From 8426928025b4fd69b635fd9daa011822e132e9fb Mon Sep 17 00:00:00 2001 From: saitejagirada Date: Wed, 26 Aug 2026 08:24:32 +0530 Subject: [PATCH 1/3] fix(urunc-cleanup): remove unnecessary k3s volume mount The urunc-cleanup DaemonSet runs install.sh with the 'reset' action, which only uses kubectl API calls and nsenter syscalls to restart the CRI runtime. It never accesses any files under /etc/containerd/. The k3s overlay was mounting the host's containerd config directory into the cleanup pod, but this was a copy-paste artifact from the urunc-deploy overlay where the mount is actually needed for the install and cleanup code paths that modify containerd configuration. Removing the unnecessary host-path volume mount from the privileged cleanup pod reduces the attack surface without any behavioral change. Verified by tracing the full reset code path and confirming zero filesystem operations on /etc/containerd/. Signed-off-by: saitejagirada --- .../overlays/k3s/kustomization.yaml | 4 +-- .../overlays/k3s/mount_k3s_conf.yaml | 31 ------------------- 2 files changed, 1 insertion(+), 34 deletions(-) delete mode 100644 deployment/urunc-deploy/urunc-cleanup/overlays/k3s/mount_k3s_conf.yaml diff --git a/deployment/urunc-deploy/urunc-cleanup/overlays/k3s/kustomization.yaml b/deployment/urunc-deploy/urunc-cleanup/overlays/k3s/kustomization.yaml index 595eba70a..98deaf60f 100644 --- a/deployment/urunc-deploy/urunc-cleanup/overlays/k3s/kustomization.yaml +++ b/deployment/urunc-deploy/urunc-cleanup/overlays/k3s/kustomization.yaml @@ -15,6 +15,4 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: -- ../../base -patches: -- path: mount_k3s_conf.yaml \ No newline at end of file +- ../../base \ No newline at end of file diff --git a/deployment/urunc-deploy/urunc-cleanup/overlays/k3s/mount_k3s_conf.yaml b/deployment/urunc-deploy/urunc-cleanup/overlays/k3s/mount_k3s_conf.yaml deleted file mode 100644 index 46cd7464a..000000000 --- a/deployment/urunc-deploy/urunc-cleanup/overlays/k3s/mount_k3s_conf.yaml +++ /dev/null @@ -1,31 +0,0 @@ -# Copyright (c) 2023-2026, Nubificus LTD -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -apiVersion: apps/v1 -kind: DaemonSet -metadata: - name: kubelet-urunc-cleanup - namespace: kube-system -spec: - template: - spec: - containers: - - name: kube-urunc-cleanup - volumeMounts: - - name: containerd-conf - mountPath: /etc/containerd/ - volumes: - - name: containerd-conf - hostPath: - path: /var/lib/rancher/k3s/agent/etc/containerd/ \ No newline at end of file From ee01680ef30f6348cc89bd4ad00110d678a5d52b Mon Sep 17 00:00:00 2001 From: saitejagirada Date: Wed, 26 Aug 2026 08:24:41 +0530 Subject: [PATCH 2/3] fix(urunc-deploy): remove redundant label removal in reset_runtime The reset code path in install.sh removes the node label urunc.io/urunc-runtime at line 395 in the reset) case block, and then calls reset_runtime() which removes the same label again at line 308. The second call is redundant and produces a warning since the label has already been removed. Remove the duplicate kubectl label command from reset_runtime() to keep the label removal solely in the reset) case block where it logically belongs. Signed-off-by: saitejagirada --- deployment/urunc-deploy/scripts/install.sh | 1 - 1 file changed, 1 deletion(-) diff --git a/deployment/urunc-deploy/scripts/install.sh b/deployment/urunc-deploy/scripts/install.sh index 92f3b01b4..4ac5d98d7 100644 --- a/deployment/urunc-deploy/scripts/install.sh +++ b/deployment/urunc-deploy/scripts/install.sh @@ -305,7 +305,6 @@ function restart_cri_runtime() { } function reset_runtime() { - kubectl label node "$NODE_NAME" urunc.io/urunc-runtime- restart_cri_runtime "$1" if [ "$1" == "crio" ] || [ "$1" == "containerd" ]; then From 0a0ffd67b676da7653734fa44e697f62de11df48 Mon Sep 17 00:00:00 2001 From: saitejagirada Date: Wed, 26 Aug 2026 08:24:48 +0530 Subject: [PATCH 3/3] chore: add saitejagirada to contributors Signed-off-by: saitejagirada --- .github/contributors.yaml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/.github/contributors.yaml b/.github/contributors.yaml index 7f7307a3d..b6491bd3d 100644 --- a/.github/contributors.yaml +++ b/.github/contributors.yaml @@ -128,3 +128,6 @@ users: OdysseasKalaitsidis: name: Odysseas Kalaitsidis email: odysseaskalaitsides@gmail.com + saitejagirada: + name: saitejagirada + email: saitejagirada@gmail.com