Using new container gateway image (with April platform Patch) causes error during boot.

Products

• CA API Gateway

Issue/Introduction

With the latest security patch (10.1.00_20230428 image) the container is failing with the following error below.  It seems that this version has a problem with updating system.properties.

 Warning  FailedPostStartHook  2m34s (x3 over 2m56s)  kubelet            Exec lifecycle hook ([sh -c echo com.l7tech.server.clusterStaleNodeCleanupTimeoutSeconds=3600 >> /opt/SecureSpan/Gateway/node/default/etc/conf/system.properties                                                                                                                                                                                                                                                             ││ ]) for Container "gateway" in Pod "<PodName>" failed - error: command 'sh -c echo com.l7tech.server.clusterStaleNodeCleanupTimeoutSeconds=3600 >> /opt/SecureSpan/Gateway/node/default/etc/conf/system.properties                                                                                                                                                                                                                      ││ ' exited with 1: sh: /opt/SecureSpan/Gateway/node/default/etc/conf/system.properties: Permission denied                                                                                                                                                                                                                                                                                                                                                                                                ││ , message: "sh: /opt/SecureSpan/Gateway/node/default/etc/conf/system.properties: Permission denied\n"                                                                                                                                                                                                                                                                                                                                                                                                  ││   Normal   Killing  2m34s (x3 over 2m56s)  kubelet  FailedPostStartHook                                                                                                                                                                                                                                                                                                                                                                                                                                ││   Warning  BackOff  2m19s (x8 over 2m55s)  kubelet  Back-off restarting failed container

Environment

Release :10.1

Cause

We did make some changes to the permissions in CR3 which seems to cause this , the file can not be updated when the user is not root . 

Resolution

There are some changes in the filesystem permission which prevent the default runasuser to update the file.

To update the file from the shell you can run docker exec -u 0 -it gatewaycontainer .

for kubernetes or Openshift you should change the securityContext to use fsGroup 0 which is the key difference in the new version of the container gateway.

The other suggested solution is to update the system.properties file before the deployment .