Unable to create PVC with hostpath-storage under ubuntu plucky

[nvinuesa]

Summary

After upgrading my host to plucky, I noticed that I couldn't bootstrap any Juju controllers in microk8s. I purged and reinstalled the snap (1.32-strict/stable, since strict confinement is suggested for Juju) but still couldn't bootstrap. The issue is when creating the persisted volume claims with hotstpath-storage.

Going further, trying to verify the behavior of hostpath-storage fails https://microk8s.io/docs/addon-hostpath-storage#verify.

I do see some permission issues on the coredns pod:

k logs coredns-79b94494c7-j2ln5 -nkube-system
listen tcp :8080: socket: permission denied

And apparmor denials in dmesg:

[ 2544.616352] audit: type=1400 audit(1747829697.711:1934): apparmor="DENIED" operation="create" class="net" profile="cri-containerd.apparmor.d" pid=90766 comm="coredns" family="inet6" sock_type="stream" protocol=0 requested="create" denied="create"
[ 2544.616358] audit: type=1400 audit(1747829697.711:1935): apparmor="DENIED" operation="create" class="net" profile="cri-containerd.apparmor.d" pid=90766 comm="coredns" family="inet6" sock_type="stream" protocol=0 requested="create" denied="create"
[ 2546.036927] audit: type=1400 audit(1747829699.132:1936): apparmor="DENIED" operation="create" class="net" profile="cri-containerd.apparmor.d" pid=12612 comm="hostpath-provis" family="inet" sock_type="stream" protocol=0 requested="create" denied="create"
[ 2549.026025] audit: type=1400 audit(1747829702.121:1937): apparmor="DENIED" operation="create" class="net" profile="cri-containerd.apparmor.d" pid=12612 comm="hostpath-provis" family="inet" sock_type="stream" protocol=0 requested="create" denied="create"

What Should Happen Instead?

These steps should pass https://microk8s.io/docs/addon-hostpath-storage#verify.

Reproduction Steps

Just these steps https://microk8s.io/docs/addon-hostpath-storage#verify.

Introspection Report

Can you suggest a fix?

Are you interested in contributing with a fix?

[DanielArndt]

I have this same issue after updating to plucky. Right off the bat (without even enabling hostpath storage) coredns and calico kube controller fail to start.

[  910.604604] audit: type=1400 audit(1747839261.946:3480): apparmor="DENIED" operation="create" class="net" profile="cri-containerd.apparmor.d" pid=64225 comm="coredns" family="inet6" sock_type="stream" protocol=0 requested="create" denied="create"
[  912.334633] audit: type=1400 audit(1747839263.676:3481): apparmor="DENIED" operation="create" class="net" profile="cri-containerd.apparmor.d" pid=63422 comm="kube-controller" family="inet" sock_type="stream" protocol=0 requested="create" denied="create"
[  917.339180] audit: type=1400 audit(1747839268.679:3482): apparmor="DENIED" operation="create" class="net" profile="cri-containerd.apparmor.d" pid=63422 comm="kube-controller" family="inet" sock_type="stream" protocol=0 requested="create" denied="create"
[  922.343721] audit: type=1400 audit(1747839273.685:3483): apparmor="DENIED" operation="create" class="net" profile="cri-containerd.apparmor.d" pid=63422 comm="kube-controller" family="inet" sock_type="stream" protocol=0 requested="create" denied="create"
[  927.348313] audit: type=1400 audit(1747839278.689:3484): apparmor="DENIED" operation="create" class="net" profile="cri-containerd.apparmor.d" pid=63422 comm="kube-controller" family="inet" sock_type="stream" protocol=0 requested="create" denied="create"
[  932.350677] audit: type=1400 audit(1747839283.690:3485): apparmor="DENIED" operation="create" class="net" profile="cri-containerd.apparmor.d" pid=63422 comm="kube-controller" family="inet" sock_type="stream" protocol=0 requested="create" denied="create"

[javierdelapuente]

We are also seeing the same issue in noble with the HWE kernel installed when using the microk8s strict snap.

[Gu1nness]

Same as @javierdelapuente, I'm having the same issue on noble with strict snap.

[sinclert-canonical]

Same as @javierdelapuente and @Gu1nness, I'm having the same issue on Ubuntu Noble with MicroK8s 1.32.4 snap (coming from the 1.32-strict/stable channel).

[Zvirovyi]

Same issue on Ubuntu 24.04.01 LTS Desktop.