Description of problem: crio checks for the security profiles path, but uses the incorrect root. This results in the security profiles directory to not be bound to the right /etc path. Version-Release number of selected component (if applicable): 4.6, 4.7, 4.8, 4.9, 4.10 How reproducible: All the time
Verified on 4.10.0-0.nightly-2022-02-10-161006 $ oc get clusterversion NAME VERSION AVAILABLE PROGRESSING SINCE STATUS version 4.10.0-0.nightly-2022-02-10-161006 True False 24m Cluster version is 4.10.0-0.nightly-2022-02-10-161006 $ oc get nodes NAME STATUS ROLES AGE VERSION ip-10-0-140-249.us-east-2.compute.internal Ready master 38m v1.23.3+759c22b ip-10-0-148-137.us-east-2.compute.internal Ready worker 30m v1.23.3+759c22b ip-10-0-168-62.us-east-2.compute.internal Ready master 37m v1.23.3+759c22b ip-10-0-170-55.us-east-2.compute.internal Ready worker 30m v1.23.3+759c22b ip-10-0-194-233.us-east-2.compute.internal Ready worker 29m v1.23.3+759c22b ip-10-0-201-65.us-east-2.compute.internal Ready master 38m v1.23.3+759c22b $ oc debug node/ip-10-0-148-137.us-east-2.compute.internal Starting pod/ip-10-0-148-137us-east-2computeinternal-debug ... ... sh-4.4# crictl ps | grep -i router 07504abadafea quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:0320135a52d557f26e5e7311c2254a46132a4ed59699d0bbd52aed987aba243c 30 minutes ago Running router 0 cda0ba3f545d4 sh-4.4# crictl exec -ti 07504abadafea /bin/sh sh-4.4$ mount | grep -i crypto overlay on /etc/crypto-policies/back-ends type overlay (rw,relatime,context="system_u:object_r:container_file_t:s0:c14,c24",lowerdir=/var/lib/containers/storage/overlay/l/7GVLOXXEZTRNEG5R7WWMRAJCFH:/var/lib/containers/storage/overlay/l/KOTWLEZMC5C64JFBOQCZLEBW2V:/var/lib/containers/storage/overlay/l/3J3MXQXKBADJRKEAGTWVSSCSFX:/var/lib/containers/storage/overlay/l/77RJT7UA4EFNIKHZQOD2WRZ6Q4:/var/lib/containers/storage/overlay/l/5KAIN2PNI24Q6JS25BXXVHF5GS:/var/lib/containers/storage/overlay/l/7DOOJV3P45L7NNZIO4ZLFKZNSR,upperdir=/var/lib/containers/storage/overlay/bff2f73fc1c64208b821088bce7cdefc22c78ec5e3911c2af502cc0e32ea37d2/diff,workdir=/var/lib/containers/storage/overlay/bff2f73fc1c64208b821088bce7cdefc22c78ec5e3911c2af502cc0e32ea37d2/work) sh-4.4$
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory (Moderate: OpenShift Container Platform 4.10.3 security update), and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHSA-2022:0056