Bug 1464012 - Browser freezes with unresponsive script warning on build pod page
Browser freezes with unresponsive script warning on build pod page
Status: CLOSED ERRATA
Product: OpenShift Container Platform
Classification: Red Hat
Component: Auth (Show other bugs)
3.6.0
Unspecified Unspecified
unspecified Severity medium
: ---
: ---
Assigned To: David Eads
Eduard Trott
:
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2017-06-22 05:34 EDT by Eduard Trott
Modified: 2017-08-16 15 EDT (History)
7 users (show)

See Also:
Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2017-08-10 01:28:56 EDT
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)
unresponsive script on build pod page (135.98 KB, image/png)
2017-06-22 05:34 EDT, Eduard Trott
no flags Details

  None (edit)
Description Eduard Trott 2017-06-22 05:34:46 EDT
Created attachment 1290585 [details]
unresponsive script on build pod page

Description of problem:
Page with pod in terminating state freeze browser

Version-Release number of selected component (if applicable):
v3.6.121

Firefox version:
50.1.0

How reproducible:
Always

Steps to Reproduce:
1. Create nodejs application from catalog with "Try sample repo" source
2. Wait until all resources are created
3. Delete nodejs build pod on web page
4. Go to nodejs build pod page

Actual results:
The pod is in terminating state. Page becomes unresponsive and Firefox freezes(after some time popup window appears with option to stop the script, see attachment)

Expected results:
UI works well

Additional info:
The problem only happens when: pod is "build pod" and pod is deleted through web.
Other pods deleted though web, or build pod deleted in oc, don't have this problem
Comment 1 Samuel Padgett 2017-06-22 08:58:37 EDT
Looks like we're getting spammed with watch updates. I see this error in the logs, which might be the cause.


E0622 12:55:15.552128   12295 garbagecollector.go:167] Error syncing item &garbagecollector.node{identity:garbagecollector.objectReference{OwnerReference:v1.OwnerReference{APIVersion:"v1", Kind:"Pod", Name:"nodejs-ex-2-build", UID:"7cc85b03-5748-11e7-aed8-9e0e2b8a4114", Controller:(*bool)(nil), BlockOwnerDeletion:(*bool)(nil)}, Namespace:"delete-build-pod"}, dependentsLock:sync.RWMutex{w:sync.Mutex{state:0, sema:0x0}, writerSem:0x0, readerSem:0x0, readerCount:0, readerWait:0}, dependents:map[*garbagecollector.node]struct {}{}, deletingDependents:true, deletingDependentsLock:sync.RWMutex{w:sync.Mutex{state:0, sema:0x0}, writerSem:0x0, readerSem:0x0, readerCount:0, readerWait:0}, beingDeleted:true, beingDeletedLock:sync.RWMutex{w:sync.Mutex{state:0, sema:0x0}, writerSem:0x0, readerSem:0x0, readerCount:0, readerWait:0}, owners:[]v1.OwnerReference{v1.OwnerReference{APIVersion:"build.openshift.io/v1", Kind:"Build", Name:"nodejs-ex-2", UID:"7cc533f5-5748-11e7-aed8-9e0e2b8a4114", Controller:(*bool)(0xc4366d34d0), BlockOwnerDeletion:(*bool)(nil)}}}: pods "nodejs-ex-2-build" is forbidden: unable to validate against any security context constraint: [provider restricted: .spec.containers[0].securityContext.privileged: Invalid value: true: Privileged containers are not allowed provider restricted: .spec.containers[0].securityContext.volumes[0]: Invalid value: "hostPath": hostPath volumes are not allowed to be used]
Comment 2 Samuel Padgett 2017-06-22 09:18:21 EDT
This is likely fixed by https://github.com/openshift/origin/pull/14816
Comment 3 Jessica Forrester 2017-06-23 12:34:32 EDT
PR linked in comment 2 did not resolve the issue
Comment 4 Jessica Forrester 2017-06-23 12:35:36 EDT
The issue is not web console specific, it occurs if the build pod is deleted with Foreground propagationPolicy
Comment 5 Jessica Forrester 2017-06-23 12:41:34 EDT
The suspicion is that this is somehow related to SCCs in combination with garbage collection.  Sending to Build component for the moment to help narrow down what about the build pod might be triggering this.
Comment 6 Samuel Padgett 2017-06-23 12:52:43 EDT
This affects web console performance of other pages that watch pods like the overview.
Comment 7 Jessica Forrester 2017-06-23 12:55:38 EDT
Easily reproducible with a simple pod example that uses SCC

apiVersion: v1
kind: Pod
metadata:
  annotations:
    openshift.io/scc: privileged
  name: test-build-pod-issue
spec:
  containers:
  - image: openshift/hello-openshift
    imagePullPolicy: IfNotPresent
    name: hello
    securityContext:
      privileged: true
  restartPolicy: Never


1) Have a user with privileged SCC create the pod in a project.
2) Have a user without privileged SCC but with pod DELETE rights, delete the pod with Foreground propagationPolicy

Pod will be stuck in Terminating.
Comment 8 Jessica Forrester 2017-06-23 12:57:47 EDT
Clearly an SCC+GC issue so will go ahead and transfer to @deads
Comment 9 David Eads 2017-06-23 14:06:35 EDT
https://github.com/openshift/origin/pull/14867
Comment 10 David Eads 2017-06-28 08:36:44 EDT
That pull merged.

@eparis POST is the correct status?
Comment 11 Eric Paris 2017-06-28 09:10:23 EDT
POST means you posted a PR for review.
MODIFIED means the actual code base has been modified to fix this issue.
Comment 13 Eduard Trott 2017-06-29 04:10:26 EDT
Issue fixed in v3.6.126.1
Comment 15 errata-xmlrpc 2017-08-10 01:28:56 EDT
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHEA-2017:1716

Note You need to log in before you can comment on or make changes to this bug.