15e0d6c7df
Rsyslog on Noble has apparmor rules that restrict rsyslog socket creation to /var/lib/*/dev/log. Previously we were configuring haproxy hosts to create an rsyslog socket for haproxy at /var/haproxy/dev/log which doesn't match the apparmor rule so gets denied. To address this we move all the host side haproxy config from /var/haproxy to /var/lib/haproxy. This allows rsyslog to create the socket. To avoid needing to update docker images (for haproxy statsd) and to continue to make the haproxy container itself happy we don't adjust paths on the target side of our bind mounts. This means some things still refer to /var/haproxy but they should all be within containers. I don't believe this will be impactful to existing load balancer servers. We should deploy new content to /var/lib/haproxy then automatically restart services (rsyslog and haproxy container) because their configs are updating. One potential problem with this is rsyslog will restart before the containers do and its log path will have moved. If we are concerned about this we can configure rsyslog to continue to attempt to create the old path in addition to the new path (this will fail on Noble). Change-Id: I4582e6b2dda188583f76265ab78bcb00a302e375
42 lines
1.4 KiB
Python
42 lines
1.4 KiB
Python
# Copyright 2018 Red Hat, Inc.
|
|
# Copyright 2022 Acme Gating, LLC
|
|
#
|
|
# Licensed under the Apache License, Version 2.0 (the "License"); you may
|
|
# not use this file except in compliance with the License. You may obtain
|
|
# a copy of the License at
|
|
#
|
|
# http://www.apache.org/licenses/LICENSE-2.0
|
|
#
|
|
# Unless required by applicable law or agreed to in writing, software
|
|
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
|
|
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
|
|
# License for the specific language governing permissions and limitations
|
|
# under the License.
|
|
|
|
import json
|
|
|
|
|
|
testinfra_hosts = ['zuul-lb02.opendev.org']
|
|
|
|
|
|
def test_zuul_listening(host):
|
|
zuul_https = host.socket("tcp://0.0.0.0:443")
|
|
assert zuul_https.is_listening
|
|
zuul_http = host.socket("tcp://0.0.0.0:80")
|
|
assert zuul_http.is_listening
|
|
zuul_finger = host.socket("tcp://0.0.0.0:79")
|
|
assert zuul_finger.is_listening
|
|
|
|
def test_haproxy_statsd_running(host):
|
|
cmd = host.run("docker inspect haproxy-docker-haproxy-statsd-1")
|
|
out = json.loads(cmd.stdout)
|
|
assert out[0]["State"]["Status"] == "running"
|
|
assert out[0]["RestartCount"] == 0
|
|
|
|
def test_haproxy_logging(host):
|
|
# rsyslog is configured to add a unix socket at this path
|
|
assert host.file('/var/lib/haproxy/dev/log').is_socket
|
|
# Haproxy logs to syslog via the above socket which produces
|
|
# this logfile
|
|
assert host.file('/var/log/haproxy.log').is_file
|