Closed brunnels closed 1 month ago
Are you using a talos installation with the iscsi extension? dd
isn't provided by talos so I assume it's a binary in your container.
I would try doing a talos install with iscsi and linux-utils from the image factory https://factory.talos.dev/?arch=amd64&cmdline-set=true&extensions=-&extensions=siderolabs%2Fiscsi-tools&extensions=siderolabs%2Futil-linux-tools&platform=metal&target=metal&version=1.7.5
You can also update an existing talos node with those extensions via (this is the amd64 bare metal installer)
talos upgrade --image factory.talos.dev/installer/613e1592b2da41ae5e265e8789429f22e121aab91cb4deb6bc3c0b6262961245:v1.7.5
@rothgar I do have iscsi extension on all nodes and I can see the iscsi volume get created in my qnap so all that is working. I think it's an issue with the security policy on the pod that the QNAP operator creates. I am able to use the talos debug daemonset to add a pod in the same namespace as the qnap operator and when I ssh into it I can run the same dd commands on the iscsi device that the qnap operator created.
I opened an issue with the QNAP project and detailed my findings there. https://github.com/qnap-dev/QNAP-CSI-PlugIn/issues/13
I'm trying to use QNAP-CSI-PlugIn to dynamically create iscsi backed PVC's on my qnap. During the last part of the configuration the node pod tries to use
dd if=/dev/sdc bs=4096 count=512 status=none
to determine the block device filesystem type but it's not permitted./dev
is mounted in the container andtalosctl disks
on the node shows that the iscsi block device resides at/dev/sdc
I have
pod-security.kubernetes.io/enforce: privileged
label set on the qnap-csi operator namespace.Is there anything else that's needed to allow the dd command to work?