InvalidApplicationUID

Message NameInvalidApplicationUID
Message CodeIST0144
DescriptionApplication pods should not run as user ID (UID) 1337
LevelWarning

This message occurs when a workload is running as User ID (UID) 1337. Application pods should not run as user ID (UID) 1337 because the istio-proxy container runs as UID 1337. Running your application containers using the same UID would result in conflicts with its iptables configurations.

User ID (UID) 1337 is reserved for the sidecar proxy.

An example

Consider a Deployment with securityContext.runAsUser running either at Pod level or at container level using UID 1337:

  1. apiVersion: apps/v1
  2. kind: Deployment
  3. metadata:
  4. name: deploy-con-sec-uid
  5. labels:
  6. app: helloworld
  7. version: v1
  8. spec:
  9. replicas: 1
  10. selector:
  11. matchLabels:
  12. app: helloworld
  13. version: v1
  14. template:
  15. metadata:
  16. labels:
  17. app: helloworld
  18. version: v1
  19. spec:
  20. securityContext:
  21. runAsUser: 1337
  22. containers:
  23. - name: helloworld
  24. image: docker.io/istio/examples-helloworld-v1
  25. securityContext:
  26. runAsUser: 1337
  27. resources:
  28. requests:
  29. cpu: "100m"
  30. imagePullPolicy: IfNotPresent #Always
  31. ports:
  32. - containerPort: 5000

How to resolve

Because the User ID (UID) 1337 is reserved for the sidecar proxy, you can use a different User ID (UID) such as 1338 for your workload.

  1. apiVersion: apps/v1
  2. kind: Deployment
  3. metadata:
  4. name: deploy-con-sec-uid
  5. labels:
  6. app: helloworld
  7. version: v1
  8. spec:
  9. replicas: 1
  10. selector:
  11. matchLabels:
  12. app: helloworld
  13. version: v1
  14. template:
  15. metadata:
  16. labels:
  17. app: helloworld
  18. version: v1
  19. spec:
  20. securityContext:
  21. runAsUser: 1338
  22. containers:
  23. - name: helloworld
  24. image: docker.io/istio/examples-helloworld-v1
  25. securityContext:
  26. runAsUser: 1338
  27. resources:
  28. requests:
  29. cpu: "100m"
  30. imagePullPolicy: IfNotPresent #Always
  31. ports:
  32. - containerPort: 5000