aboutsummaryrefslogtreecommitdiffstats
path: root/docker/services/containers-common.yaml
AgeCommit message (Collapse)AuthorFilesLines
2017-11-01Only mount selinux sysfs in nova_libvirt containerOliver Walsh1-1/+0
https://review.openstack.org/500952 initially just did this. Then we assumed every container should have the selinux sysfs. This causes issues with the sshd container used for live-migration. The advice from the selinux experts is that it should not be enabled within containers, so reverting back to the original fix that enables it only in the nova-libvirt container. Closes-bug: 1729405 Change-Id: I80bf38d7d64ab99510574af5c57423fde9b84eca (cherry picked from commit 7c8127cf96a281dd5cee96e1a68bc0508b9ba4e7)
2017-09-11Enable selinux in containersOliver Walsh1-0/+1
We cannot use the --selinux-enabled docker daemon option on CentOS/RHEL 7.3. It will fail if security_inode_copy_up is not found in the kernel symbols: https://github.com/projectatomic/docker/blob/docker-1.12.6/daemon/daemon_unix.go#L661 NB this has been reduced to a warning upstream: https://github.com/moby/moby/commit/885b29df096db1d6746ece4b3a298a1ffe85716d Instead this just bind mounts /sys/fs/selinux in containers-common.yaml. Everything appears to work at initial glance. Pingtest succeeds, and live-migration between baremetal and containerized computes works. Change-Id: I018221bf7ae9ab9ece193b55f1ce31eb1591046c Closes-bug: #1715171 (cherry picked from commit 520f889a31f1ea6ee2bad86d1dbb3c0435604d10)
2017-08-01Fix CA file bind mounting in containersJuan Antonio Osorio Robles1-1/+5
The syntax was wrong and wasn't actually bind mounting the CA file. This fixes it. Change-Id: Icfa2118ccd2a32fdc3d1af27e3e3ee02bdfbb13b
2017-07-14Adds network/cidr mapping into a new service propertyGiulio Fidente1-0/+4
Makes it possible to resolve network subnets within a service template; the data is transported into a new property ServiceData wired into every service which hopefully is generic enough to be extended in the future and transport more data. Data can be consumed in service templates to set config values which need to know what is the subnet where a deamon operates (for example the Ceph Public vs Cluster network). Change-Id: I28e21c46f1ef609517175f7e7ee19e28d1c0cba2
2017-06-13Bind mount internal CA file to all containersJuan Antonio Osorio Robles1-12/+57
This will allow the services running in the containers to trust the CA. bp tls-via-certmonger-containers Change-Id: Ib7eb682da64473a651b34243c92ab76009964aba
2017-06-07Map /etc/ssh/ssh_known_hosts to all containersOliver Walsh1-0/+1
This allows any ssh client spawned from a container to validate ssh host key. Change-Id: I86d95848e5f049e8af98107cd7027098d6cdee7c Closes-bug: #1693841
2017-05-30Merge "docker bootstrap service commands"Jenkins1-0/+2
2017-05-22docker bootstrap service commandsDan Prince1-0/+2
This patch guards db syncs and initialization code from executing on multiple nodes at the same time by using the new bootstrap_host_exec script. This helper script checks to make sure the container is executing on the "bootstrap host" for the specified service (arg 0) and then if it matches runs the specified command. Depends-On: If25f217bbb592edab4e1dde53ca99ed93c0e146c Depends-On: Ic1585bae27c318bd6bafc287e905f2ed250cce0f Change-Id: I0c864ca093ea476248b619d8c88477ef0b64e2eb Closes-Bug: 1688380
2017-05-19Update the template_version alias for all the templates to pike.Carlos Camacho1-1/+1
Master is now the development branch for pike changing the release alias name. Change-Id: I938e4a983e361aefcaa0bd9a4226c296c5823127
2017-05-08Add syslog socket to common containers volumesBogdan Dobrelya1-0/+2
Partial blueprint containerized-services-logs Change-Id: Idbf1884226503aca9072b12d050500af407973cf Signed-off-by: Bogdan Dobrelya <bdobreli@redhat.com>
2017-04-18Introduce common CAs to be mounted to the containersJuan Antonio Osorio Robles1-0/+5
When TLS is enabled, the containers need to trust the CAs that the host trusts. Change-Id: I0434b0ac10290970857cad3d1a89d00f5b054196
2017-04-18Introduce common resources for docker templatesJuan Antonio Osorio Robles1-0/+11
This enables common resources that the docker templates might need. The initial resource only is common volumes, and two volumes are introduced (localtime and hosts). Change-Id: Ic55af32803f9493a61f9b57aff849bfc6187d992