Uploaded image for project: 'Couchbase Kubernetes'
  1. Couchbase Kubernetes
  2. K8S-1541

Operator does not allow specification of pod security context to backup job pods

    XMLWordPrintable

Details

    • Improvement
    • Resolution: Fixed
    • Critical
    • 2.1.0
    • 2.0.0, 2.0.1
    • operator
    • 35: Metering, Bugs, Etc., 37: Hibernation, Backup, Prom.
    • 3

    Description

      A user may wish to configure their Couchbase Server pods to run as a specific user using a security context, which is how you also define the fsgroup.

      We allow users to specify this as part of https://docs.couchbase.com/operator/2.0/reference-couchbasecluster.html#spec-securitycontext which is passed directly down to the underlying Couchbase Server pods when creating in Kubernetes.
      There is not a way to specify the same security context for the backup job pods, as we only extract the fsgroup - https://github.com/couchbase/couchbase-operator/blob/9f6a53fa2c83ebc9669168fd1692ec479be0b89a/pkg/cluster/backup.go#L187-L189.

      This prevents deployment of the backup jobs in environments where runAsNonRoot is enforced (most secure environments) through pod security policies (https://kubernetes.io/docs/concepts/policy/pod-security-policy/#users-and-groups), due to the following error:

      Error: container has runAsNonRoot and image has non-numeric user (couchbase), cannot verify user is non-root
      

      Being able to specify the UID of 1000 in the pod security context for the backup would fix that issue.

      Attachments

        No reviews matched the request. Check your Options in the drop-down menu of this sections header.

        Activity

          People

            daniel.ma Daniel Ma (Inactive)
            matt.carabine Matt Carabine (Inactive)
            Votes:
            0 Vote for this issue
            Watchers:
            2 Start watching this issue

            Dates

              Created:
              Updated:
              Resolved:

              Gerrit Reviews

                There are no open Gerrit changes

                PagerDuty