mirror of
https://github.com/k3s-io/k3s.git
synced 2024-06-07 19:41:36 +00:00
728ebcc027
Since a recent commit, rootless mode was failing with the following errors:
```
E0122 22:59:47.615567 21 kuberuntime_manager.go:755] createPodSandbox for pod "helm-install-traefik-wf8lc_kube-system(9de0a1b2-e2a2-4ea5-8fb6-22c9272a182f)" failed: rpc error: code = Unknown desc = failed to create network namespace for sandbox "285ab835609387f82d304bac1fefa5fb2a6c49a542a9921995d0c35d33c683d5": failed to setup netns: open /var/run/netns/cni-c628a228-651e-e03e-d27d-bb5e87281846: permission denied
...
E0122 23:31:34.027814 21 pod_workers.go:191] Error syncing pod 1a77d21f-ff3d-4475-9749-224229ddc31a ("coredns-854c77959c-w4d7g_kube-system(1a77d21f-ff3d-4475-9749-224229ddc31a)"), skipping: failed to "CreatePodSandbox" for "coredns-854c77959c-w4d7g_kube-system(1a77d21f-ff3d-4475-9749-224229ddc31a)" with CreatePodSandboxError: "CreatePodSandbox for pod \"coredns-854c77959c-w4d7g_kube-system(1a77d21f-ff3d-4475-9749-224229ddc31a)\" failed: rpc error: code = Unknown desc = failed to create containerd task: io.containerd.runc.v2: create new shim socket: listen unix /run/containerd/s/8f0e40e11a69738407f1ebaf31ced3f08c29bb62022058813314fb004f93c422: bind: permission denied\n: exit status 1: unknown"
```
Remove symlinks to /run/{netns,containerd} so that rootless mode can create their own /run/{netns,containerd}.
Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
81 lines
1.8 KiB
Go
81 lines
1.8 KiB
Go
// +build !windows
|
|
|
|
package rootless
|
|
|
|
import (
|
|
"fmt"
|
|
"os"
|
|
"path/filepath"
|
|
"strings"
|
|
|
|
"github.com/pkg/errors"
|
|
"github.com/sirupsen/logrus"
|
|
"golang.org/x/sys/unix"
|
|
)
|
|
|
|
func setupMounts(stateDir string) error {
|
|
// Remove symlinks to the rootful files, so that we can create our own files.
|
|
removeList := []string{
|
|
"/var/run/netns",
|
|
"/run/containerd",
|
|
"/run/xtables.lock",
|
|
}
|
|
for _, f := range removeList {
|
|
_ = os.RemoveAll(f)
|
|
}
|
|
|
|
mountMap := [][]string{
|
|
{"/var/log", filepath.Join(stateDir, "logs")},
|
|
{"/var/lib/cni", filepath.Join(stateDir, "cni")},
|
|
{"/var/lib/kubelet", filepath.Join(stateDir, "kubelet")},
|
|
{"/etc/rancher", filepath.Join(stateDir, "etc", "rancher")},
|
|
}
|
|
|
|
for _, v := range mountMap {
|
|
if err := setupMount(v[0], v[1]); err != nil {
|
|
return errors.Wrapf(err, "failed to setup mount %s => %s", v[0], v[1])
|
|
}
|
|
}
|
|
|
|
return nil
|
|
}
|
|
|
|
func setupMount(target, dir string) error {
|
|
toCreate := target
|
|
for {
|
|
if toCreate == "/" {
|
|
return fmt.Errorf("missing /%s on the root filesystem", strings.Split(target, "/")[0])
|
|
}
|
|
|
|
if err := os.MkdirAll(toCreate, 0700); err == nil {
|
|
break
|
|
}
|
|
|
|
toCreate = filepath.Base(toCreate)
|
|
}
|
|
|
|
if err := os.MkdirAll(toCreate, 0700); err != nil {
|
|
return errors.Wrapf(err, "failed to create directory %s", toCreate)
|
|
}
|
|
|
|
logrus.Debug("Mounting none ", toCreate, " tmpfs")
|
|
if err := unix.Mount("none", toCreate, "tmpfs", 0, ""); err != nil {
|
|
return errors.Wrapf(err, "failed to mount tmpfs to %s", toCreate)
|
|
}
|
|
|
|
if err := os.MkdirAll(target, 0700); err != nil {
|
|
return errors.Wrapf(err, "failed to create directory %s", target)
|
|
}
|
|
|
|
if dir == "" {
|
|
return nil
|
|
}
|
|
|
|
if err := os.MkdirAll(dir, 0700); err != nil {
|
|
return errors.Wrapf(err, "failed to create directory %s", dir)
|
|
}
|
|
|
|
logrus.Debug("Mounting ", dir, target, " none bind")
|
|
return unix.Mount(dir, target, "none", unix.MS_BIND, "")
|
|
}
|