From 4f5dda873762438b3ba296da289dae5f3312c9da Mon Sep 17 00:00:00 2001 From: Maximilian Stinsky Date: Fri, 19 Jul 2024 12:35:19 +0200 Subject: Implement neutron-ovn-vpn-agent This patch implements vpnaas for OVN environments. It deploys a standalone neutron-ovn-vpn-agent on neutron nodes. The container no longer requires 'privileged: true'. Running as the 'neutron' user with specific kernel capabilities ensures the agent can manage network namespaces and interfaces without full privileges. Added capabilities: - NET_ADMIN # manage interfaces, IPs, routing, firewall - SYS_ADMIN # create/manage network namespaces - SYS_PTRACE # allow 'ip netns exec' attach to processes - DAC_OVERRIDE # bypass file read/write restrictions - DAC_READ_SEARCH # allow directory traversal and file read - SETPCAP # retain capabilities for privileged ops Added security options: - apparmor=unconfined # disable AppArmor confinement - seccomp=unconfined # disable seccomp filtering - label=disable # disable SELinux/labeling Depends-On: https://review.opendev.org/c/openstack/kolla/+/924302 Closes-Bug: #2048392 Change-Id: I961b1407ae1402d146f0c09924df8e007e331af5 Signed-off-by: Joachim de Groot Signed-off-by: Piotr Milewski --- ansible/inventory/all-in-one | 3 +++ ansible/inventory/multinode | 3 +++ 2 files changed, 6 insertions(+) (limited to 'ansible/inventory') diff --git a/ansible/inventory/all-in-one b/ansible/inventory/all-in-one index 79704c8de..4a8419b58 100644 --- a/ansible/inventory/all-in-one +++ b/ansible/inventory/all-in-one @@ -239,6 +239,9 @@ neutron [neutron-metadata-agent:children] neutron +[neutron-ovn-vpn-agent:children] +neutron + [neutron-metering-agent:children] neutron diff --git a/ansible/inventory/multinode b/ansible/inventory/multinode index cbb0db70c..e90848e71 100644 --- a/ansible/inventory/multinode +++ b/ansible/inventory/multinode @@ -280,6 +280,9 @@ control compute network +[neutron-ovn-vpn-agent:children] +neutron + # Cinder [cinder-api:children] cinder -- cgit v1.2.3