What happened?
Cilium is able to add its own mount, it handles this with an init container:
mount | grep bpf
bpf on /sys/fs/bpf type bpf (rw,relatime,mode=700)
Kubespray adds an fstab entry:
bpffs /sys/fs/bpf bpf defaults 0 0 in https://github.com/kubernetes-sigs/kubespray/blob/master/roles/network_plugin/cilium/tasks/install.yml
If you do a mount -a, you get a 2nd mount point appearing:
mount | grep bpf
bpf on /sys/fs/bpf type bpf (rw,relatime,mode=700)
bpffs on /sys/fs/bpf type bpf (rw,relatime)
This can cause problems with Cilium, which can then error:
Endpoint policy program not available DROPPED (UDP)
Likely due to orphaned eBPF objects Cilium already pinned.
If we perform an unmount, removing the fstab mount point, Cilium is fine.
umount /sys/fs/bpf
mount | grep bpf
bpf on /sys/fs/bpf type bpf (rw,relatime,mode=700)
The fstab entry is unneeded because Cilium's init containers already handle it. So it serves no purpose and can cause problems.
What did you expect to happen?
Cilium not having multiple bpf mounts.
How can we reproduce it (as minimally and precisely as possible)?
Deploy a kubespray cluster using Cilium.
Check for the fstab entry for bpffs
Do mount -a
See if there are 2 mounts.
For example issue created by the double mount see: cilium/cilium#8869
OS
Ubuntu 22
Version of Ansible
n/a
Version of Python
n/a
Version of Kubespray (commit)
2.29.0
Network plugin used
cilium
Full inventory with variables
n/a
Command used to invoke ansible
n/a
Output of ansible run
n/a
Anything else we need to know
No response
What happened?
Cilium is able to add its own mount, it handles this with an init container:
mount | grep bpf
bpf on /sys/fs/bpf type bpf (rw,relatime,mode=700)
Kubespray adds an fstab entry:
bpffs /sys/fs/bpf bpf defaults 0 0 in https://github.com/kubernetes-sigs/kubespray/blob/master/roles/network_plugin/cilium/tasks/install.yml
If you do a mount -a, you get a 2nd mount point appearing:
mount | grep bpf
bpf on /sys/fs/bpf type bpf (rw,relatime,mode=700)
bpffs on /sys/fs/bpf type bpf (rw,relatime)
This can cause problems with Cilium, which can then error:
Endpoint policy program not available DROPPED (UDP)
Likely due to orphaned eBPF objects Cilium already pinned.
If we perform an unmount, removing the fstab mount point, Cilium is fine.
umount /sys/fs/bpf
mount | grep bpf
bpf on /sys/fs/bpf type bpf (rw,relatime,mode=700)
The fstab entry is unneeded because Cilium's init containers already handle it. So it serves no purpose and can cause problems.
What did you expect to happen?
Cilium not having multiple bpf mounts.
How can we reproduce it (as minimally and precisely as possible)?
Deploy a kubespray cluster using Cilium.
Check for the fstab entry for bpffs
Do mount -a
See if there are 2 mounts.
For example issue created by the double mount see: cilium/cilium#8869
OS
Ubuntu 22
Version of Ansible
n/a
Version of Python
n/a
Version of Kubespray (commit)
2.29.0
Network plugin used
cilium
Full inventory with variables
n/a
Command used to invoke ansible
n/a
Output of ansible run
n/a
Anything else we need to know
No response