Skip to content

mgr/dashboard: Make saml2 robust against module load errors#66759

Open
marcan wants to merge 1 commit intoceph:mainfrom
marcan:mgr-import-robustness
Open

mgr/dashboard: Make saml2 robust against module load errors#66759
marcan wants to merge 1 commit intoceph:mainfrom
marcan:mgr-import-robustness

Conversation

@marcan
Copy link
Contributor

@marcan marcan commented Dec 30, 2025 •
edited by tchaikov
Loading

Loading saml2 can fail due to issues with the xmlsec package (subinterpreter related):

  File "/usr/share/ceph/mgr/dashboard/controllers/saml2.py", line 6, in <module>
    from onelogin.saml2.auth import OneLogin_Saml2_Auth
  File "/lib/python3.13/site-packages/onelogin/saml2/auth.py", line 12, in <module>
    import xmlsec
xmlsec.Error: (100, 'lxml & xmlsec libxml2 library version mismatch')

Instead of taking down the entire dashboard module, treat this exception like a missing saml2 package.

Improves: https://tracker.ceph.com/issues/70411

Contribution Guidelines

  • To sign and title your commits, please refer to Submitting Patches to Ceph.

  • If you are submitting a fix for a stable branch (e.g. "quincy"), please refer to Submitting Patches to Ceph - Backports for the proper workflow.

  • When filling out the below checklist, you may click boxes directly in the GitHub web UI. When entering or editing the entire PR message in the GitHub web UI editor, you may also select a checklist item by adding an x between the brackets: [x]. Spaces and capitalization matter when checking off items this way.

Checklist

  • Tracker (select at least one)
    • References tracker ticket
    • Very recent bug; references commit where it was introduced
    • New feature (ticket optional)
    • Doc update (no ticket needed)
    • Code cleanup (no ticket needed)
  • Component impact
    • Affects Dashboard, opened tracker ticket
    • Affects Orchestrator, opened tracker ticket
    • No impact that needs to be tracked
  • Documentation (select at least one)
    • Updates relevant documentation
    • No doc update is appropriate
  • Tests (select at least one)
Show available Jenkins commands

You must only issue one Jenkins command per-comment. Jenkins does not understand
comments with more than one command.

@marcan marcan requested a review from a team as a code owner December 30, 2025 06:01
@ceph-jenkins
Copy link
Collaborator

ceph-jenkins commented Dec 30, 2025

Can one of the admins verify this patch?

14 similar comments
@ceph-jenkins
Copy link
Collaborator

ceph-jenkins commented Dec 30, 2025

Can one of the admins verify this patch?

@ceph-jenkins
Copy link
Collaborator

ceph-jenkins commented Dec 30, 2025

Can one of the admins verify this patch?

@ceph-jenkins
Copy link
Collaborator

ceph-jenkins commented Dec 30, 2025

Can one of the admins verify this patch?

@ceph-jenkins
Copy link
Collaborator

ceph-jenkins commented Dec 30, 2025

Can one of the admins verify this patch?

@ceph-jenkins
Copy link
Collaborator

ceph-jenkins commented Dec 30, 2025

Can one of the admins verify this patch?

@ceph-jenkins
Copy link
Collaborator

ceph-jenkins commented Dec 30, 2025

Can one of the admins verify this patch?

@ceph-jenkins
Copy link
Collaborator

ceph-jenkins commented Dec 30, 2025

Can one of the admins verify this patch?

@ceph-jenkins
Copy link
Collaborator

ceph-jenkins commented Dec 30, 2025

Can one of the admins verify this patch?

@ceph-jenkins
Copy link
Collaborator

ceph-jenkins commented Dec 30, 2025

Can one of the admins verify this patch?

@ceph-jenkins
Copy link
Collaborator

ceph-jenkins commented Dec 30, 2025

Can one of the admins verify this patch?

@ceph-jenkins
Copy link
Collaborator

ceph-jenkins commented Dec 30, 2025

Can one of the admins verify this patch?

@ceph-jenkins
Copy link
Collaborator

ceph-jenkins commented Dec 30, 2025

Can one of the admins verify this patch?

@ceph-jenkins
Copy link
Collaborator

ceph-jenkins commented Dec 30, 2025

Can one of the admins verify this patch?

@ceph-jenkins
Copy link
Collaborator

ceph-jenkins commented Dec 30, 2025

Can one of the admins verify this patch?

@marcan marcan force-pushed the mgr-import-robustness branch from 74f774a to cf873b3 Compare December 30, 2025 06:06
@marcan
Copy link
Contributor Author

marcan commented Dec 30, 2025

The tracker issue is https://tracker.ceph.com/issues/70411, which however was closed with CI changes that didn't actually improve anything on the Ceph side. This PR actually fixes the issue in the most reasonable way (if the saml2 package does not work, do not take down the entire dashboard).

The underlying issue is unclear and hard to debug, but seems likely to be yet another subinterpreter problem. Since saml2 support is optional, it makes sense to at least just disable saml2 for deployments which run into this.

@github-project-automation github-project-automation bot moved this from New to Reviewer approved in Ceph-Dashboard Jan 5, 2026
tchaikov
tchaikov reviewed Jan 5, 2026
View reviewed changes
@marcan marcan force-pushed the mgr-import-robustness branch from cf873b3 to af1f147 Compare January 5, 2026 05:52
@marcan
mgr/dashboard: Make saml2 robust against module load errors
133b6a2 
Loading saml2 can fail due to issues with the xmlsec package (possibly
subinterpreter related):

  File "/usr/share/ceph/mgr/dashboard/controllers/saml2.py", line 6, in <module>
    from onelogin.saml2.auth import OneLogin_Saml2_Auth
  File "/lib/python3.13/site-packages/onelogin/saml2/auth.py", line 12, in <module>
    import xmlsec
xmlsec.Error: (100, 'lxml & xmlsec libxml2 library version mismatch')

Instead of taking down the entire dashboard module, treat this exception
like a missing saml2 package.

Improves: https://tracker.ceph.com/issues/70411
Signed-off-by: Hector Martin <marcan@marcan.st>
@marcan marcan force-pushed the mgr-import-robustness branch from af1f147 to 133b6a2 Compare January 5, 2026 05:52
@marcan
Copy link
Contributor Author

marcan commented Jan 5, 2026

I've changed the commit tag to "Improves:" instead of "Fixes:", as this doesn't fix the underlying issue (which is now positively identified as subinterpreters).

tchaikov
tchaikov approved these changes Jan 10, 2026
View reviewed changes
Copy link
Contributor

@tchaikov tchaikov left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

lgtm

@tchaikov
Copy link
Contributor

tchaikov commented Jan 10, 2026

Thanks for the work on this! Once the workflows are all green, we're good to merge.
Note: The CI runs are taking longer than usual right now due to the lab migration — the Jenkins worker nodes are experiencing increased load times while consuming the workload. This should resolve once the migration is complete.

@github-actions
Copy link

github-actions bot commented Mar 11, 2026

This pull request has been automatically marked as stale because it has not had any activity for 60 days. It will be closed if no further activity occurs for another 30 days.
If you are a maintainer or core committer, please follow-up on this pull request to identify what steps should be taken by the author to move this proposed change forward.
If you are the author of this pull request, thank you for your proposed contribution. If you believe this change is still appropriate, please ensure that any feedback has been addressed and ask for a code review.

@github-actions github-actions bot added the stale label Mar 11, 2026
@marcan
Copy link
Contributor Author

marcan commented Mar 12, 2026 •
edited
Loading

Ping, not sure what happened with the workflows here?

@github-actions github-actions bot removed the stale label Mar 12, 2026
@nizamial09
Copy link
Member

nizamial09 commented Mar 13, 2026

jenkins retest this please

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@tchaikov tchaikov tchaikov approved these changes

@nizamial09 nizamial09 nizamial09 approved these changes

@aaSharma14 aaSharma14 Awaiting requested review from aaSharma14 aaSharma14 is a code owner automatically assigned from ceph/dashboard

@sagargopale2233 sagargopale2233 Awaiting requested review from sagargopale2233 sagargopale2233 is a code owner automatically assigned from ceph/dashboard

Assignees

No one assigned

Labels

dashboard pybind

Projects

Ceph-Dashboard
Status: Reviewer approved

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

4 participants

@marcan @ceph-jenkins @tchaikov @nizamial09