Add checks for CNIBinDir ownership/permissions. #606
Conversation
aznashwan
force-pushed
the
check-cnibin-dir-permissions
branch
from
31878b7
to
a142d7b
Compare
There was a problem hiding this comment.
In a more general note, this does not prevent or address the issue, it only raises the error message in k8s status rather than getting cilium deployed.
I could see this causing more issues (e.g. gateway or ingress also failing to enable with errors). Perhaps we should just amend the required state? e.g. try to chown and chmod the directory?
aznashwan
force-pushed
the
check-cnibin-dir-permissions
branch
2 times, most recently
from
dfb54da
to
f2ec833
Compare
Correct, that was what was suggested in this comment on the original issue, so I just went with it.
I had considered it, but was unsure whether the snap should liberally change the state of files on the host system. If you think this is something the k8s snap should/could be able to do, I can gladly update the PR to perform the chown/chmod's directly... |
aznashwan
force-pushed
the
check-cnibin-dir-permissions
branch
from
f2ec833
to
4f05603
Compare
aznashwan
force-pushed
the
check-cnibin-dir-permissions
branch
from
4f05603
to
2350838
Compare
aznashwan
force-pushed
the
check-cnibin-dir-permissions
branch
from
2350838
to
620d156
Compare
Just updated, thanks! I initially made it part of the Cilium network setup since it was "closer" to where the Cilium chart deployment which failed due to the wrong ownership/permissions was being deployed, but it does indeed make more sense to handle this in the main k8sd setup. |
aznashwan
force-pushed
the
check-cnibin-dir-permissions
branch
from
620d156
to
c10fc83
Compare
aznashwan
force-pushed
the
check-cnibin-dir-permissions
branch
from
02c1a0c
to
256f239
Compare
Add checks/remediation steps for the ownership/permissions of the CNIBinDir during initial k8sd directories setup. Fixes: canonical#567 Signed-off-by: Nashwan Azhari <nazhari@cloudbasesolutions.com>
aznashwan
force-pushed
the
check-cnibin-dir-permissions
branch
from
256f239
to
77cb642
Compare
|
@bschimke95 I have managed to fix the previous logic bug but the tests are apparently being run as The only workaround I can think of is running the tests as root from the workflow ( |
|
Hey @aznashwan |
Signed-off-by: Nashwan Azhari <nazhari@cloudbasesolutions.com>
When the Cilium feature is enabled, add simple user/group/permissions checks on the configured CNIBinDir (/opt/cni/bin) before installing the Cilium Helm chart.
Fixes: #567