d2d4b53d47
In Kolla Ansible OpenStack deployments, by default, libvirt is configured to allow read-write access via an unauthenticated, unencrypted TCP connection, using the internal API network. This is to facilitate migration between hosts. By default, Kolla Ansible does not use encryption for services on the internal network (and did not support it until Ussuri). However, most other services on the internal network are at least authenticated (usually via passwords), ensuring that they cannot be used by anyone with access to the network, unless they have credentials. The main issue here is the lack of authentication. Any client with access to the internal network is able to connect to the libvirt TCP port and make arbitrary changes to the hypervisor. This could include starting a VM, modifying an existing VM, etc. Given the flexibility of the domain options, it could be seen as equivalent to having root access to the hypervisor. Kolla Ansible supports libvirt TLS [1] since the Train release, using client and server certificates for mutual authentication and encryption. However, this feature is not enabled by default, and requires certificates to be generated for each compute host. This change adds support for libvirt SASL authentication, and enables it by default. This provides base level of security. Deployments requiring further security should use libvirt TLS. [1] https://docs.openstack.org/kolla-ansible/latest/reference/compute/libvirt-guide.html#libvirt-tls Depends-On: https://review.opendev.org/c/openstack/kolla/+/833021 Closes-Bug: #1964013 Change-Id: Ia91ceeb609e4cdb144433122b443028c0278b71e
206 lines
7.6 KiB
YAML
206 lines
7.6 KiB
YAML
---
|
|
- name: Restart nova-conductor container
|
|
vars:
|
|
service_name: "nova-conductor"
|
|
service: "{{ nova_cell_services[service_name] }}"
|
|
become: true
|
|
kolla_docker:
|
|
action: "recreate_or_restart_container"
|
|
common_options: "{{ docker_common_options }}"
|
|
name: "{{ service.container_name }}"
|
|
image: "{{ service.image }}"
|
|
privileged: "{{ service.privileged | default(False) }}"
|
|
volumes: "{{ service.volumes|reject('equalto', '')|list }}"
|
|
dimensions: "{{ service.dimensions }}"
|
|
healthcheck: "{{ service.healthcheck | default(omit) }}"
|
|
when:
|
|
- kolla_action != "config"
|
|
- kolla_action != "upgrade" or not nova_safety_upgrade | bool
|
|
|
|
- name: Restart nova-novncproxy container
|
|
vars:
|
|
service_name: "nova-novncproxy"
|
|
service: "{{ nova_cell_services[service_name] }}"
|
|
become: true
|
|
kolla_docker:
|
|
action: "recreate_or_restart_container"
|
|
common_options: "{{ docker_common_options }}"
|
|
name: "{{ service.container_name }}"
|
|
image: "{{ service.image }}"
|
|
privileged: "{{ service.privileged | default(False) }}"
|
|
volumes: "{{ service.volumes|reject('equalto', '')|list }}"
|
|
dimensions: "{{ service.dimensions }}"
|
|
healthcheck: "{{ service.healthcheck | default(omit) }}"
|
|
when:
|
|
- kolla_action != "config"
|
|
- kolla_action != "upgrade" or not nova_safety_upgrade | bool
|
|
|
|
- name: Restart nova-spicehtml5proxy container
|
|
vars:
|
|
service_name: "nova-spicehtml5proxy"
|
|
service: "{{ nova_cell_services[service_name] }}"
|
|
become: true
|
|
kolla_docker:
|
|
action: "recreate_or_restart_container"
|
|
common_options: "{{ docker_common_options }}"
|
|
name: "{{ service.container_name }}"
|
|
image: "{{ service.image }}"
|
|
privileged: "{{ service.privileged | default(False) }}"
|
|
volumes: "{{ service.volumes|reject('equalto', '')|list }}"
|
|
dimensions: "{{ service.dimensions }}"
|
|
healthcheck: "{{ service.healthcheck | default(omit) }}"
|
|
when:
|
|
- kolla_action != "config"
|
|
- kolla_action != "upgrade" or not nova_safety_upgrade | bool
|
|
|
|
- name: Restart nova-serialproxy container
|
|
vars:
|
|
service_name: "nova-serialproxy"
|
|
service: "{{ nova_cell_services[service_name] }}"
|
|
become: true
|
|
kolla_docker:
|
|
action: "recreate_or_restart_container"
|
|
common_options: "{{ docker_common_options }}"
|
|
name: "{{ service.container_name }}"
|
|
image: "{{ service.image }}"
|
|
privileged: "{{ service.privileged | default(False) }}"
|
|
volumes: "{{ service.volumes|reject('equalto', '')|list }}"
|
|
dimensions: "{{ service.dimensions }}"
|
|
healthcheck: "{{ service.healthcheck | default(omit) }}"
|
|
when:
|
|
- kolla_action != "config"
|
|
- kolla_action != "upgrade" or not nova_safety_upgrade | bool
|
|
|
|
- name: Restart nova-ssh container
|
|
vars:
|
|
service_name: "nova-ssh"
|
|
service: "{{ nova_cell_services[service_name] }}"
|
|
become: true
|
|
kolla_docker:
|
|
action: "recreate_or_restart_container"
|
|
common_options: "{{ docker_common_options }}"
|
|
name: "{{ service.container_name }}"
|
|
image: "{{ service.image }}"
|
|
pid_mode: "{{ service.pid_mode | default('') }}"
|
|
privileged: "{{ service.privileged | default(False) }}"
|
|
volumes: "{{ service.volumes|reject('equalto', '')|list }}"
|
|
dimensions: "{{ service.dimensions }}"
|
|
healthcheck: "{{ service.healthcheck | default(omit) }}"
|
|
when:
|
|
- kolla_action != "config"
|
|
|
|
- name: Restart nova-libvirt container
|
|
vars:
|
|
service_name: "nova-libvirt"
|
|
service: "{{ nova_cell_services[service_name] }}"
|
|
nova_libvirt_notify: "{{ ['Create libvirt SASL user'] if libvirt_enable_sasl | bool else [] }}"
|
|
become: true
|
|
kolla_docker:
|
|
action: "recreate_or_restart_container"
|
|
common_options: "{{ docker_common_options }}"
|
|
name: "{{ service.container_name }}"
|
|
image: "{{ service.image }}"
|
|
pid_mode: "{{ service.pid_mode | default('') }}"
|
|
cgroupns_mode: "{{ service.cgroupns_mode | default(omit) }}"
|
|
privileged: "{{ service.privileged | default(False) }}"
|
|
volumes: "{{ service.volumes|reject('equalto', '')|list }}"
|
|
dimensions: "{{ service.dimensions }}"
|
|
healthcheck: "{{ service.healthcheck | default(omit) }}"
|
|
register: restart_nova_libvirt
|
|
# NOTE(Jeffrey4l): retry 5 to remove nova_libvirt container because when
|
|
# guests running, nova_libvirt will raise error even though it is removed.
|
|
retries: 5
|
|
until: restart_nova_libvirt is success
|
|
when:
|
|
- kolla_action != "config"
|
|
notify: "{{ nova_libvirt_notify }}"
|
|
|
|
# The SASL user needs to exist in order for nova-compute to start successfully.
|
|
- name: Create libvirt SASL user
|
|
become: true
|
|
shell:
|
|
cmd: >
|
|
set -o pipefail &&
|
|
echo {{ libvirt_sasl_password }} |
|
|
docker exec -i nova_libvirt
|
|
saslpasswd2 -c -p -a libvirt {{ libvirt_sasl_authname }}
|
|
executable: /bin/bash
|
|
changed_when: true
|
|
no_log: true
|
|
|
|
- name: Restart nova-compute container
|
|
vars:
|
|
service_name: "nova-compute"
|
|
service: "{{ nova_cell_services[service_name] }}"
|
|
become: true
|
|
kolla_docker:
|
|
action: "recreate_or_restart_container"
|
|
common_options: "{{ docker_common_options }}"
|
|
name: "{{ service.container_name }}"
|
|
environment: "{{ service.environment }}"
|
|
image: "{{ service.image }}"
|
|
privileged: "{{ service.privileged | default(False) }}"
|
|
ipc_mode: "{{ service.ipc_mode }}"
|
|
volumes: "{{ service.volumes|reject('equalto', '')|list }}"
|
|
dimensions: "{{ service.dimensions }}"
|
|
healthcheck: "{{ service.healthcheck | default(omit) }}"
|
|
when:
|
|
- kolla_action != "config"
|
|
|
|
- name: Restart nova-compute-ironic container
|
|
vars:
|
|
service_name: "nova-compute-ironic"
|
|
service: "{{ nova_cell_services[service_name] }}"
|
|
become: true
|
|
kolla_docker:
|
|
action: "recreate_or_restart_container"
|
|
common_options: "{{ docker_common_options }}"
|
|
name: "{{ service.container_name }}"
|
|
image: "{{ service.image }}"
|
|
privileged: "{{ service.privileged | default(False) }}"
|
|
volumes: "{{ service.volumes|reject('equalto', '')|list }}"
|
|
dimensions: "{{ service.dimensions }}"
|
|
healthcheck: "{{ service.healthcheck | default(omit) }}"
|
|
when:
|
|
- kolla_action != "config"
|
|
|
|
# nova-compute-fake is special. It will start multi numbers of container
|
|
# so put all variables here rather than defaults/main.yml file
|
|
- name: Restart nova-compute-fake containers
|
|
become: true
|
|
kolla_docker:
|
|
action: "recreate_or_restart_container"
|
|
common_options: "{{ docker_common_options }}"
|
|
name: "nova_compute_fake_{{ item }}"
|
|
image: "{{ nova_compute_image_full }}"
|
|
privileged: True
|
|
volumes:
|
|
- "{{ node_config_directory }}/nova-compute-fake-{{ item }}/:{{ container_config_directory }}/:ro"
|
|
- "/etc/localtime:/etc/localtime:ro"
|
|
- "/lib/modules:/lib/modules:ro"
|
|
- "/run:/run:shared"
|
|
- "kolla_logs:/var/log/kolla/"
|
|
with_sequence: start=1 end={{ num_nova_fake_per_node }}
|
|
when:
|
|
- kolla_action != "config"
|
|
|
|
# NOTE(mgoddard): After upgrading nova-compute, services will have an RPC
|
|
# version cap in place. We need to restart all services that communicate with
|
|
# nova-compute in order to allow them to use the latest RPC version. Ideally,
|
|
# there would be a way to check whether all nova services are using the latest
|
|
# version, but currently there is not. Instead, wait a short time for all nova
|
|
# compute services to update the version of their service in the database.
|
|
# This seems to take around 10 seconds, but the default is 30 to allow room
|
|
# for slowness.
|
|
|
|
- name: Wait for nova-compute services to update service versions
|
|
pause:
|
|
seconds: "{{ nova_compute_startup_delay }}"
|
|
run_once: true
|
|
when:
|
|
- kolla_action == 'upgrade'
|
|
listen:
|
|
- Restart nova-compute container
|
|
- Restart nova-compute-ironic container
|
|
- Restart nova-compute-fake containers
|