-
Bug
-
Resolution: Done
-
Major
-
openshift-4.12
-
None
-
None
-
False
-
None
-
False
-
OSDK Sprint 225, OSDK Sprint 226, OSDK Sprint 227, OSDK Sprint 228, OSDK 229, OSDK 230, ODSK 231
Description of problem:
- operator sdk scorecard test failed because of the request of PodSecurity
Version-Release number of selected component (if applicable):
- operator-sdk version: "v1.22.0-ocp", commit: "9a16a5cb237880ee540f89d7768d93a3e4e1635e", kubernetes version: "v1.24.1", go version: "go1.18.1", GOOS: "linux", GOARCH: "amd64"
- cluster version: 4.12.0-0.nightly-2022-09-07-112008
How reproducible:
- Always
Steps to Reproduce:
- generate one operator and bundle
- operator-sdk init --plugins=ansible --domain example.com
- operator-sdk create api --group cache --version v1alpha1 --kind Memcached --generate-role
- make bundle
- scorecard test the operator bundle
- operator-sdk scorecard ./bundle -c ./bundle/tests/scorecard/config.yaml -w 60s --selector=test=olm-bundle-validation-test
Actual results:
operator-sdk scorecard ./bundle -c ./bundle/tests/scorecard/config.yaml -w 60s --selector=test=olm-bundle-validation-test
--------------------------------------------------------------------------------
Image: quay.io/operator-framework/scorecard-test:v1.20.0
Entrypoint: [scorecard-test olm-bundle-validation]
Labels:
"suite":"olm"
"test":"olm-bundle-validation-test"
Results:
State: fail
Errors:
pods "scorecard-test-pgqs" is forbidden: violates PodSecurity "restricted:latest": allowPrivilegeEscalation != false (containers "scorecard-untar", "scorecard-test" must set securityContext.allowPrivilegeEscalation=false), unrestricted capabilities (containers "scorecard-untar", "scorecard-test" must set securityContext.capabilities.drop=["ALL"]), runAsNonRoot != true (pod or containers "scorecard-untar", "scorecard-test" must set securityContext.runAsNonRoot=true), seccompProfile (pod or containers "scorecard-untar", "scorecard-test" must set securityContext.seccompProfile.type to "RuntimeDefault" or "Localhost")
Expected results:
operator-sdk scorecard ./bundle -c ./bundle/tests/scorecard/config.yaml -w 60s --selector=test=olm-bundle-validation-test
--------------------------------------------------------------------------------
Image: quay.io/operator-framework/scorecard-test:v1.20.0
Entrypoint: [scorecard-test olm-bundle-validation]
Labels:
"suite":"olm"
"test":"olm-bundle-validation-test"
Results:
State: Success
Additional info:
- is cloned by
-
OCPBUGS-1665 Scorecard failed because of the request of PodSecurity
- Closed