summaryrefslogtreecommitdiffstats
AgeCommit message (Collapse)AuthorFilesLines
2016-10-05Fetch internal certificates for HAProxy based on networkJuan Antonio Osorio Robles3-80/+273
The service profile in HAProxy has the capability of creating certificates based on a map. The idea is to standardize this, as some of those certificates should match certain networks the services are listening on (with the exception of the external network which is handled differently and the tenant network which doesn't need a certificate). So, based on which network a certain service is listening on, we fetch the appropriate certificate. bp tls-via-certmonger Change-Id: I89001ae32f46c9682aecc118753ef6cd647baa62
2016-10-05Merge "Use service-specific servernames for haproxy"Jenkins1-31/+31
2016-10-05Merge "Change rabbitmq queues HA mode from ha-all to ha-exactly"Jenkins1-1/+21
2016-10-05Use service-specific servernames for haproxyJuan Antonio Osorio Robles1-31/+31
Right now we're hardcoding the server names for the services to be the controllers. This is problematic if we start using custom roles for services, which listen on nodes that are not controllers. We already have the server names for each service, so using this mapping instead fixes the issue. Change-Id: Ic4b65edb3dc1b75abbc3421a87cab97425b058c4 Closes-Bug: #1629098
2016-10-05Change rabbitmq queues HA mode from ha-all to ha-exactlyMichele Baldessari1-1/+21
It turns out that reducing number of rabbitmq queues in cluster significantly improves performance of cluster especially in the case of failover recovery time. Right now the cluster uses ha-all mode for rabbitmq queues. It is best to change this to "ha-exactly" mode and reduce the number of queue copies to ceil(N/2) where N is number of controllers in the cluster - so in typical scenario of 3 controller It would be 2 by default. It does not make much sense to keep the copies of queues over whole cluster since if the quorum of nodes is lost then the rest of cluster nodes will be stopped anyway. We let the user override this with a parameter. I.e. for a 3 node controlplane cluster we will go from this: pcs resource show rabbitmq Resource: rabbitmq (class=ocf provider=heartbeat type=rabbitmq-cluster) Attributes: set_policy="ha-all ^(?!amq\.).* {"ha-mode":"all"}" To this: pcs resource show rabbitmq Resource: rabbitmq (class=ocf provider=heartbeat type=rabbitmq-cluster) Attributes: set_policy="ha-all ^(?!amq\.).* {"ha-mode":"exactly","ha-params":2}" According to Marin Krcmarik's testing recovery time from failure was reduced significantly. Co-Authored-By: Marian Krcmarik <mkrcmari@redhat.com> Change-Id: Ib62001c03e1e08f58cf0c6e0ba07a8879a584084 Partial-Bug: #1628998
2016-10-04Cleanup the firewall logic.Dan Prince1-1/+1
We added code in t-h-t to strip empty services from the service_names list. (These are often the result of a service set to OS::Heat::None). As such we can now drop this puppet reject statement. Change-Id: Ie66f14f183de7e44a1f69af862f7d4be9a14c904
2016-10-04Merge "Fix the timeout for pacemaker systemd resources"Jenkins32-10/+40
2016-10-04Clean out UI httpd configuration fileJulie Pichon1-0/+15
When updating the package with yum directly, a new httpd config file is created with a different name than the one used by Puppet, causing httpd to fail. Cleaning out the package config file and keeping it around means it won't get overwritten on update, and is the way other projects such as puppet-horizon handle this. Change-Id: I539729ce4cd0898f8b0f3f26266e4e6d55b99e37 Closes-Bug: #1628983
2016-10-03Merge "Use FallbackResource instead of Rewrite for UI"Jenkins1-13/+7
2016-10-03Fix the timeout for pacemaker systemd resourcesMichele Baldessari32-10/+40
Back in the Mitaka cycle via the change If6b43982c958f63bc78ad997400bf1279c23df7e we made sure that the default start and stop timeouts for pacemaker systemd resources is 200s (>= twice the default 90s DefaultTimeoutStopSec in systemd). We did this change by setting puppet resource defaults for the Pacemaker::Resource::Service class: Pacemaker::Resource::Service { op_params => 'start timeout=200s stop timeout=200s', } The problem is that after the composable services rework, this does not work anymore and the pacemaker systemd resources that still exist do not have these timeouts set. We want to move away from resource defaults for this because its results are dependent on the inclusion order which in tripleo is not guaranteed any longer (https://docs.puppet.com/puppet/latest/reference/lang_scope.html#scope-lookup-rules) The only services affected in Newton are: cinder-volume, cinder-backup, manila-share, haproxy. I preferred fixing all the pacemaker resources because it seems the cleanest and most logical commit. Change-Id: If89a95706514e536a7a2949871a0002c79b6046e Closes-Bug: #1629366
2016-10-03Merge "Add swift proxy for ceilometer middleware"Jenkins1-0/+1
2016-10-03Merge "Cinder: Add iSCSI protocol parameter"Jenkins1-0/+6
2016-10-03Merge "Added X-Forwarded-Proto headers for horizon"Jenkins1-4/+7
2016-09-30telemetry: normalize coordination_urlEmilien Macchi3-3/+10
Normalize coordination_url for Telemetry services, so we can deploy them with IPv6. Change-Id: Ic6de09acf0d36ca90cc2041c0add1bc2b4a369a5 Partial-Bug: #1629279 Depends-On: I038e2bac22e3bfa5047d2e76e23cff664546464d
2016-09-28Use FallbackResource instead of Rewrite for UIHonza Pokorny1-13/+7
The original configuration produced a 400 error for all requests. The new FallbackResource directive accomplishes our task in a more elegant fashion. Change-Id: Ib5d77d158e73acc63d5c0c85d6aa6d99d2176333 Closes-Bug: 1628484
2016-09-28metadata.json: prepare RC2 releaseEmilien Macchi1-1/+1
Bump to 5.2.0 which is RC2 release. Change-Id: If5e650c52fa3d7701d3079712a9cc8db3a431e36
2016-09-28Merge "Move db syncs into mysql base role"Jenkins16-54/+63
2016-09-27Move db syncs into mysql base roleDan Prince16-54/+63
This patch moves the various DB syncs into the MySQL role. Database creation needs to occur on the MySQL server to avoid permission issues. This patch also moves database creation to step 2 so we can guarantee that all per-service databases exist at this time. This avoids complex ordering needed during step 3 where services, on different hosts, can run their own db sync's in a distributed fashion. Change-Id: I05cc0afa9373429a3197c194c3e8f784ae96de5f Partial-bug: #1620595
2016-09-26Merge "Add pameter for gmcast.listen_addr configuration"Jenkins1-4/+9
2016-09-26Merge "Make mysql bind-address configurable"Jenkins2-5/+14
2016-09-26Merge "Move inclusion of ::manila::db::mysql in manila/api profile"Jenkins5-33/+77
2016-09-26Add pameter for gmcast.listen_addr configurationJuan Antonio Osorio Robles1-4/+9
having an actual name for that configuration will allow us to pass a more proper name via t-h-t. Change-Id: Iea4bd67074824e5dc6732fd7e408743e693d80b3
2016-09-26Merge "Fix Swift manifest for Puppet4 deployment"Jenkins2-2/+2
2016-09-24Make mysql bind-address configurableJuan Antonio Osorio Robles2-5/+14
It used to be hardcoded that the bind-address was always coming from the $::hostname fact. This is wrong, as it disregards where we have configured the mysql address. This commit actually makes it configurable, so we'll be able to set it via hieradata. On the other hand, we use the hiera key that we already set 'mysql_bind_host' as a default; if, for some reason, that's unavailable then we fall back to $::hostname. Related-Bug: #1627060 Change-Id: I316acfd514aac63b84890e20283c4ca611ccde8b
2016-09-23Add swift proxy for ceilometer middlewarePradeep Kilambi1-0/+1
swift proxy has already been updated to use updated ceilometermiddleware as indicated here [1]. Include it in the proxy class. [1] https://github.com/openstack/puppet-swift/commit/e8ad981eff0f97c24a53197c42caf350627d3c9f Change-Id: Ie49f4a750368ff174b23b8d6baa743d0956d727e
2016-09-23Merge "Switch puppet-tripleo to use puppet-openstack_spec_helper"Jenkins6-76/+42
2016-09-23Merge "Add in rspec-puppet-facts support"Jenkins12-184/+136
2016-09-23Merge "Add FQDN testcase in swift proxy profile rspec tests"Jenkins1-0/+15
2016-09-23Merge "Add support for rabbit hosts to mistral"Jenkins1-1/+8
2016-09-23Merge "certmonger: improve orchestration for puppet4"Jenkins1-4/+6
2016-09-23Move inclusion of ::manila::db::mysql in manila/api profileGiulio Fidente5-33/+77
In puppet-manila it is the api service performing db sync, not scheduler. This change moves ::manila::db::mysql (which creates the empty database and users) in the tripleo manila/api profile. Also moves rabbit config into a general manila base profile as that would be needed by the scheduler service as well. Change-Id: I2b537f735b8d1be8f39e8c274be3872b193c1014
2016-09-23Add support for rabbit hosts to mistralBrad P. Crochet1-1/+8
The mistral puppet did not have support for configuring the rabbit hosts. This change adds that support. Change-Id: I6cb2cbf4a2abf494668d24b8c36b0d525643f0af
2016-09-22Switch puppet-tripleo to use puppet-openstack_spec_helperEmilien Macchi6-76/+42
Align puppet-tripleo with other Puppet OpenStack modules to use puppet-openstack_spec_helper. Here are the benefits: - Allow to use Depends-On between Puppet OpenStack modules and puppet-tripleo, and unit tests will work correctly with dependencies. - Use the Puppet OpenStack gemspec file that handle gems dependencies to test the module. - Allow to re-use ruby helper that Puppet OpenStack modules have in unit tests, to avoid duplicated code. - Don't manage .fixtures.yml file, it will be generated by Puppet OpenStack tooling. TripleO dependencies will live in Puppetfile_extras. Change-Id: Ic66e9f872c57545327a9fb4b8ae86fbf0abbd8be
2016-09-21Add in rspec-puppet-facts supportAlex Schultz12-184/+136
This change pulls in rspec-puppet-facts to provide the basic default facts for puppet-tripleo rspec tests. rspec-puppet-facts provides an easy to use interface to allow for the same set of tests to be executed with multiple sets of operating system facts. In most cases this includes defaults for Debian/RedHat based systems. In puppet-tripleo's case this is just RHEL/CentOS. We are removing the Fedora listing from the metadata.json as we only support RHEL and CentOS for tripleo. This change also updates the existing rspec tests to leverage rspec-puppet-facts to be more consistent with how facts are defined. Change-Id: I0ddc71799d74ee95b9828aea6a8dcb4abb4e4e62
2016-09-21Merge "Manage tripleo-ui configuration files with puppet"Jenkins3-0/+124
2016-09-21Fix Swift manifest for Puppet4 deploymentEmilien Macchi2-2/+2
1) swift/ringbuilder: seed must be a String Because we use validate_re in puppet-swift and puppet4 requires the regex to be a string, not an integer. 2) Fix Swift package name In puppet4, we need the resource title, not the resource name. Change-Id: I50cea96d45e0eb46c19040d9a7105ab72c2dbef7
2016-09-21Merge "swift: normalize memcache servers IP addresses"Jenkins3-1/+93
2016-09-21Add FQDN testcase in swift proxy profile rspec testsEmilien Macchi1-0/+15
Add more coverage in our unit testing for FQDNs. Change-Id: I74859cdecc0d81138b2fe986883c4f7c49b8cab3
2016-09-21Merge "Fix puppet-lint in composable contrail"Jenkins5-192/+215
2016-09-20Merge "Fixup manila-cephfs native backend defaults"Jenkins1-41/+7
2016-09-20certmonger: improve orchestration for puppet4Emilien Macchi1-4/+6
The extract-and-trust-ca actually needs /var/lib/certmonger/local/creds file to be created, which is created when certmonger is started, not when package is installed. This patch change the exec dependency to run it only when service is started. Also, since the service create the file, let's relax the Exec a little bit by allowing to retry 5 times after 1s break in case the Exec fails, for example if service takes more than 5 seconds to create this file. It will avoid us some race condition in the deployment. Change-Id: I4cf4a04bddb8f042e8e8f7e1d1b69f846c533e3b
2016-09-20swift: normalize memcache servers IP addressesEmilien Macchi3-1/+93
In the case of memcache servers are IPv6, make sure brackets set in the way we construct the list of memcache server + memcache port parameter. Also add unit-tests to test that the output is what we want in the configuration. Depends-On: I8d361ce9cfcfe6a3f8592b2b7991971a3c748c75 Closes-Bug: 1625335 Change-Id: I9fb8168d8fb56c9d8465d58a45fd8c6edfee6fdd
2016-09-20Fixup manila-cephfs native backend defaultsmarios1-41/+7
The puppet-tripleo side for manila-cephfs landed without specifying defaults for all class params [1] so when cephfs isn't enabled e.g. only generic, then you will get errors for those params. See review comments at [2] for reports of this. This will fixup the manila-cephfs puppet-tripleo side to be more in line with the tidy up adding netapp at [3]. The config is all moved tripleo-heat-templates side. The tht review for this is at https://review.openstack.org/#/c/358525/ and that will now depend on this review. [1] https://review.openstack.org/#/c/354047/ [2] https://review.openstack.org/#/c/354019/ [3] https://review.openstack.org/#/c/354014/ Change-Id: I918f6f23ae0bd3542bcfe1bf0c797d4e6aa8f4d9
2016-09-20Merge "Terminate Zaqar websocket endpoint in HAProxy"Jenkins1-0/+33
2016-09-20Terminate Zaqar websocket endpoint in HAProxyJuan Antonio Osorio Robles1-0/+33
Note that there was a need to modify different timeouts due to the nature of how websockets work. The source where the reasoning and value came from is listed as a comment in the code. Related-Bug: #1625448 Co-Authored-By: Brad P. Crochet <brad@redhat.com> Change-Id: I9de77d5f692c1c9d04e3c59c5de5312e63f81aed
2016-09-17Merge "Swift add_devices.pp IPv6 handling"Jenkins1-1/+4
2016-09-17Merge "Fix dependencies for HAProxy when certmonger is used"Jenkins2-4/+9
2016-09-17release 5.1.0Emilien Macchi1-1/+1
Change-Id: I89fcd94460c995a18fd35800b5736d70687c4f42
2016-09-17Merge "mysql: never add brackets to mysql_bind_host"Jenkins1-1/+1
2016-09-17Merge "Wait for MongoDB connections before creating replset"Jenkins1-0/+7