【OpenShift】define UID using ServiceAccount

Question

【Error Summary】

I am new to RedHat OpenShift.

OpenShift Pod status CrashLoopBackOff.

Pod logs shows “id: cannot find name for user ID 1000660000” and “java.io.FileNotFoundException: ..(Permission denied)”. I tried to solve this problem by changing UID but it doesn’t work.

If the cause is not UID ,it might be access to pvc. Is there any way to check and change pvc?

【Error Reproduction(using OpenShift web console and terminal)】

1.Create OpenShift cluster and project.

2.Add container image from external registry and create deployment.

(Application and component are created at the same time)

At this point the pod was running.

3.Open Deployment page and change Pod number to 0.

4.Remove existing Container Volume.

5.Add storage and create PVC.

6.Change Pod number to 1.

7.Pod is not running and the pod status is CrashLoopBackOff.

8.Create service account “awag-sa” by command below.

   oc create sa awag-sa
 
   oc adm policy add-scc-to-user anyuid-z awag-sa

9.Create patch yaml file “patch-file.yaml” for patching serviceAccount

spec:
  template:
    spec:
      serviceAccountName: awag-sa

10.Patch yaml file to deployment by command below

kubectl patch deployment nexus3-comp --patch "$(cat patch-file.yaml)"

11.Check Deployment yaml file(OpenShift web console) that spec.template.spec.serviceAccountName is modified correctly. But the pod status is still CrashLoopBackOff .

…
spec:
  replicas: 0
  selector:
    matchLabels:
      app: nexus3-comp
  template:
    metadata:
      creationTimestamp: null
      labels:
        app: nexus3-comp
        deploymentconfig: nexus3-comp
      annotations:
        openshift.io/generated-by: OpenShiftWebConsole
    spec:
      restartPolicy: Always
      serviceAccountName: awag-sa
      schedulerName: default-scheduler
      terminationGracePeriodSeconds: 30
      securityContext: {}
      containers:
        - name: nexus3-comp

…

SYN SYN · Accepted Answer · 2021-07-10T14:42:30

OpenShift would use "random" UIDs -- relative to your Project / Namespace, there's an annotation telling you which UID was allocated to your Project. Unless otherwise configured, your containers would run as that UID.

If your application somehow needs a working getpwnam / resolution from UID to user name, then you want to use nsswrapper.

Make sure it is installed, in your Dockerfile

apt-get install libnss-wrapper
yum install nss_wrapper

Then, in your entrypoint, load your own passwd / groups:

RUNTIME_USER=${RUNTIME_USER:-nexus}
RUNTIME_GROUP=${RUNTIME_GROUP:-$RUNTIME_USER}
RUNTIME_HOME=${RUNTIME_HOME:-/tmp}
echo Setting up nsswrapper mapping `id -u` to $RUNTIME_GROUP
(
    grep -v ^$RUNTIME_USER /etc/passwd
    echo "$RUNTIME_USER:x:`id -u`:`id -g`:$RUNTIME_USER:$RUNTIME_HOME:/usr/sbin/nologin"
) >/tmp/java-passwd
(
    grep -v ^$RUNTIME_GROUP /etc/group
    echo "$RUNTIME_GROUP:x:`id -g`:"
) >/tmp/java-group
export NSS_WRAPPER_PASSWD=/tmp/java-passwd
export NSS_WRAPPER_GROUP=/tmp/java-group
export LD_PRELOAD=/usr/lib/libnss_wrapper.so
# or /usr/lib64/libnss_wrapper.so, on EL x86_64

[rest of your entrypoint.sh -- eg: exec $@]

edit: actually, nexus doesn't care -- though previous notes would still apply, if a container crashes complaining about some missing UID.

I can't reproduce the message you're getting. As far as I've seen nexus would first crash, failing to write logs. Then its data. Fixed it both times adding a volume:

oc create deploy nexus --image=sonatype/nexus3
oc edit deploy/nexus
[...]
    volumeMounts:
    - mountPath: /opt/sonatype/nexus3/log
      name: empty
      subPath: log
    - mountPath: /nexus-data
      name: empty
      subPath: data
...
  volumes:
  - emptyDir: {}
    name: empty

Now, in your case, /nexus-data should probably be stored in a PVC, rather than some emptyDir. Either way, adding those two volumes fixed it:

# oc logs -f nexus-f7c577ff9-pqmdc
id: cannot find name for user ID 1000230000
2021-07-10 16:36:48,155+0000 INFO  [FelixStartLevel] *SYSTEM org.sonatype.nexus.pax.logging.NexusLogActivator - start
2021-07-10 16:36:49,184+0000 INFO  [FelixStartLevel] *SYSTEM org.sonatype.nexus.features.internal.FeaturesWrapper - Fast FeaturesService starting
2021-07-10 16:36:53,004+0000 INFO  [FelixStartLevel] *SYSTEM ROOT - bundle org.apache.felix.scr:2.1.26 (63) Starting with globalExtender setting: false
2021-07-10 16:36:53,038+0000 INFO  [FelixStartLevel] *SYSTEM ROOT - bundle org.apache.felix.scr:2.1.26 (63)  Version = 2.1.26
...

【OpenShift】define UID using ServiceAccount

2 Answers