Uploaded image for project: 'OpenShift Monitoring'
  1. OpenShift Monitoring
  2. MON-3225

observability-operator crashing due to seccomp error on <=4.10 (Staging)

XMLWordPrintable

    • Icon: Bug Bug
    • Resolution: Done
    • Icon: Undefined Undefined
    • None
    • None
    • None
    • None
    • False
    • Hide

      None

      Show
      None
    • False
    • NEW
    • NEW
    • MON Sprint 237

      observability-operator v0.0.21 seems to be unable to start its obo-prometheus-operator-admission-webhook on a lot of OSD/ROSA 4.10 (or lower) clusters right now due to what looks to be a seccomp error.

      33m         Warning   FailedCreate          replicaset/obo-prometheus-operator-admission-webhook-bd4c5b58f        Error creating: pods "obo-prometheus-operator-admission-webhook-bd4c5b58f-m8ntn" is forbidden: unable to validate a
      gainst any security context constraint: [pod.metadata.annotations.seccomp.security.alpha.kubernetes.io/pod: Forbidden: seccomp may not be set pod.metadata.annotations.container.seccomp.security.alpha.kubernetes.io/prometheus-operator-admission-webhook: Forbidden: seccomp may not be set provider "anyuid": Forbidden: not usable by user or serviceaccount pod.metadata.annotations.seccomp.security.alpha.kubernetes.io/pod: Forbidden: seccomp may not be set spe
      c.containers[0].securityContext.runAsUser: Invalid value: 65534: must be in the ranges: [1000800000, 1000809999] pod.metadata.annotations.container.seccomp.security.alpha.kubernetes.io/prometheus-operator-admission-webhook: Forbi
      dden: seccomp may not be set provider "pcap-dedicated-admins": Forbidden: not usable by user or serviceaccount provider "hostmount-anyuid": Forbidden: not usable by user or serviceaccount provider "machine-api-termination-handler
      ": Forbidden: not usable by user or serviceaccount provider "hostnetwork": Forbidden: not usable by user or serviceaccount provider "hostaccess": Forbidden: not usable by user or serviceaccount provider "splunkforwarder": Forbidd
      en: not usable by user or serviceaccount provider "node-exporter": Forbidden: not usable by user or serviceaccount provider "privileged": Forbidden: not usable by user or serviceaccount]                             
      

      This causes a critical and persistent PodDisruptionBudgetLimit alert to fire after cluster installation.

      OSD/ROSA Production is currently running v0.0.20 and does not appear to be impacted as best I can tell.

      Staging clusters currently impacted can be reviewed as follows:
      https://promlens.devshift.net/?l=RUY-piyfmRr

              sthaha@redhat.com Sunil Thaha
              mbargenq Matt Bargenquast (Inactive)
              Hongyan Li Hongyan Li
              Votes:
              0 Vote for this issue
              Watchers:
              8 Start watching this issue

                Created:
                Updated:
                Resolved: