openstack-ansible-lxc_hosts/vars/ubuntu-16.04.yml
Jesse Pretorius bb2e7a08a0 Revise container DNS resolution implementation
The current LXC cache preparation copies the DNS resolver config
from the host into the container.

When the host has been setup with a DNS caching system like 'unbound'
running on it, the host's resolv.conf contains only a localhost
nameserver entry which will not work from inside the container.

The Ubuntu containers use resolvconf by default. Resolvconf gathers
the DNS settings from each interface configured and compiles
/etc/resolv.conf from the interface information. This results in
a nameserver list which will start with the LXC dnsmasq service
which runs on lxcbr0. This service uses the host's DNS configuration
for name resolution.

In effect, therefore, when the containers use the DNS service on
lxcbr0, the host does the resolution and responds to the container.
This means far less moving parts and a far more predictable
implementation for name resolution.

This patch implements the changes necessary for this strategy to
work.

Change-Id: Ib139af5221dbb1f479ca068e472cf0e8aa828a8d
2016-08-17 18:42:05 +00:00

109 lines
3.4 KiB
YAML

---
# Copyright 2016, Rackspace US, Inc.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
## APT Cache Options
cache_timeout: 600
# Required apt packages.
lxc_packages:
- apparmor
- apparmor-utils
- bridge-utils
- cgmanager
- cgroup-lite
- debootstrap
- dnsmasq
- git
- iptables
- irqbalance
- language-pack-en
- liblxc1
- lxc
- lxc-dev
- lxc-templates
- python-dev
- python3-lxc
- pxz
lxc_cache_map:
distro: ubuntu
arch: "{{ lxc_architecture_mapping.get( ansible_architecture ) }}"
release: xenial
cache_packages:
- apt-transport-https
- openssh-server
copy_from_host:
- /etc/apt/sources.list
- /etc/apt/apt.conf.d/
- /root/repo.keys
cache_prep_commands: |
if [ -a /etc/resolv.conf ]; then
mv /etc/resolv.conf /etc/resolv.conf.org
fi
echo "nameserver {{ lxc_net_address }}" > /etc/resolv.conf
apt-key add /root/repo.keys
rm /root/repo.keys
export DEBIAN_FRONTEND=noninteractive
apt-get update
apt-get install -y {{ lxc_cache_install_debconf }} {{ lxc_cache_packages | join(' ') }}
apt-get upgrade -y {{ lxc_cache_install_debconf }}
rm -f /usr/bin/python
ln -s /usr/bin/python2.7 /usr/bin/python
mkdir -p /root/.ssh
chmod 700 /root/.ssh
userdel --force --remove ubuntu || true
apt-get clean
mkdir -p /var/backup
if [ -f "/usr/lib/systemd/system/poweroff.target" ];then
ln -sf /usr/lib/systemd/system/poweroff.target /etc/systemd/system/sigpwr.target || true
fi
ln -s /dev/null /etc/systemd/system/systemd-udevd.service || true
ln -s /dev/null /etc/systemd/system/systemd-udevd-control.socket || true
ln -s /dev/null /etc/systemd/system/systemd-udevd-kernel.socket || true
ln -s /dev/null /etc/systemd/system/proc-sys-fs-binfmt_misc.automount || true
echo -e '{{ lxc_container_default_interfaces }}' | tee /etc/network/interfaces
mkdir -p /etc/network/interfaces.d
chage -I -1 -d -1 -m 0 -M 99999 -E -1 root
if [ -a /etc/resolv.conf.org ]; then
mv /etc/resolv.conf.org /etc/resolv.conf
else
rm -f /etc/resolv.conf
fi
# This forces any modified configurations to remain, and any unmodified configs to be replaced
# ref: http://serverfault.com/questions/259226/automatically-keep-current-version-of-config-files-when-apt-get-install
lxc_cache_install_debconf: '-o Dpkg::Options::="--force-confdef" -o Dpkg::Options::="--force-confold" --force-yes'
lxc_cache_packages:
- apt-transport-https
- ca-certificates
- iptables
- openssh-server
- python2.7
lxc_cached_network_interfaces:
- src: "lxc-net-bridge.cfg.j2"
dest: "/etc/network/interfaces.d/lxc-net-bridge.cfg"
lxc_container_default_interfaces: |
# The loopback network interface
auto lo
iface lo inet loopback
# LXC interface, this is ALWAYS assumed to be DHCP.
auto eth0
iface eth0 inet dhcp
# Load any additional configs
source /etc/network/interfaces.d/*.cfg