Flux: Make `fluxctl install` work with Open Shift

[richardcase]

Describe the bug
When i run the following against open shift:

fluxctl install \
--git-user=${GHUSER} \
--git-email=${GHUSER}@users.noreply.github.com \
[email protected]:${GHUSER}/flux-get-started \
--git-path=namespaces,workloads \
--namespace=flux | oc apply -f -

(same issue if you use kubectl instead of oc)

The flux pod starts ok but the memcache pod fails to start. Looking at why i see the following:

pods "memcached-78f7c9df46-" is forbidden: unable to validate against
any security context constraint:
[spec.containers[0].securityContext.securityContext.runAsUser: Invalid
value: 11211: must be in the ranges: [1000510000, 1000519999]]

To Reproduce
Run the command above against an OpenShift cluster.

Expected behavior
I would expect flux and memcached to start and deploy podinfo (from the sample repo)

Additional context
I have got this working by manually changing the yaml to comment out/remove the security context entry for the memcached deployment:

        ports:
        - name: clients
          containerPort: 11211
        #securityContext:
        #  runAsUser: 11211
        #  runAsGroup: 11211
        #  allowPrivilegeEscalation: false

If you now run the yaml in memcached starts. With this change OpenShift will assign the memcached pods to the restricted SCC.

We could make this more explicit by creating a service account for memcached and explicitly assign that to an SCC (either restricted or nonroot) when targetting openshift.

This also relates to #1125

[richardcase]

As i have this working i am happy to make the fix

[2opremio]

As i have this working i am happy to make the fix

That would be fantastic!

and explicitly assign that to an SCC (either restricted or nonroot) when targetting openshift.

The problem is that fluxctl install doesn't know what you are using the yamls for

[richardcase]

The problem is that fluxctl install doesn't know what you are using the yamls for

I've added a --oc flag in my changes so that we can:

fluxctl install \
--git-user=${GHUSER} \
--git-email=${GHUSER}@users.noreply.github.com \
[email protected]:${GHUSER}/flux-get-started \
--git-path=namespaces,workloads \
--namespace=flux  --oc | oc apply -f -

Or do you think something like --target oc would be better?

[2opremio]

Or do you think something like --target oc would be better?

Sorry this went unanswered. --oc is fine

[Numblesix]

Hey is there any update on this :) ?

[KrisJohnstone]

Change has been merged. It looks like flag should be --add-security-context=false @Numblesix