containers / containers/nri-plugins

NRI pod can't access the device /dev/isst_interface

Open
#101 3 comments 0 reactions 0 assignees View on GitHub
Dominant language
Go
Stars
114
Forks
44
Avg merge
1d 8h
Merged PRs (30d)
20

Description

Hi, all.

Based on my testing about the sst feature in the topology-aware policy. I found that there some problems in the NRI pod.

**The NRI pod can't find the `/host/dev/isst_interface` device.**

![image](https://github.com/containers/nri-plugins/assets/12726668/ddbbf37b-3a57-4ce9-9d37-7eba14021b18)

After some research, I add these lines to the NRI daemonset.
![image](https://github.com/containers/nri-plugins/assets/12726668/d4141fc2-c744-4726-9f4f-c5750e27b861)

Then, the NRI pod has no permission to access this device:
```
W0804 01:56:49.287017 1 system.go:297] failed to get SST info for package 0: failed to read SST PP info: Mbox command failed with failed to open isst device "/host/dev/isst_interface": open /host/dev/isst_interface: operation not permitted
```

After that, I noticed that there are some securitycontext in the daemonset file and I modified it:
![image](https://github.com/containers/nri-plugins/assets/12726668/a951ee4c-fa19-4570-becf-a3d56bc6aac3)

I added the `privileged: true` into it and I commented the next two lines. At last, the NRI can access the sst device:
![image](https://github.com/containers/nri-plugins/assets/12726668/d4dc428f-6ef6-4436-a446-59861a048653)

So does my approach was correct?

Contributor guide

Open the contributing guide

Research direction

Review the NRI DaemonSet configuration, especially its device mounts and securityContext, then reproduce the SST access failure for /host/dev/isst_interface. Compare the behavior with and without the reported securityContext changes; done when the intended configuration permits the NRI pod to access the device without an unjustified workaround.

Written by the indexing model from the issue text.

Assessment

Tech stack
kubernetes
Domain
infrastructure, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.