倉庫指標
- 星標
- (25,672 顆星)
- PR 合併指標
- (PR 指標待抓取)
描述
/area operator
Hello to all, I'm trying to install dapr for our development team under OpenShfit 4.7 with the helm chart. Out of the box the chart doesn't work for OCP security enforcement however with some tuning on the permission ( oc adm policy add-scc-to-user nonroot -z dapr-operator -n dapr-system ) I was able to deploy the chart but I have failure on dapr-placement server:
create Pod dapr-placement-server-0 in StatefulSet dapr-placement-server failed error: pods "dapr-placement-server-0" is forbidden: unable to validate against any security context constraint: [spec.containers[0].securityContext.runAsUser: Invalid value: 0: must be in the ranges: [1000700000, 1000709999] spec.containers[0].securityContext.runAsUser: Invalid value: 0: running with the root UID is forbidden]
The simpler way could be grant anyuid to dapr-operator service account but I've test that on a small test environment and this cause cluster failure ( control plane failure, operator redeploy, instability etc etc. ) that I'm currently investigating, but looking at the helm chart I've found in dapr_placement_deployment.yaml those line:
{{- if eq .Values.cluster.forceInMemoryLog true }} runAsNonRoot: {{ .Values.runAsNonRoot }} {{- else }} runAsUser: 0
and I'm wondering if this is wanted.
Anyone else has tryed a deploy on OCP and can share some experience ?