Remove privileges from virt-launcher of SR-IOV attached VMI
Fixes
@@ -56,6 +56,7 @@ const GenieNetworksAnnotation = "cni"
const CAP_NET_ADMIN = "NET_ADMIN"
const CAP_SYS_NICE = "SYS_NICE"
+const CAP_SYS_RESOURCE = "SYS_RESOURCE"
// LibvirtStartupDelay is added to custom liveness and readiness probes initial delay value.
// Libvirt needs roughly 10 seconds to start.
@@ -315,7 +316,6 @@ func (t *templateService) RenderLaunchManifest(vmi *v1.VirtualMachineInstance) (
var volumes []k8sv1.Volume
var volumeDevices []k8sv1.VolumeDevice
var userId int64 = 0
- // Privileged mode is disabled by default.
var privileged bool = false
var volumeMounts []k8sv1.VolumeMount
var imagePullSecrets []k8sv1.LocalObjectReference
@@ -384,14 +384,6 @@ func (t *templateService) RenderLaunchManifest(vmi *v1.VirtualMachineInstance) (
},
},
})
-
- // todo: revisit when SR-IOV DP registers /dev/vfio/NN with pod
- // device group:
- // https://github.com/intel/sriov-network-device-plugin/pull/26
- //
- // Run virt-launcher compute container privileged to allow qemu
- // to open /dev/vfio/NN for PCI passthrough
- privileged = true
}
serviceAccountName := ""
@@ -935,6 +927,12 @@ func getRequiredCapabilities(vmi *v1.VirtualMachineInstance) []k8sv1.Capability
}
// add a CAP_SYS_NICE capability to allow setting cpu affinity
res = append(res, CAP_SYS_NICE)
+
+ if isSRIOVVmi(vmi) {
+ // this capability is needed for libvirt to be able to change ulimits for device passthrough:
+ // "error : cannot limit locked memory to 2098200576: Operation not permitted"
+ res = append(res, CAP_SYS_RESOURCE)
+ }
return res
}
