zalando / zalando/postgres-operator
Missing pod capabilities: ./run: 21: ulimit: error setting limit (Operation not permitted) #895
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 5.2k
- Forks
- 1.1k
- Avg merge
- 2d 16h
- Merged PRs (30d)
- 3
Description
Missing pod capabilities
- Which image of the operator are you using? ghcr.io/zalando/spilo-15:3.0-p1
- Where do you run it - cloud or metal? Kubernetes or OpenShift? [TrueNas Scale]
- Are you running Postgres Operator in production? [no]
- Type of issue? [Bug report]
The pod is trying to execute set ulimit, but is not allowed to, is this a bug?
Should ulimit be called, and if so, should the pod be configured to have the capability?
Clone of this closed issue: https://github.com/zalando/spilo/issues/881
I added this to the helm chart, but it had no effect:
securityContext:
capabilities:
add:
- CAP_SYS_RESOURCE
To fix it I had to manually edit the statefulset and delete the db-pod...
But, Will this be reset when the operator reconcile the statefulset in the future?
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the Helm chart's securityContext and the operator's StatefulSet reconciliation, then compare the pod behavior with the referenced Spilo issue. Check where the ulimit command is invoked and whether the requested capability is preserved during reconciliation. Done means the pod starts without the permission error and manual StatefulSet edits are unnecessary.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go, helm, kubernetes, postgresql
- Domain
- databases, infrastructure, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 25/100