Bug 1415096

Summary:	[platformmanagement_public_626]openshift doesn't work if 'bindPassword file:xxx' with customer path:/non-default-path in master-config
Product:	OpenShift Container Platform	Reporter:	ge liu <geliu>
Component:	apiserver-auth	Assignee:	Mo <mkhan>
Status:	CLOSED ERRATA	QA Contact:	Chuan Yu <chuyu>
Severity:	medium	Docs Contact:
Priority:	unspecified
Version:	3.4.1	CC:	aos-bugs, geliu, jliggitt, mfojtik, pweil, tdawson, trankin, wsun
Target Milestone:	---
Target Release:	---
Hardware:	x86_64
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2017-04-12 19:10:14 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Comment 1 Jordan Liggitt 2017-01-20 15:38:04 UTC

I cannot recreate the issue. Can you include the full error message:

oauthConfig.identityProvider[0].provider.bindPassword.file: Invalid value: "/tmp/bindpassword....

Does the user the openshift process is starting as have read permissions to /tmp/bindpassword.txt

Comment 7 ge liu 2017-01-26 07:13:14 UTC

@Mo, @Jordan:

The '/etc/origin/master/bindpassword.txt' is working well one and '/tmp/bindpassword.txt' doesn't work well for 'systemctl restart aotmic-openshift-master':


# ls -lahZ /tmp/bindpassword.txt 
-rw-r--r--. root root unconfined_u:object_r:user_tmp_t:s0 /tmp/bindpassword.txt

# ls -lahZ /etc/origin/master/bindpassword.txt 
-rw-r--r--. root root unconfined_u:object_r:etc_t:s0   /etc/origin/master/bindpassword.txt

# md5sum /tmp/bindpassword.txt
5f4dcc3b5aa765d61d8327deb882cf99  /tmp/bindpassword.txt
# md5sum /etc/origin/master/bindpassword.txt
5f4dcc3b5aa765d61d8327deb882cf99  /etc/origin/master/bindpassword.txt

Comment 8 Mo 2017-02-01 20:53:12 UTC

@Ge could you try using https://github.com/openshift/origin/pull/12761 ?

Comment 9 Mo 2017-02-01 23:39:36 UTC

@Ge that PR is merged now so the latest master should give better logging info.

Comment 10 ge liu 2017-02-03 03:23:34 UTC

Verified in openshift:

openshift v1.5.0-alpha.2+c4c0d9c-333
kubernetes v1.5.2+43a9be4
etcd 3.1.0


# ls -lahZ bindpassword.txt 
-rw-r--r--. root root unconfined_u:object_r:user_tmp_t:s0 bindpassword.txt
# ls -lahZ /root/openshift.local.config/master/bindpassword.txt
-rw-r--r--. root root unconfined_u:object_r:admin_home_t:s0 /root/openshift.local.config/master/bindpassword.txt

Comment 11 Mo 2017-02-03 03:35:37 UTC

@Ge new master logs please.

Comment 14 ge liu 2017-02-06 01:15:21 UTC

@Mo, I also read the logs before sent to u, and could not find the /tmp/bindpassword info even if I really used this in master-config.yaml file, but could find the login user: 'newton' info, I suppose you could find the critical infomation by reading log. I used the '--loglevel=5' when starting openshift, I'm not sure if it's enough. BTW, the difference between I filing the bug and verify it is: I filing the buy on ocp enc, so I could get the error msg by 'journalctl -l -u atomic-openshift-master',  and verify it on origin env and used 'openshift start' mode, so 'journalctl' could not find the righ service name for openshift, I can only get the master log by "openshift start xxxxx &> master.log", it there any idea for this situation?

Comment 16 errata-xmlrpc 2017-04-12 19:10:14 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2017:0884