Conversation
The latest versions of pyO3 (a Python binding for Rust) explicitly added a check to detect multiple imports. In subinterpreter environments, this leads to an ImportError: "PyO3 modules may only be initialized once per interpreter process" (it has been recenlty replaced with a more specific: "PyO3 modules may only be initialized once per interpreter process". This is only a workaround while the root cause is fixed (see PyO3/pyo3#4162). Fixes: https://tracker.ceph.com/issues/64213 Signed-off-by: Ernesto Puerta <[email protected]>
epuertat
requested review from
aaSharma14 and
cloudbehl
and removed request for
a team
Signed-off-by: Nizamudeen A <[email protected]>
|
@epuertat: when I tested this locally (both with ceph-dev and cephadm), it went successfully for me with the login and also the secure monitoring stack feature as well. Only problem I faced was some typos which I fixed here... Update: I just realized that I also need to test this on an evironment where pyo3 issues are present so will give it a go again... |
|
This pull request has been automatically marked as stale because it has not had any activity for 60 days. It will be closed if no further activity occurs for another 30 days. |
|
I can also confirm this fixes the issue on opensuse tumbleweed. Apparently something must have changed in the distro recently (my suspicion is on some library) that was making running the mgr modules impossible due to pyO3. Applying the patches on this PR made the mgr a happy panda again. |
@jecluis have you actively operated the Dashboard and/or Cephadm? Part of this change simply shifts the |
|
jenkins retest this please |
Not in this context, no. I should have mentioned it "fixed it" in the sense that now the ceph-mgr's modules don't bail out because of PyO3, and it's feasible to bring up a vstart cluster -- especially because the MDSs no longer refuse to work. But that's a good shout. I'll try a cephadm deployment at some point this week to validate it. |
Thank you! 🙏🏼😅 |
|
Hello, any news on that ? |
|
up ?! |
…ng code from ceph#57926. Tests were failing because of the hardcoded password hashes. This highlights how diffrent in spec the hashlib generated passwords are from bcrypt. 7: self = <dashboard.tests.test_access_control.AccessControlTest testMethod=test_set_user_password_hash> 7: 7: def test_set_user_password_hash(self): 7: user_orig = self.test_create_user() 7: user = self.exec_cmd('ac-user-set-password-hash', username='admin', 7: inbuf='b2/rDt2y9glTPSV.VFegiLkQeIpddtkhoFetNApYmIJOY8gau2') 7: pass_hash = calculate_password_hash('newpass', user['password']) 7: > self.assertDictEqual(user, { 7: 'username': 'admin', 7: 'password': pass_hash, 7: 'pwdExpirationDate': None, 7: 'pwdUpdateRequired': False, 7: 'name': 'admin User', 7: 'email': '[email protected]', 7: 'lastUpdate': user['lastUpdate'], 7: 'roles': [], 7: 'enabled': True 7: }) 7: E AssertionError: {'use[25 chars]d': 'b2/rDt2y9glTPSV.VFegiLkQeIpddtk[176 chars]alse} != {'use[25 chars]d': '2b12Pt3Vq/rDt2y9glTPSVVFegiLkQeIpddtkhoKb[240 chars]True } 7: E {'email': '[email protected]', 7: E 'enabled': True, 7: E 'lastUpdate': 1732135247, 7: E 'name': 'admin User', 7: E - 'password': 'b2/rDt2y9glTPSV.VFegiLkQeIpddtkhoFetNApYmIJOY8gau2', 7: E + 'password': '2b12Pt3Vq/rDt2y9glTPSVVFegiLkQeIpddtkhoKbMQHMtDsOzPCTNwvPBoY+1xJX0kHZKblZeVcAOjeIh+pweEf0J8o1obBujPFb7NORgpy8pfl5GuSzJEum1NE', 7: E 'pwdExpirationDate': None, 7: E 'pwdUpdateRequired': False, 7: E 'roles': [], 7: E 'username': 'admin'} Signed-off-by: Paulo E. Castro <[email protected]>
…ng code from ceph#57926. Tests were failing because of the hardcoded password hashes. This highlights how diffrent in spec the hashlib generated passwords are from bcrypt. 7: self = <dashboard.tests.test_access_control.AccessControlTest testMethod=test_set_user_password_hash> 7: 7: def test_set_user_password_hash(self): 7: user_orig = self.test_create_user() 7: user = self.exec_cmd('ac-user-set-password-hash', username='admin', 7: inbuf='b2/rDt2y9glTPSV.VFegiLkQeIpddtkhoFetNApYmIJOY8gau2') 7: pass_hash = calculate_password_hash('newpass', user['password']) 7: > self.assertDictEqual(user, { 7: 'username': 'admin', 7: 'password': pass_hash, 7: 'pwdExpirationDate': None, 7: 'pwdUpdateRequired': False, 7: 'name': 'admin User', 7: 'email': '[email protected]', 7: 'lastUpdate': user['lastUpdate'], 7: 'roles': [], 7: 'enabled': True 7: }) 7: E AssertionError: {'use[25 chars]d': 'b2/rDt2y9glTPSV.VFegiLkQeIpddtk[176 chars]alse} != {'use[25 chars]d': '2b12Pt3Vq/rDt2y9glTPSVVFegiLkQeIpddtkhoKb[240 chars]True } 7: E {'email': '[email protected]', 7: E 'enabled': True, 7: E 'lastUpdate': 1732135247, 7: E 'name': 'admin User', 7: E - 'password': 'b2/rDt2y9glTPSV.VFegiLkQeIpddtkhoFetNApYmIJOY8gau2', 7: E + 'password': '2b12Pt3Vq/rDt2y9glTPSVVFegiLkQeIpddtkhoKbMQHMtDsOzPCTNwvPBoY+1xJX0kHZKblZeVcAOjeIh+pweEf0J8o1obBujPFb7NORgpy8pfl5GuSzJEum1NE', 7: E 'pwdExpirationDate': None, 7: E 'pwdUpdateRequired': False, 7: E 'roles': [], 7: E 'username': 'admin'} Signed-off-by: Paulo E. Castro <[email protected]>
…ng code from ceph#57926. Tests were failing because of the hardcoded password hashes. This highlights how different in spec the hashlib generated passwords are from bcrypt. 7: self = <dashboard.tests.test_access_control.AccessControlTest testMethod=test_set_user_password_hash> 7: 7: def test_set_user_password_hash(self): 7: user_orig = self.test_create_user() 7: user = self.exec_cmd('ac-user-set-password-hash', username='admin', 7: inbuf='b2/rDt2y9glTPSV.VFegiLkQeIpddtkhoFetNApYmIJOY8gau2') 7: pass_hash = calculate_password_hash('newpass', user['password']) 7: > self.assertDictEqual(user, { 7: 'username': 'admin', 7: 'password': pass_hash, 7: 'pwdExpirationDate': None, 7: 'pwdUpdateRequired': False, 7: 'name': 'admin User', 7: 'email': '[email protected]', 7: 'lastUpdate': user['lastUpdate'], 7: 'roles': [], 7: 'enabled': True 7: }) 7: E AssertionError: {'use[25 chars]d': 'b2/rDt2y9glTPSV.VFegiLkQeIpddtk[176 chars]alse} != {'use[25 chars]d': '2b12Pt3Vq/rDt2y9glTPSVVFegiLkQeIpddtkhoKb[240 chars]True } 7: E {'email': '[email protected]', 7: E 'enabled': True, 7: E 'lastUpdate': 1732135247, 7: E 'name': 'admin User', 7: E - 'password': 'b2/rDt2y9glTPSV.VFegiLkQeIpddtkhoFetNApYmIJOY8gau2', 7: E + 'password': '2b12Pt3Vq/rDt2y9glTPSVVFegiLkQeIpddtkhoKbMQHMtDsOzPCTNwvPBoY+1xJX0kHZKblZeVcAOjeIh+pweEf0J8o1obBujPFb7NORgpy8pfl5GuSzJEum1NE', 7: E 'pwdExpirationDate': None, 7: E 'pwdUpdateRequired': False, 7: E 'roles': [], 7: E 'username': 'admin'} Signed-off-by: Paulo E. Castro <[email protected]>
…ng code from ceph#57926. Tests were failing because of the hardcoded password hashes. This highlights how different in spec the hashlib generated passwords are from bcrypt. 7: self = <dashboard.tests.test_access_control.AccessControlTest testMethod=test_set_user_password_hash> 7: 7: def test_set_user_password_hash(self): 7: user_orig = self.test_create_user() 7: user = self.exec_cmd('ac-user-set-password-hash', username='admin', 7: inbuf='b2/rDt2y9glTPSV.VFegiLkQeIpddtkhoFetNApYmIJOY8gau2') 7: pass_hash = calculate_password_hash('newpass', user['password']) 7: > self.assertDictEqual(user, { 7: 'username': 'admin', 7: 'password': pass_hash, 7: 'pwdExpirationDate': None, 7: 'pwdUpdateRequired': False, 7: 'name': 'admin User', 7: 'email': '[email protected]', 7: 'lastUpdate': user['lastUpdate'], 7: 'roles': [], 7: 'enabled': True 7: }) 7: E AssertionError: {'use[25 chars]d': 'b2/rDt2y9glTPSV.VFegiLkQeIpddtk[176 chars]alse} != {'use[25 chars]d': '2b12Pt3Vq/rDt2y9glTPSVVFegiLkQeIpddtkhoKb[240 chars]True } 7: E {'email': '[email protected]', 7: E 'enabled': True, 7: E 'lastUpdate': 1732135247, 7: E 'name': 'admin User', 7: E - 'password': 'b2/rDt2y9glTPSV.VFegiLkQeIpddtkhoFetNApYmIJOY8gau2', 7: E + 'password': '2b12Pt3Vq/rDt2y9glTPSVVFegiLkQeIpddtkhoKbMQHMtDsOzPCTNwvPBoY+1xJX0kHZKblZeVcAOjeIh+pweEf0J8o1obBujPFb7NORgpy8pfl5GuSzJEum1NE', 7: E 'pwdExpirationDate': None, 7: E 'pwdUpdateRequired': False, 7: E 'roles': [], 7: E 'username': 'admin'} Signed-off-by: Paulo E. Castro <[email protected]>
…ng code from ceph#57926. Tests were failing because of the hardcoded password hashes. This highlights how different in spec the hashlib generated passwords are from bcrypt. 7: self = <dashboard.tests.test_access_control.AccessControlTest testMethod=test_set_user_password_hash> 7: 7: def test_set_user_password_hash(self): 7: user_orig = self.test_create_user() 7: user = self.exec_cmd('ac-user-set-password-hash', username='admin', 7: inbuf='b2/rDt2y9glTPSV.VFegiLkQeIpddtkhoFetNApYmIJOY8gau2') 7: pass_hash = calculate_password_hash('newpass', user['password']) 7: > self.assertDictEqual(user, { 7: 'username': 'admin', 7: 'password': pass_hash, 7: 'pwdExpirationDate': None, 7: 'pwdUpdateRequired': False, 7: 'name': 'admin User', 7: 'email': '[email protected]', 7: 'lastUpdate': user['lastUpdate'], 7: 'roles': [], 7: 'enabled': True 7: }) 7: E AssertionError: {'use[25 chars]d': 'b2/rDt2y9glTPSV.VFegiLkQeIpddtk[176 chars]alse} != {'use[25 chars]d': '2b12Pt3Vq/rDt2y9glTPSVVFegiLkQeIpddtkhoKb[240 chars]True } 7: E {'email': '[email protected]', 7: E 'enabled': True, 7: E 'lastUpdate': 1732135247, 7: E 'name': 'admin User', 7: E - 'password': 'b2/rDt2y9glTPSV.VFegiLkQeIpddtkhoFetNApYmIJOY8gau2', 7: E + 'password': '2b12Pt3Vq/rDt2y9glTPSVVFegiLkQeIpddtkhoKbMQHMtDsOzPCTNwvPBoY+1xJX0kHZKblZeVcAOjeIh+pweEf0J8o1obBujPFb7NORgpy8pfl5GuSzJEum1NE', 7: E 'pwdExpirationDate': None, 7: E 'pwdUpdateRequired': False, 7: E 'roles': [], 7: E 'username': 'admin'} Signed-off-by: Paulo E. Castro <[email protected]>
…ng code from ceph#57926. Tests were failing because of the hardcoded password hashes. This highlights how different in spec the hashlib generated passwords are from bcrypt. 7: self = <dashboard.tests.test_access_control.AccessControlTest testMethod=test_set_user_password_hash> 7: 7: def test_set_user_password_hash(self): 7: user_orig = self.test_create_user() 7: user = self.exec_cmd('ac-user-set-password-hash', username='admin', 7: inbuf='b2/rDt2y9glTPSV.VFegiLkQeIpddtkhoFetNApYmIJOY8gau2') 7: pass_hash = calculate_password_hash('newpass', user['password']) 7: > self.assertDictEqual(user, { 7: 'username': 'admin', 7: 'password': pass_hash, 7: 'pwdExpirationDate': None, 7: 'pwdUpdateRequired': False, 7: 'name': 'admin User', 7: 'email': '[email protected]', 7: 'lastUpdate': user['lastUpdate'], 7: 'roles': [], 7: 'enabled': True 7: }) 7: E AssertionError: {'use[25 chars]d': 'b2/rDt2y9glTPSV.VFegiLkQeIpddtk[176 chars]alse} != {'use[25 chars]d': '2b12Pt3Vq/rDt2y9glTPSVVFegiLkQeIpddtkhoKb[240 chars]True } 7: E {'email': '[email protected]', 7: E 'enabled': True, 7: E 'lastUpdate': 1732135247, 7: E 'name': 'admin User', 7: E - 'password': 'b2/rDt2y9glTPSV.VFegiLkQeIpddtkhoFetNApYmIJOY8gau2', 7: E + 'password': '2b12Pt3Vq/rDt2y9glTPSVVFegiLkQeIpddtkhoKbMQHMtDsOzPCTNwvPBoY+1xJX0kHZKblZeVcAOjeIh+pweEf0J8o1obBujPFb7NORgpy8pfl5GuSzJEum1NE', 7: E 'pwdExpirationDate': None, 7: E 'pwdUpdateRequired': False, 7: E 'roles': [], 7: E 'username': 'admin'} Signed-off-by: Paulo E. Castro <[email protected]>
…ng code from ceph#57926. Tests were failing because of the hardcoded password hashes. This highlights how different in spec the hashlib generated passwords are from bcrypt. 7: self = <dashboard.tests.test_access_control.AccessControlTest testMethod=test_set_user_password_hash> 7: 7: def test_set_user_password_hash(self): 7: user_orig = self.test_create_user() 7: user = self.exec_cmd('ac-user-set-password-hash', username='admin', 7: inbuf='b2/rDt2y9glTPSV.VFegiLkQeIpddtkhoFetNApYmIJOY8gau2') 7: pass_hash = calculate_password_hash('newpass', user['password']) 7: > self.assertDictEqual(user, { 7: 'username': 'admin', 7: 'password': pass_hash, 7: 'pwdExpirationDate': None, 7: 'pwdUpdateRequired': False, 7: 'name': 'admin User', 7: 'email': '[email protected]', 7: 'lastUpdate': user['lastUpdate'], 7: 'roles': [], 7: 'enabled': True 7: }) 7: E AssertionError: {'use[25 chars]d': 'b2/rDt2y9glTPSV.VFegiLkQeIpddtk[176 chars]alse} != {'use[25 chars]d': '2b12Pt3Vq/rDt2y9glTPSVVFegiLkQeIpddtkhoKb[240 chars]True } 7: E {'email': '[email protected]', 7: E 'enabled': True, 7: E 'lastUpdate': 1732135247, 7: E 'name': 'admin User', 7: E - 'password': 'b2/rDt2y9glTPSV.VFegiLkQeIpddtkhoFetNApYmIJOY8gau2', 7: E + 'password': '2b12Pt3Vq/rDt2y9glTPSVVFegiLkQeIpddtkhoKbMQHMtDsOzPCTNwvPBoY+1xJX0kHZKblZeVcAOjeIh+pweEf0J8o1obBujPFb7NORgpy8pfl5GuSzJEum1NE', 7: E 'pwdExpirationDate': None, 7: E 'pwdUpdateRequired': False, 7: E 'roles': [], 7: E 'username': 'admin'} Signed-off-by: Paulo E. Castro <[email protected]>
|
hello! Is there any updates? |
|
This pull request has been automatically marked as stale because it has not had any activity for 60 days. It will be closed if no further activity occurs for another 30 days. |
|
Hello |
|
This pull request has been automatically marked as stale because it has not had any activity for 60 days. It will be closed if no further activity occurs for another 30 days. |
|
Hello |
|
This pull request has been automatically marked as stale because it has not had any activity for 60 days. It will be closed if no further activity occurs for another 30 days. |
|
This pull request can no longer be automatically merged: a rebase is needed and changes have to be manually resolved |
|
This pull request has been automatically marked as stale because it has not had any activity for 60 days. It will be closed if no further activity occurs for another 30 days. |
|
This pull request has been automatically closed because there has been no activity for 90 days. Please feel free to reopen this pull request (or open a new one) if the proposed change is still appropriate. Thank you for your contribution! |
5 participants
Caution
This change will require to refresh Dashboard user hashes. If we decide to go with this, a new CLI command should be provided to perform that task
Context
The latest versions of pyO3 (a Python binding for Rust) explicitly added a check to detect multiple imports. In subinterpreter environments, this leads to an ImportError: "PyO3 modules may only be initialized once per interpreter process" (it has been recenlty replaced with a more specific: "PyO3 modules do not yet support subinterpreters, see PyO3/pyo3#576").
Description
This is only a workaround while the root cause is fixed (see PyO3/pyo3#4162):
hashlib'sscrypt(which doesn't rely oncryptographylib, or any other std lib that importspyO3), instead ofbcrypt.password_hash()helper method frommgr_util.pyis still used bycephadmfor generating bcrypt hashes (required to generate Prometheus or Alertmanager password hashes).Fixes: https://tracker.ceph.com/issues/64213
Status
After solving
bcryptissues, I'm now facing issues withcryptographylibrary:Contribution Guidelines
To sign and title your commits, please refer to Submitting Patches to Ceph.
If you are submitting a fix for a stable branch (e.g. "quincy"), please refer to Submitting Patches to Ceph - Backports for the proper workflow.
When filling out the below checklist, you may click boxes directly in the GitHub web UI. When entering or editing the entire PR message in the GitHub web UI editor, you may also select a checklist item by adding an
xbetween the brackets:[x]. Spaces and capitalization matter when checking off items this way.Checklist
Show available Jenkins commands
jenkins retest this pleasejenkins test classic perfjenkins test crimson perfjenkins test signedjenkins test make checkjenkins test make check arm64jenkins test submodulesjenkins test dashboardjenkins test dashboard cephadmjenkins test apijenkins test docsjenkins render docsjenkins test ceph-volume alljenkins test ceph-volume toxjenkins test windowsjenkins test rook e2e