Cannot install on OpenShift

[aqeelat]

Chart type: Memgraph Standalone

Chart version: 0.2.4

What happened?
When installing the chart on OpenShift, the StatefulSet doest not run.

Environment:
Our values.yaml:

image:
  tag: "3.0.0"
secrets:
  enabled: true
fullnameOverride: "memgraph"

Relevant log output:

create Pod memgraph-0 in StatefulSet memgraph failed error: pods "memgraph-0" is forbidden: unable to validate against any security context constraint: [
  provider "anyuid": Forbidden: not usable by user or serviceaccount,
  provider restricted-v2: .initContainers[0].runAsUser: Invalid value: 0: must be in the ranges: [1001180000, 1001189999],
  provider restricted-v2: .initContainers[0].capabilities.add: Invalid value: "CHOWN": capability may not be added,
  provider restricted-v2: .initContainers[1].runAsUser: Invalid value: 0: must be in the ranges: [1001180000, 1001189999],
  provider restricted-v2: .initContainers[1].privileged: Invalid value: true: Privileged containers are not allowed,
  provider "restricted": Forbidden: not usable by user or serviceaccount,
  provider "nonroot-v2": Forbidden: not usable by user or serviceaccount,
  provider "nonroot": Forbidden: not usable by user or serviceaccount,
  provider "pcap-dedicated-admins": Forbidden: not usable by user or serviceaccount,
  provider "hostmount-anyuid": Forbidden: not usable by user or serviceaccount,
  provider "machine-api-termination-handler": Forbidden: not usable by user or serviceaccount,
  provider "hostnetwork-v2": Forbidden: not usable by user or serviceaccount,
  provider "hostnetwork": Forbidden: not usable by user or serviceaccount,
  provider "hostaccess": Forbidden: not usable by user or serviceaccount,
  provider "splunkforwarder": Forbidden: not usable by user or serviceaccount,
  provider "node-exporter": Forbidden: not usable by user or serviceaccount,
  provider "privileged": Forbidden: not usable by user or serviceaccount
]

Related to memgraph/memgraph#2192

[antejavor]

Hi @aqeelat, thanks for opening the issue and communicating this.

Looks like it is related to the change in ownership and not working in OpenShift @gitbuda @as51340 : #141

[as51340]

Not sure @antejavor it's because of recent changes. These lines:

provider restricted-v2: .initContainers[0].runAsUser: Invalid value: 0: must be in the ranges: [1001180000, 1001189999],
  provider restricted-v2: .initContainers[0].capabilities.add: Invalid value: "CHOWN": capability may not be added,
  provider restricted-v2: .initContainers[1].runAsUser: Invalid value: 0: must be in the ranges: [1001180000, 1001189999],
  provider restricted-v2: .initContainers[1].privileged: Invalid value: true: Privileged containers are not allowed,
  provider "restricted": Forbidden: not usable by user or serviceaccount,

look like there is something else wrong. I will take a look

[aqeelat]

The providers at the and of the list are just names of other SCCs. You can ignore them.
The default one is restricted-v2.

If it is essential to have the init container run as a specific user id or have the CHOWN permission, then you can suggest a new SCC. This is the scc that nginx operator uses: https://github.com/nginx/nginx-ingress-helm-operator/blob/main/resources/scc.yaml

However, I can imagine some infra teams that are anal about adding custom SCCs, so if the issue can be solved a different way such as requiring fewer permissions (even down the road), that would be ideal.

[as51340]

@aqeelat can you check this PR if this would help you? #149

I have only sandbox env so I think that's the reason why I am unable to test SCC

[as51340]

@aqeelat I made some progress here with removing root access. Would you be kind to test it on OpenShift? #157

[aqeelat]

@aqeelat I made some progress here with removing root access. Would you be kind to test it on OpenShift? #157

Sorry I missed this. I'll test it out today ISA.