chrony package purge doesn't work because of the norpm provider

[Alex Schultz]

We try and purge the chrony package when we install ntp[0]. But because we have a norpm provider that noops package interactions[1], it never gets purged so it's repeatedly attempted every run.

[0] https://github.com/openstack/puppet-tripleo/blob/master/manifests/profile/base/time/ntp.pp#L23-L26
[1] https://github.com/openstack/puppet-tripleo/blob/master/lib/puppet/provider/package/norpm.rb#L36-L38

[Michele Baldessari (michele)]

So just for kicks I tried simply commenting out the whole purge section:
  # package { 'chrony':
  # ensure => 'purged',
  # before => Service['ntp'],
  # }

And I still get 5 restarts of ntp when redeploying the overcloud:
2017-02-18 08:06:26 +0000 /Stage[main]/Ntp/Anchor[ntp::begin]/before (debug): subscribes to Class[Ntp::Install]
2017-02-18 08:06:26 +0000 /Stage[main]/Ntp::Install/before (debug): subscribes to Class[Ntp::Config]
2017-02-18 08:06:26 +0000 /Stage[main]/Ntp::Config/notify (debug): subscribes to Class[Ntp::Service]
2017-02-18 08:06:26 +0000 /Stage[main]/Ntp::Service/before (debug): subscribes to Anchor[ntp::end]
2017-02-18 08:06:26 +0000 /Stage[main]/Ntp::Service/Service[ntp]/before (debug): subscribes to Class[Tripleo::Firewall::Post]
2017-02-18 08:06:27 +0000 /Firewall[105 ntp ipv4] (debug): Adding autorequire relationship with Package[iptables]
2017-02-18 08:06:27 +0000 /Firewall[105 ntp ipv4] (debug): Adding autorequire relationship with Package[iptables-services]
2017-02-18 08:06:27 +0000 /Firewall[105 ntp ipv4] (debug): Adding autorequire relationship with Service[firewalld]
2017-02-18 08:06:27 +0000 /Firewall[105 ntp ipv4] (debug): Adding autorequire relationship with Service[iptables]
2017-02-18 08:06:27 +0000 /Firewall[105 ntp ipv4] (debug): Adding autorequire relationship with Service[ip6tables]
2017-02-18 08:06:27 +0000 /Firewall[105 ntp ipv4] (debug): Adding autobefore relationship with File[/etc/sysconfig/iptables]
2017-02-18 08:06:27 +0000 /Firewall[105 ntp ipv4] (debug): Adding autobefore relationship with File[/etc/sysconfig/ip6tables]
2017-02-18 08:06:27 +0000 /Firewall[105 ntp ipv6] (debug): Adding autorequire relationship with Package[iptables]
2017-02-18 08:06:27 +0000 /Firewall[105 ntp ipv6] (debug): Adding autorequire relationship with Package[iptables-services]
2017-02-18 08:06:27 +0000 /Firewall[105 ntp ipv6] (debug): Adding autorequire relationship with Service[firewalld]
2017-02-18 08:06:27 +0000 /Firewall[105 ntp ipv6] (debug): Adding autorequire relationship with Service[iptables]
2017-02-18 08:06:27 +0000 /Firewall[105 ntp ipv6] (debug): Adding autorequire relationship with Service[ip6tables]
2017-02-18 08:06:27 +0000 /Firewall[105 ntp ipv6] (debug): Adding autobefore relationship with File[/etc/sysconfig/iptables]
2017-02-18 08:06:27 +0000 /Firewall[105 ntp ipv6] (debug): Adding autobefore relationship with File[/etc/sysconfig/ip6tables]
2017-02-18 08:06:28 +0000 Puppet (debug): Executing: '/usr/bin/rpm -q ntp --nosignature --nodigest --qf %{NAME} %|EPOCH?{%{EPOCH}}:{0}| %{VERSION} %{RELEASE} %{ARCH}\n'
2017-02-18 08:06:28 +0000 Puppet (info): Computing checksum on file /etc/ntp.conf
2017-02-18 08:06:28 +0000 /Stage[main]/Ntp::Config/File[/etc/ntp.conf] (info): Filebucketed /etc/ntp.conf to puppet with sum c07b9a377faea45b96b7d3bf8976004b
2017-02-18 08:06:28 +0000 /Stage[main]/Ntp::Config/File[/etc/ntp.conf]/content (notice): content changed '{md5}c07b9a377faea45b96b7d3bf8976004b' to '{md5}ff273154a520ecc0e21c25db677de324'
2017-02-18 08:06:28 +0000 /File[/etc/ntp.conf]/seltype (notice): seltype changed 'etc_t' to 'net_conf_t'
2017-02-18 08:06:28 +0000 /Stage[main]/Ntp::Config/File[/etc/nt...

[Michele Baldessari (michele)]

Ok so I think I figured out who is constantly changing /etc/ntp.conf.
It is os-apply-config. It keeps pushing the configuration at /usr/libexec/os-apply-config/templates/etc/ntp.conf, then puppet will run and will notice a different ntp.conf and will do its usual config regeneration + restart.

So we see this in the journal for os-collect-config:
Feb 15 16:51:51 overcloud-controller-0 os-collect-config[1939]: [2017/02/15 04:51:51 PM] [INFO] writing /etc/ntp.conf
Feb 15 16:51:51 overcloud-controller-0 os-collect-config[1939]: dib-run-parts Wed Feb 15 16:51:51 UTC 2017 Running /usr/libexec/os-refresh-config/configure.d/50-ntp
Feb 15 16:51:52 overcloud-controller-0 os-collect-config[1939]: dib-run-parts Wed Feb 15 16:51:52 UTC 2017 50-ntp completed
Feb 15 16:51:55 overcloud-controller-0 os-collect-config[1939]: dib-run-parts Wed Feb 15 16:51:55 UTC 2017 50-ntp 0.315

[Alex Schultz (alex-schultz)]

Those restarts are different, this bug is just about the fact that you could end up with purge not actually function as expected and continuously attempting to remove a file. The real crux is that we shouldn't be installing both ntp and chrony

[Michele Baldessari (michele)]

Ack, want me to move the restarts to another bug?

[Alex Schultz (alex-schultz)]

yea that's a different bug

[Alex Schultz (alex-schultz)]

Raising the priority as this has a side effect of resulting in failures if chronyd is installed and the node gets rebooted as chronyd and ntpd will conflict. So we need to handle this differently rather than purging the package.

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/442041
Committed: https://git.openstack.org/cgit/openstack/puppet-tripleo/commit/?id=37ba3a8db5e38955469e8bc9158388379d64abc8
Submitter: Jenkins
Branch: master

commit 37ba3a8db5e38955469e8bc9158388379d64abc8
Author: Alex Schultz <email address hidden>
Date: Mon Mar 6 10:02:16 2017 -0700

    Stop the chronyd service

    Since the norpm provider can prevent the chronyd package from actually
    getting purged, we need to make sure the chronyd service is stopped and
    disabled so that it does not conflict with ntpd.

    Change-Id: I7a697aba7aa5a27ba4ab6e46018057f7f01dfab2
    Closes-Bug: #1665426

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/ocata
Review: https://review.openstack.org/442514

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/442514
Committed: https://git.openstack.org/cgit/openstack/puppet-tripleo/commit/?id=6d204f4f5984b993bb0f38dfde0e47b373a1fe32
Submitter: Jenkins
Branch: stable/ocata

commit 6d204f4f5984b993bb0f38dfde0e47b373a1fe32
Author: Alex Schultz <email address hidden>
Date: Mon Mar 6 10:02:16 2017 -0700

    Stop the chronyd service

    Since the norpm provider can prevent the chronyd package from actually
    getting purged, we need to make sure the chronyd service is stopped and
    disabled so that it does not conflict with ntpd.

    Change-Id: I7a697aba7aa5a27ba4ab6e46018057f7f01dfab2
    Closes-Bug: #1665426
    (cherry picked from commit 37ba3a8db5e38955469e8bc9158388379d64abc8)

[OpenStack Infra (hudson-openstack)]

Related fix proposed to branch: stable/newton
Review: https://review.openstack.org/443333

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/newton
Review: https://review.openstack.org/443334

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/443333
Committed: https://git.openstack.org/cgit/openstack/puppet-tripleo/commit/?id=777cff9574255f20f207a4bb1f624820307ea9f1
Submitter: Jenkins
Branch: stable/newton

commit 777cff9574255f20f207a4bb1f624820307ea9f1
Author: Alex Schultz <email address hidden>
Date: Mon Mar 6 10:02:16 2017 -0700

    Stop the chronyd service

    Since the norpm provider can prevent the chronyd package from actually
    getting purged, we need to make sure the chronyd service is stopped and
    disabled so that it does not conflict with ntpd.

    Change-Id: I7a697aba7aa5a27ba4ab6e46018057f7f01dfab2
    Related-Bug: #1665426
    (cherry picked from commit 37ba3a8db5e38955469e8bc9158388379d64abc8)

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/443334
Committed: https://git.openstack.org/cgit/openstack/tripleo-heat-templates/commit/?id=05d20b5df7fd676e5cae5a2c175fd33aeef70e48
Submitter: Jenkins
Branch: stable/newton

commit 05d20b5df7fd676e5cae5a2c175fd33aeef70e48
Author: Emilien Macchi <email address hidden>
Date: Wed Jan 18 13:55:04 2017 -0500

    Deploy NTP with puppet-tripleo profile

    Deploy NTP by using puppet-tripleo profile, so we can re-use the bits on
    the undercloud.

    Closes-Bug: #1665426
    Depends-On: I7a697aba7aa5a27ba4ab6e46018057f7f01dfab2
    Change-Id: I8c13fbc9267ff28065f0de97424a4eac78c370fb
    (cherry picked from commit 550dde6370b17d60bb5d615b1f95671195275889)

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/puppet-tripleo 7.0.0 release.

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/tripleo-heat-templates 5.3.0 release.

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/puppet-tripleo 6.4.0 release.