11.0CR01 not able to boot on OpenShift

Products

• CA API Gateway

Issue/Introduction

Trying to update one of our environment from 11.0 to 11.0CR01.

Error we get:

Starting Liquibase at 14:16:04 (version 4.5.0 #52 built at 2021-09-27 16:19+0000)Liquibase: Update has been successful./opt/docker/entrypoint.sh: line 241: /opt/SecureSpan/Gateway/node/default/etc/bootstrap/bundle/010_update_cluster_host.xml.req.bundle: Permission deniedRunning preboot script /opt/docker/rc.d/002-load-service-account-token.sh/opt/docker/rc.d/002-load-service-account-token.sh: line 4: /opt/SecureSpan/Gateway/node/default/etc/bootstrap/bundle/02_update_service_account_token.xml.req.bundle: Permission deniedERROR - Failed executing the script: /opt/docker/rc.d/002-load-service-account-token.sh

From 11.0CR01 POD:

bash-4.2$ iduid=1000780000(1000780000) gid=0(root) groups=0(root),1000780000bash-4.2$  ls -l /opt/SecureSpan/Gateway/node/default/etc/bootstrap/total 0drwxr-xrwt. 1 root root 17 Aug 17 17:35 bundle......bash-4.2$ touch /opt/SecureSpan/Gateway/node/default/etc/bootstrap/bundle/foobartouch: cannot touch ‘/opt/SecureSpan/Gateway/node/default/etc/bootstrap/bundle/foobar’: Permission denied

From 11.0 POD:

bash-4.2$ iduid=1000780000(1000780000) gid=0(root) groups=0(root),1000780000bash-4.2$ ls -l /opt/SecureSpan/Gateway/node/default/etc/bootstrap/total 0drwxrwx---. 1 root root 117 Jul 25 09:58 bundle......bash-4.2$ touch /opt/SecureSpan/Gateway/node/default/etc/bootstrap/bundle/foobarbash-4.2$

 

Environment

Release : 11.0

Resolution

Gateway 11.0 CR1 does not start on Openshift 

bash-4.2$ iduid=1000780000(1000780000) gid=0(root) groups=0(root),1000780000bash-4.2$  ls -l /opt/SecureSpan/Gateway/node/default/etc/bootstrap/total 0drwxr-xrwt. 1 root root 17 Aug 17 17:35 bundle......bash-4.2$ touch /opt/SecureSpan/Gateway/node/default/etc/bootstrap/bundle/foobartouch: cannot touch ‘/opt/SecureSpan/Gateway/node/default/etc/bootstrap/bundle/foobar’: Permission denied

Client created a specific SCC on openshift, which is then bound to a serviceaccount.