Bug 1634158 - With --selinux-enabled in docker, Portworx shared volumes are mounting are tmpfs in the container
Summary: With --selinux-enabled in docker, Portworx shared volumes are mounting are tm...
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: OpenShift Container Platform
Classification: Red Hat
Component: Storage
Version: 3.9.0
Hardware: All
OS: Unspecified
unspecified
medium
Target Milestone: ---
: 3.9.z
Assignee: Matthew Wong
QA Contact: Liang Xia
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2018-09-28 20:17 UTC by Harsh Desai
Modified: 2019-02-20 08:47 UTC (History)
5 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2019-02-20 08:46:56 UTC
Target Upstream Version:


Attachments (Terms of Use)


Links
System ID Priority Status Summary Last Updated
Github 58646 None None None 2018-09-28 20:17:36 UTC
Red Hat Product Errata RHBA-2019:0331 None None None 2019-02-20 08:47:02 UTC

Description Harsh Desai 2018-09-28 20:17:36 UTC
Description of problem:

Version-Release number of selected component (if applicable): Openshift 3.7.0, 3.8.0 and 3.9.0

How reproducible:

Steps to Reproduce:
1. Deploy Openshift 3.9 (Keep --selinux-enabled in docker startup arguments)
2. Deploy Portworx (https://docs.portworx.com/scheduler/kubernetes/openshift-install.html). Add env variable: ENABLE_SHARED_AND_SHARED_v4: true in the daemonset.
3. Create a shared PX PVC and get a pod to use it (https://docs.portworx.com/scheduler/kubernetes/shared-volumes.html). In the StorageClass, use "sharedv4: true".

Actual results:

On all but 1 pods, they volume is mounted at tmpfs. This is because Portworx sharedv4 volumes are based off NFS which doesn't support selinux.

Expected results:

All pods should have the PVC mounted as a PX volume instead of tmpfs.

Master Log:

Node Log (of failed PODs):

PV Dump:

PVC Dump:
kind: PersistentVolumeClaim
apiVersion: v1
metadata:
   name: px-shared-pvc
   annotations:
     volume.beta.kubernetes.io/storage-class: px-shared-sc
spec:
   accessModes:
     - ReadWriteMany
   resources:
     requests:
       storage: 10Gi

StorageClass Dump (if StorageClass used by PV/PVC):
kind: StorageClass
apiVersion: storage.k8s.io/v1beta1
metadata:
    name: px-shared-sc
provisioner: kubernetes.io/portworx-volume
parameters:
   repl: "3"
   sharedv4: "true"


Additional info:

Just start any deployment greater than or equal to replica 2 using above PVC.

Portworx has issued to fix to Kubernetes to fix this. Openshift needs to take in these fixes.

https://github.com/kubernetes/kubernetes/pull/58646 (master)
https://github.com/kubernetes/kubernetes/pull/69228 (1.12)
https://github.com/kubernetes/kubernetes/pull/69229 (1.11)
https://github.com/kubernetes/kubernetes/pull/69230 (1.10)
https://github.com/kubernetes/kubernetes/pull/69231 (1.9)

Comment 1 Harsh Desai 2018-09-28 20:19:34 UTC
This bug is to track when the above PR's get merged into an Openshift release.

Comment 5 Wenqi He 2019-02-11 09:34:37 UTC
Checked on below version:
openshift v3.9.68
kubernetes v1.9.1+a0ce1bc657

This PR has already merged to latest 3.9 package.

Comment 7 errata-xmlrpc 2019-02-20 08:46:56 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2019:0331


Note You need to log in before you can comment on or make changes to this bug.