Repository navigation
FBC registry pod init container missing SecurityContext when using --security-context-config=restricted #7039
Description
Bug Report
What did you do?
Ran operator-sdk run bundle with --security-context-config=restricted to deploy a bundle on a cluster with PodSecurity set to restricted.
operator-sdk run bundle ttl.sh/oadp-operator-bundle-f509f50a:1h --security-context-config=restrictedWhat did you expect to see?
The registry pod should be created successfully with proper security context settings on all containers.
What did you see instead?
INFO[0012] Creating a File-Based Catalog of the bundle "ttl.sh/oadp-operator-bundle-f509f50a:1h"
INFO[0014] Generated a valid File-Based Catalog
FATA[0015] Failed to run bundle: create catalog: error creating registry pod: error creating pod: pods "ttl-sh-oadp-operator-bundle-f509f50a-1h" is forbidden: violates PodSecurity "restricted:latest": allowPrivilegeEscalation != false (container "registry-grpc-init" must set securityContext.allowPrivilegeEscalation=false), unrestricted capabilities (container "registry-grpc-init" must set securityContext.capabilities.drop=["ALL"])
Root Cause
In internal/olm/operator/registry/fbcindex/fbc_registry_pod.go, when SecurityContext == "restricted", the security context is only applied to:
- Pod level (
f.pod.Spec.SecurityContext) - Main container (
f.pod.Spec.Containers[0].SecurityContext)
The init container registry-grpc-init (added via addGZIPInitContainer()) is never given a SecurityContext.
Proposed Fix
After setting the security context on the main container, also apply it to all init containers:
// Update all init containers with the same restrictive security context
for i := range f.pod.Spec.InitContainers {
f.pod.Spec.InitContainers[i].SecurityContext = restrictedSecurityContext
}Environment
- operator-sdk version: v1.38.0 / master
- Kubernetes cluster with PodSecurity
restricted:latest
Related Issues
This is a continuation of #6430, which was auto-closed due to inactivity but the bug was never fixed. That issue covered multiple security context problems; this issue is specifically scoped to the init container (registry-grpc-init) missing security context settings.
Activity
Add restrictive security context to registry pod and init containers
Add restrictive security context to registry pod and init containers
kaovilai commentedon Jan 16, 2026
As reported on openshift/oadp-operator#2067 by @weshayutin
Add restrictive security context to registry pod and init containers
openshift-bot commentedon Apr 17, 2026
Issues go stale after 90d of inactivity.
Mark the issue as fresh by commenting
/remove-lifecycle stale.Stale issues rot after an additional 30d of inactivity and eventually close.
Exclude this issue from closing by commenting
/lifecycle frozen.If this issue is safe to close now please do so with
/close./lifecycle stale
openshift-ci commentedon May 17, 2026
Stale issues rot after 30d of inactivity.
Mark the issue as fresh by commenting
/remove-lifecycle rotten.Rotten issues close after an additional 30d of inactivity.
Exclude this issue from closing by commenting
/lifecycle frozen.If this issue is safe to close now please do so with
/close./lifecycle rotten
/remove-lifecycle stale
kaovilai commentedon May 17, 2026
Unstale
openshift-ci commentedon Jun 17, 2026
Rotten issues close after 30d of inactivity.
Reopen the issue by commenting
/reopen.Mark the issue as fresh by commenting
/remove-lifecycle rotten.Exclude this issue from closing again by commenting
/lifecycle frozen./close not-planned
openshift-ci commentedon Jun 17, 2026
@openshift-ci[bot]: Closing this issue, marking it as "Not Planned".
Details
In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.