1

I just started using OpenShift and have permissions problems. I am on the free trial for OpenShift 4.3.3 and cannot get my containers to run as root. I am the only user on my instance and I have admin, but it says I need cluster-admin to run the containers as root?

I tried running:

oc policy add-role-to-group cluster-admin anyuid

and that returned:

Error from server (Forbidden): rolebindings.rbac.authorization.k8s.io "cluster-admin" is forbidden: user "hustlin" (groups=["system:authenticated:oauth" "system:authenticated"]) is attempting to grant RBAC permissions not currently held:
{APIGroups:["*"], Resources:["*"], Verbs:["*"]}
{NonResourceURLs:["*"], Verbs:["*"]}

Going through OpenShift Online -> Administrator view -> User Management -> Roles -> cluster-admin -> Role Bindings, it states: 

Restricted Access
You don't have access to this section due to cluster policy.
Error details

rolebindings.rbac.authorization.k8s.io is forbidden: User "hustlin" cannot list resource "rolebindings" in API group "rbac.authorization.k8s.io" at the cluster scope

I feel like it should not be this difficult for me to run a container as root. Just testing out OpenShift and I haven't been able to successfully run a single container on the platform, they all eventually go to CrashLoopBackOff.

Yes, I did try the:

oc login -u system:admin

command and it prompted me for my password before returning:

error: username system:admin is invalid for basic auth

I even tried following this guide from the OpenShift blog, but it would not recognize oadm.

Hustlin
  • 71
  • 8
  • "Free trial"...are you referring to OpenShift Online Starter via https://manage.openshift.com? – Will Gordon Mar 19 '20 at 18:39
  • @WillGordon it is the Starter Plan and can be found here: https://www.openshift.com/products/online/ . – Hustlin Mar 19 '20 at 19:09
  • Starter is a multitenant cluster, so there are many users all running on that cluster. It would be a huge security risk to allow users to have `cluster-admin` access. The same reasoning applies for allowing privileged containers. You can refer to the docs (https://docs.openshift.com/container-platform/3.11/creating_images/guidelines.html#openshift-specific-guidelines) on how to create a non-privileged container. – Will Gordon Mar 19 '20 at 20:25

0 Answers0