Skip to content

[release-4.18] snc: Add logic to create /Users top level directory for OCP #1049

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 2 commits into from
May 16, 2025
Merged

[release-4.18] snc: Add logic to create /Users top level directory for OCP #1049

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
0d6edd1
Revert "Add logic to make filesystem immuatable for directory sharing…
praveenkumar Apr 8, 2025
66c3288
snc: Add logic to create /User top level directory for OCP
praveenkumar Apr 8, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
60 changes: 0 additions & 60 deletions 99_master-create-users-symlink.yaml
View file
Open in desktop

This file was deleted.

39 changes: 35 additions & 4 deletions snc.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -147,10 +147,6 @@ cp cluster-network-03-config.yaml ${INSTALL_DIR}/manifests/
cp 99_master-chronyd-mask.yaml $INSTALL_DIR/openshift/
# Add dummy network unit file
cp 99-openshift-machineconfig-master-dummy-networks.yaml $INSTALL_DIR/openshift/
# Add unit file for creating /Users and symlink it to /var/Users
# It is used for mounting shared directory on Mac
# https://github.com/coreos/rpm-ostree/issues/337
cp 99_master-create-users-symlink.yaml $INSTALL_DIR/openshift/
# Add kubelet config resource to make change in kubelet
DYNAMIC_DATA=$(base64 -w0 node-sizing-enabled.env) envsubst < 99_master-node-sizing-enabled-env.yaml.in > $INSTALL_DIR/openshift/99_master-node-sizing-enabled-env.yaml
# Add codeReadyContainer as invoker to identify it with telemeter
Expand Down Expand Up @@ -245,6 +241,39 @@ retry ${OC} delete mc chronyd-mask
# Wait for the cluster again to become stable because of all the patches/changes
wait_till_cluster_stable

# This section is used to create a custom-os image which have `/Users`
# For more details check https://github.com/crc-org/snc/issues/1041#issuecomment-2785928976
# This should be performed before removing pull secret
# Unsetting KUBECONFIG is required because it has default `system:admin` user which doesn't able to create
# token to login to registry and kubeadmin user is required for that.
unset KUBECONFIG
RHCOS_IMAGE=$(${OC} adm release info -a ${OPENSHIFT_PULL_SECRET_PATH} ${OPENSHIFT_INSTALL_RELEASE_IMAGE_OVERRIDE} --image-for=rhel-coreos)
cat << EOF > ${INSTALL_DIR}/Containerfile
FROM scratch
RUN ln -sf var/Users /Users && mkdir /var/Users
EOF
podman build --from ${RHCOS_IMAGE} --authfile ${OPENSHIFT_PULL_SECRET_PATH} -t default-route-openshift-image-registry.apps-crc.testing/openshift-machine-config-operator/rhcos:latest --file ${INSTALL_DIR}/Containerfile .
retry ${OC} login -u kubeadmin -p $(cat ${INSTALL_DIR}/auth/kubeadmin-password) --insecure-skip-tls-verify=true api.${SNC_PRODUCT_NAME}.${BASE_DOMAIN}:6443
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🚨 issue (security): Hardcoded password found for kubeadmin user.

The password for the kubeadmin user is being read directly from a file and used in a command. This is a security risk as the password could be exposed.

retry ${OC} registry login -a ${INSTALL_DIR}/reg.json
podman push --authfile ${INSTALL_DIR}/reg.json --tls-verify=false default-route-openshift-image-registry.apps-crc.testing/openshift-machine-config-operator/rhcos:latest
cat << EOF > ${INSTALL_DIR}/custom-os-mc.yaml
apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
metadata:
labels:
machineconfiguration.openshift.io/role: master
name: custom-image
spec:
osImageURL: image-registry.openshift-image-registry.svc:5000/openshift-machine-config-operator/rhcos:latest
EOF
retry ${OC} apply -f ${INSTALL_DIR}/custom-os-mc.yaml
sleep 60
# Wait till machine config pool is updated correctly
while retry ${OC} get mcp master -ojsonpath='{.status.conditions[?(@.type!="Updated")].status}' | grep True; do
echo "Machine config still in updating/degrading state"
done
Comment on lines +272 to +274
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

suggestion (performance): Consider introducing a delay in the while loop to avoid busy looping.

Adding a short sleep (e.g., 'sleep 5') inside the loop could prevent high CPU usage during the waiting period if the machine config pool takes time to update.

Suggested change
while retry ${OC} get mcp master -ojsonpath='{.status.conditions[?(@.type!="Updated")].status}' | grep True; do
echo "Machine config still in updating/degrading state"
done
while retry ${OC} get mcp master -ojsonpath='{.status.conditions[?(@.type!="Updated")].status}' | grep True; do
echo "Machine config still in updating/degrading state"
sleep 5
done


export KUBECONFIG=${INSTALL_DIR}/auth/kubeconfig
mc_before_removing_pullsecret=$(retry ${OC} get mc --sort-by=.metadata.creationTimestamp --no-headers -oname)
# Replace pull secret with a null json string '{}'
retry ${OC} replace -f pull-secret.yaml
Expand Down Expand Up @@ -277,3 +306,5 @@ ${SSH} core@api.${SNC_PRODUCT_NAME}.${BASE_DOMAIN} -- 'sudo crictl rmi --prune'

# Remove the baremetal_runtimecfg container which is temp created
${SSH} core@api.${SNC_PRODUCT_NAME}.${BASE_DOMAIN} -- "sudo podman rm baremetal_runtimecfg"