openshift-ci-robot
commented
5 months ago @yuumasato: This pull request references Jira Issue OCPBUGS-19690, which is invalid:
- expected the bug to target either version "4.16." or "openshift-4.16.", but it targets "4.15.0" instead
Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.
The bug has been updated to refer to the pull request using the external bug tracker.
In response to [this](https://github.com/ComplianceAsCode/compliance-operator/pull/497):
>* With `HostNetwork: true` the sysctl `net.core.bpf_jit_harden` becomes visible to the `scanner` container.
> Below is a pod that has access to the sysctls:
>```yaml
>apiVersion: v1
>kind: Pod
>metadata:
> name: list-sysctls
>spec:
> hostNetwork: true
> volumes:
> - name: host
> hostPath:
> path: /
> type: Directory
> containers:
> - name: list
> command:
> - cat
> - /host/proc/sys/net/ipv6/conf/all/accept_ra
> - /host/proc/sys/net/core/bpf_jit_harden
> image: registry.access.redhat.com/ubi8/ubi-minimal
> securityContext:
> runAsUser: 0
> privileged: true
> volumeMounts:
> - name: host
> mountPath: /host
>```
>`$ oc create -f list-syctls-proc.yaml`
>`$ oc logs list-sysctls `
>
>* But with `HostNetwork: true`, the CO fails to upload to `resultserver`.
>`
>{"level":"info","ts":"2024-03-15T18:45:57Z","logger":"cmd","msg":"Trying to upload to resultserver","url":"https://upstream-rhcos4-high-worker-rs:8443/"}
>{"level":"error","ts":"2024-03-15T18:45:57Z","logger":"cmd","msg":"Failed to upload results to server","error":"Post \"https://upstream-rhcos4-high-worker-rs:8443/\": dial tcp: lookup upstream-rhcos4-high-worker-rs on 10.0.0.2:53: no such host","stacktrace":"github.com/ComplianceAsCode/compliance-operator/cmd/manager.uploadToResultServer.func1\n\tgithub.com/ComplianceAsCode/compliance-operator/cmd/manager/resultcollector.go:316\ngithub.com/cenkalti/backoff/v4.RetryNotifyWithTimer.Operation.withEmptyData.func1\n\tgithub.com/cenkalti/backoff/v4@v4.2.1/retry.go:18\ngithub.com/cenkalti/backoff/v4.doRetryNotify[...]\n\tgithub.com/cenkalti/backoff/v4@v4.2.1/retry.go:88\ngithub.com/cenkalti/backoff/v4.RetryNotifyWithTimer\n\tgithub.com/cenkalti/backoff/v4@v4.2.1/retry.go:61\ngithub.com/cenkalti/backoff/v4.RetryNotify\n\tgithub.com/cenkalti/backoff/v4@v4.2.1/retry.go:49\ngithub.com/cenkalti/backoff/v4.Retry\n\tgithub.com/cenkalti/backoff/v4@v4.2.1/retry.go:38\ngithub.com/ComplianceAsCode/compliance-operator/cmd/manager.uploadToResultServer\n\tgithub.com/ComplianceAsCode/compliance-operator/cmd/manager/resultcollector.go:299\ngithub.com/ComplianceAsCode/compliance-operator/cmd/manager.handleCompleteSCAPResults.func1\n\tgithub.com/ComplianceAsCode/compliance-operator/cmd/manager/resultcollector.go:390"}
>`
>* `DNSPolicy: ClusterFirstWithHostNet` is my unsuccessful attempt to fix that.
>
>
>
Instructions for interacting with me using PR comments are available [here](https://prow.ci.openshift.org/command-help?repo=ComplianceAsCode%2Fcompliance-operator). If you have questions or suggestions related to my behavior, please file an issue against the [openshift-eng/jira-lifecycle-plugin](https://github.com/openshift-eng/jira-lifecycle-plugin/issues/new) repository.
Vincent056
BhargaviGudi
yuumasato
openshift-ci[bot]
rhmdnd
github-actions[bot]
With
HostNetwork: truethe sysctlnet.core.bpf_jit_hardenbecomes visible to thescannercontainer. Below is a pod that has access to the sysctls:$ oc create -f list-syctls-proc.yaml$ oc logs list-sysctlsDNSPolicy: ClusterFirstWithHostNetallows the CO to upload toresultserver, otherwise we get the following error:{"level":"info","ts":"2024-03-15T18:45:57Z","logger":"cmd","msg":"Trying to upload to resultserver","url":"https://upstream-rhcos4-high-worker-rs:8443/"} {"level":"error","ts":"2024-03-15T18:45:57Z","logger":"cmd","msg":"Failed to upload results to server","error":"Post \"https://upstream-rhcos4-high-worker-rs:8443/\": dial tcp: lookup upstream-rhcos4-high-worker-rs on 10.0.0.2:53: no such host","stacktrace":"github.com/ComplianceAsCode/compliance-operator/cmd/manager.uploadToResultServer.func1\n\tgithub.com/ComplianceAsCode/compliance-operator/cmd/manager/resultcollector.go:316\ngithub.com/cenkalti/backoff/v4.RetryNotifyWithTimer.Operation.withEmptyData.func1\n\tgithub.com/cenkalti/backoff/v4@v4.2.1/retry.go:18\ngithub.com/cenkalti/backoff/v4.doRetryNotify[...]\n\tgithub.com/cenkalti/backoff/v4@v4.2.1/retry.go:88\ngithub.com/cenkalti/backoff/v4.RetryNotifyWithTimer\n\tgithub.com/cenkalti/backoff/v4@v4.2.1/retry.go:61\ngithub.com/cenkalti/backoff/v4.RetryNotify\n\tgithub.com/cenkalti/backoff/v4@v4.2.1/retry.go:49\ngithub.com/cenkalti/backoff/v4.Retry\n\tgithub.com/cenkalti/backoff/v4@v4.2.1/retry.go:38\ngithub.com/ComplianceAsCode/compliance-operator/cmd/manager.uploadToResultServer\n\tgithub.com/ComplianceAsCode/compliance-operator/cmd/manager/resultcollector.go:299\ngithub.com/ComplianceAsCode/compliance-operator/cmd/manager.handleCompleteSCAPResults.func1\n\tgithub.com/ComplianceAsCode/compliance-operator/cmd/manager/resultcollector.go:390"}Use the content from https://github.com/ComplianceAsCode/content/pull/11722, to check whether the
scannercontainer can access the sysctls correctly.oc compliance bind -S default-auto-apply -N test profile/upstream-rhcos4-moderateEDIT: I have re-tested and
DNSPolicy: ClusterFirstWithHostNetindeed solves theno such hosterror when trying to upload toresultserver.