diff options
103 files changed, 1387 insertions, 1098 deletions
diff --git a/capabilities-map.yaml b/capabilities-map.yaml index 1af6be9e..26100639 100644 --- a/capabilities-map.yaml +++ b/capabilities-map.yaml @@ -316,6 +316,10 @@ topics: title: Cinder Dell EMC Unity backend description: > Enables a Cinder Dell EMC Unity backend, + - file: environments/cinder-dellemc-vmax-iscsi-config.yaml + title: Cinder Dell EMC VMAX ISCSI backend + description: > + Enables a Cinder Dell EMC VMAX ISCSI backend, configured via puppet requires: - overcloud-resource-registry-puppet.yaml @@ -415,6 +419,20 @@ topics: - file: environments/manila-vnx-config.yaml title: Deploys Manila with VNX driver description: Deploys Manila and configures VNX as its default backend. + - title: Manila with VMAX + description: > + Deploys Manila and configures it with the VMAX driver. + environments: + - file: environments/manila-vmax-config.yaml + title: Deploys Manila with VMAX driver + description: Deploys Manila and configures VMAX as its default backend. + - title: Manila with Isilon + description: > + Deploys Manila and configures it with the Isilon driver. + environments: + - file: environments/manila-isilon-config.yaml + title: Deploys Manila with Isilon driver + description: Deploys Manila and configures Isilon as its default backend. requires: - overcloud-resource-registry-puppet.yaml - title: Glance backends diff --git a/ci/environments/multinode-3nodes.yaml b/ci/environments/multinode-3nodes.yaml index e040b015..647b1c65 100644 --- a/ci/environments/multinode-3nodes.yaml +++ b/ci/environments/multinode-3nodes.yaml @@ -24,6 +24,7 @@ - OS::TripleO::Services::CACerts - OS::TripleO::Services::CinderApi - OS::TripleO::Services::CinderScheduler + - OS::TripleO::Services::Clustercheck - OS::TripleO::Services::Docker - OS::TripleO::Services::Kernel - OS::TripleO::Services::Keystone diff --git a/ci/environments/multinode-containers.yaml b/ci/environments/multinode-containers.yaml index 03baf4aa..f050d9a2 100644 --- a/ci/environments/multinode-containers.yaml +++ b/ci/environments/multinode-containers.yaml @@ -25,6 +25,7 @@ parameter_defaults: - OS::TripleO::Services::CinderApi - OS::TripleO::Services::CinderScheduler - OS::TripleO::Services::CinderVolume + - OS::TripleO::Services::Clustercheck - OS::TripleO::Services::Docker - OS::TripleO::Services::Kernel - OS::TripleO::Services::Keystone diff --git a/ci/environments/multinode.yaml b/ci/environments/multinode.yaml index f945a021..eeeefc07 100644 --- a/ci/environments/multinode.yaml +++ b/ci/environments/multinode.yaml @@ -21,6 +21,7 @@ parameter_defaults: - OS::TripleO::Services::CinderApi - OS::TripleO::Services::CinderScheduler - OS::TripleO::Services::CinderVolume + - OS::TripleO::Services::Clustercheck - OS::TripleO::Services::Docker - OS::TripleO::Services::Kernel - OS::TripleO::Services::Keystone diff --git a/ci/environments/multinode_major_upgrade.yaml b/ci/environments/multinode_major_upgrade.yaml index 81301349..78127a4f 100644 --- a/ci/environments/multinode_major_upgrade.yaml +++ b/ci/environments/multinode_major_upgrade.yaml @@ -14,6 +14,7 @@ resource_registry: parameter_defaults: ControllerServices: - OS::TripleO::Services::CACerts + - OS::TripleO::Services::Clustercheck - OS::TripleO::Services::Docker - OS::TripleO::Services::Kernel - OS::TripleO::Services::Keystone diff --git a/ci/environments/scenario001-multinode-containers.yaml b/ci/environments/scenario001-multinode-containers.yaml index 0cdbef13..79d5a280 100644 --- a/ci/environments/scenario001-multinode-containers.yaml +++ b/ci/environments/scenario001-multinode-containers.yaml @@ -12,7 +12,6 @@ resource_registry: OS::TripleO::Services::CephClient: ../../docker/services/ceph-ansible/ceph-client.yaml OS::TripleO::Services::PankoApi: ../../docker/services/panko-api.yaml OS::TripleO::Services::Collectd: ../../docker/services/collectd.yaml - OS::TripleO::Services::Tacker: ../../docker/services/tacker.yaml OS::TripleO::Services::Congress: ../../docker/services/congress.yaml # TODO fluentd is being containerized: https://review.openstack.org/#/c/467072/ OS::TripleO::Services::FluentdClient: ../../puppet/services/logging/fluentd-client.yaml @@ -30,6 +29,7 @@ resource_registry: parameter_defaults: ControllerServices: + - OS::TripleO::Services::Clustercheck - OS::TripleO::Services::Docker - OS::TripleO::Services::Kernel - OS::TripleO::Services::Keystone @@ -86,7 +86,6 @@ parameter_defaults: - OS::TripleO::Services::CinderScheduler - OS::TripleO::Services::CinderVolume - OS::TripleO::Services::Collectd - - OS::TripleO::Services::Tacker - OS::TripleO::Services::Congress - OS::TripleO::Services::TripleoPackages - OS::TripleO::Services::TripleoFirewall @@ -97,6 +96,8 @@ parameter_defaults: ControllerExtraConfig: nova::compute::libvirt::services::libvirt_virt_type: qemu nova::compute::libvirt::libvirt_virt_type: qemu + # This makes the job twice as fast + ceilometer::agent::polling::polling_interval: 15 Debug: true #NOTE(gfidente): not great but we need this to deploy on ext4 #http://docs.ceph.com/docs/jewel/rados/configuration/filesystem-recommendations/ @@ -122,12 +123,14 @@ parameter_defaults: CephAdminKey: 'AQDLOh1VgEp6FRAAFzT7Zw+Y9V6JJExQAsRnRQ==' CephClientKey: 'AQC+vYNXgDAgAhAAc8UoYt+OTz5uhV7ItLdwUw==' CephPoolDefaultSize: 1 + DockerCephDaemonImage: ceph/daemon:tag-build-master-jewel-centos-7 NovaEnableRbdBackend: true CinderEnableRbdBackend: true CinderBackupBackend: ceph GlanceBackend: rbd GnocchiBackend: rbd CinderEnableIscsiBackend: false + GnocchiArchivePolicy: 'high' BannerText: | ****************************************************************** * This system is for the use of authorized users only. Usage of * diff --git a/ci/environments/scenario001-multinode.yaml b/ci/environments/scenario001-multinode.yaml index bab08a30..a9fbdfb7 100644 --- a/ci/environments/scenario001-multinode.yaml +++ b/ci/environments/scenario001-multinode.yaml @@ -27,6 +27,7 @@ resource_registry: parameter_defaults: ControllerServices: + - OS::TripleO::Services::Clustercheck - OS::TripleO::Services::Docker - OS::TripleO::Services::Kernel - OS::TripleO::Services::Keystone @@ -94,6 +95,8 @@ parameter_defaults: ControllerExtraConfig: nova::compute::libvirt::services::libvirt_virt_type: qemu nova::compute::libvirt::libvirt_virt_type: qemu + # This makes the job twice as fast + ceilometer::agent::polling::polling_interval: 15 Debug: true #NOTE(gfidente): not great but we need this to deploy on ext4 #http://docs.ceph.com/docs/jewel/rados/configuration/filesystem-recommendations/ @@ -114,6 +117,7 @@ parameter_defaults: GlanceBackend: rbd GnocchiBackend: rbd CinderEnableIscsiBackend: false + GnocchiArchivePolicy: 'high' BannerText: | ****************************************************************** * This system is for the use of authorized users only. Usage of * diff --git a/ci/environments/scenario002-multinode-containers.yaml b/ci/environments/scenario002-multinode-containers.yaml index 43acf6dc..0ca67d00 100644 --- a/ci/environments/scenario002-multinode-containers.yaml +++ b/ci/environments/scenario002-multinode-containers.yaml @@ -9,6 +9,7 @@ resource_registry: OS::TripleO::Services::BarbicanApi: ../../docker/services/barbican-api.yaml OS::TripleO::Services::Zaqar: ../../docker/services/zaqar.yaml OS::TripleO::Services::Ec2Api: ../../docker/services/ec2-api.yaml + OS::TripleO::Services::MongoDb: ../../docker/services/database/mongodb.yaml # NOTE: This is needed because of upgrades from Ocata to Pike. We # deploy the initial environment with Ocata templates, and # overcloud-resource-registry.yaml there doesn't have this Docker @@ -22,6 +23,7 @@ resource_registry: parameter_defaults: ControllerServices: + - OS::TripleO::Services::Clustercheck - OS::TripleO::Services::Docker - OS::TripleO::Services::Kernel - OS::TripleO::Services::Keystone diff --git a/ci/environments/scenario002-multinode.yaml b/ci/environments/scenario002-multinode.yaml index 5670c213..6c7f4ebb 100644 --- a/ci/environments/scenario002-multinode.yaml +++ b/ci/environments/scenario002-multinode.yaml @@ -22,6 +22,7 @@ resource_registry: parameter_defaults: ControllerServices: + - OS::TripleO::Services::Clustercheck - OS::TripleO::Services::Docker - OS::TripleO::Services::Kernel - OS::TripleO::Services::Keystone diff --git a/ci/environments/scenario003-multinode-containers.yaml b/ci/environments/scenario003-multinode-containers.yaml index e3789ea8..107b66b2 100644 --- a/ci/environments/scenario003-multinode-containers.yaml +++ b/ci/environments/scenario003-multinode-containers.yaml @@ -24,6 +24,7 @@ resource_registry: parameter_defaults: ControllerServices: + - OS::TripleO::Services::Clustercheck - OS::TripleO::Services::Docker - OS::TripleO::Services::Kernel - OS::TripleO::Services::Keystone diff --git a/ci/environments/scenario003-multinode.yaml b/ci/environments/scenario003-multinode.yaml index 5e797b40..968a881b 100644 --- a/ci/environments/scenario003-multinode.yaml +++ b/ci/environments/scenario003-multinode.yaml @@ -20,6 +20,7 @@ resource_registry: parameter_defaults: ControllerServices: + - OS::TripleO::Services::Clustercheck - OS::TripleO::Services::Docker - OS::TripleO::Services::Kernel - OS::TripleO::Services::Keystone diff --git a/ci/environments/scenario004-multinode-containers.yaml b/ci/environments/scenario004-multinode-containers.yaml index 5590de26..e2be75cc 100644 --- a/ci/environments/scenario004-multinode-containers.yaml +++ b/ci/environments/scenario004-multinode-containers.yaml @@ -16,10 +16,8 @@ resource_registry: OS::TripleO::Services::SwiftRingBuilder: OS::Heat::None OS::TripleO::Services::ManilaApi: ../../docker/services/manila-api.yaml OS::TripleO::Services::ManilaScheduler: ../../docker/services/manila-scheduler.yaml - OS::TripleO::Services::ManilaShare: ../../docker/services/manila-share.yaml + OS::TripleO::Services::ManilaShare: ../../docker/services/pacemaker/manila-share.yaml OS::TripleO::Services::ManilaBackendCephFs: ../../puppet/services/manila-backend-cephfs.yaml - # TODO: containerize NeutronBgpVpnApi - OS::TripleO::Services::NeutronBgpVpnApi: ../../puppet/services/neutron-bgpvpn-api.yaml # NOTE: This is needed because of upgrades from Ocata to Pike. We # deploy the initial environment with Ocata templates, and # overcloud-resource-registry.yaml there doesn't have this Docker @@ -38,6 +36,7 @@ parameter_defaults: - OS::TripleO::Services::CephMon - OS::TripleO::Services::CephOSD - OS::TripleO::Services::CephRgw + - OS::TripleO::Services::Clustercheck - OS::TripleO::Services::Docker - OS::TripleO::Services::Kernel - OS::TripleO::Services::Keystone @@ -48,7 +47,6 @@ parameter_defaults: - OS::TripleO::Services::HeatEngine - OS::TripleO::Services::MySQL - OS::TripleO::Services::MySQLClient - - OS::TripleO::Services::NeutronBgpVpnApi - OS::TripleO::Services::NeutronDhcpAgent - OS::TripleO::Services::NeutronL3Agent - OS::TripleO::Services::NeutronMetadataAgent @@ -79,6 +77,9 @@ parameter_defaults: - OS::TripleO::Services::TripleoFirewall - OS::TripleO::Services::Sshd - OS::TripleO::Services::Iscsid + # TODO: in Queens, re-add bgp-vpn and l2gw services when + # containerized. + # https://bugs.launchpad.net/bugs/1713612 ControllerExtraConfig: nova::compute::libvirt::services::libvirt_virt_type: qemu nova::compute::libvirt::libvirt_virt_type: qemu @@ -97,6 +98,4 @@ parameter_defaults: CephClientKey: 'AQC+vYNXgDAgAhAAc8UoYt+OTz5uhV7ItLdwUw==' CephPoolDefaultSize: 1 SwiftCeilometerPipelineEnabled: false - NeutronServicePlugins: 'router, networking_bgpvpn.neutron.services.plugin.BGPVPNPlugin' - BgpvpnServiceProvider: 'BGPVPN:Dummy:networking_bgpvpn.neutron.services.service_drivers.driver_api.BGPVPNDriver:default' NotificationDriver: 'noop' diff --git a/ci/environments/scenario004-multinode.yaml b/ci/environments/scenario004-multinode.yaml index bd30347a..a81f05e1 100644 --- a/ci/environments/scenario004-multinode.yaml +++ b/ci/environments/scenario004-multinode.yaml @@ -36,6 +36,7 @@ parameter_defaults: - OS::TripleO::Services::CephMon - OS::TripleO::Services::CephOSD - OS::TripleO::Services::CephRgw + - OS::TripleO::Services::Clustercheck - OS::TripleO::Services::Docker - OS::TripleO::Services::Kernel - OS::TripleO::Services::Keystone diff --git a/ci/environments/scenario006-multinode-containers.yaml b/ci/environments/scenario006-multinode-containers.yaml index 4715e339..d0a952d5 100644 --- a/ci/environments/scenario006-multinode-containers.yaml +++ b/ci/environments/scenario006-multinode-containers.yaml @@ -9,6 +9,7 @@ resource_registry: parameter_defaults: ControllerServices: + - OS::TripleO::Services::Clustercheck - OS::TripleO::Services::Docker - OS::TripleO::Services::Kernel - OS::TripleO::Services::Keystone diff --git a/ci/environments/scenario007-multinode-containers.yaml b/ci/environments/scenario007-multinode-containers.yaml index 8e1e6b6c..faf56ba4 100644 --- a/ci/environments/scenario007-multinode-containers.yaml +++ b/ci/environments/scenario007-multinode-containers.yaml @@ -15,6 +15,7 @@ resource_registry: OS::TripleO::Services::NovaMigrationTarget: OS::Heat::None parameter_defaults: ControllerServices: + - OS::TripleO::Services::Clustercheck - OS::TripleO::Services::Docker - OS::TripleO::Services::Kernel - OS::TripleO::Services::Keystone diff --git a/ci/environments/scenario007-multinode.yaml b/ci/environments/scenario007-multinode.yaml index dd73f476..69a63d8e 100644 --- a/ci/environments/scenario007-multinode.yaml +++ b/ci/environments/scenario007-multinode.yaml @@ -22,6 +22,7 @@ resource_registry: parameter_defaults: ControllerServices: + - OS::TripleO::Services::Clustercheck - OS::TripleO::Services::Docker - OS::TripleO::Services::Kernel - OS::TripleO::Services::Keystone diff --git a/common/deploy-steps-tasks.yaml b/common/deploy-steps-tasks.yaml index f0729425..73d3036c 100644 --- a/common/deploy-steps-tasks.yaml +++ b/common/deploy-steps-tasks.yaml @@ -5,7 +5,7 @@ # Per step puppet configuration of the baremetal host ##################################################### - name: Write the config_step hieradata - copy: content="{{dict(step=step|int)|to_json}}" dest=/etc/puppet/hieradata/config_step.json force=true + copy: content="{{dict(step=step|int)|to_json}}" dest=/etc/puppet/hieradata/config_step.json force=true mode=0600 - name: Run puppet host configuration for step {{step}} command: >- puppet apply diff --git a/common/deploy-steps.j2 b/common/deploy-steps.j2 index 32d1afcf..1119fb60 100644 --- a/common/deploy-steps.j2 +++ b/common/deploy-steps.j2 @@ -182,54 +182,52 @@ resources: puppet_step_config: {get_param: [role_data, {{role.name}}, step_config]} tasks: # Join host_prep_tasks with the other per-host configuration - yaql: - expression: $.data.host_prep_tasks + $.data.template_tasks - data: - host_prep_tasks: {get_param: [role_data, {{role.name}}, host_prep_tasks]} - template_tasks: + list_concat: + - {get_param: [role_data, {{role.name}}, host_prep_tasks]} + - {%- raw %} - # Write the manifest for baremetal puppet configuration - - name: Create /var/lib/tripleo-config directory - file: path=/var/lib/tripleo-config state=directory - - name: Write the puppet step_config manifest - copy: content="{{puppet_step_config}}" dest=/var/lib/tripleo-config/puppet_step_config.pp force=yes - # this creates a JSON config file for our docker-puppet.py script - - name: Create /var/lib/docker-puppet - file: path=/var/lib/docker-puppet state=directory - - name: Write docker-puppet-tasks json files - copy: content="{{puppet_config | to_json}}" dest=/var/lib/docker-puppet/docker-puppet.json force=yes - # FIXME: can we move docker-puppet somewhere so it's installed via a package? - - name: Write docker-puppet.py - copy: content="{{docker_puppet_script}}" dest=/var/lib/docker-puppet/docker-puppet.py force=yes - # Here we are dumping all the docker container startup configuration data - # so that we can have access to how they are started outside of heat - # and docker-cmd. This lets us create command line tools to test containers. - # FIXME do we need the docker-container-startup-configs.json or is the new per-step - # data consumed by paunch enough? - - name: Write docker-container-startup-configs - copy: content="{{docker_startup_configs | to_json}}" dest=/var/lib/docker-container-startup-configs.json force=yes - - name: Write per-step docker-container-startup-configs - copy: content="{{item.value|to_json}}" dest="/var/lib/tripleo-config/docker-container-startup-config-{{item.key}}.json" force=yes - with_dict: "{{docker_startup_configs}}" - - name: Create /var/lib/kolla/config_files directory - file: path=/var/lib/kolla/config_files state=directory - - name: Write kolla config json files - copy: content="{{item.value|to_json}}" dest="{{item.key}}" force=yes - with_dict: "{{kolla_config}}" - ######################################################## - # Bootstrap tasks, only performed on bootstrap_server_id - ######################################################## - - name: Clean /var/lib/docker-puppet/docker-puppet-tasks*.json files - file: - path: "{{item}}" - state: absent - with_fileglob: - - /var/lib/docker-puppet/docker-puppet-tasks*.json - when: deploy_server_id == bootstrap_server_id - - name: Write docker-puppet-tasks json files - copy: content="{{item.value|to_json}}" dest=/var/lib/docker-puppet/docker-puppet-tasks{{item.key.replace("step_", "")}}.json force=yes - with_dict: "{{docker_puppet_tasks}}" - when: deploy_server_id == bootstrap_server_id + # Write the manifest for baremetal puppet configuration + - name: Create /var/lib/tripleo-config directory + file: path=/var/lib/tripleo-config state=directory + - name: Write the puppet step_config manifest + copy: content="{{puppet_step_config}}" dest=/var/lib/tripleo-config/puppet_step_config.pp force=yes mode=0600 + # this creates a JSON config file for our docker-puppet.py script + - name: Create /var/lib/docker-puppet + file: path=/var/lib/docker-puppet state=directory + - name: Write docker-puppet-tasks json files + copy: content="{{puppet_config | to_json}}" dest=/var/lib/docker-puppet/docker-puppet.json force=yes mode=0600 + # FIXME: can we move docker-puppet somewhere so it's installed via a package? + - name: Write docker-puppet.py + copy: content="{{docker_puppet_script}}" dest=/var/lib/docker-puppet/docker-puppet.py force=yes mode=0600 + # Here we are dumping all the docker container startup configuration data + # so that we can have access to how they are started outside of heat + # and docker-cmd. This lets us create command line tools to test containers. + # FIXME do we need the docker-container-startup-configs.json or is the new per-step + # data consumed by paunch enough? + - name: Write docker-container-startup-configs + copy: content="{{docker_startup_configs | to_json}}" dest=/var/lib/docker-container-startup-configs.json force=yes mode=0600 + - name: Write per-step docker-container-startup-configs + copy: content="{{item.value|to_json}}" dest="/var/lib/tripleo-config/docker-container-startup-config-{{item.key}}.json" force=yes mode=0600 + with_dict: "{{docker_startup_configs}}" + - name: Create /var/lib/kolla/config_files directory + file: path=/var/lib/kolla/config_files state=directory + - name: Write kolla config json files + copy: content="{{item.value|to_json}}" dest="{{item.key}}" force=yes mode=0600 + with_dict: "{{kolla_config}}" + ######################################################## + # Bootstrap tasks, only performed on bootstrap_server_id + ######################################################## + - name: Clean /var/lib/docker-puppet/docker-puppet-tasks*.json files + file: + path: "{{item}}" + state: absent + with_fileglob: + - /var/lib/docker-puppet/docker-puppet-tasks*.json + when: deploy_server_id == bootstrap_server_id + - name: Write docker-puppet-tasks json files + copy: content="{{item.value|to_json}}" dest=/var/lib/docker-puppet/docker-puppet-tasks{{item.key.replace("step_", "")}}.json force=yes mode=0600 + with_dict: "{{docker_puppet_tasks}}" + when: deploy_server_id == bootstrap_server_id {%- endraw %} {{role.name}}HostPrepDeployment: diff --git a/common/major_upgrade_steps.j2.yaml b/common/major_upgrade_steps.j2.yaml index 11113eec..7fc91153 100644 --- a/common/major_upgrade_steps.j2.yaml +++ b/common/major_upgrade_steps.j2.yaml @@ -54,7 +54,6 @@ resources: params: ROLE_NAME: {{role.name}} - get_file: ../extraconfig/tasks/pacemaker_common_functions.sh - - get_file: ../extraconfig/tasks/run_puppet.sh - get_file: ../extraconfig/tasks/tripleo_upgrade_node.sh {{role.name}}DeliverUpgradeScriptDeployment: @@ -129,32 +128,6 @@ resources: {%- endfor %} {%- endfor %} -# Dump the puppet manifests to be apply later when disable_upgrade_deployment -# is to true -{% for role in roles if role.disable_upgrade_deployment|default(false) %} - {{role.name}}DeliverPuppetConfig: - type: OS::Heat::SoftwareConfig - properties: - group: script - config: - list_join: - - '' - - - str_replace: - template: | - #!/bin/bash - cat > /root/{{role.name}}_puppet_config.pp << ENDOFCAT - PUPPET_CLASSES - ENDOFCAT - params: - PUPPET_CLASSES: {get_param: [role_data, {{role.name}}, step_config]} - - {{role.name}}DeliverPuppetDeployment: - type: OS::Heat::SoftwareDeploymentGroup - properties: - servers: {get_param: [servers, {{role.name}}]} - config: {get_resource: {{role.name}}DeliverPuppetConfig} -{% endfor %} - # Upgrade Steps for all roles {%- for step in range(0, upgrade_steps_max) %} # Config resources for step {{step}} diff --git a/deployed-server/deployed-server-roles-data.yaml b/deployed-server/deployed-server-roles-data.yaml index d4bc1df1..7623eda6 100644 --- a/deployed-server/deployed-server-roles-data.yaml +++ b/deployed-server/deployed-server-roles-data.yaml @@ -82,10 +82,12 @@ - OS::TripleO::Services::ManilaApi - OS::TripleO::Services::ManilaScheduler - OS::TripleO::Services::ManilaBackendGeneric + - OS::TripleO::Services::ManilaBackendIsilon - OS::TripleO::Services::ManilaBackendNetapp - OS::TripleO::Services::ManilaBackendUnity - OS::TripleO::Services::ManilaBackendCephFs - OS::TripleO::Services::ManilaBackendVNX + - OS::TripleO::Services::ManilaBackendVMAX - OS::TripleO::Services::ManilaShare - OS::TripleO::Services::AodhApi - OS::TripleO::Services::AodhEvaluator diff --git a/docker/docker-puppet.py b/docker/docker-puppet.py index 4659cf53..0451ed51 100755 --- a/docker/docker-puppet.py +++ b/docker/docker-puppet.py @@ -257,7 +257,7 @@ def mp_puppet_config((config_volume, puppet_tags, manifest, config_image, volume '--volume', '%s:/etc/config.pp:ro' % tmp_man.name, '--volume', '/etc/puppet/:/tmp/puppet-etc/:ro', '--volume', '/usr/share/openstack-puppet/modules/:/usr/share/openstack-puppet/modules/:ro', - '--volume', '/var/lib/config-data/:/var/lib/config-data/:rw', + '--volume', '%s:/var/lib/config-data/:rw' % os.environ.get('CONFIG_VOLUME_PREFIX', '/var/lib/config-data'), '--volume', 'tripleo_logs:/var/log/tripleo/', # Syslog socket for puppet logs '--volume', '/dev/log:/dev/log', @@ -366,6 +366,7 @@ for infile in infiles: outfile = os.path.join(os.path.dirname(infile), "hashed-" + os.path.basename(infile)) with open(outfile, 'w') as out_f: + os.chmod(out_f.name, 0600) json.dump(infile_data, out_f) if not success: diff --git a/docker/services/ceph-ansible/ceph-base.yaml b/docker/services/ceph-ansible/ceph-base.yaml index bf2c86c4..18d3e6a3 100644 --- a/docker/services/ceph-ansible/ceph-base.yaml +++ b/docker/services/ceph-ansible/ceph-base.yaml @@ -100,6 +100,14 @@ parameters: CephClientUserName: default: openstack type: string + CephRgwClientName: + default: radosgw + type: string + CephRgwKey: + description: The cephx key for the radosgw client. Can be created + with ceph-authtool --gen-print-key. + type: string + hidden: true CephPoolDefaultSize: description: default minimum replication for RBD copies type: number @@ -115,10 +123,13 @@ parameters: CephIPv6: default: False type: boolean + SwiftPassword: + description: The password for the swift service account + type: string + hidden: true DockerCephDaemonImage: description: image type: string - default: 'ceph/daemon:tag-build-master-jewel-centos-7' conditions: custom_registry_host: @@ -241,16 +252,33 @@ outputs: - - client - {get_param: ManilaCephFSNativeCephFSAuthId} key: {get_param: CephManilaClientKey} - mon_cap: "allow r, allow command auth del, allow command auth caps, allow command auth get, allow command auth get-or-create" + mon_cap: 'allow r, allow command \\\"auth del\\\", allow command \\\"auth caps\\\", allow command \\\"auth get\\\", allow command \\\"auth get-or-create\\\"' mds_cap: "allow *" osd_cap: "allow rw" mode: "0644" + - name: + list_join: + - '.' + - - client + - {get_param: CephRgwClientName} + key: {get_param: CephRgwKey} + mon_cap: "allow rw" + osd_cap: "allow rwx" + mode: "0644" keys: *openstack_keys pools: [] ceph_conf_overrides: global: osd_pool_default_size: {get_param: CephPoolDefaultSize} osd_pool_default_pg_num: {get_param: CephPoolDefaultPgNum} + rgw_keystone_api_version: 3 + rgw_keystone_url: {get_param: [EndpointMap, KeystoneInternal, uri_no_suffix]} + rgw_keystone_accepted_roles: 'Member, _member_, admin' + rgw_keystone_admin_domain: default + rgw_keystone_admin_project: service + rgw_keystone_admin_user: swift + rgw_keystone_admin_password: {get_param: SwiftPassword} + rgw_s3_auth_use_keystone: 'true' ntp_service_enabled: false generate_fsid: false ip_version: diff --git a/docker/services/ceph-ansible/ceph-rgw.yaml b/docker/services/ceph-ansible/ceph-rgw.yaml new file mode 100644 index 00000000..4bed9b46 --- /dev/null +++ b/docker/services/ceph-ansible/ceph-rgw.yaml @@ -0,0 +1,87 @@ +heat_template_version: pike + +description: > + Ceph RadosGW service. + +parameters: + ServiceData: + default: {} + description: Dictionary packing service data + type: json + ServiceNetMap: + default: {} + description: Mapping of service_name -> network name. Typically set + via parameter_defaults in the resource registry. This + mapping overrides those in ServiceNetMapDefaults. + type: json + DefaultPasswords: + default: {} + type: json + RoleName: + default: '' + description: Role name on which the service is applied + type: string + RoleParameters: + default: {} + description: Parameters specific to the role + type: json + EndpointMap: + default: {} + description: Mapping of service endpoint -> protocol. Typically set + via parameter_defaults in the resource registry. + type: json + SwiftPassword: + description: The password for the swift service account + type: string + hidden: true + KeystoneRegion: + type: string + default: 'regionOne' + description: Keystone region for endpoint + +resources: + CephBase: + type: ./ceph-base.yaml + properties: + ServiceData: {get_param: ServiceData} + ServiceNetMap: {get_param: ServiceNetMap} + DefaultPasswords: {get_param: DefaultPasswords} + EndpointMap: {get_param: EndpointMap} + RoleName: {get_param: RoleName} + RoleParameters: {get_param: RoleParameters} + +outputs: + role_data: + description: Role data for the Ceph RadosGW service. + value: + service_name: ceph_rgw + upgrade_tasks: [] + step_config: '' + puppet_config: + config_image: '' + config_volume: '' + step_config: '' + docker_config: {} + service_workflow_tasks: {get_attr: [CephBase, role_data, service_workflow_tasks]} + config_settings: + map_merge: + - tripleo.ceph_rgw.firewall_rules: + '122 ceph rgw': + dport: {get_param: [EndpointMap, CephRgwInternal, port]} + - ceph_rgw_ansible_vars: + map_merge: + - {get_attr: [CephBase, role_data, config_settings, ceph_common_ansible_vars]} + - radosgw_keystone: true + radosgw_keystone_ssl: false + radosgw_address_block: {get_param: [ServiceData, net_cidr_map, {get_param: [ServiceNetMap, CephRgwNetwork]}]} + radosgw_civetweb_port: {get_param: [EndpointMap, CephRgwInternal, port]} + service_config_settings: + keystone: + ceph::rgw::keystone::auth::public_url: {get_param: [EndpointMap, CephRgwPublic, uri]} + ceph::rgw::keystone::auth::internal_url: {get_param: [EndpointMap, CephRgwInternal, uri]} + ceph::rgw::keystone::auth::admin_url: {get_param: [EndpointMap, CephRgwAdmin, uri]} + ceph::rgw::keystone::auth::region: {get_param: KeystoneRegion} + ceph::rgw::keystone::auth::roles: [ 'admin', 'Member', '_member_' ] + ceph::rgw::keystone::auth::tenant: service + ceph::rgw::keystone::auth::user: swift + ceph::rgw::keystone::auth::password: {get_param: SwiftPassword} diff --git a/docker/services/cinder-api.yaml b/docker/services/cinder-api.yaml index 519b2328..93d09ca0 100644 --- a/docker/services/cinder-api.yaml +++ b/docker/services/cinder-api.yaml @@ -163,6 +163,8 @@ outputs: user: root privileged: false restart: always + healthcheck: + test: /bin/true volumes: list_concat: - {get_attr: [ContainersCommon, volumes]} diff --git a/docker/services/database/mongodb.yaml b/docker/services/database/mongodb.yaml index 9b5c5b8f..d6bba20b 100644 --- a/docker/services/database/mongodb.yaml +++ b/docker/services/database/mongodb.yaml @@ -157,6 +157,10 @@ outputs: metadata_settings: get_attr: [MongodbPuppetBase, role_data, metadata_settings] upgrade_tasks: + - name: Check for mongodb service + stat: path=/usr/lib/systemd/system/mongod.service + register: mongod_service - name: Stop and disable mongodb service tags: step2 service: name=mongod state=stopped enabled=no + when: mongod_service.stat.exists diff --git a/docker/services/database/redis.yaml b/docker/services/database/redis.yaml index 980a8c6d..487b4c67 100644 --- a/docker/services/database/redis.yaml +++ b/docker/services/database/redis.yaml @@ -36,9 +36,19 @@ parameters: default: {} description: Parameters specific to the role type: json + EnableInternalTLS: + type: boolean + default: false + +conditions: + + internal_tls_enabled: {equals: [{get_param: EnableInternalTLS}, true]} resources: + ContainersCommon: + type: ../containers-common.yaml + RedisBase: type: ../../../puppet/services/database/redis.yaml properties: @@ -56,6 +66,8 @@ outputs: map_merge: - {get_attr: [RedisBase, role_data, config_settings]} - redis::daemonize: false + tripleo::stunnel::manage_service: false + tripleo::stunnel::foreground: 'yes' step_config: &step_config get_attr: [RedisBase, role_data, step_config] service_config_settings: {get_attr: [RedisBase, role_data, service_config_settings]} @@ -80,31 +92,60 @@ outputs: - path: /var/run/redis owner: redis:redis recurse: true + /var/lib/kolla/config_files/redis_tls_proxy.json: + command: stunnel /etc/stunnel/stunnel.conf + config_files: + - source: "/var/lib/kolla/config_files/src/*" + dest: "/" + merge: true + preserve_properties: true docker_config: step_1: - redis_init_logs: - start_order: 0 - detach: false - image: &redis_image {get_param: DockerRedisImage} - privileged: false - user: root - volumes: - - /var/log/containers/redis:/var/log/redis - command: ['/bin/bash', '-c', 'chown -R redis:redis /var/log/redis'] - redis: - start_order: 1 - image: *redis_image - net: host - privileged: false - restart: always - volumes: - - /run:/run - - /var/lib/kolla/config_files/redis.json:/var/lib/kolla/config_files/config.json:ro - - /var/lib/config-data/puppet-generated/redis/:/var/lib/kolla/config_files/src:ro - - /etc/localtime:/etc/localtime:ro - - /var/log/containers/redis:/var/log/redis - environment: - - KOLLA_CONFIG_STRATEGY=COPY_ALWAYS + map_merge: + - redis_init_logs: + start_order: 0 + detach: false + image: &redis_image {get_param: DockerRedisImage} + privileged: false + user: root + volumes: + - /var/log/containers/redis:/var/log/redis + command: ['/bin/bash', '-c', 'chown -R redis:redis /var/log/redis'] + - redis: + start_order: 1 + image: *redis_image + net: host + privileged: false + restart: always + volumes: + - /run:/run + - /var/lib/kolla/config_files/redis.json:/var/lib/kolla/config_files/config.json:ro + - /var/lib/config-data/puppet-generated/redis/:/var/lib/kolla/config_files/src:ro + - /etc/localtime:/etc/localtime:ro + - /var/log/containers/redis:/var/log/redis + environment: + - KOLLA_CONFIG_STRATEGY=COPY_ALWAYS + - if: + - internal_tls_enabled + - redis_tls_proxy: + start_order: 2 + image: *redis_image + net: host + user: root + restart: always + volumes: + list_concat: + - {get_attr: [ContainersCommon, volumes]} + - + - /var/lib/kolla/config_files/redis_tls_proxy.json:/var/lib/kolla/config_files/config.json:ro + - /var/lib/config-data/puppet-generated/redis/:/var/lib/kolla/config_files/src:ro + - /etc/pki/tls/certs/redis.crt:/etc/pki/tls/certs/redis.crt:ro + - /etc/pki/tls/private/redis.key:/etc/pki/tls/private/redis.key:ro + environment: + - KOLLA_CONFIG_STRATEGY=COPY_ALWAYS + - {} + metadata_settings: + get_attr: [RedisBase, role_data, metadata_settings] host_prep_tasks: - name: create persistent directories file: diff --git a/docker/services/heat-api.yaml b/docker/services/heat-api.yaml index 54c7bedd..6c1621f1 100644 --- a/docker/services/heat-api.yaml +++ b/docker/services/heat-api.yaml @@ -136,6 +136,8 @@ outputs: user: root privileged: false restart: always + healthcheck: + test: /bin/true volumes: list_concat: - {get_attr: [ContainersCommon, volumes]} diff --git a/docker/services/iscsid.yaml b/docker/services/iscsid.yaml index 80519800..c34a59d5 100644 --- a/docker/services/iscsid.yaml +++ b/docker/services/iscsid.yaml @@ -109,7 +109,7 @@ outputs: - name: Stop and disable iscsid service tags: step2 service: name=iscsid state=stopped enabled=no - when: stat_iscsid_service.stat.exists + when: (stat_iscsid_service.stat|default('')).exists|default(false) - name: stat /lib/systemd/system/iscsid.socket tags: step2 stat: path=/lib/systemd/system/iscsid.socket @@ -117,4 +117,4 @@ outputs: - name: Stop and disable iscsid.socket service tags: step2 service: name=iscsid.socket state=stopped enabled=no - when: stat_iscsid_socket.stat.exists + when: (stat_iscsid_socket.stat|default('')).exists|default(false) diff --git a/docker/services/keystone.yaml b/docker/services/keystone.yaml index 4c2c1d16..97b4c5d5 100644 --- a/docker/services/keystone.yaml +++ b/docker/services/keystone.yaml @@ -175,6 +175,8 @@ outputs: privileged: false restart: always command: ['/bin/bash', '-c', '/usr/local/bin/kolla_set_configs && /usr/sbin/crond -n'] + healthcheck: + test: /bin/true volumes: list_concat: - {get_attr: [ContainersCommon, volumes]} diff --git a/docker/services/nova-api.yaml b/docker/services/nova-api.yaml index 37c4da5b..7142b70e 100644 --- a/docker/services/nova-api.yaml +++ b/docker/services/nova-api.yaml @@ -196,6 +196,8 @@ outputs: user: root privileged: false restart: always + healthcheck: + test: /bin/true volumes: list_concat: - {get_attr: [ContainersCommon, volumes]} diff --git a/docker/services/nova-compute.yaml b/docker/services/nova-compute.yaml index 39d1740c..bf7841be 100644 --- a/docker/services/nova-compute.yaml +++ b/docker/services/nova-compute.yaml @@ -41,6 +41,10 @@ parameters: description: Port that dockerized nova migration target sshd service binds to. type: number + UpgradeLevelNovaCompute: + type: string + description: Nova Compute upgrade level + default: '' resources: @@ -142,6 +146,13 @@ outputs: path: /etc/ceph state: directory upgrade_tasks: + - name: Set compute upgrade level to auto + tags: step1 + ini_file: + str_replace: + template: "dest=/etc/nova/nova.conf section=upgrade_levels option=compute value=LEVEL" + params: + LEVEL: {get_param: UpgradeLevelNovaCompute} - name: Stop and disable nova-compute service tags: step2 service: name=openstack-nova-compute state=stopped enabled=no diff --git a/docker/services/nova-conductor.yaml b/docker/services/nova-conductor.yaml index ae737056..17d137cc 100644 --- a/docker/services/nova-conductor.yaml +++ b/docker/services/nova-conductor.yaml @@ -36,7 +36,10 @@ parameters: default: {} description: Parameters specific to the role type: json - + UpgradeLevelNovaCompute: + type: string + description: Nova Compute upgrade level + default: '' resources: @@ -108,6 +111,13 @@ outputs: path: /var/log/containers/nova state: directory upgrade_tasks: + - name: Set compute upgrade level to auto + tags: step1 + ini_file: + str_replace: + template: "dest=/etc/nova/nova.conf section=upgrade_levels option=compute value=LEVEL" + params: + LEVEL: {get_param: UpgradeLevelNovaCompute} - name: Stop and disable nova_conductor service tags: step2 service: name=openstack-nova-conductor state=stopped enabled=no diff --git a/docker/services/opendaylight-api.yaml b/docker/services/opendaylight-api.yaml index 6a62f65e..2a6fcfe8 100644 --- a/docker/services/opendaylight-api.yaml +++ b/docker/services/opendaylight-api.yaml @@ -97,10 +97,21 @@ outputs: - - /var/lib/kolla/config_files/opendaylight_api.json:/var/lib/kolla/config_files/config.json:ro - /var/lib/config-data/puppet-generated/opendaylight/:/var/lib/kolla/config_files/src:ro + - /var/log/containers/opendaylight:/opt/opendaylight/data/log + - /var/lib/opendaylight/journal:/opt/opendaylight/journal + - /var/lib/opendaylight/snapshots:/opt/opendaylight/snapshots environment: - KOLLA_CONFIG_STRATEGY=COPY_ALWAYS - + host_prep_tasks: + - name: create persistent directories + file: + path: "{{ item }}" + state: directory + with_items: + - /var/log/containers/opendaylight + - /var/lib/opendaylight/snapshots + - /var/lib/opendaylight/journal upgrade_tasks: - name: Stop and disable opendaylight_api service tags: step2 - service: name=opendaylight state=stopped enabled=no + service: name=opendaylight state=stopped enabled=no
\ No newline at end of file diff --git a/docker/services/pacemaker/database/mysql.yaml b/docker/services/pacemaker/database/mysql.yaml index 3de1696d..f57f779e 100644 --- a/docker/services/pacemaker/database/mysql.yaml +++ b/docker/services/pacemaker/database/mysql.yaml @@ -162,13 +162,13 @@ outputs: # Kolla bootstraps aren't idempotent, explicitly checking if bootstrap was done command: - 'bash' - - '-ec' + - '-ecx' - list_join: - "\n" - - 'if [ -e /var/lib/mysql/mysql ]; then exit 0; fi' - 'kolla_start' - - 'mysqld_safe --skip-networking --wsrep-on=OFF &' + - 'mysqld_safe --skip-networking --wsrep-on=OFF --wsrep-provider=none &' - 'timeout ${DB_MAX_TIMEOUT} /bin/bash -c ''until mysqladmin -uroot -p"${DB_ROOT_PASSWORD}" ping 2>/dev/null; do sleep 1; done''' - 'mysql -uroot -p"${DB_ROOT_PASSWORD}" -e "CREATE USER ''clustercheck''@''localhost'' IDENTIFIED BY ''${DB_CLUSTERCHECK_PASSWORD}'';"' - 'mysql -uroot -p"${DB_ROOT_PASSWORD}" -e "GRANT PROCESS ON *.* TO ''clustercheck''@''localhost'' WITH GRANT OPTION;"' diff --git a/docker/services/pacemaker/haproxy.yaml b/docker/services/pacemaker/haproxy.yaml index 2e5c7424..3cdc5255 100644 --- a/docker/services/pacemaker/haproxy.yaml +++ b/docker/services/pacemaker/haproxy.yaml @@ -88,6 +88,7 @@ outputs: - get_param: InternalTLSCAFile - get_param: HAProxyInternalTLSKeysDirectory - get_param: HAProxyInternalTLSCertsDirectory + - get_param: DeployedSSLCertificatePath tripleo::profile::pacemaker::haproxy_bundle::internal_certs_directory: {get_param: HAProxyInternalTLSCertsDirectory} tripleo::profile::pacemaker::haproxy_bundle::internal_keys_directory: {get_param: HAProxyInternalTLSKeysDirectory} # disable the use CRL file until we can restart the container when the file expires diff --git a/docker/services/swift-ringbuilder.yaml b/docker/services/swift-ringbuilder.yaml index e4e2c7d2..2a44f703 100644 --- a/docker/services/swift-ringbuilder.yaml +++ b/docker/services/swift-ringbuilder.yaml @@ -7,6 +7,10 @@ parameters: DockerSwiftConfigImage: description: The container image to use for the swift config_volume type: string + DockerSwiftRingbuilderConfigImage: + description: Fake parameter to bypass config_volume yaml validation + type: string + default: '' ServiceData: default: {} description: Dictionary packing service data @@ -92,9 +96,22 @@ outputs: service_config_settings: {get_attr: [SwiftRingbuilderBase, role_data, service_config_settings]} # BEGIN DOCKER SETTINGS puppet_config: - config_volume: 'swift' + config_volume: 'swift_ringbuilder' puppet_tags: exec,fetch_swift_ring_tarball,extract_swift_ring_tarball,ring_object_device,swift::ringbuilder::create,tripleo::profile::base::swift::add_devices,swift::ringbuilder::rebalance,create_swift_ring_tarball,upload_swift_ring_tarball step_config: *step_config - config_image: {get_param: DockerSwiftConfigImage} + config_image: &swift_ringbuilder_image {get_param: DockerSwiftConfigImage} kolla_config: {} - docker_config: {} + docker_config: + step_3: + swift_copy_rings: + image: *swift_ringbuilder_image + user: root + detach: false + command: + # Use bash to run the cp command so that wildcards can be used + - '/bin/bash' + - '-c' + - 'cp -v -a -t /etc/swift /swift_ringbuilder/etc/swift/*.gz /swift_ringbuilder/etc/swift/*.builder /swift_ringbuilder/etc/swift/backups' + volumes: + - /var/lib/config-data/puppet-generated/swift/etc/swift:/etc/swift:rw + - /var/lib/config-data/swift_ringbuilder:/swift_ringbuilder:ro diff --git a/docker/services/zaqar.yaml b/docker/services/zaqar.yaml index b6fb4001..34f2e439 100644 --- a/docker/services/zaqar.yaml +++ b/docker/services/zaqar.yaml @@ -130,7 +130,8 @@ outputs: - - /var/lib/config-data/zaqar/etc/zaqar/:/etc/zaqar/:ro - /var/log/containers/zaqar:/var/log/zaqar - command: "/usr/bin/bootstrap_host_exec zaqar su zaqar -s /bin/bash -c 'zaqar-sql-db-manage upgrade head'" + - /var/log/containers/httpd/zaqar:/var/log/httpd + command: "/usr/bin/bootstrap_host_exec zaqar_api su zaqar -s /bin/bash -c 'zaqar-sql-db-manage upgrade head'" - {} - step_4: zaqar: diff --git a/environments/ceph-ansible/ceph-rgw.yaml b/environments/ceph-ansible/ceph-rgw.yaml new file mode 100644 index 00000000..4b09a703 --- /dev/null +++ b/environments/ceph-ansible/ceph-rgw.yaml @@ -0,0 +1,5 @@ +resource_registry: + OS::TripleO::Services::CephRgw: ../../docker/services/ceph-ansible/ceph-rgw.yaml + OS::TripleO::Services::SwiftProxy: OS::Heat::None + OS::TripleO::Services::SwiftStorage: OS::Heat::None + OS::TripleO::Services::SwiftRingBuilder: OS::Heat::None diff --git a/environments/cinder-dellemc-vmax-iscsi-config.yaml b/environments/cinder-dellemc-vmax-iscsi-config.yaml new file mode 100644 index 00000000..3832dada --- /dev/null +++ b/environments/cinder-dellemc-vmax-iscsi-config.yaml @@ -0,0 +1,9 @@ +# A Heat environment file which can be used to enable a +# Cinder Dell EMC VMAX backend, configured via puppet +resource_registry: + OS::TripleO::Services::CinderBackendDellEMCVMAXISCSI: ../puppet/services/cinder-backend-dellemc-vmax-iscsi.yaml + +parameter_defaults: + CinderEnableDellEMCVMAXISCSIBackend: true + CinderDellEMCVMAXISCSIBackendName: 'tripleo_dellemc_vmax_iscsi' + CinderDellEMCVMAXISCSIConfigFile: '' diff --git a/environments/contrail/roles_data_contrail.yaml b/environments/contrail/roles_data_contrail.yaml index 38b70e53..bd697160 100644 --- a/environments/contrail/roles_data_contrail.yaml +++ b/environments/contrail/roles_data_contrail.yaml @@ -87,8 +87,10 @@ - OS::TripleO::Services::ManilaBackendGeneric - OS::TripleO::Services::ManilaBackendNetapp - OS::TripleO::Services::ManilaBackendUnity + - OS::TripleO::Services::ManilaBackendIsilon - OS::TripleO::Services::ManilaBackendCephFs - OS::TripleO::Services::ManilaBackendVNX + - OS::TripleO::Services::ManilaBackendVMAX - OS::TripleO::Services::ManilaShare - OS::TripleO::Services::AodhApi - OS::TripleO::Services::AodhEvaluator diff --git a/environments/docker.yaml b/environments/docker.yaml index dfa30b08..67e8a496 100644 --- a/environments/docker.yaml +++ b/environments/docker.yaml @@ -30,7 +30,6 @@ resource_registry: OS::TripleO::Services::HAproxy: ../docker/services/haproxy.yaml OS::TripleO::Services::MySQL: ../docker/services/database/mysql.yaml OS::TripleO::Services::RabbitMQ: ../docker/services/rabbitmq.yaml - OS::TripleO::Services::MongoDb: ../docker/services/database/mongodb.yaml OS::TripleO::Services::Redis: ../docker/services/database/redis.yaml OS::TripleO::Services::Memcached: ../docker/services/memcached.yaml OS::TripleO::Services::SwiftProxy: ../docker/services/swift-proxy.yaml diff --git a/environments/enable-internal-tls.yaml b/environments/enable-internal-tls.yaml index 2fdecb4f..e85185d6 100644 --- a/environments/enable-internal-tls.yaml +++ b/environments/enable-internal-tls.yaml @@ -1,3 +1,7 @@ +# ******************************************************************************** +# DEPRECATED: Use tripleo-heat-templates/environments/ssl/enable-internal-tls.yaml +# instead. +# ******************************************************************************** # A Heat environment file which can be used to enable a # a TLS for in the internal network via certmonger parameter_defaults: diff --git a/environments/manila-cephfsnative-config-docker.yaml b/environments/manila-cephfsnative-config-docker.yaml new file mode 100644 index 00000000..8c822918 --- /dev/null +++ b/environments/manila-cephfsnative-config-docker.yaml @@ -0,0 +1,20 @@ +# EXPERIMENTAL: The configuration enabled by this environment +# is not considered production-ready. +# +# A Heat environment file which can be used to enable a +# a Manila CephFS Native driver backend. +resource_registry: + OS::TripleO::Services::ManilaApi: ../docker/services/manila-api.yaml + OS::TripleO::Services::ManilaScheduler: ../docker/services/manila-scheduler.yaml + # Only manila-share is pacemaker managed: + OS::TripleO::Services::ManilaShare: ../docker/services/pacemaker/manila-share.yaml + OS::TripleO::Services::ManilaBackendCephFs: ../puppet/services/manila-backend-cephfs.yaml + + +parameter_defaults: + ManilaCephFSNativeBackendName: cephfsnative + ManilaCephFSNativeDriverHandlesShareServers: false + ManilaCephFSNativeCephFSConfPath: '/etc/ceph/ceph.conf' + ManilaCephFSNativeCephFSAuthId: 'manila' + ManilaCephFSNativeCephFSClusterName: 'ceph' + ManilaCephFSNativeCephFSEnableSnapshots: false diff --git a/environments/manila-isilon-config.yaml b/environments/manila-isilon-config.yaml new file mode 100644 index 00000000..809900c8 --- /dev/null +++ b/environments/manila-isilon-config.yaml @@ -0,0 +1,17 @@ +# This environment file enables Manila with the Isilon backend. +resource_registry: + OS::TripleO::Services::ManilaApi: ../puppet/services/manila-api.yaml + OS::TripleO::Services::ManilaScheduler: ../puppet/services/manila-scheduler.yaml + # Only manila-share is pacemaker managed: + OS::TripleO::Services::ManilaShare: ../puppet/services/pacemaker/manila-share.yaml + OS::TripleO::Services::ManilaBackendIsilon: ../puppet/services/manila-backend-isilon.yaml + +parameter_defaults: + ManilaIsilonBackendName: tripleo_isilon + ManilaIsilonDriverHandlesShareServers: true + ManilaIsilonNasLogin: '' + ManilaIsilonNasPassword: '' + ManilaIsilonNasServer: '' + ManilaIsilonNasRootDir: '' + ManilaIsilonNasServerPort: 8080 + ManilaIsilonNasServerSecure: '' diff --git a/environments/manila-netapp-config-docker.yaml b/environments/manila-netapp-config-docker.yaml new file mode 100644 index 00000000..6db6dff4 --- /dev/null +++ b/environments/manila-netapp-config-docker.yaml @@ -0,0 +1,32 @@ +# EXPERIMENTAL: The configuration enabled by this environment +# is not considered production-ready. +# +# This environment file enables Manila with the Netapp backend. +resource_registry: + OS::TripleO::Services::ManilaApi: ../docker/services/manila-api.yaml + OS::TripleO::Services::ManilaScheduler: ../docker/services/manila-scheduler.yaml + # Only manila-share is pacemaker managed: + OS::TripleO::Services::ManilaShare: ../docker/services/pacemaker/manila-share.yaml + OS::TripleO::Services::ManilaBackendNetapp: ../puppet/services/manila-backend-netapp.yaml + +parameter_defaults: + ManilaNetappBackendName: tripleo_netapp + ManilaNetappDriverHandlesShareServers: true + ManilaNetappLogin: '' + ManilaNetappPassword: '' + ManilaNetappServerHostname: '' + ManilaNetappTransportType: 'http' + ManilaNetappStorageFamily: 'ontap_cluster' + ManilaNetappServerPort: 80 + ManilaNetappVolumeNameTemplate: 'share_%(share_id)s' + ManilaNetappVserver: '' + ManilaNetappVserverNameTemplate: 'os_%s' + ManilaNetappLifNameTemplate: 'os_%(net_allocation_id)s' + ManilaNetappAggrNameSearchPattern: '(.*)' + ManilaNetappRootVolumeAggr: '' + ManilaNetappRootVolume: 'root' + ManilaNetappPortNameSearchPattern: '(.*)' + ManilaNetappTraceFlags: '' + ManilaNetappEnabledShareProtocols: 'nfs3, nfs4.0' + ManilaNetappVolumeSnapshotReservePercent: 5 + ManilaNetappSnapmirrorQuiesceTimeout: 3600 diff --git a/environments/manila-vmax-config.yaml b/environments/manila-vmax-config.yaml new file mode 100644 index 00000000..8c9946ca --- /dev/null +++ b/environments/manila-vmax-config.yaml @@ -0,0 +1,19 @@ +# This environment file enables Manila with the VMAX backend. +resource_registry: + OS::TripleO::Services::ManilaApi: ../puppet/services/manila-api.yaml + OS::TripleO::Services::ManilaScheduler: ../puppet/services/manila-scheduler.yaml + # Only manila-share is pacemaker managed: + OS::TripleO::Services::ManilaShare: ../puppet/services/pacemaker/manila-share.yaml + OS::TripleO::Services::ManilaBackendVMAX: ../puppet/services/manila-backend-vmax.yaml + +parameter_defaults: + ManilaVMAXBackendName: tripleo_manila_vmax + ManilaVMAXDriverHandlesShareServers: true + ManilaVMAXNasLogin: '' + ManilaVMAXNasPassword: '' + ManilaVMAXNasServer: '' + ManilaVMAXServerContainer: '' + ManilaVMAXShareDataPools: '' + ManilaVMAXEthernetPorts: '' + + diff --git a/environments/network-environment-v6.yaml b/environments/network-environment-v6.yaml new file mode 100644 index 00000000..1617f897 --- /dev/null +++ b/environments/network-environment-v6.yaml @@ -0,0 +1,60 @@ +#This file is an example of an environment file for defining the isolated +#networks and related parameters. +resource_registry: + # Network Interface templates to use (these files must exist) + OS::TripleO::BlockStorage::Net::SoftwareConfig: + ../network/config/single-nic-vlans/cinder-storage.yaml + OS::TripleO::Compute::Net::SoftwareConfig: + ../network/config/single-nic-vlans/compute.yaml + OS::TripleO::Controller::Net::SoftwareConfig: + ../network/config/single-nic-vlans/controller.yaml + OS::TripleO::ObjectStorage::Net::SoftwareConfig: + ../network/config/single-nic-vlans/swift-storage.yaml + OS::TripleO::CephStorage::Net::SoftwareConfig: + ../network/config/single-nic-vlans/ceph-storage.yaml + +parameter_defaults: + # This section is where deployment-specific configuration is done + # CIDR subnet mask length for provisioning network + ControlPlaneSubnetCidr: '24' + # Gateway router for the provisioning network (or Undercloud IP) + ControlPlaneDefaultRoute: 192.168.24.254 + EC2MetadataIp: 192.168.24.1 # Generally the IP of the Undercloud + # Customize the IP subnets to match the local environment + InternalApiNetCidr: 'fd00:fd00:fd00:2000::/64' + StorageNetCidr: 'fd00:fd00:fd00:3000::/64' + StorageMgmtNetCidr: 'fd00:fd00:fd00:4000::/64' + # Tenant tunneling network is IPv4 until IPv6 is fully supported + TenantNetCidr: 172.16.0.0/24 + ExternalNetCidr: '2001:db8:fd00:1000::/64' + # Customize the VLAN IDs to match the local environment + InternalApiNetworkVlanID: 20 + StorageNetworkVlanID: 30 + StorageMgmtNetworkVlanID: 40 + TenantNetworkVlanID: 50 + ExternalNetworkVlanID: 10 + # Customize the IP ranges on each network to use for static IPs and VIPs + InternalApiAllocationPools: [{'start': 'fd00:fd00:fd00:2000::10', 'end': 'fd00:fd00:fd00:2000:ffff:ffff:ffff:fffe'}] + StorageAllocationPools: [{'start': 'fd00:fd00:fd00:3000::10', 'end': 'fd00:fd00:fd00:3000:ffff:ffff:ffff:fffe'}] + StorageMgmtAllocationPools: [{'start': 'fd00:fd00:fd00:4000::10', 'end': 'fd00:fd00:fd00:4000:ffff:ffff:ffff:fffe'}] + TenantAllocationPools: [{'start': '172.16.0.10', 'end': '172.16.0.200'}] + # Leave room if the external network is also used for floating IPs + ExternalAllocationPools: [{'start': '2001:db8:fd00:1000::10', 'end': '2001:db8:fd00:1000:ffff:ffff:ffff:fffe'}] + # Gateway router for the external network + ExternalInterfaceDefaultRoute: '2001:db8:fd00:1000::1' + # Uncomment if using the Management Network (see network-management-v6.yaml) + # ManagementNetCidr: 'fd00:fd00:fd00:6000::/64' + # ManagementAllocationPools: [{'start': 'fd00:fd00:fd00:6000::10', 'end': 'fd00:fd00:fd00:6000:ffff:ffff:ffff:fffe'}] + # Use either this parameter or ControlPlaneDefaultRoute in the NIC templates + # ManagementInterfaceDefaultRoute: 'fd00:fd00:fd00:6000::1' + # Define the DNS servers (maximum 2) for the overcloud nodes + DnsServers: ["8.8.8.8","8.8.4.4"] + # List of Neutron network types for tenant networks (will be used in order) + NeutronNetworkType: 'vxlan,vlan' + # The tunnel type for the tenant network (vxlan or gre). Set to '' to disable tunneling. + NeutronTunnelTypes: 'vxlan' + # Neutron VLAN ranges per network, for example 'datacentre:1:499,tenant:500:1000': + NeutronNetworkVLANRanges: 'datacentre:1:1000' + # Customize bonding options, e.g. "mode=4 lacp_rate=1 updelay=1000 miimon=100" + # for Linux bonds w/LACP, or "bond_mode=active-backup" for OVS active/backup. + BondInterfaceOvsOptions: "bond_mode=active-backup" diff --git a/environments/neutron-opendaylight-dpdk.yaml b/environments/neutron-opendaylight-dpdk.yaml index d675252d..236b2fb9 100644 --- a/environments/neutron-opendaylight-dpdk.yaml +++ b/environments/neutron-opendaylight-dpdk.yaml @@ -12,6 +12,7 @@ parameter_defaults: NeutronMechanismDrivers: 'opendaylight_v2' NeutronServicePlugins: 'odl-router_v2' NovaSchedulerDefaultFilters: "RamFilter,ComputeFilter,AvailabilityZoneFilter,ComputeCapabilitiesFilter,ImagePropertiesFilter,NUMATopologyFilter" + OpenDaylightSNATMechanism: 'controller' ComputeOvsDpdkParameters: OvsEnableDpdk: True diff --git a/environments/services-docker/neutron-opendaylight.yaml b/environments/services-docker/neutron-opendaylight.yaml index b749cb69..31d5790e 100644 --- a/environments/services-docker/neutron-opendaylight.yaml +++ b/environments/services-docker/neutron-opendaylight.yaml @@ -12,5 +12,3 @@ parameter_defaults: NeutronEnableForceMetadata: true NeutronMechanismDrivers: 'opendaylight_v2' NeutronServicePlugins: 'odl-router_v2,trunk' - DockerNeutronApiImage: 'centos-binary-neutron-server-opendaylight:latest' - DockerNeutronConfigImage: 'centos-binary-neutron-server-opendaylight:latest' diff --git a/environments/ssl/enable-internal-tls.yaml b/environments/ssl/enable-internal-tls.yaml new file mode 100644 index 00000000..287ed19f --- /dev/null +++ b/environments/ssl/enable-internal-tls.yaml @@ -0,0 +1,36 @@ +# ******************************************************************* +# This file was created automatically by the sample environment +# generator. Developers should use `tox -e genconfig` to update it. +# Users are recommended to make changes to a copy of the file instead +# of the original, if any customizations are needed. +# ******************************************************************* +# title: Enable SSL on OpenStack Internal Endpoints +# description: | +# A Heat environment file which can be used to enable TLS for the internal +# network via certmonger +parameter_defaults: + # ****************************************************** + # Static parameters - these are values that must be + # included in the environment but should not be changed. + # ****************************************************** + # + # Type: boolean + EnableInternalTLS: True + + # Rabbit client subscriber parameter to specify an SSL connection to the RabbitMQ host. + # Type: string + RabbitClientUseSSL: True + + # Extra properties or metadata passed to Nova for the created nodes in the overcloud. It's accessible via the Nova metadata API. + # Type: json + ServerMetadata: + ipa_enroll: True + + # ********************* + # End static parameters + # ********************* +resource_registry: + OS::TripleO::ServiceServerMetadataHook: ../extraconfig/nova_metadata/krb-service-principals.yaml + OS::TripleO::Services::CertmongerUser: ../puppet/services/certmonger-user.yaml + OS::TripleO::Services::HAProxyInternalTLS: ../puppet/services/haproxy-internal-tls-certmonger.yaml + OS::TripleO::Services::TLSProxyBase: ../puppet/services/apache.yaml diff --git a/environments/ssl/enable-tls.yaml b/environments/ssl/enable-tls.yaml index c8ed2bd2..e5ef8563 100644 --- a/environments/ssl/enable-tls.yaml +++ b/environments/ssl/enable-tls.yaml @@ -11,7 +11,6 @@ # must also be used. parameter_defaults: # The content of the SSL certificate (without Key) in PEM format. - # Mandatory. This parameter must be set by the user. # Type: string SSLCertificate: | The contents of your certificate go here diff --git a/extraconfig/tasks/tripleo_upgrade_node.sh b/extraconfig/tasks/tripleo_upgrade_node.sh index baf838e4..95de99be 100644 --- a/extraconfig/tasks/tripleo_upgrade_node.sh +++ b/extraconfig/tasks/tripleo_upgrade_node.sh @@ -26,52 +26,8 @@ fi DEBUG="true" SCRIPT_NAME=$(basename $0) $(declare -f log_debug) -$(declare -f manage_systemd_service) -$(declare -f systemctl_swift) -$(declare -f special_case_ovs_upgrade_if_needed) -# pin nova messaging +-1 for the nova-compute service -if [[ -n \$NOVA_COMPUTE ]]; then - crudini --set /etc/nova/nova.conf upgrade_levels compute auto -fi - -special_case_ovs_upgrade_if_needed - -if [[ -n \$SWIFT_STORAGE ]]; then - systemctl_swift stop -fi - -yum -y update - -if [[ -n \$SWIFT_STORAGE ]]; then - systemctl_swift start -fi -# Due to bug#1640177 we need to restart compute agent -if [[ -n \$NOVA_COMPUTE ]]; then - log_debug "Restarting openstack ceilometer agent compute" - systemctl restart openstack-ceilometer-compute - yum install -y openstack-nova-migration - # https://bugs.launchpad.net/tripleo/+bug/1707926 stop&disable libvirtd - log_debug "Stop and disable libvirtd service for upgrade to containers" - systemctl stop libvirtd - systemctl disable libvirtd - log_debug "Stop and disable openstack-nova-compute for upgrade to containers" - systemctl stop openstack-nova-compute - systemctl disable openstack-nova-compute -fi - -# Apply puppet manifest to converge just right after the ${ROLE} upgrade -$(declare -f run_puppet) -for step in 1 2 3 4 5 6; do - log_debug "Running puppet step \$step for ${ROLE}" - if ! run_puppet /root/${ROLE}_puppet_config.pp ${ROLE} \${step}; then - log_debug "Puppet failure at step \${step}" - exit 1 - fi - log_debug "Completed puppet step \$step" -done - -log_debug "TripleO upgrade run completed." +log_debug "$UPGRADE_SCRIPT has completed - moving onto ansible playbooks" ENDOFCAT diff --git a/j2_excludes.yaml b/j2_excludes.yaml index 74fb3bb1..71d3d6e8 100644 --- a/j2_excludes.yaml +++ b/j2_excludes.yaml @@ -5,9 +5,4 @@ # name: # - puppet/cephstorage-role.yaml name: - - network/internal_api_v6.yaml - - network/external_v6.yaml - - network/storage_v6.yaml - - network/storage_mgmt_v6.yaml - - network/tenant_v6.yaml - - network/management_v6.yaml + - None diff --git a/network/external_v6.yaml b/network/external_v6.yaml deleted file mode 100644 index 9d1c3d00..00000000 --- a/network/external_v6.yaml +++ /dev/null @@ -1,76 +0,0 @@ -heat_template_version: pike - -description: > - External network. Public traffic, Neutron l3router for floating IPs/SNAT, etc. - -parameters: - # the defaults here work for static IP assignment (IPAM) only - ExternalNetCidr: - # OpenStack uses the EUI-64 address format, which requires a /64 prefix - default: '2001:db8:fd00:1000::/64' - description: Cidr for the external network. - type: string - ExternalNetValueSpecs: - default: {'provider:physical_network': 'external', 'provider:network_type': 'flat'} - description: Value specs for the external network. - type: json - ExternalNetAdminStateUp: - default: false - description: The admin state of the network. - type: boolean - ExternalNetShared: - default: false - description: Whether this network is shared across all tenants. - type: boolean - ExternalNetName: - default: external - description: The name of the external network. - type: string - ExternalSubnetName: - default: external_subnet - description: The name of the external subnet in Neutron. - type: string - ExternalAllocationPools: - default: [{'start': '2001:db8:fd00:1000::10', 'end': '2001:db8:fd00:1000:ffff:ffff:ffff:fffe'}] - description: Ip allocation pool range for the external network. - type: json - IPv6AddressMode: - default: dhcpv6-stateful - description: Neutron subnet IPv6 address mode - type: string - IPv6RAMode: - default: dhcpv6-stateful - description: Neutron subnet IPv6 router advertisement mode - type: string - ExternalInterfaceDefaultRoute: - default: '2001:db8:fd00:1000::1' - description: default route for the external network - type: string - -resources: - ExternalNetwork: - type: OS::Neutron::Net - properties: - admin_state_up: {get_param: ExternalNetAdminStateUp} - name: {get_param: ExternalNetName} - shared: {get_param: ExternalNetShared} - value_specs: {get_param: ExternalNetValueSpecs} - - ExternalSubnet: - type: OS::Neutron::Subnet - properties: - ip_version: 6 - ipv6_address_mode: {get_param: IPv6AddressMode} - ipv6_ra_mode: {get_param: IPv6RAMode} - cidr: {get_param: ExternalNetCidr} - name: {get_param: ExternalSubnetName} - network: {get_resource: ExternalNetwork} - allocation_pools: {get_param: ExternalAllocationPools} - gateway_ip: {get_param: ExternalInterfaceDefaultRoute} - -outputs: - OS::stack_id: - description: Neutron external network - value: {get_resource: ExternalNetwork} - subnet_cidr: - value: {get_attr: [ExternalSubnet, cidr]} diff --git a/network/internal_api_v6.yaml b/network/internal_api_v6.yaml deleted file mode 100644 index 6a0912e2..00000000 --- a/network/internal_api_v6.yaml +++ /dev/null @@ -1,72 +0,0 @@ -heat_template_version: pike - -description: > - Internal API network. Used for most APIs, Database, RPC. - -parameters: - # the defaults here work for static IP assignment (IPAM) only - InternalApiNetCidr: - # OpenStack uses the EUI-64 address format, which requires a /64 prefix - default: 'fd00:fd00:fd00:2000::/64' - description: Cidr for the internal_api network. - type: string - InternalApiNetValueSpecs: - default: {'provider:physical_network': 'internal_api', 'provider:network_type': 'flat'} - description: Value specs for the internal_api network. - type: json - InternalApiNetAdminStateUp: - default: false - description: The admin state of the network. - type: boolean - InternalApiNetShared: - default: false - description: Whether this network is shared across all tenants. - type: boolean - InternalApiNetName: - default: internal_api - description: The name of the internal_api network. - type: string - InternalApiSubnetName: - default: internal_api_subnet - description: The name of the internal_api subnet in Neutron. - type: string - InternalApiAllocationPools: - default: [{'start': 'fd00:fd00:fd00:2000::10', 'end': 'fd00:fd00:fd00:2000:ffff:ffff:ffff:fffe'}] - description: Ip allocation pool range for the internal_api network. - type: json - IPv6AddressMode: - default: dhcpv6-stateful - description: Neutron subnet IPv6 address mode - type: string - IPv6RAMode: - default: dhcpv6-stateful - description: Neutron subnet IPv6 router advertisement mode - type: string - -resources: - InternalApiNetwork: - type: OS::Neutron::Net - properties: - admin_state_up: {get_param: InternalApiNetAdminStateUp} - name: {get_param: InternalApiNetName} - shared: {get_param: InternalApiNetShared} - value_specs: {get_param: InternalApiNetValueSpecs} - - InternalApiSubnet: - type: OS::Neutron::Subnet - properties: - ip_version: 6 - ipv6_address_mode: {get_param: IPv6AddressMode} - ipv6_ra_mode: {get_param: IPv6RAMode} - cidr: {get_param: InternalApiNetCidr} - name: {get_param: InternalApiSubnetName} - network: {get_resource: InternalApiNetwork} - allocation_pools: {get_param: InternalApiAllocationPools} - gateway_ip: null - -outputs: - OS::stack_id: - description: Neutron internal network - value: {get_resource: InternalApiNetwork} - subnet_cidr: - value: {get_attr: [InternalApiSubnet, cidr]} diff --git a/network/network.j2 b/network/network.j2 new file mode 100644 index 00000000..61a5b57c --- /dev/null +++ b/network/network.j2 @@ -0,0 +1,105 @@ +heat_template_version: pike + +description: > + {{network.name}} network definition (automatically generated). + +parameters: + # the defaults here work for static IP assignment (IPAM) only + {{network.name}}NetCidr: +{%- if network.ipv6 or ipv6_override %} + default: "{{network.ipv6_subnet|default(network.ip_subnet|default(""))}}" +{%- else %} + default: "{{network.ip_subnet|default("")}}" +{%- endif %} + description: Cidr for the {{network.name_lower}} network. + type: string + {{network.name}}NetValueSpecs: + default: {'provider:physical_network': '{{network.name_lower}}', 'provider:network_type': 'flat'} + description: Value specs for the {{network.name_lower}} network. + type: json +{%- if not ":" in network.ip_subnet and not network.ipv6 and not ipv6_override %} + {{network.name}}NetEnableDHCP: + default: false + description: Whether to enable DHCP on the associated subnet (IPv4 only). + type: boolean +{%- endif %} + {{network.name}}NetAdminStateUp: + default: false + description: The admin state of the network. + type: boolean + {{network.name}}NetShared: + default: false + description: Whether this network is shared across all tenants. + type: boolean + {{network.name}}NetName: + default: {{network.name_lower}} + description: The name of the {{network.name_lower}} network. + type: string + {{network.name}}SubnetName: + default: {{network.name_lower}}_subnet + description: The name of the {{network.name_lower}} subnet in Neutron. + type: string + {{network.name}}AllocationPools: +{%- if ":" in network.ip_subnet or network.ipv6 or ipv6_override %} + default: {{network.ipv6_allocation_pools|default(network.allocation_pools|default([]))}} +{%- else %} + default: {{network.allocation_pools|default([])}} +{%- endif %} + description: Ip allocation pool range for the {{network.name_lower}} network. + type: json +{%- if ":" in network.ip_subnet or network.ipv6 or ipv6_override %} + IPv6AddressMode: + default: dhcpv6-stateful + description: Neutron subnet IPv6 address mode + type: string + IPv6RAMode: + default: dhcpv6-stateful + description: Neutron subnet IPv6 router advertisement mode + type: string +{%- endif %} + {{network.name}}InterfaceDefaultRoute: +{%- if network.ipv6 or ipv6_override %} + default: "{{network.gateway_ipv6|default(network.gateway_ip|default(''))}}" +{%- else %} + default: "{{network.gateway_ip|default('')}}" +{%- endif %} + description: default route for the {{network.name_lower}} network + type: string +{%- if network.vlan %} + {{network.name}}NetworkVlanID: + default: {{network.vlan}} + description: Vlan ID for the {{network.name}} network traffic. + type: number +{%- endif %} + +resources: + {{network.name}}Network: + type: OS::Neutron::Net + properties: + admin_state_up: {get_param: {{network.name}}NetAdminStateUp} + name: {get_param: {{network.name}}NetName} + shared: {get_param: {{network.name}}NetShared} + value_specs: {get_param: {{network.name}}NetValueSpecs} + + {{network.name}}Subnet: + type: OS::Neutron::Subnet + properties: +{%- if ":" in network.ip_subnet or network.ipv6 or ipv6_override %} + ip_version: 6 + ipv6_address_mode: {get_param: IPv6AddressMode} + ipv6_ra_mode: {get_param: IPv6RAMode} +{%- else %} + enable_dhcp: {get_param: {{network.name}}NetEnableDHCP} +{%- endif %} + cidr: {get_param: {{network.name}}NetCidr} + name: {get_param: {{network.name}}SubnetName} + network: {get_resource: {{network.name}}Network} + allocation_pools: {get_param: {{network.name}}AllocationPools} + gateway_ip: {get_param: {{network.name}}InterfaceDefaultRoute} + +outputs: + OS::stack_id: + description: {{network.name_lower}} network + value: {get_resource: {{network.name}}Network} + subnet_cidr: + value: {get_attr: [{{network.name}}Subnet, cidr]} diff --git a/network/network.network.j2.yaml b/network/network.network.j2.yaml index 29d58cd5..d9ff6169 100644 --- a/network/network.network.j2.yaml +++ b/network/network.network.j2.yaml @@ -1,91 +1 @@ -heat_template_version: pike - -description: > - {{network.name}} network definition (automatically generated). - -parameters: - # the defaults here work for static IP assignment (IPAM) only - {{network.name}}NetCidr: - default: {{network.ip_subnet|default("")}} - description: Cidr for the {{network.name_lower}} network. - type: string - {{network.name}}NetValueSpecs: - default: {'provider:physical_network': '{{network.name_lower}}', 'provider:network_type': 'flat'} - description: Value specs for the {{network.name_lower}} network. - type: json - {{network.name}}NetAdminStateUp: - default: false - description: The admin state of the network. - type: boolean - {{network.name}}NetEnableDHCP: - default: false - description: Whether to enable DHCP on the associated subnet. - type: boolean - {{network.name}}NetShared: - default: false - description: Whether this network is shared across all tenants. - type: boolean - {{network.name}}NetName: - default: {{network.name_lower}} - description: The name of the {{network.name_lower}} network. - type: string - {{network.name}}SubnetName: - default: {{network.name_lower}}_subnet - description: The name of the {{network.name_lower}} subnet in Neutron. - type: string - {{network.name}}AllocationPools: - default: {{network.allocation_pools|default([])}} - description: Ip allocation pool range for the {{network.name_lower}} network. - type: json - {{network.name}}InterfaceDefaultRoute: - default: {{network.gateway_ip|default('""')}} - description: default route for the {{network.name_lower}} network - type: string -{%- if network.vlan %} - {{network.name}}NetworkVlanID: - default: {{network.vlan}} - description: Vlan ID for the {{network.name}} network traffic. - type: number -{%- endif %} -{%- if network.ipv6 %} - IPv6AddressMode: - default: dhcpv6-stateful - description: Neutron subnet IPv6 address mode - type: string - IPv6RAMode: - default: dhcpv6-stateful - description: Neutron subnet IPv6 router advertisement mode - type: string -{%- endif %} - -resources: - {{network.name}}Network: - type: OS::Neutron::Net - properties: - admin_state_up: {get_param: {{network.name}}NetAdminStateUp} - name: {get_param: {{network.name}}NetName} - shared: {get_param: {{network.name}}NetShared} - value_specs: {get_param: {{network.name}}NetValueSpecs} - - {{network.name}}Subnet: - type: OS::Neutron::Subnet - properties: - cidr: {get_param: {{network.name}}NetCidr} - name: {get_param: {{network.name}}SubnetName} - network: {get_resource: {{network.name}}Network} - allocation_pools: {get_param: {{network.name}}AllocationPools} - gateway_ip: {get_param: {{network.name}}InterfaceDefaultRoute} -{%- if network.ipv6 %} - ip_version: 6 - ipv6_address_mode: {get_param: IPv6AddressMode} - ipv6_ra_mode: {get_param: IPv6RAMode} -{%- else %} - enable_dhcp: {get_param: {{network.name}}NetEnableDHCP} -{%- endif %} - -outputs: - OS::stack_id: - description: {{network.name_lower}} network - value: {get_resource: {{network.name}}Network} - subnet_cidr: - value: {get_attr: [{{network.name}}Subnet, cidr]} +{% include 'network.j2' %} diff --git a/network/network_v6.network.j2.yaml b/network/network_v6.network.j2.yaml new file mode 100644 index 00000000..809d145c --- /dev/null +++ b/network/network_v6.network.j2.yaml @@ -0,0 +1,2 @@ +{% set ipv6_override = true -%} +{% include 'network.j2' %} diff --git a/network/storage_mgmt_v6.yaml b/network/storage_mgmt_v6.yaml deleted file mode 100644 index 7ed4c92e..00000000 --- a/network/storage_mgmt_v6.yaml +++ /dev/null @@ -1,72 +0,0 @@ -heat_template_version: pike - -description: > - Storage management network. Storage replication, etc. - -parameters: - # the defaults here work for static IP assignment (IPAM) only - StorageMgmtNetCidr: - # OpenStack uses the EUI-64 address format, which requires a /64 prefix - default: 'fd00:fd00:fd00:4000::/64' - description: Cidr for the storage_mgmt network. - type: string - StorageMgmtNetValueSpecs: - default: {'provider:physical_network': 'storage_mgmt', 'provider:network_type': 'flat'} - description: Value specs for the storage_mgmt network. - type: json - StorageMgmtNetAdminStateUp: - default: false - description: The admin state of the network. - type: boolean - StorageMgmtNetShared: - default: false - description: Whether this network is shared across all tenants. - type: boolean - StorageMgmtNetName: - default: storage_mgmt - description: The name of the storage_mgmt network. - type: string - StorageMgmtSubnetName: - default: storage_mgmt_subnet - description: The name of the storage_mgmt subnet in Neutron. - type: string - StorageMgmtAllocationPools: - default: [{'start': 'fd00:fd00:fd00:4000::10', 'end': 'fd00:fd00:fd00:4000:ffff:ffff:ffff:fffe'}] - description: Ip allocation pool range for the storage_mgmt network. - type: json - IPv6AddressMode: - default: dhcpv6-stateful - description: Neutron subnet IPv6 address mode - type: string - IPv6RAMode: - default: dhcpv6-stateful - description: Neutron subnet IPv6 router advertisement mode - type: string - -resources: - StorageMgmtNetwork: - type: OS::Neutron::Net - properties: - admin_state_up: {get_param: StorageMgmtNetAdminStateUp} - name: {get_param: StorageMgmtNetName} - shared: {get_param: StorageMgmtNetShared} - value_specs: {get_param: StorageMgmtNetValueSpecs} - - StorageMgmtSubnet: - type: OS::Neutron::Subnet - properties: - ip_version: 6 - ipv6_address_mode: {get_param: IPv6AddressMode} - ipv6_ra_mode: {get_param: IPv6RAMode} - cidr: {get_param: StorageMgmtNetCidr} - name: {get_param: StorageMgmtSubnetName} - network: {get_resource: StorageMgmtNetwork} - allocation_pools: {get_param: StorageMgmtAllocationPools} - gateway_ip: null - -outputs: - OS::stack_id: - description: Neutron storage management network - value: {get_resource: StorageMgmtNetwork} - subnet_cidr: - value: {get_attr: [StorageMgmtSubnet, cidr]} diff --git a/network/storage_v6.yaml b/network/storage_v6.yaml deleted file mode 100644 index 51edd4b3..00000000 --- a/network/storage_v6.yaml +++ /dev/null @@ -1,72 +0,0 @@ -heat_template_version: pike - -description: > - Storage network. - -parameters: - # the defaults here work for static IP assignment (IPAM) only - StorageNetCidr: - # OpenStack uses the EUI-64 address format, which requires a /64 prefix - default: 'fd00:fd00:fd00:3000::/64' - description: Cidr for the storage network. - type: string - StorageNetValueSpecs: - default: {'provider:physical_network': 'storage', 'provider:network_type': 'flat'} - description: Value specs for the storage network. - type: json - StorageNetAdminStateUp: - default: false - description: The admin state of the network. - type: boolean - StorageNetShared: - default: false - description: Whether this network is shared across all tenants. - type: boolean - StorageNetName: - default: storage - description: The name of the storage network. - type: string - StorageSubnetName: - default: storage_subnet - description: The name of the storage subnet in Neutron. - type: string - StorageAllocationPools: - default: [{'start': 'fd00:fd00:fd00:3000::10', 'end': 'fd00:fd00:fd00:3000:ffff:ffff:ffff:fffe'}] - description: Ip allocation pool range for the storage network. - type: json - IPv6AddressMode: - default: dhcpv6-stateful - description: Neutron subnet IPv6 address mode - type: string - IPv6RAMode: - default: dhcpv6-stateful - description: Neutron subnet IPv6 router advertisement mode - type: string - -resources: - StorageNetwork: - type: OS::Neutron::Net - properties: - admin_state_up: {get_param: StorageNetAdminStateUp} - name: {get_param: StorageNetName} - shared: {get_param: StorageNetShared} - value_specs: {get_param: StorageNetValueSpecs} - - StorageSubnet: - type: OS::Neutron::Subnet - properties: - ip_version: 6 - ipv6_address_mode: {get_param: IPv6AddressMode} - ipv6_ra_mode: {get_param: IPv6RAMode} - cidr: {get_param: StorageNetCidr} - name: {get_param: StorageSubnetName} - network: {get_resource: StorageNetwork} - allocation_pools: {get_param: StorageAllocationPools} - gateway_ip: null - -outputs: - OS::stack_id: - description: Neutron storage network - value: {get_resource: StorageNetwork} - subnet_cidr: - value: {get_attr: [StorageSubnet, cidr]} diff --git a/network/tenant_v6.yaml b/network/tenant_v6.yaml deleted file mode 100644 index 9f139cb1..00000000 --- a/network/tenant_v6.yaml +++ /dev/null @@ -1,72 +0,0 @@ -heat_template_version: pike - -description: > - Tenant IPv6 network. - -parameters: - # the defaults here work for static IP assignment (IPAM) only - TenantNetCidr: - # OpenStack uses the EUI-64 address format, which requires a /64 prefix - default: 'fd00:fd00:fd00:5000::/64' - description: Cidr for the tenant network. - type: string - TenantNetValueSpecs: - default: {'provider:physical_network': 'tenant', 'provider:network_type': 'flat'} - description: Value specs for the tenant network. - type: json - TenantNetAdminStateUp: - default: false - description: The admin state of the network. - type: boolean - TenantNetShared: - default: false - description: Whether this network is shared across all tenants. - type: boolean - TenantNetName: - default: tenant - description: The name of the tenant network. - type: string - TenantSubnetName: - default: tenant_subnet - description: The name of the tenant subnet in Neutron. - type: string - TenantAllocationPools: - default: [{'start': 'fd00:fd00:fd00:5000::10', 'end': 'fd00:fd00:fd00:5000:ffff:ffff:ffff:fffe'}] - description: Ip allocation pool range for the tenant network. - type: json - IPv6AddressMode: - default: dhcpv6-stateful - description: Neutron subnet IPv6 address mode - type: string - IPv6RAMode: - default: dhcpv6-stateful - description: Neutron subnet IPv6 router advertisement mode - type: string - -resources: - TenantNetwork: - type: OS::Neutron::Net - properties: - admin_state_up: {get_param: TenantNetAdminStateUp} - name: {get_param: TenantNetName} - shared: {get_param: TenantNetShared} - value_specs: {get_param: TenantNetValueSpecs} - - TenantSubnet: - type: OS::Neutron::Subnet - properties: - ip_version: 6 - ipv6_address_mode: {get_param: IPv6AddressMode} - ipv6_ra_mode: {get_param: IPv6RAMode} - cidr: {get_param: TenantNetCidr} - name: {get_param: TenantSubnetName} - network: {get_resource: TenantNetwork} - allocation_pools: {get_param: TenantAllocationPools} - gateway_ip: null - -outputs: - OS::stack_id: - description: Neutron tenant network - value: {get_resource: TenantNetwork} - subnet_cidr: - value: {get_attr: [TenantSubnet, cidr]} diff --git a/network_data.yaml b/network_data.yaml index 6ad37dfe..fed11576 100644 --- a/network_data.yaml +++ b/network_data.yaml @@ -6,19 +6,22 @@ # name_lower: lowercase version of name used for filenames # (optional, defaults to name.lower()) # enabled: Is the network enabled (optional, defaults to true) -# ipv6: Does this network use IPv6 IPs? (optional, defaults to false) -# (optional, may use parameter defaults in environment to set) # vlan: vlan for the network (optional) # vip: Enable creation of a virtual IP on this network -# [TODO] (dsneddon@redhat.com) - Enable dynamic creation of VIP ports, -# to support VIPs on non-default networks. -# See https://bugs.launchpad.net/tripleo/+bug/1667104 -# ip_subnet: IP/CIDR, e.g. '192.168.24.0/24' (optional, may use parameter defaults) -# allocation_pools: IP range list e.g. [{'start':'10.0.0.4', 'end':'10.0.0.250}] +# ip_subnet: IP/CIDR, e.g. '192.168.24.0/24' or '2001:db8:fd00:1000::/64' +# (optional, may use parameter defaults instead) +# allocation_pools: IP range list e.g. [{'start':'10.0.0.4', 'end':'10.0.0.250'}] # gateway_ip: gateway for the network (optional, may use parameter defaults) -# NOTE: IP-related values set parameter defaults in templates, may be overridden. -# compat_name: for existing stack you may need to override the default transformation -# for the resource's name. +# ipv6_subnet: Optional, sets default IPv6 subnet if IPv4 is already defined. +# ipv6_allocation_pools: Set default IPv6 allocation pools if IPv4 allocation pools +# are already defined. +# ipv6_gateway: Set an IPv6 gateway if IPv4 gateway already defined. +# ipv6: If ip_subnet not defined, this specifies that the network is IPv6-only. +# NOTE: IP-related values set parameter defaults in templates, may be overridden, +# either by operators, or e.g in environments/network-isolation-v6.yaml where we +# set some default IPv6 addresses. +# compat_name: for existing stack you may need to override the default +# transformation for the resource's name. # # Example: # - name Example @@ -27,8 +30,17 @@ # allocation_pools: [{'start': '10.0.2.4', 'end': '10.0.2.250'}] # gateway_ip: '10.0.2.254' # -# TODO (dsneddon) remove existing templates from j2_excludes.yaml -# and generate all templates dynamically. +# To support backward compatility, two versions of the network definitions will +# be created, network/<network>.yaml and network/<network>_v6.yaml. Only +# one of these files may be used in the deployment at a time, since the +# parameters used for configuration are the same in both files. In the +# future, this behavior may be changed to create only one file for custom +# networks. You may specify IPv6 addresses for ip_subnet, allocation_pools, +# and gateway_ip if no IPv4 addresses are used for a custom network, or set +# ipv6: true, and the network/<network>.yaml file will be configured as IPv6. +# +# For configuring both IPv4 and IPv6 on the same interface, use two separate +# networks, and then assign both IPs in the custom NIC configuration templates. - name: External vip: true @@ -36,27 +48,38 @@ ip_subnet: '10.0.0.0/24' allocation_pools: [{'start': '10.0.0.4', 'end': '10.0.0.250'}] gateway_ip: '10.0.0.1' + ipv6_subnet: '2001:db8:fd00:1000::/64' + ipv6_allocation_pools: [{'start': '2001:db8:fd00:1000::10', 'end': '2001:db8:fd00:1000:ffff:ffff:ffff:fffe'}] + gateway_ipv6: '2001:db8:fd00:1000::1' - name: InternalApi name_lower: internal_api vip: true ip_subnet: '172.16.2.0/24' allocation_pools: [{'start': '172.16.2.4', 'end': '172.16.2.250'}] + ipv6_subnet: 'fd00:fd00:fd00:2000::/64' + ipv6_allocation_pools: [{'start': 'fd00:fd00:fd00:2000::10', 'end': 'fd00:fd00:fd00:2000:ffff:ffff:ffff:fffe'}] compat_name: Internal - name: Storage vip: true name_lower: storage ip_subnet: '172.16.1.0/24' allocation_pools: [{'start': '172.16.1.4', 'end': '172.16.1.250'}] + ipv6_subnet: 'fd00:fd00:fd00:3000::/64' + ipv6_allocation_pools: [{'start': 'fd00:fd00:fd00:3000::10', 'end': 'fd00:fd00:fd00:3000:ffff:ffff:ffff:fffe'}] - name: StorageMgmt name_lower: storage_mgmt vip: true ip_subnet: '172.16.3.0/24' allocation_pools: [{'start': '172.16.3.4', 'end': '172.16.3.250'}] + ipv6_subnet: 'fd00:fd00:fd00:4000::/64' + ipv6_allocation_pools: [{'start': 'fd00:fd00:fd00:4000::10', 'end': 'fd00:fd00:fd00:4000:ffff:ffff:ffff:fffe'}] - name: Tenant vip: false # Tenant network does not use VIPs name_lower: tenant ip_subnet: '172.16.0.0/24' allocation_pools: [{'start': '172.16.0.4', 'end': '172.16.0.250'}] + ipv6_subnet: 'fd00:fd00:fd00:5000::/64' + ipv6_allocation_pools: [{'start': 'fd00:fd00:fd00:5000::10', 'end': 'fd00:fd00:fd00:5000:ffff:ffff:ffff:fffe'}] - name: Management # Management network is disabled by default enabled: false @@ -64,3 +87,5 @@ name_lower: management ip_subnet: '10.0.1.0/24' allocation_pools: [{'start': '10.0.1.4', 'end': '10.0.1.250'}] + ipv6_subnet: 'fd00:fd00:fd00:6000::/64' + ipv6_allocation_pools: [{'start': 'fd00:fd00:fd00:6000::10', 'end': 'fd00:fd00:fd00:6000:ffff:ffff:ffff:fffe'}] diff --git a/overcloud-resource-registry-puppet.j2.yaml b/overcloud-resource-registry-puppet.j2.yaml index 0fa0a9fe..8f4b4b48 100644 --- a/overcloud-resource-registry-puppet.j2.yaml +++ b/overcloud-resource-registry-puppet.j2.yaml @@ -231,8 +231,10 @@ resource_registry: OS::TripleO::Services::ManilaScheduler: OS::Heat::None OS::TripleO::Services::ManilaShare: OS::Heat::None OS::TripleO::Services::ManilaBackendGeneric: OS::Heat::None + OS::TripleO::Services::ManilaBackendIsilon: OS::Heat::None OS::TripleO::Services::ManilaBackendNetapp: OS::Heat::None OS::TripleO::Services::ManilaBackendUnity: OS::Heat::None + OS::TripleO::Services::ManilaBackendVMAX: OS::Heat::None OS::TripleO::Services::ManilaBackendCephFs: OS::Heat::None OS::TripleO::Services::ManilaBackendVNX: OS::Heat::None OS::TripleO::Services::ComputeNeutronL3Agent: OS::Heat::None @@ -267,6 +269,7 @@ resource_registry: OS::TripleO::Services::CinderBackendDellPs: OS::Heat::None OS::TripleO::Services::CinderBackendDellSc: OS::Heat::None OS::TripleO::Services::CinderBackendDellEMCUnity: OS::Heat::None + OS::TripleO::Services::CinderBackendDellEMCVMAXISCSI: OS::Heat::None OS::TripleO::Services::CinderBackendNetApp: OS::Heat::None OS::TripleO::Services::CinderBackendScaleIO: OS::Heat::None OS::TripleO::Services::CinderBackendVRTSHyperScale: OS::Heat::None diff --git a/overcloud.j2.yaml b/overcloud.j2.yaml index 2e398671..367ac5b6 100644 --- a/overcloud.j2.yaml +++ b/overcloud.j2.yaml @@ -70,17 +70,14 @@ parameters: description: | Role specific additional hiera configuration to inject into the cluster. type: json -{%- endfor %} - controllerExtraConfig: - default: {} - description: | - DEPRECATED use ControllerExtraConfig instead - type: json - NovaComputeExtraConfig: +{%- if role.deprecated_param_extraconfig is defined %} + {{role.deprecated_param_extraconfig}}: default: {} description: | - DEPRECATED use ComputeExtraConfig instead + DEPRECATED use {{role.name}}ExtraConfig instead type: json +{%- endif %} +{%- endfor %} NeutronControlPlaneID: default: 'ctlplane' type: string @@ -188,15 +185,16 @@ parameters: doing an update which requires removal of specific resources. Example format ComputeRemovalPolicies: [{'resource_list': ['0']}] -{% if role.name != 'Compute' %} {{role.name}}SchedulerHints: + type: json description: Optional scheduler hints to pass to nova -{% else %} - NovaComputeSchedulerHints: - description: DEPRECATED - use ComputeSchedulerHints instead -{% endif %} + default: {} +{%- if role.deprecated_param_scheduler_hints is defined %} + {{role.deprecated_param_scheduler_hints}}: type: json + description: DEPRECATED - use {{role.name}}SchedulerHints instead default: {} +{%- endif %} {{role.name}}Parameters: type: json @@ -229,6 +227,24 @@ parameters: description: > List of server hostnames to blacklist from any triggered deployments. +{% for role in roles %} +{%- if role.deprecated_param_scheduler_hints is defined or role.deprecated_param_extraconfig is defined %} +{%- if not parameter_groups_defined|default(false) %} +parameter_groups: +- label: deprecated + description: Do not use deprecated params, they will be removed. + parameters: +{%- set parameter_groups_defined = true %} +{%- endif %} +{%- endif %} +{%- if role.deprecated_param_scheduler_hints is defined %} + - {{role.deprecated_param_scheduler_hints}} +{%- endif %} +{%- if role.deprecated_param_extraconfig is defined %} + - {{role.deprecated_param_extraconfig}} +{%- endif %} +{%- endfor %} + conditions: add_vips_to_etc_hosts: {equals : [{get_param: AddVipsToEtcHosts}, True]} @@ -407,17 +423,10 @@ resources: map_merge: - get_attr: [{{role.name}}ServiceConfigSettings, value] - get_param: ExtraConfig - {%- if role.name == 'Controller' %} - - map_merge: - - get_param: controllerExtraConfig - - get_param: {{role.name}}ExtraConfig - {%- elif role.name == 'Compute' %} - - map_merge: - - get_param: NovaComputeExtraConfig - - get_param: {{role.name}}ExtraConfig - {%- else %} +{%- if role.deprecated_param_extraconfig is defined %} + - get_param: {{role.deprecated_param_extraconfig}} +{%- endif %} - get_param: {{role.name}}ExtraConfig - {%- endif %} # Filter any null/None service_names which may be present due to mapping # of services to OS::Heat::None @@ -525,14 +534,19 @@ resources: params: '%stackname%': {get_param: 'OS::stack_name'} NodeIndex: '%index%' - {% if role.name != 'Compute' %} - {{role.name}}SchedulerHints: {get_param: {{role.name}}SchedulerHints} - {% else %} - NovaComputeSchedulerHints: {get_param: NovaComputeSchedulerHints} - {% endif %} + # Note, SchedulerHints must be defined here, not only in the + # nested template, as it can contain %index% + {{role.name}}SchedulerHints: + map_merge: +{%- if role.deprecated_param_scheduler_hints is defined %} + - {get_param: {{role.deprecated_param_scheduler_hints}}} +{%- endif %} + - {get_param: {{role.name}}SchedulerHints} ServiceConfigSettings: {get_attr: [{{role.name}}ServiceConfigSettings, value]} ServiceNames: {get_attr: [{{role.name}}ServiceNames, value]} MonitoringSubscriptions: {get_attr: [{{role.name}}ServiceChainRoleData, value, monitoring_subscriptions]} + LoggingSources: {get_attr: [{{role.name}}ServiceChainRoleData, value, logging_sources]} + LoggingGroups: {get_attr: [{{role.name}}ServiceChainRoleData, value, logging_groups]} ServiceMetadataSettings: {get_attr: [{{role.name}}ServiceChainRoleData, value, service_metadata_settings]} DeploymentServerBlacklistDict: {get_attr: [DeploymentServerBlacklistDict, value]} RoleParameters: {get_param: {{role.name}}Parameters} @@ -624,24 +638,6 @@ resources: {% for role in roles %} - {get_attr: [{{role.name}}ServiceNames, value]} {% endfor %} - logging_groups: - yaql: - expression: > - $.data.groups.flatten() - data: - groups: -{% for role in roles %} - - {get_attr: [{{role.name}}ServiceChainRoleData, value, logging_groups]} -{% endfor %} - logging_sources: - yaql: - expression: > - $.data.sources.flatten() - data: - sources: -{% for role in roles %} - - {get_attr: [{{role.name}}ServiceChainRoleData, value, logging_sources]} -{% endfor %} controller_ips: {get_attr: [{{primary_role_name}}, ip_address]} controller_names: {get_attr: [{{primary_role_name}}, hostname]} service_ips: diff --git a/puppet/all-nodes-config.yaml b/puppet/all-nodes-config.yaml index 3044fe39..37c1d4e5 100644 --- a/puppet/all-nodes-config.yaml +++ b/puppet/all-nodes-config.yaml @@ -16,10 +16,6 @@ parameters: type: comma_delimited_list controller_ips: type: comma_delimited_list - logging_groups: - type: json - logging_sources: - type: json service_ips: type: json service_node_names: @@ -113,8 +109,6 @@ resources: bootstrap_nodeid_ip: {get_input: bootstrap_nodeid_ip} all_nodes: map_merge: - - tripleo::profile::base::logging::fluentd::fluentd_sources: {get_param: logging_sources} - - tripleo::profile::base::logging::fluentd::fluentd_groups: {get_param: logging_groups} - enabled_services: yaql: expression: $.data.distinct() diff --git a/puppet/role.role.j2.yaml b/puppet/role.role.j2.yaml index 5453e65c..15da1773 100644 --- a/puppet/role.role.j2.yaml +++ b/puppet/role.role.j2.yaml @@ -105,6 +105,11 @@ parameters: description: DEPRECATED - use {{role.name}}IPs instead type: json {%- endif %} + {{role.name}}NetworkDeploymentActions: + type: comma_delimited_list + description: > + Heat action when to apply network configuration changes + default: [] NetworkDeploymentActions: type: comma_delimited_list description: > @@ -148,12 +153,6 @@ parameters: type: json description: Optional scheduler hints to pass to nova default: {} -{%- if role.deprecated_param_scheduler_hints is defined %} - {{role.deprecated_param_scheduler_hints}}: - type: json - description: DEPRECATED - use {{role.name}}SchedulerHints instead - default: {} -{%- endif %} NodeIndex: type: number default: 0 @@ -239,7 +238,7 @@ parameter_groups: description: Do not use deprecated params, they will be removed. parameters: {%- for property in role %} -{%- if property.startswith('deprecated_param_') %} +{%- if property.startswith('deprecated_param_') and not role[property].endswith('SchedulerHints') %} - {{role[property]}} {%- endif %} {%- endfor %} @@ -271,6 +270,11 @@ conditions: - {get_param: {{role.deprecated_param_flavor}}} - {{default_flavor_name}} {%- endif %} + role_network_deployment_actions_exists: + not: + equals: + - {get_param: {{role.name}}NetworkDeploymentActions} + - [] resources: {{server_resource_name}}: @@ -317,12 +321,7 @@ resources: {%- endif %} - {get_param: {{role.name}}ServerMetadata} - {get_param: ServiceMetadataSettings} - scheduler_hints: - map_merge: -{%- if role.deprecated_param_scheduler_hints is defined %} - - {get_param: {{role.deprecated_param_scheduler_hints}}} -{%- endif %} - - {get_param: {{role.name}}SchedulerHints} + scheduler_hints: {get_param: {{role.name}}SchedulerHints} deployment_swift_data: if: - deployment_swift_data_map_unset @@ -501,7 +500,10 @@ resources: actions: if: - server_not_blacklisted - - {get_param: NetworkDeploymentActions} + - if: + - role_network_deployment_actions_exists + - {get_param: {{role.name}}NetworkDeploymentActions} + - {get_param: NetworkDeploymentActions} - [] {{server_resource_name}}UpgradeInitConfig: diff --git a/puppet/services/aodh-api.yaml b/puppet/services/aodh-api.yaml index f84edde0..f0493f0e 100644 --- a/puppet/services/aodh-api.yaml +++ b/puppet/services/aodh-api.yaml @@ -116,12 +116,9 @@ outputs: metadata_settings: get_attr: [ApacheServiceBase, role_data, metadata_settings] upgrade_tasks: - yaql: - expression: $.data.apache_upgrade + $.data.aodh_api_upgrade - data: - apache_upgrade: - get_attr: [ApacheServiceBase, role_data, upgrade_tasks] - aodh_api_upgrade: - - name: Stop aodh_api service (running under httpd) - tags: step1 - service: name=httpd state=stopped + list_concat: + - get_attr: [ApacheServiceBase, role_data, upgrade_tasks] + - + - name: Stop aodh_api service (running under httpd) + tags: step1 + service: name=httpd state=stopped diff --git a/puppet/services/barbican-api.yaml b/puppet/services/barbican-api.yaml index a894dbdf..974c2538 100644 --- a/puppet/services/barbican-api.yaml +++ b/puppet/services/barbican-api.yaml @@ -186,22 +186,19 @@ outputs: metadata_settings: get_attr: [ApacheServiceBase, role_data, metadata_settings] upgrade_tasks: - yaql: - expression: $.data.apache_upgrade + $.data.barbican_api_upgrade - data: - apache_upgrade: - get_attr: [ApacheServiceBase, role_data, upgrade_tasks] - barbican_api_upgrade: - - name: Check if barbican_api is deployed - command: systemctl is-enabled openstack-barbican-api - tags: common - ignore_errors: True - register: barbican_api_enabled - - name: "PreUpgrade step0,validation: Check service openstack-barbican-api is running" - shell: /usr/bin/systemctl show 'openstack-barbican-api' --property ActiveState | grep '\bactive\b' - when: barbican_api_enabled.rc == 0 - tags: step0,validation - - name: Install openstack-barbican-api package if it was disabled - tags: step3 - yum: name=openstack-barbican-api state=latest - when: barbican_api_enabled.rc != 0 + list_concat: + - get_attr: [ApacheServiceBase, role_data, upgrade_tasks] + - + - name: Check if barbican_api is deployed + command: systemctl is-enabled openstack-barbican-api + tags: common + ignore_errors: True + register: barbican_api_enabled + - name: "PreUpgrade step0,validation: Check service openstack-barbican-api is running" + shell: /usr/bin/systemctl show 'openstack-barbican-api' --property ActiveState | grep '\bactive\b' + when: barbican_api_enabled.rc == 0 + tags: step0,validation + - name: Install openstack-barbican-api package if it was disabled + tags: step3 + yum: name=openstack-barbican-api state=latest + when: barbican_api_enabled.rc != 0 diff --git a/puppet/services/ceilometer-api.yaml b/puppet/services/ceilometer-api.yaml index aba303fb..1076c043 100644 --- a/puppet/services/ceilometer-api.yaml +++ b/puppet/services/ceilometer-api.yaml @@ -118,12 +118,9 @@ outputs: metadata_settings: get_attr: [ApacheServiceBase, role_data, metadata_settings] upgrade_tasks: - yaql: - expression: $.data.apache_upgrade + $.data.ceilometer_api_upgrade - data: - apache_upgrade: - get_attr: [ApacheServiceBase, role_data, upgrade_tasks] - ceilometer_api_upgrade: - - name: Stop ceilometer_api service (running under httpd) - tags: step1 - service: name=httpd state=stopped + list_concat: + - get_attr: [ApacheServiceBase, role_data, upgrade_tasks] + - + - name: Stop ceilometer_api service (running under httpd) + tags: step1 + service: name=httpd state=stopped diff --git a/puppet/services/cinder-api.yaml b/puppet/services/cinder-api.yaml index fbfe532a..193c6ba3 100644 --- a/puppet/services/cinder-api.yaml +++ b/puppet/services/cinder-api.yaml @@ -184,31 +184,28 @@ outputs: metadata_settings: get_attr: [ApacheServiceBase, role_data, metadata_settings] upgrade_tasks: - yaql: - expression: $.data.apache_upgrade + $.data.cinder_api_upgrade - data: - apache_upgrade: - get_attr: [ApacheServiceBase, role_data, upgrade_tasks] - cinder_api_upgrade: - - name: Check if cinder_api is deployed - command: systemctl is-enabled openstack-cinder-api - tags: common - ignore_errors: True - register: cinder_api_enabled - - name: "PreUpgrade step0,validation: Check service openstack-cinder-api is running" - shell: /usr/bin/systemctl show 'openstack-cinder-api' --property ActiveState | grep '\bactive\b' - when: cinder_api_enabled.rc == 0 - tags: step0,validation - - name: check for cinder running under apache (post upgrade) - tags: step1 - shell: "httpd -t -D DUMP_VHOSTS | grep -q cinder" - register: cinder_apache - ignore_errors: true - - name: Stop cinder_api service (running under httpd) - tags: step1 - service: name=httpd state=stopped - when: cinder_apache.rc == 0 - - name: Stop and disable cinder_api service (pre-upgrade not under httpd) - tags: step1 - when: cinder_api_enabled.rc == 0 - service: name=openstack-cinder-api state=stopped enabled=no + list_concat: + - get_attr: [ApacheServiceBase, role_data, upgrade_tasks] + - + - name: Check if cinder_api is deployed + command: systemctl is-enabled openstack-cinder-api + tags: common + ignore_errors: True + register: cinder_api_enabled + - name: "PreUpgrade step0,validation: Check service openstack-cinder-api is running" + shell: /usr/bin/systemctl show 'openstack-cinder-api' --property ActiveState | grep '\bactive\b' + when: cinder_api_enabled.rc == 0 + tags: step0,validation + - name: check for cinder running under apache (post upgrade) + tags: step1 + shell: "httpd -t -D DUMP_VHOSTS | grep -q cinder" + register: cinder_apache + ignore_errors: true + - name: Stop cinder_api service (running under httpd) + tags: step1 + service: name=httpd state=stopped + when: cinder_apache.rc == 0 + - name: Stop and disable cinder_api service (pre-upgrade not under httpd) + tags: step1 + when: cinder_api_enabled.rc == 0 + service: name=openstack-cinder-api state=stopped enabled=no diff --git a/puppet/services/cinder-backend-dellemc-vmax-iscsi.yaml b/puppet/services/cinder-backend-dellemc-vmax-iscsi.yaml new file mode 100644 index 00000000..1a3beab5 --- /dev/null +++ b/puppet/services/cinder-backend-dellemc-vmax-iscsi.yaml @@ -0,0 +1,65 @@ +# Copyright (c) 2016-2017 Dell Inc, or its subsidiaries. +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +heat_template_version: pike + +description: > + Openstack Cinder Dell EMC VMAX iscsi backend + +parameters: + CinderEnableDellEMCVMAXISCSIBackend: + type: boolean + default: true + CinderDellEMCVMAXISCSIBackendName: + type: string + default: 'tripleo_dellemc_vmax_iscsi' + CinderDellEMCVMAXISCSIConfigFile: + type: string + ServiceData: + default: {} + description: Dictionary packing service data + type: json + ServiceNetMap: + default: {} + description: Mapping of service_name -> network name. Typically set + via parameter_defaults in the resource registry. This + mapping overrides those in ServiceNetMapDefaults. + type: json + DefaultPasswords: + default: {} + type: json + RoleName: + default: '' + description: Role name on which the service is applied + type: string + RoleParameters: + default: {} + description: Parameters specific to the role + type: json + EndpointMap: + default: {} + type: json + description: Mapping of service endpoint -> protocol. Typically set + via parameter_defaults in the resource registry. + +outputs: + role_data: + description: Role data for the Cinder Dell EMC VMAX iscsi backend. + value: + service_name: cinder_backend_dellemc_vmax_iscsi + config_settings: + tripleo::profile::base::cinder::volume::cinder_enable_dellemc_vmax_iscsi_backend: {get_param: CinderEnableDellEMCVMAXISCSIBackend} + cinder::backend::dell_emc_vmax_iscsi::volume_backend_name: {get_param: CinderDellEMCVMAXISCSIBackendName} + cinder::backend::dell_emc_vmax_iscsi::cinder_emc_config_file: {get_param: CinderDellEMCVMAXISCSIConfigFile} + step_config: | + include ::tripleo::profile::base::cinder::volume diff --git a/puppet/services/database/redis-base.yaml b/puppet/services/database/redis-base.yaml index 2a6a89e9..8436062a 100644 --- a/puppet/services/database/redis-base.yaml +++ b/puppet/services/database/redis-base.yaml @@ -38,6 +38,12 @@ parameters: description: Mapping of service endpoint -> protocol. Typically set via parameter_defaults in the resource registry. type: json + EnableInternalTLS: + type: boolean + default: false + +conditions: + use_tls_proxy: {equals : [{get_param: EnableInternalTLS}, true]} outputs: role_data: @@ -53,10 +59,20 @@ outputs: # internal_api -> IP # internal_api_uri -> [IP] # internal_api_subnet - > IP/CIDR - redis::bind: {get_param: [ServiceNetMap, RedisNetwork]} + # Bind to localhost if internal TLS is enabled, since we put a TLs + # proxy in front. + redis::bind: + if: + - use_tls_proxy + - 'localhost' + - {get_param: [ServiceNetMap, RedisNetwork]} redis::port: 6379 redis::sentinel::master_name: "%{hiera('bootstrap_nodeid')}" redis::sentinel::redis_host: "%{hiera('bootstrap_nodeid_ip')}" redis::sentinel::notification_script: '/usr/local/bin/redis-notifications.sh' - redis::sentinel::sentinel_bind: {get_param: [ServiceNetMap, RedisNetwork]} + redis::sentinel::sentinel_bind: + if: + - use_tls_proxy + - 'localhost' + - {get_param: [ServiceNetMap, RedisNetwork]} redis::ulimit: {get_param: RedisFDLimit} diff --git a/puppet/services/database/redis.yaml b/puppet/services/database/redis.yaml index bdcc4fcd..810e467e 100644 --- a/puppet/services/database/redis.yaml +++ b/puppet/services/database/redis.yaml @@ -30,8 +30,15 @@ parameters: description: Mapping of service endpoint -> protocol. Typically set via parameter_defaults in the resource registry. type: json + EnableInternalTLS: + type: boolean + default: false + +conditions: + use_tls_proxy: {equals : [{get_param: EnableInternalTLS}, true]} resources: + RedisBase: type: ./redis-base.yaml properties: @@ -41,6 +48,7 @@ resources: EndpointMap: {get_param: EndpointMap} RoleName: {get_param: RoleName} RoleParameters: {get_param: RoleParameters} + EnableInternalTLS: {get_param: EnableInternalTLS} outputs: role_data: @@ -55,8 +63,41 @@ outputs: dport: - 6379 - 26379 + tripleo::profile::base::database::redis::tls_proxy_bind_ip: + get_param: [ServiceNetMap, RedisNetwork] + tripleo::profile::base::database::redis::tls_proxy_fqdn: + str_replace: + template: + "%{hiera('fqdn_$NETWORK')}" + params: + $NETWORK: {get_param: [ServiceNetMap, RedisNetwork]} + tripleo::profile::base::database::redis::tls_proxy_port: 6379 + - if: + - use_tls_proxy + - redis_certificate_specs: + service_certificate: '/etc/pki/tls/certs/redis.crt' + service_key: '/etc/pki/tls/private/redis.key' + hostname: + str_replace: + template: "%{hiera('cloud_name_NETWORK')}" + params: + NETWORK: {get_param: [ServiceNetMap, RedisNetwork]} + principal: + str_replace: + template: "redis/%{hiera('cloud_name_NETWORK')}" + params: + NETWORK: {get_param: [ServiceNetMap, RedisNetwork]} + - {} step_config: | include ::tripleo::profile::base::database::redis + metadata_settings: + if: + - use_tls_proxy + - + - service: redis + network: {get_param: [ServiceNetMap, RabbitmqNetwork]} + type: vip + - null upgrade_tasks: - name: Check if redis is deployed command: systemctl is-enabled redis diff --git a/puppet/services/disabled/mongodb-disabled.yaml b/puppet/services/disabled/mongodb-disabled.yaml index 9e58103c..c01a91fb 100644 --- a/puppet/services/disabled/mongodb-disabled.yaml +++ b/puppet/services/disabled/mongodb-disabled.yaml @@ -37,6 +37,10 @@ outputs: value: service_name: mongodb_disabled upgrade_tasks: + - name: Check for mongodb service + stat: path=/usr/lib/systemd/system/mongod.service + register: mongod_service - name: Stop and disable mongodb service on upgrade tags: step1 service: name=mongod state=stopped enabled=no + when: mongod_service.stat.exists diff --git a/puppet/services/gnocchi-api.yaml b/puppet/services/gnocchi-api.yaml index cd7ab692..0f8f352a 100644 --- a/puppet/services/gnocchi-api.yaml +++ b/puppet/services/gnocchi-api.yaml @@ -151,12 +151,9 @@ outputs: metadata_settings: get_attr: [ApacheServiceBase, role_data, metadata_settings] upgrade_tasks: - yaql: - expression: $.data.apache_upgrade + $.data.gnocchi_api_upgrade - data: - apache_upgrade: - get_attr: [ApacheServiceBase, role_data, upgrade_tasks] - gnocchi_api_upgrade: - - name: Stop gnocchi_api service (running under httpd) - tags: step1 - service: name=httpd state=stopped + list_concat: + - get_attr: [ApacheServiceBase, role_data, upgrade_tasks] + - + - name: Stop gnocchi_api service (running under httpd) + tags: step1 + service: name=httpd state=stopped diff --git a/puppet/services/haproxy-public-tls-certmonger.yaml b/puppet/services/haproxy-public-tls-certmonger.yaml index 14d171dc..cdfc41cf 100644 --- a/puppet/services/haproxy-public-tls-certmonger.yaml +++ b/puppet/services/haproxy-public-tls-certmonger.yaml @@ -36,6 +36,11 @@ parameters: HAProxyInternalTLSKeysDirectory: default: '/etc/pki/tls/private/haproxy' type: string + DeployedSSLCertificatePath: + default: '/etc/pki/tls/private/overcloud_endpoint.pem' + description: > + The filepath of the certificate as it will be stored in the controller. + type: string outputs: role_data: @@ -44,22 +49,14 @@ outputs: service_name: haproxy_public_tls_certmonger config_settings: generate_service_certificates: true - tripleo::haproxy::service_certificate: - list_join: - - '' - - - {get_param: HAProxyInternalTLSCertsDirectory} - - '/overcloud-haproxy-external.pem' + tripleo::haproxy::service_certificate: {get_param: DeployedSSLCertificatePath} tripleo::certmonger::haproxy_dirs::certificate_dir: get_param: HAProxyInternalTLSCertsDirectory tripleo::certmonger::haproxy_dirs::key_dir: get_param: HAProxyInternalTLSKeysDirectory certificates_specs: haproxy-external: - service_pem: - list_join: - - '' - - - {get_param: HAProxyInternalTLSCertsDirectory} - - '/overcloud-haproxy-external.pem' + service_pem: {get_param: DeployedSSLCertificatePath} service_certificate: list_join: - '' diff --git a/puppet/services/keystone.yaml b/puppet/services/keystone.yaml index 218ba740..6301314a 100644 --- a/puppet/services/keystone.yaml +++ b/puppet/services/keystone.yaml @@ -400,12 +400,9 @@ outputs: metadata_settings: get_attr: [ApacheServiceBase, role_data, metadata_settings] upgrade_tasks: - yaql: - expression: $.data.apache_upgrade + $.data.keystone_upgrade - data: - apache_upgrade: - get_attr: [ApacheServiceBase, role_data, upgrade_tasks] - keystone_upgrade: - - name: Stop keystone service (running under httpd) - tags: step1 - service: name=httpd state=stopped + list_concat: + - get_attr: [ApacheServiceBase, role_data, upgrade_tasks] + - + - name: Stop keystone service (running under httpd) + tags: step1 + service: name=httpd state=stopped diff --git a/puppet/services/manila-backend-isilon.yaml b/puppet/services/manila-backend-isilon.yaml new file mode 100644 index 00000000..6d8a1fb6 --- /dev/null +++ b/puppet/services/manila-backend-isilon.yaml @@ -0,0 +1,72 @@ +heat_template_version: pike + +description: > + Openstack Manila isilon backend. + +parameters: + ManilaIsilonDriverHandlesShareServers: + type: string + default: true + ManilaIsilonBackendName: + type: string + default: tripleo_isilon + ManilaIsilonNasLogin: + type: string + default: '' + ManilaIsilonNasPassword: + type: string + default: '' + ManilaIsilonNasServer: + type: string + default: '' + ManilaIsilonNasRootDir: + type: string + default: '' + ManilaIsilonNasServerPort: + type: number + default: 8080 + ManilaIsilonNasServerSecure: + type: string + default: '' + ServiceData: + default: {} + description: Dictionary packing service data + type: json + ServiceNetMap: + default: {} + description: Mapping of service_name -> network name. Typically set + via parameter_defaults in the resource registry. This + mapping overrides those in ServiceNetMapDefaults. + type: json + DefaultPasswords: + default: {} + type: json + RoleName: + default: '' + description: Role name on which the service is applied + type: string + RoleParameters: + default: {} + description: Parameters specific to the role + type: json + EndpointMap: + default: {} + type: json + description: Mapping of service endpoint -> protocol. Typically set + via parameter_defaults in the resource registry. + +outputs: + role_data: + description: Role data for the Manila Isilon backend. + value: + service_name: manila_backend_isilon + config_settings: + manila::backend::dellemc_isilon::title: {get_param: ManilaIsilonBackendName} + manila::backend::dellemc_isilon::emc_nas_login: {get_param: ManilaIsilonNasLogin} + manila::backend::dellemc_isilon::driver_handles_share_servers: {get_param: ManilaIsilonDriverHandlesShareServers} + manila::backend::dellemc_isilon::emc_nas_password: {get_param: ManilaIsilonNasPassword} + manila::backend::dellemc_isilon::emc_nas_server: {get_param: ManilaIsilonNasServer} + manila::backend::dellemc_isilon::emc_nas_root_dir: {get_param: ManilaIsilonNasRootDir} + manila::backend::dellemc_isilon::emc_nas_server_port: {get_param: ManilaIsilonNasServerPort} + manila::backend::dellemc_isilon::emc_nas_server_secure: {get_param: ManilaIsilonNasServerSecure} + step_config: diff --git a/puppet/services/manila-backend-vmax.yaml b/puppet/services/manila-backend-vmax.yaml new file mode 100644 index 00000000..cdd32f5d --- /dev/null +++ b/puppet/services/manila-backend-vmax.yaml @@ -0,0 +1,74 @@ +heat_template_version: pike + +description: > + Openstack Manila vmax backend. + +parameters: + ManilaVMAXDriverHandlesShareServers: + type: string + default: false + ManilaVMAXBackendName: + type: string + default: tripleo_manila_vmax + ManilaVMAXNasLogin: + type: string + default: '' + ManilaVMAXNasPassword: + type: string + default: '' + ManilaVMAXNasServer: + type: string + default: '' + ManilaVMAXServerContainer: + type: string + default: '' + ManilaVMAXShareDataPools: + type: string + default: '' + ManilaVMAXEthernetPorts: + type: string + default: '' + ServiceData: + default: {} + description: Dictionary packing service data + type: json + ServiceNetMap: + default: {} + description: Mapping of service_name -> network name. Typically set + via parameter_defaults in the resource registry. This + mapping overrides those in ServiceNetMapDefaults. + type: json + DefaultPasswords: + default: {} + type: json + RoleName: + default: '' + description: Role name on which the service is applied + type: string + RoleParameters: + default: {} + description: Parameters specific to the role + type: json + EndpointMap: + default: {} + type: json + description: Mapping of service endpoint -> protocol. Typically set + via parameter_defaults in the resource registry. + +outputs: + role_data: + description: Role data for the Manila VMAX backend. + value: + service_name: manila_backend_vmax + config_settings: + manila::backend::dellemc_vmax::title: {get_param: ManilaVMAXBackendName} + manila::backend::dellemc_vmax::emc_nas_login: {get_param: ManilaVMAXNasLogin} + manila::backend::dellemc_vmax::driver_handles_share_servers: {get_param: ManilaVMAXDriverHandlesShareServers} + manila::backend::dellemc_vmax::emc_nas_password: {get_param: ManilaVMAXNasPassword} + manila::backend::dellemc_vmax::emc_nas_server: {get_param: ManilaVMAXNasServer} + manila::backend::dellemc_vmax::emc_share_backend: {'vmax'} + manila::backend::dellemc_vmax::vmax_server_container: {get_param: ManilaVMAXServerContainer} + manila::backend::dellemc_vmax::vmax_share_data_pools: {get_param: ManilaVMAXShareDataPools} + manila::backend::dellemc_vmax::vmax_ethernet_ports: {get_param: ManilaVMAXEthernetPorts} + step_config: + diff --git a/puppet/services/manila-scheduler.yaml b/puppet/services/manila-scheduler.yaml index 7d43f685..364a1a3d 100644 --- a/puppet/services/manila-scheduler.yaml +++ b/puppet/services/manila-scheduler.yaml @@ -70,7 +70,7 @@ outputs: manila::compute::nova::nova_admin_password: {get_param: NovaPassword} manila::compute::nova::nova_admin_tenant_name: 'service' manila::network::neutron::neutron_url: {get_param: [EndpointMap, NeutronInternal, uri]} - manila::network::neutron::neutron_admin_auth_url: {get_param: [EndpointMap, NeutronAdmin, uri]} + manila::network::neutron::neutron_admin_auth_url: {get_param: [EndpointMap, KeystoneInternal, uri]} manila::network::neutron::neutron_admin_password: {get_param: NeutronPassword} step_config: | include ::tripleo::profile::base::manila::scheduler diff --git a/puppet/services/neutron-ovs-agent.yaml b/puppet/services/neutron-ovs-agent.yaml index 7894f78b..a2f82a58 100644 --- a/puppet/services/neutron-ovs-agent.yaml +++ b/puppet/services/neutron-ovs-agent.yaml @@ -140,22 +140,19 @@ outputs: step_config: | include ::tripleo::profile::base::neutron::ovs upgrade_tasks: - yaql: - expression: $.data.ovs_upgrade + $.data.neutron_ovs_upgrade - data: - ovs_upgrade: - get_attr: [Ovs, role_data, upgrade_tasks] - neutron_ovs_upgrade: - - name: Check if neutron_ovs_agent is deployed - command: systemctl is-enabled neutron-openvswitch-agent - tags: common - ignore_errors: True - register: neutron_ovs_agent_enabled - - name: "PreUpgrade step0,validation: Check service neutron-openvswitch-agent is running" - shell: /usr/bin/systemctl show 'neutron-openvswitch-agent' --property ActiveState | grep '\bactive\b' - when: neutron_ovs_agent_enabled.rc == 0 - tags: step0,validation - - name: Stop neutron_ovs_agent service - tags: step1 - when: neutron_ovs_agent_enabled.rc == 0 - service: name=neutron-openvswitch-agent state=stopped + list_concat: + - get_attr: [Ovs, role_data, upgrade_tasks] + - + - name: Check if neutron_ovs_agent is deployed + command: systemctl is-enabled neutron-openvswitch-agent + tags: common + ignore_errors: True + register: neutron_ovs_agent_enabled + - name: "PreUpgrade step0,validation: Check service neutron-openvswitch-agent is running" + shell: /usr/bin/systemctl show 'neutron-openvswitch-agent' --property ActiveState | grep '\bactive\b' + when: neutron_ovs_agent_enabled.rc == 0 + tags: step0,validation + - name: Stop neutron_ovs_agent service + tags: step1 + when: neutron_ovs_agent_enabled.rc == 0 + service: name=neutron-openvswitch-agent state=stopped diff --git a/puppet/services/neutron-plugin-nsx.yaml b/puppet/services/neutron-plugin-nsx.yaml index 2774b03e..26380649 100644 --- a/puppet/services/neutron-plugin-nsx.yaml +++ b/puppet/services/neutron-plugin-nsx.yaml @@ -65,14 +65,14 @@ outputs: value: service_name: neutron_plugin_nsx config_settings: - neutron::plugins::nsx_v3::default_overlay_tz: {get_param: DefaultOverlayTz} - neutron::plugins::nsx_v3::default_tier0_router: {get_param: DefaultTier0Router} - neutron::plugins::nsx_v3::nsx_api_managers: {get_param: NsxApiManagers} - neutron::plugins::nsx_v3::nsx_api_user: {get_param: NsxApiUser} - neutron::plugins::nsx_v3::nsx_api_password: {get_param: NsxApiPassword} - neutron::plugins::nsx_v3::native_dhcp_metadata: {get_param: NativeDhcpMetadata} - neutron::plugins::nsx_v3::dhcp_profile_uuid: {get_param: DhcpProfileUuid} - neutron::plugins::nsx_v3::metadata_proxy_uuid: {get_param: MetadataProxyUuid} + neutron::plugins::nsx::default_overlay_tz: {get_param: DefaultOverlayTz} + neutron::plugins::nsx::default_tier0_router: {get_param: DefaultTier0Router} + neutron::plugins::nsx::nsx_api_managers: {get_param: NsxApiManagers} + neutron::plugins::nsx::nsx_api_user: {get_param: NsxApiUser} + neutron::plugins::nsx::nsx_api_password: {get_param: NsxApiPassword} + neutron::plugins::nsx::native_dhcp_metadata: {get_param: NativeDhcpMetadata} + neutron::plugins::nsx::dhcp_profile_uuid: {get_param: DhcpProfileUuid} + neutron::plugins::nsx::metadata_proxy_uuid: {get_param: MetadataProxyUuid} step_config: | - include tripleo::profile::base::neutron::plugins::nsx_v3 + include tripleo::profile::base::neutron::plugins::nsx diff --git a/puppet/services/nova-api.yaml b/puppet/services/nova-api.yaml index b413fb12..a4a3ca2b 100644 --- a/puppet/services/nova-api.yaml +++ b/puppet/services/nova-api.yaml @@ -199,88 +199,85 @@ outputs: metadata_settings: get_attr: [ApacheServiceBase, role_data, metadata_settings] upgrade_tasks: - yaql: - expression: $.data.apache_upgrade + $.data.nova_api_upgrade - data: - apache_upgrade: - get_attr: [ApacheServiceBase, role_data, upgrade_tasks] - nova_api_upgrade: - - name: get bootstrap nodeid - tags: common - command: hiera bootstrap_nodeid - register: bootstrap_node - - name: set is_bootstrap_node fact - tags: common - set_fact: is_bootstrap_node={{bootstrap_node.stdout|lower == ansible_hostname|lower}} - - name: Extra migration for nova tripleo/+bug/1656791 - tags: step0,pre-upgrade - when: is_bootstrap_node - command: nova-manage db online_data_migrations - - name: Stop and disable nova_api service (pre-upgrade not under httpd) - tags: step2 - service: name=openstack-nova-api state=stopped enabled=no - - name: Create puppet manifest to set transport_url in nova.conf - tags: step5 - when: is_bootstrap_node - copy: - dest: /root/nova-api_upgrade_manifest.pp - mode: 0600 - content: > - $transport_url = os_transport_url({ - 'transport' => hiera('messaging_service_name', 'rabbit'), - 'hosts' => any2array(hiera('rabbitmq_node_names', undef)), - 'port' => sprintf('%s',hiera('nova::rabbit_port', '5672') ), - 'username' => hiera('nova::rabbit_userid', 'guest'), - 'password' => hiera('nova::rabbit_password'), - 'ssl' => sprintf('%s', bool2num(str2bool(hiera('nova::rabbit_use_ssl', '0')))) - }) - oslo::messaging::default { 'nova_config': - transport_url => $transport_url - } - - name: Run puppet apply to set tranport_url in nova.conf - tags: step5 - when: is_bootstrap_node - command: puppet apply --modulepath /etc/puppet/modules:/opt/stack/puppet-modules:/usr/share/openstack-puppet/modules --detailed-exitcodes /root/nova-api_upgrade_manifest.pp - register: puppet_apply_nova_api_upgrade - failed_when: puppet_apply_nova_api_upgrade.rc not in [0,2] - changed_when: puppet_apply_nova_api_upgrade.rc == 2 - - name: Setup cell_v2 (map cell0) - tags: step5 - when: is_bootstrap_node - shell: nova-manage cell_v2 map_cell0 --database_connection=$(hiera nova::cell0_database_connection) - - name: Setup cell_v2 (create default cell) - tags: step5 - when: is_bootstrap_node - # (owalsh) puppet-nova expects the cell name 'default' - # (owalsh) pass the db uri explicitly to avoid https://bugs.launchpad.net/tripleo/+bug/1662344 - shell: nova-manage cell_v2 create_cell --name='default' --database_connection=$(hiera nova::database_connection) - register: nova_api_create_cell - failed_when: nova_api_create_cell.rc not in [0,2] - changed_when: nova_api_create_cell.rc == 0 - - name: Setup cell_v2 (sync nova/cell DB) - tags: step5 - when: is_bootstrap_node - command: nova-manage db sync - async: {get_param: NovaDbSyncTimeout} - poll: 10 - - name: Setup cell_v2 (get cell uuid) - tags: step5 - when: is_bootstrap_node - shell: nova-manage cell_v2 list_cells | sed -e '1,3d' -e '$d' | awk -F ' *| *' '$2 == "default" {print $4}' - register: nova_api_cell_uuid - - name: Setup cell_v2 (migrate hosts) - tags: step5 - when: is_bootstrap_node - command: nova-manage cell_v2 discover_hosts --cell_uuid {{nova_api_cell_uuid.stdout}} --verbose - - name: Setup cell_v2 (migrate instances) - tags: step5 - when: is_bootstrap_node - command: nova-manage cell_v2 map_instances --cell_uuid {{nova_api_cell_uuid.stdout}} - - name: Sync nova_api DB - tags: step5 - command: nova-manage api_db sync - when: is_bootstrap_node - - name: Online data migration for nova - tags: step5 - when: is_bootstrap_node - command: nova-manage db online_data_migrations + list_concat: + - get_attr: [ApacheServiceBase, role_data, upgrade_tasks] + - + - name: get bootstrap nodeid + tags: common + command: hiera bootstrap_nodeid + register: bootstrap_node + - name: set is_bootstrap_node fact + tags: common + set_fact: is_bootstrap_node={{bootstrap_node.stdout|lower == ansible_hostname|lower}} + - name: Extra migration for nova tripleo/+bug/1656791 + tags: step0,pre-upgrade + when: is_bootstrap_node + command: nova-manage db online_data_migrations + - name: Stop and disable nova_api service (pre-upgrade not under httpd) + tags: step2 + service: name=openstack-nova-api state=stopped enabled=no + - name: Create puppet manifest to set transport_url in nova.conf + tags: step5 + when: is_bootstrap_node + copy: + dest: /root/nova-api_upgrade_manifest.pp + mode: 0600 + content: > + $transport_url = os_transport_url({ + 'transport' => hiera('messaging_service_name', 'rabbit'), + 'hosts' => any2array(hiera('rabbitmq_node_names', undef)), + 'port' => sprintf('%s',hiera('nova::rabbit_port', '5672') ), + 'username' => hiera('nova::rabbit_userid', 'guest'), + 'password' => hiera('nova::rabbit_password'), + 'ssl' => sprintf('%s', bool2num(str2bool(hiera('nova::rabbit_use_ssl', '0')))) + }) + oslo::messaging::default { 'nova_config': + transport_url => $transport_url + } + - name: Run puppet apply to set tranport_url in nova.conf + tags: step5 + when: is_bootstrap_node + command: puppet apply --modulepath /etc/puppet/modules:/opt/stack/puppet-modules:/usr/share/openstack-puppet/modules --detailed-exitcodes /root/nova-api_upgrade_manifest.pp + register: puppet_apply_nova_api_upgrade + failed_when: puppet_apply_nova_api_upgrade.rc not in [0,2] + changed_when: puppet_apply_nova_api_upgrade.rc == 2 + - name: Setup cell_v2 (map cell0) + tags: step5 + when: is_bootstrap_node + shell: nova-manage cell_v2 map_cell0 --database_connection=$(hiera nova::cell0_database_connection) + - name: Setup cell_v2 (create default cell) + tags: step5 + when: is_bootstrap_node + # (owalsh) puppet-nova expects the cell name 'default' + # (owalsh) pass the db uri explicitly to avoid https://bugs.launchpad.net/tripleo/+bug/1662344 + shell: nova-manage cell_v2 create_cell --name='default' --database_connection=$(hiera nova::database_connection) + register: nova_api_create_cell + failed_when: nova_api_create_cell.rc not in [0,2] + changed_when: nova_api_create_cell.rc == 0 + - name: Setup cell_v2 (sync nova/cell DB) + tags: step5 + when: is_bootstrap_node + command: nova-manage db sync + async: {get_param: NovaDbSyncTimeout} + poll: 10 + - name: Setup cell_v2 (get cell uuid) + tags: step5 + when: is_bootstrap_node + shell: nova-manage cell_v2 list_cells | sed -e '1,3d' -e '$d' | awk -F ' *| *' '$2 == "default" {print $4}' + register: nova_api_cell_uuid + - name: Setup cell_v2 (migrate hosts) + tags: step5 + when: is_bootstrap_node + command: nova-manage cell_v2 discover_hosts --cell_uuid {{nova_api_cell_uuid.stdout}} --verbose + - name: Setup cell_v2 (migrate instances) + tags: step5 + when: is_bootstrap_node + command: nova-manage cell_v2 map_instances --cell_uuid {{nova_api_cell_uuid.stdout}} + - name: Sync nova_api DB + tags: step5 + command: nova-manage api_db sync + when: is_bootstrap_node + - name: Online data migration for nova + tags: step5 + when: is_bootstrap_node + command: nova-manage db online_data_migrations diff --git a/puppet/services/opendaylight-api.yaml b/puppet/services/opendaylight-api.yaml index 472dbcce..71536ff3 100644 --- a/puppet/services/opendaylight-api.yaml +++ b/puppet/services/opendaylight-api.yaml @@ -62,6 +62,14 @@ parameters: description: Whether to manage the OpenDaylight repository type: boolean default: false + OpenDaylightSNATMechanism: + description: SNAT mechanism to be used + default: 'conntrack' + type: string + constraints: + - allowed_values: + - conntrack + - controller outputs: role_data: @@ -84,6 +92,7 @@ outputs: - 6640 - 6653 - 2550 + opendaylight::snat_mechanism: {get_param: OpenDaylightSNATMechanism} step_config: | include tripleo::profile::base::neutron::opendaylight upgrade_tasks: diff --git a/puppet/services/opendaylight-ovs.yaml b/puppet/services/opendaylight-ovs.yaml index 139ab7c7..c1cec4ff 100644 --- a/puppet/services/opendaylight-ovs.yaml +++ b/puppet/services/opendaylight-ovs.yaml @@ -141,22 +141,19 @@ outputs: step_config: | include tripleo::profile::base::neutron::plugins::ovs::opendaylight upgrade_tasks: - yaql: - expression: $.data.ovs_upgrade + $.data.opendaylight_upgrade - data: - ovs_upgrade: - get_attr: [Ovs, role_data, upgrade_tasks] - opendaylight_upgrade: - - name: Check if openvswitch is deployed - command: systemctl is-enabled openvswitch - tags: common - ignore_errors: True - register: openvswitch_enabled - - name: "PreUpgrade step0,validation: Check service openvswitch is running" - shell: /usr/bin/systemctl show 'openvswitch' --property ActiveState | grep '\bactive\b' - when: openvswitch_enabled.rc == 0 - tags: step0,validation - - name: Stop openvswitch service - tags: step1 - when: openvswitch_enabled.rc == 0 - service: name=openvswitch state=stopped + list_concat: + - get_attr: [Ovs, role_data, upgrade_tasks] + - + - name: Check if openvswitch is deployed + command: systemctl is-enabled openvswitch + tags: common + ignore_errors: True + register: openvswitch_enabled + - name: "PreUpgrade step0,validation: Check service openvswitch is running" + shell: /usr/bin/systemctl show 'openvswitch' --property ActiveState | grep '\bactive\b' + when: openvswitch_enabled.rc == 0 + tags: step0,validation + - name: Stop openvswitch service + tags: step1 + when: openvswitch_enabled.rc == 0 + service: name=openvswitch state=stopped diff --git a/puppet/services/openvswitch.yaml b/puppet/services/openvswitch.yaml index d8061d4b..6479d7f9 100644 --- a/puppet/services/openvswitch.yaml +++ b/puppet/services/openvswitch.yaml @@ -179,6 +179,6 @@ outputs: with_items: - "{{ovs_list_of_rpms.stdout_lines}}" tags: step2 - when: "'2.5.0-14' in '{{ovs_version.stdout}}' + when: "'2.5.0-14' in ovs_version.stdout|default('') or - ovs_packaging_issue|succeeded" + ovs_packaging_issue|default(false)|succeeded" diff --git a/puppet/services/pacemaker/database/redis.yaml b/puppet/services/pacemaker/database/redis.yaml index 66eb4b2a..e466f304 100644 --- a/puppet/services/pacemaker/database/redis.yaml +++ b/puppet/services/pacemaker/database/redis.yaml @@ -53,5 +53,16 @@ outputs: - redis::service_manage: false redis::notify_service: false redis::managed_by_cluster_manager: true + tripleo::profile::pacemaker::database::redis::tls_proxy_bind_ip: + get_param: [ServiceNetMap, RedisNetwork] + tripleo::profile::pacemaker::database::redis::tls_proxy_fqdn: + str_replace: + template: + "%{hiera('fqdn_$NETWORK')}" + params: + $NETWORK: {get_param: [ServiceNetMap, RedisNetwork]} + tripleo::profile::pacemaker::database::redis::tls_proxy_port: 6379 step_config: | include ::tripleo::profile::pacemaker::database::redis + metadata_settings: + get_attr: [RedisBase, role_data, metadata_settings] diff --git a/puppet/services/panko-api.yaml b/puppet/services/panko-api.yaml index 74d3f27c..892ad1c1 100644 --- a/puppet/services/panko-api.yaml +++ b/puppet/services/panko-api.yaml @@ -112,27 +112,24 @@ outputs: metadata_settings: get_attr: [ApacheServiceBase, role_data, metadata_settings] upgrade_tasks: - yaql: - expression: $.data.apache_upgrade + $.data.panko_api_upgrade - data: - apache_upgrade: - get_attr: [ApacheServiceBase, role_data, upgrade_tasks] - panko_api_upgrade: - - name: Check if httpd is deployed - command: systemctl is-enabled httpd - tags: common - ignore_errors: True - register: httpd_enabled - - name: "PreUpgrade step0,validation: Check if httpd is running" - shell: > - /usr/bin/systemctl show 'httpd' --property ActiveState | - grep '\bactive\b' - when: httpd_enabled.rc == 0 - tags: step0,validation - - name: Stop panko-api service (running under httpd) - tags: step1 - service: name=httpd state=stopped - when: httpd_enabled.rc == 0 - - name: Install openstack-panko-api package if it was not installed - tags: step3 - yum: name=openstack-panko-api state=latest + list_concat: + - get_attr: [ApacheServiceBase, role_data, upgrade_tasks] + - + - name: Check if httpd is deployed + command: systemctl is-enabled httpd + tags: common + ignore_errors: True + register: httpd_enabled + - name: "PreUpgrade step0,validation: Check if httpd is running" + shell: > + /usr/bin/systemctl show 'httpd' --property ActiveState | + grep '\bactive\b' + when: httpd_enabled.rc == 0 + tags: step0,validation + - name: Stop panko-api service (running under httpd) + tags: step1 + service: name=httpd state=stopped + when: httpd_enabled.rc == 0 + - name: Install openstack-panko-api package if it was not installed + tags: step3 + yum: name=openstack-panko-api state=latest diff --git a/puppet/services/rabbitmq.yaml b/puppet/services/rabbitmq.yaml index ba3a0984..a1a60201 100644 --- a/puppet/services/rabbitmq.yaml +++ b/puppet/services/rabbitmq.yaml @@ -122,6 +122,7 @@ outputs: rabbitmq::interface: {get_param: [ServiceNetMap, RabbitmqNetwork]} rabbitmq::nr_ha_queues: {get_param: RabbitHAQueues} rabbitmq::ssl: {get_param: EnableInternalTLS} + rabbitmq::ssl_erl_dist: {get_param: EnableInternalTLS} rabbitmq::ssl_port: 5672 rabbitmq::ssl_depth: 1 rabbitmq::ssl_only: {get_param: EnableInternalTLS} diff --git a/puppet/services/zaqar-api.yaml b/puppet/services/zaqar-api.yaml index 82d105ef..71f90534 100644 --- a/puppet/services/zaqar-api.yaml +++ b/puppet/services/zaqar-api.yaml @@ -98,6 +98,7 @@ outputs: zaqar::keystone::authtoken::project_name: 'service' zaqar::keystone::authtoken::auth_url: {get_param: [EndpointMap, KeystoneInternal, uri_no_suffix]} zaqar::keystone::authtoken::auth_uri: {get_param: [EndpointMap, KeystoneInternal, uri]} + zaqar::keystone::trust::auth_url: {get_param: [EndpointMap, KeystoneInternal, uri_no_suffix]} zaqar::debug: if: - service_debug_unset @@ -164,6 +165,8 @@ outputs: zaqar::keystone::auth_websocket::internal_url: {get_param: [EndpointMap, ZaqarWebSocketInternal, uri]} zaqar::keystone::auth_websocket::region: {get_param: KeystoneRegion} zaqar::keystone::auth_websocket::tenant: 'service' + zaqar::keystone::trust::password: {get_param: ZaqarPassword} + zaqar::keystone::trust::user_domain_name: 'Default' - if: - zaqar_management_store_sqlalchemy @@ -181,37 +184,34 @@ outputs: metadata_settings: get_attr: [ApacheServiceBase, role_data, metadata_settings] upgrade_tasks: - yaql: - expression: $.data.apache_upgrade + $.data.zaqar_upgrade - data: - apache_upgrade: - get_attr: [ApacheServiceBase, role_data, upgrade_tasks] - zaqar_upgrade: - - name: Check if zaqar is deployed - command: systemctl is-enabled openstack-zaqar - tags: common - ignore_errors: True - register: zaqar_enabled - - name: "PreUpgrade step0,validation: Check if openstack-zaqar is running" - shell: > - /usr/bin/systemctl show 'openstack-zaqar' --property ActiveState | - grep '\bactive\b' - when: zaqar_enabled.rc == 0 - tags: step0,validation - - name: Check for zaqar running under apache (post upgrade) - tags: step1 - shell: "httpd -t -D DUMP_VHOSTS | grep -q zaqar_wsgi" - register: zaqar_apache - ignore_errors: true - - name: Stop zaqar service (running under httpd) - tags: step1 - service: name=httpd state=stopped - when: zaqar_apache.rc == 0 - - name: Stop and disable zaqar service (pre-upgrade not under httpd) - tags: step1 - when: zaqar_enabled.rc == 0 - service: name=openstack-zaqar state=stopped enabled=no - - name: Install openstack-zaqar package if it was disabled - tags: step3 - yum: name=openstack-zaqar state=latest - when: zaqar_enabled.rc != 0 + list_concat: + - get_attr: [ApacheServiceBase, role_data, upgrade_tasks] + - + - name: Check if zaqar is deployed + command: systemctl is-enabled openstack-zaqar + tags: common + ignore_errors: True + register: zaqar_enabled + - name: "PreUpgrade step0,validation: Check if openstack-zaqar is running" + shell: > + /usr/bin/systemctl show 'openstack-zaqar' --property ActiveState | + grep '\bactive\b' + when: zaqar_enabled.rc == 0 + tags: step0,validation + - name: Check for zaqar running under apache (post upgrade) + tags: step1 + shell: "httpd -t -D DUMP_VHOSTS | grep -q zaqar_wsgi" + register: zaqar_apache + ignore_errors: true + - name: Stop zaqar service (running under httpd) + tags: step1 + service: name=httpd state=stopped + when: zaqar_apache.rc == 0 + - name: Stop and disable zaqar service (pre-upgrade not under httpd) + tags: step1 + when: zaqar_enabled.rc == 0 + service: name=openstack-zaqar state=stopped enabled=no + - name: Install openstack-zaqar package if it was disabled + tags: step3 + yum: name=openstack-zaqar state=latest + when: zaqar_enabled.rc != 0 diff --git a/releasenotes/notes/configuring-snat-in-opendaylight-d5ed4d62275e1876.yaml b/releasenotes/notes/configuring-snat-in-opendaylight-d5ed4d62275e1876.yaml new file mode 100644 index 00000000..31564e09 --- /dev/null +++ b/releasenotes/notes/configuring-snat-in-opendaylight-d5ed4d62275e1876.yaml @@ -0,0 +1,5 @@ +--- +features: + - | + Configure OpenDaylight SNAT to use conntrack mechanism with OVS and controller + based mechanism with OVS-DPDK. diff --git a/releasenotes/notes/fix-neutron_admin_auth_url-c88224251d8eb807.yaml b/releasenotes/notes/fix-neutron_admin_auth_url-c88224251d8eb807.yaml new file mode 100644 index 00000000..fa4074b1 --- /dev/null +++ b/releasenotes/notes/fix-neutron_admin_auth_url-c88224251d8eb807.yaml @@ -0,0 +1,4 @@ +--- +fixes: + - The "neutron_admin_auth_url" is now properly set using KeystoneInternal + rather than using the NeutronAdmin endpoint. diff --git a/releasenotes/notes/ipv6_defaults-7dbb62113f4e5084.yaml b/releasenotes/notes/ipv6_defaults-7dbb62113f4e5084.yaml new file mode 100644 index 00000000..bbc67563 --- /dev/null +++ b/releasenotes/notes/ipv6_defaults-7dbb62113f4e5084.yaml @@ -0,0 +1,10 @@ +--- +other: + - | + Network templates are now rendered with jinja2 based on network_data.yaml. + The only required parameter for each network is the name, optional params + will populate the defaults in the network template. Network templates + will be generated for both IPv4 and IPv6 versions of the networks, setting + ipv6: true on the network will generate only IPv6 templates. An example for + overriding default IP addresses for IPv6 has been added in + environments/network-environment-v6.yaml. diff --git a/releasenotes/notes/isilon_manila_e9677898724a11e7.yaml b/releasenotes/notes/isilon_manila_e9677898724a11e7.yaml new file mode 100644 index 00000000..8eb50b8f --- /dev/null +++ b/releasenotes/notes/isilon_manila_e9677898724a11e7.yaml @@ -0,0 +1,4 @@ +--- +features: + - | + Add support for Dell EMC Isilon manila driver diff --git a/releasenotes/notes/vmax_cinder_a6672898724a11e7.yaml b/releasenotes/notes/vmax_cinder_a6672898724a11e7.yaml new file mode 100644 index 00000000..e6eb7497 --- /dev/null +++ b/releasenotes/notes/vmax_cinder_a6672898724a11e7.yaml @@ -0,0 +1,4 @@ +--- +features: + - | + Add support for Dell EMC VMAX Iscsi cinder driver diff --git a/releasenotes/notes/vmax_manila_2967789872aa11e8.yaml b/releasenotes/notes/vmax_manila_2967789872aa11e8.yaml new file mode 100644 index 00000000..9f2a7a64 --- /dev/null +++ b/releasenotes/notes/vmax_manila_2967789872aa11e8.yaml @@ -0,0 +1,4 @@ +--- +features: + - | + Add support for Dell EMC VMAX Manila driver diff --git a/roles/Controller.yaml b/roles/Controller.yaml index 8f5e0cc8..88e4dfed 100644 --- a/roles/Controller.yaml +++ b/roles/Controller.yaml @@ -47,6 +47,7 @@ - OS::TripleO::Services::CinderBackendDellPs - OS::TripleO::Services::CinderBackendDellSc - OS::TripleO::Services::CinderBackendDellEMCUnity + - OS::TripleO::Services::CinderBackendDellEMCVMAXISCSI - OS::TripleO::Services::CinderBackendNetApp - OS::TripleO::Services::CinderBackendScaleIO - OS::TripleO::Services::CinderBackendVRTSHyperScale @@ -81,9 +82,11 @@ - OS::TripleO::Services::ManilaApi - OS::TripleO::Services::ManilaBackendCephFs - OS::TripleO::Services::ManilaBackendGeneric + - OS::TripleO::Services::ManilaBackendIsilon - OS::TripleO::Services::ManilaBackendNetapp - OS::TripleO::Services::ManilaBackendUnity - OS::TripleO::Services::ManilaBackendVNX + - OS::TripleO::Services::ManilaBackendVMAX - OS::TripleO::Services::ManilaScheduler - OS::TripleO::Services::ManilaShare - OS::TripleO::Services::Memcached diff --git a/roles/ControllerOpenstack.yaml b/roles/ControllerOpenstack.yaml index c2130011..cc497822 100644 --- a/roles/ControllerOpenstack.yaml +++ b/roles/ControllerOpenstack.yaml @@ -66,9 +66,11 @@ - OS::TripleO::Services::ManilaApi - OS::TripleO::Services::ManilaBackendCephFs - OS::TripleO::Services::ManilaBackendGeneric + - OS::TripleO::Services::ManilaBackendIsilon - OS::TripleO::Services::ManilaBackendNetapp - OS::TripleO::Services::ManilaBackendUnity - OS::TripleO::Services::ManilaBackendVNX + - OS::TripleO::Services::ManilaBackendVMAX - OS::TripleO::Services::ManilaScheduler - OS::TripleO::Services::ManilaShare - OS::TripleO::Services::Memcached diff --git a/roles_data.yaml b/roles_data.yaml index dcb66af3..1cdaf262 100644 --- a/roles_data.yaml +++ b/roles_data.yaml @@ -50,6 +50,7 @@ - OS::TripleO::Services::CinderBackendDellPs - OS::TripleO::Services::CinderBackendDellSc - OS::TripleO::Services::CinderBackendDellEMCUnity + - OS::TripleO::Services::CinderBackendDellEMCVMAXISCSI - OS::TripleO::Services::CinderBackendNetApp - OS::TripleO::Services::CinderBackendScaleIO - OS::TripleO::Services::CinderBackendVRTSHyperScale @@ -84,9 +85,11 @@ - OS::TripleO::Services::ManilaApi - OS::TripleO::Services::ManilaBackendCephFs - OS::TripleO::Services::ManilaBackendGeneric + - OS::TripleO::Services::ManilaBackendIsilon - OS::TripleO::Services::ManilaBackendNetapp - OS::TripleO::Services::ManilaBackendUnity - OS::TripleO::Services::ManilaBackendVNX + - OS::TripleO::Services::ManilaBackendVMAX - OS::TripleO::Services::ManilaScheduler - OS::TripleO::Services::ManilaShare - OS::TripleO::Services::Memcached diff --git a/sample-env-generator/ssl.yaml b/sample-env-generator/ssl.yaml index 6963e842..43a1afc1 100644 --- a/sample-env-generator/ssl.yaml +++ b/sample-env-generator/ssl.yaml @@ -22,6 +22,40 @@ environments: The contents of the private key go here resource_registry: OS::TripleO::NodeTLSData: ../../puppet/extraconfig/tls/tls-cert-inject.yaml + - + name: ssl/enable-internal-tls + title: Enable SSL on OpenStack Internal Endpoints + description: | + A Heat environment file which can be used to enable TLS for the internal + network via certmonger + files: + puppet/all-nodes-config.yaml: + parameters: + - EnableInternalTLS + puppet/services/nova-base.yaml: + parameters: + - RabbitClientUseSSL + overcloud.yaml: + parameters: + - ServerMetadata + static: + - EnableInternalTLS + - RabbitClientUseSSL + - ServerMetadata + sample_values: + EnableInternalTLS: True + RabbitClientUseSSL: True + ServerMetadata: |-2 + + ipa_enroll: True + resource_registry: + OS::TripleO::Services::CertmongerUser: ../puppet/services/certmonger-user.yaml + OS::TripleO::Services::HAProxyInternalTLS: ../puppet/services/haproxy-internal-tls-certmonger.yaml + # We use apache as a TLS proxy + OS::TripleO::Services::TLSProxyBase: ../puppet/services/apache.yaml + # Creates nova metadata that will create the extra service principals per + # node. + OS::TripleO::ServiceServerMetadataHook: ../extraconfig/nova_metadata/krb-service-principals.yaml - name: ssl/inject-trust-anchor title: Inject SSL Trust Anchor on Overcloud Nodes description: | @@ -91,39 +125,6 @@ environments: CongressAdmin: {protocol: 'http', port: '1789', host: 'IP_ADDRESS'} CongressInternal: {protocol: 'http', port: '1789', host: 'IP_ADDRESS'} CongressPublic: {protocol: 'https', port: '13789', host: 'IP_ADDRESS'} - ContrailAnalyticsApiAdmin: {protocol: 'http', port: '8081', host: 'IP_ADDRESS'} - ContrailAnalyticsApiInternal: {protocol: 'http', port: '8081', host: 'IP_ADDRESS'} - ContrailAnalyticsApiPublic: {protocol: 'http', port: '8081', host: 'IP_ADDRESS'} - ContrailAnalyticsCollectorHttpAdmin: {protocol: 'http', port: '8089', - host: 'IP_ADDRESS'} - ContrailAnalyticsCollectorHttpInternal: {protocol: 'http', port: '8089', - host: 'IP_ADDRESS'} - ContrailAnalyticsCollectorHttpPublic: {protocol: 'http', port: '8089', - host: 'IP_ADDRESS'} - ContrailAnalyticsCollectorSandeshAdmin: {protocol: 'http', port: '8086', - host: 'IP_ADDRESS'} - ContrailAnalyticsCollectorSandeshInternal: {protocol: 'http', port: '8086', - host: 'IP_ADDRESS'} - ContrailAnalyticsCollectorSandeshPublic: {protocol: 'http', port: '8086', - host: 'IP_ADDRESS'} - ContrailAnalyticsHttpAdmin: {protocol: 'http', port: '8090', host: 'IP_ADDRESS'} - ContrailAnalyticsHttpInternal: {protocol: 'http', port: '8090', host: 'IP_ADDRESS'} - ContrailAnalyticsHttpPublic: {protocol: 'http', port: '8090', host: 'IP_ADDRESS'} - ContrailAnalyticsRedisAdmin: {protocol: 'http', port: '6379', host: 'IP_ADDRESS'} - ContrailAnalyticsRedisInternal: {protocol: 'http', port: '6379', host: 'IP_ADDRESS'} - ContrailAnalyticsRedisPublic: {protocol: 'http', port: '6379', host: 'IP_ADDRESS'} - ContrailConfigAdmin: {protocol: 'http', port: '8082', host: 'IP_ADDRESS'} - ContrailConfigInternal: {protocol: 'http', port: '8082', host: 'IP_ADDRESS'} - ContrailConfigPublic: {protocol: 'http', port: '8082', host: 'IP_ADDRESS'} - ContrailDiscoveryAdmin: {protocol: 'http', port: '5998', host: 'IP_ADDRESS'} - ContrailDiscoveryInternal: {protocol: 'http', port: '5998', host: 'IP_ADDRESS'} - ContrailDiscoveryPublic: {protocol: 'http', port: '5998', host: 'IP_ADDRESS'} - ContrailWebuiHttpAdmin: {protocol: 'http', port: '8080', host: 'IP_ADDRESS'} - ContrailWebuiHttpInternal: {protocol: 'http', port: '8080', host: 'IP_ADDRESS'} - ContrailWebuiHttpPublic: {protocol: 'http', port: '8080', host: 'IP_ADDRESS'} - ContrailWebuiHttpsAdmin: {protocol: 'http', port: '8143', host: 'IP_ADDRESS'} - ContrailWebuiHttpsInternal: {protocol: 'http', port: '8143', host: 'IP_ADDRESS'} - ContrailWebuiHttpsPublic: {protocol: 'http', port: '8143', host: 'IP_ADDRESS'} Ec2ApiAdmin: {protocol: 'http', port: '8788', host: 'IP_ADDRESS'} Ec2ApiInternal: {protocol: 'http', port: '8788', host: 'IP_ADDRESS'} Ec2ApiPublic: {protocol: 'https', port: '13788', host: 'IP_ADDRESS'} @@ -225,39 +226,6 @@ environments: CongressAdmin: {protocol: 'http', port: '1789', host: 'IP_ADDRESS'} CongressInternal: {protocol: 'http', port: '1789', host: 'IP_ADDRESS'} CongressPublic: {protocol: 'https', port: '13789', host: 'CLOUDNAME'} - ContrailAnalyticsApiAdmin: {protocol: 'http', port: '8081', host: 'IP_ADDRESS'} - ContrailAnalyticsApiInternal: {protocol: 'http', port: '8081', host: 'IP_ADDRESS'} - ContrailAnalyticsApiPublic: {protocol: 'http', port: '8081', host: 'IP_ADDRESS'} - ContrailAnalyticsCollectorHttpAdmin: {protocol: 'http', port: '8089', - host: 'IP_ADDRESS'} - ContrailAnalyticsCollectorHttpInternal: {protocol: 'http', port: '8089', - host: 'IP_ADDRESS'} - ContrailAnalyticsCollectorHttpPublic: {protocol: 'http', port: '8089', - host: 'IP_ADDRESS'} - ContrailAnalyticsCollectorSandeshAdmin: {protocol: 'http', port: '8086', - host: 'IP_ADDRESS'} - ContrailAnalyticsCollectorSandeshInternal: {protocol: 'http', port: '8086', - host: 'IP_ADDRESS'} - ContrailAnalyticsCollectorSandeshPublic: {protocol: 'http', port: '8086', - host: 'IP_ADDRESS'} - ContrailAnalyticsHttpAdmin: {protocol: 'http', port: '8090', host: 'IP_ADDRESS'} - ContrailAnalyticsHttpInternal: {protocol: 'http', port: '8090', host: 'IP_ADDRESS'} - ContrailAnalyticsHttpPublic: {protocol: 'http', port: '8090', host: 'IP_ADDRESS'} - ContrailAnalyticsRedisAdmin: {protocol: 'http', port: '6379', host: 'IP_ADDRESS'} - ContrailAnalyticsRedisInternal: {protocol: 'http', port: '6379', host: 'IP_ADDRESS'} - ContrailAnalyticsRedisPublic: {protocol: 'http', port: '6379', host: 'IP_ADDRESS'} - ContrailConfigAdmin: {protocol: 'http', port: '8082', host: 'IP_ADDRESS'} - ContrailConfigInternal: {protocol: 'http', port: '8082', host: 'IP_ADDRESS'} - ContrailConfigPublic: {protocol: 'http', port: '8082', host: 'IP_ADDRESS'} - ContrailDiscoveryAdmin: {protocol: 'http', port: '5998', host: 'IP_ADDRESS'} - ContrailDiscoveryInternal: {protocol: 'http', port: '5998', host: 'IP_ADDRESS'} - ContrailDiscoveryPublic: {protocol: 'http', port: '5998', host: 'IP_ADDRESS'} - ContrailWebuiHttpAdmin: {protocol: 'http', port: '8080', host: 'IP_ADDRESS'} - ContrailWebuiHttpInternal: {protocol: 'http', port: '8080', host: 'IP_ADDRESS'} - ContrailWebuiHttpPublic: {protocol: 'http', port: '8080', host: 'IP_ADDRESS'} - ContrailWebuiHttpsAdmin: {protocol: 'http', port: '8143', host: 'IP_ADDRESS'} - ContrailWebuiHttpsInternal: {protocol: 'http', port: '8143', host: 'IP_ADDRESS'} - ContrailWebuiHttpsPublic: {protocol: 'http', port: '8143', host: 'IP_ADDRESS'} Ec2ApiAdmin: {protocol: 'http', port: '8788', host: 'IP_ADDRESS'} Ec2ApiInternal: {protocol: 'http', port: '8788', host: 'IP_ADDRESS'} Ec2ApiPublic: {protocol: 'https', port: '13788', host: 'CLOUDNAME'} @@ -359,39 +327,6 @@ environments: CongressAdmin: {protocol: 'https', port: '1789', host: 'CLOUDNAME'} CongressInternal: {protocol: 'https', port: '1789', host: 'CLOUDNAME'} CongressPublic: {protocol: 'https', port: '13789', host: 'CLOUDNAME'} - ContrailAnalyticsApiAdmin: {protocol: 'http', port: '8081', host: 'IP_ADDRESS'} - ContrailAnalyticsApiInternal: {protocol: 'http', port: '8081', host: 'IP_ADDRESS'} - ContrailAnalyticsApiPublic: {protocol: 'http', port: '8081', host: 'IP_ADDRESS'} - ContrailAnalyticsCollectorHttpAdmin: {protocol: 'http', port: '8089', - host: 'IP_ADDRESS'} - ContrailAnalyticsCollectorHttpInternal: {protocol: 'http', port: '8089', - host: 'IP_ADDRESS'} - ContrailAnalyticsCollectorHttpPublic: {protocol: 'http', port: '8089', - host: 'IP_ADDRESS'} - ContrailAnalyticsCollectorSandeshAdmin: {protocol: 'http', port: '8086', - host: 'IP_ADDRESS'} - ContrailAnalyticsCollectorSandeshInternal: {protocol: 'http', port: '8086', - host: 'IP_ADDRESS'} - ContrailAnalyticsCollectorSandeshPublic: {protocol: 'http', port: '8086', - host: 'IP_ADDRESS'} - ContrailAnalyticsHttpAdmin: {protocol: 'http', port: '8090', host: 'IP_ADDRESS'} - ContrailAnalyticsHttpInternal: {protocol: 'http', port: '8090', host: 'IP_ADDRESS'} - ContrailAnalyticsHttpPublic: {protocol: 'http', port: '8090', host: 'IP_ADDRESS'} - ContrailAnalyticsRedisAdmin: {protocol: 'http', port: '6379', host: 'IP_ADDRESS'} - ContrailAnalyticsRedisInternal: {protocol: 'http', port: '6379', host: 'IP_ADDRESS'} - ContrailAnalyticsRedisPublic: {protocol: 'http', port: '6379', host: 'IP_ADDRESS'} - ContrailConfigAdmin: {protocol: 'http', port: '8082', host: 'IP_ADDRESS'} - ContrailConfigInternal: {protocol: 'http', port: '8082', host: 'IP_ADDRESS'} - ContrailConfigPublic: {protocol: 'http', port: '8082', host: 'IP_ADDRESS'} - ContrailDiscoveryAdmin: {protocol: 'http', port: '5998', host: 'IP_ADDRESS'} - ContrailDiscoveryInternal: {protocol: 'http', port: '5998', host: 'IP_ADDRESS'} - ContrailDiscoveryPublic: {protocol: 'http', port: '5998', host: 'IP_ADDRESS'} - ContrailWebuiHttpAdmin: {protocol: 'http', port: '8080', host: 'IP_ADDRESS'} - ContrailWebuiHttpInternal: {protocol: 'http', port: '8080', host: 'IP_ADDRESS'} - ContrailWebuiHttpPublic: {protocol: 'http', port: '8080', host: 'IP_ADDRESS'} - ContrailWebuiHttpsAdmin: {protocol: 'http', port: '8143', host: 'IP_ADDRESS'} - ContrailWebuiHttpsInternal: {protocol: 'http', port: '8143', host: 'IP_ADDRESS'} - ContrailWebuiHttpsPublic: {protocol: 'http', port: '8143', host: 'IP_ADDRESS'} Ec2ApiAdmin: {protocol: 'https', port: '8788', host: 'CLOUDNAME'} Ec2ApiInternal: {protocol: 'https', port: '8788', host: 'CLOUDNAME'} Ec2ApiPublic: {protocol: 'https', port: '13788', host: 'CLOUDNAME'} diff --git a/test-requirements.txt b/test-requirements.txt index 1b60459c..6ba8e178 100644 --- a/test-requirements.txt +++ b/test-requirements.txt @@ -1,7 +1,7 @@ # The order of packages is significant, because pip processes them in the order # of appearance. Changing the order has an impact on the overall integration # process, which may cause wedges in the gate later. -openstackdocstheme>=1.11.0 # Apache-2.0 +openstackdocstheme>=1.16.0 # Apache-2.0 PyYAML>=3.10.0 # MIT Jinja2!=2.9.0,!=2.9.1,!=2.9.2,!=2.9.3,!=2.9.4,>=2.8 # BSD License (3 clause) six>=1.9.0 # MIT diff --git a/tools/yaml-validate.py b/tools/yaml-validate.py index a096d69a..682cb8df 100755 --- a/tools/yaml-validate.py +++ b/tools/yaml-validate.py @@ -105,7 +105,7 @@ PARAMETER_DEFINITION_EXCLUSIONS = {'ManagementNetCidr': ['default'], 'ControllerExtraConfig': ['description'], 'NovaComputeExtraConfig': ['description'], 'controllerExtraConfig': ['description'], - 'DockerSwiftConfigImage': ['default'], + 'DockerSwiftConfigImage': ['default'] } PREFERRED_CAMEL_CASE = { diff --git a/tripleo_heat_templates/environment_generator.py b/tripleo_heat_templates/environment_generator.py index f1469390..e13690dd 100755 --- a/tripleo_heat_templates/environment_generator.py +++ b/tripleo_heat_templates/environment_generator.py @@ -159,7 +159,7 @@ def _generate_environment(input_env, parent_env=None): for line in env_desc.splitlines(): env_file.write(u'# %s\n' % line) - if parameter_defaults: + if parameter_defaults or static_defaults: env_file.write(u'parameter_defaults:\n') for name, value in sorted(parameter_defaults.items()): write_sample_entry(env_file, name, value) |