keylime / keylime/attestation-operator

Agent cannot be deployed on OpenShift

Open
#75 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Go
Stars
11
Forks
10
PR merge metrics
No merged PRs in 30d

Description

When trying to deploy the operator on OpenShift local, the `hhkl-keylime-agent` DaemonSet is not deployed properly. The event log is the following:

```
Error creating: pods "hhkl-keylime-agent-" is forbidden: unable to validate against any security context constraint: [provider "anyuid": Forbidden: not usable by user or serviceaccount, spec.volumes[0]: Invalid value: "hostPath": hostPath volumes are not allowed to be used, spec.volumes[1]: Invalid value: "hostPath": hostPath volumes are not allowed to be used, provider restricted-v2: .containers[0].privileged: Invalid value: true: Privileged containers are not allowed, provider "restricted": Forbidden: not usable by user or serviceaccount, provider "nonroot-v2": Forbidden: not usable by user or serviceaccount, provider "nonroot": Forbidden: not usable by user or serviceaccount, provider "hostmount-anyuid": Forbidden: not usable by user or serviceaccount, provider "machine-api-termination-handler": Forbidden: not usable by user or serviceaccount, provider "hostnetwork-v2": Forbidden: not usable by user or serviceaccount, provider "hostnetwork": Forbidden: not usable by user or serviceaccount, provider "hostaccess": Forbidden: not usable by user or serviceaccount, provider "hostpath-provisioner": Forbidden: not usable by user or serviceaccount, provider "privileged": Forbidden: not usable by user or serviceaccount]
```

I tried to deploy the pod in both unprivileged and privileged mode (by changing the `global.service.agent.privileged` value from `build/helm/keylime/values.yaml`) with the same result. The `global.openshift` value is set to `true` in the value file.

The issue seems related to the `hhkl-keylime-agent` service account not having sufficient permissions to set the necessary `anyuid` SCC for the pod.

Version info:

```
Client Version: 4.15.2
Kustomize Version: v5.0.4-0.20230601165947-6ce0bf390ce3
Server Version: 4.14.12
Kubernetes Version: v1.27.10+28ed2d7
```

Contributor guide

No contributing guide indexed for this repository

Research direction

Start with build/helm/keylime/values.yaml, the hhkl-keylime-agent DaemonSet, and its service account configuration; compare the unprivileged and privileged settings against the reported OpenShift security context constraint errors. Done means the agent DaemonSet is created successfully on OpenShift Local with global.openshift set to true.

Written by the indexing model from the issue text.

Assessment

Tech stack
helm, kubernetes
Domain
devops, infrastructure
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.