Uploaded image for project: 'Couchbase Kubernetes'
  1. Couchbase Kubernetes
  2. K8S-1541

Operator does not allow specification of pod security context to backup job pods

    XMLWordPrintable

Details

    • Improvement
    • Resolution: Fixed
    • Critical
    • 2.1.0
    • 2.0.0, 2.0.1
    • operator
    • 35: Metering, Bugs, Etc., 37: Hibernation, Backup, Prom.
    • 3

    Description

      A user may wish to configure their Couchbase Server pods to run as a specific user using a security context, which is how you also define the fsgroup.

      We allow users to specify this as part of https://docs.couchbase.com/operator/2.0/reference-couchbasecluster.html#spec-securitycontext which is passed directly down to the underlying Couchbase Server pods when creating in Kubernetes.
      There is not a way to specify the same security context for the backup job pods, as we only extract the fsgroup - https://github.com/couchbase/couchbase-operator/blob/9f6a53fa2c83ebc9669168fd1692ec479be0b89a/pkg/cluster/backup.go#L187-L189.

      This prevents deployment of the backup jobs in environments where runAsNonRoot is enforced (most secure environments) through pod security policies (https://kubernetes.io/docs/concepts/policy/pod-security-policy/#users-and-groups), due to the following error:

      Error: container has runAsNonRoot and image has non-numeric user (couchbase), cannot verify user is non-root
      

      Being able to specify the UID of 1000 in the pod security context for the backup would fix that issue.

      Attachments

        For Gerrit Dashboard: K8S-1541
        # Subject Branch Project Status CR V

        Activity

          People

            daniel.ma Daniel Ma (Inactive)
            matt.carabine Matt Carabine (Inactive)
            Votes:
            0 Vote for this issue
            Watchers:
            2 Start watching this issue

            Dates

              Created:
              Updated:
              Resolved:

              Gerrit Reviews

                There are no open Gerrit changes

                PagerDuty