Bug 2133297 - [OSP17] Tripleo doesn't set the right permission to path "/home/stack/.tripleo/" during undercloud installation
Summary: [OSP17] Tripleo doesn't set the right permission to path "/home/stack/.triple...
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat OpenStack
Classification: Red Hat
Component: python-tripleoclient
Version: 17.0 (Wallaby)
Hardware: Unspecified
OS: Unspecified
medium
medium
Target Milestone: ga
: 17.1
Assignee: Takashi Kajinami
QA Contact: David Rosenfeld
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2022-10-09 17:37 UTC by Ravi Singh
Modified: 2023-08-16 01:13 UTC (History)
7 users (show)

Fixed In Version: python-tripleoclient-16.5.1-1.20230214000856.b780e6d.el9ost
Doc Type: Bug Fix
Doc Text:
Before this update, the `openstack undercloud install` command launched the `openstack tripleo deploy` command, which created the `/home/stack/.tripleo/history` file with `root:root` as the owner. Subsequent deploy commands failed because of permission errors. With this update, the command creates the file with the `stack` user as the owner, and deploy commands succeed without permission errors.
Clone Of:
Environment:
Last Closed: 2023-08-16 01:12:25 UTC
Target Upstream Version:
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
OpenStack gerrit 869310 0 None MERGED Make ~/.tripleo/history owned by the correct user 2023-03-22 03:14:03 UTC
Red Hat Issue Tracker OSP-19263 0 None None None 2022-10-09 17:41:55 UTC
Red Hat Product Errata RHEA-2023:4577 0 None None None 2023-08-16 01:13:03 UTC

Description Ravi Singh 2022-10-09 17:37:02 UTC
Description of problem:

Still observing permission issues as highlighted in https://bugzilla.redhat.com/show_bug.cgi?id=2058492



[stack@undercloud ~]$ openstack undercloud install
Unable to write into TripleO history file: /home/stack/.tripleo, [Errno 13] Permission denied: '/home/stack/.tripleo/history'

[stack@undercloud ~]$ ls -lrth /home/stack/.tripleo/history
-rw-r--r--. 1 root root 163 Oct  9 13:12 /home/stack/.tripleo/history

[stack@undercloud ~]$ rpm -q python3-tripleoclient
python3-tripleoclient-16.4.1-0.20220705111521.23dbe54.el9ost.noarch

Version-Release number of selected component (if applicable):
17.0

How reproducible:
Everytime

Steps to Reproduce:
1.Run undercloud install
2.
3.

Actual results:
installation failed

Expected results:
Should pass

Additional info:

Comment 1 James Slagle 2022-10-10 13:02:24 UTC
Can you be a bit more specific about how you hit this error? Were any tripleo commands run before the undercloud install? The steps to reproduce indicate you can't install the undercloud at all. 17.0 has undergone extensive testing, so I would like to understand better what happened in your environment to hit this error.

Comment 2 Ravi Singh 2022-10-18 05:47:39 UTC
I don't remember any extra commands executed apart from mentioned in official but unfortunately, my machine got re-provisioned & in the new setup, I am not able to reproduce this issue.

I will close this bug & will re-open if the issue encountered again.

Comment 3 yatanaka 2022-10-20 02:40:15 UTC
Hello, DFG:DF team,

I'm hitting the same error on my RHOSP 17.0 GA environment.
Our document[1] tell us to execute the following command with "sudo".

  [1]https://access.redhat.com/documentation/en-us/red_hat_openstack_platform/17.0/html/director_installation_and_usage/assembly_preparing-for-director-installation#proc_preparing-container-images_preparing-for-director-installation
  $ sudo openstack tripleo container image prepare default \
    --local-push-destination \
    --output-env-file containers-prepare-parameter.yaml

That's why the following file/directory are created with root owner.

  [stack@undercloud ~]$ ll -a
    :
  drwxr-xr-x. 2 root  root    21 Oct 20 10:59 .tripleo
    :
  -rw-r--r--. 1 root  root  1192 Oct 20 10:59 containers-prepare-parameter.yaml
    :

Therefore, "openstack undercloud install" fails due to permission issue.

  [stack@undercloud ~]$ openstack undercloud install
  Unable to write into TripleO history file: /home/stack/.tripleo, [Errno 13] Permission denied: '/home/stack/.tripleo/history'

I think there are three options to solve this issue.

  (1)Modify our document[1] to execute the following command after "sudo openstack tripleo container image prepare" as mentioned in Bug 2058492.
     $ sudo chown -R stack. /home/stack/.tripleo/

  (2)Modify python-tripleoclient to create /home/stack/.tripleo directory and subordinate files with 777 or 666 permissions

  (3)Remove "sudo" from our document[1].
     But I'm not sure if we can remove "sudo" safely from "openstack tripleo container image prepare" command.
     Upstream document[2] says that sudo is essential, but I succeeded to deploy RHOSP 17.0-beta without sudo as far as I tested before.
     [2]https://docs.openstack.org/project-deploy-guide/tripleo-docs/latest/deployment/container_image_prepare.html#running-container-image-prepare

Would you give me your thoughts?

Comment 4 Takashi Kajinami 2022-10-20 04:04:48 UTC
I think the problem here is that we honor SUDO_USER when locating the home directory
but do not honor it when creating files/directories under it.
So what we likely need is to make ~/.tripleo and ~/.tripleo/history owned by SUDO_USER
instead of root.

IIUC the fix for https://review.opendev.org/c/openstack/python-tripleoclient/+/847093 fixes
the owner but that happens AFTER the command attempts to modify the history file.

Comment 10 Lukas Svaty 2023-06-16 08:13:29 UTC
Bulk moving target milestone to GA after the release of Beta on 14th June '23.

Comment 17 errata-xmlrpc 2023-08-16 01:12:25 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (Release of components for Red Hat OpenStack Platform 17.1 (Wallaby)), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHEA-2023:4577


Note You need to log in before you can comment on or make changes to this bug.