Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix(calico): Added kubernetesProvider and nonPrivileged configurations #83

Merged
merged 1 commit into from
Nov 14, 2024

Conversation

smerlos
Copy link

@smerlos smerlos commented Oct 14, 2024

This PR addresses #82 by adding specific configurations for Calico in EKS. The issue was related to panic and sysctl errors, especially:

2024-10-12 12:09:47.350 [PANIC][9460] felix/table.go 784: iptables-legacy-save command failed after retries ipVersion=0x4 table="raw"
2024-10-12 12:09:48.485 [ERROR][9510] felix/int_dataplane.go 2065: Failed to set IPv4 forwarding sysctl error=open /proc/sys/net/ipv4/ip_forward: read-only file system

Changes:

  • Added kubernetesProvider: Specifies the Kubernetes platform provider (EKS), allowing automatic provider-specific configurations.

  • Added nonPrivileged: Ensures Calico runs in non-privileged mode as a non-root user where possible.

Set nonPrivileged to Disabled and kubernetesProvider to EKS in calico-crs
@smerlos smerlos self-assigned this Oct 14, 2024
@ralgozino
Copy link
Member

  • Added nonPrivileged: Ensures Calico runs in non-privileged mode as a non-root user where possible.

but you set this to Disabled, so IT IS running as root, is this what you wanted?

Copy link
Member

@ralgozino ralgozino left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

as per my previous comment

@smerlos
Copy link
Author

smerlos commented Oct 14, 2024

  • Added nonPrivileged: Ensures Calico runs in non-privileged mode as a non-root user where possible.

but you set this to Disabled, so IT IS running as root, is this what you wanted?


Thank you for your comment. As per the issue discussed in #82 and the logs shared in the description of the PR, the workload requires root privileges to execute correctly. Therefore, it is necessary to explicitly run it as root in this case.

@smerlos smerlos requested a review from ralgozino October 14, 2024 17:19
Copy link
Member

@ralgozino ralgozino left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

lgtm

Copy link
Member

@nutellinoit nutellinoit left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM!

@nutellinoit nutellinoit merged commit aa9cd3d into main Nov 14, 2024
@ralgozino ralgozino deleted the fix/tigrera-operated branch November 15, 2024 10:45
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants