[BUG] atunnel listener tcp 443 bind permission denied

Abierto
  • ¿Algo no está bien?
#3,355 0 comentarios 0 reacciones 0 asignados Ver en GitHub

Los mantenedores suelen responder en 1 día

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
4/5
Tiempo estimado
3-5 días
Aptitud para principiantes
50/100
Tipo de issue
Error
Claridad
Bastante claro
Estado de actividad
Activo
Stack tecnológico
go, kubernetes
Área
infrastructure

Línea de trabajo

Start by locating the kagent-default pod configuration and Helm chart values that set its security context; the issue says values.yaml currently does not allow overriding it. Then trace where the atunnel listener binds to port 443 and check the relevant deployment or listener tests. Done when the pod can start with the required bind permission and the issue's reproduction no longer shows the permission error.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

📋 Prerequisites
  • I have searched the existing issues to avoid creating a duplicate
  • By submitting this issue, you agree to follow our Code of Conduct
  • I am using the latest version of the software
  • I have tried to clear cache/cookies or used incognito mode (if ui-related)
  • I can consistently reproduce this issue
🎯 Affected Service(s)

Not Sure

🚦 Impact/Severity

Blocker

🐛 Bug Description

After successfully installing kagent as follows:
$ kagent install -n kagent
kagent installed successfully

A port 443 binding permission error is preventing the kagent-default pod from running, as follows.
$ kubectl logs kagent-default-67d8cc74bd-5qltw -n kagent | tail -1
{"time":"2026-10-26T08:01:50.067860845Z","level":"ERROR","msg":"Error while executing","err":"while opening atunnel listener: listen tcp :443: bind: permission denied"}

I am thinking to add NET_BIND_SERVICE capability but values.yaml doesn't allow overriding securityContext.

All other pods are running ok.

$ kubectl get all -n kagent
NAME READY STATUS RESTARTS AGE
pod/kagent-controller-69bcf5ccb4-mj4tr 1/1 Running 0 15m
pod/kagent-default-67d8cc74bd-5qltw 0/1 CrashLoopBackOff 7 (3m47s ago) 15m
pod/kagent-grafana-mcp-59df65d5df-pj6zt 1/1 Running 0 15m
pod/kagent-postgresql-566dbb9bc5-cdkrd 2/2 Running 0 17m
pod/kagent-tools-5b7c6fbcc5-sfkvh 1/1 Running 0 15m
pod/kagent-ui-7b9878557-w8n2n 1/1 Running 0 15m

$ kubectl get pods -n ate-system
NAME READY STATUS RESTARTS AGE
ate-api-server-b9b478cf7-f7nzc 2/2 Running 0 19m
ate-api-server-b9b478cf7-vlg2v 2/2 Running 0 19m
ate-controller-5c7898fb8c-prcxl 1/1 Running 0 19m
ate-idp-server-5b6d8ccb88-psmdz 1/1 Running 0 19m
ate-idp-server-5b6d8ccb88-rm5jg 1/1 Running 0 19m
atelet-5lcm4 2/2 Running 0 19m
atelet-q2jlc 2/2 Running 0 19m
atenet-egress-8db75d49c-45kp8 1/1 Running 0 19m
atenet-router-54575b59c5-c6w5p 1/1 Running 0 19m
k8s-credential-provider-d7db74489-pv7js 1/1 Running 0 19m
rustfs-7dcf5f9574-fxj57 1/1 Running 0 19m
rustfs-bucket-init-72m8p 0/1 Completed 0 19m

🔄 Steps To Reproduce

  1. Run cli to install kagent. Tried both with/without values override, no issues flagged:
    $ kagent --config kagent-config.yaml install --namespace kagent
    kagent installed successfully

  2. All pods come up as expected, except for kagent-default-. See output in description.

  3. Check log in kagent-default- to find the port 443 bind permission error.

🤔 Expected Behavior

Pod is already running as user 0 and should have permissions to bind/listen to port 443.

📱 Actual Behavior

Error:
{"time":"2026-10-26T08:01:50.067860845Z","level":"ERROR","msg":"Error while executing","err":"while opening atunnel listener: listen tcp :443: bind: permission denied"}

💻 Environment

OS Version: Ubuntu 22.04.5 LTS
K8s Version: 1.37.1
kubectl Version: 1.37.1

🔧 CLI Bug Report

No response

🔍 Additional Context

No response

📋 Logs
📷 Screenshots

No response

🙋 Are you willing to contribute?
  • I am willing to submit a PR to fix this issue
Lenguaje dominante
Go
Estrellas
4.2k
Forks
890
Merge medio
1 d 10 h
PR fusionados (30 d)
171

Preparar el entorno

Abrir en Codespaces

Inicia el contenedor de desarrollo del proyecto en tu navegador, con tu propia cuenta de GitHub.

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de kagent-dev/kagent

Todos los issues de kagent-dev/kagent

Issues similares

Más issues de Go

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.