CI: add Rawhide (Podman 6)

.github/workflows/main.yaml

@@ -28,6 +28,8 @@ jobs:
             container_engine: podman
           - lima_template: template://fedora
             container_engine: podman
+          - lima_template: template://experimental/fedora-rawhide
+            container_engine: podman
     uses: ./.github/workflows/reusable-multi-node.yaml
     with:
       lima_template: ${{ matrix.lima_template }}

README.md

@@ -89,24 +89,30 @@ EOF
 sudo sysctl --system
 ```
 
-- slirp4netns, not Pasta:
+- [Podman only] Custom configuration (since Podman v5):
 ```
-# Podman v5 (or later) users have to change the network mode from pasta to slirp4netns.
-# This step is not needed for Docker, nerdctl, and Podman v4.
-
+# Podman v5
 mkdir -p "$HOME/.config/containers/containers.conf.d"
 cat <<EOF >"$HOME/.config/containers/containers.conf.d/slirp4netns.conf"
 [network]
+# change the network mode from pasta to slirp4netns
 default_rootless_network_cmd="slirp4netns"
 EOF
 ```
-<!--
-pasta does not seem to work well
-
-> 2024-12-02T17:15:40.070018488Z stderr F E1202 17:15:40.068621       1 main.go:228] Failed to create SubnetManager:
-> error retrieving pod spec for 'kube-flannel/kube-flannel-ds-ms2d9': Get "https://10.96.0.1:443/api/v1/namespaces/kube-flannel/pods/kube-flannel-ds-ms2d9":
-> dial tcp 10.96.0.1:443: i/o timeout
--->
+```
+# Podman v6
+mkdir -p "$HOME/.config/containers/containers.conf.d"
+cat <<EOF >"$HOME/.config/containers/containers.conf.d/pasta.conf"
+[network]
+default_rootless_network_cmd="pasta"
+# change the port forwarder from rootlessport to pasta
+rootless_port_forwarder="pasta"
+# use a dedicated address (same as the slirp4netns default) instead of
+# copying the host's IP address, so that connections to the host's IP
+# address from inside the namespace are routed out to the host
+pasta_options=["-a", "10.0.2.100", "-n", "24", "-g", "10.0.2.2"]
+EOF
+```
 
 Use scripts in [`./init-host`](./init-host) for automating these steps.
 

init-host/init-host.root.sh

@@ -52,6 +52,23 @@ net.ipv4.conf.default.rp_filter = 2
 EOF
 sysctl --system
 
+# Fedora 46 (Rawhide, as of August 2026) confines SSH sessions in the
+# `sshd_session_t` SELinux domain, which is not allowed to initiate TCP
+# connections to most ports. This breaks `ssh -L PORT:127.0.0.1:PORT`
+# (used by Lima, CI, etc. for accessing kube-apiserver from outside the host):
+# > avc:  denied  { name_connect } for  comm="sshd-session"
+# > scontext=system_u:system_r:sshd_session_t:s0-s0:c0.c1023 tclass=tcp_socket
+# The `optional` block below is a NOP on distros that do not define `sshd_session_t`.
+if command -v selinuxenabled >/dev/null 2>&1 && selinuxenabled && command -v semodule >/dev/null 2>&1; then
+	cat <<EOF >/tmp/u7s-sshd-session.cil
+(optional u7s_sshd_session
+    (allow sshd_session_t port_type (tcp_socket (name_connect)))
+)
+EOF
+	semodule -i /tmp/u7s-sshd-session.cil
+	rm -f /tmp/u7s-sshd-session.cil
+fi
+
 if command -v dnf >/dev/null 2>&1; then
 	dnf install -y --best git shadow-utils make jq
 	# podman-compose requires EPEL

init-host/init-host.rootless.sh

@@ -18,15 +18,33 @@ case "${CONTAINER_ENGINE}" in
 	containerd-rootless-setuptool.sh install-bypass4netnsd
 	;;
 "podman")
-	# pasta does not seem to work well
-	# > 2024-12-02T17:15:40.070018488Z stderr F E1202 17:15:40.068621       1 main.go:228] Failed to create SubnetManager:
-	# > error retrieving pod spec for 'kube-flannel/kube-flannel-ds-ms2d9': Get "https://10.96.0.1:443/api/v1/namespaces/kube-flannel/pods/kube-flannel-ds-ms2d9":
-	# > dial tcp 10.96.0.1:443: i/o timeout
 	mkdir -p "${XDG_CONFIG_HOME}/containers/containers.conf.d"
-	cat <<EOF >"${XDG_CONFIG_HOME}/containers/containers.conf.d/slirp4netns.conf"
+	PODMAN_VERSION_MAJOR="$(podman version --format '{{.Client.Version}}' | cut -d'.' -f1)"
+	if [ "$PODMAN_VERSION_MAJOR" -ge 6 ]; then
+		# By default, pasta copies the host's IP address into the rootless network
+		# namespace, so the host's IP address does not hairpin back to the host.
+		# This breaks accessing HOST_IP:6443 (kube-apiserver published on the host)
+		# from inside the node, e.g., via the ClusterIP of the "kubernetes" service:
+		# > Failed to create SubnetManager: error retrieving pod spec for 'kube-flannel/kube-flannel-ds-...':
+		# > Get "https://10.96.0.1:443/...": dial tcp 10.96.0.1:443: i/o timeout
+		# Specify a dedicated address (same as the slirp4netns default) with
+		# `pasta_options` so that connections to HOST_IP are routed out to the host.
+		cat <<EOF >"${XDG_CONFIG_HOME}/containers/containers.conf.d/pasta.conf"
+[network]
+default_rootless_network_cmd="pasta"
+rootless_port_forwarder="pasta"
+pasta_options=["-a", "10.0.2.100", "-n", "24", "-g", "10.0.2.2"]
+EOF
+	else
+		# pasta does not seem to work well
+		# > 2024-12-02T17:15:40.070018488Z stderr F E1202 17:15:40.068621       1 main.go:228] Failed to create SubnetManager:
+		# > error retrieving pod spec for 'kube-flannel/kube-flannel-ds-ms2d9': Get "https://10.96.0.1:443/api/v1/namespaces/kube-flannel/pods/kube-flannel-ds-ms2d9":
+		# > dial tcp 10.96.0.1:443: i/o timeout
+		cat <<EOF >"${XDG_CONFIG_HOME}/containers/containers.conf.d/slirp4netns.conf"
 [network]
 default_rootless_network_cmd="slirp4netns"
 EOF
+	fi
 	systemctl --user enable --now podman-restart
 	;;
 *)