aws-node container failing to restart with SELinux enabled

[sahilbadla]

What happened:

aws-node container is having problems restarting after SELinux enforcing mode is applied. This happens because the file '/host/etc/cni/net.d/10-aws.conflist' was created by an older container(first aws-node container on the node) with a different context than the new container initializing. That puts the new container in CrashLoopBackOff.

Here's an example from one of the nodes:

Now when i delete this pod and a new pod(aws-node-rxcq6) comes up, here's the error message from the aws-node container:

Detailed exception:

As you can see the new container(with context c220,c982) is not able to "mv" the file "10-aws.conflist" that was created with different context (c615,c828). This is the line of code where it fails https://github.com/aws/amazon-vpc-cni-k8s/blob/master/scripts/entrypoint.sh#L199

Looks like if we change mv command to cp instead, it should work with selinux. Reference https://danwalsh.livejournal.com/56534.html

Attach logs

What you expected to happen:

How to reproduce it (as minimally and precisely as possible):

• Deploy cni v1.11.2
• Set Selinux to enforcing mode

Anything else we need to know?:

Environment:

• Kubernetes version (use kubectl version): v1.21.14-eks-18ef993
• CNI Version : v1.11.2
• OS (e.g: cat /etc/os-release):

-NAME="Amazon Linux"
VERSION="2"
ID="amzn"
ID_LIKE="centos rhel fedora"

• Kernel (e.g. uname -a): ip-10-134-188-70.vpc.internal 5.4.204-113.362.amzn2.x86_64

[github-actions]

This issue is stale because it has been open 60 days with no activity. Remove stale label or comment or this will be closed in 14 days

[jayanthvn]

/not stale

[github-actions]

This issue is stale because it has been open 60 days with no activity. Remove stale label or comment or this will be closed in 14 days

[jdn5126]

Since the move to a Golang entrypoint, we no longer use the shell mv command. Instead, we copy the file to the destination path named <file>.tmp, then call os.Rename: https://github.com/aws/amazon-vpc-cni-k8s/blob/master/utils/cp/cp.go#L48

This should resolve the SELinux issue in enforcing mode, so closing this as fixed by #2146

[github-actions]

⚠️COMMENT VISIBILITY WARNING⚠️

Comments on closed issues are hard for our team to see.
If you need more assistance, please open a new issue that references this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.