aboutsummaryrefslogtreecommitdiffstats
path: root/manifests/profile/base
AgeCommit message (Collapse)AuthorFilesLines
2017-03-27Add missing include of ::ec2api::keystone::authtokenSven Anderson1-0/+1
Change-Id: Id933276fab16eebd72751dca136ad805547e6291 Related-Bug: #1676491 (cherry picked from commit f137661aa178a6b390976470ddec7ed77eb05cf5)
2017-03-25Merge "Explicitly configure credentials used by ironic to access other ↵Jenkins1-0/+7
services" into stable/ocata
2017-03-24Merge "Fixes issues with raising mysql file limit" into stable/ocataJenkins1-3/+8
2017-03-21panko: Do db_sync in api manifestJuan Antonio Osorio Robles2-18/+18
The db_sync from panko comes from the panko-api package; So we move the db_sync to be done in the api manifest as it's done for other services such as barbican. This is necessary since in cases where the overcloud deploy requires puppet to do the installations, with the previous setup it failed since the command wasn't available in the step it was being done. Change-Id: I20a549cbaa2ee4b2c762dbae97f5cbf4d0b517c8 Closes-Bug: #1671716 (cherry picked from commit d73c2630b534b277122db68620be8923c4d3a6b4)
2017-03-21Explicitly configure credentials used by ironic to access other servicesDmitry Tantsur1-0/+7
Using keystone_authtoken credentials for this purpose is deprecated, and also prevents ironic-conductor from being used as a separate role. As a side effect, this change makes it possible to potentially enable ironic-inspector support in the future (it's not enabled yet). Change-Id: I21180678bec911f1be36e3b174bae81af042938c Partial-Bug: #1661250 (cherry picked from commit ffe6ae2c24f82df620df14ee4be8bd292cb95075)
2017-03-20Fixes issues with raising mysql file limitTim Rozet1-3/+8
Changes Include: - Adds spec testing - Only raise limits if nonha. puppet-systemd will restart the mariadb service which breaks ha deployments. Hence we only want to do this in noha. - Minor fix to hiera value refrenced not as parameter to mysql.pp Partial-Bug: #1648181 Related-Bug: #1524809 Co-Authored By: Feng Pan <fpan@redhat.com> Change-Id: Id063bf4b4ac229181b01f40965811cb8ac4230d5 Signed-off-by: Tim Rozet <trozet@redhat.com> Signed-off-by: Feng Pan <fpan@redhat.com> (cherry picked from commit c9acf8a687ea64686c1ecceeff45add014752121)
2017-03-07Stop the chronyd serviceAlex Schultz1-4/+6
Since the norpm provider can prevent the chronyd package from actually getting purged, we need to make sure the chronyd service is stopped and disabled so that it does not conflict with ntpd. Change-Id: I7a697aba7aa5a27ba4ab6e46018057f7f01dfab2 Closes-Bug: #1665426 (cherry picked from commit 37ba3a8db5e38955469e8bc9158388379d64abc8)
2017-03-07Merge "mariadb: Move generation of systemd drop-in to puppet-tripleo" into ↵Jenkins1-0/+15
stable/ocata
2017-03-03mariadb: Move generation of systemd drop-in to puppet-tripleoDamien Ciabrini1-0/+15
Systemd starts mariadb as user mysql, so in order to allow a large number of connections (e.g. max_connections=4096) it is necessary to raise the file descriptor limit via a system drop-in file. When installing an undercloud, such drop-in file is currently generated by instack-undercloud (in file puppet-stack-config.pp). But non-HA overcloud also need such drop-in to be generated. In order to avoid duplicating code, the drop-in creation code should be provided by puppet-tripleo. By default, no drop-in is generated; it has to be enabled by instack-undercloud or tripleo-heat-template once they will use it (resp. to create undercloud or non-HA overcloud). This patch does not aim at generating a dynamic file limit based on the number of connections, this should land in another dedicated patch. Instead, it just reuses the limit currently set for undercloud and HA-overclouds. Also, the generation of the drop-in does not force a mysql restart like it currently does in instack-undercloud, to avoid unexpected service disruption on a non-HA overcloud after a minor update. Co-Authored-By: Tim Rozet <trozet@redhat.com> Depends-On: I7ca7b5f7614971455cae2bf7c4bf8264b642b0dc Change-Id: Ia0907b2ab6062a93fb9363e39c86535a490fbaf6 Partial-Bug: #1648181 Related-Bug: #1524809 (cherry picked from commit 09665170f6d0f4536a48dd4d1444e07aa064bed7)
2017-03-03Default neutron dhcp_agents_per_network to number of agentsBrent Eagles1-1/+29
This patch will set neutron's dhcp_agents_per_network equal to the number of deployed neutron DHCP agents unless otherwise explicitly set. Conflicts: manifests/profile/base/neutron.pp Note: spec/classes/tripleo_profile_base_neutron_spec.rb removed from backport as it required defining the neutron class as a precondition to satisfy a requirement for a rabbit password. This leads to a duplicate definition. Partial-bug: #1632721 Change-Id: I5533e42c5ba9f72cc70d80489a07e30ee2341198 (cherry picked from commit 52a68ffc8f060e1961458a524e5861cea02d1c1c)
2017-02-22Merge "Create /etc/my.cnf.d/tripleo.cnf with proper bind-address" into ↵Jenkins1-0/+72
stable/ocata
2017-02-21Stop accidentally removing docker-distributionJiri Stransky1-1/+2
By default Puppet does virtual package matching if precise name matching fails. Docker-distribution RPM "provides" docker-registry: bash-4.2# rpm -q --whatprovides docker-registry docker-distribution-2.5.1-1.el7.x86_64 This means that when we wanted to make docker-registry package absent, we were actually removing docker-distribution instead. This is now fixed by allow_virtual => false. Only name matching is performed. Change-Id: I1f93b404085f0bc2b6c063f573c801db6409c0bb Closes-Bug: #1666459 (cherry picked from commit d12c004bc9c630c756a6b0df351916b9e04b9778)
2017-02-20Create /etc/my.cnf.d/tripleo.cnf with proper bind-addressMichele Baldessari1-0/+72
When fixing LP#1643487 we added ?bind_address to all DB URIs. Since this clashes with Cellsv2 due to the URIs becoming host dependent, we need a new approach to pass bind_address to pymysql that leaves the DB URIs host-independent. We first create a /etc/my.cnf.d/tripleo.cnf file with a [tripleo] section and in this section we add the correct bind-address option. Note that we use the puppet augeas lens and not the mysql one because the mysql one does not support custom sections *and* there are older versions around which do not like the /etc/my.cnf.d/* path. The reason for not reusing an existing mariadb file (my.cnf or galera.cnf) is that pymysql's ini file support is not robust enough at the moment: https://github.com/PyMySQL/PyMySQL/issues/548 The reason for putting this file creation code only on the controller nodes the following: The slow VIP failover only happens if a service runs where the VIPs exist. The VIPs get created in the haproxy profile and that is why in order to have fast VIP failovers the MySQLClient profile must live where the Haproxy service is running. Co-Authored-By: Damien Ciabrini <dciabrin@redhat.com> Partial-Bug: #1663181 Change-Id: Iff8bd2d9ee85f7bb1445aa2e1b3cfbff1f397b18 (cherry picked from commit f6116ff0f350aeecdaa346e4e49d208be49ce6b9)
2017-02-14tuning: manage keystone resources only at step3Emilien Macchi3-15/+7
1. Manage Keystone resources only at step 3. Don't verify them at step 4 and 5, it's a huge loss of time. 2. Don't require Keystone resources for Gnocchi services, they are already ready at Step 5. Related-Bug: #1664418 Change-Id: I9879718a1a86b862e5eb97e6f938533c96c9f5c8
2017-02-14Merge "Add ::ironic::config to Ironic base profile"Jenkins1-0/+1
2017-02-13nova: move placement credentials config at step 3Emilien Macchi1-1/+1
nova placement credentials in nova.conf need to be configured at step 3 so Nova services can use them as soon as they start. Change-Id: I0abdd305b7e6c8d83f23e25b3872e98eb56dd299
2017-02-12Merge "Add support to changing the Rabbitmq password on update"Jenkins1-0/+26
2017-02-11Merge "nova/api: more cleanup"Jenkins1-16/+24
2017-02-10Merge "Add module to support ScaleIO backend in Cinder"Jenkins2-0/+69
2017-02-10Merge "Rebranding of Eqlx to Dell EMC PS Series"Jenkins2-13/+13
2017-02-10Merge "Run nova-cell_v2-discover_hosts at step 5"Jenkins5-5/+12
2017-02-10nova/api: more cleanupEmilien Macchi1-16/+24
- transform nova_api_wsgi_enabled in a parameter - update rspec tests - fix TLS to run at step 1 Change-Id: I4d3f9c92f0717ae8c3bc8d71065fab281de82008
2017-02-09Run nova-cell_v2-discover_hosts at step 5Emilien Macchi5-5/+12
We need to run nova-cell_v2-discover_hosts at the very end of the deployment because nova database needs to be aware of all registred compute hosts. 1. Move keystone resources management at step 3. 2. Move nova-compute service at step 4. 3. Move nova-placement-api at step 3. 5. Run nova-cell_v2-discover_hosts at step 5 on one nova-api node. 6. Run neutron-ovs-agent at step 5 to avoid racy deployments where it starts before neutron-server when doing HA deployments. With that change, we expect Nova aware of all compute services deployed in TripleO during an initial deployment. Depends-On: If943157b2b4afeb640919e77ef0214518e13ee15 Change-Id: I6f2df2a83a248fb5dc21c2bd56029eb45b66ceae Related-Bug: #1663273 Related-Bug: #1663458
2017-02-09Merge "nova: disable API in WSGI by default"Jenkins1-1/+3
2017-02-09Add module to support ScaleIO backend in CinderGiulio Fidente2-0/+69
Also adds an initial spec file for basic testing of the module. Change-Id: I5534aab53b70de215336a076d25263c73b8d7b5b Partial-Bug: #1661316
2017-02-09Rebranding of Eqlx to Dell EMC PS Seriesrajinir2-13/+13
This changes rebrands Dell Eqlx to Dell PS series and matches the tripleo-heat-templates. Change-Id: I3536147a06b426ace18cf415e99361c47b4cf5d9
2017-02-09start nova-compute when keystone resources are createdEmilien Macchi2-4/+5
1. Move keystone resources management at step 4. 2. Move nova-compute startup at step 5. That way, we make sure nova-compute will start when all Keystone resources are ready. Change-Id: I6e153e11b8519254d2a67b9142bf774a25bce69d Closes-Bug: #1663273
2017-02-09nova: disable API in WSGI by defaultEmilien Macchi1-1/+3
Cleanup patch once the THT patch is merged. Change-Id: Iba439a4758a4728197d7620b764a4f0f2648ee0f Depends-On: I09b73476762593642a0e011f83f0233de68f2c33
2017-02-06Merge "nova/libvirt: switch vnc server binding"Jenkins1-12/+1
2017-02-06nova/libvirt: switch vnc server bindingEmilien Macchi1-12/+1
On compute nodes, instead of binding vnc server on 0.0.0.0, use the IP address provided by libvirt's t-h-t profile (hiera). Co-Authored-By: Juan Antonio Osorio Robles <jaosorior@redhat.com> Depends-On: Ie377c09734e9f6170daa519aed69c53fc67c366b Change-Id: If6b116b238a52144aad5e76c9edc7df6aa15313c Closes-Bug: #1660099
2017-02-06Stop deploying Nova API in WSGI with ApacheEmilien Macchi1-18/+19
It was suggested by Nova team to not deploying Nova API in WSGI with Apache in production. It's causing some issues that we didn't catch until now (see in the bug report). Until we figure out what was wrong, let's disable it so we can move forward in the upgrade process. Related-Bug: 1661360 Co-Authored-By: Juan Antonio Osorio Robles <jaosorior@redhat.com> Change-Id: Ia87b5bdea79e500ed41c30beb9aa9d6be302e3ac
2017-02-06Merge "Revert "Revert "set innodb_file_per_table to ON for MySQL / Galera"""Jenkins1-7/+8
2017-02-04Add ::ironic::config to Ironic base profileDan Prince1-0/+1
I have ExtraConfig settings that need to be set in ironic.conf. Adding the ::ironic::config module to our base Ironic profile should allow users to customize Ironic if needed. Change-Id: I93e9b3b5d4def1d8fa42b77b611b7d9d6cb7963b
2017-02-03Revert "Revert "set innodb_file_per_table to ON for MySQL / Galera""Alex Schultz1-7/+8
This reverts commit 3f7e74ab24bb43f9ad7e24e0efd4206ac6a3dd4e. After identifying how to workaround the performance issues on the undercloud, let's put this back in. Enabling innodb_file_per_table is important for operators to be able to better manage their databases. Change-Id: I435de381a0f0e3ef221e498f442335cdce3fb818 Depends-On: I77507c638237072e38d9888aff3da884aeff0b59 Closes-Bug: #1660722
2017-02-03Add support to changing the Rabbitmq password on updateSaravanan KR1-0/+26
Rabbitmq Password is set on the fresh deployment, but during update, if the password is changed, it is modified in all config files including rabbitmq config. But the rabbitmq connection fails because the new password is not successful applied to rabbitmq. Setting the rabbitmq_user will invoke 'rabbitmqctl change_password'. Scenario: The password change is applied on Step1 when configuring Rabbitmq. Other services may be updated on different Steps. Till other services config is updated with new rabbitmq password, and restarted, the connections will get Access Denied response. It has cyclic dependency. So the passwords will be changes at Step1 and once all services are updated, the connections will work as is. Partial-Bug: #1611704 Change-Id: I44865af3d5eb2d37eb648ac7227277e86c8fbc54
2017-02-03Merge "Use transport_url for rabbitmq connection parameters in heat"Jenkins1-12/+43
2017-02-03Merge "Add initial profiles for rest of Octavia services"Jenkins3-0/+101
2017-02-03Merge "add cache to object-expirer pipeline"Jenkins1-0/+1
2017-02-02Revert "set innodb_file_per_table to ON for MySQL / Galera"Alex Schultz1-8/+7
This reverts commit 621ea892a299d2029348db2b56fea1338bd41c48. We're getting performance problems on SATA disks. Change-Id: I30312fd5ca3405694d57e6a4ff98b490de388b92 Closes-Bug: #1661396 Related-Bug: #1660722
2017-02-02Merge "set innodb_file_per_table to ON for MySQL / Galera"Jenkins1-7/+8
2017-02-01set innodb_file_per_table to ON for MySQL / GaleraMike Bayer1-7/+8
InnoDB uses a single file by default which can grow to be tens/hundreds of gigabytes, and is not shrinkable even if data is deleted from the database. Best practices are that innodb_file_per_table is set to ON which instead stores each database table in its own file, each of which is also shrinkable by the InnoDB engine. Closes-Bug: #1660722 Change-Id: I59ee53f6462a2eeddad72b1d75c77a69322d5de4
2017-02-01Use transport_url for swift-proxy instead of rabbitmq paramsJuan Antonio Osorio Robles1-25/+52
These parameters are being deprecated, so we should be using the transport_url format instead. Change-Id: I8b7457b6233c4f88af2d7bc1b9304fcccb6edf61
2017-01-27Merge "Clean TLS proxy-related setup for neutron-server profile"Jenkins2-16/+21
2017-01-27Merge "Rename controller_admin_vip to controller_admin_host"Jenkins1-8/+9
2017-01-27Merge "Add AuditD Profile"Jenkins1-0/+30
2017-01-27Clean TLS proxy-related setup for neutron-server profileJuan Antonio Osorio Robles2-16/+21
Since the commit this depends on sets it up via hieradata, the conditionals here are no longer needed. bp tls-via-certmonger Depends-On: I9252512dbf9cf2e3eec50c41bf10629d36070bbd Change-Id: I37275e42763e103b81878b6af07c750a524c5697
2017-01-27nova: deploy basic setup for cellsEmilien Macchi1-19/+2
it's not required in Ocata, let's configure the basic setup for cells. note: it also cleanup old code that is not valid anymore. Change-Id: Iac5b2fbe1b03ec7ad4cb8cab2c7694547be6957d
2017-01-27Add AuditD ProfileSteven Hardy1-0/+30
This patch allows the management of the AuditD service and its associated files (such as `audit.rules`) This is achieved by means of the `puppet-auditd` puppet module. Closes-Bug: #1640302 Co-Authored-By: Luke Hinds (lhinds@redhat.com) Change-Id: Ie31c063b674075e35e1bfa28d1fc07f3f897407b
2017-01-27Merge "horizon: be more flexible in hiera neutron"Jenkins1-1/+1
2017-01-27Merge "Use TLS proxy for neutron server's internal TLS"Jenkins2-13/+81