15e0d6c7df
Rsyslog on Noble has apparmor rules that restrict rsyslog socket creation to /var/lib/*/dev/log. Previously we were configuring haproxy hosts to create an rsyslog socket for haproxy at /var/haproxy/dev/log which doesn't match the apparmor rule so gets denied. To address this we move all the host side haproxy config from /var/haproxy to /var/lib/haproxy. This allows rsyslog to create the socket. To avoid needing to update docker images (for haproxy statsd) and to continue to make the haproxy container itself happy we don't adjust paths on the target side of our bind mounts. This means some things still refer to /var/haproxy but they should all be within containers. I don't believe this will be impactful to existing load balancer servers. We should deploy new content to /var/lib/haproxy then automatically restart services (rsyslog and haproxy container) because their configs are updating. One potential problem with this is rsyslog will restart before the containers do and its log path will have moved. If we are concerned about this we can configure rsyslog to continue to attempt to create the old path in addition to the new path (this will fail on Noble). Change-Id: I4582e6b2dda188583f76265ab78bcb00a302e375
98 lines
2.3 KiB
YAML
98 lines
2.3 KiB
YAML
- name: Install socat for haproxy management
|
|
package:
|
|
name: socat
|
|
state: present
|
|
|
|
- name: Ensure haproxy volume directories exists
|
|
# Note on the host side we create everything under /var/lib/haproxy to
|
|
# make rsyslog apparmor rules for /var/lib/haproxy/dev/log happy.
|
|
# But within the containers /var/haproxy paths are still used.
|
|
file:
|
|
state: directory
|
|
path: "/var/lib/haproxy/{{ item }}"
|
|
owner: 1000
|
|
group: 1000
|
|
loop:
|
|
- etc
|
|
- run
|
|
- dev
|
|
|
|
- name: Ensure haproxy config template available
|
|
assert:
|
|
that:
|
|
- haproxy_config_template is defined
|
|
|
|
- name: Write rsyslog file
|
|
copy:
|
|
src: rsyslog.d/49-haproxy.conf
|
|
dest: /etc/rsyslog.d/
|
|
owner: root
|
|
group: root
|
|
mode: 0644
|
|
register: _rsyslog_added
|
|
|
|
- name: Restart rsyslog if config updates
|
|
service:
|
|
name: rsyslog
|
|
state: restarted
|
|
when: _rsyslog_added.changed
|
|
|
|
- name: Add haproxy log rotation
|
|
include_role:
|
|
name: logrotate
|
|
vars:
|
|
logrotate_file_name: '/var/log/haproxy.log'
|
|
|
|
- name: Write haproxy config file
|
|
template:
|
|
src: '{{ haproxy_config_template }}'
|
|
dest: /var/lib/haproxy/etc/haproxy.cfg
|
|
owner: 1000
|
|
group: 1000
|
|
mode: 0644
|
|
notify: Reload haproxy
|
|
|
|
# Copy in testing CA so the container can see it. When running under
|
|
# Zuul this CA is created by the test framework. We use it to
|
|
# validate the https check path
|
|
- name: Check for OpenDev Infra CA (test only)
|
|
stat:
|
|
path: /etc/opendev-ca/ca.crt
|
|
register: _opendev_ca_crt
|
|
- name: Copy in OpenDev Infra CA (test only)
|
|
copy:
|
|
src: /etc/opendev-ca/ca.crt
|
|
dest: /var/lib/haproxy/etc/
|
|
when: _opendev_ca_crt.stat.exists
|
|
|
|
- name: Ensure docker compose configuration directory
|
|
file:
|
|
path: /etc/haproxy-docker
|
|
state: directory
|
|
owner: root
|
|
group: root
|
|
mode: 0755
|
|
|
|
- name: Install docker-compose configuration
|
|
template:
|
|
src: docker-compose.yaml.j2
|
|
dest: /etc/haproxy-docker/docker-compose.yaml
|
|
owner: root
|
|
group: root
|
|
mode: 0644
|
|
notify: Reload haproxy
|
|
|
|
- name: Run docker-compose pull
|
|
shell:
|
|
cmd: docker-compose pull
|
|
chdir: /etc/haproxy-docker/
|
|
|
|
- name: Run docker-compose up
|
|
shell:
|
|
cmd: docker-compose up -d
|
|
chdir: /etc/haproxy-docker/
|
|
|
|
- name: Run docker prune to cleanup unneeded images
|
|
shell:
|
|
cmd: docker image prune -f
|