Skip to content

Conversation

@nocturo
Copy link
Contributor

@nocturo nocturo commented Sep 22, 2025

The check in the initContainer for the deployed daemonSet is only looking for exact text from the mount command, which leads to false positives and bpfman-operator mounting an overlay bpf filesystem causing problems with other applications relying on it. (I had issues with Cilium but it will break anything that is using it)

Below is an excerpt of what I mean, first we check the initial state using current method:

root@test:/# /bin/mount | /bin/grep 'bpffs on /sys/fs/bpf'
root@test:/# echo $?
1
root@test:/# ls /sys/fs/bpf/
cilium  tc
root@test:/# mount|grep bpf
bpf on /sys/fs/bpf type bpf (rw,nosuid,nodev,noexec,relatime,mode=700)
root@test:/#

then after bpfman-operator has been deployed:

root@test:/# mount|grep bpf
bpf on /sys/fs/bpf type bpf (rw,nosuid,nodev,noexec,relatime,mode=700)
bpffs on /sys/fs/bpf type bpf (rw,relatime)

This PR addresses the problem by using findmnt for finding the right mount type for /sys/fs/bpf mountpoint. After changing my daemonSet to this, I no longer have issues running bpfman-operator and Cilium.

Signed-off-by: Nemanja Zeljkovic <nocturo@gmail.com>
Copy link
Contributor

@frobware frobware left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM, but would prefer long form options to findmnt.

- |
#!/bin/sh
if ! /bin/mount | /bin/grep -q 'bpffs on /sys/fs/bpf'; then
if ! /usr/bin/findmnt -n -t bpf /sys/fs/bpf >/dev/null 2>&1; then
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
if ! /usr/bin/findmnt -n -t bpf /sys/fs/bpf >/dev/null 2>&1; then
if ! /usr/bin/findmnt --noheadings --types bpf /sys/fs/bpf >/dev/null 2>&1; then

I'd prefer long-form flags instead of short flags for self-documentation. I had to go lookup -n to see what that did.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Not a problem, pushed new commit with long-form flags.

@frobware frobware self-assigned this Sep 23, 2025
Signed-off-by: Nemanja Zeljkovic <nocturo@gmail.com>
@mergify mergify bot merged commit cc71d8f into bpfman:main Sep 26, 2025
11 checks passed
@codecov
Copy link

codecov bot commented Sep 26, 2025

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 0.00%. Comparing base (f418fd7) to head (22f0229).
⚠️ Report is 26 commits behind head on main.

Additional details and impacted files
@@     Coverage Diff     @@
##   main   #477   +/-   ##
===========================
===========================

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@frobware
Copy link
Contributor

frobware commented Jan 6, 2026

@nocturo - Just a quick heads-up and courtesy call: I’ve raised #490. I wanted to mention this since you previously raised and fixed the bpffs mount issue. The goal of #490 is to create a Go implementation that performs the equivalent functions of findmnt/mount. This means we can eliminate the need for an init container that requires a Fedora image, as the functionality will now be integrated into the agent. From your perspective, nothing should change...

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants