Failed to get nginx version: exit status 127

[cwrx777]

Hi,

I installed nginx-ingress using helm, chart: 1.2.2 nginx-ingress version: 3.5.2

custom values:

controller:
  kind: deployment
  hostNetwork: false
  ingressClass: 
    name: nginx-master
  enableSnippets: true
  nodeSelector:
    node-role.kubernetes.io/master: "true"
  service:
    type: NodePort
    spec:
      externalTrafficPolicy: Local

prometheus:
  create: false

error message:

I0614 04:13:47.751514       1 flags.go:316] Starting with flags: ["-nginx-plus=false" "-nginx-reload-timeout=60000" "-enable-app-protect=false" "-enable-app-protect-dos=false" "-nginx-configmaps=ni-master/ni-master-nginx-ingress" "-
I0614 04:13:47.754849       1 main.go:273] Kubernetes version: 1.29.4                                                                                                                                                                    
F0614 04:13:47.759105       1 manager.go:357] Failed to get nginx version: exit status 127 

what could be causing the error?

source code

I notice the following error:

type=PROCTITLE msg=audit(1718351745.502:10267950): proctitle=2F7573722F7362696E2F6E67696E78002D76
type=SYSCALL msg=audit(1718351745.502:10267950): arch=c000003e syscall=10 success=no exit=-13 a0=7f722bd05000 a1=4000 a2=1 a3=7f722bb5c208 items=0 ppid=3960597 pid=3960617 auid=4294967295 uid=101 gid=101 euid=101 suid=101 fsuid=101 egid=101 sgid=101 fsgid=101 tty=(none) ses=4294967295 comm="nginx" exe="/usr/sbin/nginx" subj=system_u:system_r:container_t:s0:c202,c292 key=(null)
type=AVC msg=audit(1718351745.502:10267950): avc:  denied  { read } for  pid=3960617 comm="nginx" path="/usr/lib/x86_64-linux-gnu/libc.so.6" dev="dm-10" ino=548935078 scontext=system_u:system_r:container_t:s0:c202,c292 tcontext=system_u:object_r:unlabeled_t:s0 tclass=file permissive=0

[jjngx]

Hi @cwrx777 , thank you for reporting. We will investigate this issue. Could you let us know what steps you do to build NIC and what environment you run?
Are you applying any specific security context?

[cwrx777]

Hi,

I managed to work around it by creating a selinux policy but I'm not sure why the target file is unlabeled.

[jjngx]

@cwrx777 could you try to deploy NIC to the environment without SELinux enabled?

Possible issue: link