Can not sync application with some securityContext about argo-cd HOT 5 CLOSED

Your securityContext is invalid. None of the attributes you specified are allowed in a PodSecurityContext. These are only valid attributes for a (Container)SecurityContext, so you'll need to move your securityContext inside your container definition.

from argo-cd.

Hi @artemus717 , thanks for raising this issue. I tried to reproduce this and my application gets in sync state inspite of using a security context. Here is the deployment manifest that I used:

apiVersion: apps/v1
kind: Deployment
metadata:
  name: nginx-deployment
spec:
  replicas: 1
  selector:
    matchLabels:
      app: nginx
  template:
    metadata:
      labels:
        app: nginx
    spec:
      containers:
        - name: nginx
          image: "nginx:1.16.0"
          imagePullPolicy: IfNotPresent
          securityContext:
            allowPrivilegeEscalation: true
            capabilities:
              add:
                - ALL
            privileged: true
            readOnlyRootFilesystem: false
            runAsNonRoot: false
            runAsUser: 0
          ports:
            - containerPort: 80

from argo-cd.

If I am not wrong, securityContext cannot be edited once a pod is created. Looking at the diff, looks like your pod is already present on the cluster and you are trying to modify the securityContext. Can you share the Sync Error message?

Argo CD by default does a kubectl apply on the resource, therefore it could fail if the pod is already present on the cluster. You can change this behaviour using sync options. Probably, a manual sync with replace and force sync option selected, should fix it i.e it will delete and recreate the pod with new securityContext.

from argo-cd.

Hi @svghadi Thanks for response. I tried delete deployment and sync again, but securityContext did not synced to online. And there are no error message in argocd-server, system calls response 200, but just no sync action.
I will try to remove deployment again and replace and force sync option.

from argo-cd.

@ChristianCiach Yes, you are correct, it works now.
@ChristianCiach @svghadi @nitishfy Thanks for you help.

from argo-cd.