podman generate kube doesn't handle privileged container

[fcrozat]

Is this a BUG REPORT or FEATURE REQUEST? (leave only one on its own line)

/kind bug

Description

podman generate kube is reporting an error if a container is privileged

Steps to reproduce the issue:

1. podman container create --name foobar --privileged registry.opensuse.org/opensuse/tumbleweed:latest

2. podman generate kube foobar

Describe the results you received:
Error: linux devices: not yet implemented

Describe the results you expected:

Generation of Kubernetes YAML is still under development!

Save the output of this file and use kubectl create -f to import

it into Kubernetes.

Created with podman-2.2.0

apiVersion: v1
kind: Pod
metadata:
creationTimestamp: "2021-01-06T14:17:11Z"
labels:
app: foobar
name: foobar
spec:
containers:

• command:
  • /bin/bash
    env:
  • name: PATH
    value: /usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
  • name: TERM
    value: xterm
  • name: container
    value: podman
  • name: HOSTNAME
    image: registry.opensuse.org/opensuse/tumbleweed:latest
    name: foobar
    resources: {}
    securityContext:
    allowPrivilegeEscalation: true
    capabilities: {}
    privileged: true
    readOnlyRootFilesystem: false
    seLinuxOptions: {}
    workingDir: /
    status: {}

---

metadata:
creationTimestamp: null
spec: {}
status:
loadBalancer: {}

Additional information you deem important (e.g. issue happens only occasionally):

Output of podman version:

Version: 2.2.0
API Version: 2.1.0
Go Version: go1.13.15
Built: Wed Dec 2 01:00:00 2020
OS/Arch: linux/amd64

Output of podman info --debug:

host:
arch: amd64
buildahVersion: 1.18.0
cgroupManager: systemd
cgroupVersion: v1
conmon:
package: conmon-2.0.21-1.1.x86_64
path: /usr/bin/conmon
version: 'conmon version 2.0.21, commit: unknown'
cpus: 2
distribution:
distribution: '"opensuse-tumbleweed"'
version: "20210102"
eventLogger: journald
hostname: localhost.localdomain
idMappings:
gidmap: null
uidmap: null
kernel: 5.10.3-1-default
linkmode: dynamic
memFree: 720027648
memTotal: 2055946240
ociRuntime:
name: runc
package: runc-1.0.0~rc92-1.1.x86_64
path: /usr/bin/runc
version: |-
runc version 1.0.0-rc92
spec: 1.0.2-dev
os: linux
remoteSocket:
path: /run/podman/podman.sock
rootless: false
slirp4netns:
executable: ""
package: ""
version: ""
swapFree: 2142531584
swapTotal: 2148335616
uptime: 3h 32m 20.11s (Approximately 0.12 days)
registries:
search:

• registry.opensuse.org
• docker.io
  store:
  configFile: /etc/containers/storage.conf
  containerStore:
  number: 5
  paused: 0
  running: 0
  stopped: 5
  graphDriverName: btrfs
  graphOptions: {}
  graphRoot: /var/lib/containers/storage
  graphStatus:
  Build Version: 'Btrfs v5.9 '
  Library Version: "102"
  imageStore:
  number: 40
  runRoot: /var/run/containers/storage
  volumePath: /var/lib/containers/storage/volumes
  version:
  APIVersion: 2.1.0
  Built: 1606867200
  BuiltTime: Wed Dec 2 01:00:00 2020
  GitCommit: ""
  GoVersion: go1.13.15
  OsArch: linux/amd64
  Version: 2.2.0

Package info (e.g. output of rpm -q podman or apt list podman):

podman-2.2.0-1.1.x86_64 (openSUSE Tumbleweed)

Have you tested with the latest version of Podman and have you checked the Podman Troubleshooting Guide?

Yes

Additional environment details (AWS, VirtualBox, physical, etc.):

[vrothberg]

Thanks for opening the issue, @fcrozat!

I'll take a look.

[aborniak]

@vrothberg Has it been fixed in podman 3.0.1 ?

[root@aborniakFC ~]# podman version
Version:      3.0.1
API Version:  3.0.0
Go Version:   go1.15.8
Built:        Fri Feb 19 18:56:17 2021
OS/Arch:      linux/amd64
[root@aborniakFC ~]#

[root@aborniakFC ~]# podman generate kube e66965324d5b
Error: linux devices: not yet implemented
[root@aborniakFC ~]#

[root@aborniakFC ~]# podman top e66965324d5b capeff
EFFECTIVE CAPS
full
AUDIT_CONTROL,AUDIT_READ,CHOWN,DAC_OVERRIDE,DAC_READ_SEARCH,FOWNER,MAC_OVERRIDE,SETGID,SETUID,SYSLOG,SYS_ADMIN,SYS_PTRACE
none
AUDIT_CONTROL,AUDIT_READ,AUDIT_WRITE,BLOCK_SUSPEND,CHOWN,DAC_OVERRIDE,DAC_READ_SEARCH,FOWNER,FSETID,IPC_LOCK,IPC_OWNER,KILL,LEASE,LINUX_IMMUTABLE,MAC_ADMIN,MAC_OVERRIDE,MKNOD,NET_ADMIN,NET_BIND_SERVICE,NET_BROADCAST,NET_RAW,SETFCAP,SETGID,SETPCAP,SETUID,SYSLOG,SYS_ADMIN,SYS_BOOT,SYS_CHROOT,SYS_MODULE,SYS_NICE,SYS_PACCT,SYS_PTRACE,SYS_RAWIO,SYS_RESOURCE,SYS_TTY_CONFIG
CHOWN,DAC_OVERRIDE,FOWNER,FSETID,SETGID,SETUID,SYS_ADMIN
AUDIT_CONTROL,CHOWN,DAC_OVERRIDE,DAC_READ_SEARCH,FOWNER,LINUX_IMMUTABLE,MAC_ADMIN,SYS_ADMIN,SYS_TTY_CONFIG
none
AUDIT_WRITE
none
full
full
full
full
none
none
none
full
full
full
full
full
[root@aborniakFC ~]#

[mheon]

@aborniak No. This one is going to make it into 3.1.0, which I am working on right now.

[aborniak]

@mheon Thank you.