kubevirt: Unable to launch virt-handler v0.20.4 on CoreOS with selinux

/kind bug

What happened: I started kubevirt v0.20.4 using some instructions from https://kubevirt.io/quickstart_minikube/ on a Kubernetes v1.15 cluster running on bare-metal nodes with CoreOS 1883.0.0 (~1yo …).

What you expected to happen: virt-handler fails to start with:

{"component":"virt-handler","hostname":"carmd-er-lxtb0cc47a4c27b6","level":"info","pos":"virt-handler.go:187","timestamp":"2019-09-04T06:02:51.362115Z"}
panic: failed to list labels:  

goroutine 1 [running]:
main.(*virtHandlerApp).Run(0xc0001f6000)
	cmd/virt-handler/virt-handler.go:205 +0x1ad6
main.main()
	cmd/virt-handler/virt-handler.go:457 +0x6e

How to reproduce it (as minimally and precisely as possible): I think running kubevirt on CoreOS should be enough, but hard to say.

Anything else we need to know?: It looks like the selinux/labels.go is calling semanage, and I couldn’t find it in the image.

Environment:

  • KubeVirt version (use virtctl version): v0.20.4
  • Kubernetes version (use kubectl version): v1.15.1
  • VM or VMI specifications: N/A
  • Cloud provider or hardware configuration: bare-metal x86-64 servers
  • OS (e.g. from /etc/os-release): CoreOS 1883.0.0 (w/ ACS patch)
  • Kernel (e.g. uname -a): 4.18.5-coreos
  • Install tools:
  • Others:

About this issue

  • Original URL
  • State: closed
  • Created 5 years ago
  • Comments: 16 (9 by maintainers)

Most upvoted comments

Maybe you can re-mount the whole system as rw, apply the policy and back it to ro, at least it worked for RHVH.

I tried that out of curiosity. semodule then tries to call some executeables in libexec which are not available on core os 😄

@CoRfr thanks for the report, looks like we have wrong log message - https://github.com/kubevirt/kubevirt/blob/0a69f68c14f26af53d21d454dd087e038a68335e/pkg/virt-handler/selinux/labels.go#L119 we do not really print the error, so its hard to say what the problem, I will create the PR with the fix, and can you try again after it will be merged, just to see what the error?