UNCLASSIFIED - NO CUI

Skip to content

Alloy operator pod fails to start when Kyverno disabled

The Alloy operator pod is currently depending on Kyverno setting the securityContext.runAsUser. If Kyverno is not deployed within BigBang the pod will fail to start.

The event that is dispatched:

apiVersion: events.k8s.io/v1
deprecatedCount: 9
deprecatedFirstTimestamp: "2025-09-23T15:50:12Z"
deprecatedLastTimestamp: "2025-09-23T15:51:39Z"
deprecatedSource:
  component: kubelet
  host: k3d-bb-helm-agent-1
eventTime: null
kind: Event
metadata:
  creationTimestamp: "2025-09-23T15:50:12Z"
  name: alloy-alloy-operator-758679bbcd-b59mp.1867f4236745fa5c
  namespace: alloy
  resourceVersion: "7316"
  uid: a0fe6edb-2af4-4d2a-99d0-18e788c0de33
note: 'Error: container has runAsNonRoot and image has non-numeric user (helm), cannot
  verify user is non-root (pod: "alloy-alloy-operator-758679bbcd-b59mp_alloy(4d1d4f68-999b-4b14-b418-3df2ef1b9b36)",
  container: alloy-operator)'
reason: Failed
regarding:
  apiVersion: v1
  fieldPath: spec.containers{alloy-operator}
  kind: Pod
  name: alloy-alloy-operator-758679bbcd-b59mp
  namespace: alloy
  resourceVersion: "6270"
  uid: 4d1d4f68-999b-4b14-b418-3df2ef1b9b36
reportingController: kubelet
reportingInstance: k3d-bb-helm-agent-1
type: Warning

The fix should be just setting an explicit runAsUser to 1001 which is what the container is expecting to run as - https://github.com/operator-framework/operator-sdk/blob/master/images/helm-operator/Dockerfile#L22-L29