mayastor: default installation results in warnings; CRD's missing
on a fresh set up cluster:
helm repo add mayastor https://openebs.github.io/mayastor-extensions/helm install mayastor mayastor/mayastor -n mayastor --create-namespace --version 2.3.0Output:
W0726 08:59:44.637192 10122 warnings.go:70] would violate PodSecurity "restricted:latest": restricted volume types (volumes "run", "containers", "pods" use restricted volume type "hostPath"), runAsNonRoot != true (pod or container "promtail" must set securityContext.runAsNonRoot=true), runAsUser=0 (pod must not set runAsUser=0), seccompProfile (pod or container "promtail" must set securityContext.seccompProfile.type to "RuntimeDefault" or "Localhost")
W0726 08:59:44.638252 10122 warnings.go:70] would violate PodSecurity "restricted:latest": host namespaces (hostNetwork=true), hostPort (containers "metrics-exporter-pool", "io-engine" use hostPorts 10124, 9502), privileged (container "io-engine" must not set securityContext.privileged=true), allowPrivilegeEscalation != false (containers "agent-core-grpc-probe", "etcd-probe", "metrics-exporter-pool", "io-engine" must set securityContext.allowPrivilegeEscalation=false), unrestricted capabilities (containers "agent-core-grpc-probe", "etcd-probe", "metrics-exporter-pool", "io-engine" must set securityContext.capabilities.drop=["ALL"]), restricted volume types (volumes "device", "udev", "configlocation" use restricted volume type "hostPath"), runAsNonRoot != true (pod or containers "agent-core-grpc-probe", "etcd-probe", "metrics-exporter-pool", "io-engine" must set securityContext.runAsNonRoot=true), seccompProfile (pod or containers "agent-core-grpc-probe", "etcd-probe", "metrics-exporter-pool", "io-engine" must set securityContext.seccompProfile.type to "RuntimeDefault" or "Localhost")
W0726 08:59:44.638422 10122 warnings.go:70] would violate PodSecurity "restricted:latest": host namespaces (hostNetwork=true), hostPort (container "agent-ha-node" uses hostPort 50053), privileged (container "agent-ha-node" must not set securityContext.privileged=true), allowPrivilegeEscalation != false (containers "agent-cluster-grpc-probe", "agent-ha-node" must set securityContext.allowPrivilegeEscalation=false), unrestricted capabilities (containers "agent-cluster-grpc-probe", "agent-ha-node" must set securityContext.capabilities.drop=["ALL"]), restricted volume types (volumes "device", "sys", "run-udev", "plugin-dir" use restricted volume type "hostPath"), runAsNonRoot != true (pod or containers "agent-cluster-grpc-probe", "agent-ha-node" must set securityContext.runAsNonRoot=true), seccompProfile (pod or containers "agent-cluster-grpc-probe", "agent-ha-node" must set securityContext.seccompProfile.type to "RuntimeDefault" or "Localhost")
W0726 08:59:44.640310 10122 warnings.go:70] would violate PodSecurity "restricted:latest": host namespaces (hostNetwork=true), hostPort (container "csi-driver-registrar" uses hostPort 10199), privileged (container "csi-node" must not set securityContext.privileged=true), allowPrivilegeEscalation != false (containers "csi-node", "csi-driver-registrar" must set securityContext.allowPrivilegeEscalation=false), unrestricted capabilities (containers "csi-node", "csi-driver-registrar" must set securityContext.capabilities.drop=["ALL"]), restricted volume types (volumes "device", "sys", "run-udev", "registration-dir", "plugin-dir", "kubelet-dir" use restricted volume type "hostPath"), runAsNonRoot != true (pod or containers "csi-node", "csi-driver-registrar" must set securityContext.runAsNonRoot=true), seccompProfile (pod or containers "csi-node", "csi-driver-registrar" must set securityContext.seccompProfile.type to "RuntimeDefault" or "Localhost")
W0726 08:59:44.666222 10122 warnings.go:70] would violate PodSecurity "restricted:latest": allowPrivilegeEscalation != false (containers "agent-core-grpc-probe", "etcd-probe", "operator-diskpool" must set securityContext.allowPrivilegeEscalation=false), unrestricted capabilities (containers "agent-core-grpc-probe", "etcd-probe", "operator-diskpool" must set securityContext.capabilities.drop=["ALL"]), runAsNonRoot != true (pod or containers "agent-core-grpc-probe", "etcd-probe", "operator-diskpool" must set securityContext.runAsNonRoot=true), seccompProfile (pod or containers "agent-core-grpc-probe", "etcd-probe", "operator-diskpool" must set securityContext.seccompProfile.type to "RuntimeDefault" or "Localhost")
W0726 08:59:44.668840 10122 warnings.go:70] would violate PodSecurity "restricted:latest": allowPrivilegeEscalation != false (containers "etcd-probe", "agent-core", "agent-ha-cluster" must set securityContext.allowPrivilegeEscalation=false), unrestricted capabilities (containers "etcd-probe", "agent-core", "agent-ha-cluster" must set securityContext.capabilities.drop=["ALL"]), runAsNonRoot != true (pod or containers "etcd-probe", "agent-core", "agent-ha-cluster" must set securityContext.runAsNonRoot=true), seccompProfile (pod or containers "etcd-probe", "agent-core", "agent-ha-cluster" must set securityContext.seccompProfile.type to "RuntimeDefault" or "Localhost")
W0726 08:59:44.668890 10122 warnings.go:70] would violate PodSecurity "restricted:latest": allowPrivilegeEscalation != false (containers "agent-core-grpc-probe", "etcd-probe", "api-rest" must set securityContext.allowPrivilegeEscalation=false), unrestricted capabilities (containers "agent-core-grpc-probe", "etcd-probe", "api-rest" must set securityContext.capabilities.drop=["ALL"]), runAsNonRoot != true (pod or containers "agent-core-grpc-probe", "etcd-probe", "api-rest" must set securityContext.runAsNonRoot=true), seccompProfile (pod or containers "agent-core-grpc-probe", "etcd-probe", "api-rest" must set securityContext.seccompProfile.type to "RuntimeDefault" or "Localhost")
W0726 08:59:44.669231 10122 warnings.go:70] would violate PodSecurity "restricted:latest": allowPrivilegeEscalation != false (containers "obs-callhome", "obs-callhome-stats" must set securityContext.allowPrivilegeEscalation=false), unrestricted capabilities (containers "obs-callhome", "obs-callhome-stats" must set securityContext.capabilities.drop=["ALL"]), runAsNonRoot != true (pod or containers "obs-callhome", "obs-callhome-stats" must set securityContext.runAsNonRoot=true), seccompProfile (pod or containers "obs-callhome", "obs-callhome-stats" must set securityContext.seccompProfile.type to "RuntimeDefault" or "Localhost")
W0726 08:59:44.677145 10122 warnings.go:70] would violate PodSecurity "restricted:latest": host namespaces (hostNetwork=true), allowPrivilegeEscalation != false (containers "api-rest-probe", "csi-provisioner", "csi-attacher", "csi-snapshotter", "csi-snapshot-controller", "csi-controller" must set securityContext.allowPrivilegeEscalation=false), unrestricted capabilities (containers "api-rest-probe", "csi-provisioner", "csi-attacher", "csi-snapshotter", "csi-snapshot-controller", "csi-controller" must set securityContext.capabilities.drop=["ALL"]), runAsNonRoot != true (pod or containers "api-rest-probe", "csi-provisioner", "csi-attacher", "csi-snapshotter", "csi-snapshot-controller", "csi-controller" must set securityContext.runAsNonRoot=true), seccompProfile (pod or containers "api-rest-probe", "csi-provisioner", "csi-attacher", "csi-snapshotter", "csi-snapshot-controller", "csi-controller" must set securityContext.seccompProfile.type to "RuntimeDefault" or "Localhost")
W0726 08:59:44.698508 10122 warnings.go:70] would violate PodSecurity "restricted:latest": allowPrivilegeEscalation != false (containers "volume-permissions", "loki" must set securityContext.allowPrivilegeEscalation=false), unrestricted capabilities (containers "volume-permissions", "loki" must set securityContext.capabilities.drop=["ALL"]), runAsNonRoot != true (pod must not set securityContext.runAsNonRoot=false), runAsUser=0 (container "volume-permissions" must not set runAsUser=0), seccompProfile (pod or containers "volume-permissions", "loki" must set securityContext.seccompProfile.type to "RuntimeDefault" or "Localhost")
W0726 08:59:44.705273 10122 warnings.go:70] would violate PodSecurity "restricted:latest": allowPrivilegeEscalation != false (container "volume-permissions" must set securityContext.allowPrivilegeEscalation=false), unrestricted capabilities (containers "volume-permissions", "etcd" must set securityContext.capabilities.drop=["ALL"]), runAsNonRoot != true (pod or container "volume-permissions" must set securityContext.runAsNonRoot=true), runAsUser=0 (container "volume-permissions" must not set runAsUser=0), seccompProfile (pod or containers "volume-permissions", "etcd" must set securityContext.seccompProfile.type to "RuntimeDefault" or "Localhost")
kubectl --kubeconfig ../kubeconfig get pods -n mayastorOutput:
NAME READY STATUS RESTARTS AGE
mayastor-agent-core-7c45b7b6c4-9z5b6 0/2 Init:0/1 0 10m
mayastor-agent-ha-node-5b59v 0/1 Init:0/1 0 10m
mayastor-agent-ha-node-l4htt 0/1 Init:0/1 0 10m
mayastor-agent-ha-node-zx6t4 0/1 Init:0/1 0 10m
mayastor-api-rest-754644d4cb-2fgkf 0/1 Init:0/2 0 10m
mayastor-csi-controller-5bbb99bf6-d7dh9 0/5 Init:0/1 0 10m
mayastor-csi-node-2gjhf 2/2 Running 0 10m
mayastor-csi-node-8xml7 2/2 Running 0 10m
mayastor-csi-node-pbxqh 2/2 Running 0 10m
mayastor-etcd-0 0/1 Pending 0 10m
mayastor-etcd-1 0/1 Pending 0 10m
mayastor-etcd-2 0/1 Pending 0 10m
mayastor-io-engine-9cvbd 0/2 Pending 0 10m
mayastor-io-engine-mvbtf 0/2 Pending 0 10m
mayastor-io-engine-t6hcf 0/2 Pending 0 10m
mayastor-loki-0 0/1 Pending 0 10m
mayastor-obs-callhome-c76f65bd9-4ll8p 2/2 Running 0 10m
mayastor-operator-diskpool-5955fcd645-nr67v 0/1 Init:0/2 0 10m
mayastor-promtail-djhxp 1/1 Running 0 10m
mayastor-promtail-k8rk7 1/1 Running 0 10m
mayastor-promtail-prgch 1/1 Running 0 10m
kubectl --kubeconfig ../kubeconfig get dsp -n mayastorOutput:
error: the server doesn't have a resource type "dsp"
kubectl --kubeconfig ../kubeconfig -n mayastor get mspOutput:
error: the server doesn't have a resource type "msp"
About this issue
- Original URL
- State: closed
- Created a year ago
- Comments: 28 (13 by maintainers)
Yeah so that’s not what we want to do here, please undo that change for now. For Mayastor volumes there’s no correlation at all. But, mayastor itself makes use of its own etcd cluster, as well as a loki instance for logs collection (useful to generate support bundle) and these two things need storage. We use 3rd party helm charts for this, which consume storage via a
StorageClass! And this is the storage class we need to give our helm chart when installing mayastor as by default it uses the default storage class IIRC. @Abhinandan-Purkait @avishnu I think we probably need to clarify this in the docs, if it’s not already.