Description of problem: When we enable internal tls[1], we have the following independent docker containers to terminate tls, and we have httpd running in these containers. neutron_server_tls_proxy glance_api_tls_proxy redis_tls_proxy [1] https://access.redhat.com/documentation/en-us/red_hat_openstack_platform/13/html/advanced_overcloud_customization/sect-enabling_internal_ssltls_on_the_overcloud However, these docker containers does not have bind related to log directories, and we have log files inside docker container. As we don't have any rotation mechanism inside docker container, this can cause filesystem grows and can affect services running on the node How reproducible: Always Steps to Reproduce: 1. Deploy overcloud with internal tls enabled 2. See docker container setup for tls_proxy containers by `docker inspect <container name>` 3. See lsof -p <pid of httpd> Actual results: tls_proxy containers does not have bind related to log directory, and httpd is writing into log file inside container Expected results: tls_proxy containers has bind related to log directory, and httpd is writing into log file on host Additional info:
Bind seen for httpd in both sudo docker inspect neutron_server_tls_proxy and sudo docker inspect glance_api_tls_proxy: "/var/log/containers/httpd/neutron-api:/var/log/httpd" bind was not seen for: sudo docker inspect redis_tls_proxy. Asked question in e-mail about that and response was: Redis logs are provided via the journal, and are already available.
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2020:0760