aboutsummaryrefslogtreecommitdiffstats
path: root/manifests/profile/base
AgeCommit message (Collapse)AuthorFilesLines
2017-07-12Merge "Refactor nova migration config into client & target profiles"Jenkins6-146/+271
2017-07-08Merge "Remove reference to bootstack_nodeid"Jenkins2-4/+4
2017-07-06Merge "Add Swift dispersion profile"Jenkins1-0/+33
2017-07-06Remove reference to bootstack_nodeidSteven Hardy2-4/+4
This has been replaced with bootstrap_nodeid which isn't hard-coded to the Controller role and thus will work should this service be deployed on any other role via composable services. Change-Id: I0a9fced847caf344e5d26b452f1bd40afab8f029
2017-07-03Update puppet-tripleo libvirt to support docker deploymentsKeith Schincke1-5/+1
It is not necessary to mangle libvirt_rbd_secret_key parameter as this is now given by the templates. Depends-On: Iff3dbcb0f1b4d2373570e184e636a71553cea708 Change-Id: I6b163ab102f505f0d0ce9eb1ad9d4274e4ff6348
2017-07-03Refactor nova migration config into client & target profilesOliver Walsh6-146/+271
The nova migration config has always been applied by the base::nova profile. It assumed that libvirtd/nova-compute and are all running on the same host. Where this config didn't apply (e.g a nova api host) it was disabled by a flag. This approach is not compatible with containers. Hieradata for all containers are combined so per-host flags no longer work, and we can no longer assume libvirtd and nova-compute run in the same context. This change refactors the profiles out of the base nova profile and into a client profile and a target profile that can be included where appropriate. Change-Id: I063a84a8e6da64ae3b09125cfa42e48df69adc12 Implements: blueprint tripleo-cold-migration
2017-06-29Zaqar: support configurable backendsDan Prince1-12/+39
This patch updates the Zaqar profile so that we have support for configuring alternate versions of the messaging and management backends. In Pike instack-undercloud started using the swift/sqlalchemy backends and the intent here is to update the new containers undercloud to use a similar default (thus letting us drop Mongodb). Change-Id: Ie6a56b9163950cee2c0341afa0c0ddce665f3704
2017-06-28Merge "Split docker options and insecure registry"Jenkins1-6/+18
2017-06-27Split docker options and insecure registryBogdan Dobrelya1-6/+18
Use augeas to modify only parameters' dedicated configuration. Split options from insecure registry. Overlapping those params may unschedule the docker service restarts for some cases, ending up with a split brain state for the docker service run-time config vs changed /etc/sysconfig/options config. Change-Id: Ic5640061837b022f7175f0db0dc269f9a61e6023 Signed-off-by: Bogdan Dobrelya <bdobreli@redhat.com>
2017-06-27Always start httpd at the same time (TLS proxy)Juan Antonio Osorio Robles2-7/+21
For the TLS everywhere job, there are some apache vhosts set up that serve as TLS proxies. These need to be started at the same time as the rest of the apache vhosts too. Change-Id: I15e67c7c04142cff01704e2590d3b2a6a949cc06
2017-06-27Always start httpd at the same timeJuan Antonio Osorio Robles9-16/+88
Puppet wipes out whatever is not in it's resource catalog each run for httpd. This causes httpd to restart if in the next step there are reasources added that were not there earlier. This patch, thus changes the instances of httpd to start at the same time: On step 3 for the bootstrap node, and on step 4 for every other node. Closes-Bug: #1699502 Change-Id: I3d29728c1ab7bd5b78100f89e00e5fa082f97b0c Co-Authored-By: Alex Schultz <aschultz@redhat.com>
2017-06-27Merge "MySQL: configure ::zaqar::db::mysql selectively"Jenkins1-0/+4
2017-06-26MySQL: configure ::zaqar::db::mysql selectivelyDan Prince1-0/+4
Adds the ability to create an empty MySQL database for Zaqar if zaqar is enabled and settings for the mysql backend are also available in hiera. This should allow Zaqar's database to get created when needed, but skipped if MongoDB is used instead (per overcloud defaults). Change-Id: I3598e39c0a3cdf80b96e728d9aa8a7e6505e0690
2017-06-26Force MySQL users to use SSL if internal TLS is enabledJuan Antonio Osorio Robles1-0/+3
This forces the MySQL users to use SSL when connecting to MySQL. bp tls-via-certmonger Depends-On: I24e4c195a31109835739e78a6b53d36f661f9fd0 Change-Id: I98856955132b680a159144204da1d5b400fe9794
2017-06-23Add Swift dispersion profileChristian Schwede1-0/+33
The swift-dispersion-populate command needs to be called when Swift and Keystone are up and running, and therefore we need to ensure this is running in step 5 or later. Change-Id: I5b4c08c252b6083dace5a65367920c475de416ce
2017-06-23Merge "Remove manifest/profile/baseui.pp"Jenkins1-22/+0
2017-06-23Merge "Make collectd to log also to file"Jenkins1-0/+9
2017-06-22Merge "Deploy ironic-api with WSGI"Jenkins1-3/+55
2017-06-21Merge "Adds OpenDaylight resources for configuring cluster with docker"Jenkins2-0/+88
2017-06-21Make collectd to log also to fileMartin Mágr1-0/+9
This change will make possible to set collectd to log to file (/var/log/collectd.log by default). Change-Id: I50289ad6657852d37abbf12938128ff9ab9e3bac
2017-06-21Deploy ironic-api with WSGIDmitry Tantsur1-3/+55
Change-Id: I952c86db88dcd611722a3feaea88f618eee17620
2017-06-20Ignore failures when loading nf_conntrack_proto_sctp kernel moduleOr Idgar1-5/+23
Ignore failures if nf_conntrack_proto_sctp module failed to load. Since RHEL 7.4, nf_conntrack_proto_sctp module is compiled into the kernel instead of as a module as the sctp support. TripleO will still try to load the module to support RHEL 7.3, but in the future will remove the module management and rely on the kernel provided in newer versions of RHEL. Co-Authored-By: Or Idgar <oidgar@redhat.com> Co-Authored-By: Alex Schultz <aschultz@redhat.com> Co-Authored-By: Emilien Macchi <emilien@redhat.com> Change-Id: I8f1c841a7c0f3b1247aba2b959b6dfbe43d8cd79 Closes-Bug: 1695885
2017-06-20Merge "Require the UI package when creating the virtual host"Jenkins1-4/+0
2017-06-19Remove manifest/profile/baseui.ppCarlos Camacho1-22/+0
This file is not needed anymore. Change-Id: I904443624c18cc5116bc6027c016b9ccdd5e10aa Closes-bug: 1698105 Depends-On: Ie20ecabea91ca4c2040c5ef3bf6c71b2b53d26ef
2017-06-19Require the UI package when creating the virtual hostCarlos Camacho1-4/+0
Quickstart is failing with this error: Error: Cannot create /var/www/openstack-tripleo-ui/dist; parent directory /var/www/openstack-tripleo-ui does not exist Error: /Stage[main]/Tripleo::Ui/Apache::Vhost[tripleo-ui]/File[/var/www/openstack-tripleo-ui/dist] ensure: change from absent to directory failed: Cannot create /var/www/openstack-tripleo-ui/dist; parent directory /var/www/openstack-tripleo-ui does not exist Puppet cant create the folders tree by itself. Closes-bug: 1698105 Change-Id: I5cce963a6225552f4b7253cb34edc72b392b9dda
2017-06-19Merge "Addition of Nuage as mechanism driver for ML2"Jenkins2-0/+35
2017-06-16Merge "Ensure hiera step value is an integer"Jenkins151-152/+152
2017-06-16Merge "Only set the stonith property on the pacemaker_master node"Jenkins2-10/+5
2017-06-15Fix redis when hostname has capital lettersAlex Schultz1-1/+1
The bootstrap_nodeid comparison should be case insensitive. Change-Id: I1e6672bb0219c1cf56ab21dd911c6f33e2436cc3 Closes-Bug: #1698190
2017-06-15Move gnocchi upgrade and api to step 4Pradeep Kilambi1-12/+12
gnocchi upgrade requires storage sacks to be initialized. This means we need to ensure the storage backends are up before running the upgrade and starting the api. Lets move the api to step 4 so we can ensure other dependencies are in place. Co-Authored-By: Juan Antonio Osorio Robles <jaosorior@redhat.com> Depends-On: Ibfa9fb39f60c1e4a802d189b32ff4c34476c93d3 Change-Id: If2ae48b21389e76fd638c0b48c148a5d4f227630
2017-06-14Addition of Nuage as mechanism driver for ML2lokesh-jain2-0/+35
Adding Nuage as mechanism driver where ML2 is the neutron core plugin. ML2 base profile includes Nuage when mechanism driver is Nuage. Added Nuage neutron ML2 profile for tripleo. Change-Id: Ib56a7ad8f43fc6274eebc83bd2a62e68c030599d
2017-06-14Only set the stonith property on the pacemaker_master nodeMichele Baldessari2-10/+5
It makes little sense to enforce the stonith property on remote nodes and/or all cluster nodes. We can just enforce it once on the pacemaker_master node as it is a cluster-wide property anyway. We can also remove the tripleo::fencing -> pacemaker::stonith constraint in the pacemaker remote profile now as the fencing stuff happens on step 5 anyway and the property is set at step 1. While this works in general it creates extra CIB changes for nothing and slows down the deployment. Change-Id: Ifef08033043a4cc90a6261e962d2fdecdf275650 Closes-Bug: #1696336
2017-06-14Ensure hiera step value is an integerSteve Baker151-152/+152
The step is typically set with the hieradata setting an integer value: {"step": 1} However it would be useful for the value to be a string so that substitutions are possible, for example: {"step": "%{::step}"} This change ensures the step parameter defaults to an integer by calling Integer(hiera('step')) This change was made by manually removing the undef defaults from fluentd.pp, uchiwa.pp, and sensu.pp then bulk updating with: find ./ -type f -print0 |xargs -0 sed -i "s/= hiera('step')/= Integer(hiera('step'))/" Change-Id: I8a47ca53a7dea8391103abcb8960a97036a6f5b3
2017-06-14Merge "Fix Swift ring management in container deployments"Jenkins1-7/+25
2017-06-14Merge "Remove unnecessary references to neutron core plugin hiera"Jenkins1-11/+3
2017-06-13Merge "Fix Swift ring rebalance order"Jenkins1-2/+2
2017-06-09Configure credentials for ironic to access cinderDmitry Tantsur1-0/+1
Change-Id: I097c494d3953b7d26d94aecc546ddef5225d1125 Depends-On: I2f0eb779b711e57f1532b1227896542d0ecffc89
2017-06-09Fix Swift ring rebalance orderChristian Schwede1-2/+2
The current order is broken if there were changes to the account and container devices, but not to the object devices. In these cases it can happen that the rebalance happens before modifying devices. Change-Id: I15641c32266939c9a00936cc471cc59b1bb54eec
2017-06-09Merge "Use CRL for HAProxy"Jenkins1-0/+10
2017-06-08Use CRL for HAProxyJuan Antonio Osorio Robles1-0/+10
This sets up the CRL file to be triggered on the certmonger_user resource. Furtherly, HAProxy uses this CRL file in the member options, thus effectively enabling revocation for proxied nodes. So, if a certificate has been revoked by the CA, HAProxy will not proxy requests to it. bp tls-via-certmonger Change-Id: I4f1edc551488aa5bf6033442c4fa1fb0d3f735cd
2017-06-08Merge "Add polkit rule to allow kolla nova user access to libvirtd socket on ↵Jenkins1-0/+59
docker host"
2017-06-08Merge "Add novajoin profile"Jenkins1-0/+83
2017-06-07Remove unnecessary references to neutron core plugin hieraBrent Eagles1-11/+3
If the tripleo::profile::base::neutron::sriov is included it is expected that the SR-IOV agent should be deployed and configured so references to core plugin configuration is out of place and currently breaks deployment. Change-Id: Ie5d8cd7863c0d042cc6a4e1fc52602d8a03a1935
2017-06-07Fix Swift ring management in container deploymentsChristian Schwede1-7/+25
The ring up- and downloading was never executed if run within a containerized environment. This is due to the fact that this manifest gets executed within step 6(5) only. There is also an ordering issue, which actually tries to create the tarballs before rebalancing. This patch fixes the step conditions and also chains the tarball creation to the rebalance. The check to query rings on all nodes can now be disabled. This is required on containerized environments: the local ring will be modified and rebalanced, but rings on the existing servers are not yet modified. Therefore a recon-check will fail, and needs to be disabled. Closes-Bug: 1694211 Change-Id: I51c5795b9893d797bd73e059910f17a98f04cdbe
2017-06-06Add polkit rule to allow kolla nova user access to libvirtd socket on docker ↵Oliver Walsh1-0/+59
host The polkit rules are currently evaluated in the context of the docker host. As a result the check fails for the kolla nova compute user, as the uids are not consistent with the host uids (in fact we probably can't assume a nova user exists on the docker host). As a short-term workaround a 'docker_nova' user group is created on the docker host and the polkit rule is updated to grant this user access to the libvirtd socket. Longer term solution probably requires running polkitd in a container too. Change-Id: I91be1f1eacf8eed9017bbfef393ee2d66771e8d6 Related-bug: #1693844
2017-06-05Merge "Add Mistral event engine"Jenkins1-0/+46
2017-06-05Add novajoin profileJuan Antonio Osorio Robles1-0/+83
This is needed in order to deploy novajoin in a containerized undercloud environment. Change-Id: Iea461f66b8f4e3b01a0498e566a2c3684144df80
2017-06-02Merge "Add conditional for setting authlogin_nsswitch_use_ldap selboolean"Jenkins1-0/+6
2017-06-01Merge "Composable Role for Neutron LBaaS"Jenkins1-0/+44
2017-06-01Add conditional for setting authlogin_nsswitch_use_ldap selbooleanJacob Liberman1-0/+6
If selinux is enabled the authlogin_nsswitch_use_ldap Boolean must be enabled. This setting allows LDAP communications to the confined LDAP/server port. This change includes a conditional for enabling this Boolean only when selinux is in use. Change-Id: If985f2434d28fcd33198929bf61f2a3a82e601fe Closes-Bug: #1695002