Rook: openshift: rook ceph toolbox container is not correctly loaded

[kdoustar]

Is this a bug report or feature request?

• Bug Report

You are not a good root in this container:

❯ oc exec -it rook-ceph-tools-6b4889fdfd-kvplc -- bash
bash-4.4$ whoami
1000570000
bash-4.4$ sudo su -
sudo: PERM_SUDOERS: setresuid(-1, 1, -1): Operation not permitted
sudo: no valid sudoers sources found, quitting
sudo: setresuid() [0, 0, 0] -> [1000570000, -1, -1]: Operation not permitted
sudo: unable to initialize policy plugin
bash-4.4$

No history, no change, no nothing

Expected behavior:
To have a correct and complete root access to the toolbox container

How to reproduce it (minimal and precise):

Install an OKD 4.5 or OKD 4.4 cluster and lunch rook-ceph on it and run this command to login to the toolbox container:

oc exec -it -n rook-ceph rook-ceph-tools-6b4889fdfd-kvplc -- bash

Environment:

• OS (e.g. from /etc/os-release):
  OKD 4.5 runs on FCOS 32

• Kernel (e.g. uname -a):
• Cloud provider or hardware configuration: Bare metal nodes
• Rook version (use rook version inside of a Rook Pod): rook: v1.3.0-beta.0.632.gcf28b16
• Storage backend version (e.g. for ceph do ceph -v): ceph version 15.2.4
• Kubernetes version (use kubectl version): v1.18.2-0-g52c56ce
• Kubernetes cluster type (e.g. Tectonic, GKE, OpenShift): OKD 4.5 GA
• Storage backend status (e.g. for Ceph use ceph health in the [Rook Ceph toolbox] (https://rook.io/docs/rook/master/ceph-toolbox.html)): health: HEALTH_OK

[travisn]

@kdoustar The toolbox is not expected to elevate commands, it is just designed to run ceph commands. For an example of a more privileged toolbox, see the direct tools example.

[kdoustar]

But it's much better in a normal kubernetes cluster. For example in a Rancher kubernetes:

rke@inf:~$ kubectl exec -n rook-ceph -it rook-ceph-tools-6d659f5579-fcwjl -- bash
Defaulting container name to rook-ceph-tools.
Use 'kubectl describe pod/rook-ceph-tools-6d659f5579-fcwjl -n rook-ceph' to see all of the containers in this pod.
[root@rook-ceph-tools-6d659f5579-fcwjl /]# whoami
root
[root@rook-ceph-tools-6d659f5579-fcwjl /]#

[travisn]

What commands are you wanting to run as root? The ceph commands don't require root.
If you want to run privileged, you can always add this to the toolbox.yaml. The yamls in the rook repo are just examples.

        securityContext:
          privileged: true