Bug 1440812
| Summary: | Capabilities specified in SCC not working | ||
|---|---|---|---|
| Product: | OpenShift Container Platform | Reporter: | Joel Rosental R. <jrosenta> |
| Component: | RFE | Assignee: | Paul Weil <pweil> |
| Status: | CLOSED NEXTRELEASE | QA Contact: | Xiaoli Tian <xtian> |
| Severity: | high | Docs Contact: | |
| Priority: | high | ||
| Version: | 3.4.0 | CC: | aos-bugs, decarr, erich, glamb, jokerman, jrosenta, mmccomas, sjenning, wmeng |
| Target Milestone: | --- | ||
| Target Release: | --- | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | If docs needed, set a value | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2017-04-12 16:27:37 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
Seems to be related with: https://github.com/openshift/origin/pull/12875 Discussed in IRC. Summary: 1. * is supported in 1.6+ by the PR listed above 2. Currently the customer must enumerate the capabilities in the SCC under the allowed capabilities 3. It also appears that they have not granted access to the privileged SCC correctly since there still is an error on the privileged field. So that should be double checked. Invalid value: true: Privileged containers are not allowed |
Description of problem: When trying to add capabilities to a container inside a pod after configuring the pod to run with privileged scc and specifying a service account to it that has been previously added to the privileged scc, I get the following error while trying to deploy the pod: 18s 3m 8 ruby-ex-2 ReplicationController Warning FailedCreate {replication-controller } Error creating: pods "ruby-ex-2-" is forbidden: unable to validate against any security context constraint: [spec.containers[0].securityContext.privileged: Invalid value: true: Privileged containers are not allowed capabilities.add: Invalid value: "IPC_LOCK": capability may not be added capabilities.add: Invalid value: "SYS_RESOURCE": capability may not be added] privileged SCC has been previously modified to allow "any" capability: allowedCapabilities: - '*' Version-Release number of selected component (if applicable): tested on 3.3 and 3.4 with same result How reproducible: always Steps to Reproduce: 1. create a custom service account, e.g: `oc create serviceaccount root` 2. oc adm policy add-scc-to-user privileged system:serviceaccount:<yourproject>:root 3. Add the following snippet to the DeploymentConfig: inside container definition: securityContext: capabilities: add: - IPC_LOCK - SYS_RESOURCE privileged: true outside container definition but still in pod definition: serviceAccount: root serviceAccountName: root 4.- Edit scc "privileged" setting the "allowedCapabilities" parameter to "*" (did this just to test). 4.- deploy the pod Actual results: Pod not created. Error creating: pods "ruby-ex-2-" is forbidden: unable to validate against any security context constraint: [spec.containers[0].securityContext.privileged: Invalid value: true: Privileged containers are not allowed capabilities.add: Invalid value: "IPC_LOCK": capability may not be added capabilities.add: Invalid value: "SYS_RESOURCE": capability may not be added] Expected results: Pod created with capabilities specified in the DeploymentConfig Additional info: