Prechecks fail on CentOS 7 if run as non-root user

Bug #1584063 reported by Derek Ditch
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
kolla
Expired
Undecided
Unassigned

Bug Description

If the prechecks are run as a non-root user (root isn't allowed to directly login via SSH in my environment), the `ip` command is not on the path during the ansible `command` invocation. `ip` is found in `/usr/sbin/ip`, but the command module doesn't specify a path. This causes the check "prechecks | Checking if kolla_internal_vip_address is in the same network as network_interface on all nodes" to fail due to the fact the command fails to execute.

Suggested fix:

1. Use absolute paths for commands (of course this could be sketchy depending on supported distros, though the Linux FHS should help?)

OR

2. Change this task to use the `shell` module. The command is on the path of the user when the shell is allocated (via /etc/profile).

Revision history for this message
Derek Ditch (dcode) wrote :

Just tried option #2 but it doesn't fix it for some reason. When I login as the user, `ip` is on my path, so I'm not sure why. I patched it with option #1 and fixes the issue. I just don't know how that applies on Debian-based systems (or others?). I would assume the `ip` command would always be in /usr/sbin/ip or /sbin/ip.

Revision history for this message
Derek Ditch (dcode) wrote :

In debian package of iproute2, the command is both `/bin/ip` and `/sbin/ip`. I would recommend giving explicit path to `/sbin/ip`, since that will work on Debian, Ubuntu, and EL-based systems (and Fedora).

Changed in kolla:
status: New → Triaged
importance: Undecided → High
Changed in kolla:
milestone: none → ocata-3
Revision history for this message
Jeffrey Zhang (jeffrey4l) wrote :

if u your not non-root user, how could u deploy kolla?

Changed in kolla:
milestone: ocata-3 → ocata-rc1
Revision history for this message
Derek Ditch (dcode) wrote : Re: [Bug 1584063] Re: Prechecks fail on CentOS 7 if run as non-root user

Using --become. When I filed this, that wasn't possible. Namely, I'm
required to disable root login over SSH, which breaks the deployment.

On Dec 15, 2016 11:59 PM, "Jeffrey Zhang" <email address hidden>
wrote:

> if u your not non-root user, how could u deploy kolla?
>
> --
> You received this bug notification because you are subscribed to the bug
> report.
> https://bugs.launchpad.net/bugs/1584063
>
> Title:
> Prechecks fail on CentOS 7 if run as non-root user
>
> To manage notifications about this bug go to:
> https://bugs.launchpad.net/kolla/+bug/1584063/+subscriptions
>

Changed in kolla:
milestone: ocata-rc1 → pike-1
Changed in kolla:
assignee: nobody → Surya Prakash Singh (confisurya)
Changed in kolla:
milestone: pike-2 → pike-3
Revision history for this message
Surya Prakash Singh (confisurya) wrote :

As currently I am not working on this, So removing myself for few days. Any one feel free to grab this.

Changed in kolla:
assignee: Surya Prakash Singh (confisurya) → nobody
Changed in kolla:
milestone: pike-3 → pike-rc1
Changed in kolla:
milestone: pike-rc1 → queens-1
Changed in kolla:
milestone: queens-2 → queens-3
Changed in kolla:
milestone: queens-3 → queens-rc1
Changed in kolla:
milestone: queens-rc1 → queens-rc2
Changed in kolla:
milestone: queens-rc2 → rocky-1
Revision history for this message
Jeffrey Zhang (jeffrey4l) wrote : Cleanup EOL bug report

This is an automated cleanup. This bug report has been closed because it
is older than 18 months and there is no open code change to fix this.
After this time it is unlikely that the circumstances which lead to
the observed issue can be reproduced.

If you can reproduce the bug, please:
* reopen the bug report (set to status "New")
* AND add the detailed steps to reproduce the issue (if applicable)
* AND leave a comment "CONFIRMED FOR: <RELEASE_NAME>"
  Only still supported release names are valid (OCATA, PIKE, QUEENS, ROCKY, ROCKY).
  Valid example: CONFIRMED FOR: OCATA

Changed in kolla:
importance: High → Undecided
status: Triaged → Expired
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.