OpenShift SCC compatibility? about blue-agent HOT 4 CLOSED

Hello @clemlesne

It appears that our Pod Admission Controller disallow you the usage of ephemeral disks. Can you confirm that?

Thank you, I finally noticed that you already provide this option. Setting pipelines.{cache,tmpdir}.volumeEnabled: false removes that error. I should have read README much more carefully.

OpenShift is really strict in terms of privilege escalations, Red Hat is right. I'm working into this.

Thanks! I would be happy to test your fixes in an OpenShift sandbox project at my org, if that's helpful.

from blue-agent.

Hello @timrburnham, thank you for your patience. Can you test the image flavor ubi9 version 6.2.1-1.2d3ceab on your OpenShift cluster?

Details:

• Build ref https://github.com/clemlesne/azure-pipelines-agent/actions/runs/6962257636/job/18945604971.
• Comit ref 2d3ceab

from blue-agent.

Hello @timrburnham,

I see your errors are:

• spec.volumes[0]: Invalid value: "ephemeral": ephemeral volumes are not allowed to be used
• spec.containers[0].securityContext.runAsUser: Invalid value: 0: must be in the ranges: [1000920000, 1000929999]

Regarding spec.volumes[0]: Invalid value: "ephemeral": ephemeral volumes are not allowed to be used:

It appears that our Pod Admission Controller disallow you the usage of ephemeral disks. Can you confirm that?

Regarding spec.containers[0].securityContext.runAsUser: Invalid value: 0: must be in the ranges: [1000920000, 1000929999]:

OpenShift is really strict in terms of privilege escalations, Red Hat is right. I'm working into this.

from blue-agent.

I'm clothing this issue as there is no update. Don't hesitate to reopen and comment.

from blue-agent.