tools/ansible/privilege-nspawn-vm.yml

   1 # Copyright (C) The Arvados Authors. All rights reserved.
   2 #
   3 # SPDX-License-Identifier: Apache-2.0
   4 #
   5 # privilege-nspawn-vm.yml - Add privileges to a systemd-nspawn VM to run
   6 # Arvados components
   7 #
   8 # Run this playbook on a host with systemd-nspawn installed. It will configure a
   9 # named VM container with all of the privileges necessary to run different Arvados
  10 # components.
  11 #
  12 # You MUST run this playbook with the `container_name` variable set to the name
  13 # of the VM to configure.
  14 #
  15 # By default the playbook grants privileges required for all Arvados components.
  16 # You can revoke the privileges for a component by setting any of the variables
  17 # `docker_privileges`, `fuse_privileges`, or `singularity_privileges` to the
  18 # string 'absent'. For example, if you're building a compute node VM that only
  19 # uses the Docker compute engine, you could set `singularity_privileges=absent`
  20 # to avoid granting privileges that are only required for Singularity.
  21
  22 - name: Add privileges to systemd-nspawn VM
  23   hosts: localhost
  24   become: yes
  25
  26   vars:
  27     docker_privileges: present
  28     fuse_privileges: present
  29     singularity_privileges: present
  30     nspawn_container_conffile: "/etc/systemd/nspawn/{{ container_name }}.nspawn"
  31     nspawn_service_conffile: "/etc/systemd/system/systemd-nspawn@{{ container_name }}.service.d/arvados-ansible.conf"
  32
  33   module_defaults:
  34     community.general.ini_file:
  35       exclusive: false
  36       ignore_spaces: true
  37       no_extra_spaces: true
  38       owner: root
  39       group: root
  40       mode: 0644
  41
  42   tasks:
  43     - name: Create systemd-nspawn drop-in directory
  44       ansible.builtin.file:
  45         state: directory
  46         path: "{{ nspawn_service_conffile|dirname }}"
  47         owner: root
  48         group: root
  49         mode: 0755
  50
  51     - name: Control access to FUSE device
  52       community.general.ini_file:
  53         state: "{{ fuse_privileges }}"
  54         path: "{{ nspawn_service_conffile }}"
  55         section: Service
  56         option: DeviceAllow
  57         value: "/dev/fuse rw"
  58       notify: daemon-reload
  59
  60     - name: Control access to block loop devices
  61       community.general.ini_file:
  62         state: "{{ singularity_privileges }}"
  63         path: "{{ nspawn_service_conffile }}"
  64         section: Service
  65         option: DeviceAllow
  66         value: "block-loop rwm"
  67       notify: daemon-reload
  68     - name: Control block loop device ordering
  69       community.general.ini_file:
  70         state: "{{ singularity_privileges }}"
  71         path: "{{ nspawn_service_conffile }}"
  72         section: Unit
  73         option: "{{ item }}"
  74         value: "modprobe@loop.service"
  75       loop:
  76         - Wants
  77         - After
  78       notify: daemon-reload
  79
  80     - name: Filter system calls for Docker
  81       community.general.ini_file:
  82         state: "{{ docker_privileges }}"
  83         path: "{{ nspawn_container_conffile }}"
  84         section: Exec
  85         option: SystemCallFilter
  86         value: "{{ item }}"
  87       loop:
  88         - add_key
  89         - bpf
  90         - keyctl
  91
  92     - name: Map private users for Singularity
  93       community.general.ini_file:
  94         state: "{{ singularity_privileges }}"
  95         path: "{{ nspawn_container_conffile }}"
  96         section: Exec
  97         option: PrivateUsers
  98         value: "0"
  99
 100     - name: Bind FUSE device
 101       community.general.ini_file:
 102         state: "{{ fuse_privileges }}"
 103         path: "{{ nspawn_container_conffile }}"
 104         section: Files
 105         option: Bind
 106         value: /dev/fuse
 107
 108     - name: Bind block loop control device
 109       community.general.ini_file:
 110         state: "{{ singularity_privileges }}"
 111         path: "{{ nspawn_container_conffile }}"
 112         section: Files
 113         option: Bind
 114         value: /dev/loop-control
 115
 116   handlers:
 117     - name: daemon-reload
 118       ansible.builtin.systemd_service:
 119         daemon_reload: true