lxd-profile doesn't contain lxc.cgroup.devices.allow

[Chris Sanders]

When deploying charmed-kubernetes on LXD I'm seeing containers fail with this error:
message: 'failed to create containerd task: OCI runtime create failed: container_linux.go:349:
          starting container process caused "process_linux.go:449: container init
          caused \"process_linux.go:415: setting cgroup config for procHooks process
          caused \\\"failed to write \\\\\\\"a *:* rwm\\\\\\\" to \\\\\\\"/sys/fs/cgroup/devices/kubepods/besteffort/pod1ba9b91e-9e37-4ecf-9725-4c53bd198ca8/8bfe325d1d24c795663ada9aa8f36b1f7a3e28e5dda283601887c42913f0585d/devices.allow\\\\\\\":
          write /sys/fs/cgroup/devices/kubepods/besteffort/pod1ba9b91e-9e37-4ecf-9725-4c53bd198ca8/8bfe325d1d24c795663ada9aa8f36b1f7a3e28e5dda283601887c42913f0585d/devices.allow:
          operation not permitted\\\"\"": unknown'

Adding the following to my lxd profile solves the issue.
lxc.cgroup.devices.allow=a

However, keys are not merged and the charm installs it's own profile after any model-specific profiles are applied over writing the change. This means you have to define a profile with
raw.lxc: |
    lxc.apparmor.profile=unconfined
    lxc.mount.auto=proc:rw sys:rw
    lxc.cgroup.devices.allow=a
    lxc.cap.drop=

Then apply the profile after the charm has installed, and restart for it to work. Including the cgroup lxc raw value in the lxd-profile would make the manual steps unnecessary and lxd installs would just work out of the box.

[George Kraft (cynerva)]

If you can share what version of Ubuntu this occurred on and what version of LXD you were running, it would help us reproduce it.

[Chris Sanders (chris.sanders)]

Distributor ID: Ubuntu
Description: Ubuntu 18.04.4 LTS
Release: 18.04
Codename: bionic

lxd --version
3.0.3

Deploying 1.18 channel if that matters.

[Tim Van Steenburgh (tvansteenburgh)]

https://github.com/charmed-kubernetes/charm-kubernetes-master/pull/97
https://github.com/charmed-kubernetes/charm-kubernetes-worker/pull/62

[George Kraft (cynerva)]

Cherry-pick to stable:
https://github.com/charmed-kubernetes/charm-kubernetes-master/commit/6aec1ff325b075c7a1bfeaa3765347c24f9bc686
https://github.com/charmed-kubernetes/charm-kubernetes-worker/commit/3d7560b72033824e14c3763d030cf778602c6c90