Add Docker default AppArmor profile to Fluentbit and Elasticsearch

Change-Id: I21efbf8d434f6245eef04308973af4e7ec0b2380
Co-authored-by: ld366r@att.com

fluent-logging/templates/daemonset-fluent-bit.yaml

@@ -93,6 +93,7 @@ spec:
 {{ tuple $envAll | include "helm-toolkit.snippets.release_uuid" | indent 8 }}
         configmap-bin-hash: {{ tuple "configmap-bin.yaml" . | include "helm-toolkit.utils.hash" }}
         configmap-etc-hash: {{ tuple "configmap-etc.yaml" . | include "helm-toolkit.utils.hash" }}
+{{ dict "envAll" $envAll "podName" "fluentbit" "containerNames" (list "fluentbit") | include "helm-toolkit.snippets.kubernetes_mandatory_access_control_annotation" | indent 8 }}
     spec:
 {{ dict "envAll" $envAll "application" "daemon" | include "helm-toolkit.snippets.kubernetes_pod_security_context" | indent 6 }}
       serviceAccountName: {{ $serviceAccountName }}

tools/deployment/apparmor/090-elasticsearch.sh

@@ -0,0 +1,78 @@
+#!/bin/bash
+
+# Copyright 2017 The Openstack-Helm Authors.
+#
+#    Licensed under the Apache License, Version 2.0 (the "License"); you may
+#    not use this file except in compliance with the License. You may obtain
+#    a copy of the License at
+#
+#         http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+#    License for the specific language governing permissions and limitations
+#    under the License.
+
+set -xe
+
+#NOTE: Lint and package chart
+make elasticsearch
+
+#NOTE: Deploy command
+tee /tmp/elasticsearch.yaml << EOF
+dependencies:
+  static:
+    tests:
+      jobs: null
+storage:
+  enabled: false
+pod:
+  mandatory_access_control:
+    type: apparmor
+    elasticsearch-master:
+      elasticsearch-master: localhost/docker-default
+    elasticsearch-data:
+      elasticsearch-data: localhost/docker-default
+    elasticsearch-client:
+      elasticsearch-client: localhost/docker-default
+  replicas:
+    data: 1
+    master: 2
+conf:
+  curator:
+    schedule:  "0 */6 * * *"
+    action_file:
+      actions:
+        1:
+          action: delete_indices
+          description: >-
+            "Delete indices older than 365 days"
+          options:
+            timeout_override:
+            continue_if_exception: False
+            ignore_empty_list: True
+            disable_action: True
+          filters:
+          - filtertype: pattern
+            kind: prefix
+            value: logstash-
+          - filtertype: age
+            source: name
+            direction: older
+            timestring: '%Y.%m.%d'
+            unit: days
+            unit_count: 365
+
+EOF
+helm upgrade --install elasticsearch ./elasticsearch \
+    --namespace=osh-infra \
+    --values=/tmp/elasticsearch.yaml
+
+#NOTE: Wait for deploy
+./tools/deployment/common/wait-for-pods.sh osh-infra
+
+#NOTE: Validate Deployment info
+helm status elasticsearch
+
+helm test elasticsearch

tools/deployment/apparmor/100-fluent-logging.sh

@@ -0,0 +1,40 @@
+#!/bin/bash
+
+# Copyright 2019 The Openstack-Helm Authors.
+#
+#    Licensed under the Apache License, Version 2.0 (the "License"); you may
+#    not use this file except in compliance with the License. You may obtain
+#    a copy of the License at
+#
+#         http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+#    License for the specific language governing permissions and limitations
+#    under the License.
+set -xe
+
+#NOTE: Lint and package chart
+make fluent-logging
+
+tee /tmp/fluent-logging.yaml <<EOF
+pod:
+  mandatory_access_control:
+    type: apparmor
+    fluentbit:
+      fluentbit: localhost/docker-default
+EOF
+
+#NOTE: Deploy command
+helm upgrade --install fluent-logging ./fluent-logging \
+    --namespace=osh-infra \
+    --values=/tmp/fluent-logging.yaml
+
+#NOTE: Wait for deploy
+./tools/deployment/common/wait-for-pods.sh osh-infra
+
+#NOTE: Validate Deployment info
+helm status fluent-logging
+
+helm test fluent-logging

zuul.d/jobs.yaml

@@ -213,7 +213,8 @@
         - ./tools/deployment/apparmor/060-prometheus-node-exporter.sh
         - ./tools/deployment/apparmor/070-prometheus-openstack-exporter.sh
         - ./tools/deployment/apparmor/080-prometheus-process-exporter.sh
-
+        - ./tools/deployment/apparmor/090-elasticsearch.sh
+        - ./tools/deployment/apparmor/100-fluent-logging.sh
 
 - job:
     name: openstack-helm-infra-openstack-support