diff options
| author | Artur Zarzycki <azarzycki@mirantis.com> | 2016-01-13 17:28:53 +0100 |
|---|---|---|
| committer | SamYaple <sam@yaple.net> | 2016-01-20 16:58:01 +0000 |
| commit | ef971bff5135b88e3451eb451418327e672f6d8b (patch) | |
| tree | 6a30ce881e4ff0dd9ca470af75e6b40aa3b70074 /docker/nova | |
| parent | 08f907a2cc67d61ae354c6ba8de1905c4f1b96c8 (diff) | |
| download | kolla-ef971bff5135b88e3451eb451418327e672f6d8b.tar.gz kolla-ef971bff5135b88e3451eb451418327e672f6d8b.zip | |
Fix permissions to /var/lib/nova/
Due to changes with the drop-root work, we lost the ability to write
to /var/lib/nova/*. This fixes those permissions and ensures cross
container talk works properly between nova_libvirt and nova_compute
Additionally, this fixes another issue introduced which saw that
nova-compute could not run sudo commands as it did not have a proper
sudoers entry
Testing from previous deploys means you need a fresh environment. You
have to remove all of the named volumes that kolla created in docker.
Check these with `docker volume ls`
Signed-off-by: Hui Kang <kangh@us.ibm.com>
Signed-off-by: Artur Zarzycki <azarzycki@mirantis.com>
Co-Authored-By: Sam Yaple <sam@yaple.net>
Co-Authored-By: Hui Kang <kangh@us.ibm.com>
Closes-Bug: #1533350
Change-Id: I7f864c448a2414e0b5d89f48337be411b891df35
Diffstat (limited to 'docker/nova')
| -rw-r--r-- | docker/nova/nova-base/Dockerfile.j2 | 4 | ||||
| -rw-r--r-- | docker/nova/nova-base/nova_sudoers | 1 | ||||
| -rw-r--r-- | docker/nova/nova-compute/Dockerfile.j2 | 6 | ||||
| -rw-r--r-- | docker/nova/nova-compute/extend_start.sh | 9 | ||||
| -rw-r--r-- | docker/nova/nova-compute/nova_compute_sudoers | 1 |
5 files changed, 21 insertions, 0 deletions
diff --git a/docker/nova/nova-base/Dockerfile.j2 b/docker/nova/nova-base/Dockerfile.j2 index 898dd3736..0f9aedd94 100644 --- a/docker/nova/nova-base/Dockerfile.j2 +++ b/docker/nova/nova-base/Dockerfile.j2 @@ -52,6 +52,10 @@ RUN ln -s nova-base-source/* nova \ && cp -r /nova/etc/nova/* /etc/nova/ \ && chown -R nova: /etc/nova /var/log/nova /home/nova /var/lib/nova +COPY nova_sudoers /etc/sudoers.d/nova_sudoers +RUN chmod 750 /etc/sudoers.d \ + && chmod 440 /etc/sudoers.d/nova_sudoers + {% endif %} RUN usermod -a -G kolla nova diff --git a/docker/nova/nova-base/nova_sudoers b/docker/nova/nova-base/nova_sudoers new file mode 100644 index 000000000..6d73da6d3 --- /dev/null +++ b/docker/nova/nova-base/nova_sudoers @@ -0,0 +1 @@ +nova ALL = (root) NOPASSWD: /var/lib/kolla/venv/bin/nova-rootwrap /etc/nova/rootwrap.conf * diff --git a/docker/nova/nova-compute/Dockerfile.j2 b/docker/nova/nova-compute/Dockerfile.j2 index 029a435c7..aad9c8ba8 100644 --- a/docker/nova/nova-compute/Dockerfile.j2 +++ b/docker/nova/nova-compute/Dockerfile.j2 @@ -50,6 +50,12 @@ RUN /var/lib/kolla/venv/bin/pip --no-cache-dir install --upgrade -c requirements {% endif %} +COPY nova_compute_sudoers /etc/sudoers.d/nova_compute_sudoers +COPY extend_start.sh /usr/local/bin/kolla_extend_start +RUN chmod 755 /usr/local/bin/kolla_extend_start \ + && chmod 750 /etc/sudoers.d \ + && chmod 440 /etc/sudoers.d/nova_compute_sudoers + {{ include_footer }} USER nova diff --git a/docker/nova/nova-compute/extend_start.sh b/docker/nova/nova-compute/extend_start.sh new file mode 100644 index 000000000..084e76a19 --- /dev/null +++ b/docker/nova/nova-compute/extend_start.sh @@ -0,0 +1,9 @@ +#!/bin/bash + +# Bootstrap and exit if KOLLA_BOOTSTRAP variable is set. This catches all cases +# of the KOLLA_BOOTSTRAP variable being set, including empty. +if [[ "${!KOLLA_BOOTSTRAP[@]}" ]]; then + sudo chown nova: /var/lib/nova/ + mkdir /var/lib/nova/instances + exit 0 +fi diff --git a/docker/nova/nova-compute/nova_compute_sudoers b/docker/nova/nova-compute/nova_compute_sudoers new file mode 100644 index 000000000..a7fb7b864 --- /dev/null +++ b/docker/nova/nova-compute/nova_compute_sudoers @@ -0,0 +1 @@ +%kolla ALL=(root) NOPASSWD: /usr/bin/chown nova\: /var/lib/nova/, /bin/chown nova\: /var/lib/nova/ |