Fix ownership of /opt/cni (#379)

Signed-off-by: Waleed Malik <ahmedwaleedmalik@gmail.com>
kubermatic · Apr 24, 2024 · ba7524a · ba7524a
1 parent 73d0d0b
commit ba7524a
Show file tree

Hide file tree

Showing 22 changed files with 39 additions and 9 deletions.
diff --git a/deploy/osps/default/osp-amzn2.yaml b/deploy/osps/default/osp-amzn2.yaml
@@ -200,6 +200,9 @@ spec:
         rm -f "$cni_filename"
         cd -
 
+        {{- /* set ownership of the CNI binaries to root:root. Required due to https://github.com/cilium/cilium/issues/23838 */}}
+        chown -R root:root "$cni_bin_dir"
+
         {{- /* # cri-tools variables */}}
         {{- if semverCompare "~1.27.0" .KubeVersion }}
         CRI_TOOLS_RELEASE="v1.27.1"

diff --git a/deploy/osps/default/osp-centos.yaml b/deploy/osps/default/osp-centos.yaml
@@ -218,8 +218,10 @@ spec:
 
         {{- /* unpack CNI */}}
         tar xvf "$cni_filename"
-        rm -f "$cni_filename"
-        cd -
+
+
+        {{- /* set ownership of the CNI binaries to root:root. Required due to https://github.com/cilium/cilium/issues/23838 */}}
+        chown -R root:root "$cni_bin_dir"
 
         {{- /* # cri-tools variables */}}
         {{- if semverCompare "~1.27.0" .KubeVersion }}

diff --git a/deploy/osps/default/osp-flatcar-cloud-init.yaml b/deploy/osps/default/osp-flatcar-cloud-init.yaml
@@ -93,6 +93,9 @@ spec:
         rm -f "$cni_filename"
         cd -
 
+        {{- /* set ownership of the CNI binaries to root:root. Required due to https://github.com/cilium/cilium/issues/23838 */}}
+        chown -R root:root "$cni_bin_dir"
+
         {{- /* # cri-tools variables */}}
         {{- if semverCompare "~1.27.0" .KubeVersion }}
         CRI_TOOLS_RELEASE="v1.27.1"

diff --git a/deploy/osps/default/osp-flatcar.yaml b/deploy/osps/default/osp-flatcar.yaml
@@ -239,6 +239,9 @@ spec:
         rm -f "$cni_filename"
         cd -
 
+        {{- /* set ownership of the CNI binaries to root:root. Required due to https://github.com/cilium/cilium/issues/23838 */}}
+        chown -R root:root "$cni_bin_dir"
+
         {{- /* # cri-tools variables */}}
         {{- if semverCompare "~1.27.0" .KubeVersion }}
         CRI_TOOLS_RELEASE="v1.27.1"

diff --git a/deploy/osps/default/osp-rhel.yaml b/deploy/osps/default/osp-rhel.yaml
@@ -211,6 +211,9 @@ spec:
         rm -f "$cni_filename"
         cd -
 
+        {{- /* set ownership of the CNI binaries to root:root. Required due to https://github.com/cilium/cilium/issues/23838 */}}
+        chown -R root:root "$cni_bin_dir"
+
         {{- /* # cri-tools variables */}}
         {{- if semverCompare "~1.27.0" .KubeVersion }}
         CRI_TOOLS_RELEASE="v1.27.1"

diff --git a/deploy/osps/default/osp-rockylinux.yaml b/deploy/osps/default/osp-rockylinux.yaml
@@ -215,6 +215,9 @@ spec:
         rm -f "$cni_filename"
         cd -
 
+        {{- /* set ownership of the CNI binaries to root:root. Required due to https://github.com/cilium/cilium/issues/23838 */}}
+        chown -R root:root "$cni_bin_dir"
+
         {{- /* # cri-tools variables */}}
         {{- if semverCompare "~1.27.0" .KubeVersion }}
         CRI_TOOLS_RELEASE="v1.27.1"

diff --git a/deploy/osps/default/osp-ubuntu.yaml b/deploy/osps/default/osp-ubuntu.yaml
@@ -237,6 +237,9 @@ spec:
         rm -f "$cni_filename"
         cd -
 
+        {{- /* set ownership of the CNI binaries to root:root. Required due to https://github.com/cilium/cilium/issues/23838 */}}
+        chown -R root:root "$cni_bin_dir"
+
         {{- /* # cri-tools variables */}}
         {{- if semverCompare "~1.27.0" .KubeVersion }}
         CRI_TOOLS_RELEASE="v1.27.1"

diff --git a/pkg/controllers/osc/testdata/osc-flatcar-aws-containerd.yaml b/pkg/controllers/osc/testdata/osc-flatcar-aws-containerd.yaml
@@ -326,6 +326,7 @@ spec:
             tar xvf "$cni_filename"
             rm -f "$cni_filename"
             cd -
+            chown -R root:root "$cni_bin_dir"
             CRI_TOOLS_RELEASE="v1.30.0"
 
             CRI_TOOLS_RELEASE="${CRI_TOOLS_RELEASE:-v1.29.0}"

diff --git a/pkg/controllers/osc/testdata/osc-kubelet-configuration-containerd.yaml b/pkg/controllers/osc/testdata/osc-kubelet-configuration-containerd.yaml
@@ -327,6 +327,7 @@ spec:
             tar xvf "$cni_filename"
             rm -f "$cni_filename"
             cd -
+            chown -R root:root "$cni_bin_dir"
             CRI_TOOLS_RELEASE="v1.30.0"
 
             cri_tools_base_url="https://github.com/kubernetes-sigs/cri-tools/releases/download/${CRI_TOOLS_RELEASE}"

diff --git a/pkg/controllers/osc/testdata/osc-rhel-8.x-azure-containerd.yaml b/pkg/controllers/osc/testdata/osc-rhel-8.x-azure-containerd.yaml
@@ -353,6 +353,7 @@ spec:
             tar xvf "$cni_filename"
             rm -f "$cni_filename"
             cd -
+            chown -R root:root "$cni_bin_dir"
             CRI_TOOLS_RELEASE="v1.30.0"
 
             CRI_TOOLS_RELEASE="${CRI_TOOLS_RELEASE:-v1.29.0}"

diff --git a/pkg/controllers/osc/testdata/osc-rhel-8.x-cloud-init-modules.yaml b/pkg/controllers/osc/testdata/osc-rhel-8.x-cloud-init-modules.yaml
@@ -355,6 +355,7 @@ spec:
             tar xvf "$cni_filename"
             rm -f "$cni_filename"
             cd -
+            chown -R root:root "$cni_bin_dir"
             CRI_TOOLS_RELEASE="v1.30.0"
 
             CRI_TOOLS_RELEASE="${CRI_TOOLS_RELEASE:-v1.29.0}"

diff --git a/pkg/controllers/osc/testdata/osc-ubuntu-aws-containerd.yaml b/pkg/controllers/osc/testdata/osc-ubuntu-aws-containerd.yaml
@@ -327,6 +327,7 @@ spec:
             tar xvf "$cni_filename"
             rm -f "$cni_filename"
             cd -
+            chown -R root:root "$cni_bin_dir"
             CRI_TOOLS_RELEASE="v1.29.0"
 
             cri_tools_base_url="https://github.com/kubernetes-sigs/cri-tools/releases/download/${CRI_TOOLS_RELEASE}"

diff --git a/pkg/controllers/osc/testdata/osc-ubuntu-aws-dualstack-IPv6+IPv4.yaml b/pkg/controllers/osc/testdata/osc-ubuntu-aws-dualstack-IPv6+IPv4.yaml
@@ -326,6 +326,7 @@ spec:
             tar xvf "$cni_filename"
             rm -f "$cni_filename"
             cd -
+            chown -R root:root "$cni_bin_dir"
             CRI_TOOLS_RELEASE="v1.29.0"
 
             cri_tools_base_url="https://github.com/kubernetes-sigs/cri-tools/releases/download/${CRI_TOOLS_RELEASE}"

diff --git a/pkg/controllers/osc/testdata/osc-ubuntu-aws-dualstack.yaml b/pkg/controllers/osc/testdata/osc-ubuntu-aws-dualstack.yaml
@@ -326,6 +326,7 @@ spec:
             tar xvf "$cni_filename"
             rm -f "$cni_filename"
             cd -
+            chown -R root:root "$cni_bin_dir"
             CRI_TOOLS_RELEASE="v1.29.0"
 
             cri_tools_base_url="https://github.com/kubernetes-sigs/cri-tools/releases/download/${CRI_TOOLS_RELEASE}"

diff --git a/pkg/controllers/osc/testdata/osp-rhel-aws-cloud-init-modules.yaml b/pkg/controllers/osc/testdata/osp-rhel-aws-cloud-init-modules.yaml
@@ -211,6 +211,9 @@ spec:
         rm -f "$cni_filename"
         cd -
 
+        {{- /* set ownership of the CNI binaries to root:root. Required due to https://github.com/cilium/cilium/issues/23838 */}}
+        chown -R root:root "$cni_bin_dir"
+
         {{- /* # cri-tools variables */}}
         {{- if semverCompare "~1.27.0" .KubeVersion }}
         CRI_TOOLS_RELEASE="v1.27.1"

diff --git a/pkg/controllers/osc/testdata/secret-flatcar-aws-containerd-provisioning.yaml b/pkg/controllers/osc/testdata/secret-flatcar-aws-containerd-provisioning.yaml
diff --git a/pkg/controllers/osc/testdata/secret-kubelet-configuration-containerd-provisioning.yaml b/pkg/controllers/osc/testdata/secret-kubelet-configuration-containerd-provisioning.yaml
diff --git a/pkg/controllers/osc/testdata/secret-osc-rhel-8.x-cloud-init-modules-provisioning.yaml b/pkg/controllers/osc/testdata/secret-osc-rhel-8.x-cloud-init-modules-provisioning.yaml
diff --git a/pkg/controllers/osc/testdata/secret-rhel-8.x-azure-containerd-provisioning.yaml b/pkg/controllers/osc/testdata/secret-rhel-8.x-azure-containerd-provisioning.yaml
diff --git a/pkg/controllers/osc/testdata/secret-ubuntu-aws-containerd-provisioning.yaml b/pkg/controllers/osc/testdata/secret-ubuntu-aws-containerd-provisioning.yaml
diff --git a/pkg/controllers/osc/testdata/secret-ubuntu-aws-dualstack-IPv6+IPv4-provisioning.yaml b/pkg/controllers/osc/testdata/secret-ubuntu-aws-dualstack-IPv6+IPv4-provisioning.yaml
diff --git a/pkg/controllers/osc/testdata/secret-ubuntu-aws-dualstack-provisioning.yaml b/pkg/controllers/osc/testdata/secret-ubuntu-aws-dualstack-provisioning.yaml