From 94a2d6e30de3fef14a93b2580c063989079b7e16 Mon Sep 17 00:00:00 2001 From: AlmaLinux RelEng Bot Date: Wed, 15 Jul 2026 21:43:56 -0400 Subject: [PATCH] import Oracle_OSS resource-agents-4.10.0-111.el9_8.5 --- ...7-podman-etcd-remove-cert-monitoring.patch | 183 ++++++++++++++++++ SPECS/resource-agents.spec | 9 +- 2 files changed, 191 insertions(+), 1 deletion(-) create mode 100644 SOURCES/RHEL-188107-podman-etcd-remove-cert-monitoring.patch diff --git a/SOURCES/RHEL-188107-podman-etcd-remove-cert-monitoring.patch b/SOURCES/RHEL-188107-podman-etcd-remove-cert-monitoring.patch new file mode 100644 index 0000000..7236513 --- /dev/null +++ b/SOURCES/RHEL-188107-podman-etcd-remove-cert-monitoring.patch @@ -0,0 +1,183 @@ +From 5709a5e92e0b375642f74fe053ed86a619c69c5f Mon Sep 17 00:00:00 2001 +From: Pablo Fontanilla +Date: Mon, 15 Jun 2026 15:14:00 +0200 +Subject: [PATCH] podman-etcd: remove cert monitoring infrastructure +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +etcd 3.6+ hot-reloads TLS certificates on each new TLS handshake via +Go's GetCertificate callback (etcd PR #7829). The cert hash monitor +that ran every 10s cycle is therefore dead code — it can never trigger +a useful action. + +Remove: etcd_certificates_hash_manager() function, etcd_certs_dir OCF +parameter, ETCD_CERTS_HASH_FILE variable, and all four call sites +(monitor, start, validate, archive). 86 lines deleted. + +This also eliminates the root cause of OCPBUGS-86897: the monitor +detected cert changes and returned OCF_ERR_GENERIC, which triggered +Pacemaker to stop etcd, call leave_etcd_member_list(), and force the +node to rejoin as a learner with a new member ID — on every cert +rotation, 10 times per CI run. + +Signed-off-by: Pablo Fontanilla +--- + heartbeat/podman-etcd | 88 +------------------------------------------ + 1 file changed, 1 insertion(+), 87 deletions(-) + +diff --git a/heartbeat/podman-etcd b/heartbeat/podman-etcd +index d0fc22e1f1..0195633af4 100755 +--- a/heartbeat/podman-etcd ++++ b/heartbeat/podman-etcd +@@ -40,7 +40,6 @@ + # Parameter defaults + OCF_RESKEY_image_default="default" + OCF_RESKEY_pod_manifest_default="/etc/kubernetes/static-pod-resources/etcd-certs/configmaps/external-etcd-pod/pod.yaml" +-OCF_RESKEY_etcd_certs_dir_default="/etc/kubernetes/static-pod-resources/etcd-certs" + OCF_RESKEY_name_default="etcd" + OCF_RESKEY_nic_default="br-ex" + OCF_RESKEY_authfile_default="/var/lib/kubelet/config.json" +@@ -54,7 +53,6 @@ OCF_RESKEY_kubeconfig_default="/etc/kubernetes/static-pod-resources/kube-apiserv + + : ${OCF_RESKEY_image=${OCF_RESKEY_image_default}} + : ${OCF_RESKEY_pod_manifest=${OCF_RESKEY_pod_manifest_default}} +-: ${OCF_RESKEY_etcd_certs_dir=${OCF_RESKEY_etcd_certs_dir_default}} + : ${OCF_RESKEY_name=${OCF_RESKEY_name_default}} + : ${OCF_RESKEY_nic=${OCF_RESKEY_nic_default}} + : ${OCF_RESKEY_authfile=${OCF_RESKEY_authfile_default}} +@@ -94,15 +92,6 @@ The Pod manifest with the configuration for Etcd. + + + +- +- +-The Etcd certificates directory mounted into the etcd container. +-The agent will monitor this directory for changes and restart the etcd container if the certificates have changed. +- +-Etcd certificates directory +- +- +- + + + The podman image to base this container off of. +@@ -326,60 +315,6 @@ Expects to have a fully populated OCF RA-compliant environment set. + END + } + +-etcd_certificates_hash_manager() +-{ +- local action="$1" +- local current_hash +- local stored_hash +- +- # If the certs directory doesn't exist, consider it unchanged +- if [ ! -d "$OCF_RESKEY_etcd_certs_dir" ]; then +- ocf_log warn "certificates directory $OCF_RESKEY_etcd_certs_dir does not exist, skipping certificate monitoring" +- return $OCF_SUCCESS +- fi +- +- # Calculate hash of all certificate files, ignore key files to avoid accidental disclosure of sensitive information +- # we only need to monitor the certificate files to detect changes. +- if ! current_hash=$(find "$OCF_RESKEY_etcd_certs_dir" -type f \( -name "*.crt" \) -exec sha256sum {} \; | sort | sha256sum | cut -d' ' -f1); then +- ocf_log err "failed to calculate certificate files hash" +- return $OCF_ERR_GENERIC +- fi +- +- # If no stored hash exists, create one and return success +- if [ ! -f "$ETCD_CERTS_HASH_FILE" ]; then +- echo "$current_hash" > "$ETCD_CERTS_HASH_FILE" +- ocf_log info "created initial certificate hash: $current_hash" +- return $OCF_SUCCESS +- fi +- +- case "$action" in +- "update") +- if ! echo "$current_hash" > "$ETCD_CERTS_HASH_FILE"; then +- ocf_log err "failed to update certificate hash file $ETCD_CERTS_HASH_FILE" +- fi +- ocf_log info "updated certificate hash: $current_hash" +- ;; +- "check") +- if ! stored_hash=$(cat "$ETCD_CERTS_HASH_FILE"); then +- ocf_log err "failed to read stored certificate hash from $ETCD_CERTS_HASH_FILE" +- # This should not happen but if for some reason we can not read the stored hash, +- # use the current hash and log the error but allow etcd to run as long as possible. +- stored_hash="$current_hash" +- fi +- if [ "$current_hash" != "$stored_hash" ]; then +- ocf_exit_reason "$NODENAME etcd certificate files have changed (stored: $stored_hash, current: $current_hash)" +- return $OCF_ERR_GENERIC +- fi +- ;; +- *) +- ocf_log err "unsupported action: $action" +- return $OCF_ERR_GENERIC +- ;; +- esac +- +- return $OCF_SUCCESS +-} +- + monitor_cmd_exec() + { + local rc=$OCF_SUCCESS +@@ -456,7 +391,7 @@ archive_current_container() + + # archive corresponding etcd configuration files + local files_to_archive="" +- for file in "$OCF_RESKEY_authfile" "$POD_MANIFEST_COPY" "$ETCD_CONFIGURATION_FILE" "$ETCD_CERTS_HASH_FILE"; do ++ for file in "$OCF_RESKEY_authfile" "$POD_MANIFEST_COPY" "$ETCD_CONFIGURATION_FILE"; do + if [ -f "$file" ]; then + files_to_archive="$files_to_archive $file" + else +@@ -1826,11 +1761,6 @@ podman_monitor() + ;; + esac + +- # Check if certificate files have changed, if they have, etcd needs to be restarted +- if ! etcd_certificates_hash_manager "check"; then +- return $OCF_ERR_GENERIC +- fi +- + if is_learner; then + ocf_log info "$NODENAME is learner. Cannot get member id" + return "$OCF_SUCCESS" +@@ -2141,14 +2071,6 @@ podman_start() + return $OCF_ERR_GENERIC + fi + +- # Update the certificate hash after the container has started successfully +- # this is to ensure that the certificate hash is updated after a restart is initiated +- # by a cert rotation event from the monitor command. +- if ! etcd_certificates_hash_manager "update"; then +- ocf_exit_reason "etcd certificate hash manager failed to update the certificate hash" +- return $OCF_ERR_GENERIC +- fi +- + # check if the container has already started + podman_simple_status + if [ $? -eq $OCF_SUCCESS ]; then +@@ -2628,13 +2550,6 @@ podman_validate() + exit $OCF_ERR_CONFIGURED + fi + +- if ! echo "validation test" > "$ETCD_CERTS_HASH_FILE" \ +- || ! cat "$ETCD_CERTS_HASH_FILE" >/dev/null 2>&1 \ +- || ! rm "$ETCD_CERTS_HASH_FILE"; then +- ocf_exit_reason "cannot read/write to certificate hash file $ETCD_CERTS_HASH_FILE" +- exit $OCF_ERR_GENERIC +- fi +- + return $OCF_SUCCESS + } + +@@ -2687,7 +2602,6 @@ ETCD_MEMBER_DIR="/var/lib/etcd/member" + ETCD_REVISION_JSON="/var/lib/etcd/revision.json" + ETCD_REVISION_BUMP_PERCENTAGE=0.2 + ETCD_BUMP_REV_DEFAULT=1000000000 +-ETCD_CERTS_HASH_FILE="${OCF_RESKEY_config_location}/certs.hash" + # State file location: Uses HA_RSCTMP to ensure automatic cleanup on reboot. + # This is intentional - reboots are controlled stops, not failures requiring detection. + CONTAINER_HEARTBEAT_FILE=${HA_RSCTMP}/podman-container-last-running diff --git a/SPECS/resource-agents.spec b/SPECS/resource-agents.spec index 3203b68..0be3887 100644 --- a/SPECS/resource-agents.spec +++ b/SPECS/resource-agents.spec @@ -45,7 +45,7 @@ Name: resource-agents Summary: Open Source HA Reusable Cluster Resource Scripts Version: 4.10.0 -Release: 111%{?rcver:%{rcver}}%{?numcomm:.%{numcomm}}%{?alphatag:.%{alphatag}}%{?dirty:.%{dirty}}%{?dist}.4 +Release: 111%{?rcver:%{rcver}}%{?numcomm:.%{numcomm}}%{?alphatag:.%{alphatag}}%{?dirty:.%{dirty}}%{?dist}.5 License: GPLv2+ and LGPLv2+ URL: https://github.com/ClusterLabs/resource-agents Source0: %{upstream_prefix}-%{upstream_version}.tar.gz @@ -209,6 +209,7 @@ Patch156: RHEL-166183-2-db2-do-not-use-db2stop-to-avoid-divergence-in-the-log.pa Patch157: RHEL-177849-podman-etcd-fix-port-2380-binding-race.patch Patch158: RHEL-177838-podman-etcd-fix-machine-deletion-deadlock.patch Patch159: RHEL-177843-podman-etcd-fix-learner-start-deadlock.patch +Patch160: RHEL-188107-podman-etcd-remove-cert-monitoring.patch # bundled ha-cloud-support libs Patch500: ha-cloud-support-aliyun.patch @@ -513,6 +514,7 @@ exit 1 %patch -p1 -P 157 %patch -p1 -P 158 %patch -p1 -P 159 +%patch -p1 -P 160 # bundled ha-cloud-support libs %patch -p1 -P 500 @@ -847,6 +849,11 @@ rm -rf %{buildroot}/usr/share/doc/resource-agents %{_usr}/lib/ocf/lib/heartbeat/OCF_*.pm %changelog +* Thu Jun 25 2026 Oyvind Albrigtsen - 4.10.0-111.5 +- podman-etcd: remove cert monitoring + + Resolves: RHEL-188107 + * Wed May 20 2026 Oyvind Albrigtsen - 4.10.0-111.4 - podman-etcd: fix port 2380 binding race - podman-etcd: fix machine deletion deadlock