OKD can't update service-ca

[joseluissmarting]

OKD: 4.9.0-0.okd-2022-02-12-140851

Okd web is inaccessible since the "service-ca" is trying to update itself, it gives this error:

oc get pods -n openshift-service-ca service-ca-9d74f7858-thxhc -o yaml | tail
waiting:
message: 'container has runAsNonRoot and image will run as root (pod: "service-ca-9d74f7858-thxhc_openshift-service-ca(d4eb1deb-712d-4f6f-a7ed-71f84f17c59f)",
container: service-ca-controller)'
reason: CreateContainerConfigError

And also, I have other pods that can't mount other secrets, so they are stuck in "ContainerCreating":
126m Warning FailedMount pod/alertmanager-main-0 Unable to attach or mount volumes: unmounted volumes=[tls-assets alertmanager-main-db secret-alertmanager-main-tls secret-alertmanager-main-proxy secret-alertmanager-kube-rbac-proxy alertmanager-trusted-ca-bundle kube-api-access-ltrnw config-volume], unattached volumes=[tls-assets alertmanager-main-db secret-alertmanager-main-tls secret-alertmanager-main-proxy secret-alertmanager-kube-rbac-proxy alertmanager-trusted-ca-bundle kube-api-access-ltrnw config-volume]: timed out waiting for the condition

And I had other issues in kube-apiserver but they are now resolved, although are still pending in "clusteroperators state".

I tried to edit the deployment to use "root" container, but it gets overwrite by okd instantly. The SCC is "restricted" but it allow root containers, but somethings else in OKD don't.

Here you have the must gather logs (too big for here):
https://we.tl/t-gNkEsx9Nez

Thanks you in advance for reading this.
Kind regards

[vrutkovs]

See https://access.redhat.com/solutions/6115601 or https://access.redhat.com/solutions/5875621

[joseluissmarting]

Yes.. I would like to see them, but I don't have a valid red hat account :(

[vrutkovs]

https://developers.redhat.com/articles/faqs-no-cost-red-hat-enterprise-linux.
tl;dr oc adm policy remove-scc-from-group anyuid system:authenticated

[joseluissmarting]

thanks! this was exactly my problem, I had edited the scc "restricted" (my fault) and it was changed and didn't work with that change:
https://access.redhat.com/solutions/6115601

I have to come back to:
runAsUser:
type: MustRunAsRange

Not:
runAsUser:
type: RunAsAny

Now I have to solve other problems hehe, thanks

PD: I can access the post with the no-cost account