Deploying on Aks Azure

[stevenrenaud]

Hello,
Good job with ManageIQ.

I struggle a little while deploying in Azure AKS with operator.
Is there any way to add the SecurityOption : runAsUser: XXXX through the Operator ?

I can't achieve to deploy without.
If i remove operator and i apply the config in every deployment everything is OK.

someting like this :
` securityContext:

        capabilities:

          drop:

            - ALL

        privileged: false

        runAsUser: 65532

        runAsNonRoot: true

        allowPrivilegeEscalation: false

`

[hlavacek87]

Hello, I have exactly same issue when trying to deploy podified manageiq-quinteros on K3S (OS Rocky Linux 9). There is no other option to patch these securityContext - "runAsUser" is missing with the operator.

Removing the operator and patching the deployments works, but that is not ok.

Any idea how to fix this?

Thank you very much.

[bdunne]

There is not currently a way to change the runAsUser in the operator. Why do you need to change that?

[hlavacek87]

Hello, I would say with any recent version of K8S or K3S you are not able to deploy the app via operator. Operator is forcing securityContext with "runAsNonRoot: true" for all deployments. But it is not adding runAsUser. I would not be necessary unless your images would be build with specific user, ie bu default would not use root user (Dockerfile - USER statement missing). So you are forcing "runAsNonRoot: true" for deployment for manageiq/httpd but the image does not have default non-root user configured. Manageiq/operator has same issue for example. Adding runAsUser to k8s deployment would fix this, or adding USER statement in Dockerfile.

Or am I really missing something?

EDIT: the error is "Error: container has runAsNonRoot and image will run as root", for more then one deployment, for example manageiq/httpd.

Thank you very much for answer.

[Fryguy]

I wonder if this is some azure policy, (or maybe all cloud hosted). It works fine on other non azure kubernetes deployments.

[Fryguy]

Oh sorry I see you are running k3s (OP was on AKS). That's still weird though as I was pretty sure I tested this on k3s pretty recently.

[hlavacek87]

It is K3S 1.29 on Rocky9 machine. I may try different OS, but I dont think it will help, there should not be different.

[Fryguy]

@bdunne opened ManageIQ/manageiq-pods#1134