From 02faf53ea8bb672060c7cfedbc093d5cff809307 Mon Sep 17 00:00:00 2001 From: Lee Yarwood Date: Fri, 13 Dec 2019 12:01:57 +0000 Subject: [PATCH] Mount /boot from the host within the nova-compute container libguestfs expects to find /boot/vmlinuz-* for the running version of the kernel. This check is duplicated in nova-compute when libguestfs has failed to launch, providing a useful bread crumb for operators [1]. Obviously when this is called from within the nova-compute container in the context of a TripleO deployment this can easily fail after a minor update that has pulled in a newer container containing a newer kernel. This check could also fail in the opposite case if the host kernel is updated past the version present in the container. This change works around this by simply passing /boot as read-only through to the nova-compute container ensure libguestfs is able to always find the correct version of vmlinuz. This should also allow us to eventually drop the kernel RPM from the nova-compute container that has been a constant source of maintenance overhead in terms of CVEs etc. [1] https://github.com/openstack/nova/blob/aa096fd18352fb9da94069ec2cab478eed5c6cca/nova/virt/disk/vfs/guestfs.py#L75-L97 Change-Id: Iadef8f3300bb1b5b995052c1a35a1becbfd5730c (cherry picked from commit 9c5c36632d23a693a60e490b3046b07b126b9154) --- deployment/nova/nova-compute-container-puppet.yaml | 1 + 1 file changed, 1 insertion(+) diff --git a/deployment/nova/nova-compute-container-puppet.yaml b/deployment/nova/nova-compute-container-puppet.yaml index 65176650e8..30de4d93e1 100644 --- a/deployment/nova/nova-compute-container-puppet.yaml +++ b/deployment/nova/nova-compute-container-puppet.yaml @@ -794,6 +794,7 @@ outputs: - /var/lib/libvirt:/var/lib/libvirt:shared,z - /sys/class/net:/sys/class/net - /sys/bus/pci:/sys/bus/pci + - /boot:/boot:ro - # podman fails to relable if nova_nfs_enabled where we have # the nfs share mounted to /var/lib/nova/instances