tiagomistral commented on issue #466:
URL: https://github.com/apache/solr-operator/issues/466#issuecomment-6466917512
I'm hitting the same error on a recent setup, and the `podSecurityContext:
{}` workaround from the description no longer works for me.
**Environment**
- Solr Operator: `0.9.1`
- Solr Helm chart: 0.9.1
- Solr image: 9.8.1
- OpenShift `4.20`, default `restricted-v2` SCC
**What I see**
The SolrCloud StatefulSet is created but its pod never is, because of
`.spec.securityContext.fsGroup: Invalid value: []int64{8983}: 8983 is not an
allowed group`.
I tried the workaround from this issue by patching the SolrCloud with an
empty pod security context:
```
kubectl patch solrcloud solr --type json \
-p
'[{"op":"replace","path":"/spec/customSolrKubeOptions/podOptions/podSecurityContext","value":{}}]'
kubectl get sts solr-solrcloud -o
jsonpath='{.spec.template.spec.securityContext}'
# {"fsGroup":8983}
```
So the StatefulSet still gets `fsGroup: 8983`. This matches
`GenerateStatefulSet` in `controllers/util/solr_util.go` on `main`: when
`podOptions.podSecurityContext` is set but has no `fsGroup`, the operator fills
in `DefaultSolrGroup`. That means the field can no longer be left unset, which
is what `restricted-v2` needs in order to assign a value from the namespace
range.
**Workarounds I found**
- Setting `fsGroup` explicitly to a value inside the namespace's
`openshift.io/sa.scc.supplemental-groups` range works, but that range is
different in every namespace and cluster, so the same values can't be promoted
between environments.
- A dedicated ServiceAccount plus an SCC that allows fsGroup/runAsUser 8983
(see #264 and #671) also works, but it needs a cluster administrator, so it is
not an option for everyone.
**Suggestion**
Either (or both):
1. Document these workarounds for OpenShift.
2. Add an opt-out so the operator doesn't set a default `fsGroup`, keeping
today's behaviour for plain Kubernetes. One thing to keep in mind:
`generateSolrSetupInitContainers` also uses the fsGroup value when preparing
backup repository volumes, so it would have to handle the unset case.
I run OpenShift, so I'm happy to test or send a PR if the maintainers agree
on the approach.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
