---
- name: Checking Docker version
  command: docker version
  register: result
  changed_when: false
  when: inventory_hostname in groups['baremetal']
  failed_when: result | failed
               or (result.stdout | from_yaml).Server.Version | regex_replace('(\\d+\\.\\d+\\.\\d+).*', '\\1') | version_compare(docker_version_min, '<')

# NOTE(mgoddard): If passwords.yml is encrypted using ansible-vault, this check
# will pass, but only because nothing in the vault file has the format of a
# YAML dict item.
- name: Checking empty passwords in passwords.yml. Run kolla-genpwd if this task fails
  local_action: command grep '^[^#].*:\s*$' "{{ CONFIG_DIR | default('/etc/kolla') }}/passwords.yml"
  run_once: True
  register: result
  changed_when: false
  failed_when: result.stdout | regex_replace('(.*ssh_key.*)', '') | search(":")

---
- name: Checking Docker version
  command: docker version
  register: result
  changed_when: false
  when: inventory_hostname in groups['baremetal']
  failed_when: result | failed
               or (result.stdout | from_yaml).Server.Version | regex_replace('(\\d+\\.\\d+\\.\\d+).*', '\\1') | version_compare(docker_version_min, '<')

# NOTE(mgoddard): If passwords.yml is encrypted using ansible-vault, this check
# will pass, but only because nothing in the vault file has the format of a
# YAML dict item.
- name: Checking empty passwords in passwords.yml. Run kolla-genpwd if this task fails
  local_action: command grep '^[^#].*:\s*$' "{{ CONFIG_DIR | default('/etc/kolla') }}/passwords.yml"
  run_once: True
  register: result
  changed_when: false
  failed_when: result.stdout | regex_replace('(.*ssh_key.*)', '') | search(":")

- name: Check if nscd is running
  command: pgrep nscd
  ignore_errors: yes
  failed_when: false
  changed_when: false
  register: nscd_status

- name: Fail if nscd is running
  fail:
    msg: |
      Service nscd is running. This is known to cause issues with Docker's user namespaces in
      Kolla. Please disable it before proceeding.
  when:
    - nscd_status.rc == 0

Add a precheck to ensure nscd is not running
Add a precheck to ensure nscd is not running

The 'name service caching daemon (nscd)' seems to effectively disable
Docker's user namespace when '/run' is bind mounted. This can cause
issues with Kolla containers that use this mount, if the uid the
container runs as exists on the system, they clash and container will
either fail to start, have sudo issues, etc.

Change-Id: I9ac6bdb193f1520d025251d3abfa761700481cc9
Closes-Bug: #1723934
