https://bugzilla.redhat.com/show_bug.cgi?id=1264699
Bug ID: 1264699 Summary: kubernetes do not respect tpmfiles.d policu Product: Fedora Version: 22 Component: kubernetes Assignee: jchaloup@redhat.com Reporter: mscherer@redhat.com QA Contact: extras-qa@fedoraproject.org CC: eparis@redhat.com, golang@lists.fedoraproject.org, jcajka@redhat.com, jchaloup@redhat.com, lsm5@redhat.com, nhorman@redhat.com, vbatts@redhat.com
Description of problem: /run/kubernetes is listed as unowned.
] That's against policy: https://fedoraproject.org/wiki/Packaging:Tmpfiles.d
Version-Release number of selected component (if applicable): kubernetes-1.1.0-0.5.gite44c8e6.fc22.x86_64
How reproducible: each time
Steps to Reproduce: 1. install kubernetes 2. verify with rpm -qf
Actual results: # rpm -qf /run/kubernetes/ file /run/kubernetes is not owned by any package
Expected results: file is owned, and with the right permission.
Additional info:
This also mean that something create /run/kubernetes/ owned as root:root, which prevent kubernetes-apiserver from starting:
Sep 20 14:01:15 gluster2 kube-apiserver[17759]: E0920 14:01:15.230961 17759 server.go:485] Unable to listen for secure (open /var/run/kubernetes/apiserver.crt: no such file or directory); will try again.
And likely linked to http://ask.projectatomic.io/en/question/199/missing-apiservercrt-unable-to-l...
Here is a trivial patch to add that.
https://bugzilla.redhat.com/show_bug.cgi?id=1264699
--- Comment #1 from M. Scherer mscherer@redhat.com --- Created attachment 1075354 --> https://bugzilla.redhat.com/attachment.cgi?id=1075354&action=edit Add /run ownership in the specfile
https://bugzilla.redhat.com/show_bug.cgi?id=1264699
M. Scherer mscherer@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Summary|kubernetes do not respect |kubernetes do not respect |tpmfiles.d policu |tpmfiles.d policy
https://bugzilla.redhat.com/show_bug.cgi?id=1264699
Jan Chaloupka jchaloup@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |ASSIGNED
--- Comment #2 from Jan Chaloupka jchaloup@redhat.com --- Thanks for that.
https://bugzilla.redhat.com/show_bug.cgi?id=1264699
--- Comment #3 from Jan Chaloupka jchaloup@redhat.com --- Installing the latest kubernetes built in rawhide I can see only files generated by kubelet:
ls /run/kubernetes/ kubelet.crt kubelet.key
https://bugzilla.redhat.com/show_bug.cgi?id=1264699
--- Comment #4 from Jan Chaloupka jchaloup@redhat.com --- kube-apiserver needs the directory as well (--cert-dir="/var/run/kubernetes") [1].
As kube-apiserver service is run under kube user and kubelet can be installed on the same host, the owner of the directory must be kube. Contrib is already covering that [2]. So, only the ownership of the directory is really missing.
[1] http://kubernetes.io/docs/admin/kube-apiserver/ [2] https://github.com/kubernetes/contrib/blob/master/init/systemd/tmpfiles.d/ku...
https://bugzilla.redhat.com/show_bug.cgi?id=1264699
--- Comment #5 from Fedora Update System updates@fedoraproject.org --- kubernetes-1.2.0-0.23.git4a3f9c5.fc23 has been submitted as an update to Fedora 23. https://bodhi.fedoraproject.org/updates/FEDORA-2016-34357c1671
https://bugzilla.redhat.com/show_bug.cgi?id=1264699
Fedora Update System updates@fedoraproject.org changed:
What |Removed |Added ---------------------------------------------------------------------------- Status|ASSIGNED |MODIFIED
https://bugzilla.redhat.com/show_bug.cgi?id=1264699
--- Comment #6 from Fedora Update System updates@fedoraproject.org --- kubernetes-1.2.0-0.23.git4a3f9c5.fc24 has been submitted as an update to Fedora 24. https://bodhi.fedoraproject.org/updates/FEDORA-2016-38a8c6915d
https://bugzilla.redhat.com/show_bug.cgi?id=1264699
--- Comment #7 from Fedora Update System updates@fedoraproject.org --- kubernetes-1.2.0-0.24.git4a3f9c5.fc23 has been submitted as an update to Fedora 23. https://bodhi.fedoraproject.org/updates/FEDORA-2016-f612484f9e
https://bugzilla.redhat.com/show_bug.cgi?id=1264699
--- Comment #8 from Fedora Update System updates@fedoraproject.org --- kubernetes-1.2.0-0.24.git4a3f9c5.fc24 has been submitted as an update to Fedora 24. https://bodhi.fedoraproject.org/updates/FEDORA-2016-223c8e5da7
golang@lists.fedoraproject.org