From 4c3f4e6f7d871ebcd0efef80e2039363443f191d Mon Sep 17 00:00:00 2001
From: Thomas Woerner <twoerner@redhat.com>
Date: Mon, 2 Dec 2024 15:01:20 +0100
Subject: [PATCH] infra/image: Use SYS_ADMIN capability for server deployment
This adds the capabilities SYS_ADMIN and SYSLOG to the container_create
call in build.sh as long as server deployment has been enabled.
The privileged option has been removed as it is no longer needed.
The hostnamectl-wrapper for the container has been removed as it is no
longer needed.
---
infra/azure/templates/build_container.yml | 2 +-
infra/image/build.sh | 12 +++++++-----
infra/image/dockerfile/c10s | 6 ------
infra/image/shcontainer | 2 +-
infra/image/utils/hostnamectl-wrapper | 12 ------------
5 files changed, 9 insertions(+), 25 deletions(-)
delete mode 100644 infra/image/utils/hostnamectl-wrapper
diff --git a/infra/azure/templates/build_container.yml b/infra/azure/templates/build_container.yml
index e3c2bde..12f0b45 100644
--- a/infra/azure/templates/build_container.yml
+++ b/infra/azure/templates/build_container.yml
@@ -23,7 +23,7 @@ jobs:
- script: ansible-galaxy collection install containers.podman
displayName: Install Ansible Galaxy collections
- - script: infra/image/build.sh -p -s ${{ parameters.distro }}
+ - script: infra/image/build.sh -s ${{ parameters.distro }}
displayName: Build ${{ parameters.distro }} base image
env:
ANSIBLE_ROLES_PATH: "${PWD}/roles"
diff --git a/infra/image/build.sh b/infra/image/build.sh
index 5e3418c..7167923 100755
--- a/infra/image/build.sh
+++ b/infra/image/build.sh
@@ -15,7 +15,7 @@ valid_distro() {
usage() {
local prog="${0##*/}"
cat << EOF
-usage: ${prog} [-h] [-p] [-n HOSTNAME] [-s] distro
+usage: ${prog} [-h] [-n HOSTNAME] [-s] distro
${prog} build a container image to test ansible-freeipa.
EOF
}
@@ -41,14 +41,14 @@ cpus="2"
memory="3g"
quayname="quay.io/ansible-freeipa/upstream-tests"
deploy_server="N"
-privileged=""
+deploy_capabilities="SYS_ADMIN,SYSLOG"
+capabilities=""
-while getopts ":hn:ps" option
+while getopts ":hn:s" option
do
case "${option}" in
h) help && exit 0 ;;
n) hostname="${OPTARG}" ;;
- p) privileged="privileged" ;;
s) deploy_server="Y" ;;
*) die -u "Invalid option: ${option}" ;;
esac
@@ -66,6 +66,8 @@ container_check
if [ "${deploy_server}" == "Y" ]
then
+ capabilities="${deploy_capabilities}"
+
[ -n "$(command -v "ansible-playbook")" ] || die "ansible-playbook is required to install FreeIPA."
deploy_playbook="${TOPDIR}/playbooks/install-server.yml"
@@ -89,7 +91,7 @@ container_create "${name}" "${tag}" \
"hostname=${hostname}" \
"memory=${memory}" \
"cpus=${cpus}" \
- "${privileged}"
+ "${capabilities:+capabilities=$capabilities}"
container_commit "${name}" "${quayname}:${tag}"
if [ "${deploy_server}" == "Y" ]
diff --git a/infra/image/dockerfile/c10s b/infra/image/dockerfile/c10s
index 969e8f6..247fce1 100644
--- a/infra/image/dockerfile/c10s
+++ b/infra/image/dockerfile/c10s
@@ -13,12 +13,6 @@ dnf --assumeyes install \
hostname; \
rm -rf /var/cache/dnf/;
-# Prepare for basic ipa-server-install in container
-# Address failing nis-domainname.service in the ipa-client-install step
-RUN mv /usr/bin/nisdomainname /usr/bin/nisdomainname.orig
-ADD utils/hostnamectl-wrapper /usr/bin/nisdomainname
-RUN chmod a+rx /usr/bin/nisdomainname
-
RUN (cd /lib/systemd/system/; \
if [ -e dbus-broker.service ] && [ ! -e dbus.service ]; then \
ln -s dbus-broker.service dbus.service; \
diff --git a/infra/image/shcontainer b/infra/image/shcontainer
index 8b736ce..a2d36c6 100644
--- a/infra/image/shcontainer
+++ b/infra/image/shcontainer
@@ -18,7 +18,7 @@ container_create() {
hostname=*) extra_opts+=("--${opt}") ;;
cpus=*) extra_opts+=("--${opt}") ;;
memory=*) extra_opts+=("--${opt}") ;;
- privileged) extra_opts+=("--${opt}") ;;
+ capabilities=*) extra_opts+=("--cap-add=${opt##*=}") ;;
*) log error "container_create: Invalid option: ${opt}" ;;
esac
done
diff --git a/infra/image/utils/hostnamectl-wrapper b/infra/image/utils/hostnamectl-wrapper
deleted file mode 100644
index 19e6f8d..0000000
--- a/infra/image/utils/hostnamectl-wrapper
+++ /dev/null
@@ -1,12 +0,0 @@
-#!/bin/bash -eu
-
-if setpriv --dump | grep -q sys_admin ; then
- if [[ "$( basename $0 )" =~ "domainname" ]] ; then
- /usr/bin/hostname -y "$@"
- else
- $0.orig "$@"
- fi
-else
- echo "Skipping invocation of $0 $@ in unprivileged container." >&2
- exit
-fi
--
GitLab