Repository: openshift/openshift-ansible

Issue #9150: `openshift_node` role fails to complete if SELinux is disabled
Created: 2018-07-11T12:13:25Z
Description
If OpenShift Origin is deployed with SELinux disabled on bare-metal machines, openshift_node will fail during setting up a sebool value.
It's easy to fix by skipping all SELinux tasks when it's disabled. For instance:
- name: Setting sebool container_manage_cgroup
  seboolean:
    name: container_manage_cgroup
    state: yes
    persistent: yes
  # add the following lines to skip the task if we do not need it
  when:
  - ansible_selinux
  - ansible_selinux.status == 'enabled'

I can create a pull request to address that in other places as well.
Version
ansible 2.6.0
  config file = None
  configured module search path = [u'/root/.ansible/plugins/modules', u'/usr/share/ansible/plugins/modules']
  ansible python module location = /usr/lib/python2.7/site-packages/ansible
  executable location = /usr/bin/ansible
  python version = 2.7.5 (default, Apr 11 2018, 07:36:10) [GCC 4.8.5 20150623 (Red Hat 4.8.5-28)]

Git version:
openshift-ansible-3.9.32-1-65-gf1255dbd5

Steps To Reproduce

Disable SELinux
Run the deploy_cluster.yml playbook:

$ ansible-playbook --diff -vv -i ${INVENTORY} openshift-ansible/playbooks/deploy_cluster.yml

Expected Results
Since we've disabled SELinux, all tasks regarding SELinux should be skipped:
TASK [openshift_node : Setting sebool container_manage_cgroup] *****************
task path: /root/openshift-ansible/roles/openshift_node/tasks/main.yml:59
skipping: [kube-node01] => {"changed": false, "skip_reason": "Conditional result was False"}
skipping: [kube-node02] => {"changed": false, "skip_reason": "Conditional result was False"}
skipping: [kube-node03] => {"changed": false, "skip_reason": "Conditional result was False"}
skipping: [kube-node04] => {"changed": false, "skip_reason": "Conditional result was False"}
skipping: [kube-master01] => {"changed": false, "skip_reason": "Conditional result was False"}

Observed Results
Since SELinux is disabled, sebool fails to complete:
TASK [openshift_node : Setting sebool container_manage_cgroup] *****************
task path: /root/openshift-ansible/roles/openshift_node/tasks/main.yml:59
fatal: [kube-node02]: FAILED! => {"changed": false, "msg": "SELinux is disabled on this host."}
fatal: [kube-node03]: FAILED! => {"changed": false, "msg": "SELinux is disabled on this host."}
fatal: [kube-node04]: FAILED! => {"changed": false, "msg": "SELinux is disabled on this host."}
fatal: [kube-node01]: FAILED! => {"changed": false, "msg": "SELinux is disabled on this host."}
fatal: [kube-master01]: FAILED! => {"changed": false, "msg": "SELinux is disabled on this host."}

Additional Information

OS version: RHEL CentOS 7.4

Duplicate issue #9767: SELinux is disabled
Created: 2018-08-26T11:48:58Z
Description
On (presumably) any install, the prerequisites script does not take into account whether SELinux is enabled, causing a failure during deploy_cluster.yml.
Version
ansible 2.6.3
  config file = /var/www/openshift-ansible/ansible.cfg
  configured module search path = ['/home/bart/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules']
  ansible python module location = /usr/local/lib/python3.5/dist-packages/ansible
  executable location = /usr/local/bin/ansible
  python version = 3.5.2 (default, Nov 23 2017, 16:37:01) [GCC 5.4.0 20160609]

openshift-ansible-3.10.35-1-9-g2e49741

Steps To Reproduce

Boot CentOS 7.5 base image
Run prerequisites.yml playbook
Run deploy_cluster.yml playbook

Expected Results
I expected the playbook to warn me about any invalid settings in the prerequisites check, so that deploy_cluster goes off without a hitch.
Observed Results
TASK [openshift_node : Setting sebool container_manage_cgroup] *****************************************************
Sunday 26 August 2018  20:39:39 +0900 (0:00:01.984)       0:05:38.773 *********
fatal: [console.cluster.serial-experiments.com]: FAILED! => {"changed": false, "msg": "SELinux is disabled on this host."}

Closing comment (2018-08-29T17:41:36Z): This may in fact be a duplicate of #9150 however that issue was closed without remediating the underlying cause. I cloned https://github.com/openshift/openshift-ansible on Aug 28 (after this jira was closed) and got the same error as reported both here and in #9150.
I would think that adding this check to the prerequisites playbook would be the solution to this issue. The fact that this is a prerequisite is quite clearly called out here: https://docs.openshift.com/container-platform/3.9/install_config/install/prerequisites.html#hardware
Why is this requirement not encoded in the prerequisites playbook?