Uploaded image for project: 'OpenShift Bugs'
  1. OpenShift Bugs
  2. OCPBUGS-8071

PodSecurity alerts fired by compliance operator

XMLWordPrintable

    • Quality / Stability / Reliability
    • False
    • Hide

      None

      Show
      None
    • None
    • None
    • No
    • None
    • None
    • None
    • CMP Sprint 67, CMP Sprint 68, CMP Sprint 69, CMP Sprint 70, CMP Sprint 71, CMP Sprint 72, CMP Sprint 73, CMP Sprint 74, CMP Sprint 75
    • 9
    • None
    • None
    • Hide
      Previously, users would see Pod Security violation running the complinace operator. This has been fixed by dropping unnecessary permissions from the Compliance Operator deployment. No functionality should have changed as a result, but permissions and capability around the deployment pods and pods that parse the profile bundles are reduced, eliminating some of the warning.
      Show
      Previously, users would see Pod Security violation running the complinace operator. This has been fixed by dropping unnecessary permissions from the Compliance Operator deployment. No functionality should have changed as a result, but permissions and capability around the deployment pods and pods that parse the profile bundles are reduced, eliminating some of the warning.
    • None
    • None
    • None
    • None

      Description of problem:

      After cluster upgrade to 4.11, PodSecurity violation alerts are triggered by compliance-operator:

            1 openshift-compliance ocp4-cis-node-infra-rs deployments would violate PodSecurity "restricted:latest": seccompProfile (pod or container "result-server" must set securityContext.seccompProfile.type to "RuntimeDefault" or "Localhost")
      1 openshift-compliance ocp4-cis-node-master-rs deployments would violate PodSecurity "restricted:latest": seccompProfile (pod or container "result-server" must set securityContext.seccompProfile.type to "RuntimeDefault" or "Localhost")
      1 openshift-compliance ocp4-cis-node-storage-rs deployments would violate PodSecurity "restricted:latest": seccompProfile (pod or container "result-server" must set securityContext.seccompProfile.type to "RuntimeDefault" or "Localhost")
      1 openshift-compliance ocp4-cis-node-worker-rs deployments would violate PodSecurity "restricted:latest": seccompProfile (pod or container "result-server" must set securityContext.seccompProfile.type to "RuntimeDefault" or "Localhost")
      1 openshift-compliance vz-ocp4-cis-rs deployments would violate PodSecurity "restricted:latest": seccompProfile (pod or container "result-server" must set securityContext.seccompProfile.type to "RuntimeDefault" or "Localhost")

      Version-Release number of selected component (if applicable):

      v0.1.61

              lbragsta@redhat.com Lance Bragstad
              rhn-support-rauferna Raul Fernandez
              Lance Bragstad
              None
              Xiaojie Yuan Xiaojie Yuan
              None
              Votes:
              0 Vote for this issue
              Watchers:
              11 Start watching this issue

                Created:
                Updated:
                Resolved: