Uploaded image for project: 'OpenShift Bugs'
  1. OpenShift Bugs
  2. OCPBUGS-962

oc debug/node & web terminal blocked by "violates PodSecurity "restricted:latest""

XMLWordPrintable

    • Icon: Bug Bug
    • Resolution: Duplicate
    • Icon: Undefined Undefined
    • None
    • 4.12
    • Management Console
    • None
    • Important
    • Rejected
    • False
    • Hide

      This bugs breaks part of the default debugging experience for administrators as we don't recommend using SSH to log onto nodes.

      Show
      This bugs breaks part of the default debugging experience for administrators as we don't recommend using SSH to log onto nodes.

      Description of problem:

      On a fresh 4.12 (4.12.0-0.nightly-2022-09-06-081331) cluster on AWS created via cluster bot, I can not get a debug terminal on the node either via oc or the web console.
      
      This is a fresh cluster. No customization.
      

      Version-Release number of selected component (if applicable):

      4.12.0-0.nightly-2022-09-06-081331
      

      How reproducible:

      Always
      

      Steps to Reproduce:

      1. Setup a latest 4.12 cluster
      2. oc get nodes
      3. oc debug node/...
      

      Actual results:

      pods "ip-10-0-186-209.us-east-2.compute.internal-debug" is forbidden: violates PodSecurity "restricted:latest": host namespaces (hostNetwork=true, hostPID=true), privileged (container "container-00" must not set securityContext.privileged=true), allowPrivilegeEscalation != false (container "container-00" must set securityContext.allowPrivilegeEscalation=false), unrestricted capabilities (container "container-00" must set securityContext.capabilities.drop=["ALL"]), restricted volume types (volume "host" uses restricted volume type "hostPath"), runAsNonRoot != true (pod or container "container-00" must set securityContext.runAsNonRoot=true), runAsUser=0 (container "container-00" must not set runAsUser=0), seccompProfile (pod or container "container-00" must set securityContext.seccompProfile.type to "RuntimeDefault" or "Localhost")
      

      Expected results:

      I get a terminal.
      

      Additional info:

      N/A
      

            jhadvig@redhat.com Jakub Hadvig
            travier@redhat.com Timothée Ravier
            Votes:
            1 Vote for this issue
            Watchers:
            10 Start watching this issue

              Created:
              Updated:
              Resolved: