shaba/one
1
0
Fork 0
mirror of https://github.com/OpenNebula/one.git synced 2024-12-22 13:33:52 +03:00
Code Releases Wiki Activity
ebc5b95b86
one/share/pkgs/sudoers/centos/opennebula

19 lines
2.3 KiB
Plaintext
Raw Normal View History

B #3046: Review sudoers (#3786)
2019-09-30 16:15:42 +03:00
Defaults:oneadmin !requiretty
Defaults:oneadmin secure_path = /sbin:/bin:/usr/sbin:/usr/bin
Cmnd_Alias ONE_CEPH = /usr/bin/rbd
F #865: Add oneshowback compute timer Signed-off-by: Petr Ospalý <pospaly@opennebula.io>
2020-05-18 10:44:56 +03:00
Cmnd_Alias ONE_HA = /usr/bin/systemctl start opennebula-flow, /usr/bin/systemctl stop opennebula-flow, /usr/bin/systemctl start opennebula-gate, /usr/bin/systemctl stop opennebula-gate, /usr/bin/systemctl start opennebula-hem, /usr/bin/systemctl stop opennebula-hem, /usr/bin/systemctl start opennebula-showback.timer, /usr/bin/systemctl stop opennebula-showback.timer, /usr/sbin/service opennebula-flow start, /usr/sbin/service opennebula-flow stop, /usr/sbin/service opennebula-gate start, /usr/sbin/service opennebula-gate stop, /usr/sbin/service opennebula-hem start, /usr/sbin/service opennebula-hem stop, /usr/sbin/arping, /usr/sbin/ip address *
B #3046: Review sudoers (#3786)
2019-09-30 16:15:42 +03:00
Cmnd_Alias ONE_LVM = /usr/sbin/lvcreate, /usr/sbin/lvremove, /usr/sbin/lvs, /usr/sbin/vgdisplay, /usr/sbin/lvchange, /usr/sbin/lvscan, /usr/sbin/lvextend
F #5228: LXC driver set co-authored-by: Christian González <cgonzalez@opennebula.io> co-authored-by: Daniel Clavijo Coca <dclavijo@opennebula.systems>
2021-03-04 23:07:50 +03:00
Cmnd_Alias ONE_LXC = /usr/bin/mount, /usr/bin/umount, /usr/bin/bindfs, /usr/sbin/losetup, /usr/bin/qemu-nbd, /usr/bin/lxc-attach, /usr/bin/lxc-config, /usr/bin/lxc-create, /usr/bin/lxc-destroy, /usr/bin/lxc-info, /usr/bin/lxc-ls, /usr/bin/lxc-start, /usr/bin/lxc-stop, /usr/bin/lxc-console, /usr/sbin/e2fsck, /usr/sbin/resize2fs, /usr/sbin/xfs_growfs, /usr/bin/rbd-nbd
F #6397: Minor adjustments to LXC marketplace - Fix LXC linuxcontainers monitor action (error setting header) - Update context packages URL reference to point to the new location - Add lxc marketplace utility to sudoers file (removed in a previous commit) - Remove CentOS from supported OS list in LXC marketplace (CentOS9_Stream includes some failures that need further debugging)
2024-07-09 11:15:00 +03:00
Cmnd_Alias ONE_MARKET = /usr/lib/one/sh/create_container_image.sh
F #6669: Support for VLAN filtering and QinQ This commit adds the following features using the vlan_filter capabilities of the Linux Bridge: * 802.1Q driver, support for QinQ. This is not a full implementation compared to the vSwitch as there is no native support in the linux bridge: - VLAN_ID is the (outer/C-VLAN) tag implemented by tagging the PHY_DEV interface - CVLANS are the customer tags, any other VLAN is filtered out in the bridge * bridge driver, support for vlan filtering (VLAN_TAGGED_ID) only the specified tags are allowed in the trunk. Additionally this commits includes linting of some files. (cherry picked from commit e379bd66842dc4aa256e1c503ca425553d02bf9b)
2024-12-11 13:11:05 +03:00
Cmnd_Alias ONE_NET = /usr/sbin/ebtables, /usr/sbin/iptables, /usr/sbin/ip6tables, /usr/sbin/ipset, /usr/sbin/ip link *, /usr/sbin/ip neighbour *, /usr/sbin/ip route *, /usr/sbin/ip rule *, /usr/sbin/ip tuntap *, /usr/sbin/nft, /var/tmp/one/vnm/tproxy, /usr/sbin/bridge vlan *
F OpenNebula/one#6641: Add the "string-phone" transparent proxy (#3221) This feature let's cloud admin to proxy VM connections to any service through the hypervisor. VMs uses a link local IP that is forwarded to a local proxy. This simplifies VM network requirements, e.g. to access gateway, vaults, configuration services etc... Implementation: - Use network namespaces to isolate VNET networking. ip netns command is executed through a wrapper to limit sudo access to commands. - Add tproxy.rb app to manage a group of daemons on HV nodes. - Use unix sockets for communication between proxy peers. "Inner" proxy runs in the netns without any network access. "Outer" proxy handles HV connections to services. - Use OpenNebulaNetwork.conf + 'onehost sync -f' for configuration. Proxy can be defined per network.
2024-09-26 19:19:48 +03:00
Cmnd_Alias ONE_NETNS = /usr/sbin/ip netns add *, /usr/sbin/ip netns delete *, /usr/sbin/ip netns pids *, /var/tmp/one/vnm/ip_netns_exec ip address *, /var/tmp/one/vnm/ip_netns_exec ip link *, /var/tmp/one/vnm/ip_netns_exec ip -j link show *, /var/tmp/one/vnm/ip_netns_exec ip route *
F #5722: Support for QinQ and MTU for OVS - CVLANs to 1dotq-tunnel - QINQ_TYPE defaults to 802.1q - Addts support fot MTU set of OVS ports co-authored-by: Mikhail Samoylov <msamoylov@opennebula.io>
2022-02-25 16:37:30 +03:00
Cmnd_Alias ONE_OVS = /usr/bin/ovs-ofctl, /usr/bin/ovs-vsctl, /usr/bin/ovs-appctl
F #3124: Compact memory (#918)
2021-03-08 13:45:50 +03:00
Cmnd_Alias ONE_MEM = /usr/sbin/sysctl vm.drop_caches=3 vm.compact_memory=1
F #5351: fix minor bug with vgpu path (#1906)
2022-04-05 16:15:45 +03:00
Cmnd_Alias ONE_VGPU = /var/tmp/one/vgpu
B #3046: Review sudoers (#3786)
2019-09-30 16:15:42 +03:00
## Command aliases are enabled individually in dedicated
## sudoers files by each OpenNebula component (server, node).
F #6397: Minor adjustments to LXC marketplace - Fix LXC linuxcontainers monitor action (error setting header) - Update context packages URL reference to point to the new location - Add lxc marketplace utility to sudoers file (removed in a previous commit) - Remove CentOS from supported OS list in LXC marketplace (CentOS9_Stream includes some failures that need further debugging)
2024-07-09 11:15:00 +03:00
# oneadmin ALL=(ALL) NOPASSWD: ONE_CEPH, ONE_HA, ONE_LVM, ONE_LXC, ONE_MARKET, ONE_NET, ONE_OVS, ONE_MEM
F OpenNebula/one#6641: Add the "string-phone" transparent proxy (#3221) This feature let's cloud admin to proxy VM connections to any service through the hypervisor. VMs uses a link local IP that is forwarded to a local proxy. This simplifies VM network requirements, e.g. to access gateway, vaults, configuration services etc... Implementation: - Use network namespaces to isolate VNET networking. ip netns command is executed through a wrapper to limit sudo access to commands. - Add tproxy.rb app to manage a group of daemons on HV nodes. - Use unix sockets for communication between proxy peers. "Inner" proxy runs in the netns without any network access. "Outer" proxy handles HV connections to services. - Use OpenNebulaNetwork.conf + 'onehost sync -f' for configuration. Proxy can be defined per network.
2024-09-26 19:19:48 +03:00
# oneadmin ALL=(ALL) NOPASSWD:SETENV: ONE_NETNS
Copy Permalink