Add openvswitch-ipsec service image

docker/base/start.sh

@@ -16,7 +16,7 @@ ARGS=""
 sudo kolla_copy_cacerts
 
 # Install projects that are in /dev-mode
-kolla_install_projects
+sudo kolla_install_projects
 
 if [[ ! "${!KOLLA_SKIP_EXTEND_START[@]}" ]]; then
     # Run additional commands if present

docker/base/sudoers

@@ -20,4 +20,7 @@ root ALL=(ALL) ALL
 # Copy custom CA certificates to containers
 %kolla ALL=(root) NOPASSWD: /usr/local/bin/kolla_copy_cacerts
 
+# Install projects in dev-mode
+%kolla ALL=(root) NOPASSWD: /usr/local/bin/kolla_install_projects
+
 #includedir /etc/sudoers.d

docker/opensearch/opensearch-dashboards/Dockerfile.j2

@@ -10,20 +10,7 @@ LABEL maintainer="{{ maintainer }}" name="{{ image_name }}" build-date="{{ build
 {{ macros.configure_user(name='opensearch-dashboards', shell='/bin/bash', homedir='/usr/share/opensearch-dashboards') }}
 {{ macros.enable_extra_repos(['opensearch-dashboards']) }}
 
-# NOTE(mgoddard): Pinning to 2.15 due to https://bugs.launchpad.net/kolla/+bug/2077319
-{% if base_package_type == 'deb' %}
-COPY apt_preferences_opensearch_dashboards /etc/apt/preferences.d/opensearch_dashboards
-{% endif %}
-
-{% if base_package_type == 'rpm' %}
-    {% set opensearch_dashboards_packages = [
-        'opensearch-dashboards-2.15.*'
-    ] %}
-{% elif base_package_type == 'deb' %}
-    {% set opensearch_dashboards_packages = [
-        'opensearch-dashboards'
-    ] %}
-{% endif %}
+{% set opensearch_dashboards_packages = ['opensearch-dashboards'] %}
 
 {{ macros.install_packages(opensearch_dashboards_packages | customizable("packages")) }}
 

docker/openvswitch/openvswitch-ipsec/Dockerfile.j2

@@ -0,0 +1,51 @@
+FROM {{ namespace }}/{{ image_prefix }}openvswitch-base:{{ tag }}
+{% block labels %}
+    LABEL maintainer="{{ maintainer }}" name="{{ image_name }}" build-date="{{ build_date }}"
+{% endblock %}
+
+{% block openvswitch_ipsec_header %}{% endblock %}
+
+{% import "macros.j2" as macros with context %}
+
+{{ macros.enable_extra_repos(['openvswitch']) }}
+
+{% block ovs_ipsec_install %}
+
+{% if base_package_type == 'rpm' %}
+    {% set openvswitch_ipsec_packages = [
+        'xz',
+        'libreswan',
+        'openvswitch3.3-ipsec',
+    ] %}
+{% elif base_package_type == 'deb' %}
+    {% set openvswitch_ipsec_packages = [
+        'libreswan',
+        'openvswitch-ipsec',
+    ] %}
+
+{% endif %}
+{{ macros.install_packages(openvswitch_ipsec_packages | customizable("packages")) }}
+
+{% endblock %}
+
+{% block install_supervision %}
+{% set s6_overlay_version = 'v3.2.0.0' %}
+{% set s6_overlay_url = 'https://github.com/just-containers/s6-overlay/releases/download/' %}
+{% set s6_overlay_noarch_checksum = 'sha256:4b0c0907e6762814c31850e0e6c6762c385571d4656eb8725852b0b1586713b6' %}
+ADD --checksum={{ s6_overlay_noarch_checksum }} \
+    {{ s6_overlay_url }}/{{ s6_overlay_version }}/s6-overlay-noarch.tar.xz /tmp
+RUN tar -C / -Jxpf /tmp/s6-overlay-noarch.tar.xz \
+    && rm /tmp/s6-overlay-noarch.tar.xz
+ADD {{ s6_overlay_url }}/{{ s6_overlay_version }}/s6-overlay-{{ base_arch }}.tar.xz /tmp
+RUN tar -C / -Jxpf /tmp/s6-overlay-{{ base_arch }}.tar.xz \
+    && rm /tmp/s6-overlay-{{ base_arch }}.tar.xz
+{% endblock %}
+
+COPY s6-rc.d/ /etc/s6-overlay/s6-rc.d/
+RUN chmod -R 755 /etc/s6-overlay
+
+{% block openvswitch_ipsec_footer %}{% endblock %}
+{% block footer %}
+ENTRYPOINT [ "/init" ]
+CMD []
+{% endblock %}

docker/openvswitch/openvswitch-ipsec/s6-rc.d/ike_daemon/finish

@@ -0,0 +1,2 @@
+#!/bin/sh
+exit 111

docker/openvswitch/openvswitch-ipsec/s6-rc.d/ike_daemon/run

@@ -0,0 +1,8 @@
+#!/command/execlineb -P
+/usr/libexec/ipsec/pluto \
+    --leak-detective \
+    --config /etc/ipsec.conf \
+    --rundir /run/openvswitch \
+    --nssdir /etc/ipsec.d \
+    --nofork \
+    --logfile /var/log/kolla/openvswitch/pluto.log

docker/openvswitch/openvswitch-ipsec/s6-rc.d/ike_daemon/type

@@ -0,0 +1 @@
+longrun

docker/openvswitch/openvswitch-ipsec/s6-rc.d/ipsec_check_config/type

@@ -0,0 +1 @@
+oneshot

docker/openvswitch/openvswitch-ipsec/s6-rc.d/ipsec_check_config/up

@@ -0,0 +1,4 @@
+#!/command/execlineb -P
+/usr/libexec/ipsec/addconn \
+    --config /etc/ipsec.conf \
+    --checkconfig

docker/openvswitch/openvswitch-ipsec/s6-rc.d/ipsec_check_modules/type

@@ -0,0 +1 @@
+oneshot

docker/openvswitch/openvswitch-ipsec/s6-rc.d/ipsec_check_modules/up

@@ -0,0 +1,2 @@
+#!/command/execlineb -P
+/usr/libexec/ipsec/_stackmanager start

docker/openvswitch/openvswitch-ipsec/s6-rc.d/ipsec_check_nflog/type

@@ -0,0 +1 @@
+oneshot

docker/openvswitch/openvswitch-ipsec/s6-rc.d/ipsec_check_nflog/up

@@ -0,0 +1,2 @@
+#!/command/execlineb -P
+/usr/sbin/ipsec --checknflog

docker/openvswitch/openvswitch-ipsec/s6-rc.d/ipsec_monitor/finish

@@ -0,0 +1,2 @@
+#!/bin/sh
+exit 111

docker/openvswitch/openvswitch-ipsec/s6-rc.d/ipsec_monitor/run

@@ -0,0 +1,8 @@
+#!/command/execlineb -P
+/usr/share/openvswitch/scripts/ovs-monitor-ipsec \
+    --no-restart-ike-daemon \
+    --ike-daemon=libreswan \
+    --pidfile=/run/openvswitch/ovs-monitor-ipsec.pid \
+    --ipsec-ctl=/run/openvswitch/pluto.ctl \
+    --log-file=/var/log/kolla/openvswitch/ovs-monitor-ipsec.log
+    unix:/run/openvswitch/db.sock

docker/openvswitch/openvswitch-ipsec/s6-rc.d/ipsec_monitor/type

@@ -0,0 +1 @@
+longrun

docker/openvswitch/openvswitch-ipsec/s6-rc.d/ipsec_nss/type

@@ -0,0 +1 @@
+oneshot

docker/openvswitch/openvswitch-ipsec/s6-rc.d/ipsec_nss/up

@@ -0,0 +1,2 @@
+#!/command/execlineb -P
+/usr/sbin/ipsec --checknss

docker/openvswitch/openvswitch-ipsec/s6-rc.d/kolla_start/type

@@ -0,0 +1 @@
+oneshot

docker/openvswitch/openvswitch-ipsec/s6-rc.d/kolla_start/up

@@ -0,0 +1,2 @@
+#!/command/execlineb -S0
+/command/with-contenv kolla_start

docker/openvswitch/openvswitch-ipsec/s6-rc.d/user/type

@@ -0,0 +1 @@
+bundle