6285b6c638
This change adds the ability to effectively use the PrivateNetwork functionality systemd provides for services. Now, if enabled, services can be created in a network namespace which isolates it from the reset of the host. Additional options have been added allowing access into the network namespace over ephemeral devices as needed. Highlights: * Isolated private networking for services will sandbox using a stand alone namespace which has no access to anything via the network. * Access into a private namespace can be provided over a single network interface which can be IP'd via local DHCP + NAT or using an upstream DHCP server. * Tests have been added to exercise the new functionality. All of the funcality has been documented in the defaults of this role. Change-Id: I6751765131f32393a1605eb2100bec46199d980a Signed-off-by: Kevin Carter <kevin@cloudnull.com>
31 lines
779 B
Django/Jinja
31 lines
779 B
Django/Jinja
[Unit]
|
|
Description=Named network namespace %I
|
|
Documentation=https://github.com/openstack/ansible-role-systemd_service
|
|
After=syslog.target
|
|
After=network.target
|
|
{% if not (systemd_PrivateNetworkIsolated | bool) %}
|
|
BindsTo=systemd-netns-access@%i.service
|
|
{% endif %}
|
|
JoinsNamespaceOf=systemd-netns@%i.service
|
|
|
|
|
|
[Service]
|
|
Type=oneshot
|
|
RemainAfterExit=true
|
|
PrivateNetwork=true
|
|
|
|
# Start process
|
|
ExecStartPre=-/usr/bin/env ip netns delete %I
|
|
ExecStart=/usr/bin/env ip netns add %I
|
|
ExecStart=/usr/bin/env ip netns exec %I ip link set lo up
|
|
ExecStart=/usr/bin/env umount /var/run/netns/%I
|
|
ExecStart=/usr/bin/env mount --bind /proc/self/ns/net /var/run/netns/%I
|
|
|
|
# Stop process
|
|
ExecStop=/usr/bin/env ip netns delete %I
|
|
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|
|
WantedBy=network-online.target
|