aboutsummaryrefslogtreecommitdiffstats
path: root/spec/classes
AgeCommit message (Collapse)AuthorFilesLines
2017-08-29Enable config for docker daemon debugAlex Schultz1-1/+23
Exposes a way to configure the docker daemon with debug enabled. Change-Id: I654a70c8bb7753679be83d78ca653ed44c3a7395 Related-Bug: #1710533 (cherry picked from commit 44b90c9a79146139cbcbe7f560bd1df667cca780)
2017-08-22Add -s (silent) to curl command for CRL refreshJuan Antonio Osorio Robles1-2/+2
Without it, it doesn't reload the services it should. Change-Id: I43e6188700deb585f905ca700e69b6875f0ded45 Closes-Bug: #1712404
2017-08-19Merge "Support for Dell EMC VMAX ISCSI Cinder Driver"Jenkins1-0/+57
2017-08-19Merge "Allow configuring multiple insecure registries"Jenkins1-0/+13
2017-08-18Merge "Move barbican's database creation to mysql profile"Jenkins1-3/+0
2017-08-17Allow configuring multiple insecure registriesJiri Stransky1-0/+13
If we're using local registries, we may want to use different registries e.g. for Ceph and for OpenStack. We allow multiple registries in general for this purpose, and we should also allow it in the insecure registry configuration. Change-Id: I5cddd20a123a85516577bde1b793a30d43171285 Related-Bug: #1709310
2017-08-17Merge "Add logrotate-crond configuration"Jenkins1-0/+59
2017-08-17Move barbican's database creation to mysql profileJuan Antonio Osorio Robles1-3/+0
This makes sure that the database creation is only executed on the mysql profile (or container if that's enabled), and stops the conflicts and errors that were happening when barbican was deployed in containerized environments. Change-Id: Ib5c99482f62397fc5fb79a9dc537dfb06ee7f4df Closes-Bug: #1710928
2017-08-16Add logrotate-crond configurationBogdan Dobrelya1-0/+59
Generate a cron job and a config for logrotate to be run against containerized services logs. Related-bug: #1700912 Change-Id: Ib9d5d8ca236296179182613e1ff625deea168614 Signed-off-by: Bogdan Dobrelya <bdobreli@redhat.com>
2017-08-14Merge "Fix legacy nova/cinder encryption key manager configuration"Jenkins2-4/+24
2017-08-14Support for Dell EMC VMAX ISCSI Cinder Driverrajinir1-0/+57
This changes adds Dell EMC VMAX ISCSI backend as composable service and matches the tripleo-heat-templates. Change-Id: Ifc169c60994856e382b76b72e020624ca64eef9f Implements: blueprint dellemc-vmax-isci
2017-08-06Update swift-proxy unit tests for puppet5Emilien Macchi1-1/+3
The latest version of puppet now require the class dependencies included in the unit tests. Change-Id: I0b6462f697f2d8012f8a785660c004f3efb13fdc
2017-08-04Merge "Configure dockerd with --iptables=false"Jenkins1-1/+1
2017-08-03Configure dockerd with --iptables=falseDan Prince1-1/+1
This change defaults --iptables=false for dockerd to avoid having Docker create its own FORWARD iptables rules. These rules can interact with normal OS networking rules and disable communications between hosts on reboot. Change-Id: I875fa14f7d810c7f0aba3b3a1b04b60a19470f0f Closes-bug: #1708279
2017-08-02Use normal socket file permissions instead of polkitOliver Walsh2-79/+45
The default (on RHEL/CentOS) is to use polkit but this is only useful for GUI support or for fine grained API access control. As we don't require either we can achieve identical control using plain old unix filesystem permissions. I've merged Sven's changes from https://review.openstack.org/484979 and https://review.openstack.org/487150. As we need to be careful with the libvirtd option quoting I think it's best to do this in puppet-tripleo instead of t-h-t yaml. The option to override the settings from t-h-t remains. Co-Authored-By: Sven Anderson <sven@redhat.com> Reverts I91be1f1eacf8eed9017bbfef393ee2d66771e8d6 Closes-bug: 1696504 Change-Id: I507bdd8e3a461091562177403a2a55fcaf6694d2 Depends-On: I17f6c9b5a6e2120a53bae296042ece492210597a
2017-08-02Merge "Support for Dell EMC Unity Cinder Driver"Jenkins1-0/+57
2017-07-31Enable TLS for the HAProxy stats interfaceJuan Antonio Osorio Robles1-0/+104
This creates a new class for the stats interface and furtherly configures it to also use the certificates that are provided by certmonger (via the internal_certificates_specs variable). Note that the already existing haproxy_stats_certificate still works and will take precedence if it's set. bp tls-via-certmonger Change-Id: Iea65d91648ab13dbe6ec20241a1a7c95ce856e3e
2017-07-30Fix legacy nova/cinder encryption key manager configurationAlan Bishop2-4/+24
Recent changes in Nova [0] and Cinder [1] result in Barbican being selected as the default encryption key manager, even when TripleO is not deploying Barbican. This change ensures the legacy key manager is enabled when no key manager (such as Barbican) has been specified. This restores the previous behavior, where the legacy key manager was enabled by default. [0] https://review.openstack.org/484501 [1] https://review.openstack.org/485322 Closes-Bug: #1706389 Change-Id: Idc92f7a77cde757538eaac51c4ad8dc397f9c3d3
2017-07-28Support for Dell EMC Unity Cinder Driverrajinir1-0/+57
This changes adds Dell EMC Unity backend as composable service and matches the tripleo-heat-templates. Change-Id: I015f7dfec4bedf72332d91b91cda3ef1dc8caf8c
2017-07-27Fix nova and selinux unit testsAlex Schultz3-7/+30
The unit tests jobs are failing because of missing pre conditions for the new shared class introduced by Ib233689fdcdda391596d01a21f77bd8e1672ae04. Additionally this change moved some classes around so that the tests are now failing due to duplicate class declarations for nova::compute::libvirt::services. This change moves the include that pulls in the declaration first prior to the include that exists in tripleo::profile::base::nova::libvirt. The selinux test was also failing due to a type issue with the fact being used (boolean vs string) Change-Id: I5bd4b61d6008820729d58f7743e7e61955dd6f51 Closes-Bug: #1707034
2017-07-24Configure redis as incoming storage driver in gnocchiPradeep Kilambi1-0/+6
puppet support for this is added in Id8d4d091da2611de75390e045ebd473caf2a8909 Change-Id: I3354b54571a1b9d0a9187698217628d273cd7d7e
2017-07-21Deprecates using exec workaround for ODL clusteringTim Rozet1-4/+2
Previously we had used an exec defined in puppet-tripleo to do clustering with OpenDaylight docker containers. The clustering issue is now fixed in puppet-opendaylight by: https://git.opendaylight.org/gerrit/#/c/60491 So removing the custom function and class workaround. Also, 'ha_node_index' is deprecated for configuring clustering with puppet-opendaylight so that is also removed. Depends-On: I21c1eb2eff6d4cb855eff4a1122f55ad625d84cc Change-Id: I7693b692c74071945fdcc08292542e9b458a540b Signed-off-by: Tim Rozet <trozet@redhat.com>
2017-07-18Merge "Create a Mesh of qdrouterd links for messaging high availability"Jenkins1-0/+119
2017-07-18Merge "Allow disabling udev usage by LVM"Jenkins1-0/+53
2017-07-16Create a Mesh of qdrouterd links for messaging high availabilityJohn Eckersberg1-0/+119
For multi-node deployments of the dispatch router, a mesh of inter-router links is created. Note that bi-directional links must not be configured. Example: For nodes A, B, C Node Inter-Router Link A: [] B: [A] C: [A,B] Change-Id: If43beea7a53c1f8f1dff062341c7ea81751c3122
2017-07-15Update resource references for dependenciesEmilien Macchi1-0/+5
The latest version of puppet now reports these as catalog failures so this change removes the unnecessary references and the references should be updated. Closes-Bug: #1702964 Change-Id: Iebc547aa92f9f40e4a633c57d79e6c9cddb5dd28
2017-07-15Merge "Add new profile for the Veritas HyperScale's cinder backend."Jenkins2-8/+87
2017-07-14Add new profile for the Veritas HyperScale's cinder backend.abhishek.kane2-8/+87
Add new hook in the keystone profile for Veritas HyperScale. Add new hook in the rabbitmq profile for Veritas HyperScale. Add new hook in the mysql profile for Veritas HyperScale. Change-Id: I9168bffa5c73a205d1bb84b831b06081c40af549 Depends-On: I316b22f4f7f9f68fe5c46075dc348a70e437fb1d Depends-On: Id188af5e2f7bf628a97a70b8f20bef28e42b372d Signed-off-by: abhishek.kane <abhishek.kane@veritas.com> Signed-off-by: Dnyaneshwar Pawar <dnyaneshwar.pawar@veritas.com>
2017-07-13Merge "Refactor iscsi initiator-name reset into separate profile"Jenkins2-9/+42
2017-07-13Remove dependency on memcached_node_ips_v6Steven Hardy1-1/+2
This is set via all_nodes_config in t-h-t, but it's a special case for this service, so it'll be better if we handle the ipv6 transformation in puppet instead of relying on the service specific list mangling in t-h-t (one aspect of which has been identified as a potential performance problem). Related-Bug: #1684272 Change-Id: Iccb9089db4b382db3adb9340f18f6d2364ca7f58
2017-07-12Merge "Refactor nova migration config into client & target profiles"Jenkins7-423/+529
2017-07-12Merge "Do not fail if PCI device is missing"Jenkins1-2/+2
2017-07-11Refactor iscsi initiator-name reset into separate profileOliver Walsh2-9/+42
This currently assumes nova-compute and iscsid run in the same context which isn't true for a containerized deployment Change-Id: I91f1ce7625c351745dbadd84b565d55598ea5b59
2017-07-03Refactor nova migration config into client & target profilesOliver Walsh7-423/+529
The nova migration config has always been applied by the base::nova profile. It assumed that libvirtd/nova-compute and are all running on the same host. Where this config didn't apply (e.g a nova api host) it was disabled by a flag. This approach is not compatible with containers. Hieradata for all containers are combined so per-host flags no longer work, and we can no longer assume libvirtd and nova-compute run in the same context. This change refactors the profiles out of the base nova profile and into a client profile and a target profile that can be included where appropriate. Change-Id: I063a84a8e6da64ae3b09125cfa42e48df69adc12 Implements: blueprint tripleo-cold-migration
2017-06-29Do not fail if PCI device is missingBrent Eagles1-2/+2
Fixes a problem where SR-IOV VF count configuration will fail if a physical function is in use by a guest when 'puppet apply' is executed. This change substitutes warnings for failures and skips complaints if a PCI device is unavailable. Note: this patch has the side-effect of allowing the same configuration data on hosts that may *not* or *ever* have PCI SR-IOV devices on the hardware. Time will tell how evil this is in practice. Closes-Bug: #1701284 Change-Id: I71edc135432ab2193741c37ce977dd11172401e6
2017-06-28Merge "Split docker options and insecure registry"Jenkins1-6/+3
2017-06-27Allow disabling udev usage by LVMJiri Stransky1-0/+53
Disabling udev usage from LVM seems to be the only observed working way of running containerized cinder-volume with local LVM backend. I didn't come across reports that not using udev would have negative impact on the functionality. Additional info at https://groups.google.com/forum/#!topic/docker-user/n4Xtvsb4RAw Change-Id: I1bf395a6228dba66fa6bf9b8bcc9f3ac3d922a49 Related-Bug: #1700140
2017-06-27Split docker options and insecure registryBogdan Dobrelya1-6/+3
Use augeas to modify only parameters' dedicated configuration. Split options from insecure registry. Overlapping those params may unschedule the docker service restarts for some cases, ending up with a split brain state for the docker service run-time config vs changed /etc/sysconfig/options config. Change-Id: Ic5640061837b022f7175f0db0dc269f9a61e6023 Signed-off-by: Bogdan Dobrelya <bdobreli@redhat.com>
2017-06-27Always start httpd at the same timeJuan Antonio Osorio Robles4-7/+93
Puppet wipes out whatever is not in it's resource catalog each run for httpd. This causes httpd to restart if in the next step there are reasources added that were not there earlier. This patch, thus changes the instances of httpd to start at the same time: On step 3 for the bootstrap node, and on step 4 for every other node. Closes-Bug: #1699502 Change-Id: I3d29728c1ab7bd5b78100f89e00e5fa082f97b0c Co-Authored-By: Alex Schultz <aschultz@redhat.com>
2017-06-21Merge "Ignore failures when loading nf_conntrack_proto_sctp kernel module"Jenkins1-0/+59
2017-06-20Ignore failures when loading nf_conntrack_proto_sctp kernel moduleOr Idgar1-0/+59
Ignore failures if nf_conntrack_proto_sctp module failed to load. Since RHEL 7.4, nf_conntrack_proto_sctp module is compiled into the kernel instead of as a module as the sctp support. TripleO will still try to load the module to support RHEL 7.3, but in the future will remove the module management and rely on the kernel provided in newer versions of RHEL. Co-Authored-By: Or Idgar <oidgar@redhat.com> Co-Authored-By: Alex Schultz <aschultz@redhat.com> Co-Authored-By: Emilien Macchi <emilien@redhat.com> Change-Id: I8f1c841a7c0f3b1247aba2b959b6dfbe43d8cd79 Closes-Bug: 1695885
2017-06-20Add maxconn parameter to MySQL / HAProxyMike Bayer1-0/+115
Allows configurability of maxconn as applies to the MySQL section of the HAProxy config, both for clustercheck and single node. Also adds a new test for the haproxy class overall to exercise options. Change-Id: I023682dd5e85cc78d6dd3e5214a53863acc4f303
2017-06-15Fix redis when hostname has capital lettersAlex Schultz1-0/+106
The bootstrap_nodeid comparison should be case insensitive. Change-Id: I1e6672bb0219c1cf56ab21dd911c6f33e2436cc3 Closes-Bug: #1698190
2017-06-15Move gnocchi upgrade and api to step 4Pradeep Kilambi1-20/+2
gnocchi upgrade requires storage sacks to be initialized. This means we need to ensure the storage backends are up before running the upgrade and starting the api. Lets move the api to step 4 so we can ensure other dependencies are in place. Co-Authored-By: Juan Antonio Osorio Robles <jaosorior@redhat.com> Depends-On: Ibfa9fb39f60c1e4a802d189b32ff4c34476c93d3 Change-Id: If2ae48b21389e76fd638c0b48c148a5d4f227630
2017-06-09Merge "Add resource to fetch CRL"Jenkins1-0/+104
2017-06-08Merge "Move tripleo::certmonger::httpd to defines folder and fix suffix"Jenkins1-63/+0
2017-06-08Add resource to fetch CRLJuan Antonio Osorio Robles1-0/+104
This will fetch the CRL file from the specified file or URL. Furtherly it will set up a cron job to refresh the crl file once a week and notify the needed services. bp tls-via-certmonger Change-Id: I38e163e8ebb80ea5f79cfb8df44a71fdcd284e04
2017-06-08Merge "Add _spec suffix to class spec tests"Jenkins5-0/+0
2017-06-08Merge "Add polkit rule to allow kolla nova user access to libvirtd socket on ↵Jenkins1-0/+79
docker host"
2017-06-08Move tripleo::certmonger::httpd to defines folder and fix suffixJuan Antonio Osorio Robles1-63/+0
It's a define, not a class. And it also needs the _spec suffix. Change-Id: Ie5e0cf81d03379d8b791fd77a5c78d12048ebfef