deploy Airflow to OpenShift - SCC constraint issue

[BELAGGOUN]

Hello,
I tried to deploy Airflow using, the helm chart and KubernetesExecutor into Openshift Cluster, I'm getting the following error:

Generated from replicaset-controller
15 times in the last 5 minutes
Error creating: pods "airflow-cluster-web-589cdfbf59-" is forbidden: unable to validate against any security context constraint: [provider "anyuid": Forbidden: not usable by user or serviceaccount, provider restricted-v2: .spec.securityContext.fsGroup: Invalid value: []int64{0}: 0 is not an allowed group, spec.initContainers[0].securityContext.runAsUser: Invalid value: 65533: must be in the ranges: [1000660000, 1000669999], spec.initContainers[1].securityContext.runAsUser: Invalid value: 50000: must be in the ranges: [1000660000, 1000669999], spec.initContainers[2].securityContext.runAsUser: Invalid value: 50000: must be in the ranges: [1000660000, 1000669999], spec.containers[0].securityContext.runAsUser: Invalid value: 50000: must be in the ranges: [1000660000, 1000669999], spec.containers[1].securityContext.runAsUser: Invalid value: 65533: must be in the ranges: [1000660000, 1000669999], provider "restricted": Forbidden: not usable by user or serviceaccount, provider "nonroot-v2": Forbidden: not usable by user or serviceaccount, provider "nonroot": Forbidden: not usable by user or serviceaccount, provider "hostmount-anyuid": Forbidden: not usable by user or serviceaccount, provider "machine-api-termination-handler": Forbidden: not usable by user or serviceaccount, provider "hostnetwork-v2": Forbidden: not usable by user or serviceaccount, provider "hostnetwork": Forbidden: not usable by user or serviceaccount, provider "hostaccess": Forbidden: not usable by user or serviceaccount, provider "hostpath-provisioner": Forbidden: not usable by user or serviceaccount, provider "privileged": Forbidden: not usable by user or serviceaccount]

The pods UID/ GID and fsGroup have to be within the range allowed by the Openshift SSC . I m not sure how to perform that and why its not n issue in other projects deployed using helm ?
Can someone help me to fix this issue ? Thank you

[thesuperzapper]

@BELAGGOUN This is because the default value of airflow.defaultSecurityContext contains fsGroup=0), and your openshift admin has disallowed using gid=0 (because they probably mistakenly think that this would give root permissions).

First, to be clear the gid=0 does correspond to the group named root on Linux, BUT having this group does not give root permissions, only the ability to read/write files owned by the root group.

By default, we set this on the chart as Kubernetes will make all mounted volume files owned by gid=0, and then give each pod's user the gid=0 group, which prevents pods from being unable to read/write the volumes.

You will need to set airflow.defaultSecurityContext.fsGroup to a gid that your openshift admin allows (which will vary).

---

Also, you will need to make sure the other uid/gid settings in the chart use values allowed by your openshift admin (which the error log helpfully lists), these are set by the *.image.gid and *.image.gid values in the chart.

[yogeshwariingale]

@BELAGGOUN Please use below command, run it for your serviceaccount used in airflow namespace.
It solves issue

oc adm policy add-scc-to-user anyuid -z serviceAccountname_usedinairflow -n your_airflow_namespace