ITADN

bug(operator): KubeArmor daemonset securityContext need proviled for kubearmorConfig to Running

#2529Closedrafael-tomelin 创建于 2026-04-06
bug
R
rafael-tomelincommented
We were using **kubeArmor Operator 1.0.1** and it was working fine. After **upgrading to 1.6.14**, Kubearmor did not work as expected. After investigating the issue, **we found is need privilege setting in daemonset securityContext.** However, we not found any document about this change. It would be better if you can update the document about this change. We not found parameter to set privilege in kubearmorConfig. If I didn't set privilege in daemonset securityContext, Kubearmorconfig returns status **Pending**. Is there another parameter besides Privileged that addresses this problem? Given this scenario, exists the following options to fix the issue? **General Information** - Environment description (`EKS kubernetes 1.34 using bottlerocket`) - Orchestration system version in use (`v1.34.4-eks-f69f56f`) - CNI (`Cilium 1.18.1`) **To Reproduce** Deployment Kubearmor Operator ```yaml apiVersion: apps/v1 kind: Deployment metadata: labels: argocd.argoproj.io/instance: kubearmor-dev kubearmor-app: kubearmor-operator name: kubearmor-operator namespace: kubearmor spec: selector: matchLabels: kubearmor-app: kubearmor-operator strategy: rollingUpdate: maxSurge: 25% maxUnavailable: 25% type: RollingUpdate template: metadata: labels: env: staging kubearmor-app: kubearmor-operator managed-by: helm-managed type: security spec: containers: - args: - '--annotateExisting=false' - '--annotateResource=false' - '--image-pull-secrets=[{"name":"registry-credentials"}]' env: - name: KUBEARMOR_OPERATOR_NS valueFrom: fieldRef: apiVersion: v1 fieldPath: metadata.namespace - name: RELATED_IMAGE_KUBEARMOR_SNITCH value: >- container-registry.local/kubearmor:kubearmor-snitch-v1.6.15 - name: RELATED_IMAGE_KUBEARMOR value: >- container-registry.local/kubearmor:kubearmor-v1.6.15 - name: RELATED_IMAGE_KUBEARMOR_INIT value: >- container-registry.local/kubearmor:kubearmor-init-v1.6.15 - name: RELATED_IMAGE_KUBEARMOR_RELAY_SERVER value: >- container-registry.local/kubearmor:kubearmor-relay-server-latest - name: RELATED_IMAGE_KUBEARMOR_CONTROLLER value: >- container-registry.local/kubearmor:kubearmor-controller-v1.6.15 image: >- container-registry.local/kubearmor:kubearmor-operator-v1.6.15 imagePullPolicy: IfNotPresent name: kubearmor-operator resources: limits: memory: 256Mi requests: cpu: 100m memory: 128Mi dnsPolicy: ClusterFirst imagePullSecrets: - name: registry-credentials nodeSelector: purpose: security restartPolicy: Always tolerations: - effect: NoSchedule key: security operator: Exists ``` kubeArmorConfig ```yaml apiVersion: operator.kubearmor.com/v1 kind: KubeArmorConfig metadata: labels: app.kubernetes.io/created-by: kubearmoroperator app.kubernetes.io/instance: kubearmorconfig-sample app.kubernetes.io/managed-by: kustomize app.kubernetes.io/name: kubearmorconfig app.kubernetes.io/part-of: kubearmoroperator argocd.argoproj.io/instance: kubearmor-dev name: kubearmorconfig-default namespace: kubearmor spec: alertThrottling: true defaultCapabilitiesPosture: audit defaultFilePosture: audit defaultNetworkPosture: audit defaultVisibility: process,network enableStdOutAlerts: false enableStdOutLogs: false enableStdOutMsgs: false globalTolerations: - operator: Exists matchArgs: true maxAlertPerSec: 10 seccompEnabled: false throttleSec: 30 ``` **Screenshots** <img width="526" height="36" alt="Image" src="https://github.com/user-attachments/assets/a128d878-69e3-4cdd-b416-2c755bc1779f" />
关闭于 2026-04-07 0 条评论