Bug 1932638 - Removing ssh keys MC does not remove the key from authorized_keys
Summary: Removing ssh keys MC does not remove the key from authorized_keys
Keywords:
Status: ASSIGNED
Alias: None
Product: OpenShift Container Platform
Classification: Red Hat
Component: Machine Config Operator
Version: 4.5
Hardware: Unspecified
OS: Unspecified
high
high
Target Milestone: ---
: 4.7.z
Assignee: Kirsten Garrison
QA Contact: Michael Nguyen
URL:
Whiteboard:
Depends On: 1885186
Blocks:
TreeView+ depends on / blocked
 
Reported: 2021-02-24 19:59 UTC by OpenShift BugZilla Robot
Modified: 2021-05-11 07:01 UTC (History)
3 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed:
Target Upstream Version:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Github openshift machine-config-operator pull 2430 0 None closed [release-4.7] Bug 1932638: handle Passwd.Users removal more gracefully 2021-03-05 03:43:18 UTC

Comment 3 sunzhaohua 2021-03-08 07:13:29 UTC
Failed to verify, after deleting 99-worker-ssh, mcp worker is degraded.

# oc get clusterversion
NAME      VERSION   AVAILABLE   PROGRESSING   SINCE   STATUS
version   4.7.1     True        False         21m     Cluster version is 4.7.1

# oc debug node/ip-10-0-214-42.us-east-2.compute.internal
Starting pod/ip-10-0-214-42us-east-2computeinternal-debug ...
To use host binaries, run `chroot /host`
Pod IP: 10.0.214.42
If you don't see a command prompt, try pressing enter.
sh-4.4# chroot /host
sh-4.4# cat /home/core/.ssh/authorized_keys
s21s21s21s21s21s21s21s21s21s21s21s21s21

# oc delete machineconfig 99-worker-ssh
machineconfig.machineconfiguration.openshift.io "99-worker-ssh" deleted

# oc get mcp
NAME     CONFIG                                             UPDATED   UPDATING   DEGRADED   MACHINECOUNT   READYMACHINECOUNT   UPDATEDMACHINECOUNT   DEGRADEDMACHINECOUNT   AGE
master   rendered-master-92e7d8bd8c6fce916cc2ff99d3d975bf   True      False      False      3              3                   3                     0                      3h24m
worker   rendered-worker-0597fe0c563d2fbf33f736f96403dc3f   False     True       True       3              0                   0                     1                      3h24m

# oc get mcp worker -o yaml
  - lastTransitionTime: "2021-03-08T04:32:59Z"
    message: 'Node ip-10-0-151-59.us-east-2.compute.internal is reporting: "can''t
      reconcile config rendered-worker-0597fe0c563d2fbf33f736f96403dc3f with rendered-worker-f57d57f3e1ba42cb7e33844e388dc321:
      ignition passwd user section contains unsupported changes: user core may not
      be deleted: unreconcilable"'
    reason: 1 nodes are reporting degraded status on sync
    status: "True"
    type: NodeDegraded


Note You need to log in before you can comment on or make changes to this bug.