kubernetes/kubernetes · critical

failed to probe volume plugins when starting SELinux warning

Error message

failed to probe volume plugins when starting SELinux warning controller: %w

What it means

Returned by newSELinuxWarningController when ProbePersistentVolumePlugins fails (core.go:1016-1018). Same root cause as errors 243/245/247: probeControllerVolumePlugins runs AttemptToLoadRecycler on the hostpath/NFS recycler pod-template files, and a missing/malformed file propagates wrapped here. This controller is disabled-by-default and additionally requires the SELinuxChangePolicy feature gate.

Source

Thrown at cmd/kube-controller-manager/app/core.go:1018

		constructor:         newSELinuxWarningController,
		isDisabledByDefault: true,
		requiredFeatureGates: []featuregate.Feature{
			features.SELinuxChangePolicy,
		},
	}
}

func newSELinuxWarningController(ctx context.Context, controllerContext ControllerContext, controllerName string) (Controller, error) {
	client, err := controllerContext.NewClient(controllerName)
	if err != nil {
		return nil, err
	}

	logger := klog.FromContext(ctx)
	csiDriverInformer := controllerContext.InformerFactory.Storage().V1().CSIDrivers()
	plugins, err := ProbePersistentVolumePlugins(logger, controllerContext.ComponentConfig.PersistentVolumeBinderController.VolumeConfiguration)
	if err != nil {
		return nil, fmt.Errorf("failed to probe volume plugins when starting SELinux warning controller: %w", err)
	}

	seLinuxController, err := selinuxwarning.NewController(
		ctx,
		client,
		controllerContext.InformerFactory.Core().V1().Pods(),
		controllerContext.InformerFactory.Core().V1().PersistentVolumeClaims(),
		controllerContext.InformerFactory.Core().V1().PersistentVolumes(),
		csiDriverInformer,
		plugins,
		GetDynamicPluginProber(ctx, controllerContext.ComponentConfig.PersistentVolumeBinderController.VolumeConfiguration),
	)
	if err != nil {
		return nil, fmt.Errorf("failed to start SELinux warning controller: %w", err)
	}

	return newControllerLoop(func(ctx context.Context) {
		seLinuxController.Run(ctx, 1)

View on GitHub (pinned to b882c60b40)

Solutions

1. Read %w and the preceding klog 'Could not create hostpath/NFS recycler pod from file' line
2. Validate or remove the --pv-recycler-pod-template-filepath-* flags
3. Confirm the SELinuxChangePolicy feature gate is intentionally enabled
4. If you did not intend to run the SELinux warning controller, leave it disabled (default)

Example fix

# before
--feature-gates=SELinuxChangePolicy=true
--pv-recycler-pod-template-filepath-hostpath=/etc/kcm/bad.yaml
# after
--feature-gates=SELinuxChangePolicy=true
--pv-recycler-pod-template-filepath-hostpath=""   # or a valid Pod template

// Same recycler-template validation as 243/245/247; gate it behind the SELinux feature flag.
if featureGates.Enabled(features.SELinuxChangePolicy) {
    if err := validateAllRecyclerTemplates(cfg.PersistentVolumeBinderController.VolumeConfiguration); err != nil {
        return err
    }
}

null

null

When it happens

Trigger: Operator explicitly enables the SELinux warning controller (it is isDisabledByDefault) with SELinuxChangePolicy feature gate on, while the recycler pod-template file flags point at a bad file. Also fires if any compiled-in persistent plugin fails Init.

Common situations: Turning on SELinux mount aware scheduling (SELinuxChangePolicy=true) without fixing a pre-existing recycler template misconfig; bad FlexVolumePluginDir causing a compiled-in plugin to fail.

Related errors

• failed to probe volume plugins when starting persistentvolum
• failed to probe volume plugins when starting attach/detach c
• failed to probe volume plugins when starting volume expand c
• failed to start SELinux warning controller: %w
• failed to construct persistentvolume controller: %w

AI-assisted analysis of kubernetes/kubernetes@b882c60b40 (2026-08-07). Data as JSON: /api/errors/6ffa4c261f4bca9b. Report an issue: GitHub.