kubernetes: flannel init container is crashing #476
Description
Description
we recently upgraded SELinux libs and we added some tests to validate various CNI in Kubernetes environment - an issue has been discovered while running kubeadm.v1.21.flannel tests.
Flannel init container is not able to run and it crashed with the following message:
core@localhost ~ $ docker logs 6a774c560ff1
cp: can't create '/etc/cni/net.d/10-flannel.conflist': Permission deniedSELinux is set in enforce mode during the tests and by checking the audit logs; we have the following:
[ 201.090219] audit: type=1400 audit(1628602162.447:213): avc: denied { write } for pid=4361 comm="cp" name="net.d" dev="vda9" ino=224 scontext=system_u:system_r:svirt_lxc_net_t:s0:c50,c336 tcontext=system_u:object_r:etc_t:s0 tclass=dir permissive=0Impact
User running flannel CNI in Kubernetes cluster using Flatcar with SELinux enabled might experience some issues.
Environment and steps to reproduce
- Run kola
kubeadm.v1.21.0.flannel.basetest with this branch:tormath1/kubernetes-1-22
Additional information
- It has not been caught before in the CI because there is a programming error in the kola codebase:
diff --git a/kola/tests/kubeadm/kubeadm.go b/kola/tests/kubeadm/kubeadm.go
index 44b47387..5b81da19 100644
--- a/kola/tests/kubeadm/kubeadm.go
+++ b/kola/tests/kubeadm/kubeadm.go
@@ -76,12 +76,13 @@ systemd:
func init() {
for _, CNI := range CNIs {
+ cni := CNI
register.Register(®ister.Test{
- Name: fmt.Sprintf("kubeadm.%s.base", CNI),
+ Name: fmt.Sprintf("kubeadm.%s.base", cni),
Distros: []string{"cl"},
ExcludePlatforms: []string{"esx"},
Run: func(c cluster.TestCluster) {
- kubeadmBaseTest(c, CNI)
+ kubeadmBaseTest(c, cni)
},
})
}- I'm currently testing with the following patch:
--- a/sec-policy/selinux-virt/files/virt.patch
+++ b/sec-policy/selinux-virt/files/virt.patch
@@ -36,4 +36,4 @@ index 256ea58..f72fbba 100644
+allow svirt_lxc_net_t var_lib_t:file { entrypoint execute execute_no_trans };
+allow svirt_lxc_net_t kernel_t:fifo_file { getattr ioctl read write open append };
+allow svirt_lxc_net_t initrc_t:fifo_file { getattr ioctl read write open append };
-+
++allow svirt_lxc_net_t etc_t:dir { write };