Uploaded image for project: 'OpenShift Service Mesh'
  1. OpenShift Service Mesh
  2. OSSM-1505

OCP 4.11 OSSM 2.1 ServiceMeshExtension fails to be ready

    XMLWordPrintable

Details

    • Bug
    • Resolution: Won't Do
    • Critical
    • None
    • OSSM 2.1.2, OSSM 2.2.1
    • Maistra
    • None
    • False
    • None
    • False
    • Hide

      1. Deploy OSSM 2.1.2 and SMCP 2.1 on OCP 4.11 nightly aws cluster
      2. Test script: https://github.com/maistra/maistra-test-tool/blob/maistra-2.1/pkg/ossm/sme_install.go
      or user can run maistra-test-tool $ go test -run T25 -v

      Show
      1. Deploy OSSM 2.1.2 and SMCP 2.1 on OCP 4.11 nightly aws cluster 2. Test script: https://github.com/maistra/maistra-test-tool/blob/maistra-2.1/pkg/ossm/sme_install.go or user can run maistra-test-tool $ go test -run T25 -v
    • Sprint 53, Sprint 54

    Description

      OCP 4.11 OSSM 2.1 ServiceMeshExtension failed to be ready
      When we test 
      quay.io/maistra-dev/header-append-filter:2.1
      The test case "Creating ServiceMeshExtension" failed to be ready.

      Build info:
      OCP 4.11.0-0.nightly-2022-05-09-050156
      OSSM operator 2.1.2
      SMCP 2.1

      How to reproduce:
      1. Deploy OSSM 2.1.2 and SMCP 2.1 on OCP 4.11 nightly aws cluster
      2. Test script: https://github.com/maistra/maistra-test-tool/blob/maistra-2.1/pkg/ossm/sme_install.go
      or user can run maistra-test-tool $ go test -run T25 -v

      Results: test failed and "error checking for SME header-append

      Logs:
      SME status: http://pastebin.test.redhat.com/1050913

      Status:
  Deployment:
    Message:  failed to pull image "quay.io/maistra-dev/header-append-filter:2.1": Trying to pull image-registry.openshift-image-registry.svc:5000/bookinfo/ossm-extension-header-a-a0eb0712@sha256:7d295f5dff1143f7afdd5ef61d02c8b987df86672e7ead8fb41f0cbc9328aa90...
Getting image source signatures
Copying blob sha256:dc5085a7738a0c23fdeab666b621ff693711929d89b519b9dab6556f18dcc2f2
Copying blob sha256:dc5085a7738a0c23fdeab666b621ff693711929d89b519b9dab6556f18dcc2f2
time="2022-05-10T23:31:00Z" level=error msg="Error while applying layer: ApplyLayer exit status 1 stdout:  stderr: Error creating mount namespace before pivot: function not implemented"
Error: writing blob: adding layer with blob "sha256:dc5085a7738a0c23fdeab666b621ff693711929d89b519b9dab6556f18dcc2f2": ApplyLayer exit status 1 stdout:  stderr: Error creating mount namespace before pivot: function not implemented
    Ready:  false
Events:     <none>

      httpbin deployment CLI warning

      serviceaccount/httpbin created
service/httpbin created
Warning: would violate PodSecurity "restricted:latest": allowPrivilegeEscalation != false (container "httpbin" must set securityContext.allowPrivilegeEscalation=false), unrestricted capabilities (container "httpbin" must set securityContext.capabilities.drop=["ALL"]), runAsNonRoot != true (pod or container "httpbin" must set securityContext.runAsNonRoot=true), seccompProfile (pod or container "httpbin" must set securityContext.seccompProfile.type to "RuntimeDefault" or "Localhost")

      proxy envoy debug log: See attachment

      Attachments

        Issue Links

          is blocked by

          Feature Request - Feature requests from customers and/or users RFE-2868 Add Security Context Constraint taylored to running Podman and Skopeo in a Pod

          • Normal - To be worked after urgent and high priorities are resolved. This term is chosen when the severity of an issue is relatively close to the level of effort to fix it. The existence of an easily implemented workaround can also lead to this priority level instead of a higher priority.
          • Deferred
          is caused by

          Epic - Created by Jira Software - do not edit or delete. Issue type for a big user story that needs to be broken down. OCPNODE-887 Enable the RuntimeDefault seccomp profile in OpenShift for all workloads

          • Normal - To be worked after urgent and high priorities are resolved. This term is chosen when the severity of an issue is relatively close to the level of effort to fix it. The existence of an easily implemented workaround can also lead to this priority level instead of a higher priority.
          • Closed
          is documented by

          Task - Represents a small unit of work that is not end-user facing. OSSM-2748 [OCP 4.11] Document that ServiceMeshExtenson doesn't work

          • Major - To be worked after higher priority work items are addressed. When the severity is high and the effort to change it is low to moderate, this term is chosen. Issues in this category likely have an existing workaround but implementation or execution may be non-trivial.
          • Closed

          Activity

            People

              jsantana@redhat.com Jonh Wendell
              yuaxu@redhat.com Yuanlin Xu
              Votes:
              0 Vote for this issue
              Watchers:
              12 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved: