Bug 1831307
| Summary: | Updating openstack-nova-common on the compute will break nova permissions in the containers | ||
|---|---|---|---|
| Product: | Red Hat OpenStack | Reporter: | David Vallee Delisle <dvd> |
| Component: | openstack-tripleo-heat-templates | Assignee: | Rajesh Tailor <ratailor> |
| Status: | CLOSED NOTABUG | QA Contact: | David Rosenfeld <drosenfe> |
| Severity: | high | Docs Contact: | |
| Priority: | high | ||
| Version: | 13.0 (Queens) | CC: | amodi, bschmaus, dasmith, dhill, eglynn, jhakimra, kchamart, lyarwood, mbooth, mburns, mschuppe, mwitt, ratailor, sbauza, sgordon, vromanso, yprokule |
| Target Milestone: | --- | Keywords: | Triaged |
| Target Release: | --- | ||
| Hardware: | Unspecified | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | If docs needed, set a value | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | 1656617 | Environment: | |
| Last Closed: | 2020-06-12 14:25:09 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 1656617 | ||
| Bug Blocks: | |||
|
Comment 3
Rajesh Tailor
2020-06-08 05:21:33 UTC
Hello Rajesh, Thanks for trying this. I believe I understand what happened. When I tried the update, I wanted to first try a simple yum update on one of the compute. No openstack packages were updated and that's because the rhel-7-server-openstack-13-rpms repo is disabled. This is a satellite deployed lab, and in my templates, I did have rhel-7-server-openstack-13-rpms in the list of enabled repos, so I suspect that tripleo disabled this repo itself during the initial deployment, or it's from infrared. For fun, I enabled the repo and reran the yum update. Since I had the packages on the node, and the repo was enabled, the packages were updated to the latest version, and indeed, the permissions on /var/lib/nova were reset to nova:nova instead of the nova container's nova user UID. I only have another compute on this environment, so instead of updating it with a plain yum update, I ran stack update on it. During the "update run", I see that the permission changed from 42436 to nova on the controllers, just like the customer had on his compute, but it doesn't matter because only nova-compute uses these folders. On the computes though, the nova packages are removed [1] before we proceed with the yum update, and the permissions [2] aren't altered. This behavior was introduced by this commit [a] to address this bug [b]. That's a good example why we need to run the updates through director. Closing this bug now. Thank you very much, DVD [a] https://review.opendev.org/#/c/628101/2 [b] https://bugzilla.redhat.com/show_bug.cgi?id=1656617 [1] ~~~ Jun 12 13:12:02 Updated: 2:docker-rhel-push-plugin-1.13.1-109.gitcccb291.el7_7.x86_64 Jun 12 13:12:02 Updated: 2:docker-common-1.13.1-109.gitcccb291.el7_7.x86_64 Jun 12 13:12:03 Updated: 2:docker-client-1.13.1-109.gitcccb291.el7_7.x86_64 Jun 12 13:12:05 Updated: 2:docker-1.13.1-109.gitcccb291.el7_7.x86_64 Jun 12 13:12:27 Erased: 1:openstack-nova-migration-17.0.13-2.el7ost.noarch Jun 12 13:12:27 Erased: 1:openstack-nova-compute-17.0.13-2.el7ost.noarch Jun 12 13:12:39 Erased: 1:openstack-nova-novncproxy-17.0.13-2.el7ost.noarch Jun 12 13:12:39 Erased: 1:openstack-nova-scheduler-17.0.13-2.el7ost.noarch Jun 12 13:12:39 Erased: 1:openstack-nova-placement-api-17.0.13-2.el7ost.noarch Jun 12 13:12:40 Erased: 1:openstack-nova-console-17.0.13-2.el7ost.noarch Jun 12 13:12:40 Erased: 1:openstack-nova-conductor-17.0.13-2.el7ost.noarch Jun 12 13:12:40 Erased: 1:openstack-nova-api-17.0.13-2.el7ost.noarch Jun 12 13:12:40 Erased: 1:openstack-nova-common-17.0.13-2.el7ost.noarch Jun 12 13:12:40 Erased: 1:python-nova-17.0.13-2.el7ost.noarch Jun 12 13:13:31 Updated: corosync-2.4.3-6.el7_7.1.x86_64 Jun 12 13:13:31 Updated: corosynclib-2.4.3-6.el7_7.1.x86_64 Jun 12 13:13:31 Updated: pacemaker-libs-1.1.20-5.el7_7.2.x86_64 Jun 12 13:13:32 Updated: pacemaker-cli-1.1.20-5.el7_7.2.x86_64 Jun 12 13:13:32 Updated: resource-agents-4.1.1-30.el7_7.4.x86_64 Jun 12 13:13:32 Updated: pacemaker-cluster-libs-1.1.20-5.el7_7.2.x86_64 Jun 12 13:13:32 Updated: pacemaker-1.1.20-5.el7_7.2.x86_64 Jun 12 13:13:32 Updated: clufter-common-0.77.1-1.el7.noarch Jun 12 13:13:32 Updated: clufter-bin-0.77.1-1.el7.x86_64 Jun 12 13:13:32 Updated: python-clufter-0.77.1-1.el7.noarch Jun 12 13:13:34 Updated: pcs-0.9.167-3.el7_7.1.x86_64 Jun 12 13:13:34 Updated: pacemaker-remote-1.1.20-5.el7_7.2.x86_64 Jun 12 13:13:34 Installed: 1:containers-common-0.1.37-3.el7.x86_64 Jun 12 13:13:34 Installed: python2-jmespath-0.9.0-6.el7_7.noarch Jun 12 13:13:34 Updated: python-semantic_version-2.4.2-2.el7.noarch Jun 12 13:13:34 Updated: 1:oci-systemd-hook-0.2.0-1.git05e6923.el7_6.x86_64 Jun 12 13:13:34 Updated: driverctl-0.108-1.el7_6.noarch Jun 12 13:13:34 Updated: 2:oci-umount-2.5-3.el7.x86_64 Jun 12 13:13:36 Updated: etcd-3.2.26-1.el7.x86_64 Jun 12 13:13:36 Updated: dpdk-18.11.2-1.el7.x86_64 Jun 12 13:13:36 Updated: 1:atomic-registries-1.22.1-29.gitb507039.el7.x86_64 Jun 12 13:13:36 Updated: python-websocket-client-0.56.0-3.git3c25814.el7.noarch Jun 12 13:13:48 Updated: 2:container-selinux-2.107-3.el7.noarch Jun 12 13:13:48 Updated: 1:python-docker-pycreds-0.3.0-11.el7.noarch Jun 12 13:13:48 Erased: 1:skopeo-containers-0.1.31-1.dev.gitae64ff7.el7.x86_64 Jun 12 13:13:48 Erased: python-jmespath-0.9.0-5.el7ost.noarch ~~~ [2] ~~~ [root@ess13z2-scpu-0 log]# ls -tlra /var/lib/nova/instances/ total 4 drwxr-xr-x. 5 nova nova 97 Feb 3 12:05 . drwxr-xr-x. 2 42436 42436 93 Jun 9 06:04 locks drwxr-xr-x. 2 42436 42436 54 Jun 9 06:04 _base drwxr-xr-x. 2 42436 42436 54 Jun 9 06:04 ffdb07b2-552d-4696-afb7-1f228e306b81 -rw-r--r--. 1 42436 42436 60 Jun 12 12:43 compute_nodes drwxr-xr-x. 3 42436 42436 23 Jun 12 13:12 .. ~~~ |