)]}'
{"neutron/templates/daemonset-sriov-agent.yaml":[{"author":{"_account_id":24780,"name":"Sangeet Gupta","email":"sg774j@att.com","username":"sgupta"},"change_message_id":"81560db801f700a40471ce8c4dd26ee314e37f34","unresolved":false,"context_lines":[{"line_number":65,"context_line":"{{ tuple $envAll \"neutron_sriov_agent_init\" | include \"helm-toolkit.snippets.image\" | indent 10 }}"},{"line_number":66,"context_line":"{{ tuple $envAll $envAll.Values.pod.resources.agent.sriov | include \"helm-toolkit.snippets.kubernetes_resources\" | indent 10 }}"},{"line_number":67,"context_line":"          securityContext:"},{"line_number":68,"context_line":"            privileged: true"},{"line_number":69,"context_line":"            runAsUser: 0"},{"line_number":70,"context_line":"          command:"},{"line_number":71,"context_line":"            - /tmp/neutron-sriov-agent-init.sh"}],"source_content_type":"text/x-yaml","patch_set":2,"id":"5fc1f717_e4a9bc8f","line":68,"updated":"2019-03-14 21:55:54.000000000","message":"I thought appArmor profile could not be applied to privileged container.\n\nAlso, isn\u0027t default appArmor profile applied by default. It is part of Linux kernel.","commit_id":"584c63c2e9120536005bcb677bac88dca9ee1335"},{"author":{"_account_id":8749,"name":"Evgeniy L","email":"eli@mirantis.com","username":"evgeniyl"},"change_message_id":"5993f2ac9e450fc02150ad9accc9f377c27980ad","unresolved":false,"context_lines":[{"line_number":65,"context_line":"{{ tuple $envAll \"neutron_sriov_agent_init\" | include \"helm-toolkit.snippets.image\" | indent 10 }}"},{"line_number":66,"context_line":"{{ tuple $envAll $envAll.Values.pod.resources.agent.sriov | include \"helm-toolkit.snippets.kubernetes_resources\" | indent 10 }}"},{"line_number":67,"context_line":"          securityContext:"},{"line_number":68,"context_line":"            privileged: true"},{"line_number":69,"context_line":"            runAsUser: 0"},{"line_number":70,"context_line":"          command:"},{"line_number":71,"context_line":"            - /tmp/neutron-sriov-agent-init.sh"}],"source_content_type":"text/x-yaml","patch_set":2,"id":"5fc1f717_8ccd7186","line":68,"in_reply_to":"5fc1f717_e4a9bc8f","updated":"2019-03-15 14:38:22.000000000","message":"I think it is related to the discussion that happens here: https://review.openstack.org/#/c/640173/2/neutron/values.yaml","commit_id":"584c63c2e9120536005bcb677bac88dca9ee1335"}],"neutron/values.yaml":[{"author":{"_account_id":8749,"name":"Evgeniy L","email":"eli@mirantis.com","username":"evgeniyl"},"change_message_id":"a317abcb2b4c7e93afc5deab7fd45b22fef9776d","unresolved":false,"context_lines":[{"line_number":312,"context_line":"          service: local_image_registry"},{"line_number":313,"context_line":""},{"line_number":314,"context_line":"pod:"},{"line_number":315,"context_line":"  mandatory_access_control:"},{"line_number":316,"context_line":"    type: apparmor"},{"line_number":317,"context_line":"    neutron-dhcp-agent-default:"},{"line_number":318,"context_line":"      neutron-dhcp-agent-default: localhost/docker-default"}],"source_content_type":"text/x-yaml","patch_set":2,"id":"5fc1f717_ee254d5d","line":315,"range":{"start_line":315,"start_character":2,"end_line":315,"end_character":26},"updated":"2019-03-12 20:22:25.000000000","message":"Every one of the containers that this patch changes has \"privileged\" set to \"true\", so here are a few questions related to that:\n\n1. Does apparmor configuration takes priority over \"privileged\" flag?\n\n2. If it does and we don\u0027t need unconfined containers, shouldn\u0027t we remove \"privileged\" flags if they are not needed?\n\nThanks!","commit_id":"584c63c2e9120536005bcb677bac88dca9ee1335"},{"author":{"_account_id":29131,"name":"diwakar thyagaraj","email":"diwakar.chitoor.thyagaraj@att.com","username":"dt241s@att.com"},"change_message_id":"473438f22806c7dad7bdf15629457b5236730427","unresolved":false,"context_lines":[{"line_number":312,"context_line":"          service: local_image_registry"},{"line_number":313,"context_line":""},{"line_number":314,"context_line":"pod:"},{"line_number":315,"context_line":"  mandatory_access_control:"},{"line_number":316,"context_line":"    type: apparmor"},{"line_number":317,"context_line":"    neutron-dhcp-agent-default:"},{"line_number":318,"context_line":"      neutron-dhcp-agent-default: localhost/docker-default"}],"source_content_type":"text/x-yaml","patch_set":2,"id":"5fc1f717_e9c98725","line":315,"range":{"start_line":315,"start_character":2,"end_line":315,"end_character":26},"in_reply_to":"5fc1f717_15ec3c28","updated":"2019-03-15 14:08:09.000000000","message":"okay let me give try in lab, I got it deployed locally and get back to you thanks evgeniy","commit_id":"584c63c2e9120536005bcb677bac88dca9ee1335"},{"author":{"_account_id":29131,"name":"diwakar thyagaraj","email":"diwakar.chitoor.thyagaraj@att.com","username":"dt241s@att.com"},"change_message_id":"d686b3bcd7ac97c6b544b7b5f8d8e0098472145d","unresolved":false,"context_lines":[{"line_number":312,"context_line":"          service: local_image_registry"},{"line_number":313,"context_line":""},{"line_number":314,"context_line":"pod:"},{"line_number":315,"context_line":"  mandatory_access_control:"},{"line_number":316,"context_line":"    type: apparmor"},{"line_number":317,"context_line":"    neutron-dhcp-agent-default:"},{"line_number":318,"context_line":"      neutron-dhcp-agent-default: localhost/docker-default"}],"source_content_type":"text/x-yaml","patch_set":2,"id":"5fc1f717_cc3710ff","line":315,"range":{"start_line":315,"start_character":2,"end_line":315,"end_character":26},"in_reply_to":"5fc1f717_63a2bdb0","updated":"2019-03-14 15:29:52.000000000","message":"Thansk Evgeniy,I checked all namespaces under openstack namespaces, I am not sure how to access host networking. Can you guide me on that If you don\u0027t mind please","commit_id":"584c63c2e9120536005bcb677bac88dca9ee1335"},{"author":{"_account_id":8749,"name":"Evgeniy L","email":"eli@mirantis.com","username":"evgeniyl"},"change_message_id":"f6dc9d285baff99a9ee5a4fe4ad269d4407cede9","unresolved":false,"context_lines":[{"line_number":312,"context_line":"          service: local_image_registry"},{"line_number":313,"context_line":""},{"line_number":314,"context_line":"pod:"},{"line_number":315,"context_line":"  mandatory_access_control:"},{"line_number":316,"context_line":"    type: apparmor"},{"line_number":317,"context_line":"    neutron-dhcp-agent-default:"},{"line_number":318,"context_line":"      neutron-dhcp-agent-default: localhost/docker-default"}],"source_content_type":"text/x-yaml","patch_set":2,"id":"5fc1f717_f02f5a85","line":315,"range":{"start_line":315,"start_character":2,"end_line":315,"end_character":26},"in_reply_to":"5fc1f717_8796deef","updated":"2019-03-13 16:41:29.000000000","message":"Thank you for your response, sure, I understand what \"privileged\" means. The question is don\u0027t \"privileged\" \u003d true conflicts with apparmor profiles that are set here?\n\nHere is how docker handles that:\n\nhttps://github.com/moby/moby/blob/8e610b2b55bfd1bfa9436ab110d311f5e8a74dcb/daemon/container_linux.go#L21-L28\n\nhttps://github.com/moby/moby/blob/46036c230805d55eed797c45678e5e69ef9c1386/daemon/oci_linux.go#L835-L841\n\nE.g. in neutron l3 agent there is the following configuration:\n\n      hostNetwork: true\n      shareProcessNamespace: true\n      hostPID: true\n      containers:\n        - name: neutron-l3-agent\n          securityContext:\n            privileged: true\n\nThis is the reason I have the following questions:\n\n1. Who does take the priority, \"privileged: true\" with its overrides, or the profile that is defined here?\n\n2. Have you verified that all capabilities that l3 agent requires (access host networking and manage namespaces) are working when \"localhost/docker-default\" is configured? And taking into account links to docker source code, have you had a chance to check that all these containers are run with \"localhost/docker-default\" and not \"unconfined\" apparmor profile?\n\nMaybe there is some k8s magic that handles that, which I\u0027m not aware of.","commit_id":"584c63c2e9120536005bcb677bac88dca9ee1335"},{"author":{"_account_id":8749,"name":"Evgeniy L","email":"eli@mirantis.com","username":"evgeniyl"},"change_message_id":"4049c7f5f5550838e3f61866aa89e22648678923","unresolved":false,"context_lines":[{"line_number":312,"context_line":"          service: local_image_registry"},{"line_number":313,"context_line":""},{"line_number":314,"context_line":"pod:"},{"line_number":315,"context_line":"  mandatory_access_control:"},{"line_number":316,"context_line":"    type: apparmor"},{"line_number":317,"context_line":"    neutron-dhcp-agent-default:"},{"line_number":318,"context_line":"      neutron-dhcp-agent-default: localhost/docker-default"}],"source_content_type":"text/x-yaml","patch_set":2,"id":"5fc1f717_dd2b3c92","line":315,"range":{"start_line":315,"start_character":2,"end_line":315,"end_character":26},"in_reply_to":"5fc1f717_cc3710ff","updated":"2019-03-14 17:24:37.000000000","message":"When I say \"namespaces\" I mean Linux network namespaces, if you start a VM with floating IP assigned, you should be able to see namespaces got created by neutron-l3-agent \n\n    $ sudo ip netns list\n    qrouter-921611a1-1017-45f5-88b5-32fd07e443eb (id: 33)\n    qrouter-85ec2aa7-0235-4e32-8624-a1125b7635b1 (id: 20)\n    qrouter-22050654-0815-4884-97eb-60689adda845 (id: 24)\n\nAlso I would recommend checking audit logs on the host to see if there are new syscalls that were denied.\n\nThe reason I\u0027m unsure about the functionality after this change is I see that this would prohibit write access to /proc/sys [1], which may be required e.g. during sysctl calls from neutron [2].\n\n\n[1] https://github.com/moby/moby/blob/master/profiles/apparmor/template.go#L30\n\n[2] https://github.com/openstack/neutron/blob/45e73be4162a2cf9865ced874957505741920f95/neutron/agent/l3/namespaces.py#L91-L108","commit_id":"584c63c2e9120536005bcb677bac88dca9ee1335"},{"author":{"_account_id":8749,"name":"Evgeniy L","email":"eli@mirantis.com","username":"evgeniyl"},"change_message_id":"de1120506079d8bb64bc42ad7ad472aedb8d9cd4","unresolved":false,"context_lines":[{"line_number":312,"context_line":"          service: local_image_registry"},{"line_number":313,"context_line":""},{"line_number":314,"context_line":"pod:"},{"line_number":315,"context_line":"  mandatory_access_control:"},{"line_number":316,"context_line":"    type: apparmor"},{"line_number":317,"context_line":"    neutron-dhcp-agent-default:"},{"line_number":318,"context_line":"      neutron-dhcp-agent-default: localhost/docker-default"}],"source_content_type":"text/x-yaml","patch_set":2,"id":"5fc1f717_15ec3c28","line":315,"range":{"start_line":315,"start_character":2,"end_line":315,"end_character":26},"in_reply_to":"5fc1f717_dd2b3c92","updated":"2019-03-14 17:27:55.000000000","message":"Also if you check this on a development environment, you may have network namespaces left after the initial deployment created by \"unconfined\" Neutron, one of the way to double-check this is to delete network namespaces manually and restart l3-agent pod.","commit_id":"584c63c2e9120536005bcb677bac88dca9ee1335"},{"author":{"_account_id":29131,"name":"diwakar thyagaraj","email":"diwakar.chitoor.thyagaraj@att.com","username":"dt241s@att.com"},"change_message_id":"d48952f1ea3cc25050e9a65f96a9b23efc92db7e","unresolved":false,"context_lines":[{"line_number":312,"context_line":"          service: local_image_registry"},{"line_number":313,"context_line":""},{"line_number":314,"context_line":"pod:"},{"line_number":315,"context_line":"  mandatory_access_control:"},{"line_number":316,"context_line":"    type: apparmor"},{"line_number":317,"context_line":"    neutron-dhcp-agent-default:"},{"line_number":318,"context_line":"      neutron-dhcp-agent-default: localhost/docker-default"}],"source_content_type":"text/x-yaml","patch_set":2,"id":"5fc1f717_7f17c946","line":315,"range":{"start_line":315,"start_character":2,"end_line":315,"end_character":26},"in_reply_to":"5fc1f717_ee254d5d","updated":"2019-03-12 22:04:58.000000000","message":"Evgeniy, this is for enabling  AppArmor Profile","commit_id":"584c63c2e9120536005bcb677bac88dca9ee1335"},{"author":{"_account_id":29131,"name":"diwakar thyagaraj","email":"diwakar.chitoor.thyagaraj@att.com","username":"dt241s@att.com"},"change_message_id":"b5f8b5ada87eab8419691937786c08e076ca9c98","unresolved":false,"context_lines":[{"line_number":312,"context_line":"          service: local_image_registry"},{"line_number":313,"context_line":""},{"line_number":314,"context_line":"pod:"},{"line_number":315,"context_line":"  mandatory_access_control:"},{"line_number":316,"context_line":"    type: apparmor"},{"line_number":317,"context_line":"    neutron-dhcp-agent-default:"},{"line_number":318,"context_line":"      neutron-dhcp-agent-default: localhost/docker-default"}],"source_content_type":"text/x-yaml","patch_set":2,"id":"5fc1f717_8796deef","line":315,"range":{"start_line":315,"start_character":2,"end_line":315,"end_character":26},"in_reply_to":"5fc1f717_ee254d5d","updated":"2019-03-13 15:27:05.000000000","message":"Hi Evgeniy,\nBy default a container is not allowed to access any devices on the host, but a “privileged” container is given access to all devices on the host. This allows the container nearly all the same access as processes running on the host. So we both to be used. Hopefully I answered what you\u0027re looking for.\nThanks","commit_id":"584c63c2e9120536005bcb677bac88dca9ee1335"},{"author":{"_account_id":29131,"name":"diwakar thyagaraj","email":"diwakar.chitoor.thyagaraj@att.com","username":"dt241s@att.com"},"change_message_id":"fc211e1175955fb67d61971db5d76c403ae6d596","unresolved":false,"context_lines":[{"line_number":312,"context_line":"          service: local_image_registry"},{"line_number":313,"context_line":""},{"line_number":314,"context_line":"pod:"},{"line_number":315,"context_line":"  mandatory_access_control:"},{"line_number":316,"context_line":"    type: apparmor"},{"line_number":317,"context_line":"    neutron-dhcp-agent-default:"},{"line_number":318,"context_line":"      neutron-dhcp-agent-default: localhost/docker-default"}],"source_content_type":"text/x-yaml","patch_set":2,"id":"5fc1f717_f65d1215","line":315,"range":{"start_line":315,"start_character":2,"end_line":315,"end_character":26},"in_reply_to":"5fc1f717_f02f5a85","updated":"2019-03-13 17:56:17.000000000","message":"More Output for all neutron pods.\n\nraj@ubuntu:~/openstack-helm-infra$ for OUTPUT in $(kubectl get pods --all-namespaces -o wide | grep 1/1 | grep neutron | awk \u0027{print $2}\u0027); do kubectl exec -it $OUTPUT -n openstack cat /proc/1/attr/current; done\ndocker-default (enforce)\ndocker-default (enforce)\ndocker-default (enforce)\ndocker-default (enforce)\ndocker-default (enforce)\nraj@ubuntu:~/openstack-helm-infra$","commit_id":"584c63c2e9120536005bcb677bac88dca9ee1335"},{"author":{"_account_id":29131,"name":"diwakar thyagaraj","email":"diwakar.chitoor.thyagaraj@att.com","username":"dt241s@att.com"},"change_message_id":"2ff5eada4fe40f97d6285c919e6f8398e7ebb98f","unresolved":false,"context_lines":[{"line_number":312,"context_line":"          service: local_image_registry"},{"line_number":313,"context_line":""},{"line_number":314,"context_line":"pod:"},{"line_number":315,"context_line":"  mandatory_access_control:"},{"line_number":316,"context_line":"    type: apparmor"},{"line_number":317,"context_line":"    neutron-dhcp-agent-default:"},{"line_number":318,"context_line":"      neutron-dhcp-agent-default: localhost/docker-default"}],"source_content_type":"text/x-yaml","patch_set":2,"id":"5fc1f717_fb017b07","line":315,"range":{"start_line":315,"start_character":2,"end_line":315,"end_character":26},"in_reply_to":"5fc1f717_f02f5a85","updated":"2019-03-13 17:52:46.000000000","message":"Yes I did verify it \nraj@ubuntu:~/openstack-helm-infra$ kubectl exec neutron-l3-agent-default-7ls82 -n openstack -c neutron-l3-agent-default cat /proc/1/attr/current\ndocker-default (enforce)\nraj@ubuntu:~/openstack-helm-infra$ kubectl describe pods neutron-l3-agent-default-7ls82 -n openstack\nName:           neutron-l3-agent-default-7ls82\nNamespace:      openstack\nNode:           ubuntu/172.17.0.1\nStart Time:     Thu, 07 Mar 2019 21:18:04 -0600\nLabels:         application\u003dneutron\n                component\u003dl3-agent\n                controller-revision-hash\u003d1716238515\n                pod-template-generation\u003d1\n                release_group\u003dneutron\nAnnotations:    configmap-bin-hash\u003dbc4839421cd439dd76e4969f3eed85cb764eebd935070484aad066a9ff48f818\n                configmap-etc-hash\u003deeb0ce41b699561603a4c816e2115c7c20a32049c50f890a32bcfdf7521cde02\n                container.apparmor.security.beta.kubernetes.io/neutron-l3-agent-default\u003dlocalhost/docker-default\n                openstackhelm.openstack.org/release_uuid\u003d\nStatus:         Running\nIP:             172.17.0.1\nControlled By:  DaemonSet/neutron-l3-agent-default\nInit Containers:","commit_id":"584c63c2e9120536005bcb677bac88dca9ee1335"},{"author":{"_account_id":8749,"name":"Evgeniy L","email":"eli@mirantis.com","username":"evgeniyl"},"change_message_id":"0fd38ea54df2e770c57de5e59f7fdeb1ce9b4cb3","unresolved":false,"context_lines":[{"line_number":312,"context_line":"          service: local_image_registry"},{"line_number":313,"context_line":""},{"line_number":314,"context_line":"pod:"},{"line_number":315,"context_line":"  mandatory_access_control:"},{"line_number":316,"context_line":"    type: apparmor"},{"line_number":317,"context_line":"    neutron-dhcp-agent-default:"},{"line_number":318,"context_line":"      neutron-dhcp-agent-default: localhost/docker-default"}],"source_content_type":"text/x-yaml","patch_set":2,"id":"5fc1f717_63a2bdb0","line":315,"range":{"start_line":315,"start_character":2,"end_line":315,"end_character":26},"in_reply_to":"5fc1f717_f65d1215","updated":"2019-03-13 21:48:40.000000000","message":"Thanks, this answers first part of the question, apparmor profile takes priority over privileged flag (unconfined), looking into apparmor profile I see quite strict rules https://github.com/moby/moby/blob/master/profiles/apparmor/template.go#L37-L43 that e.g. block any writes to /sys/class/net\n\nCan you also confirm a second part of the question?\n\n   Have you verified that all capabilities that l3 agent requires (access host networking and manage namespaces) are working when \"localhost/docker-default\" is configured?","commit_id":"584c63c2e9120536005bcb677bac88dca9ee1335"}]}