From 26e83ac4d4398ed94ed5391e4faed54824ed9a4d Mon Sep 17 00:00:00 2001 From: Akihiro Suda Date: Mon, 24 May 2021 23:35:22 +0900 Subject: [PATCH] kubelet: ignore /dev/kmsg error when running in userns oomwatcher.NewWatcher returns "open /dev/kmsg: operation not permitted" error, when running with sysctl value `kernel.dmesg_restrict=1`. The error is negligible for KubeletInUserNamespace. Signed-off-by: Akihiro Suda --- pkg/kubelet/kubelet.go | 21 ++++++++++++++++++--- 1 file changed, 18 insertions(+), 3 deletions(-) diff --git a/pkg/kubelet/kubelet.go b/pkg/kubelet/kubelet.go index 43cad89dba0..4cf6fe201ab 100644 --- a/pkg/kubelet/kubelet.go +++ b/pkg/kubelet/kubelet.go @@ -34,6 +34,7 @@ import ( "k8s.io/client-go/informers" cadvisorapi "github.com/google/cadvisor/info/v1" + libcontaineruserns "github.com/opencontainers/runc/libcontainer/userns" "k8s.io/mount-utils" "k8s.io/utils/integer" @@ -481,7 +482,19 @@ func NewMainKubelet(kubeCfg *kubeletconfiginternal.KubeletConfiguration, oomWatcher, err := oomwatcher.NewWatcher(kubeDeps.Recorder) if err != nil { - return nil, err + if libcontaineruserns.RunningInUserNS() { + if utilfeature.DefaultFeatureGate.Enabled(features.KubeletInUserNamespace) { + // oomwatcher.NewWatcher returns "open /dev/kmsg: operation not permitted" error, + // when running in a user namespace with sysctl value `kernel.dmesg_restrict=1`. + klog.V(2).InfoS("Failed to create an oomWatcher (running in UserNS, ignoring)", "err", err) + oomWatcher = nil + } else { + klog.ErrorS(err, "Failed to create an oomWatcher (running in UserNS, Hint: enable KubeletInUserNamespace feature flag to ignore the error)") + return nil, err + } + } else { + return nil, err + } } clusterDNS := make([]net.IP, 0, len(kubeCfg.ClusterDNS)) @@ -1360,8 +1373,10 @@ func (kl *Kubelet) initializeModules() error { } // Start out of memory watcher. - if err := kl.oomWatcher.Start(kl.nodeRef); err != nil { - return fmt.Errorf("failed to start OOM watcher %v", err) + if kl.oomWatcher != nil { + if err := kl.oomWatcher.Start(kl.nodeRef); err != nil { + return fmt.Errorf("failed to start OOM watcher: %w", err) + } } // Start resource analyzer