OCPBUGS-52161: imageutil: unset PAXRecords and Xattrs in image layers when applying to disk

[joelanford]

Fixes https://issues.redhat.com/browse/OCPBUGS-52161

TL;DR: a cert-manager-operator bundle image contains files that we fail to write to disk because they include xattr "security.capability" that our controller's user apparently cannot write.

This is fixable by simply unsetting xattrs and PAXRecords from the tar header so that we don't actually try to set those attributes on the file we create on disk.

This is not reproducible upstream, even with the exact same bundle image (registry.redhat.io/cert-manager/cert-manager-operator-bundle@sha256:9a212e5a65ec7a71b4462539902515cfeecf5b02fd8a3f3beaaa6c5ecfc49ec2)

Upstream PR: operator-framework/operator-controller#1823

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: joelanford

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• DOWNSTREAM_OWNERS [joelanford]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[joelanford]

/hold

Need to see if this actually solves the problem.

[joelanford]

Manifest to reproduce:

---
apiVersion: v1
kind: Namespace
metadata:
  name: cert-manager-operator
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: cert-manager-operator-installer
  namespace: cert-manager-operator
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: cert-manager-operator-installer
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cluster-admin
subjects:
- kind: ServiceAccount
  name: cert-manager-operator-installer
  namespace: cert-manager-operator
---
apiVersion: olm.operatorframework.io/v1
kind: ClusterExtension
metadata:
  name: cert-manager-operator
spec:
  namespace: cert-manager-operator
  serviceAccount:
    name: cert-manager-operator-installer
  source:
    catalog:
      channels:
      - stable-v1
      packageName: openshift-cert-manager-operator
      upgradeConstraintPolicy: CatalogProvided
      version: 1.15.0
    sourceType: Catalog

[openshift-ci-robot]

@joelanford: This pull request references Jira Issue OCPBUGS-52161, which is valid. The bug has been moved to the POST state.

3 validation(s) were run on this bug

• bug is open, matching expected state (open)
• bug target version (4.19.0) matches configured target version for branch (4.19.0)
• bug is in the state New, which is one of the valid states (NEW, ASSIGNED, POST)

No GitHub users were found matching the public email listed for the QA contact in Jira ([email protected]), skipping review request.

The bug has been updated to refer to the pull request using the external bug tracker.

In response to this:

Fixes https://issues.redhat.com/browse/OCPBUGS-52161

TL;DR: a cert-manager-operator bundle image contains files that we fail to write to disk because they include xattr "security.capability" that our controller's user apparently cannot write.

This is fixable by simply unsetting xattrs and PAXRecords from the tar header so that we don't actually try to set those attributes on the file we create on disk.

This is not reproducible upstream, even with the exact same bundle image (registry.redhat.io/cert-manager/cert-manager-operator-bundle@sha256:9a212e5a65ec7a71b4462539902515cfeecf5b02fd8a3f3beaaa6c5ecfc49ec2)

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-ci-robot]

@joelanford: This pull request references Jira Issue OCPBUGS-52161, which is valid.

3 validation(s) were run on this bug

• bug is open, matching expected state (open)
• bug target version (4.19.0) matches configured target version for branch (4.19.0)
• bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, POST)

No GitHub users were found matching the public email listed for the QA contact in Jira ([email protected]), skipping review request.

In response to this:

Fixes https://issues.redhat.com/browse/OCPBUGS-52161

TL;DR: a cert-manager-operator bundle image contains files that we fail to write to disk because they include xattr "security.capability" that our controller's user apparently cannot write.

This is fixable by simply unsetting xattrs and PAXRecords from the tar header so that we don't actually try to set those attributes on the file we create on disk.

This is not reproducible upstream, even with the exact same bundle image (registry.redhat.io/cert-manager/cert-manager-operator-bundle@sha256:9a212e5a65ec7a71b4462539902515cfeecf5b02fd8a3f3beaaa6c5ecfc49ec2)

Upstream PR: operator-framework/operator-controller#1823

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[joelanford]

/hold cancel

I confirmed that this does fix the bug.

[openshift-ci]

@joelanford: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/okd-scos-e2e-aws-ovn	d491dce	link	false	/test okd-scos-e2e-aws-ovn

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[camilamacedo86]

We will sync it from upstream, right?
Do we need to get this one merged or let the sync?
Did you make it here to test?

[jianzhangbjz]

Test pass, details: https://issues.redhat.com/browse/OCPBUGS-52161

[jianzhangbjz]

/label qe-approved

[jianzhangbjz]

/lgtm

[openshift-ci-robot]

@joelanford: Jira Issue OCPBUGS-52161: All pull requests linked via external trackers have merged:

• openshift/operator-framework-operator-controller#280

Jira Issue OCPBUGS-52161 has been moved to the MODIFIED state.

In response to this:

Fixes https://issues.redhat.com/browse/OCPBUGS-52161

TL;DR: a cert-manager-operator bundle image contains files that we fail to write to disk because they include xattr "security.capability" that our controller's user apparently cannot write.

This is fixable by simply unsetting xattrs and PAXRecords from the tar header so that we don't actually try to set those attributes on the file we create on disk.

This is not reproducible upstream, even with the exact same bundle image (registry.redhat.io/cert-manager/cert-manager-operator-bundle@sha256:9a212e5a65ec7a71b4462539902515cfeecf5b02fd8a3f3beaaa6c5ecfc49ec2)

Upstream PR: operator-framework/operator-controller#1823

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-bot]

[ART PR BUILD NOTIFIER]

Distgit: ose-olm-catalogd
This PR has been included in build ose-olm-catalogd-container-v4.19.0-202502280938.p0.gd33af18.assembly.stream.el9.
All builds following this will include this PR.

[openshift-bot]

[ART PR BUILD NOTIFIER]

Distgit: ose-olm-operator-controller
This PR has been included in build ose-olm-operator-controller-container-v4.19.0-202502280938.p0.gd33af18.assembly.stream.el9.
All builds following this will include this PR.

[joelanford]

/cherry-pick release-4.18

[openshift-cherrypick-robot]

@joelanford: #280 failed to apply on top of branch "release-4.18":

Applying: UPSTREAM: <drop>: util/image: unset PAXRecords and Xattrs when applying files
Using index info to reconstruct a base tree...
A	internal/shared/util/image/filters.go
A	internal/shared/util/image/filters_test.go
Falling back to patching base and 3-way merge...
CONFLICT (modify/delete): internal/shared/util/image/filters_test.go deleted in HEAD and modified in UPSTREAM: <drop>: util/image: unset PAXRecords and Xattrs when applying files. Version UPSTREAM: <drop>: util/image: unset PAXRecords and Xattrs when applying files of internal/shared/util/image/filters_test.go left in tree.
CONFLICT (modify/delete): internal/shared/util/image/filters.go deleted in HEAD and modified in UPSTREAM: <drop>: util/image: unset PAXRecords and Xattrs when applying files. Version UPSTREAM: <drop>: util/image: unset PAXRecords and Xattrs when applying files of internal/shared/util/image/filters.go left in tree.
error: Failed to merge in the changes.
hint: Use 'git am --show-current-patch=diff' to see the failed patch
hint: When you have resolved this problem, run "git am --continue".
hint: If you prefer to skip this patch, run "git am --skip" instead.
hint: To restore the original branch and stop patching, run "git am --abort".
hint: Disable this message with "git config advice.mergeConflict false"
Patch failed at 0001 UPSTREAM: <drop>: util/image: unset PAXRecords and Xattrs when applying files

In response to this:

/cherry-pick release-4.18

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.