Skip to content

Mount /run/xtables.lock as FileOrCreate in Helm chart #2841

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
orsenthil merged 3 commits into from
Apr 3, 2024
Merged

Mount /run/xtables.lock as FileOrCreate in Helm chart #2841

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
bdb4016
Mount /run/xtables.lock as FileOrCreate
kwohlfahrt Mar 12, 2024
80e1f4b
Merge branch 'master' into patch-1
Mar 14, 2024
60d9645
Merge branch 'master' into patch-1
Apr 3, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions charts/aws-vpc-cni/templates/daemonset.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -183,6 +183,7 @@ spec:
- name: xtables-lock
hostPath:
path: /run/xtables.lock
type: FileOrCreate
Copy link
Contributor

@orsenthil orsenthil Mar 14, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Should we have reasons to believe that /run/xtables.lock file should be have been created by the iptables package in the operating system?

There is note of caution in kubelet volume docs - https://kubernetes.io/docs/concepts/storage/volumes/

Caution: The FileOrCreate mode does not create the parent directory of the file. If the parent directory of the mounted file does not exist, the pod fails to start. To ensure that this mode works, you can try to mount directories and files separately, as shown in the FileOrCreate example for hostPath.

Copy link
Contributor Author

@kwohlfahrt kwohlfahrt Mar 15, 2024 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Just tested this on a fresh Ubuntu 22.04 VM. /run/xtables.lock is not created until the first run of the iptables-legacy command.

The default iptables is a compatibility wrapper around nftables, which never creates this file at all, it is only created when interacting with actual iptables with iptables-legacy. So if nothing on startup calls the legacy iptables interface, the file will not exist.

Copy link
Contributor Author

@kwohlfahrt kwohlfahrt Mar 15, 2024 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If the parent directory of the mounted file does not exist, the pod fails to start. To ensure that this mode works, you can try to mount directories and files separately, as shown in the FileOrCreate example for hostPath.

I would expect /run to exist on all Linux hosts, as it is part of FHS, so I don't think this is a risk? kube-proxy (as set up by kubeadm) already uses FileOrCreate for this path, so if /run doesn't exist, kube-proxy won't start, and the node will be broken anyway.

{{- with .Values.extraVolumes }}
{{- toYaml .| nindent 6 }}
{{- end }}
Expand Down