{"record":{"id":"6ffa4c261f4bca9b","repo":"kubernetes/kubernetes","slug":"failed-to-probe-volume-plugins-when-starting-selin","errorCode":null,"errorMessage":"failed to probe volume plugins when starting SELinux warning controller: %w","messagePattern":"failed to probe volume plugins when starting SELinux warning controller: %w","errorType":"console","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"cmd/kube-controller-manager/app/core.go","lineNumber":1018,"sourceCode":"\t\tconstructor:         newSELinuxWarningController,\n\t\tisDisabledByDefault: true,\n\t\trequiredFeatureGates: []featuregate.Feature{\n\t\t\tfeatures.SELinuxChangePolicy,\n\t\t},\n\t}\n}\n\nfunc newSELinuxWarningController(ctx context.Context, controllerContext ControllerContext, controllerName string) (Controller, error) {\n\tclient, err := controllerContext.NewClient(controllerName)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\tlogger := klog.FromContext(ctx)\n\tcsiDriverInformer := controllerContext.InformerFactory.Storage().V1().CSIDrivers()\n\tplugins, err := ProbePersistentVolumePlugins(logger, controllerContext.ComponentConfig.PersistentVolumeBinderController.VolumeConfiguration)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to probe volume plugins when starting SELinux warning controller: %w\", err)\n\t}\n\n\tseLinuxController, err := selinuxwarning.NewController(\n\t\tctx,\n\t\tclient,\n\t\tcontrollerContext.InformerFactory.Core().V1().Pods(),\n\t\tcontrollerContext.InformerFactory.Core().V1().PersistentVolumeClaims(),\n\t\tcontrollerContext.InformerFactory.Core().V1().PersistentVolumes(),\n\t\tcsiDriverInformer,\n\t\tplugins,\n\t\tGetDynamicPluginProber(ctx, controllerContext.ComponentConfig.PersistentVolumeBinderController.VolumeConfiguration),\n\t)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to start SELinux warning controller: %w\", err)\n\t}\n\n\treturn newControllerLoop(func(ctx context.Context) {\n\t\tseLinuxController.Run(ctx, 1)","sourceCodeStart":1000,"sourceCodeEnd":1036,"githubUrl":"https://github.com/kubernetes/kubernetes/blob/b882c60b4023bdf09264c2d5d30a2cadebc240fb/cmd/kube-controller-manager/app/core.go#L1000-L1036","documentation":"Returned by newSELinuxWarningController when ProbePersistentVolumePlugins fails (core.go:1016-1018). Same root cause as errors 243/245/247: probeControllerVolumePlugins runs AttemptToLoadRecycler on the hostpath/NFS recycler pod-template files, and a missing/malformed file propagates wrapped here. This controller is disabled-by-default and additionally requires the SELinuxChangePolicy feature gate.","triggerScenarios":"Operator explicitly enables the SELinux warning controller (it is isDisabledByDefault) with SELinuxChangePolicy feature gate on, while the recycler pod-template file flags point at a bad file. Also fires if any compiled-in persistent plugin fails Init.","commonSituations":"Turning on SELinux mount aware scheduling (SELinuxChangePolicy=true) without fixing a pre-existing recycler template misconfig; bad FlexVolumePluginDir causing a compiled-in plugin to fail.","solutions":["Read %w and the preceding klog 'Could not create hostpath/NFS recycler pod from file' line","Validate or remove the --pv-recycler-pod-template-filepath-* flags","Confirm the SELinuxChangePolicy feature gate is intentionally enabled","If you did not intend to run the SELinux warning controller, leave it disabled (default)"],"exampleFix":"# before\n--feature-gates=SELinuxChangePolicy=true\n--pv-recycler-pod-template-filepath-hostpath=/etc/kcm/bad.yaml\n# after\n--feature-gates=SELinuxChangePolicy=true\n--pv-recycler-pod-template-filepath-hostpath=\"\"   # or a valid Pod template","handlingStrategy":"validation","validationCode":"// Same recycler-template validation as 243/245/247; gate it behind the SELinux feature flag.\nif featureGates.Enabled(features.SELinuxChangePolicy) {\n    if err := validateAllRecyclerTemplates(cfg.PersistentVolumeBinderController.VolumeConfiguration); err != nil {\n        return err\n    }\n}","typeGuard":"null","tryCatchPattern":"null","preventionTips":["Leave the SELinux warning controller disabled (default) unless you actively run SELinuxChangePolicy","Fix recycler template files once; the same file is shared by four volume-plugin probes"],"tags":["kubernetes","kube-controller-manager","storage","volume-plugins","selinux","feature-gate","startup","configuration"],"analyzedSha":"b882c60b4023bdf09264c2d5d30a2cadebc240fb","analyzedAt":"2026-08-07T04:07:48.144Z","schemaVersion":2},"datasetVersion":"2026-08-07T07:17:06.508Z"}