I've installed Spring Cloud Dataflow on OpenShift / Kubernetes using bitnami helm chart. On OpenShift, you have to disable security contexts in custom values in order to deploy and run SCDF services.
podSecurityContext:
enabled: false
containerSecurityContext:
enabled: false
Otherwise OpenShift reports an error:
provider "restricted-loki": Forbidden: not usable by user or serviceaccount,
provider restricted: .spec.securityContext.fsGroup:
Invalid value: []int64{1001}: 1001 is not an allowed group, spec.containers[0].securityContext.runAsUser:
Invalid value: 1001: must be in the ranges: [1001230000, 1001239999]
After disabling security contexts, the deployment works fine. However, when I register an application (task via docker-URL) and try to launch it, I get a similar error:
Failure executing: POST at: https://172.29.0.1/api/v1/namespaces/my-ns/pods. Message: Forbidden!Configured service account doesn't have access. Service account may have been revoked. pods "my-task-8jm653e6rp" is forbidden: unable to validate against any security context constraint: [ provider "anyuid": Forbidden: not usable by user or serviceaccount, provider "mtc-minio": Forbidden: not usable by user or serviceaccount, provider "restricted-loki": Forbidden: not usable by user or serviceaccount, spec.containers[0].securityContext.runAsUser: Invalid value: 1001: must be in the ranges: [1001230000, 1001239999], ...
So I assume that it is again a security context issue. Is there a way to pass kubernetes deployment properties to disable security contexts?
I tried setting the deployment property spring.cloud.deployer.kubernetes.pod-security-context.run-as-user=1001230001 but the error remains the same.
Or am I on the wrong track? What else could be the issue?