Bug 2004039 - [MTC] Rsync pods are not running as privileged
Summary: [MTC] Rsync pods are not running as privileged
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Migration Toolkit for Containers
Classification: Red Hat
Component: Controller
Version: 1.6.0
Hardware: Unspecified
OS: Unspecified
high
medium
Target Milestone: ---
: 1.7.0
Assignee: Pranav Gaikwad
QA Contact: Xin jiang
Avital Pinnick
URL:
Whiteboard:
Depends On:
Blocks: 2074044
TreeView+ depends on / blocked
 
Reported: 2021-09-14 12:16 UTC by Prasad Joshi
Modified: 2022-04-11 12:31 UTC (History)
6 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
: 2074044 (view as bug list)
Environment:
Last Closed: 2022-03-24 06:32:26 UTC
Target Upstream Version:
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Github konveyor mig-controller pull 1207 0 None open Bug 2004039: Use correct client when attempting to create Rsync mutations for Transfer Server 2021-09-17 15:15:20 UTC
Red Hat Product Errata RHBA-2022:1043 0 None None None 2022-03-24 06:32:38 UTC

Description Prasad Joshi 2021-09-14 12:16:06 UTC
Description of problem: When we enable migration_rsync_privileged: true rsync pods should run as privileged


Version-Release number of selected component (if applicable):
SOURCE CLUSTER: Azure OCP 4.6 (MTC 1.6.0)
TARGET CLUSTER: Azure OCP 4.9 (MTC 1.6.0)
REPLICATION REPOSITORY: Azure Blob Storage



How reproducible:
Always


Steps to Reproduce:
1. Create a project in source cluster
$ oc new-project rsync

2. Create an application in source cluster
$ oc new-app django-psql-persistent

3. Add migration_rsync_privileged: true in migrationcontroller CR.
$ oc  edit migrationcontroller -n openshift-migration

4. Create a migplan
5. Execute Cutover

Actual results: Rsync pods are not running as privileged


Expected results: Rsync pods should run as privileged


Additional info:
$ oc get pods rsync-server -n rsync -o yaml
...
 securityContext:
      capabilities:
        drop:
        - MKNOD
        - SETPCAP
      privileged: false
      readOnlyRootFilesystem: true

$ oc get migrationcontroller -o yaml
...
spec:
    azure_resource_group: ""
    cluster_name: host
    mig_namespace_limit: "10"
    mig_pod_limit: "100"
    mig_pv_limit: "100"
    migration_controller: true
    migration_log_reader: true
    migration_rsync_privileged: true
    migration_ui: true
    migration_velero: true
    olm_managed: true
    restic_timeout: 1h
    rsync_opt_bwlimit: 300
    version: 1.6.0

$  oc get pods rsync-6jznh -n rsync -o yaml
...
securityContext:
      capabilities:
        drop:
        - MKNOD
        - SETPCAP
      privileged: false
      readOnlyRootFilesystem: true
      runAsUser: 0

Comment 6 errata-xmlrpc 2022-03-24 06:32:26 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (Migration Toolkit for Containers (MTC) 1.7.0 release advisory), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2022:1043


Note You need to log in before you can comment on or make changes to this bug.