# Cannot deploy ECK 2.7.0 with PSP

**URL:** <https://discuss.elastic.co/t/cannot-deploy-eck-2-7-0-with-psp/330743>\
**Category:** Elastic Cloud on Kubernetes (ECK)\
**Created:** [April 25, 2023, 1:11pm UTC](https://discuss.elastic.co/t/cannot-deploy-eck-2-7-0-with-psp/330743 "2023-04-25T13:11:03Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![sebastianboelling](https://avatars.discourse-cdn.com/v4/letter/s/258eb7/32.png) [@sebastianboelling](https://discuss.elastic.co/u/sebastianboelling)\
**Post date:** [April 25, 2023, 1:11pm UTC](https://discuss.elastic.co/t/cannot-deploy-eck-2-7-0-with-psp/330743/1 "2023-04-25T13:11:03Z")

</div>

Hi,

I tried to deploy ECK 2.7.0 on my Tanzu Kubernetes environment and get the following error message:

```auto
Warning Failed 5m6s (x2 over 5m7s) kubelet Error: container has runAsNonRoot and image will run as root (pod: "elastic-operator-0_srv247(2ddfe704-c0e9-4a5a-b916-5c5e646c6c4d)", container: manager)

```

I am using PSP and configured it the operator.yaml and crds.yaml accordingly. With ECK 2.6.1 everything runs without any errors.

The container spec in the operator.yaml is as follows:

```auto
containers:
      - image: "myownrepo/eck/eck-operator:2.7.0"
        imagePullPolicy: IfNotPresent
        name: manager
        args:
        - "manager"
        - "--config=/conf/eck.yaml"
        securityContext:
          allowPrivilegeEscalation: false
          capabilities:
            drop:
            - ALL
          readOnlyRootFilesystem: true
          runAsNonRoot: true
        env:

```

Are there changes to the 2.7.0 image which break my definition?

Regards

Sebastian

---

<div class="post-metadata">

**Author:** ![michael.morello](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/michael.morello/32/47448_2.png) [@michael.morello](https://discuss.elastic.co/u/michael.morello)\
**Post date:** [April 25, 2023, 1:50pm UTC](https://discuss.elastic.co/t/cannot-deploy-eck-2-7-0-with-psp/330743/2 "2023-04-25T13:50:45Z")

</div>

ECK 2.7.0 is supposed to run as user `65532` (which [actually inherits it from Distroless I guess](https://github.com/GoogleContainerTools/distroless/blob/71f12282fb490bca087103cfb03fcf7c015951b0/base/base.bzl#L8)):

`docker inspect docker.elastic.co/eck/eck-operator:2.7.0`:

```json
       "Config": {
            "Hostname": "",
            "Domainname": "",
            "User": "65532",

```

`docker inspect docker.elastic.co/eck/eck-operator:2.6.1` returns the same as above.

Could you check what is the value of `Config.User` for your image `myownrepo/eck/eck-operator:2.7.0`?

---

<div class="post-metadata">

**Author:** ![sebastianboelling](https://avatars.discourse-cdn.com/v4/letter/s/258eb7/32.png) [@sebastianboelling](https://discuss.elastic.co/u/sebastianboelling)\
**Post date:** [April 25, 2023, 2:52pm UTC](https://discuss.elastic.co/t/cannot-deploy-eck-2-7-0-with-psp/330743/3 "2023-04-25T14:52:50Z")

</div>

It is

```auto
 "Config": {
            "Hostname": "",
            "Domainname": "",
            "User": "",

```

Regards

---

<div class="post-metadata">

**Author:** ![sebastianboelling](https://avatars.discourse-cdn.com/v4/letter/s/258eb7/32.png) [@sebastianboelling](https://discuss.elastic.co/u/sebastianboelling)\
**Post date:** [April 27, 2023, 11:09am UTC](https://discuss.elastic.co/t/cannot-deploy-eck-2-7-0-with-psp/330743/4 "2023-04-27T11:09:33Z")

</div>

I've found the issue. The image was faulty imported to the repo. After new import the ECK 2.7.0 works fine.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 25, 2023, 11:09am UTC](https://discuss.elastic.co/t/cannot-deploy-eck-2-7-0-with-psp/330743/5 "2023-05-25T11:09:50Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.