Error installing artifactory-oss helm chart in openshift

user_16452639 0
Viewed 108

I am trying to install artifactory oss in a openshift cluster. I am using this helm chart https://charts.jfrog.io/artifactory-oss-107.39.4.tgz (Warning I am very new to openshift etc.. I am on a steep learning curve )

I am running the helm chart as the openshift cluster-admin account

However I am getting this error

pods "artifactory-artifactory-nginx-5c66b8c948-" is forbidden: unable to validate against any security context constraint: [provider "anyuid": Forbidden: not usable by user or serviceaccount, provider restricted: .spec.securityContext.fsGroup: Invalid value: []int64{107}: 107 is not an allowed group, spec.initContainers[0].securityContext.runAsUser: Invalid value: 104: must be in the ranges: [1000970000, 1000979999], spec.containers[0].securityContext.runAsUser: Invalid

I think it is a openshift permissions error .. in that it requires a more permissive security constraint. However given I am running as cluster-admin I find that a little suprising.

Can anyone offer a suggestion how to resolve this issue and get artifactory-oss running in openshift?

Thanks in advance !

--

Tried passing some options to set the uid and gild.. I tried starting with this

helm upgrade --install artifactory --set artifactory.uid=1001010042,artifactory.gid=1001010042,nginx.uid=1001010042,nginx.gid=1001010042,artifactory.masterKey=${MASTER_KEY},artifactory.joinKey=${JOIN_KEY},artifactory.postgresql.postgresqlPassword=$POSTGRES_PASSWORD --namespace artifactory jfrog/artifactory-oss

The options should have set the uids and gids.. but I still got.. Seems the helm chart ignores efforts to overwrite the values

pods "artifactory-artifactory-nginx-5c66b8c948-" is forbidden: unable to validate against any security context constraint: [provider "anyuid": Forbidden: not usable by user or serviceaccount, provider restricted: .spec.securityContext.fsGroup: Invalid value: []int64{107}: 107 is not an allowed group, spec.initContainers[0].securityContext.runAsUser: Invalid value: 104: must be in the ranges: [1000930000, 1000939999], spec.containers[0].securityContext.runAsUser: Invalid

openshift artifactory
1 Answers

Regarding the JFrog Artifactory OSS Helm Chart, its documentation Installing Artifactory points out to some prerequisites.

  • When installing Artifactory, you must run the installation as a root user or provide sudo access to a non-root user.
  • For Helm
    • Create a unique Master Key (Artifactory requires a unique master key) pass it to the template during installation.
    • Create a secret containing the key. The key in the secret must be named master-key
      kubectl create secret generic my-masterkey-secret -n artifactory --from-literal=master-key=${MASTER_KEY}
    • make sure to pass the same master key on all future calls to Helm install and Helm upgrade.
      This means always passing --set artifactory.masterKey=${MASTER_KEY} (for the custom master key) or --set artifactory.masterKeySecretName=my-masterkey-secret (for the manual secret) and verifying that the contents of the secret remain unchanged.
    • create a unique join key: By default the chart has one set in the values.yaml (artifactory.joinKey).
      However, this key is for demonstration purposes only and should not be used in a production environment

The point is: it depends on the exact command used to install the Helm Chart.

helm upgrade --install artifactory --set artifactory.masterKey=${MASTER_KEY} \
                                   --set artifactory.joinKey=${JOIN_KEY} \
                                   --namespace artifactory jfrog/artifactory

As illustrated here, the value for "runAsUser" and "fsGroup" in values.yaml can have an influence on the error message..

Unlike other installations, Helm Chart configurations are made to the values.yaml and are then applied to the system.yaml.

Follow these steps to apply the configuration changes.

  • Make the changes to values.yaml.
  • Run the command.
    helm upgrade --install artifactory -n artifactory -f values.yaml

See Managing security context constraints for more.

VonC_63090
Related