services.setup: Pull Grafana image from docker.io

[allisonkarlitskaya]

Bitnami recently stopped publishing their images on quay.io after
becoming a verified publisher on Dockerhub.

Verified publishers are not subject to rate limitations, allowing us to
pull their Grafana the image from docker.io now.

bitnami-labs/sealed-secrets#822 (comment)

• image-refresh services

[cockpituous]

image-refresh in progress on 1-ci-srv-02.
Log: https://logs.cockpit-project.org/logs/image-refresh-3388-20220517-093838/

[cockpituous]

image-refresh services done: https://github.com/cockpit-project/bots/commits/image-refresh-services-20220517-102222

[cockpituous]

image-refresh in progress on 4-ci-srv-03.
Log: https://logs.cockpit-project.org/logs/image-refresh-3388-20220517-102222/

[allisonkarlitskaya]

image-refresh in progress on 4-ci-srv-03. Log: https://logs.cockpit-project.org/logs/image-refresh-3388-20220517-102222/

Silly bot. No cookie.

[cockpituous]

image-refresh services done: https://github.com/cockpit-project/bots/commits/image-refresh-services-20220517-111414

[martinpitt]

Nice, thanks! I'm glad that there's some way out of the pull limits again. Apparently it doesn't like the new FreeIPA, but that's an independent problem.

[cockpituous]

image-refresh in progress on 1-ci-srv-06.
Log: https://logs.cockpit-project.org/logs/image-refresh-3388-20220517-121515/

[cockpituous]

image-refresh services done: https://github.com/cockpit-project/bots/commits/image-refresh-services-20220517-131111

[SilviaMiranda]

LGTM, minus one tiny thing :)

[SilviaMiranda]

-ie is actually creating a backup. Would you consider changing it to -i?

[allisonkarlitskaya]

Thanks for the catch. Updated.

[cockpituous]

image-refresh in progress on 3-ci-srv-05.
Log: https://logs.cockpit-project.org/logs/image-refresh-3388-20220517-155252/

[cockpituous]

image-refresh services done: https://github.com/cockpit-project/bots/commits/image-refresh-services-20220517-163737

[mvollmer]

Without properly labeled files, we need to switch off SELinux entirely.

[allisonkarlitskaya]

I feel like it shouldn't be necessary. The logic here is that we need to relabel the first time we run it because the empty directory should have the correct label. After that, everything in that directory will have been created by the container itself and shouldn't need relabelling.

At the same time

• this is the services image
• this is a workaround for a known bug in the image
• we have better things to work on

So 👍 to disabling selinux to deal with this.

[mvollmer]

The logic here is that we need to relabel the first time we run it because the empty directory should have the correct label.

I have no idea how podman works, but doesn't it need to relabel the inside of a container every time a new one is created?

[cockpituous]

image-refresh in progress on 2-cockpit-9.
Log: https://logs.cockpit-project.org/logs/image-refresh-3388-20220523-121313/

[cockpituous]

Task failed: https://logs.cockpit-project.org/logs/image-refresh-3388-20220523-121313/

[cockpituous]

image-refresh in progress on 4-ci-srv-05.
Log: https://logs.cockpit-project.org/logs/image-refresh-3388-20220523-121616/

[cockpituous]

Task failed: https://logs.cockpit-project.org/logs/image-refresh-3388-20220523-121616/

[cockpituous]

image-refresh in progress on 1-ci-srv-02.
Log: https://logs.cockpit-project.org/logs/image-refresh-3388-20220523-122121/

[cockpituous]

image-refresh services done: https://github.com/cockpit-project/bots/commits/image-refresh-services-20220523-131010

[martinpitt]

Cheers!

[martinpitt]

This is both ugly and error prone, and also not even necessary any more with disabling SELinux below. I suggest to simply drop the :Z where it writes the script above, and drop this.

[martinpitt]

Ah, you want to drop this again at some point when this is fixed, I see.

[mvollmer]

also not even necessary any more with disabling SELinux below.

It is, unfortunately. podman crashes regardless of whether SELinux is enabled or not.

[martinpitt]

FTR, 👍 from me. This has fooled us too many times, and it's completely irrelevant to what we want to test.

[mvollmer]

Hmm, this is meant to be a "temporary" workaround, and hopefully we can just remove these two lines once the fix to #173 has reached us.

[martinpitt]

Thanks!