이 콘텐츠는 선택한 언어로 제공되지 않습니다.
Chapter 1. Troubleshooting RuntimeClass
Diagnose and resolve common build configuration errors related to RuntimeClass isolation. Identifying these issues ensures that builds run in the intended isolated environments and helps maintain cluster security.
1.1. Resolving build failures with RuntimeClassNameNotValid 링크 복사링크가 클립보드에 복사되었습니다!
If the runtimeClassName value violates DNS subdomain naming conventions, the Build or BuildRun status is set to RuntimeClassNameNotValid.
Procedure
Run the following command to check the build status:
$ oc get build buildah-build-kata -o jsonpath='{.status.reason}'To fix this issue, update the
runtimeClassNameto use only lowercase alphanumeric characters, dots (.), or hyphens (-), and ensure it begins and ends with an alphanumeric character.The following example output displays the invalid names:
runtimeClassName: My_Runtime! # Invalid: uppercase, underscore, and special character
runtimeClassName: Kata # Invalid: uppercase letter
runtimeClassName: -kata # Invalid: starts with hyphen
+ The following example output displays the valid names:
runtimeClassName: kata # Valid
runtimeClassName: gvisor.runsc # Valid: contains dot
runtimeClassName: kata-containers # Valid: contains hyphen
1.2. Resolving build pods in Pending state 링크 복사링크가 클립보드에 복사되었습니다!
When a build pod fails to schedule, examine the pod events for diagnostic details to identify the root cause.
Procedure
Run the following command to examine the pod events:
$ oc describe pod <build-pod-name>Identify any
FailedSchedulingevents, which often result from the following scenarios:The
Buildvalidation only checks string format, a name that is syntactically valid but refers to a missingRuntimeClasswill fail during scheduling. Run the following command to verify the resource exists:$ oc get runtimeclass kataThe targeted nodes must have the Kata runtime properly installed. Confirm the
KataConfigstatus and node readiness:$ oc get kataconfig -o yamlCheck
status.installationStatusto ensure the installation on worker nodes was successful.The operator-managed
kataruntimeClass applies anode-role.kubernetes.io/kata-oc: ""selector. If your build configuration defines additional selectors, they must intersect with theruntimeClassrequirements. Verify node labels:$ oc get nodes --show-labels | grep kata
1.3. Resolve buildRun failures with BuildRunBuildFieldOverrideForbidden 링크 복사링크가 클립보드에 복사되었습니다!
The BuildRunBuildFieldOverrideForbidden error occurs if you try to set runtimeClassName on a BuildRun that has an embedded spec.build.spec rather than a reference to a named Build.
Procedure
Run the following command to check the
BuildRunstatus message:$ oc get buildrun <buildrun-name> -o jsonpath='{.status.conditions[0].message}'To resolve this issue, use one of the following methods:
Define the
runtimeClassNamedirectly within the inlinespec.build.specblock:apiVersion: shipwright.io/v1beta1 kind: BuildRun spec: build: spec: # ... source and strategy fields ... runtimeClassName: kataReference a standalone
Buildby name to use the override field:apiVersion: shipwright.io/v1beta1 kind: BuildRun spec: build: name: buildah-build-kata runtimeClassName: kata
1.4. Resolving build pod failures with RuntimeClass not found error 링크 복사링크가 클립보드에 복사되었습니다!
If events report that the runtimeClass is missing, the operator setup might be incomplete.
Procedure
Confirm the operator is active:
$ oc get csv -n openshift-sandboxed-containers-operatorCheck the
KataConfiginstallation status:$ oc get kataconfig -o jsonpath='{.items[0].status.installationStatus}'- Ensure all worker nodes have completed the mandatory reboot process.