[RHOCP 4.x] No capabilities were dropped for a pod when using `requiredDropCapabilities= ALL`
Issue
- While trying to drop all capabilities of a pod, in the RHOCP v4.6 or v4.7 cluster, no capabilities were getting dropped.
// In RHOCP v4.6 and v4.7 no capabilities were dropped as can be seen from the "Current and Bounding set"
$ oc exec -it <pod-name> -- capsh --print
Current: = cap_chown,cap_dac_override,cap_fowner,cap_fsetid,cap_setpcap,cap_net_bind_service+i
Bounding set =cap_chown,cap_dac_override,cap_fowner,cap_fsetid,cap_setpcap,cap_net_bind_service
.
.
// In RHOCP v4.9 and v4.9, the capabilities were dropped as expected when using `requiredDropCapabilities= ALL`
$ oc exec -it <pod-name> -- capsh --print
Current: = <<<<<<<< Pod Capabilities were dropped
Bounding set = <<<<<<<< Pod Capabilities were dropped
.
.
- The
requiredDropCapabilities= allis working in RHOCP v4.8 and v4.9 and not working in RHOCP v4.6 and v4.7
Environment
- Red Hat OpenShift Container Platform
- 4.x
Subscriber exclusive content
A Red Hat subscription provides unlimited access to our knowledgebase, tools, and much more.