rpms/resource-agents
7
0
Fork 0
Code Issues Pull Requests Releases Activity

Add AlmaLinux to RHEL-based distro detection in ocf-distro

Browse Source
This commit is contained in:
Andrew Lukoshko 2026-07-16 02:44:06 +00:00 committed by root
commit c835c977db
2 changed files with 192 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

183
SOURCES/RHEL-188107-podman-etcd-remove-cert-monitoring.patch Normal file
View File

@ -0,0 +1,183 @@
From 5709a5e92e0b375642f74fe053ed86a619c69c5f Mon Sep 17 00:00:00 2001
From: Pablo Fontanilla <pfontani@redhat.com>
Date: Mon, 15 Jun 2026 15:14:00 +0200
Subject: [PATCH] podman-etcd: remove cert monitoring infrastructure
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
etcd 3.6+ hot-reloads TLS certificates on each new TLS handshake via
Go's GetCertificate callback (etcd PR #7829). The cert hash monitor
that ran every 10s cycle is therefore dead code — it can never trigger
a useful action.
Remove: etcd_certificates_hash_manager() function, etcd_certs_dir OCF
parameter, ETCD_CERTS_HASH_FILE variable, and all four call sites
(monitor, start, validate, archive). 86 lines deleted.
This also eliminates the root cause of OCPBUGS-86897: the monitor
detected cert changes and returned OCF_ERR_GENERIC, which triggered
Pacemaker to stop etcd, call leave_etcd_member_list(), and force the
node to rejoin as a learner with a new member ID — on every cert
rotation, 10 times per CI run.
Signed-off-by: Pablo Fontanilla <pfontani@redhat.com>
---
heartbeat/podman-etcd | 88 +------------------------------------------
1 file changed, 1 insertion(+), 87 deletions(-)
diff --git a/heartbeat/podman-etcd b/heartbeat/podman-etcd
index d0fc22e1f1..0195633af4 100755
--- a/heartbeat/podman-etcd
+++ b/heartbeat/podman-etcd
@@ -40,7 +40,6 @@
# Parameter defaults
OCF_RESKEY_image_default="default"
OCF_RESKEY_pod_manifest_default="/etc/kubernetes/static-pod-resources/etcd-certs/configmaps/external-etcd-pod/pod.yaml"
-OCF_RESKEY_etcd_certs_dir_default="/etc/kubernetes/static-pod-resources/etcd-certs"
OCF_RESKEY_name_default="etcd"
OCF_RESKEY_nic_default="br-ex"
OCF_RESKEY_authfile_default="/var/lib/kubelet/config.json"
@@ -54,7 +53,6 @@ OCF_RESKEY_kubeconfig_default="/etc/kubernetes/static-pod-resources/kube-apiserv
: ${OCF_RESKEY_image=${OCF_RESKEY_image_default}}
: ${OCF_RESKEY_pod_manifest=${OCF_RESKEY_pod_manifest_default}}
-: ${OCF_RESKEY_etcd_certs_dir=${OCF_RESKEY_etcd_certs_dir_default}}
: ${OCF_RESKEY_name=${OCF_RESKEY_name_default}}
: ${OCF_RESKEY_nic=${OCF_RESKEY_nic_default}}
: ${OCF_RESKEY_authfile=${OCF_RESKEY_authfile_default}}
@@ -94,15 +92,6 @@ The Pod manifest with the configuration for Etcd.
<content type="string" default="${OCF_RESKEY_pod_manifest_default}"/>
</parameter>
-<parameter name="etcd_certs_dir" required="0" unique="0">
-<longdesc lang="en">
-The Etcd certificates directory mounted into the etcd container.
-The agent will monitor this directory for changes and restart the etcd container if the certificates have changed.
-</longdesc>
-<shortdesc lang="en">Etcd certificates directory</shortdesc>
-<content type="string" default="${OCF_RESKEY_etcd_certs_dir_default}"/>
-</parameter>
-
<parameter name="image" required="0" unique="0">
<longdesc lang="en">
The podman image to base this container off of.
@@ -326,60 +315,6 @@ Expects to have a fully populated OCF RA-compliant environment set.
END
}
-etcd_certificates_hash_manager()
-{
- local action="$1"
- local current_hash
- local stored_hash
-
- # If the certs directory doesn't exist, consider it unchanged
- if [ ! -d "$OCF_RESKEY_etcd_certs_dir" ]; then
- ocf_log warn "certificates directory $OCF_RESKEY_etcd_certs_dir does not exist, skipping certificate monitoring"
- return $OCF_SUCCESS
- fi
-
- # Calculate hash of all certificate files, ignore key files to avoid accidental disclosure of sensitive information
- # we only need to monitor the certificate files to detect changes.
- if ! current_hash=$(find "$OCF_RESKEY_etcd_certs_dir" -type f \( -name "*.crt" \) -exec sha256sum {} \; | sort | sha256sum | cut -d' ' -f1); then
- ocf_log err "failed to calculate certificate files hash"
- return $OCF_ERR_GENERIC
- fi
-
- # If no stored hash exists, create one and return success
- if [ ! -f "$ETCD_CERTS_HASH_FILE" ]; then
- echo "$current_hash" > "$ETCD_CERTS_HASH_FILE"
- ocf_log info "created initial certificate hash: $current_hash"
- return $OCF_SUCCESS
- fi
-
- case "$action" in
- "update")
- if ! echo "$current_hash" > "$ETCD_CERTS_HASH_FILE"; then
- ocf_log err "failed to update certificate hash file $ETCD_CERTS_HASH_FILE"
- fi
- ocf_log info "updated certificate hash: $current_hash"
- ;;
- "check")
- if ! stored_hash=$(cat "$ETCD_CERTS_HASH_FILE"); then
- ocf_log err "failed to read stored certificate hash from $ETCD_CERTS_HASH_FILE"
- # This should not happen but if for some reason we can not read the stored hash,
- # use the current hash and log the error but allow etcd to run as long as possible.
- stored_hash="$current_hash"
- fi
- if [ "$current_hash" != "$stored_hash" ]; then
- ocf_exit_reason "$NODENAME etcd certificate files have changed (stored: $stored_hash, current: $current_hash)"
- return $OCF_ERR_GENERIC
- fi
- ;;
- *)
- ocf_log err "unsupported action: $action"
- return $OCF_ERR_GENERIC
- ;;
- esac
-
- return $OCF_SUCCESS
-}
-
monitor_cmd_exec()
{
local rc=$OCF_SUCCESS
@@ -456,7 +391,7 @@ archive_current_container()
# archive corresponding etcd configuration files
local files_to_archive=""
- for file in "$OCF_RESKEY_authfile" "$POD_MANIFEST_COPY" "$ETCD_CONFIGURATION_FILE" "$ETCD_CERTS_HASH_FILE"; do
+ for file in "$OCF_RESKEY_authfile" "$POD_MANIFEST_COPY" "$ETCD_CONFIGURATION_FILE"; do
if [ -f "$file" ]; then
files_to_archive="$files_to_archive $file"
else
@@ -1826,11 +1761,6 @@ podman_monitor()
;;
esac
- # Check if certificate files have changed, if they have, etcd needs to be restarted
- if ! etcd_certificates_hash_manager "check"; then
- return $OCF_ERR_GENERIC
- fi
-
if is_learner; then
ocf_log info "$NODENAME is learner. Cannot get member id"
return "$OCF_SUCCESS"
@@ -2141,14 +2071,6 @@ podman_start()
return $OCF_ERR_GENERIC
fi
- # Update the certificate hash after the container has started successfully
- # this is to ensure that the certificate hash is updated after a restart is initiated
- # by a cert rotation event from the monitor command.
- if ! etcd_certificates_hash_manager "update"; then
- ocf_exit_reason "etcd certificate hash manager failed to update the certificate hash"
- return $OCF_ERR_GENERIC
- fi
-
# check if the container has already started
podman_simple_status
if [ $? -eq $OCF_SUCCESS ]; then
@@ -2628,13 +2550,6 @@ podman_validate()
exit $OCF_ERR_CONFIGURED
fi
- if ! echo "validation test" > "$ETCD_CERTS_HASH_FILE" \
- || ! cat "$ETCD_CERTS_HASH_FILE" >/dev/null 2>&1 \
- || ! rm "$ETCD_CERTS_HASH_FILE"; then
- ocf_exit_reason "cannot read/write to certificate hash file $ETCD_CERTS_HASH_FILE"
- exit $OCF_ERR_GENERIC
- fi
-
return $OCF_SUCCESS
}
@@ -2687,7 +2602,6 @@ ETCD_MEMBER_DIR="/var/lib/etcd/member"
ETCD_REVISION_JSON="/var/lib/etcd/revision.json"
ETCD_REVISION_BUMP_PERCENTAGE=0.2
ETCD_BUMP_REV_DEFAULT=1000000000
-ETCD_CERTS_HASH_FILE="${OCF_RESKEY_config_location}/certs.hash"
# State file location: Uses HA_RSCTMP to ensure automatic cleanup on reboot.
# This is intentional - reboots are controlled stops, not failures requiring detection.
CONTAINER_HEARTBEAT_FILE=${HA_RSCTMP}/podman-container-last-running

11
SPECS/resource-agents.spec
View File

@ -45,7 +45,7 @@
Name: resource-agents
Summary: Open Source HA Reusable Cluster Resource Scripts
Version: 4.10.0
Release: 111%{?rcver:%{rcver}}%{?numcomm:.%{numcomm}}%{?alphatag:.%{alphatag}}%{?dirty:.%{dirty}}%{?dist}.4.alma.1
Release: 111%{?rcver:%{rcver}}%{?numcomm:.%{numcomm}}%{?alphatag:.%{alphatag}}%{?dirty:.%{dirty}}%{?dist}.5.alma.1
License: GPLv2+ and LGPLv2+
URL: https://github.com/ClusterLabs/resource-agents
Source0: %{upstream_prefix}-%{upstream_version}.tar.gz
@ -209,6 +209,7 @@ Patch156: RHEL-166183-2-db2-do-not-use-db2stop-to-avoid-divergence-in-the-log.pa
Patch157: RHEL-177849-podman-etcd-fix-port-2380-binding-race.patch
Patch158: RHEL-177838-podman-etcd-fix-machine-deletion-deadlock.patch
Patch159: RHEL-177843-podman-etcd-fix-learner-start-deadlock.patch
Patch160: RHEL-188107-podman-etcd-remove-cert-monitoring.patch
# bundled ha-cloud-support libs
Patch500: ha-cloud-support-aliyun.patch
@ -519,6 +520,7 @@ exit 1
%patch -p1 -P 157
%patch -p1 -P 158
%patch -p1 -P 159
%patch -p1 -P 160
# bundled ha-cloud-support libs
%patch -p1 -P 500
@ -853,9 +855,14 @@ rm -rf %{buildroot}/usr/share/doc/resource-agents
%{_usr}/lib/ocf/lib/heartbeat/OCF_*.pm
%changelog
* Fri Jun 26 2026 Andrew Lukoshko <alukoshko@almalinux.org> - 4.10.0-111.4.alma.1
* Thu Jul 16 2026 Andrew Lukoshko <alukoshko@almalinux.org> - 4.10.0-111.5.alma.1
- Add AlmaLinux to RHEL-based distro detection in ocf-distro
* Thu Jun 25 2026 Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.10.0-111.5
- podman-etcd: remove cert monitoring
Resolves: RHEL-188107
* Wed May 20 2026 Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.10.0-111.4
- podman-etcd: fix port 2380 binding race
- podman-etcd: fix machine deletion deadlock