[BUG] atunnel listener tcp 443 bind permission denied

未关闭
  • 哪里不对？
#3,355 0 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看

维护者通常 1 天内回复

还没有人认领这个 Issue。

评估

难度
4/5
预计耗时
3-5 天
新手友好度
50/100
Issue 类型
缺陷
描述清晰度
基本清楚
活跃度
活跃
技术栈
go, kubernetes
领域
infrastructure

调研方向

Start by locating the kagent-default pod configuration and Helm chart values that set its security context; the issue says values.yaml currently does not allow overriding it. Then trace where the atunnel listener binds to port 443 and check the relevant deployment or listener tests. Done when the pod can start with the required bind permission and the issue's reproduction no longer shows the permission error.

由索引模型根据 Issue 内容生成。

描述

📋 Prerequisites
  • I have searched the existing issues to avoid creating a duplicate
  • By submitting this issue, you agree to follow our Code of Conduct
  • I am using the latest version of the software
  • I have tried to clear cache/cookies or used incognito mode (if ui-related)
  • I can consistently reproduce this issue
🎯 Affected Service(s)

Not Sure

🚦 Impact/Severity

Blocker

🐛 Bug Description

After successfully installing kagent as follows:
$ kagent install -n kagent
kagent installed successfully

A port 443 binding permission error is preventing the kagent-default pod from running, as follows.
$ kubectl logs kagent-default-67d8cc74bd-5qltw -n kagent | tail -1
{"time":"2026-10-26T08:01:50.067860845Z","level":"ERROR","msg":"Error while executing","err":"while opening atunnel listener: listen tcp :443: bind: permission denied"}

I am thinking to add NET_BIND_SERVICE capability but values.yaml doesn't allow overriding securityContext.

All other pods are running ok.

$ kubectl get all -n kagent
NAME READY STATUS RESTARTS AGE
pod/kagent-controller-69bcf5ccb4-mj4tr 1/1 Running 0 15m
pod/kagent-default-67d8cc74bd-5qltw 0/1 CrashLoopBackOff 7 (3m47s ago) 15m
pod/kagent-grafana-mcp-59df65d5df-pj6zt 1/1 Running 0 15m
pod/kagent-postgresql-566dbb9bc5-cdkrd 2/2 Running 0 17m
pod/kagent-tools-5b7c6fbcc5-sfkvh 1/1 Running 0 15m
pod/kagent-ui-7b9878557-w8n2n 1/1 Running 0 15m

$ kubectl get pods -n ate-system
NAME READY STATUS RESTARTS AGE
ate-api-server-b9b478cf7-f7nzc 2/2 Running 0 19m
ate-api-server-b9b478cf7-vlg2v 2/2 Running 0 19m
ate-controller-5c7898fb8c-prcxl 1/1 Running 0 19m
ate-idp-server-5b6d8ccb88-psmdz 1/1 Running 0 19m
ate-idp-server-5b6d8ccb88-rm5jg 1/1 Running 0 19m
atelet-5lcm4 2/2 Running 0 19m
atelet-q2jlc 2/2 Running 0 19m
atenet-egress-8db75d49c-45kp8 1/1 Running 0 19m
atenet-router-54575b59c5-c6w5p 1/1 Running 0 19m
k8s-credential-provider-d7db74489-pv7js 1/1 Running 0 19m
rustfs-7dcf5f9574-fxj57 1/1 Running 0 19m
rustfs-bucket-init-72m8p 0/1 Completed 0 19m

🔄 Steps To Reproduce

  1. Run cli to install kagent. Tried both with/without values override, no issues flagged:
    $ kagent --config kagent-config.yaml install --namespace kagent
    kagent installed successfully

  2. All pods come up as expected, except for kagent-default-. See output in description.

  3. Check log in kagent-default- to find the port 443 bind permission error.

🤔 Expected Behavior

Pod is already running as user 0 and should have permissions to bind/listen to port 443.

📱 Actual Behavior

Error:
{"time":"2026-10-26T08:01:50.067860845Z","level":"ERROR","msg":"Error while executing","err":"while opening atunnel listener: listen tcp :443: bind: permission denied"}

💻 Environment

OS Version: Ubuntu 22.04.5 LTS
K8s Version: 1.37.1
kubectl Version: 1.37.1

🔧 CLI Bug Report

No response

🔍 Additional Context

No response

📋 Logs
📷 Screenshots

No response

🙋 Are you willing to contribute?
  • I am willing to submit a PR to fix this issue
主要语言
Go
星标
4.2k
派生
890
平均合并
1 天 10 小时
30 天内合并 PR
171

环境准备

在 Codespaces 中打开

在浏览器里用你自己的 GitHub 账号启动这个项目的开发容器。

  • 没有 Dockerfile 或 Docker Compose 文件
  • 没有 Pull Request 模板
  • 阅读贡献指南

从这里开始

  1. 先读完整个 Issue，再读项目的贡献指南。
  2. 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
  3. Fork 仓库，在一个分支上完成修改。
  4. 提交 Pull Request，并在描述里引用这个 Issue 编号。

kagent-dev/kagent 的其他 Issue

查看 kagent-dev/kagent 的全部 Issue

相似的 Issue

更多 Go Issue

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。