quincy: mgr/prometheus: use vendored "packaging" instead #49698

Matan-B · 2023-01-10T18:13:33Z

Backport of: #49712

Fixes: https://tracker.ceph.com/issues/58416

Contribution Guidelines

To sign and title your commits, please refer to Submitting Patches to Ceph.
If you are submitting a fix for a stable branch (e.g. "pacific"), please refer to Submitting Patches to Ceph - Backports for the proper workflow.

Checklist

Tracker (select at least one)
- References tracker ticket
- Very recent bug; references commit where it was introduced
- New feature (ticket optional)
- Doc update (no ticket needed)
- Code cleanup (no ticket needed)
Component impact
- Affects Dashboard, opened tracker ticket
- Affects Orchestrator, opened tracker ticket
- No impact that needs to be tracked
Documentation (select at least one)
- Updates relevant documentation
- No doc update is appropriate
Tests (select at least one)
- Includes unit test(s)
- Includes integration test(s)
- Includes bug reproducer
- No tests

Show available Jenkins commands

jenkins retest this please
jenkins test classic perf
jenkins test crimson perf
jenkins test signed
jenkins test make check
jenkins test make check arm64
jenkins test submodules
jenkins test dashboard
jenkins test dashboard cephadm
jenkins test api
jenkins test docs
jenkins render docs
jenkins test ceph-volume all
jenkins test ceph-volume tox
jenkins test windows

ljflores · 2023-01-11T23:51:38Z

jenkins test make check

Matan-B · 2023-01-12T12:50:58Z

https://shaman.ceph.com/builds/ceph/wip-matanb-quincy-mgr-packaging
https://pulpito.ceph.com/matan-2023-01-12_12:47:55-smoke:basic-wip-matanb-quincy-mgr-packaging-distro-default-smithi/

tchaikov · 2023-01-12T13:51:39Z

please use git cherry-pick -x to perform backport.

nizamial09 · 2023-01-24T05:44:55Z

can we merge this? @tchaikov @Matan-B

idryomov · 2023-01-25T12:06:15Z

debian/control

@@ -93,6 +93,7 @@ Build-Depends: automake,
               tox <pkg.ceph.check>,
               python3-coverage <pkg.ceph.check>,
               python3-dateutil <pkg.ceph.check>,
+               python3-pkg-resources <pkg.ceph.check>,


This conflict (vs debian/ceph-mgr-modules-core.requires file in main) needs to be documented in the commit message, in particular explaining the reason why this dependency is a pkg.ceph.check dependency instead of regular one.

Can you help me understand why is it a conflict?

Well, it's not a straight cherry-pick, is it? The original commit in main adds a line to debian/ceph-mgr-modules-core.requires file, here you are adding a different line to debian/control file.

Oh, the original commit couldn't be cherry-picked as is since we introduced some changes in the organization of the debian dir (ceph-mgr-modules-core.requires doesn't exist yet).
All the packages listed in main's ceph-mgr-modules-core.requires are marked as pkg.ceph.check in P/Q debian/control.
The changes here are the same as in Pacific's backport #49695.
I can add this explanation to the commit's message if this was your intent.

I can add this explanation to the commit's message if this was your intent.

Yes -- this should be done as a rule, not just upon request.

Added, thank you.

All the packages listed in main's ceph-mgr-modules-core.requires are marked as pkg.ceph.check in P/Q debian/control.

Unresolving as this statement appears to be false for 2 out of 6 packages:

88 python3-cherrypy3, 89 python3-natsort, 91 python3-pecan <pkg.ceph.check>, 95 python3-dateutil <pkg.ceph.check>, 98 python3-requests <pkg.ceph.check>, 103 python3-werkzeug <pkg.ceph.check>,

Am I looking in the wrong place?

Therefore, python3-pkg-resources is listed as <pkg.ceph.check> in debian/control

All of this begs the question: are these backports adding this line to the right section to begin with? I think we need to clarify whether python3-pkg-resources package is:

a general build dependency for Ceph

a build dependency for Ceph that is needed only for make check

a runtime dependency for ceph-mgr-modules-core package

some combination of 1-3?

The changes here are the same as in Pacific's backport #49695.

Adding @ljflores who approved #49695.

idryomov · 2023-01-26T10:10:12Z

After @yuriw picked up this PR into his integration branch, the previous

"backtrace": [
        "  File \"/usr/share/ceph/mgr/prometheus/__init__.py\", line 2, in <module>\n    from .module import Module, StandbyModule",
        "  File \"/usr/share/ceph/mgr/prometheus/module.py\", line 3, in <module>\n    from packaging.version import Version",
        "ModuleNotFoundError: No module named 'packaging'"
    ],

errors expectedly disappeared but the rerun is full of SELinux denials now (pasting just a couple):

SELinux denials found on ubuntu@smithi112.front.sepia.ceph.com: ['type=AVC msg=audit(1674703513.041:15024): avc: denied { open } for pid=61343 comm="rpm" path="/var/lib/rpm/Packages" dev="sda1" ino=73848 scontext=system_u:system_r:setroubleshootd_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:var_lib_t:s0 tclass=file permissive=1', 'type=AVC msg=audit(1674703513.041:15026): avc: denied { map } for pid=61343 comm="rpm" path="/var/lib/rpm/Name" dev="sda1" ino=73849 scontext=system_u:system_r:setroubleshootd_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:var_lib_t:s0 tclass=file permissive=1', 'type=AVC msg=audit(1674703512.695:15003): avc: denied { search } for pid=6912 comm=72733A6D61696E20513A526567 name="cephtest" dev="sda1" ino=262168 scontext=system_u:system_r:syslogd_t:s0 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=dir permissive=1', 'type=AVC msg=audit(1674703513.041:15024): avc: denied { read } for pid=61343 comm="rpm" name="Packages" dev="sda1" ino=73848 scontext=system_u:system_r:setroubleshootd_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:var_lib_t:s0 tclass=file permissive=1', 'type=AVC msg=audit(1674703513.041:15025): avc: denied { lock } for pid=61343 comm="rpm" path="/var/lib/rpm/Packages" dev="sda1" ino=73848 scontext=system_u:system_r:setroubleshootd_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:var_lib_t:s0 tclass=file permissive=1']

SELinux denials found on ubuntu@smithi046.front.sepia.ceph.com: ['type=AVC msg=audit(1674703764.376:214): avc: denied { read } for pid=6345 comm="rpm" name="Packages" dev="sda1" ino=98534 scontext=system_u:system_r:setroubleshootd_t:s0 tcontext=unconfined_u:object_r:var_lib_t:s0 tclass=file permissive=1', 'type=AVC msg=audit(1674704136.380:16947): avc: denied { read } for pid=694 comm="sssd" name="resolv.conf" dev="sda1" ino=395814 scontext=system_u:system_r:sssd_t:s0 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file permissive=1', 'type=AVC msg=audit(1674709729.279:19538): avc: denied { lock } for pid=116202 comm="rpm" path="/var/lib/rpm/Packages" dev="sda1" ino=525265 scontext=system_u:system_r:setroubleshootd_t:s0 tcontext=unconfined_u:object_r:var_lib_t:s0 tclass=file permissive=1', 'type=AVC msg=audit(1674709728.878:19521): avc: denied { search } for pid=6232 comm=72733A6D61696E20513A526567 name="cephtest" dev="sda1" ino=525252 scontext=system_u:system_r:syslogd_t:s0 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=dir permissive=1', 'type=AVC msg=audit(1674704018.801:14037): avc: denied { search } for pid=6232 comm=72733A6D61696E20513A526567 name="cephtest" dev="sda1" ino=525252 scontext=system_u:system_r:syslogd_t:s0 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=dir permissive=1', 'type=AVC msg=audit(1674708605.946:19267): avc: denied { map } for pid=114362 comm="rpm" path="/var/lib/rpm/Name" dev="sda1" ino=525266 scontext=system_u:system_r:setroubleshootd_t:s0 tcontext=unconfined_u:object_r:var_lib_t:s0 tclass=file permissive=1', 'type=AVC msg=audit(1674708605.946:19265): avc: denied { open } for pid=114362 comm="rpm" path="/var/lib/rpm/Packages" dev="sda1" ino=525265 scontext=system_u:system_r:setroubleshootd_t:s0 tcontext=unconfined_u:object_r:var_lib_t:s0 tclass=file permissive=1', 'type=AVC msg=audit(1674704136.737:16978): avc: denied { open } for pid=92700 comm="rpm" path="/var/lib/rpm/Packages" dev="sda1" ino=525265 scontext=system_u:system_r:setroubleshootd_t:s0 tcontext=unconfined_u:object_r:var_lib_t:s0 tclass=file permissive=1', 'type=AVC msg=audit(1674703764.398:215): avc: denied { lock } for pid=6345 comm="rpm" path="/var/lib/rpm/Packages" dev="sda1" ino=98534 scontext=system_u:system_r:setroubleshootd_t:s0 tcontext=unconfined_u:object_r:var_lib_t:s0 tclass=file permissive=1', 'type=AVC msg=audit(1674704019.155:14038): avc: denied { read } for pid=77385 comm="rpm" name="Packages" dev="sda1" ino=98534 scontext=system_u:system_r:setroubleshootd_t:s0 tcontext=unconfined_u:object_r:var_lib_t:s0 tclass=file permissive=1', 'type=AVC msg=audit(1674704137.519:17046): avc: denied { read } for pid=93007 comm="rpm" name="Packages" dev="sda1" ino=525265 scontext=system_u:system_r:setroubleshootd_t:s0 tcontext=unconfined_u:object_r:var_lib_t:s0 tclass=file permissive=1', 'type=AVC msg=audit(1674704136.737:16979): avc: denied { lock } for pid=92700 comm="rpm" path="/var/lib/rpm/Packages" dev="sda1" ino=525265 scontext=system_u:system_r:setroubleshootd_t:s0 tcontext=unconfined_u:object_r:var_lib_t:s0 tclass=file permissive=1', 'type=AVC msg=audit(1674708602.551:19264): avc: denied { search } for pid=6232 comm=72733A6D61696E20513A526567 name="cephtest" dev="sda1" ino=525252 scontext=system_u:system_r:syslogd_t:s0 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=dir permissive=1', 'type=AVC msg=audit(1674709729.279:19537): avc: denied { open } for pid=116202 comm="rpm" path="/var/lib/rpm/Packages" dev="sda1" ino=525265 scontext=system_u:system_r:setroubleshootd_t:s0 tcontext=unconfined_u:object_r:var_lib_t:s0 tclass=file permissive=1', 'type=AVC msg=audit(1674704137.519:17046): avc: denied { open } for pid=93007 comm="rpm" path="/var/lib/rpm/Packages" dev="sda1" ino=525265 scontext=system_u:system_r:setroubleshootd_t:s0 tcontext=unconfined_u:object_r:var_lib_t:s0 tclass=file permissive=1', 'type=AVC msg=audit(1674704136.737:16980): avc: denied { map } for pid=92700 comm="rpm" path="/var/lib/rpm/Name" dev="sda1" ino=525266 scontext=system_u:system_r:setroubleshootd_t:s0 tcontext=unconfined_u:object_r:var_lib_t:s0 tclass=file permissive=1', 'type=AVC msg=audit(1674704019.155:14040): avc: denied { map } for pid=77385 comm="rpm" path="/var/lib/rpm/Name" dev="sda1" ino=98535 scontext=system_u:system_r:setroubleshootd_t:s0 tcontext=unconfined_u:object_r:var_lib_t:s0 tclass=file permissive=1', 'type=AVC msg=audit(1674703764.376:214): avc: denied { open } for pid=6345 comm="rpm" path="/var/lib/rpm/Packages" dev="sda1" ino=98534 scontext=system_u:system_r:setroubleshootd_t:s0 tcontext=unconfined_u:object_r:var_lib_t:s0 tclass=file permissive=1', 'type=AVC msg=audit(1674704019.155:14038): avc: denied { open } for pid=77385 comm="rpm" path="/var/lib/rpm/Packages" dev="sda1" ino=98534 scontext=system_u:system_r:setroubleshootd_t:s0 tcontext=unconfined_u:object_r:var_lib_t:s0 tclass=file permissive=1', 'type=AVC msg=audit(1674704137.519:17047): avc: denied { lock } for pid=93007 comm="rpm" path="/var/lib/rpm/Packages" dev="sda1" ino=525265 scontext=system_u:system_r:setroubleshootd_t:s0 tcontext=unconfined_u:object_r:var_lib_t:s0 tclass=file permissive=1', 'type=AVC msg=audit(1674704019.155:14039): avc: denied { lock } for pid=77385 comm="rpm" path="/var/lib/rpm/Packages" dev="sda1" ino=98534 scontext=system_u:system_r:setroubleshootd_t:s0 tcontext=unconfined_u:object_r:var_lib_t:s0 tclass=file permissive=1', 'type=AVC msg=audit(1674704136.737:16978): avc: denied { read } for pid=92700 comm="rpm" name="Packages" dev="sda1" ino=525265 scontext=system_u:system_r:setroubleshootd_t:s0 tcontext=unconfined_u:object_r:var_lib_t:s0 tclass=file permissive=1', 'type=AVC msg=audit(1674708605.946:19266): avc: denied { lock } for pid=114362 comm="rpm" path="/var/lib/rpm/Packages" dev="sda1" ino=525265 scontext=system_u:system_r:setroubleshootd_t:s0 tcontext=unconfined_u:object_r:var_lib_t:s0 tclass=file permissive=1', 'type=AVC msg=audit(1674704137.519:17048): avc: denied { map } for pid=93007 comm="rpm" path="/var/lib/rpm/Name" dev="sda1" ino=525266 scontext=system_u:system_r:setroubleshootd_t:s0 tcontext=unconfined_u:object_r:var_lib_t:s0 tclass=file permissive=1', 'type=AVC msg=audit(1674708605.946:19265): avc: denied { read } for pid=114362 comm="rpm" name="Packages" dev="sda1" ino=525265 scontext=system_u:system_r:setroubleshootd_t:s0 tcontext=unconfined_u:object_r:var_lib_t:s0 tclass=file permissive=1', 'type=AVC msg=audit(1674703764.404:216): avc: denied { map } for pid=6345 comm="rpm" path="/var/lib/rpm/Name" dev="sda1" ino=98535 scontext=system_u:system_r:setroubleshootd_t:s0 tcontext=unconfined_u:object_r:var_lib_t:s0 tclass=file permissive=1', 'type=AVC msg=audit(1674709729.279:19537): avc: denied { read } for pid=116202 comm="rpm" name="Packages" dev="sda1" ino=525265 scontext=system_u:system_r:setroubleshootd_t:s0 tcontext=unconfined_u:object_r:var_lib_t:s0 tclass=file permissive=1', 'type=AVC msg=audit(1674709729.280:19539): avc: denied { map } for pid=116202 comm="rpm" path="/var/lib/rpm/Name" dev="sda1" ino=525266 scontext=system_u:system_r:setroubleshootd_t:s0 tcontext=unconfined_u:object_r:var_lib_t:s0 tclass=file permissive=1']

https://pulpito.ceph.com/yuriw-2023-01-25_23:08:40-rbd-wip-yuri3-testing-2023-01-25-0909-quincy-distro-default-smithi/

@b-ranto Could you please take a look?

b-ranto · 2023-01-26T22:49:18Z

Are we sure these denials are related to this PR? Looking at the denials a lot of them do not seem to be related to ceph at all (more to setroubleshoot and sssd). The one that actually seems to be related might be a known issue -- it complains about a log context mismatch. IIRC, we have been ignoring/filtering this one in teuthology as it was a test case issue where it stored the log in home dir.

idryomov · 2023-01-27T09:36:44Z

Are we sure these denials are related to this PR?

No, we aren't. Yesterday I suggested that @yuriw did a quincy baseline run with no PRs included.

b-ranto · 2023-01-27T10:10:26Z

@idryomov It looks to me like the filters for denials are broken. IIRC, we used to filter out these denials in teuthology runs.

adk3798 · 2023-01-27T13:53:42Z

To confirm, this run on quincy https://pulpito.ceph.com/gabrioux-2023-01-25_19:12:38-orch:cephadm-wip-guits-testing-2-2023-01-25-1520-pacific-distro-default-smithi/ did not have this PR and still saw a bunch of selinux denials. I feel like this PR is probably good and we can just tackle the denials separately.

idryomov · 2023-01-27T15:49:19Z

I feel like this PR is probably good and we can just tackle the denials separately.

I tend to agree but @Matan-B needs to add an explanation for how the conflict was addressed to the commit message first.

* Note: The cherry-pick is altered, the original commit couldn't be cherry-picked as is since we introduced some changes in the organization of the debian dir (ceph-mgr-modules-core.requires doesn't exist yet). All the packages listed in main's ceph-mgr-modules-core.requires are marked as pkg.ceph.check in P/Q debian/control. Therefore, python3-pkg-resources is listed as <pkg.ceph.check> in debian/control. instead of using the top-level "packaging" module, use the one vendored by setuptools. packaging python module provides versioning defined by PEP-440. but python3-packaging is provided by CentOS8 powertools repo, which is not enabled by default. and in CentOS9, this package is provided by AppStream instead of BaseOS. as prometheus mgr module is included by ceph-mgr-module-core, it would be desirable if our user can install ceph-mgr-module-core without enabling powertools or AppStream repo on a CentOS or its derivative distros. fortunately, setuptools vendors packaging module. and both CentOS8 and CentOS9 provide python3-setuptools in their BaseOS repos. in this change, instead of using "packging" module, we use the venderored one, which is in turn embedded in pkg_resources. this python module is provided by python3-setuptools on CentOS distros, and python3-pkg-resources on Debian and its derivatives the packaging recipes are updated accordingly to reflect the new runtime dependency. Signed-off-by: Kefu Chai <tchaikov@gmail.com> (cherry picked from commit cf60892) Signed-off-by: Matan Breizman <mbreizma@redhat.com>

Matan-B · 2023-01-29T12:12:57Z

I feel like this PR is probably good and we can just tackle the denials separately.

I tend to agree but @Matan-B needs to add an explanation for how the conflict was addressed to the commit message first.

Explanation is added.

idryomov · 2023-01-30T17:25:08Z

errors expectedly disappeared but the rerun is full of SELinux denials now (pasting just a couple):

Now tracked here: https://tracker.ceph.com/issues/58610

ljflores · 2023-02-06T19:49:32Z

https://pulpito.ceph.com/?branch=wip-yuri7-testing-2023-01-30-1510-quincy

No failures related to this PR. Merging

idryomov · 2023-02-06T19:57:23Z

@ljflores I'd like to highlight the concern that both pacific and quincy backports here may be incorrect that seems to have fallen through the cracks: #49698 (comment). In particular, if python3-pkg-resources is a runtime dependency for ceph-mgr-modules-core, it should be added as a dependency of the same (and not be conditioned on make check.

ljflores · 2023-02-07T21:51:47Z

@ljflores I'd like to highlight the concern that both pacific and quincy backports here may be incorrect that seems to have fallen through the cracks: #49698 (comment). In particular, if python3-pkg-resources is a runtime dependency for ceph-mgr-modules-core, it should be added as a dependency of the same (and not be conditioned on make check.

@idryomov thanks for bringing this to my attention, you're right that the comment was lost. I approved this PR initially to unblock failures in the rados suite. This patch has fixed those failures, so it was good in my eyes.

However, @tchaikov and/or @Matan-B, would either of you be able to address Ilya's concern about python3-pkg-resources?

ljflores · 2023-02-07T21:52:36Z

@adk3798 as well? ^

github-actions bot added build/ops pybind labels Jan 10, 2023

github-actions bot added this to the quincy milestone Jan 10, 2023

ljflores approved these changes Jan 10, 2023

View reviewed changes

Matan-B added the DNM label Jan 11, 2023

Matan-B force-pushed the wip-matanb-quincy-mgr-packaging branch from b3876e4 to 53ba162 Compare January 12, 2023 09:19

github-actions bot added the monitoring label Jan 12, 2023

Matan-B removed the DNM label Jan 12, 2023

ljflores changed the title ~~quincy: Add packaging module~~ quincy: mgr/prometheus: use vendored "packaging" instead Jan 12, 2023

Matan-B force-pushed the wip-matanb-quincy-mgr-packaging branch 2 times, most recently from e298339 to 09634e9 Compare January 15, 2023 07:41

Matan-B added the needs-qa label Jan 24, 2023

idryomov reviewed Jan 25, 2023

View reviewed changes

yuriw added the wip-yuri3-testing label Jan 25, 2023

ljflores added wip-lflores-testing-2 and removed wip-lflores-testing-2 labels Jan 27, 2023

Matan-B force-pushed the wip-matanb-quincy-mgr-packaging branch from 09634e9 to 853b6d7 Compare January 29, 2023 12:11

yuriw added wip-yuri7-testing wip-yuri8-testing and removed wip-yuri3-testing labels Jan 30, 2023

ljflores merged commit 3c7f9e0 into ceph:quincy Feb 6, 2023

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

quincy: mgr/prometheus: use vendored "packaging" instead #49698

quincy: mgr/prometheus: use vendored "packaging" instead #49698

Matan-B commented Jan 10, 2023 •

edited by idryomov

ljflores commented Jan 11, 2023

Matan-B commented Jan 12, 2023

tchaikov commented Jan 12, 2023

nizamial09 commented Jan 24, 2023

idryomov Jan 25, 2023

Matan-B Jan 29, 2023

idryomov Jan 29, 2023

Matan-B Jan 29, 2023 •

edited

idryomov Jan 29, 2023 •

edited

Matan-B Jan 29, 2023

idryomov Jan 29, 2023 •

edited

idryomov commented Jan 26, 2023 •

edited

b-ranto commented Jan 26, 2023

idryomov commented Jan 27, 2023

b-ranto commented Jan 27, 2023

adk3798 commented Jan 27, 2023

idryomov commented Jan 27, 2023

Matan-B commented Jan 29, 2023

idryomov commented Jan 30, 2023

ljflores commented Feb 6, 2023

idryomov commented Feb 6, 2023

ljflores commented Feb 7, 2023 •

edited

ljflores commented Feb 7, 2023

quincy: mgr/prometheus: use vendored "packaging" instead #49698

quincy: mgr/prometheus: use vendored "packaging" instead #49698

Conversation

Matan-B commented Jan 10, 2023 • edited by idryomov

Contribution Guidelines

Checklist

ljflores commented Jan 11, 2023

Matan-B commented Jan 12, 2023

tchaikov commented Jan 12, 2023

nizamial09 commented Jan 24, 2023

idryomov Jan 25, 2023

Choose a reason for hiding this comment

Matan-B Jan 29, 2023

Choose a reason for hiding this comment

idryomov Jan 29, 2023

Choose a reason for hiding this comment

Matan-B Jan 29, 2023 • edited

Choose a reason for hiding this comment

idryomov Jan 29, 2023 • edited

Choose a reason for hiding this comment

Matan-B Jan 29, 2023

Choose a reason for hiding this comment

idryomov Jan 29, 2023 • edited

Choose a reason for hiding this comment

idryomov commented Jan 26, 2023 • edited

b-ranto commented Jan 26, 2023

idryomov commented Jan 27, 2023

b-ranto commented Jan 27, 2023

adk3798 commented Jan 27, 2023

idryomov commented Jan 27, 2023

Matan-B commented Jan 29, 2023

idryomov commented Jan 30, 2023

ljflores commented Feb 6, 2023

idryomov commented Feb 6, 2023

ljflores commented Feb 7, 2023 • edited

ljflores commented Feb 7, 2023

Matan-B commented Jan 10, 2023 •

edited by idryomov

Matan-B Jan 29, 2023 •

edited

idryomov Jan 29, 2023 •

edited

idryomov Jan 29, 2023 •

edited

idryomov commented Jan 26, 2023 •

edited

ljflores commented Feb 7, 2023 •

edited