Re: [atomic-devel] De-duping vagrant work by adding a new one: cgwalters/vagrant-atomic-cluster

2015-04-15 Thread Eric Paris
On Wed, 2015-04-15 at 07:51 -0400, Matt Micene wrote: > Eparis and I had some discussions on how to merge the two repos > (kubernetes-ansible and ansible-atomic), mainly boiling down to where > to merge. > > Decision was made to go upstream with it and the merging set is under > the contrib dir he

Re: [atomic-devel] systemd.unit files and atomic upgrade.

2015-05-21 Thread Eric Paris
On Thu, 2015-05-21 at 16:07 -0400, Tim St Clair wrote: > Hey Folks - > >We recently upgraded our cluster 7.1.0->7.1.1->7.1.2 and we > uncovered that our systemd.unit files did not hold across upgrades. > > Is/was this a known issue? You mean the files in /usr/lib/systemd/system changed?

Re: [atomic-devel] systemd.unit files and atomic upgrade.

2015-05-21 Thread Eric Paris
hing in /etc/systemd/system and then /etc/systemd/system gets put in place after? -Eric > - Original Message ----- > > From: "Eric Paris" > > To: "Tim St Clair" > > Cc: atomic-devel@projectatomic.io > > Sent: Thursday, May 21, 2015 3:08:28 PM &g

Re: [atomic-devel] systemd.unit files and atomic upgrade.

2015-05-22 Thread Eric Paris
On Fri, 2015-05-22 at 10:06 -0400, Robert Rati wrote: > I've reproduced this issue pretty easily. We have symlinks in > /etc/systemd/system that point to common unit files on an NFS share. > The unit files in the NFS share are usable and functioning on 7.1.0. > Then I do: > > ostree remote add

Re: [atomic-devel] [PATCH] manifest: Add iptables-services

2015-07-06 Thread Eric Paris
On Mon, 2015-07-06 at 12:53 -0400, Colin Walters wrote: > Currently, firewalld is the default for Fedora. However, both Docker > and Kubernetes do not yet know how to talk to it. Work is underway > on > that, but in the meantime, iptables-services is an absolutely tiny > package, and the cost of

Re: [atomic-devel] kubernetes pod can't access secret volume due to avc

2015-07-17 Thread Eric Paris
Sadly, no, the only step you missed was disabling SELinux. https://github.com/GoogleCloudPlatform/kubernetes/issues/2630 Is where Paul is tracking his work around these problems. On Fri, 2015-07-17 at 09:50 +0200, Tobias Florek wrote: > Hi, > > using the following atomic host version I can't ac

[atomic-devel] Ansible on atomic-host

2015-07-27 Thread Eric Paris
So I haven't dug into this, might be wasting people's time, but upstream kube ansible has some 'pre-ansible' tasks to get Rawhide boxes functional with ansible [1]. The bare minimum appears (related to atomic) to be python2 and libselinux-python. I know we added python2 by hand, just want to ask t

Re: [atomic-devel] [PATCH] Re: Fedora atomic host 23 and ansible

2015-10-21 Thread Eric Paris
On Wed, 2015-10-21 at 16:06 -0400, Colin Walters wrote: > On Wed, Oct 21, 2015, at 04:05 PM, Colin Walters wrote: > > > Python 2 is explicitly installed, but the question is how far up > > the stack > > we go. > > Specifically a topical question is `python-docker-py` which is used > by the Ansibl

Re: [atomic-devel] Parallel installing 1.9 and 1.10

2016-03-28 Thread Eric Paris
On Mon, 2016-03-28 at 09:27 -0400, Colin Walters wrote: > Hi, > > In some of my use cases I have OpenShift/Kubernetes clusters that are > primarily certified on 1.9, and so I'd like to keep using that.  But > it'd be useful to be able to quickly try out 1.10 on some of my > nodes, or in cases outs

Re: [atomic-devel] Parallel installing 1.9 and 1.10

2016-03-28 Thread Eric Paris
On Mon, 2016-03-28 at 10:54 -0400, Daniel J Walsh wrote: > Well a couple of points, we are currently blocked from pushing  > docker-1.10 into fedora 23, because > it will break k8s, and it looks like we could have the same problem > when  > we go to ship docker-1.10 > into rhel in May.If we sh

Re: [atomic-devel] can fedora atomic 23 be upgraded to 24

2016-06-22 Thread Eric Paris
It would make sense if rpm-ostreed ran as non init_t and if that type have MAC_ADMIN. Not much we that can be done to fix it now, but we could fix policy for 24->25... -Eric On Wed, 2016-06-22 at 10:56 -0400, Micah Abbott wrote: > On 06/22/2016 09:34 AM, Muayyad AlSadi wrote: > > now, it gave me

Re: [atomic-devel] Fedora 2wk Atomic Blocker Bugs

2017-01-17 Thread Eric Paris
On Tue, 2017-01-17 at 13:42 -0500, Dusty Mabe wrote: > There are a few bugs that are blocking 2wk release. > > - one with the kernel that causes kube dns to not work > * https://bugzilla.redhat.com/show_bug.cgi?id=1414068 > - one with kube that causes selinux breakage > * https://bugzilla.

Re: [atomic-devel] Has anyone considered packaging dumb-init or tini for use in Fedora/CentOS/RHEL?

2017-03-06 Thread Eric Paris
On Mon, 2017-03-06 at 21:22 -0500, Clayton Coleman wrote: > They'd be really helpful for cases where you don't want full blown > systemd, but want a long running container that needs to reap > processes.  I don't know that one or the other matters, I have a > slight bias for dumb-init in terms of s

Re: [atomic-devel] firewalld in atomic host

2017-04-25 Thread Eric Paris
I question if we need firewalld in atomic. It could be a regular container. Or a system container if we need it running before docker. No? Not sure who to ask to look at actually doing it. But yes, I think everyone who has software doing automated updating of iptables rules wants something like f