<p>Pod doesn't start. Pod is not shown by  <code>oc(kubectl) get pods</code> command.</p>
<p>Error summary:</p>
<p>Type       :      Status : Reason</p>
<p>Progressing    :  True   : NewReplicaSetAvailable</p>
<p>Available       : False :  MinimumReplicasUnavailable</p>
<p>ReplicaFailure :  True  :  FailedCreate</p>
<p>Deployment YAML file:</p>
<pre><code>kind: Deployment
apiVersion: apps/v1
metadata:
  annotations:
    deployment.kubernetes.io/revision: '2'
  selfLink: &gt;-
    /apis/apps/v1/namespaces/awag-project/deployments/integrated-repository-webapp
  resourceVersion: '3460356'
  name: integrated-repository-webapp
 
 ...

status:
  observedGeneration: 10
  unavailableReplicas: 1
  conditions:
    - type: Progressing
      status: 'True'
       ...
      reason: NewReplicaSetAvailable
      message: &gt;-
        ReplicaSet &quot;integrated-repository-webapp-d69879c5f&quot; has successfully
        progressed.
    - type: Available
      status: 'False'
      ...
      reason: MinimumReplicasUnavailable
      message: Deployment does not have minimum availability.
    - type: ReplicaFailure
      status: 'True'
      ...
      reason: FailedCreate
      message: &gt;-
        pods &quot;integrated-repository-webapp-d69879c5f-&quot; is forbidden: unable to
        validate against any security context constraint:
        [spec.containers[0].securityContext.containers[0].hostPort: Invalid
        value: 80: Host ports are not allowed to be used
        spec.containers[0].securityContext.containers[0].hostPort: Invalid
        value: 443: Host ports are not allowed to be used]
</code></pre>
<p>Describe deployment command message:</p>
<pre><code>Name:                   integrated-repository-webapp
Namespace:              awag-project
CreationTimestamp:      Tue, 13 Jul 2021 00:31:31 +0900
Labels:                 &lt;none&gt;
Annotations:            deployment.kubernetes.io/revision: 2
Selector:               app=integrated-repository-webapp
Replicas:               1 desired | 0 updated | 0 total | 0 available | 1 unavailable
StrategyType:           RollingUpdate
MinReadySeconds:        0
RollingUpdateStrategy:  25% max unavailable, 25% max surge
Pod Template:
  Labels:  app=integrated-repository-webapp
  Containers:
   integrated-repository-webapp:
    Image:       jp.icr.io/etp-namespace/integrated-repository
    Ports:       9080/TCP, 9443/TCP
    Host Ports:  80/TCP, 443/TCP
    Environment Variables from:
      integrated-repository-webapp-config  ConfigMap  Optional: false
    Environment:
   ...
    Mounts:                                              &lt;none&gt;
  Volumes:                                               &lt;none&gt;
Conditions:
  Type             Status  Reason
  ----             ------  ------
  Progressing      True    NewReplicaSetAvailable
  Available        False   MinimumReplicasUnavailable
  ReplicaFailure   True    FailedCreate
OldReplicaSets:    &lt;none&gt;
NewReplicaSet:     integrated-repository-webapp-d69879c5f (0/1 replicas created)
Events:
  Type    Reason             Age                From                   Message
  ----    ------             ----               ----                   -------
  Normal  ScalingReplicaSet  63m                deployment-controller  Scaled up replica set integrated-repository-webapp-f9cd69684 to 2
  Normal  ScalingReplicaSet  63m                deployment-controller  Scaled down replica set integrated-repository-webapp-f9cd69684 to 1
  Normal  ScalingReplicaSet  51m (x3 over 66m)  deployment-controller  Scaled up replica set integrated-repository-webapp-f9cd69684 to 1
  Normal  ScalingReplicaSet  17m (x3 over 53m)  deployment-controller  Scaled down replica set integrated-repository-webapp-f9cd69684 to 0
  Normal  ScalingReplicaSet  17m                deployment-controller  Scaled down replica set integrated-repository-webapp-d69879c5f to 0
  Normal  ScalingReplicaSet  17m (x2 over 18m)  deployment-controller  Scaled up replica set integrated-repository-webapp-d69879c5f to 1

</code></pre>
<hr />
<p>Edited 1</p>
<p>To start pod by root user  I created a ServiceAccount and attached to deployment.
Pod changed to pending status but not running.
Port error seems to be resolved but it is not Available due to  MinimumReplicasUnavailable.</p>
<p>1.Error Reproduction:</p>
<p>Create Service Account &quot;ir-sa&quot;</p>
<p>oc create sa ir-sa</p>
<p>oc adm policy add-scc-to-user privileged-z ir-sa</p>
<p>patch to deployment</p>
<pre><code>spec:
template:
  spec:
    serviceAccountName: ir-sa
</code></pre>
<p>2.Deployment YAML file:</p>
<pre><code>conditions:
   - type: Progressing
     status: 'True'
     ...
     reason: NewReplicaSetAvailable
     message: &gt;-
       ReplicaSet &quot;integrated-repository-webapp-76c767549&quot; has successfully
       progressed.
   - type: Available
     status: 'False'
     ...
     reason: MinimumReplicasUnavailable
     message: Deployment does not have minimum availability.

</code></pre>
<p>3.describe pod command output</p>
<pre><code> Type     Reason                  Age                    From               Message
  ----     ------                  ----                   ----               -------
  Normal   Scheduled               5m46s                  default-scheduler  Successfully assigned awag-project/integrated-repository-webapp-76c767549-rrbcx to 10.244.0.11
  Normal   AddedInterface          5m46s                  multus             Add eth0 [172.17.20.41/32]
  Warning  FailedCreatePodSandBox  5m45s                  kubelet            Failed to create pod sandbox: rpc error: code = Unknown desc = failed to add hostport mapping for sandbox k8s_integrated-repository-webapp-76c767549-rrbcx_awag-project_07f11210-f70e-4553-b598-862b101eb57a_0(61bf202c0bd3423444ec64e8f50a9a1aa2cdf173fe9a638e31a3113ec8775eed): cannot open hostport 443 for pod k8s_integrated-repository-webapp-76c767549-rrbcx_awag-project_07f11210-f70e-4553-b598-862b101eb57a_0_: listen tcp4 :443: bind: address already in use
  Normal   AddedInterface          5m44s                  multus             Add eth0 [172.17.20.56/32]
…

  Warning  FailedCreatePodSandBox  44s (x141 over 5m27s)  kubelet            (combined from similar events): Failed to create pod sandbox: rpc error: code = Unknown desc = failed to add hostport mapping for sandbox k8s_integrated-repository-webapp-76c767549-rrbcx_awag-project_07f11210-f70e-4553-b598-862b101eb57a_0(d47342c920507c8e9c65c3afd808caec4f73524d5c08b76ab2dc0db0b1004453): cannot open hostport 443 for pod k8s_integrated-repository-webapp-76c767549-rrbcx_awag-project_07f11210-f70e-4553-b598-862b101eb57a_0_: listen tcp4 :443: bind: address already in use

</code></pre>
<hr />
<p>Edited 2</p>
<p>I added Ingress and changed deployment's port to 444.
Pod is still pending status but the reason changed to ImagePullBackOff.</p>
<p><strong>1.Create Ingress</strong></p>
<p>kubectl get ingress command output
(acutual ingeress-subdomain is edited to INGRESS-SUBDOMAIN)</p>
<pre><code>NAME                                   CLASS    HOSTS                                                                                              ADDRESS   PORTS     AGE
integrated-repository-webapp-ingress   &lt;none&gt;   INGRESS-SUBDOMAIN            80, 443   24h
</code></pre>
<p><strong>2.Change deployment’s port 443 to 444</strong></p>
<p>Deployent YAML(spec.template.spec.ports)</p>
<pre><code>   ports:
            - hostPort: 80
              containerPort: 9080
              protocol: TCP
            - hostPort: 444←(it was 443 before)
              containerPort: 9443
              protocol: TCP
</code></pre>
<p><strong>3.got different  error message</strong></p>
<p>deployment YAML file</p>
<pre><code>status:
  observedGeneration: 28
  replicas: 2
  updatedReplicas: 1
  unavailableReplicas: 2
  conditions:
    - type: Available
      status: 'False'
      …
      reason: MinimumReplicasUnavailable
      message: Deployment does not have minimum availability.
    - type: Progressing
      status: 'False'
       …
      reason: ProgressDeadlineExceeded
      message: &gt;-
        ReplicaSet &quot;integrated-repository-webapp-5bcb99db9d&quot; has timed out
        progressing.


</code></pre>
<p>describe pod command out put</p>
<pre><code>Name:         integrated-repository-webapp-5bcb99db9d-s76br
Namespace:    awag-project
…
Status:       Pending
…
Containers:
  integrated-repository-webapp:
   …
    Ports:          9080/TCP, 9443/TCP
    Host Ports:     80/TCP, 444/TCP
    State:          Waiting
      Reason:       ImagePullBackOff
    Ready:          False
    Restart Count:  0
    Environment Variables from:
      integrated-repository-webapp-config  ConfigMap  Optional: false
    …
Conditions:
  Type              Status
  Initialized       True 
  Ready             False 
  ContainersReady   False 
  PodScheduled      True 
Volumes:
  ir-sa-token-v848t:
    Type:        Secret (a volume populated by a Secret)
    SecretName:  ir-sa-token-v848t
    Optional:    false
QoS Class:       BestEffort
Node-Selectors:  &lt;none&gt;
Tolerations:     node.kubernetes.io/not-ready:NoExecute op=Exists for 300s
                 node.kubernetes.io/unreachable:NoExecute op=Exists for 300s
Events:
  Type     Reason          Age                    From               Message
  ----     ------          ----                   ----               -------
  Normal   Scheduled       41m                    default-scheduler  Successfully assigned awag-project/integrated-repository-webapp-5bcb99db9d-s76br to 10.244.0.12
  Normal   AddedInterface  41m                    multus             Add eth0 [172.17.54.125/32]
  Normal   Pulling         40m (x4 over 41m)      kubelet            Pulling image &quot;jp.icr.io/etp-namespace/integrated-repository&quot;
  Warning  Failed          40m (x4 over 41m)      kubelet            Failed to pull image &quot;jp.icr.io/etp-namespace/integrated-repository&quot;: rpc error: code = Unknown desc = unable to retrieve auth token: invalid username/password: unauthorized: The login credentials are not valid, or your IBM Cloud account is not active.
  Warning  Failed          40m (x4 over 41m)      kubelet            Error: ErrImagePull
  Warning  Failed          6m49s (x153 over 41m)  kubelet            Error: ImagePullBackOff
  Normal   BackOff         105s (x175 over 41m)   kubelet            Back-off pulling image &quot;jp.icr.io/etp-namespace/integrated-repository&quot;

</code></pre>

Moe
<blockquote>
<pre><code>  message: &gt;-
    pods &quot;integrated-repository-webapp-d69879c5f-&quot; is forbidden: unable to
    validate against any security context constraint:
    [spec.containers[0].securityContext.containers[0].hostPort: Invalid
    value: 80: Host ports are not allowed to be used
    spec.containers[0].securityContext.containers[0].hostPort: Invalid
    value: 443: Host ports are not allowed to be used]
</code></pre>
</blockquote>
<p>You are trying to bind application in container to ports 80 and 443 which are &lt; 1024 and that is not allowed for non-root user, what is exactly happend in your case. As in previous issue <a href="https://stackoverflow.com/a/68328710/1025312">https://stackoverflow.com/a/68328710/1025312</a> user <a href="https://stackoverflow.com/users/5607207/syn">SYN</a> has mentioned Openshift uses Random UIDs. So you need to change port in container to e.g 8080, 8443 or any other greater than 1024.</p>
