summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
-rw-r--r--manifests/profile/base/docker.pp58
-rw-r--r--manifests/profile/base/nova/libvirt.pp17
-rw-r--r--spec/classes/tripleo_profile_base_docker_spec.rb79
-rw-r--r--spec/classes/tripleo_profile_base_nova_libvirt_spec.rb45
4 files changed, 62 insertions, 137 deletions
diff --git a/manifests/profile/base/docker.pp b/manifests/profile/base/docker.pp
index e042947..5f6d97c 100644
--- a/manifests/profile/base/docker.pp
+++ b/manifests/profile/base/docker.pp
@@ -43,18 +43,6 @@
# [*step*]
# step defaults to hiera('step')
#
-# [*configure_libvirt_polkit*]
-# Configures libvirt polkit to grant the kolla nova user access to the libvirtd unix domain socket on the host.
-# Defaults to true when nova_compute service is enabled, false when nova_compute is disabled
-#
-# [*docker_nova_uid*]
-# When configure_libvirt_polkit = true, the uid/gid of the nova user within the docker container.
-# Defaults to 42436
-#
-# [*services_enabled*]
-# List of TripleO services enabled on the role.
-# Defaults to hiera('services_names')
-#
# DEPRECATED PARAMETERS
#
# [*docker_namespace*]
@@ -73,20 +61,11 @@ class tripleo::profile::base::docker (
$configure_storage = true,
$storage_options = '-s overlay2',
$step = Integer(hiera('step')),
- $configure_libvirt_polkit = undef,
- $docker_nova_uid = 42436,
- $services_enabled = hiera('service_names', []),
# DEPRECATED PARAMETERS
$docker_namespace = undef,
$insecure_registry = false,
) {
- if $configure_libvirt_polkit == undef {
- $configure_libvirt_polkit_real = 'nova_compute' in $services_enabled
- } else {
- $configure_libvirt_polkit_real = $configure_libvirt_polkit
- }
-
if $step >= 1 {
package {'docker':
ensure => installed,
@@ -176,41 +155,4 @@ class tripleo::profile::base::docker (
}
}
- if ($step >= 4 and $configure_libvirt_polkit_real) {
- # Workaround for polkit authorization for libvirtd socket on host
- #
- # This creates a local user with the kolla nova uid, and sets the polkit rule to
- # allow both it and the nova user from the nova rpms, should it exist (uid 162).
-
- group { 'docker_nova_group':
- name => 'docker_nova',
- gid => $docker_nova_uid
- }
- -> user { 'docker_nova_user':
- name => 'docker_nova',
- uid => $docker_nova_uid,
- gid => $docker_nova_uid,
- shell => '/sbin/nologin',
- comment => 'OpenStack Nova Daemons',
- groups => ['nobody']
- }
-
- # Similar to the polkit rule in the openstack-nova rpm spec
- # but allow both the 'docker_nova' and 'nova' user
- $docker_nova_polkit_rule = '// openstack-nova libvirt management permissions
-polkit.addRule(function(action, subject) {
- if (action.id == "org.libvirt.unix.manage" &&
- /^(docker_)?nova$/.test(subject.user)) {
- return polkit.Result.YES;
- }
-});
-'
- package {'polkit':
- ensure => installed,
- }
- -> file {'/etc/polkit-1/rules.d/50-nova.rules':
- content => $docker_nova_polkit_rule,
- mode => '0644'
- }
- }
}
diff --git a/manifests/profile/base/nova/libvirt.pp b/manifests/profile/base/nova/libvirt.pp
index 83f0c38..6c865dc 100644
--- a/manifests/profile/base/nova/libvirt.pp
+++ b/manifests/profile/base/nova/libvirt.pp
@@ -23,8 +23,13 @@
# for more details.
# Defaults to hiera('step')
#
+# [*libvirtd_config*]
+# (Optional) Overrides for libvirtd config options
+# Default to {}
+#
class tripleo::profile::base::nova::libvirt (
$step = Integer(hiera('step')),
+ $libvirtd_config = {},
) {
include ::tripleo::profile::base::nova::compute_libvirt_shared
@@ -33,6 +38,18 @@ class tripleo::profile::base::nova::libvirt (
include ::tripleo::profile::base::nova::migration::client
include ::nova::compute::libvirt::services
+ $libvirtd_config_default = {
+ unix_sock_group => {value => '"libvirt"'},
+ auth_unix_ro => {value => '"none"'},
+ auth_unix_rw => {value => '"none"'},
+ unix_sock_ro_perms => {value => '"0777"'},
+ unix_sock_rw_perms => {value => '"0770"'}
+ }
+
+ class { '::nova::compute::libvirt::config':
+ libvirtd_config => merge($libvirtd_config_default, $libvirtd_config)
+ }
+
file { ['/etc/libvirt/qemu/networks/autostart/default.xml',
'/etc/libvirt/qemu/networks/default.xml']:
ensure => absent,
diff --git a/spec/classes/tripleo_profile_base_docker_spec.rb b/spec/classes/tripleo_profile_base_docker_spec.rb
index dc5efa7..e0947dc 100644
--- a/spec/classes/tripleo_profile_base_docker_spec.rb
+++ b/spec/classes/tripleo_profile_base_docker_spec.rb
@@ -121,85 +121,6 @@ describe 'tripleo::profile::base::docker' do
}
end
- context 'with step 4 and configure_libvirt_polkit disabled' do
- let(:params) { {
- :step => 4,
- :configure_libvirt_polkit => false
- } }
- it {
- is_expected.to_not contain_group('docker_nova_group')
- is_expected.to_not contain_user('docker_nova_user')
- is_expected.to_not contain_package('polkit')
- is_expected.to_not contain_file('/etc/polkit-1/rules.d/50-nova.rules')
- }
- end
-
- context 'with step 4 and configure_libvirt_polkit enabled' do
- let(:params) { {
- :step => 4,
- :configure_libvirt_polkit => true
- } }
- it {
- is_expected.to contain_group('docker_nova_group').with(
- :name => 'docker_nova',
- :gid => 42436
- )
- is_expected.to contain_user('docker_nova_user').with(
- :name => 'docker_nova',
- :uid => 42436,
- :gid => 42436,
- :shell => '/sbin/nologin',
- :groups => ['nobody']
- )
- is_expected.to contain_package('polkit')
- is_expected.to contain_file('/etc/polkit-1/rules.d/50-nova.rules')
- }
- end
-
- context 'with step 4 and nova_compute service installed' do
- let(:params) { {
- :step => 4,
- :services_enabled => ['docker', 'nova_compute']
- } }
- it {
- is_expected.to contain_group('docker_nova_group').with(
- :name => 'docker_nova',
- :gid => 42436
- )
- is_expected.to contain_user('docker_nova_user').with(
- :name => 'docker_nova',
- :uid => 42436,
- :gid => 42436,
- :shell => '/sbin/nologin',
- :groups => ['nobody']
- )
- is_expected.to contain_package('polkit')
- is_expected.to contain_file('/etc/polkit-1/rules.d/50-nova.rules')
- }
- end
-
- context 'with step 4 and configure_libvirt_polkit enabled and docker_nova uid' do
- let(:params) { {
- :step => 4,
- :configure_libvirt_polkit => true,
- :docker_nova_uid => 12345
- } }
- it {
- is_expected.to contain_group('docker_nova_group').with(
- :name => 'docker_nova',
- :gid => 12345
- )
- is_expected.to contain_user('docker_nova_user').with(
- :name => 'docker_nova',
- :uid => 12345,
- :gid => 12345,
- :shell => '/sbin/nologin',
- :groups => ['nobody']
- )
- is_expected.to contain_package('polkit')
- is_expected.to contain_file('/etc/polkit-1/rules.d/50-nova.rules')
- }
- end
end
on_supported_os.each do |os, facts|
diff --git a/spec/classes/tripleo_profile_base_nova_libvirt_spec.rb b/spec/classes/tripleo_profile_base_nova_libvirt_spec.rb
index 0734a0f..65aa8c1 100644
--- a/spec/classes/tripleo_profile_base_nova_libvirt_spec.rb
+++ b/spec/classes/tripleo_profile_base_nova_libvirt_spec.rb
@@ -69,6 +69,51 @@ eos
is_expected.to contain_file('/etc/libvirt/qemu/networks/autostart/default.xml').with_ensure('absent')
is_expected.to contain_file('/etc/libvirt/qemu/networks/default.xml').with_ensure('absent')
is_expected.to contain_exec('libvirt-default-net-destroy')
+ is_expected.to contain_class('nova::compute::libvirt::config').with_libvirtd_config({
+ "unix_sock_group" => {"value" => '"libvirt"'},
+ "auth_unix_ro" => {"value" => '"none"'},
+ "auth_unix_rw" => {"value" => '"none"'},
+ "unix_sock_ro_perms" => {"value" => '"0777"'},
+ "unix_sock_rw_perms" => {"value" => '"0770"'}
+ })
+ }
+ end
+
+ context 'with step 4 and libvirtd_config' do
+ let(:pre_condition) do
+ <<-eos
+ class { '::tripleo::profile::base::nova':
+ step => #{params[:step]},
+ oslomsg_rpc_hosts => [ '127.0.0.1' ],
+ }
+ class { '::tripleo::profile::base::nova::migration':
+ step => #{params[:step]}
+ }
+ class { '::tripleo::profile::base::nova::migration::client':
+ step => #{params[:step]}
+ }
+ class { '::tripleo::profile::base::nova::compute_libvirt_shared':
+ step => #{params[:step]}
+ }
+eos
+ end
+
+ let(:params) { { :step => 4, :libvirtd_config => { "unix_sock_group" => {"value" => '"foobar"'}} } }
+
+ it {
+ is_expected.to contain_class('tripleo::profile::base::nova::libvirt')
+ is_expected.to contain_class('tripleo::profile::base::nova')
+ is_expected.to contain_class('nova::compute::libvirt::services')
+ is_expected.to contain_file('/etc/libvirt/qemu/networks/autostart/default.xml').with_ensure('absent')
+ is_expected.to contain_file('/etc/libvirt/qemu/networks/default.xml').with_ensure('absent')
+ is_expected.to contain_exec('libvirt-default-net-destroy')
+ is_expected.to contain_class('nova::compute::libvirt::config').with_libvirtd_config({
+ "unix_sock_group" => {"value" => '"foobar"'},
+ "auth_unix_ro" => {"value" => '"none"'},
+ "auth_unix_rw" => {"value" => '"none"'},
+ "unix_sock_ro_perms" => {"value" => '"0777"'},
+ "unix_sock_rw_perms" => {"value" => '"0770"'}
+ })
}
end
end