Commit Graph

3 Commits (master)

Author SHA1 Message Date
Sagi Shnaidman 019419463f Use community.general ansible collection instead of modules
Replace module calls by community.general ansible collection calls.
Change-Id: Ie96b3d35cea61370b1f98d7e060d696c4807c6b7
2 years ago
Cédric Jeanneret d77fe55516 Ensure SELinux context persist across restorecon and reboot
Until now, we only relied on the ":z" flag in order to set container
volumes label to container_file_t.
While it works fine, it has multiple issues:
- if an operator runs a restorecon, it might break the container service
- if an SELinux related package is updated, it might reset the label,
  and break the container service
- it requires a container stop&start to reset the label to the expected
  value
- in case of deep tree or huge amount of file, relabelling takes time

This change ensures the system sets the expected context on the specific
locations, instead of following the content of selinux-policy-targeted
rulesets.

It has an equivalent for some locations in tripleo-ansible repository:
https://review.opendev.org/c/openstack/tripleo-ansible/+/782393

Note about swift locations:
Since openstack-selinux already sets fcontext rules for, at least, once
swift location, we can't override it here. The following
openstack-selinux patch is being pushed in order to work around this
specific case:
https://github.com/redhat-openstack/openstack-selinux/pull/73

Change-Id: Icb7f58004e281b42141c70a9a4895905dc32b45d
Resolves: rhbz#1941922
2 years ago
Jose Luis Franco Arza bb8cb15d20 Update container-config-scripts/ folder content before update_tasks.
Currently, multiple scripts are being stored in
/var/lib/container-config-scripts directory if any of theses scripts
are being used during the update_tasks the content won't be up to
date (or the script will be fully missing if added in a new release),
as the content of this folder is being updated during the deploy tasks
(step 1), which occurs after all the update_tasks.

This patch gathers the tasks responsible for the folder creation and
content update into a new playbook named common_container_config_scripts.yaml,
this way we can reference the tasks from the deploy-tasks step1 playbook
(as it was happening up to now) and invoke them before the update_tasks
playbook gets called.

Change-Id: I2ac6bb98e1d4183327e888240fc8d5a70e0d6fcb
Related-Bug: #1904193
2 years ago