Need to make sure that arbitrary-users-patch images work on OpenShift v4

[ibuziuk]

We have to do arbitrary-users-patch [1] of the community images been supported on OpenShift. During the discussion on openshift/origin#23369 it appeared to be that CRI-O now has support for adding the entry of the user to the /etc/password if it does not exists in /etc/passwd. Assuming that CRI-O is the default contianer engine for OpenShift v4 we need to verify that our patched images work correctly on both OpenShift v3 and OpenShift v4 and there are no side-effects.

[1] https://github.com/eclipse/che-devfile-registry/tree/master/arbitrary-users-patch

[ibuziuk]

@rhopp should help us with the OpenShift v4 access

[rhopp]

I have Che 7 (some nightly version) deployed on OCP 4 right now (while trying something else), so I tried to start workspace from this devfile: https://github.com/eclipse/che-devfile-registry/blob/master/devfiles/java-maven/devfile.yaml

Image used in the devfile:

Image:         quay.io/eclipse/che-java11-maven:nightly
    Image ID:      quay.io/eclipse/che-java11-maven@sha256:33000ee0000b18ea5a7dd8c32cc4871ed7c5baba03c449f0110f5b33e06718c9

This is how it looks like in Che, when I open terminal:

@amisevsk This doesn't look correct, right? ^^

[amisevsk]

Nope, the entrypoint doesn't seem to run here.

[ibuziuk]

@rhopp @l0rd @slemeur please consider adding this issue to the end game plan during triage (I think we need to add it as a subtask for Verify and fix devfile registry images to work on openshift )

[ibuziuk]

@rhopp quay.io/eclipse/che-java11-maven:nightly definitely works on v3.11.82 it is pretty frustrating if this is failing on OpenShift v4

[l0rd]

@rhopp are you able to get the UID and the corresponding line in the /etc/passwd in the maven container?

[l0rd]

That is pretty weird. Assuming CRI-O updates /etc/passwd:

1. you should not be able to open a terminal but apparently you can (maybe in your case it has used another default login shell?)
2. entrypoint.sh should still be executed but it looks like it's not (maybe it failed and return before completing?)

[rhopp]

@l0rd We've found the reason for my failure - I was using old devfile, which has "command" for the container defined -> thus the pod has "command" defined meaning openshift overriden entrypoint with this command.

[ibuziuk]

Have tested with the following devfiles form the registry against OCP v4 and was not able to spot any issues:

• java-maven - https://github.com/eclipse/che-devfile-registry/tree/master/devfiles/java-maven
• go - https://raw.githubusercontent.com/eclipse/che-devfile-registry/master/devfiles/go/devfile.yaml
• python - https://raw.githubusercontent.com/eclipse/che-devfile-registry/master/devfiles/python/devfile.yaml
• php-web-simple - https://raw.githubusercontent.com/eclipse/che-devfile-registry/master/devfiles/php-web-simple/devfile.yaml

Basically, all the workspaces started from those devfiles have a dedicated /etc/passwd entry and whoami return user, witt id like uid=1000820000(user) gid=0(root) groups=0(root),1000820000

@rhopp @l0rd I believe we can close this issue as done.

[l0rd]

@ibuziuk cool!