diff options
128 files changed, 1157 insertions, 185 deletions
diff --git a/ci/common/net-config-multinode-os-net-config.yaml b/ci/common/net-config-multinode-os-net-config.yaml index 9d45a9ff..316862ee 100644 --- a/ci/common/net-config-multinode-os-net-config.yaml +++ b/ci/common/net-config-multinode-os-net-config.yaml @@ -56,14 +56,14 @@ resources: function network_config_hook { primary_private_ip=$(cat /etc/nodepool/primary_node_private) sed -i "s/primary_private_ip/$primary_private_ip/" /etc/os-net-config/config.json - subnode_private_ip=$(cat /etc/nodepool/node_private) + subnode_private_ip=$(cat /etc/nodepool/sub_nodes_private) sed -i "s/subnode_private_ip/$subnode_private_ip/" /etc/os-net-config/config.json # We start with an arbitrarily high vni key so that we don't # overlap with Neutron created values. These will also match the # values that we've been using previously from the devstack-gate # code. vni=1000002 - subnode_index=$(grep -n $(cat /etc/nodepool/node_private) /etc/nodepool/sub_nodes_private | cut -d: -f1) + subnode_index=$(grep -n $(cat /etc/nodepool/sub_nodes_private) /etc/nodepool/sub_nodes_private | cut -d: -f1) let vni+=$subnode_index sed -i "s/vni/$vni/" /etc/os-net-config/config.json export interface_name="br-ex_$primary_private_ip" diff --git a/ci/environments/multinode-containers.yaml b/ci/environments/multinode-containers.yaml index 781527f4..7f0d6221 100644 --- a/ci/environments/multinode-containers.yaml +++ b/ci/environments/multinode-containers.yaml @@ -65,6 +65,9 @@ parameter_defaults: #http://docs.ceph.com/docs/jewel/rados/configuration/filesystem-recommendations/ ceph::profile::params::osd_max_object_name_len: 256 ceph::profile::params::osd_max_object_namespace_len: 64 + #NOTE(gfidente): necessary when deploying a single OSD + ceph::profile::params::osd_pool_default_pg_num: 32 + ceph::profile::params::osd_pool_default_pgp_num: 32 SwiftCeilometerPipelineEnabled: False Debug: True NotificationDriver: 'noop' diff --git a/ci/environments/multinode.yaml b/ci/environments/multinode.yaml index eeeefc07..b939e377 100644 --- a/ci/environments/multinode.yaml +++ b/ci/environments/multinode.yaml @@ -67,6 +67,9 @@ parameter_defaults: #http://docs.ceph.com/docs/jewel/rados/configuration/filesystem-recommendations/ ceph::profile::params::osd_max_object_name_len: 256 ceph::profile::params::osd_max_object_namespace_len: 64 + #NOTE(gfidente): necessary when deploying a single OSD + ceph::profile::params::osd_pool_default_pg_num: 32 + ceph::profile::params::osd_pool_default_pgp_num: 32 SwiftCeilometerPipelineEnabled: False Debug: True NotificationDriver: 'noop' diff --git a/ci/environments/scenario001-multinode-containers.yaml b/ci/environments/scenario001-multinode-containers.yaml index 01c27a95..cbbc5216 100644 --- a/ci/environments/scenario001-multinode-containers.yaml +++ b/ci/environments/scenario001-multinode-containers.yaml @@ -13,7 +13,9 @@ resource_registry: OS::TripleO::Services::PankoApi: ../../docker/services/panko-api.yaml OS::TripleO::Services::Collectd: ../../docker/services/collectd.yaml OS::TripleO::Services::Congress: ../../docker/services/congress.yaml - # TODO fluentd is being containerized: https://review.openstack.org/#/c/467072/ + # FIXME(mandre) fluentd container image missing from tripleomaster registry + # https://bugs.launchpad.net/tripleo/+bug/1721723 + # OS::TripleO::Services::FluentdClient: ../../docker/services/fluentd-client.yaml OS::TripleO::Services::FluentdClient: ../../puppet/services/logging/fluentd-client.yaml OS::TripleO::Services::SensuClient: ../../docker/services/sensu-client.yaml # Some infra instances don't pass the ping test but are otherwise working. @@ -118,7 +120,7 @@ parameter_defaults: CephAdminKey: 'AQDLOh1VgEp6FRAAFzT7Zw+Y9V6JJExQAsRnRQ==' CephClientKey: 'AQC+vYNXgDAgAhAAc8UoYt+OTz5uhV7ItLdwUw==' CephPoolDefaultSize: 1 - DockerCephDaemonImage: ceph/daemon:tag-build-master-jewel-centos-7 + DockerCephDaemonImage: ceph/daemon:tag-build-ceph-dfg-jewel-centos-7 NovaEnableRbdBackend: true CinderEnableRbdBackend: true CinderBackupBackend: ceph diff --git a/ci/environments/scenario001-multinode.yaml b/ci/environments/scenario001-multinode.yaml index a9fbdfb7..177b73c0 100644 --- a/ci/environments/scenario001-multinode.yaml +++ b/ci/environments/scenario001-multinode.yaml @@ -103,6 +103,9 @@ parameter_defaults: ExtraConfig: ceph::profile::params::osd_max_object_name_len: 256 ceph::profile::params::osd_max_object_namespace_len: 64 + #NOTE(gfidente): necessary when deploying a single OSD + ceph::profile::params::osd_pool_default_pg_num: 32 + ceph::profile::params::osd_pool_default_pgp_num: 32 #NOTE: These ID's and keys should be regenerated for # a production deployment. What is here is suitable for # developer and CI testing only. diff --git a/ci/environments/scenario004-multinode-containers.yaml b/ci/environments/scenario004-multinode-containers.yaml index 4b647925..7eb9813e 100644 --- a/ci/environments/scenario004-multinode-containers.yaml +++ b/ci/environments/scenario004-multinode-containers.yaml @@ -98,6 +98,9 @@ parameter_defaults: ExtraConfig: ceph::profile::params::osd_max_object_name_len: 256 ceph::profile::params::osd_max_object_namespace_len: 64 + #NOTE(gfidente): necessary when deploying a single OSD + ceph::profile::params::osd_pool_default_pg_num: 32 + ceph::profile::params::osd_pool_default_pgp_num: 32 #NOTE: These ID's and keys should be regenerated for # a production deployment. What is here is suitable for # developer and CI testing only. diff --git a/ci/environments/scenario004-multinode.yaml b/ci/environments/scenario004-multinode.yaml index a81f05e1..0dfeb63a 100644 --- a/ci/environments/scenario004-multinode.yaml +++ b/ci/environments/scenario004-multinode.yaml @@ -89,6 +89,9 @@ parameter_defaults: ExtraConfig: ceph::profile::params::osd_max_object_name_len: 256 ceph::profile::params::osd_max_object_namespace_len: 64 + #NOTE(gfidente): necessary when deploying a single OSD + ceph::profile::params::osd_pool_default_pg_num: 32 + ceph::profile::params::osd_pool_default_pgp_num: 32 #NOTE: These ID's and keys should be regenerated for # a production deployment. What is here is suitable for # developer and CI testing only. diff --git a/common/deploy-steps.j2 b/common/deploy-steps.j2 index c076a09d..a1bd8826 100644 --- a/common/deploy-steps.j2 +++ b/common/deploy-steps.j2 @@ -4,6 +4,9 @@ # On upgrade certain roles can be disabled for operator driven upgrades # See major_upgrade_steps.j2.yaml and post-upgrade.j2.yaml {%- set enabled_roles = roles -%} + {%- set is_upgrade = false -%} +{%- else %} + {%- set is_upgrade = true -%} {%- endif -%} {%- set primary_role = [enabled_roles[0]] -%} {%- for role in enabled_roles -%} @@ -189,7 +192,11 @@ resources: tasks: # Join host_prep_tasks with the other per-host configuration list_concat: +{%- if is_upgrade|default(false) and role.disable_upgrade_deployment|default(false) %} + - [] +{%- else %} - {get_param: [role_data, {{role.name}}, host_prep_tasks]} +{%- endif %} - {%- raw %} # Write the manifest for baremetal puppet configuration diff --git a/docker/services/README.rst b/docker/services/README.rst index ce255ba8..a843efc3 100644 --- a/docker/services/README.rst +++ b/docker/services/README.rst @@ -124,3 +124,24 @@ Steps correlate to the following: 5) Service activation (Pacemaker) a) step 5 baremetal b) step 5 containers + +Update steps: +------------- + +All services have an associated update_tasks output that is an ansible +snippet that will be run during update in an rolling update that is +expected to run in a rolling update fashion (one node at a time) + +For Controller (where pacemaker is running) we have the following states: + 1. Step=1: stop the cluster on the updated node; + 2. Step=2: Pull the latest image and retag the it pcmklatest + 3. Step=3: yum upgrade happens on the host. + 4. Step=4: Restart the cluster on the node + 5. Step=5: Verification: + Currently we test that the pacemaker services are running. + +Then the usual deploy steps are run which pull in the latest image for +all containerized services and the updated configuration if any. + +Note: as pacemaker is not containerized, the points 1 and 4 happen in +puppet/services/pacemaker.yaml. diff --git a/docker/services/aodh-api.yaml b/docker/services/aodh-api.yaml index 49c5f9c5..9445069b 100644 --- a/docker/services/aodh-api.yaml +++ b/docker/services/aodh-api.yaml @@ -39,6 +39,10 @@ parameters: EnableInternalTLS: type: boolean default: false + UpgradeRemoveUnusedPackages: + default: false + description: Remove package if the service is being disabled during upgrade + type: boolean conditions: @@ -70,6 +74,8 @@ outputs: map_merge: - get_attr: [AodhApiPuppetBase, role_data, config_settings] - apache::default_vhost: false + logging_source: {get_attr: [AodhApiPuppetBase, role_data, logging_source]} + logging_groups: {get_attr: [AodhApiPuppetBase, role_data, logging_groups]} step_config: &step_config list_join: - "\n" @@ -158,5 +164,10 @@ outputs: - name: Stop and disable aodh service (running under httpd) tags: step2 service: name=httpd state=stopped enabled=no + - name: Remove openstack-aodh-api package if operator requests it + yum: name=openstack-aodh-api state=removed + tags: step2 + ignore_errors: True + when: {get_param: UpgradeRemoveUnusedPackages} metadata_settings: get_attr: [AodhApiPuppetBase, role_data, metadata_settings] diff --git a/docker/services/aodh-evaluator.yaml b/docker/services/aodh-evaluator.yaml index 86bdfdf9..fda6faa2 100644 --- a/docker/services/aodh-evaluator.yaml +++ b/docker/services/aodh-evaluator.yaml @@ -36,6 +36,10 @@ parameters: default: {} description: Parameters specific to the role type: json + UpgradeRemoveUnusedPackages: + default: false + description: Remove package if the service is being disabled during upgrade + type: boolean resources: @@ -63,6 +67,8 @@ outputs: config_settings: map_merge: - get_attr: [AodhEvaluatorBase, role_data, config_settings] + logging_source: {get_attr: [AodhEvaluatorBase, role_data, logging_source]} + logging_groups: {get_attr: [AodhEvaluatorBase, role_data, logging_groups]} step_config: &step_config list_join: - "\n" @@ -112,3 +118,8 @@ outputs: - name: Stop and disable openstack-aodh-evaluator service tags: step2 service: name=openstack-aodh-evaluator.service state=stopped enabled=no + - name: Remove openstack-aodh-evaluator package if operator requests it + yum: name=openstack-aodh-evaluator state=removed + tags: step2 + ignore_errors: True + when: {get_param: UpgradeRemoveUnusedPackages} diff --git a/docker/services/aodh-listener.yaml b/docker/services/aodh-listener.yaml index 3f986ab2..fbe86d3b 100644 --- a/docker/services/aodh-listener.yaml +++ b/docker/services/aodh-listener.yaml @@ -36,6 +36,10 @@ parameters: default: {} description: Parameters specific to the role type: json + UpgradeRemoveUnusedPackages: + default: false + description: Remove package if the service is being disabled during upgrade + type: boolean resources: @@ -63,6 +67,8 @@ outputs: config_settings: map_merge: - get_attr: [AodhListenerBase, role_data, config_settings] + logging_source: {get_attr: [AodhListenerBase, role_data, logging_source]} + logging_groups: {get_attr: [AodhListenerBase, role_data, logging_groups]} step_config: &step_config list_join: - "\n" @@ -112,3 +118,8 @@ outputs: - name: Stop and disable openstack-aodh-listener service tags: step2 service: name=openstack-aodh-listener.service state=stopped enabled=no + - name: Remove openstack-aodh-listener package if operator requests it + yum: name=openstack-aodh-listener state=removed + tags: step2 + ignore_errors: True + when: {get_param: UpgradeRemoveUnusedPackages} diff --git a/docker/services/aodh-notifier.yaml b/docker/services/aodh-notifier.yaml index 852120c9..d9081d54 100644 --- a/docker/services/aodh-notifier.yaml +++ b/docker/services/aodh-notifier.yaml @@ -36,6 +36,10 @@ parameters: default: {} description: Parameters specific to the role type: json + UpgradeRemoveUnusedPackages: + default: false + description: Remove package if the service is being disabled during upgrade + type: boolean resources: @@ -63,6 +67,8 @@ outputs: config_settings: map_merge: - get_attr: [AodhNotifierBase, role_data, config_settings] + logging_source: {get_attr: [AodhNotifierBase, role_data, logging_source]} + logging_groups: {get_attr: [AodhNotifierBase, role_data, logging_groups]} step_config: &step_config list_join: - "\n" @@ -112,3 +118,8 @@ outputs: - name: Stop and disable openstack-aodh-notifier service tags: step2 service: name=openstack-aodh-notifier.service state=stopped enabled=no + - name: Remove openstack-aodh-notifier package if operator requests it + yum: name=openstack-aodh-notifier state=removed + tags: step2 + ignore_errors: True + when: {get_param: UpgradeRemoveUnusedPackages} diff --git a/docker/services/barbican-api.yaml b/docker/services/barbican-api.yaml index b1bf7da8..af528f79 100644 --- a/docker/services/barbican-api.yaml +++ b/docker/services/barbican-api.yaml @@ -39,6 +39,10 @@ parameters: EnableInternalTLS: type: boolean default: false + UpgradeRemoveUnusedPackages: + default: false + description: Remove package if the service is being disabled during upgrade + type: boolean conditions: @@ -71,6 +75,8 @@ outputs: map_merge: - get_attr: [BarbicanApiBase, role_data, config_settings] - apache::default_vhost: false + logging_source: {get_attr: [BarbicanApiBase, role_data, logging_source]} + logging_groups: {get_attr: [BarbicanApiBase, role_data, logging_groups]} step_config: &step_config list_join: - "\n" @@ -150,5 +156,10 @@ outputs: - name: Stop and disable barbican_api service tags: step2 service: name=openstack-barbican-api state=stopped enabled=no + - name: Remove openstack-barbican-api package if operator requests it + yum: name=openstack-barbican-api state=removed + tags: step2 + ignore_errors: True + when: {get_param: UpgradeRemoveUnusedPackages} metadata_settings: - get_attr: [BarbicanApiBase, role_data, metadata_settings]
\ No newline at end of file + get_attr: [BarbicanApiBase, role_data, metadata_settings] diff --git a/docker/services/ceilometer-agent-central.yaml b/docker/services/ceilometer-agent-central.yaml index d772462d..6342c82e 100644 --- a/docker/services/ceilometer-agent-central.yaml +++ b/docker/services/ceilometer-agent-central.yaml @@ -36,6 +36,10 @@ parameters: default: {} description: Parameters specific to the role type: json + UpgradeRemoveUnusedPackages: + default: false + description: Remove package if the service is being disabled during upgrade + type: boolean resources: @@ -58,6 +62,8 @@ outputs: value: service_name: {get_attr: [CeilometerAgentCentralBase, role_data, service_name]} config_settings: {get_attr: [CeilometerAgentCentralBase, role_data, config_settings]} + logging_source: {get_attr: [CeilometerAgentCentralBase, role_data, logging_source]} + logging_groups: {get_attr: [CeilometerAgentCentralBase, role_data, logging_groups]} step_config: &step_config get_attr: [CeilometerAgentCentralBase, role_data, step_config] service_config_settings: {get_attr: [CeilometerAgentCentralBase, role_data, service_config_settings]} @@ -125,3 +131,8 @@ outputs: - name: Stop and disable ceilometer agent central service tags: step2 service: name=openstack-ceilometer-central state=stopped enabled=no + - name: Remove openstack-ceilometer-central package if operator requests it + yum: name=openstack-ceilometer-central state=removed + tags: step2 + ignore_errors: True + when: {get_param: UpgradeRemoveUnusedPackages} diff --git a/docker/services/ceilometer-agent-compute.yaml b/docker/services/ceilometer-agent-compute.yaml index 90b30d46..1ee9f492 100644 --- a/docker/services/ceilometer-agent-compute.yaml +++ b/docker/services/ceilometer-agent-compute.yaml @@ -36,6 +36,10 @@ parameters: default: {} description: Parameters specific to the role type: json + UpgradeRemoveUnusedPackages: + default: false + description: Remove package if the service is being disabled during upgrade + type: boolean resources: @@ -58,6 +62,8 @@ outputs: value: service_name: {get_attr: [CeilometerAgentComputeBase, role_data, service_name]} config_settings: {get_attr: [CeilometerAgentComputeBase, role_data, config_settings]} + logging_source: {get_attr: [CeilometerAgentComputeBase, role_data, logging_source]} + logging_groups: {get_attr: [CeilometerAgentComputeBase, role_data, logging_groups]} step_config: &step_config get_attr: [CeilometerAgentComputeBase, role_data, step_config] service_config_settings: {get_attr: [CeilometerAgentComputeBase, role_data, service_config_settings]} @@ -116,3 +122,13 @@ outputs: tags: step2 service: name=openstack-ceilometer-polling state=stopped enabled=no when: openstack_ceilometer_polling_enabled.rc|default('') == 0 + - name: Remove openstack-ceilometer-compute package if operator requests it + yum: name=openstack-ceilometer-compute state=removed + tags: step2 + ignore_errors: True + when: {get_param: UpgradeRemoveUnusedPackages} + - name: Remove openstack-ceilometer-polling package if operator requests it + yum: name=openstack-ceilometer-polling state=removed + tags: step2 + ignore_errors: True + when: {get_param: UpgradeRemoveUnusedPackages} diff --git a/docker/services/ceilometer-agent-ipmi.yaml b/docker/services/ceilometer-agent-ipmi.yaml index 82d55be2..9df93aaa 100644 --- a/docker/services/ceilometer-agent-ipmi.yaml +++ b/docker/services/ceilometer-agent-ipmi.yaml @@ -36,6 +36,10 @@ parameters: default: {} description: Parameters specific to the role type: json + UpgradeRemoveUnusedPackages: + default: false + description: Remove package if the service is being disabled during upgrade + type: boolean resources: @@ -58,6 +62,8 @@ outputs: value: service_name: {get_attr: [CeilometerAgentIpmiBase, role_data, service_name]} config_settings: {get_attr: [CeilometerAgentIpmiBase, role_data, config_settings]} + logging_source: {get_attr: [CeilometerAgentIpmiBase, role_data, logging_source]} + logging_groups: {get_attr: [CeilometerAgentIpmiBase, role_data, logging_groups]} step_config: &step_config get_attr: [CeilometerAgentIpmiBase, role_data, step_config] service_config_settings: {get_attr: [CeilometerAgentIpmiBase, role_data, service_config_settings]} @@ -102,3 +108,8 @@ outputs: - name: Stop and disable ceilometer agent ipmi service tags: step2 service: name=openstack-ceilometer-agent-ipmi state=stopped enabled=no + - name: Remove openstack-ceilometer-ipmi package if operator requests it + yum: name=openstack-ceilometer-ipmi state=removed + tags: step2 + ignore_errors: True + when: {get_param: UpgradeRemoveUnusedPackages} diff --git a/docker/services/ceilometer-agent-notification.yaml b/docker/services/ceilometer-agent-notification.yaml index 891750ad..de1d2e72 100644 --- a/docker/services/ceilometer-agent-notification.yaml +++ b/docker/services/ceilometer-agent-notification.yaml @@ -36,6 +36,10 @@ parameters: default: {} description: Parameters specific to the role type: json + UpgradeRemoveUnusedPackages: + default: false + description: Remove package if the service is being disabled during upgrade + type: boolean resources: @@ -58,6 +62,8 @@ outputs: value: service_name: {get_attr: [CeilometerAgentNotificationBase, role_data, service_name]} config_settings: {get_attr: [CeilometerAgentNotificationBase, role_data, config_settings]} + logging_source: {get_attr: [CeilometerAgentNotificationBase, role_data, logging_source]} + logging_groups: {get_attr: [CeilometerAgentNotificationBase, role_data, logging_groups]} step_config: &step_config get_attr: [CeilometerAgentNotificationBase, role_data, step_config] service_config_settings: {get_attr: [CeilometerAgentNotificationBase, role_data, service_config_settings]} @@ -117,3 +123,8 @@ outputs: - name: Stop and disable ceilometer agent notification service tags: step2 service: name=openstack-ceilometer-notification state=stopped enabled=no + - name: Remove openstack-ceilometer-notification package if operator requests it + yum: name=openstack-ceilometer-notification state=removed + tags: step2 + ignore_errors: True + when: {get_param: UpgradeRemoveUnusedPackages} diff --git a/docker/services/cinder-api.yaml b/docker/services/cinder-api.yaml index 06705309..25390c63 100644 --- a/docker/services/cinder-api.yaml +++ b/docker/services/cinder-api.yaml @@ -39,6 +39,10 @@ parameters: EnableInternalTLS: type: boolean default: false + UpgradeRemoveUnusedPackages: + default: false + description: Remove package if the service is being disabled during upgrade + type: boolean conditions: @@ -68,6 +72,8 @@ outputs: value: service_name: {get_attr: [CinderBase, role_data, service_name]} config_settings: {get_attr: [CinderBase, role_data, config_settings]} + logging_source: {get_attr: [CinderBase, role_data, logging_source]} + logging_groups: {get_attr: [CinderBase, role_data, logging_groups]} step_config: &step_config list_join: - "\n" @@ -197,3 +203,8 @@ outputs: file: path: /var/spool/cron/cinder state: absent + - name: Remove httpd package if operator requests it + yum: name=httpd state=removed + tags: step2 + ignore_errors: True + when: {get_param: UpgradeRemoveUnusedPackages} diff --git a/docker/services/cinder-backup.yaml b/docker/services/cinder-backup.yaml index ad3b43c2..66877b5f 100644 --- a/docker/services/cinder-backup.yaml +++ b/docker/services/cinder-backup.yaml @@ -36,7 +36,10 @@ parameters: default: {} description: Parameters specific to the role type: json - + UpgradeRemoveUnusedPackages: + default: false + description: Remove package if the service is being disabled during upgrade + type: boolean resources: @@ -62,6 +65,8 @@ outputs: value: service_name: {get_attr: [CinderBase, role_data, service_name]} config_settings: {get_attr: [CinderBase, role_data, config_settings]} + logging_source: {get_attr: [CinderBase, role_data, logging_source]} + logging_groups: {get_attr: [CinderBase, role_data, logging_groups]} step_config: &step_config list_join: - "\n" @@ -145,3 +150,8 @@ outputs: - name: Stop and disable cinder_backup service tags: step2 service: name=openstack-cinder-backup state=stopped enabled=no + - name: Remove openstack-cinder package if operator requests it + yum: name=openstack-cinder state=removed + tags: step2 + ignore_errors: True + when: {get_param: UpgradeRemoveUnusedPackages} diff --git a/docker/services/cinder-scheduler.yaml b/docker/services/cinder-scheduler.yaml index 1ac31874..1772f9e9 100644 --- a/docker/services/cinder-scheduler.yaml +++ b/docker/services/cinder-scheduler.yaml @@ -36,7 +36,10 @@ parameters: default: {} description: Parameters specific to the role type: json - + UpgradeRemoveUnusedPackages: + default: false + description: Remove package if the service is being disabled during upgrade + type: boolean resources: @@ -62,6 +65,8 @@ outputs: value: service_name: {get_attr: [CinderBase, role_data, service_name]} config_settings: {get_attr: [CinderBase, role_data, config_settings]} + logging_source: {get_attr: [CinderBase, role_data, logging_source]} + logging_groups: {get_attr: [CinderBase, role_data, logging_groups]} step_config: &step_config list_join: - "\n" @@ -121,3 +126,8 @@ outputs: - name: Stop and disable cinder_scheduler service tags: step2 service: name=openstack-cinder-scheduler state=stopped enabled=no + - name: Remove openstack-cinder package if operator requests it + yum: name=openstack-cinder state=removed + tags: step2 + ignore_errors: True + when: {get_param: UpgradeRemoveUnusedPackages} diff --git a/docker/services/cinder-volume.yaml b/docker/services/cinder-volume.yaml index eb904c0b..d8a93b13 100644 --- a/docker/services/cinder-volume.yaml +++ b/docker/services/cinder-volume.yaml @@ -45,6 +45,10 @@ parameters: default: 10280 description: The size of the loopback file used by the cinder LVM driver. type: number + UpgradeRemoveUnusedPackages: + default: false + description: Remove package if the service is being disabled during upgrade + type: boolean resources: @@ -73,6 +77,8 @@ outputs: map_merge: - get_attr: [CinderBase, role_data, config_settings] - tripleo::profile::base::lvm::enable_udev: false + logging_source: {get_attr: [CinderBase, role_data, logging_source]} + logging_groups: {get_attr: [CinderBase, role_data, logging_groups]} step_config: &step_config list_join: - "\n" @@ -185,3 +191,8 @@ outputs: - name: Stop and disable cinder_volume service tags: step2 service: name=openstack-cinder-volume state=stopped enabled=no + - name: Remove openstack-cinder package if operator requests it + yum: name=openstack-cinder state=removed + tags: step2 + ignore_errors: True + when: {get_param: UpgradeRemoveUnusedPackages} diff --git a/docker/services/collectd.yaml b/docker/services/collectd.yaml index 3c0ba09b..2ab020c7 100644 --- a/docker/services/collectd.yaml +++ b/docker/services/collectd.yaml @@ -36,7 +36,10 @@ parameters: default: {} description: Parameters specific to the role type: json - + UpgradeRemoveUnusedPackages: + default: false + description: Remove package if the service is being disabled during upgrade + type: boolean resources: @@ -63,6 +66,8 @@ outputs: - get_attr: [CollectdBase, role_data, config_settings] - tripleo::profile::base::metrics::collectd::enable_file_logging: true collectd::plugin::logfile::log_file: /var/log/collectd/collectd.log + logging_source: {get_attr: [CollectdBase, role_data, logging_source]} + logging_groups: {get_attr: [CollectdBase, role_data, logging_groups]} step_config: &step_config get_attr: [CollectdBase, role_data, step_config] service_config_settings: {get_attr: [CollectdBase, role_data, service_config_settings]} @@ -111,3 +116,8 @@ outputs: - name: Stop and disable collectd service tags: step2 service: name=collectd.service state=stopped enabled=no + - name: Remove collectd package if operator requests it + yum: name=collectd state=removed + tags: step2 + ignore_errors: True + when: {get_param: UpgradeRemoveUnusedPackages} diff --git a/docker/services/congress.yaml b/docker/services/congress.yaml index 08170cef..eb287d54 100644 --- a/docker/services/congress.yaml +++ b/docker/services/congress.yaml @@ -36,6 +36,10 @@ parameters: default: {} description: Parameters specific to the role type: json + UpgradeRemoveUnusedPackages: + default: false + description: Remove package if the service is being disabled during upgrade + type: boolean resources: @@ -63,6 +67,8 @@ outputs: config_settings: map_merge: - get_attr: [CongressBase, role_data, config_settings] + logging_source: {get_attr: [CongressBase, role_data, logging_source]} + logging_groups: {get_attr: [CongressBase, role_data, logging_groups]} step_config: &step_config list_join: - "\n" @@ -139,3 +145,8 @@ outputs: - name: Stop and disable congress_api service tags: step2 service: name=openstack-congress-server state=stopped enabled=no + - name: Remove openstack-congress package if operator requests it + yum: name=openstack-congress state=removed + tags: step2 + ignore_errors: True + when: {get_param: UpgradeRemoveUnusedPackages} diff --git a/docker/services/database/mongodb.yaml b/docker/services/database/mongodb.yaml index 5cf6f925..b933be96 100644 --- a/docker/services/database/mongodb.yaml +++ b/docker/services/database/mongodb.yaml @@ -70,6 +70,8 @@ outputs: map_merge: - get_attr: [MongodbPuppetBase, role_data, config_settings] - mongodb::server::fork: false + logging_source: {get_attr: [MongodbPuppetBase, role_data, logging_source]} + logging_groups: {get_attr: [MongodbPuppetBase, role_data, logging_groups]} step_config: &step_config list_join: - "\n" diff --git a/docker/services/database/mysql.yaml b/docker/services/database/mysql.yaml index 402dc351..174acd44 100644 --- a/docker/services/database/mysql.yaml +++ b/docker/services/database/mysql.yaml @@ -79,6 +79,8 @@ outputs: pid-file: /var/lib/mysql/mariadb.pid mysqld_safe: pid-file: /var/lib/mysql/mariadb.pid + logging_source: {get_attr: [MysqlPuppetBase, role_data, logging_source]} + logging_groups: {get_attr: [MysqlPuppetBase, role_data, logging_groups]} step_config: &step_config list_join: - "\n" @@ -125,11 +127,26 @@ outputs: command: ['/bin/bash', '-c', 'chown -R mysql:mysql /var/log/mariadb'] step_2: mysql_bootstrap: + start_order: 1 detach: false image: *mysql_image net: host + user: root # Kolla bootstraps aren't idempotent, explicitly checking if bootstrap was done - command: ['bash', '-c', 'test -e /var/lib/mysql/mysql || kolla_start'] + command: + - 'bash' + - '-ecx' + - + list_join: + - "\n" + - - 'if [ -e /var/lib/mysql/mysql ]; then exit 0; fi' + - 'echo -e "\n[mysqld]\nwsrep_provider=none" >> /etc/my.cnf' + - 'sudo -u mysql -E kolla_start' + - 'mysqld_safe --skip-networking --wsrep-on=OFF &' + - 'timeout ${DB_MAX_TIMEOUT} /bin/bash -c ''until mysqladmin -uroot -p"${DB_ROOT_PASSWORD}" ping 2>/dev/null; do sleep 1; done''' + - 'mysql -uroot -p"${DB_ROOT_PASSWORD}" -e "CREATE USER ''mysql''@''localhost'';"' + - 'mysql -uroot -p"${DB_ROOT_PASSWORD}" -e "REVOKE ALL PRIVILEGES, GRANT OPTION FROM ''mysql''@''localhost'';"' + - 'timeout ${DB_MAX_TIMEOUT} mysqladmin -uroot -p"${DB_ROOT_PASSWORD}" shutdown' volumes: &mysql_volumes list_concat: - @@ -141,7 +158,7 @@ outputs: - /var/log/containers/mysql:/var/log/mariadb - if: - internal_tls_enabled - - + - - list_join: - ':' - - {get_param: InternalTLSCAFile} @@ -149,12 +166,13 @@ outputs: - 'ro' - /etc/pki/tls/certs/mysql.crt:/var/lib/kolla/config_files/src-tls/etc/pki/tls/certs/mysql.crt:ro - /etc/pki/tls/private/mysql.key:/var/lib/kolla/config_files/src-tls/etc/pki/tls/private/mysql.key:ro - - null + - null environment: - KOLLA_CONFIG_STRATEGY=COPY_ALWAYS - KOLLA_BOOTSTRAP=True # NOTE(mandre) skip wsrep cluster status check - KOLLA_KUBERNETES=True + - DB_MAX_TIMEOUT=60 - list_join: - '=' @@ -189,7 +207,7 @@ outputs: - /var/lib/config-data/mysql/root:/root:ro #provides .my.cnf - if: - internal_tls_enabled - - + - - list_join: - ':' - - {get_param: InternalTLSCAFile} @@ -197,7 +215,7 @@ outputs: - 'ro' - /etc/pki/tls/certs/mysql.crt:/var/lib/kolla/config_files/src-tls/etc/pki/tls/certs/mysql.crt:ro - /etc/pki/tls/private/mysql.key:/var/lib/kolla/config_files/src-tls/etc/pki/tls/private/mysql.key:ro - - null + - null metadata_settings: get_attr: [MysqlPuppetBase, role_data, metadata_settings] host_prep_tasks: diff --git a/docker/services/database/redis.yaml b/docker/services/database/redis.yaml index 487b4c67..627a40e8 100644 --- a/docker/services/database/redis.yaml +++ b/docker/services/database/redis.yaml @@ -68,6 +68,8 @@ outputs: - redis::daemonize: false tripleo::stunnel::manage_service: false tripleo::stunnel::foreground: 'yes' + logging_source: {get_attr: [RedisBase, role_data, logging_source]} + logging_groups: {get_attr: [RedisBase, role_data, logging_groups]} step_config: &step_config get_attr: [RedisBase, role_data, step_config] service_config_settings: {get_attr: [RedisBase, role_data, service_config_settings]} diff --git a/docker/services/ec2-api.yaml b/docker/services/ec2-api.yaml index 1d4ddd38..48f1da4b 100644 --- a/docker/services/ec2-api.yaml +++ b/docker/services/ec2-api.yaml @@ -60,6 +60,8 @@ outputs: value: service_name: {get_attr: [Ec2ApiPuppetBase, role_data, service_name]} config_settings: {get_attr: [Ec2ApiPuppetBase, role_data, config_settings]} + logging_source: {get_attr: [Ec2ApiPuppetBase, role_data, logging_source]} + logging_groups: {get_attr: [Ec2ApiPuppetBase, role_data, logging_groups]} step_config: &step_config list_join: - "\n" diff --git a/docker/services/etcd.yaml b/docker/services/etcd.yaml index 42c9f2d3..019b8c1b 100644 --- a/docker/services/etcd.yaml +++ b/docker/services/etcd.yaml @@ -57,6 +57,8 @@ outputs: description: Role data for the etcd role. value: service_name: {get_attr: [EtcdPuppetBase, role_data, service_name]} + logging_source: {get_attr: [EtcdPuppetBase, role_data, logging_source]} + logging_groups: {get_attr: [EtcdPuppetBase, role_data, logging_groups]} step_config: &step_config list_join: - "\n" diff --git a/docker/services/fluentd-client.yaml b/docker/services/fluentd-client.yaml new file mode 100644 index 00000000..55ea2463 --- /dev/null +++ b/docker/services/fluentd-client.yaml @@ -0,0 +1,121 @@ +heat_template_version: pike + +description: > + OpenStack containerized fluentd services + +parameters: + DockerFluentdClientImage: + description: image + type: string + DockerFluentdConfigImage: + description: The container image to use fluentd config_volume + type: string + EndpointMap: + default: {} + description: Mapping of service endpoint -> protocol. Typically set + via parameter_defaults in the resource registry. + type: json + ServiceData: + default: {} + description: Dictionary packing service data + type: json + ServiceNetMap: + default: {} + description: Mapping of service_name -> network name. Typically set + via parameter_defaults in the resource registry. This + mapping overrides those in ServiceNetMapDefaults. + type: json + DefaultPasswords: + default: {} + type: json + RoleName: + default: '' + description: Role name on which the service is applied + type: string + RoleParameters: + default: {} + description: Parameters specific to the role + type: json + +resources: + + ContainersCommon: + type: ./containers-common.yaml + + FluentdClientBase: + type: ../../puppet/services/logging/fluentd-client.yaml + properties: + EndpointMap: {get_param: EndpointMap} + ServiceData: {get_param: ServiceData} + ServiceNetMap: {get_param: ServiceNetMap} + DefaultPasswords: {get_param: DefaultPasswords} + RoleName: {get_param: RoleName} + RoleParameters: {get_param: RoleParameters} + +outputs: + role_data: + description: Role data for the fluentd role. + value: + service_name: {get_attr: [FluentdClientBase, role_data, service_name]} + config_settings: + map_merge: + - {get_attr: [FluentdClientBase, role_data, config_settings]} + - tripleo::profile::base::logging::fluentd::fluentd_path_transform: + - /var/log/ + - /var/log/containers/ + step_config: &step_config + get_attr: [FluentdClientBase, role_data, step_config] + # BEGIN DOCKER SETTINGS + puppet_config: + config_volume: fluentd + puppet_tags: config + step_config: *step_config + config_image: {get_param: DockerFluentdConfigImage} + kolla_config: + /var/lib/kolla/config_files/fluentd.json: + command: /usr/bin/fluentd -c /etc/fluentd/fluent.conf -o /var/log/fluentd/fluentd.log + config_files: + - source: "/var/lib/kolla/config_files/src/*" + dest: "/" + merge: true + preserve_properties: true + permissions: + - path: /var/lib/fluentd + owner: fluentd:fluentd + recurse: true + - path: /var/log/fluentd + owner: fluentd:fluentd + recurse: true + docker_config: + step_3: + fluentd_client: + image: {get_param: DockerFluentdClientImage} + net: host + privileged: true + user: root + restart: always + volumes: + list_concat: + - {get_attr: [ContainersCommon, volumes]} + - + - /var/cache/containers/fluentd:/var/cache/fluentd:rw + - /var/lib/kolla/config_files/fluentd.json:/var/lib/kolla/config_files/config.json:ro + - /var/lib/config-data/puppet-generated/fluentd/:/var/lib/kolla/config_files/src:ro + - /var/log/containers:/var/log/containers:ro + - /var/log/containers/fluentd:/var/log/fluentd:rw + environment: + - KOLLA_CONFIG_STRATEGY=COPY_ALWAYS + host_prep_tasks: + - name: create persistent logs directory for fluentd + file: + path: /var/log/containers/fluentd + state: directory + - name: create persistent cache directory + file: + path: /var/cache/containers/fluentd + state: directory + upgrade_tasks: + - name: Stop and disable fluentd service + tags: step2 + service: name=fluentd.service state=stopped enabled=no + diff --git a/docker/services/glance-api.yaml b/docker/services/glance-api.yaml index 8f2bd604..e1a3827a 100644 --- a/docker/services/glance-api.yaml +++ b/docker/services/glance-api.yaml @@ -44,6 +44,10 @@ parameters: description: > When using GlanceBackend 'file', mount NFS share for image storage. type: boolean + UpgradeRemoveUnusedPackages: + default: false + description: Remove package if the service is being disabled during upgrade + type: boolean conditions: @@ -78,6 +82,8 @@ outputs: map_merge: - get_attr: [GlanceApiPuppetBase, role_data, config_settings] - glance::api::sync_db: false + logging_source: {get_attr: [GlanceApiPuppetBase, role_data, logging_source]} + logging_groups: {get_attr: [GlanceApiPuppetBase, role_data, logging_groups]} step_config: &step_config list_join: - "\n" @@ -191,5 +197,10 @@ outputs: - name: Stop and disable glance_api service tags: step2 service: name=openstack-glance-api state=stopped enabled=no + - name: Remove openstack-glance package if operator requests it + yum: name=openstack-glance state=removed + tags: step2 + ignore_errors: True + when: {get_param: UpgradeRemoveUnusedPackages} metadata_settings: get_attr: [GlanceApiPuppetBase, role_data, metadata_settings] diff --git a/docker/services/gnocchi-api.yaml b/docker/services/gnocchi-api.yaml index 47b3b811..96f6ab98 100644 --- a/docker/services/gnocchi-api.yaml +++ b/docker/services/gnocchi-api.yaml @@ -71,6 +71,8 @@ outputs: map_merge: - get_attr: [GnocchiApiPuppetBase, role_data, config_settings] - apache::default_vhost: false + logging_source: {get_attr: [GnocchiApiPuppetBase, role_data, logging_source]} + logging_groups: {get_attr: [GnocchiApiPuppetBase, role_data, logging_groups]} step_config: &step_config get_attr: [GnocchiApiPuppetBase, role_data, step_config] service_config_settings: {get_attr: [GnocchiApiPuppetBase, role_data, service_config_settings]} diff --git a/docker/services/gnocchi-metricd.yaml b/docker/services/gnocchi-metricd.yaml index 9a114458..b966fa68 100644 --- a/docker/services/gnocchi-metricd.yaml +++ b/docker/services/gnocchi-metricd.yaml @@ -61,6 +61,8 @@ outputs: value: service_name: {get_attr: [GnocchiMetricdBase, role_data, service_name]} config_settings: {get_attr: [GnocchiMetricdBase, role_data, config_settings]} + logging_source: {get_attr: [GnocchiMetricdBase, role_data, logging_source]} + logging_groups: {get_attr: [GnocchiMetricdBase, role_data, logging_groups]} step_config: &step_config list_join: - "\n" diff --git a/docker/services/gnocchi-statsd.yaml b/docker/services/gnocchi-statsd.yaml index 834d0055..0ebc83f6 100644 --- a/docker/services/gnocchi-statsd.yaml +++ b/docker/services/gnocchi-statsd.yaml @@ -61,6 +61,8 @@ outputs: value: service_name: {get_attr: [GnocchiStatsdBase, role_data, service_name]} config_settings: {get_attr: [GnocchiStatsdBase, role_data, config_settings]} + logging_source: {get_attr: [GnocchiStatsdBase, role_data, logging_source]} + logging_groups: {get_attr: [GnocchiStatsdBase, role_data, logging_groups]} step_config: &step_config list_join: - "\n" diff --git a/docker/services/haproxy.yaml b/docker/services/haproxy.yaml index 70e1f893..b6c43527 100644 --- a/docker/services/haproxy.yaml +++ b/docker/services/haproxy.yaml @@ -100,6 +100,8 @@ outputs: # NOTE(jaosorior): We disable the CRL since we have no way to restart haproxy # when this is updated tripleo::haproxy::crl_file: null + logging_source: {get_attr: [HAProxyBase, role_data, logging_source]} + logging_groups: {get_attr: [HAProxyBase, role_data, logging_groups]} step_config: &step_config get_attr: [HAProxyBase, role_data, step_config] service_config_settings: {get_attr: [HAProxyBase, role_data, service_config_settings]} diff --git a/docker/services/heat-api-cfn.yaml b/docker/services/heat-api-cfn.yaml index cfe11cd6..84bc0672 100644 --- a/docker/services/heat-api-cfn.yaml +++ b/docker/services/heat-api-cfn.yaml @@ -69,6 +69,8 @@ outputs: map_merge: - get_attr: [HeatBase, role_data, config_settings] - apache::default_vhost: false + logging_source: {get_attr: [HeatBase, role_data, logging_source]} + logging_groups: {get_attr: [HeatBase, role_data, logging_groups]} step_config: &step_config get_attr: [HeatBase, role_data, step_config] service_config_settings: {get_attr: [HeatBase, role_data, service_config_settings]} diff --git a/docker/services/heat-api.yaml b/docker/services/heat-api.yaml index 2bb588de..75d0b8c1 100644 --- a/docker/services/heat-api.yaml +++ b/docker/services/heat-api.yaml @@ -71,6 +71,8 @@ outputs: - apache::default_vhost: false step_config: &step_config get_attr: [HeatBase, role_data, step_config] + logging_source: {get_attr: [HeatBase, role_data, logging_source]} + logging_groups: {get_attr: [HeatBase, role_data, logging_groups]} service_config_settings: {get_attr: [HeatBase, role_data, service_config_settings]} # BEGIN DOCKER SETTINGS puppet_config: diff --git a/docker/services/heat-engine.yaml b/docker/services/heat-engine.yaml index fdba7d58..21ae2426 100644 --- a/docker/services/heat-engine.yaml +++ b/docker/services/heat-engine.yaml @@ -37,7 +37,6 @@ parameters: description: Parameters specific to the role type: json - resources: ContainersCommon: @@ -65,6 +64,8 @@ outputs: map_merge: - get_attr: [HeatBase, role_data, config_settings] - apache::default_vhost: false + logging_source: {get_attr: [HeatBase, role_data, logging_source]} + logging_groups: {get_attr: [HeatBase, role_data, logging_groups]} step_config: &step_config list_join: - "\n" diff --git a/docker/services/horizon.yaml b/docker/services/horizon.yaml index 9a2c8bad..d6ffb6dc 100644 --- a/docker/services/horizon.yaml +++ b/docker/services/horizon.yaml @@ -73,6 +73,8 @@ outputs: access_log_format: '%a %l %u %t \"%r\" %>s %b \"%%{}{Referer}i\" \"%%{}{User-Agent}i\"' options: ['FollowSymLinks','MultiViews'] - horizon::secure_cookies: false + logging_source: {get_attr: [HorizonBase, role_data, logging_source]} + logging_groups: {get_attr: [HorizonBase, role_data, logging_groups]} step_config: {get_attr: [HorizonBase, role_data, step_config]} service_config_settings: {get_attr: [HorizonBase, role_data, service_config_settings]} # BEGIN DOCKER SETTINGS diff --git a/docker/services/ironic-api.yaml b/docker/services/ironic-api.yaml index 38710f3b..156e5f98 100644 --- a/docker/services/ironic-api.yaml +++ b/docker/services/ironic-api.yaml @@ -64,6 +64,8 @@ outputs: map_merge: - get_attr: [IronicApiBase, role_data, config_settings] - apache::default_vhost: false + logging_source: {get_attr: [IronicApiBase, role_data, logging_source]} + logging_groups: {get_attr: [IronicApiBase, role_data, logging_groups]} step_config: &step_config list_join: - "\n" diff --git a/docker/services/ironic-conductor.yaml b/docker/services/ironic-conductor.yaml index 37f4d46e..465aa8b1 100644 --- a/docker/services/ironic-conductor.yaml +++ b/docker/services/ironic-conductor.yaml @@ -71,6 +71,8 @@ outputs: - ironic::pxe::tftp_root: /var/lib/ironic/tftpboot - ironic::pxe::http_root: /var/lib/ironic/httpboot - ironic::conductor::http_root: /var/lib/ironic/httpboot + logging_source: {get_attr: [IronicConductorBase, role_data, logging_source]} + logging_groups: {get_attr: [IronicConductorBase, role_data, logging_groups]} step_config: &step_config list_join: - "\n" diff --git a/docker/services/iscsid.yaml b/docker/services/iscsid.yaml index c34a59d5..da9b1b2c 100644 --- a/docker/services/iscsid.yaml +++ b/docker/services/iscsid.yaml @@ -57,6 +57,8 @@ outputs: value: service_name: {get_attr: [IscsidBase, role_data, service_name]} config_settings: {get_attr: [IscsidBase, role_data, config_settings]} + logging_source: {get_attr: [IscsidBase, role_data, logging_source]} + logging_groups: {get_attr: [IscsidBase, role_data, logging_groups]} step_config: &step_config {get_attr: [IscsidBase, role_data, step_config]} service_config_settings: {get_attr: [IscsidBase, role_data, service_config_settings]} diff --git a/docker/services/keystone.yaml b/docker/services/keystone.yaml index 8f4a2014..26cef614 100644 --- a/docker/services/keystone.yaml +++ b/docker/services/keystone.yaml @@ -81,6 +81,8 @@ outputs: map_merge: - get_attr: [KeystoneBase, role_data, config_settings] - apache::default_vhost: false + logging_source: {get_attr: [KeystoneBase, role_data, logging_source]} + logging_groups: {get_attr: [KeystoneBase, role_data, logging_groups]} step_config: &step_config list_join: - "\n" diff --git a/docker/services/manila-api.yaml b/docker/services/manila-api.yaml index a0e501ec..d2360f97 100644 --- a/docker/services/manila-api.yaml +++ b/docker/services/manila-api.yaml @@ -59,6 +59,8 @@ outputs: value: service_name: {get_attr: [ManilaApiPuppetBase, role_data, service_name]} config_settings: {get_attr: [ManilaApiPuppetBase, role_data, config_settings]} + logging_source: {get_attr: [ManilaApiPuppetBase, role_data, logging_source]} + logging_groups: {get_attr: [ManilaApiPuppetBase, role_data, logging_groups]} step_config: &step_config list_join: - "\n" diff --git a/docker/services/manila-scheduler.yaml b/docker/services/manila-scheduler.yaml index 7b5dfec3..931ce23d 100644 --- a/docker/services/manila-scheduler.yaml +++ b/docker/services/manila-scheduler.yaml @@ -59,6 +59,8 @@ outputs: value: service_name: {get_attr: [ManilaSchedulerPuppetBase, role_data, service_name]} config_settings: {get_attr: [ManilaSchedulerPuppetBase, role_data, config_settings]} + logging_source: {get_attr: [ManilaSchedulerPuppetBase, role_data, logging_source]} + logging_groups: {get_attr: [ManilaSchedulerPuppetBase, role_data, logging_groups]} step_config: &step_config list_join: - "\n" diff --git a/docker/services/manila-share.yaml b/docker/services/manila-share.yaml index 332ba864..cf3303c3 100644 --- a/docker/services/manila-share.yaml +++ b/docker/services/manila-share.yaml @@ -61,6 +61,8 @@ outputs: value: service_name: {get_attr: [ManilaBase, role_data, service_name]} config_settings: {get_attr: [ManilaBase, role_data, config_settings]} + logging_source: {get_attr: [ManilaBase, role_data, logging_source]} + logging_groups: {get_attr: [ManilaBase, role_data, logging_groups]} step_config: &step_config list_join: - "\n" diff --git a/docker/services/memcached.yaml b/docker/services/memcached.yaml index 7e28bdc1..c78b85a6 100644 --- a/docker/services/memcached.yaml +++ b/docker/services/memcached.yaml @@ -58,6 +58,8 @@ outputs: value: service_name: {get_attr: [MemcachedBase, role_data, service_name]} config_settings: {get_attr: [MemcachedBase, role_data, config_settings]} + logging_source: {get_attr: [MemcachedBase, role_data, logging_source]} + logging_groups: {get_attr: [MemcachedBase, role_data, logging_groups]} step_config: &step_config get_attr: [MemcachedBase, role_data, step_config] service_config_settings: {get_attr: [MemcachedBase, role_data, service_config_settings]} diff --git a/docker/services/mistral-api.yaml b/docker/services/mistral-api.yaml index 38b97aef..50c80216 100644 --- a/docker/services/mistral-api.yaml +++ b/docker/services/mistral-api.yaml @@ -63,6 +63,8 @@ outputs: config_settings: map_merge: - get_attr: [MistralApiBase, role_data, config_settings] + logging_source: {get_attr: [MistralApiBase, role_data, logging_source]} + logging_groups: {get_attr: [MistralApiBase, role_data, logging_groups]} step_config: &step_config list_join: - "\n" diff --git a/docker/services/mistral-engine.yaml b/docker/services/mistral-engine.yaml index 2b498be3..12f7779b 100644 --- a/docker/services/mistral-engine.yaml +++ b/docker/services/mistral-engine.yaml @@ -64,6 +64,8 @@ outputs: config_settings: map_merge: - get_attr: [MistralBase, role_data, config_settings] + logging_source: {get_attr: [MistralBase, role_data, logging_source]} + logging_groups: {get_attr: [MistralBase, role_data, logging_groups]} step_config: &step_config list_join: - "\n" diff --git a/docker/services/mistral-executor.yaml b/docker/services/mistral-executor.yaml index e106fe47..0ee7d534 100644 --- a/docker/services/mistral-executor.yaml +++ b/docker/services/mistral-executor.yaml @@ -64,6 +64,8 @@ outputs: config_settings: map_merge: - get_attr: [MistralBase, role_data, config_settings] + logging_source: {get_attr: [MistralBase, role_data, logging_source]} + logging_groups: {get_attr: [MistralBase, role_data, logging_groups]} step_config: &step_config list_join: - "\n" diff --git a/docker/services/neutron-api.yaml b/docker/services/neutron-api.yaml index c028fc28..34d70ff0 100644 --- a/docker/services/neutron-api.yaml +++ b/docker/services/neutron-api.yaml @@ -39,6 +39,10 @@ parameters: EnableInternalTLS: type: boolean default: false + UpgradeRemoveUnusedPackages: + default: false + description: Remove package if the service is being disabled during upgrade + type: boolean conditions: @@ -67,6 +71,8 @@ outputs: description: Role data for the Neutron API role. value: service_name: {get_attr: [NeutronBase, role_data, service_name]} + logging_source: {get_attr: [NeutronBase, role_data, logging_source]} + logging_groups: {get_attr: [NeutronBase, role_data, logging_groups]} config_settings: map_merge: - get_attr: [NeutronBase, role_data, config_settings] @@ -189,5 +195,10 @@ outputs: tags: step2 when: neutron_server_enabled.rc == 0 service: name=neutron-server state=stopped enabled=no + - name: Remove openstack-neutron package if operator requests it + yum: name=openstack-neutron state=removed + tags: step2 + ignore_errors: True + when: {get_param: UpgradeRemoveUnusedPackages} metadata_settings: get_attr: [NeutronBase, role_data, metadata_settings] diff --git a/docker/services/neutron-dhcp.yaml b/docker/services/neutron-dhcp.yaml index 4b75d542..4b5a2711 100644 --- a/docker/services/neutron-dhcp.yaml +++ b/docker/services/neutron-dhcp.yaml @@ -60,6 +60,8 @@ outputs: config_settings: map_merge: - get_attr: [NeutronBase, role_data, config_settings] + logging_source: {get_attr: [NeutronBase, role_data, logging_source]} + logging_groups: {get_attr: [NeutronBase, role_data, logging_groups]} step_config: &step_config get_attr: [NeutronBase, role_data, step_config] service_config_settings: {get_attr: [NeutronBase, role_data, service_config_settings]} diff --git a/docker/services/neutron-l3.yaml b/docker/services/neutron-l3.yaml index 06470c05..09232c26 100644 --- a/docker/services/neutron-l3.yaml +++ b/docker/services/neutron-l3.yaml @@ -58,6 +58,8 @@ outputs: value: service_name: {get_attr: [NeutronL3Base, role_data, service_name]} config_settings: {get_attr: [NeutronL3Base, role_data, config_settings]} + logging_source: {get_attr: [NeutronL3Base, role_data, logging_source]} + logging_groups: {get_attr: [NeutronL3Base, role_data, logging_groups]} step_config: &step_config get_attr: [NeutronL3Base, role_data, step_config] puppet_config: diff --git a/docker/services/neutron-metadata.yaml b/docker/services/neutron-metadata.yaml index a5a7c34b..9fe839e9 100644 --- a/docker/services/neutron-metadata.yaml +++ b/docker/services/neutron-metadata.yaml @@ -58,6 +58,8 @@ outputs: value: service_name: {get_attr: [NeutronMetadataBase, role_data, service_name]} config_settings: {get_attr: [NeutronMetadataBase, role_data, config_settings]} + logging_source: {get_attr: [NeutronMetadataBase, role_data, logging_source]} + logging_groups: {get_attr: [NeutronMetadataBase, role_data, logging_groups]} step_config: &step_config get_attr: [NeutronMetadataBase, role_data, step_config] puppet_config: diff --git a/docker/services/neutron-ovs-agent.yaml b/docker/services/neutron-ovs-agent.yaml index 81bb1c20..e6faf34d 100644 --- a/docker/services/neutron-ovs-agent.yaml +++ b/docker/services/neutron-ovs-agent.yaml @@ -36,6 +36,10 @@ parameters: description: Mapping of service endpoint -> protocol. Typically set via parameter_defaults in the resource registry. type: json + UpgradeRemoveUnusedPackages: + default: false + description: Remove package if the service is being disabled during upgrade + type: boolean resources: @@ -58,6 +62,8 @@ outputs: value: service_name: {get_attr: [NeutronOvsAgentBase, role_data, service_name]} config_settings: {get_attr: [NeutronOvsAgentBase, role_data, config_settings]} + logging_source: {get_attr: [NeutronOvsAgentBase, role_data, logging_source]} + logging_groups: {get_attr: [NeutronOvsAgentBase, role_data, logging_groups]} step_config: &step_config get_attr: [NeutronOvsAgentBase, role_data, step_config] puppet_config: @@ -136,3 +142,8 @@ outputs: - name: Stop and disable neutron_ovs_agent service tags: step2 service: name=neutron-openvswitch-agent state=stopped enabled=no + - name: Remove openstack-neutron-openvswitch package if operator requests it + yum: name=openstack-neutron-openvswitch state=removed + tags: step2 + ignore_errors: True + when: {get_param: UpgradeRemoveUnusedPackages} diff --git a/docker/services/neutron-plugin-ml2.yaml b/docker/services/neutron-plugin-ml2.yaml index 8d12e0de..88d46ca2 100644 --- a/docker/services/neutron-plugin-ml2.yaml +++ b/docker/services/neutron-plugin-ml2.yaml @@ -53,6 +53,8 @@ outputs: config_settings: map_merge: - get_attr: [NeutronBase, role_data, config_settings] + logging_source: {get_attr: [NeutronBase, role_data, logging_source]} + logging_groups: {get_attr: [NeutronBase, role_data, logging_groups]} step_config: &step_config get_attr: [NeutronBase, role_data, step_config] service_config_settings: {get_attr: [NeutronBase, role_data, service_config_settings]} diff --git a/docker/services/nova-api.yaml b/docker/services/nova-api.yaml index 9f1ae865..f262bcb1 100644 --- a/docker/services/nova-api.yaml +++ b/docker/services/nova-api.yaml @@ -39,6 +39,10 @@ parameters: EnableInternalTLS: type: boolean default: false + UpgradeRemoveUnusedPackages: + default: false + description: Remove package if the service is being disabled during upgrade + type: boolean conditions: @@ -71,6 +75,8 @@ outputs: map_merge: - get_attr: [NovaApiBase, role_data, config_settings] - apache::default_vhost: false + logging_source: {get_attr: [NovaApiBase, role_data, logging_source]} + logging_groups: {get_attr: [NovaApiBase, role_data, logging_groups]} step_config: &step_config list_join: - "\n" @@ -234,6 +240,11 @@ outputs: - name: Stop and disable nova_api service tags: step2 service: name=openstack-nova-api state=stopped enabled=no + - name: Remove openstack-nova-api package if operator requests it + yum: name=openstack-nova-api state=removed + tags: step2 + ignore_errors: True + when: {get_param: UpgradeRemoveUnusedPackages} - name: remove old nova cron jobs file: path: /var/spool/cron/nova diff --git a/docker/services/nova-compute.yaml b/docker/services/nova-compute.yaml index bf7841be..883f438b 100644 --- a/docker/services/nova-compute.yaml +++ b/docker/services/nova-compute.yaml @@ -45,6 +45,10 @@ parameters: type: string description: Nova Compute upgrade level default: '' + UpgradeRemoveUnusedPackages: + default: false + description: Remove package if the service is being disabled during upgrade + type: boolean resources: @@ -63,7 +67,6 @@ resources: DefaultPasswords: {get_param: DefaultPasswords} RoleName: {get_param: RoleName} RoleParameters: {get_param: RoleParameters} - MigrationSshPort: {get_param: DockerNovaMigrationSshdPort} outputs: role_data: @@ -72,6 +75,8 @@ outputs: service_name: {get_attr: [NovaComputeBase, role_data, service_name]} config_settings: get_attr: [NovaComputeBase, role_data, config_settings] + logging_source: {get_attr: [NovaComputeBase, role_data, logging_source]} + logging_groups: {get_attr: [NovaComputeBase, role_data, logging_groups]} step_config: &step_config list_join: - "\n" @@ -156,3 +161,8 @@ outputs: - name: Stop and disable nova-compute service tags: step2 service: name=openstack-nova-compute state=stopped enabled=no + - name: Remove openstack-nova-compute package if operator requests it + yum: name=openstack-nova-compute state=removed + tags: step2 + ignore_errors: True + when: {get_param: UpgradeRemoveUnusedPackages} diff --git a/docker/services/nova-conductor.yaml b/docker/services/nova-conductor.yaml index 17d137cc..f15c3a68 100644 --- a/docker/services/nova-conductor.yaml +++ b/docker/services/nova-conductor.yaml @@ -40,6 +40,11 @@ parameters: type: string description: Nova Compute upgrade level default: '' + UpgradeRemoveUnusedPackages: + default: false + description: Remove package if the service is being disabled during upgrade + type: boolean + resources: @@ -65,6 +70,8 @@ outputs: value: service_name: {get_attr: [NovaConductorBase, role_data, service_name]} config_settings: {get_attr: [NovaConductorBase, role_data, config_settings]} + logging_source: {get_attr: [NovaConductorBase, role_data, logging_source]} + logging_groups: {get_attr: [NovaConductorBase, role_data, logging_groups]} step_config: &step_config list_join: - "\n" @@ -121,3 +128,8 @@ outputs: - name: Stop and disable nova_conductor service tags: step2 service: name=openstack-nova-conductor state=stopped enabled=no + - name: Remove openstack-nova-conductor package if operator requests it + yum: name=openstack-nova-conductor state=removed + tags: step2 + ignore_errors: True + when: {get_param: UpgradeRemoveUnusedPackages} diff --git a/docker/services/nova-consoleauth.yaml b/docker/services/nova-consoleauth.yaml index 715a861b..069b09bc 100644 --- a/docker/services/nova-consoleauth.yaml +++ b/docker/services/nova-consoleauth.yaml @@ -36,6 +36,10 @@ parameters: default: {} description: Parameters specific to the role type: json + UpgradeRemoveUnusedPackages: + default: false + description: Remove package if the service is being disabled during upgrade + type: boolean resources: @@ -61,6 +65,8 @@ outputs: value: service_name: {get_attr: [NovaConsoleauthPuppetBase, role_data, service_name]} config_settings: {get_attr: [NovaConsoleauthPuppetBase, role_data, config_settings]} + logging_source: {get_attr: [NovaConsoleauthPuppetBase, role_data, logging_source]} + logging_groups: {get_attr: [NovaConsoleauthPuppetBase, role_data, logging_groups]} step_config: &step_config list_join: - "\n" @@ -110,3 +116,8 @@ outputs: - name: Stop and disable nova_consoleauth service tags: step2 service: name=openstack-nova-consoleauth state=stopped enabled=no + - name: Remove openstack-nova-console package if operator requests it + yum: name=openstack-nova-console state=removed + tags: step2 + ignore_errors: True + when: {get_param: UpgradeRemoveUnusedPackages} diff --git a/docker/services/nova-ironic.yaml b/docker/services/nova-ironic.yaml index 543758a1..1bed40ec 100644 --- a/docker/services/nova-ironic.yaml +++ b/docker/services/nova-ironic.yaml @@ -61,6 +61,8 @@ outputs: value: service_name: {get_attr: [NovaIronicBase, role_data, service_name]} config_settings: {get_attr: [NovaIronicBase, role_data, config_settings]} + logging_source: {get_attr: [NovaIronicBase, role_data, logging_source]} + logging_groups: {get_attr: [NovaIronicBase, role_data, logging_groups]} step_config: &step_config list_join: - "\n" diff --git a/docker/services/nova-libvirt.yaml b/docker/services/nova-libvirt.yaml index d20c093d..df168945 100644 --- a/docker/services/nova-libvirt.yaml +++ b/docker/services/nova-libvirt.yaml @@ -105,7 +105,6 @@ resources: DefaultPasswords: {get_param: DefaultPasswords} RoleName: {get_param: RoleName} RoleParameters: {get_param: RoleParameters} - MigrationSshPort: {get_param: DockerNovaMigrationSshdPort} outputs: role_data: @@ -117,6 +116,8 @@ outputs: - get_attr: [NovaLibvirtBase, role_data, config_settings] - tripleo::profile::base::certmonger_user::libvirt_postsave_cmd: "true" # TODO: restart the libvirt container here + logging_source: {get_attr: [NovaLibvirtBase, role_data, logging_source]} + logging_groups: {get_attr: [NovaLibvirtBase, role_data, logging_groups]} step_config: &step_config list_join: - "\n" diff --git a/docker/services/nova-metadata.yaml b/docker/services/nova-metadata.yaml index 53ae7910..54d9312b 100644 --- a/docker/services/nova-metadata.yaml +++ b/docker/services/nova-metadata.yaml @@ -60,6 +60,8 @@ outputs: config_settings: map_merge: - get_attr: [NovaMetadataBase, role_data, config_settings] + logging_source: {get_attr: [NovaMetadataBase, role_data, logging_source]} + logging_groups: {get_attr: [NovaMetadataBase, role_data, logging_groups]} step_config: &step_config get_attr: [NovaMetadataBase, role_data, step_config] service_config_settings: {get_attr: [NovaMetadataBase, role_data, service_config_settings]} diff --git a/docker/services/nova-migration-target.yaml b/docker/services/nova-migration-target.yaml index 385343a0..cb3b950e 100644 --- a/docker/services/nova-migration-target.yaml +++ b/docker/services/nova-migration-target.yaml @@ -41,6 +41,29 @@ parameters: description: Port that dockerized nova migration target sshd service binds to. type: number + MigrationSshKey: + type: json + description: > + SSH key for migration. + Expects a dictionary with keys 'public_key' and 'private_key'. + Values should be identical to SSH public/private key files. + default: + public_key: '' + private_key: '' + MigrationSshPort: + default: 2022 + description: Target port for migration over ssh + type: number + +conditions: + + # During Ocata->Pike upgrade initially configure the ssh service on port 22 + # to proxy migration commands to the containerized sshd on port 2022. + # When the upgrade converges we can switch migrations over to port 2022. + enable_migration_proxy: + equals: + - {get_param: MigrationSshPort} + - 22 resources: @@ -74,10 +97,17 @@ outputs: map_merge: - get_attr: [SshdBase, role_data, config_settings] - get_attr: [NovaMigrationTargetBase, role_data, config_settings] - - tripleo.nova_migration_target.firewall_rules: - '113 nova_migration_target': - dport: - - {get_param: DockerNovaMigrationSshdPort} + # NB this prevents the baremetal ssh from listening on port 2022 + # It doesn't affect the sshd port in the container as we override it below on the sshd cli + - tripleo::profile::base::sshd::port: 22 + - if: + - enable_migration_proxy + - tripleo::profile::base::nova::migration::proxy::ssh_private_key: {get_param: [ MigrationSshKey, private_key ]} + tripleo::profile::base::nova::migration::proxy::target_port: {get_param: DockerNovaMigrationSshdPort} + tripleo::profile::base::nova::migration::proxy::target_host: "%{hiera('live_migration_ssh_inbound_addr')}" + - {} + logging_source: {get_attr: [NovaMigrationTargetBase, role_data, logging_source]} + logging_groups: {get_attr: [NovaMigrationTargetBase, role_data, logging_groups]} step_config: &step_config list_join: - "\n" diff --git a/docker/services/nova-placement.yaml b/docker/services/nova-placement.yaml index d66a6fb8..bd5ae731 100644 --- a/docker/services/nova-placement.yaml +++ b/docker/services/nova-placement.yaml @@ -39,6 +39,10 @@ parameters: EnableInternalTLS: type: boolean default: false + UpgradeRemoveUnusedPackages: + default: false + description: Remove package if the service is being disabled during upgrade + type: boolean conditions: @@ -71,6 +75,8 @@ outputs: map_merge: - get_attr: [NovaPlacementBase, role_data, config_settings] - apache::default_vhost: false + logging_source: {get_attr: [NovaPlacementBase, role_data, logging_source]} + logging_groups: {get_attr: [NovaPlacementBase, role_data, logging_groups]} step_config: &step_config list_join: - "\n" @@ -138,3 +144,9 @@ outputs: - name: Stop and disable nova_placement service (running under httpd) tags: step2 service: name=httpd state=stopped enabled=no + - name: Remove httpd package if operator requests it + yum: name=httpd state=removed + tags: step2 + ignore_errors: True + when: {get_param: UpgradeRemoveUnusedPackages} + diff --git a/docker/services/nova-scheduler.yaml b/docker/services/nova-scheduler.yaml index 8d8a6358..f8109b96 100644 --- a/docker/services/nova-scheduler.yaml +++ b/docker/services/nova-scheduler.yaml @@ -36,6 +36,10 @@ parameters: default: {} description: Parameters specific to the role type: json + UpgradeRemoveUnusedPackages: + default: false + description: Remove package if the service is being disabled during upgrade + type: boolean resources: @@ -61,6 +65,8 @@ outputs: value: service_name: {get_attr: [NovaSchedulerBase, role_data, service_name]} config_settings: {get_attr: [NovaSchedulerBase, role_data, config_settings]} + logging_source: {get_attr: [NovaSchedulerBase, role_data, logging_source]} + logging_groups: {get_attr: [NovaSchedulerBase, role_data, logging_groups]} step_config: &step_config list_join: - "\n" @@ -111,3 +117,8 @@ outputs: - name: Stop and disable nova_scheduler service tags: step2 service: name=openstack-nova-scheduler state=stopped enabled=no + - name: Remove openstack-nova-scheduler package if operator requests it + yum: name=openstack-nova-scheduler state=removed + tags: step2 + ignore_errors: True + when: {get_param: UpgradeRemoveUnusedPackages} diff --git a/docker/services/nova-vnc-proxy.yaml b/docker/services/nova-vnc-proxy.yaml index c5f651d2..b1da294b 100644 --- a/docker/services/nova-vnc-proxy.yaml +++ b/docker/services/nova-vnc-proxy.yaml @@ -36,6 +36,10 @@ parameters: default: {} description: Parameters specific to the role type: json + UpgradeRemoveUnusedPackages: + default: false + description: Remove package if the service is being disabled during upgrade + type: boolean resources: @@ -61,6 +65,8 @@ outputs: value: service_name: {get_attr: [NovaVncProxyPuppetBase, role_data, service_name]} config_settings: {get_attr: [NovaVncProxyPuppetBase, role_data, config_settings]} + logging_source: {get_attr: [NovaVncProxyPuppetBase, role_data, logging_source]} + logging_groups: {get_attr: [NovaVncProxyPuppetBase, role_data, logging_groups]} step_config: &step_config list_join: - "\n" @@ -110,3 +116,8 @@ outputs: - name: Stop and disable nova_vnc_proxy service tags: step2 service: name=openstack-nova-novncproxy state=stopped enabled=no + - name: Remove openstack-nova-novncproxy package if operator requests it + yum: name=openstack-nova-novncproxy state=removed + tags: step2 + ignore_errors: True + when: {get_param: UpgradeRemoveUnusedPackages} diff --git a/docker/services/octavia-api.yaml b/docker/services/octavia-api.yaml index da698991..c5e729c4 100644 --- a/docker/services/octavia-api.yaml +++ b/docker/services/octavia-api.yaml @@ -69,6 +69,8 @@ outputs: value: service_name: {get_attr: [OctaviaApiPuppetBase, role_data, service_name]} config_settings: {get_attr: [OctaviaApiPuppetBase, role_data, config_settings]} + logging_source: {get_attr: [OctaviaApiPuppetBase, role_data, logging_source]} + logging_groups: {get_attr: [OctaviaApiPuppetBase, role_data, logging_groups]} step_config: &step_config list_join: - "\n" diff --git a/docker/services/octavia-health-manager.yaml b/docker/services/octavia-health-manager.yaml index f5e1eda5..5180e416 100644 --- a/docker/services/octavia-health-manager.yaml +++ b/docker/services/octavia-health-manager.yaml @@ -36,7 +36,10 @@ parameters: default: {} description: Parameters specific to the role type: json - + UpgradeRemoveUnusedPackages: + default: false + description: Remove package if the service is being disabled during upgrade + type: boolean resources: @@ -59,6 +62,8 @@ outputs: value: service_name: {get_attr: [OctaviaHealthManagerPuppetBase, role_data, service_name]} config_settings: {get_attr: [OctaviaHealthManagerPuppetBase, role_data, config_settings]} + logging_source: {get_attr: [OctaviaHealthManagerPuppetBase, role_data, logging_source]} + logging_groups: {get_attr: [OctaviaHealthManagerPuppetBase, role_data, logging_groups]} step_config: &step_config get_attr: [OctaviaHealthManagerPuppetBase, role_data, step_config] service_config_settings: {get_attr: [OctaviaHealthManagerPuppetBase, role_data, service_config_settings]} @@ -115,3 +120,8 @@ outputs: - name: Stop and disable octavia_health_manager service tags: step2 service: name=openstack-octavia-health-manager state=stopped enabled=no + - name: Remove openstack-octavia-health-manager package if operator requests it + yum: name=openstack-octavia-health-manager state=removed + tags: step2 + ignore_errors: True + when: {get_param: UpgradeRemoveUnusedPackages} diff --git a/docker/services/octavia-housekeeping.yaml b/docker/services/octavia-housekeeping.yaml index 1dc0db37..64e4f480 100644 --- a/docker/services/octavia-housekeeping.yaml +++ b/docker/services/octavia-housekeeping.yaml @@ -37,7 +37,6 @@ parameters: description: Parameters specific to the role type: json - resources: ContainersCommon: @@ -59,6 +58,8 @@ outputs: value: service_name: {get_attr: [OctaviaHousekeepingPuppetBase, role_data, service_name]} config_settings: {get_attr: [OctaviaHousekeepingPuppetBase, role_data, config_settings]} + logging_source: {get_attr: [OctaviaHousekeepingPuppetBase, role_data, logging_source]} + logging_groups: {get_attr: [OctaviaHousekeepingPuppetBase, role_data, logging_groups]} step_config: &step_config get_attr: [OctaviaHousekeepingPuppetBase, role_data, step_config] service_config_settings: {get_attr: [OctaviaHousekeepingPuppetBase, role_data, service_config_settings]} diff --git a/docker/services/octavia-worker.yaml b/docker/services/octavia-worker.yaml index d29e1a3a..e00f6bb8 100644 --- a/docker/services/octavia-worker.yaml +++ b/docker/services/octavia-worker.yaml @@ -37,7 +37,6 @@ parameters: description: Parameters specific to the role type: json - resources: ContainersCommon: @@ -59,6 +58,8 @@ outputs: value: service_name: {get_attr: [OctaviaWorkerPuppetBase, role_data, service_name]} config_settings: {get_attr: [OctaviaWorkerPuppetBase, role_data, config_settings]} + logging_source: {get_attr: [OctaviaWorkerPuppetBase, role_data, logging_source]} + logging_groups: {get_attr: [OctaviaWorkerPuppetBase, role_data, logging_groups]} step_config: &step_config get_attr: [OctaviaWorkerPuppetBase, role_data, step_config] service_config_settings: {get_attr: [OctaviaWorkerPuppetBase, role_data, service_config_settings]} diff --git a/docker/services/opendaylight-api.yaml b/docker/services/opendaylight-api.yaml index 2a6fcfe8..dbe49e9b 100644 --- a/docker/services/opendaylight-api.yaml +++ b/docker/services/opendaylight-api.yaml @@ -60,6 +60,8 @@ outputs: config_settings: map_merge: - get_attr: [OpenDaylightBase, role_data, config_settings] + logging_source: {get_attr: [OpenDaylightBase, role_data, logging_source]} + logging_groups: {get_attr: [OpenDaylightBase, role_data, logging_groups]} step_config: &step_config get_attr: [OpenDaylightBase, role_data, step_config] # BEGIN DOCKER SETTINGS diff --git a/docker/services/ovn-controller.yaml b/docker/services/ovn-controller.yaml index c5c365e2..285d14bb 100644 --- a/docker/services/ovn-controller.yaml +++ b/docker/services/ovn-controller.yaml @@ -60,6 +60,8 @@ outputs: config_settings: map_merge: - get_attr: [OvnControllerBase, role_data, config_settings] + logging_source: {get_attr: [OvnControllerBase, role_data, logging_source]} + logging_groups: {get_attr: [OvnControllerBase, role_data, logging_groups]} step_config: &step_config get_attr: [OvnControllerBase, role_data, step_config] service_config_settings: {get_attr: [OvnControllerBase, role_data, service_config_settings]} diff --git a/docker/services/ovn-dbs.yaml b/docker/services/ovn-dbs.yaml index f6ac62ed..977f95fb 100644 --- a/docker/services/ovn-dbs.yaml +++ b/docker/services/ovn-dbs.yaml @@ -63,6 +63,8 @@ outputs: config_settings: map_merge: - get_attr: [OVNDbsBase, role_data, config_settings] + logging_source: {get_attr: [OVNDbsBase, role_data, logging_source]} + logging_groups: {get_attr: [OVNDbsBase, role_data, logging_groups]} step_config: &step_config get_attr: [OVNDbsBase, role_data, step_config] # BEGIN DOCKER SETTINGS diff --git a/docker/services/pacemaker/cinder-backup.yaml b/docker/services/pacemaker/cinder-backup.yaml index cdb8c1bc..4a99184f 100644 --- a/docker/services/pacemaker/cinder-backup.yaml +++ b/docker/services/pacemaker/cinder-backup.yaml @@ -85,6 +85,8 @@ outputs: - 'pcmklatest' cinder::backup::manage_service: false cinder::backup::enabled: false + logging_source: {get_attr: [CinderBackupBase, role_data, logging_source]} + logging_groups: {get_attr: [CinderBackupBase, role_data, logging_groups]} step_config: "" service_config_settings: {get_attr: [CinderBackupBase, role_data, service_config_settings]} # BEGIN DOCKER SETTINGS @@ -205,3 +207,33 @@ outputs: - name: Disable cinder_backup service tags: step2 service: name=openstack-cinder-backup enabled=no + update_tasks: + - name: Get docker Cinder-Backup image + set_fact: + docker_image: {get_param: DockerCinderBackupImage} + docker_image_latest: *cinder_backup_image_pcmklatest + when: step == '2' + - name: Pull latest Cinder-Backup images + command: "docker pull {{docker_image}}" + when: step == "2" + - name: Get previous Cinder-Backup image id + shell: "docker images | awk '/cinder-backup.* pcmklatest/{print $3}'" + register: cinder_backup_image_id + - block: + - name: Get a list of container using Cinder-Backup image + shell: "docker ps -q -f 'ancestor={{cinder_backup_image_id.stdout}}'" + register: cinder_backup_containers_to_destroy + # It will be recreated with the delpoy step. + - name: Remove any container using the same Cinder-Backup image + shell: "docker rm -fv {{item}}" + with_items: "{{ cinder_backup_containers_to_destroy.stdout_lines }}" + - name: Remove previous Cinder-Backup images + shell: "docker rmi -f {{cinder_backup_image_id.stdout}}" + when: + - step == '2' + - cinder_backup_image_id.stdout != '' + - name: Retag pcmklatest to latest Cinder-Backup image + shell: "docker tag {{docker_image}} {{docker_image_latest}}" + when: step == "2" + # Got to check that pacemaker_is_active is working fine with bundle. + # TODO: pacemaker_is_active resource doesn't support bundle. diff --git a/docker/services/pacemaker/cinder-volume.yaml b/docker/services/pacemaker/cinder-volume.yaml index 15c5e099..ce93e5f1 100644 --- a/docker/services/pacemaker/cinder-volume.yaml +++ b/docker/services/pacemaker/cinder-volume.yaml @@ -79,6 +79,8 @@ outputs: cinder::volume::manage_service: false cinder::volume::enabled: false cinder::host: hostgroup + logging_source: {get_attr: [CinderBase, role_data, logging_source]} + logging_groups: {get_attr: [CinderBase, role_data, logging_groups]} step_config: "" service_config_settings: {get_attr: [CinderBase, role_data, service_config_settings]} # BEGIN DOCKER SETTINGS @@ -223,6 +225,33 @@ outputs: - name: Disable cinder_volume service from boot tags: step2 service: name=openstack-cinder-volume enabled=no - - - + update_tasks: + - name: Get docker Cinder-Volume image + set_fact: + docker_image: {get_param: DockerCinderVolumeImage} + docker_image_latest: *cinder_volume_image_pcmklatest + when: step == '2' + - name: Get previous Cinder-Volume image id + shell: "docker images | awk '/cinder-volume.* pcmklatest/{print $3}'" + register: cinder_volume_image_id + - block: + - name: Get a list of container using Cinder-Volume image + shell: "docker ps -q -f 'ancestor={{cinder_volume_image_id.stdout}}'" + register: cinder_volume_containers_to_destroy + # It will be recreated with the delpoy step. + - name: Remove any container using the same Cinder-Volume image + shell: "docker rm -fv {{item}}" + with_items: "{{ cinder_volume_containers_to_destroy.stdout_lines }}" + - name: Remove previous Cinder-Volume images + shell: "docker rmi -f {{cinder_volume_image_id.stdout}}" + when: + - step == '2' + - cinder_volume_image_id.stdout != '' + - name: Pull latest Cinder-Volume images + command: "docker pull {{docker_image}}" + when: step == "2" + - name: Retag pcmklatest to latest Cinder-Volume image + shell: "docker tag {{docker_image}} {{docker_image_latest}}" + when: step == "2" + # Got to check that pacemaker_is_active is working fine with bundle. + # TODO: pacemaker_is_active resource doesn't support bundle. diff --git a/docker/services/pacemaker/clustercheck.yaml b/docker/services/pacemaker/clustercheck.yaml index c7c316a4..b5d128d4 100644 --- a/docker/services/pacemaker/clustercheck.yaml +++ b/docker/services/pacemaker/clustercheck.yaml @@ -60,6 +60,8 @@ outputs: value: service_name: clustercheck config_settings: {get_attr: [MysqlPuppetBase, role_data, config_settings]} + logging_source: {get_attr: [MysqlPuppetBase, role_data, logging_source]} + logging_groups: {get_attr: [MysqlPuppetBase, role_data, logging_groups]} step_config: "include ::tripleo::profile::pacemaker::clustercheck" # BEGIN DOCKER SETTINGS # puppet_config: @@ -93,3 +95,5 @@ outputs: - KOLLA_CONFIG_STRATEGY=COPY_ALWAYS host_prep_tasks: upgrade_tasks: + update_tasks: + # Nothing: It's not managed by pacemaker, so let paunch do it. diff --git a/docker/services/pacemaker/database/mysql.yaml b/docker/services/pacemaker/database/mysql.yaml index 9dace271..a65117fc 100644 --- a/docker/services/pacemaker/database/mysql.yaml +++ b/docker/services/pacemaker/database/mysql.yaml @@ -97,6 +97,12 @@ outputs: - 4567 - 4568 - 9200 + tripleo::profile::pacemaker::database::mysql_bundle::bind_address: + str_replace: + template: + "%{hiera('fqdn_$NETWORK')}" + params: + $NETWORK: {get_param: [ServiceNetMap, MysqlNetwork]} - if: - internal_tls_enabled @@ -104,6 +110,8 @@ outputs: tripleo::profile::pacemaker::database::mysql_bundle::ca_file: get_param: InternalTLSCAFile - {} + logging_source: {get_attr: [MysqlPuppetBase, role_data, logging_source]} + logging_groups: {get_attr: [MysqlPuppetBase, role_data, logging_groups]} step_config: "" # BEGIN DOCKER SETTINGS # puppet_config: @@ -305,3 +313,33 @@ outputs: - name: Restart xinetd service after clustercheck removal tags: step2 service: name=xinetd state=restarted + update_tasks: + - name: Get docker Mariadb image + set_fact: + docker_image: {get_param: DockerMysqlImage} + docker_image_latest: *mysql_image_pcmklatest + when: step == '2' + - name: Get previous Mariadb image id + shell: "docker images | awk '/mariadb.* pcmklatest/{print $3}'" + register: mariadb_image_id + - block: + - name: Get a list of container using Mariadb image + shell: "docker ps -q -f 'ancestor={{mariadb_image_id.stdout}}'" + register: mariadb_containers_to_destroy + # It will be recreated with the delpoy step. + - name: Remove any container using the same Mariadb image + shell: "docker rm -fv {{item}}" + with_items: "{{ mariadb_containers_to_destroy.stdout_lines }}" + - name: Remove previous Mariadb images + shell: "docker rmi -f {{mariadb_image_id.stdout}}" + when: + - step == '2' + - mariadb_image_id.stdout != '' + - name: Pull latest Mariadb images + command: "docker pull {{docker_image}}" + when: step == "2" + - name: Retag pcmklatest to latest Mariadb image + shell: "docker tag {{docker_image}} {{docker_image_latest}}" + when: step == "2" + # Got to check that pacemaker_is_active is working fine with bundle. + # TODO: pacemaker_is_active resource doesn't support bundle. diff --git a/docker/services/pacemaker/database/redis.yaml b/docker/services/pacemaker/database/redis.yaml index 4d26a084..fe69bb00 100644 --- a/docker/services/pacemaker/database/redis.yaml +++ b/docker/services/pacemaker/database/redis.yaml @@ -86,6 +86,8 @@ outputs: - 26379 tripleo::stunnel::manage_service: false tripleo::stunnel::foreground: 'yes' + logging_source: {get_attr: [RedisBase, role_data, logging_source]} + logging_groups: {get_attr: [RedisBase, role_data, logging_groups]} step_config: "" service_config_settings: {get_attr: [RedisBase, role_data, service_config_settings]} # BEGIN DOCKER SETTINGS @@ -253,3 +255,33 @@ outputs: - name: Disable redis service tags: step2 service: name=redis enabled=no + update_tasks: + - name: Get docker Redis image + set_fact: + docker_image: {get_param: DockerRedisImage} + docker_image_latest: *redis_image_pcmklatest + when: step == '2' + - name: Get previous Redis image id + shell: "docker images | awk '/redis.* pcmklatest/{print $3}'" + register: redis_image_id + - block: + - name: Get a list of container using Redis image + shell: "docker ps -q -f 'ancestor={{redis_image_id.stdout}}'" + register: redis_containers_to_destroy + # It will be recreated with the delpoy step. + - name: Remove any container using the same Redis image + shell: "docker rm -fv {{item}}" + with_items: "{{ redis_containers_to_destroy.stdout_lines }}" + - name: Remove previous Redis images + shell: "docker rmi -f {{redis_image_id.stdout}}" + when: + - step == '2' + - redis_image_id.stdout != '' + - name: Pull latest Redis images + command: "docker pull {{docker_image}}" + when: step == "2" + - name: Retag pcmklatest to latest Redis image + shell: "docker tag {{docker_image}} {{docker_image_latest}}" + when: step == "2" + # Got to check that pacemaker_is_active is working fine with bundle. + # TODO: pacemaker_is_active resource doesn't support bundle. diff --git a/docker/services/pacemaker/haproxy.yaml b/docker/services/pacemaker/haproxy.yaml index 2cc04e96..f1c8f905 100644 --- a/docker/services/pacemaker/haproxy.yaml +++ b/docker/services/pacemaker/haproxy.yaml @@ -99,6 +99,8 @@ outputs: data: {get_param: DockerHAProxyImage} expression: $.data.rightSplit(separator => ":", maxSplits => 1)[0] - 'pcmklatest' + logging_source: {get_attr: [HAProxyBase, role_data, logging_source]} + logging_groups: {get_attr: [HAProxyBase, role_data, logging_groups]} step_config: "" service_config_settings: {get_attr: [HAProxyBase, role_data, service_config_settings]} # BEGIN DOCKER SETTINGS @@ -251,3 +253,33 @@ outputs: retries: 5 until: output.rc == 0 when: is_bootstrap_node and haproxy_res|succeeded + update_tasks: + - name: Get docker Haproxy image + set_fact: + docker_image: {get_param: DockerHAProxyImage} + docker_image_latest: *haproxy_image_pcmklatest + when: step == '2' + - name: Get previous Haproxy image id + shell: "docker images | awk '/haproxy.* pcmklatest/{print $3}'" + register: haproxy_image_id + - block: + - name: Get a list of container using Haproxy image + shell: "docker ps -q -f 'ancestor={{haproxy_image_id.stdout}}'" + register: haproxy_containers_to_destroy + # It will be recreated with the delpoy step. + - name: Remove any container using the same Haproxy image + shell: "docker rm -fv {{item}}" + with_items: "{{ haproxy_containers_to_destroy.stdout_lines }}" + - name: Remove previous Haproxy images + shell: "docker rmi -f {{haproxy_image_id.stdout}}" + when: + - step == '2' + - haproxy_image_id.stdout != '' + - name: Pull latest Haproxy images + command: "docker pull {{docker_image}}" + when: step == "2" + - name: Retag pcmklatest to latest Haproxy image + shell: "docker tag {{docker_image}} {{docker_image_latest}}" + when: step == "2" + # Got to check that pacemaker_is_active is working fine with bundle. + # TODO: pacemaker_is_active resource doesn't support bundle. diff --git a/docker/services/pacemaker/manila-share.yaml b/docker/services/pacemaker/manila-share.yaml index 805f101c..55f66b9b 100644 --- a/docker/services/pacemaker/manila-share.yaml +++ b/docker/services/pacemaker/manila-share.yaml @@ -69,6 +69,8 @@ outputs: manila::share::manage_service: false manila::share::enabled: false manila::host: hostgroup + logging_source: {get_attr: [ManilaBase, role_data, logging_source]} + logging_groups: {get_attr: [ManilaBase, role_data, logging_groups]} step_config: "" service_config_settings: {get_attr: [ManilaBase, role_data, service_config_settings]} # BEGIN DOCKER SETTINGS @@ -164,3 +166,33 @@ outputs: - name: Stop and disable manila_share service tags: step2 service: name=openstack-manila-share state=stopped enabled=no + update_tasks: + - name: Get docker Manila-Share image + set_fact: + docker_image: {get_param: DockerManilaShareImage} + docker_image_latest: *manila_share_image_pcmklatest + when: step == '2' + - name: Get previous Manila-Share image id + shell: "docker images | awk '/manila-share.* pcmklatest/{print $3}'" + register: manila_share_image_id + - block: + - name: Get a list of container using Manila-Share image + shell: "docker ps -q -f 'ancestor={{manila_share_image_id.stdout}}'" + register: manila-share_containers_to_destroy + # It will be recreated with the delpoy step. + - name: Remove any container using the same Manila-Share image + shell: "docker rm -fv {{item}}" + with_items: "{{ manila_share_containers_to_destroy.stdout_lines }}" + - name: Remove previous Manila-Share images + shell: "docker rmi -f {{manila_share_image_id.stdout}}" + when: + - step == '2' + - manila_share_image_id.stdout != '' + - name: Pull latest Manila-Share images + command: "docker pull {{docker_image}}" + when: step == "2" + - name: Retag pcmklatest to latest Manila-Share image + shell: "docker tag {{docker_image}} {{docker_image_latest}}" + when: step == "2" + # Got to check that pacemaker_is_active is working fine with bundle. + # TODO: pacemaker_is_active resource doesn't support bundle. diff --git a/docker/services/pacemaker/ovn-dbs.yaml b/docker/services/pacemaker/ovn-dbs.yaml index 03c5a397..1658b093 100644 --- a/docker/services/pacemaker/ovn-dbs.yaml +++ b/docker/services/pacemaker/ovn-dbs.yaml @@ -73,6 +73,8 @@ outputs: - tripleo::profile::pacemaker::ovn_dbs_bundle::ovn_dbs_docker_image: {get_param: DockerOvnDbsImage} - tripleo::profile::pacemaker::ovn_dbs_bundle::nb_db_port: {get_param: OVNNorthboundServerPort} - tripleo::profile::pacemaker::ovn_dbs_bundle::sb_db_port: {get_param: OVNSouthboundServerPort} + logging_source: {get_attr: [OVNDbsBase, role_data, logging_source]} + logging_groups: {get_attr: [OVNDbsBase, role_data, logging_groups]} step_config: '' service_config_settings: {get_attr: [OVNDbsBase, role_data, service_config_settings]} # BEGIN DOCKER SETTINGS diff --git a/docker/services/pacemaker/rabbitmq.yaml b/docker/services/pacemaker/rabbitmq.yaml index 7333689c..f17747c0 100644 --- a/docker/services/pacemaker/rabbitmq.yaml +++ b/docker/services/pacemaker/rabbitmq.yaml @@ -77,6 +77,8 @@ outputs: - 4369 - 5672 - 25672 + logging_source: {get_attr: [RabbitmqBase, role_data, logging_source]} + logging_groups: {get_attr: [RabbitmqBase, role_data, logging_groups]} step_config: &step_config get_attr: [RabbitmqBase, role_data, step_config] service_config_settings: {get_attr: [RabbitmqBase, role_data, service_config_settings]} @@ -246,3 +248,33 @@ outputs: - name: Disable rabbitmq service tags: step2 service: name=rabbitmq-server enabled=no + update_tasks: + - name: Get docker Rabbitmq image + set_fact: + docker_image: {get_param: DockerRabbitmqImage} + docker_image_latest: *rabbitmq_image_pcmklatest + when: step == '2' + - name: Get previous Rabbitmq image id + shell: "docker images | awk '/rabbitmq.* pcmklatest/{print $3}'" + register: rabbitmq_image_id + - block: + - name: Get a list of container using Rabbitmq image + shell: "docker ps -q -f 'ancestor={{rabbitmq_image_id.stdout}}'" + register: rabbitmq_containers_to_destroy + # It will be recreated with the delpoy step. + - name: Remove any container using the same Rabbitmq image + shell: "docker rm -fv {{item}}" + with_items: "{{ rabbitmq_containers_to_destroy.stdout_lines }}" + - name: Remove previous Rabbitmq images + shell: "docker rmi -f {{rabbitmq_image_id.stdout}}" + when: + - step == '2' + - rabbitmq_image_id.stdout != '' + - name: Pull latest Rabbitmq images + command: "docker pull {{docker_image}}" + when: step == "2" + - name: Retag pcmklatest to latest Rabbitmq image + shell: "docker tag {{docker_image}} {{docker_image_latest}}" + when: step == "2" + # Got to check that pacemaker_is_active is working fine with bundle. + # TODO: pacemaker_is_active resource doesn't support bundle. diff --git a/docker/services/panko-api.yaml b/docker/services/panko-api.yaml index 3edd9049..7987c8dc 100644 --- a/docker/services/panko-api.yaml +++ b/docker/services/panko-api.yaml @@ -73,6 +73,8 @@ outputs: map_merge: - get_attr: [PankoApiPuppetBase, role_data, config_settings] - apache::default_vhost: false + logging_source: {get_attr: [PankoApiPuppetBase, role_data, logging_source]} + logging_groups: {get_attr: [PankoApiPuppetBase, role_data, logging_groups]} step_config: &step_config list_join: - "\n" diff --git a/docker/services/rabbitmq.yaml b/docker/services/rabbitmq.yaml index add78879..237995b9 100644 --- a/docker/services/rabbitmq.yaml +++ b/docker/services/rabbitmq.yaml @@ -82,6 +82,8 @@ outputs: - internal_tls_enabled - tripleo::certmonger::rabbitmq::postsave_cmd: "true" # TODO: restart the rabbitmq container here - {} + logging_source: {get_attr: [RabbitmqBase, role_data, logging_source]} + logging_groups: {get_attr: [RabbitmqBase, role_data, logging_groups]} step_config: &step_config list_join: - "\n" @@ -218,3 +220,9 @@ outputs: - name: Stop and disable rabbitmq service tags: step2 service: name=rabbitmq-server state=stopped enabled=no + update_tasks: + # TODO: Are we sure we want to support this. Rolling update + # without pacemaker may fail. Do we test this ? In any case, + # this is under paunch control so the latest image should be + # pulled in by the deploy steps. Same question for other + # usually managed by pacemaker container. diff --git a/docker/services/sahara-api.yaml b/docker/services/sahara-api.yaml index b0c3736c..cf7eae85 100644 --- a/docker/services/sahara-api.yaml +++ b/docker/services/sahara-api.yaml @@ -36,6 +36,10 @@ parameters: default: {} description: Parameters specific to the role type: json + UpgradeRemoveUnusedPackages: + default: false + description: Remove package if the service is being disabled during upgrade + type: boolean resources: @@ -62,6 +66,8 @@ outputs: map_merge: - get_attr: [SaharaApiPuppetBase, role_data, config_settings] - sahara::sync_db: false + logging_source: {get_attr: [SaharaApiPuppetBase, role_data, logging_source]} + logging_groups: {get_attr: [SaharaApiPuppetBase, role_data, logging_groups]} step_config: &step_config list_join: - "\n" @@ -136,3 +142,8 @@ outputs: - name: Stop and disable sahara_api service tags: step2 service: name=openstack-sahara-api state=stopped enabled=no + - name: Remove openstack-sahara-api package if operator requests it + yum: name=openstack-sahara-api state=removed + tags: step2 + ignore_errors: True + when: {get_param: UpgradeRemoveUnusedPackages} diff --git a/docker/services/sahara-engine.yaml b/docker/services/sahara-engine.yaml index b1660296..0a061bd3 100644 --- a/docker/services/sahara-engine.yaml +++ b/docker/services/sahara-engine.yaml @@ -36,6 +36,10 @@ parameters: default: {} description: Parameters specific to the role type: json + UpgradeRemoveUnusedPackages: + default: false + description: Remove package if the service is being disabled during upgrade + type: boolean resources: @@ -62,6 +66,8 @@ outputs: map_merge: - get_attr: [SaharaEnginePuppetBase, role_data, config_settings] - sahara::sync_db: false + logging_source: {get_attr: [SaharaEnginePuppetBase, role_data, logging_source]} + logging_groups: {get_attr: [SaharaEnginePuppetBase, role_data, logging_groups]} step_config: &step_config list_join: - "\n" @@ -119,3 +125,8 @@ outputs: - name: Stop and disable sahara_engine service tags: step2 service: name=openstack-sahara-engine state=stopped enabled=no + - name: Remove openstack-sahara-engine package if operator requests it + yum: name=openstack-sahara-engine state=removed + tags: step2 + ignore_errors: True + when: {get_param: UpgradeRemoveUnusedPackages} diff --git a/docker/services/sensu-client.yaml b/docker/services/sensu-client.yaml index b64231cd..a535af46 100644 --- a/docker/services/sensu-client.yaml +++ b/docker/services/sensu-client.yaml @@ -39,13 +39,17 @@ parameters: SensuDockerCheckCommand: type: string default: | + output='' for i in $(docker ps --format '{{.ID}}'); do if result=$(docker inspect --format='{{.State.Health.Status}}' $i 2>/dev/null); then if [ "$result" != 'healthy' ]; then - echo "$(docker inspect --format='{{.Name}}' $i) ($i): $(docker inspect --format='{{json .State}}' $i)" && exit 2; + output="${output} ; $(docker inspect --format='{{.Name}}' $i) ($i): $(docker inspect --format='{{(index .State.Health.Log 0).Output}}' $i)"; fi fi done + if [ ! -z "${output}" ]; then + echo ${output:3} && exit 2; + fi SensuDockerCheckInterval: type: number description: The frequency in seconds the docker health check is executed. diff --git a/docker/services/sshd.yaml b/docker/services/sshd.yaml new file mode 100644 index 00000000..6f57f13d --- /dev/null +++ b/docker/services/sshd.yaml @@ -0,0 +1,72 @@ +heat_template_version: pike + +description: > + Configure sshd_config + +parameters: + ServiceData: + default: {} + description: Dictionary packing service data + type: json + ServiceNetMap: + default: {} + description: Mapping of service_name -> network name. Typically set + via parameter_defaults in the resource registry. This + mapping overrides those in ServiceNetMapDefaults. + type: json + DefaultPasswords: + default: {} + type: json + RoleName: + default: '' + description: Role name on which the service is applied + type: string + RoleParameters: + default: {} + description: Parameters specific to the role + type: json + EndpointMap: + default: {} + description: Mapping of service endpoint -> protocol. Typically set + via parameter_defaults in the resource registry. + type: json + MigrationSshPort: + default: 2022 + description: Target port for migration over ssh + type: number + +conditions: + + # During Ocata->Pike upgrade initially configure the ssh service on port 22 + # to proxy migration commands to the containerized sshd on port 2022. + # When the upgrade converges we can switch migrations over to port 2022. + enable_migration_proxy: + equals: + - {get_param: MigrationSshPort} + - 22 + +resources: + SshdBase: + type: ../../puppet/services/sshd.yaml + properties: + EndpointMap: {get_param: EndpointMap} + ServiceNetMap: {get_param: ServiceNetMap} + DefaultPasswords: {get_param: DefaultPasswords} + RoleName: {get_param: RoleName} + RoleParameters: {get_param: RoleParameters} + +outputs: + role_data: + description: Role data for the ssh + value: + service_name: sshd + config_settings: {get_attr: [SshdBase, role_data, config_settings]} + step_config: + list_join: + - "\n" + - - get_attr: [SshdBase, role_data, step_config] + - if: + - enable_migration_proxy + - | + include tripleo::profile::base::nova::migration::proxy + - '' diff --git a/docker/services/swift-proxy.yaml b/docker/services/swift-proxy.yaml index 86871210..3a27ab85 100644 --- a/docker/services/swift-proxy.yaml +++ b/docker/services/swift-proxy.yaml @@ -39,6 +39,10 @@ parameters: EnableInternalTLS: type: boolean default: false + UpgradeRemoveUnusedPackages: + default: false + description: Remove package if the service is being disabled during upgrade + type: boolean conditions: @@ -67,6 +71,8 @@ outputs: config_settings: {get_attr: [SwiftProxyBase, role_data, config_settings]} step_config: &step_config get_attr: [SwiftProxyBase, role_data, step_config] + logging_source: {get_attr: [SwiftProxyBase, role_data, logging_source]} + logging_groups: {get_attr: [SwiftProxyBase, role_data, logging_groups]} service_config_settings: {get_attr: [SwiftProxyBase, role_data, service_config_settings]} # BEGIN DOCKER SETTINGS puppet_config: @@ -145,5 +151,10 @@ outputs: - name: Stop and disable swift_proxy service tags: step2 service: name=openstack-swift-proxy state=stopped enabled=no + - name: Remove openstack-swift-proxy package if operator requests it + yum: name=openstack-swift-proxy state=removed + tags: step2 + ignore_errors: True + when: {get_param: UpgradeRemoveUnusedPackages} metadata_settings: get_attr: [SwiftProxyBase, role_data, metadata_settings] diff --git a/docker/services/swift-ringbuilder.yaml b/docker/services/swift-ringbuilder.yaml index 2a44f703..bfb57edd 100644 --- a/docker/services/swift-ringbuilder.yaml +++ b/docker/services/swift-ringbuilder.yaml @@ -91,6 +91,8 @@ outputs: map_merge: - {get_attr: [SwiftRingbuilderBase, role_data, config_settings]} - tripleo::profile::base::swift::ringbuilder:skip_consistency_check: true + logging_source: {get_attr: [SwiftRingbuilderBase, role_data, logging_source]} + logging_groups: {get_attr: [SwiftRingbuilderBase, role_data, logging_groups]} step_config: &step_config get_attr: [SwiftRingbuilderBase, role_data, step_config] service_config_settings: {get_attr: [SwiftRingbuilderBase, role_data, service_config_settings]} diff --git a/docker/services/swift-storage.yaml b/docker/services/swift-storage.yaml index e879b25d..e0c1194a 100644 --- a/docker/services/swift-storage.yaml +++ b/docker/services/swift-storage.yaml @@ -50,7 +50,10 @@ parameters: default: {} description: 'A hash of additional raw devices to use as Swift backend (eg. {sdb: {}})' type: json - + UpgradeRemoveUnusedPackages: + default: false + description: Remove package if the service is being disabled during upgrade + type: boolean resources: @@ -77,6 +80,8 @@ outputs: - {get_attr: [SwiftStorageBase, role_data, config_settings]} # FIXME (cschwede): re-enable this once checks works inside containers - swift::storage::all::mount_check: false + logging_source: {get_attr: [SwiftStorageBase, role_data, logging_source]} + logging_groups: {get_attr: [SwiftStorageBase, role_data, logging_groups]} step_config: &step_config get_attr: [SwiftStorageBase, role_data, step_config] service_config_settings: {get_attr: [SwiftStorageBase, role_data, service_config_settings]} @@ -466,3 +471,12 @@ outputs: - openstack-swift-object-replicator - openstack-swift-object-updater - openstack-swift-object + - name: Remove openstack-swift-container,object,account packages if operator requests it + yum: name={{ item }} state=removed + tags: step2 + ignore_errors: True + when: {get_param: UpgradeRemoveUnusedPackages} + with_items: + - openstack-swift-container + - openstack-swift-object + - openstack-swift-account diff --git a/docker/services/tacker.yaml b/docker/services/tacker.yaml index 1b7d78ca..9bd5de26 100644 --- a/docker/services/tacker.yaml +++ b/docker/services/tacker.yaml @@ -63,6 +63,8 @@ outputs: config_settings: map_merge: - get_attr: [TackerBase, role_data, config_settings] + logging_source: {get_attr: [TackerBase, role_data, logging_source]} + logging_groups: {get_attr: [TackerBase, role_data, logging_groups]} step_config: &step_config list_join: - "\n" diff --git a/docker/services/zaqar.yaml b/docker/services/zaqar.yaml index ab30ab5a..ff40cb1a 100644 --- a/docker/services/zaqar.yaml +++ b/docker/services/zaqar.yaml @@ -73,6 +73,8 @@ outputs: value: service_name: {get_attr: [ZaqarBase, role_data, service_name]} config_settings: {get_attr: [ZaqarBase, role_data, config_settings]} + logging_source: {get_attr: [ZaqarBase, role_data, logging_source]} + logging_groups: {get_attr: [ZaqarBase, role_data, logging_groups]} step_config: &step_config list_join: - "\n" diff --git a/environments/docker-services-tls-everywhere.yaml b/environments/docker-services-tls-everywhere.yaml index ba190e7c..342f2781 100644 --- a/environments/docker-services-tls-everywhere.yaml +++ b/environments/docker-services-tls-everywhere.yaml @@ -49,6 +49,7 @@ resource_registry: OS::TripleO::Services::PankoApi: ../docker/services/panko-api.yaml OS::TripleO::Services::RabbitMQ: ../docker/services/rabbitmq.yaml OS::TripleO::Services::Redis: ../docker/services/database/redis.yaml + OS::TripleO::Services::Sshd: ../docker/services/sshd.yaml OS::TripleO::Services::SwiftProxy: ../docker/services/swift-proxy.yaml OS::TripleO::Services::SwiftRingBuilder: ../docker/services/swift-ringbuilder.yaml OS::TripleO::Services::SwiftStorage: ../docker/services/swift-storage.yaml diff --git a/environments/docker.yaml b/environments/docker.yaml index 06e3d3ab..57379925 100644 --- a/environments/docker.yaml +++ b/environments/docker.yaml @@ -32,6 +32,7 @@ resource_registry: OS::TripleO::Services::RabbitMQ: ../docker/services/rabbitmq.yaml OS::TripleO::Services::Redis: ../docker/services/database/redis.yaml OS::TripleO::Services::Memcached: ../docker/services/memcached.yaml + OS::TripleO::Services::Sshd: ../docker/services/sshd.yaml OS::TripleO::Services::SwiftProxy: ../docker/services/swift-proxy.yaml OS::TripleO::Services::SwiftStorage: ../docker/services/swift-storage.yaml OS::TripleO::Services::SwiftRingBuilder: ../docker/services/swift-ringbuilder.yaml diff --git a/environments/major-upgrade-composable-steps-docker.yaml b/environments/major-upgrade-composable-steps-docker.yaml index 888e2705..1f45d025 100644 --- a/environments/major-upgrade-composable-steps-docker.yaml +++ b/environments/major-upgrade-composable-steps-docker.yaml @@ -9,3 +9,5 @@ parameter_defaults: set -eu # Ocata to Pike, put any needed host-level workarounds here yum install -y ansible-pacemaker + MigrationSshPort: 22 + UpgradeRemoveUnusedPackages: false
\ No newline at end of file diff --git a/environments/major-upgrade-composable-steps.yaml b/environments/major-upgrade-composable-steps.yaml index db83f906..e8a00740 100644 --- a/environments/major-upgrade-composable-steps.yaml +++ b/environments/major-upgrade-composable-steps.yaml @@ -14,3 +14,5 @@ parameter_defaults: rm -f /usr/libexec/os-apply-config/templates/etc/puppet/hiera.yaml rm -f /usr/libexec/os-refresh-config/configure.d/40-hiera-datafiles rm -f /etc/puppet/hieradata/*.yaml + MigrationSshPort: 22 + UpgradeRemoveUnusedPackages: false
\ No newline at end of file diff --git a/environments/major-upgrade-converge-docker.yaml b/environments/major-upgrade-converge-docker.yaml index 668f8a94..3f0a3ecd 100644 --- a/environments/major-upgrade-converge-docker.yaml +++ b/environments/major-upgrade-converge-docker.yaml @@ -8,3 +8,4 @@ parameter_defaults: UpgradeLevelNovaCompute: '' UpgradeInitCommonCommand: '' UpgradeInitCommand: '' + MigrationSshPort: 2022 diff --git a/environments/major-upgrade-converge.yaml b/environments/major-upgrade-converge.yaml index 668f8a94..3f0a3ecd 100644 --- a/environments/major-upgrade-converge.yaml +++ b/environments/major-upgrade-converge.yaml @@ -8,3 +8,4 @@ parameter_defaults: UpgradeLevelNovaCompute: '' UpgradeInitCommonCommand: '' UpgradeInitCommand: '' + MigrationSshPort: 2022 diff --git a/environments/network-isolation-v6.j2.yaml b/environments/network-isolation-v6.j2.yaml index bb27ee43..617dfa61 100644 --- a/environments/network-isolation-v6.j2.yaml +++ b/environments/network-isolation-v6.j2.yaml @@ -28,6 +28,7 @@ resource_registry: OS::TripleO::Network::Ports::RedisVipPort: ../network/ports/vip_v6.yaml + # Port assignments by role, edit role definition to assign networks to roles. {%- for role in roles %} # Port assignments for the {{role.name}} {%- for network in networks %} @@ -36,11 +37,9 @@ resource_registry: {%- elif network.name in role.networks|default([]) and network.enabled|default(true) and network.name == 'Tenant' %} # IPv4 until OVS and Neutron support IPv6 tunnel endpoints OS::TripleO::{{role.name}}::Ports::{{network.name}}Port: ../network/ports/{{network.name_lower|default(network.name.lower())}}.yaml - {%- else %} - OS::TripleO::{{role.name}}::Ports::{{network.name}}Port: ../network/ports/noop.yaml {%- endif %} {%- endfor %} -{%- endfor %} +{% endfor %} parameter_defaults: diff --git a/environments/network-isolation.j2.yaml b/environments/network-isolation.j2.yaml index 2db1a828..3d4f59b6 100644 --- a/environments/network-isolation.j2.yaml +++ b/environments/network-isolation.j2.yaml @@ -22,13 +22,12 @@ resource_registry: {%- endfor %} OS::TripleO::Network::Ports::RedisVipPort: ../network/ports/vip.yaml + # Port assignments by role, edit role definition to assign networks to roles. {%- for role in roles %} # Port assignments for the {{role.name}} {%- for network in networks %} {%- if network.name in role.networks|default([]) and network.enabled|default(true) %} OS::TripleO::{{role.name}}::Ports::{{network.name}}Port: ../network/ports/{{network.name_lower|default(network.name.lower())}}.yaml - {%- else %} - OS::TripleO::{{role.name}}::Ports::{{network.name}}Port: ../network/ports/noop.yaml {%- endif %} {%- endfor %} -{%- endfor %} +{% endfor %} diff --git a/environments/nova-nuage-config.yaml b/environments/nova-nuage-config.yaml index 5e75ed9e..e8e3aaa4 100644 --- a/environments/nova-nuage-config.yaml +++ b/environments/nova-nuage-config.yaml @@ -1,8 +1,7 @@ # A Heat environment file which can be used to enable # Nuage backend on the compute, configured via puppet resource_registry: - OS::TripleO::ComputeExtraConfigPre: ../puppet/extraconfig/pre_deploy/compute/nova-nuage.yaml - OS::TripleO::Services::ComputeNeutronCorePlugin: ../puppet/services/neutron-compute-plugin-nuage.yaml + OS::TripleO::Services::ComputeNeutronCorePlugin: OS::TripleO::Services::ComputeNeutronCorePluginNuage parameter_defaults: NuageActiveController: '0.0.0.0' diff --git a/environments/services-docker/fluentd-client.yaml b/environments/services-docker/fluentd-client.yaml new file mode 100644 index 00000000..1781a59c --- /dev/null +++ b/environments/services-docker/fluentd-client.yaml @@ -0,0 +1,2 @@ +resource_registry: + OS::TripleO::Services::FluentdClient: ../../docker/services/fluentd-client.yaml diff --git a/environments/ssl/tls-endpoints-public-dns.yaml b/environments/ssl/tls-endpoints-public-dns.yaml index 3b3ddc16..d1bd2d20 100644 --- a/environments/ssl/tls-endpoints-public-dns.yaml +++ b/environments/ssl/tls-endpoints-public-dns.yaml @@ -77,9 +77,9 @@ parameter_defaults: OctaviaAdmin: {protocol: 'http', port: '9876', host: 'IP_ADDRESS'} OctaviaInternal: {protocol: 'http', port: '9876', host: 'IP_ADDRESS'} OctaviaPublic: {protocol: 'https', port: '13876', host: 'CLOUDNAME'} - PankoAdmin: {protocol: 'http', port: '8779', host: 'IP_ADDRESS'} - PankoInternal: {protocol: 'http', port: '8779', host: 'IP_ADDRESS'} - PankoPublic: {protocol: 'https', port: '13779', host: 'CLOUDNAME'} + PankoAdmin: {protocol: 'http', port: '8977', host: 'IP_ADDRESS'} + PankoInternal: {protocol: 'http', port: '8977', host: 'IP_ADDRESS'} + PankoPublic: {protocol: 'https', port: '13977', host: 'CLOUDNAME'} SaharaAdmin: {protocol: 'http', port: '8386', host: 'IP_ADDRESS'} SaharaInternal: {protocol: 'http', port: '8386', host: 'IP_ADDRESS'} SaharaPublic: {protocol: 'https', port: '13386', host: 'CLOUDNAME'} diff --git a/environments/ssl/tls-endpoints-public-ip.yaml b/environments/ssl/tls-endpoints-public-ip.yaml index bca6a891..b776f648 100644 --- a/environments/ssl/tls-endpoints-public-ip.yaml +++ b/environments/ssl/tls-endpoints-public-ip.yaml @@ -77,9 +77,9 @@ parameter_defaults: OctaviaAdmin: {protocol: 'http', port: '9876', host: 'IP_ADDRESS'} OctaviaInternal: {protocol: 'http', port: '9876', host: 'IP_ADDRESS'} OctaviaPublic: {protocol: 'https', port: '13876', host: 'IP_ADDRESS'} - PankoAdmin: {protocol: 'http', port: '8779', host: 'IP_ADDRESS'} - PankoInternal: {protocol: 'http', port: '8779', host: 'IP_ADDRESS'} - PankoPublic: {protocol: 'https', port: '13779', host: 'IP_ADDRESS'} + PankoAdmin: {protocol: 'http', port: '8977', host: 'IP_ADDRESS'} + PankoInternal: {protocol: 'http', port: '8977', host: 'IP_ADDRESS'} + PankoPublic: {protocol: 'https', port: '13977', host: 'IP_ADDRESS'} SaharaAdmin: {protocol: 'http', port: '8386', host: 'IP_ADDRESS'} SaharaInternal: {protocol: 'http', port: '8386', host: 'IP_ADDRESS'} SaharaPublic: {protocol: 'https', port: '13386', host: 'IP_ADDRESS'} diff --git a/environments/ssl/tls-everywhere-endpoints-dns.yaml b/environments/ssl/tls-everywhere-endpoints-dns.yaml index e3fe608b..e0cfc9e6 100644 --- a/environments/ssl/tls-everywhere-endpoints-dns.yaml +++ b/environments/ssl/tls-everywhere-endpoints-dns.yaml @@ -77,9 +77,9 @@ parameter_defaults: OctaviaAdmin: {protocol: 'https', port: '9876', host: 'IP_ADDRESS'} OctaviaInternal: {protocol: 'https', port: '9876', host: 'IP_ADDRESS'} OctaviaPublic: {protocol: 'https', port: '13876', host: 'CLOUDNAME'} - PankoAdmin: {protocol: 'https', port: '8779', host: 'CLOUDNAME'} - PankoInternal: {protocol: 'https', port: '8779', host: 'CLOUDNAME'} - PankoPublic: {protocol: 'https', port: '13779', host: 'CLOUDNAME'} + PankoAdmin: {protocol: 'https', port: '8977', host: 'CLOUDNAME'} + PankoInternal: {protocol: 'https', port: '8977', host: 'CLOUDNAME'} + PankoPublic: {protocol: 'https', port: '13977', host: 'CLOUDNAME'} SaharaAdmin: {protocol: 'https', port: '8386', host: 'CLOUDNAME'} SaharaInternal: {protocol: 'https', port: '8386', host: 'CLOUDNAME'} SaharaPublic: {protocol: 'https', port: '13386', host: 'CLOUDNAME'} diff --git a/network/ports/net_ip_list_map.j2.yaml b/network/ports/net_ip_list_map.j2.yaml index e929ab2c..16bd3986 100644 --- a/network/ports/net_ip_list_map.j2.yaml +++ b/network/ports/net_ip_list_map.j2.yaml @@ -21,30 +21,6 @@ parameters: NetworkHostnameMap: default: [] type: json - - InternalApiNetName: - default: internal_api - description: The name of the internal_api network. - type: string - ExternalNetName: - default: external - description: The name of the external network. - type: string - ManagementNetName: - default: management - description: The name of the management network. - type: string - StorageNetName: - default: storage - description: The name of the storage network. - type: string - StorageMgmtNetName: - default: storage_mgmt - description: The name of the storage_mgmt network. - type: string - TenantNetName: - default: tenant - description: The name of the tenant network. {%- for network in networks %} {{network.name}}NetName: default: {{network.name_lower}} diff --git a/network/service_net_map.j2.yaml b/network/service_net_map.j2.yaml index 54646c38..e19ccd84 100644 --- a/network/service_net_map.j2.yaml +++ b/network/service_net_map.j2.yaml @@ -55,7 +55,6 @@ parameters: HeatApiCfnNetwork: internal_api HeatApiCloudwatchNetwork: internal_api NovaApiNetwork: internal_api - NovaColdMigrationNetwork: ctlplane NovaPlacementNetwork: internal_api NovaMetadataNetwork: internal_api NovaVncProxyNetwork: internal_api diff --git a/overcloud-resource-registry-puppet.j2.yaml b/overcloud-resource-registry-puppet.j2.yaml index e5ae5279..e402f125 100644 --- a/overcloud-resource-registry-puppet.j2.yaml +++ b/overcloud-resource-registry-puppet.j2.yaml @@ -152,6 +152,7 @@ resource_registry: # can be the same as NeutronCorePlugin but some vendors install different # things where VMs run OS::TripleO::Services::ComputeNeutronCorePlugin: puppet/services/neutron-plugin-ml2.yaml + OS::TripleO::Services::ComputeNeutronCorePluginNuage: puppet/services/neutron-compute-plugin-nuage.yaml # Neutron Core Plugin Vendors (these typically override NeutronCorePlugin) OS::TripleO::Services::NeutronCorePluginML2OVN: puppet/services/neutron-plugin-ml2-ovn.yaml OS::TripleO::Services::NeutronCorePluginPlumgrid: puppet/services/neutron-plugin-plumgrid.yaml @@ -257,6 +258,7 @@ resource_registry: OS::TripleO::Services::IronicApi: OS::Heat::None OS::TripleO::Services::IronicConductor: OS::Heat::None OS::TripleO::Services::IronicInspector: OS::Heat::None + OS::TripleO::Services::IronicPxe: OS::Heat::None OS::TripleO::Services::NovaIronic: OS::Heat::None OS::TripleO::Services::TripleoPackages: puppet/services/tripleo-packages.yaml OS::TripleO::Services::TripleoFirewall: puppet/services/tripleo-firewall.yaml diff --git a/puppet/extraconfig/pre_deploy/compute/nova-nuage.yaml b/puppet/extraconfig/pre_deploy/compute/nova-nuage.yaml deleted file mode 100644 index ea2fd71c..00000000 --- a/puppet/extraconfig/pre_deploy/compute/nova-nuage.yaml +++ /dev/null @@ -1,92 +0,0 @@ -heat_template_version: pike - -description: Configure hieradata for Nuage configuration on the Compute - -parameters: - server: - description: ID of the compute node to apply this config to - type: string - - NuageActiveController: - description: IP address of the Active Virtualized Services Controller (VSC) - type: string - NuageStandbyController: - description: IP address of the Standby Virtualized Services Controller (VSC) - type: string - NuageMetadataPort: - description: TCP Port to listen for metadata server requests - type: string - default: '9697' - NuageNovaMetadataPort: - description: TCP Port used by Nova metadata server - type: string - default: '8775' - NuageMetadataProxySharedSecret: - description: Shared secret to sign the instance-id request - type: string - NuageNovaClientVersion: - description: Client Version Nova - type: string - default: '2' - NuageNovaOsUsername: - description: Nova username in keystone_authtoken - type: string - default: 'nova' - NuageMetadataAgentStartWithOvs: - description: Set to True if nuage-metadata-agent needs to be started with nuage-openvswitch-switch - type: string - default: 'True' - NuageNovaApiEndpoint: - description: One of publicURL, internalURL, adminURL in "keystone endpoint-list" - type: string - default: 'publicURL' - NuageNovaRegionName: - description: Region name in "keystone endpoint-list" - type: string - default: 'regionOne' - -# Declaration of resources for the template. -resources: - NovaNuageConfig: - type: OS::Heat::StructuredConfig - properties: - group: hiera - config: - datafiles: - nova_nuage_data: - mapped_data: - nuage::vrs::active_controller: {get_input: ActiveController} - nuage::vrs::standby_controller: {get_input: StandbyController} - nuage::metadataagent::metadata_port: {get_input: MetadataPort} - nuage::metadataagent::nova_metadata_port: {get_input: NovaMetadataPort} - nuage::metadataagent::metadata_secret: {get_input: SharedSecret} - nuage::metadataagent::nova_client_version: {get_input: NovaClientVersion} - nuage::metadataagent::nova_os_username: {get_input: NovaOsUsername} - nuage::metadataagent::metadata_agent_start_with_ovs: {get_input: MetadataAgentStartWithOvs} - nuage::metadataagent::nova_api_endpoint_type: {get_input: NovaApiEndpointType} - nuage::metadataagent::nova_region_name: {get_input: NovaRegionName} - - NovaNuageDeployment: - type: OS::Heat::StructuredDeployment - properties: - name: NovaNuageDeployment - config: {get_resource: NovaNuageConfig} - server: {get_param: server} - input_values: - ActiveController: {get_param: NuageActiveController} - StandbyController: {get_param: NuageStandbyController} - MetadataPort: {get_param: NuageMetadataPort} - NovaMetadataPort: {get_param: NuageNovaMetadataPort} - SharedSecret: {get_param: NuageMetadataProxySharedSecret} - NovaClientVersion: {get_param: NuageNovaClientVersion} - NovaOsUsername: {get_param: NuageNovaOsUsername} - MetadataAgentStartWithOvs: {get_param: NuageMetadataAgentStartWithOvs} - NovaApiEndpointType: {get_param: NuageNovaApiEndpoint} - NovaRegionName: {get_param: NuageNovaRegionName} - -# Specify output parameters that will be available -# after the template is instantiated. -outputs: - deploy_stdout: - description: Deployment reference, used to trigger puppet apply on changes - value: {get_attr: [NovaNuageDeployment, deploy_stdout]} diff --git a/puppet/services/ceph-mon.yaml b/puppet/services/ceph-mon.yaml index 4fe6e908..5783d18c 100644 --- a/puppet/services/ceph-mon.yaml +++ b/puppet/services/ceph-mon.yaml @@ -109,8 +109,8 @@ outputs: - get_attr: [CephBase, role_data, config_settings] - ceph::profile::params::ms_bind_ipv6: {get_param: CephIPv6} ceph::profile::params::mon_key: {get_param: CephMonKey} - ceph::profile::params::osd_pool_default_pg_num: 32 - ceph::profile::params::osd_pool_default_pgp_num: 32 + ceph::profile::params::osd_pool_default_pg_num: 128 + ceph::profile::params::osd_pool_default_pgp_num: 128 ceph::profile::params::osd_pool_default_size: {get_param: CephPoolDefaultSize} # repeat returns items in a list, so we need to map_merge twice tripleo::profile::base::ceph::mon::ceph_pools: diff --git a/puppet/services/kernel.yaml b/puppet/services/kernel.yaml index 011ec037..1c2da401 100644 --- a/puppet/services/kernel.yaml +++ b/puppet/services/kernel.yaml @@ -60,6 +60,11 @@ parameters: ARP cache. The garbage collector will always run if there are more than this number of entries in the cache. type: number + InotifyIntancesMax: + default: 1024 + description: Configures sysctl fs.inotify.max_user_instances key + type: number + outputs: role_data: @@ -129,5 +134,9 @@ outputs: value: {get_param: NeighbourGcThreshold2} net.ipv4.neigh.default.gc_thresh3: value: {get_param: NeighbourGcThreshold3} + # set inotify value for neutron/dnsmasq scale + fs.inotify.max_user_instances: + value: {get_param: InotifyIntancesMax} + step_config: | include ::tripleo::profile::base::kernel diff --git a/puppet/services/neutron-compute-plugin-nuage.yaml b/puppet/services/neutron-compute-plugin-nuage.yaml index f1a56530..e594c2da 100644 --- a/puppet/services/neutron-compute-plugin-nuage.yaml +++ b/puppet/services/neutron-compute-plugin-nuage.yaml @@ -38,6 +38,39 @@ parameters: description: TCP Port to listen for metadata server requests type: string default: '9697' + NuageActiveController: + description: IP address of the Active Virtualized Services Controller (VSC) + type: string + NuageStandbyController: + description: IP address of the Standby Virtualized Services Controller (VSC) + type: string + NuageNovaMetadataPort: + description: TCP Port used by Nova metadata server + type: string + default: '8775' + NuageMetadataProxySharedSecret: + description: Shared secret to sign the instance-id request + type: string + NuageNovaClientVersion: + description: Client Version Nova + type: string + default: '2' + NuageNovaOsUsername: + description: Nova username in keystone_authtoken + type: string + default: 'nova' + NuageMetadataAgentStartWithOvs: + description: Set to True if nuage-metadata-agent needs to be started with nuage-openvswitch-switch + type: string + default: 'True' + NuageNovaApiEndpoint: + description: One of publicURL, internalURL, adminURL in "keystone endpoint-list" + type: string + default: 'publicURL' + NuageNovaRegionName: + description: Region name in "keystone endpoint-list" + type: string + default: 'regionOne' outputs: role_data: @@ -45,6 +78,16 @@ outputs: value: service_name: neutron_compute_plugin_nuage config_settings: + nuage::vrs::active_controller: {get_param: NuageActiveController} + nuage::vrs::standby_controller: {get_param: NuageStandbyController} + nuage::metadataagent::metadata_port: {get_param: NuageMetadataPort} + nuage::metadataagent::nova_metadata_port: {get_param: NuageNovaMetadataPort} + nuage::metadataagent::metadata_secret: {get_param: NuageMetadataProxySharedSecret} + nuage::metadataagent::nova_client_version: {get_param: NuageNovaClientVersion} + nuage::metadataagent::nova_os_username: {get_param: NuageNovaOsUsername} + nuage::metadataagent::metadata_agent_start_with_ovs: {get_param: NuageMetadataAgentStartWithOvs} + nuage::metadataagent::nova_api_endpoint_type: {get_param: NuageNovaApiEndpoint} + nuage::metadataagent::nova_region_name: {get_param: NuageNovaRegionName} tripleo::profile::base::neutron::agents::nuage::nova_os_tenant_name: 'service' tripleo::profile::base::neutron::agents::nuage::nova_os_password: {get_param: NovaPassword} tripleo::profile::base::neutron::agents::nuage::nova_auth_ip: {get_param: [EndpointMap, KeystoneInternal, host]} diff --git a/puppet/services/nova-base.yaml b/puppet/services/nova-base.yaml index 08302ee9..55392086 100644 --- a/puppet/services/nova-base.yaml +++ b/puppet/services/nova-base.yaml @@ -159,7 +159,8 @@ outputs: service_name: nova_base config_settings: map_merge: - - nova::rabbit_password: {get_param: RabbitPassword} + - nova::my_ip: {get_param: [ServiceNetMap, NovaApiNetwork]} + nova::rabbit_password: {get_param: RabbitPassword} nova::rabbit_userid: {get_param: RabbitUserName} nova::rabbit_use_ssl: {get_param: RabbitClientUseSSL} nova::rabbit_port: {get_param: RabbitClientPort} diff --git a/puppet/services/nova-compute.yaml b/puppet/services/nova-compute.yaml index 22a743e0..9e5ba129 100644 --- a/puppet/services/nova-compute.yaml +++ b/puppet/services/nova-compute.yaml @@ -108,7 +108,7 @@ parameters: public_key: '' private_key: '' MigrationSshPort: - default: 22 + default: 2022 description: Target port for migration over ssh type: number diff --git a/puppet/services/nova-libvirt.yaml b/puppet/services/nova-libvirt.yaml index 3f37cd94..ac7cc8f1 100644 --- a/puppet/services/nova-libvirt.yaml +++ b/puppet/services/nova-libvirt.yaml @@ -94,7 +94,7 @@ parameters: public_key: '' private_key: '' MigrationSshPort: - default: 22 + default: 2022 description: Target port for migration over ssh type: number diff --git a/puppet/services/nova-migration-target.yaml b/puppet/services/nova-migration-target.yaml index 128abc2c..e121d37a 100644 --- a/puppet/services/nova-migration-target.yaml +++ b/puppet/services/nova-migration-target.yaml @@ -39,6 +39,10 @@ parameters: default: public_key: '' private_key: '' + MigrationSshPort: + default: 2022 + description: Target port for migration over ssh + type: number outputs: role_data: @@ -51,7 +55,20 @@ outputs: tripleo::profile::base::nova::migration::target::ssh_localaddrs: - "%{hiera('cold_migration_ssh_inbound_addr')}" - "%{hiera('live_migration_ssh_inbound_addr')}" - live_migration_ssh_inbound_addr: {get_param: [ServiceNetMap, NovaLibvirtNetwork]} - cold_migration_ssh_inbound_addr: {get_param: [ServiceNetMap, NovaColdMigrationNetwork]} + live_migration_ssh_inbound_addr: + get_param: + - ServiceNetMap + - str_replace: + template: "ROLENAMEHostnameResolveNetwork" + params: + ROLENAME: {get_param: RoleName} + cold_migration_ssh_inbound_addr: {get_param: [ServiceNetMap, NovaApiNetwork]} + tripleo::profile::base::sshd::port: + - 22 + - {get_param: MigrationSshPort} + tripleo.nova_migration_target.firewall_rules: + '113 nova_migration_target': + dport: + - {get_param: MigrationSshPort} step_config: | include tripleo::profile::base::nova::migration::target diff --git a/puppet/services/pacemaker.yaml b/puppet/services/pacemaker.yaml index 158d04bd..badb1a4e 100644 --- a/puppet/services/pacemaker.yaml +++ b/puppet/services/pacemaker.yaml @@ -156,3 +156,15 @@ outputs: - name: Start pacemaker cluster tags: step4 pacemaker_cluster: state=online + update_tasks: + - name: Check pacemaker cluster running before the minor update + when: step == "0" # TODO(marios) disabling validations? + pacemaker_cluster: state=online check_and_fail=true + async: 30 + poll: 4 + - name: Stop pacemaker cluster + when: step == "1" + pacemaker_cluster: state=offline + - name: Start pacemaker cluster + when: step == "4" + pacemaker_cluster: state=online diff --git a/puppet/services/tripleo-packages.yaml b/puppet/services/tripleo-packages.yaml index 2a8620c8..bfdac3e3 100644 --- a/puppet/services/tripleo-packages.yaml +++ b/puppet/services/tripleo-packages.yaml @@ -53,10 +53,26 @@ outputs: fail: msg="rpm-python package was not present before this run! Check environment before re-running" when: rpm_python_check.changed != false tags: step0 + - block: + - name: Upgrade os-net-config + yum: name=os-net-config state=latest + - name: take new os-net-config parameters into account now + command: os-net-config --no-activate -c /etc/os-net-config/config.json -v --detailed-exit-codes + register: os_net_config_upgrade + failed_when: os_net_config_upgrade.rc not in [0,2] + changed_when: os_net_config_upgrade.rc == 2 + tags: step3 - name: Update all packages tags: step3 yum: name=* state=latest update_tasks: + - name: Check for existing yum.pid + stat: path=/var/run/yum.pid + register: yum_pid_file + when: step == "0" or step == "3" + - name: Exit if existing yum process + fail: msg="ERROR existing yum.pid detected - can't continue! Please ensure there is no other package update process for the duration of the minor update worfklow. Exiting." + when: (step == "0" or step == "3") and yum_pid_file.stat.exists - name: Update all packages - yum: name=* state=latest + yum: name=* state=latest update_cache=yes # cache for tripleo/+bug/1703830 when: step == "3" diff --git a/releasenotes/notes/add-option-remove-unused-packages-on-upgrade-5a469428a6948148.yaml b/releasenotes/notes/add-option-remove-unused-packages-on-upgrade-5a469428a6948148.yaml new file mode 100644 index 00000000..dbb7af1f --- /dev/null +++ b/releasenotes/notes/add-option-remove-unused-packages-on-upgrade-5a469428a6948148.yaml @@ -0,0 +1,12 @@ +--- +upgrade: + - Adds a new UpgradeRemoveUnusedPackages parameter (default False) and some + service upgrade_tasks that use this parameter to remove any unused + packages. "Unused" is those services that are being stopped and disabled + from starting on boot (because they are being containerized). Note that + ignore_errors is set on all the package removal ansible tasks so any + issues removing a given package will not fail the upgrade workflow. + + For clarity, setting UpgradeRemoveUnusedPackages to True in your deployment + environment file(s) will result in the REMOVAL of packages for stopped + and disabled services, during the upgrade. diff --git a/releasenotes/notes/fix-tenant-net-name-type-94a9c50c86529001.yaml b/releasenotes/notes/fix-tenant-net-name-type-94a9c50c86529001.yaml new file mode 100644 index 00000000..77d9d52f --- /dev/null +++ b/releasenotes/notes/fix-tenant-net-name-type-94a9c50c86529001.yaml @@ -0,0 +1,5 @@ +--- +fixes: + - | + Removes hardcoded network names. The networks are + now defined dynamically by network_data.yaml. diff --git a/roles/Controller.yaml b/roles/Controller.yaml index 88e4dfed..a6fab555 100644 --- a/roles/Controller.yaml +++ b/roles/Controller.yaml @@ -75,6 +75,7 @@ - OS::TripleO::Services::Horizon - OS::TripleO::Services::IronicApi - OS::TripleO::Services::IronicConductor + - OS::TripleO::Services::IronicPxe - OS::TripleO::Services::Iscsid - OS::TripleO::Services::Keepalived - OS::TripleO::Services::Kernel diff --git a/roles/ControllerOpenstack.yaml b/roles/ControllerOpenstack.yaml index 2f86d2d2..bbc6374b 100644 --- a/roles/ControllerOpenstack.yaml +++ b/roles/ControllerOpenstack.yaml @@ -58,6 +58,7 @@ - OS::TripleO::Services::Horizon - OS::TripleO::Services::IronicApi - OS::TripleO::Services::IronicConductor + - OS::TripleO::Services::IronicPxe - OS::TripleO::Services::Iscsid - OS::TripleO::Services::Keepalived - OS::TripleO::Services::Kernel diff --git a/roles/IronicConductor.yaml b/roles/IronicConductor.yaml index 3d437aa3..44d98e3d 100644 --- a/roles/IronicConductor.yaml +++ b/roles/IronicConductor.yaml @@ -13,6 +13,7 @@ - OS::TripleO::Services::Docker - OS::TripleO::Services::FluentdClient - OS::TripleO::Services::IronicConductor + - OS::TripleO::Services::IronicPxe - OS::TripleO::Services::Kernel - OS::TripleO::Services::MySQLClient - OS::TripleO::Services::Ntp diff --git a/roles_data.yaml b/roles_data.yaml index a1adc5ee..41802202 100644 --- a/roles_data.yaml +++ b/roles_data.yaml @@ -78,6 +78,7 @@ - OS::TripleO::Services::Horizon - OS::TripleO::Services::IronicApi - OS::TripleO::Services::IronicConductor + - OS::TripleO::Services::IronicPxe - OS::TripleO::Services::Iscsid - OS::TripleO::Services::Keepalived - OS::TripleO::Services::Kernel diff --git a/sample-env-generator/ssl.yaml b/sample-env-generator/ssl.yaml index 43a1afc1..a3b5f24a 100644 --- a/sample-env-generator/ssl.yaml +++ b/sample-env-generator/ssl.yaml @@ -172,9 +172,9 @@ environments: OctaviaAdmin: {protocol: 'http', port: '9876', host: 'IP_ADDRESS'} OctaviaInternal: {protocol: 'http', port: '9876', host: 'IP_ADDRESS'} OctaviaPublic: {protocol: 'https', port: '13876', host: 'IP_ADDRESS'} - PankoAdmin: {protocol: 'http', port: '8779', host: 'IP_ADDRESS'} - PankoInternal: {protocol: 'http', port: '8779', host: 'IP_ADDRESS'} - PankoPublic: {protocol: 'https', port: '13779', host: 'IP_ADDRESS'} + PankoAdmin: {protocol: 'http', port: '8977', host: 'IP_ADDRESS'} + PankoInternal: {protocol: 'http', port: '8977', host: 'IP_ADDRESS'} + PankoPublic: {protocol: 'https', port: '13977', host: 'IP_ADDRESS'} SaharaAdmin: {protocol: 'http', port: '8386', host: 'IP_ADDRESS'} SaharaInternal: {protocol: 'http', port: '8386', host: 'IP_ADDRESS'} SaharaPublic: {protocol: 'https', port: '13386', host: 'IP_ADDRESS'} @@ -273,9 +273,9 @@ environments: OctaviaAdmin: {protocol: 'http', port: '9876', host: 'IP_ADDRESS'} OctaviaInternal: {protocol: 'http', port: '9876', host: 'IP_ADDRESS'} OctaviaPublic: {protocol: 'https', port: '13876', host: 'CLOUDNAME'} - PankoAdmin: {protocol: 'http', port: '8779', host: 'IP_ADDRESS'} - PankoInternal: {protocol: 'http', port: '8779', host: 'IP_ADDRESS'} - PankoPublic: {protocol: 'https', port: '13779', host: 'CLOUDNAME'} + PankoAdmin: {protocol: 'http', port: '8977', host: 'IP_ADDRESS'} + PankoInternal: {protocol: 'http', port: '8977', host: 'IP_ADDRESS'} + PankoPublic: {protocol: 'https', port: '13977', host: 'CLOUDNAME'} SaharaAdmin: {protocol: 'http', port: '8386', host: 'IP_ADDRESS'} SaharaInternal: {protocol: 'http', port: '8386', host: 'IP_ADDRESS'} SaharaPublic: {protocol: 'https', port: '13386', host: 'CLOUDNAME'} @@ -374,9 +374,9 @@ environments: OctaviaAdmin: {protocol: 'https', port: '9876', host: 'IP_ADDRESS'} OctaviaInternal: {protocol: 'https', port: '9876', host: 'IP_ADDRESS'} OctaviaPublic: {protocol: 'https', port: '13876', host: 'CLOUDNAME'} - PankoAdmin: {protocol: 'https', port: '8779', host: 'CLOUDNAME'} - PankoInternal: {protocol: 'https', port: '8779', host: 'CLOUDNAME'} - PankoPublic: {protocol: 'https', port: '13779', host: 'CLOUDNAME'} + PankoAdmin: {protocol: 'https', port: '8977', host: 'CLOUDNAME'} + PankoInternal: {protocol: 'https', port: '8977', host: 'CLOUDNAME'} + PankoPublic: {protocol: 'https', port: '13977', host: 'CLOUDNAME'} SaharaAdmin: {protocol: 'https', port: '8386', host: 'CLOUDNAME'} SaharaInternal: {protocol: 'https', port: '8386', host: 'CLOUDNAME'} SaharaPublic: {protocol: 'https', port: '13386', host: 'CLOUDNAME'} diff --git a/tools/yaml-validate.py b/tools/yaml-validate.py index f7a45d7b..c3229621 100755 --- a/tools/yaml-validate.py +++ b/tools/yaml-validate.py @@ -35,9 +35,10 @@ OPTIONAL_SECTIONS = ['workflow_tasks'] REQUIRED_DOCKER_SECTIONS = ['service_name', 'docker_config', 'puppet_config', 'config_settings', 'step_config'] OPTIONAL_DOCKER_SECTIONS = ['docker_puppet_tasks', 'upgrade_tasks', - 'post_upgrade_tasks', 'service_config_settings', + 'post_upgrade_tasks', 'update_tasks', + 'service_config_settings', 'host_prep_tasks', 'metadata_settings', - 'kolla_config'] + 'kolla_config', 'logging_source', 'logging_groups'] REQUIRED_DOCKER_PUPPET_CONFIG_SECTIONS = ['config_volume', 'step_config', 'config_image'] OPTIONAL_DOCKER_PUPPET_CONFIG_SECTIONS = [ 'puppet_tags', 'volumes' ] @@ -116,6 +117,22 @@ PREFERRED_CAMEL_CASE = { 'haproxy': 'HAProxy', } +# Overrides for docker/puppet validation +# <filename>: True explicitly enables validation +# <filename>: False explicitly disables validation +# +# If a filename is not found in the overrides then the top level directory is +# used to determine which validation method to use. +VALIDATE_PUPPET_OVERRIDE = { + # docker/service/sshd.yaml is a variation of the puppet sshd service + './docker/services/sshd.yaml': True, + # qdr aliases rabbitmq service to provide alternative messaging backend + './puppet/services/qdr.yaml': False, +} +VALIDATE_DOCKER_OVERRIDE = { + # docker/service/sshd.yaml is a variation of the puppet sshd service + './docker/services/sshd.yaml': False, +} def exit_usage(): print('Usage %s <yaml file or directory>' % sys.argv[0]) @@ -436,12 +453,14 @@ def validate(filename, param_map): % filename) return 1 - # qdr aliases rabbitmq service to provide alternative messaging backend - if (filename.startswith('./puppet/services/') and - filename not in ['./puppet/services/qdr.yaml']): + if VALIDATE_PUPPET_OVERRIDE.get(filename, False) or ( + filename.startswith('./puppet/services/') and + VALIDATE_PUPPET_OVERRIDE.get(filename, True)): retval = validate_service(filename, tpl) - if filename.startswith('./docker/services/'): + if VALIDATE_DOCKER_OVERRIDE.get(filename, False) or ( + filename.startswith('./docker/services/') and + VALIDATE_DOCKER_OVERRIDE.get(filename, True)): retval = validate_docker_service(filename, tpl) if filename.endswith('hyperconverged-ceph.yaml'): |