diff options
| author | Mark Goddard <mark@stackhpc.com> | 2017-03-31 14:32:43 +0100 |
|---|---|---|
| committer | Mark Goddard <mark@stackhpc.com> | 2017-03-31 14:37:30 +0100 |
| commit | 1c3336c8c9c1a77964041730973b4839c9a4c441 (patch) | |
| tree | 307f7b105d95418a3c9e0f18c07fed85fc19a081 /docker/ironic | |
| parent | f5be229ae65beb9887ea68782bec07d73ff01d42 (diff) | |
| download | kolla-1c3336c8c9c1a77964041730973b4839c9a4c441.tar.gz kolla-1c3336c8c9c1a77964041730973b4839c9a4c441.zip | |
Use separate sudoers for ironic conductor modprobe
The original fix (8b101b28a1040fd6b4753c09364106274d7e6e09) for bug
1676466 added unnecessary entries to the sudoers file in the
ironic-base image. These included a rootwrap entry pointing to the
virtualenv used by source type images (not present in binary type
images) and a modprobe iscsi_tcp which is only required by the
ironic-conductor image.
This change adds a single sudoers file for the iscsi_tcp modprobe
to the ironic-conductor image and reverts to the common pattern of
adding a sudoers file to ironic-base only for source type images.
Change-Id: I89f1c4bd741de9ba184f14fcbcb708636616e420
Closes-bug: #1678143
Related-bug: #1676466
Related-bug: #1667864
Diffstat (limited to 'docker/ironic')
| -rw-r--r-- | docker/ironic/ironic-base/Dockerfile.j2 | 4 | ||||
| -rw-r--r-- | docker/ironic/ironic-base/ironic_sudoers | 2 | ||||
| -rw-r--r-- | docker/ironic/ironic-conductor/Dockerfile.j2 | 4 | ||||
| -rw-r--r-- | docker/ironic/ironic-conductor/iscsi_tcp_sudoers | 1 |
4 files changed, 7 insertions, 4 deletions
diff --git a/docker/ironic/ironic-base/Dockerfile.j2 b/docker/ironic/ironic-base/Dockerfile.j2 index ddde46b80..e192aba48 100644 --- a/docker/ironic/ironic-base/Dockerfile.j2 +++ b/docker/ironic/ironic-base/Dockerfile.j2 @@ -31,12 +31,12 @@ RUN ln -s ironic-base-source/* ironic \ && chown -R ironic: /etc/ironic \ && sed -i 's|^exec_dirs.*|exec_dirs=/var/lib/kolla/venv/bin,/sbin,/usr/sbin,/bin,/usr/bin,/usr/local/bin,/usr/local/sbin|g' /etc/ironic/rootwrap.conf -{% endif %} - ADD ironic_sudoers /etc/sudoers.d/kolla_ironic_sudoers RUN chmod 750 /etc/sudoers.d \ && chmod 440 /etc/sudoers.d/kolla_ironic_sudoers +{% endif %} + COPY extend_start.sh /usr/local/bin/kolla_extend_start RUN touch /usr/local/bin/kolla_ironic_extend_start \ diff --git a/docker/ironic/ironic-base/ironic_sudoers b/docker/ironic/ironic-base/ironic_sudoers index 573aa2194..3e7c843f3 100644 --- a/docker/ironic/ironic-base/ironic_sudoers +++ b/docker/ironic/ironic-base/ironic_sudoers @@ -1 +1 @@ -ironic ALL = (root) NOPASSWD: /var/lib/kolla/venv/bin/ironic-rootwrap /etc/ironic/rootwrap.conf *, /usr/sbin/modprobe iscsi_tcp, /sbin/modprobe iscsi_tcp +ironic ALL = (root) NOPASSWD: /var/lib/kolla/venv/bin/ironic-rootwrap /etc/ironic/rootwrap.conf * diff --git a/docker/ironic/ironic-conductor/Dockerfile.j2 b/docker/ironic/ironic-conductor/Dockerfile.j2 index ef309421c..35a26cf1d 100644 --- a/docker/ironic/ironic-conductor/Dockerfile.j2 +++ b/docker/ironic/ironic-conductor/Dockerfile.j2 @@ -90,7 +90,9 @@ RUN {{ macros.install_pip(ironic_conductor_pip_packages | customizable("pip_pack {{ macros.install_packages(ironic_conductor_packages | customizable("packages")) }} COPY extend_start.sh /usr/local/bin/kolla_ironic_extend_start -RUN chmod 755 /usr/local/bin/kolla_ironic_extend_start +COPY iscsi_tcp_sudoers /etc/sudoers.d/kolla_iscsi_tcp_sudoers +RUN chmod 755 /usr/local/bin/kolla_ironic_extend_start \ + && chmod 440 /etc/sudoers.d/kolla_iscsi_tcp_sudoers {% block ironic_conductor_footer %}{% endblock %} {% block footer %}{% endblock %} diff --git a/docker/ironic/ironic-conductor/iscsi_tcp_sudoers b/docker/ironic/ironic-conductor/iscsi_tcp_sudoers new file mode 100644 index 000000000..75f5e3411 --- /dev/null +++ b/docker/ironic/ironic-conductor/iscsi_tcp_sudoers @@ -0,0 +1 @@ +ironic ALL = (root) NOPASSWD: /usr/sbin/modprobe iscsi_tcp, /sbin/modprobe iscsi_tcp |