No seccomp support

[samcv]

Component:

What happened:
When attempting to use Kubernetes dashboard, I get the error: feb 26 08:08:21 worker-3 kubelet[1500]: E0226 08:08:21.242021 1500 remote_runtime.go:105] RunPodSandbox from runtime service failed: rpc error: code = Unknown desc = failed to generate seccomp spec opts: seccomp is not supported which shows up in my journal

What was expected:
For the pod to start.
Steps to reproduce
kubectl apply -f https://raw.githubusercontent.com/kubernetes/dashboard/v2.0.0-rc5/aio/deploy/recommended.yaml
Resolution proposal (optional):
Support seccomp. I am not sure but I think containerd needs to be compiled with seccomp support (just guessing)

[NicolasT]

Indeed, the containerd package as distributed in EPEL (which is the one we install) is not compiled with seccomp support. Adding this would require us to ship our own build of containerd, which would require quite a bit of work.

Meanwhile, you could remove the seccomp-related annotation from the dashboard Deployment PodSpec and get it to run.

[samcv]

Would it be appropriate to get them to include it? Or is there a reason you think it is not included?

…

On 27.02.2020 16:18, Nicolas Trangez wrote: Indeed, the containerd package as distributed in EPEL (which is the one we install) is not compiled with seccomp support. Adding this would require us to ship our own build of containerd, which would require quite a bit of work. Meanwhile, you could remove the seccomp-related annotation from the dashboard _Deployment_ _PodSpec_ and get it to run. -- You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub [1], or unsubscribe [2]. Links: ------ [1] #2259?email_source=notifications&email_token=AEZWLFPEODXXBHITFR6ZQDDRE7KUPA5CNFSM4K36PDGKYY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGOENEXGHI#issuecomment-592016157 [2] https://github.com/notifications/unsubscribe-auth/AEZWLFJ7ERITRRVA2QBUM53RE7KUPANCNFSM4K36PDGA

[NicolasT]

Would it be appropriate to get them to include it? Or is there a reason you think it is not included?

I never tried, to be honest. One reason why it's not included could be if the version of libseccomp that ships with RHEL7 is too old.

Anyway, the version of containerd as shipped in EPEL is somewhat old as well, so building our own could make sense. We'll need to look into it: given the age of RHEL7, packaging Go applications is... not trivial.

[NicolasT]

I built a containerd 1.2.13 RPM with seccomp enabled, and after deploying it (manually) to one node in my test-cluster, I can deploy the upstream dashboard manifest (slightly changing the manifest to ensure the dashboard-metrics-server gets scheduled on this one node) and everything seems to work.

I'll spend some time to integrate this in the project.