Jail role #21

seankelly · 2014-11-26T03:43:37Z

Other roles would depend on the jail role and pass the parameters (currently name and ip_address) for the jail to it. Note this does not start the jail.

The jails will be configured via Ansible so minimal configuration needs to happen from the flavour.

seankelly · 2014-11-26T03:58:11Z

Note: this role needs to update /etc/jail.conf still. I think this is the reason why it's annoying to automate.

djmitche · 2014-11-26T03:59:01Z

It seems like it's beyond lineinfile's capabilities. Could we write an Ansible module that can parse, update, and re-write the file? Or maybe I don't understand the difficulty..

verm · 2014-11-26T03:59:29Z

roles/jail/files/flavours/base/etc/make.conf

+
+NO_DOCS=yes
+NOPORTDOCS=yes
+NOPORTEXAMPLES=yes


OPTIONS_UNSET=DOCS EXAMPLES

Thea above is the correct way to do this for FreeBSD 10. The old configs were for when we used 9

Ah yes, OPTIONS. I've seen stuff about that in UPDATING, but I forgot about it otherwise. Thanks for noting what needed to be changed.

seankelly · 2014-11-26T04:04:37Z

The primary difficulty is the config is multiple lines. However, the man pages mention it's vaguely like C, so I'm wondering if it could all be on a single line. If not, then we would want an Ansible module.

seankelly · 2014-11-26T04:10:08Z

Making a module might be required anyway if we want to do anything more complex than just add jails. This role can't delete jails for instance

sa2ajj · 2014-11-26T14:17:43Z

LGTM to the extent I understand what happens.

I think the best is to add some playbook to create a jail, so we could see it action (it actually creates a jail, and it creates a useful jail :)).

djmitche · 2014-11-26T14:22:11Z

Agreed - I think @verm knows the most about jails, at least in FreeBSD 10, and has indicated there are some tricky bits, so I'd like to try this out and experience those tricky bits for myself. You can only learn to fall off a horse by falling off a horse, after all. But this functionality is a prerequisite for doing a lot of other stuff (and for a much easier kind of local testing: repeat([delete jail, run Ansible]))

seankelly · 2014-11-27T02:23:38Z

Conveniently I have a jail playbook.

sa2ajj · 2014-11-27T16:21:47Z

jail.yml

+- name: Jail test
+  hosts: servicehosts
+  roles:
+      - { role: jail, name: jailtest.buildbot.net, ip_address: ['vtnet0|192.168.122.16'] }


So we will also need to specify the interface as well?

I'm a bit concerned about this since some of our jails have only internal addresses and some have both.

I believe so, yes. The jail can have addresses on any number of interfaces. Testing on a VM indicates the interface needs to be included.

sa2ajj · 2014-11-27T17:52:15Z

To make the example more specific, let's create a jail for TRAC-3068

seankelly · 2014-12-02T04:06:49Z

Further experimenting shows the jail configuration in /etc/jail.conf can be on a single line. If all of the jails do not need additional options beyond what any other jail requires, then the lineinfile module might be good enough.

sa2ajj · 2014-12-02T16:23:22Z

I think we should start with the lineinfile module and see if it's sufficient. It might well be that if we need something "sophisticated", we actually do something wrong :)

djmitche · 2014-12-02T19:43:37Z

djmitche@c5649d6 was necessary for me to get this working (still playing with it)

seankelly · 2014-12-03T01:52:32Z

Oh, yeah, need to install it. Not sure how I missed that.

This is the safe name that is used to identify it in /etc/jail.conf.

The config file is created in /usr/local/etc/ezjail and uses the jail's safe name.

seankelly · 2014-12-03T04:09:34Z

I think I got everything now.

sa2ajj · 2014-12-03T16:17:43Z

roles/jail/tasks/main.yml

+---
+- name: Install ezjail
+  pkgng:
+    name: ezjail


I like thing explicit: state: present?

seankelly · 2014-12-04T03:15:15Z

Updated.

sa2ajj · 2014-12-04T17:14:56Z

jail.yml

+  hosts: servicehosts
+  roles:
+    - role: jail
+      name: jailtest.buildbot.net


can we actually just put real jail here, for example, I suggested pgsql.int.

sa2ajj · 2014-12-04T17:16:38Z

LGTM

Unsure whether this should go in the docs or the directory of the role. I opted for the latter thinking if someone wanted to learn how to use the role, they would be more likely to look in the role's directory.

seankelly · 2014-12-05T02:34:31Z

Done I think. Moved the example playbook to a README in the jail directory.

Jail role

sa2ajj · 2014-12-14T18:11:13Z

roles/jail/templates/ezjail.conf

+ezjail_jailtemplate="${ezjail_jaildir}/newjail"
+ezjail_jailbase="${ezjail_jaildir}/base"
+ezjail_sourcetree=/usr/src
+ezjail_ftphost=freebsd.isc.org


@seankelly any reason you used freebsd.isc.org here? it fails for me, while ftp.freebsd.org gets me further...

It's what the service hosts have in their ezjail.conf.

Going through ftp1..14.us.freebsd.org indicates freebsd.isc.org is the closest.

Right, the ezjail.conf that comes with 10.1 seems to have ftp.freebsd.org...

seankelly added 6 commits November 25, 2014 21:41

Set ezjail config

580a224

Copy config

19378d8

Install FreeBSD root, with ports, for the base jail

cf04dfc

Add base flavour config

2017578

The jails will be configured via Ansible so minimal configuration needs to happen from the flavour.

Create config and jail

09a7a49

Enable jails in /etc/rc.conf

f3c4237

verm reviewed Nov 26, 2014
View reviewed changes

Use OPTIONS option in make.conf for FreeBSD 10

79ae8dc

Add a demo playbook that uses jail role

1b10510

sa2ajj reviewed Nov 27, 2014
View reviewed changes

sa2ajj added the needs more work label Nov 30, 2014

Reformat example jail playbook to be more readable

08a5126

seankelly added 5 commits December 2, 2014 19:54

Install ezjail

0f77929

Add variables for ezjail base and jail log directories

b0e2b27

Create jail log directory

9314fb9

Get the jail safe name

458d8ba

This is the safe name that is used to identify it in /etc/jail.conf.

Insert jail into /etc/jail.conf

bdaaaa5

seankelly added 2 commits December 2, 2014 22:05

never changed rebase onto safename

d573b2b

Fix creates for ezjail-admin install

e35736e

The config file is created in /usr/local/etc/ezjail and uses the jail's safe name.

sa2ajj added needs more review and removed needs more work labels Dec 3, 2014

sa2ajj reviewed Dec 3, 2014
View reviewed changes

roles/jail/tasks/main.yml

---

- name: Install ezjail

pkgng:

name: ezjail

Copy link

sa2ajj Dec 3, 2014

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I like thing explicit: state: present?

seankelly added 2 commits December 3, 2014 20:31

Be explicit about the state of the package

e64a64f

Duh, use service module

9f5cfcf

sa2ajj reviewed Dec 4, 2014
View reviewed changes

seankelly changed the title ~~[DO NOT MERGE] Jail role~~ Jail role Dec 5, 2014

Add a README describing briefly how to use the jail role

2f453df

Unsure whether this should go in the docs or the directory of the role. I opted for the latter thinking if someone wanted to learn how to use the role, they would be more likely to look in the role's directory.

seankelly force-pushed the jail-role branch from 49c00fa to 2f453df Compare December 5, 2014 02:33

sa2ajj pushed a commit that referenced this pull request Dec 5, 2014

Merge pull request #21 from seankelly/jail-role

6dc4a0d

Jail role

sa2ajj merged commit 6dc4a0d into buildbot:master Dec 5, 2014

seankelly deleted the jail-role branch December 6, 2014 02:36

sa2ajj reviewed Dec 14, 2014
View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Jail role #21

Jail role #21

seankelly commented Nov 26, 2014

seankelly commented Nov 26, 2014

djmitche commented Nov 26, 2014

verm Nov 26, 2014

seankelly Nov 26, 2014

seankelly commented Nov 26, 2014

seankelly commented Nov 26, 2014

sa2ajj commented Nov 26, 2014

djmitche commented Nov 26, 2014

seankelly commented Nov 27, 2014

sa2ajj Nov 27, 2014

seankelly Dec 2, 2014

sa2ajj commented Nov 27, 2014

seankelly commented Dec 2, 2014

sa2ajj commented Dec 2, 2014

djmitche commented Dec 2, 2014

seankelly commented Dec 3, 2014

seankelly commented Dec 3, 2014

sa2ajj Dec 3, 2014

seankelly commented Dec 4, 2014

sa2ajj Dec 4, 2014

sa2ajj commented Dec 4, 2014

seankelly commented Dec 5, 2014

sa2ajj Dec 14, 2014

seankelly Dec 14, 2014

seankelly Dec 14, 2014

sa2ajj Dec 15, 2014

Jail role #21

Jail role #21

Conversation

seankelly commented Nov 26, 2014

seankelly commented Nov 26, 2014

djmitche commented Nov 26, 2014

Choose a reason for hiding this comment

Choose a reason for hiding this comment

seankelly commented Nov 26, 2014

seankelly commented Nov 26, 2014

sa2ajj commented Nov 26, 2014

djmitche commented Nov 26, 2014

seankelly commented Nov 27, 2014

Choose a reason for hiding this comment

Choose a reason for hiding this comment

sa2ajj commented Nov 27, 2014

seankelly commented Dec 2, 2014

sa2ajj commented Dec 2, 2014

djmitche commented Dec 2, 2014

seankelly commented Dec 3, 2014

seankelly commented Dec 3, 2014

Choose a reason for hiding this comment

seankelly commented Dec 4, 2014

Choose a reason for hiding this comment

sa2ajj commented Dec 4, 2014

seankelly commented Dec 5, 2014

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment