From ef971bff5135b88e3451eb451418327e672f6d8b Mon Sep 17 00:00:00 2001 From: Artur Zarzycki Date: Wed, 13 Jan 2016 17:28:53 +0100 Subject: Fix permissions to /var/lib/nova/ Due to changes with the drop-root work, we lost the ability to write to /var/lib/nova/*. This fixes those permissions and ensures cross container talk works properly between nova_libvirt and nova_compute Additionally, this fixes another issue introduced which saw that nova-compute could not run sudo commands as it did not have a proper sudoers entry Testing from previous deploys means you need a fresh environment. You have to remove all of the named volumes that kolla created in docker. Check these with `docker volume ls` Signed-off-by: Hui Kang Signed-off-by: Artur Zarzycki Co-Authored-By: Sam Yaple Co-Authored-By: Hui Kang Closes-Bug: #1533350 Change-Id: I7f864c448a2414e0b5d89f48337be411b891df35 --- docker/nova/nova-base/Dockerfile.j2 | 4 ++++ docker/nova/nova-base/nova_sudoers | 1 + docker/nova/nova-compute/Dockerfile.j2 | 6 ++++++ docker/nova/nova-compute/extend_start.sh | 9 +++++++++ docker/nova/nova-compute/nova_compute_sudoers | 1 + 5 files changed, 21 insertions(+) create mode 100644 docker/nova/nova-base/nova_sudoers create mode 100644 docker/nova/nova-compute/extend_start.sh create mode 100644 docker/nova/nova-compute/nova_compute_sudoers (limited to 'docker') diff --git a/docker/nova/nova-base/Dockerfile.j2 b/docker/nova/nova-base/Dockerfile.j2 index 898dd3736..0f9aedd94 100644 --- a/docker/nova/nova-base/Dockerfile.j2 +++ b/docker/nova/nova-base/Dockerfile.j2 @@ -52,6 +52,10 @@ RUN ln -s nova-base-source/* nova \ && cp -r /nova/etc/nova/* /etc/nova/ \ && chown -R nova: /etc/nova /var/log/nova /home/nova /var/lib/nova +COPY nova_sudoers /etc/sudoers.d/nova_sudoers +RUN chmod 750 /etc/sudoers.d \ + && chmod 440 /etc/sudoers.d/nova_sudoers + {% endif %} RUN usermod -a -G kolla nova diff --git a/docker/nova/nova-base/nova_sudoers b/docker/nova/nova-base/nova_sudoers new file mode 100644 index 000000000..6d73da6d3 --- /dev/null +++ b/docker/nova/nova-base/nova_sudoers @@ -0,0 +1 @@ +nova ALL = (root) NOPASSWD: /var/lib/kolla/venv/bin/nova-rootwrap /etc/nova/rootwrap.conf * diff --git a/docker/nova/nova-compute/Dockerfile.j2 b/docker/nova/nova-compute/Dockerfile.j2 index 029a435c7..aad9c8ba8 100644 --- a/docker/nova/nova-compute/Dockerfile.j2 +++ b/docker/nova/nova-compute/Dockerfile.j2 @@ -50,6 +50,12 @@ RUN /var/lib/kolla/venv/bin/pip --no-cache-dir install --upgrade -c requirements {% endif %} +COPY nova_compute_sudoers /etc/sudoers.d/nova_compute_sudoers +COPY extend_start.sh /usr/local/bin/kolla_extend_start +RUN chmod 755 /usr/local/bin/kolla_extend_start \ + && chmod 750 /etc/sudoers.d \ + && chmod 440 /etc/sudoers.d/nova_compute_sudoers + {{ include_footer }} USER nova diff --git a/docker/nova/nova-compute/extend_start.sh b/docker/nova/nova-compute/extend_start.sh new file mode 100644 index 000000000..084e76a19 --- /dev/null +++ b/docker/nova/nova-compute/extend_start.sh @@ -0,0 +1,9 @@ +#!/bin/bash + +# Bootstrap and exit if KOLLA_BOOTSTRAP variable is set. This catches all cases +# of the KOLLA_BOOTSTRAP variable being set, including empty. +if [[ "${!KOLLA_BOOTSTRAP[@]}" ]]; then + sudo chown nova: /var/lib/nova/ + mkdir /var/lib/nova/instances + exit 0 +fi diff --git a/docker/nova/nova-compute/nova_compute_sudoers b/docker/nova/nova-compute/nova_compute_sudoers new file mode 100644 index 000000000..a7fb7b864 --- /dev/null +++ b/docker/nova/nova-compute/nova_compute_sudoers @@ -0,0 +1 @@ +%kolla ALL=(root) NOPASSWD: /usr/bin/chown nova\: /var/lib/nova/, /bin/chown nova\: /var/lib/nova/ -- cgit v1.2.3