hashicorp / hashicorp/boundary-reference-architecture
EKS deployment failed: Disabling IPC_LOCK, please use --privileged or --cap-add IPC_LOCK
- Dominant language
- HCL
- Stars
- 217
- Forks
- 105
- PR merge metrics
- No merged PRs in 30d
Description
Hello, I tried to deploy the Boundary controller to EKS Kubernetes version 1.22, but container does not have enough privileges to chown the /boundary directory:
```
chown: /boundary/..2022_07_29_07_35_20.877353490/controller.hcl: Read-only file system
chown: /boundary/..2022_07_29_07_35_20.877353490: Read-only file system
chown: /boundary/..2022_07_29_07_35_20.877353490: Read-only file system
chown: /boundary/controller.hcl: Read-only file system
chown: /boundary/..data: Read-only file system
chown: /boundary: Read-only file system
chown: /boundary: Read-only file system
Could not chown /boundary (may not have appropriate permissions)
Couldn't start Boundary with IPC_LOCK. Disabling IPC_LOCK, please use --privileged or --cap-add IPC_LOCK
```
The boundary docker image: **0.9**
I modified a bit example resources:
controller.tf:
```hcl
resource "kubernetes_namespace" "boundary" {
metadata {
name = var.namespace
}
}
resource "kubernetes_secret" "boundary_url" {
depends_on = [
kubernetes_namespace.boundary,
]
metadata {
name = "boundary-rds-url"
labels = var.controller_labels
namespace = var.namespace
}
data = {
POSTGRESS_URL="postgresql://${var.database_username}:${var.database_password}@${var.database_address}:${var.database_port}/${var.database_name}"
}
}
resource "kubernetes_deployment" "boundary" {
depends_on = [
kubernetes_namespace.boundary,
kubernetes_secret.boundary_url
]
metadata {
name = var.controller_deployment
labels = var.controller_labels
namespace = var.namespace
}
spec {
replicas = 1
selector {
match_labels = var.controller_labels
}
template {
metadata {
labels = var.controller_labels
}
spec {
volume {
name = "controller-config"
config_map {
name = "controller-config"
}
}
container {
image = "hashicorp/boundary:${var.image_ver}"
name = "controller"
image_pull_policy = var.image_pull_pilicy
volume_mount {
name = "controller-config"
mount_path = "/boundary"
read_only = false
}
args = [
"server",
"-config",
"/boundary/controller.hcl"
]
env {
name = "POSTGRESS_URL"
value_from {
secret_key_ref {
name = "boundary-rds-url"
key = "POSTGRESS_URL"
}
}
}
env {
name = "HOSTNAME"
value = "controller"
}
port {
container_port = 9200
}
port {
container_port = 9201
}
port {
container_port = 9202
}
liveness_probe {
http_get {
path = "/"
port = 9200
}
}
readiness_probe {
http_get {
path = "/"
port = 9200
}
}
}
}
}
}
}
resource "kubernetes_config_map" "controller_config" {
depends_on = [
kubernetes_namespace.boundary,
]
metadata {
name = "controller-config"
labels = var.controller_labels
namespace = var.namespace
}
data = {
"controller.hcl" = <
Contributor guide
Research direction
Start with controller.tf and the Kubernetes deployment configuration shown in the issue, focusing on the controller-config volume mount and container privileges. Reproduce the EKS deployment using Boundary image 0.9 and inspect the reported chown and IPC_LOCK errors. Done means the controller starts successfully with the documented configuration and no longer reports these errors.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, kubernetes, terraform
- Domain
- cloud, infrastructure
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100