Merge pull request 'Fix kea CrashLoopBackOff: render socket paths under /var/run/kea' (#3) from benvin/fix-runstatedir-path into main

Reviewed-on: #3

Dockerfile.kea

@@ -13,7 +13,7 @@ RUN dnf -y install epel-release \
  && dnf -y install kea kea-hooks \
  && dnf clean all \
  && rm -rf /var/cache/dnf \
- && mkdir -p /run/kea
+ && mkdir -p /var/run/kea
 
 EXPOSE 67/udp 8000/tcp
 # Command is supplied by the operator (per-container entrypoint scripts).

README.md

@@ -12,7 +12,7 @@ Namespace: `dhcp-system`. API group: `kea.unkin.net/v1alpha1`.
 |------|---------|
 | **KeaCluster** | Spawns a StatefulSet of `kea-dhcp4` + `kea-ctrl-agent` pods, an HA control channel, and an anycast DHCP `Service`. Holds global config (domain, lease times, NTP, PXE option-defs). |
 | **KeaSubnet** | One DHCPv4 subnet referenced to a KeaCluster (`clusterRef`). CIDR, optional pools, routers, DNS, domain, next-server. Pool-less subnets are declared so relayed requests are still serviced. |
-| **KeaClientClass** | PXE boot class matched on client architecture (option 93), e.g. `Legacy` → `/undionly.kpxe`, `UEFI-64` → `/ipxe.efi`. |
+| **KeaClientClass** | PXE boot class matched on client architecture (option 93), e.g. `legacy` → `/undionly.kpxe`, `uefi-64` → `/ipxe.efi`. |
 | **KeaAPI** | Spawns the Terraform-friendly REST API service (see below). |
 
 The **KeaCluster** controller lists the matching subnets and client classes,

config/samples/01-subnets.yaml

@@ -10,7 +10,7 @@ spec:
   subnet: 198.18.13.0/24
   pools:
     - 198.18.13.200 - 198.18.13.220
-  routers: [198.18.13.1]
+  routers: [198.18.13.254]
   dnsServers: [198.18.19.15]
   domainName: main.unkin.net
   nextServer: 198.18.19.19
@@ -25,7 +25,7 @@ spec:
   subnet: 198.18.14.0/24
   pools:
     - 198.18.14.200 - 198.18.14.220
-  routers: [198.18.14.1]
+  routers: [198.18.14.254]
   dnsServers: [198.18.19.15]
   domainName: main.unkin.net
   nextServer: 198.18.19.19
@@ -40,7 +40,7 @@ spec:
   subnet: 198.18.15.0/24
   pools:
     - 198.18.15.200 - 198.18.15.220
-  routers: [198.18.15.1]
+  routers: [198.18.15.254]
   dnsServers: [198.18.19.15]
   domainName: main.unkin.net
   nextServer: 198.18.19.19
@@ -55,7 +55,7 @@ spec:
   subnet: 198.18.16.0/24
   pools:
     - 198.18.16.200 - 198.18.16.220
-  routers: [198.18.16.1]
+  routers: [198.18.16.254]
   dnsServers: [198.18.19.15]
   domainName: main.unkin.net
   nextServer: 198.18.19.19

config/samples/02-clientclasses.yaml

@@ -1,9 +1,10 @@
 # PXE boot classes matching the client architecture option (code 93), replacing
-# the legacy dhcpd "Legacy" and "UEFI-64" classes.
+# the legacy dhcpd "Legacy" and "UEFI-64" classes. Object names must be RFC1123
+# (lowercase); the operator renders the kea client-class name from metadata.name.
 apiVersion: kea.unkin.net/v1alpha1
 kind: KeaClientClass
 metadata:
-  name: Legacy
+  name: legacy
   namespace: dhcp-system
 spec:
   clusterRef: pxe
@@ -13,7 +14,7 @@ spec:
 apiVersion: kea.unkin.net/v1alpha1
 kind: KeaClientClass
 metadata:
-  name: UEFI-64
+  name: uefi-64
   namespace: dhcp-system
 spec:
   clusterRef: pxe

internal/kea/config_test.go

@@ -231,4 +231,21 @@ func TestRenderCtrlAgent(t *testing.T) {
 			t.Errorf("ctrl-agent config missing %q", m)
 		}
 	}
+	// Kea 2.6+ only accepts unix socket paths under /var/run/kea (exact string).
+	if !strings.Contains(out, `"socket-name": "/var/run/kea/`) {
+		t.Errorf("ctrl-agent socket-name must be under /var/run/kea, got: %s", out)
+	}
+}
+
+func TestControlSocketPathAllowedByKea(t *testing.T) {
+	if !strings.HasPrefix(CtrlSocketPath, "/var/run/kea/") {
+		t.Errorf("CtrlSocketPath %q must live under /var/run/kea (kea 2.6+ restriction)", CtrlSocketPath)
+	}
+	out, err := RenderDHCP4(referenceInput())
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !strings.Contains(out, `"socket-name": "/var/run/kea/`) {
+		t.Errorf("dhcp4 control-socket must be under /var/run/kea, got: %s", out)
+	}
 }

internal/kea/consts.go

@@ -10,8 +10,11 @@ const (
 
 	// ConfigDir is where projected config is mounted read-only.
 	ConfigDir = "/etc/kea-operator"
-	// RunDir is a shared emptyDir for the config copy and control socket.
+	// RunDir is a shared emptyDir for the config copy and control socket. Kea
-	RunDir = "/run/kea"
+	// 2.6+ restricts unix socket paths to its compiled runstatedir and rejects
+	// anything else by exact string ("supported path is '/var/run/kea'"), even
+	// though /var/run symlinks to /run, so this must be the literal /var/run/kea.
+	RunDir = "/var/run/kea"
 
 	// DHCP4ConfPath is the runtime kea-dhcp4 config.
 	DHCP4ConfPath = RunDir + "/kea-dhcp4.conf"