openstack/openstack-helm-infra
Code Issues Proposed changes

Merge "Enable AppArmor profile to Openvswitch."

Browse Source
This commit is contained in:
Zuul 2020-03-17 19:57:10 +00:00 committed by Gerrit Code Review
commit 1a3de19e4f
4 changed files with 13 additions and 46 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
openvswitch/templates/daemonset-ovs-db.yaml
View File

@ -54,7 +54,7 @@ spec:
annotations: annotations:
{{ tuple $envAll | include "helm-toolkit.snippets.release_uuid" | indent 8 }} {{ tuple $envAll | include "helm-toolkit.snippets.release_uuid" | indent 8 }}
configmap-bin-hash: {{ tuple "configmap-bin.yaml" . | include "helm-toolkit.utils.hash" }} configmap-bin-hash: {{ tuple "configmap-bin.yaml" . | include "helm-toolkit.utils.hash" }}
{{ dict "envAll" $envAll "podName" "openvswitch-db" "containerNames" (list "openvswitch-db") | include "helm-toolkit.snippets.kubernetes_mandatory_access_control_annotation" | indent 8 }} {{ dict "envAll" $envAll "podName" "openvswitch-db" "containerNames" (list "openvswitch-db" "openvswitch-db-perms") | include "helm-toolkit.snippets.kubernetes_mandatory_access_control_annotation" | indent 8 }}
spec: spec:
shareProcessNamespace: true shareProcessNamespace: true
serviceAccountName: {{ $serviceAccountName }} serviceAccountName: {{ $serviceAccountName }}

2
openvswitch/templates/daemonset-ovs-vswitchd.yaml
View File

@ -62,7 +62,7 @@ spec:
annotations: annotations:
{{ tuple $envAll | include "helm-toolkit.snippets.release_uuid" | indent 8 }} {{ tuple $envAll | include "helm-toolkit.snippets.release_uuid" | indent 8 }}
configmap-bin-hash: {{ tuple "configmap-bin.yaml" . | include "helm-toolkit.utils.hash" }} configmap-bin-hash: {{ tuple "configmap-bin.yaml" . | include "helm-toolkit.utils.hash" }}
{{ dict "envAll" $envAll "podName" "openvswitch-vswitchd" "containerNames" (list "openvswitch-vswitchd") | include "helm-toolkit.snippets.kubernetes_mandatory_access_control_annotation" | indent 8 }} {{ dict "envAll" $envAll "podName" "openvswitch-vswitchd" "containerNames" (list "openvswitch-vswitchd" "openvswitch-vswitchd-modules") | include "helm-toolkit.snippets.kubernetes_mandatory_access_control_annotation" | indent 8 }}
spec: spec:
shareProcessNamespace: true shareProcessNamespace: true
serviceAccountName: {{ $serviceAccountName }} serviceAccountName: {{ $serviceAccountName }}

10
openvswitch/values_overrides/apparmor.yaml Normal file
View File

@ -0,0 +1,10 @@
#NOTE: Enable this with the correct policy
pod:
mandatory_access_control:
type: apparmor
openvswitch-vswitchd:
openvswitch-vswitchd: runtime/default
openvswitch-vswitchd-modules: runtime/default
openvswitch-db:
openvswitch-db: runtime/default
openvswitch-db-perms: runtime/default

44
tools/deployment/apparmor/120-openvswitch.sh
View File

@ -1,44 +0,0 @@
#!/bin/bash
# Copyright 2019 The Openstack-Helm Authors.
#
# Licensed under the Apache License, Version 2.0 (the "License"); you may
# not use this file except in compliance with the License. You may obtain
# a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
# License for the specific language governing permissions and limitations
# under the License.
set -xe
#NOTE: Lint and package chart
make openvswitch
#NOTE: Deploy command
tee /tmp/openvswitch.yaml <<EOF
pod:
mandatory_access_control:
type: apparmor
openvswitch-vswitchd:
openvswitch-vswitchd: runtime/default
openvswitch-db:
openvswitch-db: runtime/default
EOF
#NOTE: Deploy command
helm upgrade --install openvswitch ./openvswitch \
--namespace=osh-infra \
--values=/tmp/openvswitch.yaml
#NOTE: Wait for deploy
./tools/deployment/common/wait-for-pods.sh osh-infra
#NOTE: Validate Deployment info
helm status openvswitch
helm test openvswitch

1
tools/deployment/apparmor/120-openvswitch.sh Symbolic link
View File

@ -0,0 +1 @@
../openstack-support/060-openvswitch.sh