Repository navigation
coroot-node not working with secureboot #205
Copy link
Copy link
Closed
Description
K8S version talos-v1.10.1, coroot-operator version 0.3.1, secureboot enabled.
error logs as follows:
E0510 07:37:43.249018 170739 profiling.go:105] load bpf objects: field DisassociateCtty: program disassociate_ctty: load program: invalid argument
E0510 07:37:46.283135 170739 tracer.go:472] open /sys/kernel/tracing/events/task/task_newtask/format: no such file or directoryfull logs as follows:
k logs coroot-node-agent-67lmm
I0510 07:37:41.349229 170739 net.go:26] whitelisted public IPs: [0.0.0.0/0]
I0510 07:37:41.349983 170739 net.go:38] ephemeral-port-range: 32768-60999
I0510 07:37:41.652038 170739 cilium.go:48] found cilium ebpf-map: cilium_ct4_global
I0510 07:37:41.652123 170739 cilium.go:56] no such file or directory
I0510 07:37:41.652226 170739 cilium.go:64] no such file or directory
I0510 07:37:41.652364 170739 cilium.go:66] found cilium ebpf-map: cilium_lb4_backends_v3
I0510 07:37:41.652417 170739 cilium.go:74] no such file or directory
I0510 07:37:41.652442 170739 cilium.go:74] no such file or directory
W0510 07:37:41.653298 170739 systemd.go:38] failed to connect to systemd bus: dial unix /proc/1/root/run/systemd/private: connect: no such file or directory
I0510 07:37:41.653498 170739 main.go:108] agent version: 1.23.22
I0510 07:37:41.653829 170739 main.go:114] hostname: exarch-03
I0510 07:37:41.653850 170739 main.go:115] kernel version: 6.12.25-talos
I0510 07:37:41.655774 170739 main.go:72] machine-id: d36391799e9d53b9794f3447cee0b495
I0510 07:37:41.656120 170739 tracing.go:40] OpenTelemetry traces collector endpoint: http://coroot-coroot.monitoring-system:8080/v1/traces
I0510 07:37:41.657018 170739 otel.go:30] OpenTelemetry logs collector endpoint: http://coroot-coroot.monitoring-system:8080/v1/logs
I0510 07:37:41.658060 170739 metadata.go:74] cloud provider:
I0510 07:37:41.658121 170739 collector.go:157] instance metadata: <nil>
I0510 07:37:41.658721 170739 profiling.go:57] profiles endpoint: http://coroot-coroot.monitoring-system:8080/v1/profiles
E0510 07:37:43.249018 170739 profiling.go:105] load bpf objects: field DisassociateCtty: program disassociate_ctty: load program: invalid argument
E0510 07:37:43.249018 170739 profiling.go:105] load bpf objects: field DisassociateCtty: program disassociate_ctty: load program: invalid argument
E0510 07:37:43.249018 170739 profiling.go:105] load bpf objects: field DisassociateCtty: program disassociate_ctty: load program: invalid argument
E0510 07:37:43.249018 170739 profiling.go:105] load bpf objects: field DisassociateCtty: program disassociate_ctty: load program: invalid argument
I0510 07:37:43.250872 170739 cgroup_linux.go:51] cgroup v2 root is /host/sys/fs/cgroup
W0510 07:37:43.252942 170739 registry.go:90] Cannot connect to the Docker daemon at unix:///proc/1/root/run/docker.sock. Is the docker daemon running?
W0510 07:37:43.252942 170739 registry.go:90] Cannot connect to the Docker daemon at unix:///proc/1/root/run/docker.sock. Is the docker daemon running?
I0510 07:37:46.267400 170739 containerd.go:38] using /run/containerd/containerd.sock
I0510 07:37:46.267614 170739 crio.go:58] cri-o socket:
W0510 07:37:46.282622 170739 registry.go:99] systemd journal not found in /proc/1/root/run/log/journal,/proc/1/root/var/log/journal
W0510 07:37:46.282622 170739 registry.go:99] systemd journal not found in /proc/1/root/run/log/journal,/proc/1/root/var/log/journal
E0510 07:37:46.283135 170739 tracer.go:472] open /sys/kernel/tracing/events/task/task_newtask/format: no such file or directory
E0510 07:37:46.283135 170739 tracer.go:472] open /sys/kernel/tracing/events/task/task_newtask/format: no such file or directory
E0510 07:37:46.283135 170739 tracer.go:472] open /sys/kernel/tracing/events/task/task_newtask/format: no such file or directory
E0510 07:37:46.283135 170739 tracer.go:472] open /sys/kernel/tracing/events/task/task_newtask/format: no such file or directory
E0510 07:37:47.069617 170739 tracer.go:213] load program: invalid argument:
0: R1=ctx() R10=fp0
; int openssl_SSL_write_enter_v1_1_1(struct pt_regs *ctx) { @ openssl.c:99
0: (bf) r9 = r1 ; R1=ctx() R9_w=ctx()
; WRITE_ENTER(ctx, bio_st_v1_1_1); @ openssl.c:100
1: (79) r3 = *(u64 *)(r9 +112) ; R3_w=scalar() R9_w=ctx()
2: (bf) r1 = r10 ; R1_w=fp0 R10=fp0
; @ openssl.c:0
3: (07) r1 += -64 ; R1_w=fp-64
; WRITE_ENTER(ctx, bio_st_v1_1_1); @ openssl.c:100
4: (b7) r2 = 32 ; R2_w=32
5: (85) call bpf_probe_read#4
program of this type cannot use helper bpf_probe_read#4
processed 6 insns (limit 1000000) max_states_per_insn 0 total_states 0 peak_states 0 mark_read 0
E0510 07:37:47.069617 170739 tracer.go:213] load program: invalid argument:
0: R1=ctx() R10=fp0
; int openssl_SSL_write_enter_v1_1_1(struct pt_regs *ctx) { @ openssl.c:99
0: (bf) r9 = r1 ; R1=ctx() R9_w=ctx()
; WRITE_ENTER(ctx, bio_st_v1_1_1); @ openssl.c:100
1: (79) r3 = *(u64 *)(r9 +112) ; R3_w=scalar() R9_w=ctx()
2: (bf) r1 = r10 ; R1_w=fp0 R10=fp0
; @ openssl.c:0
3: (07) r1 += -64 ; R1_w=fp-64
; WRITE_ENTER(ctx, bio_st_v1_1_1); @ openssl.c:100
4: (b7) r2 = 32 ; R2_w=32
5: (85) call bpf_probe_read#4
program of this type cannot use helper bpf_probe_read#4
processed 6 insns (limit 1000000) max_states_per_insn 0 total_states 0 peak_states 0 mark_read 0
E0510 07:37:47.069617 170739 tracer.go:213] load program: invalid argument:
0: R1=ctx() R10=fp0
; int openssl_SSL_write_enter_v1_1_1(struct pt_regs *ctx) { @ openssl.c:99
0: (bf) r9 = r1 ; R1=ctx() R9_w=ctx()
; WRITE_ENTER(ctx, bio_st_v1_1_1); @ openssl.c:100
1: (79) r3 = *(u64 *)(r9 +112) ; R3_w=scalar() R9_w=ctx()
2: (bf) r1 = r10 ; R1_w=fp0 R10=fp0
; @ openssl.c:0
3: (07) r1 += -64 ; R1_w=fp-64
; WRITE_ENTER(ctx, bio_st_v1_1_1); @ openssl.c:100
4: (b7) r2 = 32 ; R2_w=32
5: (85) call bpf_probe_read#4
program of this type cannot use helper bpf_probe_read#4
processed 6 insns (limit 1000000) max_states_per_insn 0 total_states 0 peak_states 0 mark_read 0
E0510 07:37:47.069617 170739 tracer.go:213] load program: invalid argument:
0: R1=ctx() R10=fp0
; int openssl_SSL_write_enter_v1_1_1(struct pt_regs *ctx) { @ openssl.c:99
0: (bf) r9 = r1 ; R1=ctx() R9_w=ctx()
; WRITE_ENTER(ctx, bio_st_v1_1_1); @ openssl.c:100
1: (79) r3 = *(u64 *)(r9 +112) ; R3_w=scalar() R9_w=ctx()
2: (bf) r1 = r10 ; R1_w=fp0 R10=fp0
; @ openssl.c:0
3: (07) r1 += -64 ; R1_w=fp-64
; WRITE_ENTER(ctx, bio_st_v1_1_1); @ openssl.c:100
4: (b7) r2 = 32 ; R2_w=32
5: (85) call bpf_probe_read#4
program of this type cannot use helper bpf_probe_read#4
processed 6 insns (limit 1000000) max_states_per_insn 0 total_states 0 peak_states 0 mark_read 0
F0510 07:37:47.069684 170739 main.go:155] failed to load collection: program openssl_SSL_write_enter_v1_1_1: load program: invalid argument: program of this type cannot use helper bpf_probe_read#4 (12 line(s) omitted)
F0510 07:37:47.069684 170739 main.go:155] failed to load collection: program openssl_SSL_write_enter_v1_1_1: load program: invalid argument: program of this type cannot use helper bpf_probe_read#4 (12 line(s) omitted)
F0510 07:37:47.069684 170739 main.go:155] failed to load collection: program openssl_SSL_write_enter_v1_1_1: load program: invalid argument: program of this type cannot use helper bpf_probe_read#4 (12 line(s) omitted)
F0510 07:37:47.069684 170739 main.go:155] failed to load collection: program openssl_SSL_write_enter_v1_1_1: load program: invalid argument: program of this type cannot use helper bpf_probe_read#4 (12 line(s) omitted)
F0510 07:37:47.069684 170739 main.go:155] failed to load collection: program openssl_SSL_write_enter_v1_1_1: load program: invalid argument: program of this type cannot use helper bpf_probe_read#4 (12 line(s) omitted)Reactions are currently unavailable
Metadata
Metadata
Assignees
Labels
No labels
Activity
[-]openssl_SSL_write_enter_v1_1_1 invalid argument[/-][+]talos v1.10 node failed to start[/+][-]talos v1.10 node failed to start[/-][+]coroot-node not working with secureboot[/+]soulwhisper commentedon May 13, 2025
further test on same schema with secureboot disabled, coroot-node working good.
I found fix from upstream components. I should use kernel args when building image
-lockdown lockdown=integrity.