[release-4.11] Bug 2104561: pkg/controller/common/helpers: Explicitly set mode 0644#3232
Conversation
When da5184f (Move Ignition file generation to controller/common, fix Compression, 2022-04-29, openshift#3128) created the NewIgnFileBytes* helpers, the call-sites which had previously explicitly set file modes began leaving them unset. Updating from 4.10 to 4.11 and picking up da5184f, clusters which include ContainerRuntimeConfig (or possibly KubeletConfig) which flow through the NewIgnFileBytes* helpers would have rendered MachineConfig entries with null/unset mode values. While this is not a problem for Ignition v3 clients, where there is an explicit 0644 default: $ git clone --depth 1 --branch main https://github.com/coreos/ignition.git $ cd ignition $ git --no-pager log --oneline -1 7652b83 (grafted, HEAD -> main, origin/main, origin/HEAD) Merge pull request openshift#1409 from bgilbert/notes $ git --no-pager grep '_mode_.*file' docs docs/configuration-v3_0.md: * **_mode_** (integer): the file's permission mode. Note that the mode must be properly specified as a **decimal** value (i.e. 0644 -> 420). Setuid/setgid/sticky bits are not supported. If not specified, the permission mode for files defaults to 0644 or the existing file's permissions if `overwrite` is false, `contents.source` is unspecified, and a file already exists at the path. docs/configuration-v3_1.md: * **_mode_** (integer): the file's permission mode. Note that the mode must be properly specified as a **decimal** value (i.e. 0644 -> 420). Setuid/setgid/sticky bits are not supported. If not specified, the permission mode for files defaults to 0644 or the existing file's permissions if `overwrite` is false, `contents.source` is unspecified, and a file already exists at the path. docs/configuration-v3_2.md: * **_mode_** (integer): the file's permission mode. Note that the mode must be properly specified as a **decimal** value (i.e. 0644 -> 420). Setuid/setgid/sticky bits are not supported. If not specified, the permission mode for files defaults to 0644 or the existing file's permissions if `overwrite` is false, `contents.source` is unspecified, and a file already exists at the path. docs/configuration-v3_3.md: * **_mode_** (integer): the file's permission mode. Note that the mode must be properly specified as a **decimal** value (i.e. 0644 -> 420). Setuid/setgid/sticky bits are not supported. If not specified, the permission mode for files defaults to 0644 or the existing file's permissions if `overwrite` is false, `contents.source` is unspecified, and a file already exists at the path. docs/configuration-v3_4_experimental.md: * **_mode_** (integer): the file's permission mode. Note that the mode must be properly specified as a **decimal** value (i.e. 0644 -> 420). Setuid/setgid/sticky bits are supported. If not specified, the permission mode for files defaults to 0644 or the existing file's permissions if `overwrite` is false, `contents.source` is unspecified, and a file already exists at the path. it is a problem for Ignition v2 clients, where there is no such default: $ git clone --depth 1 --branch spec2x https://github.com/coreos/ignition.git $ cd ignition $ git --no-pager log --oneline -1 4db553d (grafted, HEAD -> spec2x, origin/spec2x) Merge pull request openshift#1067 from bgilbert/spec2y $ git --no-pager grep '_mode_.*file' doc doc/configuration-v2_0.md: * **_mode_** (integer): the file's permission mode. Note that the mode must be properly specified as a **decimal** value (i.e. 0644 -> 420). doc/configuration-v2_1.md: * **_mode_** (integer): the file's permission mode. Note that the mode must be properly specified as a **decimal** value (i.e. 0644 -> 420). doc/configuration-v2_2.md: * **_mode_** (integer): the file's permission mode. Note that the mode must be properly specified as a **decimal** value (i.e. 0644 -> 420). doc/configuration-v2_3.md: * **_mode_** (integer): the file's permission mode. Note that the mode must be properly specified as a **decimal** value (i.e. 0644 -> 420). doc/configuration-v2_4.md: * **_mode_** (integer): the file's permission mode. Note that the mode must be properly specified as a **decimal** value (i.e. 0644 -> 420). doc/configuration-v2_5-experimental.md: * **_mode_** (integer): the file's permission mode. Note that the mode must be properly specified as a **decimal** value (i.e. 0644 -> 420). There is also no in-cluster component responsible for updating boot image configuration, or even complaining about stale boot image configuration, in Machines or MachineSets. This causes problems when 4.10 clusters with older boot images (at least older than 4.6 [1], I haven't pinned down a specific version): 1. Cluster updates to 4.11. 2. Incoming machine-config operator renders fresh MachineConfig from any ContainerRuntimeConfig or KubeletConfig. 3. Those rendered MachineConfig contain null/unset modes. 4. A new Machine is created with the old Ignition v2 boot image. 5. The boot image Ignition lays down a file with mode 0, because Ignition v2 does not define a default mode. 6. The boot image pivots into the modern machine-os-content image. 7. The incoming (modern) machine-config daemon notices the mode 0 file, compares it with its Ignition-v3-like 0644 default mode, and complains with [2]: unexpected on-disk state validating against rendered-worker-44f2c74623e4d3bbe9557a9e82102c01: mode mismatch for file: "/etc/crio/crio.conf.d/01-ctrcfg-pidsLimit"; expected: -rw-r--r--/420/0644; received: ----------/0/0 Folks should probably update to more modern boot images, but this commit restores the explicit mode to avoid breaking on this mode-mismatch issue for folks who are still running Ignition v2 boot images. [1]: https://bugzilla.redhat.com/show_bug.cgi?id=2102004#c28 [2]: https://bugzilla.redhat.com/show_bug.cgi?id=2102004#c0
|
@openshift-cherrypick-robot: Bugzilla bug 2102004 has been cloned as Bugzilla bug 2104561. Retitling PR to link against new bug. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
openshift-ci
Bot
changed the title
openshift-ci
Bot
added
bugzilla/severity-high
|
@openshift-cherrypick-robot: This pull request references Bugzilla bug 2104561, which is valid. The bug has been moved to the POST state. The bug has been updated to refer to the pull request using the external bug tracker. 6 validation(s) were run on this bug
Requesting review from QA contact: DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: openshift-cherrypick-robot, sinnykumari The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
openshift-ci
Bot
added
the
approved
sdodson
added
the
staff-eng-approved
|
Added staff-eng-approved, this fixes a regression during upgrades from 4.10 to 4.11. |
|
@openshift-cherrypick-robot: All pull requests linked via external trackers have merged: Bugzilla bug 2104561 has been moved to the MODIFIED state. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
|
@openshift-cherrypick-robot: The following test failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here. |
5 participants
This is an automated cherry-pick of #3226
/assign yuqi-zhang