Skip to content

Commit

Permalink
Updates the container build process
Browse files Browse the repository at this point in the history 
The container build process needs to make sure that the service
sources are correctly setup and updated prior to running any other
playbooks.

The modification here is nessisary to break out the process for the
proxy create, apt sources deployment, the update of those sources
and keys, container upgrades and the installation of python2.7 for
use with Ansible. This also allows for better debugging of a failure
in container create as we'll now be able to tell where in the process
a failure happens and be able to use tags to resolve it.

Change-Id: I36be437303a73bbc98a1cd5297f6c65591653cd7
Closes-Bug: 1464771
  • Loading branch information
@cloudnull
cloudnull committed Jun 15, 2015
1 parent e6da43a commit 86b6e8e
Showing 1 changed file with 149 additions and 47 deletions.
196 changes: 149 additions & 47 deletions playbooks/roles/lxc_container_create/tasks/container_create.yml
View file
Expand Up @@ -62,60 +62,88 @@
vg_name: "{{ properties.container_vg_name|default(lxc_container_vg_name) }}"
template_options: "{{ lxc_container_template_options }}"
container_command: |
{% if global_environment_variables is defined %}
{%- for name, value in global_environment_variables.items() %}
{% if value %}
if ! grep '{{ name }}={{ value }}' /etc/environment;
echo '{{ name }}={{ value }}' | tee -a /etc/environment
fi
{% endif %}
{%- endfor %}
{% endif %}
mkdir -p ~/.ssh/
if [ ! -f "~/.ssh/authorized_keys" ];then
touch ~/.ssh/authorized_keys
fi
grep '{{ lxc_container_ssh_key }}' ~/.ssh/authorized_keys || echo '{{ lxc_container_ssh_key }}' | tee -a ~/.ssh/authorized_keys
# Create internal directories
mkdir -p /etc/network/interfaces.d
mkdir -p /var/backup
sed -i 's/PermitRootLogin.*/PermitRootLogin\ yes/g' /etc/ssh/sshd_config
service ssh restart
# Configure defined apt-repos
rm /etc/apt/sources.list
echo '# Do not edit this file. Add new sources to /etc/apt/sources.list.d/' | tee /etc/apt/sources.list
echo 'deb {{ lxc_container_template_main_apt_repo }} {{ lxc_container_release }} main restricted universe multiverse' | tee -a /etc/apt/sources.list
echo 'deb {{ lxc_container_template_main_apt_repo }} {{ lxc_container_release }}-updates main restricted universe multiverse' | tee -a /etc/apt/sources.list
echo 'deb {{ lxc_container_template_main_apt_repo }} {{ lxc_container_release }}-backports main restricted universe multiverse' | tee -a /etc/apt/sources.list
echo 'deb {{ lxc_container_template_security_apt_repo }} {{ lxc_container_release }}-security main restricted universe multiverse' | tee -a /etc/apt/sources.list
while timeout 120 apt-get update && apt-get -y install python2.7; [ $? = 124 ]; do
sleep 5
done
rm /usr/bin/python
ln -s /usr/bin/python2.7 /usr/bin/python
echo -e '{{ lxc_container_default_interfaces }}' | tee /etc/network/interfaces
delegate_to: "{{ physical_host }}"
tags:
- lxc-container-create

- name: Load container service mounts and profile
lxc_container:
name: "{{ inventory_hostname }}"
container_command: |
mkdir -p /var/backup
mkdir -p /var/log/{{ properties.service_name }}
container_config:
- "lxc.aa_profile=lxc-openstack"
- "lxc.mount.entry=/openstack/backup/{{ inventory_hostname }} var/backup none defaults,bind,rw 0 0"
- "lxc.mount.entry=/openstack/log/{{ inventory_hostname }} var/log/{{ properties.service_name }} none defaults,bind,rw 0 0"
- "lxc.aa_profile=lxc-openstack"
when: properties.service_name is defined
delegate_to: "{{ physical_host }}"
tags:
- lxc-container-create
- lxc-container-service-config

- name: Force container user password set
- name: Setup basic container ssh
lxc_container:
name: "{{ inventory_hostname }}"
container_command: >
getent passwd "{{ lxc_container_user_name }}" &&
echo "{{ lxc_container_user_name }}:{{ lxc_container_user_password }}" | chpasswd
container_command: |
# Enable root ssh login
if grep -q "^PermitRootLogin" /etc/ssh/sshd_config;then
sed -i 's/PermitRootLogin.*/PermitRootLogin\ yes/g' /etc/ssh/sshd_config
else
echo 'PermitRootLogin yes' | tee -a /etc/ssh/sshd_config
fi
# Disable ssh password auth
if grep -q "^PasswordAuthentication" /etc/ssh/sshd_config;then
sed -i 's/PasswordAuthentication.*/PasswordAuthentication\ no/g' /etc/ssh/sshd_config
else
echo 'PasswordAuthentication no' | tee -a /etc/ssh/sshd_config
fi
# Disable UseDNS in ssh
if grep -q "^UseDNS" /etc/ssh/sshd_config;then
sed -i 's/UseDNS.*/UseDNS\ no/g' /etc/ssh/sshd_config
else
echo 'UseDNS no' | tee -a /etc/ssh/sshd_config
fi
# Disable x11 forwarding in ssh
if grep -q "^X11Forwarding" /etc/ssh/sshd_config;then
sed -i 's/X11Forwarding.*/X11Forwarding\ no/g' /etc/ssh/sshd_config
else
echo 'X11Forwarding no' | tee -a /etc/ssh/sshd_config
fi
# Enable tcp keepalive in ssh
if grep -q "^TCPKeepAlive" /etc/ssh/sshd_config;then
sed -i 's/TCPKeepAlive.*/TCPKeepAlive\ yes/g' /etc/ssh/sshd_config
else
echo 'TCPKeepAlive yes' | tee -a /etc/ssh/sshd_config
fi
service ssh restart
with_dict: container_networks
delegate_to: "{{ physical_host }}"
tags:
- lxc-container-user-password-regen
- lxc-container-ssh-config

- name: Create ssh key entry
lxc_container:
name: "{{ inventory_hostname }}"
container_command: |
mkdir -p ~/.ssh/
if [ ! -f "~/.ssh/authorized_keys" ];then
touch ~/.ssh/authorized_keys
fi
grep '{{ lxc_container_ssh_key }}' ~/.ssh/authorized_keys || echo '{{ lxc_container_ssh_key }}' | tee -a ~/.ssh/authorized_keys
with_dict: container_networks
delegate_to: "{{ physical_host }}"
tags:
- lxc-container-key

- name: Container network interfaces
lxc_container:
name: "{{ inventory_hostname }}"
container_command: |
echo -e '{{ lxc_container_interface }}' | tee /etc/network/interfaces.d/{{ item.value.interface }}.cfg
if [ ! -d "/etc/network/interfaces.d" ];then
mkdir -p /etc/network/interfaces.d
fi
echo -e '{{ lxc_container_interface }}' | tee /etc/network/interfaces.d/{{ item.value.interface }}.cfg
with_dict: container_networks
delegate_to: "{{ physical_host }}"
tags:
Expand All @@ -135,7 +163,7 @@
tags:
- lxc-container-networks

- name: Container network configs
- name: Container network includes
lineinfile:
dest: "/var/lib/lxc/{{ inventory_hostname }}/config"
line: "lxc.include = /var/lib/lxc/{{ inventory_hostname }}/{{ item.value.interface }}.ini"
Expand All @@ -149,15 +177,89 @@
tags:
- lxc-container-networks

- name: Create container service directories
# Flush the handlers to ensure the container and networking is online.
- meta: flush_handlers

# Resets the container user's password using lxc_container because Python2.7
# may not be installed at this point.
- name: Force container user password set
lxc_container:
name: "{{ inventory_hostname }}"
container_command: |
mkdir -p '/var/log/{{ properties.service_name }}'
mkdir -p '/etc/{{ properties.service_name }}'
container_config:
- "lxc.mount.entry=/openstack/log/{{ inventory_hostname }} var/log/{{ properties.service_name }} none defaults,bind,rw 0 0"
when: properties.service_name is defined
getent passwd "{{ lxc_container_user_name }}" &&
echo "{{ lxc_container_user_name }}:{{ lxc_container_user_password }}" | chpasswd
delegate_to: "{{ physical_host }}"
no_log: True
tags:
- lxc-container-user-password-regen

# Setup proxy configs, this is done here to ensure that we have our container proxy setup
# prior to running online commands. This is using lxc_container because python2.7 may not be
# installed at this point.
- name: Run proxy config
lxc_container:
name: "{{ inventory_hostname }}"
container_command: |
if ! grep '{{ item.key }}={{ item.value }}' /etc/environment; then
echo '{{ item.key }}={{ item.value }}' | tee -a /etc/environment
fi
with_dict: global_environment_variables | default({})
when: global_environment_variables is defined
delegate_to: "{{ physical_host }}"
tags:
- lxc-container-proxy

# Uses lxc_container because the repos need to be available before python2.7 is installed
# and python2.7 may not be installed at this point.
- name: Create main apt repos
lxc_container:
name: "{{ inventory_hostname }}"
container_command: |
# Configure defined apt-repos
rm /etc/apt/sources.list
echo '# Sources created by the ansible' | tee /etc/apt/sources.list
echo 'deb {{ lxc_container_template_main_apt_repo }} {{ lxc_container_release }} main restricted universe multiverse' | tee -a /etc/apt/sources.list
echo 'deb {{ lxc_container_template_main_apt_repo }} {{ lxc_container_release }}-updates main restricted universe multiverse' | tee -a /etc/apt/sources.list
echo 'deb {{ lxc_container_template_main_apt_repo }} {{ lxc_container_release }}-backports main restricted universe multiverse' | tee -a /etc/apt/sources.list
echo 'deb {{ lxc_container_template_security_apt_repo }} {{ lxc_container_release }}-security main restricted universe multiverse' | tee -a /etc/apt/sources.list
for i in {1..3};do
timeout 60 sh -c "/usr/bin/apt-get update && /usr/bin/apt-key update"
if [ "$?" == 0 ];then
break
else
if [ ! "$i" == "3" ];then
echo "Failure to update on attempt $i retrying..."
/usr/bin/apt-get clean
sleep 2
else
echo 'Failed to update'
exit 99
fi
fi
done
delegate_to: "{{ physical_host }}"
tags:
- lxc-container-sources

# Update the container and ensure that its all patched. This is using lxc_container
# because python2.7 may not be installed at this point.
- name: Ensure container is updated
lxc_container:
name: "{{ inventory_hostname }}"
container_command: |
apt-get -y upgrade
delegate_to: "{{ physical_host }}"
tags:
- lxc-container-upgrade

# Uses lxc_container because python2.7 may not be installed within the container at this point.
- name: Ensure python is installed and is default 2.7
lxc_container:
name: "{{ inventory_hostname }}"
container_command: |
apt-get -y install python2.7
rm /usr/bin/python
ln -s /usr/bin/python2.7 /usr/bin/python
delegate_to: "{{ physical_host }}"
tags:
- lxc-container-service-dirs
- lxc-container-python

0 comments on commit 86b6e8e

Please sign in to comment.