Pod Exec Fails With Permission Issue

Problem

After you upgrade runtime from Docker to Containerd, nodes upgrades successfully, but if you try to exec some pods it fails with the below error logs:

Pod logs
    
xxxxxxxxxx
 
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ WARNING: UNPROTECTED PRIVATE KEY FILE! @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@Permissions 0644 for '/etc/ssh/ssh_host_rsa_key' are too open.It is required that your private key files are NOT accessible by others.This private key will be ignored.@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ WARNING: UNPROTECTED PRIVATE KEY FILE! @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@Permissions 0644 for '/etc/ssh/ssh_host_ecdsa_key' are too open.It is required that your private key files are NOT accessible by others.This private key will be ignored.@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ WARNING: UNPROTECTED PRIVATE KEY FILE! @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@Permissions 0644 for '/etc/ssh/ssh_host_ed25519_key' are too open.
Copy

Environment

Platform9 Managed Kubernetes - v5.6.8
Kubernetes version - 1.22.9

Cause

The directory listed below does not have correct permission inside directory /var/lib/containerd after runtime upgrade to containerd.

Permission
    
xxxxxxxxxx
 
drwxr-xr-x 3 root root 4096 Aug 14 10:47 io.containerd.snapshotter.v1.aufsdrwxr-xr-x 3 root root 4096 Aug 14 10:47 io.containerd.snapshotter.v1.nativedrwxr-xr-x 3 root root 4096 Aug 14 10:47 io.containerd.snapshotter.v1.overlayfs
Copy

Resolution

You need to manually change the permission to 0700 for above directory using chmod command.

Change permission
    
xxxxxxxxxx
 
# chmod -R 0700  io.containerd.snapshotter.v1.aufs# chmod -R 0700  io.containerd.snapshotter.v1.native# chmod -R 0700  io.containerd.snapshotter.v1.overlayfs
Copy

Directory permissions inside /var/lib/containerd should look like below:

/var/lib/containerd
    
xxxxxxxxxx
 
# ls -ll /var/lib/containerdtotal 40drwxr-xr-x 4 root root 4096 Aug  2 07:56 io.containerd.content.v1.contentdrwxr-xr-x 4 root root 4096 Aug  2 07:57 io.containerd.grpc.v1.cridrwx--x--x 2 root root 4096 Aug  2 07:56 io.containerd.metadata.v1.boltdrwx--x--x 2 root root 4096 Aug  2 07:56 io.containerd.runtime.v1.linuxdrwx--x--x 3 root root 4096 Aug  2 07:57 io.containerd.runtime.v2.taskdrwx------ 3 root root 4096 Aug  2 07:56 io.containerd.snapshotter.v1.aufsdrwx------ 2 root root 4096 Aug  2 07:56 io.containerd.snapshotter.v1.btrfsdrwx------ 3 root root 4096 Aug  2 07:56 io.containerd.snapshotter.v1.nativedrwx------ 3 root root 4096 Aug  2 07:56 io.containerd.snapshotter.v1.overlayfsdrwx------ 2 root root 4096 Sep 21 02:00 tmpmounts
Copy

Last updated on

Was this page helpful?