aboutsummaryrefslogtreecommitdiffstats
AgeCommit message (Collapse)AuthorFilesLines
2017-01-18Merge "Remove legacy flag and use composable interface"Jenkins2-20/+3
2017-01-18Add Ceph RBD mirror Pacemaker profileGiulio Fidente2-0/+141
This change adds a profile for the Ceph RBD mirror service, which should be managed by Pacemaker to make sure there is always a single instance running. Change-Id: Ic63dc5cffece38942d305f538f71dd58a5d50789 Partial-Bug: #1652177
2017-01-18Remove legacy flag and use composable interfacePradeep Kilambi2-20/+3
We dont need this flag anymore as we will disable api using composable interface instead. See I67900f7e6816212831aea8ed18f323652857fbd3 Closes-bug: #1656364 Change-Id: Ib6aea02bde6ad7e5223336579f0a99d6cd3ee98f
2017-01-18updates to collectd supportLars Kellogg-Stedman3-48/+80
Based on Steve Hardy's comments in https://review.openstack.org/#/c/413748/, we need to move handling of the list of plugins out of the heat templates and into puppet. This module now uses the service_names variable to look up information on per-service collectd plugins. Change-Id: Ie5fba01e1f91ffdc39eb0eb1be9b1464c797b04f
2017-01-18Do not depend on bootstrap_nodeid for any pacemaker profileMichele Baldessari8-14/+20
When we create a pacemaker resource it must happen from a single node. If it happens from multiple nodes an immediate error will be returned by pcs. For the pacemaker roles we enforce this by leveraging the recently introduced <SERVICE_NAME_bootstrap_short_node_name> which gives us the first hostname per-service, regardless of the role. (introduced via I03e8685f939e8ae1fcd8b16883b559615042505d) With this approach if a pacemaker service belongs to two different roles (say role Controller on node A and role galera on node B), it will only create the resource from one of the two and not both (which would return an error). Only setting Partial-Bug for this one, because it addresses the issue from the pacemaker resource creation POV (which is always affected). But the issue itself is a race that we're theoretically affected by since the composable roles work landed. While I have tried to fix the more general case in previous attempts, I think it is best if we start a discussion on how to fix it, because each approach has a bunch of potential drawbacks and is quite invasive on how we do things. A discussion slot for this has been proposed for the Atlanta PTG. Change-Id: I662398cab60d523d204b57a5674ca8f5c0f2e68a Partial-Bug: #1615983
2017-01-18Merge "Set ceph key when using manila ceph backend"Jenkins1-1/+36
2017-01-17add cache to object-expirer pipelineMarcus Furlong1-0/+1
Without 'cache' in the object-expirer pipeline, adding $memcache_servers will have no effect. This commit adds 'cache' to the pipeline. Change-Id: I8ddb71e8e6a5844446dd2478b6b9389ed0ade075
2017-01-17Merge "Call VF configuration from udev rules"Jenkins3-4/+33
2017-01-17Merge "Add missing Swift base class"Jenkins1-0/+1
2017-01-16Merge "Include swift::storage::loopbacks class"Jenkins1-0/+1
2017-01-16Merge "Set memcache_servers in /etc/swift/object-expirer.conf"Jenkins1-1/+3
2017-01-16Merge "Enable object-expirer on Swift proxy profile"Jenkins1-0/+2
2017-01-16Merge "Implement Nova Placement API profile"Jenkins4-0/+133
2017-01-16Merge "Include ::heat at step 3"Jenkins1-2/+0
2017-01-14nova: disable ::nova::db::sync_cell_v2Emilien Macchi2-13/+17
This feature is broken for us now and there is work in progress in Nova to improve nova cell deployment. Until it's fixed upstream, we need to disable cells deployment for now, so we can promote our CI. Change-Id: I379ba9e94a92ed225a03a67fc975b542447a9c8b Related-Bug: #1649341
2017-01-13Include ::heat at step 3James Slagle1-2/+0
Since we include ::heat::keystone::domain at step 3, and that class requires heat.conf since it uses the heat_config resource, we need to also include ::heat at step 3. The ::heat class will take care of installing openstack-heat-common that provides heat.conf. Closes-Bug: #165389 Partially-implements: blueprint split-stack-software-configuration Change-Id: I5ba34ca96ca84d3f1cf3785ed8bbef6720f7bd42
2017-01-11Set ceph key when using manila ceph backendJan Provaznik1-1/+36
Manila ceph driver reads ceph's client configuration (keyring is the most important) from ceph.conf file (or any other file set by cephfs_conf_path). ceph.conf should be updated with keyring location. If ceph is deployed by tripleo then also manila ceph key is added into ceph and ceph filesystem is created. Depends-On: I18436a64fc991b9e697a1d79e369ac110cf8fe20 Change-Id: Iac4a260af6738ed6afd4bcb107221a736d07c1b5 Partial-Bug: #1644784 Closes-Bug: #1646147
2017-01-11Add support for fence_ironic fencing agent.Chris Jones1-0/+3
We now support creating Pacemaker stonith fencing using the fence_ironic fencing agent. Partial-Bug: #1649695 Depends-On: I315f9bb78a1296f691dadaeb39fb0a48df1d5f06 Change-Id: I596eef68820f16516feeda147d3689f0da85d7ac
2017-01-11Implement Nova Placement API profileEmilien Macchi4-0/+133
Allow TripleO to deploy Nova Placement API with a new profile. Change-Id: I5e25a50f3d7a9b39f4146a61cb528963ee09e90c
2017-01-10Merge "Rspec tests for nova profiles"Jenkins12-1/+801
2017-01-10Merge "Add Docker Registry profile"Jenkins2-0/+84
2017-01-10Merge "Move nova cells db sync into nova-api profile"Jenkins3-65/+26
2017-01-10Merge "Add support for not using admin_token in Ceph/RGW"Jenkins4-9/+51
2017-01-09Rspec tests for nova profilesAlex Schultz12-1/+801
This change fixes the hiera calls in the base nova profile to use the parameter rather than continue to call hiera. Additionally this change includes basic test coverage for the various nova profiles. Change-Id: If393606eeb3c39ed3a2655bd89c5c276a9cf106e
2017-01-09Move nova cells db sync into nova-api profileDan Prince3-65/+26
Having the db_sync code live in the mysql profile causes coupling that doesn't work unless your MySQL server has the latest Nova packages installed. This may not work for some baremetal setups (where an isolated database exists) or with containers where the MySQL container definately doesn't have nova packages installed. Moving this code into the nova-api role also matches where we were already db syncing the normal API database so it should be fine and safe. Change-Id: Ib625e2ac9c8d6bd1d335c58e291facc4ea5839ae Co-Authored-By: Alex Schultz <aschultz@redhat.com>
2017-01-09Add support for not using admin_token in Ceph/RGWKeith Schincke4-9/+51
This patch add the option for using Keyston V3 authention with the Ceph/RGW service instead of using the admin_token Change-Id: I42861afcac221478dcb68be13b6dbc2533a7f158
2017-01-09Use THT to define cell0 creationAlex Schultz1-4/+1
As part of the initial implementation, we hard coded the cell0 setup in puppet. This change switches it to leverage the defined value in the tripleo-heat-templates Change-Id: I896a124d91d06ca85b77c9fbe24fd252815a2d28 Depends-On: I08119d781ef60750cc19753bc03190e413159925 Related-Bug: #1649341
2017-01-09Add Docker Registry profileMartin André2-0/+84
The profile was moved out of instack-undercloud puppet manifest and changed to install a v2 Docker registry rather than the old, deprecated v1 registry. Change-Id: Iecf7a4c7e86349e6ecaa0a8ee6d37223e3af7862
2017-01-09Add haproxy firewall rules for galera and redisMichele Baldessari1-0/+18
This change adds haproxy rules for galera and redis. They are not there because these haproxy entries do not use the ::tripleo::haproxy::endpoint function which does this automatically. Rabbit does not need them because it does not go through haproxy. Closes-Bug: #1654280 Change-Id: If995d5c36341f3c089cbda9a0827ea28c19c796b
2017-01-07Merge "Ensure panko::db class is initialized"Jenkins1-0/+1
2017-01-07Merge "Fix puppet warning for empty value"Jenkins1-0/+2
2017-01-06Ensure panko::db class is initializedPradeep Kilambi1-0/+1
Change-Id: If2f6559a7d76b26fa9b0a3ecfa2e2101aae93e3c
2017-01-06Merge "glance/api: cleanup on dbsync"Jenkins1-8/+1
2017-01-06Fix puppet warning for empty valueEmilien Macchi1-0/+2
Unknown variable: 'haproxy_ssl_firewall_rules' when public_ssl_port is empty. Fixing it by setting an empty hash in this case. Change-Id: If864732262852ef79ebb91ee77902c86b847072a
2017-01-05firewall: add IPv6 supportEmilien Macchi2-18/+84
This patch adds support for ip6tables rules in TripleO, in a intuitive and flexible fashion. 1) Default firewal rules 'source' parameter to undef. It was 0.0.0.0/0 before but now undef, so we don't need complex logic to support ipv6 rules. undef will create empty source, which is the same as 0.0.0.0/0 or ::/0. 2) Automatically convert icmp rules to ipv6-icmp for ipv6 rules. 3) Automatically create IPv6 rules like it's for IPv4. 4) Only create rules that can be created, depending on source/destination ip version. This patch should be backward compatible and adds a layer of security for IPv6 deployments. If previous deployments were manually creating Ipv6 rules, it's possible that this patch will override them. Our framework is able to configure any rule, so it shouldn't be a problem for upgrades. Co-Authored-By: Ben Nemec <bnemec@redhat.com> Closes-Bug: #1654050 Change-Id: I98a00a9ae265d3e5854632e749cc8c3a1647298c
2017-01-05glance/api: cleanup on dbsyncEmilien Macchi1-8/+1
Cleanup some code that were useful in the effort of removing Glance Registry service from TripleO. Change-Id: I2a4bdc413e953b8b713d9a12bba74ca18487fe0d
2017-01-05Merge "Adds a profile for the Ceph MDS service"Jenkins2-0/+94
2017-01-04nova-api: switch to new wsgi classEmilien Macchi1-1/+1
nova::wsgi::apache was deprecated in ocata in favor of nova::wsgi::apache_api. Let's switch to it. Change-Id: I59b3b36be33268fa6e261a7db3c4aa8e8e712ffb Depends-On: I5fc99062d349597393e2248c66f2d863029c7730
2017-01-04Merge "Fixes missing haproxy firewall rules for OpenDaylight"Jenkins1-17/+9
2017-01-04Adds a profile for the Ceph MDS serviceGiulio Fidente2-0/+94
This change adds a profile to deploy the Ceph MDS service and some basic unit tests for it. Depends-On: I558b43deaa9b243c54f3d7ae945f11dd4925eb5d Change-Id: Iaecc3ff7acb851776c5057c42a5a513a70425d2c Partial-Bug: #1644784
2017-01-04Fixes missing haproxy firewall rules for OpenDaylightTim Rozet1-17/+9
This migrates the haproxy config for ODL to use the tripleo::haproxy::endpoint class. This class automatically configures firewall rules for each haproxy endpoint. Also removes listening on public network for IP and adds listening on ctlplane network for admin access. Partial-Bug: 1651476 Change-Id: I1f2af2793d040fda17bf73252afe59434d99f31f Signed-off-by: Tim Rozet <trozet@redhat.com>
2017-01-04Sync the db as part of the glance-api installFlavio Percoco2-12/+25
The glance database should be created as part of the glance-api service installation and not the registry. Move the db_sync param to the glance-api class call. Change-Id: Ib9f511219e8cb9a7322745b6bd7c4f9c9cc0c198
2017-01-04Merge "Adds ability to populate SSH Banner text"Jenkins3-0/+94
2017-01-04Merge "Add the ml2_odl section when using opendalight_v2"Jenkins1-1/+1
2017-01-04Merge "Don't include api/scheduler manifests on manila share service set up"Jenkins1-2/+0
2017-01-03Merge "Add fossw of networking-fujitsu support to puppet-tripleo"Jenkins1-0/+5
2017-01-03Merge "Add cell_v2 setup for nova"Jenkins1-1/+70
2017-01-03Merge "Avoid Yum/RPM prefetch in norpm provider"Jenkins1-0/+4
2017-01-03Merge "Include nova::compute::libvirt::qemu from the libvirt profile"Jenkins1-0/+2
2017-01-02Avoid Yum/RPM prefetch in norpm providerDan Prince1-0/+4
When package installation is disabled we still prefetch packages. This disables the package prefetch by returning an empty array which should be fine in the normal case and fixes issues when running puppet in some docker containers. Change-Id: Ia483c5f8500b804ba37a80e9ca1ec9c038f0a867