openstack-ansible-lxc_hosts/vars/redhat-7.yml
Jesse Pretorius bb2e7a08a0 Revise container DNS resolution implementation
The current LXC cache preparation copies the DNS resolver config
from the host into the container.

When the host has been setup with a DNS caching system like 'unbound'
running on it, the host's resolv.conf contains only a localhost
nameserver entry which will not work from inside the container.

The Ubuntu containers use resolvconf by default. Resolvconf gathers
the DNS settings from each interface configured and compiles
/etc/resolv.conf from the interface information. This results in
a nameserver list which will start with the LXC dnsmasq service
which runs on lxcbr0. This service uses the host's DNS configuration
for name resolution.

In effect, therefore, when the containers use the DNS service on
lxcbr0, the host does the resolution and responds to the container.
This means far less moving parts and a far more predictable
implementation for name resolution.

This patch implements the changes necessary for this strategy to
work.

Change-Id: Ib139af5221dbb1f479ca068e472cf0e8aa828a8d
2016-08-17 18:42:05 +00:00

97 lines
2.9 KiB
YAML

---
# Copyright 2016, Rackspace US, Inc.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
lxc_download_url: "https://linuxcontainers.org/downloads/lxc/lxc-2.0.1.tar.gz"
# Required rpm packages.
lxc_packages:
- '@Development Tools'
- automake
- autoconf
- bridge-utils
- debootstrap
- docbook2X
- dnsmasq
- git
- graphviz
- libseccomp
- libseccomp-devel
- libcap-devel
- libselinux
- libselinux-devel
- python-devel
- python34-libs
- python34-devel
- pkgconfig
- redhat-lsb
- xz
lxc_cache_map:
distro: centos
arch: amd64
release: 7
copy_from_host:
- /etc/yum.repos.d/
- /etc/pki/rpm-gpg/
cache_prep_commands: |
if [ -a /etc/resolv.conf ]; then
mv /etc/resolv.conf /etc/resolv.conf.org
fi
echo "nameserver {{ lxc_net_address }}" > /etc/resolv.conf
yum install -y {{ lxc_cache_packages | join(' ') }}
rm -f /usr/bin/python
ln -s /usr/bin/python2.7 /usr/bin/python
/usr/bin/wget https://dl.fedoraproject.org/pub/epel/epel-release-latest-7.noarch.rpm -O /tmp/epel-release-latest-7.noarch.rpm
/usr/bin/rpm -ivh /tmp/epel-release-latest-7.noarch.rpm || true
yum clean all
mkdir -p /var/backup
if [ -f "/usr/lib/systemd/system/poweroff.target" ];then
ln -sf /usr/lib/systemd/system/poweroff.target /etc/systemd/system/sigpwr.target || true
fi
ln -s /dev/null /etc/systemd/system/systemd-udevd.service || true
ln -s /dev/null /etc/systemd/system/systemd-udevd-control.socket || true
ln -s /dev/null /etc/systemd/system/systemd-udevd-kernel.socket || true
ln -s /dev/null /etc/systemd/system/proc-sys-fs-binfmt_misc.automount || true
echo -e '{{ lxc_container_default_interfaces }}' | tee /etc/sysconfig/network-scripts/ifcfg-eth0
chage -I -1 -d -1 -m 0 -M 99999 -E -1 root
if [ -a /etc/resolv.conf.org ]; then
mv /etc/resolv.conf.org /etc/resolv.conf
else
rm -f /etc/resolv.conf
fi
lxc_cache_packages:
- ca-certificates
- openssh-server
- python2
- sudo
- wget
pip_install_options: >
--global-option=build_ext
--global-option="-L/opt/lxc_embedded/x86_64-linux-gnu/"
--global-option="-I/opt/lxc_embedded/include/"
lxc_cached_network_interfaces:
- src: "lxc-net-ifcfg-bridge.cfg.j2"
dest: "/etc/sysconfig/network-scripts/ifcfg-lxcbr0"
lxc_container_default_interfaces: |
DEVICE=eth0
BOOTPROTO=dhcp
ONBOOT=yes
NM_CONTROLLED=no
TYPE=Ethernet