hashicorp / hashicorp/boundary-reference-architecture

EKS deployment failed: Disabling IPC_LOCK, please use --privileged or --cap-add IPC_LOCK

Open
#90 1 comment 0 reactions 0 assignees View on GitHub
Dominant language
HCL
Stars
217
Forks
105
PR merge metrics
No merged PRs in 30d

Description

Hello, I tried to deploy the Boundary controller to EKS Kubernetes version 1.22, but container does not have enough privileges to chown the /boundary directory:
```
chown: /boundary/..2022_07_29_07_35_20.877353490/controller.hcl: Read-only file system
chown: /boundary/..2022_07_29_07_35_20.877353490: Read-only file system
chown: /boundary/..2022_07_29_07_35_20.877353490: Read-only file system
chown: /boundary/controller.hcl: Read-only file system
chown: /boundary/..data: Read-only file system
chown: /boundary: Read-only file system
chown: /boundary: Read-only file system
Could not chown /boundary (may not have appropriate permissions)
Couldn't start Boundary with IPC_LOCK. Disabling IPC_LOCK, please use --privileged or --cap-add IPC_LOCK
```
The boundary docker image: **0.9**

I modified a bit example resources:
controller.tf:
```hcl
resource "kubernetes_namespace" "boundary" {
metadata {
name = var.namespace
}
}

resource "kubernetes_secret" "boundary_url" {
depends_on = [
kubernetes_namespace.boundary,
]
metadata {
name = "boundary-rds-url"
labels = var.controller_labels
namespace = var.namespace
}
data = {
POSTGRESS_URL="postgresql://${var.database_username}:${var.database_password}@${var.database_address}:${var.database_port}/${var.database_name}"
}
}

resource "kubernetes_deployment" "boundary" {
depends_on = [
kubernetes_namespace.boundary,
kubernetes_secret.boundary_url
]
metadata {
name = var.controller_deployment
labels = var.controller_labels
namespace = var.namespace
}

spec {
replicas = 1

selector {
match_labels = var.controller_labels
}

template {
metadata {
labels = var.controller_labels
}

spec {
volume {
name = "controller-config"

config_map {
name = "controller-config"
}
}

container {
image = "hashicorp/boundary:${var.image_ver}"
name = "controller"

image_pull_policy = var.image_pull_pilicy
volume_mount {
name = "controller-config"
mount_path = "/boundary"
read_only = false
}

args = [
"server",
"-config",
"/boundary/controller.hcl"
]

env {
name = "POSTGRESS_URL"
value_from {
secret_key_ref {
name = "boundary-rds-url"
key = "POSTGRESS_URL"
}
}
}

env {
name = "HOSTNAME"
value = "controller"
}

port {
container_port = 9200
}
port {
container_port = 9201
}
port {
container_port = 9202
}

liveness_probe {
http_get {
path = "/"
port = 9200
}
}

readiness_probe {
http_get {
path = "/"
port = 9200
}
}
}
}
}
}
}

resource "kubernetes_config_map" "controller_config" {
depends_on = [
kubernetes_namespace.boundary,
]

metadata {
name = "controller-config"
labels = var.controller_labels
namespace = var.namespace
}

data = {
"controller.hcl" = <

Contributor guide

Open the contributing guide

Research direction

Start with controller.tf and the Kubernetes deployment configuration shown in the issue, focusing on the controller-config volume mount and container privileges. Reproduce the EKS deployment using Boundary image 0.9 and inspect the reported chown and IPC_LOCK errors. Done means the controller starts successfully with the documented configuration and no longer reports these errors.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, kubernetes, terraform
Domain
cloud, infrastructure
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.