Pulp: Issueshttps://pulp.plan.io/https://pulp.plan.io/favicon.ico2021-08-04T14:14:02ZPulp
Planio Pulp - Issue #9211 (NEW): Vagrant devel installs have SELinux errorshttps://pulp.plan.io/issues/92112021-08-04T14:14:02Zmdepaulo@redhat.com
<p>Because SELinux installs are in editable mode, the .pyc files produce SELinux errors.</p>
<p>Other SELinux errors may exist too due to the devel installs.</p>
<pre><code class="text syntaxhl" data-language="text">TASK [pulp_devel : SELinux status] *********************************************
ok: [pulp3-source-fedora34] => {
"selinux_analyze.stdout_lines": [
"SELinux is preventing gunicorn from search access on the directory vagrant.",
"SELinux is preventing gunicorn from search access on the directory /.",
"SELinux is preventing gunicorn from getattr access on the directory /home/vagrant/devel/pulpcore.",
"SELinux is preventing gunicorn from read access on the directory models.",
"SELinux is preventing gunicorn from open access on the directory /home/vagrant/devel/pulpcore/pulpcore/app/models.",
"SELinux is preventing gunicorn from getattr access on the directory /home/vagrant.",
"SELinux is preventing gunicorn from getattr access on the file /home/vagrant/devel/pulp_ansible/pulp_ansible/app/settings.py.",
"SELinux is preventing gunicorn from read access on the file settings.py.",
"SELinux is preventing gunicorn from open access on the file /home/vagrant/devel/pulpcore/pulpcore/app/settings.py.",
"SELinux is preventing gunicorn from ioctl access on the file /home/vagrant/devel/pulp_ansible/pulp_ansible/app/settings.py.",
"SELinux is preventing pulpcore-worker from read access on the file __init__.cpython-39.pyc.",
"SELinux is preventing pulpcore-worker from open access on the file /home/vagrant/devel/pulp_ansible/pulp_ansible/__pycache__/__init__.cpython-39.pyc.",
"SELinux is preventing pulpcore-worker from ioctl access on the file /home/vagrant/devel/pulp_ansible/pulp_ansible/__pycache__/__init__.cpython-39.pyc.",
"SELinux is preventing pulpcore-worker from name_connect access on the tcp_socket port 5432.",
"SELinux is preventing pulpcore-worker from add_name access on the directory 21847@pulp3-source-fedora34.localhost.example.com.",
"SELinux is preventing pulpcore-worker from remove_name access on the directory 21235@pulp3-source-fedora34.localhost.example.com.",
"SELinux is preventing pulpcore-worker from rmdir access on the directory 21235@pulp3-source-fedora34.localhost.example.com.",
"SELinux is preventing nginx from read access on the file nginx.conf.",
"SELinux is preventing nginx from open access on the file /home/vagrant/devel/pulp_ansible/pulp_ansible/app/webserver_snippets/nginx.conf.",
"SELinux is preventing nginx from getattr access on the file /home/vagrant/devel/pulp_ansible/pulp_ansible/app/webserver_snippets/nginx.conf."
]
}
</code></pre> Pulp - Task #9005 (NEW): pulp_installer's molecule CI should not always connect as roothttps://pulp.plan.io/issues/90052021-07-02T18:07:29Zmdepaulo@redhat.com
<p>This seems to be a product of, or the default configuration of, the docker plugin for molecule. (molecule uses <code>docker exec</code> to talk to the container, not SSH.)</p>
<p>We should look into performance options as we solve this. Even if it means eliminating/weakening SSH encryption on the CI environment / molecule containers.</p> Pulp - Issue #8993 (NEW): SELinux: avc: denied pulpcore-worker on Fedora 34https://pulp.plan.io/issues/89932021-06-30T14:02:12ZStephenW
<p>Hello</p>
<p>I installed Pulp3 on Fedora 34 using "ansible-galaxy collection install pulp.pulp_installer"</p>
<p>at the end of the Ansible run:
TASK [pulp.pulp_installer.pulp_health_check : Checking Pulp services]
msg: 'pulpcore-resource-manager.service state: stopped'</p>
<p>On the managed node, I see lots of avc: denied :</p>
<p>fedoraserver ~]# ausearch -m AVC,USER_AVC -ts recent</p>
<p>time->Tue Jun 29 15:59:06 2021
type=AVC msg=audit(1624975146.441:668194): avc: denied { name_connect } for pid=1129665 comm="pulpcore-worker" dest=6379 scontext=system_u:system_r:init_t:s0 tcontext=system_u:object_r:redis_port_t:s0 tclass=tcp_socket permissive=0</p>
<p>fedoraserver ~]# sepolgen-ifgen
fedoraserver ~]# audit2allow -Ral</p>
<p>require {
type init_t;
}</p>
<p>#============= init_t ==============
corenet_tcp_connect_postgresql_port(init_t)
corenet_tcp_connect_redis_port(init_t)</p>
<p>Thank you</p> Pulp - Task #8848 (NEW): pulp_installer to run CI against stable brancheshttps://pulp.plan.io/issues/88482021-06-01T21:20:04Zmdepaulo@redhat.com
<p>Currently, the source molecule tests test the master branch of pulpcore and master branch of plugins, rather than the appropriate branches like pulpcore 3.11 and pulp_rpm 3.11</p>
<p>So effectively we are relying on release jobs on old branches to catch errors, at release time.</p> Pulp - Story #8086 (NEW): pulp_installer should use latest version of pip to install packageshttps://pulp.plan.io/issues/80862021-01-13T13:42:45Zdkliban@redhat.com
<p>The newer versions of pip include an improved dependency resolution mechanism. The pulp_installer needs a task added to upgrade pip before installing any pulp packages.</p> Pulp - Issue #8055 (NEW): When SELinux is enabled, pulp_installer relabels all the files in /var/...https://pulp.plan.io/issues/80552021-01-08T17:04:00Zdkliban@redhat.com
<p>The installer takes a long time to upgrade an existing system that's running with SELinux enabled because it always relabels /var/lib/pulp in the "Restore SELinux contexts on Pulp dirs that may exist" handler[0]. The list of the directories is here[1].</p>
<p>[0] <a href="https://github.com/pulp/pulp_installer/blob/3.9.0-1/roles/pulp_common/handlers/main.yml#L13-L21" class="external">https://github.com/pulp/pulp_installer/blob/3.9.0-1/roles/pulp_common/handlers/main.yml#L13-L21</a>
[1] <a href="https://github.com/pulp/pulp_installer/blob/3.9.0-1/roles/pulp_common/defaults/main.yml#L63-L66" class="external">https://github.com/pulp/pulp_installer/blob/3.9.0-1/roles/pulp_common/defaults/main.yml#L63-L66</a></p> Pulp - Task #7668 (NEW): remove pid files from the systemd service fileshttps://pulp.plan.io/issues/76682020-10-07T17:05:32Zdkliban@redhat.com
<p>Systemd does not need explicitly defined pid files to keep track of the services. We should make a change the systemd service files similar to the change here: <a href="https://github.com/theforeman/puppet-pulpcore/commit/b3b7c133c513dd2c30b00a81e64b2bb33ca92397" class="external">https://github.com/theforeman/puppet-pulpcore/commit/b3b7c133c513dd2c30b00a81e64b2bb33ca92397</a></p> Pulp - Task #7642 (NEW): Update pulp_installer's list of supported Fedora releaseshttps://pulp.plan.io/issues/76422020-10-01T18:18:58Zmdepaulo@redhat.com
<p>Fedora 32 is supported; pulplift CI tests it. Fedora 30 will probably be dropped in the task that blocks this.</p>
<p>Note that this list is in roles/*/meta/main.yml</p> Pulp - Issue #7641 (NEW): pulp_installer role READMEs should not tell users to set ansible_python...https://pulp.plan.io/issues/76412020-10-01T18:17:29Zmdepaulo@redhat.com
<p>Multiple roles' README.md files list under variables:</p>
<pre><code>ansible_python_interpreter`: **Required**. Path to the Python interpreter.
</code></pre>
<p>It definitely isn't required to be set, since the default behavior is auto_legacy in Ansible 2.8 through 2.11, and auto in 2.12 (planned.)</p>
<p>Furthermore, we probably shouldn't even list it. It is a common built-in Ansible variable that. There are many others, and there seems to be nothing special about it. Perhaps we should list it in case users are running Fedora 30.</p> Pulp - Issue #7640 (NEW): pulp_rpm_prerequisites sets ansible_python_interpreter unnecessarilyhttps://pulp.plan.io/issues/76402020-10-01T18:14:01Zmdepaulo@redhat.com
<p>There is no reason it should be set to:</p>
<pre><code>ansible_python_interpreter: /usr/bin/python
</code></pre>
<p>Since the behavior of auto_legacy and auto is to set it to that (python2) anyway.</p>
<p>It also would only affect the role (and later applied roles) at most, since the role is always (and conditionally) dynamically included. If it has any effect, this makes it harder to test the installer, different interpreter depending on whether or not pulp_rpm is getting installed.</p> Pulp - Task #7575 (NEW): pulp_installer's SELinux support should handle folder paths being changedhttps://pulp.plan.io/issues/75752020-09-25T21:09:08Zmdepaulo@redhat.com
<p>pulp_install_dir, pulp_user_home, etc are currently baked into pulpcore-selinux.</p>
<p>pulp_installer should support accommodating this, such as by replacing the .fc file from pulpcore-selinux, or running label database commands.</p> Pulp - Issue #7479 (NEW): pulp_installer source-upgrade CI is failing on pkg_resources.Contextual...https://pulp.plan.io/issues/74792020-09-09T13:50:14Zmdepaulo@redhat.com
<p>This occurs in debian-10 when running collect static after pulp_devel, not when running it after installing pulp via <code>pulp_all_services</code>.</p>
<p>It started occurring on daily CI and pull requests on 2020-09-8. I re-ran the overnight CI from the prior day (which originally succeeded), and when it did, it failed.</p>
<p>This error stands out as a dependency issue. Sometimes a package other than toml is listed though:</p>
<pre><code>pkg_resources.ContextualVersionConflict: (toml 0.10.1 (/usr/local/lib/pulp/lib/python3.7/site-packages), Requirement.parse('toml<=0.10.0'), {'dynaconf'})
</code></pre>
<p><a href="https://github.com/pulp/pulp_installer/runs/1091080108?check_suite_focus=true#step:7:1467" class="external">https://github.com/pulp/pulp_installer/runs/1091080108?check_suite_focus=true#step:7:1467</a></p>
<p>Full error:</p>
<pre><code> RUNNING HANDLER [pulp_common : Collect static content] *************************
Wednesday 09 September 2020 12:42:43 +0000 (0:00:02.148) 0:08:16.417 ***
fatal: [debian-10]: FAILED! => {
"changed": true,
"cmd": [
"/usr/local/lib/pulp/bin/django-admin",
"collectstatic",
"--noinput",
"--link"
],
"delta": "0:00:00.358256",
"end": "2020-09-09 12:42:43.925665",
"rc": 1,
"start": "2020-09-09 12:42:43.567409"
}
STDERR:
Traceback (most recent call last):
File "/usr/local/lib/pulp/bin/django-admin", line 8, in <module>
sys.exit(execute_from_command_line())
File "/usr/local/lib/pulp/lib/python3.7/site-packages/django/core/management/__init__.py", line 381, in execute_from_command_line
utility.execute()
File "/usr/local/lib/pulp/lib/python3.7/site-packages/django/core/management/__init__.py", line 325, in execute
settings.INSTALLED_APPS
File "/usr/local/lib/pulp/lib/python3.7/site-packages/django/conf/__init__.py", line 79, in __getattr__
self._setup(name)
File "/usr/local/lib/pulp/lib/python3.7/site-packages/django/conf/__init__.py", line 66, in _setup
self._wrapped = Settings(settings_module)
File "/usr/local/lib/pulp/lib/python3.7/site-packages/django/conf/__init__.py", line 157, in __init__
mod = importlib.import_module(self.SETTINGS_MODULE)
File "/usr/lib/python3.7/importlib/__init__.py", line 127, in import_module
return _bootstrap._gcd_import(name[level:], package, level)
File "<frozen importlib._bootstrap>", line 1006, in _gcd_import
File "<frozen importlib._bootstrap>", line 983, in _find_and_load
File "<frozen importlib._bootstrap>", line 967, in _find_and_load_unlocked
File "<frozen importlib._bootstrap>", line 677, in _load_unlocked
File "<frozen importlib._bootstrap_external>", line 728, in exec_module
File "<frozen importlib._bootstrap>", line 219, in _call_with_frames_removed
File "/usr/local/lib/pulp/lib/python3.7/site-packages/pulpcore/app/settings.py", line 76, in <module>
plugin_app_config = entry_point.load()
File "/usr/local/lib/pulp/lib/python3.7/site-packages/pkg_resources/__init__.py", line 2410, in load
self.require(*args, **kwargs)
File "/usr/local/lib/pulp/lib/python3.7/site-packages/pkg_resources/__init__.py", line 2433, in require
items = working_set.resolve(reqs, env, installer, extras=self.extras)
File "/usr/local/lib/pulp/lib/python3.7/site-packages/pkg_resources/__init__.py", line 791, in resolve
raise VersionConflict(dist, req).with_context(dependent_req)
pkg_resources.ContextualVersionConflict: (toml 0.10.1 (/usr/local/lib/pulp/lib/python3.7/site-packages), Requirement.parse('toml<=0.10.0'), {'dynaconf'})
MSG:
non-zero return code
changed: [fedora-31]
</code></pre> Pulp - Task #7281 (NEW): Update docs to state that installer can only install one cluster at a timehttps://pulp.plan.io/issues/72812020-08-05T14:39:19Zdkliban@redhat.com
<p>The documentation needs to have a "Known limitations" section. One of the items should state that that the installer can only install one Pulp cluster at a time.</p> Pulp - Task #6942 (NEW): Update galaxy_ng docs for the pulp_installer install-from-rpm supporthttps://pulp.plan.io/issues/69422020-06-09T15:45:37Zmdepaulo@redhat.com
<p>Its docs should show the example variables for doing this.</p> Pulp - Story #6688 (NEW): pulp_installer: preflight check and system-wide packages are incompatiblehttps://pulp.plan.io/issues/66882020-05-08T14:40:15Zmdepaulo@redhat.com
<p>Part of the pre-flight check does not understand system-wide packages, but another part is still affected by them.</p>
<p>This leads to false positives (enforcements) in addition to false negatives in the preflight check.</p>
<p>We no longer need system-wide packages, so we should remove support for it, and migrate user installs off of it, as safely as possible.</p>