gate is faling because of bindeps or image changes

Bug #1562383 reported by Steven Dake
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
kolla
Fix Released
Critical
Steven Dake
Liberty
Fix Released
Critical
Steven Dake
Mitaka
Fix Released
Critical
Steven Dake

Bug Description

something changed recently in the images according to openstack-infra. This is causing all of our gate jobs to fail that use sudo to switch user groups. Instead use newgrp and remove the usage of sudo entirely from the tox.ini file.

Steven Dake (sdake)
Changed in kolla:
importance: Undecided → Critical
status: New → Confirmed
assignee: nobody → Steven Dake (sdake)
milestone: none → newton-1
Changed in kolla:
status: Confirmed → In Progress
Revision history for this message
Steven Dake (sdake) wrote :

newgrp doesn't work. sgid tox to docker doesn't work. the only solution that may work is opening permissions on docker.sock to be world writeable.

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix merged to kolla (master)

Reviewed: https://review.openstack.org/297945
Committed: https://git.openstack.org/cgit/openstack/kolla/commit/?id=a78934672738ffc3a74495172534ed50c6f7f658
Submitter: Jenkins
Branch: master

commit a78934672738ffc3a74495172534ed50c6f7f658
Author: Steven Dake <email address hidden>
Date: Sat Mar 26 10:11:32 2016 -0700

    Fix gate to use world writeable docker socket

    A recent change related to sudo securepath broke how sudo -E
    works. Now the PATH is reset by sudo as set by tox. As a result
    we can no longer rely on sudo -E anywhere in our gating system
    relating to path inheritence from the parent shell.

    This patch uses a shell operation in the setup_nodes.yml code
    to chmod the docker socket to 666 so docker containers can build
    properly. Now docker operations don't return a permission denied
    and we no longer require the sudo -E operation in any of our tox
    scripts. This isn't a security vulnerability because our gate
    scripts are only meant to be run in OpenStack infrastructure.
    To make this more clear I recommend moving these shell scripts to
    tests/gate.

    Change-Id: I5b3d6e280e3c12a25defedb14b5589ba642043fa
    Closes-Bug: #1562383

Changed in kolla:
status: In Progress → Fix Released
Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix merged to kolla (stable/mitaka)

Reviewed: https://review.openstack.org/298098
Committed: https://git.openstack.org/cgit/openstack/kolla/commit/?id=eb70a13ae4fe78cd91336936fd87b786bb69c48d
Submitter: Jenkins
Branch: stable/mitaka

commit eb70a13ae4fe78cd91336936fd87b786bb69c48d
Author: Steven Dake <email address hidden>
Date: Sat Mar 26 10:11:32 2016 -0700

    Fix gate to use world writeable docker socket

    A recent change related to sudo securepath broke how sudo -E
    works. Now the PATH is reset by sudo as set by tox. As a result
    we can no longer rely on sudo -E anywhere in our gating system
    relating to path inheritence from the parent shell.

    This patch uses a shell operation in the setup_nodes.yml code
    to chmod the docker socket to 666 so docker containers can build
    properly. Now docker operations don't return a permission denied
    and we no longer require the sudo -E operation in any of our tox
    scripts. This isn't a security vulnerability because our gate
    scripts are only meant to be run in OpenStack infrastructure.
    To make this more clear I recommend moving these shell scripts to
    tests/gate.

    Change-Id: I5b3d6e280e3c12a25defedb14b5589ba642043fa
    Closes-Bug: #1562383

Revision history for this message
Doug Hellmann (doug-hellmann) wrote : Fix included in openstack/kolla 2.0.0

This issue was fixed in the openstack/kolla 2.0.0 release.

Revision history for this message
Doug Hellmann (doug-hellmann) wrote : Fix included in openstack/kolla 1.1.0

This issue was fixed in the openstack/kolla 1.1.0 release.

Revision history for this message
Doug Hellmann (doug-hellmann) wrote : Fix included in openstack/kolla 3.0.0.0b1

This issue was fixed in the openstack/kolla 3.0.0.0b1 development milestone.

To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.