Skip to content

Seccomp profile in queue-proxy incompatible with gvisor #13471

@daraghlowe

Description

@daraghlowe

What version of Knative?

1.8.0

Expected Behavior

Pods should be able to start on GKE nodes running gvisor.

Actual Behavior

Gvisor refuses to allow the pods to start as a seccomp profile has been set, the following error is shown in events which refuses to allow the pod to start:

Seccomp is not supported

#13376 added the config below to queue-proxy containers by default, however gvisor won't allow any profile or even a blank profile to be set.

          seccompProfile:
            type: RuntimeDefault

Maybe this could be configurable in a config map whether it gets added to the queue proxy?

Steps to Reproduce the Problem

Create a Knative service running on node running gvisor on a cluster running Knative 1.8.0.

Metadata

Metadata

Assignees

No one assigned

    Labels

    kind/bugCategorizes issue or PR as related to a bug.triage/acceptedIssues which should be fixed (post-triage)

    Type

    No type

    Projects

    No projects

    Milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions