Harden kea socket dir to 0750 (fix remaining CrashLoopBackOff) #4

2026-08-08T20:12:27+10:00

unkinben commented

2026-08-08 20:12:27 +10:00

v0.1.1 moved the socket dir to /var/run/kea but kea-0/kea-1 still crash-loop. Current error (both kea-dhcp4 and kea-ctrl-agent):

DHCP4_PARSER_COMMIT_FAIL parser failed to commit changes: 'socket-name' is invalid: socket path:/var/run/kea does not exist or has more relaxed permissions than 750

Kea 2.6+ refuses a unix-socket directory whose mode is more relaxed than 0750. The shared emptyDir is mounted at /var/run/kea with the default 0777, so kea rejects it. The kea containers run as root, so the rendered entrypoints can tighten it.

chmod 0750 the RunDir in both entrypoints (after mkdir, before exec).
Test asserting both entrypoints chmod the socket dir to 0750.

Needs a v0.1.2 release afterwards so argocd-apps can bump the operator image.

https://claude.ai/code/session_01JUoARVdmhxKQHyyyp1pxeT

v0.1.1 moved the socket dir to /var/run/kea but kea-0/kea-1 still crash-loop. Current error (both kea-dhcp4 and kea-ctrl-agent): ``` DHCP4_PARSER_COMMIT_FAIL parser failed to commit changes: 'socket-name' is invalid: socket path:/var/run/kea does not exist or has more relaxed permissions than 750 ``` Kea 2.6+ refuses a unix-socket directory whose mode is more relaxed than 0750. The shared `emptyDir` is mounted at `/var/run/kea` with the default **0777**, so kea rejects it. The kea containers run as root, so the rendered entrypoints can tighten it. - `chmod 0750` the RunDir in both entrypoints (after mkdir, before exec). - Test asserting both entrypoints chmod the socket dir to 0750. Needs a v0.1.2 release afterwards so argocd-apps can bump the operator image. https://claude.ai/code/session_01JUoARVdmhxKQHyyyp1pxeT

unkinben added 1 commit 2026-08-08 20:12:28 +10:00

Harden kea socket dir to 0750 in the rendered entrypoints

ci/woodpecker/pr/pre-commit Pipeline was successful

Details

ci/woodpecker/pr/test Pipeline was successful

Details

ci/woodpecker/pr/build Pipeline was successful

Details

e95e5437a2

After v0.1.1 moved the socket dir to /var/run/kea, kea-dhcp4 and
kea-ctrl-agent still crash-loop:

  DHCP4_PARSER_COMMIT_FAIL ... 'socket-name' is invalid: socket path:/var/run/kea
  does not exist or has more relaxed permissions than 750

Kea 2.6+ refuses a unix-socket directory whose mode is more relaxed than
0750. The shared emptyDir is mounted at /var/run/kea with the default 0777,
so kea rejects it. The kea containers run as root, so the entrypoints can
tighten it.

- chmod 0750 the RunDir in both rendered entrypoints after mkdir.
- Assert both entrypoints chmod the socket dir to 0750.

Needs a v0.1.2 release so argocd-apps can bump the operator image.

Claude-Session: https://claude.ai/code/session_01JUoARVdmhxKQHyyyp1pxeT

benvin merged commit 8e655c26af into main

2026-08-08 22:13:30 +10:00

benvin deleted branch benvin/fix-socket-dir-perms

2026-08-08 22:13:30 +10:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: unkin/kea-operator#4