You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@airflow.apache.org by "tjedynak (via GitHub)" <gi...@apache.org> on 2025/12/15 08:19:41 UTC
[I] [Helm Chart 1.18.0][OpenShift] rbac.createSCCRoleBinding anyuid RoleBinding missing api-server & dag-processor ServiceAccounts -> pods rejected by SCC (restricted-v2), release fails/times out [airflow]
tjedynak opened a new issue, #59433:
URL: https://github.com/apache/airflow/issues/59433
### Official Helm Chart version
1.18.0 (latest released)
### Apache Airflow version
3.1.5
### Kubernetes Version
Server Version: v1.31.5
### Helm Chart configuration
# Official Airflow Helm chart
chartVersion: 1.18.0
rbac:
create: true
createSCCRoleBinding: true
# Components enabled include:
# - api-server (Deployment + ServiceAccount)
# - dag-processor (Deployment + ServiceAccount)
#
# OpenShift namespace uses default SCC admission (restricted-v2).
# No custom SCCs were assigned manually.
### Docker Image customizations
We use a custom Airflow docker image based on Apache Airflow.
However, the issue is not specific to our code: it is an OpenShift SCC admission failure caused by the SCC RoleBinding created by the chart missing component ServiceAccounts (api-server, dag-processor). Without the anyuid SCC binding applied to those SAs, pods are evaluated against restricted-v2 and rejected due to fixed UIDs (e.g. 50000 for Airflow, 65533 for git-sync) and fsGroup=0.
### What happened
Installing the Helm chart on OpenShift fails / times out because some pods cannot be created due to SCC admission errors.
The chart creates a RoleBinding:
- kind: RoleBinding
- roleRef: ClusterRole `system:openshift:scc:anyuid`
…but the subjects list does NOT include ServiceAccounts for:
- `epis-orchestration-airflow-api-server`
- `epis-orchestration-airflow-dag-processor`
As a result, ReplicaSets for api-server and dag-processor fail to create pods with errors like:
- `provider "anyuid": Forbidden: not usable by user or serviceaccount`
- `restricted-v2: runAsUser 50000 must be in the ranges: [<project-uid-range>]`
- `restricted-v2: fsGroup 0 is not an allowed group`
- for dag-processor also: `runAsUser 65533` (git-sync) rejected by restricted-v2
This blocks the installation and results in:
`failed post-install ... timed out waiting for the condition`.
### What you think should happen instead
When `rbac.createSCCRoleBinding=true`, the chart should include *all enabled component ServiceAccounts* in the OpenShift SCC RoleBinding to `system:openshift:scc:anyuid`.
At minimum (when those components are enabled / SAs exist), the RoleBinding subjects should include:
- `ServiceAccount: epis-orchestration-airflow-api-server`
- `ServiceAccount: epis-orchestration-airflow-dag-processor`
This would allow pods to be admitted on OpenShift without manual SCC/RBAC workarounds.
### How to reproduce
1. Use an OpenShift cluster (tested on OpenShift 4.18.1) with default SCC admission (restricted-v2) in the target namespace.
2. Install Airflow Helm chart `1.18.0` with:
- `rbac.create=true`
- `rbac.createSCCRoleBinding=true`
- with api-server and dag-processor enabled (Deployments & ServiceAccounts are created).
3. Observe that the chart-created RoleBinding `epis-orchestration-airflow-scc-rolebinding` contains subjects:
- webserver, worker, scheduler, triggerer, migrate-database-job, create-user-job
but is missing:
- api-server, dag-processor
4. ReplicaSets for api-server and dag-processor fail pod creation due to SCC admission errors.
5. Workaround: manually create an additional RoleBinding to `system:openshift:scc:anyuid` for the missing ServiceAccounts; then pods can be created.
### Anything else
_No response_
### Are you willing to submit PR?
- [ ] Yes I am willing to submit a PR!
### Code of Conduct
- [x] I agree to follow this project's [Code of Conduct](https://github.com/apache/airflow/blob/main/CODE_OF_CONDUCT.md)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] [Helm Chart 1.18.0][OpenShift] rbac.createSCCRoleBinding anyuid RoleBinding missing api-server & dag-processor ServiceAccounts -> pods rejected by SCC (restricted-v2), release fails/times out [airflow]
Posted by "boring-cyborg[bot] (via GitHub)" <gi...@apache.org>.
boring-cyborg[bot] commented on issue #59433:
URL: https://github.com/apache/airflow/issues/59433#issuecomment-3654363894
Thanks for opening your first issue here! Be sure to follow the issue template! If you are willing to raise PR to address this issue please do so, no need to wait for approval.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] [Helm Chart 1.18.0][OpenShift] rbac.createSCCRoleBinding anyuid RoleBinding missing api-server & dag-processor ServiceAccounts -> pods rejected by SCC (restricted-v2), release fails/times out [airflow]
Posted by "shahar1 (via GitHub) via commits" <co...@airflow.apache.org>.
shahar1 commented on issue #59433:
URL: https://github.com/apache/airflow/issues/59433#issuecomment-6686452465
Solved by https://github.com/apache/airflow/pull/57985
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] [Helm Chart 1.18.0][OpenShift] rbac.createSCCRoleBinding anyuid RoleBinding missing api-server & dag-processor ServiceAccounts -> pods rejected by SCC (restricted-v2), release fails/times out [airflow]
Posted by "shahar1 (via GitHub) via commits" <co...@airflow.apache.org>.
shahar1 closed issue #59433: [Helm Chart 1.18.0][OpenShift] rbac.createSCCRoleBinding anyuid RoleBinding missing api-server & dag-processor ServiceAccounts -> pods rejected by SCC (restricted-v2), release fails/times out
URL: https://github.com/apache/airflow/issues/59433
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] [Helm Chart 1.18.0][OpenShift] rbac.createSCCRoleBinding anyuid RoleBinding missing api-server & dag-processor ServiceAccounts -> pods rejected by SCC (restricted-v2), release fails/times out [airflow]
Posted by "NewtonChutney (via GitHub)" <gi...@apache.org>.
NewtonChutney commented on issue #59433:
URL: https://github.com/apache/airflow/issues/59433#issuecomment-3959666546
I just tried the 1.19 helm chart on an openshift cluster, on a new project(aka a namespace), and I faced this error after deploying with both `rbac.create` `rbac.createSCCRoleBinding` set to true..
```
create Pod airflow-postgresql-0 in StatefulSet airflow-postgresql failed error: pods "airflow-postgresql-0" is forbidden: unable to validate against any security context constraint:
[
provider "anyuid": Forbidden: not usable by user or serviceaccount,
provider restricted-v2: .spec.securityContext.fsGroup: Invalid value: []int64{1001}: 1001 is not an allowed group,
provider restricted-v2: .containers[0].runAsUser: Invalid value: 1001: must be in the ranges: [1001750000, 1001759999],
provider restricted: .spec.securityContext.fsGroup: Invalid value: []int64{1001}: 1001 is not an allowed group,
provider restricted: .containers[0].runAsUser: Invalid value: 1001: must be in the ranges: [1001750000, 1001759999], pod.metadata.annotations[container.seccomp.security.alpha.kubernetes.io/postgresql]: Forbidden: seccomp may not be set,
provider "nonroot-v2": Forbidden: not usable by user or serviceaccount,
provider "nonroot": Forbidden: not usable by user or serviceaccount,
provider "hostmount-anyuid": Forbidden: not usable by user or serviceaccount,
provider "elasticsearch-scc": Forbidden: not usable by user or serviceaccount,
provider "hostmount-anyuid-v2": Forbidden: not usable by user or serviceaccount,
provider "machine-api-termination-handler": Forbidden: not usable by user or serviceaccount,
provider "hostnetwork-v2": Forbidden: not usable by user or serviceaccount,
provider "hostnetwork": Forbidden: not usable by user or serviceaccount,
provider "hostaccess": Forbidden: not usable by user or serviceaccount,
provider "splunkforwarder": Forbidden: not usable by user or serviceaccount,
provider "node-exporter": Forbidden: not usable by user or serviceaccount,
provider "privileged": Forbidden: not usable by user or serviceaccount
]
```
I'm new to Openshift, and haven't worked with helm charts as much..
Does the above mean the cluster is more restricted and the helm chart is fine?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] [Helm Chart 1.18.0][OpenShift] rbac.createSCCRoleBinding anyuid RoleBinding missing api-server & dag-processor ServiceAccounts -> pods rejected by SCC (restricted-v2), release fails/times out [airflow]
Posted by "andreahlert (via GitHub)" <gi...@apache.org>.
andreahlert commented on issue #59433:
URL: https://github.com/apache/airflow/issues/59433#issuecomment-3866539273
This has been fixed on `main` by #57985, which added the missing SCC RoleBinding subjects for `api-server` and `redis`. The `dag-processor` ServiceAccount is also already included (conditionally, when `dagProcessor.enabled` is set).
The fix should ship with Helm Chart 1.19.0, which is currently in RC testing (#61268).
As a workaround for 1.18.0, you can manually create an additional RoleBinding targeting the missing ServiceAccounts (as you already mentioned).
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org