"Unable to validate against any security context constraint" obtained when trying to deploy CA SiteMinder 12.9.0 in Openshift containers

Products

• SITEMINDER

Issue/Introduction

Trying to deploy CA SiteMinder 12.9.0 in containers in the Openshift platform there are the following errors:

20s         Warning   FailedCreate        replicaset/policyserver-siteminder-policy-server-f7c87d9d       Error creating: pods "policyserver-siteminder-policy-server-f7c87d9d-" is forbidden: unable to validate against any security context constraint: [provider "anyuid": Forbidden: not usable by user or serviceaccount, spec.volumes[2]: Invalid value: "hostPath": hostPath volumes are not allowed to be used, provider "nonroot-v2": Forbidden: not usable by user or serviceaccount, provider "nonroot": Forbidden: not usable by user or serviceaccount, provider "hostmount-anyuid": Forbidden: not usable by user or serviceaccount, provider "hostmount-anyuid-v2": Forbidden: not usable by user or serviceaccount, provider "machine-api-termination-handler": Forbidden: not usable by user or serviceaccount, provider "hostnetwork-v2": Forbidden: not usable by user or serviceaccount, provider "hostnetwork": Forbidden: not usable by user or serviceaccount, provider "hostaccess": Forbidden: not usable by user or serviceaccount, provider "node-exporter": Forbidden: not usable by user or serviceaccount, provider "privileged": Forbidden: not usable by user or serviceaccount, provider "velero-privileged": Forbidden: not usable by user or serviceaccount]

Environment

CA SiteMinder 12.9 in containers, Openshift platform

May be valid for other container platforms as well

Cause

This is due to incorrectly specified uid and guid which fall outside the namespace defined

Resolution

Get the UID, GUID and fsGroup that the containers should be running as by running the following:

kubectl get ns ${SERVER_NAMESPACE} -o yaml

Then export them as variables before running helm upgrade again:

export SMSERVER_UID=<uid>

export SMSERVER_GID=<gid>

export SMSERVER_FSGROUP=<gid>

 

and finally make sure that the values hereby specified are also the ones present in the values.yaml file under the following entries:

 

global.securityContext.runAsUser

global.securityContext.runAsGroup

global.securityContext.fsGroup