Amazon-eks-ami: Could not connect to D-Bus system bus

[dawidmalina]

What happened:
/var/run/dbus volume is not mounted to kube-proxy

What you expected to happen:
Properly configure kube-proxy daemonset

How to reproduce it (as minimally and precisely as possible):
Run regular node and check kube-proxy logs

Anything else we need to know?:

Environment:

• AWS Region: eu-central-1
• Instance Type(s): t3.large
• EKS Platform version: eks.1
• Kubernetes version: 1.11
• AMI Version: ami-010caa98bae9a09e2
• Kernel: Linux ip-10-10-12-205.eu-central-1.compute.internal 4.14.88-88.76.amzn2.x86_64 #1 SMP Mon Jan 7 18:43:26 UTC 2019 x86_64 x86_64 x86_64 GNU/Linux
• Release information (run cat /tmp/release on a node):
  

I0111 11:35:10.732422       5 iptables.go:200] Could not connect to D-Bus system bus: dial unix /var/run/dbus/system_bus_socket: connect: no such file or directory

[micahhausler]

d-bus is used for firewalld by kube-proxy. Amazon linux doesn't use firewalld, so this just noise in the logs.

[dawidmalina]

Even if this is "just a noise" it can be easily fixed. Why don't you care about proper configuration?

[micahhausler]

Kubernetes components are designed to work with a diverse variety of systems, some of which EKS and AWS don't use. You are free to modify your kube-proxy daemon sets to mount dbus, but for the default configuration on EKS, kube-proxy does not need access to dbus. Since kube-proxy doesn't need access, we won't give it access. By limiting what kube-proxy can access, it improves the security profile. I would argue that just because Kubernetes _can_ access a certain component, doesn't mean it needs to, and it would still be a "proper configuration" to not mount dbus. Does that make sense to you?

[dawidmalina]

Yes, I appreciate it. Another noise in the logs I need to stop to be so pedantic:)