Bug 2102004: pkg/controller/common/helpers: Explicitly set mode 0644#3226
Conversation
When da5184f (Move Ignition file generation to controller/common, fix Compression, 2022-04-29, openshift#3128) created the NewIgnFileBytes* helpers, the call-sites which had previously explicitly set file modes began leaving them unset. Updating from 4.10 to 4.11 and picking up da5184f, clusters which include ContainerRuntimeConfig (or possibly KubeletConfig) which flow through the NewIgnFileBytes* helpers would have rendered MachineConfig entries with null/unset mode values. While this is not a problem for Ignition v3 clients, where there is an explicit 0644 default: $ git clone --depth 1 --branch main https://github.com/coreos/ignition.git $ cd ignition $ git --no-pager log --oneline -1 7652b83 (grafted, HEAD -> main, origin/main, origin/HEAD) Merge pull request openshift#1409 from bgilbert/notes $ git --no-pager grep '_mode_.*file' docs docs/configuration-v3_0.md: * **_mode_** (integer): the file's permission mode. Note that the mode must be properly specified as a **decimal** value (i.e. 0644 -> 420). Setuid/setgid/sticky bits are not supported. If not specified, the permission mode for files defaults to 0644 or the existing file's permissions if `overwrite` is false, `contents.source` is unspecified, and a file already exists at the path. docs/configuration-v3_1.md: * **_mode_** (integer): the file's permission mode. Note that the mode must be properly specified as a **decimal** value (i.e. 0644 -> 420). Setuid/setgid/sticky bits are not supported. If not specified, the permission mode for files defaults to 0644 or the existing file's permissions if `overwrite` is false, `contents.source` is unspecified, and a file already exists at the path. docs/configuration-v3_2.md: * **_mode_** (integer): the file's permission mode. Note that the mode must be properly specified as a **decimal** value (i.e. 0644 -> 420). Setuid/setgid/sticky bits are not supported. If not specified, the permission mode for files defaults to 0644 or the existing file's permissions if `overwrite` is false, `contents.source` is unspecified, and a file already exists at the path. docs/configuration-v3_3.md: * **_mode_** (integer): the file's permission mode. Note that the mode must be properly specified as a **decimal** value (i.e. 0644 -> 420). Setuid/setgid/sticky bits are not supported. If not specified, the permission mode for files defaults to 0644 or the existing file's permissions if `overwrite` is false, `contents.source` is unspecified, and a file already exists at the path. docs/configuration-v3_4_experimental.md: * **_mode_** (integer): the file's permission mode. Note that the mode must be properly specified as a **decimal** value (i.e. 0644 -> 420). Setuid/setgid/sticky bits are supported. If not specified, the permission mode for files defaults to 0644 or the existing file's permissions if `overwrite` is false, `contents.source` is unspecified, and a file already exists at the path. it is a problem for Ignition v2 clients, where there is no such default: $ git clone --depth 1 --branch spec2x https://github.com/coreos/ignition.git $ cd ignition $ git --no-pager log --oneline -1 4db553d (grafted, HEAD -> spec2x, origin/spec2x) Merge pull request openshift#1067 from bgilbert/spec2y $ git --no-pager grep '_mode_.*file' doc doc/configuration-v2_0.md: * **_mode_** (integer): the file's permission mode. Note that the mode must be properly specified as a **decimal** value (i.e. 0644 -> 420). doc/configuration-v2_1.md: * **_mode_** (integer): the file's permission mode. Note that the mode must be properly specified as a **decimal** value (i.e. 0644 -> 420). doc/configuration-v2_2.md: * **_mode_** (integer): the file's permission mode. Note that the mode must be properly specified as a **decimal** value (i.e. 0644 -> 420). doc/configuration-v2_3.md: * **_mode_** (integer): the file's permission mode. Note that the mode must be properly specified as a **decimal** value (i.e. 0644 -> 420). doc/configuration-v2_4.md: * **_mode_** (integer): the file's permission mode. Note that the mode must be properly specified as a **decimal** value (i.e. 0644 -> 420). doc/configuration-v2_5-experimental.md: * **_mode_** (integer): the file's permission mode. Note that the mode must be properly specified as a **decimal** value (i.e. 0644 -> 420). There is also no in-cluster component responsible for updating boot image configuration, or even complaining about stale boot image configuration, in Machines or MachineSets. This causes problems when 4.10 clusters with older boot images (at least older than 4.6 [1], I haven't pinned down a specific version): 1. Cluster updates to 4.11. 2. Incoming machine-config operator renders fresh MachineConfig from any ContainerRuntimeConfig or KubeletConfig. 3. Those rendered MachineConfig contain null/unset modes. 4. A new Machine is created with the old Ignition v2 boot image. 5. The boot image Ignition lays down a file with mode 0, because Ignition v2 does not define a default mode. 6. The boot image pivots into the modern machine-os-content image. 7. The incoming (modern) machine-config daemon notices the mode 0 file, compares it with its Ignition-v3-like 0644 default mode, and complains with [2]: unexpected on-disk state validating against rendered-worker-44f2c74623e4d3bbe9557a9e82102c01: mode mismatch for file: "/etc/crio/crio.conf.d/01-ctrcfg-pidsLimit"; expected: -rw-r--r--/420/0644; received: ----------/0/0 Folks should probably update to more modern boot images, but this commit restores the explicit mode to avoid breaking on this mode-mismatch issue for folks who are still running Ignition v2 boot images. [1]: https://bugzilla.redhat.com/show_bug.cgi?id=2102004#c28 [2]: https://bugzilla.redhat.com/show_bug.cgi?id=2102004#c0
openshift-ci
Bot
added
bugzilla/severity-unspecified
|
@wking: This pull request references Bugzilla bug 2102004, which is invalid:
Comment DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
|
/bugzilla refresh |
openshift-ci
Bot
added
bugzilla/valid-bug
|
@wking: This pull request references Bugzilla bug 2102004, which is valid. The bug has been moved to the POST state. The bug has been updated to refer to the pull request using the external bug tracker. 3 validation(s) were run on this bug
Requesting review from QA contact: DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
|
I couldn't figure out the MachineSet incantation to test this end-to-end against OCP 4.5 / Ignition v2 boot images, but this confirms the smaller "we are now explicitly setting |
|
/bugzilla refresh |
openshift-ci
Bot
added
bugzilla/severity-high
|
@wking: This pull request references Bugzilla bug 2102004, which is valid. 3 validation(s) were run on this bug
Requesting review from QA contact: DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
|
@wking: all tests passed! Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here. |
yuqi-zhang
left a comment
yuqi-zhang
left a comment
There was a problem hiding this comment.
Very nice investigation! Thanks for the PR.
I think we should consider this a 4.11 release blocker and attempt to backport into 4.11.0 ASAP
|
/lgtm |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: wking, yuqi-zhang The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
openshift-ci
Bot
added
the
approved
|
@wking: All pull requests linked via external trackers have merged: Bugzilla bug 2102004 has been moved to the MODIFIED state. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
|
/cherry-pick release-4.11 |
|
@yuqi-zhang: new pull request created: #3232 DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
|
While I think this fix is correct, I also think a better fix would be changing the ignition spec 3 → spec 2 conversion logic to handle this instead. Then it'd apply everywhere, not even just in the MCO. |
Agreed, let's do so as a follow up. Since this already merged, I'll go ahead and push through the backport to unblock upgrades with this file |
|
Thanks Trevor for investigating and working on fix! |
5 participants
When da5184f (#3128) created the
NewIgnFileBytes*helpers, the call-sites which had previously explicitly set file modesbegan leaving them unset. Updating from 4.10 to 4.11 and picking up da5184f, clusters which include ContainerRuntimeConfig (or possibly KubeletConfig) which flow through the NewIgnFileBytes* helpers would have rendered MachineConfig entries with null/unset mode values.
While this is not a problem for Ignition v3 clients, where there is an explicit 0644 default:
it is a problem for Ignition v2 clients, where there is no such default:
There is also no in-cluster component responsible for updating boot image configuration, or even complaining about stale boot image configuration, in Machines or MachineSets. This causes problems when 4.10 clusters with older boot images (at least older than 4.6, I haven't pinned down a specific version):
Cluster updates to 4.11.
Incoming machine-config operator renders fresh MachineConfig from any ContainerRuntimeConfig or KubeletConfig.
Those rendered MachineConfig contain null/unset modes.
A new Machine is created with the old Ignition v2 boot image.
The boot image Ignition lays down a file with mode 0, because Ignition v2 does not define a default mode.
The boot image pivots into the modern machine-os-content image.
The incoming (modern) machine-config daemon notices the mode 0 file, compares it with its Ignition-v3-like 0644 default mode, and complains with:
Folks should probably update to more modern boot images, but this commit restores the explicit mode to avoid breaking on this mode-mismatch issue for folks who are still running Ignition v2 boot images.