Skip to content
This repository has been archived by the owner on Oct 16, 2020. It is now read-only.

Config drive mounted regardless of oem/cloud-config.yml entries #314

Closed
jayofdoom opened this issue Mar 24, 2015 · 1 comment
Closed

Config drive mounted regardless of oem/cloud-config.yml entries #314

jayofdoom opened this issue Mar 24, 2015 · 1 comment
Assignees
@marineam
Labels
component/other

Comments

@jayofdoom
Copy link

Hi all, this is an upstreaming of the bug reported to Ironic here: https://bugs.launchpad.net/ironic/+bug/1433812

Basically, despite masking all relevant units (https://github.com/openstack/ironic-python-agent/blob/master/imagebuild/coreos/oem/cloud-config.yml#L5p) if a configdrive exists on a booted disk it will still be mounted. This is undesirable in several cases for OpenStack Ironic, such as when we boot to erase an existing installation or overwrite an existing one (if cleaning is disabled).

Using the kernel command line config option to disable configdrive is a workaround, but since Ironic has multiple ramdisks, we'd rather not add a CoreOS-specific workaround to the default configuration.

There are two possible workarounds:

  1. We could remove the offending units from the PXE image during build time. This would be a break from existing policy where we don't modify anything outside of oem/ from the shipped CoreOS image, and prevent us from ever shipping a 100% stock CoreOS PXE image.

  2. We could unmount the configdrive before masking the units. Would this work? Or is the cloud-config.yml processed too late in the boot process to have prevented coreos-cloudinit from running against an existing configdrive?

Any insight would be appreciated, as well as a better overall way to handle this in PXE images.
@marineam marineam self-assigned this Mar 24, 2015
openstack-gerrit pushed a commit to openstack/ironic that referenced this issue Mar 24, 2015
@jayofdoom
Ensure configdrive isn't mounted in CoreOS ramdisks
87abb93 
Temporary workaround for bug #1433812. CoreOS processes the
cloud-config.yml too late the boot process to prevent mounting and
processing the configdrive. Pass coreos.configdrive=0 on the kernel
command line to ensure this doesn't occur, as it can be a security risk
(previous tenants may have written a malicious configdrive, and it would
be read before being cleaned).

Long-term, we should remove this workaround and either completely remove
the mount units from the ramdisk during the build process or get a
better fix from upstream (coreos/bugs#314).

Change-Id: I59575b2c5c89c3ceef03598f8b86f0e330cfacad
Partial-bug: 1433812
openstack-gerrit pushed a commit to openstack/openstack that referenced this issue Mar 24, 2015
@openstack-gerrit
Updated openstack/openstack
226b5a6 
Project: openstack/ironic  565338fc5bc23111dccfc1b753512b0ce7bca786

Ensure configdrive isn't mounted in CoreOS ramdisks

Temporary workaround for bug #1433812. CoreOS processes the
cloud-config.yml too late the boot process to prevent mounting and
processing the configdrive. Pass coreos.configdrive=0 on the kernel
command line to ensure this doesn't occur, as it can be a security risk
(previous tenants may have written a malicious configdrive, and it would
be read before being cleaned).

Long-term, we should remove this workaround and either completely remove
the mount units from the ramdisk during the build process or get a
better fix from upstream (coreos/bugs#314).

Change-Id: I59575b2c5c89c3ceef03598f8b86f0e330cfacad
Partial-bug: 1433812
openstack-gerrit pushed a commit to openstack/openstack that referenced this issue Mar 27, 2015
@openstack-gerrit
Updated openstack/openstack
2ce9dce 
Project: openstack/ironic  b2548c86c623db9c9f6140ff442b2c9f5321888a

Ensure configdrive isn't mounted for ipxe/elilo

This extends 87abb934e0d97cce0562a028e68c0a70a35c19ce to work with elilo
and ipxe.

Temporary workaround for bug #1433812. CoreOS processes the
cloud-config.yml too late the boot process to prevent mounting and
processing the configdrive. Pass coreos.configdrive=0 on the kernel
command line to ensure this doesn't occur, as it can be a security
risk (previous tenants may have written a malicious configdrive,
and it would be read before being cleaned).

Long-term, we should remove this workaround and either completely remove
the mount units from the ramdisk during the build process or get a
better fix from upstream (coreos/bugs#314).

Change-Id: I03fd230a9d03dd4daeaa53148ec9975d741c14a0
Partial-bug: 1433812
openstack-gerrit pushed a commit to openstack/ironic that referenced this issue Mar 27, 2015
@jayofdoom @rameshg87
Ensure configdrive isn't mounted for ipxe/elilo
be5e85f 
This extends 87abb93 to work with elilo
and ipxe.

Temporary workaround for bug #1433812. CoreOS processes the
cloud-config.yml too late the boot process to prevent mounting and
processing the configdrive. Pass coreos.configdrive=0 on the kernel
command line to ensure this doesn't occur, as it can be a security
risk (previous tenants may have written a malicious configdrive,
and it would be read before being cleaned).

Long-term, we should remove this workaround and either completely remove
the mount units from the ramdisk during the build process or get a
better fix from upstream (coreos/bugs#314).

Change-Id: I03fd230a9d03dd4daeaa53148ec9975d741c14a0
Partial-bug: 1433812
@crawford
Copy link
Contributor

@jayofdoom now that CoreOS ships with Ignition, you can just mask off any units you don't want to run. Ignition runs before systemd, so you won't have to deal with any race conditions.

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Assignees

@marineam marineam

Labels
component/other
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
3 participants
@marineam @crawford @jayofdoom