podman fails to apply z flag when glance-api is using NFS

[Alan Bishop]

When glance-api is configured to use NFS, podman fails when trying to relabel /var/lib/glance with the z flag. This is similar to what nova encountered in https://bugs.launchpad.net/tripleo/+bug/1835503.

The overcloud fails to deploy:

/var/lib/mistral/overcloud/ansible.log:108852: "Error running ['podman', 'run', '--name', 'glance_api_db_sync', '--label', 'config_id=tripleo_step3', '--label', 'container_name=glance_api_db_sync', '--label', 'managed_by=paunch', '--label', 'config_data={\"command\": \"/usr/bin/bootstrap_host_exec glance_api su glance -s /bin/bash -c \\'/usr/local/bin/kolla_start\\'\", \"detach\": false, \"environment\": [\"KOLLA_BOOTSTRAP=True\", \"KOLLA_CONFIG_STRATEGY=COPY_ALWAYS\", \"TRIPLEO_CONFIG_HASH=da62b423adc85a20e373ceb54e07fe89\"], \"image\": \"192.168.24.1:8787/rhosp15/openstack-glance-api:20190806.1\", \"net\": \"host\", \"privileged\": false, \"user\": \"root\", \"volumes\": [\"/etc/hosts:/etc/hosts:ro\", \"/etc/localtime:/etc/localtime:ro\", \"/etc/pki/ca-trust/extracted:/etc/pki/ca-trust/extracted:ro\", \"/etc/pki/ca-trust/source/anchors:/etc/pki/ca-trust/source/anchors:ro\", \"/etc/pki/tls/certs/ca-bundle.crt:/etc/pki/tls/certs/ca-bundle.crt:ro\", \"/etc/pki/tls/certs/ca-bundle.trust.crt:/etc/pki/tls/certs/ca-bundle.trust.crt:ro\", \"/etc/pki/tls/cert.pem:/etc/pki/tls/cert.pem:ro\", \"/dev/log:/dev/log\", \"/etc/ssh/ssh_known_hosts:/etc/ssh/ssh_known_hosts:ro\", \"/etc/puppet:/etc/puppet:ro\", \"/var/log/containers/glance:/var/log/glance:z\", \"/var/lib/kolla/config_files/glance_api.json:/var/lib/kolla/config_files/config.json\", \"/var/lib/config-data/puppet-generated/glance_api/:/var/lib/kolla/config_files/src:ro\", \"/etc/ceph:/var/lib/kolla/config_files/src-ceph:ro\", \"/var/lib/glance:/var/lib/glance:slave,z\"]}', '--conmon-pidfile=/var/run/glance_api_db_sync.pid', '--log-driver', 'json-file', '--log-opt', 'path=/var/log/containers/stdouts/glance_api_db_sync.log', '--env=KOLLA_BOOTSTRAP=True', '--env=KOLLA_CONFIG_STRATEGY=COPY_ALWAYS', '--env=TRIPLEO_CONFIG_HASH=da62b423adc85a20e373ceb54e07fe89', '--net=host', '--privileged=false', '--user=root', '--volume=/etc/hosts:/etc/hosts:ro', '--volume=/etc/localtime:/etc/localtime:ro', '--volume=/etc/pki/ca-trust/extracted:/etc/pki/ca-trust/extracted:ro', '--volume=/etc/pki/ca-trust/source/anchors:/etc/pki/ca-trust/source/anchors:ro', '--volume=/etc/pki/tls/certs/ca-bundle.crt:/etc/pki/tls/certs/ca-bundle.crt:ro', '--volume=/etc/pki/tls/certs/ca-bundle.trust.crt:/etc/pki/tls/certs/ca-bundle.trust.crt:ro', '--volume=/etc/pki/tls/cert.pem:/etc/pki/tls/cert.pem:ro', '--volume=/dev/log:/dev/log', '--volume=/etc/ssh/ssh_known_hosts:/etc/ssh/ssh_known_hosts:ro', '--volume=/etc/puppet:/etc/puppet:ro', '--volume=/var/log/containers/glance:/var/log/glance:z', '--volume=/var/lib/kolla/config_files/glance_api.json:/var/lib/kolla/config_files/config.json', '--volume=/var/lib/config-data/puppet-generated/glance_api/:/var/lib/kolla/config_files/src:ro', '--volume=/etc/ceph:/var/lib/kolla/config_files/src-ceph:ro', '--volume=/var/lib/glance:/var/lib/glance:slave,z', '192.168.24.1:8787/rhosp15/openstack-glance-api:20190806.1', '/usr/bin/bootstrap_host_exec', 'glance_api', 'su', 'glance', '-s', '/bin/bash', '-c', \"'/usr/local/bin/kolla_start'\"]. [127]",
<snip>

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.opendev.org/682768

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/stein
Review: https://review.opendev.org/683960

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.opendev.org/682768
Committed: https://git.openstack.org/cgit/openstack/tripleo-heat-templates/commit/?id=aa1f4bf62156fa5e72b8171702acf3db755a67d8
Submitter: Zuul
Branch: master

commit aa1f4bf62156fa5e72b8171702acf3db755a67d8
Author: Alan Bishop <email address hidden>
Date: Tue Sep 17 17:24:46 2019 -0700

    Fix selinux context for glance-api

    Remove the z flag from glance-api's service directory. The service
    directory does not need to be shared with other containers, and
    podman fails to apply setting with glance is using NFS (i.e.
    /var/lib/glance/images is a mount point).

    Also update the NFS mount options to use svirt_sandbox_file_t, which
    is consistent with the parent service directory.

    Closes-Bug: #1834857
    Closes-Bug: #1844465
    Change-Id: I7e135615fb53815ce14a3bcfec42b28f86d6dbae

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.opendev.org/683960
Committed: https://git.openstack.org/cgit/openstack/tripleo-heat-templates/commit/?id=fb431ccebec81df53f247c0962225c646adee473
Submitter: Zuul
Branch: stable/stein

commit fb431ccebec81df53f247c0962225c646adee473
Author: Alan Bishop <email address hidden>
Date: Tue Sep 17 17:24:46 2019 -0700

    Fix selinux context for glance-api

    Remove the z flag from glance-api's service directory. The service
    directory does not need to be shared with other containers, and
    podman fails to apply setting with glance is using NFS (i.e.
    /var/lib/glance/images is a mount point).

    Also update the NFS mount options to use svirt_sandbox_file_t, which
    is consistent with the parent service directory.

    Closes-Bug: #1834857
    Closes-Bug: #1844465
    Change-Id: I7e135615fb53815ce14a3bcfec42b28f86d6dbae
    (cherry picked from commit aa1f4bf62156fa5e72b8171702acf3db755a67d8)

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/tripleo-heat-templates 11.3.0 release.

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/tripleo-heat-templates 10.6.2 release.