sysbox-deploy-k8s: detect k8s nodes with secure-boot enabled and generate error message
@ctalledo is already working on this.
Since Jul 26, 2021.
- Dominant language
- Shell
- Stars
- 3.9k
- Forks
- 230
- Avg merge
- 7h 48m
- Merged PRs (30d)
- 3
Description
The sysbox-deploy-k8s daemonset installs Sysbox on Kubernetes clusters. As part of the installation, it installs and loads the shiftfs kernel module.
Turns out that on GKE, we found out that the shiftfs installation failed on K8s nodes configured with "Secure Boot" enabled. Secure boot caused the loading of the shiftfs module to be blocked. This in turn caused the sysbox-deploy-k8s to fail, though the reason for the failure was not obvious.
We should improve the sysbox-deploy-k8s daemonset as follows:
-
When the installation fails due to a failure to load shiftfs, a clear error should be logged.
-
If the sysbox-deploy-k8s detects that the node has secure boot enabled, it should also log a warning message indicating that it should be disabled.
Note that the requirement to disable secure-boot should go away when we add support for ID-mapped mounts to sysbox (i.e., the alternative to shiftfs landing in kernels 5.12+).
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.