Add docker-default (enforce) AppArmor profile to openvswitch

Change-Id: I7b091f668d9293d7eafd9c1b54c4eab715bbd93c

openvswitch/templates/daemonset-ovs-db.yaml

@@ -40,6 +40,7 @@ spec:
       annotations:
 {{ tuple $envAll | include "helm-toolkit.snippets.release_uuid" | indent 8 }}
         configmap-bin-hash: {{ tuple "configmap-bin.yaml" . | include "helm-toolkit.utils.hash" }}
+{{ dict "envAll" $envAll "podName" "openvswitch-db" "containerNames" (list "openvswitch-db") | include "helm-toolkit.snippets.kubernetes_mandatory_access_control_annotation" | indent 8 }}
     spec:
       shareProcessNamespace: true
       serviceAccountName: {{ $serviceAccountName }}

openvswitch/templates/daemonset-ovs-vswitchd.yaml

@@ -40,6 +40,7 @@ spec:
       annotations:
 {{ tuple $envAll | include "helm-toolkit.snippets.release_uuid" | indent 8 }}
         configmap-bin-hash: {{ tuple "configmap-bin.yaml" . | include "helm-toolkit.utils.hash" }}
+{{ dict "envAll" $envAll "podName" "openvswitch-vswitchd" "containerNames" (list "openvswitch-vswitchd") | include "helm-toolkit.snippets.kubernetes_mandatory_access_control_annotation" | indent 8 }}
     spec:
       shareProcessNamespace: true
       serviceAccountName: {{ $serviceAccountName }}

tools/deployment/apparmor/110-openvswitch.sh

@@ -0,0 +1,44 @@
+#!/bin/bash
+
+# Copyright 2019 The Openstack-Helm Authors.
+#
+#    Licensed under the Apache License, Version 2.0 (the "License"); you may
+#    not use this file except in compliance with the License. You may obtain
+#    a copy of the License at
+#
+#         http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+#    License for the specific language governing permissions and limitations
+#    under the License.
+
+set -xe
+
+#NOTE: Lint and package chart
+make openvswitch
+
+#NOTE: Deploy command
+tee /tmp/openvswitch.yaml <<EOF
+pod:
+  mandatory_access_control:
+    type: apparmor
+    openvswitch-vswitchd:
+      openvswitch-vswitchd: localhost/docker-default
+    openvswitch-db:
+      openvswitch-db: localhost/docker-default
+EOF
+
+#NOTE: Deploy command
+helm upgrade --install openvswitch ./openvswitch \
+    --namespace=osh-infra \
+    --values=/tmp/openvswitch.yaml
+
+#NOTE: Wait for deploy
+./tools/deployment/common/wait-for-pods.sh osh-infra
+
+#NOTE: Validate Deployment info
+helm status  openvswitch
+
+helm test openvswitch

zuul.d/jobs.yaml

@@ -215,6 +215,7 @@
         - ./tools/deployment/apparmor/080-prometheus-process-exporter.sh
         - ./tools/deployment/apparmor/090-elasticsearch.sh
         - ./tools/deployment/apparmor/100-fluent-logging.sh
+        - ./tools/deployment/apparmor/110-openvswitch.sh
 
 - job:
     name: openstack-helm-infra-openstack-support