summaryrefslogtreecommitdiffstats
path: root/spec
diff options
context:
space:
mode:
authorOliver Walsh <owalsh@redhat.com>2017-06-06 12:12:43 +0100
committerOliver Walsh <owalsh@redhat.com>2017-06-06 21:49:08 +0100
commit016cef3ea729e1e3aed948ff3d07d650a5d92884 (patch)
treede4b21db077d14e70a1ab0a7745d48b31dff7a2b /spec
parent0a75929adeea9ea7a53ad5a45c9bb1f1b6962b9b (diff)
Add polkit rule to allow kolla nova user access to libvirtd socket on docker host
The polkit rules are currently evaluated in the context of the docker host. As a result the check fails for the kolla nova compute user, as the uids are not consistent with the host uids (in fact we probably can't assume a nova user exists on the docker host). As a short-term workaround a 'docker_nova' user group is created on the docker host and the polkit rule is updated to grant this user access to the libvirtd socket. Longer term solution probably requires running polkitd in a container too. Change-Id: I91be1f1eacf8eed9017bbfef393ee2d66771e8d6 Related-bug: #1693844
Diffstat (limited to 'spec')
-rw-r--r--spec/classes/tripleo_profile_base_docker_spec.rb79
1 files changed, 79 insertions, 0 deletions
diff --git a/spec/classes/tripleo_profile_base_docker_spec.rb b/spec/classes/tripleo_profile_base_docker_spec.rb
index 0b988f6..bb21055 100644
--- a/spec/classes/tripleo_profile_base_docker_spec.rb
+++ b/spec/classes/tripleo_profile_base_docker_spec.rb
@@ -124,6 +124,85 @@ describe 'tripleo::profile::base::docker' do
}
end
+ context 'with step 4 and configure_libvirt_polkit disabled' do
+ let(:params) { {
+ :step => 4,
+ :configure_libvirt_polkit => false
+ } }
+ it {
+ is_expected.to_not contain_group('docker_nova_group')
+ is_expected.to_not contain_user('docker_nova_user')
+ is_expected.to_not contain_package('polkit')
+ is_expected.to_not contain_file('/etc/polkit-1/rules.d/50-nova.rules')
+ }
+ end
+
+ context 'with step 4 and configure_libvirt_polkit enabled' do
+ let(:params) { {
+ :step => 4,
+ :configure_libvirt_polkit => true
+ } }
+ it {
+ is_expected.to contain_group('docker_nova_group').with(
+ :name => 'docker_nova',
+ :gid => 42436
+ )
+ is_expected.to contain_user('docker_nova_user').with(
+ :name => 'docker_nova',
+ :uid => 42436,
+ :gid => 42436,
+ :shell => '/sbin/nologin',
+ :groups => ['nobody']
+ )
+ is_expected.to contain_package('polkit')
+ is_expected.to contain_file('/etc/polkit-1/rules.d/50-nova.rules')
+ }
+ end
+
+ context 'with step 4 and nova_compute service installed' do
+ let(:params) { {
+ :step => 4,
+ :services_enabled => ['docker', 'nova_compute']
+ } }
+ it {
+ is_expected.to contain_group('docker_nova_group').with(
+ :name => 'docker_nova',
+ :gid => 42436
+ )
+ is_expected.to contain_user('docker_nova_user').with(
+ :name => 'docker_nova',
+ :uid => 42436,
+ :gid => 42436,
+ :shell => '/sbin/nologin',
+ :groups => ['nobody']
+ )
+ is_expected.to contain_package('polkit')
+ is_expected.to contain_file('/etc/polkit-1/rules.d/50-nova.rules')
+ }
+ end
+
+ context 'with step 4 and configure_libvirt_polkit enabled and docker_nova uid' do
+ let(:params) { {
+ :step => 4,
+ :configure_libvirt_polkit => true,
+ :docker_nova_uid => 12345
+ } }
+ it {
+ is_expected.to contain_group('docker_nova_group').with(
+ :name => 'docker_nova',
+ :gid => 12345
+ )
+ is_expected.to contain_user('docker_nova_user').with(
+ :name => 'docker_nova',
+ :uid => 12345,
+ :gid => 12345,
+ :shell => '/sbin/nologin',
+ :groups => ['nobody']
+ )
+ is_expected.to contain_package('polkit')
+ is_expected.to contain_file('/etc/polkit-1/rules.d/50-nova.rules')
+ }
+ end
end
on_supported_os.each do |os, facts|