Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Windows Daemonset not starting under Openshift due to SCC #950

Open
philipp1992 opened this issue Nov 18, 2024 · 0 comments
Open

Windows Daemonset not starting under Openshift due to SCC #950

philipp1992 opened this issue Nov 18, 2024 · 0 comments
Labels

Comments

@philipp1992
Copy link

Hi,
using 24.10.0 or 24.06 under Openshift 4.16 with Windows Nodes.
The operator successfully creates the "trident-node-windows" SCC.

allowHostPorts: false
priority: null
requiredDropCapabilities:
  - MKNOD
allowPrivilegedContainer: false
runAsUser:
  type: RunAsAny
users:
  - 'system:serviceaccount:trident:trident-node-windows'
allowHostDirVolumePlugin: false
allowHostIPC: false
seLinuxContext:
  type: MustRunAs
readOnlyRootFilesystem: false
metadata:
  annotations:
    kubernetes.io/description: 'trident-node-windows is a clone of the anyuid built-in, and is meant just for use with trident.'
  resourceVersion: '1736544975'
  name: trident-node-windows
  uid: ff45ad32-0fb0-42af-aeff-1c2cd8367ae4
  creationTimestamp: '2024-11-18T09:19:22Z'

    - apiVersion: trident.netapp.io/v1
      controller: true
      kind: TridentOrchestrator
      name: trident
      uid: 02250c41-f783-430b-9292-181888c15926
  labels:
    app: node.csi.trident.netapp.io
fsGroup:
  type: RunAsAny
groups: []
kind: SecurityContextConstraints
defaultAddCapabilities: null
supplementalGroups:
  type: RunAsAny
volumes:
  - downwardAPI
  - emptyDir
  - projected
allowHostPID: false
allowHostNetwork: false
allowPrivilegeEscalation: true
apiVersion: security.openshift.io/v1
allowedCapabilities: null

The windows Pod from the Daemonset cant start though, because the SCC does not allow "hostPath". The linux scc created by Trident does allow it.

image

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

No branches or pull requests

1 participant