tripleo-heat-templates/docker/services/nova-consoleauth.yaml
Cédric Jeanneret d70d128aa0 Enable virt_sandbox_use_netlink SELinux boolean for port healthchecks
As healthchecks are using "ss" command, we need to allow contaier_t
to access a tcp diagnostic socket, at least for the port healthchecks.

This follows change I9ebdf09c36fd2c69d05128b584593b41d9144e56, triggered
by the neutron healthchecks. A second pass was necessary in order to
further check the calls of ss.

Change-Id: I27e4c860948667abc2c21df5ec9e01627f58465a
Related-Bug: #1810512
2019-01-11 08:19:18 +01:00

184 lines
6.3 KiB
YAML

heat_template_version: rocky
description: >
OpenStack containerized Nova Consoleauth service
parameters:
DockerNovaConsoleauthImage:
description: image
type: string
DockerNovaConfigImage:
description: The container image to use for the nova config_volume
type: string
NovaConsoleauthLoggingSource:
type: json
default:
tag: openstack.nova.consoleauth
path: /var/log/containers/nova/nova-consoleauth.log
EndpointMap:
default: {}
description: Mapping of service endpoint -> protocol. Typically set
via parameter_defaults in the resource registry.
type: json
ServiceData:
default: {}
description: Dictionary packing service data
type: json
ServiceNetMap:
default: {}
description: Mapping of service_name -> network name. Typically set
via parameter_defaults in the resource registry. This
mapping overrides those in ServiceNetMapDefaults.
type: json
DefaultPasswords:
default: {}
type: json
RoleName:
default: ''
description: Role name on which the service is applied
type: string
RoleParameters:
default: {}
description: Parameters specific to the role
type: json
UpgradeRemoveUnusedPackages:
default: false
description: Remove package if the service is being disabled during upgrade
type: boolean
resources:
ContainersCommon:
type: ./containers-common.yaml
MySQLClient:
type: ../../puppet/services/database/mysql-client.yaml
NovaConsoleauthPuppetBase:
type: ../../puppet/services/nova-consoleauth.yaml
properties:
EndpointMap: {get_param: EndpointMap}
ServiceData: {get_param: ServiceData}
ServiceNetMap: {get_param: ServiceNetMap}
DefaultPasswords: {get_param: DefaultPasswords}
RoleName: {get_param: RoleName}
RoleParameters: {get_param: RoleParameters}
NovaLogging:
type: OS::TripleO::Services::Logging::NovaCommon
properties:
DockerNovaImage: {get_param: DockerNovaConsoleauthImage}
NovaServiceName: 'consoleauth'
outputs:
role_data:
description: Role data for the Nova Consoleauth service.
value:
service_name: {get_attr: [NovaConsoleauthPuppetBase, role_data, service_name]}
config_settings:
map_merge:
- {get_attr: [NovaConsoleauthPuppetBase, role_data, config_settings]}
- {get_attr: [NovaLogging, config_settings]}
service_config_settings:
map_merge:
- get_attr: [NovaConsoleauthPuppetBase, role_data, service_config_settings]
- fluentd:
tripleo_fluentd_groups_nova_consoleauth:
- nova
tripleo_fluentd_sources_nova_consoleauth:
- {get_param: NovaConsoleauthLoggingSource}
# BEGIN DOCKER SETTINGS
puppet_config:
config_volume: nova
puppet_tags: nova_config
step_config:
list_join:
- "\n"
- - {get_attr: [NovaConsoleauthPuppetBase, role_data, step_config]}
- {get_attr: [MySQLClient, role_data, step_config]}
config_image: {get_param: DockerNovaConfigImage}
kolla_config:
/var/lib/kolla/config_files/nova_consoleauth.json:
command:
list_join:
- ' '
- - /usr/bin/nova-consoleauth
- get_attr: [NovaLogging, cmd_extra_args]
config_files:
- source: "/var/lib/kolla/config_files/src/*"
dest: "/"
merge: true
preserve_properties: true
permissions:
- path: /var/log/nova
owner: nova:nova
recurse: true
docker_config:
step_4:
nova_consoleauth:
image: {get_param: DockerNovaConsoleauthImage}
net: host
privileged: false
restart: always
healthcheck:
test:
list_join:
- ' '
- - '/openstack/healthcheck'
- yaql:
expression: str($.data.port)
data:
port: {get_attr: [NovaConsoleauthPuppetBase, role_data, config_settings, 'nova::rabbit_port']}
volumes:
list_concat:
- {get_attr: [ContainersCommon, volumes]}
- {get_attr: [NovaLogging, volumes]}
-
- /var/lib/kolla/config_files/nova_consoleauth.json:/var/lib/kolla/config_files/config.json:ro
- /var/lib/config-data/puppet-generated/nova/:/var/lib/kolla/config_files/src:ro
environment:
- KOLLA_CONFIG_STRATEGY=COPY_ALWAYS
host_prep_tasks:
list_concat:
- {get_attr: [NovaLogging, host_prep_tasks]}
- - name: enable virt_sandbox_use_netlink for healthcheck
seboolean:
name: virt_sandbox_use_netlink
persistent: yes
state: yes
upgrade_tasks:
- when: step|int == 3
block:
- name: Set fact for removal of openstack-nova-console package
set_fact:
remove_nova_console_package: {get_param: UpgradeRemoveUnusedPackages}
- name: Remove openstack-nova-console package if operator requests it
package: name=openstack-nova-console state=removed
ignore_errors: True
when: remove_nova_console_package|bool
post_upgrade_tasks:
- when: step|int == 1
import_role:
name: tripleo-docker-rm
vars:
containers_to_rm:
- nova_consoleauth
fast_forward_upgrade_tasks:
- when:
- step|int == 0
- release == 'ocata'
block:
- name: Check if nova_consoleauth is deployed
command: systemctl is-active --quiet openstack-nova-consoleauth
ignore_errors: True
register: nova_consoleauth_enabled_result
- name: Set fact nova_consoleauth_enabled
set_fact:
nova_consoleauth_enabled: "{{ nova_consoleauth_enabled_result.rc == 0 }}"
- name: Stop and disable nova-consoleauth service
service: name=openstack-nova-consoleauth state=stopped
when:
- step|int == 1
- release == 'ocata'
- nova_consoleauth_enabled|bool