-
Notifications
You must be signed in to change notification settings - Fork 88
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
fix: Removing '-Dcom.redhat.fips=false' from the default JAVA_OPTS #1777
Conversation
Signed-off-by: Ilya Buziuk <ibuziuk@redhat.com>
Codecov ReportAll modified and coverable lines are covered by tests ✅
Additional details and impacted files@@ Coverage Diff @@
## main #1777 +/- ##
=======================================
Coverage 59.53% 59.53%
=======================================
Files 71 71
Lines 8605 8605
=======================================
Hits 5123 5123
Misses 3131 3131
Partials 351 351 ☔ View full report in Codecov by Sentry. |
@ibuziuk: thanks for the detailed "How to test this PR?" section in description. |
@dmytro-ndp
|
@dmytro-ndp I believe it is important to test that Dev Spaces 3.8 can not run without On Dev Spaces 3.8 if this flag is removed, che-server should fail to start with the following error:
|
@tolusha : thanks for the answer.
|
|
@tolusha: something went wrong on my local machine, and I hadn't managed building che-operator image. |
Please use the following image to test |
@dmytro-ndp why are you using local machine and not the dogfooding instance? |
@ibuziuk :
Because I didn't know that it was possible to build che-operator image on Che dogfooding instance I have a question about PR testing.
Is it really needed taking into account that there is already |
@dmytro-ndp no worries, my point was that we should use Eclipse Che for development / verification as much as possible ;-)
PR description is saying about testing Dev Spaces 3.9.1 and 3.8.0. For upstream Eclipse Che verification patching CR is not needed, but it is important to note that the issue was reproducible only on Dev Spaces, not Eclipse Che. That's great to verify upstream functionality, but before merging this PR please also do the verification of Dev Spaces according to the PR description. |
@ibuziuk : I have successfully tested Dev Spaces 3.9.1 deployed using quay.io/dmytro_ndp/che-operator:pr-1777 built from this PR to OCP 4.14 cluster with FIPS enabled (Cluster Bot command
if was enabled
Quarkus and Lombok workspaces has started successfully. TODO: testing DS 3.8.0 / Eclipse Che next. |
@ibuziuk : about
DS 3.8.0 server DID NOT fail to start on OCP 4.14 azure with fips, and |
@dmytro-ndp thanks for the review, this does not look expected. Would it be possible to try the same flow against 3.7? Basically, I tried it in mid-July and was able to reproduce this error - https://issues.redhat.com/browse/CRW-4592?focusedId=22646733&page=com.atlassian.jira.plugin.system.issuetabpanels%3Acomment-tabpanel#comment-22646733 |
@ibuziuk: DS 3.7.2 server had also successfully started on OCP 4.14 azure with fips, and Here is server logs: https://gist.github.com/dmytro-ndp/1c0d536000e27e6b893f9c52552b502f Do you think it could be related to OCP version = 4.14? |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
PR looks good to merge, because Eclipse Che Next has been successfully deployed to OCP 4.13 with FIPS enabled using "quay.io/dmytro_ndp/che-operator:pr-1777" image built from this PR (https://main-jenkins-csb-crwqe.apps.ocp-c1.prod.psi.redhat.com/job/Che/job/ocp/job/basic/job/install-che-to-ocp/89/) as well as Dev Spaces 3.9.1 to OCP 4.14 with FIPS enabled.
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: dmytro-ndp, ibuziuk, tolusha The full list of commands accepted by this bot can be found here.
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
@dmytro-ndp Thanks for the review, I was able to reproduce the error back in the summer - https://issues.redhat.com/secure/attachment/13005118/13005118_devspaces-56c78b84-ddb6d-devspaces.log
Which Dev Spaces version does it correspond to? |
@ibuziuk : I have tested DS 3.7.2 with You can find devspaces logs in my message above: #1777 (comment)
It could be DS 3.7.0 or 3.7.1 |
ack, thanks |
Build 3.11 :: operator-bundle_3.x/2335: Console, Changes, Git Data |
Build 3.11 :: sync-to-downstream_3.x/5414: Console, Changes, Git Data |
Build 3.11 :: push-latest-container-to-quay_3.x/3798: Console, Changes, Git Data |
Build 3.11 :: sync-to-downstream_3.x/5414: Build container: devspaces-operator-bundle synced; /DS_CI/get-sources-rhpkg-container-build_3.x/5287 triggered; /job/DS_CI/job/dsc_3.x triggered; |
Build 3.11 :: operator-bundle_3.x/2335: Upstream sync done; /DS_CI/sync-to-downstream_3.x/5414 triggered |
Build 3.11 :: copyIIBsToQuay/2218: Console, Changes, Git Data |
Build 3.11 :: dsc_3.x/1601: Console, Changes, Git Data |
Build 3.11 :: dsc_3.x/1601: 3.11.0-CI |
Build 3.11 :: operator-bundle_3.x/2336: Console, Changes, Git Data |
Build 3.11 :: sync-to-downstream_3.x/5416: Console, Changes, Git Data |
Build 3.11 :: push-latest-container-to-quay_3.x/3800: Console, Changes, Git Data |
Build 3.11 :: copyIIBsToQuay/2220: Console, Changes, Git Data |
Build 3.11 :: sync-to-downstream_3.x/5416: Build container: devspaces-operator-bundle synced; /DS_CI/get-sources-rhpkg-container-build_3.x/5289 triggered; /job/DS_CI/job/dsc_3.x triggered; |
Build 3.11 :: operator-bundle_3.x/2336: Upstream sync done; /DS_CI/sync-to-downstream_3.x/5416 triggered |
Build 3.11 :: dsc_3.x/1602: Console, Changes, Git Data |
Build 3.11 :: dsc_3.x/1602: 3.11.0-CI |
Build 3.11 :: operator-bundle_3.x/2340: Console, Changes, Git Data |
Build 3.11 :: sync-to-downstream_3.x/5436: Console, Changes, Git Data |
Build 3.11 :: get-sources-rhpkg-container-build_3.x/5310: devspaces-operator-bundle : 3.x :: Build 57278576 : operator-bundle-3.11-115 |
Build 3.11 :: sync-to-downstream_3.x/5436: Build container: devspaces-operator-bundle synced; /DS_CI/get-sources-rhpkg-container-build_3.x/5310 triggered; /job/DS_CI/job/dsc_3.x triggered; |
Build 3.11 :: operator-bundle_3.x/2340: Upstream sync done; /DS_CI/sync-to-downstream_3.x/5436 triggered |
Build 3.11 :: dsc_3.x/1606: Console, Changes, Git Data |
Build 3.11 :: dsc_3.x/1606: 3.11.0-CI |
What does this PR do?
Removing '-Dcom.redhat.fips=false' from the default JAVA_OPTS
In the latest Dev Spaces release the latest 6.8.1 version of k8s client is used which is FIPS compatible - fabric8io/kubernetes-client#3582 and there is no need to disable fips via
-Dcom.redhat.fips=false
on the che-server end.Screenshot/screencast of this PR
What issues does this PR fix or reference?
https://issues.redhat.com/browse/CRW-4592
How to test this PR?
launch 4.13 azure,fips
)oc get cm cluster-config-v1 -n kube-system -o json | jq -r '.data' | grep -i "fips"
command-Dcom.redhat.fips=false
JAVA_OPTS
env var in che-server / devspaces pod as well as in theche
configmap - it should be-XX:MaxRAMPercentage=85.0
PR Checklist
As the author of this Pull Request I made sure that:
What issues does this PR fix or reference
andHow to test this PR
completedReviewers
Reviewers, please comment how you tested the PR when approving it.