6 Commits

Author SHA1 Message Date
Éric Lemoine
63e2c64081 Remove duplicate code in glance extend_start.sh
Change-Id: I34f63aef2a473c475f3740e160f64e6c1ee758fc
Partial-Bug: #1546944
2016-02-24 11:41:24 +01:00
Éric Lemoine
5de471f61e Make Heka collect Glance logs
Partially implements: blueprint heka
Change-Id: I9e5ba649bc45356822138ad223430f4b93722448
2016-02-19 21:49:21 +00:00
Paul Bourke
988c4f23f1 Fix issues in Glance filesystem backend
The drop root change for Glance highlighted the fact that we were
binding volumes from glance_data into the wrong container - it was
glance_registry whereas it should be glance_api. This would result in
all images being lost if the glance_api container happens to restart.

Also, we need a sudoers file to chown the file backend dir to the glance
user.

Change-Id: If04337045bb94b3126e48d1f5bf0ea29e20373ae
Closes-Bug: #1516729
2015-11-17 09:42:39 +00:00
Steven Dake
bd9e8c22d7 drop root for glance
This uses the grouping feature of sudo to limit the amount of times
the base sudo file has to be modified to only once.  The container
contents always runs as the user root, except the software which is
controlled by Kolla.  This software may run as root, but it has
undergone a security audit and preserves permissions of the correct
files and does not permit the glance user to write any of the
set_config.py control files.

Change-Id: Ie3cd23edcde5b408a8f66970456279a1b15028e0
Partially-Implements: blueprint drop-root
2015-11-09 11:00:29 -05:00
Sam Yaple
5f200e0446 Fix issue with su and bad kernels
Long story short, some kernels before 3.15 had an issue with using su
in a container when the network namespace was --net=host. The gate
has a 3.10 and a 3.13 kernel and has a problem with this. This changes
everything to use sudo

backport: liberty
Partially-Implements: blueprint functional-testing-gate
Change-Id: I4d79ccaa1cddffcc8393f64e7e1be2538efe33e5
2015-10-13 15:13:55 +00:00
Sam Yaple
cb4e875ae1 Common start.sh
The majority of the start.sh code is identical. This removes that
duplicate code while still maintaining the ability to call code in a
specific container.

The start.sh is moved into /usr/local/bin/kolla_start in the container

The extend_start.sh script is called by the kolla_start script at the
location /usr/local/bin/kolla_extend_start . It always exists because
we create a noop kolla_extend_start in the base directory. We override
it with extend_start.sh in a specific image should we need to.

Of note, the neutron-agents container is exempt from this new
structure due to it being a fat container.

Additionally, we fix the inconsistent permissions throughout. 644 for
repo files and the scripts are set to 755 via a Docker RUN command to
ensure someones local perm change won't break upstream containers.

Change-Id: I7da8d19965463ad30ee522a71183e3f092e0d6ad
Closes-Bug: #1501295
2015-10-06 03:30:26 +00:00