On RKE2 and similar clusters, two flux controllers from IronBank images won't run due to PodSecurityPolicy issues
Running images defined with non-numeric users will fail under some Kubernetes cluster configurations with strict policies.
Currently, the referenced PlatformOne Flux manifest references two such IronBank images that won't run on our clusters as described in the README.md for this project the customer template.
- source-controller (IB image defined to run as user "controller")
- notification-controller (IB image defined to run as user "controller")
To address these issues on RKE2 I've had to add securityContext blocks to the above deployments in the flux manifests such as (controller is uid=1000):
securityContext:
runAsNonRoot: true
runAsUser: 1000
runAsGroup: 1000
privileged: false
allowPrivilegeEscalation: false
readOnlyRootFilesystem: true
AC
Add security context into Flux deployments (running as non-1000 is a good idea)
Edited by Jason Krause