<p>I want to deploy <code>pgadmin</code> on a RKE2 Kubernetes cluster to access databases. Unfortunately the <code>pgadmin</code> pod crashes due to PSP issues I think. I know PSP is deprecated and we're planning to switch to OPA soon, but it would be efficient to use <code>pgadmin</code> in the meantime.</p>
<p>The deployment file looks like this:</p>
<pre class="lang-yaml prettyprint-override"><code>apiVersion: apps/v1
kind: Deployment
metadata:
  name: pgadmin
spec:
  selector:
   matchLabels:
    app: pgadmin
  replicas: 1
  template:
    metadata:
      labels:
        app: pgadmin
    spec:
      containers:
        - name: pgadmin4
          image: dpage/pgadmin4:latest
          env:
           - name: PGADMIN_DEFAULT_EMAIL
             value: &quot;test@ind.nl&quot;
           - name: PGADMIN_DEFAULT_PASSWORD
             value: &quot;test&quot;
           - name: PGADMIN_PORT
             value: &quot;80&quot;
          ports:
            - containerPort: 80
              name: pgadminport
          securityContext:
            runAsUser: 0
            runAsGroup: 0
            allowPrivilegeEscalation: true
            readOnlyRootFilesystem: false
---
apiVersion: v1
kind: Service
metadata:
  name: pgadmin
  labels:
    app: pgadmin
spec:
  selector:
   app: pgadmin
  type: NodePort
  ports:
   - port: 80
     nodePort: 30200
</code></pre>
<p>It returns logs with permission issues:</p>
<pre><code>/entrypoint.sh: line 62: /venv/bin/python3: Operation not permitted
sudo: PERM_SUDOERS: setresuid(-1, 1, -1): Operation not permitted
sudo: no valid sudoers sources found, quitting
sudo: error initializing audit plugin sudoers_audit
/entrypoint.sh: line 84: /venv/bin/python3: Operation not permitted
/entrypoint.sh: exec: line 92: /venv/bin/gunicorn: Operation not permitted
</code></pre>
<p>When I edit the <code>runAsUser</code> and <code>runAsGroup</code> variable to 5050, it returns these logs:</p>
<pre><code>/entrypoint.sh: line 62: /venv/bin/python3: Operation not permitted
sudo: unable to change to root gid: Operation not permitted
sudo: error initializing audit plugin sudoers_audit
/entrypoint.sh: line 84: /venv/bin/python3: Operation not permitted
/entrypoint.sh: exec: line 92: /venv/bin/gunicorn: Operation not permitted
</code></pre>
<p>When I edit the <code>runAsGroup</code> variable back to 0, it returns these logs:</p>
<pre><code>/entrypoint.sh: line 62: /venv/bin/python3: Operation not permitted
sudo: PERM_SUDOERS: setresuid(-1, 1, -1): Operation not permitted
sudo: no valid sudoers sources found, quitting
sudo: setresuid() [0, 0, 0] -&gt; [5050, -1, -1]: Operation not permitted
sudo: error initializing audit plugin sudoers_audit
/entrypoint.sh: line 84: /venv/bin/python3: Operation not permitted
/entrypoint.sh: exec: line 92: /venv/bin/gunicorn: Operation not permitted
</code></pre>
<p>UPDATE 1:
The PSP that's being used looks like this:</p>
<pre class="lang-yaml prettyprint-override"><code>apiVersion: policy/v1beta1
kind: PodSecurityPolicy
metadata:
  annotations:
    psp.rke2.io/global-restricted: resolved
  creationTimestamp: &quot;2022-06-30T14:00:25Z&quot;
  name: global-restricted-psp
  resourceVersion: &quot;3493795&quot;
  uid: b7209f38-9609-4b81-b3ef-ab7a17b39bbd
spec:
  allowPrivilegeEscalation: true
  fsGroup:
    ranges:
    - max: 65535
      min: 0
    rule: MustRunAs
  requiredDropCapabilities:
  - ALL
  runAsUser:
    rule: RunAsAny
  seLinux:
    rule: RunAsAny
  supplementalGroups:
    ranges:
    - max: 65535
      min: 0
    rule: MustRunAs
  volumes:
  - configMap
  - emptyDir
  - projected
  - secret
  - downwardAPI
  - persistentVolumeClaim
</code></pre>
<p>Anybody ideas?</p>

Lucas Scheepers
<p>I think what you're misssing here is the configuration to handle persistent-data. I tried the same deployment file as yours and just added the <code>volumes</code> &amp; <code>volumeMounts</code> config, albeit an emptyDir (you might want to persist data though), and it works.</p>
<p>I then use the command</p>
<pre><code>kubectl port-forward pgadmin-6ff557759c-m5cxn 8080:80 
</code></pre>
<p>to be able to access the pg-admin console locally on <code>http://127.0.0.1:8080</code>.</p>
<p>Here's the deployment.yaml file:</p>
<pre><code>apiVersion: apps/v1
kind: Deployment
metadata:
  name: pgadmin
spec:
  selector:
   matchLabels:
    app: pgadmin
  replicas: 1
  template:
    metadata:
      labels:
        app: pgadmin
    spec:
      containers:
        - name: pgadmin4
          image: dpage/pgadmin4:latest
          env:
           - name: PGADMIN_DEFAULT_EMAIL
             value: &quot;test@ind.nl&quot;
           - name: PGADMIN_DEFAULT_PASSWORD
             value: &quot;test&quot;
           - name: PGADMIN_PORT
             value: &quot;80&quot;
          ports:
            - containerPort: 80
              name: pgadminport
          securityContext:
            runAsUser: 5050
            runAsGroup: 5050
            allowPrivilegeEscalation: true
            readOnlyRootFilesystem: false
          volumeMounts:
          - mountPath: /var/lib/pgadmin
            name: pgadmin-data
      volumes:
      - emptyDir: {}
        name: pgadmin-data
</code></pre>
<p>Well, I also changed the <code>runAsUser</code> &amp; <code>runAsGroup</code> to 5050 (taking some inspiration from the helm chart here: <a href="https://artifacthub.io/packages/helm/runix/pgadmin4" rel="nofollow noreferrer">https://artifacthub.io/packages/helm/runix/pgadmin4</a> (it may not be needed though).</p>
<p>Having said that, it'd be a lot easier for you to use a helm-chart as it allows you easily handle config to add <code>PersistentVolume</code> via an existing <code>PersistentVolumeClaim</code> or a <code>storageClass</code>.</p>
<p>Hope this helps!</p>
