Runing kuryr-libnetworks not from root user fails

[Dmitriy Rabotyagov]

I'm trying to run kuryr-libnetwork as not privileged user (kuryr) with systemd-service, by setting AmbientCapabilities and CapabilityBoundingSet as CAP_NET_ADMIN (the way it's documented here https://docs.openstack.org/kuryr-libnetwork/latest/install/compute-install-ubuntu.html)

However, when I try to verify it's operation I have the following trace: http://paste.openstack.org/show/785947/

AFAIK, using oslo_concurrency execute as root requires setting rootwrap, which is not the case: https://opendev.org/openstack/kuryr/src/branch/master/kuryr/lib/binding/drivers/veth.py#L148

But running kuryr as root is not really secure IMO especially when rootwrap is used everywhere.

[Andrew Bonney (andrewbonney)]

I've pushed a change to https://review.opendev.org/c/openstack/kuryr/+/764908 which I believe should help with this, provided 'AmbientCapabilities' are still used for non-root users.

I had a go at a couple of alternatives with root helpers or privsep too, but this doesn't appear to avoid the need for an ambient capability due to what happens within the 'pyroute2' library:
- https://github.com/bbc/kuryr/tree/root-helper
- https://github.com/bbc/kuryr/tree/privsep

[Andrew Bonney (andrewbonney)]

Would it be reasonable for this fix to be backported at least to Victoria, if not Ussuri too?

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/kuryr 2.3.0 release.

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/kuryr 2.0.1 release.

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/kuryr 2.1.1 release.