summaryrefslogtreecommitdiffstats
AgeCommit message (Collapse)AuthorFilesLines
2017-06-09Merge "Use CRL for HAProxy"Jenkins3-1/+28
2017-06-09Merge "Add resource to fetch CRL"Jenkins3-0/+257
2017-06-08Merge "Move tripleo::certmonger::httpd to defines folder and fix suffix"Jenkins1-0/+2
2017-06-08Use CRL for HAProxyJuan Antonio Osorio Robles3-1/+28
This sets up the CRL file to be triggered on the certmonger_user resource. Furtherly, HAProxy uses this CRL file in the member options, thus effectively enabling revocation for proxied nodes. So, if a certificate has been revoked by the CA, HAProxy will not proxy requests to it. bp tls-via-certmonger Change-Id: I4f1edc551488aa5bf6033442c4fa1fb0d3f735cd
2017-06-08Add resource to fetch CRLJuan Antonio Osorio Robles3-0/+257
This will fetch the CRL file from the specified file or URL. Furtherly it will set up a cron job to refresh the crl file once a week and notify the needed services. bp tls-via-certmonger Change-Id: I38e163e8ebb80ea5f79cfb8df44a71fdcd284e04
2017-06-08Merge "Add _spec suffix to class spec tests"Jenkins5-0/+0
2017-06-08Merge "Add polkit rule to allow kolla nova user access to libvirtd socket on ↵Jenkins2-0/+138
docker host"
2017-06-08Merge "Add novajoin profile"Jenkins2-0/+209
2017-06-08Move tripleo::certmonger::httpd to defines folder and fix suffixJuan Antonio Osorio Robles1-0/+2
It's a define, not a class. And it also needs the _spec suffix. Change-Id: Ie5e0cf81d03379d8b791fd77a5c78d12048ebfef
2017-06-08Add _spec suffix to class spec testsJuan Antonio Osorio Robles5-0/+0
Some of them didn't have it. So I added it to them for uniformity. Change-Id: I2ea57d0ecfe151f9a14db9f7722a26f09aa8a506
2017-06-06Add polkit rule to allow kolla nova user access to libvirtd socket on docker ↵Oliver Walsh2-0/+138
host The polkit rules are currently evaluated in the context of the docker host. As a result the check fails for the kolla nova compute user, as the uids are not consistent with the host uids (in fact we probably can't assume a nova user exists on the docker host). As a short-term workaround a 'docker_nova' user group is created on the docker host and the polkit rule is updated to grant this user access to the libvirtd socket. Longer term solution probably requires running polkitd in a container too. Change-Id: I91be1f1eacf8eed9017bbfef393ee2d66771e8d6 Related-bug: #1693844
2017-06-05Merge "Add Mistral event engine"Jenkins2-0/+50
2017-06-05Merge "Drop un-needed 'else' in noop_resource"Jenkins1-1/+0
2017-06-05Merge "Pacemaker support for OVN DB servers"Jenkins3-1/+135
2017-06-05Add novajoin profileJuan Antonio Osorio Robles2-0/+209
This is needed in order to deploy novajoin in a containerized undercloud environment. Change-Id: Iea461f66b8f4e3b01a0498e566a2c3684144df80
2017-06-05Prepare for release 7.1.0Emilien Macchi2-3/+3
Change-Id: I6306429e37a50fb30ec5704d8192a29e6da586ec
2017-06-03Merge "Clustercheck, monitor service for galera containers"Jenkins1-0/+65
2017-06-03Merge "Puppet module to deploy MySQL bundle for HA"Jenkins1-0/+302
2017-06-03Merge "Puppet module to deploy RabbitMQ bundle for HA"Jenkins1-0/+194
2017-06-02Merge "Puppet module to deploy Redis bundle for HA"Jenkins1-0/+178
2017-06-02Puppet module to deploy MySQL bundle for HADamien Ciabrini1-0/+302
This module is used by tripleo-heat-templates to configure and deploy Kolla-based mysql containers managed by pacemaker. We use short-lived containers that call pcs via puppet to create the needed pacemaker resources, properties and constraints. Co-Authored-By: Michele Baldesari <michele@acksyn.org> Partial-Bug: #1692842 Depends-On: I44fbd7f89ab22b72e8d3fc0a0e3fe54a9418a60f Depends-On: Ie9b7e7d2a3cec4b121915a17c1e809e4ec950e7f Change-Id: I3b4d8ad2eec70080419882d5d822f78ebd3721ae
2017-06-02Merge "Puppet module to deploy HAProxy bundle for HA"Jenkins2-3/+211
2017-06-02Drop un-needed 'else' in noop_resourceDan Prince1-1/+0
Change-Id: Id45ac93d482ff23c4c834e2d345a926fc408573f
2017-06-02Merge "Add conditional for setting authlogin_nsswitch_use_ldap selboolean"Jenkins1-0/+6
2017-06-01Merge "Composable Role for Neutron LBaaS"Jenkins3-0/+91
2017-06-01Add conditional for setting authlogin_nsswitch_use_ldap selbooleanJacob Liberman1-0/+6
If selinux is enabled the authlogin_nsswitch_use_ldap Boolean must be enabled. This setting allows LDAP communications to the confined LDAP/server port. This change includes a conditional for enabling this Boolean only when selinux is in use. Change-Id: If985f2434d28fcd33198929bf61f2a3a82e601fe Closes-Bug: #1695002
2017-06-01Merge "Restart docker after changing storage driver"Jenkins1-0/+2
2017-06-01do not include remote name in branch spec for release notesDoug Hellmann1-1/+1
Reno will add the origin prefix if there is no local branch with the desired name. Change-Id: I76cc3199edacc4e35af44e01c57720100faee529 Signed-off-by: Doug Hellmann <doug@doughellmann.com>
2017-06-01make release note a list of stringsDoug Hellmann1-2/+3
Change-Id: I806e15f24309261bb4bf108aacc43a5c4d2d33bc Signed-off-by: Doug Hellmann <doug@doughellmann.com>
2017-06-01Pacemaker support for OVN DB serversBabu Shanmugam3-1/+135
This patch enables OVN DB servers to be started in master/slave mode in the pacemaker cluster. A virtual IP resource is created first and then the pacemaker OVN OCF resource - "ovn:ovndb-servers" is created. The OVN OCF resource is configured to be colocated with the vip resource. The ovn-controller and Neutron OVN ML2 mechanism driver which depends on OVN DB servers will always connect to the vip address on which the master OVN DB servers listen on. The OVN OCF resource itself takes care of (re)starting ovn-northd service on the master node and we don't have to manage it. When HA is enabled for OVN DB servers, haproxy does not configure the OVN DB servers in its configuration. This patch requires OVS 2.7 in the overcloud. Co-authored:by: Numan Siddique <nusiddiq@redhat.com> Change-Id: I9dc366002ef5919339961e5deebbf8aa815c73db Partial-bug: #1670564
2017-05-31Merge "Add missing octavia mysql user creation"Jenkins1-0/+3
2017-05-30Puppet module to deploy RabbitMQ bundle for HADamien Ciabrini1-0/+194
This module is used by tripleo-heat-templates to configure and deploy Kolla-based RabbitMQ containers managed by pacemaker. We use short-lived containers that call pcs via puppet to create the needed pacemaker resources, properties and constraints. Co-Authored-By: Michele Baldessari <michele@acksyn.org> Co-Authored-By: John Eckersberg <jeckersb@redhat.com> Partial-Bug: #1692909 Change-Id: I0722e4a4d4716f477e8304cfa1aadd3eef7c2f31 Depends-On: I44fbd7f89ab22b72e8d3fc0a0e3fe54a9418a60f Depends-On: Ie9b7e7d2a3cec4b121915a17c1e809e4ec950e7f
2017-05-26Restart docker after changing storage driverSteve Baker1-0/+2
This likely explains why CI appears to still be running the devicemapper driver even though overlay2 is now the default. Change-Id: Ic2d80bae1fddbdb1c80bae297031521dd78d896a Closes-Bug: #1692502
2017-05-26Merge "Move ceilometer upgrade step out of base"Jenkins5-44/+54
2017-05-26Merge "Pass mistral::api service_name from t-h-t"Jenkins1-11/+3
2017-05-25Puppet module to deploy HAProxy bundle for HADamien Ciabrini2-3/+211
This module is used by tripleo-heat-templates to configure and deploy Kolla-based haproxy containers managed by pacemaker. We use short-lived containers that call pcs via puppet to create the needed pacemaker resources, properties and constraints. Co-Authored-By: Michele Baldesari <michele@acksyn.org> Partial-Bug: #1692908 Depends-On: I44fbd7f89ab22b72e8d3fc0a0e3fe54a9418a60f Depends-On: Ie9b7e7d2a3cec4b121915a17c1e809e4ec950e7f Change-Id: Ifcf890a88ef003d3ab754cb677cbf34ba8db9312
2017-05-25Puppet module to deploy Redis bundle for HADamien1-0/+178
This module is used by tripleo-heat-templates to configure and deploy Kolla-based Redis containers managed by pacemaker. We use short-lived containers that call pcs via puppet to create the needed pacemaker resources, properties and constraints. Co-Authored-By: Michele Baldesari <michele@acksyn.org> Partial-Bug: #1692924 Depends-On: I44fbd7f89ab22b72e8d3fc0a0e3fe54a9418a60f Depends-On: Ie9b7e7d2a3cec4b121915a17c1e809e4ec950e7f Change-Id: Ia1131611d15670190b7b6654f72e6290bf7f8b9e
2017-05-24Move ceilometer upgrade step out of basePradeep Kilambi5-44/+54
ceilometer-upgrade should only run on controller nodes. Since its currently in base profile, it gets triggered on compute as well. So instead split out the upgrade into its own and include when we deploy notification and central agents instead. Change-Id: I2910e8aa5da7fded4cf94b57fb0a14fefd88adbe Closes-bug: #1693339
2017-05-24Merge "Add support for autofencing to Pacemaker Remote."Jenkins1-0/+27
2017-05-24Merge "Enable mistral to run under mod_wsgi"Jenkins2-4/+59
2017-05-24Add missing octavia mysql user creationMartin André1-0/+3
This patch makes sure the octavia mysql user is created when the octavia_api service is enabled. Change-Id: I270f3f6879737fc29370165e4a8fa8c9c19fffb3
2017-05-23Clustercheck, monitor service for galera containersDamien Ciabrini1-0/+65
In HA overcloud deployments, HAProxy makes use of a helper service called "clustercheck", to check whether galera nodes are available for serving traffic. This change implements a dedicated profile for clustercheck, which was originally part of the pacemaker mysql profile. The profile generates the necessary configuration files for clustercheck and let heat templates manage the associated container's lifecycle. Co-Authored-By: Michele Baldessari <michele@acksyn.org> Partial-Bug: #1692969 Change-Id: I1aabe34fa6a9c8c705a4405f275b66502c313cf2
2017-05-23Enable novajoin user on keystone profileJuan Antonio Osorio Robles1-0/+3
If novajoin is enabled, the keystone profile should create its user. bp tls-via-certmonger-containers Change-Id: Ifb43b72cbf0180cf12e6d3584c92ae01ce5294e5
2017-05-22Merge "TLS everywhere: Add resources for mongodb's TLS configuration"Jenkins2-0/+96
2017-05-19Merge "Bad example in firewall.pp"Jenkins1-1/+1
2017-05-19Merge "Switch to overlay2 driver for storage"Jenkins2-4/+90
2017-05-19Bad example in firewall.ppCyril Lopez1-1/+1
It was an error in the example to set firewall rule Tested on newton. Closes-Bug: 1691990 Change-Id: I091ad0305ac9d9fbb63853e46169fcaa6092456b Signed-off-by: Cyril Lopez <cylopez@redhat.com>
2017-05-19Switch to overlay2 driver for storageDan Prince2-4/+90
This patch switches the default to the overlay2 storage driver and see if it helps performance. Background: The loopback driver is not recommended for production. Most other docker storage backends require extra disks (or partitions) which we don't have on the root disk. Overlay seems to make the most since for TripleO upgrades where we intend to update in-place installations to use docker. Co-Authored-By: Martin André <m.andre@redhat.com> Change-Id: I6896a9b3e9dc3e269bf5b0dc753bf8c985482daf
2017-05-18Merge "Update tox configuration"Jenkins5-63/+21
2017-05-18Merge "Update gitignore not to exclude fixture hieradata"Jenkins1-1/+2