Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

ovs-cni-marker privileges #214

Open
vkatabat opened this issue Dec 6, 2021 · 3 comments
Open

ovs-cni-marker privileges #214

vkatabat opened this issue Dec 6, 2021 · 3 comments

Comments

@vkatabat
Copy link

vkatabat commented Dec 6, 2021

Hi,
To limit ovs-cni pod securityContext. We removed privileges=true for ovs-cni-marker. We are tried with capabilities : CAP_IPC_LOCK/CAP_NET_BIND/CAP_NET_RAW which i think are required to connect to OVS DB. Could you please suggest what the minimum capability required for ovs-cni-marker container to work?
Error Seen:
F1206 07:05:08.670471 1 main.go:84] Failed to create a new marker object: Error creating the ovsdb connection: failed to connect to ovsdb error: failed to connect to ovsdb error: failed to connect to endpoints ["unix:/host/var/run/openvswitch/db.sock"]: dial unix /host/var/run/openvswitch/db.sock: connect: permission denied

@phoracek
Copy link
Member

Hello.

The network capabilities should not be needed. The marker observes available bridges through the socket only.

Regarding the error, it may be due to the container running under a regular user while the socket is only accessible for openvswitch/root. Could you share ls -lZ /var/run/openvswitch from your host, so we could check who owns the file and selinux context? On top of that, if you could share the Pod spec generated by the DaemonSet, it should tell us more about the user under which the process runs.

@kfox1111
Copy link

kfox1111 commented Jun 3, 2024

Is the marker required or optional?

@phoracek
Copy link
Member

phoracek commented Jun 4, 2024

@kfox1111 it is entirely optional

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

3 participants