Uploaded image for project: 'OpenShift Bugs'
  1. OpenShift Bugs
  2. OCPBUGS-9178

MCO does not detect change in authorized_keys file

XMLWordPrintable

    • Low
    • None
    • 3
    • MCO Sprint 257, MCO Sprint 258, MCO Sprint 259, MCO Sprint 260
    • 4
    • Unspecified
    • If docs needed, set a value

      Description of problem: The MachineConfigOperator does not pick up on out of band changes to the /home/core/.ssh/authorized_keys file.

      Version-Release number of MCO (Machine Config Operator) (if applicable): 4.10

      Platform (AWS, VSphere, Metal, etc.): vsphere

      Are you certain that the root cause of the issue being reported is the MCO (Machine Config Operator)?
      (Y/N/Not sure): Not Sure

      How reproducible: every time

      Did you catch this issue by running a Jenkins job? NO

      Steps to Reproduce:
      1. access a node via `oc debug node` or ssh
      2. vi ~/.ssh/authorized_keys
      3. change the content of the authorized_keys file

      Actual results: This manual change to a file that is deployed by MCO through the MachineConfig "99-worker-ssh" and "99-master-ssh" is not detected, or fixed

      Expected results: I would expect that a change to the ~/.ssh/authorized_keys file on a node would be detected by the MCO as it is defined through a MachineConfig object by default in OpenShift. (99-worker-ssh, and 99-master-ssh).

      Additional info:

      1. Please consider attaching a must-gather archive (via oc adm must-gather). Please review must-gather contents for sensitive information before attaching any must-gathers to a Bugzilla report. You may also mark the bug private if you wish.

      2. If a must-gather is unavailable, please provide the output of:

      $ oc get co machine-config -o yaml

      $ oc get mcp (and oc describe mcp/${degraded_pool} if pools are degraded)

      $ oc get mc

      $ oc get pod -n openshift-machine-config-operator

      $ oc get node -o wide

      Mustgather was too large to upload. I have uploaded file with the outputs from these commands.

      3. If a node is not accessible via API, please provide console/journal/kubelet logs of the problematic node

      4. Are there RHEL nodes on the cluster? NO

            rh-ee-rsaini Rishabh Saini
            mdeneve@redhat.com Mark DeNeve
            Rio Liu Rio Liu
            Red Hat Employee
            Votes:
            0 Vote for this issue
            Watchers:
            7 Start watching this issue

              Created:
              Updated:
              Resolved: