# K8s deployment failed as security pre-required?

**URL:** <https://discuss.elastic.co/t/k8s-deployment-failed-as-security-pre-required/99610>\
**Category:** Beats\
**Tags:** packetbeat\
**Created:** [September 6, 2017, 4:00pm UTC](https://discuss.elastic.co/t/k8s-deployment-failed-as-security-pre-required/99610 "2017-09-06T16:00:15Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Yveseirean](https://avatars.discourse-cdn.com/v4/letter/y/f17d59/32.png) [@Yveseirean](https://discuss.elastic.co/u/Yveseirean)\
**Post date:** [September 6, 2017, 4:00pm UTC](https://discuss.elastic.co/t/k8s-deployment-failed-as-security-pre-required/99610/1 "2017-09-06T16:00:15Z")

</div>

deployment in kubernetes without configuration met errors:

```
panic: standard_init_linux.go:178: exec user process caused "operation not permitted" [recovered]
        panic: standard_init_linux.go:178: exec user process caused "operation not permitted"
goroutine 1 [running, locked to thread]:
panic(0x7eb2e0, 0xc820139260)
        /usr/lib/go1.6/src/runtime/panic.go:481 +0x3e6
github.com/urfave/cli.HandleAction.func1(0xc8200ab2f8)
        /build/amd64-usr/var/tmp/portage/app-emulation/runc-1.0.0_rc2_p9/work/runc-1.0.0_rc2_p9/Godeps/_workspace/src/github.com/urfave/cli/app.go:478 +0x38e
panic(0x7eb2e0, 0xc820139260)
        /usr/lib/go1.6/src/runtime/panic.go:443 +0x4e9
github.com/opencontainers/runc/libcontainer.(*LinuxFactory).StartInitialization.func1(0xc8200aac08, 0xc82001e0b8, 0xc8200aad18)
        /build/amd64-usr/var/tmp/portage/app-emulation/runc-1.0.0_rc2_p9/work/runc-1.0.0_rc2_p9/Godeps/_workspace/src/github.com/opencontainers/runc/libcontainer/factory_linux.go:259 +0x136
github.com/opencontainers/runc/libcontainer.(*LinuxFactory).StartInitialization(0xc820068960, 0x7f48112294d0, 0xc820139260)
        /build/amd64-usr/var/tmp/portage/app-emulation/runc-1.0.0_rc2_p9/work/runc-1.0.0_rc2_p9/Godeps/_workspace/src/github.com/opencontainers/runc/libcontainer/factory_linux.go:277 +0x5b1
main.glob.func8(0xc820086780, 0x0, 0x0)
        /build/amd64-usr/var/tmp/portage/app-emulation/runc-1.0.0_rc2_p9/work/runc-1.0.0_rc2_p9/main_unix.go:26 +0x68
reflect.Value.call(0x74fac0, 0x9012a0, 0x13, 0x847808, 0x4, 0xc8200ab278, 0x1, 0x1, 0x0, 0x0, ...)
        /usr/lib/go1.6/src/reflect/value.go:435 +0x120d
reflect.Value.Call(0x74fac0, 0x9012a0, 0x13, 0xc8200ab278, 0x1, 0x1, 0x0, 0x0, 0x0)
        /usr/lib/go1.6/src/reflect/value.go:303 +0xb1
github.com/urfave/cli.HandleAction(0x74fac0, 0x9012a0, 0xc820086780, 0x0, 0x0)
        /build/amd64-usr/var/tmp/portage/app-emulation/runc-1.0.0_rc2_p9/work/runc-1.0.0_rc2_p9/Godeps/_workspace/src/github.com/urfave/cli/app.go:487 +0x2ee
github.com/urfave/cli.Command.Run(0x84a6b8, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8e05e0, 0x51, 0x0, ...)
        /build/amd64-usr/var/tmp/portage/app-emulation/runc-1.0.0_rc2_p9/work/runc-1.0.0_rc2_p9/Godeps/_workspace/src/github.com/urfave/cli/command.go:191 +0xfec
github.com/urfave/cli.(*App).Run(0xc820001980, 0xc82000a100, 0x2, 0x2, 0x0, 0x0)
        /build/amd64-usr/var/tmp/portage/app-emulation/runc-1.0.0_rc2_p9/work/runc-1.0.0_rc2_p9/Godeps/_workspace/src/github.com/urfave/cli/app.go:240 +0xaa4
main.main()
        /build/amd64-usr/var/tmp/portage/app-emulation/runc-1.0.0_rc2_p9/work/runc-1.0.0_rc2_p9/main.go:137 +0xe24

```

the deployment is very straightforwards:

> ```
> apiVersion: extensions/v1beta1
> kind: Deployment
> metadata:
> name: packetbeat
> namespace: monitoring
> spec:
> replicas: 1
> template:
> metadata:
> labels:
> app: packetbeat
> name: packetbeat
> spec:
> containers:
> - image: local-registry:5000/packetbeat:5.5.2
> name: packetbeat
> resources:
> limits:
> cpu: 500m
> memory: 512Mi
> requests:
> cpu: 500m
> memory: 512Mi
> 
> ```

The OS:  
_x86\_64 Intel(R) Xeon(R) CPU E5-2680 v4 @ 2.40GHz GenuineIntel GNU/Linux_

The reason I thought its OS level security related as:  
\_[Issues · moby/moby · GitHub](https://github.com/moby/moby/issues/29928_)

Any help will be really appreciated! 😀

---

<div class="post-metadata">

**Author:** ![exekias](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/exekias/32/28718_2.png) [@exekias](https://discuss.elastic.co/u/exekias)\
**Post date:** [September 7, 2017, 10:14am UTC](https://discuss.elastic.co/t/k8s-deployment-failed-as-security-pre-required/99610/2 "2017-09-07T10:14:13Z")

</div>

Hi @Yveseirean,

I think the error you see is related to packetbeat needed permissions, could you try to set security context for the container? something like this:

```auto
name: packetbeat
image: local-registry:5000/packetbeat:5.5.2
...
securityContext:
    runAsUser: 0

```

---

<div class="post-metadata">

**Author:** ![exekias](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/exekias/32/28718_2.png) [@exekias](https://discuss.elastic.co/u/exekias)\
**Post date:** [September 7, 2017, 10:18am UTC](https://discuss.elastic.co/t/k8s-deployment-failed-as-security-pre-required/99610/3 "2017-09-07T10:18:18Z")

</div>

You could also just add `NET_ADMIN` capability, as explained here: [https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container)

These are the docs on how to run it in docker: [https://www.elastic.co/guide/en/beats/packetbeat/6.0/running-on-docker.html](https://www.elastic.co/guide/en/beats/packetbeat/6.0/running-on-docker.html)

---

<div class="post-metadata">

**Author:** ![Yveseirean](https://avatars.discourse-cdn.com/v4/letter/y/f17d59/32.png) [@Yveseirean](https://discuss.elastic.co/u/Yveseirean)\
**Post date:** [September 8, 2017, 10:14am UTC](https://discuss.elastic.co/t/k8s-deployment-failed-as-security-pre-required/99610/4 "2017-09-08T10:14:47Z")

</div>

thank you, enquiring the NET\_ADMIN credentials at this moment, will update later

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 6, 2017, 10:15am UTC](https://discuss.elastic.co/t/k8s-deployment-failed-as-security-pre-required/99610/5 "2017-10-06T10:15:02Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.