Skip to content

Commit

Permalink
OSPCIX-372 Fix race in ironic tls patch sequence
Browse files Browse the repository at this point in the history
In order for ironic agent ramdisks to work, they need to contain the
CA certificate of the deployment such that they can talk to the OCP
TLS endpoint.

Unfortunately, the sequence of invocation to patch the ramdisk
images, which was merged, contains an invocation of a podman
plugin, which by default launches containers as detached
operations. The net result is the command can return
almost immediately, and then the next step attempts to
execute and then fails because files it expects may not appear
for several seconds. So the correct path is to disable
the detach operation call so when podman exits, we know the task
has been completed to allow for the next task to execute.

Also adds an ls -la of the folder we expect files to be in to aid
in future ci framework troubleshooting.
  • Loading branch information
juliakreger authored and openshift-merge-bot[bot] committed Jul 15, 2024
1 parent 5d922dd commit cc9eaa3
Showing 1 changed file with 2 additions and 0 deletions.
2 changes: 2 additions & 0 deletions hooks/playbooks/ironic_inject_tls.yml
Original file line number Diff line number Diff line change
Expand Up @@ -56,6 +56,7 @@
image: "{{ ironic_python_image }}"
name: ironic-python-agent
rm: true
detach: false
volumes:
- "{{ cifmw_basedir }}/artifacts/ironic_ipa_tls/:/target:Z"

Expand All @@ -66,6 +67,7 @@
executable: "/bin/bash"
script: |
set -xe -o pipefail
ls -la {{ cifmw_basedir }}/artifacts/ironic_ipa_tls/
zcat {{ cifmw_basedir }}/artifacts/ironic_ipa_tls/ironic-python-agent.initramfs | cpio -idmv
cp {{ cifmw_basedir }}/artifacts/ironic_ipa_tls/internal-ca-bundle.pem etc/pki/ca-trust/source/anchors/
chroot {{ cifmw_basedir }}/artifacts/ironic_ipa_tls/initramfs << EOF_CHROOT_SCRIPT
Expand Down

0 comments on commit cc9eaa3

Please sign in to comment.