openstack/kayobe
Code Issues Proposed changes

Run selinux playbook on seed hypervisor

Browse Source 
Change-Id: Iec0b9cd24eda4fc0fc38003dea66c50ece7425b6
This commit is contained in:
Will Szumski
2022-01-04 17:46:49 +00:00
committed by Pierre Riteau
parent caa7cc54ee
commit 836f394a6d
5 changed files with 11 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
ansible/seed-hypervisor-host-configure.yml
View File

@@ -9,6 +9,7 @@
- import_playbook: "wipe-disks.yml" - import_playbook: "wipe-disks.yml"
- import_playbook: "users.yml" - import_playbook: "users.yml"
- import_playbook: "dev-tools.yml" - import_playbook: "dev-tools.yml"
- import_playbook: "selinux.yml"
- import_playbook: "network.yml" - import_playbook: "network.yml"
- import_playbook: "firewall.yml" - import_playbook: "firewall.yml"
- import_playbook: "tuned.yml" - import_playbook: "tuned.yml"

2
ansible/selinux.yml
View File

@@ -1,6 +1,6 @@
--- ---
- name: Configure SELinux state and reboot if required - name: Configure SELinux state and reboot if required
hosts: seed:overcloud:infra-vms hosts: seed:seed-hypervisor:overcloud:infra-vms
tags: tags:
- selinux - selinux
roles: roles:

6
playbooks/kayobe-infra-vm-base/pre.yml
View File

@@ -32,12 +32,6 @@
value: 1 value: 1
become: true become: true
- name: Ensure SELinux is disabled
selinux:
state: disabled
become: True
when: ansible_os_family in ['RedHat', 'Rocky']
# NOTE(mgoddard): Use the name zz-overrides.yml to ensure this takes # NOTE(mgoddard): Use the name zz-overrides.yml to ensure this takes
# precedence over the standard config files. # precedence over the standard config files.
- name: Ensure kayobe-config override config file exists - name: Ensure kayobe-config override config file exists

6
playbooks/kayobe-seed-vm-base/pre.yml
View File

@@ -32,12 +32,6 @@
value: 1 value: 1
become: true become: true
- name: Ensure SELinux is disabled
selinux:
state: disabled
become: True
when: ansible_os_family in ['RedHat', 'Rocky']
# NOTE(mgoddard): Use the name zz-overrides.yml to ensure this takes # NOTE(mgoddard): Use the name zz-overrides.yml to ensure this takes
# precedence over the standard config files. # precedence over the standard config files.
- name: Ensure kayobe-config override config file exists - name: Ensure kayobe-config override config file exists

9
releasenotes/notes/selinux-seed-hypervisor-40c74b625ea93a7e.yaml Normal file
View File

@@ -0,0 +1,9 @@
---
features:
- |
Kayobe now configures SELinux on the seed hypervisor. The default is to set
SELinux to ``permissive``.
fixes:
- |
Configures SELinux to ``permissive`` on the seed hypervisor, which fixes
permission issues when provisioning seed or infra VMs.