diff options
| author | Maximilian Stinsky <maximilian.stinsky-damke@wiit.cloud> | 2024-07-19 12:35:19 +0200 |
|---|---|---|
| committer | Piotr Milewski <vurmil@gmail.com> | 2026-04-17 09:07:00 +0000 |
| commit | 4f5dda873762438b3ba296da289dae5f3312c9da (patch) | |
| tree | e5dc0742dcb8c48c3125e00c601c9ffb20a28a5d /ansible/inventory | |
| parent | 88aecb6009d2ef6e543849cd9930d1bd80cfca2f (diff) | |
| download | kolla-ansible-4f5dda873762438b3ba296da289dae5f3312c9da.tar.gz kolla-ansible-4f5dda873762438b3ba296da289dae5f3312c9da.zip | |
Implement neutron-ovn-vpn-agent
This patch implements vpnaas for OVN environments. It deploys
a standalone neutron-ovn-vpn-agent on neutron nodes.
The container no longer requires 'privileged: true'. Running
as the 'neutron' user with specific kernel capabilities ensures
the agent can manage network namespaces and interfaces without
full privileges.
Added capabilities:
- NET_ADMIN # manage interfaces, IPs, routing, firewall
- SYS_ADMIN # create/manage network namespaces
- SYS_PTRACE # allow 'ip netns exec' attach to processes
- DAC_OVERRIDE # bypass file read/write restrictions
- DAC_READ_SEARCH # allow directory traversal and file read
- SETPCAP # retain capabilities for privileged ops
Added security options:
- apparmor=unconfined # disable AppArmor confinement
- seccomp=unconfined # disable seccomp filtering
- label=disable # disable SELinux/labeling
Depends-On: https://review.opendev.org/c/openstack/kolla/+/924302
Closes-Bug: #2048392
Change-Id: I961b1407ae1402d146f0c09924df8e007e331af5
Signed-off-by: Joachim de Groot <joachim.de.groot@menzel-it.net>
Signed-off-by: Piotr Milewski <vurmil@gmail.com>
Diffstat (limited to 'ansible/inventory')
| -rw-r--r-- | ansible/inventory/all-in-one | 3 | ||||
| -rw-r--r-- | ansible/inventory/multinode | 3 |
2 files changed, 6 insertions, 0 deletions
diff --git a/ansible/inventory/all-in-one b/ansible/inventory/all-in-one index 79704c8de..4a8419b58 100644 --- a/ansible/inventory/all-in-one +++ b/ansible/inventory/all-in-one @@ -239,6 +239,9 @@ neutron [neutron-metadata-agent:children] neutron +[neutron-ovn-vpn-agent:children] +neutron + [neutron-metering-agent:children] neutron diff --git a/ansible/inventory/multinode b/ansible/inventory/multinode index cbb0db70c..e90848e71 100644 --- a/ansible/inventory/multinode +++ b/ansible/inventory/multinode @@ -280,6 +280,9 @@ control compute network +[neutron-ovn-vpn-agent:children] +neutron + # Cinder [cinder-api:children] cinder |