serving: Seccomp profile in queue-proxy incompatible with gvisor
What version of Knative?
1.8.0
Expected Behavior
Pods should be able to start on GKE nodes running gvisor.
Actual Behavior
Gvisor refuses to allow the pods to start as a seccomp profile has been set, the following error is shown in events which refuses to allow the pod to start:
Seccomp is not supported
https://github.com/knative/serving/pull/13376 added the config below to queue-proxy containers by default, however gvisor won’t allow any profile or even a blank profile to be set.
seccompProfile:
type: RuntimeDefault
Maybe this could be configurable in a config map whether it gets added to the queue proxy?
Steps to Reproduce the Problem
Create a Knative service running on node running gvisor on a cluster running Knative 1.8.0.
About this issue
- Original URL
- State: closed
- Created 2 years ago
- Comments: 16 (10 by maintainers)
I created a PR to address a)
I think b) would be covered by Evan’s PR https://github.com/knative/serving/pull/13398
Looks like knative rolled this back, but anyways per the GKE bug tracker
RuntimeDefaultandUnconfinedare allowed in GKE Sandbox starting in 1.26.