From 364b9f418c31b93b916a2328344b737bd68856e6 Mon Sep 17 00:00:00 2001 From: Kim soo Date: Fri, 13 Mar 2026 15:53:06 +0900 Subject: masakari: Add crmadmin and cibadmin to monitors sudoers The hostmonitor calls crmadmin and cibadmin with run_as_root=True, but the sudoers file only includes crm_mon. Since the container runs as the masakari user, sudo calls to crmadmin and cibadmin fail with "password required", causing the hostmonitor to skip all host monitoring every cycle. This completely breaks automatic instance evacuation in HCI (hyper-converged) deployments where all nodes run the full pacemaker stack instead of pacemaker-remote. In separated deployments, the crmadmin code path is skipped because pacemaker_remote_status=True, which is why this bug has gone undetected. Closes-Bug: #2144074 Change-Id: I22bbaa1f1fd1f3d53de48ec7c0099d028118448b Signed-off-by: Kim soo --- docker/masakari/masakari-monitors/masakari_monitors_sudoers | 2 ++ 1 file changed, 2 insertions(+) diff --git a/docker/masakari/masakari-monitors/masakari_monitors_sudoers b/docker/masakari/masakari-monitors/masakari_monitors_sudoers index 6cc823d78..be3867b5c 100644 --- a/docker/masakari/masakari-monitors/masakari_monitors_sudoers +++ b/docker/masakari/masakari-monitors/masakari_monitors_sudoers @@ -1,3 +1,5 @@ masakari ALL=(root) NOPASSWD: /var/lib/kolla/venv/bin/privsep-helper masakari ALL=(root) NOPASSWD: /usr/sbin/tcpdump * masakari ALL=(root) NOPASSWD: /usr/sbin/crm_mon -X +masakari ALL=(root) NOPASSWD: /usr/sbin/crmadmin * +masakari ALL=(root) NOPASSWD: /usr/sbin/cibadmin --query -- cgit v1.2.3