From 409b5263ff02054e1ba4125c7c3939bc2535078e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Fabiano=20Fid=C3=AAncio?= Date: Wed, 15 Jul 2026 12:46:40 +0200 Subject: [PATCH 1/2] kata-deploy: fix kata-monitor CRI socket mount for non-vanilla clusters MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Derive the runtime endpoint from k8sDistribution and mount the matching host socket directory so kata-monitor can reach containerd on non-vanilla k8s deployments. Fixes #13378 Signed-off-by: Fabiano Fidêncio Assisted-by: Cursor --- .../kata-deploy/templates/_helpers.tpl | 53 +++++++++++++++++++ .../kata-deploy/templates/kata-monitor.yaml | 6 +-- .../helm-chart/kata-deploy/values.yaml | 8 ++- 3 files changed, 63 insertions(+), 4 deletions(-) diff --git a/tools/packaging/kata-deploy/helm-chart/kata-deploy/templates/_helpers.tpl b/tools/packaging/kata-deploy/helm-chart/kata-deploy/templates/_helpers.tpl index dfd14dc564..72a79246cd 100644 --- a/tools/packaging/kata-deploy/helm-chart/kata-deploy/templates/_helpers.tpl +++ b/tools/packaging/kata-deploy/helm-chart/kata-deploy/templates/_helpers.tpl @@ -71,6 +71,59 @@ If containerd.configDir is set explicitly, use that instead. {{- end -}} {{- end -}} +{{/* +Set the CRI containerd socket URI depending on the k8s distribution. +If containerd.runtimeSocket is set explicitly, use that instead. +*/}} +{{- define "containerdRuntimeSocket" -}} +{{- if and .containerd .containerd.runtimeSocket -}} +{{- .containerd.runtimeSocket -}} +{{- else if or (eq .k8sDistribution "k3s") (eq .k8sDistribution "rke2") -}} +unix:///run/k3s/containerd/containerd.sock +{{- else if eq .k8sDistribution "k0s" -}} +unix:///run/k0s/containerd.sock +{{- else if eq .k8sDistribution "microk8s" -}} +unix:///var/snap/microk8s/common/run/containerd.sock +{{- else -}} +unix:///run/containerd/containerd.sock +{{- end -}} +{{- end -}} + +{{/* +Resolve the kata-monitor CRI runtime endpoint. +When monitor.runtimeEndpoint is empty, inherit containerd.runtimeSocket or +derive it from k8sDistribution. +*/}} +{{- define "monitorRuntimeEndpoint" -}} +{{- if .Values.monitor.runtimeEndpoint -}} +{{- .Values.monitor.runtimeEndpoint -}} +{{- else -}} +{{- include "containerdRuntimeSocket" .Values -}} +{{- end -}} +{{- end -}} + +{{/* +Filesystem path of the CRI runtime socket, derived from monitorRuntimeEndpoint. +*/}} +{{- define "monitorRuntimeSocketPath" -}} +{{- $endpoint := include "monitorRuntimeEndpoint" . -}} +{{- if hasPrefix "unix://" $endpoint -}} +{{- trimPrefix "unix://" $endpoint -}} +{{- else if hasPrefix "unix:" $endpoint -}} +{{- trimPrefix "unix:" $endpoint -}} +{{- else -}} +{{- $endpoint -}} +{{- end -}} +{{- end -}} + +{{/* +Host directory containing the CRI runtime socket, derived from monitorRuntimeEndpoint. +Used for kata-monitor volume hostPath and mountPath so the socket is reachable in-container. +*/}} +{{- define "monitorRuntimeSocketDir" -}} +{{- include "monitorRuntimeSocketPath" . | dir -}} +{{- end -}} + {{/* Check if node-feature-discovery is already installed by someone else Returns the namespace where node-feature-discovery is found, or empty string if not found diff --git a/tools/packaging/kata-deploy/helm-chart/kata-deploy/templates/kata-monitor.yaml b/tools/packaging/kata-deploy/helm-chart/kata-deploy/templates/kata-monitor.yaml index 567bb99cf8..c46f33e1a4 100644 --- a/tools/packaging/kata-deploy/helm-chart/kata-deploy/templates/kata-monitor.yaml +++ b/tools/packaging/kata-deploy/helm-chart/kata-deploy/templates/kata-monitor.yaml @@ -44,14 +44,14 @@ spec: args: - -listen-address={{ .Values.monitor.listenAddress }} - -log-level={{ .Values.monitor.logLevel }} - - -runtime-endpoint={{ .Values.monitor.runtimeEndpoint }} + - -runtime-endpoint={{ include "monitorRuntimeEndpoint" . }} ports: - containerPort: {{ .Values.monitor.port }} resources: {{- toYaml .Values.monitor.resources | nindent 10 }} volumeMounts: - name: containerd-sock - mountPath: /run/containerd + mountPath: {{ include "monitorRuntimeSocketDir" . }} readOnly: true - name: sbs mountPath: /run/vc/sbs/ @@ -60,7 +60,7 @@ spec: volumes: - name: containerd-sock hostPath: - path: /run/containerd + path: {{ include "monitorRuntimeSocketDir" . }} type: Directory - name: sbs hostPath: diff --git a/tools/packaging/kata-deploy/helm-chart/kata-deploy/values.yaml b/tools/packaging/kata-deploy/helm-chart/kata-deploy/values.yaml index 2eb272fcab..7eed14b0e2 100644 --- a/tools/packaging/kata-deploy/helm-chart/kata-deploy/values.yaml +++ b/tools/packaging/kata-deploy/helm-chart/kata-deploy/values.yaml @@ -119,7 +119,9 @@ monitor: reference: quay.io/kata-containers/kata-monitor tag: "" listenAddress: "0.0.0.0:8090" - runtimeEndpoint: "unix:///run/containerd/containerd.sock" + # CRI runtime socket for kata-monitor. When empty, inherits containerd.runtimeSocket + # or derives from k8sDistribution (e.g. k3s uses unix:///run/k3s/containerd/containerd.sock). + runtimeEndpoint: "" logLevel: "info" port: 8090 securityContext: @@ -144,6 +146,10 @@ containerd: # When empty, derived automatically from k8sDistribution. # Example: "/etc/my-containerd/" configDir: "" + # Override the CRI containerd socket URI. + # When empty, derived automatically from k8sDistribution. + # Example: "unix:///run/k3s/containerd/containerd.sock" + runtimeSocket: "" # Override the containerd config file name. # When empty, the kata-deploy binary uses its built-in default ("config.toml") # or auto-detects based on the runtime (k0s, microk8s, k3s/rke2). From 850c3d874e3f1ecc70a2b5245744b3935c3fd127 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Fabiano=20Fid=C3=AAncio?= Date: Wed, 15 Jul 2026 22:58:34 +0200 Subject: [PATCH 2/2] kata-deploy: align kata-monitor log level with chart debug flag MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Resolve kata-monitor log level from monitor.logLevel, the chart-wide logLevel, and debug:true, matching the precedence used by kata-deploy. Fixes #13382 Signed-off-by: Fabiano Fidêncio Assisted-by: Cursor --- .../kata-deploy/templates/_helpers.tpl | 18 ++++++++++++++++++ .../kata-deploy/templates/kata-monitor.yaml | 2 +- .../helm-chart/kata-deploy/values.yaml | 4 +++- 3 files changed, 22 insertions(+), 2 deletions(-) diff --git a/tools/packaging/kata-deploy/helm-chart/kata-deploy/templates/_helpers.tpl b/tools/packaging/kata-deploy/helm-chart/kata-deploy/templates/_helpers.tpl index 72a79246cd..6a9266a76e 100644 --- a/tools/packaging/kata-deploy/helm-chart/kata-deploy/templates/_helpers.tpl +++ b/tools/packaging/kata-deploy/helm-chart/kata-deploy/templates/_helpers.tpl @@ -124,6 +124,24 @@ Used for kata-monitor volume hostPath and mountPath so the socket is reachable i {{- include "monitorRuntimeSocketPath" . | dir -}} {{- end -}} +{{/* +Resolve kata-monitor log level. +Honors monitor.logLevel, then the chart-wide logLevel, then debug:true -> debug. +*/}} +{{- define "monitorLogLevel" -}} +{{- $logLevel := .Values.monitor.logLevel | default "" | trim -}} +{{- if not $logLevel -}} +{{- $logLevel = .Values.logLevel | default "" | trim -}} +{{- end -}} +{{- if and (not $logLevel) .Values.debug -}} +{{- $logLevel = "debug" -}} +{{- end -}} +{{- if not $logLevel -}} +{{- $logLevel = "info" -}} +{{- end -}} +{{- $logLevel -}} +{{- end -}} + {{/* Check if node-feature-discovery is already installed by someone else Returns the namespace where node-feature-discovery is found, or empty string if not found diff --git a/tools/packaging/kata-deploy/helm-chart/kata-deploy/templates/kata-monitor.yaml b/tools/packaging/kata-deploy/helm-chart/kata-deploy/templates/kata-monitor.yaml index c46f33e1a4..a502de2a63 100644 --- a/tools/packaging/kata-deploy/helm-chart/kata-deploy/templates/kata-monitor.yaml +++ b/tools/packaging/kata-deploy/helm-chart/kata-deploy/templates/kata-monitor.yaml @@ -43,7 +43,7 @@ spec: {{- toYaml .Values.monitor.securityContext | nindent 10 }} args: - -listen-address={{ .Values.monitor.listenAddress }} - - -log-level={{ .Values.monitor.logLevel }} + - -log-level={{ include "monitorLogLevel" . }} - -runtime-endpoint={{ include "monitorRuntimeEndpoint" . }} ports: - containerPort: {{ .Values.monitor.port }} diff --git a/tools/packaging/kata-deploy/helm-chart/kata-deploy/values.yaml b/tools/packaging/kata-deploy/helm-chart/kata-deploy/values.yaml index 7eed14b0e2..b233d879e8 100644 --- a/tools/packaging/kata-deploy/helm-chart/kata-deploy/values.yaml +++ b/tools/packaging/kata-deploy/helm-chart/kata-deploy/values.yaml @@ -122,7 +122,9 @@ monitor: # CRI runtime socket for kata-monitor. When empty, inherits containerd.runtimeSocket # or derives from k8sDistribution (e.g. k3s uses unix:///run/k3s/containerd/containerd.sock). runtimeEndpoint: "" - logLevel: "info" + # Log level for kata-monitor. When empty, inherits chart-wide logLevel and + # debug:true implies debug; otherwise defaults to info. + logLevel: "" port: 8090 securityContext: privileged: false