Bug 1969230

Summary:	service-ca pod does not run when restricted SCC is changed
Product:	OpenShift Container Platform	Reporter:	Matt Bargenquast <mbargenq>
Component:	service-ca	Assignee:	Stefan Schimanski <sttts>
Status:	CLOSED NOTABUG	QA Contact:	scheng
Severity:	unspecified	Docs Contact:
Priority:	unspecified
Version:	4.7	CC:	aos-bugs, cblecker, mfojtik, slaznick, surbania, wking
Target Milestone:	---	Keywords:	Reopened, ServiceDeliveryImpact
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2022-02-23 08:17:49 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Matt Bargenquast 2021-06-08 03:09:05 UTC

Description of problem:

When the "restricted" SCC is changed to have a "runAsUser" value of "RunAsAny" it results in the service-ca pod not starting up and remaining in a "CreateContainerConfigError" state. 

The pod yaml notes:
container has runAsNonRoot and image will run as root (pod: "service-ca-78d76c8f96-9d94g_openshift-service-ca(164c78e4-4e79-47d3-afca-53358e43e70b)", container: service-ca-controller)

Version-Release number of selected component (if applicable):

4.7.11

How reproducible:

Always

Steps to Reproduce:
1. Set the "restricted" SCC to have a "runAsUser" value of "RunAsAny"
2. Restart the service-ca pod.
3. Pod will not start up.

Comment 1 Standa Laznicka 2021-06-08 07:01:16 UTC

https://docs.openshift.com/container-platform/4.7/authentication/managing-security-context-constraints.html

Comment 3 Standa Laznicka 2022-02-23 08:17:49 UTC

The docs in https://bugzilla.redhat.com/show_bug.cgi?id=1969230#c1 say you should not change the default SCCs.

Comment 4 Standa Laznicka 2022-02-23 08:18:27 UTC

Also, your bug report is different from the original.