SKUPPER-1069 - skupper init fails on non-OpenShift clusters

If you create a site on a non-OpenShift cluster you might encounter a problem creating sites, with skupper status reporting pending.

If you check the pods, you might see status similar to the following:

$ kubectl get pods
NAME                                         READY   STATUS                       RESTARTS   AGE
skupper-router-698478664c-6xq72              0/2     CreateContainerConfigError   0          17s
skupper-service-controller-698c785d7-dqc8m   0/1     CreateContainerConfigError   0          10s

To confirm you are encountering this problem, search for a Kubernetes event similar to the following:

$ kubectl get events| grep Warning

Warning  Failed          17m (x4 over 17m)     kubelet            Error: container has runAsNonRoot and image will run as root

Workaround

Specify a user id as follows:

$ skupper init --run-as-user 2000

where 2000 is the id of the user you want to run the containers. You can assign any non-zero number as id.

If you are creating sites using YAML, you specify the user in the data section:

  data:
    name: my-site
    run-as-user: "2000"

SKUPPER-869 - Enable idle connection timeouts for the TCP transport

If an endpoint is terminated, for example a client is killed, the other endpoint observes a half-closed connection. If the other endpoint does not close the connection or attempt to send data to the connection, the Skupper router does not release the memory allocated to that connection

Workaround

Avoid client server configurations that use this behavior if possible. For example, if a server automatically closes dormant connections, or attempts to communicate with client, the Skupper router frees the memory when a client is terminated.

SKUPPER-805 - skupper init doesn’t work for ordinary user on OCP 3.11

Workaround

Two workarounds are available:

---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: skupper-non-admin
rules:
- apiGroups:
  - ""
  resources:
  - configmaps
  - pods
  - pods/exec
  - services
  - secrets
  - serviceaccounts
  verbs:
  - get
  - list
  - watch
  - create
  - update
  - delete
- apiGroups:
  - apps
  resources:
  - deployments
  - statefulsets
  - daemonsets
  verbs:
  - get
  - list
  - watch
  - create
  - update
  - delete
- apiGroups:
  - route.openshift.io
  resources:
  - routes
  verbs:
  - get
  - list
  - watch
  - create
  - delete
- apiGroups:
  - networking.k8s.io
  resources:
  - ingresses
  - networkpolicies
  verbs:
  - get
  - list
  - watch
  - create
  - delete
- apiGroups:
  - projectcontour.io
  resources:
  - httpproxies
  verbs:
  - get
  - list
  - watch
  - create
  - delete
- apiGroups:
  - rbac.authorization.k8s.io
  resources:
  - rolebindings
  - roles
  verbs:
  - get
  - list
  - watch
  - create
  - delete

You can save the YAML above to role.yaml, apply it and bind the role to a username using:

$ oc apply -f role.yaml
$  oc policy add-role-to-user skupper-non-admin <username> -n <namespace-name> --role-namespace=<namespace-name>