summaryrefslogtreecommitdiffstats
path: root/etc/nova/rootwrap.d
Commit message (Collapse)AuthorAgeFilesLines
* Adds support for the Indigo Virtual Switch (IVS)Kevin Benton2013-06-091-0/+5
| | | | | | | | | | | | Implements: blueprint ivs-vif-driver Adds line to rootwrap config to allow call to ivs-ctl to control the Indigo switch. Adds a new 'ivs' VIF type in network/model.py. Adds support to the LibvirtGenericVIFDriver class for the IVS switch. Adds functions to linux_net.py to create and delete IVS vif ports. Adds unit tests to test the new IVS methods. Change-Id: I65436b82f65374103644af8aba9dba14ba73f94c
* Strip exec_dirs prefix from rootwrap filtersDirk Mueller2013-05-183-49/+49
| | | | | | | | | | Make the rootwrap filters more portable by removing the explicit exec_dirs prefix from them. This allows a binary to be installed in any of the exec_dirs and still be used by rootwrap, which improves cross-distro portability. Change-Id: Ieccb8c480e0e116a976d0920ab900305a5615015
* Allow different paths for deploy-helper helpers.Robert Collins2013-05-111-5/+5
| | | | | | | | | | Different distros (or even distro releases) put iscsiadm in potentially arbitrary paths. It is better to use rootwraps' own search than to hardcode the path. Fixes bug 1178612 Change-Id: I690788b666a84e599504690d0e2d087eaa66a4c8
* Destroy conntrack table on source host during migrationAnte Karamatic2013-04-261-0/+3
| | | | | | | | | | | | If a VM migrates from hostA to hostB, there will still be connections in the conntrack table of the hostA. If, for any reason, VM is migrated back to the hostA, while those connections are still in conntrack table, persistent connections (such is ssh) to VM, from outside, will get dropped. They get dropped cause hostA was expecting different packets and cause of that requires establishing new connection. By dropping conntrack table entries for VM we make sure that connection flow is not interupted by old packets. Change-Id: If8e146e05914e9febd6fc40a1d8085306c1244ea
* Merge "Switch nova-baremetal-deploy-helper to use sfdisk."Jenkins2013-04-011-1/+1
|\
| * Switch nova-baremetal-deploy-helper to use sfdisk.Chris Krelle2013-03-261-1/+1
| | | | | | | | | | | | | | | | | | | | | | This patch changes make_partitions function to use sfdisk instead of fdisk. Also added logging of cmd, stdout, and stderr should command fail. Fixes Bug 1088652 Change-Id: Ia2711a5450900c95598253f2a7b02e7c3e83a3d8 Authored-by: Chris Krelle <nobodycam@gmail.com>
* | Adds Tilera back-end for baremetalMikyung Kang2013-03-261-0/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | blueprint add-tilera-to-baremetal. The baremetal driver is a hypervisor driver for Openstack Nova Compute. Within the Openstack framework, it has the same role as the drivers for other hypervisors (libvirt, xen, etc). With this patch set of tilera-backend, provisioning and management of non-PXE tilera physical hardware is accomplished using common cloud APIs and tools. Change-Id: I356c06a07ace463779e3b84836d5000331e24814 Co-authored-by: Mikyung Kang <mkkang@isi.edu> Co-authored-by: David Kang <dkang@isi.edu> Co-authored-by: Ken Igarashi <igarashik@nttdocomo.co.jp> Co-authored-by: Arata Notsu <notsu@virtualtech.jp> Co-authored-by: Devananda van der Veen <devananda.vdv@gmail.com>
* | xenapi: Retrieve VM uuid from xenstore.Bob Ball2013-03-251-0/+3
|/ | | | | | | | Fall back to retrieving the uuid from xenstore if /sys/hypervisor/uuid isn't accessible. Change-Id: I409079068d3102ff86a71431b29c1ce2e6fe8857 Fixes: bug #1157211
* Fix ephemeral devices on LVM don't get mkfs'dRafi Khardalian2013-03-011-0/+4
| | | | | | | | | | | | | Fixes bug 1083424 Updated imagebackend to run the necessary callback conditionally based on whether LVM is configured for use and ephemeral_size is defined. The callback function was updated not to invoke qemu-img for LVM, since the ephemeral disk is already present/created via LVM. Lastly, the mkfs call had to be changed to be run as root, since we are dealing with raw devices. Change-Id: Ieb1febb0ea086f8e5063d92ca376d349fcd43a43
* Add a volume driver in Nova for Scality SOFSJean-Marc Saffroy2013-02-201-0/+1
| | | | | | | | | | | Scality SOFS is a network filesystem mounted with FUSE, with most options given in a configuration file. Given a mount point and a SOFS configuration file as driver options, the Scality volume driver mounts SOFS, and then creates, accesses and deletes volumes as regular (sparse) files on SOFS. Change-Id: I84bf268e5a2c5c33b8706830e8067914fae44aed Implements: blueprint scality-volume-driver
* Fibre channel block storage support (nova changes)Walter A. Boring IV2013-02-181-1/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | implements blueprint libvirt-fibre-channel These changes constitute the required libvirt changes to support attaching Fibre Channel volumes to a VM. This requires a few new packages to be available on the system sysfsutils -- This is needed to discover the FC HBAs sg3-utils -- this package is needed for scsi device discovery multipath -- This package is needed for multipath support. Typical Fibre Channel arrays support exporting volumes via multiple ports, so multipath support is highly desirable for fault tolerance. If multipath is not installed, the new FibreChannel libvirt volume driver will still work. If multipath is enabled, the new Fibre Channel volume driver detects each of the attached devices for the volume, and properly removes every one of them on detach. In order to use this, the cinder volume driver's initialize_connection will simply return a dictionary with a new driver_volume_type called 'fibrechan'. The target_wwn can be a single entry or a list of wwns that correspond to the list of remote wwn(s) that will export the volume. return {'driver_volume_type': 'fibre_channel', 'data': {'target_lun', 1, 'target_wwn': '1234567890123'}} or return {'driver_volume_type': 'fibre_channel', 'data': {'target_lun', 1, 'target_wwn': ['1234567890123', '0987654321321']}} Change-Id: Ifccc56f960ef434f7cb56a9367e4cad288358440
* Enable multipath for libvirt iSCSI Volume DriverErik Zaadi2013-02-181-0/+2
| | | | | | | | | | | | | | | | Implements: blueprint libvirt-volume-multipath-iscsi nova/virt/libvirt/volume.py:LibvirtISCSIVolumeDriver can now make use of multipath (behavior defined by use_multipath flag) runs a scsi inquiry to the storage vendor (iSCSI portal) asking for more portals, logins to the discovered portals and uses a multipath device (/dev/mapper/XX) instead of a singlepath device (/dev/disk/by-path/ip-IP:PORT-iscsi-IQN-lun-X). This improves IO speed and robustness, since if one iSCSI portal goes down, there are still others to take care of IO. Change-Id: I30489234b8329f576cf2cbb0ef390670dbee5b95
* Adding support for AoE block storage SANs.Jean-Baptiste RANSY2013-02-121-0/+5
| | | | | | | | | | | | | Adding support for AoE (ATA over Ethernet) block storage SANs. AoE initiator driver is supported on all Linux initiators (released under GPL), ATA over Ethernet (AoE) Linux driver for all 3.x and 2.6 kernels. Implements blueprint libvirt-aoe - Fix (minor) Redundant exception caching Change-Id: I00de13eb2d4bd1105b9eb68f1465825414e2d5d7
* Merge "Add rootwrap filters for password injection with localfs"Jenkins2013-01-301-0/+6
|\
| * Add rootwrap filters for password injection with localfsArata Notsu2013-01-211-0/+6
| | | | | | | | | | | | | | | | Allow to 'sudo cat' to read passwd and shadow. bug 1098077 Change-Id: Ic734bd33223df879b5e1f144bb4c85702eb88dfa
* | Merge "Run_as_root to ensure resize2fs succeed for all image backends"Jenkins2013-01-231-0/+2
|\ \
| * | Run_as_root to ensure resize2fs succeed for all image backendsunicell2013-01-191-0/+2
| |/ | | | | | | | | | | | | | | | | | | | | | | | | | | Unlike other file based image backend, operation over LVM logical volumes requires root to functioning correctly. Resize2fs on logical volumes also need run_as_root. Otherwise, when running nova-compute as non-root user, instance creation with flavor disk size larger than image size would fail. Caused by resize2fs failure. Fixes LP# 1101137 Change-Id: I16a2aa4382be58843270ff23e11bfb1e20c568d2
* / Remove baremetal-compute-pxe.filtersMark McLoughlin2013-01-091-11/+0
|/ | | | | | | | The baremetal PXE driver doesn't seem to run dnsmasq at all, so remove the rootwrap filter which allows it to do so. This was introduced by commit a2f260f. Change-Id: I4cc1127222b73af218a6a8808d0ad54478878af1
* PXE bare-metal provisioning helper serverMikyung Kang2013-01-081-0/+10
| | | | | | | | | | | | | | | | | | | | a part of blueprint general-bare-metal-provisioning-framework. Implement nova-baremetal-deploy-helper. This service listens for HTTP requests from baremetal deploy ramdisk, formats the remote disk and writes an image to it, as part of baremetal PXE provisioning. blueprint improve-baremetal-pxe-deploy shows how we plan to improve this process. Change-Id: I0a1b020cc5f81d49559acd4dcc781397a58e2c01 Co-authored-by: Mikyung Kang <mkkang@isi.edu> Co-authored-by: David Kang <dkang@isi.edu> Co-authored-by: Ken Igarashi <igarashik@nttdocomo.co.jp> Co-authored-by: Arata Notsu <notsu@virtualtech.jp> Co-authored-by: Devananda van der Veen <devananda.vdv@gmail.com>
* Provide a PXE NodeDriver for the Baremetal driverDevananda van der Veen2013-01-072-0/+11
| | | | | | | | | | | | | This patch implements a PXE NodeDriver class within the Baremetal provisioning framework, which provides a means for deploying machine images using TFTP and PXE. This patch relies on functionality provided by the nova-baremetal-deploy-helper utility, implemented in review 15830. blueprint general-bare-metal-provisioning-framework. Change-Id: I8d849601186e3dc13f10382857ff2bbc1ff1026d
* Implement IPMI sub-driver for baremetal computeDevananda van der Veen2012-12-281-0/+9
| | | | | | | | | This patch implements only the IPMI power manager for baremetal nova compute. Documentation will come in a separate patch. blueprint general-bare-metal-provisioning-framework Change-Id: I60ccfbf963d7bbf6f840e627396601b7bba80e7f
* Merge "Execute pygrub using nova-rootwrap in xenapi"Jenkins2012-12-211-0/+3
|\
| * Execute pygrub using nova-rootwrap in xenapiArmando Migliaccio2012-12-181-0/+3
| | | | | | | | | | | | | | | | | | Preserve the behavior where, if pygrub fails, compute attempts to spawn the VM in HVM mode. Fixes bug #1091628 Change-Id: Ia462964ebb1fc21d8e289de32557a2e7867f1257
* | New Baremetal provisioning framework.Mikyung Kang2012-12-191-0/+3
|/ | | | | | | | | | | | | | | | | | | | | This is a minimal patch for the new baremetal driver. With this driver, nova compute registers multiple entries of baremetal nodes. It periodically updates the capabilities of the multiple baremetal nodes and reports it as a list of capabilities. It does not include Tilera or PXE back-ends, which will be provided by subsequent patches. It also does not include VIF or volume components. Part 4 of 7: blueprint general-bare-metal-provisioning-framework. Change-Id: I55617a8da52d20d4df727b8bbde8e5f72d3bf130 Co-authored-by: Mikyung Kang <mkkang@isi.edu> Co-authored-by: David Kang <dkang@isi.edu> Co-authored-by: Ken Igarashi <igarashik@nttdocomo.co.jp> Co-authored-by: Arata Notsu <notsu@virtualtech.jp> Co-authored-by: Chris Krelle <NobodyCam@gmail.com> Co-authored-by: Devananda van der Veen <devananda.vdv@gmail.com>
* Configurable exec_dirs to find rootwrap commandsThierry Carrez2012-12-033-40/+20
| | | | | | | | | | | | Adds support for a configurable set of trusted directories to search executables in (exec_dirs), which defaults to system PATH. If your filter specifies an exec_path that doesn't start with '/', then it will be searched in exec_dirs. Avoids having to write multiple filters to care for distro differences. Fixes bug 1079723. Also returns a specific error rather than try to run absent executables. Change-Id: Idab03bb0be6832a75ffeed4e78d25d0543f5caf9
* Merge "adjust rootwrap filters for recent file injection changes"Jenkins2012-11-291-30/+15
|\
| * adjust rootwrap filters for recent file injection changesPádraig Brady2012-11-221-30/+15
| | | | | | | | | | | | | | Removed filters for guestmount, fusermount and cp. Adjusted comment paths as per the recent refactoring. Change-Id: I643554b89862225d16456e47daf6c11828f602d2
* | Merge "Allow multi_host compute nodes to share dhcp ip"Jenkins2012-11-281-0/+5
|\ \
| * | Allow multi_host compute nodes to share dhcp ipVishvananda Ishaya2012-11-261-0/+5
| |/ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This adds a new flag: share_dhcp_address which if enabled in multihost mode will allow all compute nodes to share an ip on guest network. The code will isolate the address using iptables and ebtables so it is only visible to the vms. This patch has two benefits: a) we don't have to use an ip address from every network for each compute node. This is especially valuable in vlan mode where the networks are generally small b) we can improve security by blocking all access to the ip on the guest network from outside the compute node. While we could do similar blocking using a different ip for each node, it makes dhcp setup much more complicated if a vm is migrated to another node. Implements blueprint shared-dhcp-ip Change-Id: Iaf84c0ad2848921122866956105eb44c074450dc
* / Make nova-dhcpbridge use CONFIG_FILE over FLAGFILEMark McLoughlin2012-11-262-0/+2
|/ | | | | | | | | | | | | | | nova-dhcpbridge's FLAGFILE environment variable is one of the few remaining references we have to "flags". Switching to use a new environment variable is easy, but we need to take care that when you upgrade the code the compute and network services might not be restarted immediately. If this happens, the services may launch a new dnsmasq (so rootwrap needs to continue to support FLAGFILE) or an existing dnsmasq might run the lease script (so the script needs to support FLAGFILE). Change-Id: Ieb55daa2507abb8327c7f5a2ef2f682740f31a5d
* removes the nova-volume code from novaVishvananda Ishaya2012-10-281-36/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This removes the majority of the nova-volume code from the codebase. It updates relevent config options to default to cinder. It updates a number of existing tests that were depending on code that was removed. A few things still need to be removed: * volume/driver.py & volume/iscsi.py These files are used by the libvirt volume driver tests. These tests should be updated to mock the relevant calls. * scheduler/simple.py & scheduler/multi.py These files should no longer be necessary so they can be removed in a subsequent patch * exception.py cleanup Once the above files are removed there are a number of unused exceptions which can be removed * database calls and database tables The database calls have not been removed and the tables have not been dropped. This can be done in a separate migration * additional config options and nova.conf.sample There may be a few extra config options that can be removed and the conf sample can be regenerated Implements bp delete-nova-volume Change-Id: I0b540e54dbabd26901a7530035a38583bb521fda
* Adds new volume API extensionsUnmesh Gurjar2012-09-181-0/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Adds following extensions: 1. Create volume from image 2. Copy volume to image Added unit tests. Implements: blueprint create-volume-from-image Conflicts: cinder/api/openstack/volume/contrib/volume_actions.py cinder/tests/api/openstack/fakes.py cinder/tests/api/openstack/volume/contrib/test_volume_actions.py cinder/tests/policy.json nova/api/openstack/volume/volumes.py nova/flags.py nova/tests/api/openstack/volume/test_volumes.py nova/tests/test_volume.py nova/utils.py nova/volume/api.py nova/volume/manager.py This is based on a cherry-pick of cinder commit 2f5360753308eb8b10581fc3c026c1b66f42ebdc with bug fixes 8c30edff982042d2533a810709308b586267c0e9 and ffe5036fa0e63ccde2d19aa0f425ec43de338dd7 squashed in. Change-Id: I9c73bd3fa2fa2e0648c01ff3f4fc66f757d7bc3f
* Fix volume deletion when device mapper is usedRafi Khardalian2012-09-171-0/+4
| | | | | | | | | Call dmsetup remove if there is a /dev/mapper/nova--volumes- element present. Resolves bug 979020 Change-Id: Iddaaed411a77dda4bd32f9a97687ff17744119eb
* Use lvs instead of os.listdir in _cleanup_lvmBoris Filippov2012-09-061-0/+3
| | | | | | | | | | | Compute user may not have permission to list /dev/<VolGroup> directory. This results in error during instance cleanup and not deleted lvm images, if libvirt driver use lvm images backend. To prevent this, _cleanup_lvm use lvs command instead of os.listdir. This fixes bug 1042710 Change-Id: I82ab4ca5ba3320f50c84e23839fcf6ed8f02be8c
* Config drive v2Michael Still2012-08-111-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This is the first cut of config drive v2. Some points to note: - implements a helper to create new-style config drives. These config drives can be VFAT or ISO9660, this is controlled by a flag. The current default is ISO9660. - the config drives contain all the injected files, as well as everything returned from the ec2 style metadata service. Only the most recent version of the ec2 metadata is used, but future versions will appear as well. - the v1 functionality of specifying an image from glance to have the files injected into is dropped. - the location for file injection is now a directory named openstack/files, not the root level of the filesystem. Filename mapping is in the openstack metadata files. - the default format for the config drive is iso9660, although the previous vfat is available with a flag change. - includes the first version of an openstack metadata format. - there are some simple unit tests which probably need more done to them. Partially implements bp config-drive-v2. Change-Id: I210fa4dd7d8d6be398a46b30a0d46b960e22d6b0
* Added updated locations for iscsiadmChuck Short2012-08-072-0/+2
| | | | | | | | | | | | | Attaching volumes to instances currently result in a traceback running on 12.10. This is due to the change of location from /sbin to /usr/bin for iscsiadm. Fixes LP: #1033960 Change-Id: Ie8c6214efbac72b2715264a7d9dd7fe5e43ef693 Signed-off-by: Chuck Short <chuck.short@canonical.com>
* Add persistent volumes for tgtd.Chuck Short2012-07-271-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Currently if you restart the server running nova-volume or restart tgt, you will loose your iscsi targets that have been created. This is not good. In order for iscsi targets to be persistent across reboots or restarts, one has to have the target's configuration information in /etc/tgt/targets.conf or /etc/tgt/conf.d. So when tgtd is restarted then the iscsi targets will be there as expected. This patch will add a configuration file to $state_path/volumes when the volume is created. The configuration file is identified by the volume uuid. It creates a logicalunit when the volume is created as well. The iscsi target and configuration file will be removed once the volume has been removed as well. In order to use this, you have to include the following in your /etc/tgt/targets.conf include $state_path/volumes/* For upgrades, it will just re-create the volumes already in the volumes table. Fixes LP: #1011159 Change-Id: I38fc096ab881ccb52cb688ae46d9d36b0a7b3a45 Signed-off-by: Chuck Short <chuck.short@canonical.com>
* Provide rootwrap filters for nova-api-metadataThierry Carrez2012-07-241-0/+17
| | | | | | | | | | | | The metadata service in nova-api needs access to ip[6]tables-{save-restore} to accept connections to the metadata service. This change adds an api-metadata.filters file that needs to be deployed on setups running nova-api-metadata or nova-api with "metadata" in enabled_apis. Fixes bug 1002111. Change-Id: I5aecb223876e12550394f31dbc7df893868baa8b
* set correct SELinux context for injected ssh keysPádraig Brady2012-07-201-0/+4
| | | | | | | | | | | Instruct guests to ensure at boot, that the correct SELinux context is set for /root/.ssh/. This will cater for keys injected by nova from hosts without SELinux (enabled) or using libguestfs which currently doesn't support setting extended attributes. Suggested-by: David Naori <dnaori@redhat.com> Change-Id: Ibf3869e3ee477e91623e0c030838c1ec8a6128a6
* Migrate existing routes from flat_interfaceDan Smith2012-06-252-16/+6
| | | | | | | | | | | | Right now, any routes that exist on flat_interface (other than the default route) get lost when we set up the bridge. This patch migrates them over to avoid losing that connectivity. It does so by using 'ip route' instead of 'route', which is much easier to script and is consistent with other use of iproute2 tools in linux_net.py. Bug 962822 Change-Id: I7d9e8e05169f2f87e8481595397c02fd3a3612f4
* Move rootwrap filters definition to config filesThierry Carrez2012-06-223-0/+297
Move rootwrap filters definition from being defined within Nova code to being defined in configuration files to facilitate pluging-in new rootwrap commands. Transition notes: * nova-rootwrap now requires an additional (first) parameter pointing to the root-owned rootwrap.conf file, sudoers needs to be updated to specify that ("nova-rootwrap /etc/nova/rootwrap.conf *") * Packagers should ship {compute,network,volume}.filters inside a directory listed in rootwrap.conf rather than shipping nova/rootwrap/{compute,network,volume}.py * Filter definitions now only support strings. The KillFilter (which was using arrays as parameters) was modified and the tests updated. Implements bp nova-rootwrap-pluggable-filters Corresponding devstack change needs to land first, so that tests pass: https://review.openstack.org/8842 Change-Id: I2350154cd8057bd57926ed542de035626f7de37d