apache / apache/solr-operator

Run solr-operator and solr helm chart on openshift get error "would violate PodSecurity "restricted:v1.24""

Open
#671 6 comments 2 reactions 0 assignees View on GitHub
Dominant language
Go
Stars
283
Forks
148
PR merge metrics
No merged PRs in 30d

Description

When try to run solr-operator and solr helm chart on openshift get the following error regarding podSecurity, the question is where to change that podSecurity?
```
2024-01-02T09:23:51Z INFO Setting default settings for SolrCloud {"controller": "solrcloud", "controllerGroup": "solr.apache.org", "controllerKind": "SolrCloud", "SolrCloud": {"name":"solr","namespace":"vizone-dev"}, "namespace": "vizone-dev", "name": "solr", "reconcileID": "30cc6979-4cbf-404b-99c9-d4b955569eba"}
2024-01-02T09:23:51Z INFO Creating Zookeeer Cluster {"controller": "solrcloud", "controllerGroup": "solr.apache.org", "controllerKind": "SolrCloud", "SolrCloud": {"name":"solr","namespace":"vizone-dev"}, "namespace": "vizone-dev", "name": "solr", "reconcileID": "3f8781bc-dd1d-4693-a07d-3432d18b5941", "zookeeperCluster": "solr-solrcloud-zookeeper"}
2024-01-02T09:23:51Z INFO Creating Common Service {"controller": "solrcloud", "controllerGroup": "solr.apache.org", "controllerKind": "SolrCloud", "SolrCloud": {"name":"solr","namespace":"vizone-dev"}, "namespace": "vizone-dev", "name": "solr", "reconcileID": "3f8781bc-dd1d-4693-a07d-3432d18b5941", "service": "solr-solrcloud-common"}
2024-01-02T09:23:51Z INFO Creating Headless Service {"controller": "solrcloud", "controllerGroup": "solr.apache.org", "controllerKind": "SolrCloud", "SolrCloud": {"name":"solr","namespace":"vizone-dev"}, "namespace": "vizone-dev", "name": "solr", "reconcileID": "3f8781bc-dd1d-4693-a07d-3432d18b5941", "service": "solr-solrcloud-headless"}
2024-01-02T09:23:51Z INFO Creating ConfigMap {"controller": "solrcloud", "controllerGroup": "solr.apache.org", "controllerKind": "SolrCloud", "SolrCloud": {"name":"solr","namespace":"vizone-dev"}, "namespace": "vizone-dev", "name": "solr", "reconcileID": "3f8781bc-dd1d-4693-a07d-3432d18b5941", "configMap": "solr-solrcloud-configmap"}
2024-01-02T09:23:51Z INFO Creating StatefulSet {"controller": "solrcloud", "controllerGroup": "solr.apache.org", "controllerKind": "SolrCloud", "SolrCloud": {"name":"solr","namespace":"vizone-dev"}, "namespace": "vizone-dev", "name": "solr", "reconcileID": "3f8781bc-dd1d-4693-a07d-3432d18b5941", "statefulSet": "solr-solrcloud"}
2024-01-02T09:23:51Z INFO KubeAPIWarningLogger would violate PodSecurity "restricted:v1.24": allowPrivilegeEscalation != false (containers "cp-solr-xml", "solrcloud-node" must set securityContext.allowPrivilegeEscalation=false), unrestricted capabilities (containers "cp-solr-xml", "solrcloud-node" must set securityContext.capabilities.drop=["ALL"])

```

Tried to change the security context via solr helm values.yaml like this :
```
podOptions:
podSecurityContext:
runAsNonRoot: true
```

But could not set allowPrivilegeEscalation and capabilities there, they are on container lever security context.

in CustomSolrKubeOptions, perhaps not only expose podOptions.PodSecurityContext, also expose container SecurityContext somehow, the AllowPrivilegeEscalation is defined on that level.
```
type CustomSolrKubeOptions struct {
// SolrPodOptions defines the custom options for solrCloud pods.
// +optional
PodOptions *PodOptions `json:"podOptions,omitempty"`

// Additional options for container security context
// +optional
ContainerSecurityContext *corev1.SecurityContext `json:"containerSecurityContext,omitempty"`
}
```

in corev1:
```
// SecurityContext holds security configuration that will be applied to a container.
// Some fields are present in both SecurityContext and PodSecurityContext. When both
// are set, the values in SecurityContext take precedence.
type SecurityContext struct {
...
AllowPrivilegeEscalation *bool `json:"allowPrivilegeEscalation,omitempty" protobuf:"varint,7,opt,name=allowPrivilegeEscalation"`

```

Contributor guide

No contributing guide indexed for this repository

Research direction

Start with CustomSolrKubeOptions, PodOptions, and the corev1.SecurityContext fields mentioned in the issue; trace how these options are applied to the Solr and ZooKeeper container definitions. Add a way to configure container-level security settings, then verify that generated pods can set allowPrivilegeEscalation and dropped capabilities for restricted PodSecurity environments.

Written by the indexing model from the issue text.

Assessment

Tech stack
go, helm, kubernetes
Domain
infrastructure, security
Issue type
Feature
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
38/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.