openstack
/
tripleo-heat-templates
Code Issues Proposed changes

Revert "Drop the SELinux flags for openvswitch /var/run directory" 

This reverts commit af80a0d914.

Reason: the added SELinux rule actually allows openvswitch to write in
container_file_t - not the contrary. We therefore still need the ":z" flag.
A possible follow-up would be to drop the "shared" flag (useless) and
remove the duplicated mount.

Change-Id: Idc8813792b5c6d4d4226491f81de2965beeaadbe
This commit is contained in:
Cédric Jeanneret (Tengu) 2019-11-26 12:26:45 +00:00 committed by Cédric Jeanneret
parent fa3140a723
commit 1ce103186d
5 changed files with 10 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
deployment/neutron/neutron-dhcp-container-puppet.yaml
View File

@ -364,7 +364,7 @@ outputs:
- /var/lib/kolla/config_files/neutron_dhcp.json:/var/lib/kolla/config_files/config.json:ro
- /var/lib/config-data/puppet-generated/neutron/:/var/lib/kolla/config_files/src:ro
- /lib/modules:/lib/modules:ro
- /run/openvswitch:/run/openvswitch
- /run/openvswitch:/run/openvswitch:shared,z
- /var/lib/neutron:/var/lib/neutron:shared,z
- /run/netns:/run/netns:shared
- /var/lib/neutron/kill_scripts:/etc/neutron/kill_scripts:shared,z

2
deployment/neutron/neutron-l3-container-puppet.yaml
View File

@ -322,7 +322,7 @@ outputs:
- /var/lib/kolla/config_files/neutron_l3_agent.json:/var/lib/kolla/config_files/config.json:ro
- /var/lib/config-data/puppet-generated/neutron/:/var/lib/kolla/config_files/src:ro
- /lib/modules:/lib/modules:ro
- /run/openvswitch:/run/openvswitch
- /run/openvswitch:/run/openvswitch:shared,z
- /var/lib/neutron:/var/lib/neutron:shared,z
- /run/netns:/run/netns:shared
- /var/lib/neutron/kill_scripts:/etc/neutron/kill_scripts:shared,z

7
deployment/neutron/neutron-ovs-agent-container-puppet.yaml
View File

@ -243,7 +243,7 @@ outputs:
# on the unix domain socket - /run/openvswitch/db.sock
volumes:
- /lib/modules:/lib/modules:ro
- /run/openvswitch:/run/openvswitch
- /run/openvswitch:/run/openvswitch:shared,z
kolla_config:
/var/lib/kolla/config_files/neutron_ovs_agent.json:
command: /neutron_ovs_agent_launcher.sh
@ -295,7 +295,8 @@ outputs:
- /var/lib/kolla/config_files/neutron_ovs_agent.json:/var/lib/kolla/config_files/config.json:ro
- /var/lib/config-data/puppet-generated/neutron/:/var/lib/kolla/config_files/src:ro
- /lib/modules:/lib/modules:ro
- /run/openvswitch:/run/openvswitch
- /run/openvswitch:/run/openvswitch:shared,z
- /var/run/openvswitch/:/var/run/openvswitch/:shared,z
-
if:
- docker_puppet_mount_host
@ -325,7 +326,7 @@ outputs:
- /var/lib/config-data/puppet-generated/neutron/:/var/lib/kolla/config_files/src:ro
- /var/lib/container-config-scripts/neutron_ovs_agent_launcher.sh:/neutron_ovs_agent_launcher.sh:ro
- /lib/modules:/lib/modules:ro
- /run/openvswitch:/run/openvswitch
- /run/openvswitch:/run/openvswitch:shared,z
environment:
KOLLA_CONFIG_STRATEGY: COPY_ALWAYS
metadata_settings:

2
deployment/ovn/ovn-controller-container-puppet.yaml
View File

@ -184,7 +184,7 @@ outputs:
# on the unix domain socket - /run/openvswitch/db.sock
volumes:
- /lib/modules:/lib/modules:ro
- /run/openvswitch:/run/openvswitch
- /run/openvswitch:/run/openvswitch:shared,z
# Needed for creating module load files
- /etc/sysconfig/modules:/etc/sysconfig/modules
kolla_config:

6
deployment/ovn/ovn-metadata-container-puppet.yaml
View File

@ -216,7 +216,7 @@ outputs:
config_image: {get_param: ContainerNeutronConfigImage}
volumes:
- /lib/modules:/lib/modules:ro
- /run/openvswitch:/run/openvswitch
- /run/openvswitch:/run/openvswitch:shared,z
kolla_config:
/var/lib/kolla/config_files/ovn_metadata_agent.json:
command:
@ -298,7 +298,7 @@ outputs:
list_concat:
- {get_attr: [ContainersCommon, container_puppet_apply_volumes]}
- - /lib/modules:/lib/modules:ro
- /run/openvswitch:/run/openvswitch
- /run/openvswitch:/run/openvswitch:shared,z
ovn_metadata_agent:
start_order: 1
image: {get_param: ContainerOvnMetadataImage}
@ -316,7 +316,7 @@ outputs:
- /var/lib/kolla/config_files/ovn_metadata_agent.json:/var/lib/kolla/config_files/config.json:ro
- /var/lib/config-data/puppet-generated/neutron/:/var/lib/kolla/config_files/src:ro
- /lib/modules:/lib/modules:ro
- /run/openvswitch:/run/openvswitch
- /run/openvswitch:/run/openvswitch:shared,z
- /var/lib/neutron:/var/lib/neutron:shared,z
- /run/netns:/run/netns:shared
- /var/lib/neutron/kill_scripts:/etc/neutron/kill_scripts:shared,z