Metrics-server: Error: container has runAsNonRoot and image will run as root

[devopsop]

Greetings,

With yesterday's addition in the deployment file:

        securityContext:
          readOnlyRootFilesystem: true
          runAsNonRoot: true

I get this error while pod is initializing
Error: container has runAsNonRoot and image will run as root

I am using EKS 1.14.6 - Fresh new cluster

When I remove the block above, everything runs fine.

[SarfarazAliKhan]

Same here

I'm using k3s, Kubernetes v1.16.2

[serathius]

/assign

[auto-testing]

+1 k8s, Kubernetes v1.16.2

[ysolis]

this is related to #152

[ysolis]

to avoid this problem i deploy from latest release, not master branch ...

[vjdhama]

The issue is related to missing runAsUser. I tested with it and it works on kind and EKS 1.14.6.

I can send a new PR for the fix.

[vjdhama]

I see, there is already a PR in play.

https://github.com/kubernetes-incubator/metrics-server/pull/337

[scoopex]

to avoid this problem i deploy from latest release, not master branch ...

Yes, that helped. This should be part of the documentation.

$ git clone https://github.com/kubernetes-incubator/metrics-server.git
$ cd metrics-server
$ git checkout v0.3.6
$ kubectl create -f deploy/1.8+/

Unfortunately, metrics server ist started now but does not get metrics.

[lucj]

Is there any updates on this problem ?

[serathius]

https://github.com/kubernetes-sigs/metrics-server/pull/337 was merged

[udit0612]

@serathius i still got the error in the logs E1107 13:30:35.383039 1 manager.go:111] unable to fully collect metrics: unable to fully scrape metrics from source kubelet_summary:k8s-master: unable to fetch metrics from Kubelet

[serathius]

@udit0612 this issue is about not running container as root. Your error looks like problem with mismatch of your cluster and metrics server configuration.

Please look if there is other issue that describes similar problem. I also would be open to help you configure it on k8s slack in #sig-instrumentation channel

[tushi0407]

I am also getting the same issue.But in my case infra is handled by infra team and they make it mandatory to make images as non root user.I am stuck there as i am not sure how i can make my angular app using non root user.Here is my docker file :

FROM docker.com/node:latest as node
WORKDIR /app

COPY . .
RUN npm install

RUN npm build --prod

RUN npm run ng build -- --prod

stage 2 : to run application

FROM docker.com/nginx:alpine
COPY --from=node /app/dist/MyApp /usr/share/nginx/html