UNCLASSIFIED - NO CUI

On RKE2 and similar clusters, two flux controllers from IronBank images won't run due to PodSecurityPolicy issues

Running images defined with non-numeric users will fail under some Kubernetes cluster configurations with strict policies. Currently, the referenced PlatformOne Flux manifest references two such IronBank images that won't run on our clusters as described in the README.md for this project the customer template.

  • source-controller (IB image defined to run as user "controller")
  • notification-controller (IB image defined to run as user "controller")

To address these issues on RKE2 I've had to add securityContext blocks to the above deployments in the flux manifests such as (controller is uid=1000):

      securityContext:
        runAsNonRoot: true
        runAsUser: 1000
        runAsGroup: 1000
        privileged: false
        allowPrivilegeEscalation: false
        readOnlyRootFilesystem: true

AC

Add security context into Flux deployments (running as non-1000 is a good idea)

Edited by Jason Krause