Uploaded image for project: 'Openshift sandboxed containers'
  1. Openshift sandboxed containers
  2. KATA-880

[kata] Regular user have no write access right to mounted pv when using kata container runtime

XMLWordPrintable

    • Icon: Bug Bug
    • Resolution: Duplicate
    • Icon: Low Low
    • None
    • 4.8
    • sandboxed-containers
    • None
    • 0
    • 0

      Description of problem:
      Regular user(not kubeadmin) have no write access right to mounted pv when using kata container runtime.

      Version-Release number of selected component (if applicable):
      4.8.0-0.nightly-2021-06-16-020345

      How reproducible:
      Always

      Steps to Reproduce:
      1. Install the kata-operator and make it as container engine
      2. Login into cluster as regular user
      $ oc whoami
      testuser-10

      3. Create pod and pvc, could not write data to mounted volume
      sh-4.4$ ls -ldZ /mnt/local/
      drwxrwsr-x 3 root 1000670000 ? 4096 Jun 17 11:29 /mnt/local/

      sh-4.4$ touch /mnt/local/a
      touch: cannot touch '/mnt/local/a': Permission denied

      sh-4.4$ id
      uid=1000670000(1000670000) gid=0(root) groups=0(root),1000670000

      sh-4.4$ mount | grep mnt
      kataShared on /mnt/local type virtiofs (rw,relatime)

      4. Check on the node:
      sh-4.4# mount | grep pvc-bbb65e4c-07e0-4b2c-872b-f21843288038
      /dev/sdc on /var/lib/kubelet/plugins/kubernetes.io/gce-pd/mounts/wduan-0617g-gcp-rxnl9--pvc-bbb65e4c-07e0-4b2c-872b-f21843288038 type ext4 (rw,relatime,seclabel)
      /dev/sdc on /var/lib/kubelet/pods/705292c8-6915-4612-aca4-83b7ba7e6ad0/volumes/kubernetes.io~gce-pd/pvc-bbb65e4c-07e0-4b2c-872b-f21843288038 type ext4 (rw,relatime,seclabel)

      sh-4.4# ls lZd /var/lib/kubelet/plugins/kubernetes.io/gce-pd/mounts/wduan-0617g-gcp-rxnl9-pvc-bbb65e4c-07e0-4b2c-872b-f21843288038
      drwxrwsr-x. 3 root 1000670000 system_u:object_r:container_file_t:s0:c10,c26 4096 Jun 17 11:29 /var/lib/kubelet/plugins/kubernetes.io/gce-pd/mounts/wduan-0617g-gcp-rxnl9--pvc-bbb65e4c-07e0-4b2c-872b-f21843288038

      Actual results:
      Regular user have no write access right to mounted volume.

      Expected results:
      Regular user should have the write access right to mounted volume.

            aadam@redhat.com Ariel Adam
            wduan@redhat.com Wei Duan
            Votes:
            0 Vote for this issue
            Watchers:
            8 Start watching this issue

              Created:
              Updated:
              Resolved: