helm charts are not compatible with OpenShift

[stvno]

$ helm install strmprivacy helm --values values.yaml --namespace strmprivacy

W0620 14:37:31.727825    2400 warnings.go:70] would violate PodSecurity "restricted:v1.24": allowPrivilegeEscalation != false (container "create" must set securityContext.allowPrivilegeEscalation=false), unrestricted capabilities (container "create" must set securityContext.capabilities.drop=["ALL"]), seccompProfile (pod or container "create" must set securityContext.seccompProfile.type to "RuntimeDefault" or "Localhost")
Error: INSTALLATION FAILED: failed pre-install: timed out waiting for the condition

OpenShift has strict security policies and it seems the helm charts don't comply currently

[bvdeenen]

@stvno could you run the same command with --debug added, so we know which pod manifests trigger the error? It might be one of our manifests, or also a pod in one of the dependencies like Redis, Kafka etc.

[stvno]

$ helm install strmprivacy helm --values values.yaml --namespace strmprivacy --debug
install.go:193: [debug] Original chart version: ""
install.go:210: [debug] CHART PATH: C:\Users\rijks\Documents\strm\data-plane-helm-chart\helm

client.go:133: [debug] creating 1 resource(s)
install.go:152: [debug] CRD alertmanagerconfigs.monitoring.coreos.com is already present. Skipping.
client.go:133: [debug] creating 1 resource(s)
install.go:152: [debug] CRD alertmanagers.monitoring.coreos.com is already present. Skipping.
client.go:133: [debug] creating 1 resource(s)
install.go:152: [debug] CRD podmonitors.monitoring.coreos.com is already present. Skipping.
client.go:133: [debug] creating 1 resource(s)
install.go:152: [debug] CRD probes.monitoring.coreos.com is already present. Skipping.
client.go:133: [debug] creating 1 resource(s)
install.go:152: [debug] CRD prometheuses.monitoring.coreos.com is already present. Skipping.
client.go:133: [debug] creating 1 resource(s)
install.go:152: [debug] CRD prometheusrules.monitoring.coreos.com is already present. Skipping.
client.go:133: [debug] creating 1 resource(s)
install.go:152: [debug] CRD servicemonitors.monitoring.coreos.com is already present. Skipping.
client.go:133: [debug] creating 1 resource(s)
install.go:152: [debug] CRD thanosrulers.monitoring.coreos.com is already present. Skipping.
client.go:477: [debug] Starting delete for "strmprivacy-prometheus-admission" ServiceAccount
client.go:133: [debug] creating 1 resource(s)
client.go:477: [debug] Starting delete for "strmprivacy-prometheus-admission" ClusterRole
client.go:133: [debug] creating 1 resource(s)
client.go:477: [debug] Starting delete for "strmprivacy-prometheus-admission" ClusterRoleBinding
client.go:133: [debug] creating 1 resource(s)
client.go:477: [debug] Starting delete for "strmprivacy-prometheus-admission" Role
client.go:133: [debug] creating 1 resource(s)
client.go:477: [debug] Starting delete for "strmprivacy-prometheus-admission" RoleBinding
client.go:133: [debug] creating 1 resource(s)
client.go:477: [debug] Starting delete for "strmprivacy-prometheus-admission-create" Job
client.go:133: [debug] creating 1 resource(s)
W0620 17:17:44.212237 4588 warnings.go:70] would violate PodSecurity "restricted:v1.24": allowPrivilegeEscalation != false (container "create" must set securityContext.allowPrivilegeEscalation=false), unrestricted capabilities (container "create" must set securityContext.capabilities.drop=["ALL"]), seccompProfile (pod or container "create" must set securityContext.seccompProfile.type to "RuntimeDefault" or "Localhost")
client.go:703: [debug] Watching for changes to Job strmprivacy-prometheus-admission-create with timeout of 5m0s
client.go:731: [debug] Add/Modify event for strmprivacy-prometheus-admission-create: ADDED
client.go:770: [debug] strmprivacy-prometheus-admission-create: Jobs active: 0, jobs failed: 0, jobs succeeded: 0
client.go:731: [debug] Add/Modify event for strmprivacy-prometheus-admission-create: MODIFIED
client.go:770: [debug] strmprivacy-prometheus-admission-create: Jobs active: 0, jobs failed: 0, jobs succeeded: 0