Bug 1619672
| Summary: | After upgrade to OCP 3.9, existing Openshift nodes do not have the SELinux boolean container_manage_cgroup enabled, but new nodes added to the cluster have it enabled | ||
|---|---|---|---|
| Product: | OpenShift Container Platform | Reporter: | Sylvain Chen <sychen> |
| Component: | Cluster Version Operator | Assignee: | Michael Gugino <mgugino> |
| Status: | CLOSED ERRATA | QA Contact: | Weihua Meng <wmeng> |
| Severity: | medium | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | 3.9.0 | CC: | ansverma, aos-bugs, cshereme, jokerman, mgugino, mmccomas, scuppett, sdodson, smunilla, sychen |
| Target Milestone: | --- | Keywords: | Reopened |
| Target Release: | 3.9.z | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | If docs needed, set a value | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2018-12-13 19:27:05 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
|
Description
Sylvain Chen
2018-08-21 12:46:08 UTC
Please manually set the boolean on existing nodes as a workaround. (In reply to Scott Dodson from comment #1) > Please manually set the boolean on existing nodes as a workaround. Why wouldn't we fix this? Hello Team, We need to change the upgrade playbook to enable the "container_manage_cgroup" boolean. Also, we should add in the documentation the remark that there is this bug going on currently. Regards, Anshul Verma (In reply to Michael Gugino from comment #2) > (In reply to Scott Dodson from comment #1) > > Please manually set the boolean on existing nodes as a workaround. > > Why wouldn't we fix this? Because we didn't break it and the problem can be introduced entirely outside of the installer. You `yum upgrade` your selinux policy and now your cluster is broken without any involvement of openshift-ansible. If you have time to fix it in the upgrade go for it, please make sure it's addressed in 3.10 too. (In reply to Scott Dodson from comment #4) > (In reply to Michael Gugino from comment #2) > > (In reply to Scott Dodson from comment #1) > > > Please manually set the boolean on existing nodes as a workaround. > > > > Why wouldn't we fix this? > > Because we didn't break it and the problem can be introduced entirely > outside of the installer. You `yum upgrade` your selinux policy and now your > cluster is broken without any involvement of openshift-ansible. > > If you have time to fix it in the upgrade go for it, please make sure it's > addressed in 3.10 too. Yeah, we're in a tough spot. This seems like one of those problems that we have to be quite reactive to as it's certainly nothing the users are doing to break themselves other than properly patching their hosts (which should be encouraged). I will try to take this on. PR Created in master: https://github.com/openshift/openshift-ansible/pull/9824 In openshift-ansible-3.9.42-1 and later fixed. openshift-ansible-3.9.47-1.git.0.8180c87.el7.noarch before upgrade atomic-openshift version: v3.7.68 # getsebool -a | grep container_manage_cgroup container_manage_cgroup --> off after upgrade to 3.9 openshift v3.9.47 # getsebool container_manage_cgroup container_manage_cgroup --> on This value is consistent with v3.9 fresh install now. Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2018:3748 |