keystone based standalone deployment failed with No such file or directory: ''/usr/sbin/nft'

[chandan kumar]

tripleo-podman-integration-centos-8-scenario000-standalone job runs in third party dependency check job against podman.

It creates podman rpm using make package-install command and then the rpm is passed to above job.
commit used to build the rpm is: https://github.com/containers/libpod/commit/6d36d05447fd594bedebea8a9a4366d348a78290

https://logserver.rdoproject.org/78/26178/6/check/podman-package-centos-8/b15882d/job-output.txt

The keystone based standalone job is failing with following errors:
https://logserver.rdoproject.org/78/26178/6/check/tripleo-podman-integration-centos-8-scenario000-standalone/ec65143/logs/undercloud/home/zuul/standalone_deploy.log.txt.gz

TASK [Flush Nftables rules when nftables.conf changed] *************************
Wednesday 01 April 2020 01:52:13 +0000 (0:00:00.593) 0:01:39.142 *******
fatal: [standalone]: FAILED! => changed=false
  cmd: /usr/sbin/nft flush ruleset
  msg: '[Errno 2] No such file or directory: ''/usr/sbin/nft'': ''/usr/sbin/nft'''
  rc: 2

Here is the code which runs: https://opendev.org/openstack/tripleo-heat-templates/src/branch/master/deployment/tripleo-firewall/tripleo-firewall-baremetal-ansible.yaml#L75

It might be an issue with tht.
It needs to be investigated.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.opendev.org/716615

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.opendev.org/716615
Committed: https://git.openstack.org/cgit/openstack/tripleo-heat-templates/commit/?id=aa019cdd5d84b6678395c18ff536b804a8b10005
Submitter: Zuul
Branch: master

commit aa019cdd5d84b6678395c18ff536b804a8b10005
Author: Michele Baldessari <email address hidden>
Date: Wed Apr 1 16:47:01 2020 +0200

    Do not fail if /usr/sbin/nft is not present

    In change Ia4a2a58aada3b893fa23e04722f0a7d77e05a981 we added some rules
    to forcefully cleanup nftables in case those were changed outside our
    control. Turns out that some Centos8 CI jobs do not have it installed.
    Let's not fail in that cases.

    Change-Id: I693d2b3c9de7135416d809b625cff62184a10668
    Closes-Bug: #1870095

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/train
Review: https://review.opendev.org/716978

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.opendev.org/716978
Committed: https://git.openstack.org/cgit/openstack/tripleo-heat-templates/commit/?id=eedb679db95b281b2be0199d48876b8af64ea3a0
Submitter: Zuul
Branch: stable/train

commit eedb679db95b281b2be0199d48876b8af64ea3a0
Author: Michele Baldessari <email address hidden>
Date: Wed Apr 1 16:47:01 2020 +0200

    Do not fail if /usr/sbin/nft is not present

    In change Ia4a2a58aada3b893fa23e04722f0a7d77e05a981 we added some rules
    to forcefully cleanup nftables in case those were changed outside our
    control. Turns out that some Centos8 CI jobs do not have it installed.
    Let's not fail in that cases.

    Change-Id: I693d2b3c9de7135416d809b625cff62184a10668
    Closes-Bug: #1870095
    (cherry picked from commit aa019cdd5d84b6678395c18ff536b804a8b10005)

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/tripleo-heat-templates 12.2.0 release.

[OpenStack Infra (hudson-openstack)]

Related fix proposed to branch: master
Review: https://review.opendev.org/740485

[OpenStack Infra (hudson-openstack)]

Related fix proposed to branch: stable/ussuri
Review: https://review.opendev.org/740486

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.opendev.org/739963
Committed: https://git.openstack.org/cgit/openstack/tripleo-heat-templates/commit/?id=9db0d36614c5abdb0ccb02ff6b300bc0d277f672
Submitter: Zuul
Branch: stable/train

commit 9db0d36614c5abdb0ccb02ff6b300bc0d277f672
Author: yatinkarel <email address hidden>
Date: Fri Jul 10 11:22:18 2020 +0530

    Revert "[train/backport] Prevent nftables to interfere with tripleo firewall"

    This reverts commit c3b24599d7055c4dead110d25d7479eca7a557fe.

    Revert "Do not fail if /usr/sbin/nft is not present"

    This reverts commit eedb679db95b281b2be0199d48876b8af64ea3a0.

    The nftables rules are not enabled now after [1] so reverting
    the original changes which are not needed.

    [1] https://git.centos.org/rpms/nftables/c/3730f48

    Related-Bug: #1870095
    Related-Bug: #1869166
    Closes-Bug: #1887112
    Change-Id: Ib3309cbbd6f2ca300ec205528402a3836a6f34df

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.opendev.org/740485
Committed: https://git.openstack.org/cgit/openstack/tripleo-heat-templates/commit/?id=8e3c4f572891717e1ce9b997e5ab35bb602a544b
Submitter: Zuul
Branch: master

commit 8e3c4f572891717e1ce9b997e5ab35bb602a544b
Author: yatinkarel <email address hidden>
Date: Fri Jul 10 20:12:45 2020 +0530

    Revert "Prevent nftables to interfere with tripleo firewall"

    This reverts commit d44df735e9675f4bb55dd56091217abc776bd4cd.

    Revert "Do not fail if /usr/sbin/nft is not present"

    This reverts commit aa019cdd5d84b6678395c18ff536b804a8b10005.

    The nftables rules are not enabled now after [1] so reverting
    the original changes which are not needed.

    [1] https://git.centos.org/rpms/nftables/c/3730f48

    Related-Bug: #1870095
    Related-Bug: #1869166
    Change-Id: I3923ea24c640941961624326cf3abe1012020771

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.opendev.org/740486
Committed: https://git.openstack.org/cgit/openstack/tripleo-heat-templates/commit/?id=9c861fcfc427d55f96e24e5d573e0ca535d44cb1
Submitter: Zuul
Branch: stable/ussuri

commit 9c861fcfc427d55f96e24e5d573e0ca535d44cb1
Author: yatinkarel <email address hidden>
Date: Fri Jul 10 20:12:45 2020 +0530

    Revert "Prevent nftables to interfere with tripleo firewall"

    This reverts commit d44df735e9675f4bb55dd56091217abc776bd4cd.

    Revert "Do not fail if /usr/sbin/nft is not present"

    This reverts commit aa019cdd5d84b6678395c18ff536b804a8b10005.

    The nftables rules are not enabled now after [1] so reverting
    the original changes which are not needed.

    [1] https://git.centos.org/rpms/nftables/c/3730f48

    Related-Bug: #1870095
    Related-Bug: #1869166
    Change-Id: I3923ea24c640941961624326cf3abe1012020771
    (cherry picked from commit 8e3c4f572891717e1ce9b997e5ab35bb602a544b)

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/tripleo-heat-templates 11.4.0 release.