deletion of a SelinuxProfile object hangs forever
#2684
Labels
kind/bug
Categorizes issue or PR as related to a bug.
Comments
spod "security-profiles-operator" Logsspod "selinuxd" Logs |
|
After further testing, if I have all the objects in the same yaml file, the delete hangs and the But if I separate out the When it hangs: NamespaceSelinuxProfilesThe profile is being deleted off the Node: Before Delete Call: After Delete Call while command is hung: Following the logs, it appears that the |
|
Please could you try to verify if this issue is still occurring when the latest release? Also please could you check in the profile that the finalizer associated with the pod is removed after the pod is deleted. The profile CR should not be referenced by any pod, otherwise won't be deleted. |
|
Yes, v0.9.0 fixed the issue. After further investigation, I'm pretty what was happening is that when the application namespace was deleted, the SecurityProfileNodeStatus instance was deleted, but the SelinuxProfile still had the node finalizers (which are deleted by the SecurityProfileNodeStatus code), so it was hung. I was in the process of adding a finalizer to the SecurityProfileNodeStatus so it wouldn't be deleted until it was able to delete the node finalizer from the SelinuxProfile. But I was having trouble deleting the new SecurityProfileNodeStatus finalizer. Moving to Cluster Scoped fixed the problem. |
|
I did notice #2745 while testing with v0.9.0. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
With the security-profiles-operator.v0.8.6
Same issue as #2215, but I was unable to reopen it. I am a coworker of Andrew (who left the company) and the original issue is still happening. The nodes are not coming and going. The logs below are current logs, but very similar to those in #2215.
What happened:
I attempt to delete a
selinuxProfilebut unable to because the finalizers are never removed by the node agents.First deployed the security-profiles-operator on Openshift with 3 master and 3 worker nodes via OperatorHub and the OCP Console:
security-profiles-operator
Then create an application
Namespaceand aSelinuxProfilein that namespace:SelinuxProfile After Create
Then create a pod in the application namespace to use the
SelinuxProfile.SelinuxProfile After Application Pod Created
After a few minutes when pod is verified to be working properly, remove the pod.
SelinuxProfile After Application Pod Deleted
Then attempt to delete the
SelinuxProfileand the command hangs.SelinuxProfile After Attempting to delete SelinuxProfile
security-profiles-operator Logs
What you expected to happen:
SelinuxProfileis cleaned up correctlyHow to reproduce it (as minimally and precisely as possible):
Spin up an Openshift 4.18-nightly cluster with 3 master and 3 worker nodes on GCP
$ kubectl version
Client Version: v1.28.2
Kustomize Version: v5.0.4-0.20230601165947-6ce0bf390ce3
Server Version: v1.31.4
First deployed the security-profiles-operator on Openshift 4.18-nightly with 3 master and 3 worker nodes via OperatorHub and the OCP Console.
install a SelinuxProfile, use it in a pod, then delete it
Anything else we need to know?:
Environment:
cat /etc/os-release):uname -a):The text was updated successfully, but these errors were encountered: