)]}'
{"deployment/ironic/ironic-pxe-container-puppet.yaml":[{"author":{"_account_id":4571,"name":"Steve Baker","email":"sbaker@redhat.com","username":"steve-stevebaker"},"change_message_id":"841f54abeb1716196706ff470f7eeaec6afcfe3d","unresolved":true,"context_lines":[{"line_number":124,"context_line":"            image: \u0026ironic_pxe_image {get_param: ContainerIronicPxeImage}"},{"line_number":125,"context_line":"            command: [\u0027/bin/bash\u0027, \u0027-c\u0027, \u0027BIND_HOST\u003d$(hiera ironic::pxe::tftp_bind_host -c /etc/puppet/hiera.yaml); /usr/sbin/dnsmasq --keep-in-foreground --user\u003droot --listen-address\u003d$BIND_HOST --port\u003d0 --enable-tftp --tftp-root\u003d/var/lib/ironic/tftpboot\u0027]"},{"line_number":126,"context_line":"            net: host"},{"line_number":127,"context_line":"            privileged: true"},{"line_number":128,"context_line":"            restart: always"},{"line_number":129,"context_line":"            healthcheck:"},{"line_number":130,"context_line":"              test: /openstack/healthcheck"}],"source_content_type":"text/x-yaml","patch_set":5,"id":"b5b0d463_6882f5d2","line":127,"updated":"2021-08-30 21:24:57.000000000","message":"Could this container be given the required capabilities via `cap_add:` instead of going full privileged?","commit_id":"db50ccda2b089c1e9f2a242ba824c7d4ea519935"},{"author":{"_account_id":11655,"name":"Julia Kreger","email":"juliaashleykreger@gmail.com","username":"jkreger","status":"Flying to the moon with a Jetpack!"},"change_message_id":"54e28f402ad2e6801a016f2f0a1cb92d7a7f0731","unresolved":true,"context_lines":[{"line_number":124,"context_line":"            image: \u0026ironic_pxe_image {get_param: ContainerIronicPxeImage}"},{"line_number":125,"context_line":"            command: [\u0027/bin/bash\u0027, \u0027-c\u0027, \u0027BIND_HOST\u003d$(hiera ironic::pxe::tftp_bind_host -c /etc/puppet/hiera.yaml); /usr/sbin/dnsmasq --keep-in-foreground --user\u003droot --listen-address\u003d$BIND_HOST --port\u003d0 --enable-tftp --tftp-root\u003d/var/lib/ironic/tftpboot\u0027]"},{"line_number":126,"context_line":"            net: host"},{"line_number":127,"context_line":"            privileged: true"},{"line_number":128,"context_line":"            restart: always"},{"line_number":129,"context_line":"            healthcheck:"},{"line_number":130,"context_line":"              test: /openstack/healthcheck"}],"source_content_type":"text/x-yaml","patch_set":5,"id":"5da2b61d_b81713d5","line":127,"in_reply_to":"b5b0d463_6882f5d2","updated":"2021-08-31 13:39:23.000000000","message":"The dnsmasq process launches and attempts to manage the capabilities it has access to before dropping. I\u0027m unsure if it is all or nothing, but some forum posts suggest all or nothing. At a minimum, We might be able to away with CAP_NET_ADMIN CAP_NET_RAW CAP_SETUID [0], but it seems pre-fork it interacts with the kernel management facility for capability management, and if it operationally needs anything else that should fail.\n\nAlso, Metal3 gave up on this path and just started setting the container to privileged so it would launch without headaches.\n\n[0]: https://github.com/imp/dnsmasq/blob/4e7694d7107d2299f4aaededf8917fceb5dfb924/src/dnsmasq.c#L608","commit_id":"db50ccda2b089c1e9f2a242ba824c7d4ea519935"},{"author":{"_account_id":4571,"name":"Steve Baker","email":"sbaker@redhat.com","username":"steve-stevebaker"},"change_message_id":"841f54abeb1716196706ff470f7eeaec6afcfe3d","unresolved":true,"context_lines":[{"line_number":142,"context_line":"            start_order: 91"},{"line_number":143,"context_line":"            image: *ironic_pxe_image"},{"line_number":144,"context_line":"            net: host"},{"line_number":145,"context_line":"            privileged: true"},{"line_number":146,"context_line":"            security_opt:"},{"line_number":147,"context_line":"              - label\u003ddisable"},{"line_number":148,"context_line":"            restart: always"}],"source_content_type":"text/x-yaml","patch_set":5,"id":"5f0e9b33_01c7f19e","line":145,"updated":"2021-08-30 21:24:57.000000000","message":"Why does this need to switch to privileged?","commit_id":"db50ccda2b089c1e9f2a242ba824c7d4ea519935"},{"author":{"_account_id":11655,"name":"Julia Kreger","email":"juliaashleykreger@gmail.com","username":"jkreger","status":"Flying to the moon with a Jetpack!"},"change_message_id":"54e28f402ad2e6801a016f2f0a1cb92d7a7f0731","unresolved":true,"context_lines":[{"line_number":142,"context_line":"            start_order: 91"},{"line_number":143,"context_line":"            image: *ironic_pxe_image"},{"line_number":144,"context_line":"            net: host"},{"line_number":145,"context_line":"            privileged: true"},{"line_number":146,"context_line":"            security_opt:"},{"line_number":147,"context_line":"              - label\u003ddisable"},{"line_number":148,"context_line":"            restart: always"}],"source_content_type":"text/x-yaml","patch_set":5,"id":"89fc3c22_5c621085","line":145,"in_reply_to":"5f0e9b33_01c7f19e","updated":"2021-08-31 13:39:23.000000000","message":"Umm, this... doesn\u0027t. Odd.","commit_id":"db50ccda2b089c1e9f2a242ba824c7d4ea519935"},{"author":{"_account_id":24245,"name":"Harald Jensås","email":"hjensas@redhat.com","username":"harald.jensas"},"change_message_id":"50c5c38e94bcf0770724963c5268e45b7ac08622","unresolved":true,"context_lines":[{"line_number":122,"context_line":"          ironic_pxe_tftp:"},{"line_number":123,"context_line":"            start_order: 90"},{"line_number":124,"context_line":"            image: \u0026ironic_pxe_image {get_param: ContainerIronicPxeImage}"},{"line_number":125,"context_line":"            command: [\u0027/bin/bash\u0027, \u0027-c\u0027, \u0027BIND_HOST\u003d$(hiera ironic::pxe::tftp_bind_host -c /etc/puppet/hiera.yaml); /usr/sbin/dnsmasq --keep-in-foreground --user\u003droot --listen-address\u003d$BIND_HOST --port\u003d0 --enable-tftp --tftp-root\u003d/var/lib/ironic/tftpboot\u0027]"},{"line_number":126,"context_line":"            net: host"},{"line_number":127,"context_line":"            cap_add:"},{"line_number":128,"context_line":"              - NET_ADMIN"}],"source_content_type":"text/x-yaml","patch_set":6,"id":"1285d08d_a72650fa","line":125,"updated":"2021-09-04 10:28:16.000000000","message":"I think we should add --conf-file\u003d/dev/null to ensure dnsmasq does not end up reading a default configuration file. To avoid issues like below.\n\n[root@server ~]# cat /etc/dnsmasq.conf\nlog-dhcp\nport\u003d0\n\ndhcp-host\u003d00:84:ed:01:00:10,tag:dhcpv6,client.localdomain,[2001::20],[2001::21],[2001::22],[2001::23]\ndhcp-range\u003dset:range0,2001::10,2001::100,64,10m\ndhcp-sequential-ip\n# dhcpv6s for Client System Architecture Type (61)\ndhcp-match\u003dset:efi6,option6:61,0007\ndhcp-match\u003dset:efi6,option6:61,0009\ndhcp-match\u003dset:efi6,option6:61,0011\ndhcp-option\u003dtag:efi6,option6:bootfile-url,tftp://[2001::2]/shimx64.efi\n\n\n[root@server ~]# dnsmasq -k --port\u003d0 --enable-tftp --tftp-root\u003d/var/lib/tftpboot/\n\ndnsmasq: failed to bind DHCPv6 server socket: Address already in use","commit_id":"037ce1e2b65d9786323235b722b5ef0770cabe86"},{"author":{"_account_id":6926,"name":"Bogdan Dobrelya","email":"bdobreli@redhat.com","username":"bogdando"},"change_message_id":"f2097f0d147aff80d0ad54cf914d153eb0b91e89","unresolved":true,"context_lines":[{"line_number":122,"context_line":"          ironic_pxe_tftp:"},{"line_number":123,"context_line":"            start_order: 90"},{"line_number":124,"context_line":"            image: \u0026ironic_pxe_image {get_param: ContainerIronicPxeImage}"},{"line_number":125,"context_line":"            command: [\u0027/bin/bash\u0027, \u0027-c\u0027, \u0027BIND_HOST\u003d$(hiera ironic::pxe::tftp_bind_host -c /etc/puppet/hiera.yaml); /usr/sbin/dnsmasq --keep-in-foreground --user\u003droot --listen-address\u003d$BIND_HOST --port\u003d0 --enable-tftp --tftp-root\u003d/var/lib/ironic/tftpboot\u0027]"},{"line_number":126,"context_line":"            net: host"},{"line_number":127,"context_line":"            cap_add:"},{"line_number":128,"context_line":"              - NET_ADMIN"}],"source_content_type":"text/x-yaml","patch_set":6,"id":"5464f0b7_adbf8a1c","line":125,"in_reply_to":"1285d08d_a72650fa","updated":"2021-09-09 15:50:15.000000000","message":"good point!","commit_id":"037ce1e2b65d9786323235b722b5ef0770cabe86"},{"author":{"_account_id":4571,"name":"Steve Baker","email":"sbaker@redhat.com","username":"steve-stevebaker"},"change_message_id":"99c4f547f435f1d359f440dd0f77897076e60abc","unresolved":true,"context_lines":[{"line_number":122,"context_line":"          ironic_pxe_tftp:"},{"line_number":123,"context_line":"            start_order: 90"},{"line_number":124,"context_line":"            image: \u0026ironic_pxe_image {get_param: ContainerIronicPxeImage}"},{"line_number":125,"context_line":"            command: [\u0027/bin/bash\u0027, \u0027-c\u0027, \u0027BIND_HOST\u003d$(hiera ironic::pxe::tftp_bind_host -c /etc/puppet/hiera.yaml); /usr/sbin/dnsmasq --keep-in-foreground --user\u003droot --conf-file\u003d/dev/null --listen-address\u003d$BIND_HOST --port\u003d0 --enable-tftp --tftp-root\u003d/var/lib/ironic/tftpboot\u0027]"},{"line_number":126,"context_line":"            net: host"},{"line_number":127,"context_line":"            cap_add:"},{"line_number":128,"context_line":"              - NET_ADMIN"}],"source_content_type":"text/x-yaml","patch_set":7,"id":"31b2741c_d0b82e2d","line":125,"updated":"2021-09-14 02:07:53.000000000","message":"I find tftp logs to be useful, especially as a first indication that your node is alive and can reach the controller.\n\nCan this log to a file like the inspector dnsmasq[1], so the following:\n\n  --log-facility\u003d/var/log/ironic/dnsmasq.log\n\nwill result in a log file available on the undercloud at /var/log/containers/ironic/dnsmasq.log\n\n[1] https://opendev.org/openstack/tripleo-heat-templates/src/branch/master/deployment/ironic/ironic-inspector-container-puppet.yaml#L432","commit_id":"b1c3989f0303f5b045f97532e7ff93b4aa87f2d2"},{"author":{"_account_id":11655,"name":"Julia Kreger","email":"juliaashleykreger@gmail.com","username":"jkreger","status":"Flying to the moon with a Jetpack!"},"change_message_id":"ca08f647e0b3b8ee6ea48ab84401335f307c8783","unresolved":true,"context_lines":[{"line_number":122,"context_line":"          ironic_pxe_tftp:"},{"line_number":123,"context_line":"            start_order: 90"},{"line_number":124,"context_line":"            image: \u0026ironic_pxe_image {get_param: ContainerIronicPxeImage}"},{"line_number":125,"context_line":"            command: [\u0027/bin/bash\u0027, \u0027-c\u0027, \u0027BIND_HOST\u003d$(hiera ironic::pxe::tftp_bind_host -c /etc/puppet/hiera.yaml); /usr/sbin/dnsmasq --keep-in-foreground --user\u003droot --conf-file\u003d/dev/null --listen-address\u003d$BIND_HOST --port\u003d0 --enable-tftp --tftp-root\u003d/var/lib/ironic/tftpboot\u0027]"},{"line_number":126,"context_line":"            net: host"},{"line_number":127,"context_line":"            cap_add:"},{"line_number":128,"context_line":"              - NET_ADMIN"}],"source_content_type":"text/x-yaml","patch_set":7,"id":"c460755e_57d0945e","line":125,"in_reply_to":"31b2741c_d0b82e2d","updated":"2021-09-14 19:15:15.000000000","message":"Reasonable to me.","commit_id":"b1c3989f0303f5b045f97532e7ff93b4aa87f2d2"}]}