Allow deployments to run when selinux is disabled

This change will allow the generated playbooks to run when selinux is
disabled. Presently the seboolean module will fail when a systems has
selinux disabled. While selinux could be set permissive to avoid an
error, the disabled setting is a valid configuration and should be
respected.

> seboolean will now only run when selinux is enabled.

Change-Id: Ifd31adcf27902a8a77de9c68482306ec9da6d250
Signed-off-by: Kevin Carter <kecarter@redhat.com>

deployment/barbican/barbican-api-container-puppet.yaml

@@ -803,6 +803,9 @@ outputs:
                 name: virt_sandbox_use_netlink
                 persistent: true
                 state: true
+              when:
+                - ansible_facts.selinux is defined
+                - ansible_facts.selinux.status == "enabled"
       scale_tasks:
         if:
         - {get_param: BarbicanPkcs11CryptoLunasaEnabled}

deployment/ceilometer/ceilometer-agent-compute-container-puppet.yaml

@@ -139,3 +139,6 @@ outputs:
             name: virt_sandbox_use_netlink
             persistent: true
             state: true
+          when:
+            - ansible_facts.selinux is defined
+            - ansible_facts.selinux.status == "enabled"

deployment/ceilometer/ceilometer-agent-notification-container-puppet.yaml

@@ -220,6 +220,9 @@ outputs:
             name: virt_sandbox_use_netlink
             persistent: true
             state: true
+          when:
+            - ansible_facts.selinux is defined
+            - ansible_facts.selinux.status == "enabled"
       external_upgrade_tasks:
         - when:
             - step|int == 1

deployment/cinder/cinder-backup-container-puppet.yaml

@@ -282,6 +282,9 @@ outputs:
                 name: virt_sandbox_use_netlink
                 persistent: true
                 state: true
+              when:
+                - ansible_facts.selinux is defined
+                - ansible_facts.selinux.status == "enabled"
       deploy_steps_tasks:
         - name: Clean up when switching cinder-backup from pcmk to active-active
           when:

deployment/cinder/cinder-scheduler-container-puppet.yaml

@@ -163,6 +163,9 @@ outputs:
             name: virt_sandbox_use_netlink
             persistent: true
             state: true
+          when:
+            - ansible_facts.selinux is defined
+            - ansible_facts.selinux.status == "enabled"
       external_upgrade_tasks:
         - when:
             - step|int == 1

deployment/deprecated/nova/nova-libvirt-container-puppet.yaml

@@ -925,6 +925,9 @@ outputs:
                 name: os_enable_vtpm
                 persistent: true
                 state: true
+              when:
+                - ansible_facts.selinux is defined
+                - ansible_facts.selinux.status == "enabled"
       metadata_settings:
         list_concat:
           - if:

deployment/heat/heat-engine-container-puppet.yaml

@@ -305,6 +305,9 @@ outputs:
                 name: virt_sandbox_use_netlink
                 persistent: true
                 state: true
+              when:
+                - ansible_facts.selinux is defined
+                - ansible_facts.selinux.status == "enabled"
       upgrade_tasks: []
       external_upgrade_tasks:
         - when:

deployment/logrotate/logrotate-crond-container-puppet.yaml

@@ -113,6 +113,9 @@ outputs:
             name: logrotate_read_inside_containers
             persistent: true
             state: true
+          when:
+            - ansible_facts.selinux is defined
+            - ansible_facts.selinux.status == "enabled"
       deploy_steps_tasks:
         - name: configure tmpwatch on the host
           when: step|int == 2

deployment/manila/manila-scheduler-container-puppet.yaml

@@ -128,6 +128,9 @@ outputs:
             name: virt_sandbox_use_netlink
             persistent: true
             state: true
+          when:
+            - ansible_facts.selinux is defined
+            - ansible_facts.selinux.status == "enabled"
       upgrade_tasks: []
       external_upgrade_tasks:
         - when:

deployment/neutron/neutron-dhcp-container-puppet.yaml

@@ -428,6 +428,9 @@ outputs:
                 name: virt_sandbox_use_netlink
                 persistent: true
                 state: true
+              when:
+                - ansible_facts.selinux is defined
+                - ansible_facts.selinux.status == "enabled"
             - name: set conditions
               set_fact:
                 dnsmasq_wrapper_enabled: {get_param: NeutronEnableDnsmasqDockerWrapper}

deployment/neutron/neutron-l3-container-puppet.yaml

@@ -355,6 +355,9 @@ outputs:
                 name: virt_sandbox_use_netlink
                 persistent: true
                 state: true
+              when:
+                - ansible_facts.selinux is defined
+                - ansible_facts.selinux.status == "enabled"
             - name: set conditions
               set_fact:
                 keepalived_wrapper_enabled: {get_param: NeutronEnableKeepalivedWrapper}

deployment/neutron/neutron-metadata-container-puppet.yaml

@@ -211,4 +211,7 @@ outputs:
                 name: virt_sandbox_use_netlink
                 persistent: true
                 state: true
+              when:
+                - ansible_facts.selinux is defined
+                - ansible_facts.selinux.status == "enabled"
       upgrade_tasks: []

deployment/neutron/neutron-ovs-agent-container-puppet.yaml

@@ -418,6 +418,9 @@ outputs:
                   name: virt_sandbox_use_netlink
                   persistent: true
                   state: true
+                when:
+                  - ansible_facts.selinux is defined
+                  - ansible_facts.selinux.status == "enabled"
       update_tasks:
         # puppetlabs-firewall manages security rules via Puppet but make the rules
         # consistent by default. Since Neutron also creates some rules, we don't

deployment/neutron/neutron-sriov-agent-container-puppet.yaml

@@ -202,6 +202,9 @@ outputs:
                 name: virt_sandbox_use_netlink
                 persistent: true
                 state: true
+              when:
+                - ansible_facts.selinux is defined
+                - ansible_facts.selinux.status == "enabled"
             - if:
                 - derive_pci_whitelist_enabled
                 - - name: "creating directory"

deployment/nova/nova-compute-container-puppet.yaml

@@ -1525,6 +1525,9 @@ outputs:
               name: virt_sandbox_use_netlink
               persistent: true
               state: true
+            when:
+              - ansible_facts.selinux is defined
+              - ansible_facts.selinux.status == "enabled"
           - name: install Instance HA recovery script
             when: instance_ha_enabled|bool
             block:

deployment/nova/nova-conductor-container-puppet.yaml

@@ -242,6 +242,9 @@ outputs:
                 name: virt_sandbox_use_netlink
                 persistent: true
                 state: true
+              when:
+                - ansible_facts.selinux is defined
+                - ansible_facts.selinux.status == "enabled"
       external_upgrade_tasks:
         - when: step|int == 1
           block: &nova_online_db_migration

deployment/nova/nova-ironic-container-puppet.yaml

@@ -230,6 +230,9 @@ outputs:
             name: virt_sandbox_use_netlink
             persistent: true
             state: true
+          when:
+            - ansible_facts.selinux is defined
+            - ansible_facts.selinux.status == "enabled"
       external_post_deploy_tasks: {get_attr: [NovaComputeCommon, nova_compute_common_deploy_steps_tasks]}
       external_upgrade_tasks:
         - when:

deployment/nova/nova-modular-libvirt-container-puppet.yaml

@@ -963,6 +963,9 @@ outputs:
                 name: os_enable_vtpm
                 persistent: true
                 state: true
+              when:
+                - ansible_facts.selinux is defined
+                - ansible_facts.selinux.status == "enabled"
       metadata_settings:
         list_concat:
           - if:

deployment/nova/nova-scheduler-container-puppet.yaml

@@ -323,6 +323,9 @@ outputs:
                 name: virt_sandbox_use_netlink
                 persistent: true
                 state: true
+              when:
+                - ansible_facts.selinux is defined
+                - ansible_facts.selinux.status == "enabled"
       external_upgrade_tasks:
         - when:
             - step|int == 1

deployment/octavia/octavia-worker-container-puppet.yaml

@@ -179,6 +179,9 @@ outputs:
             name: virt_sandbox_use_netlink
             persistent: true
             state: true
+          when:
+            - ansible_facts.selinux is defined
+            - ansible_facts.selinux.status == "enabled"
       update_tasks: {get_attr: [OctaviaBase, role_data, update_tasks]}
       upgrade_tasks: {get_attr: [OctaviaBase, role_data, upgrade_tasks]}
       external_upgrade_tasks:

deployment/ovn/ovn-controller-container-puppet.yaml

@@ -420,6 +420,9 @@ outputs:
             name: virt_sandbox_use_netlink
             persistent: true
             state: true
+          when:
+            - ansible_facts.selinux is defined
+            - ansible_facts.selinux.status == "enabled"
         - name: Copy in cleanup script
           copy:
             content: {get_file: ../neutron/neutron-cleanup}