Uploaded image for project: 'Openshift sandboxed containers'
  1. Openshift sandboxed containers
  2. KATA-551

4.7 kata operator will mutate pods in other namespaces that don't have kata-webhook installed

XMLWordPrintable

    • Icon: Bug Bug
    • Resolution: Done
    • Icon: High High
    • None
    • 4.7, 4.8, 4.9, 4.10-1.2.0, OCP 4.11
    • sandboxed-containers
    • None
    • 0
    • Kata Sprint #196, Kata Sprint #197, Kata Sprint #198
    • 0
    • 0

      Description of problem:
      4.7 kata operator will mutate pods in other namespaces that don't have kata-webhook installed

      install kata operator 4.7
      create new project `foo`
      install kata-webhook for ns foo
      create a pod...it should mutate it to have `kata` as runtime
      create new project `bar`
      within the new project, create the same pod as step #4 without installing the kata-webhook
      do `oc get pod xxx -o yaml | grep kata` and see that `kata` is the runtime for the pod in the project `bar` even though there is not kata-webhook installed in it.

      Version-Release number of selected component (if applicable):
      kata-operator 4.7

      How reproducible:
      always

      Steps to Reproduce:
      see above description of the problem

      Actual results:
      kata runtime is enabled for pods in projects that don't have the kata-webhook.

      Expected results:
      kata runtime is enabled only if the user input yaml has it specified or kata-webhook in installed in the namespace.

      Additional info:

            ssheribe@redhat.com Snir sheriber
            pruan Peter Ruan
            Votes:
            0 Vote for this issue
            Watchers:
            7 Start watching this issue

              Created:
              Updated:
              Resolved: