Uploaded image for project: 'OpenShift Bugs'
  1. OpenShift Bugs
  2. OCPBUGS-18682

operator-sdk run bundle fails on ocp 4.14 clusters

    XMLWordPrintable

Details

    • Bug
    • Resolution: Not a Bug
    • Undefined
    • None
    • 4.13
    • Operator SDK
    • None
    • No
    • False
    • Hide

      None

      Show
      None

    Description

      Description of problem:

      $ operator-sdk --index-image=quay.io/operator-framework/opm:v1.28.0 run bundle quay.io/junchen/lifecycle-agent-bundle:4.14.0
      WARN[0014] quay.io/operator-framework/opm:v1.28.0 is a SQLite index image. SQLite based index images are being deprecated and will be removed in a future release, please migrate your catalogs to the new File-Based Catalog format 
      FATA[0030] Failed to run bundle: create catalog: error creating registry pod: error creating pod: pods "quay-io-junchen-lifecycle-agent-bundle-4-14-0" is forbidden: violates PodSecurity "restricted:latest": allowPrivilegeEscalation != false (container "registry-grpc" must set securityContext.allowPrivilegeEscalation=false), unrestricted capabilities (container "registry-grpc" must set securityContext.capabilities.drop=["ALL"]), runAsNonRoot != true (pod or container "registry-grpc" must set securityContext.runAsNonRoot=true), seccompProfile (pod or container "registry-grpc" must set securityContext.seccompProfile.type to "RuntimeDefault" or "Localhost") 
      
      
      $ operator-sdk --index-image=quay.io/operator-framework/opm:v1.28.0 --security-context-config restricted run bundle quay.io/junchen/lifecycle-agent-bundle:4.14.0
      WARN[0013] quay.io/operator-framework/opm:v1.28.0 is a SQLite index image. SQLite based index images are being deprecated and will be removed in a future release, please migrate your catalogs to the new File-Based Catalog format 
      FATA[0022] Failed to run bundle: create catalog: error creating registry pod: error creating pod: pods "quay-io-junchen-lifecycle-agent-bundle-4-14-0" is forbidden: violates PodSecurity "restricted:latest": runAsNonRoot != true (pod or container "registry-grpc" must set securityContext.runAsNonRoot=true)
      
      

      Version-Release number of selected component (if applicable):

       

      How reproducible:

      Always

      Steps to Reproduce:

      1. See description
      2.
      3.
      

      Actual results:

      error creating pod

      Expected results:

      operator running

      Additional info:

       

      Attachments

        Issue Links

          Activity

            People

              rh-ee-cchantse Catherine Chan-Tse
              jche@redhat.com Jun Chen
              Jia Fan Jia Fan
              Votes:
              0 Vote for this issue
              Watchers:
              6 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved: