containers / containers/nri-plugins
NRI pod can't access the device /dev/isst_interface
- Dominant language
- Go
- Stars
- 114
- Forks
- 44
- Avg merge
- 1d 8h
- Merged PRs (30d)
- 20
Description
Hi, all.
Based on my testing about the sst feature in the topology-aware policy. I found that there some problems in the NRI pod.
**The NRI pod can't find the `/host/dev/isst_interface` device.**

After some research, I add these lines to the NRI daemonset.

Then, the NRI pod has no permission to access this device:
```
W0804 01:56:49.287017 1 system.go:297] failed to get SST info for package 0: failed to read SST PP info: Mbox command failed with failed to open isst device "/host/dev/isst_interface": open /host/dev/isst_interface: operation not permitted
```
After that, I noticed that there are some securitycontext in the daemonset file and I modified it:

I added the `privileged: true` into it and I commented the next two lines. At last, the NRI can access the sst device:

So does my approach was correct?
Contributor guide
Research direction
Review the NRI DaemonSet configuration, especially its device mounts and securityContext, then reproduce the SST access failure for /host/dev/isst_interface. Compare the behavior with and without the reported securityContext changes; done when the intended configuration permits the NRI pod to access the device without an unjustified workaround.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- kubernetes
- Domain
- infrastructure, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 35/100