Remove elasticsearch policy and port #6

lzap · 2015-03-12T13:02:27Z

This patch is needed to be able to actually upgrade via yum, otherwise
elasticsearch_port_t causes issues during yum transaction.

This must be merged ideally in the same time as
theforeman/foreman-selinux#44 otherwise nightly will
not be upgradeable.

EDIT: This patch now removes the policy completely.

lzap · 2015-03-19T11:11:09Z

DO NOT MERGE upgrade paths do not work, I need to rewrite this totally.

lzap · 2015-03-19T12:37:55Z

@domcleal how about this? I would follow the same startegy in foreman

lzap · 2015-03-19T12:38:56Z

The only question is now to effectively manage ports for the single port type. When we add docker or openstack, semanage port is clunky...

lzap · 2015-03-19T12:40:33Z

Maybe it's better to have it per service:

katello_elasticsearch_port_t
katello_docker_port_t
foreman_nova_port_t

domcleal · 2015-03-19T13:27:33Z

Yeah, I think you're right that with semanage it's easier to have separate types. Anyway, this style looks better and as long as this is released before the corresponding foreman-selinux change then it gets away from complex upgrade issues.

domcleal · 2015-03-19T13:28:08Z

Oh, simultaneously actually so we don't redefine the same port range as different names.

lzap · 2015-03-19T13:32:15Z

Ok I have renamed to katello_elasticsearch_port_t. Going to test this with updated foreman change.

lzap · 2015-03-19T15:50:29Z

@domcleal one question - if we merge this and build into nighlty and katello 2.2, how do we make sure that this is installed before the foreman-selinux update which relies on this?

lzap · 2015-03-19T15:51:10Z

I mean RC/nightly user can issue just yum upgrade and in this case foreman gets upgraded first (which will fail)

domcleal · 2015-03-20T15:40:32Z

Why might it fail? Maybe because the current loaded katello policy references the elasticsearch_port_t type that foreman-selinux removes? Maybe it needs more thought and a better solution then.

I don't think you can make this ever upgrade before foreman-selinux due to the direction of the dependency, unless you explicitly ask users to upgrade it first.

lzap · 2015-03-20T15:42:11Z

Ok how about to merge this, release into RC/nightly and then the refactoring in foreman merge later and only into nightly?

domcleal · 2015-03-20T15:45:31Z

How are you going to manage the port conflict?

lzap · 2015-03-26T16:56:10Z

@domcleal I think I found the solution:

Introduced katello_elasticsearch_port_t as a separate thing to prevent further conflicts
Added extra step in enable script - if elasticsearch_port_t is defined, move the port to the newly created katello_elasticsearch_port_t
Added optional_policy block to have this working with old elasticsearch_port_t so it works on 1.8 installation where the patch is not yet merged
We will merge this into nightly/1.8 katello and merge the other foreman-selinux patch only to nightly

domcleal · 2015-03-31T11:52:59Z

katello-selinux-enable

-      echo "port -a -t elasticsearch_port_t -p tcp 9200-9300" > $TMP
+    # Previously elasticsearch_port_t was defined in Foreman - move it
+    /usr/sbin/semanage port -E | grep -qE '\s+elasticsearch_port_t\s+' && \
+      semanage port -m -t katello_elasticsearch_port_t -p tcp 9200-9300


Do you need to remove the ports from elasticsearch_port_t here? Maybe echo "port -d -t elasticsearch_port_t" >> $TMP (made up) or similar?

No, we actually move the port numbers from elasticsearch_port_t to katello_elasticsearch_port_t. Calling -d on elasticsearch_port_t would fail.

Note this is not part of the $TMP transaction as I was not sure if it works in one call. Wanted it outside of it.

Sorry, what I don't get is that this code doesn't appear to move the ports, it just adds them to katello_*. What removes them from elasticsearch_port_t?

lzap explained on IRC that semanage will apparently move the port definitions from elasticsearch_port_t to katello_elasticsearch_port_t when running this command. I'm surprised, but haven't tested it.

domcleal · 2015-03-31T11:53:40Z

@lzap good idea, I think that makes sense.

domcleal · 2015-04-02T12:24:47Z

I think a change will also be required to foreman-selinux sooner than 1.9. If this works and is active in a Katello 2.1 + Foreman 1.8.0 installation then will a subsequent upgrade of foreman-selinux to 1.8.1 cause foreman-selinux-enable to add elasticsearch_port_t again after this has renamed it?

ehelms · 2015-06-23T14:04:45Z

@lzap what's the status of this PR? Seems it has been sitting for a while

lzap · 2015-06-24T11:39:37Z

This is still WIP, trying to find a way how to do this. We see issues with upgrades.

ehelms · 2015-07-09T12:49:20Z

@lzap OK, if this is no required for the next set of releases (e.g. 1.9/2.3) then I wouldn't worry to much about it. Katello 2.4 should see the removal of ES from your stack.

lzap · 2015-07-15T09:59:56Z

Sounds like a plan, unfortunately in 1.9 we will have duplicate elasticsearch policies.

ehelms · 2015-11-18T18:54:36Z

We have removed elasticsearch from our deployments in nightly at this point -- can this be closed in light of?

ehelms · 2015-12-14T13:41:54Z

@lzap ping

lzap · 2016-01-04T14:15:35Z

Ok can you confirm we no longer start ES or even connect to it in any way? If so, let's close this one and I can go ahead removing this port completely from the codebase.

ehelms · 2016-01-05T14:52:35Z

I can confirm that.

lzap · 2016-01-06T12:11:40Z

REBASED. This patch now removes the policy completely.

jlsherrill · 2016-01-06T15:28:47Z

ACK looks good to me. thanks @lzap !

Remove elasticsearch policy and port

lzap mentioned this pull request Mar 19, 2015

Fixes #9126 - moved Katello policy to a separate repo theforeman/foreman-selinux#44

Closed

lzap force-pushed the test branch 2 times, most recently from 7925eb2 to e2fdaf6 Compare March 19, 2015 12:37

lzap force-pushed the test branch from e2fdaf6 to 83c95ed Compare March 19, 2015 13:31

lzap force-pushed the test branch from 83c95ed to d24ea6b Compare March 26, 2015 16:54

domcleal reviewed Mar 31, 2015
View reviewed changes

lzap self-assigned this Apr 29, 2015

lzap changed the title ~~Refs #9126 - moved Katello policy to a separate repo~~ WIP rename elasticsearch port resource to prevent conflicts with base policy May 11, 2015

ehelms added the Waiting on contributor label Jul 9, 2015

lzap force-pushed the test branch from d24ea6b to bf33d25 Compare January 6, 2016 12:10

lzap changed the title ~~WIP rename elasticsearch port resource to prevent conflicts with base policy~~ Remove elasticsearch policy and port Jan 6, 2016

Fixes #13014 - removed elasticsearch policy and port

8cf33f7

lzap force-pushed the test branch from bf33d25 to 8cf33f7 Compare January 6, 2016 12:15

jlsherrill added a commit that referenced this pull request Jan 6, 2016

Merge pull request #6 from lzap/test

055444e

Remove elasticsearch policy and port

jlsherrill merged commit 055444e into theforeman:master Jan 6, 2016

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Remove elasticsearch policy and port #6

Remove elasticsearch policy and port #6

lzap commented Mar 12, 2015

lzap commented Mar 19, 2015

lzap commented Mar 19, 2015

lzap commented Mar 19, 2015

lzap commented Mar 19, 2015

domcleal commented Mar 19, 2015

domcleal commented Mar 19, 2015

lzap commented Mar 19, 2015

lzap commented Mar 19, 2015

lzap commented Mar 19, 2015

domcleal commented Mar 20, 2015

lzap commented Mar 20, 2015

domcleal commented Mar 20, 2015

lzap commented Mar 26, 2015

domcleal Mar 31, 2015

lzap Mar 31, 2015

domcleal Apr 2, 2015

domcleal Apr 2, 2015

domcleal commented Mar 31, 2015

domcleal commented Apr 2, 2015

ehelms commented Jun 23, 2015

lzap commented Jun 24, 2015

ehelms commented Jul 9, 2015

lzap commented Jul 15, 2015

ehelms commented Nov 18, 2015

ehelms commented Dec 14, 2015

lzap commented Jan 4, 2016

ehelms commented Jan 5, 2016

lzap commented Jan 6, 2016

jlsherrill commented Jan 6, 2016

Remove elasticsearch policy and port #6

Remove elasticsearch policy and port #6

Conversation

lzap commented Mar 12, 2015

lzap commented Mar 19, 2015

lzap commented Mar 19, 2015

lzap commented Mar 19, 2015

lzap commented Mar 19, 2015

domcleal commented Mar 19, 2015

domcleal commented Mar 19, 2015

lzap commented Mar 19, 2015

lzap commented Mar 19, 2015

lzap commented Mar 19, 2015

domcleal commented Mar 20, 2015

lzap commented Mar 20, 2015

domcleal commented Mar 20, 2015

lzap commented Mar 26, 2015

domcleal Mar 31, 2015

Choose a reason for hiding this comment

lzap Mar 31, 2015

Choose a reason for hiding this comment

domcleal Apr 2, 2015

Choose a reason for hiding this comment

domcleal Apr 2, 2015

Choose a reason for hiding this comment

domcleal commented Mar 31, 2015

domcleal commented Apr 2, 2015

ehelms commented Jun 23, 2015

lzap commented Jun 24, 2015

ehelms commented Jul 9, 2015

lzap commented Jul 15, 2015

ehelms commented Nov 18, 2015

ehelms commented Dec 14, 2015

lzap commented Jan 4, 2016

ehelms commented Jan 5, 2016

lzap commented Jan 6, 2016

jlsherrill commented Jan 6, 2016