diff options
Diffstat (limited to 'manifests')
| -rw-r--r-- | manifests/profile/base/nova.pp | 159 | ||||
| -rw-r--r-- | manifests/profile/pacemaker/database/redis.pp | 31 |
2 files changed, 117 insertions, 73 deletions
diff --git a/manifests/profile/base/nova.pp b/manifests/profile/base/nova.pp index ab9b615..65355d4 100644 --- a/manifests/profile/base/nova.pp +++ b/manifests/profile/base/nova.pp @@ -87,29 +87,35 @@ # Expects a hash with keys 'private_key' and 'public_key'. # Defaults to {} # +# [*migration_ssh_localaddrs*] +# (Optional) Restrict ssh migration to clients connecting via this list of +# IPs. +# Defaults to [] (no restriction) +# # [*libvirt_tls*] # (Optional) Whether or not libvird TLS service is enabled. # Defaults to false class tripleo::profile::base::nova ( - $bootstrap_node = hiera('bootstrap_nodeid', undef), - $libvirt_enabled = false, - $manage_migration = false, - $oslomsg_rpc_proto = hiera('messaging_rpc_service_name', 'rabbit'), - $oslomsg_rpc_hosts = any2array(hiera('rabbitmq_node_names', undef)), - $oslomsg_rpc_password = hiera('nova::rabbit_password'), - $oslomsg_rpc_port = hiera('nova::rabbit_port', '5672'), - $oslomsg_rpc_username = hiera('nova::rabbit_userid', 'guest'), - $oslomsg_notify_proto = hiera('messaging_notify_service_name', 'rabbit'), - $oslomsg_notify_hosts = any2array(hiera('rabbitmq_node_names', undef)), - $oslomsg_notify_password = hiera('nova::rabbit_password'), - $oslomsg_notify_port = hiera('nova::rabbit_port', '5672'), - $oslomsg_notify_username = hiera('nova::rabbit_userid', 'guest'), - $oslomsg_use_ssl = hiera('nova::rabbit_use_ssl', '0'), - $nova_compute_enabled = false, - $step = hiera('step'), - $migration_ssh_key = {}, - $libvirt_tls = false + $bootstrap_node = hiera('bootstrap_nodeid', undef), + $libvirt_enabled = false, + $manage_migration = false, + $oslomsg_rpc_proto = hiera('messaging_rpc_service_name', 'rabbit'), + $oslomsg_rpc_hosts = any2array(hiera('rabbitmq_node_names', undef)), + $oslomsg_rpc_password = hiera('nova::rabbit_password'), + $oslomsg_rpc_port = hiera('nova::rabbit_port', '5672'), + $oslomsg_rpc_username = hiera('nova::rabbit_userid', 'guest'), + $oslomsg_notify_proto = hiera('messaging_notify_service_name', 'rabbit'), + $oslomsg_notify_hosts = any2array(hiera('rabbitmq_node_names', undef)), + $oslomsg_notify_password = hiera('nova::rabbit_password'), + $oslomsg_notify_port = hiera('nova::rabbit_port', '5672'), + $oslomsg_notify_username = hiera('nova::rabbit_userid', 'guest'), + $oslomsg_use_ssl = hiera('nova::rabbit_use_ssl', '0'), + $nova_compute_enabled = false, + $step = hiera('step'), + $migration_ssh_key = {}, + $migration_ssh_localaddrs = [], + $libvirt_tls = false ) { if $::hostname == downcase($bootstrap_node) { $sync_db = true @@ -131,10 +137,29 @@ class tripleo::profile::base::nova ( backend => 'oslo_cache.memcache_pool', memcache_servers => $memcache_servers, } + class { '::nova': + default_transport_url => os_transport_url({ + 'transport' => $oslomsg_rpc_proto, + 'hosts' => $oslomsg_rpc_hosts, + 'port' => $oslomsg_rpc_port, + 'username' => $oslomsg_rpc_username, + 'password' => $oslomsg_rpc_password, + 'ssl' => $oslomsg_use_ssl_real, + }), + notification_transport_url => os_transport_url({ + 'transport' => $oslomsg_notify_proto, + 'hosts' => $oslomsg_notify_hosts, + 'port' => $oslomsg_notify_port, + 'username' => $oslomsg_notify_username, + 'password' => $oslomsg_notify_password, + 'ssl' => $oslomsg_use_ssl_real, + }), + } include ::nova::placement + } - if $step >= 4 and $manage_migration { - + if $step >= 4 { + if $manage_migration { # Libvirt setup (live-migration) if $libvirt_tls { class { '::nova::migration::libvirt': @@ -148,57 +173,75 @@ class tripleo::profile::base::nova ( transport => 'ssh', configure_libvirt => $libvirt_enabled, configure_nova => $nova_compute_enabled, - client_user => 'nova', - client_extraparams => {'keyfile' => '/var/lib/nova/.ssh/id_rsa'} + client_user => 'nova_migration', + client_extraparams => {'keyfile' => '/etc/nova/migration/identity'} } } - if $migration_ssh_key != {} { + $services_enabled = hiera('service_names', []) + if !empty($migration_ssh_key) and 'sshd' in $services_enabled { # Nova SSH tunnel setup (cold-migration) - #TODO: Remove me when https://review.rdoproject.org/r/#/c/4008 lands - user { 'nova': - ensure => present, - shell => '/bin/bash', + # Server side + if !empty($migration_ssh_localaddrs) { + $allow_type = sprintf('LocalAddress %s User', join($migration_ssh_localaddrs,',')) + $deny_type = 'LocalAddress' + $deny_name = sprintf('!%s', join($migration_ssh_localaddrs,',!')) + + ssh::server::match_block { 'nova_migration deny': + name => $deny_name, + type => $deny_type, + order => 2, + options => { + 'DenyUsers' => 'nova_migration' + }, + notify => Service['sshd'] + } + } + else { + $allow_type = 'User' + } + $allow_name = 'nova_migration' + + ssh::server::match_block { 'nova_migration allow': + name => $allow_name, + type => $allow_type, + order => 1, + options => { + 'ForceCommand' => '/bin/nova-migration-wrapper', + 'PasswordAuthentication' => 'no', + 'AllowTcpForwarding' => 'no', + 'X11Forwarding' => 'no', + 'AuthorizedKeysFile' => '/etc/nova/migration/authorized_keys' + }, + notify => Service['sshd'] } - $private_key_parts = split($migration_ssh_key['public_key'], ' ') - $nova_public_key = { - type => $private_key_parts[0], - key => $private_key_parts[1] + file { '/etc/nova/migration/authorized_keys': + content => $migration_ssh_key['public_key'], + mode => '0640', + owner => 'root', + group => 'nova_migration', + require => Package['openstack-nova-migration'], } - $nova_private_key = { - type => $private_key_parts[0], - key => $migration_ssh_key['private_key'] + + # Client side + file { '/etc/nova/migration/identity': + content => $migration_ssh_key['private_key'], + mode => '0600', + owner => 'nova', + group => 'nova', + require => Package['openstack-nova-migration'], } + $migration_pkg_ensure = installed } else { - $nova_public_key = undef - $nova_private_key = undef + $migration_pkg_ensure = absent } } else { - $nova_public_key = undef - $nova_private_key = undef + $migration_pkg_ensure = absent } - - class { '::nova': - default_transport_url => os_transport_url({ - 'transport' => $oslomsg_rpc_proto, - 'hosts' => $oslomsg_rpc_hosts, - 'port' => $oslomsg_rpc_port, - 'username' => $oslomsg_rpc_username, - 'password' => $oslomsg_rpc_password, - 'ssl' => $oslomsg_use_ssl_real, - }), - notification_transport_url => os_transport_url({ - 'transport' => $oslomsg_notify_proto, - 'hosts' => $oslomsg_notify_hosts, - 'port' => $oslomsg_notify_port, - 'username' => $oslomsg_notify_username, - 'password' => $oslomsg_notify_password, - 'ssl' => $oslomsg_use_ssl_real, - }), - nova_public_key => $nova_public_key, - nova_private_key => $nova_private_key, + package {'openstack-nova-migration': + ensure => $migration_pkg_ensure } } } diff --git a/manifests/profile/pacemaker/database/redis.pp b/manifests/profile/pacemaker/database/redis.pp index 3ef6815..4f5a861 100644 --- a/manifests/profile/pacemaker/database/redis.pp +++ b/manifests/profile/pacemaker/database/redis.pp @@ -32,9 +32,12 @@ # Defaults to hiera('step') # # [*redis_file_limit*] -# (Optional) The file limit to put in /etc/security/limits.d/redis.conf +# (Deprecated) The file limit to put in /etc/security/limits.d/redis.conf # for when redis is managed by pacemaker. Defaults to hiera('redis_file_limit') -# or 10240 (default in redis systemd limits) +# or 10240 (default in redis systemd limits). Note this option is deprecated +# since puppet-redis grew support for ulimits in cluster configurations. +# https://github.com/arioch/puppet-redis/pull/192. Set redis::ulimit via hiera +# to control this limit. # # [*pcs_tries*] # (Optional) The number of times pcs commands should be retried. @@ -44,7 +47,7 @@ class tripleo::profile::pacemaker::database::redis ( $bootstrap_node = hiera('redis_short_bootstrap_node_name'), $enable_load_balancer = hiera('enable_load_balancer', true), $step = hiera('step'), - $redis_file_limit = hiera('redis_file_limit', 10240), + $redis_file_limit = undef, $pcs_tries = hiera('pcs_tries', 20), ) { if $::hostname == downcase($bootstrap_node) { @@ -54,19 +57,17 @@ class tripleo::profile::pacemaker::database::redis ( } if $step >= 1 { - include ::redis - # Until puppet-redis grows support for /etc/security/limits.conf/redis.conf - # https://github.com/arioch/puppet-redis/issues/130 - # we best explicitely set the file limit only in the pacemaker profile - # (the base profile does not need it as it is using systemd which has - # the limits set there) - file { '/etc/security/limits.d/redis.conf': - content => inline_template("redis soft nofile <%= @redis_file_limit %>\nredis hard nofile <%= @redis_file_limit %>\n"), - owner => '0', - group => '0', - mode => '0644', + # If the old hiera key exists we use that to set the ulimit in order not to break + # operators which set it. We might remove this in a later release (post pike anyway) + $old_redis_file_limit = hiera('redis_file_limit', undef) + if $old_redis_file_limit != undef { + warning('redis_file_limit parameter is deprecated, use redis::ulimit in hiera.') + class { '::redis': + ulimit => $old_redis_file_limit, + } + } else { + include ::redis } - if $pacemaker_master and hiera('stack_action') == 'UPDATE' { tripleo::pacemaker::resource_restart_flag { 'redis-master': # ouch, but trying to stay close how notification works in |