Failed To Create CoreCLR

[pbalexlear]

looks like the issue #9336 has began reoccuring when deploying an aspnet:3.1* image to AKS with

readonly file system the error:

Failed to create CoreCLR, HRESULT: 0x80004005

occurs

[mangod9]

@pbalexlear is there a repro?

FYI: @mikem8361 @janvorli

[pbalexlear]

@mangod9 hello what do you mean by repro? what would you like me to provide?

[janvorli]

@pbalexlear repro means a set of steps to reproduce the issue.

[pbalexlear]

Sure i will provide a k8s manifest for this, do you have a sample image of a dotnet3.1 app i can use thats hosted on a public repo?Not sure if its the attempt to load in a certificate or just the runtime starting that is the issue.

the problem only occurs when i have the following settings turned on:
securityContext:
readOnlyRootFilesystem: true

i am using the following base image:
FROM mcr.microsoft.com/dotnet/core/aspnet:3.1.10-buster-slim AS base

but have also seen the issue on latest tag as well

1. create a secret that contains a certificate in it on k8s
2. deploy the below manifest with an application that attempts to use this cert
   for example my program.cs looks like

    public class Program
    {
        public static void Main(string[] args)
        {
            CreateHostBuilder(args).Build().Run();
        }

        public static IHostBuilder CreateHostBuilder(string[] args) =>


            Host.CreateDefaultBuilder(args).ConfigureLogging(logging =>
            {
                logging.ClearProviders();
                logging.AddConsole(consoleOptions =>
                {
                    consoleOptions.TimestampFormat = "[yyyy-MM-dd hh:mm:ss]";
                });
            })
                .ConfigureWebHostDefaults(webBuilder =>
                {
                    webBuilder.UseStartup<Startup>().UseKestrel(config =>
                    {

                        config.Listen(IPAddress.Any, int.Parse(Environment.GetEnvironmentVariable("HTTPS_PORT")), listenOptions =>
                         {
                             listenOptions.UseHttps(Environment.GetEnvironmentVariable("HTTPS_CERT"), Environment.GetEnvironmentVariable("HTTPS_CERT_PASS"));

                         });


                    });
                });
    }

Manifest:

apiVersion: apps/v1
kind: Deployment
metadata:
  name: test-app
  labels:
    app: test-app
spec:
  replicas: {{ .Values.replicaCount }}
  selector:
    matchLabels:
      app: test-app
  template:
    metadata:
      labels:
        app: test-app
    spec:
        containers:
        - name: testcontainer
          image: "{dotnetcore 3.1 sample image here}"
          ports:
          - containerPort: 443
          volumeMounts:
            - name: webhook-certs
              mountPath: /etc/certs
              readOnly: true
          securityContext:
            readOnlyRootFilesystem: true
        volumes:
        - name: webhook-certs
          secret:
            secretName: {{ .Values.certificateSecretName }}

[ajeet2808]

I am running into same issue, is it fixed or is there any workaround? Any help will greatly appreciated.

[mangod9]

We havent investigated this yet. Assume you are also hitting it with readOnlyRootFilesystem: true ?

[ajeet2808]

Thank you for reply @mangod9 .
Yes, but after adding ENV COMPlus_EnableDiagnostics=0 to my Dockerfile it's working fine with readOnlyRootFilesystem: true.
I feel, this bug can be closed.

[mangod9]

hmm, interesting. Not sure why that fixes it -- how did you figure it out?