-
Notifications
You must be signed in to change notification settings - Fork 169
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
ARO-6756 Remove usecheckaccess feature and environment variables #3643
Conversation
/azp run ci,e2e |
Azure Pipelines successfully started running 2 pipeline(s). |
/azp run e2e |
Azure Pipelines successfully started running 1 pipeline(s). |
/azp run e2e |
Azure Pipelines successfully started running 1 pipeline(s). |
/azp run e2e |
Azure Pipelines successfully started running 1 pipeline(s). |
/azp run e2e,ci |
1effa8f
to
faa09e6
Compare
/azp run ci, e2e |
Azure Pipelines successfully started running 2 pipeline(s). |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM if E2E passes!
Please rebase pull request. |
faa09e6
to
cbe8fa6
Compare
/azp run ci, e2e |
Azure Pipelines successfully started running 2 pipeline(s). |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
lgtm! thanks for the cleanup.
Remove RHUI and Microsoft repo configuration, add Mariner Extended repo config Remove lvm disk resize Mariner does not use lvm, the disk is automatically grown to the full size specified. Firewalld configuration has been removed, as Mariner does not have the requirements to support the nftables backend. Firewall rules will be configured at the vnet level in Azure. Remove semanage Mariner Linux does not have selinux configured. Add changes to remove CHECKACCESS Merged in PR #3643 Remove gateway log rotation config Log rotation for the podman level driver log was not the correct approach. The podman log driver is now journald, so all logs will be shipped to journald rather than a ctr.log file. Update gateway vmss OS image to cbl-mariner-2-gen2-fips
Remove RHUI and Microsoft repo configuration, add Mariner Extended repo config Remove lvm disk resize Mariner does not use lvm, the disk is automatically grown to the full size specified. Firewalld configuration has been removed, as Mariner does not have the requirements to support the nftables backend. Firewall rules will be configured at the vnet level in Azure. Remove semanage Mariner Linux does not have selinux configured. Add changes to remove CHECKACCESS Merged in PR #3643 Remove gateway log rotation config Log rotation for the podman level driver log was not the correct approach. The podman log driver is now journald, so all logs will be shipped to journald rather than a ctr.log file. During mdm and mdsd setup, I've added wait steps for the download scripts to complete getting certificates. Without this, the download scripts run in a subshell and fixing up the certificates fails. Update gateway vmss OS image to cbl-mariner-2-gen2-fips. Add firewalld configuration back, required for podman networking Add podman aro network creation to isolate RP containers from possible interaction on the default podman network.
Remove RHUI and Microsoft repo configuration, add Mariner Extended repo config Remove lvm disk resize Mariner does not use lvm, the disk is automatically grown to the full size specified. Firewalld configuration has been removed, as Mariner does not have the requirements to support the nftables backend. Firewall rules will be configured at the vnet level in Azure. Remove semanage Mariner Linux does not have selinux configured. Add changes to remove CHECKACCESS Merged in PR #3643 Remove gateway log rotation config Log rotation for the podman level driver log was not the correct approach. The podman log driver is now journald, so all logs will be shipped to journald rather than a ctr.log file. During mdm and mdsd setup, I've added wait steps for the download scripts to complete getting certificates. Without this, the download scripts run in a subshell and fixing up the certificates fails. Update gateway vmss OS image to cbl-mariner-2-gen2-fips. Add firewalld configuration back, required for podman networking Add podman aro network creation to isolate RP containers from possible interaction on the default podman network.
Restructure VMSS bootstrap bash scripts for increased reliability, and easier debugging Move all shared code into a commonly shared file to be sourced by all bootstrapping scripts. This allows for code reuse, minimal duplication. Fix mdm mdsd certificate download script Increase rpm retry time to 30 minutes total, every 30 seconds. Install Azure Security Monitor via VMSS Extension Remove RHUI and Microsoft repo configuration, add Mariner Extended repo config Remove lvm disk resize Mariner does not use lvm, the disk is automatically grown to the full size specified. Firewalld configuration has been removed, as Mariner does not have the requirements to support the nftables backend. Firewall rules will be configured at the vnet level in Azure. Remove semanage Mariner Linux does not have selinux configured. Add changes to remove CHECKACCESS Merged in PR #3643 Remove gateway log rotation config Log rotation for the podman level driver log was not the correct approach. The podman log driver is now journald, so all logs will be shipped to journald rather than a ctr.log file. During mdm and mdsd setup, I've added wait steps for the download scripts to complete getting certificates. Without this, the download scripts run in a subshell and fixing up the certificates fails. Add firewalld configuration, required for podman networking Add podman aro network creation to isolate RP containers from possible interaction on the default podman network.
Restructure VMSS bootstrap bash scripts for increased reliability, and easier debugging Move all shared code into a commonly shared file to be sourced by all bootstrapping scripts. This allows for code reuse, minimal duplication. Fix mdm mdsd certificate download script Increase rpm retry time to 30 minutes total, every 30 seconds. Install Azure Security Monitor via VMSS Extension Remove RHUI and Microsoft repo configuration, add Mariner Extended repo config Remove lvm disk resize Mariner does not use lvm, the disk is automatically grown to the full size specified. Firewalld configuration has been removed, as Mariner does not have the requirements to support the nftables backend. Firewall rules will be configured at the vnet level in Azure. Remove semanage Mariner Linux does not have selinux configured. Add changes to remove CHECKACCESS Merged in PR #3643 Remove gateway log rotation config Log rotation for the podman level driver log was not the correct approach. The podman log driver is now journald, so all logs will be shipped to journald rather than a ctr.log file. During mdm and mdsd setup, I've added wait steps for the download scripts to complete getting certificates. Without this, the download scripts run in a subshell and fixing up the certificates fails. Add firewalld configuration, required for podman networking Add podman aro network creation to isolate RP containers from possible interaction on the default podman network.
Restructure VMSS bootstrap bash scripts for increased reliability, and easier debugging Move all shared code into a commonly shared file to be sourced by all bootstrapping scripts. This allows for code reuse, minimal duplication. Fix mdm mdsd certificate download script Increase rpm retry time to 30 minutes total, every 30 seconds. Install Azure Security Monitor via VMSS Extension Remove RHUI and Microsoft repo configuration, add Mariner Extended repo config Remove lvm disk resize Mariner does not use lvm, the disk is automatically grown to the full size specified. Firewalld configuration has been removed, as Mariner does not have the requirements to support the nftables backend. Firewall rules will be configured at the vnet level in Azure. Remove semanage Mariner Linux does not have selinux configured. Add changes to remove CHECKACCESS Merged in PR #3643 Remove gateway log rotation config Log rotation for the podman level driver log was not the correct approach. The podman log driver is now journald, so all logs will be shipped to journald rather than a ctr.log file. During mdm and mdsd setup, I've added wait steps for the download scripts to complete getting certificates. Without this, the download scripts run in a subshell and fixing up the certificates fails. Add firewalld configuration, required for podman networking Add podman aro network creation to isolate RP containers from possible interaction on the default podman network.
Restructure VMSS bootstrap bash scripts for increased reliability, and easier debugging Move all shared code into a commonly shared file to be sourced by all bootstrapping scripts. This allows for code reuse, minimal duplication. Fix mdm mdsd certificate download script Increase rpm retry time to 30 minutes total, every 30 seconds. Install Azure Security Monitor via VMSS Extension Remove RHUI and Microsoft repo configuration, add Mariner Extended repo config Remove lvm disk resize Mariner does not use lvm, the disk is automatically grown to the full size specified. Firewalld configuration has been removed, as Mariner does not have the requirements to support the nftables backend. Firewall rules will be configured at the vnet level in Azure. Remove semanage Mariner Linux does not have selinux configured. Add changes to remove CHECKACCESS Merged in PR #3643 Remove gateway log rotation config Log rotation for the podman level driver log was not the correct approach. The podman log driver is now journald, so all logs will be shipped to journald rather than a ctr.log file. During mdm and mdsd setup, I've added wait steps for the download scripts to complete getting certificates. Without this, the download scripts run in a subshell and fixing up the certificates fails. Add firewalld configuration, required for podman networking Add podman aro network creation to isolate RP containers from possible interaction on the default podman network.
Which issue this PR addresses:
Additional changes for
https://issues.redhat.com/browse/ARO-6756
Additional PRs:-
https://msazure.visualstudio.com/AzureRedHatOpenShift/_git/ARO-Pipelines/pullrequest/10341885
https://msazure.visualstudio.com/AzureRedHatOpenShift/_git/RP-Config/pullrequest/10341820
It just removes the feature and related environment variables, doesn't change the implementation as the checkAccessV2 is used for all the environments after #3524
What this PR does / why we need it:
Since CheckAccessV2 is now available and running in all the environments, no feature variable is needed for CheckAccessV2
Test plan for issue:
-> Updated Unit Tests where checkaccessv2 variable was used.
-> Pass all the unit test cases
-> Pass e2e
Is there any documentation that needs to be updated for this PR?
Document already exists for CheckAccessV2 in ADO:- https://msazure.visualstudio.com/AzureRedHatOpenShift/_wiki/wikis/AzureRedHatOpenShift.wiki/409184/CheckAccess-API-migration
The document will be updated with the getAccess marked as deprecated once the changes are merged and available in production.
How do you know this will function as expected in production?
Currently, the production/Local Dev/Full RP already relies on CheckAccessV2, so no functionality change from that point of view.