Kubernetes extension does not work with snap version of VS Code

[dholbach]

I have the latest version of VS Code install through snap install code --classic on Ubuntu.

When starting the Kubernetes extension (latest, installed through VSIX), I see the following error messages in /var/log/syslog:

Apr 15 11:59:50 reef kernel: [13150.164921] audit: type=1400 audit(1555322390.646:498): apparmor="DENIED" operation="file_inherit" profile="/snap/core/6673/usr/lib/snapd/snap-confine" pid=18791 comm="snap-confine" family="unix" sock_type="stream" protocol=0 requested_mask="send receive" denied_mask="send receive" addr=none peer_addr=none

In another round of testing, I saw:

[69083.590392] audit: type=1400 audit(1554802886.556:723): apparmor="DENIED" operation="ptrace" profile="/usr/sbin/libvirtd" pid=1305 comm="libvirtd" requested_mask="read" denied_mask="read" peer="snap.vscode.vscode"

I turned there for help as I couldn't figure out why the extension simply didn't work for me with a local minikube cluster up and running.

It appears snap confinement blocks access to resources the Kubernetes extension need to figure out what's happening.

[itowlson]

Hmm, okay. I'm not familiar with snap but will take a look. Are you able to work around this by installing VS Code via another mechanism? Thanks for letting us know!

[dholbach]

The .deb version works fine. (Snaps are mentioned above on the same page.)

[iliatages]

+1

[4ndt3s]

Same problem here.

[lstocchi]

Hello everyone, I was able to replicate it and i think i have a fix (#771) . Would you please try it and see if it works for you?

You can install the extension by using the vsix file. I created it (download link: https://github.com/lstocchi/vscode-kubernetes-tools/raw/master/vscode-kubernetes-tools-1.2.1.vsix ) or you can build it by yourself (you can use this branch https://github.com/lstocchi/vscode-kubernetes-tools/tree/i770 ).

Once installed you should keep seeing the error as before Kubectl command failed:. Now if you go in the settings page and set "vs-kubernetes.enable-snap-flag" to true the extension should start working normally (CMD/CTRL + SHIFT + P -> search for Open Setting -> click on Preferences: Open Settings (JSON) -> add "vs-kubernetes.enable-snap-flag": true and save).

If you can confirm it works it would be really helpful for us. Thank you!!!

[dholbach]

Jun 19 15:34:20 reef kernel: [71587.554967] audit: type=1400 audit(1592573660.140:841): apparmor="DENIED" operation="file_inherit" profile="/snap/core/9289/usr/lib/snapd/snap-confine" pid=41160 comm="snap-confine" family="unix" sock_type="stream" protocol=0 requested_mask="send receive" denied_mask="send receive" addr=none peer_addr=none

[itowlson]

@dholbach Sometimes VS Code caches the marketplace version of an extension (particularly when a test VSIX has the same version number). Could you try once more with the instructions at https://github.com/Azure/vscode-kubernetes-tools/issues/770#issuecomment-646497892 please? Thanks, and appreciate your help and patience.

[dholbach]

This is on Ubuntu 20.04 with code (cd9ea648) and minikube v1.11.0 and a 1-node cluster (v1.18.3) up.

[lstocchi]

Thanks for the feedback @dholbach. It looks to me that we made some progress, right? At least you can see the cluster and its resources now, or you were able to see them even before?

In my configuration i don't see those error messages you have in the terminal. Can you make a screenshot of the output of snap list command? I'm only interested in vscode and kubectl rows. Thank you.

[dholbach]

Yep, just tried it again. I can't seem to expand any of the dropdowns in the cluster list.

Jun 23 18:45:33 reef kernel: [32844.954948] audit: type=1400 audit(1592930733.833:645): apparmor="DENIED" operation="file_inherit" profile="/snap/core/9436/usr/lib/snapd/snap-confine" pid=35422 comm="snap-confine" family="unix" sock_type="stream" protocol=0 requested_mask="send receive" denied_mask="send receive" addr=none peer_addr=none

[daniel@reef ~ ]$ snap list code kubectl
Name     Version   Rev   Tracking       Publisher   Notes
code     cd9ea648  35    latest/stable  vscode✓     classic
kubectl  1.18.4    1545  latest/stable  canonical✓  classic
[daniel@reef ~ ]$ 

[lstocchi]

@dholbach I tried reproducing your error by installing ubuntu 20.04, using your exact vscode and kubectl version but i am still able to see all resources with the patch i made :/ I don't have any clue why you cannot expand any of the dropdowns.

Since you can see the clusters nodes, kubectl has been run so it should also work when executing other commands such as kubectl get pods. The only other reason i can think of is because you don't have the rights on the cluster but you are using minikube so it shouldn't be this (??). Have you tried with a remote cluster? If you run the command in the terminal /snap/bin/kubectl get pods or whatever, does it prints the right output? Are you sure you are using the same config in vscode?

[dholbach]

I guess I could try a remote cluster too.

Here's the relevant parts of the config:

    "vs-kubernetes": {
        "vs-kubernetes.enable-snap-flag": true,
        "vs-kubernetes.knownKubeconfigs": [
            "/home/daniel/.kube/config"
        ],
        "vs-kubernetes.kubeconfig": "/home/daniel/.kube/config",
        "vs-kubernetes.minikube-path": "/home/daniel/bin/minikube"
    },

I just made sure I ran your version of the plugin, I'm on minikube v1.11.0. Using /snap/bin/kubectl on the terminal works just fine.

[Dringho]

I ran into this issue too (for the last few months actually).

I tried your patched vsix but I can only see the clusters now, not the resources.

I'm using UBUNTU 18.04 using kubectl installed from snap uname -a Linux xxxx-MS-7798 5.4.0-53-generic #59~18.04.1-Ubuntu SMP Wed Oct 21 12:14:56 UTC 2020 x86_64 x86_64 x86_64 GNU/Linux

The only fix was to uninstall kubectl from snap and install it from Google

snap remove kubectl
sudo apt-get install apt-transport-https ca-certificates gnupg
echo "deb [signed-by=/usr/share/keyrings/cloud.google.gpg] https://packages.cloud.google.com/apt cloud-sdk main" | sudo tee -a /etc/apt/sources.list.d/google-cloud-sdk.list
curl https://packages.cloud.google.com/apt/doc/apt-key.gpg | sudo apt-key --keyring /usr/share/keyrings/cloud.google.gpg add -
sudo apt-get update && sudo apt-get install kubectl

[lopes-leonardo]

I ran into this issue too (for the last few months actually).

I tried your patched vsix but I can only see the clusters now, not the resources.

I'm using UBUNTU 18.04 using kubectl installed from snap uname -a Linux xxxx-MS-7798 5.4.0-53-generic #59~18.04.1-Ubuntu SMP Wed Oct 21 12:14:56 UTC 2020 x86_64 x86_64 x86_64 GNU/Linux

The only fix was to uninstall kubectl from snap and install it from Google

snap remove kubectl
sudo apt-get install apt-transport-https ca-certificates gnupg
echo "deb [signed-by=/usr/share/keyrings/cloud.google.gpg] https://packages.cloud.google.com/apt cloud-sdk main" | sudo tee -a /etc/apt/sources.list.d/google-cloud-sdk.list
curl https://packages.cloud.google.com/apt/doc/apt-key.gpg | sudo apt-key --keyring /usr/share/keyrings/cloud.google.gpg add -
sudo apt-get update && sudo apt-get install kubectl

Thanks @Dringho, reinstalling the kubectl from google solved for me. I was also not able to expand any of the kubernetes items in the VSCode extension after installing from snap.

[Mostafa-wael]

I guess I could try a remote cluster too.

Here's the relevant parts of the config:

    "vs-kubernetes": {
        "vs-kubernetes.enable-snap-flag": true,
        "vs-kubernetes.knownKubeconfigs": [
            "/home/daniel/.kube/config"
        ],
        "vs-kubernetes.kubeconfig": "/home/daniel/.kube/config",
        "vs-kubernetes.minikube-path": "/home/daniel/bin/minikube"
    },

I just made sure I ran your version of the plugin, I'm on minikube v1.11.0. Using /snap/bin/kubectl on the terminal works just fine.

For some reason, this didn't work with me. It worked when I removed the prefix and made it like this:

"vs-kubernetes": {
        "enable-snap-flag": true,
        "helm-path": "/snap/bin/helm",
        "kubectl-path": "/snap/bin/kubectl"
 },