Add missing service accounts and etcd metadata capability to OpenShift SCC #292
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Signed-off-by: Dom Del Nano <ddelnano@gmail.com>
✅ Deploy Preview for docs-px-dev ready!
To edit notification comments on pull requests, go to your Netlify site configuration. |
Signed-off-by: Dom Del Nano <ddelnano@gmail.com>
ddelnano
changed the title
1 task
aimichelle
approved these changes
Dec 23, 2024
aimichelle
pushed a commit
to pixie-io/pixie
that referenced
this pull request
Dec 23, 2024
#2069) Summary: Ensure etcd stateful set has required capabilities to run on OpenShift When using the etcd metadata store on an Openshift cluster, the container gets stuck in its start up script and continuously prints the following error. ``` Waiting for pl-etcd-1.pl-etcd.pl to come up ping: permission denied (are you root?) Waiting for pl-etcd-1.pl-etcd.pl to come up ping: permission denied (are you root?) ``` The etcd stateful set requires an additional capability, which was missed when the other services had stricter security context settings added. This change also requires the following `SecurityContextConstraints` changes (pixie-io/docs.px.dev#292) Relevant Issues: N/A Type of change: /kind bug Test Plan: Deployed the non-operator version of Pixie to an Openshift cluster and verified etcd is scheduled now - [x] Verified etcd metadata deployment with these changes works on GKE cluster Changelog Message: Fixed an issue where the etcd metadata store wouldn't schedule on Openshift clusters Signed-off-by: Dom Del Nano <ddelnano@gmail.com>
ddelnano
added a commit
to ddelnano/pixie
that referenced
this pull request
Aug 6, 2025
pixie-io#2069) Summary: Ensure etcd stateful set has required capabilities to run on OpenShift When using the etcd metadata store on an Openshift cluster, the container gets stuck in its start up script and continuously prints the following error. ``` Waiting for pl-etcd-1.pl-etcd.pl to come up ping: permission denied (are you root?) Waiting for pl-etcd-1.pl-etcd.pl to come up ping: permission denied (are you root?) ``` The etcd stateful set requires an additional capability, which was missed when the other services had stricter security context settings added. This change also requires the following `SecurityContextConstraints` changes (pixie-io/docs.px.dev#292) Relevant Issues: N/A Type of change: /kind bug Test Plan: Deployed the non-operator version of Pixie to an Openshift cluster and verified etcd is scheduled now - [x] Verified etcd metadata deployment with these changes works on GKE cluster Changelog Message: Fixed an issue where the etcd metadata store wouldn't schedule on Openshift clusters Signed-off-by: Dom Del Nano <ddelnano@gmail.com> GitOrigin-RevId: 73c8340
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Summary: Add missing service accounts and etcd metadata capability to OpenShift SCC
Someone from the community had trouble deploying the non-operator version of Pixie on Openshift. The
NET_RAWcapability is needed in order to have the etcd metadata store work properly. I also realized that these service accounts were missing from the SCC. I haven't seen a case where it has prevented Pixie from working, but I think it's best to include them to avoid future issues.