Bug 1392742
| Summary: | OpenShift installer always sets --selinux-enabled in sysconfig/docker. Can break working overlay installs. | ||
|---|---|---|---|
| Product: | OpenShift Container Platform | Reporter: | Mike Fiedler <mifiedle> |
| Component: | Installer | Assignee: | Russell Teague <rteague> |
| Status: | CLOSED ERRATA | QA Contact: | Johnny Liu <jialiu> |
| Severity: | medium | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | 3.4.0 | CC: | adellape, aos-bugs, jlee, jokerman, mifiedle, mmccomas, rteague, tdawson, vlaad |
| Target Milestone: | --- | ||
| Target Release: | --- | ||
| Hardware: | x86_64 | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | Enhancement | |
| Doc Text: |
Feature: Add new option 'openshift_docker_selinux_enabled'
Reason: Allow user to override default installation docker options setting of '--selinux-enabled'.
Result: Placing 'openshift_docker_selinux_enabled=false' in user inventory file will remove --selinux-enabled docker option.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | 2017-04-12 18:48:14 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
|
Description
Mike Fiedler
2016-11-08 06:13:20 UTC
Mike, marking this upcoming release. If this is a regression lets remove that flag and we can treat it as a blocker, if it's not a regression we'll get to it after the release. Related discussion (docs BZ): https://bugzilla.redhat.com/show_bug.cgi?id=1290487#c8 This is not a regression. 3.3 installer behaves the same way. The discussion Alex links is a good one, but I think the more general issue here is having the installer respect the existing docker config if there is nothing about it that breaks OpenShift. UpcomingRelease sounds fine. @Russell, go through the above PR, seem like introduce a new ansible option - openshift_docker_selinux_enabled, that means user should set "openshift_docker_selinux_enabled=false" in inventory host file to run install with docker overlay setting, am I right? (In reply to Johnny Liu from comment #6) Johnny, if the user wants to disable the use of selinux within the containers, they would set "openshift_docker_selinux_enabled=false". This will cause docker to not run selinux within the container regardless of the status of selinux on the host. Mike, could you comment on where we are headed with this and if it meets your original request? This handles the specific example of enabling/disabling selinux for the containers. My more general concern in this bug was not breaking existing good Docker configurations by overwriting the configuration during OpenShift install. Is OpenShift always "in control" of the Docker configuration? i.e. existing user configuration outside of what OpenShift performs is not supported? I can live with a restriction, but we should probably document it. Verified this bug with openshift-ansible-3.5.3-1.git.0.80c2436.el7.noarch, and PASS. Set openshift_docker_selinux_enabled=false in inventory host file, trigger installation, after it is completed, checking: # cat /etc/sysconfig/docker|grep OPTION OPTIONS=' --log-driver=json-file --log-opt max-size=50m' No "--selinux-enabled" options in docker config file. Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2017:0903 |