AWX requirement of privileged container

Archives AWX Project
1

Hi,

I’m setting up AWX on Openshift for POC(very likely it will be adopted) and I noticed that it requires SCC privileged permissions.
Do you know what features requires this and whether it is possible to deploy without it?

Thanks in advance,
Idan

2

https://docs.ansible.com/ansible-tower/latest/html/userguide/security.html

Bubble wrap requires privileged containers and is on by default. You can disable it via the job isolation toggle. I looked to the docs above.

3

Great thank you for clarifying that.

4

So to confirm, there’s no way to deploy without SCC privileged permissions? My openshift admins wanted some specifics on what permissions were needed before they would allow that (I think they’re looking to create a custom role).

5

Idan,

I encourage you to reach out to a Red Hat representative so they can help you POC Tower.

ngonzal,

There is no supported way to deploy without SCC privileged permissions. That being said, I can think of how you can make it work. You need to set privileged: false in installer/roles/kubernetes/templates/deployment.yml.j2

That will get the container deployed. Then you need to disable bubblewrap like I describe above.

6

Hi Chris,

Thanks for your help, I got AWX deployed successfully on our Openshift.
Like you said, I had to update the deployment.yml.j2 and disable “Job Isolation” and it deployed successfully.
For production deployments we will need to keep that enabled, we will review this later.

ngonzal, you can review my working deployment scripts https://github.com/iplaman/awx/commit/1d396060a94ca2c3f774834dddf4169d84da1a64

Thanks,
Idan

7

Has there been any progress on this?
bubblewrap is something we want to have enabled but it only works with privileged containers which isn't allowed on our cluster.

Has anyone been able to work around this?

8

Nothing has changed about this as there’s been no real movement from the bubblewrap team… if that changes or another tool like bwrap comes along then we’ll take another look.

9

Hey Chris,

Any sense on appetite to enhance AWX install to conditionalize whether it configures AWX with privileged expectations? (considering whether to PR but don’t want to waste time if project just going to decide not to accept it)

Regards,
Andy