Bug 1638398
| Summary: | overcloud nodes have incorrect hostname - OC deploy fails on pacemaker/corosync | ||
|---|---|---|---|
| Product: | Red Hat OpenStack | Reporter: | Pavel Sedlák <psedlak> |
| Component: | diskimage-builder | Assignee: | Bob Fournier <bfournie> |
| Status: | CLOSED ERRATA | QA Contact: | Arik Chernetsky <achernet> |
| Severity: | high | Docs Contact: | |
| Priority: | high | ||
| Version: | 10.0 (Newton) | CC: | aschultz, bfournie, dsneddon, hjensas, jschluet, majopela, mburns, michele, mschuppe, owalsh, psedlak, slinaber |
| Target Milestone: | --- | Keywords: | Triaged, ZStream |
| Target Release: | 10.0 (Newton) | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | diskimage-builder-1.26.1-4.el7ost | Doc Type: | If docs needed, set a value |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2018-11-26 18:00:40 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
|
Description
Pavel Sedlák
2018-10-11 13:18:28 UTC
On compute-0 (which has same issue, i've already modified controller so cannot inspect it anymore), there are few AVC denials possibly related:
> type=AVC msg=audit(1539106775.354:36): avc: denied { read } for pid=3599 comm="NetworkManager" name="dhclient-eth0.pid" dev="tmpfs" ino=30701 scontext=system_u:system_r:NetworkManager_t:s0 tcontext=system_u:object_r:var_run_t:s0 tclass=file permissive=0
> type=AVC msg=audit(1539106775.361:37): avc: denied { read } for pid=3599 comm="NetworkManager" name="dhclient-eth1.pid" dev="tmpfs" ino=33456 scontext=system_u:system_r:NetworkManager_t:s0 tcontext=system_u:object_r:var_run_t:s0 tclass=file permissive=0
> type=AVC msg=audit(1539106775.365:38): avc: denied { read } for pid=3599 comm="NetworkManager" name="dhclient-eth2.pid" dev="tmpfs" ino=31671 scontext=system_u:system_r:NetworkManager_t:s0 tcontext=system_u:object_r:var_run_t:s0 tclass=file permissive=0
> type=AVC msg=audit(1539106775.373:41): avc: denied { read } for pid=3670 comm="dhclient" name="dhclient-eth0.pid" dev="tmpfs" ino=30701 scontext=system_u:system_r:dhcpc_t:s0 tcontext=system_u:object_r:var_run_t:s0 tclass=file permissive=0
> type=AVC msg=audit(1539106775.373:42): avc: denied { read } for pid=3674 comm="dhclient" name="dhclient-eth1.pid" dev="tmpfs" ino=33456 scontext=system_u:system_r:dhcpc_t:s0 tcontext=system_u:object_r:var_run_t:s0 tclass=file permissive=0
> type=AVC msg=audit(1539106775.373:43): avc: denied { write } for pid=3674 comm="dhclient" name="dhclient-eth1.pid" dev="tmpfs" ino=33456 scontext=system_u:system_r:dhcpc_t:s0 tcontext=system_u:object_r:var_run_t:s0 tclass=file permissive=0
> type=AVC msg=audit(1539106775.373:44): avc: denied { write } for pid=3670 comm="dhclient" name="dhclient-eth0.pid" dev="tmpfs" ino=30701 scontext=system_u:system_r:dhcpc_t:s0 tcontext=system_u:object_r:var_run_t:s0 tclass=file permissive=0
> type=AVC msg=audit(1539106775.380:45): avc: denied { read } for pid=3678 comm="dhclient" name="dhclient-eth2.pid" dev="tmpfs" ino=31671 scontext=system_u:system_r:dhcpc_t:s0 tcontext=system_u:object_r:var_run_t:s0 tclass=file permissive=0
> type=AVC msg=audit(1539106775.380:46): avc: denied { write } for pid=3678 comm="dhclient" name="dhclient-eth2.pid" dev="tmpfs" ino=31671 scontext=system_u:system_r:dhcpc_t:s0 tcontext=system_u:object_r:var_run_t:s0 tclass=file permissive=0
> type=AVC msg=audit(1539106775.391:47): avc: denied { write } for pid=3670 comm="dhclient" name="dhclient-eth0.pid" dev="tmpfs" ino=30701 scontext=system_u:system_r:dhcpc_t:s0 tcontext=system_u:object_r:var_run_t:s0 tclass=file permissive=0
> type=AVC msg=audit(1539106775.391:48): avc: denied { write } for pid=3674 comm="dhclient" name="dhclient-eth1.pid" dev="tmpfs" ino=33456 scontext=system_u:system_r:dhcpc_t:s0 tcontext=system_u:object_r:var_run_t:s0 tclass=file permissive=0
> type=AVC msg=audit(1539106775.398:49): avc: denied { write } for pid=3678 comm="dhclient" name="dhclient-eth2.pid" dev="tmpfs" ino=31671 scontext=system_u:system_r:dhcpc_t:s0 tcontext=system_u:object_r:var_run_t:s0 tclass=file permissive=0
> type=AVC msg=audit(1539106775.413:50): avc: denied { write } for pid=3674 comm="dhclient" name="dhclient-eth1.pid" dev="tmpfs" ino=33456 scontext=system_u:system_r:dhcpc_t:s0 tcontext=system_u:object_r:var_run_t:s0 tclass=file permissive=0
> type=AVC msg=audit(1539106775.416:51): avc: denied { write } for pid=3670 comm="dhclient" name="dhclient-eth0.pid" dev="tmpfs" ino=30701 scontext=system_u:system_r:dhcpc_t:s0 tcontext=system_u:object_r:var_run_t:s0 tclass=file permissive=0
> type=AVC msg=audit(1539106775.433:52): avc: denied { write } for pid=3678 comm="dhclient" name="dhclient-eth2.pid" dev="tmpfs" ino=31671 scontext=system_u:system_r:dhcpc_t:s0 tcontext=system_u:object_r:var_run_t:s0 tclass=file permissive=0
> type=AVC msg=audit(1539106792.039:112): avc: denied { unlink } for pid=3599 comm="NetworkManager" name="dhclient-eth2.pid" dev="tmpfs" ino=31671 scontext=system_u:system_r:NetworkManager_t:s0 tcontext=system_u:object_r:var_run_t:s0 tclass=file permissive=0
> type=AVC msg=audit(1539106792.171:114): avc: denied { unlink } for pid=3599 comm="NetworkManager" name="dhclient-eth1.pid" dev="tmpfs" ino=33456 scontext=system_u:system_r:NetworkManager_t:s0 tcontext=system_u:object_r:var_run_t:s0 tclass=file permissive=0
> type=AVC msg=audit(1539106792.293:115): avc: denied { unlink } for pid=3599 comm="NetworkManager" name="dhclient-eth0.pid" dev="tmpfs" ino=30701 scontext=system_u:system_r:NetworkManager_t:s0 tcontext=system_u:object_r:var_run_t:s0 tclass=file permissive=0
Selinux issue may not be related, seems similar was already seen once in past without affecting functionality as reported in bug 1390011. So the recommended fix is to backport https://review.openstack.org/#/c/416664/ to OSP-10, is that correct? https://review.openstack.org/#/c/490962/ does not need to be backported? Has anyone done the backport yet? If not I will do it (In reply to Bob Fournier from comment #24) > So the recommended fix is to backport > https://review.openstack.org/#/c/416664/ to OSP-10, is that correct? > https://review.openstack.org/#/c/490962/ does not need to be backported? We have only tested with both patches: diff -urN diskimage-builder-osp10/elements/dhcp-all-interfaces/install.d/dhcp-interface@.service diskimage-builder-osp13/diskimage_builder/elements/dhcp-all-interfaces/install.d/dhcp-interface@.service --- diskimage-builder-osp10/elements/dhcp-all-interfaces/install.d/dhcp-interface@.service 2018-10-23 14:04:13.351476911 +0200 +++ diskimage-builder-osp13/diskimage_builder/elements/dhcp-all-interfaces/install.d/dhcp-interface@.service 2018-10-23 14:04:34.473701409 +0200 @@ -1,7 +1,15 @@ [Unit] Description=DHCP interface %i -Before=network-pre.target -Wants=network-pre.target +# We want to run after network.target so it doesn't try to bring +# up the interfaces a second time, but network-online should not +# be reached until after we've brought up the interfaces. +# We also need to break the default dependencies which prevents +# this from operating on Ubuntu/Debian as the unit gets stuck +# into a cyclical dependency loop. +DefaultDependencies=no +After=network.target +Before=network-online.target +Wants=network-online.target OK. As they are patches in same area of code I will backport the first (https://review.openstack.org/#/c/416664/) then the second (https://review.openstack.org/#/c/490962/). In /var/log/messages on controller-0 and compute-0 it looks like the same issue with hostnames using the IP, e.g. on controller: Oct 25 14:57:24 host-192-168-24-18 kernel: Initializing cgroup subsys cpuset Oct 25 14:57:24 host-192-168-24-18 kernel: Initializing cgroup subsys cpu Oct 25 14:57:24 host-192-168-24-18 kernel: Initializing cgroup subsys cpuacct and on compute: Oct 25 14:57:23 host-192-168-24-11 kernel: Initializing cgroup subsys cpuset Oct 25 14:57:23 host-192-168-24-11 kernel: Initializing cgroup subsys cpu Oct 25 14:57:23 host-192-168-24-11 kernel: Initializing cgroup subsys cpuacct Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2018:3674 |