Octane should be able to ssh as non-root user and use sudo.

Bug #1575477 reported by Jaymes Mosher
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
Fuel for OpenStack
Fix Committed
Wishlist
Ilya Kharin

Bug Description

Some environments prefer to restrict the ability to log in directly as root. As I understand, changes in Fuel 9.0 will add the ability for Fuel to operate with non-root users.

It would be useful if Octane was also able to SSH to nodes as a non-root user and use sudo to perform upgrades.

I think I have a working patch that enables this for both SSH and SFTP access. It requires passwordless sudo access, however. I'll submit a change request here shortly.

Steps to reproduce:
Expected results:
Actual results:
Reproducibility:
Workaround:
    NA

Impact:
    Low
    Feature request

Description of environment:
    VERSION:
      api: '1.0'
      astute_sha: 3825776b9987536cc42e4e359d1da149836cf0c1
      build_id: 2015-12-03_21-48-51
      build_number: '2151'
      feature_groups:
      - mirantis
      fuel-library_sha: be0a37c50c80fc168a330c80168787f60181df61
      fuel-ostf_sha: 0c3ea063906f0ab7a7751439d562cd29cc8a425f
      fuelmain_sha: 70fc249bb7cbd456aa6846f3578a214ba2949510
      nailgun_sha: caa87bf5327cac9a6cd3e9524e4d975096f923df
      openstack_version: 2014.2.2-6.1
      production: docker
      python-fuelclient_sha: 38ea104314a09383d81df137751cd13e5e972ff3
      release: '6.1'

Additional Information:
    No

Changed in fuel:
assignee: nobody → Fuel Sustaining (fuel-sustaining-team)
importance: Undecided → Medium
status: New → Confirmed
Changed in fuel:
assignee: Fuel Sustaining (fuel-sustaining-team) → Fuel Octane (fuel-octane-team)
milestone: none → 10.0
Revision history for this message
Jaymes Mosher (jmosher-u) wrote :

My attempt at adding sudo ability here: https://review.openstack.org/#/c/326129/

Ilya Kharin (akscram)
Changed in fuel:
importance: Medium → Wishlist
Revision history for this message
Jaymes Mosher (jmosher-u) wrote :

Split change request into two per Oleg Gelbukh's request.

Add sudo ability: https://review.openstack.org/#/c/326129/
Add check-sudo command: https://review.openstack.org/#/c/331884/

Nikita Zubkov (zubchick)
Changed in fuel:
assignee: Fuel Octane (fuel-octane-team) → Nikita Zubkov (zubchick)
Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix proposed to fuel-octane (master)

Fix proposed to branch: master
Review: https://review.openstack.org/338183

Changed in fuel:
status: Confirmed → In Progress
Revision history for this message
OpenStack Infra (hudson-openstack) wrote :

Fix proposed to branch: master
Review: https://review.openstack.org/342188

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix merged to fuel-octane (master)

Reviewed: https://review.openstack.org/342188
Committed: https://git.openstack.org/cgit/openstack/fuel-octane/commit/?id=19d4b508ba642abcfea14b3ac4090204fc2cdb03
Submitter: Jenkins
Branch: master

commit 19d4b508ba642abcfea14b3ac4090204fc2cdb03
Author: Nikita Zubkov <email address hidden>
Date: Thu Jul 14 16:54:54 2016 +0300

    For non-root user run sftp server as root

    To be able to get access to all files on fs.

    Change-Id: I3a106ff75023acfc9ce79c90efde5d07ba0dce3f
    Partial-Bug: #1575477

Revision history for this message
OpenStack Infra (hudson-openstack) wrote :

Reviewed: https://review.openstack.org/338183
Committed: https://git.openstack.org/cgit/openstack/fuel-octane/commit/?id=e4c12fc006a084870b4c127ab0841632b401abb7
Submitter: Jenkins
Branch: master

commit e4c12fc006a084870b4c127ab0841632b401abb7
Author: Nikita Zubkov <email address hidden>
Date: Wed Jul 6 14:01:30 2016 +0300

    Add non-root ssh connection

    Since fuel 9.0 clusters have non-root service user. This patch adds
    logic that allows connecting to slaves with such credentials if cluster
    have non-root support.

    Change-Id: Iac4ac168022de7e60c40494841ac34d70f6f7986
    Partial-Bug: #1575477

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix proposed to fuel-octane (master)

Fix proposed to branch: master
Review: https://review.openstack.org/351721

Changed in fuel:
assignee: Nikita Zubkov (zubchick) → Ilya Kharin (akscram)
Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Change abandoned on fuel-octane (master)

Change abandoned by Ilya Kharin (<email address hidden>) on branch: master
Review: https://review.openstack.org/351721
Reason: This patch have to go in stable/mitaka instead of master.

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix proposed to fuel-octane (stable/mitaka)

Fix proposed to branch: stable/mitaka
Review: https://review.openstack.org/351728

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix merged to fuel-octane (stable/mitaka)
Download full text (17.8 KiB)

Reviewed: https://review.openstack.org/351728
Committed: https://git.openstack.org/cgit/openstack/fuel-octane/commit/?id=3101bf302ea0f2d501fd42a6ae6046c3587ac093
Submitter: Jenkins
Branch: stable/mitaka

commit a05d2ecf13e15c12f10e1517fae425e583e0d714
Author: Nikita Zubkov <email address hidden>
Date: Thu Aug 4 17:51:56 2016 +0300

    fix ssh connection auth

    According to spec [1] service user must use key authentication​ for ssh

    [1] https://github.com/openstack/fuel-specs/blame/ba4504/specs/9.0/fuel-nonroot-openstack-nodes.rst#L61-L64

    Change-Id: I461f659d4f0985283a43ec6a702bdd78af91a072

commit 7140398e501879a4e1f5605f3d1cc99195464850
Author: Sergey Abramov <email address hidden>
Date: Tue Aug 2 12:12:57 2016 +0300

    Setup upgrade levels for each fuel version

    Setup upgrade levels block in nova.conf for each fuel version,
    this is required for backward compatibility on RPC.

    Change-Id: I6ccbc34457d11616b015cdb1e46e733b0b49ce58

commit 9e2a419ac79ad591faee9afe16419bf4497eacad
Author: Vladimir Khlyunev <email address hidden>
Date: Mon Aug 1 21:31:56 2016 +0300

    Fix several typos

    Copypasting is evil, lets remove typos

    Change-Id: Icf4bec1a3de954911a469fa98380af2b6175da08

commit 013a7ded2275245a38ee58289dac2bc8b90fa37e
Author: Sergey Abramov <email address hidden>
Date: Wed Jul 20 16:05:10 2016 +0300

    Host evacuation using nova

    Evacuate instance from compute node using
    nova host-evacuate-live except host_evacuation.sh script

    Change-Id: I01a04cfa1ed2aafce7987e523e6b589dea21fbb0

commit 00a1d0dce1f7ae5db6706a59353403516f7913dc
Author: Sergey Abramov <email address hidden>
Date: Tue Jul 19 17:10:44 2016 +0300

    Change shutoff vm command

    * run nova commands using nova util function
    * host filter using get nova node handle method(
        hostname for fuel < 6.1 and fqdn for newer version)

    Change-Id: Ib5c373714e359982b13910a225787167db7b35e9

commit 49357c98313c5f551b13d0877581c5fb5e108db1
Author: Nikita Zubkov <email address hidden>
Date: Mon Jun 27 18:40:13 2016 +0300

    Add `stderr_log_level` parameter to popen

    Now posible to set logging level in popen for logging stderr

    fuel-bootstrap build comand stderr now logged with INFO level

    Change-Id: Ibaa2be54c68ce7a428e07052c917f54e99b95a5e

commit fb582b271dab4bdd10d27149a77c0e1f6a580b9e
Author: Sergey Abramov <email address hidden>
Date: Thu Jul 21 17:56:41 2016 +0300

    Add run_nova_cmd function

    This is required for running nova command on contoller without
    manipulating manipulating with command.

    It makes code easier and more readable

    Usage:

        from fuelclient.objects import environment as environment_obj

        from octane.util import env
        from octane.util import nova

        env_id = ...
        my_env = environment_obj.Environment(env_id)
        controller = env.get_one_controller(my_env)
        nova_cmd_just_run = [...]
        nova_cmd_with_output = [...]
        nova.run_nova_cmd(nova_cmd_just_run, controller, False)
        result = nova.run_nova_cmd(nova_cmd_w...

tags: added: in-stable-mitaka
Ilya Kharin (akscram)
Changed in fuel:
status: In Progress → Fix Committed
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.