OCPBUGS-49675, OCPBUGS-55039: In OCL. Usbguard service fails when we install the usbguard extension: IPsec tmpfile.d directives missing when enabling IPsec in OCL #4986
Conversation
openshift-ci-robot
added
jira/severity-moderate
|
@dkhater-redhat: This pull request references Jira Issue OCPBUGS-49675, which is invalid:
Comment The bug has been updated to refer to the pull request using the external bug tracker. In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
dkhater-redhat
force-pushed
the
usb-libre-fix
branch
from
56b7814 to
d5ce541
Compare
openshift-ci
bot
added
the
approved
dkhater-redhat
changed the title
|
@dkhater-redhat: This pull request references Jira Issue OCPBUGS-49675, which is invalid:
Comment The bug has been updated to refer to the pull request using the external bug tracker. This pull request references Jira Issue OCPBUGS-55039, which is invalid:
Comment The bug has been updated to refer to the pull request using the external bug tracker. In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
/jira refresh |
|
@dkhater-redhat: This pull request references Jira Issue OCPBUGS-49675, which is invalid:
Comment This pull request references Jira Issue OCPBUGS-55039, which is invalid:
Comment In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
/jira refresh |
openshift-ci-robot
added
jira/valid-bug
|
@dkhater-redhat: This pull request references Jira Issue OCPBUGS-49675, which is valid. 3 validation(s) were run on this bug
Requesting review from QA contact: This pull request references Jira Issue OCPBUGS-55039, which is valid. The bug has been moved to the POST state. 3 validation(s) were run on this bug
Requesting review from QA contact: In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
/lgtm |
3 similar comments
dkhater-redhat
force-pushed
the
usb-libre-fix
branch
from
d5ce541 to
fc5f032
Compare
|
/lgtm |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: dkhater-redhat, umohnani8 The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
|
Pre-merge verification
MOSC Templateoc create -f - << EOF
apiVersion: machineconfiguration.openshift.io/v1
kind: MachineOSConfig
metadata:
name: worker-4
spec:
machineConfigPool:
name: worker
imageBuilder:
imageBuilderType: Job
baseImagePullSecret:
name: $(oc get secret -n openshift-config pull-secret -o json | jq "del(.metadata.namespace, .metadata.creationTimestamp, .metadata.resourceVersion, .metadata.uid, .metadata.name)" | jq '.metadata.name="pull-copy"' | oc -n openshift-machine-config-operator create -f - &> /dev/null; echo -n "pull-copy")
renderedImagePushSecret:
name: $(oc get -n openshift-machine-config-operator sa builder -ojsonpath='{.secrets[0].name}')
renderedImagePushSpec: "image-registry.openshift-image-registry.svc:5000/openshift-machine-config-operator/ocb-image:latest"
oc get machineosbuilds NAME PREPARED BUILDING SUCCEEDED INTERRUPTED FAILED AGE worker-4-013e7244d67ba32faadf129abd020797 False False True False False 4m33s Extension Templateoc create -f - << EOF
apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
metadata:
labels:
machineconfiguration.openshift.io/role: worker
name: tc-56131-all-extensions
spec:
config:
ignition:
version: 3.1.0
extensions:
- usbguard
- kerberos
- kernel-devel
- sandboxed-containers
- ipsec
- wasm
- sysstat
EOF
machineconfig.machineconfiguration.openshift.io/tc-56131-all-extensions created
sh-5.1# rpm -qa |grep usbguard
usbguard-selinux-1.0.0-16.el9.noarch
usbguard-1.0.0-16.el9.x86_64
sh-5.1# systemctl enable --now usbguard
Created symlink /etc/systemd/system/basic.target.wants/usbguard.service → /usr/lib/systemd/system/usbguard.service.
sh-5.1# journalctl -xeu usbguard.service
~
Apr 17 09:16:37 ip-10-0-38-113 systemd[1]: Starting USBGuard daemon...
░░ Subject: A start job for unit usbguard.service has begun execution
░░ Defined-By: systemd
░░ Support: https://access.redhat.com/support
░░
░░ A start job for unit usbguard.service has begun execution.
░░
░░ The job identifier is 2204.
Apr 17 09:16:37 ip-10-0-38-113 systemd[1]: Started USBGuard daemon.
░░ Subject: A start job for unit usbguard.service has finished successfully
░░ Defined-By: systemd
░░ Support: https://access.redhat.com/support
░░
░░ A start job for unit usbguard.service has finished successfully.
░░
░░ The job identifier is 2204.
sh-5.1# systemctl status usbguard
● usbguard.service - USBGuard daemon
Loaded: loaded (/usr/lib/systemd/system/usbguard.service; enabled; preset: disabled)
Active: active (running) since Thu 2025-04-17 09:16:37 UTC; 50s ago
Docs: man:usbguard-daemon(8)
Process: 12338 ExecStart=/usr/sbin/usbguard-daemon -f -s -K -c /etc/usbguard/usbguard-daemon.conf (code=exited, status=0/SUCCESS)
Main PID: 12340 (usbguard-daemon)
Tasks: 3 (limit: 99972)
Memory: 4.4M
CPU: 149ms
CGroup: /system.slice/usbguard.service
└─12340 /usr/sbin/usbguard-daemon -f -s -K -c /etc/usbguard/usbguard-daemon.conf
Apr 17 09:16:37 ip-10-0-38-113 systemd[1]: Starting USBGuard daemon...
Apr 17 09:16:37 ip-10-0-38-113 systemd[1]: Started USBGuard daemon.
sh-5.1# rpm -V --nomtime crun-wasm kata-containers kernel-devel kernel-headers krb5-workstation libkadm5 libreswan NetworkManager-libreswan sysstat usbguard
missing /usr/lib/tmpfiles.d/usbguard.conf
sh-5.1# rpm -qf /usr/lib/tmpfiles.d/usbguard.conf
usbguard-1.0.0-16.el9.x86_64
sh-5.1# rpm -qa | grep libreswan
libreswan-5.2-1.el9fdp.x86_64
NetworkManager-libreswan-1.2.24-1.el9.x86_64
sh-5.1# systemctl status libreswan
Unit libreswan.service could not be found.
sh-5.1# systemctl status ipsec
○ ipsec.service - Internet Key Exchange (IKE) Protocol Daemon for IPsec
Loaded: loaded (/usr/lib/systemd/system/ipsec.service; enabled; preset: disabled)
Drop-In: /etc/systemd/system/ipsec.service.d
└─01-after-configure-ovs.conf
Active: inactive (dead)
Docs: man:ipsec(8)
man:pluto(8)
man:ipsec.conf(5)
sh-5.1# systemctl start ipsec
sh-5.1# systemctl status ipsec
● ipsec.service - Internet Key Exchange (IKE) Protocol Daemon for IPsec
Loaded: loaded (/usr/lib/systemd/system/ipsec.service; enabled; preset: disabled)
Drop-In: /etc/systemd/system/ipsec.service.d
└─01-after-configure-ovs.conf
Active: active (running) since Thu 2025-04-17 15:50:00 UTC; 3s ago
Docs: man:ipsec(8)
man:pluto(8)
man:ipsec.conf(5)
Process: 182322 ExecStartPre=/usr/libexec/ipsec/addconn --config /etc/ipsec.conf --checkconfig (code=exited, status=0/SUCCESS)
Process: 182323 ExecStartPre=/usr/sbin/ipsec checknss (code=exited, status=0/SUCCESS)
Process: 182327 ExecStartPre=/usr/sbin/ipsec checknflog (code=exited, status=0/SUCCESS)
Main PID: 182342 (pluto)
Status: "Startup completed."
Tasks: 4 (limit: 99972)
Memory: 6.8M
CPU: 82ms
CGroup: /system.slice/ipsec.service
└─182342 /usr/libexec/ipsec/pluto --leak-detective --config /etc/ipsec.conf --nofork
/label qe-approved |
openshift-ci
bot
added
the
qe-approved
|
@dkhater-redhat: This pull request references Jira Issue OCPBUGS-49675, which is valid. 3 validation(s) were run on this bug
Requesting review from QA contact: This pull request references Jira Issue OCPBUGS-55039, which is valid. 3 validation(s) were run on this bug
Requesting review from QA contact: In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
/retest-required |
2 similar comments
|
/retest-required |
|
/retest-required |
|
/hold Revision fc5f032 was retested 3 times: holding |
openshift-ci
bot
added
the
do-not-merge/hold
|
/retest-required |
|
/unhold |
openshift-ci
bot
removed
the
do-not-merge/hold
|
@dkhater-redhat: The following test failed, say
Full PR test history. Your PR dashboard. Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
|
/test e2e-hypershift |
openshift-merge-bot
bot
merged commit fd75b3e
into
openshift:main
|
@dkhater-redhat: Jira Issue OCPBUGS-49675: All pull requests linked via external trackers have merged: Jira Issue OCPBUGS-49675 has been moved to the MODIFIED state. Jira Issue OCPBUGS-55039: All pull requests linked via external trackers have merged: Jira Issue OCPBUGS-55039 has been moved to the MODIFIED state. In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
[ART PR BUILD NOTIFIER] Distgit: ose-machine-config-operator |
OCPBUGS-49675, OCPBUGS-55039: In OCL. Usbguard service fails when we install the usbguard extension: IPsec tmpfile.d directives missing when enabling IPsec in OCL
OCPBUGS-49675, OCPBUGS-55039: In OCL. Usbguard service fails when we install the usbguard extension: IPsec tmpfile.d directives missing when enabling IPsec in OCL
- What I did
Added the missing tmpfiles.d configurations ipsec and modified permissions for usbguard configuration. This is a patch and will be modified once USBGuard/usbguard#652 is backported into rhel.
- How to verify it
- Description for the changelog