tripleo

standalone ansible fails when not run as root

Bug #1883609 reported by Alex Schultz
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
tripleo
Fix Released
Medium
Alex Schultz
tripleo wallaby-3

Bug Description

You can run `openstack tripleo deploy` with --output-only to generate the ansible playbooks for a deployment. However if you don't run ansible-playbook with sudo on the resulting files, it fails. Since ansible can handle the privilege elevation, we should ensure we use become: true correctly on the various tasks.

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Related fix proposed to tripleo-ansible (master)

Related fix proposed to branch: master
Review: https://review.opendev.org/736024

Revision history for this message
OpenStack Infra (hudson-openstack) wrote :

Related fix proposed to branch: master
Review: https://review.opendev.org/736040

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Related fix proposed to tripleo-heat-templates (master)

Related fix proposed to branch: master
Review: https://review.opendev.org/736047

Revision history for this message
OpenStack Infra (hudson-openstack) wrote :

Related fix proposed to branch: master
Review: https://review.opendev.org/736279

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Related fix merged to tripleo-ansible (master)

Reviewed: https://review.opendev.org/736024
Committed: https://git.openstack.org/cgit/openstack/tripleo-ansible/commit/?id=746bd9a52b2a4288af705f161ec41736a4e3b5e3
Submitter: Zuul
Branch: master

commit 746bd9a52b2a4288af705f161ec41736a4e3b5e3
Author: Alex Schultz <email address hidden>
Date: Tue Jun 16 14:38:57 2020 -0600

    Fix host entries permissions

    The cleanup tasks needs become: true because it was created with root.

    Change-Id: Iaa39aa301be182722e0650583d1ad17c0e8dc82b
    Related-Bug: #1883609

Revision history for this message
OpenStack Infra (hudson-openstack) wrote :

Reviewed: https://review.opendev.org/736040
Committed: https://git.openstack.org/cgit/openstack/tripleo-ansible/commit/?id=c8d8e9adaf62f1b3e6a274fbb5ec17dae4dc8449
Submitter: Zuul
Branch: master

commit c8d8e9adaf62f1b3e6a274fbb5ec17dae4dc8449
Author: Alex Schultz <email address hidden>
Date: Tue Jun 16 14:47:26 2020 -0600

    Fix tripleo_hierdata permissions

    Add become: true to the tasks that need to be able to write to /etc/

    Change-Id: I24b118220ce2371f651cad6b8dfbbf5d031ee118
    Related-Bug: #1883609

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Related fix merged to tripleo-heat-templates (master)

Reviewed: https://review.opendev.org/736279
Committed: https://git.openstack.org/cgit/openstack/tripleo-heat-templates/commit/?id=230481674ffd577ed83573daa28b6d3e0ef57637
Submitter: Zuul
Branch: master

commit 230481674ffd577ed83573daa28b6d3e0ef57637
Author: Alex Schultz <email address hidden>
Date: Wed Jun 17 09:51:05 2020 -0600

    Move sidecar kill scripts to host prep

    These tasks are really should be managed a single time against the host
    rather than at deployment time.

    Change-Id: I535d8360493267d50196aebb6365124b67e9ba78
    Related-Bug: #1883609

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Related fix proposed to tripleo-ansible (stable/ussuri)

Related fix proposed to branch: stable/ussuri
Review: https://review.opendev.org/739498

Revision history for this message
OpenStack Infra (hudson-openstack) wrote :

Related fix proposed to branch: stable/ussuri
Review: https://review.opendev.org/739500

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Related fix proposed to tripleo-ansible (stable/train)

Related fix proposed to branch: stable/train
Review: https://review.opendev.org/739540

Revision history for this message
OpenStack Infra (hudson-openstack) wrote :

Related fix proposed to branch: stable/train
Review: https://review.opendev.org/739541

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Related fix proposed to tripleo-heat-templates (stable/train)

Related fix proposed to branch: stable/train
Review: https://review.opendev.org/739547

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Related fix merged to tripleo-heat-templates (master)

Reviewed: https://review.opendev.org/736047
Committed: https://git.openstack.org/cgit/openstack/tripleo-heat-templates/commit/?id=4e39acd14771ef9e8085b29be3b9374678d8089e
Submitter: Zuul
Branch: master

commit 4e39acd14771ef9e8085b29be3b9374678d8089e
Author: Alex Schultz <email address hidden>
Date: Tue Jun 16 15:01:43 2020 -0600

    Fix privilege escalation

    This change enabled become: true to the deploy step and host prep task
    execution. external tasks are still become: false as they are delegated
    to localhost and run as the same user running the deployment.

    Change-Id: I79631ce0ed450febae96db2f32198e02eb427d91
    Related-Bug: #1883609

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Related fix merged to tripleo-ansible (stable/ussuri)

Reviewed: https://review.opendev.org/739498
Committed: https://git.openstack.org/cgit/openstack/tripleo-ansible/commit/?id=b2ea17cc8ae9ab905993763a49fb9b152af71986
Submitter: Zuul
Branch: stable/ussuri

commit b2ea17cc8ae9ab905993763a49fb9b152af71986
Author: Alex Schultz <email address hidden>
Date: Tue Jun 16 14:38:57 2020 -0600

    Fix host entries permissions

    The cleanup tasks needs become: true because it was created with root.

    Change-Id: Iaa39aa301be182722e0650583d1ad17c0e8dc82b
    Related-Bug: #1883609
    (cherry picked from commit 746bd9a52b2a4288af705f161ec41736a4e3b5e3)

tags: added: in-stable-ussuri
Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Related fix proposed to tripleo-heat-templates (stable/ussuri)

Related fix proposed to branch: stable/ussuri
Review: https://review.opendev.org/739591

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Related fix proposed to tripleo-heat-templates (stable/train)

Related fix proposed to branch: stable/train
Review: https://review.opendev.org/739592

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Related fix proposed to tripleo-heat-templates (stable/ussuri)

Related fix proposed to branch: stable/ussuri
Review: https://review.opendev.org/739595

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Related fix merged to tripleo-ansible (stable/ussuri)

Reviewed: https://review.opendev.org/739500
Committed: https://git.openstack.org/cgit/openstack/tripleo-ansible/commit/?id=a7f9c2c0a37fe0b490a569108016d6cbb68521e7
Submitter: Zuul
Branch: stable/ussuri

commit a7f9c2c0a37fe0b490a569108016d6cbb68521e7
Author: Alex Schultz <email address hidden>
Date: Tue Jun 16 14:47:26 2020 -0600

    Fix tripleo_hierdata permissions

    Add become: true to the tasks that need to be able to write to /etc/

    Change-Id: I24b118220ce2371f651cad6b8dfbbf5d031ee118
    Related-Bug: #1883609
    (cherry picked from commit c8d8e9adaf62f1b3e6a274fbb5ec17dae4dc8449)

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Related fix merged to tripleo-ansible (stable/train)

Reviewed: https://review.opendev.org/739540
Committed: https://git.openstack.org/cgit/openstack/tripleo-ansible/commit/?id=e3fb917193cc2a568c899c9e178da5222b91bad1
Submitter: Zuul
Branch: stable/train

commit e3fb917193cc2a568c899c9e178da5222b91bad1
Author: Alex Schultz <email address hidden>
Date: Tue Jun 16 14:38:57 2020 -0600

    Fix host entries permissions

    The cleanup tasks needs become: true because it was created with root.

    Change-Id: Iaa39aa301be182722e0650583d1ad17c0e8dc82b
    Related-Bug: #1883609
    (cherry picked from commit 746bd9a52b2a4288af705f161ec41736a4e3b5e3)

tags: added: in-stable-train
Revision history for this message
OpenStack Infra (hudson-openstack) wrote :

Reviewed: https://review.opendev.org/739541
Committed: https://git.openstack.org/cgit/openstack/tripleo-ansible/commit/?id=d1e80761c48c86897d4d023488af3c81e2666f87
Submitter: Zuul
Branch: stable/train

commit d1e80761c48c86897d4d023488af3c81e2666f87
Author: Alex Schultz <email address hidden>
Date: Tue Jun 16 14:47:26 2020 -0600

    Fix tripleo_hierdata permissions

    Add become: true to the tasks that need to be able to write to /etc/

    Change-Id: I24b118220ce2371f651cad6b8dfbbf5d031ee118
    Related-Bug: #1883609
    (cherry picked from commit c8d8e9adaf62f1b3e6a274fbb5ec17dae4dc8449)

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Related fix merged to tripleo-heat-templates (stable/train)

Reviewed: https://review.opendev.org/739547
Committed: https://git.openstack.org/cgit/openstack/tripleo-heat-templates/commit/?id=16fc8da6349fd1f3d1e806082a454c0ed758684a
Submitter: Zuul
Branch: stable/train

commit 16fc8da6349fd1f3d1e806082a454c0ed758684a
Author: Emilien Macchi <email address hidden>
Date: Mon Jul 6 12:27:57 2020 -0400

    Manual backport of "Move sidecar kill scripts to host prep" to Train

    Manual backport of https://review.opendev.org/#/c/736279 into
    stable/train.

    The patch didn't apply cleanly so we manually moved the tasks so
    these tasks are managed a single time against the host rather than at
    deployment time.

    Change-Id: Idf1e24e69a485b51761c161bb939ccbba6601912
    Related-Bug: #1883609

Revision history for this message
OpenStack Infra (hudson-openstack) wrote :

Reviewed: https://review.opendev.org/739592
Committed: https://git.openstack.org/cgit/openstack/tripleo-heat-templates/commit/?id=7168701091897dbe6180a06fd90d523da61a0f24
Submitter: Zuul
Branch: stable/train

commit 7168701091897dbe6180a06fd90d523da61a0f24
Author: Alex Schultz <email address hidden>
Date: Tue Jun 16 15:01:43 2020 -0600

    Fix privilege escalation

    This change enabled become: true to the deploy step and host prep task
    execution. external tasks are still become: false as they are delegated
    to localhost and run as the same user running the deployment.

    Change-Id: I79631ce0ed450febae96db2f32198e02eb427d91
    Related-Bug: #1883609
    (cherry picked from commit 4e39acd14771ef9e8085b29be3b9374678d8089e)

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Related fix merged to tripleo-heat-templates (stable/ussuri)

Reviewed: https://review.opendev.org/739591
Committed: https://git.openstack.org/cgit/openstack/tripleo-heat-templates/commit/?id=f917423be9ed0cba53889808d93e4fc0884babec
Submitter: Zuul
Branch: stable/ussuri

commit f917423be9ed0cba53889808d93e4fc0884babec
Author: Alex Schultz <email address hidden>
Date: Tue Jun 16 15:01:43 2020 -0600

    Fix privilege escalation

    This change enabled become: true to the deploy step and host prep task
    execution. external tasks are still become: false as they are delegated
    to localhost and run as the same user running the deployment.

    Change-Id: I79631ce0ed450febae96db2f32198e02eb427d91
    Related-Bug: #1883609
    (cherry picked from commit 4e39acd14771ef9e8085b29be3b9374678d8089e)

Revision history for this message
OpenStack Infra (hudson-openstack) wrote :

Reviewed: https://review.opendev.org/739595
Committed: https://git.openstack.org/cgit/openstack/tripleo-heat-templates/commit/?id=d29386d8b61e60676d84ed75d566e6eebd8a19e5
Submitter: Zuul
Branch: stable/ussuri

commit d29386d8b61e60676d84ed75d566e6eebd8a19e5
Author: Alex Schultz <email address hidden>
Date: Wed Jun 17 09:51:05 2020 -0600

    Move sidecar kill scripts to host prep

    These tasks are really should be managed a single time against the host
    rather than at deployment time.

    Change-Id: I535d8360493267d50196aebb6365124b67e9ba78
    Related-Bug: #1883609
    (cherry picked from commit 230481674ffd577ed83573daa28b6d3e0ef57637)

Emilien Macchi (emilienm)
Changed in tripleo:
milestone: victoria-1 → victoria-3
Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Related fix proposed to tripleo-ansible (master)

Related fix proposed to branch: master
Review: https://review.opendev.org/745734

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Related fix proposed to tripleo-heat-templates (stable/ussuri)

Related fix proposed to branch: stable/ussuri
Review: https://review.opendev.org/745737

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Related fix merged to tripleo-ansible (master)

Reviewed: https://review.opendev.org/745734
Committed: https://git.openstack.org/cgit/openstack/tripleo-ansible/commit/?id=c9b252815d3be19120f886e108c9f72152d79352
Submitter: Zuul
Branch: master

commit c9b252815d3be19120f886e108c9f72152d79352
Author: Alex Schultz <email address hidden>
Date: Tue Aug 11 13:36:11 2020 -0600

    Additional permission fixes for roles

    Change-Id: I015a845f0e2e440aa147a823a4bebc93d512664e
    Related-Bug: #1883609

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Related fix proposed to tripleo-ansible (stable/ussuri)

Related fix proposed to branch: stable/ussuri
Review: https://review.opendev.org/746228

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Related fix proposed to tripleo-ansible (stable/train)

Related fix proposed to branch: stable/train
Review: https://review.opendev.org/746229

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Related fix merged to tripleo-heat-templates (stable/ussuri)

Reviewed: https://review.opendev.org/745737
Committed: https://git.openstack.org/cgit/openstack/tripleo-heat-templates/commit/?id=70a0991593b76bb9b1b53ff5b61f4ea2640e3d68
Submitter: Zuul
Branch: stable/ussuri

commit 70a0991593b76bb9b1b53ff5b61f4ea2640e3d68
Author: Alex Schultz <email address hidden>
Date: Tue Aug 11 14:15:53 2020 -0600

    Fix permissions for paunch

    Paunch needs to be run as root so we need a become: true in order to
    work if the playbook is not run as root.

    Change-Id: I136ff6836aa8629b037f309076b4b682e30b9de2
    Related-Bug: #1883609

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Related fix proposed to tripleo-heat-templates (stable/train)

Related fix proposed to branch: stable/train
Review: https://review.opendev.org/747409

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Related fix merged to tripleo-ansible (stable/ussuri)

Reviewed: https://review.opendev.org/746228
Committed: https://git.openstack.org/cgit/openstack/tripleo-ansible/commit/?id=98be5e50532858837c3792e369ee742cd45d0cb6
Submitter: Zuul
Branch: stable/ussuri

commit 98be5e50532858837c3792e369ee742cd45d0cb6
Author: Alex Schultz <email address hidden>
Date: Tue Aug 11 13:36:11 2020 -0600

    Additional permission fixes for roles

    Change-Id: I015a845f0e2e440aa147a823a4bebc93d512664e
    Related-Bug: #1883609
    (cherry picked from commit c9b252815d3be19120f886e108c9f72152d79352)

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Change abandoned on tripleo-heat-templates (stable/train)

Change abandoned by Alex Schultz (<email address hidden>) on branch: stable/train
Review: https://review.opendev.org/747409
Reason: was already backported 16fc8da634

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Related fix merged to tripleo-ansible (stable/train)

Reviewed: https://review.opendev.org/746229
Committed: https://git.openstack.org/cgit/openstack/tripleo-ansible/commit/?id=5ec8909e16f5161da4f8bcf608c2e7296b9cce16
Submitter: Zuul
Branch: stable/train

commit 5ec8909e16f5161da4f8bcf608c2e7296b9cce16
Author: Alex Schultz <email address hidden>
Date: Tue Aug 11 13:36:11 2020 -0600

    Additional permission fixes for roles

    Change-Id: I015a845f0e2e440aa147a823a4bebc93d512664e
    Related-Bug: #1883609
    (cherry picked from commit c9b252815d3be19120f886e108c9f72152d79352)

Marios Andreou (marios-b)
Changed in tripleo:
milestone: victoria-3 → wallaby-1
Marios Andreou (marios-b)
Changed in tripleo:
milestone: wallaby-1 → wallaby-2
Marios Andreou (marios-b)
Changed in tripleo:
milestone: wallaby-2 → wallaby-3
Revision history for this message
Alex Schultz (alex-schultz) wrote :

This should work now. If not, please reopen

Changed in tripleo:
status: Triaged → Fix Released
assignee: nobody → Alex Schultz (alex-schultz)
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.
Subscribing...

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.