8cd8784825
Ubuntu Noble ships with an enforcing rsyslogd apparmor profile. This profile prevents our haproxy container from opening the syslog socket we bind mount into the container. I discussed this in #ubuntu-security which resulted in this issue: https://bugs.launchpad.net/ubuntu/+source/rsyslog/+bug/2098148 which includes many details on what is going on. This change implements the suggested workaround for our haproxy nodes. I believe this is the only place we are currently attempting to directly access rsyslog sockets from within containers. The tl;dr on the fix is that we have to tell rsyslogd to attach disconnected connections as the container runs in a different filesystem namespace which disconnects the paths for the socket. Unfortunately sarnold indicates that we have to edit the primary profile configuration file as this flag applies to the top level of the profile. We cannot use one of the files this profile #includes. Change-Id: I4e09211a1bdc4dfbf3012a66e79c181c6fb957a4
112 lines
2.8 KiB
YAML
112 lines
2.8 KiB
YAML
- name: Install socat for haproxy management
|
|
package:
|
|
name: socat
|
|
state: present
|
|
|
|
- name: Ensure haproxy volume directories exists
|
|
# Note on the host side we create everything under /var/lib/haproxy to
|
|
# make rsyslog apparmor rules for /var/lib/haproxy/dev/log happy.
|
|
# But within the containers /var/haproxy paths are still used.
|
|
file:
|
|
state: directory
|
|
path: "/var/lib/haproxy/{{ item }}"
|
|
owner: 1000
|
|
group: 1000
|
|
loop:
|
|
- etc
|
|
- run
|
|
- dev
|
|
|
|
- name: Ensure haproxy config template available
|
|
assert:
|
|
that:
|
|
- haproxy_config_template is defined
|
|
|
|
- name: Fix rsyslog apparmor profile on Noble and newer
|
|
when: ansible_distribution_version is version('24.04', '>=')
|
|
block:
|
|
- name: Edit rsyslogd apparmor profile
|
|
lineinfile:
|
|
path: /etc/apparmor.d/usr.sbin.rsyslogd
|
|
regexp: '^profile rsyslogd /usr/sbin/rsyslogd {'
|
|
line: 'profile rsyslogd /usr/sbin/rsyslogd flags=(attach_disconnected) {'
|
|
register: profile_update
|
|
|
|
- name: Reload rsyslogd apparmor profile
|
|
command: apparmor_parser -r /etc/apparmor.d/usr.sbin.rsyslogd
|
|
when: profile_update.changed
|
|
|
|
- name: Write rsyslog file
|
|
copy:
|
|
src: rsyslog.d/49-haproxy.conf
|
|
dest: /etc/rsyslog.d/
|
|
owner: root
|
|
group: root
|
|
mode: 0644
|
|
register: _rsyslog_added
|
|
|
|
- name: Restart rsyslog if config updates
|
|
service:
|
|
name: rsyslog
|
|
state: restarted
|
|
when: _rsyslog_added.changed
|
|
|
|
- name: Add haproxy log rotation
|
|
include_role:
|
|
name: logrotate
|
|
vars:
|
|
logrotate_file_name: '/var/log/haproxy.log'
|
|
|
|
- name: Write haproxy config file
|
|
template:
|
|
src: '{{ haproxy_config_template }}'
|
|
dest: /var/lib/haproxy/etc/haproxy.cfg
|
|
owner: 1000
|
|
group: 1000
|
|
mode: 0644
|
|
notify: Reload haproxy
|
|
|
|
# Copy in testing CA so the container can see it. When running under
|
|
# Zuul this CA is created by the test framework. We use it to
|
|
# validate the https check path
|
|
- name: Check for OpenDev Infra CA (test only)
|
|
stat:
|
|
path: /etc/opendev-ca/ca.crt
|
|
register: _opendev_ca_crt
|
|
- name: Copy in OpenDev Infra CA (test only)
|
|
copy:
|
|
src: /etc/opendev-ca/ca.crt
|
|
dest: /var/lib/haproxy/etc/
|
|
when: _opendev_ca_crt.stat.exists
|
|
|
|
- name: Ensure docker compose configuration directory
|
|
file:
|
|
path: /etc/haproxy-docker
|
|
state: directory
|
|
owner: root
|
|
group: root
|
|
mode: 0755
|
|
|
|
- name: Install docker-compose configuration
|
|
template:
|
|
src: docker-compose.yaml.j2
|
|
dest: /etc/haproxy-docker/docker-compose.yaml
|
|
owner: root
|
|
group: root
|
|
mode: 0644
|
|
notify: Reload haproxy
|
|
|
|
- name: Run docker-compose pull
|
|
shell:
|
|
cmd: docker-compose pull
|
|
chdir: /etc/haproxy-docker/
|
|
|
|
- name: Run docker-compose up
|
|
shell:
|
|
cmd: docker-compose up -d
|
|
chdir: /etc/haproxy-docker/
|
|
|
|
- name: Run docker prune to cleanup unneeded images
|
|
shell:
|
|
cmd: docker image prune -f
|