Bug 2103969
| Summary: | [RHOSP 17.0] Ceilometer can't read /run/libvirt resulting in no 'cpu' metrics | |||
|---|---|---|---|---|
| Product: | Red Hat OpenStack | Reporter: | Leif Madsen <lmadsen> | |
| Component: | openstack-tripleo-heat-templates | Assignee: | Leif Madsen <lmadsen> | |
| Status: | CLOSED ERRATA | QA Contact: | Leonid Natapov <lnatapov> | |
| Severity: | high | Docs Contact: | mgeary <mgeary> | |
| Priority: | medium | |||
| Version: | 17.0 (Wallaby) | CC: | jschluet, mburns, ykulkarn | |
| Target Milestone: | z1 | Keywords: | Triaged, ZStream | |
| Target Release: | 17.0 | |||
| Hardware: | Unspecified | |||
| OS: | Unspecified | |||
| Whiteboard: | ||||
| Fixed In Version: | openstack-tripleo-heat-templates-14.3.1-0.20221102130639.feca772.el9ost | Doc Type: | Bug Fix | |
| Doc Text: |
Cause: Improper volume mount to /run/libvirt in the ceilometer-agent-compute container.
Consequence: The ceilometer-agent-compute can not read the /run/libvirt directory resulting in an inability to poll for CPU metrics on compute nodes.
Fix: The appropriate global permissions have been applied to /run/libvirt directory.
Result: It is now possible to poll for CPU telemetry with ceilometer-agent-compute container on the compute nodes, resulting in CPU telemetry data via the compute service (nova).
|
Story Points: | --- | |
| Clone Of: | 2103964 | |||
| : | 2103970 (view as bug list) | Environment: | ||
| Last Closed: | 2023-01-25 12:28:50 UTC | Type: | --- | |
| Regression: | --- | Mount Type: | --- | |
| Documentation: | --- | CRM: | ||
| Verified Versions: | Category: | --- | ||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | ||
| Cloudforms Team: | --- | Target Upstream Version: | ||
| Embargoed: | ||||
| Bug Depends On: | 2103964, 2122656 | |||
| Bug Blocks: | 2103970, 2103971 | |||
Upstream change after further testing by Yadnesh, Leonid, and myself has been proposed at https://review.opendev.org/c/openstack/tripleo-heat-templates/+/854421 Once merged, will begin the backport process for both upstream and downstream. New target to have this resolved is now RHOSP 17.0 z1 with a Known Issue release note being added here to inform others of this issue. Once merged to master upstream is completed, I will begin the process of backporting the fix to 17.0, 16.2, and 16.1 for their next respective releases. Per discussion on IRC with Takashi and others, it looks like there is some work that would happen outside of ceilometer-agent-compute itself to allow the proper SELinux permissions and access to the files required without triggering a full relabel of the path via the 'z' flag for the bind mount of the containers volume. Tracking dependency for this issue is now at https://bugzilla.redhat.com/show_bug.cgi?id=2122656 and I will likely abandon my change request. I will likely want to revert the change upstream from 'shared' to 'ro' but I will check with others before proposing. No permission denied errors. from ceilometer-agent-compute-container-puppet.yaml - /run/libvirt:/run/libvirt:shared,z Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory (Red Hat OpenStack Platform 17.0.1 bug fix and enhancement advisory), and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2023:0271 |
I am moving this bug back to assign because we found out that selinux prevents reading /run/libvirt. See the log bellow. A new fix would add "z" option to the original "ro". type=AVC msg=audit(1661320143.727:562520): avc: denied { write } for pid=669402 comm="ceilometer-poll" name="virtqemud-sock-ro" dev="tmpfs" ino=93846 scontext=system_u:system_r:container_t:s0:c526,c1012 tcontext=system_u:object_r:virt_var_run_t:s0 tclass=sock_file permissive=0