Bug 1420541 - Unable to set Supplemental Groups or fsGroup for the registry via the command line. [NEEDINFO]
Summary: Unable to set Supplemental Groups or fsGroup for the registry via the command...
Keywords:
Status: CLOSED DEFERRED
Alias: None
Product: OpenShift Container Platform
Classification: Red Hat
Component: RFE
Version: 3.4.0
Hardware: Unspecified
OS: Unspecified
medium
high
Target Milestone: ---
: ---
Assignee: Michal Fojtik
QA Contact: ge liu
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2017-02-08 22:50 UTC by Ryan Howe
Modified: 2020-03-11 15:46 UTC (History)
10 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2018-03-12 13:54:36 UTC
Target Upstream Version:
erich: needinfo? (mfojtik)


Attachments (Terms of Use)

Description Ryan Howe 2017-02-08 22:50:43 UTC
Description of problem:

There is not easy way with via the registry deployer to set Supplemental Groups or fsGroup. These would need to be manually added after a deploy. In which case the registry would deploy fine but hit issues when getting images pushed because it does not have permissions to write to the PV that is attached. 

There needs to be an option via the `oadm registry` command so that an admin can set SupplementalGroups or fsGroup. This would also be needed so that the installer is able to deploy the registry with volumes that need this set. 

https://bugzilla.redhat.com/show_bug.cgi?id=1420526

Comment 1 Michal Fojtik 2017-04-07 13:46:07 UTC
PR: https://github.com/openshift/origin/pull/12951

Comment 2 Michal Fojtik 2017-04-24 08:52:12 UTC
The PR was merged, please see https://github.com/openshift/origin/pull/12951/files#diff-df3b6baf7e3b18ed4b1ff84012467504R189 for the new command line options for testing.

I will update the documentation shortly.

Comment 3 ge liu 2017-04-25 10:28:41 UTC
Tried to set '--supplemental-groups' successfully, but set '--fs-group' fails:

1). delete default installed registry

2). create registry and set 'fs-group' option:
 # oadm registry --fs-group=2000020000

the pods stay in deploying status for a long time, 

# oc get pods
NAME                       READY     STATUS    RESTARTS   AGE
docker-registry-1-deploy   1/1       Running   0          3m


check the pods details:

 securityContext:
    fsGroup: 1000030000
    seLinuxOptions:
      level: s0:c6,c0
  serviceAccount: deployer
  serviceAccountName: deployer
  terminationGracePeriodSeconds: 10


tried in two new installed env, and got same result.

Comment 7 Eric Rich 2018-03-12 13:54:36 UTC
This bug has been identified as a dated (created more than 3 months ago) bug. 
This bug has been triaged (has a trello card linked to it), or reviewed by Engineering/PM and has been put into the product backlog, 
however this bug has not been slated for a currently planned release (3.9, 3.10 or 3.11), which cover our releases for the rest of the calendar year. 

As a result of this bugs age, state on the current roadmap and PM Score (being below 70), this bug is being Closed - Differed, 
as it is currently not part of the products immediate priorities.

Please see: https://docs.google.com/document/d/1zdqF4rB3ea8GmVIZ7qWCVYUaQ7-EexUrQEF0MTwdDkw/edit for more details.


Note You need to log in before you can comment on or make changes to this bug.