bug(operator): KubeArmor daemonset securityContext need proviled for kubearmorConfig to Running
bug
We were using **kubeArmor Operator 1.0.1** and it was working fine. After **upgrading to 1.6.14**, Kubearmor did not work as expected. After investigating the issue, **we found is need privilege setting in daemonset securityContext.**
However, we not found any document about this change. It would be better if you can update the document about this change. We not found parameter to set privilege in kubearmorConfig.
If I didn't set privilege in daemonset securityContext, Kubearmorconfig returns status **Pending**.
Is there another parameter besides Privileged that addresses this problem?
Given this scenario, exists the following options to fix the issue?
**General Information**
- Environment description (`EKS kubernetes 1.34 using bottlerocket`)
- Orchestration system version in use (`v1.34.4-eks-f69f56f`)
- CNI (`Cilium 1.18.1`)
**To Reproduce**
Deployment Kubearmor Operator
```yaml
apiVersion: apps/v1
kind: Deployment
metadata:
labels:
argocd.argoproj.io/instance: kubearmor-dev
kubearmor-app: kubearmor-operator
name: kubearmor-operator
namespace: kubearmor
spec:
selector:
matchLabels:
kubearmor-app: kubearmor-operator
strategy:
rollingUpdate:
maxSurge: 25%
maxUnavailable: 25%
type: RollingUpdate
template:
metadata:
labels:
env: staging
kubearmor-app: kubearmor-operator
managed-by: helm-managed
type: security
spec:
containers:
- args:
- '--annotateExisting=false'
- '--annotateResource=false'
- '--image-pull-secrets=[{"name":"registry-credentials"}]'
env:
- name: KUBEARMOR_OPERATOR_NS
valueFrom:
fieldRef:
apiVersion: v1
fieldPath: metadata.namespace
- name: RELATED_IMAGE_KUBEARMOR_SNITCH
value: >-
container-registry.local/kubearmor:kubearmor-snitch-v1.6.15
- name: RELATED_IMAGE_KUBEARMOR
value: >-
container-registry.local/kubearmor:kubearmor-v1.6.15
- name: RELATED_IMAGE_KUBEARMOR_INIT
value: >-
container-registry.local/kubearmor:kubearmor-init-v1.6.15
- name: RELATED_IMAGE_KUBEARMOR_RELAY_SERVER
value: >-
container-registry.local/kubearmor:kubearmor-relay-server-latest
- name: RELATED_IMAGE_KUBEARMOR_CONTROLLER
value: >-
container-registry.local/kubearmor:kubearmor-controller-v1.6.15
image: >-
container-registry.local/kubearmor:kubearmor-operator-v1.6.15
imagePullPolicy: IfNotPresent
name: kubearmor-operator
resources:
limits:
memory: 256Mi
requests:
cpu: 100m
memory: 128Mi
dnsPolicy: ClusterFirst
imagePullSecrets:
- name: registry-credentials
nodeSelector:
purpose: security
restartPolicy: Always
tolerations:
- effect: NoSchedule
key: security
operator: Exists
```
kubeArmorConfig
```yaml
apiVersion: operator.kubearmor.com/v1
kind: KubeArmorConfig
metadata:
labels:
app.kubernetes.io/created-by: kubearmoroperator
app.kubernetes.io/instance: kubearmorconfig-sample
app.kubernetes.io/managed-by: kustomize
app.kubernetes.io/name: kubearmorconfig
app.kubernetes.io/part-of: kubearmoroperator
argocd.argoproj.io/instance: kubearmor-dev
name: kubearmorconfig-default
namespace: kubearmor
spec:
alertThrottling: true
defaultCapabilitiesPosture: audit
defaultFilePosture: audit
defaultNetworkPosture: audit
defaultVisibility: process,network
enableStdOutAlerts: false
enableStdOutLogs: false
enableStdOutMsgs: false
globalTolerations:
- operator: Exists
matchArgs: true
maxAlertPerSec: 10
seccompEnabled: false
throttleSec: 30
```
**Screenshots**
<img width="526" height="36" alt="Image" src="https://github.com/user-attachments/assets/a128d878-69e3-4cdd-b416-2c755bc1779f" />
关闭于 2026-04-07 0 条评论