Issue with securityContext on Openshift

[mrethers]

Setting nexus.securityContext to {} has no effect. The deployment still gets created with fsGroup: 200. The deployment resource doesn't specify a ServiceAccount to run the pods as so my only option at the moment is to add a new SCC to the default ServiceAccount which is not great.

I installed the operator through the web console by the way.

Thanks

[mparram]

other workaround is to force in the RS, at spec.template.spec.securityContext: {}
but the operator will loop to reconcile without good result.

[rafaeltuelho]

Ran into the same issue on a OPenshift 4 cluster other day...
Getting this error:

pods "example-nexusrepo-sonatype-nexus-577cbb7d77-" is forbidden: unable to validate against any security context constraint: [fsGroup: Invalid value: []int64{2000}: 2000 is not an allowed group]

[rafaeltuelho]

any thought/suggestion here?

[nmousouros]

You can add this SCC and attach it to the service account using nexus. However you will hit the next issue. The operator creates an emptyDir{} mount for the backups. I found no way to persist that and you cannot assign a UID to emptyDir{}. If I remove it from the statefull set the pod will start until it gets overwritten by the operator. Is this github even maintained? I found ZERO support from the developers and this Issue shows the same....

`
apiVersion: security.openshift.io/v1
kind: SecurityContextConstraints
metadata:
name: nexus-scc
fsGroup:
ranges:
- max: 2000
min: 2000
type: MustRunAs
runAsUser:
type: MustRunAs
uid: 2000
seLinuxContext:
type: MustRunAs
supplementalGroups:
ranges:
- max: 2000
min: 2000
type: MustRunAs
volumes:

• persistentVolumeClaim
• secret
  `

[mpuglin]

Hello, in order to get faster response I would like to suggest you checkout http://community.sonatype.com for feature discussion or https://support.sonatype.com for technical support.

[CMYanko]

Not sure how we didn't see this, looking into it

[CMYanko]

For reference:
https://kubernetes.io/docs/tasks/configure-pod-container/security-context/

[davesteinberg]

Is the operator actually the recommended way of installing Nexus on OpenShift 4? Is there another way that does work?

[jflinchbaugh]

We're seeing if people are interested in using the operator, and we intend to fix these issues as they come up.

Alternatively, there are also various sets of helm charts available:

• https://hub.helm.sh/charts/sonatype/nexus-repository-manager
• https://github.com/sonatype-nexus-community/deployment-reference-architecture/tree/master/OpenShift/helm/nexus-repository-manager

[davesteinberg]

Thanks! I'm certainly interested.

Does the Helm chart actually solve the problem on OpenShift? It looks like it's got the same kind of securityContext stuff going on (I haven't tried it yet).

I did find this article last night about using oc new-app (the old OCP way) to deploy, and I gave it a try: https://deepkb.com/CO_000017/en/kb/IMPORT-3e2aaf7b-a315-3156-ae6a-a76f03eca486/setting-up-a-nexus-mirror

It's working so far, though I haven't yet taken a look under the covers.

Update: Yuck, the old approach yielded version 2 of Nexus Repository Manager.

[rafaeltuelho]

I would like to use the Operator. But as it's not working properly I decided to go with the old way using teamplates.

[CMYanko]

does this work in the community operator? We are evaluating absorbing that code.

[rafaeltuelho]

I tested only the Official one from the Red Hat Registry

[worsco]

We're seeing if people are interested in using the operator, and we intend to fix these issues as they come up.

How do you measure interest?
Is it by the number of entries in this issue that report that the Red Hat Certified Operator for Nexus does not work on OpenShift 4?

If so, here's another report that I'm attempting to use the Red Hat Certified Operator for Nexus, and it does not work on OpenShift 4.5.

As a work around, you have change the 2000 to the supplemental group that is assigned to the namespace/project.

For example, if my namespace/project is "aaa-nexus-repo", then  oc get namespace aaa-nexus-repo -o yaml | grep supplemental-groups will return openshift.io/sa.scc.supplemental-groups: 1000620000/10000. I have to replace 2000 with 1000620000 and the instance will deploy.

[worsco]

If you're looking for a nexus operator that is currently maintained by the community that supports route creation as well as a more up-to-date image, try https://github.com/m88i/nexus-operator (also found in the OperatorHub).