diff options
| author | Kim soo <popododo0720@naver.com> | 2026-03-13 15:53:06 +0900 |
|---|---|---|
| committer | Kim soo <popododo0720@naver.com> | 2026-03-13 15:53:06 +0900 |
| commit | 364b9f418c31b93b916a2328344b737bd68856e6 (patch) | |
| tree | 8fa75ce814d2d300d98f8129e1694223c16e399b /docker | |
| parent | 761b0c0beb564d81fcbd420099ea7512e83bb789 (diff) | |
| download | kolla-364b9f418c31b93b916a2328344b737bd68856e6.tar.gz kolla-364b9f418c31b93b916a2328344b737bd68856e6.zip | |
masakari: Add crmadmin and cibadmin to monitors sudoers
The hostmonitor calls crmadmin and cibadmin with run_as_root=True,
but the sudoers file only includes crm_mon. Since the container runs
as the masakari user, sudo calls to crmadmin and cibadmin fail with
"password required", causing the hostmonitor to skip all host
monitoring every cycle.
This completely breaks automatic instance evacuation in HCI
(hyper-converged) deployments where all nodes run the full pacemaker
stack instead of pacemaker-remote. In separated deployments, the
crmadmin code path is skipped because pacemaker_remote_status=True,
which is why this bug has gone undetected.
Closes-Bug: #2144074
Change-Id: I22bbaa1f1fd1f3d53de48ec7c0099d028118448b
Signed-off-by: Kim soo <popododo0720@naver.com>
Diffstat (limited to 'docker')
| -rw-r--r-- | docker/masakari/masakari-monitors/masakari_monitors_sudoers | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/docker/masakari/masakari-monitors/masakari_monitors_sudoers b/docker/masakari/masakari-monitors/masakari_monitors_sudoers index 6cc823d78..be3867b5c 100644 --- a/docker/masakari/masakari-monitors/masakari_monitors_sudoers +++ b/docker/masakari/masakari-monitors/masakari_monitors_sudoers @@ -1,3 +1,5 @@ masakari ALL=(root) NOPASSWD: /var/lib/kolla/venv/bin/privsep-helper masakari ALL=(root) NOPASSWD: /usr/sbin/tcpdump * masakari ALL=(root) NOPASSWD: /usr/sbin/crm_mon -X +masakari ALL=(root) NOPASSWD: /usr/sbin/crmadmin * +masakari ALL=(root) NOPASSWD: /usr/sbin/cibadmin --query |