Change:
https://k8s- https://k8s- Konnectivity network proxy tests have been failing since 5/7/2021. Looking at the diff of changes it seems like it's related to running the control plane as non root. () cc is there anything that needs to be changed on the konnectivity network proxy to support this? The proxy component communicates with the apiserver with a UDS socket. This is the error we're seeing in the tests: /sig api-machinery /sig cloud-provider
- I think I missed this component. I am working on a fix. I apologize for the inconvenience. Thanks for bringing this to my attention.
/triage accepted
/reopen The status of these jobs is still completely red :thinking: the fix merged with the job failing, maybe is unrelated but we should have the jobs green.
Reopened this issue. <detailsIn response to : /reopen Instructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details
the http job was been fixed but the grpc job still fails, most errors have the following message
can you please take a look to the grpc one to see if is the same issue or a new one?

Discussion:
sed -i -e "s@{{ *health_port *}}@$2@g" "${temp_file}" sed -i -e "s@{{ *admin_port *}}@$3@g" "${temp_file}" sed -i -e "s@{{ *liveness_probe_initial_delay *}}@30@g" "${temp_file}" <ins> if [[ -n "${KONNECTIVITY_SERVER_RUNASUSER:-}" && -n "${KONNECTIVITY_SERVER_RUNASGROUP:-}" && -n "${KONNECTIVITY_SERVER_SOCKET_WRITER_GROUP:-}" ]]; then sed -i -e "s@{{ *run_as_user *}}@runAsUser: ${KONNECTIVITY_SERVER_RUNASUSER}@g" "${temp_file}" sed -i -e "s@{{ *run_as_group *}}@runAsGroup: ${KONNECTIVITY_SERVER_RUNASGROUP}@g" "${temp_file}" sed -i -e "s@{{ *supplemental_groups *}}@supplementalGroups: [${KUBE_PKI_READERS_GROUP}]@g" "${temp_file}" sed -i -e "s@{{ *container_security_context *}}@securityContext:@g" "${temp_file}" sed -i -e "s@{{ *capabilities *}}@capabilities:@g" "${temp_file}" sed -i -e "s@{{ *drop_capabilities *}}@drop: [ ALL ]@g" "${temp_file}" sed -i -e "s@{{ *disallow_privilege_escalation *}}@allowPrivilegeEscalation: false@g" "${temp_file}" mkdir -p /etc/srv/kubernetes/konnectivity-server/ chown -R "${KONNECTIVITY_SERVER_RUNASUSER}":"${KONNECTIVITY_SERVER_RUNASGROUP}" /etc/srv/kubernetes/konnectivity-server chmod g+w /etc/srv/kubernetes/konnectivity-server else sed -i -e "s@{{ *run_as_user *}}@@g" "${temp_file}" sed -i -e "s@{{ *run_as_group *}}@@g" "${temp_file}" sed -i -e "s@{{ *supplemental_groups *}}@@g" "${temp_file}" sed -i -e "s@{{ *container_security_context *}}@@g" "${temp_file}" sed -i -e "s@{{ *capabilities *}}@@g" "${temp_file}" sed -i -e "s@{{ *drop_capabilities *}}@@g" "${temp_file}" sed -i -e "s@{{ *disallow_privilege_escalation *}}@@g" "${temp_file}" fi </ins> mv "${temp_file}" /etc/kubernetes/manifests }

# in the manifests, and copies them to /etc/kubernetes/manifests. function start-konnectivity-server { echo "Start konnectivity server pods" <del> prepare-log-file /var/log/konnectivity-server.log </del> <ins> prepare-log-file /var/log/konnectivity-server.log "${KONNECTIVITY_SERVER_RUNASUSER:-0}" </ins> prepare-konnectivity-server-manifest "8132" "8133" "8134" }

component: konnectivity-server spec: securityContext: <ins> {{ run_as_user }} {{ run_as_group }} {{ supplemental_groups }} </ins> seccompProfile: type: RuntimeDefault priorityClassName: system-node-critical

hostNetwork: true containers: - name: konnectivity-server-container <ins> {{ container_security_context }}: {{ disallow_privilege_escalation}} {{ capabilities }} {{ drop_capabilities }} </ins> image: k8s.gcr.io/kas-network-proxy/proxy-server:v0.0.15 resources: requests:

ETCD_RUNASUSER: 2006 ETCD_RUNASGROUP: 2006 KUBE_POD_LOG_READERS_GROUP: 2007 <ins> KONNECTIVITY_SERVER_RUNASUSER: 2008 KONNECTIVITY_SERVER_RUNASGROUP: 2008 KONNECTIVITY_SERVER_SOCKET_WRITER_GROUP: 2008 </ins> EOF # KUBE_APISERVER_REQUEST_TIMEOUT_SEC (if set) controls the --request-timeout # flag