From c7472c0ff61ccbbc6843286269d627b7b1dee6e2 Mon Sep 17 00:00:00 2001 From: Bertrand Lanson Date: Sat, 29 Nov 2025 11:31:35 +0100 Subject: Fix idempotence on comparing capabilities for podman Currently, we add the AUDIT_WRITE capability for all unprivileged podman containers. This causes a diff because the cap is popped from params before comparing with the running container's actual values. This patch fixes it by overriding compare_cap_add() to normalize capability formats and account for auto-added AUDIT_WRITE, while working around a bug in older Podman versions where AUDIT_WRITE doesn't appear in the inspect API response. Closes-bug: #2133434 Change-Id: I61fc50654fb06e041776fd394f6b1cab2f9903ba Signed-off-by: Bertrand Lanson --- ansible/module_utils/kolla_podman_worker.py | 36 +++++++++++++++++++++++++++++ 1 file changed, 36 insertions(+) (limited to 'ansible/module_utils') diff --git a/ansible/module_utils/kolla_podman_worker.py b/ansible/module_utils/kolla_podman_worker.py index d7b09a135..e876f923e 100644 --- a/ansible/module_utils/kolla_podman_worker.py +++ b/ansible/module_utils/kolla_podman_worker.py @@ -306,6 +306,42 @@ class PodmanWorker(ContainerWorker): self.changed = True return self.changed + def compare_cap_add(self, container_info): + new_cap_add = self.params.get('cap_add', list()).copy() + + new_cap_add = [ + 'CAP_' + cap.upper() + if not cap.upper().startswith('CAP_') + else cap.upper() + for cap in new_cap_add + ] + + try: + current_cap_add = ( + container_info['HostConfig'].get('CapAdd', None) or [] + ) + except (KeyError, TypeError): + current_cap_add = [] + + current_cap_add = [cap.upper() for cap in current_cap_add] + + privileged = container_info['HostConfig'].get('Privileged', False) + if not privileged: + # NOTE(blanson): prepare_container_args() always adds AUDIT_WRITE + # for non-privileged containers. Also works around Podman <4.4 bug + # where AUDIT_WRITE doesn't appear in inspect. Since capabilities + # can't be modified post-creation, this won't mask real drift. + if 'CAP_AUDIT_WRITE' not in new_cap_add: + new_cap_add.append('CAP_AUDIT_WRITE') + + if 'CAP_AUDIT_WRITE' not in current_cap_add: + current_cap_add.append('CAP_AUDIT_WRITE') + + if set(new_cap_add).symmetric_difference(set(current_cap_add)): + return True + + return False + def compare_pid_mode(self, container_info): new_pid_mode = self.params.get('pid_mode') or self.params.get('pid') current_pid_mode = container_info['HostConfig'].get('PidMode') -- cgit v1.2.3