RHEL: Do not pull rootless CNI infra image, and instead request that user build it. #8671

mheon · 2020-12-09T19:28:16Z

Instead, we want to advise users to manually build the image. We cannot distribute the existing image for RHEL 8.3.1, and the feature will be tech preview, so this degraded user experience will have to be sufficient until we can get a better solution in place.

Ref: https://issues.redhat.com/browse/RUN-1127

Please note that this is a RHEL only change and should not be included in non-RHEL branches.

Also, cherry-pick #8652 into the RHEL tree.

The existing logic (Range > 0) always triggered, because range is guaranteed to be at least 1 (a single port has a range of 1, a two port range (e.g. 80-81) has a range of 2, and so on). As such this could cause ports that had a host port assigned to them by the user to randomly assign one instead. Fixes containers#8650 Fixes containers#8651 Signed-off-by: Matthew Heon <mheon@redhat.com>

mheon · 2020-12-09T19:48:36Z

@baude @TomSweeneyRedHat @rhatdan PTAL

rhatdan · 2020-12-09T19:51:38Z

@mheon Looks like you have a PR in here that is not supposed to be here on Ports.

mheon · 2020-12-09T19:53:18Z

@rhatdan Deliberate cherry-pick - that's a pretty significant bugfix we should get into RHEL. We're not frozen yet, so I grabbed it.

rhatdan · 2020-12-09T19:55:36Z

LGTM

TomSweeneyRedHat · 2020-12-09T20:21:20Z

libpod/rootless_cni_linux.go

 	if err != nil {
+		if errors.Cause(err) == define.ErrNoSuchImage {
+			return nil, errors.Errorf("rootless CNI infra image not present - please build image from https://github.com/containers/podman/blob/v2.2.1/contrib/rootless-cni-infra/Containerfile and tag as %q", imageName)


I know it's long already, but could we give them the command to use to build the image instead of just the Containerfile?

I don't think so - the actual build process is getting very complicated because we can't just do a podman build $URL (you need to pull down not just the containerfile, but the directory containing it, and then do a podman build on that)

We have a separate card to document this elsewhere, which is where I think that sort of documentation will need to land.

What about letting Podman itself execute git clone ... && git checkout ... && podman build -t rootless-cni-infra .

Problem is disconnected environments - we can't guarantee the system has a working connection to the internet.

vrothberg · 2020-12-14T07:51:10Z

@AkihiroSuda PTAL.

At some point we'd love to ship multi-arch images but the local build seems like the best way forward for now.

vrothberg · 2020-12-14T07:57:05Z

@AkihiroSuda PTAL.

At some point we'd love to ship multi-arch images but the local build seems like the best way forward for now.

Ah, that's a RHEL-only branch

AkihiroSuda · 2020-12-14T08:09:17Z

test/e2e/network_create_test.go

@@ -74,6 +74,7 @@ var _ = Describe("Podman network create", func() {
 	)

 	BeforeEach(func() {
+		SkipIfRootless("rootless CNI is tech preview in 8.3.1")


8.3.1 -> RHEL 8.3.1

AkihiroSuda · 2020-12-14T08:11:30Z

Ref: https://issues.redhat.com/browse/RUN-1127

I don't have visibility in this URL, but I'm wondering Red Hat could build and upload the infra image by themselves if they have concern in the image built outside Red Hat.

vrothberg · 2020-12-14T08:14:02Z

Ref: https://issues.redhat.com/browse/RUN-1127

I don't have visibility in this URL, but I'm wondering Red Hat could build and upload the infra image by themselves if they have concern in the image built outside Red Hat.

I think that's the long-term goal. Thanks for checking!

mheon · 2021-01-04T19:49:35Z

Re-pushed. Added some extra docs to the README on Github about building, which should help people get started.

@rhatdan @TomSweeneyRedHat PTAL

Instead, we want to advise users to manually build the image. We cannot distribute the existing image for RHEL 8.3.1, and the feature will be tech preview, so this degraded user experience will have to be sufficient until we can get a better solution in place. Ref: https://issues.redhat.com/browse/RUN-1127 Please note that this is a RHEL only change and should not be included in non-RHEL branches. Signed-off-by: Matthew Heon <mheon@redhat.com>

mheon · 2021-01-04T22:32:37Z

Good to merge

vrothberg

LGTM

mheon · 2021-01-05T15:04:27Z

@containers/podman-maintainers PTAL

openshift-ci-robot · 2021-01-05T15:09:05Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: AkihiroSuda, mheon

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~OWNERS~~ [mheon]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

rhatdan · 2021-01-05T21:58:12Z

/lgtm

Instead, we want to advise users to manually build the image. We cannot distribute the existing image for RHEL 8.4.0, and the feature will be tech preview, so this degraded user experience will have to be sufficient until we can get a better solution in place. Ref: https://issues.redhat.com/browse/RUN-1127 Please note that this is a RHEL only change and should not be included in non-RHEL branches. This is a forward-port of the original changes in containers#8671 to the new v3.0.1-rhel branch. Signed-off-by: Matthew Heon <mheon@redhat.com>

openshift-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Dec 9, 2020

TomSweeneyRedHat reviewed Dec 9, 2020

View reviewed changes

mheon force-pushed the rhel_no_pull_infra branch 2 times, most recently from 0a596dd to fefb663 Compare December 11, 2020 18:39

AkihiroSuda reviewed Dec 14, 2020

View reviewed changes

AkihiroSuda mentioned this pull request Dec 14, 2020

Proposal: imageless rootless-cni-infra #8709

Closed

mheon force-pushed the rhel_no_pull_infra branch from fefb663 to c2ad5a8 Compare January 4, 2021 19:48

mheon force-pushed the rhel_no_pull_infra branch from c2ad5a8 to 4007554 Compare January 4, 2021 20:55

vrothberg reviewed Jan 5, 2021

View reviewed changes

AkihiroSuda approved these changes Jan 5, 2021

View reviewed changes

openshift-ci-robot assigned rhatdan Jan 5, 2021

openshift-ci-robot added the lgtm Indicates that a PR is ready to be merged. label Jan 5, 2021

openshift-merge-robot merged commit 14c35f6 into containers:v2.2.1-rhel Jan 5, 2021

mheon mentioned this pull request Mar 1, 2021

[v3.0.1-rhel] Fix RHBZ#1932083 #9552

Merged

github-actions bot added the locked - please file new issue/PR Assist humans wanting to comment on an old issue or PR with locked comments. label Sep 23, 2023

github-actions bot locked as resolved and limited conversation to collaborators Sep 23, 2023

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

RHEL: Do not pull rootless CNI infra image, and instead request that user build it. #8671

RHEL: Do not pull rootless CNI infra image, and instead request that user build it. #8671

mheon commented Dec 9, 2020

mheon commented Dec 9, 2020

rhatdan commented Dec 9, 2020

mheon commented Dec 9, 2020

rhatdan commented Dec 9, 2020

TomSweeneyRedHat Dec 9, 2020

mheon Dec 10, 2020

mheon Dec 10, 2020

AkihiroSuda Dec 14, 2020

mheon Dec 14, 2020

vrothberg commented Dec 14, 2020

vrothberg commented Dec 14, 2020

AkihiroSuda Dec 14, 2020

AkihiroSuda commented Dec 14, 2020

vrothberg commented Dec 14, 2020

mheon commented Jan 4, 2021

mheon commented Jan 4, 2021

vrothberg left a comment

mheon commented Jan 5, 2021

openshift-ci-robot commented Jan 5, 2021

rhatdan commented Jan 5, 2021

RHEL: Do not pull rootless CNI infra image, and instead request that user build it. #8671

RHEL: Do not pull rootless CNI infra image, and instead request that user build it. #8671

Conversation

mheon commented Dec 9, 2020

mheon commented Dec 9, 2020

rhatdan commented Dec 9, 2020

mheon commented Dec 9, 2020

rhatdan commented Dec 9, 2020

TomSweeneyRedHat Dec 9, 2020

Choose a reason for hiding this comment

mheon Dec 10, 2020

Choose a reason for hiding this comment

mheon Dec 10, 2020

Choose a reason for hiding this comment

AkihiroSuda Dec 14, 2020

Choose a reason for hiding this comment

mheon Dec 14, 2020

Choose a reason for hiding this comment

vrothberg commented Dec 14, 2020

vrothberg commented Dec 14, 2020

AkihiroSuda Dec 14, 2020

Choose a reason for hiding this comment

AkihiroSuda commented Dec 14, 2020

vrothberg commented Dec 14, 2020

mheon commented Jan 4, 2021

mheon commented Jan 4, 2021

vrothberg left a comment

Choose a reason for hiding this comment

mheon commented Jan 5, 2021

openshift-ci-robot commented Jan 5, 2021

rhatdan commented Jan 5, 2021