Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Bug 1865743: Add a prestart line to change ownership of openvswitch dir #2316

Merged
merged 1 commit into from Jan 11, 2021

Conversation

abhat
Copy link
Contributor

@abhat abhat commented Jan 4, 2021

Temporary fix for making sure the ownership of openvswitch directory is set to openvswitch user till we fix coreos/rpm-ostree#49.

Signed-off-by: Aniket Bhat anbhat@redhat.com

@openshift-ci-robot openshift-ci-robot added bugzilla/severity-urgent Referenced Bugzilla bug's severity is urgent for the branch this PR is targeting. bugzilla/valid-bug Indicates that a referenced Bugzilla bug is valid for the branch this PR is targeting. labels Jan 4, 2021
@openshift-ci-robot
Copy link
Contributor

@abhat: This pull request references Bugzilla bug 1865743, which is valid. The bug has been moved to the POST state. The bug has been updated to refer to the pull request using the external bug tracker.

3 validation(s) were run on this bug
  • bug is open, matching expected state (open)
  • bug target release (4.7.0) matches configured target release for branch (4.7.0)
  • bug is in the state ASSIGNED, which is one of the valid states (NEW, ASSIGNED, ON_DEV, POST, POST)

In response to this:

Bug 1865743: Add a prestart line to change ownership of openvswitch dir

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@abhat
Copy link
Contributor Author

abhat commented Jan 4, 2021

/assign @cgwalters. I also thought about doing DynamicUser=yes, but I am not sure if using that I can actually specify the user to be openvswitch. It looked like setting that option, the system will create an unused uid/gid instead.

Also, there are repercussions about using that option for persistent directories and how to set up StateDirectory/LogsDirectory etc. correctly without breaking existing assumptions about how openvswitch service works. Given that, this seemed to be a prudent choice.

@yuqi-zhang
Copy link
Contributor

/approve tentatively, will leave review to colin

@openshift-ci-robot openshift-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Jan 4, 2021
@abhat
Copy link
Contributor Author

abhat commented Jan 5, 2021

/test e2e-aws-serial

@abhat
Copy link
Contributor Author

abhat commented Jan 5, 2021

Ok so there is openvswitch.useropts file that seems to be setting the OVS_USER_ID and OVS_USER_OPT environment variables that the openvswitch.service file is using. The drop-in does change the permissions on the directories, but because the openvswitch process is running as a different group hugetlbfs, any new bridge created by ovs is done using that gid.

I don't know who owns that env file and how it gets populated during ignition (via some config). But it would seem to make sense to use the same env. variable in this PR potentially?

@yuqi-zhang, @cgwalters any ideas?

The openvswitch dirs should be owned by the user running the
openvswitch and ovsdb-server processes. This is controller
either by contents of default.conf or /etc/config/openvswitch file.

Signed-off-by: Aniket Bhat <anbhat@redhat.com>
@danielmellado
Copy link

The PR seems to be just applying the workaround mentioned in this bugzilla, so overall LGTM

@danielmellado
Copy link

/lgtm

@openshift-ci-robot openshift-ci-robot added the lgtm Indicates that a PR is ready to be merged. label Jan 11, 2021
@openshift-ci-robot
Copy link
Contributor

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: abhat, danielmellado, yuqi-zhang

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@openshift-bot
Copy link
Contributor

/retest

Please review the full test history for this PR and help us cut down flakes.

2 similar comments
@openshift-bot
Copy link
Contributor

/retest

Please review the full test history for this PR and help us cut down flakes.

@openshift-bot
Copy link
Contributor

/retest

Please review the full test history for this PR and help us cut down flakes.

@cuppett
Copy link
Member

cuppett commented Jan 11, 2021

/cherry-pick release-4.6

@openshift-cherrypick-robot

@cuppett: once the present PR merges, I will cherry-pick it on top of release-4.6 in a new PR and assign it to you.

In response to this:

/cherry-pick release-4.6

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@@ -4,3 +4,6 @@ dropins:
contents: |
[Service]
Restart=always
ExecStartPre=-/bin/sh -c '/usr/bin/chown -R :$${OVS_USER_ID##*:} /var/lib/openvswitch'
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Are you sure about the leading : to only change the group?
There's quite a lot of syntatic sorcery going on here.
OK $$ is to quote it from systemd's expansion, so the shell sees it.
The ##*: is...I don't quite follow that, what is it doing?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I leveraged this sorcery from an existing ovs-vswitchd service file on a deployed cluster. I am assuming it works :).

@openshift-ci
Copy link
Contributor

openshift-ci bot commented Jan 11, 2021

@abhat: The following test failed, say /retest to rerun all failed tests:

Test name Commit Details Rerun command
ci/prow/e2e-ovn-step-registry c6b48e4 link /test e2e-ovn-step-registry

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

@openshift-bot
Copy link
Contributor

/retest

Please review the full test history for this PR and help us cut down flakes.

@openshift-merge-robot openshift-merge-robot merged commit a8c78a3 into openshift:master Jan 11, 2021
@openshift-cherrypick-robot

@cuppett: new pull request created: #2331

In response to this:

/cherry-pick release-4.6

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@openshift-ci-robot
Copy link
Contributor

@abhat: All pull requests linked via external trackers have merged:

Bugzilla bug 1865743 has been moved to the MODIFIED state.

In response to this:

Bug 1865743: Add a prestart line to change ownership of openvswitch dir

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@abhat abhat deleted the fix_uid_gid branch January 25, 2021 19:28
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
approved Indicates a PR has been approved by an approver from all required OWNERS files. bugzilla/severity-urgent Referenced Bugzilla bug's severity is urgent for the branch this PR is targeting. bugzilla/valid-bug Indicates that a referenced Bugzilla bug is valid for the branch this PR is targeting. lgtm Indicates that a PR is ready to be merged.
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Drop requirement on nss-altfiles, use systemd sysusers
10 participants