| Age | Commit message (Collapse) | Author | Files | Lines |
|---|
|
Provide TripleO overcloud manifests to deploy MidoNet and the cluster
services that needs to run.
Change-Id: I24f852e74fc4652d4609e1a71897e813448055fe
|
|
Change-Id: I9c6fafa4b7b57cc0941040e899bcdd2e89fc9d58
Signed-off-by: Gael Chamoulaud <gchamoul@redhat.com>
|
|
Nova vnc and swift proxy were listening on the same port if SSL is
enabled in the load balancer
Change-Id: Ibf4aa118d6c8e94f8f2a68bf270d5445ebda7593
|
|
|
|
keystone and heat_cfn were listening on the same port if SSL is enabled
inm the load balancer.
Change-Id: I099119198ebf3322a783581f0c6758417e705a2e
|
|
When using websockets in HAProxy, like nova_novncproxy does, we
need to set "timeout tunnel" to avoid disconnections after a short
period without traffic.
Change-Id: I1b66cd9a1d20cbbe35a2ada5782a76a01b14bcd1
Closes-BZ: 1267043
|
|
Current HAproxy config is broken for MySQL timeout parameters.
This is what we have today by default in HAproxy logs:
--------------
[WARNING] 238/115010 (13878) : config : missing timeouts for proxy
'mysql'.
| While not properly invalid, you will certainly encounter various
problems
| with such a configuration. To fix this, please ensure that all
following
| timeouts are set to a non-zero value: 'client', 'connect', 'server'.
--------------
This patch aims to:
* Use the correct parameters to configure puppetlabs-haproxy
* Update the database timeouts to higher values to prevent the
services from disconnecting too frequently by setting the Galera HAProxy
timeout to 90 minutes.
Change-Id: I06dd4bf81d4f4fd3c01bb681f6f0b3152f2b8eea
|
|
|
|
- s/manila/$manila
Change-Id: I7aaa8f83fe758484ab39af28c914fa3d78464633
Signed-off-by: Gael Chamoulaud <gchamoul@redhat.com>
|
|
This simplifies use of tripleo::packages so that when
enable_upgrade is set to true you no longer have to enable_install
as well.
Change-Id: Ic3050a64530be9e2b6827ed8566f59d28547ae81
|
|
|
|
The haproxy configuration for horizon does not have 'mode http' set.
This proxy needs to be in http mode since it is using a cookie for
persistence. The default section has 'mode tcp', which is fine, but
horizon proxy needs to override this setting to get http mode. Without
this, you will likely see an error like this:
[WARNING] 238/115010 (13878) : config : cookie will be ignored for proxy
'horizon' (needs 'mode http').'
Closes BZ-1257687
Change-Id: I397986ea022f47a33a5210696752509f4a2731a5
|
|
|
|
Currently the address of the syslog server for HAProxy is hardcoded to
/dev/log without a way to customize this setting.
This commit aims to give a user more flexibility about which syslog
server address to use.
Change-Id: If7f7c8154e544e5d8a49f79f642e1ad01644a66d
|
|
|
|
When establishing a connection from the client (Web Browser) to the
novncproxy (loadbalanced by HAproxy), we need to make sure the client
will stick on the same server the time he's connected, because HAproxy
load-balance to another novncproxy node, the client will loose the
connection and timeout like 'Connection Reset By Peer error'.
This patch aims to configure novnc HAproxy configuration to balance
using 'source' mode, so it will make sure the server remains the same
while the connection is established.
Change-Id: Ibbb7162b763f1fd2854a10a92a681910e0683c0a
Closes-BZ: 1257324
|
|
This patch converts the write_package_names function into
a proper resource. Using the write_package_names only works
if the function comes last in the puppet manifest. By
making the same functionality a custom resource we allow
for it to exist anywhere in the manifest and provide the
same functionality.
The new syntax would be:
package_manifest{'/tmp/foo': ensure => present}
Co-Authored-By: Martin Mágr <mmagr@redhat.com>
Change-Id: If3e03b1983fed47082fac8ce63f975557dbc503c
|
|
This patch is the initial modulesync run, it impacts:
* gitignore: just a sync between projects
* gemfile:
- update and allow to setup facter version and gem source
- split beaker gems with a dedicated group
- switch to rspec-puppet 2.2.0
* rakefile:
- use the new syntax for lint configuration
- add a acceptance target
* acceptance:
- sync nodesets
- update tests in order to use zuul-cloner
* spec: added rspec coverage report
Change-Id: Iadefbe2cc0525224e9917c6712712c67ce1e0fff
|
|
To make sure we don't use the ssl-hello-chk option set by the
puppet-haproxy module we used to redefine the listener options
for all listeners.
With this change a default for the options hash is provided to
the puppet class instead.
This change also configures use of tcpka only where wanted, as
documented by [1], removing it from the haproxy defaults section,
given it wasn't used anyway by the other listeners which were
indeed overriding options.
1. https://github.com/beekhof/osp-ha-deploy/blob/master/pcmk/lb.scenario
Change-Id: Ic8deb77533f561cea7ce7db1d20f6be5e2dc0d33
|
|
Adds bindings to the Manila service for HAProxy.
Change-Id: I175d5b7e35a781d04452fc6aee610e8dca005419
|
|
EC2 API returns 400 for unauthenticated requests, making HAProxy believe
that the service is down. We'll use TCP check instead of HTTP check for
EC2 API.
Change-Id: Ide7f9390603c9893b95cacd51d468461255dcf07
|
|
|
|
This updates some of the listener options set by loadbalancer.pp.
Iroinc needs to pass in the option to do a httpchk, otherwise
puppet-haproxy defaults it to doing a ssl-hello-chk, which won't work
against the non-ssl loadbalancer server.
Ceilometer and glance_registry both don't support a httpchk against the
root (/) of their webservers (they return a straight 401) so disable
those checks completely.
Change-Id: Ibfc81175842a748eb077b132b0818c4ea17bbcf6
|
|
The default per frontend maxconn is set to 2000, which can easily
be reached with modern hardware with multiple logic cores; this
change adds a parameter to configure the default maxconn value,
default it to 4096 and also increases the global maxconn to 20480
to preserve the 1:5 ratio.
Change-Id: I3fffc51ecc704ceccb86ca008ecba02578c29eb5
|
|
Currently firewalling is implemented in tripleo/init.pp this commit
moves it to its own scope tripleo/firewall.pp.
This is done so that in tripleo-heat-templates we can have a simple and
generic `include tripleo::firewall` in every manifest - unconditional.
The rest of the behavior will all be managed by hiera.
If a user wants to enable firewalling:
```
tripleo::firewall::manage_firewall: true
```
If a user wants to specify firewall rules:
```
tripleo::firewall::firewall_rules:
'103 mongod':
port: 27017
```
Change-Id: I144c60db2a568a94dce5b51257f1d10980173325
|
|
|
|
|
|
|
|
|
|
Backend options for Ceilometer and Ironic are aligned with what we
use for the other OpenStack services.
Listener options for Horizon is updated so that we do cookie
tracking as suggested by refarch doc.
Change-Id: I4640d974a3ab8188919eaae79dde71463234b5ff
|
|
|
|
|
|
Change-Id: Ic0ae6b743a732ccd2cf7e395b5ab172bf3daaf7d
|
|
|
|
|
|
This patch adds a new tripleo::noop class that can be
used to help switch all resources of a given type
to noop mode. The class does this via Puppet resource
collectors to enable the noop metaparam on all resources
of the specified type.
When a resource is in noop mode no action
will get taken (however puppet stdout will log information
about what would happen if noop were removed).
The motivation for this patch is to be able to do something
like this and run puppet to configure select resources
(like only config files):
class {'tripleo::noop':
file => false
}
It is important to note that when tripleo::noop is used all common
resources default to noop mode.
This could be used alongside docker containers to provide
a mechanism to pre-configure all related config files for
a set of docker containers ahead of time.
Change-Id: I67f9dbbf33a2d6bcee5005ae0b6b1aa7091039ad
|
|
When doing a heat stack-show, Heat initially returns a 302 redirect.
With the existing loadbalancer config for SSL, this results in a
redirect to an http:// address pointing at the SSL port, which
naturally doesn't work.
The fix for this is to use the rsprep haproxy option to rewrite the
Location header in responses from the Heat api server. This allows
us to properly handle redirect traffic as https.
Also note that http header rewriting requires "mode http", so that
is added here as well.
Change-Id: I7e5c5b1877e9aa46c4b88dfba45c1fddf61727fc
|
|
Just like any other OpenStack API endpoint.
Change-Id: Iaa45d7bef94c3c42df0988a58f146bb8a530f74e
|
|
This function writes out package names that have been
defined in a given puppet catalog.
In order to work this should be place last (or very late)
in a manifest to ensure it picks up packages.
Change-Id: Ie21b5bf7df71337da02ea43915dc4e70d3052bb7
|
|
This adds a new class to help configure package installation
and upgrades.
The previous approach was to use a global package declaration
at the top of each manifest within the tripleo-heat-templates.
The new approach is to use a Package collector (<| |>) to
allow us to configure the package provider within a
class. This should help remove some of the duplicated logic
within the triplo-heat-template manifests and is
also a good fit for puppet-tripleo in that is generic
and unlikely to change that often.
In addition to installation this class also support upgrades
to puppet managed packages as well.
Change-Id: Ie8fbc344149bc8c9977e127de77636903607617a
|
|
|
|
|
|
The glance-registry service is returning 401 to httpchk, which
makes haproxy think it is down. This change switches the check
mode to tcp.
Closes-Bug: https://bugzilla.redhat.com/show_bug.cgi?id=1234637
Closes-Bug: 1468566
Change-Id: Icdd80aa9cd56e5afd3707eb7fa38aaedb8535af6
|
|
In the pacemaker scenario we want to use the clustercheck script
to evict galera nodes which are out of sync. This change adds a
parameter meant to enable use of clustercheck for the mysql service.
Change-Id: I7199c7e5d759a76f58c0f48b40e9d460a3163886
Closes-Bug: 1456701
|
|
We do not want to give users control over the galera_master_node,
this should be gathered using the clustercheck script instead.
Depends-On: I56ebd2d8405ac35c707666d993b396f04aeb683e
Change-Id: Ib6a36e9283b73133251fb9ff3f33e71c50edb3db
Closes-Bug: 1467918
Closes-Bug: https://bugzilla.redhat.com/show_bug.cgi?id=1234817
|
|
|
|
Change-Id: I682bac7726393da66b8da9c17fa638f02d4b0a1b
|
|
* Provide a Define function which will allow to manage IPtables rules.
* Manage rules in 'pre' and 'post' Puppet stages, it allows to create
rules before and after regular Puppet stages (ie: to make sure no rule
exists *before* and everything is blocked *after* regular Puppet
stages)
Change-Id: I84fc79096f6fc3db76a61d012d8cb62dd12bdd89
|
|
Adds a class to configure fence devices and a helper function which
helps to select the devices for configuration on appropriate nodes.
Depends on patches outside OpenStack's Gerrit:
https://github.com/redhat-openstack/puppet-pacemaker/pull/50
https://github.com/redhat-openstack/puppet-pacemaker/pull/52
Change-Id: I819fc8c126ec47cd207c59b3dcf92ff699649c5a
|
|
This patch optionally creates new virtual IPs for
the storage, storage_mgmt, and internal_api
networks if ip addresses are provided.
Additionally the HAproxy configuration is updated
to use hiera lookups to obtain virtual IPs for
alternate networks. By default the ctlplane
VIP is still used.
Change-Id: I20483574920a1da689374b0eb1b39b0391c3d243
|
Jaume Devesa
Gael Chamoulaud
Juan Antonio Osorio Robles
Jenkins
Javier Pena
Emilien Macchi
Dan Prince
Yanis Guenane
Cody Herriges
Giulio Fidente
Ryan Hefner
Jiri Stransky
James Slagle
Ben Nemec
Jeremy Stanley