fix(urunc-cleanup): remove unnecessary k3s volume mount and redundant label removal - #994
Open
saitejagirada wants to merge 3 commits into
Conversation
The urunc-cleanup DaemonSet runs install.sh with the 'reset' action, which only uses kubectl API calls and nsenter syscalls to restart the CRI runtime. It never accesses any files under /etc/containerd/. The k3s overlay was mounting the host's containerd config directory into the cleanup pod, but this was a copy-paste artifact from the urunc-deploy overlay where the mount is actually needed for the install and cleanup code paths that modify containerd configuration. Removing the unnecessary host-path volume mount from the privileged cleanup pod reduces the attack surface without any behavioral change. Verified by tracing the full reset code path and confirming zero filesystem operations on /etc/containerd/. Signed-off-by: saitejagirada <saitejagirada@gmail.com>
The reset code path in install.sh removes the node label urunc.io/urunc-runtime at line 395 in the reset) case block, and then calls reset_runtime() which removes the same label again at line 308. The second call is redundant and produces a warning since the label has already been removed. Remove the duplicate kubectl label command from reset_runtime() to keep the label removal solely in the reset) case block where it logically belongs. Signed-off-by: saitejagirada <saitejagirada@gmail.com>
Signed-off-by: saitejagirada <saitejagirada@gmail.com>
✅ Deploy Preview for urunc canceled.
|
saitejagirada
marked this pull request as ready for review
August 26, 2026 04:16
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Two small fixes for the urunc-cleanup deployment:
Remove unnecessary k3s volume mount: The
urunc-cleanupDaemonSet's k3s overlay mounts/var/lib/rancher/k3s/agent/etc/containerd/into the pod, but theresetcode path ininstall.shnever accesses any files under/etc/containerd/. It only useskubectl(API calls) andnsenter(host PID namespace syscalls). The mount was a copy-paste from theurunc-deployoverlay where it is needed for theinstall/cleanuppaths that modify containerd config viatomlq. Removing it reduces the attack surface of the privileged cleanup pod.Remove redundant
kubectl labelcall: Thereset)case block at line 395 runskubectl label node "$NODE_NAME" urunc.io/urunc-runtime-, then callsreset_runtime()which runs the same command again at line 308. The duplicate is removed fromreset_runtime(), keeping the label removal in thereset)case block where it logically belongs.Related issues
How was this tested?
kubectl kustomize deployment/urunc-deploy/urunc-cleanup/base/andkubectl kustomize deployment/urunc-deploy/urunc-cleanup/overlays/k3s/build successfully after changesbash -n deployment/urunc-deploy/scripts/install.sh— syntax OKresetcode path:main("reset") → kubectl label → reset_runtime() → restart_cri_runtime() → host_systemctl → wait_till_node_is_ready()— confirmed zero filesystem operations on/etc/containerd/LLM usage
An LLM (Google Antigravity / Claude Opus 4.6) assisted with code path analysis and tracing. All findings were independently verified by reading the source code and running kustomize builds.
Checklist
make lint).make test_ctr,make test_nerdctl,make test_docker,make test_crictl).