Privilege escalation not allowed during sync on replication
- 主要言語
- Python
- スター
- 22.1k
- フォーク
- 5.4k
- 平均マージ
- 5時間
- マージ済み PR(30日)
- 671
説明
### Helm Chart Version
1.9.2
### What step the error happened?
During the Sync
### Relevant information
Hello everybody,
we have airbyte running in our azure kubernetes environment in the OSS version. Since the latest update (updated from 1.6.7 to 1.9.2) we are experiencing issues with the replication job due to some policies set in AKS.
The error message is quite simple stating "allowPriviligeEscalation is not allowed". When digging into the configuration of the replication pod that is being created I realized that the securityContext is always set to {}:
securityContext: {}
Here is the error message from the workload launcher:
```bash
io.airbyte.workload.launcher.pipeline.stages.model.StageError: io.airbyte.workers.exception.KubeClientException: Failed to create pod replication-job-1310-attempt-0
Caused by: io.fabric8.kubernetes.client.KubernetesClientException: Failure executing: PATCH at: https://10.0.0.1:443/api/v1/namespaces/airbyte/pods/replication-job-1310-attempt-0?fieldManager=fabric8. Message: admission webhook "validation.gatekeeper.sh" denied the request:
[azurepolicy-k8sazurev3noprivilegeescalatio-7252f4b2f661abfbee37] Privilege escalation container is not allowed: destination
[azurepolicy-k8sazurev3noprivilegeescalatio-7252f4b2f661abfbee37] Privilege escalation container is not allowed: init
[azurepolicy-k8sazurev3noprivilegeescalatio-7252f4b2f661abfbee37] Privilege escalation container is not allowed: orchestrator
[azurepolicy-k8sazurev3noprivilegeescalatio-7252f4b2f661abfbee37] Privilege escalation container is not allowed: source.
```
How do I configure security contexts (allowPrivilegeEscalation=false) for replication job pods in AKS with Azure Policy enforcement?
### Relevant log output
```shell
io.airbyte.workload.launcher.pipeline.stages.model.StageError: io.airbyte.workers.exception.KubeClientException: Failed to create pod replication-job-1310-attempt-0
Caused by: io.fabric8.kubernetes.client.KubernetesClientException: Failure executing: PATCH at: https://10.0.0.1:443/api/v1/namespaces/airbyte/pods/replication-job-1310-attempt-0?fieldManager=fabric8. Message: admission webhook "validation.gatekeeper.sh" denied the request:
[azurepolicy-k8sazurev3noprivilegeescalatio-7252f4b2f661abfbee37] Privilege escalation container is not allowed: destination
[azurepolicy-k8sazurev3noprivilegeescalatio-7252f4b2f661abfbee37] Privilege escalation container is not allowed: init
[azurepolicy-k8sazurev3noprivilegeescalatio-7252f4b2f661abfbee37] Privilege escalation container is not allowed: orchestrator
[azurepolicy-k8sazurev3noprivilegeescalatio-7252f4b2f661abfbee37] Privilege escalation container is not allowed: source.
```
---
**Internal Tracking:** https://github.com/airbytehq/oncall/issues/12122
コントリビューションガイド
評価
この issue はまだ評価されていません。