From 62cdc3949f733b726fc1e25708b755e1a21dd9f7 Mon Sep 17 00:00:00 2001
From: Bogdan Dobrelya <bdobreli@redhat.com>
Date: Thu, 17 May 2018 17:16:29 +0200
Subject: [PATCH] Allow custom time constraints to rotate logs

Time based constraints must prevail over size et al
constraints applied for logs of containerized services.
Time based constraints are needed in order to abide
GDPR requirements.

Depending on FS type, Linux may not allow system operators
to access files creation time attribute (see the Birth
attribute shown as '-' by the stat -c %w command).
This is work-arouned by alternative strict time-based rules
defined in the postrotate script, which purges files in
/var/log/containers and ensures GDPR compliant system
configuration, limited to the containerized services logs.

Extended management of life time of journald and /var/log
files residing on bare metal hosts, should be done in
follow up patches.

Partial-bug: #1771543

Change-Id: I6f2f98aba103f83a4f64a435077f4de33f9692c0
Depends-On: Id8e4717a5ecda53bc9cd39f1c2efaa80b56bd45e
Signed-off-by: Bogdan Dobrelya <bdobreli@redhat.com>
---
 docker/services/logrotate-crond.yaml          | 25 +++++++++++++++++--
 ...ate-containers-purge-a5587253fe6cbb28.yaml | 15 +++++++++++
 2 files changed, 38 insertions(+), 2 deletions(-)
 create mode 100644 releasenotes/notes/logrotate-containers-purge-a5587253fe6cbb28.yaml

diff --git a/docker/services/logrotate-crond.yaml b/docker/services/logrotate-crond.yaml
index f314f96ecd..e38d39994c 100644
--- a/docker/services/logrotate-crond.yaml
+++ b/docker/services/logrotate-crond.yaml
@@ -36,7 +36,24 @@ parameters:
     default: {}
     description: Parameters specific to the role
     type: json
-
+  LogrotateMaxsize:
+    description: Configures tme maxsize param for containerized logrotate.
+    type: string
+    default: '10M'
+  LogrotateRotationInterval:
+    description: Configures rotation interval for containerized logrotate.
+    type: string
+    default: 'daily'
+    constraints:
+      - allowed_values: [ 'daily', 'weekly', 'monthly' ]
+  LogrotateRotate:
+    description: Configures the rotate param for containerized logrotate.
+    type: string
+    default: '14'
+  LogrotatePurgeAfterDays:
+    description: Enforces life time (days) of rotated and compressed files.
+    type: string
+    default: '14'
 
 resources:
 
@@ -48,7 +65,11 @@ outputs:
     description: Role data for the crond role.
     value:
       service_name: logrotate_crond
-      config_settings: {}
+      config_settings:
+        tripleo::profile::base::logging::logrotate::maxsize: {get_param: LogrotateMaxsize}
+        tripleo::profile::base::logging::logrotate::rotation: {get_param: LogrotateRotationInterval}
+        tripleo::profile::base::logging::logrotate::rotate: {get_param: LogrotateRotate}
+        tripleo::profile::base::logging::logrotate::purge_after_days: {get_param: LogrotatePurgeAfterDays}
       # BEGIN DOCKER SETTINGS
       puppet_config:
         config_volume: crond
diff --git a/releasenotes/notes/logrotate-containers-purge-a5587253fe6cbb28.yaml b/releasenotes/notes/logrotate-containers-purge-a5587253fe6cbb28.yaml
new file mode 100644
index 0000000000..2263870d8d
--- /dev/null
+++ b/releasenotes/notes/logrotate-containers-purge-a5587253fe6cbb28.yaml
@@ -0,0 +1,15 @@
+---
+upgrade:
+  - |
+    The 'LogrotatePurgeAfterDays'
+    enforces cleaning up of information exceeded its life-time
+    (defaults to a 14 days) in the /var/log/containers directory of
+    bare metal overcloud hosts, including upgrade (from containers)
+    cases, when leftovers may be remaining on the host systems.
+security:
+  - |
+    New heat parameters for containerized services 'LogrotateMaxsize',
+    'LogrotateRotationInterval', 'LogrotateRotate' and
+    'LogrotatePurgeAfterDays' allow customizing size/time-based rules
+    for the containerized services logs rotation.
+    The time based rules prevail over all.