Usage:
```
minikube config set rootless true
minikube start --driver=podman --container-runtime=(cri-o|containerd)`
```
Tested on Podman 4.0.2, Ubuntu 21.10.
Needs cgroup v2 (as in Rootless Docker): https://rootlesscontaine.rs/getting-started/common/cgroup2/
See also `site/content/en/docs/drivers/includes/podman_usage.inc`
Fix issue 8719
Fix issue 12460
Replace PR 12901
Changes from PR 12901: `rootless` is now a config property.
In the previous PR, `--rootless` was implemented as a flag for `minikube start`
Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
Since the machine drivers are hardcoded in minikube,
drivers need to be added to the registry to be tested.
Add a basic sanity check for the qemu-system binary,
and set up the basic configuration such as cpus/memory.
minikube 1.23 (PR 12359) added fuse-overlayfs snapshotter for rootless Docker driver,
but got broken in minikube 1.25 (issue 13534).
We can drop fuse-overlayfs for kernel >= 5.11.
Fix issue 13534
We may add back fuse-overlayfs later if there is a huge demand to
support kernel < 5.11.
That will require packing preloadable tarballs for fuse-overlayfs
snapshotter.
Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
As VMware's a company and we're dealing with specific applications of said company, updating the start docs to be more specific about those applications.
site/content/en/docs/drivers/_index.md:
* Updated macOS reference from VMware to VMware Fusion
* Updated Windows reference from VMware to VMware Workstation
site/content/en/docs/start/_index.md:
* Update reference from VMware to VMware Fusion/Workstation.
We change the default `--host-only-cidr` to `192.168.59.1/24` in order
to be compatible with the new default host-only networking restrictions
implemented in VirtualBox 6.1.28.
This fixes access denied errors on `minikube start` when using
VirtualBox >= 6.1.28:
```
VBoxManage: error: Code E_ACCESSDENIED (0x80070005) - Access denied (extended info not available)
VBoxManage: error: Context: "EnableStaticIPConfig(Bstr(pszIp).raw(), Bstr(pszNetmask).raw())" at line 242 of file VBoxManageHostonly.cpp
```
More details:
VirtualBox 6.1.28 introduced new restrictions on host-only networking:
https://www.virtualbox.org/wiki/Changelog-6.1#v28
Manual: https://www.virtualbox.org/manual/ch06.html#network_hostonly
> On Linux, Mac OS X and Solaris Oracle VM VirtualBox will only allow IP
> addresses in 192.68.56.0/21 range to be assigned to host-only
> adapters. For IPv6 only link-local addresses are allowed. If other
> ranges are desired, they can be enabled by creating
> /etc/vbox/networks.conf and specifying allowed ranges there. For
> example, to allow 10.0.0.0/8 and 192.168.0.0/16 IPv4 ranges as well as
> 2001::/64 range put the following lines into /etc/vbox/networks.conf:
>
> * 10.0.0.0/8 192.168.0.0/16
> * 2001::/64
>
> Lines starting with the hash # are ignored. Next example allows any
> addresses, effectively disabling range control:
>
> * 0.0.0.0/0 ::/0
These new restrictions manifest in the form of the following issue on
`minikube start` due to the default `--host-only-cidr` used by the
VirtualBox driver being `192.168.99.1/24`:
```console
😄 minikube v1.23.2 on Ubuntu 18.04
✨ Using the virtualbox driver based on user configuration
👍 Starting control plane node minikube in cluster minikube
🔥 Creating virtualbox VM (CPUs=2, Memory=6000MB, Disk=20000MB) ...
🔥 Deleting "minikube" in virtualbox ...
🤦 StartHost failed, but will try again: creating host: create: creating: Error setting up host only network on machine start: /usr/bin/VBoxManage hostonlyif ipconfig vboxnet0 --ip 192.168.99.1 --netmask 255.255.255.0 failed:
VBoxManage: error: Code E_ACCESSDENIED (0x80070005) - Access denied (extended info not available)
VBoxManage: error: Context: "EnableStaticIPConfig(Bstr(pszIp).raw(), Bstr(pszNetmask).raw())" at line 242 of file VBoxManageHostonly.cpp
🔥 Creating virtualbox VM (CPUs=2, Memory=6000MB, Disk=20000MB) ...
😿 Failed to start virtualbox VM. Running "minikube delete" may fix it: creating host: create: creating: Error setting up host only network on machine start: /usr/bin/VBoxManage hostonlyif ipconfig vboxnet1 --ip 192.168.99.1 --netmask 255.255.255.0 failed:
VBoxManage: error: Code E_ACCESSDENIED (0x80070005) - Access denied (extended info not available)
VBoxManage: error: Context: "EnableStaticIPConfig(Bstr(pszIp).raw(), Bstr(pszNetmask).raw())" at line 242 of file VBoxManageHostonly.cpp
❌ Exiting due to GUEST_PROVISION: Failed to start host: creating host: create: creating: Error setting up host only network on machine start: /usr/bin/VBoxManage hostonlyif ipconfig vboxnet1 --ip 192.168.99.1 --netmask 255.255.255.0 failed:
VBoxManage: error: Code E_ACCESSDENIED (0x80070005) - Access denied (extended info not available)
VBoxManage: error: Context: "EnableStaticIPConfig(Bstr(pszIp).raw(), Bstr(pszNetmask).raw())" at line 242 of file VBoxManageHostonly.cpp
╭───────────────────────────────────────────────────────────────────────────────────────────╮
│ │
│ 😿 If the above advice does not help, please let us know: │
│ 👉https://github.com/kubernetes/minikube/issues/new/choose │
│ │
│ Please run `minikube logs --file=logs.txt` and attach logs.txt to the GitHub issue. │
│ │
╰───────────────────────────────────────────────────────────────────────────────────────────╯
```
While the above is the primary error, other errors will be reported if
the adapter already exists (this happens when the adapter was created
before updating to VirtualBox 6.1.28, on a version of VirtualBox without
the new restrictions). Some examples:
```
❌ Exiting due to IF_VBOX_NOT_VISIBLE: Failed to start host: creating host: create: creating: Error setting up host only network on machine start: The host-only adapter we just created is not visible. This is a well known VirtualBox bug. You might want to uninstall it and reinstall at least version 5.0.12 that is is supposed to fix this issue
```
```
❌ minikube is unable to connect to the VM: dial tcp 192.168.99.112:22: i/o timeout
This is likely due to one of two reasons:
- VPN or firewall interference
- virtualbox network configuration issue
Suggested workarounds:
- Disable your local VPN or firewall software
- Configure your local VPN or firewall to allow access to 192.168.99.112
- Restart or reinstall virtualbox
- Use an alternative --vm-driver
- Use --force to override this connectivity check
❌ Exiting due to GUEST_PROVISION: Failed to validate network: dial tcp 192.168.99.112:22: i/o timeout
```
When switching to a valid CIDR, `minikube start` works as usual:
```console
😄 minikube v1.23.2 on Ubuntu 18.04
✨ Using the virtualbox driver based on user configuration
👍 Starting control plane node minikube in cluster minikube
🔥 Creating virtualbox VM (CPUs=2, Memory=6000MB, Disk=20000MB) ...
🐳 Preparing Kubernetes v1.22.2 on Docker 20.10.8 ...
▪ Generating certificates and keys ...
▪ Booting up control plane ...
▪ Configuring RBAC rules ...
▪ Using image gcr.io/k8s-minikube/storage-provisioner:v5
🔎 Verifying Kubernetes components...
🌟 Enabled addons: storage-provisioner, default-storageclass
🏄 Done! kubectl is now configured to use "minikube" cluster and "default" namespace by default
```
Signed-off-by: Nicolas Busseneau <nicolas@isovalent.com>
Requirements:
- Install rootless Docker 20.10 or later, see https://rootlesscontaine.rs/getting-started/docker/
- Enable cgroup v2 delegation, see https://rootlesscontaine.rs/getting-started/common/cgroup2/
Usage: `minikube start --driver=docker --container-runtime=containerd`.
The `--container-runtime` flag needs to be set to "containerd".
CRI-O can be also supported later.
Closes issue 10836 ("add support for rootless Docker").
Support for rootless Podman (issue 8719) is not covered in this commit.
---
Code reading guide:
- `deploy/kicbase/Dockerfile`: updated to install fuse-overlayfs and containerd-fuse-overlayfs, which is used
instead of `overlayfs` snapshotter
- `deploy/kicbase/entrypoint`: updated to verify cgroup v2 delegation.
Mostly from 8a83ee46b2/images/base/files/usr/local/bin/entrypoint
- `cmd/minikube/cmd/start_flags.go`: updated to set `KubeletInUserNamespace` feature gate when rootless
- `pkg/drivers/kic/oci`: updated to use port forwarding, because rootless container IPs are not reachable from the host
- `pkg/minikube/cruntime`: updated to generate `/etc/containerd/config.toml` with rootless support.
Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
Courtesy of markdownlint, but nothing to show on:
git show --ignore-all-space --ignore-blank-lines
Ignore generated commands, with trailing whitespace.
Those need to be fixed in "generate-docs" instead...
klaases
Akihiro Suda
Steven Powell
Peter Becich
Sharif Elgamal
Anders F Björklund
Medya Ghazizadeh
Daniel Helfand
Sahan Serasinghe
Marcus Puckett
Nicolas Busseneau
Rajwinder Mahal
Evan Anderson
KushagraIndurkhya
Predrag Rogic
Ilya Zuyev
Daehyeok Mun
AUT0R3V
Ben Leggett