在分子创建的对接容器中运行ufw命令

Question

我创建了一个任务init ufw，首先我安装ufw，然后我想更改它的策略以拒绝：

---

- name: Ensure UFW is enabled
  ufw:
    state: enabled
    policy: reject
  become: true
  register: firewall_enabled
  when: '(firewall_enabled | default({})) | dictsort | length < 1'

当我运行molecule converge时，会得到以下错误：

fatal: [focal]: FAILED! => {"changed": false, "commands": ["/usr/sbin/ufw status verbose", "/usr/bin/grep -h '^### tuple' /lib/ufw/user.rules /lib/ufw/user6.rules /etc/ufw/user.rules /etc/ufw/user6.rules /var/lib/ufw/user.rules /var/lib/ufw/user6.rules", "/usr/sbin/ufw -f enable"], "msg": "ERROR: initcaps\n[Errno 2] ip6tables v1.8.4 (legacy): can't initialize ip6tables table `filter': Table does not exist (do you need to insmod?)\nPerhaps ip6tables or your kernel needs to be upgraded.\n\n"}

经过一些搜索后，我意识到这是因为它具有创建坞容器的功能，所以我将功能添加到molecule.yaml文件中，但是它根本不起作用，我也得到了同样的错误。

这是我的molecule.yaml文件：

---
dependency:
  name: galaxy
driver:
  name: docker
lint: |
    yamllint .
    ansible-lint
    flake8
platforms:
  - name: bionic
    image: ubuntu:18.04
    volumes:
      - /sys/fs/cgroup:/sys/fs/cgroup:ro
    privileged: true
    capabilities: ['NET_ADMIN']
provisioner:
  name: ansible
verifier:
  name: testinfra

Answer 1

通过创建自定义码头映像并在容器内安装uff包解决了这一问题。

molecule.yml

---
dependency:
  name: galaxy
driver:
  name: docker
platforms:
 - name: instance
   dockerfile: ./Dockerfile.j2
   image: ubuntu:18.04
   privileged: true   #To elevate privilages as become: true failes in *Gather fatcs task*
provisioner:
  name: ansible
  lint:
    name: ansible-lint
verifier:
  name: testinfra

​

Dockerfile.j2

{% if item.registry is defined %}
FROM {{ item.registry.url }}/{{ item.image }}
{% else %}
FROM {{ item.image }}
{% endif %}

RUN apt-get update -y && apt-get install ufw -y

​