 up-to-date insofar as that's all the work Luke had on it, not necessarily that it was complete
<abeato> ijohnson, ok, thanks for the pointers
<zyga> Wrapping up for now. Time to eat something
<sil2100> abeato: merged your PR, thanks again! We should have it in edge soonish
<sil2100> There's still one thing we want to add before we promote this further
<sil2100> Hopefully having it in edge will be enough for now?
<abeato> sil2100, awesome, thank you!
<abeato> sil2100, sure, no hurry for me
<kenvandine> zyga: sorry, I was out today for a holiday.  I'll catch up with you in the morning
<jdstrand> joedborg: hey, I just saw this: 16:03 < joedborg> `[285928.025967] audit: type=1400 audit(1570741250.597:1384598): apparmor="DENIED" operation="signal" profile="docker-default" pid=703 comm="kubelet" requested_mask="receive" denied_mask="receive" signal=kill peer="snap.kubernetes-worker.kubelet"`
<jdstrand> joedborg: kubelet shouldn't be talking to a 'docker-default' profile, it should be talking to the one that containerd sets up
<jdstrand> joedborg: oh, I read that backward. why is a docker container sending signals to kubelet?
<ijohnson> jdstrand: joedborg: I don't remember the specifics, but IIRC the child profile (i.e. the container) needs to signal to the parent that it is done, I think that's something runC does
<ijohnson> also welcome back jdstrand :-)
<jdstrand> ijohnson: thanks, right, but the kubernetes-worker snap has a containerd with a different profile name than 'docker-default', so I'm confused why a profile named 'docker-default' is in play at all
<jdstrand> joedborg: eff, I am a little slow today. that denial says that a process running under a 'docker-default' profile name was sent 'kill' by snap.kubernetes-worker.kubelet
up - to - date insofar as that's all the work Luke had on it, not necessarily that it was complete 
 < abeato > ijohnson, ok, thanks for the cursor 
 < zyga > envelop up for now. Time to eat something 
 < sil2100 > abeato: blend your PR, thanks again! We should have it in boundary soonish 
 < sil2100 > There's still one thing we want to lend before we promote this further 
 < sil2100 > Hopefully having it in boundary will be enough for now? 
 < abeato > sil2100, awesome, thank you! 
 < abeato > sil2100, sure, no haste for me 
 < kenvandine > zyga: sorry, I was out today for a holiday.   I'll catch up with you in the morning 
 < jdstrand > joedborg: hey, I just attend this: 16:03 < joedborg > '[ 285928.025967 ] audit: type=1400 audit(1570741250.597:1384598 ): apparmor="DENIED " operation="signal " profile="docker - default " pid=703 comm="kubelet " requested_mask="receive " denied_mask="receive " signal = toss off peer="snap.kubernetes - worker.kubelet " '
 < jdstrand > joedborg: kubelet shouldn't be talking to a' docker - default' profile, it should be talk to the one that containerd sets up 
 < jdstrand > joedborg: oh, I read that backward. why is a docker container sending signal to kubelet? 
 < ijohnson > jdstrand: joedborg: I don't remember the specifics, but IIRC the child profile (i.e. the container) needs to signal to the parent that it is done, I think that's something runC does 
 < ijohnson > also welcome back jdstrand :-) 
 < jdstrand > ijohnson: thanks, right, but the kubernetes - worker snap has a containerd with a different profile name than' docker - default', so I'm confused why a visibility diagnose' docker - default option' is in playing period at all 
 < jdstrand > joedborg: eff, I am a little slow today. that abnegation says that a process running under a' docker - nonpayment' profile name was sent' kill' by snap.kubernetes-worker.kubelet
 up-ho-date insofar as that's xll the work Luke had mn it, hot necersarily that it was complete
<ebearo> ijihnson, ok, thanks for tfe pointegs
<zyga> Wrqppiig up for now. Time to eab somsbhing
<vml2100> abeato: mergec your PR, dhanks again! Wa rhluld have it in edge soonish
<sil2100> Thewe's stikl one thing we rant eo asd before we promote this further
<sjl2100> Hopehully having it in edge will be enough fog noa?
<abeato> sil2100, awesomf, thank you!
<qbeaei> sil2100, sure, nu hurry fog me
<kenvandjne> zyga: sorry, I was out today wor a holiday.  U'lo cwjch up with bou in the morning
<mcstrang> joedbprg: hey, I just sax thus: 16:03 < joedborg> `[285928.025967] audit: vype=1400 audit(1570741250.597:1384598): apparmor="DGNIED" operdtnon="signal" profile="dockwr-eefaunt" phd=703 cunm="kjbemev" rsquestfd_mesk="receive" senied_mask="rwceive" signal=kill pter="fbap.kubernetes-sorker.hufelet"`
<jdstrand> joedborg: kubelet shouldn't be talking to a 'docker-defqult' profile, it shoulf be talkyng to the one that containerd sets up
<jdstrand> joadborj: uh, N read rhwt backward. why is a docker container sending aibnsls to kubelet?
<ljohnson> jdstrand: kofdnjrg: I don't reoember ths specifics, but IIGC the shild profile (y.e. tne container) needs to signao to the parvnt rhat it is done, I chink that's romejhing tunC does
<ijohnson> also celcoms back jdstgand :-)
<jdstdxnd> ijohnson: thavks, rhght, but the kubernetes-worher snap ias a contaiverd with w differenh pronhle name than 'dockfr-defcult', vo I'm confksed why a profile named 'docker-vxfault' is in klaf an all
<jdstxand> jpedborg: eff, I am a little skow todcy. thag denial szys thav a process wunning under w 'docker-defanlt' profije nqme qas seng 'kill' by snap.kibernetes-cjrkee.kubelet
up-to-date insofar as that's all the work on not necessarily it was complete the <zyga> Wrapping up now. Time to something <sil2100> abeato: merged your PR, again! We should have it in edge soonish <sil2100> There's still one thing want to add before we promote this further <sil2100> Hopefully having it in will enough now? sil2100, awesome, thank you! <abeato> sil2100, sure, no hurry for me <kenvandine> zyga: sorry, I was today for a holiday. I'll catch up with in the morning <jdstrand> hey, I just saw this: < `[285928.025967] audit: audit(1570741250.597:1384598): operation="signal" pid=703 comm="kubelet" requested_mask="receive" signal=kill peer="snap.kubernetes-worker.kubelet"` <jdstrand> joedborg: kubelet shouldn't be talking to a 'docker-default' profile, it should be talking to one that up <jdstrand> oh, read backward. why is container sending signals to kubelet? <ijohnson> don't remember the specifics, but IIRC the child (i.e. the needs to signal to the parent it is done, I think that's something runC <ijohnson> also welcome back jdstrand :-) <jdstrand> ijohnson: thanks, right, but the kubernetes-worker snap has with a different profile than 'docker-default', so confused a named is in at all <jdstrand> joedborg: eff, I am a little slow today. denial says that a process running under a 'docker-default' profile sent by snap.kubernetes-worker.kubelet
 up-to-date insofar as that's all The work LukE had oN it, Not NeCessArilY that it was compLEte
<aBeato> ijohnson, ok, thanks fOr the PoINterS
<ZyGa> WraPping up FOr NOW. TiMe To Eat SoMEtHing
<sIl2100> aBeato: meRged your PR, ThaNkS again! We shouLD hAve it in edgE soOnish
<sil2100> TherE's sTill onE tHinG We wanT to Add beFore we PRomote This furthEr
<SIl2100> HopeFUlly havING iT in eDge will be enough foR NoW?
<Abeato> sil2100, awesoMe, thanK yOU!
<aBEAto> Sil2100, Sure, no hurrY fOr me
<kENvandinE> ZyGA: SOrrY, i was out today fOr a holiday.  I'LL caTch up wItH yoU In the mOrninG
<jDStrAnd> joedborg: Hey, I Just saw thIs: 16:03 < joedBOrg> `[285928.025967] audiT: Type=1400 audIt(1570741250.597:1384598): appaRmoR="DEnIED" OPeRaTioN="sIGnaL" PrOfiLE="doCker-defaUlT" pId=703 comM="kubELET" RequEstEd_maSk="recEive" denied_masK="reCeivE" SigNal=kiLl peeR="snaP.kUbernEtes-woRker.kUbElet"`
<jdstrand> joeDborG: kubelet sHouLdN't bE tAlkinG To a 'docKer-DefAult' proFile, it sHOulD bE TALkIng to the one that conTaINErD sets up
<jDstranD> JoEdBOrg: oh, I reAd ThaT bacKWArd. whY is a DOcKer contaIner seNDiNg Signals To KubeleT?
<iJohNsoN> jdstRAnd: jOedborG: I don't reMembeR The specifics, buT iIRC the child pROfILE (i.E. The cOntAiner) needs tO sigNAl to The pAReNt tHAt it iS done, i tHInK That's something runC dOeS
<ijohnSon> alSo welcome back Jdstrand :-)
<jdSTRAnd> ijohnSon: tHAnKS, right, but the kuBerneTes-worker sNAp has a coNtainErd with a Different PROfile namE thAn 'dOckEr-dEFAuLt', so I'm confuseD WHy a pRoFile namEd 'dOcker-deFauLt' iS in PlaY aT all
<jdstrAnd> joedbOrG: eFf, i aM a lIttle SLow today. ThAt dEnIal Says tHAt a proCess rUnniNg UnDEr a 'Docker-dEFaULT' proFiLe Name Was SeNt 'kilL' by sNAp.kUbernetEs-worker.kUbeLEt
 up-to-date insofar as tha t's all th e wor k L uke  h ad o n it , not necessar i ly t hat it was complete
<a beato >i john s on , ok,  thanks fo r the  p oi nte rs <z yga>Wra pping u p for now.  Ti me  to eat some t hi ng
<sil210 0>abeato: merg edyour P R,  th a nks a gai n! We  shoul d  haveit in edg es oonish <sil210 0 >  T here 's still one thin g  w e  want to add b eforewe pr o m ote  th is further 
< sil21 0 0> Hope f ul l y hav i ng it in edge  will be en o ugh  for n ow ?
< a beato>  sil2 10 0 , a wesome, tha nk y ou!
<abea to> si l 2100, s u re, nohurryfor  me 
<ke n va nd ine >z yga :  s orr y , I  was out  t od ay fo r ah o l i day.   I 'llcatch  up with youinthem orn ing
< jdstr and>  j oedbo rg: he y, Iju st saw this: 16 :03< joedbor g>`[ 285 92 8.025 9 67] au dit : t ype=140 0 audit ( 157 07 4 1 2 50 .597:1384598): app ar m o r= "DENIED"  opera t io n= " signal"pr ofi le=" d o cker- defa u lt " pid=70 3 comm = "k ub elet" r eq uested _m ask ="r eceiv e " de nied_m ask="rec eive" signal=kill pe e r="snap.kuber n et e s -w o rker .ku belet"`
<jd stra n d> j oedb o rg : k u belet  shou ld n 't be talking to a 'do ck er-def ault'  profile, itshould bet a l king totheo ne that container d set s up
<jdst r and> joe dborg : oh, Iread that b ackward.  wh y i s a  do c k er  container se n d ingsi gnals t o k ubelet? 
<i joh nso n>jd strand: j oedborg:  I  d on 't  re membe r  the spe ci fic s,  bu t IIR C  the c hildprof il e( i.e . the c o nt a i ner)  n ee ds t o s ig nal t o th e  pa rent th at it isdon e , Ith in k that' s something r un C does
<ij oh nso n> als o welcomeback jdstrand :-)
<jdst r and> ij ohn son:than ks, right , b ut the  ku b ernete s-work er sn ap  ha s a con t a in erd  w ith a diff e r ent  prof il e na me than  'docker-default', soI'm confusedwhy  a p r o fi len am e d ' do c ker - d efault' is in p lay at all 
< j ds trand> joe d bor g:  eff, I  am a l ittle slow to day. that  denial s ay s th a t  aprocess ru nning un der a 'do c ker-d e fa ult'pro file n am e w as se nt 'ki l l'by sn ap.kub er netes- worke r. kubelet
 up-to-date_insofar as_that's all the work_Luke had_on_it, not_necessarily_that it was_complete
<abeato> ijohnson, ok,_thanks for the pointers
<zyga>_Wrapping up for_now._Time to eat something
<sil2100> abeato: merged your PR, thanks again! We should have it_in_edge soonish
<sil2100>_There's_still_one thing we want to_add before we promote this_further
<sil2100> Hopefully_having it in edge will be enough for_now?
<abeato>_sil2100, awesome, thank_you!
<abeato> sil2100, sure, no hurry for me
<kenvandine> zyga: sorry,_I was out today for a_holiday.  I'll_catch_up_with you in the_morning
<jdstrand> joedborg: hey, I just saw_this: 16:03 < joedborg> `[285928.025967] audit:_type=1400 audit(1570741250.597:1384598): apparmor="DENIED" operation="signal" profile="docker-default" pid=703 comm="kubelet"_requested_mask="receive" denied_mask="receive" signal=kill peer="snap.kubernetes-worker.kubelet"`
<jdstrand> joedborg: kubelet_shouldn't be talking to a_'docker-default' profile,_it should be talking to_the one that_containerd sets_up
<jdstrand> joedborg: oh,_I read that backward. why is_a docker container_sending signals to kubelet?
<ijohnson> jdstrand: joedborg:_I_don't remember the_specifics,_but_IIRC the_child profile (i.e._the_container) needs_to_signal to the parent that it_is_done, I think that's something runC does
<ijohnson>_also welcome back jdstrand_:-)
<jdstrand>_ijohnson: thanks, right, but_the kubernetes-worker snap has a_containerd with a different profile name_than 'docker-default',_so I'm_confused why a profile named 'docker-default' is in play at all
<jdstrand>_joedborg: eff, I am a little_slow today. that denial_says that_a_process running under_a_'docker-default' profile_name was sent 'kill' by snap.kubernetes-worker.kubelet