Uploaded image for project: 'OpenShift Bugs'
  1. OpenShift Bugs
  2. OCPBUGS-11544

multus-admission-controller should not run as root under Hypershift-managed CNO


    • Icon: Bug Bug
    • Resolution: Done
    • Icon: Major Major
    • 4.12.z
    • 4.13, 4.12, 4.14
    • HyperShift
    • Important
    • No
    • Proposed
    • False
    • Hide



      This is a clone of issue OCPBUGS-10807. The following is the description of the original issue:

      Description of problem:

      Cluster Network Operator managed component multus-admission-controller does not conform to Hypershift control plane expectations.
      When CNO is managed by Hypershift, multus-admission-controller and other CNO-managed deployments should run with non-root security context. If Hypershift runs control plane on kubernetes (as opposed to Openshift) management cluster, it adds pod security context to its managed deployments, including CNO, with runAsUser element inside. In such a case CNO should do the same, set security context for its managed deployments, like multus-admission-controller, to meet Hypershift security rules.

      Version-Release number of selected component (if applicable):


      How reproducible:


      Steps to Reproduce:

      1.Create OCP cluster using Hypershift using Kube management cluster
      2.Check pod security context of multus-admission-controller

      Actual results:

      no pod security context is set on multus-admission-controller

      Expected results:

      pod security context is set with runAsUser: xxxx

      Additional info:

      Corresponding CNO change 

            agarcial@redhat.com Alberto Garcia Lamela
            openshift-crt-jira-prow OpenShift Prow Bot
            Jie Zhao Jie Zhao
            IBM Employee
            Michael Topchiev
            0 Vote for this issue
            5 Start watching this issue