OCPBUGS-11437: MCO keeps the pull secret to .orig file once it replaced #3759

inesqyx · 2023-06-26T19:44:06Z

OCPBUGS11437
The pull secret is preserved in the path /etc/machine-config-daemon/orig/var/lib/kubelet/config.json.mcdorig. Whereas, the user needs it to be deleted when the pull secret is being deleted/ replaced.
What is the problem
There is complaint about that the MCD is creating orig files to preserve files that should not be preserved. To be more specific, the orig preserving system should only preserve files that are originally on the disk, but are now preserving files that are written by Ignition. The root cause is that Ignition writes the files before the MCD takes the control as a result when MCD comes in, it sees all the files written before as files on disk, which is very wrong.
What I did
Add more constraints for orig file generation: orig files should only be generated on files that 1) claimed by the rpm 2) exist in the usr/etc directory 3) exist before MCD takes control
How to verify it
Ignition writes files in the /var directory. And now when cat into the orig folder for the MCD, there is no var folder, meaning that files written by Ignition are not preserved now. Specific example would be that catting into /etc/machine-config-daemon/orig/var/lib/kubelet/config.json.mcdori will now return no so such file

openshift-ci-robot · 2023-06-26T19:44:12Z

@inesqyx: This pull request references Jira Issue OCPBUGS-11437, which is invalid:

expected the bug to target the "4.14.0" version, but no target version was set

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

The bug has been updated to refer to the pull request using the external bug tracker.

In response to this:

- What I did
Provide another workaround for OCPBUGS-11437
- How to verify it
WIP

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

openshift-ci · 2023-06-26T19:44:12Z

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

inesqyx · 2023-06-26T19:44:28Z

/test all

openshift-ci-robot · 2023-06-26T20:52:28Z

@inesqyx: This pull request references Jira Issue OCPBUGS-11437, which is invalid:

expected the bug to target the "4.14.0" version, but no target version was set

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

In response to this:

- What I did
A specific solution that targeted towards the reporter's problem, instead of a system-wise approach: ask the createOrig func to specifically create a noorig file for file path with suffix - config.json (pull secret)

- How to verify it
catting into /etc/machine-config-daemon/orig/var/lib/kubelet/config.json.mcdori will now return no so such file.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

inesqyx · 2023-06-27T17:32:37Z

/retest-required

openshift-ci-robot · 2023-06-27T17:33:18Z

@inesqyx: This pull request references Jira Issue OCPBUGS-11437, which is invalid:

expected the bug to target the "4.14.0" version, but no target version was set

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

In response to this:

- What I did
A specific solution that targeted towards the reporter's problem, instead of a system-wise approach: ask the createOrig func to specifically create no backup file for file path with suffix - config.json (pull secret)

- How to verify it
catting into /etc/machine-config-daemon/orig/var/lib/kubelet/config.json.mcdorig will now return no so such file.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

openshift-ci-robot · 2023-06-27T19:01:59Z

@inesqyx: This pull request references Jira Issue OCPBUGS-11437, which is invalid:

expected the bug to target the "4.14.0" version, but no target version was set

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

The bug has been updated to refer to the pull request using the external bug tracker.

In response to this:

- What I did
A specific solution that targeted towards the reporter's problem, instead of a system-wise approach: ask the createOrig func to specifically create no backup file for file path with suffix - config.json (pull secret)

- How to verify it

catting into /etc/machine-config-daemon/orig/var/lib/kubelet/config.json.mcdorig will now return no so such file.

confirmed that it is preserving the exact same amount of files as before, just not the pull secret

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

openshift-ci-robot · 2023-06-27T19:03:10Z

@inesqyx: This pull request references Jira Issue OCPBUGS-11437, which is invalid:

expected the bug to target the "4.14.0" version, but no target version was set

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

In response to this:

- What I did
A specific solution targeted towards undesired preservation on pull secret: ask the createOrig func to specifically create no backup file for file path with suffix - config.json (pull secret)

- How to verify it

catting into /etc/machine-config-daemon/orig/var/lib/kubelet/config.json.mcdorig will now return no so such file.

confirmed that it is preserving the exact same amount of files as before, just not the pull secret

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

sergiordlr · 2023-06-28T14:55:44Z

Verified using IPI on OSP

Verify that the file /etc/machine-config-daemon/orig/var/lib/kubelet/config.json.mcdorig does not exist

oc debug node/sregidor-nps-zgw74-worker-0-9cc8x -- chroot /host cat /etc/machine-config-daemon/orig/var/lib/kubelet/config.json.mcdorig
Starting pod/sregidor-nps-zgw74-worker-0-9cc8x-debug-n2zmb ...
To use host binaries, run `chroot /host`
cat: /etc/machine-config-daemon/orig/var/lib/kubelet/config.json.mcdorig: No such file or directory

Create a MC that deploys a file and remove the MC

apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
metadata:
  labels:
    machineconfiguration.openshift.io/role: worker
  name: test-machine-config
spec:
  config:
    ignition:
      version: 3.1.0
    storage:
      files:
      - contents:
          source: data:text/plain;charset=utf-8;base64,dGVzdA==
        filesystem: root
        mode: 420
        path: /etc/test-file.test

The file is created and removed normally. We can read the delete-stale logs when removing the file

I0628 11:44:27.559549    2249 update.go:1250] Deleting stale data
I0628 11:44:27.559664    2249 update.go:1313] Removed stale file "/etc/test-file.test"

Create a MC that deploy the /var/lib/kubelet/config.json and remove it

apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
metadata:
  labels:
    machineconfiguration.openshift.io/role: worker
  name: test-machine-config
spec:
  config:
    ignition:
      version: 3.1.0
    storage:
      files:
      - contents:
          source: data:text/plain;charset=utf-8;base64,e30=
        filesystem: root
        mode: 0600
        path: /var/lib/kubelet/config.json

When we deploy the MC the file /var/lib/kubelet/config.json has this content: {}

When we remove the MC the file /var/lib/kubelet/config.json has the content defined in the pull-secret.

Configure an empty pull-secret: {}

After configuring the emtpy pull-secret the file /var/lib/kubelet/config.json does not exist

]$ oc debug node/sregidor-nps-zgw74-worker-0-9cc8x -- chroot /host cat /etc/machine-config-daemon/orig/var/lib/kubelet/config.json.mcdorig
Starting pod/sregidor-nps-zgw74-worker-0-9cc8x-debug-slf4r ...
To use host binaries, run `chroot /host`
cat: /etc/machine-config-daemon/orig/var/lib/kubelet/config.json.mcdorig: No such file or directory

Upgrade from 4.13

Before the upgrade, the file exists and contains the right content:

$ oc get clusterversion
NAME      VERSION                              AVAILABLE   PROGRESSING   SINCE   STATUS
version   4.13.0-0.nightly-2023-06-20-224158   True        False         15m     Cluster version is 4.13.0-0.nightly-2023-06-20-224158
$ oc debug node/sregidor-up2-7n9q7-worker-0-jbskz -- chroot /host cat /etc/machine-config-daemon/orig/var/lib/kubelet/config.json.mcdorig | head -c 10
Starting pod/sregidor-up2-7n9q7-worker-0-jbskz-debug-vc8n6 ...
To use host binaries, run `chroot /host`
{"auths":{
Removing debug pod ...

After the upgrade, the file still exists

 oc debug node/sregidor-up2-7n9q7-worker-0-jbskz -- chroot /host head -c 10 /etc/machine-config-daemon/orig/var/lib/kubelet/config.json.mcdorig
Starting pod/sregidor-up2-7n9q7-worker-0-jbskz-debug-qh7wf ...
To use host binaries, run `chroot /host`
{"auths":{
Removing debug pod ...

Even if we re-configure the pull-secret, and we set an empty pull-secret, the file is not removed.

Configure a MC using a file that exists in the machines inside /etc/ and has "config.json" suffix.

Look for that file:

Debug a worker node:

sh-5.1# find . -iname "*config.json" 2> /dev/null |grep -v storage
./run/openshift-sdn/cniserver/config.json
./sysroot/ostree/deploy/rhcos/var/lib/kubelet/config.json
./usr/etc/tpm2-tss/fapi-config.json
./var/lib/kubelet/config.json
./var/lib/kubelet/pods/b482e398-27f6-4dac-b8c0-6715c0010f99/volumes/kubernetes.io~secret/installation-pull-secrets/config.json
./var/lib/kubelet/pods/b482e398-27f6-4dac-b8c0-6715c0010f99/volumes/kubernetes.io~secret/installation-pull-secrets/..2023_06_28_13_26_35.4113272500/config.json
./etc/tpm2-tss/fapi-config.json
sh-5.1# cat ./etc/tpm2-tss/fapi-config.json
{
     "profile_name": "P_ECCP256SHA256",
     "profile_dir": "/etc/tpm2-tss/fapi-profiles/",
     "user_dir": "~/.local/share/tpm2-tss/user/keystore",
     "system_dir": "/var/lib/tpm2-tss/system/keystore",
     "tcti": "",
     "system_pcrs" : [],
     "log_dir" : "/run/tpm2-tss/eventlog/"
}

We will use /etc/tpm2-tss/fapi-config.json. We create a MC to replace the file in the machine

apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
metadata:
  labels:
    machineconfiguration.openshift.io/role: worker
  name: test-fapi-config
spec:
  config:
    ignition:
      version: 3.1.0
    storage:
      files:
      - contents:
          source: data:text/plain;charset=utf-8;base64,ewoKCgoKCiAgICAgInByb2ZpbGVfbmFtZSI6ICJQX0VDQ1AyNTZTSEEyNTYiLAogICAgICJwcm9maWxlX2RpciI6ICIvZXRjL3RwbTItdHNzL2ZhcGktcHJvZmlsZXMvIiwKICAgICAidXNlcl9kaXIiOiAifi8ubG9jYWwvc2hhcmUvdHBtMi10c3MvdXNlci9rZXlzdG9yZSIsCiAgICAgInN5c3RlbV9kaXIiOiAiL3Zhci9saWIvdHBtMi10c3Mvc3lzdGVtL2tleXN0b3JlIiwKICAgICAidGN0aSI6ICIiLAogICAgICJzeXN0ZW1fcGNycyIgOiBbXSwKICAgICAibG9nX2RpciIgOiAiL3J1bi90cG0yLXRzcy9ldmVudGxvZy8iCn0KCg==
        filesystem: root
        mode: 0644
        path: /etc/tpm2-tss/fapi-config.json

The the configuration is applied without problems.

We see that there is no "orig" file created for this file:

sh-5.1# cat ./etc/tpm2-tss/fapi-config.json
{





     "profile_name": "P_ECCP256SHA256",
     "profile_dir": "/etc/tpm2-tss/fapi-profiles/",
     "user_dir": "~/.local/share/tpm2-tss/user/keystore",
     "system_dir": "/var/lib/tpm2-tss/system/keystore",
     "tcti": "",
     "system_pcrs" : [],
     "log_dir" : "/run/tpm2-tss/eventlog/"
}

sh-5.1# find . -iname "*orig" 2> /dev/null |grep fapi
sh-5.1# exit

When we remove the MC, the file is deleted. We can see these lines in the daemon logs

I0628 13:57:44.872194    2388 update.go:1250] Deleting stale data
I0628 13:57:44.872282    2388 update.go:1313] Removed stale file "/etc/tpm2-tss/fapi-config.json"

And the original file is lost:

sh-5.1# cat /etc/tpm2-tss/fapi-config.json 
cat: /etc/tpm2-tss/fapi-config.json: No such file or directory

My main concerns after the verification steps are:

When we upgrade a cluster to a version with this fix, the file /etc/machine-config-daemon/orig/var/lib/kubelet/config.json.mcdorig is still present in the cluster, and is not removed.
When we try to reconfigure any file that is present in the cluster and has the suffix "config.json", the file's original content is not tracked and can be eventually deleted. In the current verification steps we used "/etc/tpm2-tss/fapi-config.json", but since the OS versions will be evolving, in the future it can happen that more files like this one are affected. Maybe the current fapi-config file is not important, but it is possible that the ones in the future are.

Before adding the qe-appoved label I would like to make sure that those behaviors are expected/OK.

Thank you very much!

yuqi-zhang

Thanks Ines! The general approach makes sense to me, some comments:

When we upgrade a cluster to a version with this fix, the file /etc/machine-config-daemon/orig/var/lib/kubelet/config.json.mcdorig is still present in the cluster, and is not removed.

Agree with Sergio. I think eventually we want to remove the orig approach. We could make it such that we delete the orig file entirely for the pull secret even on upgrades as noted by Sergio's test process. I don't think it must be part of this PR though, so it depends on what you want to do @inesqyx

Also minor nit: if you can update the commit message to also have some of the context in your PR message, that would be good as well!

yuqi-zhang · 2023-06-28T23:53:30Z

pkg/daemon/file_writers.go

@@ -60,6 +61,12 @@ func createOrigFile(fromPath, fpath string) error {
 		return writeFileAtomicallyWithDefaults(noOrigFileStampName(fpath), nil)
 	}

+	// https://issues.redhat.com/browse/OCPBUGS-11437


When commenting a bug like this, it means that the code that follows is intended as a workaround, and we would want to remove the code at a later time.

I think that makes sense here, since we eventually want to fix the "orig file" implementation, either separately or eventually as part of layering. Maybe it would be good to mention that here? i.e. this code can be eventually superceded by a proper fix to the underlying problem

yuqi-zhang · 2023-06-28T23:53:46Z

pkg/daemon/file_writers.go

@@ -60,6 +61,12 @@ func createOrigFile(fromPath, fpath string) error {
 		return writeFileAtomicallyWithDefaults(noOrigFileStampName(fpath), nil)
 	}

+	// https://issues.redhat.com/browse/OCPBUGS-11437
+	// MCO keeps the pull secret to .orig file once it replaced
+	if strings.HasSuffix(fpath, "config.json") {


I think like Sergio mentions, this probably should check specifically for the pull secret path and not just any config.json

Thanks, @sergiordlr and @yuqi-zhang for pointing this out. I have made the changes to more carefully point at the desired path, and yet to be tested.

sergiordlr · 2023-06-29T12:41:06Z

I set the jira status to "assigned" again, please, set it back to "post" when the PR is ready for verification again.

inesqyx · 2023-06-29T17:29:03Z

/retest-required

inesqyx · 2023-06-29T18:54:47Z

/retest-required

cgwalters · 2023-06-30T12:17:29Z

I think we can more categorically exclude everything in /var from the .orig treatment btw, as a big part of the idea here is that /var starts out empty on ostree systems.

That would avoid hardcoding anything relating to the pull secret.

openshift-ci-robot · 2023-07-05T13:48:03Z

@inesqyx: This pull request references Jira Issue OCPBUGS-11437, which is invalid:

expected the bug to target the "4.14.0" version, but no target version was set

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

In response to this:

OCPBUGS11437
The pull secret is preserved in the path /etc/machine-config-daemon/orig/var/lib/kubelet/config.json.mcdorig. Whereas, the user needs it to be deleted when the pull secret is being deleted/ replaced.

What is the problem
There is complaint about that the MCD is creating orig files to preserve files that should not be preserved. To be more specific, the orig preserving system should only preserve files that are originally on the disk, but are now preserving files that are written by Ignition. The root cause is that Ignition writes the files before the MCD takes the control as a result when MCD comes in, it sees all the files written before as files on disk, which is very wrong.

What I did
Add more constraints for orig file generation: orig files should only be generated on files that 1) claimed by the rpm 2) exist in the usr/etc directory 3) exist before MCD takes control

How to verify it
Ignition writes files in the /var directory. And now when cat into the orig folder for the MCD, there is no var folder, meaning that files written by Ignition are not preserved now. Specific example would be that catting into /etc/machine-config-daemon/orig/var/lib/kubelet/config.json.mcdori will now return no so such file

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

inesqyx · 2023-07-07T15:07:14Z

/retest-required

inesqyx · 2023-07-07T15:40:52Z

/retest-required

inesqyx · 2023-08-29T16:25:07Z

/retest-required

inesqyx · 2023-08-29T19:52:49Z

/retest-required

inesqyx · 2023-08-29T20:06:06Z

/test unit

yuqi-zhang

some nits on logs and comments, otherwise lgtm!

yuqi-zhang · 2023-08-30T23:23:46Z

pkg/daemon/file_writers.go

@@ -45,12 +46,80 @@ func noOrigFileStampName(fpath string) string {
 	return filepath.Join(noOrigParentDir(), fpath+".mcdnoorig")
 }

+func isFileOwnedByRPMPkg(fpath string) (bool, bool, error) {
+	// The first bool returned indicated whether the underlying OS is Mac


nit: for clarity purposes, maybe something like:

The first bool returns false if rpm exists, and true otherwise (indicating other Linux distros or Mac). We would like to skip orig file creation and preservation

yuqi-zhang · 2023-08-30T23:25:59Z

pkg/daemon/file_writers.go

+			}
+		} else if isMac {
+			// Run on Mac
+			klog.Infof("Running on Mac,skip orig file preservation.")


nit: same as above, I think rephrase to "rpm binary not found", and change the references from Mac to "rpmNotFound" or similar, I think that's more clear in case someone gets this error on a non-fedora/rhel machine for some reason

yuqi-zhang · 2023-08-30T23:26:13Z

pkg/daemon/update.go

 				}
+			} else if isMac {
+				// Run on Mac
+				klog.Infof("Running on Mac,skip file restoration.")


nit: same as above

yuqi-zhang · 2023-08-30T23:26:28Z

pkg/daemon/update_test.go

+	assert.Nil(t, errr)
+	assert.Nil(t, errr)
+	// fileNotOwnedMsg := "not owned"
+	// if strings.Contains(string(out), fileNotOwnedMsg) {


nit: remove unused code

yuqi-zhang · 2023-08-30T23:28:20Z

pkg/daemon/update_test.go

-	assert.Nil(t, err)
+	// Check whether the given path is owned by an rpm pkg
+	cmd := exec.Command(path, "-qf", path)
+	_, errr := cmd.CombinedOutput()


just curious, why is this errr? Why not just _, err = cmd.CombinedOutput()

rioliu-rh · 2023-09-05T02:13:06Z

@inesqyx @yuqi-zhang any update on this PR? we have a automation PR depends on this one. https://github.com/openshift/openshift-tests-private/pull/11128
/cc @sergiordlr

inesqyx · 2023-09-06T13:17:44Z

@inesqyx @yuqi-zhang any update on this PR? we have a automation PR depends on this one. openshift/openshift-tests-private#11128 /cc @sergiordlr

Hey, Rio! I am back from the PTO and sorry for the late reply. I will have the changes in place and make it through in a day or so. Should be quick. Thanks for the reminder!

inesqyx · 2023-09-06T13:39:59Z

/retest-required

…are claimed by the rpm; delete all incorrectly preserved orig files and create noorigs for them

openshift-ci · 2023-09-06T16:35:36Z

@inesqyx: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/okd-scos-e2e-aws-ovn	`1cebf67`	link	false	`/test okd-scos-e2e-aws-ovn`

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

yuqi-zhang

/lgtm

Thanks for the fixes! @rioliu-rh would you say this is a critical fix then? Merging to master (4.14) is currently blocked unless it can be considered a critical fix

openshift-ci · 2023-09-06T21:33:17Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: inesqyx, yuqi-zhang

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~OWNERS~~ [yuqi-zhang]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

inesqyx · 2023-09-07T13:36:23Z

/retest-required

openshift-bot · 2023-09-08T10:05:26Z

/jira refresh

The requirements for Jira bugs have changed (Jira issues linked to PRs on main branch need to target different OCP), recalculating validity.

openshift-ci-robot · 2023-09-08T10:06:54Z

@openshift-bot: This pull request references Jira Issue OCPBUGS-11437, which is invalid:

expected the bug to target the "4.15.0" version, but it targets "4.14.0" instead

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

In response to this:

/jira refresh

The requirements for Jira bugs have changed (Jira issues linked to PRs on main branch need to target different OCP), recalculating validity.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

inesqyx · 2023-09-10T20:43:42Z

/jira refresh

openshift-ci-robot · 2023-09-10T20:43:47Z

@inesqyx: This pull request references Jira Issue OCPBUGS-11437, which is valid.

3 validation(s) were run on this bug

bug is open, matching expected state (open)
bug target version (4.15.0) matches configured target version for branch (4.15.0)
bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, POST)

Requesting review from QA contact:
/cc @rioliu-rh

In response to this:

/jira refresh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

openshift-ci-robot · 2023-09-18T10:15:01Z

@inesqyx: Jira Issue OCPBUGS-11437: All pull requests linked via external trackers have merged:

openshift/machine-config-operator#3759

Jira Issue OCPBUGS-11437 has been moved to the MODIFIED state.

In response to this:

OCPBUGS11437
The pull secret is preserved in the path /etc/machine-config-daemon/orig/var/lib/kubelet/config.json.mcdorig. Whereas, the user needs it to be deleted when the pull secret is being deleted/ replaced.

What is the problem
There is complaint about that the MCD is creating orig files to preserve files that should not be preserved. To be more specific, the orig preserving system should only preserve files that are originally on the disk, but are now preserving files that are written by Ignition. The root cause is that Ignition writes the files before the MCD takes the control as a result when MCD comes in, it sees all the files written before as files on disk, which is very wrong.

What I did
Add more constraints for orig file generation: orig files should only be generated on files that 1) claimed by the rpm 2) exist in the usr/etc directory 3) exist before MCD takes control

How to verify it
Ignition writes files in the /var directory. And now when cat into the orig folder for the MCD, there is no var folder, meaning that files written by Ignition are not preserved now. Specific example would be that catting into /etc/machine-config-daemon/orig/var/lib/kubelet/config.json.mcdori will now return no so such file

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

openshift-ci-robot added jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. jira/invalid-bug Indicates that a referenced Jira bug is invalid for the branch this PR is targeting. labels Jun 26, 2023

openshift-ci bot added the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Jun 26, 2023

inesqyx force-pushed the OCPBUGS11437-workaround2 branch from 24a1f49 to 1845ca2 Compare June 27, 2023 18:40

inesqyx changed the title ~~[DNM] OCPBUGS-11437: MCO keeps the pull secret to .orig file once it replaced - another workaround~~ OCPBUGS-11437: MCO keeps the pull secret to .orig file once it replaced Jun 27, 2023

inesqyx marked this pull request as ready for review June 27, 2023 18:43

openshift-ci bot removed the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Jun 27, 2023

openshift-ci bot requested review from cgwalters and cheesesashimi June 27, 2023 18:44

yuqi-zhang reviewed Jun 28, 2023

View reviewed changes

inesqyx force-pushed the OCPBUGS11437-workaround2 branch from 1845ca2 to 27901de Compare June 29, 2023 16:48

inesqyx force-pushed the OCPBUGS11437-workaround2 branch 2 times, most recently from f28b928 to 7e615b5 Compare July 5, 2023 15:07

inesqyx force-pushed the OCPBUGS11437-workaround2 branch from 73fa61d to 9e77c24 Compare July 7, 2023 15:36

inesqyx force-pushed the OCPBUGS11437-workaround2 branch from e08f5db to 8a36c31 Compare August 29, 2023 16:24

yuqi-zhang reviewed Aug 30, 2023

View reviewed changes

openshift-ci bot requested a review from sergiordlr September 5, 2023 02:13

inesqyx force-pushed the OCPBUGS11437-workaround2 branch from 8a36c31 to 39cfba3 Compare September 6, 2023 13:39

Restrict orig preservation to only /usr/etc directory and files that …

1cebf67

…are claimed by the rpm; delete all incorrectly preserved orig files and create noorigs for them

inesqyx force-pushed the OCPBUGS11437-workaround2 branch from 39cfba3 to 1cebf67 Compare September 6, 2023 13:46

yuqi-zhang approved these changes Sep 6, 2023

View reviewed changes

openshift-ci bot assigned yuqi-zhang Sep 6, 2023

openshift-ci bot added the lgtm Indicates that a PR is ready to be merged. label Sep 6, 2023

openshift-ci bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Sep 6, 2023

openshift-ci-robot added jira/invalid-bug Indicates that a referenced Jira bug is invalid for the branch this PR is targeting. and removed jira/valid-bug Indicates that a referenced Jira bug is valid for the branch this PR is targeting. labels Sep 8, 2023

openshift-ci-robot added jira/valid-bug Indicates that a referenced Jira bug is valid for the branch this PR is targeting. and removed jira/invalid-bug Indicates that a referenced Jira bug is invalid for the branch this PR is targeting. labels Sep 10, 2023

openshift-merge-robot merged commit f7333c4 into openshift:master Sep 18, 2023

OCPBUGS-11437: MCO keeps the pull secret to .orig file once it replaced #3759

OCPBUGS-11437: MCO keeps the pull secret to .orig file once it replaced #3759

Conversation

inesqyx commented Jun 26, 2023 • edited Loading

openshift-ci-robot commented Jun 26, 2023

openshift-ci bot commented Jun 26, 2023

inesqyx commented Jun 26, 2023

openshift-ci-robot commented Jun 26, 2023

inesqyx commented Jun 27, 2023

openshift-ci-robot commented Jun 27, 2023

openshift-ci-robot commented Jun 27, 2023

openshift-ci-robot commented Jun 27, 2023

sergiordlr commented Jun 28, 2023 • edited Loading

yuqi-zhang left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

sergiordlr commented Jun 29, 2023

inesqyx commented Jun 29, 2023

inesqyx commented Jun 29, 2023

cgwalters commented Jun 30, 2023

openshift-ci-robot commented Jul 5, 2023

inesqyx commented Jul 7, 2023

inesqyx commented Jul 7, 2023

inesqyx commented Aug 29, 2023

inesqyx commented Aug 29, 2023

inesqyx commented Aug 29, 2023

yuqi-zhang left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

rioliu-rh commented Sep 5, 2023

inesqyx commented Sep 6, 2023

inesqyx commented Sep 6, 2023

openshift-ci bot commented Sep 6, 2023 • edited Loading

yuqi-zhang left a comment

Choose a reason for hiding this comment

openshift-ci bot commented Sep 6, 2023

inesqyx commented Sep 7, 2023

openshift-bot commented Sep 8, 2023

openshift-ci-robot commented Sep 8, 2023

inesqyx commented Sep 10, 2023

openshift-ci-robot commented Sep 10, 2023

openshift-ci-robot commented Sep 18, 2023

inesqyx commented Jun 26, 2023 •

edited

Loading

sergiordlr commented Jun 28, 2023 •

edited

Loading

openshift-ci bot commented Sep 6, 2023 •

edited

Loading