Implement graphical console read-only support

Change-Id: I321c1d0e6bce4e66107f92fc67c95bc38a0a9ad9
Related-Bug: 2086715

ironic/conf/vnc.py

@@ -71,6 +71,12 @@ opts = [
         default=['none'],
         help='The allowed authentication schemes to use with proxied '
              'VNC connections'),
+    cfg.BoolOpt(
+        'read_only',
+        default=False,
+        help='When True, keyboard and mouse events will not be passed '
+             'to the console.'
+    ),
     cfg.IntOpt(
         'token_timeout',
         default=600,

ironic/console/container/ironic-console.container.template

@@ -6,6 +6,7 @@ Image={{ image }}
 PublishPort={{ port }}
 Environment=APP={{ app }}
 Environment=APP_INFO='{{ app_info }}'
+Environment=READ_ONLY={{ read_only }}
 
 [Install]
 WantedBy=default.target

ironic/console/container/systemd.py

@@ -192,6 +192,7 @@ class SystemdConsoleContainer(base.BaseConsoleContainer):
                 'port': CONF.vnc.systemd_container_publish_port,
                 'app': app_name,
                 'app_info': json.dumps(app_info),
+                'read_only': CONF.vnc.read_only,
             }
 
             LOG.debug('Writing %s', container_file)

ironic/tests/unit/console/container/test_console_container.py

@@ -183,6 +183,10 @@ class TestSystemdConsoleContainer(base.TestCase):
             'console_image',
             'localhost/ironic-vnc-container',
             group='vnc')
+        CONF.set_override(
+            'read_only',
+            True,
+            group='vnc')
 
         uuid = '1234'
         container_path = self.provider._container_path(uuid)
@@ -200,6 +204,7 @@ Image=localhost/ironic-vnc-container
 PublishPort=192.0.2.2::5900
 Environment=APP=fake
 Environment=APP_INFO='{}'
+Environment=READ_ONLY=True
 
 [Install]
 WantedBy=default.target""", f.read())

releasenotes/notes/vnc_read_only-e0f18c5d0d356515.yaml

@@ -0,0 +1,5 @@
+---
+features:
+  - |
+    When ``ironic.conf`` ``[vnc]read_only=True`` is set, keyboard and mouse
+    events will not be passed to the console.

tools/vnc-container/bin/start-browser-x11vnc.sh

@@ -2,4 +2,10 @@
 
 set -eux
 
-x11vnc -nevershared -forever -afteraccept 'start-selenium-browser.py &' -gone 'killall -s SIGTERM python3'
+if [ "$READ_ONLY" = "True" ]; then
+    viewonly="-viewonly"
+else
+    viewonly=""
+fi
+
+x11vnc $viewonly -nevershared -forever -afteraccept 'start-selenium-browser.py &' -gone 'killall -s SIGTERM python3'