gefyra: gefyra up: secrets "gefyra-cargo-connection" not found

Tried setting up gefyra, but it errored out with the below error:

➜  ~ gefyra version
[INFO] Gefyra client version: 0.8.1

Logs:

➜  ~ gefyra -d up
[INFO] There was no --endpoint argument provided. Connecting to a local Kubernetes node.
[INFO] Installing Gefyra Operator
[DEBUG] Creating Docker network
[INFO] Created network 'gefyra' (63ea1b4a3c)
[DEBUG] Network {'Name': 'gefyra', 'Id': '63ea1b4a3c7db6343d701f981c2ecef650db3800911de5c8d61517c51bac5', 'Created': '2022-07-13T20:05:14.75968771Z', 'Scope': 'local', 'Driver': 'bridge', 'EnableIPv6': False, 'IPAM': {'Driver': 'default', 'Options': None, 'Config': [{'Subnet': '172.22.0.0/16'}]}, 'Internal': False, 'Attachable': False, 'Ingress': False, 'ConfigFrom': {'Network': ''}, 'ConfigOnly': False, 'Containers': {}, 'Options': {}, 'Labels': {}}
[INFO] Container image "quay.io/gefyra/operator:0.8.1" already present on machine
[INFO] Operator became ready in 190.4024 seconds
[ERROR] Not Found: {'kind': 'Status', 'apiVersion': 'v1', 'metadata': {}, 'status': 'Failure', 'message': 'secrets "gefyra-cargo-connection" not found', 'reason': 'NotFound', 'details': {'name': 'gefyra-cargo-connection', 'kind': 'secrets'}, 'code': 404}
 ~ oc get all
NAME                                   READY   STATUS    RESTARTS   AGE
pod/gefyra-operator-579fb7d567-s6qrp   1/1     Running   0          3m15s

NAME                                TYPE        CLUSTER-IP      EXTERNAL-IP   PORT(S)           AGE
service/gefyra-stowaway-rsync       ClusterIP   None            <none>        10873/TCP         3m13s
service/gefyra-stowaway-wireguard   NodePort    172.30.126.77   <none>        51820:31820/UDP   3m13s

NAME                              READY   UP-TO-DATE   AVAILABLE   AGE
deployment.apps/gefyra-operator   1/1     1            1           3m16s
deployment.apps/gefyra-stowaway   0/1     0            0           3m13s

NAME                                         DESIRED   CURRENT   READY   AGE
replicaset.apps/gefyra-operator-579fb7d567   1         1         1       3m17s
replicaset.apps/gefyra-stowaway-68886d4c9c   1         0         0       3m14s
➜  ~ oc get secrets
NAME                              TYPE                                  DATA   AGE
builder-dockercfg-hj9sl           kubernetes.io/dockercfg               1      87s
builder-token-6jznc               kubernetes.io/service-account-token   4      87s
builder-token-sjd5s               kubernetes.io/service-account-token   4      87s
default-dockercfg-trn5j           kubernetes.io/dockercfg               1      87s
default-token-8wqtw               kubernetes.io/service-account-token   4      87s
default-token-hk2ww               kubernetes.io/service-account-token   4      87s
deployer-dockercfg-zsmqk          kubernetes.io/dockercfg               1      87s
deployer-token-kndfn              kubernetes.io/service-account-token   4      87s
deployer-token-nwk2q              kubernetes.io/service-account-token   4      87s
gefyra-operator-dockercfg-f9vv9   kubernetes.io/dockercfg               1      87s
gefyra-operator-token-r5ptn       kubernetes.io/service-account-token   4      87s
gefyra-operator-token-sl6g8       kubernetes.io/service-account-token   4      87s

oc version:

Client Version: v4.2.0-alpha.0-1420-gf1f09a3
Server Version: 4.8.43
Kubernetes Version: v1.21.11+6b3cbdd

About this issue

  • Original URL
  • State: closed
  • Created 2 years ago
  • Comments: 20 (4 by maintainers)

Most upvoted comments

I was able to break down the issues here.

  1. in OpenShift there is a so called SCC (see https://docs.openshift.com/container-platform/4.10/authentication/managing-security-context-constraints.html) preventing Stowaway to start with the required capabilities
  2. Stowaway does currently not employ a proper service account to assign privileges
  3. there is another issue with running wireguard-go in CRC (at least with OpenShift Local)

In my current development state I could remedy point 1 and 2. After assigning Stowaway a service account (which will be created automatically), I am able to releax the SCC on it with: oc adm policy add-scc-to-user privileged -z gefyra-stowaway -n gefyra. Then, the Stowaway Pod was successfully scheduled and started with an error message concerning wireguard-go. That is where I am currently stuck. I am going to investigate this one in the coming days.