diff --git a/neutron/templates/daemonset-ovs-agent.yaml b/neutron/templates/daemonset-ovs-agent.yaml index 9c815faa73..9508af0fa8 100644 --- a/neutron/templates/daemonset-ovs-agent.yaml +++ b/neutron/templates/daemonset-ovs-agent.yaml @@ -166,9 +166,6 @@ spec: {{- end }} {{- range $key, $value := $envAll.Values.conf.rootwrap_filters }} {{- if ( has "ovs_agent" $value.pods ) }} - {{- if and ( eq "taas" $key ) (not $envAll.Values.conf.plugins.taas.taas.enabled) }} - ## if taas is not enabled, do not include taas.filters - {{- else }} {{- $filePrefix := replace "_" "-" $key }} {{- $rootwrapFile := printf "/etc/neutron/rootwrap.d/%s.filters" $filePrefix }} - name: neutron-etc @@ -177,7 +174,6 @@ spec: readOnly: true {{- end }} {{- end }} - {{- end }} - name: run mountPath: /run {{ if $mounts_neutron_ovs_agent.volumeMounts }}{{ toYaml $mounts_neutron_ovs_agent.volumeMounts | indent 12 }}{{ end }} @@ -247,9 +243,6 @@ spec: readOnly: true {{- range $key, $value := $envAll.Values.conf.rootwrap_filters }} {{- if ( has "ovs_agent" $value.pods ) }} - {{- if and ( eq "taas" $key ) (not $envAll.Values.conf.plugins.taas.taas.enabled) }} - ## if taas is not enabled, do not include taas.filters - {{- else }} {{- $filePrefix := replace "_" "-" $key }} {{- $rootwrapFile := printf "/etc/neutron/rootwrap.d/%s.filters" $filePrefix }} - name: neutron-etc @@ -258,7 +251,6 @@ spec: readOnly: true {{- end }} {{- end }} - {{- end }} - name: run mountPath: /run {{ if $mounts_neutron_ovs_agent.volumeMounts }}{{ toYaml $mounts_neutron_ovs_agent.volumeMounts | indent 12 }}{{ end }} diff --git a/neutron/templates/daemonset-sriov-agent.yaml b/neutron/templates/daemonset-sriov-agent.yaml index 239699c6d9..e1bb2e9cab 100644 --- a/neutron/templates/daemonset-sriov-agent.yaml +++ b/neutron/templates/daemonset-sriov-agent.yaml @@ -117,9 +117,6 @@ spec: readOnly: true {{- range $key, $value := $envAll.Values.conf.rootwrap_filters }} {{- if ( has "sriov_agent" $value.pods ) }} - {{- if and ( eq "taas" $key ) (not $envAll.Values.conf.plugins.taas.taas.enabled) }} - ## if taas is not enabled, do not include taas.filters - {{- else }} {{- $filePrefix := replace "_" "-" $key }} {{- $rootwrapFile := printf "/etc/neutron/rootwrap.d/%s.filters" $filePrefix }} - name: neutron-etc @@ -128,7 +125,6 @@ spec: readOnly: true {{- end }} {{- end }} - {{- end }} - name: run mountPath: /run {{ if $mounts_neutron_sriov_agent.volumeMounts }}{{ toYaml $mounts_neutron_sriov_agent.volumeMounts | indent 12 }}{{ end }} @@ -196,9 +192,6 @@ spec: readOnly: true {{- range $key, $value := $envAll.Values.conf.rootwrap_filters }} {{- if ( has "sriov_agent" $value.pods ) }} - {{- if and ( eq "taas" $key ) (not $envAll.Values.conf.plugins.taas.taas.enabled) }} - ## if taas is not enabled, do not include taas.filters - {{- else }} {{- $filePrefix := replace "_" "-" $key }} {{- $rootwrapFile := printf "/etc/neutron/rootwrap.d/%s.filters" $filePrefix }} - name: neutron-etc @@ -207,7 +200,6 @@ spec: readOnly: true {{- end }} {{- end }} - {{- end }} - name: run mountPath: /run {{ if $mounts_neutron_sriov_agent.volumeMounts }}{{ toYaml $mounts_neutron_sriov_agent.volumeMounts | indent 12 }}{{ end }} diff --git a/neutron/values.yaml b/neutron/values.yaml index 690736b6af..8de2692e71 100644 --- a/neutron/values.yaml +++ b/neutron/values.yaml @@ -1261,7 +1261,7 @@ conf: [DEFAULT] # List of directories to load filter definitions from (separated by ','). # These directories MUST all be only writeable by root ! - filters_path=/etc/neutron/rootwrap.d,/usr/share/neutron/rootwrap + filters_path=/etc/neutron/rootwrap.d,/usr/share/neutron/rootwrap,/var/lib/openstack/etc/neutron/rootwrap.d # List of directories to search executables in, in case filters do not # explicitely specify a full path (separated by ',') @@ -1691,23 +1691,6 @@ conf: # NOTE: A second `--config-file` arg can also be added above. Since # many neutron components are installed like that (eg: by devstack). # Adjust to suit local requirements. - taas: - pods: - - ovs_agent - - sriov_agent - content: | - # neutron-rootwrap command filters for nodes on which neutron - # tap-as-a-service(taas) is eanbled. Taas uses this command - # as part of its flow control. - - # format seems to be - # cmd-name: filter-name, raw-command, user, args - - [Filters] - - # This is needed to allow taas to insert/remove vlan id to the - # target vf under /sys/class/net/[device-name]/device/sriov/[vf-index]/[mirror] - i40e_sysfs_command: RegExpFilter, i40e_sysfs_command, root, i40e_sysfs_command, \w+, .+, .+ linux_vxlan: pods: - bagpipe_bgp