import Oracle_OSS resource-agents-4.10.0-111.el9_8.5
This commit is contained in:
AlmaLinux RelEng Bot
parent
2fe04c28a5
commit
94a2d6e30d
183
SOURCES/RHEL-188107-podman-etcd-remove-cert-monitoring.patch
Normal file
183
SOURCES/RHEL-188107-podman-etcd-remove-cert-monitoring.patch
Normal file
@ -0,0 +1,183 @@
|
||||
From 5709a5e92e0b375642f74fe053ed86a619c69c5f Mon Sep 17 00:00:00 2001
|
||||
From: Pablo Fontanilla <pfontani@redhat.com>
|
||||
Date: Mon, 15 Jun 2026 15:14:00 +0200
|
||||
Subject: [PATCH] podman-etcd: remove cert monitoring infrastructure
|
||||
MIME-Version: 1.0
|
||||
Content-Type: text/plain; charset=UTF-8
|
||||
Content-Transfer-Encoding: 8bit
|
||||
|
||||
etcd 3.6+ hot-reloads TLS certificates on each new TLS handshake via
|
||||
Go's GetCertificate callback (etcd PR #7829). The cert hash monitor
|
||||
that ran every 10s cycle is therefore dead code — it can never trigger
|
||||
a useful action.
|
||||
|
||||
Remove: etcd_certificates_hash_manager() function, etcd_certs_dir OCF
|
||||
parameter, ETCD_CERTS_HASH_FILE variable, and all four call sites
|
||||
(monitor, start, validate, archive). 86 lines deleted.
|
||||
|
||||
This also eliminates the root cause of OCPBUGS-86897: the monitor
|
||||
detected cert changes and returned OCF_ERR_GENERIC, which triggered
|
||||
Pacemaker to stop etcd, call leave_etcd_member_list(), and force the
|
||||
node to rejoin as a learner with a new member ID — on every cert
|
||||
rotation, 10 times per CI run.
|
||||
|
||||
Signed-off-by: Pablo Fontanilla <pfontani@redhat.com>
|
||||
---
|
||||
heartbeat/podman-etcd | 88 +------------------------------------------
|
||||
1 file changed, 1 insertion(+), 87 deletions(-)
|
||||
|
||||
diff --git a/heartbeat/podman-etcd b/heartbeat/podman-etcd
|
||||
index d0fc22e1f1..0195633af4 100755
|
||||
--- a/heartbeat/podman-etcd
|
||||
+++ b/heartbeat/podman-etcd
|
||||
@@ -40,7 +40,6 @@
|
||||
# Parameter defaults
|
||||
OCF_RESKEY_image_default="default"
|
||||
OCF_RESKEY_pod_manifest_default="/etc/kubernetes/static-pod-resources/etcd-certs/configmaps/external-etcd-pod/pod.yaml"
|
||||
-OCF_RESKEY_etcd_certs_dir_default="/etc/kubernetes/static-pod-resources/etcd-certs"
|
||||
OCF_RESKEY_name_default="etcd"
|
||||
OCF_RESKEY_nic_default="br-ex"
|
||||
OCF_RESKEY_authfile_default="/var/lib/kubelet/config.json"
|
||||
@@ -54,7 +53,6 @@ OCF_RESKEY_kubeconfig_default="/etc/kubernetes/static-pod-resources/kube-apiserv
|
||||
|
||||
: ${OCF_RESKEY_image=${OCF_RESKEY_image_default}}
|
||||
: ${OCF_RESKEY_pod_manifest=${OCF_RESKEY_pod_manifest_default}}
|
||||
-: ${OCF_RESKEY_etcd_certs_dir=${OCF_RESKEY_etcd_certs_dir_default}}
|
||||
: ${OCF_RESKEY_name=${OCF_RESKEY_name_default}}
|
||||
: ${OCF_RESKEY_nic=${OCF_RESKEY_nic_default}}
|
||||
: ${OCF_RESKEY_authfile=${OCF_RESKEY_authfile_default}}
|
||||
@@ -94,15 +92,6 @@ The Pod manifest with the configuration for Etcd.
|
||||
<content type="string" default="${OCF_RESKEY_pod_manifest_default}"/>
|
||||
</parameter>
|
||||
|
||||
-<parameter name="etcd_certs_dir" required="0" unique="0">
|
||||
-<longdesc lang="en">
|
||||
-The Etcd certificates directory mounted into the etcd container.
|
||||
-The agent will monitor this directory for changes and restart the etcd container if the certificates have changed.
|
||||
-</longdesc>
|
||||
-<shortdesc lang="en">Etcd certificates directory</shortdesc>
|
||||
-<content type="string" default="${OCF_RESKEY_etcd_certs_dir_default}"/>
|
||||
-</parameter>
|
||||
-
|
||||
<parameter name="image" required="0" unique="0">
|
||||
<longdesc lang="en">
|
||||
The podman image to base this container off of.
|
||||
@@ -326,60 +315,6 @@ Expects to have a fully populated OCF RA-compliant environment set.
|
||||
END
|
||||
}
|
||||
|
||||
-etcd_certificates_hash_manager()
|
||||
-{
|
||||
- local action="$1"
|
||||
- local current_hash
|
||||
- local stored_hash
|
||||
-
|
||||
- # If the certs directory doesn't exist, consider it unchanged
|
||||
- if [ ! -d "$OCF_RESKEY_etcd_certs_dir" ]; then
|
||||
- ocf_log warn "certificates directory $OCF_RESKEY_etcd_certs_dir does not exist, skipping certificate monitoring"
|
||||
- return $OCF_SUCCESS
|
||||
- fi
|
||||
-
|
||||
- # Calculate hash of all certificate files, ignore key files to avoid accidental disclosure of sensitive information
|
||||
- # we only need to monitor the certificate files to detect changes.
|
||||
- if ! current_hash=$(find "$OCF_RESKEY_etcd_certs_dir" -type f \( -name "*.crt" \) -exec sha256sum {} \; | sort | sha256sum | cut -d' ' -f1); then
|
||||
- ocf_log err "failed to calculate certificate files hash"
|
||||
- return $OCF_ERR_GENERIC
|
||||
- fi
|
||||
-
|
||||
- # If no stored hash exists, create one and return success
|
||||
- if [ ! -f "$ETCD_CERTS_HASH_FILE" ]; then
|
||||
- echo "$current_hash" > "$ETCD_CERTS_HASH_FILE"
|
||||
- ocf_log info "created initial certificate hash: $current_hash"
|
||||
- return $OCF_SUCCESS
|
||||
- fi
|
||||
-
|
||||
- case "$action" in
|
||||
- "update")
|
||||
- if ! echo "$current_hash" > "$ETCD_CERTS_HASH_FILE"; then
|
||||
- ocf_log err "failed to update certificate hash file $ETCD_CERTS_HASH_FILE"
|
||||
- fi
|
||||
- ocf_log info "updated certificate hash: $current_hash"
|
||||
- ;;
|
||||
- "check")
|
||||
- if ! stored_hash=$(cat "$ETCD_CERTS_HASH_FILE"); then
|
||||
- ocf_log err "failed to read stored certificate hash from $ETCD_CERTS_HASH_FILE"
|
||||
- # This should not happen but if for some reason we can not read the stored hash,
|
||||
- # use the current hash and log the error but allow etcd to run as long as possible.
|
||||
- stored_hash="$current_hash"
|
||||
- fi
|
||||
- if [ "$current_hash" != "$stored_hash" ]; then
|
||||
- ocf_exit_reason "$NODENAME etcd certificate files have changed (stored: $stored_hash, current: $current_hash)"
|
||||
- return $OCF_ERR_GENERIC
|
||||
- fi
|
||||
- ;;
|
||||
- *)
|
||||
- ocf_log err "unsupported action: $action"
|
||||
- return $OCF_ERR_GENERIC
|
||||
- ;;
|
||||
- esac
|
||||
-
|
||||
- return $OCF_SUCCESS
|
||||
-}
|
||||
-
|
||||
monitor_cmd_exec()
|
||||
{
|
||||
local rc=$OCF_SUCCESS
|
||||
@@ -456,7 +391,7 @@ archive_current_container()
|
||||
|
||||
# archive corresponding etcd configuration files
|
||||
local files_to_archive=""
|
||||
- for file in "$OCF_RESKEY_authfile" "$POD_MANIFEST_COPY" "$ETCD_CONFIGURATION_FILE" "$ETCD_CERTS_HASH_FILE"; do
|
||||
+ for file in "$OCF_RESKEY_authfile" "$POD_MANIFEST_COPY" "$ETCD_CONFIGURATION_FILE"; do
|
||||
if [ -f "$file" ]; then
|
||||
files_to_archive="$files_to_archive $file"
|
||||
else
|
||||
@@ -1826,11 +1761,6 @@ podman_monitor()
|
||||
;;
|
||||
esac
|
||||
|
||||
- # Check if certificate files have changed, if they have, etcd needs to be restarted
|
||||
- if ! etcd_certificates_hash_manager "check"; then
|
||||
- return $OCF_ERR_GENERIC
|
||||
- fi
|
||||
-
|
||||
if is_learner; then
|
||||
ocf_log info "$NODENAME is learner. Cannot get member id"
|
||||
return "$OCF_SUCCESS"
|
||||
@@ -2141,14 +2071,6 @@ podman_start()
|
||||
return $OCF_ERR_GENERIC
|
||||
fi
|
||||
|
||||
- # Update the certificate hash after the container has started successfully
|
||||
- # this is to ensure that the certificate hash is updated after a restart is initiated
|
||||
- # by a cert rotation event from the monitor command.
|
||||
- if ! etcd_certificates_hash_manager "update"; then
|
||||
- ocf_exit_reason "etcd certificate hash manager failed to update the certificate hash"
|
||||
- return $OCF_ERR_GENERIC
|
||||
- fi
|
||||
-
|
||||
# check if the container has already started
|
||||
podman_simple_status
|
||||
if [ $? -eq $OCF_SUCCESS ]; then
|
||||
@@ -2628,13 +2550,6 @@ podman_validate()
|
||||
exit $OCF_ERR_CONFIGURED
|
||||
fi
|
||||
|
||||
- if ! echo "validation test" > "$ETCD_CERTS_HASH_FILE" \
|
||||
- || ! cat "$ETCD_CERTS_HASH_FILE" >/dev/null 2>&1 \
|
||||
- || ! rm "$ETCD_CERTS_HASH_FILE"; then
|
||||
- ocf_exit_reason "cannot read/write to certificate hash file $ETCD_CERTS_HASH_FILE"
|
||||
- exit $OCF_ERR_GENERIC
|
||||
- fi
|
||||
-
|
||||
return $OCF_SUCCESS
|
||||
}
|
||||
|
||||
@@ -2687,7 +2602,6 @@ ETCD_MEMBER_DIR="/var/lib/etcd/member"
|
||||
ETCD_REVISION_JSON="/var/lib/etcd/revision.json"
|
||||
ETCD_REVISION_BUMP_PERCENTAGE=0.2
|
||||
ETCD_BUMP_REV_DEFAULT=1000000000
|
||||
-ETCD_CERTS_HASH_FILE="${OCF_RESKEY_config_location}/certs.hash"
|
||||
# State file location: Uses HA_RSCTMP to ensure automatic cleanup on reboot.
|
||||
# This is intentional - reboots are controlled stops, not failures requiring detection.
|
||||
CONTAINER_HEARTBEAT_FILE=${HA_RSCTMP}/podman-container-last-running
|
||||
@ -45,7 +45,7 @@
|
||||
Name: resource-agents
|
||||
Summary: Open Source HA Reusable Cluster Resource Scripts
|
||||
Version: 4.10.0
|
||||
Release: 111%{?rcver:%{rcver}}%{?numcomm:.%{numcomm}}%{?alphatag:.%{alphatag}}%{?dirty:.%{dirty}}%{?dist}.4
|
||||
Release: 111%{?rcver:%{rcver}}%{?numcomm:.%{numcomm}}%{?alphatag:.%{alphatag}}%{?dirty:.%{dirty}}%{?dist}.5
|
||||
License: GPLv2+ and LGPLv2+
|
||||
URL: https://github.com/ClusterLabs/resource-agents
|
||||
Source0: %{upstream_prefix}-%{upstream_version}.tar.gz
|
||||
@ -209,6 +209,7 @@ Patch156: RHEL-166183-2-db2-do-not-use-db2stop-to-avoid-divergence-in-the-log.pa
|
||||
Patch157: RHEL-177849-podman-etcd-fix-port-2380-binding-race.patch
|
||||
Patch158: RHEL-177838-podman-etcd-fix-machine-deletion-deadlock.patch
|
||||
Patch159: RHEL-177843-podman-etcd-fix-learner-start-deadlock.patch
|
||||
Patch160: RHEL-188107-podman-etcd-remove-cert-monitoring.patch
|
||||
|
||||
# bundled ha-cloud-support libs
|
||||
Patch500: ha-cloud-support-aliyun.patch
|
||||
@ -513,6 +514,7 @@ exit 1
|
||||
%patch -p1 -P 157
|
||||
%patch -p1 -P 158
|
||||
%patch -p1 -P 159
|
||||
%patch -p1 -P 160
|
||||
|
||||
# bundled ha-cloud-support libs
|
||||
%patch -p1 -P 500
|
||||
@ -847,6 +849,11 @@ rm -rf %{buildroot}/usr/share/doc/resource-agents
|
||||
%{_usr}/lib/ocf/lib/heartbeat/OCF_*.pm
|
||||
|
||||
%changelog
|
||||
* Thu Jun 25 2026 Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.10.0-111.5
|
||||
- podman-etcd: remove cert monitoring
|
||||
|
||||
Resolves: RHEL-188107
|
||||
|
||||
* Wed May 20 2026 Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.10.0-111.4
|
||||
- podman-etcd: fix port 2380 binding race
|
||||
- podman-etcd: fix machine deletion deadlock
|
||||
|
||||
Loading…
Reference in New Issue
Block a user