Doesn't work with gvisor

[Pithikos]

I'm relatively new to Kubernetes and need to add SSL between pods. I thought of using linkerd since it seems the most minimal solution out there.

However it seems I can't get it working under gvisor.

    State:       Waiting
      Reason:    CrashLoopBackOff
    Last State:  Terminated
      Reason:    Error
      Message:   vel=info msg="iptables-save v1.8.8 (legacy): Cannot initialize: Permission denied (you must be root)\n\n"
time="2023-02-22T08:48:46Z" level=error msg="aborting firewall configuration"

My test deployment looks like below

apiVersion: apps/v1
kind: Deployment
metadata:
  name: myapp
  labels:
    app: myapp
spec:
  replicas: 1
  selector:
    matchLabels:
      app: myapp
  template:
    metadata:
      labels:
        app: myapp
      annotations:
        linkerd.io/inject: enabled
    spec:
      runtimeClassName: gvisor  # This brings havoc
      containers:
        - name: myapp
          image: nginx:latest
          ports:
            - containerPort: 80

How do I resolve this?

[mateiidavid]

@Pithikos hm, interesting. Haven't seen many people use gvisor as a container runtime. Have you tried installing with the initContainer set to runAsRoot?

linkerd install --set proxyInit.runAsRoot=true.

Or alternatively, try using the CNI plugin. It'll be executed on the host so generally you don't need to run anything as root, or give the binary any special permissions.

[Pithikos]

Just FYI, I was trying with CNI. But it ended up way too much work from what I've hoped for. For already very secure tight-up pods it seemed a lot of debugging and issues. A bit overwhelming - I had hoped to be able to just plug and play but it seems it doesn't play very well with a lot of securityContext directives and gvisor.

In the end I changed my architecture to do the encryption at application layer.