Azure / Azure/azure-arc-validation

k8s-conformance-test is missing securityContext for pod controller-manager, container manager

Open
#50 1 comment 0 reactions 0 assignees View on GitHub
Dominant language
No language data
Stars
12
Forks
31
PR merge metrics
No merged PRs in 30d

Description

## Description of problem:

The container `manager` for a pod `controller-manager` is causing failures on tests `test_kubernetes_configuration_helm_operator` and `test_kubernetes_configuration_flux_operator`.

## Version-Release number of selected component (if applicable):

- Kubernetes distribution:

```
- Upstream Kubernetes Version: v1.22.3+e790d7f
- K8s Distribution Version: OpenShift Container Platform 4.9.17
```

- [arc-k8s-platform/platform.yaml](https://github.com/Azure/azure-arc-validation/blob/a78b9a1126ef4c2eab3a21769e150a46f829735a/testsuite/arc-k8s-platform/platform.yaml)

```
arck8sconformance.azurecr.io/arck8sconformance/clusterconnect:0.1.5
```

- [aak8sSupportPolicy.txt](https://github.com/Azure/azure-arc-validation/blob/a78b9a1126ef4c2eab3a21769e150a46f829735a/testsuite/aak8sSupportPolicy.txt)

```
1.5.2
1.4.0
1.3.8
```

- sonobuoy
```
$ sonobuoy version
Sonobuoy Version: v0.56.0
MinimumKubeVersion: 1.17.0
MaximumKubeVersion: 1.99.99
GitSHA: 0665cd322b11bb40c2774776de765c38d8104bed
```

## How reproducible:

Always

## Steps to Reproduce:
1. Run the k8s conformance test script: `bash -x k8s-conformance-test-suite.sh`
2. Check the logs of `config-agent-XXX` pod, container `config-agent`. It should be returning error waiting CRD[1]
```
{"Message":"2022/02/21 19:26:00 Started Polling for local CRD Changes that needs to be reported to Azure",
..
{"Message":"error: Unable to get the status from the local CRD with the error : {Error : Retry for given duration didn't get any results with err {status not populated}}","LogType":"ConfigAgentTrace","LogLevel":"Error","Environment":"prod","Role":"ClusterConfigAgent","
```
3. When looking at the controller logs, we can see missing permissions to run fluxctl binary:
```
{"Message":"2022/02/21 19:34:38 open /data/fluxctl: permission denied"
```
4. When adding the `securityContext.privileged: true` to the container `manager` of pod `controller-manager-xyz` it will work as expected
```
kubectl patch deployment.apps/controller-manager -n azure-arc \
--type='json' \
-p='[{"op": "replace", "path": "/spec/template/spec/containers/0/securityContext", "value":{"privileged": true}}]'
```

## Actual results:

## Expected results:

- The pod can be fixed to run successfully the conformance tests

Desired:
- The container does not need to run as privileged

## Additional info:

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.