Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

KubeAPIWarningLogger for PodSecurity in nmstate-operator pod #1194

Open
dougsland opened this issue Jul 10, 2023 · 0 comments
Open

KubeAPIWarningLogger for PodSecurity in nmstate-operator pod #1194

dougsland opened this issue Jul 10, 2023 · 0 comments

Comments

@dougsland
Copy link
Contributor

What happened:
There is KubeAPIWarningLogger for PodSecurity in nmstate-operator pod

OCP Version: 4.14.0-0.nightly-2023-06-29-065352
knmstate operator version: kubernetes-nmstate-operator.4.14.0-202306280456

% oc get pod
NAME READY STATUS RESTARTS AGE
nmstate-cert-manager-6d5c5556d8-mk9cj 1/1 Running 0 40s
nmstate-console-plugin-9849db676-t62jl 1/1 Running 0 39s
nmstate-handler-cgk8m 1/1 Running 0 40s
nmstate-handler-f7mtt 1/1 Running 0 40s
nmstate-handler-gndwl 1/1 Running 0 39s
nmstate-handler-hmz9z 1/1 Running 0 39s
nmstate-handler-lzd7d 1/1 Running 0 40s
nmstate-handler-wzwfx 1/1 Running 0 39s
nmstate-operator-754bc98c8c-4z5jt 1/1 Running 0 3m32s
nmstate-webhook-88896bdbf-ptj4v 1/1 Running 0 40s
nmstate-webhook-88896bdbf-t9ksh 1/1 Running 0 40s

% oc logs nmstate-operator-754bc98c8c-4z5jt | grep KubeAPIWarningLogger
{"level":"info","ts":"2023-06-30T06:39:11.615Z","logger":"KubeAPIWarningLogger","msg":"unknown field "roleRef.namespace""}
{"level":"info","ts":"2023-06-30T06:39:11.757Z","logger":"KubeAPIWarningLogger","msg":"would violate PodSecurity "restricted:latest": host namespaces (hostNetwork=true), privileged (container "nmstate-handler" must not set securityContext.privileged=true), allowPrivilegeEscalation != false (container "nmstate-handler" must set securityContext.allowPrivilegeEscalation=false), unrestricted capabilities (container "nmstate-handler" must set securityContext.capabilities.drop=["ALL"]), restricted volume types (volumes "dbus-socket", "nmstate-lock", "ovs-socket" use restricted volume type "hostPath"), runAsNonRoot != true (pod or container "nmstate-handler" must set securityContext.runAsNonRoot=true), seccompProfile (pod or container "nmstate-handler" must set securityContext.seccompProfile.type to "RuntimeDefault" or "Localhost")"}

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant