Merge "Remove chrony package if containerized chrony is enabled" into stable/train

ansible/roles/baremetal/defaults/main.yml

@@ -80,11 +80,13 @@ ubuntu_pkg_removals:
  - lxc
  - libvirt-bin
  - open-iscsi
+ - "{% if enable_chrony | bool %}chrony{% endif %}"
 
 redhat_pkg_removals:
  - libvirt
  - libvirt-daemon
  - iscsi-initiator-utils
+ - "{% if enable_chrony | bool %}chrony{% endif %}"
 
 # Path to a virtualenv in which to install python packages. If None, a
 # virtualenv will not be used.

ansible/roles/baremetal/tasks/post-install.yml

@@ -146,6 +146,22 @@
     - ansible_distribution == "Ubuntu"
     - apparmor_libvirtd_profile.stat.exists
 
+- name: Get stat of chronyd apparmor profile
+  stat:
+    path: /etc/apparmor.d/usr.sbin.chronyd
+  register: apparmor_chronyd_profile
+  when:
+    - ansible_os_family == "Debian"
+    - enable_chrony | bool
+
+- name: Remove apparmor profile for chrony
+  command: apparmor_parser -R /etc/apparmor.d/usr.sbin.chronyd
+  become: True
+  when:
+    - ansible_os_family == "Debian"
+    - enable_chrony | bool
+    - apparmor_chronyd_profile.stat.exists
+
 - name: Create docker group
   group:
     name: docker

releasenotes/notes/bug-1882513-chrony-permission-denied-917b3bffc5cdb38d.yaml

@@ -0,0 +1,6 @@
+---
+fixes:
+  - |
+    Removing chrony package and AppArmor profile from docker host if
+    containerized chrony is enabled.
+    `LP#1882513 <https://bugs.launchpad.net/kolla-ansible/+bug/1882513>`__