executor error: pods xxx is forbidden: unable to validate against any security context constraint: []

[h4wkmoon]

Hi,

I'm just posting because I'm not sure it's a bug yet.
I'm running Argo on OCP4.6

the main tasks of the workflows work as planned, but the container "wait" always fails with :

time="2021-02-26T15:15:11.751Z" level=info msg="Annotating pod with output"
time="2021-02-26T15:15:11.766Z" level=error msg="executor error: pods "dag-diamond-example-3569244516" is forbidden: unable to validate against any security context constraint: []"
time="2021-02-26T15:15:11.766Z" level=info msg="Killing sidecars"
time="2021-02-26T15:15:11.769Z" level=info msg="Alloc=6977 TotalAlloc=16959 Sys=71360 NumGC=6 Goroutines=9"
time="2021-02-26T15:15:11.783Z" level=fatal msg="pods "dag-diamond-example-3569244516" is forbidden: unable to validate against any security context constraint: []"

The service account used is admin of the namespace.
What am I missing ?

[h4wkmoon]

I tried by setting the serviceaccount that runs the job as cluster-admin, and it works.

Obviously, this is not going the be ok for a multi teams production.

Does anyone know the correct role needed ?

[alexec]

https://github.com/argoproj/argo-workflows/blob/master/manifests/namespace-install/workflow-controller-rbac/workflow-controller-role.yaml

[h4wkmoon]

Hi,
sorry to be so dump, or at least noob.

I've created this namespaced role, in the argo ns.
The default sa in the ns has been granted this role.
Same issue.

What am I missing ? RTFM is a valid answer, but I can't find the "FM".

[h4wkmoon]

Using the default sa, given the role, I managed to manualy annotate the argo-server pod. This validates that the sa can actually annotate pods in the ns.
But, when it comes to annotating the job pod, the same error pops.

The only difference I can find is the annotation :

• for the argp-serer pod :
  openshift.io/scc: restricted
• for the job pods :
  openshift.io/scc: anyuid
  I can't see why the pods are created with this annotation. And even more, I don't want the scc anyuid to be a prerequisite for workflows.

I keep searching.
Regards,
Fred.

[h4wkmoon]

I did a bit of cleaning up on the previous installation of argo workflows.
And a fresh install.

Giving the role mentionned above is enough to make the workflow works.
Closing discussion.