Note: This bug is displayed in read-only format because the product is no longer active in Red Hat Bugzilla.

Bug 1782063

Summary:	4.1 and 4.2 AWS UPI CI fail with 'unknown flag: --allow-privileged' when used with 4.3 AMIs
Product:	OpenShift Container Platform	Reporter:	W. Trevor King <wking>
Component:	Test Infrastructure	Assignee:	Steve Kuznetsov <skuznets>
Status:	CLOSED CURRENTRELEASE	QA Contact:
Severity:	unspecified	Docs Contact:
Priority:	unspecified
Version:	4.1.z
Target Milestone:	---
Target Release:	4.4.0
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2020-05-15 00:26:20 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description W. Trevor King 2019-12-11 05:33:22 UTC

Because we're using 4.3 AMIs regardless of installer version today.  For example, this 4.2 proxy job [1] had a log tarball whose ./bootstrap/journals/kubelet.log showed crashlooping on:

  Dec 04 16:06:14 ip-10-0-4-179 hyperkube[2242]: F1204 16:06:14.652676    2242 server.go:154] unknown flag: --allow-privileged

The installer stopped setting --allow-privileged in [2], but that was never bacported to 4.2-.  Using a 4.2 AMI for 4.2 UPI would avoid the issue. You could probably get away with using a 4.2 AMI for 4.1 UPI if you wanted.

You could also avoid this issue by treating the bootimage (AMI) as a pivot-only image and pivoting the bootstrap machine to the release-references machine-os-content (like we do for cluster machines). That's getting kicked around in [3], but it's not what the installer does today (and certainly not in 4.1/4.2 today).

Like bug 1782062, the fix for this probably involves the coming multi-step implementation, e.g. [4].

[1]: https://prow.svc.ci.openshift.org/view/gcs/origin-ci-test/logs/release-openshift-ocp-installer-e2e-aws-proxy-4.2/220
[2]: https://github.com/openshift/installer/pull/2459
[3]: https://github.com/openshift/installer/issues/2542
[4]: https://github.com/openshift/ci-tools/pull/319

Comment 1 W. Trevor King 2019-12-11 05:37:34 UTC

This causes 100% failure for 4.2 proxy CI [1,2], for all jobs since [3].

[1]: https://search.svc.ci.openshift.org/chart?name=proxy-4.2&search=waiting%20for%20Kubernetes%20API:%20context%20deadline%20exceeded
[2]: https://testgrid.k8s.io/redhat-openshift-ocp-release-4.2-informing#release-openshift-ocp-installer-e2e-aws-proxy-4.2
[3]: https://prow.svc.ci.openshift.org/view/gcs/origin-ci-test/logs/release-openshift-ocp-installer-e2e-aws-proxy-4.2/218

Comment 4 Steve Kuznetsov 2020-05-15 00:26:20 UTC

This was fixed but is not something QE verifies.

Comment 5 W. Trevor King 2020-05-19 02:59:41 UTC

Not clear why I was set needinfo when the bug was closed.  If there's a specific ask from me, feel free to set it again.