cilium: remove appArmorProfile for k8s<v1.30.0 #19888

ComradeProgrammer · 2024-10-30T22:21:05Z

FIX #19683
cilium: remove spec.template.spec.securityContext.appArmorProfile field when k8s version is smaller than 1.30.0

Before:

./out/minikube start --cni cilium --cpus max --kubernetes-version v1.28.9
😄  minikube v1.34.0 on Darwin 14.6.1 (arm64)
✨  Automatically selected the docker driver. Other choices: qemu2, ssh
📌  Using Docker Desktop driver with root privileges
👍  Starting "minikube" primary control-plane node in "minikube" cluster
🚜  Pulling base image v0.0.45-1730110049-19872 ...
🔥  Creating docker container (CPUs=8, Memory=6100MB) ...
🐳  Preparing Kubernetes v1.28.9 on Docker 27.3.1 ...
    ▪ Generating certificates and keys ...
    ▪ Booting up control plane ...
    ▪ Configuring RBAC rules ...
🔗  Configuring Cilium (Container Networking Interface) ...
💢  initialization failed, will try again: apply cni: cni apply: cmd: sudo /var/lib/minikube/binaries/v1.28.9/kubectl apply --kubeconfig=/var/lib/minikube/kubeconfig -f /var/tmp/minikube/cni.yaml output: -- stdout --
serviceaccount/cilium created
serviceaccount/cilium-envoy created
serviceaccount/cilium-operator created
configmap/cilium-config created
configmap/cilium-envoy-config created
clusterrole.rbac.authorization.k8s.io/cilium created
clusterrole.rbac.authorization.k8s.io/cilium-operator created
clusterrolebinding.rbac.authorization.k8s.io/cilium created
clusterrolebinding.rbac.authorization.k8s.io/cilium-operator created
role.rbac.authorization.k8s.io/cilium-config-agent created
rolebinding.rbac.authorization.k8s.io/cilium-config-agent created
service/cilium-envoy created
service/hubble-peer created
deployment.apps/cilium-operator created

-- /stdout --
** stderr ** 
Error from server (BadRequest): error when creating "/var/tmp/minikube/cni.yaml": DaemonSet in version "v1" cannot be handled as a DaemonSet: strict decoding error: unknown field "spec.template.spec.securityContext.appArmorProfile"
Error from server (BadRequest): error when creating "/var/tmp/minikube/cni.yaml": DaemonSet in version "v1" cannot be handled as a DaemonSet: strict decoding error: unknown field "spec.template.spec.securityContext.appArmorProfile"

** /stderr **: sudo /var/lib/minikube/binaries/v1.28.9/kubectl apply --kubeconfig=/var/lib/minikube/kubeconfig -f /var/tmp/minikube/cni.yaml: Process exited with status 1
stdout:
serviceaccount/cilium created
serviceaccount/cilium-envoy created
serviceaccount/cilium-operator created
configmap/cilium-config created
configmap/cilium-envoy-config created
clusterrole.rbac.authorization.k8s.io/cilium created
clusterrole.rbac.authorization.k8s.io/cilium-operator created
clusterrolebinding.rbac.authorization.k8s.io/cilium created
clusterrolebinding.rbac.authorization.k8s.io/cilium-operator created
role.rbac.authorization.k8s.io/cilium-config-agent created
rolebinding.rbac.authorization.k8s.io/cilium-config-agent created
service/cilium-envoy created
service/hubble-peer created
deployment.apps/cilium-operator created

stderr:
Error from server (BadRequest): error when creating "/var/tmp/minikube/cni.yaml": DaemonSet in version "v1" cannot be handled as a DaemonSet: strict decoding error: unknown field "spec.template.spec.securityContext.appArmorProfile"
Error from server (BadRequest): error when creating "/var/tmp/minikube/cni.yaml": DaemonSet in version "v1" cannot be handled as a DaemonSet: strict decoding error: unknown field "spec.template.spec.securityContext.appArmorProfile"

^C

After:


$ ./out/minikube start --cni cilium --cpus max --kubernetes-version v1.28.9
😄  minikube v1.34.0 on Darwin 14.6.1 (arm64)
✨  Automatically selected the docker driver. Other choices: qemu2, ssh
📌  Using Docker Desktop driver with root privileges
👍  Starting "minikube" primary control-plane node in "minikube" cluster
🚜  Pulling base image v0.0.45-1730110049-19872 ...
🔥  Creating docker container (CPUs=8, Memory=6100MB) ...
🐳  Preparing Kubernetes v1.28.9 on Docker 27.3.1 ...
    ▪ Generating certificates and keys ...
    ▪ Booting up control plane ...
    ▪ Configuring RBAC rules ...
🔗  Configuring Cilium (Container Networking Interface) ...
🔎  Verifying Kubernetes components...
    ▪ Using image gcr.io/k8s-minikube/storage-provisioner:v5
🌟  Enabled addons: storage-provisioner, default-storageclass
🏄  Done! kubectl is now configured to use "minikube" cluster and "default" namespace by default

medyagh · 2024-10-31T17:01:40Z

/ok-to-test

medyagh · 2024-10-31T17:01:53Z

@ComradeProgrammer thanks for the PR :) plz check the lint

medyagh

lets make sure the PR mentions cillim, so in the changelog users know it only affects the cillim

cilium: remove appArmorProfile for k8s<v1.30.0

pkg/minikube/cni/cilium.go

medyagh · 2024-11-22T18:03:37Z

@ComradeProgrammer plz take a look at the review

Co-authored-by: Steven Powell <[email protected]>

minikube-pr-bot · 2024-12-09T23:27:55Z

kvm2 driver with docker runtime

+----------------+----------+---------------------+
|    COMMAND     | MINIKUBE | MINIKUBE (PR 19888) |
+----------------+----------+---------------------+
| minikube start | 71.5s    | 51.6s               |
| enable ingress | 18.2s    | 16.7s               |
+----------------+----------+---------------------+

Times for minikube start: 51.1s 46.7s 48.9s 160.5s 50.7s
Times for minikube (PR 19888) start: 47.9s 51.3s 53.2s 53.2s 52.2s

Times for minikube ingress: 14.5s 19.0s 26.5s 15.5s 15.6s
Times for minikube (PR 19888) ingress: 19.5s 15.0s 19.0s 15.5s 14.5s

docker driver with docker runtime

+----------------+----------+---------------------+
|    COMMAND     | MINIKUBE | MINIKUBE (PR 19888) |
+----------------+----------+---------------------+
| minikube start | 22.0s    | 22.7s               |
| enable ingress | 12.9s    | 13.4s               |
+----------------+----------+---------------------+

Times for minikube start: 20.6s 21.5s 21.7s 21.8s 24.4s
Times for minikube (PR 19888) start: 24.4s 23.3s 20.6s 24.3s 20.7s

Times for minikube ingress: 13.3s 13.3s 12.3s 13.3s 12.3s
Times for minikube (PR 19888) ingress: 13.8s 12.8s 13.8s 13.3s 13.3s

docker driver with containerd runtime

+----------------+----------+---------------------+
|    COMMAND     | MINIKUBE | MINIKUBE (PR 19888) |
+----------------+----------+---------------------+
| minikube start | 21.0s    | 22.2s               |
| enable ingress | 39.2s    | 36.1s               |
+----------------+----------+---------------------+

Times for minikube ingress: 38.8s 39.3s 38.8s 39.3s 39.8s
Times for minikube (PR 19888) ingress: 38.8s 23.8s 38.8s 39.3s 39.8s

Times for minikube start: 18.9s 22.3s 22.6s 20.4s 20.9s
Times for minikube (PR 19888) start: 20.3s 22.4s 22.8s 24.0s 21.7s

minikube-pr-bot · 2024-12-10T02:25:41Z

Here are the number of top 10 failed tests in each environments with lowest flake rate.

Environment	Test Name	Flake Rate
Docker_Linux_crio (3 failed)	TestFunctional/parallel/ImageCommands/ImageListShort(gopogh)	5.88% (chart)
Hyperkit_macOS (10 failed)	TestFunctional/parallel/UpdateContextCmd/no_minikube_cluster(gopogh)	0.00% (chart)
Docker_Windows (2 failed)	TestStartStop/group/old-k8s-version/serial/SecondStart(gopogh)	0.00% (chart)
Docker_Linux_containerd_arm64 (1 failed)	TestStartStop/group/old-k8s-version/serial/SecondStart(gopogh)	47.06% (chart)

Besides the following environments also have failed tests:

Docker_Linux_crio_arm64: 2 failed (gopogh)
Hyper-V_Windows: 11 failed (gopogh)
Docker_Cloud_Shell: 3 failed (gopogh)
KVM_Linux_crio: 32 failed (gopogh)

To see the flake rates of all tests by environment, click here.

medyagh · 2024-12-12T18:25:46Z

/lgtm

k8s-ci-robot · 2024-12-12T18:25:54Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: ComradeProgrammer, medyagh

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~OWNERS~~ [medyagh]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

k8s-ci-robot added the cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. label Oct 30, 2024

k8s-ci-robot requested review from medyagh and spowelljr October 30, 2024 22:21

ComradeProgrammer requested review from medyagh and removed request for medyagh October 30, 2024 22:21

k8s-ci-robot added the size/M Denotes a PR that changes 30-99 lines, ignoring generated files. label Oct 30, 2024

ComradeProgrammer force-pushed the armor branch from 184ebc9 to 7f731c5 Compare October 30, 2024 22:24

k8s-ci-robot added the ok-to-test Indicates a non-member PR verified by an org member that is safe to test. label Oct 31, 2024

medyagh reviewed Oct 31, 2024

View reviewed changes

This comment has been minimized.

Sign in to view

ComradeProgrammer changed the title ~~remove appArmorProfile for k8s<v1.30.0~~ cilium: remove appArmorProfile for k8s<v1.30.0 Oct 31, 2024

ComradeProgrammer force-pushed the armor branch from 7f731c5 to fca5ebd Compare October 31, 2024 20:43

This comment has been minimized.

Sign in to view

cilium: remove appArmorProfile for k8s<v1.30.0

6e61e68

ComradeProgrammer force-pushed the armor branch from fca5ebd to 6e61e68 Compare November 1, 2024 22:25

This comment has been minimized.

Sign in to view

spowelljr requested changes Nov 15, 2024

View reviewed changes

pkg/minikube/cni/cilium.go Outdated Show resolved Hide resolved

pkg/minikube/cni/cilium.go Outdated Show resolved Hide resolved

pkg/minikube/cni/cilium.go Outdated Show resolved Hide resolved

Apply suggestions from code review

b240f9d

Co-authored-by: Steven Powell <[email protected]>

ComradeProgrammer force-pushed the armor branch from 1d938b1 to b240f9d Compare December 9, 2024 22:10

medyagh merged commit 323c007 into kubernetes:master Dec 12, 2024
27 of 37 checks passed

k8s-ci-robot assigned medyagh Dec 12, 2024

k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Dec 12, 2024

k8s-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Dec 12, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

cilium: remove appArmorProfile for k8s<v1.30.0 #19888

cilium: remove appArmorProfile for k8s<v1.30.0 #19888

ComradeProgrammer commented Oct 30, 2024 •

edited

Loading

medyagh commented Oct 31, 2024

medyagh commented Oct 31, 2024

medyagh left a comment

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

medyagh commented Nov 22, 2024

minikube-pr-bot commented Dec 9, 2024

minikube-pr-bot commented Dec 10, 2024

medyagh commented Dec 12, 2024

k8s-ci-robot commented Dec 12, 2024

cilium: remove appArmorProfile for k8s<v1.30.0 #19888

cilium: remove appArmorProfile for k8s<v1.30.0 #19888

Conversation

ComradeProgrammer commented Oct 30, 2024 • edited Loading

medyagh commented Oct 31, 2024

medyagh commented Oct 31, 2024

medyagh left a comment

Choose a reason for hiding this comment

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

medyagh commented Nov 22, 2024

minikube-pr-bot commented Dec 9, 2024

minikube-pr-bot commented Dec 10, 2024

medyagh commented Dec 12, 2024

k8s-ci-robot commented Dec 12, 2024

ComradeProgrammer commented Oct 30, 2024 •

edited

Loading