openstack/openstack-helm
Code Issues Proposed changes

Enable Apparmor to Cinder

Browse Source 
Co-Authored by gage Hugo <gagehugo@gmail.com>.

This Patchset creates Zuul Gate Jobs for apparmor to support Cinder.

Change-Id: I7705512a3b50560b183e19f0868be40078241cdd
This commit is contained in:
dt241s@att.com 2020-02-22 02:55:52 +00:00 committed by diwakar thyagaraj
parent 4a5374aebd
commit 1c46490094
8 changed files with 55 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
cinder/templates/deployment-api.yaml
View File

@ -45,6 +45,7 @@ spec:
{{ tuple $envAll | include "helm-toolkit.snippets.release_uuid" | indent 8 }}
configmap-bin-hash: {{ tuple "configmap-bin.yaml" . | include "helm-toolkit.utils.hash" }}
configmap-etc-hash: {{ tuple "configmap-etc.yaml" . | include "helm-toolkit.utils.hash" }}
{{ dict "envAll" $envAll "podName" "cinder-api" "containerNames" (list "cinder-api" "ceph-coordination-volume-perms" "init") | include "helm-toolkit.snippets.kubernetes_mandatory_access_control_annotation" | indent 8 }}
spec:
serviceAccountName: {{ $serviceAccountName }}
{{ dict "envAll" $envAll "application" "cinder_api" | include "helm-toolkit.snippets.kubernetes_pod_security_context" | indent 6 }}

1
cinder/templates/deployment-backup.yaml
View File

@ -45,6 +45,7 @@ spec:
{{ tuple $envAll | include "helm-toolkit.snippets.release_uuid" | indent 8 }}
configmap-bin-hash: {{ tuple "configmap-bin.yaml" . | include "helm-toolkit.utils.hash" }}
configmap-etc-hash: {{ tuple "configmap-etc.yaml" . | include "helm-toolkit.utils.hash" }}
{{ dict "envAll" $envAll "podName" "cinder-backup" "containerNames" (list "cinder-backup" "ceph-coordination-volume-perms" "init") | include "helm-toolkit.snippets.kubernetes_mandatory_access_control_annotation" | indent 8 }}
spec:
serviceAccountName: {{ $serviceAccountName }}
{{ dict "envAll" $envAll "application" "cinder_backup" | include "helm-toolkit.snippets.kubernetes_pod_security_context" | indent 6 }}

1
cinder/templates/deployment-scheduler.yaml
View File

@ -45,6 +45,7 @@ spec:
{{ tuple $envAll | include "helm-toolkit.snippets.release_uuid" | indent 8 }}
configmap-bin-hash: {{ tuple "configmap-bin.yaml" . | include "helm-toolkit.utils.hash" }}
configmap-etc-hash: {{ tuple "configmap-etc.yaml" . | include "helm-toolkit.utils.hash" }}
{{ dict "envAll" $envAll "podName" "cinder-scheduler" "containerNames" (list "cinder-scheduler" "ceph-coordination-volume-perms" "init") | include "helm-toolkit.snippets.kubernetes_mandatory_access_control_annotation" | indent 8 }}
spec:
serviceAccountName: {{ $serviceAccountName }}
{{ dict "envAll" $envAll "application" "cinder_scheduler" | include "helm-toolkit.snippets.kubernetes_pod_security_context" | indent 6 }}

1
cinder/templates/deployment-volume.yaml
View File

@ -45,6 +45,7 @@ spec:
{{ tuple $envAll | include "helm-toolkit.snippets.release_uuid" | indent 8 }}
configmap-bin-hash: {{ tuple "configmap-bin.yaml" . | include "helm-toolkit.utils.hash" }}
configmap-etc-hash: {{ tuple "configmap-etc.yaml" . | include "helm-toolkit.utils.hash" }}
{{ dict "envAll" $envAll "podName" "cinder-volume" "containerNames" (list "cinder-volume" "ceph-coordination-volume-perms" "init-cinder-conf" "init" ) | include "helm-toolkit.snippets.kubernetes_mandatory_access_control_annotation" | indent 8 }}
spec:
serviceAccountName: {{ $serviceAccountName }}
{{ dict "envAll" $envAll "application" "cinder_volume" | include "helm-toolkit.snippets.kubernetes_pod_security_context" | indent 6 }}

2
cinder/templates/job-backup-storage-init.yaml
View File

@ -59,6 +59,8 @@ spec:
metadata:
labels:
{{ tuple $envAll "cinder" "storage-init" | include "helm-toolkit.snippets.kubernetes_metadata_labels" | indent 8 }}
annotations:
{{ dict "envAll" $envAll "podName" "cinder-backup-storage-init" "containerNames" (list "cinder-backup-storage-init" "init") | include "helm-toolkit.snippets.kubernetes_mandatory_access_control_annotation" | indent 8 }}
spec:
serviceAccountName: {{ $serviceAccountName }}
{{ dict "envAll" $envAll "application" "cinder" | include "helm-toolkit.snippets.kubernetes_pod_security_context" | indent 6 }}

23
cinder/values_overrides/apparmor.yaml Normal file
View File

@ -0,0 +1,23 @@
pod:
mandatory_access_control:
type: apparmor
cinder-api:
cinder-api: runtime/default
ceph-coordination-volume-perms: runtime/default
init: runtime/default
cinder-backup:
cinder-backup: runtime/default
ceph-coordination-volume-perms: runtime/default
init: runtime/default
cinder-scheduler:
cinder-scheduler: runtime/default
ceph-coordination-volume-perms: runtime/default
init: runtime/default
cinder-volume:
cinder-volume: runtime/default
ceph-coordination-volume-perms: runtime/default
init-cinder-conf: runtime/default
init: runtime/default
cinder-backup-storage-init:
cinder-backup-storage-init: runtime/default
init: runtime/default

24
zuul.d/jobs-openstack-helm.yaml
View File

@ -291,6 +291,30 @@
- ./tools/deployment/developer/common/170-setup-gateway.sh
- ./tools/deployment/developer/common/900-use-it.sh
- job:
name: openstack-helm-apparmor-cinder
parent: openstack-helm-chart-deploy
run: tools/gate/playbooks/osh-gate-runner.yaml
timeout: 9600
vars:
osh_params:
openstack_release: stein
container_distro_name: ubuntu
container_distro_version: bionic
feature_gates: apparmor
gate_scripts:
- ./tools/deployment/common/install-packages.sh
- ./tools/deployment/common/deploy-k8s.sh
- ./tools/deployment/common/setup-client.sh
- ./tools/deployment/component/ceph/ceph.sh
- ./tools/deployment/component/ceph/ceph-ns-activate.sh
- ./tools/deployment/component/common/ingress.sh
- ./tools/deployment/component/common/mariadb.sh
- ./tools/deployment/component/common/memcached.sh
- ./tools/deployment/component/common/rabbitmq.sh
- ./tools/deployment/component/keystone/keystone.sh
- ./tools/deployment/component/cinder/cinder.sh
- job:
name: openstack-helm-netpol-compute-kit-train
parent: openstack-helm-chart-deploy

2
zuul.d/project.yaml
View File

@ -46,6 +46,8 @@
- openstack-helm-horizon
- openstack-helm-apparmor:
voting: false
- openstack-helm-apparmor-cinder:
voting: false
- openstack-helm-netpol-compute-kit
- openstack-helm-netpol-compute-kit-train
- openstack-helm-netpol-cinder