container-puppet.sh fails if SElinux is enforced and Paunch disabled

[Emilien Macchi]

When disabling Paunch & enabling SElinux, container-puppet.sh script (entrypoint of all Puppet containers) fail to read content from /tmp/puppet-tmp:
http://paste.openstack.org/show/789937/

We need to update OpenStack SElinux podman policy to allows that.

[OpenStack Infra (hudson-openstack)]

Related fix proposed to branch: master
Review: https://review.opendev.org/709562

[Cédric Jeanneret (cjeanner)]

Patch for openstack-selinux is proposed:
https://github.com/redhat-openstack/openstack-selinux/pull/58

[OpenStack Infra (hudson-openstack)]

Related fix proposed to branch: stable/train
Review: https://review.opendev.org/709646

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.opendev.org/709562
Committed: https://git.openstack.org/cgit/openstack/tripleo-ansible/commit/?id=99448e20feabf141a49d6953d980c2de6a7c4b07
Submitter: Zuul
Branch: master

commit 99448e20feabf141a49d6953d980c2de6a7c4b07
Author: Emilien Macchi <email address hidden>
Date: Mon Feb 24 10:58:53 2020 -0500

    container_puppet_config: disable SElinux labelling

    This is a leftover from container-puppet.py that was missed in the
    migration to Ansible. If we don't do that, SElinux will report alerts
    because the entrypoint (container-puppet.sh) tries to copy (and
    therefore read) the content of /tmp/puppet-tmp which isn't readable per
    current OpenStack SElinux podman policies.

    While this is done in the policy, let's port the configuration that was
    done before in container-puppet.py and this patch will be reverted once
    the policy is less restritive.

    Change-Id: I5baefe16f313cc17d369c9f16529516fc8d6f6e5
    Related-Bug: #1864501

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.opendev.org/709646
Committed: https://git.openstack.org/cgit/openstack/tripleo-ansible/commit/?id=888f6d72cbc97c6f41a8101b75485fa9a0590449
Submitter: Zuul
Branch: stable/train

commit 888f6d72cbc97c6f41a8101b75485fa9a0590449
Author: Emilien Macchi <email address hidden>
Date: Mon Feb 24 10:58:53 2020 -0500

    container_puppet_config: disable SElinux labelling

    This is a leftover from container-puppet.py that was missed in the
    migration to Ansible. If we don't do that, SElinux will report alerts
    because the entrypoint (container-puppet.sh) tries to copy (and
    therefore read) the content of /tmp/puppet-tmp which isn't readable per
    current OpenStack SElinux podman policies.

    While this is done in the policy, let's port the configuration that was
    done before in container-puppet.py and this patch will be reverted once
    the policy is less restritive.

    Change-Id: I5baefe16f313cc17d369c9f16529516fc8d6f6e5
    Related-Bug: #1864501
    (cherry picked from commit 99448e20feabf141a49d6953d980c2de6a7c4b07)