Bug 1415096 - [platformmanagement_public_626]openshift doesn't work if 'bindPassword file:xxx' with customer path:/non-default-path in master-config
Summary: [platformmanagement_public_626]openshift doesn't work if 'bindPassword file:x...
Alias: None
Product: OpenShift Container Platform
Classification: Red Hat
Component: apiserver-auth
Version: 3.4.1
Hardware: x86_64
OS: Linux
Target Milestone: ---
: ---
Assignee: Mo
QA Contact: Chuan Yu
Depends On:
TreeView+ depends on / blocked
Reported: 2017-01-20 09:05 UTC by ge liu
Modified: 2017-07-24 14:11 UTC (History)
8 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Last Closed: 2017-04-12 19:10:14 UTC
Target Upstream Version:

Attachments (Terms of Use)

System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2017:0884 0 normal SHIPPED_LIVE Red Hat OpenShift Container Platform 3.5 RPM Release Advisory 2017-04-12 22:50:07 UTC

Comment 1 Jordan Liggitt 2017-01-20 15:38:04 UTC
I cannot recreate the issue. Can you include the full error message:

oauthConfig.identityProvider[0].provider.bindPassword.file: Invalid value: "/tmp/bindpassword....

Does the user the openshift process is starting as have read permissions to /tmp/bindpassword.txt

Comment 7 ge liu 2017-01-26 07:13:14 UTC
@Mo, @Jordan:

The '/etc/origin/master/bindpassword.txt' is working well one and '/tmp/bindpassword.txt' doesn't work well for 'systemctl restart aotmic-openshift-master':

# ls -lahZ /tmp/bindpassword.txt 
-rw-r--r--. root root unconfined_u:object_r:user_tmp_t:s0 /tmp/bindpassword.txt

# ls -lahZ /etc/origin/master/bindpassword.txt 
-rw-r--r--. root root unconfined_u:object_r:etc_t:s0   /etc/origin/master/bindpassword.txt

# md5sum /tmp/bindpassword.txt
5f4dcc3b5aa765d61d8327deb882cf99  /tmp/bindpassword.txt
# md5sum /etc/origin/master/bindpassword.txt
5f4dcc3b5aa765d61d8327deb882cf99  /etc/origin/master/bindpassword.txt

Comment 8 Mo 2017-02-01 20:53:12 UTC
@Ge could you try using https://github.com/openshift/origin/pull/12761 ?

Comment 9 Mo 2017-02-01 23:39:36 UTC
@Ge that PR is merged now so the latest master should give better logging info.

Comment 10 ge liu 2017-02-03 03:23:34 UTC
Verified in openshift:

openshift v1.5.0-alpha.2+c4c0d9c-333
kubernetes v1.5.2+43a9be4
etcd 3.1.0

# ls -lahZ bindpassword.txt 
-rw-r--r--. root root unconfined_u:object_r:user_tmp_t:s0 bindpassword.txt
# ls -lahZ /root/openshift.local.config/master/bindpassword.txt
-rw-r--r--. root root unconfined_u:object_r:admin_home_t:s0 /root/openshift.local.config/master/bindpassword.txt

Comment 11 Mo 2017-02-03 03:35:37 UTC
@Ge new master logs please.

Comment 14 ge liu 2017-02-06 01:15:21 UTC
@Mo, I also read the logs before sent to u, and could not find the /tmp/bindpassword info even if I really used this in master-config.yaml file, but could find the login user: 'newton' info, I suppose you could find the critical infomation by reading log. I used the '--loglevel=5' when starting openshift, I'm not sure if it's enough. BTW, the difference between I filing the bug and verify it is: I filing the buy on ocp enc, so I could get the error msg by 'journalctl -l -u atomic-openshift-master',  and verify it on origin env and used 'openshift start' mode, so 'journalctl' could not find the righ service name for openshift, I can only get the master log by "openshift start xxxxx &> master.log", it there any idea for this situation?

Comment 16 errata-xmlrpc 2017-04-12 19:10:14 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.


Note You need to log in before you can comment on or make changes to this bug.