When installing an OKD cluster, some nodes do not come up. It turns out they do not have a node name because the afterburn service does not run. It errors out due to selinux denials:
[core@ip-10-0-29-129 ~]$ systemctl status afterburn.service
× afterburn.service - Afterburn (Metadata)
Loaded: loaded (/usr/lib/systemd/system/afterburn.service; disabled; preset: disabled)
Active: failed (Result: exit-code) since Thu 2024-07-18 06:32:31 UTC; 11h ago
Docs: https://coreos.github.io/afterburn/usage/attributes/
Main PID: 879 (code=exited, status=1/FAILURE)
CPU: 42ms
Jul 18 06:32:30 localhost afterburn[879]: Jul 18 06:32:30.747 INFO Putting http://169.254.169.254/latest/api/token: Attempt #1
Jul 18 06:32:31 ip-10-0-29-129 afterburn[879]: Jul 18 06:32:31.765 INFO Putting http://169.254.169.254/latest/api/token: Attempt #2
Jul 18 06:32:31 ip-10-0-29-129 afterburn[879]: Error: failed to run
Jul 18 06:32:31 ip-10-0-29-129 afterburn[879]: Caused by:
Jul 18 06:32:31 ip-10-0-29-129 afterburn[879]: 0: writing metadata attributes
Jul 18 06:32:31 ip-10-0-29-129 afterburn[879]: 1: failed to create directory "/run/metadata"
Jul 18 06:32:31 ip-10-0-29-129 afterburn[879]: 2: Permission denied (os error 13)
Jul 18 06:32:31 ip-10-0-29-129 systemd[1]: afterburn.service: Main process exited, code=exited, status=1/FAILURE
Jul 18 06:32:31 ip-10-0-29-129 systemd[1]: afterburn.service: Failed with result 'exit-code'.
Jul 18 06:32:31 ip-10-0-29-129 systemd[1]: Failed to start Afterburn (Metadata).
When installing an OKD cluster, some nodes do not come up. It turns out they do not have a node name because the afterburn service does not run. It errors out due to selinux denials:
Also, the denials in the audit logs:
This has started happening after https://github.com/openshift/os/pull/1552 where we had to use selinux version
selinux-policy-38.1.36-1.el9
asselinux-policy-38.1.36-1.el9
is not available anymore (https://github.com/openshift/os/issues/1514).