Skip to content

fix(network): add CAP_NET_ADMIN to non-root virt-launcher #2415

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
loktev-d wants to merge 8 commits into
base: main
Choose a base branch
from
Draft

fix(network): add CAP_NET_ADMIN to non-root virt-launcher #2415

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
f4cf17e
wip
loktev-d May 28, 2026
290fadf
Merge branch 'main' into fix/kubevirt/launcher-cap-net-admin
loktev-d May 28, 2026
848e898
add file caps
loktev-d May 28, 2026
1ff6e0c
bump cache
loktev-d May 28, 2026
5448dda
bump cache
loktev-d May 28, 2026
2dd26c6
wip
loktev-d May 29, 2026
d14a74b
wip
loktev-d May 29, 2026
0b44de4
Revert "wip"
loktev-d May 29, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion build/components/versions.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@ firmware:
libvirt: v10.9.0
edk2: stable202411
core:
3p-kubevirt: v1.6.2-v12n.38
3p-kubevirt: fix/network/net-admin
3p-containerized-data-importer: v1.60.3-v12n.19
distribution: 2.8.3
package:
Expand Down
6 changes: 4 additions & 2 deletions images/virt-artifact/werf.inc.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,13 +2,14 @@
# Source https://github.com/kubevirt/kubevirt/blob/v1.3.1/hack/dockerized#L15
{{- $gitRepoName := "3p-kubevirt" }}
{{- $gitRepoUrl := (printf "%s/%s" "deckhouse" $gitRepoName) }}
{{- $tag := get $.Core $gitRepoName }}
{{- $version := (split "-" $tag)._0 }}
{{- $tag := "fix/network/net-admin" }}
{{- $version := "v1.6.2" }}

---
image: {{ .ModuleNamePrefix }}{{ .ImageName }}-src-artifact
final: false
fromImage: builder/src
fromCacheVersion: "2026-05-28-2"
secrets:
- id: SOURCE_REPO
value: {{ $.SOURCE_REPO }}
Expand Down Expand Up @@ -44,6 +45,7 @@ packages:
image: {{ .ModuleNamePrefix }}{{ .ImageName }}
final: false
fromImage: {{ eq $.SVACE_ENABLED "false" | ternary "builder/golang-alt-1.25" "builder/golang-alt-svace-1.25" }}
fromCacheVersion: "2026-05-28-2"
mount:
{{- include "mount points for golang builds" . }}
secrets:
Expand Down
9 changes: 7 additions & 2 deletions images/virt-launcher/werf.inc.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,7 @@
image: {{ .ModuleNamePrefix }}{{ .ImageName }}
final: true
fromImage: {{ .ModuleNamePrefix }}distroless
fromCacheVersion: "2026-05-28-4"
git:
{{- include "image mount points" . }}
import:
Expand Down Expand Up @@ -135,6 +136,7 @@ packages:
image: {{ .ModuleNamePrefix }}{{ .ImageName }}-binaries
final: false
fromImage: {{ .ModuleNamePrefix }}base-alt-p11-binaries
fromCacheVersion: "2026-05-28-4"
git:
# Add qemu and virtqemud configs
- add: {{ .ModuleDir }}/images/{{ .ImageName }}/configs
Expand Down Expand Up @@ -392,8 +394,9 @@ shell:
ln -s var/run run

- |
setcap cap_net_bind_service=+ep /relocate/usr/bin/virt-launcher-monitor
setcap cap_net_bind_service=+ep /relocate/usr/bin/tini
setcap cap_net_bind_service,cap_net_admin=+ep /relocate/usr/bin/virt-launcher-monitor
setcap cap_net_bind_service,cap_net_admin=+ep /relocate/usr/bin/virt-launcher
setcap cap_net_bind_service,cap_net_admin=+ep /relocate/usr/bin/tini

# /etc/libvirt-init will be copied back into /etc/libvirt at runtime. This is necessary because we configure libvirt to mount /etc/libvirt and set readOnlyRootFilesystem for other directories.
# DO NOT REMOVE. node-labeler.sh uses /etc/libvirt.
Expand All @@ -404,6 +407,7 @@ shell:
image: {{ .ModuleNamePrefix }}{{ .ImageName }}-gobuilder
final: false
fromImage: {{ eq $.SVACE_ENABLED "false" | ternary "builder/golang-alt-1.25" "builder/golang-alt-svace-1.25" }}
fromCacheVersion: "2026-05-28-4"
git:
- add: {{ .ModuleDir }}/images/{{ .ImageName }}/node-labeller
to: /node-labeller
Expand Down Expand Up @@ -456,6 +460,7 @@ shell:
image: {{ .ModuleNamePrefix }}{{ .ImageName }}-cbuilder
final: false
fromImage: {{ eq $.SVACE_ENABLED "false" | ternary "builder/golang-bookworm-1.25" "builder/golang-alt-svace-1.25" }}
fromCacheVersion: "2026-05-28-4"
git:
- add: {{ .ModuleDir }}/images/{{ .ImageName }}/static_binaries
to: /static_binaries
Expand Down
Loading