github/k3s - k3s - https://git.xinac.net

Commit Graph

Author	SHA1	Message	Date
Akihiro Suda	e672c988e4	rootless: allow kernel.dmesg_restrict=1 When `/dev/kmsg` is unreadable due to sysctl value `kernel.dmesg_restrict=1`, bind-mount `/dev/null` into `/dev/kmsg` Fix issue 3011 Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>	4 years ago
Akihiro Suda	6e8284e3d4	rootless: enable resource limitation (requires cgroup v2, systemd) Now rootless mode can be used with cgroup v2 resource limitations. A pod is executed in a cgroup like "/user.slice/user-1001.slice/user@1001.service/k3s-rootless.service/kubepods/podd0eb6921-c81a-4214-b36c-d3b9bb212fac/63b5a253a1fd4627da16bfce9bec58d72144cf30fe833e0ca9a6d60ebf837475". This is accomplished by running `kubelet` in a cgroup namespace, and enabling `cgroupfs` driver for the cgroup hierarchy delegated by systemd. To enable cgroup v2 resource limitation, `k3s server --rootless` needs to be launched as `systemctl --user` service. Please see the comment lines in `k3s-rootless.service` for the usage. Running `k3s server --rootless` via a terminal is not supported. When it really needs to be launched via a terminal, `systemd-run --user -p Delegate --tty` needs to be prepended to create a systemd scope. Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>	4 years ago
Akihiro Suda	11ef43011a	bump up RootlessKit Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>	4 years ago
Akihiro Suda	728ebcc027	rootless: remove rootful /run/{netns,containerd} symlinks Since a recent commit, rootless mode was failing with the following errors: ``` E0122 22:59:47.615567 21 kuberuntime_manager.go:755] createPodSandbox for pod "helm-install-traefik-wf8lc_kube-system(9de0a1b2-e2a2-4ea5-8fb6-22c9272a182f)" failed: rpc error: code = Unknown desc = failed to create network namespace for sandbox "285ab835609387f82d304bac1fefa5fb2a6c49a542a9921995d0c35d33c683d5": failed to setup netns: open /var/run/netns/cni-c628a228-651e-e03e-d27d-bb5e87281846: permission denied ... E0122 23:31:34.027814 21 pod_workers.go:191] Error syncing pod 1a77d21f-ff3d-4475-9749-224229ddc31a ("coredns-854c77959c-w4d7g_kube-system(1a77d21f-ff3d-4475-9749-224229ddc31a)"), skipping: failed to "CreatePodSandbox" for "coredns-854c77959c-w4d7g_kube-system(1a77d21f-ff3d-4475-9749-224229ddc31a)" with CreatePodSandboxError: "CreatePodSandbox for pod \"coredns-854c77959c-w4d7g_kube-system(1a77d21f-ff3d-4475-9749-224229ddc31a)\" failed: rpc error: code = Unknown desc = failed to create containerd task: io.containerd.runc.v2: create new shim socket: listen unix /run/containerd/s/8f0e40e11a69738407f1ebaf31ced3f08c29bb62022058813314fb004f93c422: bind: permission denied\n: exit status 1: unknown" ``` Remove symlinks to /run/{netns,containerd} so that rootless mode can create their own /run/{netns,containerd}. Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>	4 years ago
Akihiro Suda	43f7eaedf8	rootless: fix "stat /run/user/1000: no such file or directory" on `kubectl run` k3s was mounting a tmpfs on `/run` by itself, so it was hiding RootlessKit's `/run`. Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>	4 years ago
Akihiro Suda	67410d2757	rootless: validate sysctl before starting up Fix #2420 Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>	4 years ago
Brad Davidson	79c499f0e0	Fix handling of TLS configuration args Also fixes an unrelated error formatting issue turned up while testing. Signed-off-by: Brad Davidson <brad.davidson@rancher.com>	4 years ago
Akihiro Suda	a70cdac356	update rootlesskit to v0.10.0 Fix intermittent "Connection reset by peer" error during port forwarding https://github.com/rootless-containers/rootlesskit/issues/153 Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>	4 years ago
Knic Knic	c2db115ec3	fix formatting	5 years ago
Knic Knic	2346ccc63f	get build on windows and get api_server to work	5 years ago
Darren Shepherd	782004bec9	Create pidns for rootless	5 years ago
Akihiro Suda	5a51a8de45	rootless: use built-in port driver Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>	6 years ago
Akihiro Suda	490d6aefe0	rootless: fix mounting /var/lib/cni k3s was unable to start up when /var/lib/cni is missing on the host. Fix https://github.com/rancher/k3s/issues/470 Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>	6 years ago
Darren Shepherd	046a817818	Add rootless support	6 years ago

16 Commits (bcb662926d005dd65275bc462d4664ff5994ce07)