From 3fa780d98f15f0ec4bb63e50d9e7c4174c0798fc Mon Sep 17 00:00:00 2001 From: Jesse Pretorius Date: Tue, 19 Jul 2016 16:40:10 +0100 Subject: [PATCH] Move LXC AppArmor profile setting to the inventory To reduce the number of times a container is restarted during the build process, this patch moves the AA profile definition from the service playbooks to the inventory. This ensures that the profile can be applied when the container is created, rather than after the fact. This, in turn, eliminates the need to restart the container again and wait for SSH connectivity to be restored. There are additional configurations in some playbooks which will require an additional facility in the lxc_container_create role to allow something similar for container command execution. The changes to implement this will follow in another patch once that facility is available. Change-Id: I688640cf06a7ed2554210e49275cc3de10371a23 Depends-On: I4c95a231af3306c5010b168e7cc181deecf1a58d --- .../common-tasks/os-lxc-container-setup.yml | 11 ----------- .../inventory/group_vars/all_containers.yml | 19 +++++++++++++++++++ .../inventory/group_vars/cinder_volume.yml | 17 +++++++++++++++++ playbooks/inventory/group_vars/galera_all.yml | 16 +++++++++++++++- .../inventory/group_vars/neutron_agent.yml | 17 +++++++++++++++++ 5 files changed, 68 insertions(+), 12 deletions(-) create mode 100644 playbooks/inventory/group_vars/all_containers.yml create mode 100644 playbooks/inventory/group_vars/cinder_volume.yml create mode 100644 playbooks/inventory/group_vars/neutron_agent.yml diff --git a/playbooks/common-tasks/os-lxc-container-setup.yml b/playbooks/common-tasks/os-lxc-container-setup.yml index c99f909119..1c64fc5737 100644 --- a/playbooks/common-tasks/os-lxc-container-setup.yml +++ b/playbooks/common-tasks/os-lxc-container-setup.yml @@ -27,16 +27,6 @@ # If extra container configurations are desirable set the # "extra_container_config" list to strings containing the options needed. -- name: Set the LXC app-armor profile - lxc_container: - name: "{{ inventory_hostname }}" - container_config: - - "lxc.aa_profile={{ aa_profile | default('lxc-openstack') }}" - delegate_to: "{{ physical_host }}" - when: - - not is_metal | bool - register: _cp - - name: Ensure mount directories exists file: path: "{{ item['mount_path'] }}" @@ -80,7 +70,6 @@ delegate_to: "{{ physical_host }}" when: - > - (_cp is defined and _cp | changed) or (_bm is defined and _bm | changed) or (_ec is defined and _ec | changed) - not is_metal | bool diff --git a/playbooks/inventory/group_vars/all_containers.yml b/playbooks/inventory/group_vars/all_containers.yml new file mode 100644 index 0000000000..07c1fe4377 --- /dev/null +++ b/playbooks/inventory/group_vars/all_containers.yml @@ -0,0 +1,19 @@ +--- +# Copyright 2016, Rackspace US, Inc. +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +# This is the default LXC AppArmor profile +# Groups which need the unbound profile have a specific override +lxc_container_config_list: + - "lxc.aa_profile=lxc-openstack" diff --git a/playbooks/inventory/group_vars/cinder_volume.yml b/playbooks/inventory/group_vars/cinder_volume.yml new file mode 100644 index 0000000000..1533d7d9b4 --- /dev/null +++ b/playbooks/inventory/group_vars/cinder_volume.yml @@ -0,0 +1,17 @@ +--- +# Copyright 2016, Rackspace US, Inc. +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +lxc_container_config_list: + - "lxc.aa_profile=unconfined" diff --git a/playbooks/inventory/group_vars/galera_all.yml b/playbooks/inventory/group_vars/galera_all.yml index b7e5840815..978eefedfd 100644 --- a/playbooks/inventory/group_vars/galera_all.yml +++ b/playbooks/inventory/group_vars/galera_all.yml @@ -1,2 +1,16 @@ --- -galera_client_drop_config_file: true \ No newline at end of file +# Copyright 2016, Rackspace US, Inc. +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +galera_client_drop_config_file: true diff --git a/playbooks/inventory/group_vars/neutron_agent.yml b/playbooks/inventory/group_vars/neutron_agent.yml new file mode 100644 index 0000000000..1533d7d9b4 --- /dev/null +++ b/playbooks/inventory/group_vars/neutron_agent.yml @@ -0,0 +1,17 @@ +--- +# Copyright 2016, Rackspace US, Inc. +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +lxc_container_config_list: + - "lxc.aa_profile=unconfined"