diff options
Diffstat (limited to 'manifests')
| -rw-r--r-- | manifests/certmonger/ca/crl.pp | 149 | ||||
| -rw-r--r-- | manifests/haproxy.pp | 13 | ||||
| -rw-r--r-- | manifests/profile/base/certmonger_user.pp | 10 | ||||
| -rw-r--r-- | manifests/profile/base/ironic/conductor.pp | 1 | ||||
| -rw-r--r-- | manifests/profile/base/neutron/sriov.pp | 14 | ||||
| -rw-r--r-- | manifests/profile/base/swift/ringbuilder.pp | 36 | ||||
| -rw-r--r-- | manifests/profile/pacemaker/cinder/backup_bundle.pp | 146 | ||||
| -rw-r--r-- | manifests/profile/pacemaker/cinder/volume_bundle.pp | 141 | ||||
| -rw-r--r-- | manifests/profile/pacemaker/database/mysql.pp | 33 | ||||
| -rw-r--r-- | manifests/profile/pacemaker/database/mysql_bundle.pp | 5 | ||||
| -rw-r--r-- | manifests/profile/pacemaker/database/redis_bundle.pp | 5 | ||||
| -rw-r--r-- | manifests/profile/pacemaker/haproxy_bundle.pp | 1 | ||||
| -rw-r--r-- | manifests/profile/pacemaker/rabbitmq_bundle.pp | 5 | ||||
| -rw-r--r-- | manifests/ui.pp | 39 |
14 files changed, 554 insertions, 44 deletions
diff --git a/manifests/certmonger/ca/crl.pp b/manifests/certmonger/ca/crl.pp new file mode 100644 index 0000000..59a3681 --- /dev/null +++ b/manifests/certmonger/ca/crl.pp @@ -0,0 +1,149 @@ +# Copyright 2017 Red Hat, Inc. +# +# Licensed under the Apache License, Version 2.0 (the "License"); you may +# not use this file except in compliance with the License. You may obtain +# a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT +# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the +# License for the specific language governing permissions and limitations +# under the License. +# +# == class: tripleo::certmonger::ca::crl +# +# Class that downloads the appropriate CRL file from the CA. This can +# furtherly be used by services in order for proper certificate revocation to +# come into effect. The class also sets up a cron job that will refresh the CRL +# once a week. Also, processing of the CRL file might be needed. e.g. most CAs +# use DER format to distribute the CRLs, while services such as HAProxy expect +# the CRL to be in PEM format. +# +# === Parameters +# +# [*crl_dest*] +# (Optional) The file where the CRL file will be stored. +# Defaults to '/etc/pki/CA/crl/overcloud-crl.pem' +# +# [*crl_source*] +# (Optional) The URI where the CRL file will be fetched from. +# Defaults to undef +# +# [*process*] +# (Optional) Whether the CRL needs processing before being used. This means +# transforming from DER to PEM format or viceversa. This is because most CRLs +# by default come in DER format, so most likely it needs to be transformed. +# Defaults to true +# +# [*crl_preprocessed*] +# (Optional) The pre-processed CRL file which will be transformed. +# Defaults to '/etc/pki/CA/crl/overcloud-crl.bin' +# +# [*crl_preprocessed_format*] +# (Optional) The pre-processed CRL file's format which will be transformed. +# Defaults to 'DER' +# +# [*minute*] +# (optional) Defaults to '0'. +# +# [*hour*] +# (optional) Defaults to '1'. +# +# [*monthday*] +# (optional) Defaults to '*'. +# +# [*month*] +# (optional) Defaults to '*'. +# +# [*weekday*] +# (optional) Defaults to '6'. +# +# [*maxdelay*] +# (optional) Seconds. Defaults to 0. Should be a positive integer. +# Induces a random delay before running the cronjob to avoid running all +# cron jobs at the same time on all hosts this job is configured. +# +# [*reload_cmds*] +# (Optional) list of commands to be executed after fetching the CRL list in +# the cron job. This will usually be a list of reload commands issued to +# services that use the CRL. +# Defaults to [] +# +class tripleo::certmonger::ca::crl ( + $crl_dest = '/etc/pki/CA/crl/overcloud-crl.pem', + $crl_source = undef, + $process = true, + $crl_preprocessed = '/etc/pki/CA/crl/overcloud-crl.bin', + $crl_preprocessed_format = 'DER', + $minute = '0', + $hour = '1', + $monthday = '*', + $month = '*', + $weekday = '6', + $maxdelay = 0, + $reload_cmds = [], +) { + if $crl_source { + $ensure = 'present' + } else { + $ensure = 'absent' + } + + if $maxdelay == 0 { + $sleep = '' + } else { + $sleep = "sleep `expr \${RANDOM} \\% ${maxdelay}`; " + } + + if $process { + $fetched_crl = $crl_preprocessed + } else { + $fetched_crl = $crl_dest + } + + file { 'tripleo-ca-crl' : + ensure => $ensure, + path => $fetched_crl, + source => $crl_source, + mode => '0644', + } + + if $process and $ensure == 'present' { + $crl_dest_format = $crl_preprocessed_format ? { + 'PEM' => 'DER', + 'DER' => 'PEM' + } + # transform CRL from DER to PEM or viceversa + $process_cmd = "openssl crl -in ${$crl_preprocessed} -inform ${crl_preprocessed_format} -outform ${crl_dest_format} -out ${crl_dest}" + exec { 'tripleo-ca-crl-process-command' : + command => $process_cmd, + path => '/usr/bin', + refreshonly => true, + subscribe => File['tripleo-ca-crl'] + } + } else { + $process_cmd = [] + } + + if $ensure == 'present' { + # Fetch CRL in cron job and notify needed services + $cmd_list = concat(["${sleep}curl -L -o ${fetched_crl} ${crl_source}"], $process_cmd, $reload_cmds) + $cron_cmd = join($cmd_list, ' && ') + } else { + $cron_cmd = absent + } + + cron { 'tripleo-refresh-crl-file': + ensure => $ensure, + command => $cron_cmd, + environment => 'PATH=/usr/bin SHELL=/bin/sh', + user => 'root', + minute => $minute, + hour => $hour, + monthday => $monthday, + month => $month, + weekday => $weekday, + } +} diff --git a/manifests/haproxy.pp b/manifests/haproxy.pp index efbfedc..98c9c96 100644 --- a/manifests/haproxy.pp +++ b/manifests/haproxy.pp @@ -146,6 +146,10 @@ # the servers it balances # Defaults to '/etc/pki/ca-trust/extracted/openssl/ca-bundle.trust.crt' # +# [*crl_file*] +# Path to the CRL file to be used for checking revoked certificates. +# Defaults to undef +# # [*haproxy_stats_certificate*] # Filename of an HAProxy-compatible certificate and key file # When set, enables SSL on the haproxy stats endpoint using the specified file. @@ -565,6 +569,7 @@ class tripleo::haproxy ( $ssl_cipher_suite = '!SSLv2:kEECDH:kRSA:kEDH:kPSK:+3DES:!aNULL:!eNULL:!MD5:!EXP:!RC4:!SEED:!IDEA:!DES', $ssl_options = 'no-sslv3', $ca_bundle = '/etc/pki/ca-trust/extracted/openssl/ca-bundle.trust.crt', + $crl_file = undef, $haproxy_stats_certificate = undef, $keystone_admin = hiera('keystone_enabled', false), $keystone_public = hiera('keystone_enabled', false), @@ -728,7 +733,13 @@ class tripleo::haproxy ( $ports = merge($default_service_ports, $service_ports) if $enable_internal_tls { - $internal_tls_member_options = ['ssl', 'verify required', "ca-file ${ca_bundle}"] + $base_internal_tls_member_options = ['ssl', 'verify required', "ca-file ${ca_bundle}"] + + if $crl_file { + $internal_tls_member_options = concat($base_internal_tls_member_options, "crl-file ${crl_file}") + } else { + $internal_tls_member_options = $base_internal_tls_member_options + } Haproxy::Balancermember { verifyhost => true } diff --git a/manifests/profile/base/certmonger_user.pp b/manifests/profile/base/certmonger_user.pp index 4ba51ec..7a6559e 100644 --- a/manifests/profile/base/certmonger_user.pp +++ b/manifests/profile/base/certmonger_user.pp @@ -77,6 +77,16 @@ class tripleo::profile::base::certmonger_user ( $rabbitmq_certificate_specs = hiera('tripleo::profile::base::rabbitmq::certificate_specs', {}), $etcd_certificate_specs = hiera('tripleo::profile::base::etcd::certificate_specs', {}), ) { + unless empty($haproxy_certificates_specs) { + $reload_haproxy = ['systemctl reload haproxy'] + Class['::tripleo::certmonger::ca::crl'] ~> Haproxy::Balancermember<||> + Class['::tripleo::certmonger::ca::crl'] ~> Class['::haproxy'] + } else { + $reload_haproxy = [] + } + class { '::tripleo::certmonger::ca::crl' : + reload_cmds => $reload_haproxy, + } include ::tripleo::certmonger::ca::libvirt unless empty($apache_certificates_specs) { diff --git a/manifests/profile/base/ironic/conductor.pp b/manifests/profile/base/ironic/conductor.pp index 5ebf167..f7a2eb0 100644 --- a/manifests/profile/base/ironic/conductor.pp +++ b/manifests/profile/base/ironic/conductor.pp @@ -51,6 +51,7 @@ class tripleo::profile::base::ironic::conductor ( } # Configure access to other services + include ::ironic::cinder include ::ironic::drivers::inspector include ::ironic::glance include ::ironic::neutron diff --git a/manifests/profile/base/neutron/sriov.pp b/manifests/profile/base/neutron/sriov.pp index 24c7b63..095da0f 100644 --- a/manifests/profile/base/neutron/sriov.pp +++ b/manifests/profile/base/neutron/sriov.pp @@ -23,23 +23,15 @@ # for more details. # Defaults to hiera('step') # -# [*mechanism_drivers*] -# (Optional) The mechanism drivers to use with the Ml2 plugin -# Defaults to hiera('neutron::plugins::ml2::mechanism_drivers') -# class tripleo::profile::base::neutron::sriov( - $step = hiera('step'), - $mechanism_drivers = hiera('neutron::plugins::ml2::mechanism_drivers'), + $step = hiera('step') ) { include ::tripleo::profile::base::neutron if $step >= 4 { - if 'sriovnicswitch' in $mechanism_drivers { - include ::neutron::agents::ml2::sriov - include ::tripleo::host::sriov - } + include ::neutron::agents::ml2::sriov + include ::tripleo::host::sriov } - } diff --git a/manifests/profile/base/swift/ringbuilder.pp b/manifests/profile/base/swift/ringbuilder.pp index f7cfea4..67156d4 100644 --- a/manifests/profile/base/swift/ringbuilder.pp +++ b/manifests/profile/base/swift/ringbuilder.pp @@ -69,6 +69,10 @@ # [*swift_ring_put_tempurl*] # PUT tempurl to upload Swift rings to # +# [*skip_consistency_check*] +# If set to true, skip the recon check to ensure rings are identical on all +# nodes. Defaults to false +# class tripleo::profile::base::swift::ringbuilder ( $replicas, $build_ring = true, @@ -82,9 +86,10 @@ class tripleo::profile::base::swift::ringbuilder ( $min_part_hours = undef, $swift_ring_get_tempurl = hiera('swift_ring_get_tempurl', ''), $swift_ring_put_tempurl = hiera('swift_ring_put_tempurl', ''), + $skip_consistency_check = false, ) { - if $step == 2 and $swift_ring_get_tempurl != '' { + if $step >= 2 and $swift_ring_get_tempurl != '' { exec{'fetch_swift_ring_tarball': path => ['/usr/bin'], command => "curl --insecure --silent '${swift_ring_get_tempurl}' -o /tmp/swift-rings.tar.gz", @@ -130,22 +135,35 @@ class tripleo::profile::base::swift::ringbuilder ( } Ring_object_device<| |> ~> Exec['rebalance_object'] - Ring_object_device<| |> ~> Exec['rebalance_account'] - Ring_object_device<| |> ~> Exec['rebalance_container'] + Ring_account_device<| |> ~> Exec['rebalance_account'] + Ring_container_device<| |> ~> Exec['rebalance_container'] } } - if $step == 5 and $build_ring and $swift_ring_put_tempurl != '' { - exec{'create_swift_ring_tarball': - path => ['/bin', '/usr/bin'], - command => 'tar cvzf /tmp/swift-rings.tar.gz /etc/swift/*.builder /etc/swift/*.ring.gz /etc/swift/backups/', - unless => 'swift-recon --md5 | grep -q "doesn\'t match"' - } ~> + if $step >= 5 and $build_ring and $swift_ring_put_tempurl != '' { + if $skip_consistency_check { + exec{'create_swift_ring_tarball': + path => ['/bin', '/usr/bin'], + command => 'tar cvzf /tmp/swift-rings.tar.gz /etc/swift/*.builder /etc/swift/*.ring.gz /etc/swift/backups/', + } + } else { + exec{'create_swift_ring_tarball': + path => ['/bin', '/usr/bin'], + command => 'tar cvzf /tmp/swift-rings.tar.gz /etc/swift/*.builder /etc/swift/*.ring.gz /etc/swift/backups/', + unless => 'swift-recon --md5 | grep -q "doesn\'t match"', + } + } exec{'upload_swift_ring_tarball': path => ['/usr/bin'], command => "curl --insecure --silent -X PUT '${$swift_ring_put_tempurl}' --data-binary @/tmp/swift-rings.tar.gz", require => Exec['create_swift_ring_tarball'], refreshonly => true, } + + Exec['rebalance_account'] ~> Exec['create_swift_ring_tarball'] + Exec['rebalance_container'] ~> Exec['create_swift_ring_tarball'] + Exec['rebalance_object'] ~> Exec['create_swift_ring_tarball'] + + Exec['create_swift_ring_tarball'] ~> Exec['upload_swift_ring_tarball'] } } diff --git a/manifests/profile/pacemaker/cinder/backup_bundle.pp b/manifests/profile/pacemaker/cinder/backup_bundle.pp new file mode 100644 index 0000000..cd06986 --- /dev/null +++ b/manifests/profile/pacemaker/cinder/backup_bundle.pp @@ -0,0 +1,146 @@ +# Copyright 2017 Red Hat, Inc. +# +# Licensed under the Apache License, Version 2.0 (the "License"); you may +# not use this file except in compliance with the License. You may obtain +# a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT +# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the +# License for the specific language governing permissions and limitations +# under the License. +# +# == Class: tripleo::profile::pacemaker::cinder::backup_bundle +# +# Containerized Redis Pacemaker HA profile for tripleo +# +# === Parameters +# +# [*cinder_backup_docker_image*] +# (Optional) The docker image to use for creating the pacemaker bundle +# Defaults to hiera('tripleo::profile::pacemaker::cinder::backup_bundle::cinder_docker_image', undef) +# +# [*pcs_tries*] +# (Optional) The number of times pcs commands should be retried. +# Defaults to hiera('pcs_tries', 20) +# +# [*bootstrap_node*] +# (Optional) The hostname of the node responsible for bootstrapping tasks +# Defaults to hiera('redis_short_bootstrap_node_name') +# +# [*step*] +# (Optional) The current step in deployment. See tripleo-heat-templates +# for more details. +# Defaults to hiera('step') +# +# +class tripleo::profile::pacemaker::cinder::backup_bundle ( + $bootstrap_node = hiera('cinder_backup_short_bootstrap_node_name'), + $cinder_backup_docker_image = hiera('tripleo::profile::pacemaker::cinder::backup_bundle::cinder_backup_docker_image', undef), + $pcs_tries = hiera('pcs_tries', 20), + $step = hiera('step'), +) { + if $::hostname == downcase($bootstrap_node) { + $pacemaker_master = true + } else { + $pacemaker_master = false + } + + include ::tripleo::profile::base::cinder::backup + + if $step >= 2 and $pacemaker_master { + $cinder_backup_short_node_names = hiera('cinder_backup_short_node_names') + $cinder_backup_short_node_names.each |String $node_name| { + pacemaker::property { "cinder-backup-role-${node_name}": + property => 'cinder-backup-role', + value => true, + tries => $pcs_tries, + node => $node_name, + before => Pacemaker::Resource::Bundle[$::cinder::params::backup_service], + } + } + } + + if $step >= 5 { + if $pacemaker_master { + $cinder_backup_nodes_count = count(hiera('cinder_backup_short_node_names', [])) + + pacemaker::resource::bundle { $::cinder::params::backup_service : + image => $cinder_backup_docker_image, + replicas => 1, + location_rule => { + resource_discovery => 'exclusive', + score => 0, + expression => ['cinder-backup-role eq true'], + }, + container_options => 'network=host', + options => '--ipc=host --privileged=true --user=root --log-driver=journald -e KOLLA_CONFIG_STRATEGY=COPY_ALWAYS', + run_command => '/bin/bash /usr/local/bin/kolla_start', + storage_maps => { + 'cinder-backup-cfg-files' => { + 'source-dir' => '/var/lib/kolla/config_files/cinder_backup.json', + 'target-dir' => '/var/lib/kolla/config_files/config.json', + 'options' => 'ro', + }, + 'cinder-backup-cfg-data' => { + 'source-dir' => '/var/lib/config-data/cinder/etc/cinder', + 'target-dir' => '/etc/cinder', + 'options' => 'ro', + }, + 'cinder-backup-cfg-ceph' => { + 'source-dir' => '/var/lib/config-data/cinder/etc/ceph', + 'target-dir' => '/etc/ceph', + 'options' => 'ro', + }, + 'cinder-backup-hosts' => { + 'source-dir' => '/etc/hosts', + 'target-dir' => '/etc/hosts', + 'options' => 'ro', + }, + 'cinder-backup-localtime' => { + 'source-dir' => '/etc/localtime', + 'target-dir' => '/etc/localtime', + 'options' => 'ro', + }, + 'cinder-backup-dev' => { + 'source-dir' => '/dev', + 'target-dir' => '/dev', + 'options' => 'rw', + }, + 'cinder-backup-run' => { + 'source-dir' => '/run', + 'target-dir' => '/run', + 'options' => 'rw', + }, + 'cinder-backup-sys' => { + 'source-dir' => '/sys', + 'target-dir' => '/sys', + 'options' => 'rw', + }, + 'cinder-backup-lib-modules' => { + 'source-dir' => '/lib/modules', + 'target-dir' => '/lib/modules', + 'options' => 'ro', + }, + 'cinder-backup-iscsi' => { + 'source-dir' => '/etc/iscsi', + 'target-dir' => '/etc/iscsi', + 'options' => 'rw', + }, + 'cinder-backup-var-lib-cinder' => { + 'source-dir' => '/var/lib/cinder', + 'target-dir' => '/var/lib/cinder', + 'options' => 'rw', + }, + 'cinder-backup-var-log' => { + 'source-dir' => '/var/log/containers/cinder', + 'target-dir' => '/var/log/cinder', + 'options' => 'rw', + }, + }, + } + } + } +} diff --git a/manifests/profile/pacemaker/cinder/volume_bundle.pp b/manifests/profile/pacemaker/cinder/volume_bundle.pp new file mode 100644 index 0000000..f0858c9 --- /dev/null +++ b/manifests/profile/pacemaker/cinder/volume_bundle.pp @@ -0,0 +1,141 @@ +# Copyright 2017 Red Hat, Inc. +# +# Licensed under the Apache License, Version 2.0 (the "License"); you may +# not use this file except in compliance with the License. You may obtain +# a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT +# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the +# License for the specific language governing permissions and limitations +# under the License. +# +# == Class: tripleo::profile::pacemaker::cinder::volume_bundle +# +# Containerized Redis Pacemaker HA profile for tripleo +# +# === Parameters +# +# [*cinder_volume_docker_image*] +# (Optional) The docker image to use for creating the pacemaker bundle +# Defaults to hiera('tripleo::profile::pacemaker::cinder::volume_bundle::cinder_docker_image', undef) +# +# [*pcs_tries*] +# (Optional) The number of times pcs commands should be retried. +# Defaults to hiera('pcs_tries', 20) +# +# [*bootstrap_node*] +# (Optional) The hostname of the node responsible for bootstrapping tasks +# Defaults to hiera('redis_short_bootstrap_node_name') +# +# [*step*] +# (Optional) The current step in deployment. See tripleo-heat-templates +# for more details. +# Defaults to hiera('step') +# +# +class tripleo::profile::pacemaker::cinder::volume_bundle ( + $bootstrap_node = hiera('cinder_volume_short_bootstrap_node_name'), + $cinder_volume_docker_image = hiera('tripleo::profile::pacemaker::cinder::volume_bundle::cinder_volume_docker_image', undef), + $pcs_tries = hiera('pcs_tries', 20), + $step = hiera('step'), +) { + if $::hostname == downcase($bootstrap_node) { + $pacemaker_master = true + } else { + $pacemaker_master = false + } + + include ::tripleo::profile::base::cinder::volume + + if $step >= 2 and $pacemaker_master { + $cinder_volume_short_node_names = hiera('cinder_volume_short_node_names') + $cinder_volume_short_node_names.each |String $node_name| { + pacemaker::property { "cinder-volume-role-${node_name}": + property => 'cinder-volume-role', + value => true, + tries => $pcs_tries, + node => $node_name, + before => Pacemaker::Resource::Bundle[$::cinder::params::volume_service], + } + } + } + + if $step >= 5 { + if $pacemaker_master { + $cinder_volume_nodes_count = count(hiera('cinder_volume_short_node_names', [])) + + pacemaker::resource::bundle { $::cinder::params::volume_service: + image => $cinder_volume_docker_image, + replicas => 1, + location_rule => { + resource_discovery => 'exclusive', + score => 0, + expression => ['cinder-volume-role eq true'], + }, + container_options => 'network=host', + options => '--ipc=host --privileged=true --user=root --log-driver=journald -e KOLLA_CONFIG_STRATEGY=COPY_ALWAYS', + run_command => '/bin/bash /usr/local/bin/kolla_start', + storage_maps => { + 'cinder-volume-cfg-files' => { + 'source-dir' => '/var/lib/kolla/config_files/cinder_volume.json', + 'target-dir' => '/var/lib/kolla/config_files/config.json', + 'options' => 'ro', + }, + 'cinder-volume-cfg-data' => { + 'source-dir' => '/var/lib/config-data/cinder/etc/cinder', + 'target-dir' => '/etc/cinder', + 'options' => 'ro', + }, + 'cinder-volume-hosts' => { + 'source-dir' => '/etc/hosts', + 'target-dir' => '/etc/hosts', + 'options' => 'ro', + }, + 'cinder-volume-localtime' => { + 'source-dir' => '/etc/localtime', + 'target-dir' => '/etc/localtime', + 'options' => 'ro', + }, + 'cinder-volume-dev' => { + 'source-dir' => '/dev', + 'target-dir' => '/dev', + 'options' => 'rw', + }, + 'cinder-volume-run' => { + 'source-dir' => '/run', + 'target-dir' => '/run', + 'options' => 'rw', + }, + 'cinder-volume-sys' => { + 'source-dir' => '/sys', + 'target-dir' => '/sys', + 'options' => 'rw', + }, + 'cinder-volume-lib-modules' => { + 'source-dir' => '/lib/modules', + 'target-dir' => '/lib/modules', + 'options' => 'ro', + }, + 'cinder-volume-iscsi' => { + 'source-dir' => '/etc/iscsi', + 'target-dir' => '/etc/iscsi', + 'options' => 'rw', + }, + 'cinder-volume-var-lib-cinder' => { + 'source-dir' => '/var/lib/cinder', + 'target-dir' => '/var/lib/cinder', + 'options' => 'rw', + }, + 'cinder-volume-var-log' => { + 'source-dir' => '/var/log/containers/cinder', + 'target-dir' => '/var/log/cinder', + 'options' => 'rw', + }, + }, + } + } + } +} diff --git a/manifests/profile/pacemaker/database/mysql.pp b/manifests/profile/pacemaker/database/mysql.pp index 031e80c..d42d557 100644 --- a/manifests/profile/pacemaker/database/mysql.pp +++ b/manifests/profile/pacemaker/database/mysql.pp @@ -53,20 +53,22 @@ class tripleo::profile::pacemaker::database::mysql ( $pacemaker_master = false } - # use only mysql_node_names when we land a patch in t-h-t that - # switches to autogenerating these values from composable services - # The galera node names need to match the pacemaker node names... so if we - # want to use FQDNs for this, the cluster will not finish bootstrapping, - # since all the nodes will be marked as slaves. For now, we'll stick to the - # short name which is already registered in pacemaker until we get around - # this issue. - $galera_node_names_lookup = hiera('mysql_short_node_names', hiera('mysql_node_names', $::hostname)) + $galera_node_names_lookup = hiera('mysql_short_node_names', $::hostname) + $galera_fqdns_names_lookup = hiera('mysql_node_names', $::hostname) + if is_array($galera_node_names_lookup) { - $galera_nodes = downcase(join($galera_node_names_lookup, ',')) + $galera_nodes_count = length($galera_node_names_lookup) + $galera_nodes = downcase(join($galera_fqdns_names_lookup, ',')) + $galera_name_pairs = zip($galera_node_names_lookup, $galera_fqdns_names_lookup) } else { + $galera_nodes_count = 1 $galera_nodes = downcase($galera_node_names_lookup) + $galera_name_pairs = [[$galera_node_names_lookup, $galera_fqdns_names_lookup]] } - $galera_nodes_count = count(split($galera_nodes, ',')) + + # NOTE(jaosorior): The usage of cluster_host_map requires resource-agents-3.9.5-82.el7_3.11 + $processed_galera_name_pairs = $galera_name_pairs.map |$pair| { join($pair, ':') } + $cluster_host_map = join($processed_galera_name_pairs, ';') $mysqld_options = { 'mysqld' => { @@ -100,6 +102,15 @@ class tripleo::profile::pacemaker::database::mysql ( } } + # since we are configuring rsync for wsrep_sst_method, we ought to make sure + # it's installed. We only includ this at step 2 since puppet-rsync may be + # included later and also adds the package resource. + if $step == 2 { + if ! defined(Package['rsync']) { + package {'rsync':} + } + } + # remove_default_accounts parameter will execute some mysql commands # to remove the default accounts created by MySQL package. # We need MySQL running to run the commands successfully, so better to @@ -136,7 +147,7 @@ class tripleo::profile::pacemaker::database::mysql ( op_params => 'promote timeout=300s on-fail=block', master_params => '', meta_params => "master-max=${galera_nodes_count} ordered=true", - resource_params => "additional_parameters='--open-files-limit=16384' enable_creation=true wsrep_cluster_address='gcomm://${galera_nodes}'", + resource_params => "additional_parameters='--open-files-limit=16384' enable_creation=true wsrep_cluster_address='gcomm://${galera_nodes}' cluster_host_map='${cluster_host_map}'", tries => $pcs_tries, location_rule => { resource_discovery => 'exclusive', diff --git a/manifests/profile/pacemaker/database/mysql_bundle.pp b/manifests/profile/pacemaker/database/mysql_bundle.pp index 451d7f7..a127a5c 100644 --- a/manifests/profile/pacemaker/database/mysql_bundle.pp +++ b/manifests/profile/pacemaker/database/mysql_bundle.pp @@ -199,6 +199,11 @@ MYSQL_HOST=localhost\n", image => $mysql_docker_image, replicas => $galera_nodes_count, masters => $galera_nodes_count, + location_rule => { + resource_discovery => 'exclusive', + score => 0, + expression => ['galera-role eq true'], + }, container_options => 'network=host', options => '--user=root --log-driver=journald -e KOLLA_CONFIG_STRATEGY=COPY_ALWAYS', run_command => '/bin/bash /usr/local/bin/kolla_start', diff --git a/manifests/profile/pacemaker/database/redis_bundle.pp b/manifests/profile/pacemaker/database/redis_bundle.pp index 167e54a..8e30c2f 100644 --- a/manifests/profile/pacemaker/database/redis_bundle.pp +++ b/manifests/profile/pacemaker/database/redis_bundle.pp @@ -73,6 +73,11 @@ class tripleo::profile::pacemaker::database::redis_bundle ( image => $redis_docker_image, replicas => $redis_nodes_count, masters => 1, + location_rule => { + resource_discovery => 'exclusive', + score => 0, + expression => ['redis-role eq true'], + }, container_options => 'network=host', options => '--user=root --log-driver=journald -e KOLLA_CONFIG_STRATEGY=COPY_ALWAYS', run_command => '/bin/bash /usr/local/bin/kolla_start', diff --git a/manifests/profile/pacemaker/haproxy_bundle.pp b/manifests/profile/pacemaker/haproxy_bundle.pp index 3e7b7dd..292c9dd 100644 --- a/manifests/profile/pacemaker/haproxy_bundle.pp +++ b/manifests/profile/pacemaker/haproxy_bundle.pp @@ -87,6 +87,7 @@ class tripleo::profile::pacemaker::haproxy_bundle ( pacemaker::resource::bundle { 'haproxy-bundle': image => $haproxy_docker_image, replicas => $haproxy_nodes_count, + location_rule => $haproxy_location_rule, container_options => 'network=host', options => '--user=root --log-driver=journald -e KOLLA_CONFIG_STRATEGY=COPY_ALWAYS', run_command => '/bin/bash /usr/local/bin/kolla_start', diff --git a/manifests/profile/pacemaker/rabbitmq_bundle.pp b/manifests/profile/pacemaker/rabbitmq_bundle.pp index b05b0b1..f6c5044 100644 --- a/manifests/profile/pacemaker/rabbitmq_bundle.pp +++ b/manifests/profile/pacemaker/rabbitmq_bundle.pp @@ -105,6 +105,11 @@ class tripleo::profile::pacemaker::rabbitmq_bundle ( pacemaker::resource::bundle { 'rabbitmq-bundle': image => $rabbitmq_docker_image, replicas => $rabbitmq_nodes_count, + location_rule => { + resource_discovery => 'exclusive', + score => 0, + expression => ['rabbitmq-role eq true'], + }, container_options => 'network=host', options => '--user=root --log-driver=journald -e KOLLA_CONFIG_STRATEGY=COPY_ALWAYS', run_command => '/bin/bash /usr/local/bin/kolla_start', diff --git a/manifests/ui.pp b/manifests/ui.pp index 1745535..825ffc2 100644 --- a/manifests/ui.pp +++ b/manifests/ui.pp @@ -65,10 +65,18 @@ # The ironic proxy endpoint url # Defaults to undef # +# [*endpoint_proxy_ironic_inspector*] +# The ironic inspector proxy endpoint url +# Defaults to undef +# # [*endpoint_config_ironic*] # The ironic config endpoint url # Defaults to undef # +# [*endpoint_config_ironic_inspector*] +# The ironic inspector config endpoint url +# Defaults to undef +# # [*endpoint_proxy_mistral*] # The mistral proxy endpoint url # Defaults to undef @@ -112,18 +120,20 @@ class tripleo::ui ( 'ko-KR' => 'Korean', 'zh-CN' => 'Simplified Chinese' }, - $endpoint_proxy_zaqar = undef, - $endpoint_proxy_keystone = undef, - $endpoint_proxy_heat = undef, - $endpoint_proxy_ironic = undef, - $endpoint_proxy_mistral = undef, - $endpoint_proxy_swift = undef, - $endpoint_config_zaqar = undef, - $endpoint_config_keystone = undef, - $endpoint_config_heat = undef, - $endpoint_config_ironic = undef, - $endpoint_config_mistral = undef, - $endpoint_config_swift = undef, + $endpoint_proxy_zaqar = undef, + $endpoint_proxy_keystone = undef, + $endpoint_proxy_heat = undef, + $endpoint_proxy_ironic = undef, + $endpoint_proxy_ironic_inspector = undef, + $endpoint_proxy_mistral = undef, + $endpoint_proxy_swift = undef, + $endpoint_config_zaqar = undef, + $endpoint_config_keystone = undef, + $endpoint_config_heat = undef, + $endpoint_config_ironic = undef, + $endpoint_config_ironic_inspector = undef, + $endpoint_config_mistral = undef, + $endpoint_config_swift = undef, ) { @@ -160,6 +170,11 @@ class tripleo::ui ( 'reverse_urls' => $endpoint_proxy_ironic }, { + 'path' => '/ironic-inspector', + 'url' => $endpoint_proxy_ironic_inspector, + 'reverse_urls' => $endpoint_proxy_ironic_inspector + }, + { 'path' => '/mistral', 'url' => $endpoint_proxy_mistral, 'reverse_urls' => $endpoint_proxy_mistral |