Skip to content

MCO-396: daemon: FCOS workaround, plus SELinux workaround #3358

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
openshift-merge-robot merged 2 commits into from
Oct 9, 2022
Merged

MCO-396: daemon: FCOS workaround, plus SELinux workaround #3358

openshift-merge-robot merged 2 commits into from
Oct 9, 2022

Conversation

@cgwalters
Copy link
Member

@cgwalters cgwalters commented Oct 1, 2022 •
edited
Loading

daemon: Temporarily copy auth file with more open perms on FCOS

This works around an rpm-ostree regression
https://issues.redhat.com/browse/OKD-63

daemon: Temporarily setenforce 0 for inplace update from container

In practice, we should ship a SELinux policy tweak that allows a transition
from spc_t -> install_t but for now I want to see if this works.

@cgwalters cgwalters mentioned this pull request Oct 1, 2022
Merged
@openshift-ci openshift-ci bot requested review from cheesesashimi and jkyros October 1, 2022 11:58
@openshift-ci openshift-ci bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Oct 1, 2022
@vrutkovs
Copy link
Contributor

vrutkovs commented Oct 1, 2022

/test okd-e2e-aws

@vrutkovs
Copy link
Contributor

vrutkovs commented Oct 1, 2022

OKD install now passes in okd-e2e-aws, thanks!

yuqi-zhang
yuqi-zhang approved these changes Oct 3, 2022
View reviewed changes
Copy link
Contributor

@yuqi-zhang yuqi-zhang left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

/lgtm

@openshift-ci openshift-ci bot added the lgtm Indicates that a PR is ready to be merged. label Oct 3, 2022
@openshift-ci-robot
Copy link
Contributor

openshift-ci-robot commented Oct 3, 2022

/retest-required

Remaining retests: 0 against base HEAD 71469ce and 2 for PR HEAD 6ccdd57 in total

@openshift-ci-robot
Copy link
Contributor

openshift-ci-robot commented Oct 3, 2022

/retest-required

Remaining retests: 0 against base HEAD 87bde27 and 1 for PR HEAD 6ccdd57 in total

@yuqi-zhang
Copy link
Contributor

yuqi-zhang commented Oct 3, 2022

CI is currently blocked on https://issues.redhat.com/browse/TRT-589

@vrutkovs
Copy link
Contributor

vrutkovs commented Oct 4, 2022

/retest

@cgwalters
Copy link
Member Author

cgwalters commented Oct 4, 2022

OK from the controlplane journal on OKD:

Oct 04 11:53:29 ip-10-0-159-199 audit[3599]: AVC avc:  denied  { mac_admin } for  pid=3599 comm="pool-rpm-ostree" capability=33  scontext=system_u:system_r:spc_t:s0 tcontext=system_u:system_r:spc_t:s0 tclass=capability2 permissive=0

Argh. This is likely to bite us in RHEL too. We're going to need to override the container security context. This issue is one of the reasons why running ostree in a container is a bit tricky.

@cgwalters
Copy link
Member Author

cgwalters commented Oct 4, 2022

https://issues.redhat.com/browse/MCO-396

@openshift-ci-robot
Copy link
Contributor

openshift-ci-robot commented Oct 4, 2022

/retest-required

Remaining retests: 0 against base HEAD 4c66f8f and 0 for PR HEAD 6ccdd57 in total

@openshift-ci openshift-ci bot removed the lgtm Indicates that a PR is ready to be merged. label Oct 4, 2022
@cgwalters
Copy link
Member Author

cgwalters commented Oct 4, 2022

OK I rolled a workaround for https://issues.redhat.com/browse/MCO-396 into this, because the OKD path is hitting this today.

@cgwalters cgwalters changed the title daemon: Temporarily copy auth file with more open perms on FCOS daemon: FCOS workaround, plus SELinux workaround Oct 4, 2022
@cgwalters
Copy link
Member Author

cgwalters commented Oct 4, 2022

/test ci/prow/okd-e2e-aws

@openshift-ci
Copy link
Contributor

openshift-ci bot commented Oct 4, 2022

@cgwalters: The specified target(s) for /test were not found.
The following commands are available to trigger required jobs:

  • /test 4.12-upgrade-from-stable-4.11-images
  • /test cluster-bootimages
  • /test e2e-agnostic-upgrade
  • /test e2e-aws
  • /test e2e-gcp-op
  • /test images
  • /test unit
  • /test verify

The following commands are available to trigger optional jobs:

  • /test 4.12-upgrade-from-stable-4.11-e2e-aws-ovn-upgrade
  • /test bootstrap-unit
  • /test e2e-aws-disruptive
  • /test e2e-aws-ovn-workers-rhel8
  • /test e2e-aws-proxy
  • /test e2e-aws-serial
  • /test e2e-aws-single-node
  • /test e2e-aws-upgrade
  • /test e2e-aws-upgrade-single-node
  • /test e2e-aws-workers-rhel8
  • /test e2e-azure
  • /test e2e-azure-ovn-upgrade
  • /test e2e-azure-upgrade
  • /test e2e-gcp-op-single-node
  • /test e2e-gcp-single-node
  • /test e2e-gcp-upgrade
  • /test e2e-metal-assisted
  • /test e2e-metal-ipi
  • /test e2e-metal-ipi-ovn-dualstack
  • /test e2e-metal-ipi-ovn-ipv6
  • /test e2e-openstack
  • /test e2e-openstack-parallel
  • /test e2e-ovirt
  • /test e2e-ovirt-upgrade
  • /test e2e-ovn-step-registry
  • /test e2e-vsphere
  • /test e2e-vsphere-upgrade
  • /test e2e-vsphere-upi
  • /test okd-e2e-aws
  • /test okd-e2e-gcp-op
  • /test okd-e2e-upgrade
  • /test okd-e2e-vsphere
  • /test okd-images

Use /test all to run the following jobs that were automatically triggered:

  • pull-ci-openshift-machine-config-operator-master-e2e-agnostic-upgrade
  • pull-ci-openshift-machine-config-operator-master-e2e-aws
  • pull-ci-openshift-machine-config-operator-master-e2e-gcp-op
  • pull-ci-openshift-machine-config-operator-master-images
  • pull-ci-openshift-machine-config-operator-master-okd-images
  • pull-ci-openshift-machine-config-operator-master-unit
  • pull-ci-openshift-machine-config-operator-master-verify
Details

In response to this:

/test ci/prow/okd-e2e-aws

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@cgwalters
Copy link
Member Author

cgwalters commented Oct 4, 2022

/test okd-e2e-aws

@cgwalters
daemon: Temporarily setenforce 0 for inplace update from container
0451275 
In practice, we should ship a SELinux policy tweak that allows a transition
from `spc_t` -> `install_t` but for now I want to see if this works.
@cgwalters cgwalters force-pushed the chmod-auth-for-fcos branch from 36d9ff0 to 0451275 Compare October 5, 2022 10:48
@cgwalters
Copy link
Member Author

cgwalters commented Oct 5, 2022

/test okd-e2e-aws

@cgwalters
Copy link
Member Author

cgwalters commented Oct 5, 2022

ci/prow/okd-e2e-aws — Job succeeded.   

🎉

@cgwalters cgwalters changed the title daemon: FCOS workaround, plus SELinux workaround MCO-396: daemon: FCOS workaround, plus SELinux workaround Oct 5, 2022
@cgwalters
Copy link
Member Author

cgwalters commented Oct 5, 2022

/jira refresh

@sinnykumari
Copy link
Contributor

sinnykumari commented Oct 6, 2022

/lgtm

@cgwalters
Copy link
Member Author

cgwalters commented Oct 6, 2022

This undermines my confidence in the old-bootimage path, we'll want to verify that better after this lands.

@openshift-ci openshift-ci bot added the lgtm Indicates that a PR is ready to be merged. label Oct 6, 2022
@openshift-ci
Copy link
Contributor

openshift-ci bot commented Oct 6, 2022

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: cgwalters, sinnykumari, yuqi-zhang

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details Needs approval from an approver in each of these files:
  • OWNERS [cgwalters,sinnykumari,yuqi-zhang]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@openshift-ci-robot
Copy link
Contributor

openshift-ci-robot commented Oct 6, 2022

/retest-required

Remaining retests: 0 against base HEAD 3589316 and 2 for PR HEAD 0451275 in total

@vrutkovs
Copy link
Contributor

vrutkovs commented Oct 6, 2022

/test okd-scos-images

@vrutkovs
Copy link
Contributor

vrutkovs commented Oct 7, 2022

/retest

@vrutkovs
Copy link
Contributor

vrutkovs commented Oct 7, 2022

/skip

SKipping optional tests as it unblocks OKD nightlies

@vrutkovs
Copy link
Contributor

vrutkovs commented Oct 7, 2022

/retest

1 similar comment
@vrutkovs
Copy link
Contributor

vrutkovs commented Oct 7, 2022

/retest

@openshift-ci-robot
Copy link
Contributor

openshift-ci-robot commented Oct 7, 2022

/retest-required

Remaining retests: 0 against base HEAD 2cd6ace and 1 for PR HEAD 0451275 in total

@openshift-ci-robot
Copy link
Contributor

openshift-ci-robot commented Oct 7, 2022

/retest-required

Remaining retests: 0 against base HEAD 48e94f5 and 0 for PR HEAD 0451275 in total

@openshift-ci-robot
Copy link
Contributor

openshift-ci-robot commented Oct 7, 2022

/hold

Revision 0451275 was retested 3 times: holding

@openshift-ci openshift-ci bot added the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Oct 7, 2022
@vrutkovs
Copy link
Contributor

vrutkovs commented Oct 8, 2022

/test e2e-agnostic-upgrade

@vrutkovs
Copy link
Contributor

vrutkovs commented Oct 8, 2022

/hold cancel

@openshift-ci openshift-ci bot removed the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Oct 8, 2022
@openshift-ci-robot
Copy link
Contributor

openshift-ci-robot commented Oct 8, 2022

/retest-required

Remaining retests: 0 against base HEAD 48e94f5 and 2 for PR HEAD 0451275 in total

@vrutkovs
Copy link
Contributor

vrutkovs commented Oct 8, 2022

/retest

@openshift-ci
Copy link
Contributor

openshift-ci bot commented Oct 8, 2022 •
edited
Loading

@cgwalters: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name Commit Details Required Rerun command
ci/prow/e2e-hypershift 0451275 link false /test e2e-hypershift
ci/prow/okd-scos-e2e-vsphere 0451275 link false /test okd-scos-e2e-vsphere
ci/prow/okd-scos-e2e-upgrade 0451275 link false /test okd-scos-e2e-upgrade
ci/prow/okd-scos-e2e-gcp-op 0451275 link false /test okd-scos-e2e-gcp-op
ci/prow/okd-scos-e2e-aws 0451275 link false /test okd-scos-e2e-aws

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

@vrutkovs
Copy link
Contributor

vrutkovs commented Oct 9, 2022

/retest

@openshift-merge-robot openshift-merge-robot merged commit 10c8a66 into openshift:master Oct 9, 2022
This was referenced Mar 7, 2023
Merged
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@yuqi-zhang yuqi-zhang yuqi-zhang approved these changes

@cheesesashimi cheesesashimi Awaiting requested review from cheesesashimi

@jkyros jkyros Awaiting requested review from jkyros

Assignees

@sinnykumari sinnykumari

@yuqi-zhang yuqi-zhang

Labels

approved Indicates a PR has been approved by an approver from all required OWNERS files. lgtm Indicates that a PR is ready to be merged.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

6 participants

@cgwalters @vrutkovs @openshift-ci-robot @yuqi-zhang @sinnykumari @openshift-merge-robot