Skip to content

Unable to deploy runtime-enforcer with open-shift 4.22 cluster #775

Open
Bug
Open
Unable to deploy runtime-enforcer with open-shift 4.22 cluster#775
Bug
Labels
bugSomething isn't working

Description

@venkateshjayagopal
venkateshjayagopal
opened on Jul 24, 2026

Is there an existing issue for this?

  • I have searched the existing issues

Environment

- OS: Red Hat 11.5.0-14
- Architecture: x86
- Cluster: OC 4.22 cluster

Issue Description

  • Expected behavior: Unable to deploy runtime-enforcer using HELM. Followed quick start guide to deploy.
  • Current behavior: Observing multiple ERRORs while deploying cert-manager and runtime-enforcer using HELM
  • Steps to reproduce:
  • Install HELM
  • Deploy cert-manager using below command,
[neuvector@master0 runtime-enforcer]$ helm install cert-manager jetstack/cert-manager \
        --namespace cert-manager \
        --create-namespace \
        --set crds.enabled=true \
        --wait

NAME: cert-manager
LAST DEPLOYED: Fri Jul 24 17:36:41 2026
NAMESPACE: cert-manager
STATUS: deployed
REVISION: 1
DESCRIPTION: Install complete
TEST SUITE: None
NOTES:
cert-manager v1.21.0 has been deployed successfully!

In order to begin issuing certificates, you will need to set up a ClusterIssuer
or Issuer resource (for example, by creating a 'letsencrypt-staging' issuer).

More information on the different types of issuers and how to configure them
can be found in our documentation:

https://cert-manager.io/docs/configuration/

For information on how to configure cert-manager to automatically provision
Certificates for Ingress resources, take a look at the `ingress-shim`
documentation:

https://cert-manager.io/docs/usage/ingress/

For information on how to configure cert-manager to automatically provision
Certificates for Gateway API resources, take a look at the `gateway resource`
documentation:

https://cert-manager.io/docs/usage/gateway/

Deploy cert-manager-csi-driver using HELM

[neuvector@master0 ~]$ helm install cert-manager-csi-driver jetstack/cert-manager-csi-driver \
        --namespace cert-manager \
        --wait
I0724 17:27:49.109980 3535459 warnings.go:107] "Warning: would violate PodSecurity \"restricted:latest\": privileged (container \"cert-manager-csi-driver\" must not set securityContext.privileged=true), allowPrivilegeEscalation != false (container \"cert-manager-csi-driver\" must set securityContext.allowPrivilegeEscalation=false), restricted volume types (volumes \"plugin-dir\", \"pods-mount-dir\", \"registration-dir\", \"csi-data-dir\" use restricted volume type \"hostPath\"), runAsNonRoot != true (pod or containers \"node-driver-registrar\", \"liveness-probe\", \"cert-manager-csi-driver\" must set securityContext.runAsNonRoot=true), runAsUser=0 (containers \"node-driver-registrar\", \"liveness-probe\", \"cert-manager-csi-driver\" must not set runAsUser=0)"
NAME: cert-manager-csi-driver
LAST DEPLOYED: Fri Jul 24 17:27:48 2026
NAMESPACE: cert-manager
STATUS: deployed
REVISION: 1
DESCRIPTION: Install complete
TEST SUITE: None
[neuvector@master0 ~]$ kubectl get pods -n cert-manager
NAME                                       READY   STATUS    RESTARTS   AGE
cert-manager-8fcb9d456-kxxrz               1/1     Running   0          54s
cert-manager-cainjector-85c8bf6d8b-kwm72   1/1     Running   0          54s
cert-manager-csi-driver-cxn8h              3/3     Running   0          16s
cert-manager-csi-driver-mzffc              3/3     Running   0          16s
cert-manager-webhook-85d7d5497-bqpzd       1/1     Running   0          54s

Now try deploying runtime-enforcer using HELM,

[neuvector@master0 runtime-enforcer]$ helm install runtime-enforcer ./ --namespace runtime-enforcer --set controller.image.tag=latest,agent.image.tag=latest,controller.image.pullPolicy=Always,agent.image.pullPolicy=Always
I0724 17:53:13.005874 3562622 warnings.go:107] "Warning: would violate PodSecurity \"restricted:latest\": forbidden AppArmor profile (pod must not set AppArmor profile type to \"Unconfined\"), host namespaces (hostPID=true), seLinuxOptions (pod set forbidden securityContext.seLinuxOptions: type \"spc_t\"), unrestricted capabilities (container \"agent\" must not include \"BPF\", \"PERFMON\", \"SYS_PTRACE\", \"SYS_RESOURCE\" in securityContext.capabilities.add), restricted volume types (volume \"nri-socket\" uses restricted volume type \"hostPath\"), runAsNonRoot != true (pod must not set securityContext.runAsNonRoot=false)"
Error: INSTALLATION FAILED: server-side apply failed for object runtime-enforcer/runtime-enforcer-agent apps/v1, Kind=DaemonSet: daemonsets.apps "runtime-enforcer-agent" is forbidden: runtime-enforcer-agent uses an inline volume provided by CSIDriver csi.cert-manager.io and namespace runtime-enforcer has a pod security enforce level that is lower than privileged
server-side apply failed for object runtime-enforcer/runtime-enforcer-controller-manager apps/v1, Kind=Deployment: deployments.apps "runtime-enforcer-controller-manager" is forbidden: runtime-enforcer-controller-manager uses an inline volume provided by CSIDriver csi.cert-manager.io and namespace runtime-enforcer has a pod security enforce level that is lower than privileged
server-side apply failed for object runtime-enforcer/runtime-enforcer-otel-collector apps/v1, Kind=Deployment: deployments.apps "runtime-enforcer-otel-collector" is forbidden: runtime-enforcer-otel-collector uses an inline volume provided by CSIDriver csi.cert-manager.io and namespace runtime-enforcer has a pod security enforce level that is lower than privileged

I had enforced pod-security.kubernetes.io/enforce=privileged to both cert-manager and runtime-enforcer namespace.

kubectl label namespace cert-manager pod-security.kubernetes.io/enforce=privileged --overwrite
kubectl label namespace runtime-enforcer pod-security.kubernetes.io/enforce=privileged --overwrite

Then I tried to deploy the cert-manager, csi-driver and runtime-enforcer again, but the not pods were deployed for runtime-enforcer,

[neuvector@master0 runtime-enforcer]$ helm install runtime-enforcer ./ --namespace runtime-enforcer --set controller.image.tag=latest,agent.image.tag=latest,controller.image.pullPolicy=Always,agent.image.pullPolicy=Always
I0724 17:55:01.527761 3564259 warnings.go:107] "Warning: would violate PodSecurity \"restricted:latest\": forbidden AppArmor profile (pod must not set AppArmor profile type to \"Unconfined\"), host namespaces (hostPID=true), seLinuxOptions (pod set forbidden securityContext.seLinuxOptions: type \"spc_t\"), unrestricted capabilities (container \"agent\" must not include \"BPF\", \"PERFMON\", \"SYS_PTRACE\", \"SYS_RESOURCE\" in securityContext.capabilities.add), restricted volume types (volume \"nri-socket\" uses restricted volume type \"hostPath\"), runAsNonRoot != true (pod must not set securityContext.runAsNonRoot=false)"
I0724 17:55:01.527789 3564259 warnings.go:107] "Warning: runtime-enforcer-agent uses an inline volume provided by CSIDriver csi.cert-manager.io and namespace runtime-enforcer has a pod security warn level that is lower than privileged"
I0724 17:55:01.545242 3564259 warnings.go:107] "Warning: runtime-enforcer-controller-manager uses an inline volume provided by CSIDriver csi.cert-manager.io and namespace runtime-enforcer has a pod security warn level that is lower than privileged"
I0724 17:55:01.545690 3564259 warnings.go:107] "Warning: runtime-enforcer-otel-collector uses an inline volume provided by CSIDriver csi.cert-manager.io and namespace runtime-enforcer has a pod security warn level that is lower than privileged"
NAME: runtime-enforcer
LAST DEPLOYED: Fri Jul 24 17:55:00 2026
NAMESPACE: runtime-enforcer
STATUS: deployed
REVISION: 1
DESCRIPTION: Install complete
TEST SUITE: None
[neuvector@master0 runtime-enforcer]$
[neuvector@master0 runtime-enforcer]$
[neuvector@master0 runtime-enforcer]$ kubectl get pods -n runtime-enforcer
No resources found in runtime-enforcer namespace.
[neuvector@master0 runtime-enforcer]$ helm list -A
NAME                    NAMESPACE               REVISION        UPDATED                                 STATUS          CHART                           APP VERSION
cert-manager            cert-manager            1               2026-07-24 17:36:41.700755251 +0000 UTC deployed        cert-manager-v1.21.0            v1.21.0
cert-manager-csi-driver cert-manager            1               2026-07-24 17:52:36.479068172 +0000 UTC deployed        cert-manager-csi-driver-v0.15.0 v0.15.0
runtime-enforcer        runtime-enforcer        1               2026-07-24 17:55:00.920800495 +0000 UTC deployed        runtime-enforcer-0.1.9          v0.7.0
[neuvector@master0 runtime-enforcer]$ kubectl get pods -n runtime-enforcer
No resources found in runtime-enforcer namespace.
[neuvector@master0 runtime-enforcer]$ kubectl describe ns runtime-enforcer
Name:         runtime-enforcer
Labels:       kubernetes.io/metadata.name=runtime-enforcer
              name=runtime-enforcer
              pod-security.kubernetes.io/audit=restricted
              pod-security.kubernetes.io/audit-version=latest
              pod-security.kubernetes.io/enforce=privileged
              pod-security.kubernetes.io/warn=restricted
              pod-security.kubernetes.io/warn-version=latest
Annotations:  openshift.io/sa.scc.mcs: s0:c27,c24
              openshift.io/sa.scc.supplemental-groups: 1000750000/10000
              openshift.io/sa.scc.uid-range: 1000750000/10000
              security.openshift.io/MinimallySufficientPodSecurityStandard: restricted
Status:       Active

No resource quota.

No LimitRange resource.
[neuvector@master0 runtime-enforcer]$ kubectl describe deployment runtime-enforcer-agent
Error from server (NotFound): deployments.apps "runtime-enforcer-agent" not found
[neuvector@master0 runtime-enforcer]$ kubectl describe deployment runtime-enforcer-agent -n runtime-enforcer
Error from server (NotFound): deployments.apps "runtime-enforcer-agent" not found
[neuvector@master0 runtime-enforcer]$ helm list -A
NAME                    NAMESPACE               REVISION        UPDATED                                 STATUS          CHART                           APP VERSION
cert-manager            cert-manager            1               2026-07-24 17:36:41.700755251 +0000 UTC deployed        cert-manager-v1.21.0            v1.21.0
cert-manager-csi-driver cert-manager            1               2026-07-24 17:52:36.479068172 +0000 UTC deployed        cert-manager-csi-driver-v0.15.0 v0.15.0
runtime-enforcer        runtime-enforcer        1               2026-07-24 17:55:00.920800495 +0000 UTC deployed        runtime-enforcer-0.1.9          v0.7.0
[neuvector@master0 runtime-enforcer]$ kubectl get pods -n runtime-enforcer
No resources found in runtime-enforcer namespace.
[neuvector@master0 runtime-enforcer]$ oc get deployment
No resources found in neuvector namespace.
[neuvector@master0 runtime-enforcer]$ oc get deployment -n runtime-enforcer
NAME                                  READY   UP-TO-DATE   AVAILABLE   AGE
runtime-enforcer-controller-manager   0/1     0            0           6m35s
runtime-enforcer-otel-collector       0/1     0            0           6m35s
[neuvector@master0 runtime-enforcer]$ oc get replicaset
-n runtime-enforcer
No resources found in neuvector namespace.
-bash: -n: command not found
[neuvector@master0 runtime-enforcer]$ oc get replicaset -n runtime-enforcer
NAME                                             DESIRED   CURRENT   READY   AGE
runtime-enforcer-controller-manager-599786f94f   1         0         0       6m58s
runtime-enforcer-otel-collector-dc7cc8fcb        1         0         0       6m58s
[neuvector@master0 runtime-enforcer]$ oc describe deployment runtime-enforcer-controller-manager -n runtime-enforcer
Name:                   runtime-enforcer-controller-manager
Namespace:              runtime-enforcer
CreationTimestamp:      Fri, 24 Jul 2026 17:55:01 +0000
Labels:                 app.kubernetes.io/instance=runtime-enforcer
                        app.kubernetes.io/managed-by=Helm
                        app.kubernetes.io/name=runtime-enforcer
                        app.kubernetes.io/version=v0.7.0
                        control-plane=controller-manager
                        helm.sh/chart=runtime-enforcer-0.1.9
Annotations:            deployment.kubernetes.io/revision: 1
                        meta.helm.sh/release-name: runtime-enforcer
                        meta.helm.sh/release-namespace: runtime-enforcer
Selector:               app.kubernetes.io/component=controller,app.kubernetes.io/instance=runtime-enforcer,app.kubernetes.io/name=runtime-enforcer
Replicas:               1 desired | 0 updated | 0 total | 0 available | 1 unavailable
StrategyType:           RollingUpdate
MinReadySeconds:        0
RollingUpdateStrategy:  25% max unavailable, 25% max surge
Pod Template:
  Labels:           app.kubernetes.io/component=controller
                    app.kubernetes.io/instance=runtime-enforcer
                    app.kubernetes.io/managed-by=Helm
                    app.kubernetes.io/name=runtime-enforcer
                    app.kubernetes.io/version=v0.7.0
                    helm.sh/chart=runtime-enforcer-0.1.9
  Annotations:      kubectl.kubernetes.io/default-container: manager
  Service Account:  runtime-enforcer-controller-manager
  Containers:
   manager:
    Image:      ghcr.io/rancher-sandbox/runtime-enforcer/controller:latest
    Port:       <none>
    Host Port:  <none>
    Command:
      /controller
    Args:
      --wp-status-reconciler-agent-grpc-port=50051
      --wp-status-reconciler-update-interval=30s
      --wp-status-reconciler-agent-label-selector=app.kubernetes.io/component=agent,app.kubernetes.io/instance=runtime-enforcer,app.kubernetes.io/name=runtime-enforcer
      --wp-status-reconciler-agent-grpc-mtls-cert-dir=/etc/runtime-enforcer/certs
      --log-level=info
      --metrics-bind-address=:8443
      --leader-elect
      --health-probe-bind-address=:8081
    Limits:
      cpu:     250m
      memory:  256Mi
    Requests:
      cpu:      250m
      memory:   256Mi
    Liveness:   http-get http://:8081/healthz delay=15s timeout=1s period=20s #success=1 #failure=3
    Readiness:  http-get http://:8081/readyz delay=5s timeout=1s period=10s #success=1 #failure=3
    Environment:
      KUBERNETES_CLUSTER_DOMAIN:       cluster.local
      OTEL_EXPORTER_OTLP_ENDPOINT:     https://runtime-enforcer-otel-collector.runtime-enforcer.svc.cluster.local:4317
      OTEL_EXPORTER_OTLP_PROTOCOL:     grpc
      OTEL_EXPORTER_OTLP_CERTIFICATE:  /etc/runtime-enforcer/certs/ca.crt
    Mounts:
      /etc/runtime-enforcer/certs from grpc-certs (ro)
      /tmp/k8s-webhook-server/serving-certs/ from webhook-certs (ro)
  Volumes:
   webhook-certs:
    Type:              CSI (a Container Storage Interface (CSI) volume source)
    Driver:            csi.cert-manager.io
    FSType:
    ReadOnly:          true
    VolumeAttributes:      csi.cert-manager.io/dns-names=runtime-enforcer-controller-webhook.runtime-enforcer.svc
                           csi.cert-manager.io/issuer-kind=Issuer
                           csi.cert-manager.io/issuer-name=runtime-enforcer-ca
   grpc-certs:
    Type:               CSI (a Container Storage Interface (CSI) volume source)
    Driver:             csi.cert-manager.io
    FSType:
    ReadOnly:           true
    VolumeAttributes:       csi.cert-manager.io/dns-names=runtime-enforcer-controller
                            csi.cert-manager.io/issuer-kind=Issuer
                            csi.cert-manager.io/issuer-name=runtime-enforcer-ca
  Priority Class Name:  runtime-enforcer-priorityclass
  Node-Selectors:       <none>
  Tolerations:          <none>
Conditions:
  Type             Status  Reason
  ----             ------  ------
  Progressing      True    NewReplicaSetCreated
  Available        False   MinimumReplicasUnavailable
  ReplicaFailure   True    FailedCreate
OldReplicaSets:    <none>
NewReplicaSet:     runtime-enforcer-controller-manager-599786f94f (0/1 replicas created)
Events:
  Type    Reason             Age    From                   Message
  ----    ------             ----   ----                   -------
  Normal  ScalingReplicaSet  7m16s  deployment-controller  Scaled up replica set runtime-enforcer-controller-manager-599786f94f from 0 to 1
[neuvector@master0 runtime-enforcer]$ kubectl get pods -n runtime-enforcer
No resources found in runtime-enforcer namespace.
[neuvector@master0 runtime-enforcer]$ oc describe rs runtime-enforcer-controller-manager-599786f94f
Error from server (NotFound): replicasets.apps "runtime-enforcer-controller-manager-599786f94f" not found
[neuvector@master0 runtime-enforcer]$ oc describe rs runtime-enforcer-controller-manager-599786f94f -n runtime-enforcer
Name:           runtime-enforcer-controller-manager-599786f94f
Namespace:      runtime-enforcer
Selector:       app.kubernetes.io/component=controller,app.kubernetes.io/instance=runtime-enforcer,app.kubernetes.io/name=runtime-enforcer,pod-template-hash=599786f94f
Labels:         app.kubernetes.io/component=controller
                app.kubernetes.io/instance=runtime-enforcer
                app.kubernetes.io/managed-by=Helm
                app.kubernetes.io/name=runtime-enforcer
                app.kubernetes.io/version=v0.7.0
                helm.sh/chart=runtime-enforcer-0.1.9
                pod-template-hash=599786f94f
Annotations:    deployment.kubernetes.io/desired-replicas: 1
                deployment.kubernetes.io/max-replicas: 2
                deployment.kubernetes.io/revision: 1
                meta.helm.sh/release-name: runtime-enforcer
                meta.helm.sh/release-namespace: runtime-enforcer
Controlled By:  Deployment/runtime-enforcer-controller-manager
Replicas:       0 current / 1 desired
Pods Status:    0 Running / 0 Waiting / 0 Succeeded / 0 Failed
Pod Template:
  Labels:           app.kubernetes.io/component=controller
                    app.kubernetes.io/instance=runtime-enforcer
                    app.kubernetes.io/managed-by=Helm
                    app.kubernetes.io/name=runtime-enforcer
                    app.kubernetes.io/version=v0.7.0
                    helm.sh/chart=runtime-enforcer-0.1.9
                    pod-template-hash=599786f94f
  Annotations:      kubectl.kubernetes.io/default-container: manager
  Service Account:  runtime-enforcer-controller-manager
  Containers:
   manager:
    Image:      ghcr.io/rancher-sandbox/runtime-enforcer/controller:latest
    Port:       <none>
    Host Port:  <none>
    Command:
      /controller
    Args:
      --wp-status-reconciler-agent-grpc-port=50051
      --wp-status-reconciler-update-interval=30s
      --wp-status-reconciler-agent-label-selector=app.kubernetes.io/component=agent,app.kubernetes.io/instance=runtime-enforcer,app.kubernetes.io/name=runtime-enforcer
      --wp-status-reconciler-agent-grpc-mtls-cert-dir=/etc/runtime-enforcer/certs
      --log-level=info
      --metrics-bind-address=:8443
      --leader-elect
      --health-probe-bind-address=:8081
    Limits:
      cpu:     250m
      memory:  256Mi
    Requests:
      cpu:      250m
      memory:   256Mi
    Liveness:   http-get http://:8081/healthz delay=15s timeout=1s period=20s #success=1 #failure=3
    Readiness:  http-get http://:8081/readyz delay=5s timeout=1s period=10s #success=1 #failure=3
    Environment:
      KUBERNETES_CLUSTER_DOMAIN:       cluster.local
      OTEL_EXPORTER_OTLP_ENDPOINT:     https://runtime-enforcer-otel-collector.runtime-enforcer.svc.cluster.local:4317
      OTEL_EXPORTER_OTLP_PROTOCOL:     grpc
      OTEL_EXPORTER_OTLP_CERTIFICATE:  /etc/runtime-enforcer/certs/ca.crt
    Mounts:
      /etc/runtime-enforcer/certs from grpc-certs (ro)
      /tmp/k8s-webhook-server/serving-certs/ from webhook-certs (ro)
  Volumes:
   webhook-certs:
    Type:              CSI (a Container Storage Interface (CSI) volume source)
    Driver:            csi.cert-manager.io
    FSType:
    ReadOnly:          true
    VolumeAttributes:      csi.cert-manager.io/dns-names=runtime-enforcer-controller-webhook.runtime-enforcer.svc
                           csi.cert-manager.io/issuer-kind=Issuer
                           csi.cert-manager.io/issuer-name=runtime-enforcer-ca
   grpc-certs:
    Type:               CSI (a Container Storage Interface (CSI) volume source)
    Driver:             csi.cert-manager.io
    FSType:
    ReadOnly:           true
    VolumeAttributes:       csi.cert-manager.io/dns-names=runtime-enforcer-controller
                            csi.cert-manager.io/issuer-kind=Issuer
                            csi.cert-manager.io/issuer-name=runtime-enforcer-ca
  Priority Class Name:  runtime-enforcer-priorityclass
  Node-Selectors:       <none>
  Tolerations:          <none>
Conditions:
  Type             Status  Reason
  ----             ------  ------
  ReplicaFailure   True    FailedCreate
Events:
  Type     Reason        Age                   From                   Message
  ----     ------        ----                  ----                   -------
  Warning  FailedCreate  25s (x18 over 8m37s)  replicaset-controller  Error creating: pods "runtime-enforcer-controller-manager-599786f94f-" is forbidden: unable to validate against any security context constraint: [provider "anyuid": Forbidden: not usable by user or serviceaccount, provider restricted-v2: .containers[0].runAsUser: Invalid value: 1000: must be in the ranges: [1000750000, 1000759999], provider restricted-v3: .spec.hostUsers: Invalid value: null: Host Users must be set to false, provider "restricted": Forbidden: not usable by user or serviceaccount, provider "nested-container": Forbidden: not usable by user or serviceaccount, provider "nonroot-v2": Forbidden: not usable by user or serviceaccount, provider "nonroot": Forbidden: not usable by user or serviceaccount, provider "neuvector-scc-controller": Forbidden: not usable by user or serviceaccount, provider "neuvector-scanner": Forbidden: not usable by user or serviceaccount, provider "hostmount-anyuid": Forbidden: not usable by user or serviceaccount, provider "hostmount-anyuid-v2": Forbidden: not usable by user or serviceaccount, provider "machine-api-termination-handler": Forbidden: not usable by user or serviceaccount, provider "hostnetwork-v2": Forbidden: not usable by user or serviceaccount, provider "hostnetwork": Forbidden: not usable by user or serviceaccount, provider "hostaccess": Forbidden: not usable by user or serviceaccount, provider "insights-runtime-extractor-scc": Forbidden: not usable by user or serviceaccount, provider "node-exporter": Forbidden: not usable by user or serviceaccount, provider "privileged": Forbidden: not usable by user or serviceaccount]
[neuvector@master0 runtime-enforcer]$ ^C
[neuvector@master0 runtime-enforcer]$
[neuvector@master0 runtime-enforcer]$
[neuvector@master0 runtime-enforcer]$

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't working

    Type

    Bug

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions