Uploaded image for project: 'OpenShift Bugs'
  1. OpenShift Bugs
  2. OCPBUGS-49295

Update securityContext in master/examples/hello-openshift/hello-pod.json

XMLWordPrintable

    • Icon: Bug Bug
    • Resolution: Unresolved
    • Icon: Normal Normal
    • None
    • 4.15
    • Test Infrastructure
    • None
    • Quality / Stability / Reliability
    • False
    • Hide

      None

      Show
      None
    • None
    • Moderate
    • None
    • None
    • None
    • None
    • None
    • None
    • None
    • None
    • None
    • None
    • None
    • None

      Description of problem:

       We have current docs that point to the examples in openshift/origin, and the examples need to be updated.
      
      Running:
      oc create -f https://raw.githubusercontent.com/openshift/origin/master/examples/hello-openshift/hello-pod.json
      
      Produces the error:
      
      Warning: would violate PodSecurity "restricted:v1.24": allowPrivilegeEscalation != false (container "hello-openshift" must set securityContext.allowPrivilegeEscalation=false), unrestricted capabilities (container "hello-openshift" must set securityContext.capabilities.drop=["ALL"]), runAsNonRoot != true (pod or container "hello-openshift" must set securityContext.runAsNonRoot=true), seccompProfile (pod or container "hello-openshift" must set securityContext.seccompProfile.type to "RuntimeDefault" or "Localhost")   Update securityContext in master/examples/hello-openshift/hello-pod.json
      
      Docs link that points to the content: 
      
      https://docs.openshift.com/container-platform/4.17/networking/routes/route-configuration.html

      Version-Release number of selected component (if applicable):

          4.15 +

      How reproducible:

          100%

      Steps to Reproduce:

          1. Try to use docs in https://docs.openshift.com/container-platform/4.17/networking/routes/route-configuration.html

      Actual results:

          The second step points to openshift/origin/master/examples and fails with the error: 
      
      Warning: would violate PodSecurity "restricted:v1.24": allowPrivilegeEscalation != false (container "hello-openshift" must set securityContext.allowPrivilegeEscalation=false), unrestricted capabilities (container "hello-openshift" must set securityContext.capabilities.drop=["ALL"]), runAsNonRoot != true (pod or container "hello-openshift" must set securityContext.runAsNonRoot=true), seccompProfile (pod or container "hello-openshift" must set securityContext.seccompProfile.type to "RuntimeDefault" or "Localhost")   Update securityContext in master/examples/hello-openshift/hello-pod.json
      
      

      Expected results:

           The openshift/origin/master/examples should remain a reliable source for our admin user docs.

      Additional info:

          Following the instructions in the Warning fixes the issue but a new user might not know how to do this correctly.

              nmoraiti Nikolaos Moraitis
              cholman@redhat.com Candace Holman
              None
              None
              Nikolaos Moraitis Nikolaos Moraitis
              None
              Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

                Created:
                Updated: