Bug 1401901

Summary:	ovirt-imageio-daemon requires vdsm user but it's not requiring vdsm rpm because vdsm is requiring ovirt-imageio-daemon
Product:	[oVirt] ovirt-imageio	Reporter:	Simone Tiraboschi <stirabos>
Component:	General	Assignee:	Daniel Erez <derez>
Status:	CLOSED CURRENTRELEASE	QA Contact:	Avihai <aefrat>
Severity:	medium	Docs Contact:
Priority:	medium
Version:	---	CC:	amureini, bugs, derez, mmucha, nsoffer, stirabos, tnisan, ylavi
Target Milestone:	ovirt-4.1.0-beta	Flags:	rule-engine: ovirt-4.1+
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2017-02-15 14:59:21 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	Storage	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	1438921

Description Simone Tiraboschi 2016-12-06 11:24:40 UTC

Description of problem:
ovirt-imageio-daemon requires vdsm user but it's not requiring vdsm rpm because vdsm is requiring ovirt-imageio-daemon so nothing is enforcing the correct rpm install order.
If ovirt-imageio-daemon got installed, in a single transaction, before vdsm yum will report:

Installing : ovirt-imageio-daemon-0.5.0-0.201612010905.git741361f.el7.centos.noarch 180/270
warning: user vdsm does not exist - using root
warning: group kvm does not exist - using root

and all the ovirt-imageio-daemon dirs and files will be assigned to root and this could cause runtime errors:

[root@c72he20161206h1 ~]# ls -la /etc/ovirt-imageio-daemon
total 16
drwxr-xr-x. 2 root root 24 Dec 6 11:57 .
drwxr-xr-x. 104 root root 8192 Dec 6 11:59 ..
-rw-r--r--. 1 root root 375 Dec 1 10:05 logger.conf
[root@c72he20161206h1 ~]# ls -la /var/log/ovirt-imageio-daemon
total 4
drwxr-xr-x. 2 root root 6 Dec 1 10:05 .
drwxr-xr-x. 18 root root 4096 Dec 6 11:59 ..

Version-Release number of selected component (if applicable):

How reproducible:
It depends from yum ordering which is currently not enforced

Steps to Reproduce:
1. yum install vdsm
2.
3.

Actual results:
ovirt-imageio-daemon-0.5.0-0.201612010905.git741361f.el7.centos.noarch 180/270
warning: user vdsm does not exist - using root
warning: group kvm does not exist - using root

Expected results:
no yum warnings

Additional info:
vdsm requires ovirt-imageio-daemon

Comment 1 Nir Soffer 2016-12-06 11:33:59 UTC

ovirt-imageio-daemon is a helper for vdsm. Vdsm control it to allow upload to 
vdsm images or downloads from vdsm images.

ovirt-imageio-daemon uses vdsm pki (/etc/pki/vdsm) so ovirt-imageio-proxy can 
access via https.

We went with the easy solution, running as vdsm, and installation on a clean
system was probably never tested.

I think the right solution is to run ovirt-imageio-daemon on under its own user,
(imageio?) so we don't have any dependency on vdsm.

To allow ovirt-imageio-daemon access to vdsm pki files and images, vdsm can 
add the imageio user to qemu group, in vdsm-tool configure --module=imageio.
This is the same way we configure sanlock.

Comment 2 Simone Tiraboschi 2016-12-06 12:59:00 UTC

Simple workaround: manually run 
  yum reinstall ovirt-imageio-daemon
once vdsm is there

Comment 3 Allon Mureinik 2016-12-07 09:15:54 UTC

(In reply to Nir Soffer from comment #1)
> We went with the easy solution, running as vdsm, and installation on a clean
> system was probably never tested.
> 
> I think the right solution is to run ovirt-imageio-daemon on under its own
> user,
> (imageio?) so we don't have any dependency on vdsm.
> 
> To allow ovirt-imageio-daemon access to vdsm pki files and images, vdsm can 
> add the imageio user to qemu group, in vdsm-tool configure --module=imageio.
> This is the same way we configure sanlock.
Sounds like a plan.

Simone - given the workaround, how urgent is this?
To me 4.1-beta seems like a reasonable target for this.

Comment 4 Nir Soffer 2016-12-07 10:12:27 UTC

(In reply to Allon Mureinik from comment #3)
> > I think the right solution is to run ovirt-imageio-daemon on under its own
> > user,
> > (imageio?) so we don't have any dependency on vdsm.
> > 
> > To allow ovirt-imageio-daemon access to vdsm pki files and images, vdsm can 
> > add the imageio user to qemu group, in vdsm-tool configure --module=imageio.
> > This is the same way we configure sanlock.
> Sounds like a plan.

Simone suggested to add a Requires(pre): vdsm - it this works, we can fix
this bug *now*, and work on the more correct approach in later version.

Comment 5 Nir Soffer 2016-12-23 20:30:08 UTC

Simone, can you check if this patch solves the issue on your setup?

Comment 6 Tal Nisan 2017-01-01 10:18:13 UTC

Not sure why it was moved to MODIFIED, it's a 4.0.7 bug with a patch only on master, we are missing 2 backports

Comment 7 Daniel Erez 2017-01-01 12:49:28 UTC

(In reply to Tal Nisan from comment #6)
> Not sure why it was moved to MODIFIED, it's a 4.0.7 bug with a patch only on
> master, we are missing 2 backports

@Tal - ovirt-imageio project currently has only master branch, i.e. no branches to backport into. Can we move it to MODIFIED?

Comment 8 Nir Soffer 2017-01-01 12:56:33 UTC

(In reply to Daniel Erez from comment #7)
> (In reply to Tal Nisan from comment #6)
> > Not sure why it was moved to MODIFIED, it's a 4.0.7 bug with a patch only on
> > master, we are missing 2 backports
> 
> @Tal - ovirt-imageio project currently has only master branch, i.e. no
> branches to backport into.

But we have downstream repositories that must include this fix - is this fix
included in the downstream repositories?

Comment 9 Daniel Erez 2017-01-01 13:35:38 UTC

(In reply to Nir Soffer from comment #8)
> (In reply to Daniel Erez from comment #7)
> > (In reply to Tal Nisan from comment #6)
> > > Not sure why it was moved to MODIFIED, it's a 4.0.7 bug with a patch only on
> > > master, we are missing 2 backports
> > 
> > @Tal - ovirt-imageio project currently has only master branch, i.e. no
> > branches to backport into.
> 
> But we have downstream repositories that must include this fix - is this fix
> included in the downstream repositories?

The packages are uploaded upon release, there are no branches to backport into.

Comment 10 Tal Nisan 2017-01-02 11:51:58 UTC

*** Bug 1400003 has been marked as a duplicate of this bug. ***

Comment 11 Simone Tiraboschi 2017-01-02 15:16:16 UTC

The upstream build ovirt-imageio-daemon-1.0.0-0.201612271935.git8df9ac6.el7.centos.noarch got installed successfully.

Comment 12 Sandro Bonazzola 2017-01-25 07:55:10 UTC

4.0.6 has been the last oVirt 4.0 release, please re-target this bug.

Comment 13 Avihai 2017-01-31 11:24:16 UTC

Verified on VDSM -> 4.19.2-2 .
Engine -> ovirt-engine-4.1.0.2-0.2.el7.noarch .