Skip to content

coroot-node not working with secureboot #205

Closed

Description

@soulwhisper

K8S version talos-v1.10.1, coroot-operator version 0.3.1, secureboot enabled.

error logs as follows:

E0510 07:37:43.249018  170739 profiling.go:105] load bpf objects: field DisassociateCtty: program disassociate_ctty: load program: invalid argument

E0510 07:37:46.283135  170739 tracer.go:472] open /sys/kernel/tracing/events/task/task_newtask/format: no such file or directory

full logs as follows:

k logs coroot-node-agent-67lmm
I0510 07:37:41.349229  170739 net.go:26] whitelisted public IPs: [0.0.0.0/0]
I0510 07:37:41.349983  170739 net.go:38] ephemeral-port-range: 32768-60999
I0510 07:37:41.652038  170739 cilium.go:48] found cilium ebpf-map: cilium_ct4_global
I0510 07:37:41.652123  170739 cilium.go:56] no such file or directory
I0510 07:37:41.652226  170739 cilium.go:64] no such file or directory
I0510 07:37:41.652364  170739 cilium.go:66] found cilium ebpf-map: cilium_lb4_backends_v3
I0510 07:37:41.652417  170739 cilium.go:74] no such file or directory
I0510 07:37:41.652442  170739 cilium.go:74] no such file or directory
W0510 07:37:41.653298  170739 systemd.go:38] failed to connect to systemd bus: dial unix /proc/1/root/run/systemd/private: connect: no such file or directory
I0510 07:37:41.653498  170739 main.go:108] agent version: 1.23.22
I0510 07:37:41.653829  170739 main.go:114] hostname: exarch-03
I0510 07:37:41.653850  170739 main.go:115] kernel version: 6.12.25-talos
I0510 07:37:41.655774  170739 main.go:72] machine-id:  d36391799e9d53b9794f3447cee0b495
I0510 07:37:41.656120  170739 tracing.go:40] OpenTelemetry traces collector endpoint: http://coroot-coroot.monitoring-system:8080/v1/traces
I0510 07:37:41.657018  170739 otel.go:30] OpenTelemetry logs collector endpoint: http://coroot-coroot.monitoring-system:8080/v1/logs
I0510 07:37:41.658060  170739 metadata.go:74] cloud provider:
I0510 07:37:41.658121  170739 collector.go:157] instance metadata: <nil>
I0510 07:37:41.658721  170739 profiling.go:57] profiles endpoint: http://coroot-coroot.monitoring-system:8080/v1/profiles
E0510 07:37:43.249018  170739 profiling.go:105] load bpf objects: field DisassociateCtty: program disassociate_ctty: load program: invalid argument
E0510 07:37:43.249018  170739 profiling.go:105] load bpf objects: field DisassociateCtty: program disassociate_ctty: load program: invalid argument
E0510 07:37:43.249018  170739 profiling.go:105] load bpf objects: field DisassociateCtty: program disassociate_ctty: load program: invalid argument
E0510 07:37:43.249018  170739 profiling.go:105] load bpf objects: field DisassociateCtty: program disassociate_ctty: load program: invalid argument
I0510 07:37:43.250872  170739 cgroup_linux.go:51] cgroup v2 root is /host/sys/fs/cgroup
W0510 07:37:43.252942  170739 registry.go:90] Cannot connect to the Docker daemon at unix:///proc/1/root/run/docker.sock. Is the docker daemon running?
W0510 07:37:43.252942  170739 registry.go:90] Cannot connect to the Docker daemon at unix:///proc/1/root/run/docker.sock. Is the docker daemon running?
I0510 07:37:46.267400  170739 containerd.go:38] using /run/containerd/containerd.sock
I0510 07:37:46.267614  170739 crio.go:58] cri-o socket:
W0510 07:37:46.282622  170739 registry.go:99] systemd journal not found in /proc/1/root/run/log/journal,/proc/1/root/var/log/journal
W0510 07:37:46.282622  170739 registry.go:99] systemd journal not found in /proc/1/root/run/log/journal,/proc/1/root/var/log/journal
E0510 07:37:46.283135  170739 tracer.go:472] open /sys/kernel/tracing/events/task/task_newtask/format: no such file or directory
E0510 07:37:46.283135  170739 tracer.go:472] open /sys/kernel/tracing/events/task/task_newtask/format: no such file or directory
E0510 07:37:46.283135  170739 tracer.go:472] open /sys/kernel/tracing/events/task/task_newtask/format: no such file or directory
E0510 07:37:46.283135  170739 tracer.go:472] open /sys/kernel/tracing/events/task/task_newtask/format: no such file or directory
E0510 07:37:47.069617  170739 tracer.go:213] load program: invalid argument:
        0: R1=ctx() R10=fp0
        ; int openssl_SSL_write_enter_v1_1_1(struct pt_regs *ctx) { @ openssl.c:99
        0: (bf) r9 = r1                       ; R1=ctx() R9_w=ctx()
        ; WRITE_ENTER(ctx, bio_st_v1_1_1); @ openssl.c:100
        1: (79) r3 = *(u64 *)(r9 +112)        ; R3_w=scalar() R9_w=ctx()
        2: (bf) r1 = r10                      ; R1_w=fp0 R10=fp0
        ;  @ openssl.c:0
        3: (07) r1 += -64                     ; R1_w=fp-64
        ; WRITE_ENTER(ctx, bio_st_v1_1_1); @ openssl.c:100
        4: (b7) r2 = 32                       ; R2_w=32
        5: (85) call bpf_probe_read#4
        program of this type cannot use helper bpf_probe_read#4
        processed 6 insns (limit 1000000) max_states_per_insn 0 total_states 0 peak_states 0 mark_read 0
E0510 07:37:47.069617  170739 tracer.go:213] load program: invalid argument:
        0: R1=ctx() R10=fp0
        ; int openssl_SSL_write_enter_v1_1_1(struct pt_regs *ctx) { @ openssl.c:99
        0: (bf) r9 = r1                       ; R1=ctx() R9_w=ctx()
        ; WRITE_ENTER(ctx, bio_st_v1_1_1); @ openssl.c:100
        1: (79) r3 = *(u64 *)(r9 +112)        ; R3_w=scalar() R9_w=ctx()
        2: (bf) r1 = r10                      ; R1_w=fp0 R10=fp0
        ;  @ openssl.c:0
        3: (07) r1 += -64                     ; R1_w=fp-64
        ; WRITE_ENTER(ctx, bio_st_v1_1_1); @ openssl.c:100
        4: (b7) r2 = 32                       ; R2_w=32
        5: (85) call bpf_probe_read#4
        program of this type cannot use helper bpf_probe_read#4
        processed 6 insns (limit 1000000) max_states_per_insn 0 total_states 0 peak_states 0 mark_read 0
E0510 07:37:47.069617  170739 tracer.go:213] load program: invalid argument:
        0: R1=ctx() R10=fp0
        ; int openssl_SSL_write_enter_v1_1_1(struct pt_regs *ctx) { @ openssl.c:99
        0: (bf) r9 = r1                       ; R1=ctx() R9_w=ctx()
        ; WRITE_ENTER(ctx, bio_st_v1_1_1); @ openssl.c:100
        1: (79) r3 = *(u64 *)(r9 +112)        ; R3_w=scalar() R9_w=ctx()
        2: (bf) r1 = r10                      ; R1_w=fp0 R10=fp0
        ;  @ openssl.c:0
        3: (07) r1 += -64                     ; R1_w=fp-64
        ; WRITE_ENTER(ctx, bio_st_v1_1_1); @ openssl.c:100
        4: (b7) r2 = 32                       ; R2_w=32
        5: (85) call bpf_probe_read#4
        program of this type cannot use helper bpf_probe_read#4
        processed 6 insns (limit 1000000) max_states_per_insn 0 total_states 0 peak_states 0 mark_read 0
E0510 07:37:47.069617  170739 tracer.go:213] load program: invalid argument:
        0: R1=ctx() R10=fp0
        ; int openssl_SSL_write_enter_v1_1_1(struct pt_regs *ctx) { @ openssl.c:99
        0: (bf) r9 = r1                       ; R1=ctx() R9_w=ctx()
        ; WRITE_ENTER(ctx, bio_st_v1_1_1); @ openssl.c:100
        1: (79) r3 = *(u64 *)(r9 +112)        ; R3_w=scalar() R9_w=ctx()
        2: (bf) r1 = r10                      ; R1_w=fp0 R10=fp0
        ;  @ openssl.c:0
        3: (07) r1 += -64                     ; R1_w=fp-64
        ; WRITE_ENTER(ctx, bio_st_v1_1_1); @ openssl.c:100
        4: (b7) r2 = 32                       ; R2_w=32
        5: (85) call bpf_probe_read#4
        program of this type cannot use helper bpf_probe_read#4
        processed 6 insns (limit 1000000) max_states_per_insn 0 total_states 0 peak_states 0 mark_read 0
F0510 07:37:47.069684  170739 main.go:155] failed to load collection: program openssl_SSL_write_enter_v1_1_1: load program: invalid argument: program of this type cannot use helper bpf_probe_read#4 (12 line(s) omitted)
F0510 07:37:47.069684  170739 main.go:155] failed to load collection: program openssl_SSL_write_enter_v1_1_1: load program: invalid argument: program of this type cannot use helper bpf_probe_read#4 (12 line(s) omitted)
F0510 07:37:47.069684  170739 main.go:155] failed to load collection: program openssl_SSL_write_enter_v1_1_1: load program: invalid argument: program of this type cannot use helper bpf_probe_read#4 (12 line(s) omitted)
F0510 07:37:47.069684  170739 main.go:155] failed to load collection: program openssl_SSL_write_enter_v1_1_1: load program: invalid argument: program of this type cannot use helper bpf_probe_read#4 (12 line(s) omitted)
F0510 07:37:47.069684  170739 main.go:155] failed to load collection: program openssl_SSL_write_enter_v1_1_1: load program: invalid argument: program of this type cannot use helper bpf_probe_read#4 (12 line(s) omitted)

Activity

  1. changed the title [-]openssl_SSL_write_enter_v1_1_1 invalid argument[/-] [+]talos v1.10 node failed to start[/+] on May 10, 2025
  2. changed the title [-]talos v1.10 node failed to start[/-] [+]coroot-node not working with secureboot[/+] on May 13, 2025
  3. soulwhisper commented on May 13, 2025

    @soulwhisper
    Author

    further test on same schema with secureboot disabled, coroot-node working good.

    I found fix from upstream components. I should use kernel args when building image -lockdown lockdown=integrity.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions