openstack/bifrost
Code Issues Proposed changes

Add missing ironic-inspector bits

Browse Source 
- rootwrap configuration bits from source repository
- sudoers rule for ironic-inspector-rootwrap

Change-Id: Ic3f7e4a6cc9e9d9dbe1b0910707e3652b97ef257
Depends-On: I405add3ded3035c732a8227acda2437bf692cc95
This commit is contained in:
Olivier Bourdon 2018-08-07 13:20:12 +02:00
parent 6f27563d78
commit ad4d61bb4d
2 changed files with 21 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
playbooks/roles/bifrost-ironic-install/tasks/inspector_bootstrap.yml
View File

@ -39,6 +39,21 @@
group=ironic
mode=0755
state=directory
# Note(TheJulia): The rootwrap copies will need to be re-tooled
# to possibly directly retreive current files if a source install
# is not utilized.
- name: "Copy rootwrap.conf from ironic-inspector source folder"
copy:
src: "{{ ironicinspector_git_folder }}/rootwrap.conf"
dest: "/etc/ironic-inspector/rootwrap.conf"
remote_src: yes
mode: 0644
owner: root
group: root
# Note(ashestakov): "copy" module in ansible doesn't support recursive
# copying on remote host. "cp" command used instead.
- name: "Copy rootwrap.d contents from ironic-inspector source folder"
command: cp -r "{{ ironicinspector_git_folder }}/rootwrap.d/" "/etc/ironic-inspector/rootwrap.d"
- name: "Populate keystone for ironic-inspector "
include: keystone_setup_inspector.yml

8
playbooks/roles/bifrost-ironic-install/tasks/ironic_config.yml
View File

@ -45,8 +45,12 @@
when: enable_venv | bool == true
with_items:
- "{{ bifrost_venv_dir }}/bin/ironic-rootwrap"
- "{{ bifrost_venv_dir }}/bin/ironic-inspector-rootwrap"
- name: "Set sudoers for rootwrap"
lineinfile:
dest: /etc/sudoers
regexp: '^ironic(.*)/etc/ironic/rootwrap.conf(.*)'
line: "ironic ALL = (root) NOPASSWD: {{ ironic_rootwrap_dir }}/ironic-rootwrap /etc/ironic/rootwrap.conf *"
regexp: "{{ item.regexp }}"
line: "{{ item.line }}"
with_items:
- { regexp: '^ironic(.*)/ironic-rootwrap /etc/ironic/rootwrap.conf(.*)', line: "ironic ALL = (root) NOPASSWD: {{ ironic_rootwrap_dir }}/ironic-rootwrap /etc/ironic/rootwrap.conf *" }
- { regexp: '^ironic(.*)/ironic-inspector-rootwrap /etc/ironic-inspector/rootwrap.conf(.*)', line: "ironic ALL = (root) NOPASSWD: {{ ironic_rootwrap_dir }}/ironic-inspector-rootwrap /etc/ironic-inspector/rootwrap.conf *" }