airbytehq / airbytehq/airbyte

Privilege escalation not allowed during sync on replication

オープン
#77,613 コメント 2 件 リアクション 1 件 担当者 0 名 GitHub で見る
area/platform autoteam community needs-triage team/compose team/platform-move type/bug
主要言語
Python
スター
22.1k
フォーク
5.4k
平均マージ
5時間
マージ済み PR(30日)
671

説明

### Helm Chart Version

1.9.2

### What step the error happened?

During the Sync

### Relevant information

Hello everybody,

we have airbyte running in our azure kubernetes environment in the OSS version. Since the latest update (updated from 1.6.7 to 1.9.2) we are experiencing issues with the replication job due to some policies set in AKS.

The error message is quite simple stating "allowPriviligeEscalation is not allowed". When digging into the configuration of the replication pod that is being created I realized that the securityContext is always set to {}:

securityContext: {}

Here is the error message from the workload launcher:

```bash
io.airbyte.workload.launcher.pipeline.stages.model.StageError: io.airbyte.workers.exception.KubeClientException: Failed to create pod replication-job-1310-attempt-0

Caused by: io.fabric8.kubernetes.client.KubernetesClientException: Failure executing: PATCH at: https://10.0.0.1:443/api/v1/namespaces/airbyte/pods/replication-job-1310-attempt-0?fieldManager=fabric8. Message: admission webhook "validation.gatekeeper.sh" denied the request:
[azurepolicy-k8sazurev3noprivilegeescalatio-7252f4b2f661abfbee37] Privilege escalation container is not allowed: destination
[azurepolicy-k8sazurev3noprivilegeescalatio-7252f4b2f661abfbee37] Privilege escalation container is not allowed: init
[azurepolicy-k8sazurev3noprivilegeescalatio-7252f4b2f661abfbee37] Privilege escalation container is not allowed: orchestrator
[azurepolicy-k8sazurev3noprivilegeescalatio-7252f4b2f661abfbee37] Privilege escalation container is not allowed: source.
```

How do I configure security contexts (allowPrivilegeEscalation=false) for replication job pods in AKS with Azure Policy enforcement?

### Relevant log output

```shell
io.airbyte.workload.launcher.pipeline.stages.model.StageError: io.airbyte.workers.exception.KubeClientException: Failed to create pod replication-job-1310-attempt-0

Caused by: io.fabric8.kubernetes.client.KubernetesClientException: Failure executing: PATCH at: https://10.0.0.1:443/api/v1/namespaces/airbyte/pods/replication-job-1310-attempt-0?fieldManager=fabric8. Message: admission webhook "validation.gatekeeper.sh" denied the request:
[azurepolicy-k8sazurev3noprivilegeescalatio-7252f4b2f661abfbee37] Privilege escalation container is not allowed: destination
[azurepolicy-k8sazurev3noprivilegeescalatio-7252f4b2f661abfbee37] Privilege escalation container is not allowed: init
[azurepolicy-k8sazurev3noprivilegeescalatio-7252f4b2f661abfbee37] Privilege escalation container is not allowed: orchestrator
[azurepolicy-k8sazurev3noprivilegeescalatio-7252f4b2f661abfbee37] Privilege escalation container is not allowed: source.
```

---
**Internal Tracking:** https://github.com/airbytehq/oncall/issues/12122

コントリビューションガイド

コントリビューションガイドを開く

評価

この issue はまだ評価されていません。

新しい issue をメールで受け取る

初心者向けの GitHub issue を短くまとめたダイジェスト。