Bug 1795394 - init container setup does not have the proper `securityContext`
Summary: init container setup does not have the proper `securityContext`
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: OpenShift Container Platform
Classification: Red Hat
Component: kube-apiserver
Version: 4.3.0
Hardware: Unspecified
OS: Unspecified
high
high
Target Milestone: ---
: 4.3.z
Assignee: Stefan Schimanski
QA Contact: Ke Wang
URL:
Whiteboard:
Depends On: 1793694
Blocks: 1795395
TreeView+ depends on / blocked
 
Reported: 2020-01-27 21:19 UTC by Scott Dodson
Modified: 2023-03-24 16:51 UTC (History)
12 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of: 1793694
: 1795395 (view as bug list)
Environment:
Last Closed: 2020-02-12 09:42:20 UTC
Target Upstream Version:
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Github openshift cluster-kube-apiserver-operator pull 629 0 None closed Properly set pod as privileged 2020-09-04 09:20:03 UTC
Red Hat Product Errata RHBA-2020:0391 0 None None None 2020-02-12 09:42:53 UTC

Comment 3 Ke Wang 2020-02-04 03:21:25 UTC
Verified with OCP build 4.3.0-0.nightly-2020-02-04-004432.

Verification steps referring to the code changes from PR https://github.com/openshift/cluster-kube-apiserver-operator/pull/629

1. Check the apiserver pods information, 
$ apiserver_pod=$(oc get po -n openshift-kube-apiserver | grep kube-apiserver | awk '{print $1}' | head -1)

$ oc get po $apiserver_pod -n openshift-kube-apiserver -o json | jq .spec.initContainers[0].securityContext
{
  "privileged": true
}
$ oc get po $apiserver_pod -n openshift-kube-apiserver -o json | jq .spec.containers[0].securityContext
{
  "privileged": true
}

The containers' securityContext were changed.

2. Check if the related error ‘failed to tryAcquireOrRenew’ can be found.
$ apiserver_node=$(oc get po -o wide -n openshift-kube-apiserver | grep kube-apiserver | awk '{print $7}' | head -1)
$ oc debug node/$apiserver_node

After logged in  the debug pod of the apiserver node , 
sh-4.2# chroot /host

sh-4.4# grep -r 'failed to tryAcquireOrRenew' /var/log/pods/openshift-kube-apiserver_kube-apiserver-*/

Not found the related error ‘failed to tryAcquireOrRenew’ .

Comment 5 errata-xmlrpc 2020-02-12 09:42:20 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2020:0391


Note You need to log in before you can comment on or make changes to this bug.