diff options
| -rw-r--r-- | manifests/certmonger/haproxy.pp | 75 | ||||
| -rw-r--r-- | manifests/profile/base/database/mysql.pp | 85 | ||||
| -rw-r--r-- | manifests/profile/base/nova/compute.pp | 3 | ||||
| -rw-r--r-- | manifests/profile/base/pacemaker.pp | 2 | ||||
| -rw-r--r-- | manifests/profile/pacemaker/database/mysql.pp | 184 | ||||
| -rw-r--r-- | manifests/profile/pacemaker/gnocchi.pp | 7 | ||||
| -rw-r--r-- | manifests/profile/pacemaker/nova/conductor.pp | 5 |
7 files changed, 354 insertions, 7 deletions
diff --git a/manifests/certmonger/haproxy.pp b/manifests/certmonger/haproxy.pp new file mode 100644 index 0000000..2b738e6 --- /dev/null +++ b/manifests/certmonger/haproxy.pp @@ -0,0 +1,75 @@ +# Copyright 2016 Red Hat, Inc. +# +# Licensed under the Apache License, Version 2.0 (the "License"); you may +# not use this file except in compliance with the License. You may obtain +# a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT +# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the +# License for the specific language governing permissions and limitations +# under the License. +# +# == Resource: tripleo::certmonger::haproxy +# +# Request a certificate for the HAProxy service and does the necessary logic to +# get it into a format that the service understands. +# +# === Parameters +# +# [*service_pem*] +# The file in PEM format that the HAProxy service will use as a certificate. +# +# [*service_certificate*] +# The certificate file that certmonger will be tracking. +# +# [*service_key*] +# The key file that certmonger will use for the certificate. +# +# [*hostname*] +# The hostname that certmonger will use as the common name for the +# certificate. +# +# [*postsave_cmd*] +# The post-save-command that certmonger will use once it renews the +# certificate. +# +# [*principal*] +# The haproxy service principal that is set for HAProxy in kerberos. +# +define tripleo::certmonger::haproxy ( + $service_pem, + $service_certificate, + $service_key, + $hostname, + $postsave_cmd, + $principal = undef, +){ + certmonger_certificate { "${title}-cert": + hostname => $hostname, + certfile => $service_certificate, + keyfile => $service_key, + postsave_cmd => $postsave_cmd, + principal => $principal, + } + concat { $service_pem : + ensure => present, + mode => '0640', + owner => 'haproxy', + group => 'haproxy', + } + concat::fragment { "${title}-cert-fragment": + target => $service_pem, + source => $service_certificate, + order => '01', + require => Certmonger_certificate["${title}-cert"], + } + concat::fragment { "${title}-key-fragment": + target => $service_pem, + source => $service_key, + order => 10, + require => Certmonger_certificate["${title}-cert"], + } +} diff --git a/manifests/profile/base/database/mysql.pp b/manifests/profile/base/database/mysql.pp new file mode 100644 index 0000000..9552e10 --- /dev/null +++ b/manifests/profile/base/database/mysql.pp @@ -0,0 +1,85 @@ +# Copyright 2016 Red Hat, Inc. +# +# Licensed under the Apache License, Version 2.0 (the "License"); you may +# not use this file except in compliance with the License. You may obtain +# a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT +# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the +# License for the specific language governing permissions and limitations +# under the License. +# +# == Class: tripleo::profile::base::database::mysql +# +# MySQL profile for tripleo +# +# === Parameters +# +# [*step*] +# (Optional) The current step in deployment. See tripleo-heat-templates +# for more details. +# Defaults to hiera('step') +# +# [*mysql_server_options*] +# (Optional) Extras options to deploy MySQL. Useful when deploying Galera cluster. +# Should be an hash. +# Defaults to {} +# +# [*manage_resources*] +# (Optional) Whether or not manage root user, root my.cnf, and service. +# Defaults to true +# +# [*remove_default_accounts*] +# (Optional) Whether or not remove default MySQL accounts. +# Defaults to true +# +class tripleo::profile::base::database::mysql ( + $step = hiera('step'), + $mysql_server_options = {}, + $manage_resources = true, + $remove_default_accounts = true, +) { + + validate_hash($mysql_server_options) + + # non-ha scenario + if $manage_resources { + $mysql_step = 2 + } else { + # ha scenario + $mysql_step = 1 + } + if hiera('step') >= $mysql_step { + if str2bool(hiera('enable_galera', true)) { + $mysql_config_file = '/etc/my.cnf.d/galera.cnf' + } else { + $mysql_config_file = '/etc/my.cnf.d/server.cnf' + } + # TODO Galara + # FIXME: due to https://bugzilla.redhat.com/show_bug.cgi?id=1298671 we + # set bind-address to a hostname instead of an ip address; to move Mysql + # from internal_api on another network we'll have to customize both + # MysqlNetwork and ControllerHostnameResolveNetwork in ServiceNetMap + $mysql_server_default = { + 'mysqld' => { + 'bind-address' => $::hostname, + 'max_connections' => hiera('mysql_max_connections'), + 'open_files_limit' => '-1', + } + } + $mysql_server_options_real = deep_merge($mysql_server_default, $mysql_server_options) + class { '::mysql::server': + config_file => $mysql_config_file, + override_options => $mysql_server_options_real, + create_root_user => $manage_resources, + create_root_my_cnf => $manage_resources, + service_manage => $manage_resources, + service_enabled => $manage_resources, + remove_default_accounts => $remove_default_accounts, + } + } + +} diff --git a/manifests/profile/base/nova/compute.pp b/manifests/profile/base/nova/compute.pp index c734906..076996a 100644 --- a/manifests/profile/base/nova/compute.pp +++ b/manifests/profile/base/nova/compute.pp @@ -38,6 +38,9 @@ class tripleo::profile::base::nova::compute ( # deploy basic bits for nova-compute include ::nova::compute + # If Service['nova-conductor'] is in catalog, make sure we start it + # before nova-compute. + Service<| title == 'nova-conductor' |> -> Service['nova-compute'] # deploy bits to connect nova compute to neutron include ::nova::network::neutron diff --git a/manifests/profile/base/pacemaker.pp b/manifests/profile/base/pacemaker.pp index fc58891..de107a9 100644 --- a/manifests/profile/base/pacemaker.pp +++ b/manifests/profile/base/pacemaker.pp @@ -85,7 +85,7 @@ class tripleo::profile::base::pacemaker ( # Create an openstack-core dummy resource. See RHBZ 1290121 pacemaker::resource::ocf { 'openstack-core': ocf_agent_name => 'heartbeat:Dummy', - clone_params => true, + clone_params => 'interleave=true', } } } diff --git a/manifests/profile/pacemaker/database/mysql.pp b/manifests/profile/pacemaker/database/mysql.pp new file mode 100644 index 0000000..1acdf0d --- /dev/null +++ b/manifests/profile/pacemaker/database/mysql.pp @@ -0,0 +1,184 @@ +# Copyright 2016 Red Hat, Inc. +# +# Licensed under the Apache License, Version 2.0 (the "License"); you may +# not use this file except in compliance with the License. You may obtain +# a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT +# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the +# License for the specific language governing permissions and limitations +# under the License. +# +# == Class: tripleo::profile::pacemaker::database::mysql +# +# MySQL with Pacemaker profile for tripleo +# +# === Parameters +# +# [*step*] +# (Optional) The current step in deployment. See tripleo-heat-templates +# for more details. +# Defaults to hiera('step') +# +class tripleo::profile::pacemaker::database::mysql ( + $step = hiera('step'), +) { + + if $::hostname == downcase(hiera('bootstrap_nodeid')) { + $pacemaker_master = true + } else { + $pacemaker_master = false + } + $mysql_bind_host = hiera('mysql_bind_host') + $galera_nodes = downcase(hiera('galera_node_names', $::hostname)) + $galera_nodes_count = count(split($galera_nodes, ',')) + $mysqld_options = { + 'mysqld' => { + 'skip-name-resolve' => '1', + 'binlog_format' => 'ROW', + 'default-storage-engine' => 'innodb', + 'innodb_autoinc_lock_mode' => '2', + 'innodb_locks_unsafe_for_binlog'=> '1', + 'query_cache_size' => '0', + 'query_cache_type' => '0', + 'bind-address' => $::hostname, + 'max_connections' => hiera('mysql_max_connections'), + 'open_files_limit' => '-1', + 'wsrep_on' => 'ON', + 'wsrep_provider' => '/usr/lib64/galera/libgalera_smm.so', + 'wsrep_cluster_name' => 'galera_cluster', + 'wsrep_cluster_address' => "gcomm://${galera_nodes}", + 'wsrep_slave_threads' => '1', + 'wsrep_certify_nonPK' => '1', + 'wsrep_max_ws_rows' => '131072', + 'wsrep_max_ws_size' => '1073741824', + 'wsrep_debug' => '0', + 'wsrep_convert_LOCK_to_trx' => '0', + 'wsrep_retry_autocommit' => '1', + 'wsrep_auto_increment_control' => '1', + 'wsrep_drupal_282555_workaround'=> '0', + 'wsrep_causal_reads' => '0', + 'wsrep_sst_method' => 'rsync', + 'wsrep_provider_options' => "gmcast.listen_addr=tcp://[${mysql_bind_host}]:4567;", + } + } + + class { '::tripleo::profile::base::database::mysql': + manage_resources => false, + remove_default_accounts => $pacemaker_master, + mysql_server_options => $mysqld_options, + } + + if hiera('step') >= 2 and $pacemaker_master { + if $pacemaker_master { + pacemaker::resource::ocf { 'galera' : + ocf_agent_name => 'heartbeat:galera', + op_params => 'promote timeout=300s on-fail=block', + master_params => '', + meta_params => "master-max=${galera_nodes_count} ordered=true", + resource_params => "additional_parameters='--open-files-limit=16384' enable_creation=true wsrep_cluster_address='gcomm://${galera_nodes}'", + require => Class['::mysql::server'], + before => Exec['galera-ready'], + } + exec { 'galera-ready' : + command => '/usr/bin/clustercheck >/dev/null', + timeout => 30, + tries => 180, + try_sleep => 10, + environment => ['AVAILABLE_WHEN_READONLY=0'], + require => Exec['create-root-sysconfig-clustercheck'], + } + # We add a clustercheck db user and we will switch /etc/sysconfig/clustercheck + # to it in a later step. We do this only on one node as it will replicate on + # the other members. We also make sure that the permissions are the minimum necessary + mysql_user { 'clustercheck@localhost': + ensure => 'present', + password_hash => mysql_password(hiera('mysql_clustercheck_password')), + require => Exec['galera-ready'], + } + mysql_grant { 'clustercheck@localhost/*.*': + ensure => 'present', + options => ['GRANT'], + privileges => ['PROCESS'], + table => '*.*', + user => 'clustercheck@localhost', + } + } + # This step is to create a sysconfig clustercheck file with the root user and empty password + # on the first install only (because later on the clustercheck db user will be used) + # We are using exec and not file in order to not have duplicate definition errors in puppet + # when we later set the the file to contain the clustercheck data + exec { 'create-root-sysconfig-clustercheck': + command => "/bin/echo 'MYSQL_USERNAME=root\nMYSQL_PASSWORD=\'\'\nMYSQL_HOST=localhost\n' > /etc/sysconfig/clustercheck", + unless => '/bin/test -e /etc/sysconfig/clustercheck && grep -q clustercheck /etc/sysconfig/clustercheck', + } + xinetd::service { 'galera-monitor' : + port => '9200', + server => '/usr/bin/clustercheck', + per_source => 'UNLIMITED', + log_on_success => '', + log_on_failure => 'HOST', + flags => 'REUSE', + service_type => 'UNLISTED', + user => 'root', + group => 'root', + require => Exec['create-root-sysconfig-clustercheck'], + } + } + + if hiera('step') >= 4 or ( hiera('step') >= 3 and $pacemaker_master ) { + # At this stage we are guaranteed that the clustercheck db user exists + # so we switch the resource agent to use it. + $mysql_clustercheck_password = hiera('mysql_clustercheck_password') + file { '/etc/sysconfig/clustercheck' : + ensure => file, + mode => '0600', + owner => 'root', + group => 'root', + content => "MYSQL_USERNAME=clustercheck\n +MYSQL_PASSWORD='${mysql_clustercheck_password}'\n +MYSQL_HOST=localhost\n", + } + } + + if hiera('step') >= 5 { + # We now make sure that the root db password is set to a random one + # At first installation /root/.my.cnf will be empty and we connect without a root + # password. On second runs or updates /root/.my.cnf will already be populated + # with proper credentials. This step happens on every node because this sql + # statement does not automatically replicate across nodes. + $mysql_root_password = hiera('mysql::server::root_password') + exec { 'galera-set-root-password': + command => "/bin/touch /root/.my.cnf && /bin/echo \"UPDATE mysql.user SET Password = PASSWORD('${mysql_root_password}') WHERE user = 'root'; flush privileges;\" | /bin/mysql --defaults-extra-file=/root/.my.cnf -u root", + } + file { '/root/.my.cnf' : + ensure => file, + mode => '0600', + owner => 'root', + group => 'root', + content => "[client] + user=root + password=\"${mysql_root_password}\" + + [mysql] + user=root + password=\"${mysql_root_password}\"", + require => Exec['galera-set-root-password'], + } + if $pacemaker_master { + pacemaker::constraint::base { 'galera-then-openstack-core-constraint': + constraint_type => 'order', + first_resource => 'galera-master', + second_resource => 'openstack-core-clone', + first_action => 'promote', + second_action => 'start', + require => [Pacemaker::Resource::Ocf['galera'], + Pacemaker::Resource::Ocf['openstack-core']], + } + } + } + +} diff --git a/manifests/profile/pacemaker/gnocchi.pp b/manifests/profile/pacemaker/gnocchi.pp index a6d472c..98d1b36 100644 --- a/manifests/profile/pacemaker/gnocchi.pp +++ b/manifests/profile/pacemaker/gnocchi.pp @@ -31,16 +31,11 @@ # for more details. # Defaults to hiera('step') # -# [*sync_db*] -# (Optional) Whether to run db sync -# Defaults to undef -# class tripleo::profile::pacemaker::gnocchi ( $gnocchi_indexer_backend = downcase(hiera('gnocchi_indexer_backend', 'mysql')), $bootstrap_node = hiera('bootstrap_nodeid'), $step = hiera('step'), - $sync_db = true, ) { Service <| tag == 'gnocchi-service' |> { @@ -64,7 +59,7 @@ class tripleo::profile::pacemaker::gnocchi ( } } - if $step >= 3 and $sync_db { + if $step >= 3 and $pacemaker_master { include ::gnocchi include ::gnocchi::config include ::gnocchi::client diff --git a/manifests/profile/pacemaker/nova/conductor.pp b/manifests/profile/pacemaker/nova/conductor.pp index 495c92e..3d5e41e 100644 --- a/manifests/profile/pacemaker/nova/conductor.pp +++ b/manifests/profile/pacemaker/nova/conductor.pp @@ -47,6 +47,11 @@ class tripleo::profile::pacemaker::nova::conductor ( pacemaker::resource::service { $::nova::params::conductor_service_name: clone_params => 'interleave=true', } + # If Service['nova-compute'] is in catalog, make sure we start it after + # nova-conductor pcmk resource. + # Also make sure to restart nova-compute if nova-conductor pcmk resource changed + # the state, since nova-compute is deployed at a previous step. + Pacemaker::Resource::Service[$::nova::params::conductor_service_name] ~> Service<| title == 'nova-compute' |> } } |