Bug 1450286
| Summary: | docker-registry and router deployments failed due to serviceaccount not found while using docker system container in containerized installation | ||
|---|---|---|---|
| Product: | OpenShift Container Platform | Reporter: | Gan Huang <ghuang> |
| Component: | Installer | Assignee: | Steve Milner <smilner> |
| Status: | CLOSED ERRATA | QA Contact: | Gan Huang <ghuang> |
| Severity: | high | Docs Contact: | |
| Priority: | medium | ||
| Version: | 3.6.0 | CC: | aos-bugs, gscrivan, jokerman, mmccomas |
| Target Milestone: | --- | ||
| Target Release: | --- | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | If docs needed, set a value | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2017-08-10 05:23:08 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 1450307 | ||
| Bug Blocks: | |||
|
Description
Gan Huang
2017-05-12 07:34:17 UTC
Adding gscrivan as this may be related to the underlying container. PR for adding /var/run into the system container: https://github.com/projectatomic/atomic-system-containers/pull/67 Handing this over to Giuseppe for merging and verification. To clarify, the container-engine service doesn't cause this problem when the rest of the install is not containerized, correct? (IE: containerized=false) I am trying to replicate it here, in the meanwhile could you try to replace "-v /run:/run" in the systemd unit file for the node container to "-v /run:/run -v /var/run/secrets:/var/run/secrets:rbind", restart the service and see if it works? To give some more background, Giuseppe believes that this is a an issue with the openshift.docker.node.service file. It's currently mounting with "/run:/run". The /var/run/secrets directory is mounted as a tmpfs and is not propagated which could be the issue. The belief is by specifying "-v /var/run/secrets:/var/run/secrets:rbind" the file system should become available. I could reproduce it here and I could see that `openshift.docker.gte_1_10` is not properly set when using the Docker container.
It results in losing `:rslave` in "-v {{ openshift.common.data_dir }}:{{ openshift.common.data_dir }}{{ ':rslave' if openshift.docker.gte_1_10 | default(False) | bool else '' }}" in the roles/openshift_node/templates/openshift.docker.node.service file.
I've tried to manually set ':rslave' and it solves the reported issue.
Giuseppe: PTAL https://github.com/openshift/openshift-ansible/pull/4184 PR merged. Verified with openshift-ansible-3.6.98-1.git.0.e651d65.el7.noarch.rpm atomic-1.17.2-4.git2760e30.el7.x86_64 runc-1.0.0-6.gite800860.el7.x86_64 # atomic -v 1.17.1 # runc -v runc version 1.0.0-rc3 commit: cafb8d8755dc2b990fc73fbf7bff62f534da9219-dirty spec: 1.0.0-rc5 # docker version Client: Version: 1.12.6 API version: 1.24 Package version: docker-1.12.6-28.git1398f24.el7.x86_64 Go version: go1.7.4 Git commit: 1398f24/1.12.6 Built: Wed May 17 01:16:44 2017 OS/Arch: linux/amd64 Server: Version: 1.12.6 API version: 1.24 Package version: docker-1.12.6-31.git3a6eaeb.el7.x86_64 Go version: go1.7.6 Git commit: 3a6eaeb/1.12.6 Built: Tue Jun 6 12:45:07 2017 OS/Arch: linux/amd64 Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHEA-2017:1716 |