gate is faling because of bindeps or image changes

[Steven Dake]

something changed recently in the images according to openstack-infra. This is causing all of our gate jobs to fail that use sudo to switch user groups. Instead use newgrp and remove the usage of sudo entirely from the tox.ini file.

[Steven Dake (sdake)]

newgrp doesn't work. sgid tox to docker doesn't work. the only solution that may work is opening permissions on docker.sock to be world writeable.

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/297945
Committed: https://git.openstack.org/cgit/openstack/kolla/commit/?id=a78934672738ffc3a74495172534ed50c6f7f658
Submitter: Jenkins
Branch: master

commit a78934672738ffc3a74495172534ed50c6f7f658
Author: Steven Dake <email address hidden>
Date: Sat Mar 26 10:11:32 2016 -0700

    Fix gate to use world writeable docker socket

    A recent change related to sudo securepath broke how sudo -E
    works. Now the PATH is reset by sudo as set by tox. As a result
    we can no longer rely on sudo -E anywhere in our gating system
    relating to path inheritence from the parent shell.

    This patch uses a shell operation in the setup_nodes.yml code
    to chmod the docker socket to 666 so docker containers can build
    properly. Now docker operations don't return a permission denied
    and we no longer require the sudo -E operation in any of our tox
    scripts. This isn't a security vulnerability because our gate
    scripts are only meant to be run in OpenStack infrastructure.
    To make this more clear I recommend moving these shell scripts to
    tests/gate.

    Change-Id: I5b3d6e280e3c12a25defedb14b5589ba642043fa
    Closes-Bug: #1562383

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/298098
Committed: https://git.openstack.org/cgit/openstack/kolla/commit/?id=eb70a13ae4fe78cd91336936fd87b786bb69c48d
Submitter: Jenkins
Branch: stable/mitaka

commit eb70a13ae4fe78cd91336936fd87b786bb69c48d
Author: Steven Dake <email address hidden>
Date: Sat Mar 26 10:11:32 2016 -0700

    Fix gate to use world writeable docker socket

    A recent change related to sudo securepath broke how sudo -E
    works. Now the PATH is reset by sudo as set by tox. As a result
    we can no longer rely on sudo -E anywhere in our gating system
    relating to path inheritence from the parent shell.

    This patch uses a shell operation in the setup_nodes.yml code
    to chmod the docker socket to 666 so docker containers can build
    properly. Now docker operations don't return a permission denied
    and we no longer require the sudo -E operation in any of our tox
    scripts. This isn't a security vulnerability because our gate
    scripts are only meant to be run in OpenStack infrastructure.
    To make this more clear I recommend moving these shell scripts to
    tests/gate.

    Change-Id: I5b3d6e280e3c12a25defedb14b5589ba642043fa
    Closes-Bug: #1562383

[Doug Hellmann (doug-hellmann)]

This issue was fixed in the openstack/kolla 2.0.0 release.

[Doug Hellmann (doug-hellmann)]

This issue was fixed in the openstack/kolla 1.1.0 release.

[Doug Hellmann (doug-hellmann)]

This issue was fixed in the openstack/kolla 3.0.0.0b1 development milestone.