tuned requires elevated privileges

Bug #1659474 reported by Lars Kellogg-Stedman
8
This bug affects 1 person
Affects Status Importance Assigned to Milestone
tripleo
Fix Released
High
Unassigned

Bug Description

Running tuned requires elevated privileges, but the tuned tasks do not have become: true. This results in the quickstart failing. Instead of:

  - name: Retrieve current tuned profile
    command: tuned-adm active
    register: tuned
    changed_when: False

We need:

  - name: Retrieve current tuned profile
    command: tuned-adm active
    register: tuned
    changed_when: False
    become: true

(And on the preceding task as well)

Tags: ci quickstart
Revision history for this message
Attila Darazs (adarazs) wrote :

The main playbook is a bit like a maze at this point, but things happens like:

- playbooks/quickstart.yml includes provision.yml
- provision yaml uses the provision/local role which adds the virthost with the root user: https://github.com/openstack/tripleo-quickstart/blob/master/roles/provision/local/tasks/main.yml#L47
- provision remote does a bunch of stuff, including the tasks you mentioned
- it creates non_root_user on the virthost and readds its to the inventory with the new user

Thus the role runs with root privileges at this point and doesn't require become.

Changed in tripleo-quickstart:
status: New → Invalid
Revision history for this message
Lars Kellogg-Stedman (larsks) wrote :

My deployment actually failed because of this problem, and was only successful after I added the become: lines to those tasks. Other tasks *in that same playbook* have become: lines, suggesting that it is in fact necessary.

Changed in tripleo-quickstart:
status: Invalid → New
Revision history for this message
Attila Darazs (adarazs) wrote :

It's not really necessary if you use the roles with quickstart.sh + the basic quickstart.yml playbook, because of how the virthost definition changes (explained in comment #1).

So I think you ran with --retain-inventory and used an older generated inventory or executed the playbook/roles with an existing inventory file that defined the virthost user as something else than root.

All this being said "sudo" will succeed when root is used, so there's no harm in adding it. Change coming right up.

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix proposed to tripleo-quickstart (master)

Fix proposed to branch: master
Review: https://review.openstack.org/426238

Changed in tripleo-quickstart:
assignee: nobody → Attila Darazs (adarazs)
status: New → In Progress
Revision history for this message
John Trowbridge (trown) wrote :

Moved from tripleo-quickstart launchpad (Moving in progress).

Changed in tripleo-quickstart:
importance: Undecided → High
Changed in tripleo:
status: New → In Progress
importance: Undecided → High
milestone: none → ocata-rc1
tags: added: ci
no longer affects: tripleo-quickstart
tags: added: quickstart
Changed in tripleo:
milestone: ocata-rc1 → ocata-rc2
Changed in tripleo:
milestone: ocata-rc2 → pike-1
Changed in tripleo:
milestone: pike-1 → pike-2
Changed in tripleo:
milestone: pike-2 → pike-3
Revision history for this message
Emilien Macchi (emilienm) wrote :

There are no currently open reviews on this bug, changing the status back to the previous state and unassigning. If there are active reviews related to this bug, please include links in comments.

Changed in tripleo:
status: In Progress → New
status: New → Triaged
Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix included in openstack/tripleo-quickstart 2.1.0

This issue was fixed in the openstack/tripleo-quickstart 2.1.0 release.

Changed in tripleo:
milestone: pike-3 → pike-rc1
Ronelle Landy (rlandy)
Changed in tripleo:
status: Triaged → Fix Released
Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix included in openstack/tripleo-quickstart 2.1.1

This issue was fixed in the openstack/tripleo-quickstart 2.1.1 release.

To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.