minikube driver check should not call sudo, if sudo fails

[bigon]

Steps to reproduce the issue:

1. minikube start (without --driver)

Full output of minikube logs command:

😄  minikube v1.22.0 on Debian 11.0
✨  Automatically selected the docker driver. Other choices: kvm2, ssh
👍  Starting control plane node minikube in cluster minikube
[...]

It seems that minikube stills calls podman executable (and sudo) even if it tells that it uses docker. I see logs/mails coming from sudo telling me that minikube tried to run podman executable without providing a password

Messages like:

edoras.bigon.be : Jul 14 09:36:54 : bigon : a password is required ; TTY=pts/2 ; PWD=/home/bigon/bin ; USER=root ; COMMAND=/usr/bin/podman version --format {{.Version}}
edoras.bigon.be : Jul 14 10:05:28 : bigon : a password is required ; TTY=pts/2 ; PWD=/home/bigon ; USER=root ; COMMAND=/usr/bin/podman ps -a --filter label=name.minikube.sigs.k8s.io=minikube --format {{.Names}}
edoras.bigon.be : Jul 14 10:05:28 : bigon : a password is required ; TTY=pts/2 ; PWD=/home/bigon ; USER=root ; COMMAND=/usr/bin/podman volume ls --filter label=name.minikube.sigs.k8s.io=minikube --format {{.Name}}
edoras.bigon.be : Jul 14 10:05:28 : bigon : a password is required ; TTY=pts/2 ; PWD=/home/bigon ; USER=root ; COMMAND=/usr/bin/podman network ls --filter=label=created_by.minikube.sigs.k8s.io --format {{.Name}}
[...]

[afbjorklund]

I think this is the driver auto-detection in action... You can select the docker driver explicitly, to avoid it...

It assumes that if podman is installed, that it has also been setup for passwordless sudo (sudo -n podman)

Similarly it assumes that if docker is installed, that the user has been added to the root-equivalent group (no sudo)

There is no particular reason why podman couldn't use a group or docker use sudo, other than "historic reasons".

[afbjorklund]

I suppose we could try parsing the output of sudo -l, before trying to invoke sudo -k -n podman.

1. Check for podman
2. Check for sudo
3. Check for podman in sudo -l
4. Check for sudo -k -n podman
5. Validate podman (server) version

There are a few corner cases like ALL and groups and such, but other than that it should be listed.

---

On Linux there is no client/server, so there is only one version. It could be validated earlier there.

$ podman version
Version:      3.2.2
API Version:  3.2.2
Go Version:   go1.15.2
Built:        Thu Jan  1 01:00:00 1970
OS/Arch:      linux/amd64
$ podman-remote version
Client:
Version:      3.2.2
API Version:  3.2.2
Go Version:   go1.15.2
Built:        Thu Jan  1 01:00:00 1970
OS/Arch:      linux/amd64

Server:
Version:      3.2.2
API Version:  3.2.2
Go Version:   go1.15.2
Built:        Thu Jan  1 01:00:00 1970
OS/Arch:      linux/amd64

On Win and Mac the podman-remote client binary is renamed, to be called podman instead.

EDIT: Never mind, still need to call "sudo podman version" for the full output (not rootless).

Supposedly we could use "podman --version" as an alternative Linux shortcut, if desired

[medyagh]

@bigon the reason minikube is calling podman, it is because when you don't specify the driver with --driver flag, minikube will check all installed tools on your system and automatically select best driver (most healthy one)

I am curious, does this mnikube calls to podman cause any harm or annoyance to the user experience?

[medyagh]

/triage needs-information
/kind support

[bigon]

The main problem is that it calls sudo, it immediately fails and and sudo failures generate a mail

[medyagh]

@bigon I see ! I agree we should do better job, if we can NOT execute sudo, we should skip it
as @afbjorklund mentioned in this comment, I agree

#11973 (comment)

this is a good first issue

[clintonyeb]

@medyagh I would like to pick this up as a good first issue. Could you please give me some pointers? I am looking at driver/driver.go which seems to be responsible for selecting the best driver to run with.

[djplt]

@clintonyeb just wanted to check if you were still working on this issue or if I'm okay to pick this up?

[djplt]

/assign

[klaases]

Hi @djplt, @medyagh left a comment on your PR, once we merge the PR we can close this issue. Thanks!

[k8s-triage-robot]

The Kubernetes project currently lacks enough contributors to adequately respond to all issues and PRs.

This bot triages issues and PRs according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Mark this issue or PR as fresh with /remove-lifecycle stale
• Mark this issue or PR as rotten with /lifecycle rotten
• Close this issue or PR with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

[k8s-triage-robot]

The Kubernetes project currently lacks enough active contributors to adequately respond to all issues and PRs.

This bot triages issues and PRs according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Mark this issue or PR as fresh with /remove-lifecycle rotten
• Close this issue or PR with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle rotten

[k8s-triage-robot]

The Kubernetes project currently lacks enough active contributors to adequately respond to all issues and PRs.

This bot triages issues and PRs according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Reopen this issue or PR with /reopen
• Mark this issue or PR as fresh with /remove-lifecycle rotten
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/close

[k8s-ci-robot]

@k8s-triage-robot: Closing this issue.

In response to this:

The Kubernetes project currently lacks enough active contributors to adequately respond to all issues and PRs.

This bot triages issues and PRs according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Reopen this issue or PR with /reopen
• Mark this issue or PR as fresh with /remove-lifecycle rotten
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.