1
0
forked from rpms/sos
sos/sos-bz2130922-collect-ocp412.patch
2022-11-05 08:13:08 +00:00

63 lines
2.4 KiB
Diff

From 765f5f283bdb4747b0069f2f5d3381134b4b9a95 Mon Sep 17 00:00:00 2001
From: Jake Hunsaker <jhunsake@redhat.com>
Date: Thu, 15 Sep 2022 12:36:42 -0400
Subject: [PATCH] [ocp] Add newly required labels to temp OCP namespace
Newer OCP versions have a more restrictive default deployment
configuration. As such, add the required labels to the temporary
namespace/project we use for collections.
Signed-off-by: Jake Hunsaker <jhunsake@redhat.com>
---
sos/collector/clusters/ocp.py | 23 ++++++++++++++++++++++-
1 file changed, 22 insertions(+), 1 deletion(-)
diff --git a/sos/collector/clusters/ocp.py b/sos/collector/clusters/ocp.py
index 06301536f..92c4e04a2 100644
--- a/sos/collector/clusters/ocp.py
+++ b/sos/collector/clusters/ocp.py
@@ -142,12 +142,32 @@ def setup(self):
self.fmt_oc_cmd("new-project %s" % self.project)
)
if ret['status'] == 0:
+ self._label_sos_project()
return True
self.log_debug("Failed to create project: %s" % ret['output'])
raise Exception("Failed to create temporary project for collection. "
"\nAborting...")
+ def _label_sos_project(self):
+ """Add pertinent labels to the temporary project we've created so that
+ our privileged containers can properly run.
+ """
+ labels = [
+ "security.openshift.io/scc.podSecurityLabelSync=false",
+ "pod-security.kubernetes.io/enforce=privileged"
+ ]
+ for label in labels:
+ ret = self.exec_primary_cmd(
+ self.fmt_oc_cmd(
+ f"label namespace {self.project} {label} --overwrite"
+ )
+ )
+ if not ret['status'] == 0:
+ raise Exception(
+ f"Error applying namespace labels: {ret['output']}"
+ )
+
def cleanup(self):
"""Remove the project we created to execute within
"""
@@ -231,8 +251,9 @@ def get_nodes(self):
for node_name, node in self.node_dict.items():
if roles:
for role in roles:
- if role == node['roles']:
+ if role in node['roles']:
nodes.append(node_name)
+ break
else:
nodes.append(node_name)
else: