-
Notifications
You must be signed in to change notification settings - Fork 155
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
core/dracut/ignition-ostree: add ignition-ostree-sysusers service #774
Conversation
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This looks good to me! With this, are you able to refer to users/groups created via systemd-sysusers in your Ignition config?
overlay.d/05core/usr/lib/dracut/modules.d/40ignition-ostree/coreos-sysroot-bwrap
Show resolved
Hide resolved
@jlebon yes, although testing this right now is skewed due to the pending On a custom image without
|
2f885b7
to
a7e1233
Compare
Added a test, dropped RFC, this should be ready to merge. |
/cc @travier FYI this touches into sysusers.d topic, but should be already fitting into future reworks. |
overlay.d/05core/usr/lib/dracut/modules.d/40ignition-ostree/coreos-sysroot-bwrap
Show resolved
Hide resolved
overlay.d/05core/usr/lib/dracut/modules.d/40ignition-ostree/ignition-ostree-sysusers
Show resolved
Hide resolved
|
I don't think this will work as this would require splitting the Ignition stage that creates users/groups from the files stage to make a similar call like the one included here to create the users. This will only setup users/groups that are declared in sysusers files in the ostree commit but not included in passwd/shadow/group. |
Are you talking about the case where the Ignition config adds sysusers drop-in configs and in the same Ignition config there are files which reference those users/groups as owners? Hmm, do we really need to handle this? Ignition already provides a declarative way of creating system users/groups and it creates users/groups before creating files. |
Yes. From coreos/fedora-coreos-tracker#155, one of the option is to move to a fully sysusers defined list of users for the system for rpm-ostree & Ignition. This option could enable first boot removal among other things. |
I think we need a larger design discussion for this topic but this has not happened yet as this has not been a priority so far. But this should probably not prevent this PR from being merged. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Did it come up to have Ignition have support for this built in? It really feels like we're doing this special thing behind its back here that other Ignition users would want.
Ignition still carries code to use chroot()
for getent lookups which is a "poor-man's" containerization.
mount --bind /sysroot "${TMP_CHROOT_DIR}"/sysroot | ||
} | ||
|
||
run_chrooted_bwrap() { |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This would probably be a good thing to live in rdcore (and in theory in the future it could be a crate shared between rdcore and rpm-ostree).
Not a blocker though.
Also I agree strongly with #774 (comment) |
@cgwalters it indeed started with coreos/ignition#1153 on Ignition side but got redirected here. |
This introduces a new `coreos-sysroot-bwrap` helper in initramfs, for binaries that need to be executed with the final sysroot as a target, but before the pivot-root happens.
faba078
to
b67b155
Compare
This introduces a new `ignition-ostree-sysusers.service`, which takes care of poulating users and groups on the target sysroot before the Ignition `files` stage.
This ensure that entries in Ignition configuration can reference system users even if not present in ostree commit (e.g. `zincati).
b67b155
to
dd25144
Compare
bump |
…-context ci: remember test cluster context
This introduces a new
ignition-ostree-sysusers.service
, which takescare of poulating users and groups on the target sysroot before the
Ignition
files
stage.