Running minc with rootless

[praveenkumar]

This is tracker issue to identify what are the shortcoming to run the MicroShift in container in rootless mode.

[praveenkumar]

#21 have one of the ask for same.

[praveenkumar]

We need to explore around https://kubernetes.io/docs/tasks/administer-cluster/kubelet-in-userns/ one because kind is also using same https://github.com/kubernetes-sigs/kind/blob/1e95d05eeccdf615e24d7af11276e2954fe265a2/pkg/cluster/internal/kubeadm/config.go#L498

[praveenkumar]

With all those changes like in the microshift side

# cat /etc/microshift/config.d/00-kubelet-enable-feature.yaml 
kubelet:
  featureGates:
    KubeletInUserNamespace: true

I am able to run microshift service as rootless but looks like pods are not coming up as expected :(

# oc get pods -A
NAMESPACE              NAME                                       READY   STATUS                      RESTARTS   AGE
kube-flannel           kube-flannel-ds-fd76k                      0/1     Init:CreateContainerError   0          22s
kube-proxy             kube-proxy-2g9fs                           0/1     CreateContainerError        0          22s
kube-system            csi-snapshot-controller-75d84cb97c-mp2d5   0/1     Pending                     0          30s
openshift-dns          node-resolver-m6gtd                        0/1     CreateContainerError        0          22s
openshift-ingress      router-default-76cdd4b765-8cn22            0/1     Pending                     0          29s
openshift-service-ca   service-ca-df6759f9d-zwm2w                 0/1     Pending                     0          29s

debug output of kube-proxy container

# oc describe pod kube-proxy-2g9fs -n kube-proxy
Events:
  Type     Reason     Age                From               Message
  ----     ------     ----               ----               -------
  Normal   Scheduled  106s               default-scheduler  Successfully assigned kube-proxy/kube-proxy-2g9fs to 127.0.0.1.nip.io
  Normal   Pulling    105s               kubelet            Pulling image "quay.io/okd/scos-content@sha256:f474e3714d152336efa27ad45035cbf8b417fa4cb524fa7d0ca91b815d704114"
  Warning  Failed     99s                kubelet            Error: failed to add conmon to systemd sandbox cgroup: start transient unit "crio-conmon-f62328b0448b3681987a5bd4bca274ca9b81eb3c8075b9b306ffa7dc2bb21ad7.scope": could not execute `systemctl --user --no-pager show-environment`, output="Failed to connect to bus: No medium found\n": exit status 1
  Normal   Pulled     99s                kubelet            Successfully pulled image "quay.io/okd/scos-content@sha256:f474e3714d152336efa27ad45035cbf8b417fa4cb524fa7d0ca91b815d704114" in 5.776s (5.776s including waiting). Image size: 335179203 bytes.
  Warning  Failed     99s                kubelet            Error: failed to add conmon to systemd sandbox cgroup: start transient unit "crio-conmon-b98992a74d4044b3490950152cf25517b161bbd172b74c41a9692414a5d9cc80.scope": could not execute `systemctl --user --no-pager show-environment`, output="Failed to connect to bus: No medium found\n": exit status 1
  Warning  Failed     88s                kubelet            Error: failed to add conmon to systemd sandbox cgroup: start transient unit "crio-conmon-7f14846d04e154469232fa17387eb2528b783b2f2fa31e333b50a24ef9e66cff.scope": could not execute `systemctl --user --no-pager show-environment`, output="Failed to connect to bus: No medium found\n": exit status 1

[praveenkumar]

We also need https://kind.sigs.k8s.io/docs/user/rootless/#host-requirements to delegate the cpu/mem from host to container.