Bug #48107
closedcephadm fails to deploy iscsi gateway when selinux is enabled
20%
Description
With Ceph 15.2.5 iSCSI Gateway containers will still fail start.
Applying the changes from the following pull request allows the containers to start.
Updated by Nathan Cutler over 3 years ago
- Status changed from New to Resolved
This looks like a mistake. https://github.com/ceph/ceph/pull/31321 contains a single commit 0444025aaf559a662882abc49465b5e31a66280d and this commit is already present in octopus.
Updated by David Rivera over 3 years ago
Nathan Cutler wrote:
This looks like a mistake. https://github.com/ceph/ceph/pull/31321 contains a single commit 0444025aaf559a662882abc49465b5e31a66280d and this commit is already present in octopus.
After a closer look, it looks like iSCSI gateway deployment doesn't use ceph-daemon but the issue is the same; re-labeling of /sys and/dev directories.
The following causes the tcmu and iscsi containers to fail at start.
/sys/kernel/config:z
/dev:/dev:z
/dev/log:/dev/log:z
Removing :z from those in unit.run allows both containers to start.
Updated by Nathan Cutler over 3 years ago
After a closer look, it looks like iSCSI gateway deployment doesn't use ceph-daemon
cephadm is not called "ceph-daemon" anymore: it was renamed to cephadm some time ago.
but the issue is the same; re-labeling of /sys and/dev directories.
How did you deploy your iscsi gateway, if not using cephadm?
Updated by David Rivera over 3 years ago
Nathan Cutler wrote:
How did you deploy your iscsi gateway, if not using cephadm?
iSCSI gateway was deployed using the ceph orchestrator.
[ceph: root@ceph0 /]# ceph -v ceph version 15.2.5 (2c93eff00150f0cc5f106a559557a58d3d7b6f1f) octopus (stable)
I attempted to deploy the gateway using the command line and using by applying a service text file. Both methods resulted in failure to start dues to selinux relabeling.
Using the command Line:
ceph orch iscsi apply rbd admin admin --trusted_ip_list=192.168.22.100 --placement=ceph0.cluster.internal
Using service text file:
service_type: iscsi service_id: iscsi placement: hosts: - ceph0.cluster.internal spec: pool: rbd api_user: admin api_password: admin trusted_ip_list: 192.168.22.100
ceph orch apply -i /tmp/iscsi.txt
Updated by Nathan Cutler over 3 years ago
- Tracker changed from Backport to Bug
- Project changed from Ceph to Orchestrator
- Subject changed from Octopus: ceph-daemon fails when selinux is enabled to cephadm fails to deploy iscsi gateway when selinux is enabled
- Status changed from Resolved to New
- Target version deleted (
v15.2.6) - % Done set to 0
- Regression set to No
- Severity set to 3 - minor
- Affected Versions v15.2.5 added
Updated by Juan Miguel Olmo Martínez about 3 years ago
- Assignee set to Juan Miguel Olmo Martínez
Updated by Sebastian Wagner about 3 years ago
- Related to Bug #48925: cephadm: iscsi missing mgr permissions added
Updated by Juan Miguel Olmo Martínez about 3 years ago
- % Done changed from 0 to 20
Updated by Sebastian Wagner almost 3 years ago
- Status changed from New to Can't reproduce