Openshift setup for Camunda 8

gomic4 · December 6, 2023, 5:04pm

We are trying to setup Camunda 8 in openshift not able to configure Postgres,elastic search and keycloak.
Tried the default options where security context is null as well. Getting below error:

create Pod camunda-platform-elasticsearch-master-0 in StatefulSet camunda-platform-elasticsearch-master failed error: pods “camunda-platform-elasticsearch-master-0” is forbidden: unable to validate against any security context constraint: [provider “trident-controller”: Forbidden: not usable by user or serviceaccount, provider “restricted-runasnonroot-uid”: Forbidden: not usable by user or serviceaccount, provider “alertmanager”: Forbidden: not usable by user or serviceaccount, provider “anyuid”: Forbidden: not usable by user or serviceaccount, provider “thanos-compact”: Forbidden: not usable by user or serviceaccount, provider “thanos-ruler”: Forbidden: not usable by user or serviceaccount, provider “thanos-store-gateway”: Forbidden: not usable by user or serviceaccount, provider restricted-v2: .spec.securityContext.fsGroup: Invalid value: int64{1001}: 1001 is not an allowed group, provider restricted-v2: .containers[0].runAsUser: Invalid value: 1001: must be in the ranges: [1003470000, 1003479999], provider restricted: .spec.securityContext.fsGroup: Invalid value: int64{1001}: 1001 is not an allowed group, provider restricted: .containers[0].runAsUser: Invalid value: 1001: must be in the ranges: [1003470000, 1003479999], provider “nonroot-v2”: Forbidden: not usable by user or serviceaccount, provider “nonroot”: Forbidden: not usable by user or serviceaccount, provider “noobaa”: Forbidden: not usable by user or serviceaccount, provider “noobaa-endpoint”: Forbidden: not usable by user or serviceaccount, provider “pcap-dedicated-admins”: Forbidden: not usable by user or serviceaccount, provider “hostmount-anyuid”: Forbidden: not usable by user or serviceaccount, provider “aqua-scc”: Forbidden: not usable by user or serviceaccount, provider “machine-api-termination-handler”: Forbidden: not usable by user or serviceaccount, provider “hostnetwork-v2”: Forbidden: not usable by user or serviceaccount, provider “hostnetwork”: Forbidden: not usable by user or serviceaccount, provider “hostaccess”: Forbidden: not usable by user or serviceaccount, provider “kepler-exporter-scc”: Forbidden: not usable by user or serviceaccount, provider “splunkforwarder”: Forbidden: not usable by user or serviceaccount, provider “aqua-kube-enforcer-scc”: Forbidden: not usable by user or serviceaccount, provider “trident-node-linux”: Forbidden: not usable by user or serviceaccount, provider “fluent-bit-logging”: Forbidden: not usable by user or serviceaccount, provider “rook-ceph”: Forbidden: not usable by user or serviceaccount, provider “bprosa-node-exporter”: Forbidden: not usable by user or serviceaccount, provider “node-exporter”: Forbidden: not usable by user or serviceaccount, provider “qualys-scc”: Forbidden: not usable by user or serviceaccount, provider “rook-ceph-csi”: Forbidden: not usable by user or serviceaccount, provider “privileged”: Forbidden: not usable by user or serviceaccount]

Configuration

github.com

camunda/camunda-platform-helm/blob/dce62aad7c83dbb9f958685b43ecee4b1f0f0588/charts/camunda-platform/openshift/values.yaml

##
# This is a minimal sample values file to get you started with an Openshift cluster using the recommended default
# policies. Using these values, you will be able to deploy the chart using the least permissive SCC, "restricted".
#
# Everywhere we assign "null" to a value is to ensure that default values of one of the charts, or of its dependencies,
# will not cause issues with the "restricted" SCC (e.g. assign a fixed UID or GID). Additionally, we want to make sure
# that all volume mounts are mounted with the minimum required permissions. You can omit these everywhere if you will
# use a different SCC such as nonroot or anyuid.
##
---
# omit the values below if zeebe.enabled is false
zeebe:
  configMap:
    defaultMode: 0555
  podSecurityContext:
    fsGroup: null
  containerSecurityContext:
    runAsUser: null

# omit the values below if zeebe-gateway.enabled is false

This file has been truncated. show original

Can some one please help me here ?

GotnOGuts · December 6, 2023, 6:42pm

Looks like something specific to your site.

	provider restricted-v2: .spec.securityContext.fsGroup: Invalid value: int64{1001}: 1001 is not an allowed group,
	provider restricted-v2: .containers[0].runAsUser: Invalid value: 1001: must be in the ranges: [1003470000, 1003479999],
	provider restricted: .spec.securityContext.fsGroup: Invalid value: int64{1001}: 1001 is not an allowed group,
	provider restricted: .containers[0].runAsUser: Invalid value: 1001: must be in the ranges: [1003470000, 1003479999],

It looks like your OpenShift doesn’t like having a userID of 1001.

nathan.loding · December 6, 2023, 10:11pm

Hi @gomic4, welcome to the forums! I think GotnOGuts has it right … this part of our documentation might be helpful.

gomic4 · December 7, 2023, 3:13pm

Hi
The patch did fix the issue but i amnot able to override any values in values.yml
Example: Image repository, CPU, Memory

Configuration is below
elasticsearch:

@param elasticsearch.enabled

enabled: true
image:
registry: “”
repository: docker.elastic.co/elasticsearch/elasticsearch
tag: 8.8.2

Same thing when i try to update the yml in the open shift console it works
Also i was able to configure registory by appending elasticsearch.image.repository=docker.elastic.co/elasticsearch/elasticsearch in the helm command

nathan.loding · December 7, 2023, 9:54pm

Apologies @gomic4, I’m not sure what issue you are having with overriding the values. Can you share a bit more? The configuration snippet you provided doesn’t override any of the CPU or memory values?