kvm2 driver: check if user in "libvirt" group and exit if they are not #5617

piccadil · 2019-10-14T10:12:46Z

Please, add that user starting minikube should be in "libvirt" group. Because without adding user in "libvirt" group will be an error "authentification unavailable"

medyagh · 2019-10-14T23:04:58Z

@josedonizetti what you think ?

preferably we should do that for the users. or tell them nicely that it should be like that

@aidkz do you mind sharing our OS Distro and version ?

piccadil · 2019-10-15T06:50:58Z

@josedonizetti what you think ?

preferably we should do that for the users. or tell them nicely that it should be like that

@aidkz do you mind sharing our OS Distro and version ?
Linux localhost.localdomain 3.10.0-1062.1.2.el7.x86_64
CentOS Linux release 7.7.1908 (Core)
Name : qemu-kvm
Arch : x86_64
Epoch : 10
Version : 1.5.3
Release : 167.el7_7.1

afbjorklund · 2019-10-15T15:05:29Z

CentOS is supposed to provide some kind of authentication mechanism, like PolicyKit ?

Of course, that also means entering your password each time you want to access it...

afbjorklund · 2019-10-15T15:10:41Z

Please, add that user starting minikube should be in "libvirt" group.

Note that the name of the group might vary between Linux distributions.

For instance, on Ubuntu 16.04 the socket is owned by the "libvirtd" group...

Might be better to refer to external documentation, like https://libvirt.org ?

tstromberg · 2019-10-16T20:23:25Z

Running virt-host-validate should provide the correct checks here. Our documentation calls for it, but we should do so as well in our code.

piccadil · 2019-10-17T09:45:09Z

running virt-host-validate not showing checks for user/group permissions:

virt-host-validate
  QEMU: Checking for hardware virtualization                                 : PASS
  QEMU: Checking if device /dev/kvm exists                                   : PASS
  QEMU: Checking if device /dev/kvm is accessible                            : PASS
  QEMU: Checking if device /dev/vhost-net exists                             : PASS
  QEMU: Checking if device /dev/net/tun exists                               : PASS
  QEMU: Checking for cgroup 'memory' controller support                      : PASS
  QEMU: Checking for cgroup 'memory' controller mount-point                  : PASS
  QEMU: Checking for cgroup 'cpu' controller support                         : PASS
  QEMU: Checking for cgroup 'cpu' controller mount-point                     : PASS
  QEMU: Checking for cgroup 'cpuacct' controller support                     : PASS
  QEMU: Checking for cgroup 'cpuacct' controller mount-point                 : PASS
  QEMU: Checking for cgroup 'cpuset' controller support                      : PASS
  QEMU: Checking for cgroup 'cpuset' controller mount-point                  : PASS
  QEMU: Checking for cgroup 'devices' controller support                     : PASS
  QEMU: Checking for cgroup 'devices' controller mount-point                 : PASS
  QEMU: Checking for cgroup 'blkio' controller support                       : PASS
  QEMU: Checking for cgroup 'blkio' controller mount-point                   : PASS
  QEMU: Checking for device assignment IOMMU support                         : WARN (No ACPI DMAR table found, IOMMU either disabled in BIOS or not supported by this hardware platform)

medyagh · 2019-10-23T18:14:36Z

I would be happy to review any PR that would add this check !

nanikjava · 2019-11-07T21:07:21Z

/assign @nanikjava

nanikjava · 2019-11-17T03:48:09Z

The main code resides inside pkg/minikube/registry/devs/kvm2/kvm2.go

All drivers init() function initialize the driver using the registry.Registry(..) which accept registry.DriverDef(..) struct. The DriverDef(..) struct only have specific function for initialize the driver (Loader) and status checker (StatusChecker) nothing in between.

The 'cleanest' way is to add something like a 'precheck' function that will do other necessary steps after initializing the driver, however this will make the changed quite bit as there are codes (test and non-test) that will need to be refactored.

The alternative is to add the group checking inside the init function however the downside is that the error message will be bit confusing for the user.

tstromberg · 2019-11-17T04:58:17Z

@nanikjava - I suspect the current call to virsh domcapabilities will fail if the user is not in the correct group, but quite likely with a terribly confusing message.

One trick here is how to reliably discover what group the user should be in to launch a VM. You will probably have more luck finding a virsh command that reliably fails if the user is not in the correct group, and provide the appropriate advice if it fails.

Every distro I know of uses libvirt or libvirtd, but I'm sure there are some strange configurations out there.

nanikjava · 2019-11-17T09:37:01Z

Testing was done by removing local account from libvirt group. This is the full error after running

minikube start --vm-driver=kvm2

I1117 20:24:12.412275    3016 translate.go:92] Setting Language to en-US ...
I1117 20:24:12.412826    3016 out.go:131] Setting OutFile to fd 1 ...
I1117 20:24:12.412845    3016 out.go:172] isatty.IsTerminal(1) = true
I1117 20:24:12.412853    3016 out.go:138] Setting ErrFile to fd 2...
I1117 20:24:12.412863    3016 out.go:172] isatty.IsTerminal(2) = true
I1117 20:24:12.412962    3016 root.go:284] Updating PATH: /home/nanik/.minikube/bin
I1117 20:24:12.413705    3016 notify.go:125] Checking for updates...
I1117 20:24:12.679333    3016 start.go:250] hostinfo: {"hostname":"pop-os","uptime":195333,"bootTime":1573787319,"procs":491,"os":"linux","platform":"ubuntu","platformFamily":"debian","platformVersion":"19.04","kernelVersion":"5.3.0-22-generic","virtualizationSystem":"kvm","virtualizationRole":"host","hostid":"c50e6dd4-924b-a886-a6a3-2b925dce0cdd"}
I1117 20:24:12.680457    3016 start.go:260] virtualization: kvm host
😄  minikube v1.6.0-beta.0 on Ubuntu 19.04
.......
.......
.......
.......

I1117 20:24:12.971718    3016 start.go:292] selected driver: kvm2
I1117 20:24:12.971728    3016 start.go:582] validating driver "kvm2" against <nil>
I1117 20:24:13.006292    3016 start.go:588] status for kvm2: {Installed:true Healthy:false Error:/usr/bin/virsh domcapabilities --virttype kvm failed:
error: failed to connect to the hypervisor
error: Failed to connect socket to '/var/run/libvirt/libvirt-sock': Permission denied Fix:Follow your Linux distribution instructions for configuring KVM Doc:https://minikube.sigs.k8s.io/docs/reference/drivers/kvm2/}

⚠️  'kvm2' driver reported an issue: /usr/bin/virsh domcapabilities --virttype kvm failed:
error: failed to connect to the hypervisor
error: Failed to connect socket to '/var/run/libvirt/libvirt-sock': Permission denied
💡  Suggestion: Follow your Linux distribution instructions for configuring KVM
📘  Documentation: https://minikube.sigs.k8s.io/docs/reference/drivers/kvm2/

I1117 20:24:13.006966    3016 install.go:102] Validating docker-machine-driver-kvm2, PATH=/home/nanik/.minikube/bin:/home/nanik/bin:/home/nanik/Downloads/node-v10.16.3-linux-x64/bin/:/home/nanik/Downloads/node-v10.16.3-linux-x64/bin/gradle-5.6.2-bin/bin:/home/nanik/Downloads/Postman/app:/home/nanik/bin/jdk-9.0.4/bin:/home/nanik/AndroidProjects/android-studio/bin:/home/nanik/Golang/go/bin:/home/nanik/AndroidProjects/android-sdk/platform-tools:/home/nanik/AndroidProjects/android-sdk/tools/bin:/home/nanik/AndroidProjects/android-sdk/emulator:/home/nanik/bin:/home/nanik/AndroidProjects/docker/docker:/home/nanik/AndroidProjects/android-sdk/emulator/qemu/linux-x86_64:/home/nanik/Music:/home/nanik/AndroidStudioProjects/ReverseEngineering/dex-tools-2.1-SNAPSHOT:/home/nanik/AndroidStudioProjects/ReverseEngineering/dex-tools-2.1-SNAPSHOT/bin:/home/nanik/AndroidStudioProjects/nanikjavaminikube/src/golang.org/x/tools/cmd/goimports:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games:/usr/local/games
W1117 20:24:13.023961    3016 install.go:46] docker-machine-driver-kvm2: docker-machine-driver-kvm2 is version 1.5.2, want 1.6.0-beta.0
💾  Downloading driver docker-machine-driver-kvm2:
I1117 20:24:13.025739    3016 install.go:145] Downloading: &{Ctx:<nil> Src:https://github.com/kubernetes/minikube/releases/download/v1.6.0-beta.0/docker-machine-driver-kvm2?checksum=file:https://github.com/kubernetes/minikube/releases/download/v1.6.0-beta.0/docker-machine-driver-kvm2.sha256 Dst:/home/nanik/.minikube/bin/docker-machine-driver-kvm2 Pwd: Mode:2 Detectors:[] Decompressors:map[] Getters:map[] Dir:false ProgressListener:<nil> Options:[0x9a73b0]}
    > docker-machine-driver-kvm2.sha256: 65 B / 65 B [-------] 100.00% ? p/s 0s
    > docker-machine-driver-kvm2: 13.86 MiB / 13.86 MiB  100.00% 46.30 KiB p/s 
I1117 20:29:34.102657    3016 downloader.go:60] Not caching ISO, using https://storage.googleapis.com/minikube/iso/minikube-v1.5.1.iso
I1117 20:29:34.102854    3016 profile.go:89] Saving config to /home/nanik/.minikube/profiles/minikube/config.json ...
I1117 20:29:34.102906    3016 lock.go:41] attempting to write to file "/home/nanik/.minikube/profiles/minikube/config.json" with filemode -rw-------
I1117 20:29:34.110656    3016 cache_images.go:300] CacheImage: k8s.gcr.io/k8s-dns-kube-dns-amd64:1.14.13 -> /home/nanik/.minikube/cache/images/k8s.gcr.io/k8s-dns-kube-dns-amd64_1.14.13
I1117 20:29:34.110659    3016 cluster.go:97] Machine does not exist... provisioning new machine
I1117 20:29:34.110710    3016 cache_images.go:300] CacheImage: k8s.gcr.io/pause:3.1 -> /home/nanik/.minikube/cache/images/k8s.gcr.io/pause_3.1
I1117 20:29:34.110714    3016 cache_images.go:300] CacheImage: k8s.gcr.io/kube-addon-manager:v9.0 -> /home/nanik/.minikube/cache/images/k8s.gcr.io/kube-addon-manager_v9.0
I1117 20:29:34.110726    3016 cache_images.go:300] CacheImage: k8s.gcr.io/coredns:1.6.2 -> /home/nanik/.minikube/cache/images/k8s.gcr.io/coredns_1.6.2
I1117 20:29:34.110733    3016 cache_images.go:300] CacheImage: k8s.gcr.io/kube-proxy:v1.17.0-beta.1 -> /home/nanik/.minikube/cache/images/k8s.gcr.io/kube-proxy_v1.17.0-beta.1
I1117 20:29:34.110751    3016 cache_images.go:306] /home/nanik/.minikube/cache/images/k8s.gcr.io/coredns_1.6.2 exists
I1117 20:29:34.110744    3016 cache_images.go:306] /home/nanik/.minikube/cache/images/k8s.gcr.io/kube-addon-manager_v9.0 exists

.......
.......
.......
.......


💡  Tip: Use 'minikube start -p <name>' to create a new cluster, or 'minikube delete' to delete this one.
I1117 20:30:05.686432    3016 main.go:110] libmachine: (minikube) Calling .GetState
I1117 20:30:05.686731    3016 cluster.go:114] Machine state:  Error
🔄  Retriable failure: Error getting state for host: getting connection: getting domain: error connecting to libvirt socket.: virError(Code=38, Domain=7, Message='Failed to connect socket to '/var/run/libvirt/libvirt-sock': Permission denied')
I1117 20:30:05.686964    3016 main.go:110] libmachine: Found binary path at /home/nanik/.minikube/bin/docker-machine-driver-kvm2
I1117 20:30:05.687004    3016 main.go:110] libmachine: Launching plugin server for driver kvm2
I1117 20:30:05.698701    3016 main.go:110] libmachine: Plugin server listening at address 127.0.0.1:40435
I1117 20:30:05.698959    3016 main.go:110] libmachine: () Calling .GetVersion
I1117 20:30:05.699246    3016 main.go:110] libmachine: Using API Version  1
I1117 20:30:05.699255    3016 main.go:110] libmachine: () Calling .SetConfigRaw
I1117 20:30:05.699445    3016 main.go:110] libmachine: () Calling .GetMachineName
I1117 20:30:05.699736    3016 main.go:110] libmachine: Found binary path at /home/nanik/.minikube/bin/docker-machine-driver-kvm2
I1117 20:30:05.699756    3016 main.go:110] libmachine: Launching plugin server for driver kvm2
I1117 20:30:05.711294    3016 main.go:110] libmachine: Plugin server listening at address 127.0.0.1:46817
I1117 20:30:05.711619    3016 main.go:110] libmachine: () Calling .GetVersion
I1117 20:30:05.711988    3016 main.go:110] libmachine: Using API Version  1
I1117 20:30:05.711999    3016 main.go:110] libmachine: () Calling .SetConfigRaw
I1117 20:30:05.712186    3016 main.go:110] libmachine: () Calling .GetMachineName
I1117 20:30:05.712303    3016 main.go:110] libmachine: (minikube) Calling .GetState
⚠️  Unable to get the status of the minikube cluster.
W1117 20:30:05.712641    3016 start.go:1010] DeleteHost: Docker machine "minikube" does not exist. Use "docker-machine ls" to list machines. Use "docker-machine create" to add a new one.

💣  Unable to start VM
❌  Error: [KVM_CONNECTION_ERROR] Error getting state for host: getting connection: getting domain: error connecting to libvirt socket.: virError(Code=38, Domain=7, Message='Failed to connect socket to '/var/run/libvirt/libvirt-sock': Permission denied')
💡  Suggestion: Have you set up libvirt correctly?
📘  Documentation: https://minikube.sigs.k8s.io/docs/reference/drivers/kvm2/

The current behaviour is not good as it keeps on going even after the permission denied error shows up.

Error:/usr/bin/virsh domcapabilities --virttype kvm failed:
error: failed to connect to the hypervisor
error: Failed to connect socket to '/var/run/libvirt/libvirt-sock': Permission denied Fix:Follow your Linux distribution instructions for configuring KVM Doc:https://minikube.sigs.k8s.io/docs/reference/drivers/kvm2/}

Personally would like for minikube to directly terminate after it shows up with the error.

This tie in to my previous comment as the code does not treat fatal error such as this as a show stopper. The code must be refactored to take into account if any error does occur there should be some kind of flag to indicate that the code must stop.

nanikjava · 2019-11-17T12:31:14Z

Idea of how the checking and failing will work nanikjava@3be173f

josedonizetti · 2019-12-13T15:45:16Z

@nanikjava can you create a PR with the idea? Mark is as WIP, easier to give feedback on the PR.

priyawadhwa · 2019-12-16T22:57:54Z

@nanikjava, are you still working on this issue?

nanikjava · 2019-12-18T02:26:13Z

@nanikjava, are you still working on this issue?

Yes I will work on this as I have created an early proto of the idea. Thanks

nanikjava · 2019-12-18T02:26:25Z

@nanikjava can you create a PR with the idea? Mark is as WIP, easier to give feedback on the PR.

@josedonizetti will do.

nanikjava · 2019-12-19T00:11:54Z

PR submitted #6120

bushraKhan23 · 2020-04-15T22:14:38Z

❌ [KVM_CONNECTION_ERROR] Failed to start kvm2 VM. "minikube start" may fix it. driver start: creating network: getting libvirt connection: error connecting to libvirt socket.: virError(Code=38, Domain=7, Message='Failed to connect socket to '/var/run/libvirt/libvirt-sock': No such file or directory')

medyagh · 2020-05-11T23:07:10Z

is anyone still interested to do this PR ?

@nanikjava

bushraKhan23 · 2020-05-12T12:29:40Z

yes. me trying

…

On Tue, May 12, 2020 at 4:07 AM Medya Ghazizadeh ***@***.***> wrote: is anyone still interested to do this PR ? @nanikjava <https://github.com/nanikjava> — You are receiving this because you commented. Reply to this email directly, view it on GitHub <#5617 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AHZBLE74UZZRZHDJSXHAH5LRRCAKXANCNFSM4JANEG6A> .

medyagh · 2020-05-13T04:28:05Z

@bushraKhan23 excellent. let me know if you needed any PR review

priyawadhwa · 2020-05-20T18:15:55Z

/remove-lifecycle stale

fejta-bot · 2020-08-18T19:17:15Z

Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/lifecycle stale

fejta-bot · 2020-09-17T19:59:49Z

Stale issues rot after 30d of inactivity.
Mark the issue as fresh with /remove-lifecycle rotten.
Rotten issues close after an additional 30d of inactivity.

If this issue is safe to close now please do so with /close.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/lifecycle rotten

medyagh · 2020-09-23T18:40:00Z

@bushraKhan23 still intereted?

priyawadhwa · 2021-02-18T21:47:16Z

This issue is open for anyone who is interested in taking it on!

prezha · 2021-03-03T01:47:33Z

could be solved together with #10070

/assign

Undefeated22 · 2023-06-28T19:58:36Z

did'nt helped

medyagh added co/kvm2-driver KVM2 driver related issues triage/needs-information Indicates an issue needs more information in order to work on it. needs-solution-message Issues where where offering a solution for an error would be helpful labels Oct 14, 2019

medyagh changed the title ~~kvm2~~ kvm2: check if user in "libvirt" group Oct 14, 2019

tstromberg removed the needs-solution-message Issues where where offering a solution for an error would be helpful label Oct 16, 2019

tstromberg added help wanted Denotes an issue that needs help from a contributor. Must meet "help wanted" guidelines. priority/backlog Higher priority than priority/awaiting-more-evidence. labels Oct 17, 2019

k8s-ci-robot assigned nanikjava Nov 7, 2019

nanikjava mentioned this issue Dec 19, 2019

[WIP] Add checking for libvirt group #6120

Closed

medyagh unassigned nanikjava May 11, 2020

k8s-ci-robot removed the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label May 20, 2020

afbjorklund mentioned this issue May 26, 2020

minikube should not ask for the (sudo) password more than once #8278

Closed

afbjorklund mentioned this issue Jun 10, 2020

Set the --force-systemd true or false automatically (by detecting the cgroups) #8348

Open

k8s-ci-robot added the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label Aug 18, 2020

k8s-ci-robot added lifecycle/rotten Denotes an issue or PR that has aged beyond stale and will be auto-closed. and removed lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. labels Sep 17, 2020

sharifelgamal added lifecycle/frozen Indicates that an issue or PR should not be auto-closed due to staleness. and removed lifecycle/rotten Denotes an issue or PR that has aged beyond stale and will be auto-closed. labels Sep 30, 2020

priyawadhwa added the good first issue Denotes an issue ready for a new contributor, according to the "help wanted" guidelines. label Feb 18, 2021

priyawadhwa changed the title ~~kvm2: check if user in "libvirt" group~~ kvm2 driver: check if user in "libvirt" group and exit if they are not Feb 18, 2021

k8s-ci-robot assigned prezha Mar 3, 2021

prezha added this to the v.1.19.0 milestone Mar 3, 2021

prezha mentioned this issue Mar 4, 2021

kvm: provide solution if user doesn't belong to libvirt group #10712

Merged

medyagh closed this as completed in #10712 Mar 6, 2021

afbjorklund mentioned this issue Mar 12, 2021

Minikube fails on KVM2 on fresh minikube installation on Fedora 33 (with solution) #10794

Closed

kuangyu0801 mentioned this issue Jun 1, 2021

Minikube fail to start with KVM2 on Ubuntu on mainfream s390x due to "PR_KVM_USER_PERMISSION: libvirt group membership check failed" #11551

Closed

eshkinkot mentioned this issue Jun 10, 2021

Minikube fail to start with KVM2 on Slackware with "PR_KVM_USER_PERMISSION: libvirt group membership check failed" #11630

Closed

vmorris mentioned this issue Jun 15, 2021

minikube start fails with podman or kvm2 drivers on s390x #11658

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

kvm2 driver: check if user in "libvirt" group and exit if they are not #5617

kvm2 driver: check if user in "libvirt" group and exit if they are not #5617

piccadil commented Oct 14, 2019 •

edited

Loading

medyagh commented Oct 14, 2019 •

edited

Loading

piccadil commented Oct 15, 2019 •

edited

Loading

afbjorklund commented Oct 15, 2019

afbjorklund commented Oct 15, 2019 •

edited

Loading

tstromberg commented Oct 16, 2019

piccadil commented Oct 17, 2019 •

edited by tstromberg

Loading

medyagh commented Oct 23, 2019

nanikjava commented Nov 7, 2019

nanikjava commented Nov 17, 2019

tstromberg commented Nov 17, 2019 •

edited

Loading

nanikjava commented Nov 17, 2019

nanikjava commented Nov 17, 2019 •

edited

Loading

josedonizetti commented Dec 13, 2019

priyawadhwa commented Dec 16, 2019

nanikjava commented Dec 18, 2019

nanikjava commented Dec 18, 2019

nanikjava commented Dec 19, 2019

bushraKhan23 commented Apr 15, 2020

medyagh commented May 11, 2020

bushraKhan23 commented May 12, 2020 via email

medyagh commented May 13, 2020

priyawadhwa commented May 20, 2020

fejta-bot commented Aug 18, 2020

fejta-bot commented Sep 17, 2020

medyagh commented Sep 23, 2020

priyawadhwa commented Feb 18, 2021

prezha commented Mar 3, 2021

Undefeated22 commented Jun 28, 2023

kvm2 driver: check if user in "libvirt" group and exit if they are not #5617

kvm2 driver: check if user in "libvirt" group and exit if they are not #5617

Comments

piccadil commented Oct 14, 2019 • edited Loading

medyagh commented Oct 14, 2019 • edited Loading

piccadil commented Oct 15, 2019 • edited Loading

afbjorklund commented Oct 15, 2019

afbjorklund commented Oct 15, 2019 • edited Loading

tstromberg commented Oct 16, 2019

piccadil commented Oct 17, 2019 • edited by tstromberg Loading

medyagh commented Oct 23, 2019

nanikjava commented Nov 7, 2019

nanikjava commented Nov 17, 2019

tstromberg commented Nov 17, 2019 • edited Loading

nanikjava commented Nov 17, 2019

nanikjava commented Nov 17, 2019 • edited Loading

josedonizetti commented Dec 13, 2019

priyawadhwa commented Dec 16, 2019

nanikjava commented Dec 18, 2019

nanikjava commented Dec 18, 2019

nanikjava commented Dec 19, 2019

bushraKhan23 commented Apr 15, 2020

medyagh commented May 11, 2020

bushraKhan23 commented May 12, 2020 via email

medyagh commented May 13, 2020

priyawadhwa commented May 20, 2020

fejta-bot commented Aug 18, 2020

fejta-bot commented Sep 17, 2020

medyagh commented Sep 23, 2020

priyawadhwa commented Feb 18, 2021

prezha commented Mar 3, 2021

Undefeated22 commented Jun 28, 2023

piccadil commented Oct 14, 2019 •

edited

Loading

medyagh commented Oct 14, 2019 •

edited

Loading

piccadil commented Oct 15, 2019 •

edited

Loading

afbjorklund commented Oct 15, 2019 •

edited

Loading

piccadil commented Oct 17, 2019 •

edited by tstromberg

Loading

tstromberg commented Nov 17, 2019 •

edited

Loading

nanikjava commented Nov 17, 2019 •

edited

Loading