From 5d17ea45a9535fb3d1d5d0d99d63ff52fa3090ef Mon Sep 17 00:00:00 2001 From: emma034186-stack Date: Wed, 22 Jul 2026 22:17:51 +0800 Subject: [PATCH] fix(cilium): stop early if kube_owner is not root (#13385) Cilium's init containers run as UID 0 with capabilities (including CAP_DAC_OVERRIDE) dropped, so host paths it writes to (e.g. /opt/cni/bin) must be owned by root or it will fail with a permission error. Add a pre-flight assert that fails fast with a clear message when kube_network_plugin == cilium and kube_owner != root, instead of changing CNI bin ownership defaults for all network plugins. --- .../preinstall/tasks/0040-verify-settings.yml | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/roles/kubernetes/preinstall/tasks/0040-verify-settings.yml b/roles/kubernetes/preinstall/tasks/0040-verify-settings.yml index 1395087c1..c3333671f 100644 --- a/roles/kubernetes/preinstall/tasks/0040-verify-settings.yml +++ b/roles/kubernetes/preinstall/tasks/0040-verify-settings.yml @@ -68,6 +68,18 @@ - kube_network_plugin == 'cilium' or cilium_deploy_additionally - not ignore_assert_errors +- name: Stop if kube_owner is not root when using cilium + assert: + that: kube_owner == 'root' + fail_msg: | + kube_owner is set to '{{ kube_owner }}', but cilium requires it to be 'root'. + Cilium's init containers run as UID 0 with capabilities (including CAP_DAC_OVERRIDE) dropped, + so host paths it writes to (e.g. /opt/cni/bin) must be owned by root or it will fail with + a permission error. See https://github.com/kubernetes-sigs/kubespray/issues/13378 + when: + - kube_network_plugin == 'cilium' or cilium_deploy_additionally + - not ignore_assert_errors + - name: Stop if kernel version is too low for nftables assert: that: ansible_facts['kernel'].split('-')[0] is version('5.13', '>=')