Skip to content

Bug: 1686556: Symlink /root/.docker/config.json to kubelet auth #535

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
openshift-merge-robot merged 1 commit into from
Mar 9, 2019
Merged

Bug: 1686556: Symlink /root/.docker/config.json to kubelet auth #535

openshift-merge-robot merged 1 commit into from
Mar 9, 2019

Conversation

@cgwalters
Copy link
Member

@cgwalters cgwalters commented Mar 8, 2019

This is a workaround for us switching to an authenticated pause
image and crio not knowing how to use the kubelet's auth for this.

https://bugzilla.redhat.com/show_bug.cgi?id=1686556

@openshift-ci-robot openshift-ci-robot added size/S Denotes a PR that changes 10-29 lines, ignoring generated files. approved Indicates a PR has been approved by an approver from all required OWNERS files. labels Mar 8, 2019
@cgwalters
Copy link
Member Author

cgwalters commented Mar 8, 2019

(And we need to hack this because the template controller doesn't know about symlinks, just files)

@cgwalters cgwalters changed the title controller: Symlink /root/.docker/config.json to kubelet auth WIP: controller: Symlink /root/.docker/config.json to kubelet auth Mar 8, 2019
@openshift-ci-robot openshift-ci-robot added the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Mar 8, 2019
@cgwalters
Copy link
Member Author

cgwalters commented Mar 8, 2019

Adding WIP since I only compile tested this.

@wking
Copy link
Member

wking commented Mar 8, 2019

Adding WIP since I only compile tested this.

Is there a way for hard-code a private pause image while CI-testing this?

@smarterclayton smarterclayton changed the title WIP: controller: Symlink /root/.docker/config.json to kubelet auth WIP: Bug: 1686556: controller: Symlink /root/.docker/config.json to kubelet auth Mar 8, 2019
@smarterclayton smarterclayton changed the title WIP: Bug: 1686556: controller: Symlink /root/.docker/config.json to kubelet auth WIP: Bug: 1686556: Symlink /root/.docker/config.json to kubelet auth Mar 8, 2019
@wking wking mentioned this pull request Mar 8, 2019
Closed
@cgwalters
Copy link
Member Author

cgwalters commented Mar 8, 2019

/test e2e-aws

(So I can grab the release image this time)

@cgwalters
Copy link
Member Author

cgwalters commented Mar 8, 2019

/test e2e-aws

@cgwalters cgwalters mentioned this pull request Mar 8, 2019
Closed
@cgwalters
Copy link
Member Author

cgwalters commented Mar 8, 2019

Is there a way for hard-code a private pause image while CI-testing this?

Gave that a shot in

#537 (comment)

@cgwalters
Copy link
Member Author

cgwalters commented Mar 8, 2019

Testing this out live reveals I almost got it right:

$ oc debug node/ip-10-0-129-163.ec2.internal
Starting pod/ip-10-0-129-163ec2internal-debug ...
To directly access the host PATH, try `chroot /host /bin/bash`
If you don't see a command prompt, try pressing enter.
sh-4.2# chroot /host
sh-4.2# ls -al /root/
total 24
drwx------.  3 root root  123 Mar  8 19:17 .
drwxr-xr-x. 23 root root 4096 Mar  8 19:17 ..
-rw-r--r--.  1 root root   18 Mar  8 19:17 .bash_logout
-rw-r--r--.  1 root root  193 Mar  8 19:17 .bash_profile
-rw-r--r--.  1 root root  231 Mar  8 19:17 .bashrc
drwxr-xr-x.  2 root root   25 Mar  8 19:17 .docker
-rw-------.  1 root root 2667 Mar  6 22:23 anaconda-ks.cfg
-rw-------.  1 root root 2334 Mar  6 22:23 original-ks.cfg
sh-4.2# ls -al /root/.docker/
total 0
drwxr-xr-x. 2 root root  25 Mar  8 19:17 .
drwx------. 3 root root 123 Mar  8 19:17 ..
lrwxrwxrwx. 1 root root  26 Mar  8 19:17 config.json -> /var/lib/kubelet/auth.json
sh-4.2#

@cgwalters
Copy link
Member Author

cgwalters commented Mar 8, 2019

And now with s/auth.json/config.json/

@cgwalters
Copy link
Member Author

cgwalters commented Mar 8, 2019

#537 (comment)

/hold cancel

@cgwalters cgwalters changed the title WIP: Bug: 1686556: Symlink /root/.docker/config.json to kubelet auth Bug: 1686556: Symlink /root/.docker/config.json to kubelet auth Mar 8, 2019
@openshift-ci-robot openshift-ci-robot removed the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Mar 8, 2019
@cgwalters
Copy link
Member Author

cgwalters commented Mar 8, 2019

Let's ship this!

@cgwalters
Copy link
Member Author

cgwalters commented Mar 8, 2019

Although wait a sec...the link seems to be inside the SSH MC.

/hold

@openshift-ci-robot openshift-ci-robot added the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Mar 8, 2019
@cgwalters
controller: Symlink /root/.docker/config.json to kubelet auth
8b08dfb 
This is a workaround for us switching to an authenticated pause
image and crio not knowing how to use the kubelet's auth for this.

https://bugzilla.redhat.com/show_bug.cgi?id=1686556
@cgwalters
Copy link
Member Author

cgwalters commented Mar 9, 2019

OK, now this should be really ready to go.

@cgwalters
Copy link
Member Author

cgwalters commented Mar 9, 2019

/hold cancel

@openshift-ci-robot openshift-ci-robot removed the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Mar 9, 2019
@runcom
Copy link
Member

runcom commented Mar 9, 2019

/approve
/lgtm

@openshift-ci-robot openshift-ci-robot added the lgtm Indicates that a PR is ready to be merged. label Mar 9, 2019
@openshift-ci-robot
Copy link
Contributor

openshift-ci-robot commented Mar 9, 2019

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: cgwalters, runcom

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@openshift-merge-robot openshift-merge-robot merged commit 218ec46 into openshift:master Mar 9, 2019
@mtrmac mtrmac mentioned this pull request Mar 11, 2019
Merged
runcom added a commit to runcom/machine-config-operator that referenced this pull request Mar 26, 2019
@runcom
pkg/daemon: allow empty new links section
b8c532b 
This PR is further fixing https://bugzilla.redhat.com/show_bug.cgi?id=1677198 by
allowing an old cluster to contain links (coming from openshift#535) which are
then removed when upgrading to post openshift#540.

What's happening to QE is that:

1) they're starting a cluster with an MCO version which contains openshift#535
2) they're upgrading to a payload which doesn't have openshift#535 cause it has openshift#540 which reverts openshift#535

The above means that point 1) generates MachineConfigs with an unsupported symlink and when
upgrading to 2), the symlink is removed causing drift and an unreconcilable error.

QE can start testing with a newer MCO version to avoid this, but for
ease of testing, let's add this snippet to make sure getting rid of
links, which we don't support anyway, just works.

Signed-off-by: Antonio Murdaca <[email protected]>
@runcom runcom mentioned this pull request Mar 26, 2019
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@kikisdeliveryservice kikisdeliveryservice Awaiting requested review from kikisdeliveryservice

@LorbusChris LorbusChris Awaiting requested review from LorbusChris

Assignees

@runcom runcom

Labels

approved Indicates a PR has been approved by an approver from all required OWNERS files. lgtm Indicates that a PR is ready to be merged. size/S Denotes a PR that changes 10-29 lines, ignoring generated files.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

5 participants

@cgwalters @wking @runcom @openshift-ci-robot @openshift-merge-robot