Bug 1942837

Description of problem:
Following:

https://docs.openshift.com/container-platform/4.6/nodes/containers/nodes-containers-sysctls.html

pods are stuck on ContainerCreating state:

[agabriel@agabriel OCPv4]$ oc get pod 
NAME                     READY   STATUS              RESTARTS   AGE
httpd-57f9f97d4b-5ppqf   0/1     ContainerCreating   0          20s
httpd-b45f5c85c-ch7ng    1/1     Running             0          23h
[agabriel@agabriel OCPv4]$ 

with the error:

7s          Warning   FailedCreatePodSandBox   pod/httpd-57f9f97d4b-5ppqf    Failed to create pod sandbox: rpc error: code = Unknown desc = failed to cleanup [/var/run/netns/dccafd5f-b79d-453a-9eba-300b3d5676ee /var/run/ipcns/dccafd5f-b79d-453a-9eba-300b3d5676ee /var/run/utsns/dccafd5f-b79d-453a-9eba-300b3d5676ee] after pinns failure  exit status 1


Version-Release number of selected component (if applicable):
Openshift 4.6

How reproducible:


Steps to Reproduce:
1. follow https://docs.openshift.com/container-platform/4.6/nodes/containers/nodes-containers-sysctls.html

[agabriel@agabriel OCPv4]$ oc get machineconfig 99-worker-generated-kubelet -o jsonpath='{.metadata.ownerReferences}{"\n"}'
[{"apiVersion":"machineconfiguration.openshift.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"KubeletConfig","name":"custom-kubelet","uid":"84c5d5bd-463d-435a-ae58-1c834e08d38a"}]
[agabriel@agabriel OCPv4]
[agabriel@agabriel OCPv4]$ oc get kubeletconfig custom-kubelet -o jsonpath='{.spec.kubeletConfig}{"\n"}'
{"allowedUnsafeSysctls":["kernel.msg*","net.ipv4.route.min_pmtu"]}
[agabriel@agabriel OCPv4]

2. create a new SCC, bind it to the ServiceAccount and assign it to the pod

[agabriel@agabriel OCPv4]$ oc create -f restricted_scc.yml 
securitycontextconstraints.security.openshift.io/restricted-syscts created
[agabriel@agabriel OCPv4]$ 
[agabriel@agabriel OCPv4]$ 
[agabriel@agabriel OCPv4]$ 
[agabriel@agabriel OCPv4]$ 
[agabriel@agabriel OCPv4]$ oc get scc
NAME                PRIV    CAPS         SELINUX     RUNASUSER          FSGROUP     SUPGROUP    PRIORITY     READONLYROOTFS   VOLUMES
anyuid              false   <no value>   MustRunAs   RunAsAny           RunAsAny    RunAsAny    10           false            ["configMap","downwardAPI","emptyDir","persistentVolumeClaim","projected","secret"]
hostaccess          false   <no value>   MustRunAs   MustRunAsRange     MustRunAs   RunAsAny    <no value>   false            ["configMap","downwardAPI","emptyDir","hostPath","persistentVolumeClaim","projected","secret"]
hostmount-anyuid    false   <no value>   MustRunAs   RunAsAny           RunAsAny    RunAsAny    <no value>   false            ["configMap","downwardAPI","emptyDir","hostPath","nfs","persistentVolumeClaim","projected","secret"]
hostnetwork         false   <no value>   MustRunAs   MustRunAsRange     MustRunAs   MustRunAs   <no value>   false            ["configMap","downwardAPI","emptyDir","persistentVolumeClaim","projected","secret"]
node-exporter       true    <no value>   RunAsAny    RunAsAny           RunAsAny    RunAsAny    <no value>   false            ["*"]
nonroot             false   <no value>   MustRunAs   MustRunAsNonRoot   RunAsAny    RunAsAny    <no value>   false            ["configMap","downwardAPI","emptyDir","persistentVolumeClaim","projected","secret"]
privileged          true    ["*"]        RunAsAny    RunAsAny           RunAsAny    RunAsAny    <no value>   false            ["*"]
restricted          false   <no value>   MustRunAs   MustRunAsRange     MustRunAs   RunAsAny    <no value>   false            ["configMap","downwardAPI","emptyDir","persistentVolumeClaim","projected","secret"]
restricted-syscts   false   <no value>   MustRunAs   MustRunAsRange     MustRunAs   RunAsAny    <no value>   false            ["configMap","downwardAPI","emptyDir","persistentVolumeClaim","projected","secret"]
[agabriel@agabriel OCPv4]$ 
[agabriel@agabriel OCPv4]$ 
[agabriel@agabriel OCPv4]$ oc get scc restricted-syscts -o jsonpath='{.allowedUnsafeSysctls}{"\n"}'
["kernel.msg*","net.ipv4.route.min_pmtu","kernel.msgmax"]
[agabriel@agabriel OCPv4]$
[agabriel@agabriel OCPv4]$ 
[agabriel@agabriel OCPv4]$ 
[agabriel@agabriel OCPv4]$ oc create serviceaccount sysctls
serviceaccount/sysctls created
[agabriel@agabriel OCPv4]$ oc adm policy add-scc-to-user restricted-sysctls -z sysctls
clusterrole.rbac.authorization.k8s.io/system:openshift:scc:restricted-sysctls added: "sysctls"
[agabriel@agabriel OCPv4]$ 
[agabriel@agabriel OCPv4]$ 
[agabriel@agabriel OCPv4]$ oc get all
NAME                        READY   STATUS    RESTARTS   AGE
pod/httpd-b45f5c85c-5rw59   1/1     Running   0          21h

NAME            TYPE        CLUSTER-IP      EXTERNAL-IP   PORT(S)             AGE
service/httpd   ClusterIP   172.30.129.83   <none>        8080/TCP,8443/TCP   21h

NAME                    READY   UP-TO-DATE   AVAILABLE   AGE
deployment.apps/httpd   1/1     0            1           21h

NAME                               DESIRED   CURRENT   READY   AGE
replicaset.apps/httpd-65b69b845d   1         0         0       21h
replicaset.apps/httpd-7ddd77d5fb   0         0         0       21h
replicaset.apps/httpd-b45f5c85c    1         1         1       21h

NAME                                   IMAGE REPOSITORY                                               TAGS      UPDATED
imagestream.image.openshift.io/httpd   image-registry.openshift-image-registry.svc:5000/test3/httpd   2.4-el8   22 hours ago
[agabriel@agabriel OCPv4]$ 
[agabriel@agabriel OCPv4]$ 
[agabriel@agabriel OCPv4]$ oc patch deployment.apps/httpd --patch '{"spec":{"template":{"spec":{"serviceAccountName": "sysctls"}}}}'
deployment.apps/httpd patched
[agabriel@agabriel OCPv4]$

3.

Actual results:
The new pod with the unsafe sysctls is unable to start

Expected results:
The new pod with the unsafe sysctls is able to start


Additional info:
The SCC part is missing from the documentation. A documentation bug was already opened for that: https://bugzilla.redhat.com/show_bug.cgi?id=1893607