From 8553e52acd79dc8457747def955a749eabf0cb96 Mon Sep 17 00:00:00 2001 From: k-s-dean Date: Tue, 28 Jun 2022 12:18:35 +0100 Subject: adds firewalld configuration based on enabled services This change introduces automated configuration of firewalld and adds a new filter for extracting services from the project_services dict. the filter selects any enabled services and their haproxy element and returns them so they can be iterated over. This commit also enables automated configuration of firewalld from enabled openstack services and adds them to the defined zone and reloads the system firewall. Change-Id: Iea3680142711873984efff2b701347b6a56dd355 --- kolla_ansible/tests/unit/test_filters.py | 405 +++++++++++++++++++++++++++++++ 1 file changed, 405 insertions(+) (limited to 'kolla_ansible/tests') diff --git a/kolla_ansible/tests/unit/test_filters.py b/kolla_ansible/tests/unit/test_filters.py index 859cfd7aa..c6c6adf75 100644 --- a/kolla_ansible/tests/unit/test_filters.py +++ b/kolla_ansible/tests/unit/test_filters.py @@ -110,6 +110,411 @@ class TestFilters(unittest.TestCase): filters.service_mapped_to_host, self.context, service) + def test_extract_haproxy_services_empty_dict(self): + example_service = {} + actual = filters.extract_haproxy_services( + self.context, example_service) + # No change + self.assertDictEqual({}, actual) + + def test_extract_haproxy_services_no_haproxy_dict(self): + example_service = { + "keystone-ssh": { + "container_name": "keystone_ssh", + "dimensions": {}, + "enabled": True, + "group": "keystone", + "healthcheck": { + "interval": "30", + "retries": "3", + "start_period": "5", + "test": [ + "CMD-SHELL", + "healthcheck_listen sshd 8023" + ], + "timeout": "30" + }, + "image": "keystone-ssh:latest", + "volumes": [ + "/etc/kolla/keystone-ssh/:/var/lib/kolla/config_files/:ro", + "/etc/localtime:/etc/localtime:ro", + "", + "kolla_logs:/var/log/kolla/", + "keystone_fernet_tokens:/etc/keystone/fernet-keys" + ] + } + } + actual = filters.extract_haproxy_services(self.context, + example_service) + self.assertDictEqual({}, actual) + + def test_extract_haproxy_services_haproxy_dict(self): + example_service = { + "keystone": { + "container_name": "keystone", + "dimensions": {}, + "enabled": True, + "group": "keystone", + "haproxy": { + "keystone_admin": { + "enabled": True, + "external": False, + "listen_port": "35357", + "mode": "http", + "port": "35357", + "tls_backend": True + }, + "keystone_external": { + "backend_http_extra": [], + "enabled": True, + "external": True, + "listen_port": "5000", + "mode": "http", + "port": "5000", + "tls_backend": True + }, + "keystone_internal": { + "backend_http_extra": [], + "enabled": True, + "external": False, + "listen_port": "5000", + "mode": "http", + "port": "5000", + "tls_backend": True + } + }, + "healthcheck": { + "interval": "30", + "retries": "3", + "start_period": "5", + "test": [ + "CMD-SHELL", + "healthcheck_curl https://1.2.3.4:5000" + ], + "timeout": "30" + }, + "image": "keystone:latest", + "volumes": [ + "/etc/kolla/keystone/:/var/lib/kolla/config_files/:ro", + "/etc/localtime:/etc/localtime:ro", + "", + "", + "kolla_logs:/var/log/kolla/", + "keystone_fernet_tokens:/etc/keystone/fernet-keys" + ] + } + } + expected = { + 'keystone_admin': { + 'enabled': True, + 'external': False, + 'listen_port': '35357', + 'mode': 'http', + 'port': '35357', + 'tls_backend': True + }, + 'keystone_external': { + 'backend_http_extra': [], + 'enabled': True, + 'external': True, + 'listen_port': '5000', + 'mode': 'http', + 'port': '5000', + 'tls_backend': True + }, + 'keystone_internal': { + 'backend_http_extra': [], + 'enabled': True, + 'external': False, + 'listen_port': '5000', + 'mode': 'http', + 'port': '5000', + 'tls_backend': True + } + } + actual = filters.extract_haproxy_services(self.context, + example_service) + self.assertDictEqual(expected, actual) + + def test_extract_two_services_with_haproxy_dict(self): + example_service = { + "glance-api": { + "container_name": "glance_api", + "dimensions": {}, + "enabled": True, + "environment": { + "http_proxy": "", + "https_proxy": "", + "no_proxy": "127.0.0.1,localhost,1.2.3.4,1.2.3.4" + }, + "group": "glance-api", + "haproxy": { + "glance_api": { + "backend_http_extra": [ + "timeout server 6h" + ], + "custom_member_list": [ + "server someserver 1.2.3.4:9292 " + "check inter 2000 rise 2 fall 5", + "" + ], + "enabled": False, + "external": False, + "frontend_http_extra": [ + "timeout client 6h" + ], + "mode": "http", + "port": "9292" + }, + "glance_api_external": { + "backend_http_extra": [ + "timeout server 6h" + ], + "custom_member_list": [ + "server someserver 1.2.3.4:9292 " + "check inter 2000 rise 2 fall 5", + "" + ], + "enabled": False, + "external": True, + "frontend_http_extra": [ + "timeout client 6h" + ], + "mode": "http", + "port": "9292" + } + }, + "healthcheck": { + "interval": "30", + "retries": "3", + "start_period": "5", + "test": [ + "CMD-SHELL", + "healthcheck_curl http://localhost:9292" + ], + "timeout": "30" + }, + "host_in_groups": True, + "image": "centos-source-glance-api:latest", + "privileged": False, + "volumes": [ + "/etc/localtime:/etc/localtime:ro", + "", + "glance:/var/lib/glance/", + "", + "kolla_logs:/var/log/kolla/", + "", + "" + ] + }, + "glance-tls-proxy": { + "container_name": "glance_tls_proxy", + "dimensions": {}, + "enabled": True, + "group": "glance-api", + "haproxy": { + "glance_tls_proxy": { + "backend_http_extra": [ + "timeout server 6h" + ], + "custom_member_list": [ + "server someserver 1.2.3.4:9292 " + "check inter 2000 rise 2 fall 5 ssl verify " + "required ca-file ca-bundle.trust.crt", + "" + ], + "enabled": True, + "external": False, + "frontend_http_extra": [ + "timeout client 6h" + ], + "mode": "http", + "port": "9292", + "tls_backend": "yes" + }, + "glance_tls_proxy_external": { + "backend_http_extra": [ + "timeout server 6h" + ], + "custom_member_list": [ + "server someserver 1.2.3.4:9292 " + "check inter 2000 rise 2 fall 5 ssl verify " + "required ca-file ca-bundle.trust.crt", + "" + ], + "enabled": True, + "external": True, + "frontend_http_extra": [ + "timeout client 6h" + ], + "mode": "http", + "port": "9292", + "tls_backend": "yes" + } + }, + "healthcheck": { + "interval": "30", + "retries": "3", + "start_period": "5", + "test": [ + "CMD-SHELL", + "healthcheck_curl -u openstack:asdf 1.2.3.4:9293" + ], + "timeout": "30" + }, + "host_in_groups": True, + "image": "centos-source-haproxy:latest", + "volumes": [ + "/etc/localtime:/etc/localtime:ro", + "", + "kolla_logs:/var/log/kolla/" + ] + } + } + expected = { + "glance_api": { + "backend_http_extra": [ + "timeout server 6h" + ], + 'custom_member_list': ['server someserver ' + '1.2.3.4:9292 check inter 2000 ' + 'rise 2 fall 5', + ''], + "enabled": False, + "external": False, + "frontend_http_extra": [ + "timeout client 6h" + ], + "mode": "http", + "port": "9292" + }, + "glance_api_external": { + "backend_http_extra": [ + "timeout server 6h" + ], + 'custom_member_list': ['server someserver ' + '1.2.3.4:9292 check inter 2000 ' + 'rise 2 fall 5', + ''], + "enabled": False, + "external": True, + "frontend_http_extra": [ + "timeout client 6h" + ], + "mode": "http", + "port": "9292" + }, + "glance_tls_proxy": { + "backend_http_extra": [ + "timeout server 6h" + ], + 'custom_member_list': ['server someserver 1.2.3.4:9292 ' + 'check inter 2000 rise 2 fall 5 ' + 'ssl verify required ca-file ' + 'ca-bundle.trust.crt', + ''], + "enabled": True, + "external": False, + "frontend_http_extra": [ + "timeout client 6h" + ], + "mode": "http", + "port": "9292", + "tls_backend": "yes" + }, + "glance_tls_proxy_external": { + "backend_http_extra": [ + "timeout server 6h" + ], + 'custom_member_list': ['server someserver 1.2.3.4:9292 ' + 'check inter 2000 rise 2 fall 5 ' + 'ssl verify required ca-file ' + 'ca-bundle.trust.crt', + ''], + + "enabled": True, + "external": True, + "frontend_http_extra": [ + "timeout client 6h" + ], + "mode": "http", + "port": "9292", + "tls_backend": "yes" + } + } + actual = filters.extract_haproxy_services(self.context, + example_service) + self.assertDictEqual(expected, actual) + + def test_extract_haproxy_services_haproxy_dict_duplicate(self): + example_service = { + "keystone": { + "container_name": "keystone", + "dimensions": {}, + "enabled": True, + "group": "keystone", + "haproxy": { + "keystone_admin": { + "enabled": True, + "external": False, + "listen_port": "35357", + "mode": "http", + "port": "35357", + "tls_backend": True + }, + }, + "healthcheck": { + "interval": "30", + "retries": "3", + "start_period": "5", + "test": [ + "CMD-SHELL", + "healthcheck_curl https://1.2.3.4:5000" + ], + "timeout": "30" + }, + "image": "keystone:latest", + "volumes": [ + "/etc/kolla/keystone/:/var/lib/kolla/config_files/:ro", + "kolla_logs:/var/log/kolla/" + ] + }, + "keystone-ssh": { + "container_name": "keystone_ssh", + "dimensions": {}, + "enabled": True, + "group": "keystone", + "haproxy": { + "keystone_admin": { + "enabled": True, + "external": False, + "listen_port": "35357", + "mode": "http", + "port": "35357", + "tls_backend": True + }, + }, + "healthcheck": { + "interval": "30", + "retries": "3", + "start_period": "5", + "test": [ + "CMD-SHELL", + "healthcheck_listen sshd 8023" + ], + "timeout": "30" + }, + "image": "keystone-ssh:latest", + "volumes": [ + "/etc/kolla/keystone-ssh/:/var/lib/kolla/config_files/:ro", + "kolla_logs:/var/log/kolla/" + ] + } + } + self.assertRaises(exception.FilterError, + filters.extract_haproxy_services, + self.context, example_service) + @mock.patch.object(filters, 'service_enabled') @mock.patch.object(filters, 'service_mapped_to_host') def test_service_enabled_and_mapped_to_host(self, mock_mapped, -- cgit v1.2.3