NO-JIRA: Stop exposing the entire host filesystem #1085

jmencak · 2024-06-11T11:00:57Z

With the principle of least privilege in mind, stop exposing the
entirety of the host filesystem. Previously, we were mounting
the entire host filesystem to "/host". With this change, only
the necessary host directories for using TuneD are mounted and
a host's /var/lib directory for the operand's persistent
/var/lib/ocp-tuned directory.

Other changes

For e2e tests, use MCD to write to host's /etc/sysctl.d/ since
we are no longer exposing the entire host filesystem for the NTO
operand.

openshift-ci · 2024-06-11T11:02:09Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: jmencak

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~OWNERS~~ [jmencak]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

ffromani

I like the idea, questions about details of the implementation

assets/tuned/manifests/ds-tuned.yaml

test/e2e/basic/metrics_cert_rotation.go

ffromani · 2024-06-11T11:55:22Z

test/e2e/basic/sysctl_d_override.go

-			}
-			if pod != nil {
-				util.ExecAndLogCommand("oc", "exec", "-n", ntoconfig.WatchNamespace(), pod.Name, "--", "rm", sysctlFile)
+				util.ExecAndLogCommand("oc", "debug", fmt.Sprintf("no/%s", node.Name), "--", "rm", sysctlFile)


here and following: could you please elaborate why oc debug exposes less than oc exec? It seems equivalente (or perhaps worse) than what we have currently

Thank you for looking! True, however, this is code in e2e tests. The main idea is not to expose the entire /host in Tuned pods. Happy to share internal links to customer questions why we are exposing the entire /host over Slack if you're interested.

jmencak · 2024-06-11T13:42:02Z

  STEP: writing /host/etc/sysctl.d/zzz.conf override file on the host with net.ipv4.neigh.default.gc_thresh1=256 @ 06/11/24 11:55:45.647
  run command 'oc [debug no/ip-10-0-23-102.us-west-2.compute.internal -- sh -c echo net.ipv4.neigh.default.gc_thresh1=256 > /host/etc/sysctl.d/zzz.conf; sync /host/etc/sysctl.d/zzz.conf]':
    out=
    err=error: unable to get namespace namespaces "ci-op-371fk0cx" not found
    ret=exit status 1

Hmm, looks like we might not be able to use oc debug in the CI? Let's see if we can use MCO for this.

Also,
/cc @liqcui
for awareness. Is this PR going to break any QE tests that you might have?

liqcui · 2024-06-11T13:47:37Z

  STEP: writing /host/etc/sysctl.d/zzz.conf override file on the host with net.ipv4.neigh.default.gc_thresh1=256 @ 06/11/24 11:55:45.647
  run command 'oc [debug no/ip-10-0-23-102.us-west-2.compute.internal -- sh -c echo net.ipv4.neigh.default.gc_thresh1=256 > /host/etc/sysctl.d/zzz.conf; sync /host/etc/sysctl.d/zzz.conf]':
    out=
    err=error: unable to get namespace namespaces "ci-op-371fk0cx" not found
    ret=exit status 1

Hmm, looks like we might not be able to use oc debug in the CI? Let's see if we can use MCO for this.

Also, /cc @liqcui for awareness. Is this PR going to break any QE tests that you might have?

Hi Jiri, Thank you for prompting me, We use openshift-node-tuning-operator namespace instead of ci-xxx ns when execute debug command. you can try this

jmencak · 2024-06-11T14:22:51Z

Hi Jiri, Thank you for prompting me, We use openshift-node-tuning-operator namespace instead of ci-xxx ns when execute debug command. you can try this

Aah, good point, thank you. NM, I've just switched to using MCO/MCD. I don't have a problem with either approach though. The ping was meant as a heads up so that I don't break any QE's tests that might use /host in Tuned pods.

openshift-ci-robot · 2024-07-01T16:11:17Z

@jmencak: This pull request explicitly references no jira issue.

In response to this:

With the principle of least privilege in mind, stop exposing the entirety of the host filesystem.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

MarSik · 2024-07-10T07:12:00Z

@jmencak I think you should be more explicit in the cover message and in the commit about the internal changes to test infrastructure. Apart from that it looks good to me.

With the principle of least privilege in mind, stop exposing the entirety of the host filesystem. Previously, we were mounting the entire host filesystem to "/host". With this change, only the necessary host directories for using TuneD are mounted and a host's /var/lib directory for the operand's persistent /var/lib/ocp-tuned directory. Other changes * For e2e tests, use MCD to write to host's /etc/sysctl.d/ since we are no longer exposing the entire host filesystem for the NTO operand.

jmencak · 2024-07-10T07:30:30Z

Since this affects #1019 GetMachineConfigDaemonForNode(), adding
/hold
Happy to rebase once @ffromani merges #1019

Tal-or · 2024-07-10T07:52:14Z

@jmencak are these kind of tests running on hypershift as well?
If yes, hypershift doesn't have the MCD concept

jmencak · 2024-07-10T08:35:29Z

@jmencak are these kind of tests running on hypershift as well? If yes, hypershift doesn't have the MCD concept

Thank you for looking. No, I'm not aware of any lanes running these tests on HyperShift hosted clusters. In any case, this would not work prior this PR anyway. The "reboots" e2e tests rely on MCO.

jmencak · 2024-07-10T10:52:43Z

/retest

openshift-ci · 2024-07-10T14:21:35Z

@jmencak: all tests passed!

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

openshift-bot · 2024-10-09T01:00:24Z

Issues go stale after 90d of inactivity.

Mark the issue as fresh by commenting /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.
Exclude this issue from closing by commenting /lifecycle frozen.

If this issue is safe to close now please do so with /close.

/lifecycle stale

openshift-bot · 2024-11-08T08:30:42Z

Stale issues rot after 30d of inactivity.

Mark the issue as fresh by commenting /remove-lifecycle rotten.
Rotten issues close after an additional 30d of inactivity.
Exclude this issue from closing by commenting /lifecycle frozen.

If this issue is safe to close now please do so with /close.

/lifecycle rotten
/remove-lifecycle stale

openshift-merge-robot · 2024-11-08T08:30:50Z

PR needs rebase.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

jmencak · 2024-11-08T09:13:48Z

/remove-lifecycle rotten

openshift-ci bot requested review from dagrayvid and rbaturov June 11, 2024 11:02

openshift-ci bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Jun 11, 2024

ffromani reviewed Jun 11, 2024

View reviewed changes

openshift-ci bot requested a review from liqcui June 11, 2024 13:42

jmencak changed the title ~~Stop exposing the entire host filesystem~~ NO-JIRA: Stop exposing the entire host filesystem Jul 1, 2024

openshift-ci-robot added the jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. label Jul 1, 2024

jmencak force-pushed the 4.17-tuned-no-host branch from 18ad80f to 6a1398f Compare July 10, 2024 07:27

openshift-ci bot added the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Jul 10, 2024

openshift-ci bot added the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label Oct 9, 2024

openshift-ci bot added lifecycle/rotten Denotes an issue or PR that has aged beyond stale and will be auto-closed. and removed lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. labels Nov 8, 2024

openshift-merge-robot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Nov 8, 2024

openshift-ci bot removed the lifecycle/rotten Denotes an issue or PR that has aged beyond stale and will be auto-closed. label Nov 8, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

NO-JIRA: Stop exposing the entire host filesystem #1085

NO-JIRA: Stop exposing the entire host filesystem #1085

jmencak commented Jun 11, 2024 •

edited

Loading

openshift-ci bot commented Jun 11, 2024

ffromani left a comment

ffromani Jun 11, 2024

jmencak Jun 11, 2024

jmencak commented Jun 11, 2024

liqcui commented Jun 11, 2024

jmencak commented Jun 11, 2024

openshift-ci-robot commented Jul 1, 2024

MarSik commented Jul 10, 2024

jmencak commented Jul 10, 2024

Tal-or commented Jul 10, 2024

jmencak commented Jul 10, 2024

jmencak commented Jul 10, 2024

openshift-ci bot commented Jul 10, 2024

openshift-bot commented Oct 9, 2024

openshift-bot commented Nov 8, 2024

openshift-merge-robot commented Nov 8, 2024

jmencak commented Nov 8, 2024

NO-JIRA: Stop exposing the entire host filesystem #1085

Are you sure you want to change the base?

NO-JIRA: Stop exposing the entire host filesystem #1085

Conversation

jmencak commented Jun 11, 2024 • edited Loading

openshift-ci bot commented Jun 11, 2024

ffromani left a comment

Choose a reason for hiding this comment

ffromani Jun 11, 2024

Choose a reason for hiding this comment

jmencak Jun 11, 2024

Choose a reason for hiding this comment

jmencak commented Jun 11, 2024

liqcui commented Jun 11, 2024

jmencak commented Jun 11, 2024

openshift-ci-robot commented Jul 1, 2024

MarSik commented Jul 10, 2024

jmencak commented Jul 10, 2024

Tal-or commented Jul 10, 2024

jmencak commented Jul 10, 2024

jmencak commented Jul 10, 2024

openshift-ci bot commented Jul 10, 2024

openshift-bot commented Oct 9, 2024

openshift-bot commented Nov 8, 2024

openshift-merge-robot commented Nov 8, 2024

jmencak commented Nov 8, 2024

jmencak commented Jun 11, 2024 •

edited

Loading