diff options
Diffstat (limited to 'docker/services')
86 files changed, 942 insertions, 24 deletions
diff --git a/docker/services/README.rst b/docker/services/README.rst index ce255ba8..a843efc3 100644 --- a/docker/services/README.rst +++ b/docker/services/README.rst @@ -124,3 +124,24 @@ Steps correlate to the following: 5) Service activation (Pacemaker) a) step 5 baremetal b) step 5 containers + +Update steps: +------------- + +All services have an associated update_tasks output that is an ansible +snippet that will be run during update in an rolling update that is +expected to run in a rolling update fashion (one node at a time) + +For Controller (where pacemaker is running) we have the following states: + 1. Step=1: stop the cluster on the updated node; + 2. Step=2: Pull the latest image and retag the it pcmklatest + 3. Step=3: yum upgrade happens on the host. + 4. Step=4: Restart the cluster on the node + 5. Step=5: Verification: + Currently we test that the pacemaker services are running. + +Then the usual deploy steps are run which pull in the latest image for +all containerized services and the updated configuration if any. + +Note: as pacemaker is not containerized, the points 1 and 4 happen in +puppet/services/pacemaker.yaml. diff --git a/docker/services/aodh-api.yaml b/docker/services/aodh-api.yaml index 49c5f9c5..9445069b 100644 --- a/docker/services/aodh-api.yaml +++ b/docker/services/aodh-api.yaml @@ -39,6 +39,10 @@ parameters: EnableInternalTLS: type: boolean default: false + UpgradeRemoveUnusedPackages: + default: false + description: Remove package if the service is being disabled during upgrade + type: boolean conditions: @@ -70,6 +74,8 @@ outputs: map_merge: - get_attr: [AodhApiPuppetBase, role_data, config_settings] - apache::default_vhost: false + logging_source: {get_attr: [AodhApiPuppetBase, role_data, logging_source]} + logging_groups: {get_attr: [AodhApiPuppetBase, role_data, logging_groups]} step_config: &step_config list_join: - "\n" @@ -158,5 +164,10 @@ outputs: - name: Stop and disable aodh service (running under httpd) tags: step2 service: name=httpd state=stopped enabled=no + - name: Remove openstack-aodh-api package if operator requests it + yum: name=openstack-aodh-api state=removed + tags: step2 + ignore_errors: True + when: {get_param: UpgradeRemoveUnusedPackages} metadata_settings: get_attr: [AodhApiPuppetBase, role_data, metadata_settings] diff --git a/docker/services/aodh-evaluator.yaml b/docker/services/aodh-evaluator.yaml index 86bdfdf9..fda6faa2 100644 --- a/docker/services/aodh-evaluator.yaml +++ b/docker/services/aodh-evaluator.yaml @@ -36,6 +36,10 @@ parameters: default: {} description: Parameters specific to the role type: json + UpgradeRemoveUnusedPackages: + default: false + description: Remove package if the service is being disabled during upgrade + type: boolean resources: @@ -63,6 +67,8 @@ outputs: config_settings: map_merge: - get_attr: [AodhEvaluatorBase, role_data, config_settings] + logging_source: {get_attr: [AodhEvaluatorBase, role_data, logging_source]} + logging_groups: {get_attr: [AodhEvaluatorBase, role_data, logging_groups]} step_config: &step_config list_join: - "\n" @@ -112,3 +118,8 @@ outputs: - name: Stop and disable openstack-aodh-evaluator service tags: step2 service: name=openstack-aodh-evaluator.service state=stopped enabled=no + - name: Remove openstack-aodh-evaluator package if operator requests it + yum: name=openstack-aodh-evaluator state=removed + tags: step2 + ignore_errors: True + when: {get_param: UpgradeRemoveUnusedPackages} diff --git a/docker/services/aodh-listener.yaml b/docker/services/aodh-listener.yaml index 3f986ab2..fbe86d3b 100644 --- a/docker/services/aodh-listener.yaml +++ b/docker/services/aodh-listener.yaml @@ -36,6 +36,10 @@ parameters: default: {} description: Parameters specific to the role type: json + UpgradeRemoveUnusedPackages: + default: false + description: Remove package if the service is being disabled during upgrade + type: boolean resources: @@ -63,6 +67,8 @@ outputs: config_settings: map_merge: - get_attr: [AodhListenerBase, role_data, config_settings] + logging_source: {get_attr: [AodhListenerBase, role_data, logging_source]} + logging_groups: {get_attr: [AodhListenerBase, role_data, logging_groups]} step_config: &step_config list_join: - "\n" @@ -112,3 +118,8 @@ outputs: - name: Stop and disable openstack-aodh-listener service tags: step2 service: name=openstack-aodh-listener.service state=stopped enabled=no + - name: Remove openstack-aodh-listener package if operator requests it + yum: name=openstack-aodh-listener state=removed + tags: step2 + ignore_errors: True + when: {get_param: UpgradeRemoveUnusedPackages} diff --git a/docker/services/aodh-notifier.yaml b/docker/services/aodh-notifier.yaml index 852120c9..d9081d54 100644 --- a/docker/services/aodh-notifier.yaml +++ b/docker/services/aodh-notifier.yaml @@ -36,6 +36,10 @@ parameters: default: {} description: Parameters specific to the role type: json + UpgradeRemoveUnusedPackages: + default: false + description: Remove package if the service is being disabled during upgrade + type: boolean resources: @@ -63,6 +67,8 @@ outputs: config_settings: map_merge: - get_attr: [AodhNotifierBase, role_data, config_settings] + logging_source: {get_attr: [AodhNotifierBase, role_data, logging_source]} + logging_groups: {get_attr: [AodhNotifierBase, role_data, logging_groups]} step_config: &step_config list_join: - "\n" @@ -112,3 +118,8 @@ outputs: - name: Stop and disable openstack-aodh-notifier service tags: step2 service: name=openstack-aodh-notifier.service state=stopped enabled=no + - name: Remove openstack-aodh-notifier package if operator requests it + yum: name=openstack-aodh-notifier state=removed + tags: step2 + ignore_errors: True + when: {get_param: UpgradeRemoveUnusedPackages} diff --git a/docker/services/barbican-api.yaml b/docker/services/barbican-api.yaml index b1bf7da8..af528f79 100644 --- a/docker/services/barbican-api.yaml +++ b/docker/services/barbican-api.yaml @@ -39,6 +39,10 @@ parameters: EnableInternalTLS: type: boolean default: false + UpgradeRemoveUnusedPackages: + default: false + description: Remove package if the service is being disabled during upgrade + type: boolean conditions: @@ -71,6 +75,8 @@ outputs: map_merge: - get_attr: [BarbicanApiBase, role_data, config_settings] - apache::default_vhost: false + logging_source: {get_attr: [BarbicanApiBase, role_data, logging_source]} + logging_groups: {get_attr: [BarbicanApiBase, role_data, logging_groups]} step_config: &step_config list_join: - "\n" @@ -150,5 +156,10 @@ outputs: - name: Stop and disable barbican_api service tags: step2 service: name=openstack-barbican-api state=stopped enabled=no + - name: Remove openstack-barbican-api package if operator requests it + yum: name=openstack-barbican-api state=removed + tags: step2 + ignore_errors: True + when: {get_param: UpgradeRemoveUnusedPackages} metadata_settings: - get_attr: [BarbicanApiBase, role_data, metadata_settings]
\ No newline at end of file + get_attr: [BarbicanApiBase, role_data, metadata_settings] diff --git a/docker/services/ceilometer-agent-central.yaml b/docker/services/ceilometer-agent-central.yaml index d772462d..6342c82e 100644 --- a/docker/services/ceilometer-agent-central.yaml +++ b/docker/services/ceilometer-agent-central.yaml @@ -36,6 +36,10 @@ parameters: default: {} description: Parameters specific to the role type: json + UpgradeRemoveUnusedPackages: + default: false + description: Remove package if the service is being disabled during upgrade + type: boolean resources: @@ -58,6 +62,8 @@ outputs: value: service_name: {get_attr: [CeilometerAgentCentralBase, role_data, service_name]} config_settings: {get_attr: [CeilometerAgentCentralBase, role_data, config_settings]} + logging_source: {get_attr: [CeilometerAgentCentralBase, role_data, logging_source]} + logging_groups: {get_attr: [CeilometerAgentCentralBase, role_data, logging_groups]} step_config: &step_config get_attr: [CeilometerAgentCentralBase, role_data, step_config] service_config_settings: {get_attr: [CeilometerAgentCentralBase, role_data, service_config_settings]} @@ -125,3 +131,8 @@ outputs: - name: Stop and disable ceilometer agent central service tags: step2 service: name=openstack-ceilometer-central state=stopped enabled=no + - name: Remove openstack-ceilometer-central package if operator requests it + yum: name=openstack-ceilometer-central state=removed + tags: step2 + ignore_errors: True + when: {get_param: UpgradeRemoveUnusedPackages} diff --git a/docker/services/ceilometer-agent-compute.yaml b/docker/services/ceilometer-agent-compute.yaml index 90b30d46..1ee9f492 100644 --- a/docker/services/ceilometer-agent-compute.yaml +++ b/docker/services/ceilometer-agent-compute.yaml @@ -36,6 +36,10 @@ parameters: default: {} description: Parameters specific to the role type: json + UpgradeRemoveUnusedPackages: + default: false + description: Remove package if the service is being disabled during upgrade + type: boolean resources: @@ -58,6 +62,8 @@ outputs: value: service_name: {get_attr: [CeilometerAgentComputeBase, role_data, service_name]} config_settings: {get_attr: [CeilometerAgentComputeBase, role_data, config_settings]} + logging_source: {get_attr: [CeilometerAgentComputeBase, role_data, logging_source]} + logging_groups: {get_attr: [CeilometerAgentComputeBase, role_data, logging_groups]} step_config: &step_config get_attr: [CeilometerAgentComputeBase, role_data, step_config] service_config_settings: {get_attr: [CeilometerAgentComputeBase, role_data, service_config_settings]} @@ -116,3 +122,13 @@ outputs: tags: step2 service: name=openstack-ceilometer-polling state=stopped enabled=no when: openstack_ceilometer_polling_enabled.rc|default('') == 0 + - name: Remove openstack-ceilometer-compute package if operator requests it + yum: name=openstack-ceilometer-compute state=removed + tags: step2 + ignore_errors: True + when: {get_param: UpgradeRemoveUnusedPackages} + - name: Remove openstack-ceilometer-polling package if operator requests it + yum: name=openstack-ceilometer-polling state=removed + tags: step2 + ignore_errors: True + when: {get_param: UpgradeRemoveUnusedPackages} diff --git a/docker/services/ceilometer-agent-ipmi.yaml b/docker/services/ceilometer-agent-ipmi.yaml index 82d55be2..9df93aaa 100644 --- a/docker/services/ceilometer-agent-ipmi.yaml +++ b/docker/services/ceilometer-agent-ipmi.yaml @@ -36,6 +36,10 @@ parameters: default: {} description: Parameters specific to the role type: json + UpgradeRemoveUnusedPackages: + default: false + description: Remove package if the service is being disabled during upgrade + type: boolean resources: @@ -58,6 +62,8 @@ outputs: value: service_name: {get_attr: [CeilometerAgentIpmiBase, role_data, service_name]} config_settings: {get_attr: [CeilometerAgentIpmiBase, role_data, config_settings]} + logging_source: {get_attr: [CeilometerAgentIpmiBase, role_data, logging_source]} + logging_groups: {get_attr: [CeilometerAgentIpmiBase, role_data, logging_groups]} step_config: &step_config get_attr: [CeilometerAgentIpmiBase, role_data, step_config] service_config_settings: {get_attr: [CeilometerAgentIpmiBase, role_data, service_config_settings]} @@ -102,3 +108,8 @@ outputs: - name: Stop and disable ceilometer agent ipmi service tags: step2 service: name=openstack-ceilometer-agent-ipmi state=stopped enabled=no + - name: Remove openstack-ceilometer-ipmi package if operator requests it + yum: name=openstack-ceilometer-ipmi state=removed + tags: step2 + ignore_errors: True + when: {get_param: UpgradeRemoveUnusedPackages} diff --git a/docker/services/ceilometer-agent-notification.yaml b/docker/services/ceilometer-agent-notification.yaml index 891750ad..de1d2e72 100644 --- a/docker/services/ceilometer-agent-notification.yaml +++ b/docker/services/ceilometer-agent-notification.yaml @@ -36,6 +36,10 @@ parameters: default: {} description: Parameters specific to the role type: json + UpgradeRemoveUnusedPackages: + default: false + description: Remove package if the service is being disabled during upgrade + type: boolean resources: @@ -58,6 +62,8 @@ outputs: value: service_name: {get_attr: [CeilometerAgentNotificationBase, role_data, service_name]} config_settings: {get_attr: [CeilometerAgentNotificationBase, role_data, config_settings]} + logging_source: {get_attr: [CeilometerAgentNotificationBase, role_data, logging_source]} + logging_groups: {get_attr: [CeilometerAgentNotificationBase, role_data, logging_groups]} step_config: &step_config get_attr: [CeilometerAgentNotificationBase, role_data, step_config] service_config_settings: {get_attr: [CeilometerAgentNotificationBase, role_data, service_config_settings]} @@ -117,3 +123,8 @@ outputs: - name: Stop and disable ceilometer agent notification service tags: step2 service: name=openstack-ceilometer-notification state=stopped enabled=no + - name: Remove openstack-ceilometer-notification package if operator requests it + yum: name=openstack-ceilometer-notification state=removed + tags: step2 + ignore_errors: True + when: {get_param: UpgradeRemoveUnusedPackages} diff --git a/docker/services/cinder-api.yaml b/docker/services/cinder-api.yaml index 06705309..25390c63 100644 --- a/docker/services/cinder-api.yaml +++ b/docker/services/cinder-api.yaml @@ -39,6 +39,10 @@ parameters: EnableInternalTLS: type: boolean default: false + UpgradeRemoveUnusedPackages: + default: false + description: Remove package if the service is being disabled during upgrade + type: boolean conditions: @@ -68,6 +72,8 @@ outputs: value: service_name: {get_attr: [CinderBase, role_data, service_name]} config_settings: {get_attr: [CinderBase, role_data, config_settings]} + logging_source: {get_attr: [CinderBase, role_data, logging_source]} + logging_groups: {get_attr: [CinderBase, role_data, logging_groups]} step_config: &step_config list_join: - "\n" @@ -197,3 +203,8 @@ outputs: file: path: /var/spool/cron/cinder state: absent + - name: Remove httpd package if operator requests it + yum: name=httpd state=removed + tags: step2 + ignore_errors: True + when: {get_param: UpgradeRemoveUnusedPackages} diff --git a/docker/services/cinder-backup.yaml b/docker/services/cinder-backup.yaml index ad3b43c2..66877b5f 100644 --- a/docker/services/cinder-backup.yaml +++ b/docker/services/cinder-backup.yaml @@ -36,7 +36,10 @@ parameters: default: {} description: Parameters specific to the role type: json - + UpgradeRemoveUnusedPackages: + default: false + description: Remove package if the service is being disabled during upgrade + type: boolean resources: @@ -62,6 +65,8 @@ outputs: value: service_name: {get_attr: [CinderBase, role_data, service_name]} config_settings: {get_attr: [CinderBase, role_data, config_settings]} + logging_source: {get_attr: [CinderBase, role_data, logging_source]} + logging_groups: {get_attr: [CinderBase, role_data, logging_groups]} step_config: &step_config list_join: - "\n" @@ -145,3 +150,8 @@ outputs: - name: Stop and disable cinder_backup service tags: step2 service: name=openstack-cinder-backup state=stopped enabled=no + - name: Remove openstack-cinder package if operator requests it + yum: name=openstack-cinder state=removed + tags: step2 + ignore_errors: True + when: {get_param: UpgradeRemoveUnusedPackages} diff --git a/docker/services/cinder-scheduler.yaml b/docker/services/cinder-scheduler.yaml index 1ac31874..1772f9e9 100644 --- a/docker/services/cinder-scheduler.yaml +++ b/docker/services/cinder-scheduler.yaml @@ -36,7 +36,10 @@ parameters: default: {} description: Parameters specific to the role type: json - + UpgradeRemoveUnusedPackages: + default: false + description: Remove package if the service is being disabled during upgrade + type: boolean resources: @@ -62,6 +65,8 @@ outputs: value: service_name: {get_attr: [CinderBase, role_data, service_name]} config_settings: {get_attr: [CinderBase, role_data, config_settings]} + logging_source: {get_attr: [CinderBase, role_data, logging_source]} + logging_groups: {get_attr: [CinderBase, role_data, logging_groups]} step_config: &step_config list_join: - "\n" @@ -121,3 +126,8 @@ outputs: - name: Stop and disable cinder_scheduler service tags: step2 service: name=openstack-cinder-scheduler state=stopped enabled=no + - name: Remove openstack-cinder package if operator requests it + yum: name=openstack-cinder state=removed + tags: step2 + ignore_errors: True + when: {get_param: UpgradeRemoveUnusedPackages} diff --git a/docker/services/cinder-volume.yaml b/docker/services/cinder-volume.yaml index eb904c0b..d8a93b13 100644 --- a/docker/services/cinder-volume.yaml +++ b/docker/services/cinder-volume.yaml @@ -45,6 +45,10 @@ parameters: default: 10280 description: The size of the loopback file used by the cinder LVM driver. type: number + UpgradeRemoveUnusedPackages: + default: false + description: Remove package if the service is being disabled during upgrade + type: boolean resources: @@ -73,6 +77,8 @@ outputs: map_merge: - get_attr: [CinderBase, role_data, config_settings] - tripleo::profile::base::lvm::enable_udev: false + logging_source: {get_attr: [CinderBase, role_data, logging_source]} + logging_groups: {get_attr: [CinderBase, role_data, logging_groups]} step_config: &step_config list_join: - "\n" @@ -185,3 +191,8 @@ outputs: - name: Stop and disable cinder_volume service tags: step2 service: name=openstack-cinder-volume state=stopped enabled=no + - name: Remove openstack-cinder package if operator requests it + yum: name=openstack-cinder state=removed + tags: step2 + ignore_errors: True + when: {get_param: UpgradeRemoveUnusedPackages} diff --git a/docker/services/collectd.yaml b/docker/services/collectd.yaml index 3c0ba09b..2ab020c7 100644 --- a/docker/services/collectd.yaml +++ b/docker/services/collectd.yaml @@ -36,7 +36,10 @@ parameters: default: {} description: Parameters specific to the role type: json - + UpgradeRemoveUnusedPackages: + default: false + description: Remove package if the service is being disabled during upgrade + type: boolean resources: @@ -63,6 +66,8 @@ outputs: - get_attr: [CollectdBase, role_data, config_settings] - tripleo::profile::base::metrics::collectd::enable_file_logging: true collectd::plugin::logfile::log_file: /var/log/collectd/collectd.log + logging_source: {get_attr: [CollectdBase, role_data, logging_source]} + logging_groups: {get_attr: [CollectdBase, role_data, logging_groups]} step_config: &step_config get_attr: [CollectdBase, role_data, step_config] service_config_settings: {get_attr: [CollectdBase, role_data, service_config_settings]} @@ -111,3 +116,8 @@ outputs: - name: Stop and disable collectd service tags: step2 service: name=collectd.service state=stopped enabled=no + - name: Remove collectd package if operator requests it + yum: name=collectd state=removed + tags: step2 + ignore_errors: True + when: {get_param: UpgradeRemoveUnusedPackages} diff --git a/docker/services/congress.yaml b/docker/services/congress.yaml index 08170cef..eb287d54 100644 --- a/docker/services/congress.yaml +++ b/docker/services/congress.yaml @@ -36,6 +36,10 @@ parameters: default: {} description: Parameters specific to the role type: json + UpgradeRemoveUnusedPackages: + default: false + description: Remove package if the service is being disabled during upgrade + type: boolean resources: @@ -63,6 +67,8 @@ outputs: config_settings: map_merge: - get_attr: [CongressBase, role_data, config_settings] + logging_source: {get_attr: [CongressBase, role_data, logging_source]} + logging_groups: {get_attr: [CongressBase, role_data, logging_groups]} step_config: &step_config list_join: - "\n" @@ -139,3 +145,8 @@ outputs: - name: Stop and disable congress_api service tags: step2 service: name=openstack-congress-server state=stopped enabled=no + - name: Remove openstack-congress package if operator requests it + yum: name=openstack-congress state=removed + tags: step2 + ignore_errors: True + when: {get_param: UpgradeRemoveUnusedPackages} diff --git a/docker/services/database/mongodb.yaml b/docker/services/database/mongodb.yaml index 5cf6f925..b933be96 100644 --- a/docker/services/database/mongodb.yaml +++ b/docker/services/database/mongodb.yaml @@ -70,6 +70,8 @@ outputs: map_merge: - get_attr: [MongodbPuppetBase, role_data, config_settings] - mongodb::server::fork: false + logging_source: {get_attr: [MongodbPuppetBase, role_data, logging_source]} + logging_groups: {get_attr: [MongodbPuppetBase, role_data, logging_groups]} step_config: &step_config list_join: - "\n" diff --git a/docker/services/database/mysql.yaml b/docker/services/database/mysql.yaml index 402dc351..174acd44 100644 --- a/docker/services/database/mysql.yaml +++ b/docker/services/database/mysql.yaml @@ -79,6 +79,8 @@ outputs: pid-file: /var/lib/mysql/mariadb.pid mysqld_safe: pid-file: /var/lib/mysql/mariadb.pid + logging_source: {get_attr: [MysqlPuppetBase, role_data, logging_source]} + logging_groups: {get_attr: [MysqlPuppetBase, role_data, logging_groups]} step_config: &step_config list_join: - "\n" @@ -125,11 +127,26 @@ outputs: command: ['/bin/bash', '-c', 'chown -R mysql:mysql /var/log/mariadb'] step_2: mysql_bootstrap: + start_order: 1 detach: false image: *mysql_image net: host + user: root # Kolla bootstraps aren't idempotent, explicitly checking if bootstrap was done - command: ['bash', '-c', 'test -e /var/lib/mysql/mysql || kolla_start'] + command: + - 'bash' + - '-ecx' + - + list_join: + - "\n" + - - 'if [ -e /var/lib/mysql/mysql ]; then exit 0; fi' + - 'echo -e "\n[mysqld]\nwsrep_provider=none" >> /etc/my.cnf' + - 'sudo -u mysql -E kolla_start' + - 'mysqld_safe --skip-networking --wsrep-on=OFF &' + - 'timeout ${DB_MAX_TIMEOUT} /bin/bash -c ''until mysqladmin -uroot -p"${DB_ROOT_PASSWORD}" ping 2>/dev/null; do sleep 1; done''' + - 'mysql -uroot -p"${DB_ROOT_PASSWORD}" -e "CREATE USER ''mysql''@''localhost'';"' + - 'mysql -uroot -p"${DB_ROOT_PASSWORD}" -e "REVOKE ALL PRIVILEGES, GRANT OPTION FROM ''mysql''@''localhost'';"' + - 'timeout ${DB_MAX_TIMEOUT} mysqladmin -uroot -p"${DB_ROOT_PASSWORD}" shutdown' volumes: &mysql_volumes list_concat: - @@ -141,7 +158,7 @@ outputs: - /var/log/containers/mysql:/var/log/mariadb - if: - internal_tls_enabled - - + - - list_join: - ':' - - {get_param: InternalTLSCAFile} @@ -149,12 +166,13 @@ outputs: - 'ro' - /etc/pki/tls/certs/mysql.crt:/var/lib/kolla/config_files/src-tls/etc/pki/tls/certs/mysql.crt:ro - /etc/pki/tls/private/mysql.key:/var/lib/kolla/config_files/src-tls/etc/pki/tls/private/mysql.key:ro - - null + - null environment: - KOLLA_CONFIG_STRATEGY=COPY_ALWAYS - KOLLA_BOOTSTRAP=True # NOTE(mandre) skip wsrep cluster status check - KOLLA_KUBERNETES=True + - DB_MAX_TIMEOUT=60 - list_join: - '=' @@ -189,7 +207,7 @@ outputs: - /var/lib/config-data/mysql/root:/root:ro #provides .my.cnf - if: - internal_tls_enabled - - + - - list_join: - ':' - - {get_param: InternalTLSCAFile} @@ -197,7 +215,7 @@ outputs: - 'ro' - /etc/pki/tls/certs/mysql.crt:/var/lib/kolla/config_files/src-tls/etc/pki/tls/certs/mysql.crt:ro - /etc/pki/tls/private/mysql.key:/var/lib/kolla/config_files/src-tls/etc/pki/tls/private/mysql.key:ro - - null + - null metadata_settings: get_attr: [MysqlPuppetBase, role_data, metadata_settings] host_prep_tasks: diff --git a/docker/services/database/redis.yaml b/docker/services/database/redis.yaml index 487b4c67..627a40e8 100644 --- a/docker/services/database/redis.yaml +++ b/docker/services/database/redis.yaml @@ -68,6 +68,8 @@ outputs: - redis::daemonize: false tripleo::stunnel::manage_service: false tripleo::stunnel::foreground: 'yes' + logging_source: {get_attr: [RedisBase, role_data, logging_source]} + logging_groups: {get_attr: [RedisBase, role_data, logging_groups]} step_config: &step_config get_attr: [RedisBase, role_data, step_config] service_config_settings: {get_attr: [RedisBase, role_data, service_config_settings]} diff --git a/docker/services/ec2-api.yaml b/docker/services/ec2-api.yaml index 1d4ddd38..48f1da4b 100644 --- a/docker/services/ec2-api.yaml +++ b/docker/services/ec2-api.yaml @@ -60,6 +60,8 @@ outputs: value: service_name: {get_attr: [Ec2ApiPuppetBase, role_data, service_name]} config_settings: {get_attr: [Ec2ApiPuppetBase, role_data, config_settings]} + logging_source: {get_attr: [Ec2ApiPuppetBase, role_data, logging_source]} + logging_groups: {get_attr: [Ec2ApiPuppetBase, role_data, logging_groups]} step_config: &step_config list_join: - "\n" diff --git a/docker/services/etcd.yaml b/docker/services/etcd.yaml index 42c9f2d3..019b8c1b 100644 --- a/docker/services/etcd.yaml +++ b/docker/services/etcd.yaml @@ -57,6 +57,8 @@ outputs: description: Role data for the etcd role. value: service_name: {get_attr: [EtcdPuppetBase, role_data, service_name]} + logging_source: {get_attr: [EtcdPuppetBase, role_data, logging_source]} + logging_groups: {get_attr: [EtcdPuppetBase, role_data, logging_groups]} step_config: &step_config list_join: - "\n" diff --git a/docker/services/fluentd-client.yaml b/docker/services/fluentd-client.yaml new file mode 100644 index 00000000..55ea2463 --- /dev/null +++ b/docker/services/fluentd-client.yaml @@ -0,0 +1,121 @@ +heat_template_version: pike + +description: > + OpenStack containerized fluentd services + +parameters: + DockerFluentdClientImage: + description: image + type: string + DockerFluentdConfigImage: + description: The container image to use fluentd config_volume + type: string + EndpointMap: + default: {} + description: Mapping of service endpoint -> protocol. Typically set + via parameter_defaults in the resource registry. + type: json + ServiceData: + default: {} + description: Dictionary packing service data + type: json + ServiceNetMap: + default: {} + description: Mapping of service_name -> network name. Typically set + via parameter_defaults in the resource registry. This + mapping overrides those in ServiceNetMapDefaults. + type: json + DefaultPasswords: + default: {} + type: json + RoleName: + default: '' + description: Role name on which the service is applied + type: string + RoleParameters: + default: {} + description: Parameters specific to the role + type: json + +resources: + + ContainersCommon: + type: ./containers-common.yaml + + FluentdClientBase: + type: ../../puppet/services/logging/fluentd-client.yaml + properties: + EndpointMap: {get_param: EndpointMap} + ServiceData: {get_param: ServiceData} + ServiceNetMap: {get_param: ServiceNetMap} + DefaultPasswords: {get_param: DefaultPasswords} + RoleName: {get_param: RoleName} + RoleParameters: {get_param: RoleParameters} + +outputs: + role_data: + description: Role data for the fluentd role. + value: + service_name: {get_attr: [FluentdClientBase, role_data, service_name]} + config_settings: + map_merge: + - {get_attr: [FluentdClientBase, role_data, config_settings]} + - tripleo::profile::base::logging::fluentd::fluentd_path_transform: + - /var/log/ + - /var/log/containers/ + step_config: &step_config + get_attr: [FluentdClientBase, role_data, step_config] + # BEGIN DOCKER SETTINGS + puppet_config: + config_volume: fluentd + puppet_tags: config + step_config: *step_config + config_image: {get_param: DockerFluentdConfigImage} + kolla_config: + /var/lib/kolla/config_files/fluentd.json: + command: /usr/bin/fluentd -c /etc/fluentd/fluent.conf -o /var/log/fluentd/fluentd.log + config_files: + - source: "/var/lib/kolla/config_files/src/*" + dest: "/" + merge: true + preserve_properties: true + permissions: + - path: /var/lib/fluentd + owner: fluentd:fluentd + recurse: true + - path: /var/log/fluentd + owner: fluentd:fluentd + recurse: true + docker_config: + step_3: + fluentd_client: + image: {get_param: DockerFluentdClientImage} + net: host + privileged: true + user: root + restart: always + volumes: + list_concat: + - {get_attr: [ContainersCommon, volumes]} + - + - /var/cache/containers/fluentd:/var/cache/fluentd:rw + - /var/lib/kolla/config_files/fluentd.json:/var/lib/kolla/config_files/config.json:ro + - /var/lib/config-data/puppet-generated/fluentd/:/var/lib/kolla/config_files/src:ro + - /var/log/containers:/var/log/containers:ro + - /var/log/containers/fluentd:/var/log/fluentd:rw + environment: + - KOLLA_CONFIG_STRATEGY=COPY_ALWAYS + host_prep_tasks: + - name: create persistent logs directory for fluentd + file: + path: /var/log/containers/fluentd + state: directory + - name: create persistent cache directory + file: + path: /var/cache/containers/fluentd + state: directory + upgrade_tasks: + - name: Stop and disable fluentd service + tags: step2 + service: name=fluentd.service state=stopped enabled=no + diff --git a/docker/services/glance-api.yaml b/docker/services/glance-api.yaml index 8f2bd604..e1a3827a 100644 --- a/docker/services/glance-api.yaml +++ b/docker/services/glance-api.yaml @@ -44,6 +44,10 @@ parameters: description: > When using GlanceBackend 'file', mount NFS share for image storage. type: boolean + UpgradeRemoveUnusedPackages: + default: false + description: Remove package if the service is being disabled during upgrade + type: boolean conditions: @@ -78,6 +82,8 @@ outputs: map_merge: - get_attr: [GlanceApiPuppetBase, role_data, config_settings] - glance::api::sync_db: false + logging_source: {get_attr: [GlanceApiPuppetBase, role_data, logging_source]} + logging_groups: {get_attr: [GlanceApiPuppetBase, role_data, logging_groups]} step_config: &step_config list_join: - "\n" @@ -191,5 +197,10 @@ outputs: - name: Stop and disable glance_api service tags: step2 service: name=openstack-glance-api state=stopped enabled=no + - name: Remove openstack-glance package if operator requests it + yum: name=openstack-glance state=removed + tags: step2 + ignore_errors: True + when: {get_param: UpgradeRemoveUnusedPackages} metadata_settings: get_attr: [GlanceApiPuppetBase, role_data, metadata_settings] diff --git a/docker/services/gnocchi-api.yaml b/docker/services/gnocchi-api.yaml index 47b3b811..96f6ab98 100644 --- a/docker/services/gnocchi-api.yaml +++ b/docker/services/gnocchi-api.yaml @@ -71,6 +71,8 @@ outputs: map_merge: - get_attr: [GnocchiApiPuppetBase, role_data, config_settings] - apache::default_vhost: false + logging_source: {get_attr: [GnocchiApiPuppetBase, role_data, logging_source]} + logging_groups: {get_attr: [GnocchiApiPuppetBase, role_data, logging_groups]} step_config: &step_config get_attr: [GnocchiApiPuppetBase, role_data, step_config] service_config_settings: {get_attr: [GnocchiApiPuppetBase, role_data, service_config_settings]} diff --git a/docker/services/gnocchi-metricd.yaml b/docker/services/gnocchi-metricd.yaml index 9a114458..b966fa68 100644 --- a/docker/services/gnocchi-metricd.yaml +++ b/docker/services/gnocchi-metricd.yaml @@ -61,6 +61,8 @@ outputs: value: service_name: {get_attr: [GnocchiMetricdBase, role_data, service_name]} config_settings: {get_attr: [GnocchiMetricdBase, role_data, config_settings]} + logging_source: {get_attr: [GnocchiMetricdBase, role_data, logging_source]} + logging_groups: {get_attr: [GnocchiMetricdBase, role_data, logging_groups]} step_config: &step_config list_join: - "\n" diff --git a/docker/services/gnocchi-statsd.yaml b/docker/services/gnocchi-statsd.yaml index 834d0055..0ebc83f6 100644 --- a/docker/services/gnocchi-statsd.yaml +++ b/docker/services/gnocchi-statsd.yaml @@ -61,6 +61,8 @@ outputs: value: service_name: {get_attr: [GnocchiStatsdBase, role_data, service_name]} config_settings: {get_attr: [GnocchiStatsdBase, role_data, config_settings]} + logging_source: {get_attr: [GnocchiStatsdBase, role_data, logging_source]} + logging_groups: {get_attr: [GnocchiStatsdBase, role_data, logging_groups]} step_config: &step_config list_join: - "\n" diff --git a/docker/services/haproxy.yaml b/docker/services/haproxy.yaml index 70e1f893..b6c43527 100644 --- a/docker/services/haproxy.yaml +++ b/docker/services/haproxy.yaml @@ -100,6 +100,8 @@ outputs: # NOTE(jaosorior): We disable the CRL since we have no way to restart haproxy # when this is updated tripleo::haproxy::crl_file: null + logging_source: {get_attr: [HAProxyBase, role_data, logging_source]} + logging_groups: {get_attr: [HAProxyBase, role_data, logging_groups]} step_config: &step_config get_attr: [HAProxyBase, role_data, step_config] service_config_settings: {get_attr: [HAProxyBase, role_data, service_config_settings]} diff --git a/docker/services/heat-api-cfn.yaml b/docker/services/heat-api-cfn.yaml index cfe11cd6..84bc0672 100644 --- a/docker/services/heat-api-cfn.yaml +++ b/docker/services/heat-api-cfn.yaml @@ -69,6 +69,8 @@ outputs: map_merge: - get_attr: [HeatBase, role_data, config_settings] - apache::default_vhost: false + logging_source: {get_attr: [HeatBase, role_data, logging_source]} + logging_groups: {get_attr: [HeatBase, role_data, logging_groups]} step_config: &step_config get_attr: [HeatBase, role_data, step_config] service_config_settings: {get_attr: [HeatBase, role_data, service_config_settings]} diff --git a/docker/services/heat-api.yaml b/docker/services/heat-api.yaml index 2bb588de..75d0b8c1 100644 --- a/docker/services/heat-api.yaml +++ b/docker/services/heat-api.yaml @@ -71,6 +71,8 @@ outputs: - apache::default_vhost: false step_config: &step_config get_attr: [HeatBase, role_data, step_config] + logging_source: {get_attr: [HeatBase, role_data, logging_source]} + logging_groups: {get_attr: [HeatBase, role_data, logging_groups]} service_config_settings: {get_attr: [HeatBase, role_data, service_config_settings]} # BEGIN DOCKER SETTINGS puppet_config: diff --git a/docker/services/heat-engine.yaml b/docker/services/heat-engine.yaml index fdba7d58..21ae2426 100644 --- a/docker/services/heat-engine.yaml +++ b/docker/services/heat-engine.yaml @@ -37,7 +37,6 @@ parameters: description: Parameters specific to the role type: json - resources: ContainersCommon: @@ -65,6 +64,8 @@ outputs: map_merge: - get_attr: [HeatBase, role_data, config_settings] - apache::default_vhost: false + logging_source: {get_attr: [HeatBase, role_data, logging_source]} + logging_groups: {get_attr: [HeatBase, role_data, logging_groups]} step_config: &step_config list_join: - "\n" diff --git a/docker/services/horizon.yaml b/docker/services/horizon.yaml index 9a2c8bad..d6ffb6dc 100644 --- a/docker/services/horizon.yaml +++ b/docker/services/horizon.yaml @@ -73,6 +73,8 @@ outputs: access_log_format: '%a %l %u %t \"%r\" %>s %b \"%%{}{Referer}i\" \"%%{}{User-Agent}i\"' options: ['FollowSymLinks','MultiViews'] - horizon::secure_cookies: false + logging_source: {get_attr: [HorizonBase, role_data, logging_source]} + logging_groups: {get_attr: [HorizonBase, role_data, logging_groups]} step_config: {get_attr: [HorizonBase, role_data, step_config]} service_config_settings: {get_attr: [HorizonBase, role_data, service_config_settings]} # BEGIN DOCKER SETTINGS diff --git a/docker/services/ironic-api.yaml b/docker/services/ironic-api.yaml index 38710f3b..156e5f98 100644 --- a/docker/services/ironic-api.yaml +++ b/docker/services/ironic-api.yaml @@ -64,6 +64,8 @@ outputs: map_merge: - get_attr: [IronicApiBase, role_data, config_settings] - apache::default_vhost: false + logging_source: {get_attr: [IronicApiBase, role_data, logging_source]} + logging_groups: {get_attr: [IronicApiBase, role_data, logging_groups]} step_config: &step_config list_join: - "\n" diff --git a/docker/services/ironic-conductor.yaml b/docker/services/ironic-conductor.yaml index 37f4d46e..465aa8b1 100644 --- a/docker/services/ironic-conductor.yaml +++ b/docker/services/ironic-conductor.yaml @@ -71,6 +71,8 @@ outputs: - ironic::pxe::tftp_root: /var/lib/ironic/tftpboot - ironic::pxe::http_root: /var/lib/ironic/httpboot - ironic::conductor::http_root: /var/lib/ironic/httpboot + logging_source: {get_attr: [IronicConductorBase, role_data, logging_source]} + logging_groups: {get_attr: [IronicConductorBase, role_data, logging_groups]} step_config: &step_config list_join: - "\n" diff --git a/docker/services/iscsid.yaml b/docker/services/iscsid.yaml index c34a59d5..da9b1b2c 100644 --- a/docker/services/iscsid.yaml +++ b/docker/services/iscsid.yaml @@ -57,6 +57,8 @@ outputs: value: service_name: {get_attr: [IscsidBase, role_data, service_name]} config_settings: {get_attr: [IscsidBase, role_data, config_settings]} + logging_source: {get_attr: [IscsidBase, role_data, logging_source]} + logging_groups: {get_attr: [IscsidBase, role_data, logging_groups]} step_config: &step_config {get_attr: [IscsidBase, role_data, step_config]} service_config_settings: {get_attr: [IscsidBase, role_data, service_config_settings]} diff --git a/docker/services/keystone.yaml b/docker/services/keystone.yaml index 8f4a2014..26cef614 100644 --- a/docker/services/keystone.yaml +++ b/docker/services/keystone.yaml @@ -81,6 +81,8 @@ outputs: map_merge: - get_attr: [KeystoneBase, role_data, config_settings] - apache::default_vhost: false + logging_source: {get_attr: [KeystoneBase, role_data, logging_source]} + logging_groups: {get_attr: [KeystoneBase, role_data, logging_groups]} step_config: &step_config list_join: - "\n" diff --git a/docker/services/manila-api.yaml b/docker/services/manila-api.yaml index a0e501ec..d2360f97 100644 --- a/docker/services/manila-api.yaml +++ b/docker/services/manila-api.yaml @@ -59,6 +59,8 @@ outputs: value: service_name: {get_attr: [ManilaApiPuppetBase, role_data, service_name]} config_settings: {get_attr: [ManilaApiPuppetBase, role_data, config_settings]} + logging_source: {get_attr: [ManilaApiPuppetBase, role_data, logging_source]} + logging_groups: {get_attr: [ManilaApiPuppetBase, role_data, logging_groups]} step_config: &step_config list_join: - "\n" diff --git a/docker/services/manila-scheduler.yaml b/docker/services/manila-scheduler.yaml index 7b5dfec3..931ce23d 100644 --- a/docker/services/manila-scheduler.yaml +++ b/docker/services/manila-scheduler.yaml @@ -59,6 +59,8 @@ outputs: value: service_name: {get_attr: [ManilaSchedulerPuppetBase, role_data, service_name]} config_settings: {get_attr: [ManilaSchedulerPuppetBase, role_data, config_settings]} + logging_source: {get_attr: [ManilaSchedulerPuppetBase, role_data, logging_source]} + logging_groups: {get_attr: [ManilaSchedulerPuppetBase, role_data, logging_groups]} step_config: &step_config list_join: - "\n" diff --git a/docker/services/manila-share.yaml b/docker/services/manila-share.yaml index 332ba864..cf3303c3 100644 --- a/docker/services/manila-share.yaml +++ b/docker/services/manila-share.yaml @@ -61,6 +61,8 @@ outputs: value: service_name: {get_attr: [ManilaBase, role_data, service_name]} config_settings: {get_attr: [ManilaBase, role_data, config_settings]} + logging_source: {get_attr: [ManilaBase, role_data, logging_source]} + logging_groups: {get_attr: [ManilaBase, role_data, logging_groups]} step_config: &step_config list_join: - "\n" diff --git a/docker/services/memcached.yaml b/docker/services/memcached.yaml index 7e28bdc1..c78b85a6 100644 --- a/docker/services/memcached.yaml +++ b/docker/services/memcached.yaml @@ -58,6 +58,8 @@ outputs: value: service_name: {get_attr: [MemcachedBase, role_data, service_name]} config_settings: {get_attr: [MemcachedBase, role_data, config_settings]} + logging_source: {get_attr: [MemcachedBase, role_data, logging_source]} + logging_groups: {get_attr: [MemcachedBase, role_data, logging_groups]} step_config: &step_config get_attr: [MemcachedBase, role_data, step_config] service_config_settings: {get_attr: [MemcachedBase, role_data, service_config_settings]} diff --git a/docker/services/mistral-api.yaml b/docker/services/mistral-api.yaml index 38b97aef..50c80216 100644 --- a/docker/services/mistral-api.yaml +++ b/docker/services/mistral-api.yaml @@ -63,6 +63,8 @@ outputs: config_settings: map_merge: - get_attr: [MistralApiBase, role_data, config_settings] + logging_source: {get_attr: [MistralApiBase, role_data, logging_source]} + logging_groups: {get_attr: [MistralApiBase, role_data, logging_groups]} step_config: &step_config list_join: - "\n" diff --git a/docker/services/mistral-engine.yaml b/docker/services/mistral-engine.yaml index 2b498be3..12f7779b 100644 --- a/docker/services/mistral-engine.yaml +++ b/docker/services/mistral-engine.yaml @@ -64,6 +64,8 @@ outputs: config_settings: map_merge: - get_attr: [MistralBase, role_data, config_settings] + logging_source: {get_attr: [MistralBase, role_data, logging_source]} + logging_groups: {get_attr: [MistralBase, role_data, logging_groups]} step_config: &step_config list_join: - "\n" diff --git a/docker/services/mistral-executor.yaml b/docker/services/mistral-executor.yaml index e106fe47..0ee7d534 100644 --- a/docker/services/mistral-executor.yaml +++ b/docker/services/mistral-executor.yaml @@ -64,6 +64,8 @@ outputs: config_settings: map_merge: - get_attr: [MistralBase, role_data, config_settings] + logging_source: {get_attr: [MistralBase, role_data, logging_source]} + logging_groups: {get_attr: [MistralBase, role_data, logging_groups]} step_config: &step_config list_join: - "\n" diff --git a/docker/services/neutron-api.yaml b/docker/services/neutron-api.yaml index c028fc28..34d70ff0 100644 --- a/docker/services/neutron-api.yaml +++ b/docker/services/neutron-api.yaml @@ -39,6 +39,10 @@ parameters: EnableInternalTLS: type: boolean default: false + UpgradeRemoveUnusedPackages: + default: false + description: Remove package if the service is being disabled during upgrade + type: boolean conditions: @@ -67,6 +71,8 @@ outputs: description: Role data for the Neutron API role. value: service_name: {get_attr: [NeutronBase, role_data, service_name]} + logging_source: {get_attr: [NeutronBase, role_data, logging_source]} + logging_groups: {get_attr: [NeutronBase, role_data, logging_groups]} config_settings: map_merge: - get_attr: [NeutronBase, role_data, config_settings] @@ -189,5 +195,10 @@ outputs: tags: step2 when: neutron_server_enabled.rc == 0 service: name=neutron-server state=stopped enabled=no + - name: Remove openstack-neutron package if operator requests it + yum: name=openstack-neutron state=removed + tags: step2 + ignore_errors: True + when: {get_param: UpgradeRemoveUnusedPackages} metadata_settings: get_attr: [NeutronBase, role_data, metadata_settings] diff --git a/docker/services/neutron-dhcp.yaml b/docker/services/neutron-dhcp.yaml index 4b75d542..4b5a2711 100644 --- a/docker/services/neutron-dhcp.yaml +++ b/docker/services/neutron-dhcp.yaml @@ -60,6 +60,8 @@ outputs: config_settings: map_merge: - get_attr: [NeutronBase, role_data, config_settings] + logging_source: {get_attr: [NeutronBase, role_data, logging_source]} + logging_groups: {get_attr: [NeutronBase, role_data, logging_groups]} step_config: &step_config get_attr: [NeutronBase, role_data, step_config] service_config_settings: {get_attr: [NeutronBase, role_data, service_config_settings]} diff --git a/docker/services/neutron-l3.yaml b/docker/services/neutron-l3.yaml index 06470c05..09232c26 100644 --- a/docker/services/neutron-l3.yaml +++ b/docker/services/neutron-l3.yaml @@ -58,6 +58,8 @@ outputs: value: service_name: {get_attr: [NeutronL3Base, role_data, service_name]} config_settings: {get_attr: [NeutronL3Base, role_data, config_settings]} + logging_source: {get_attr: [NeutronL3Base, role_data, logging_source]} + logging_groups: {get_attr: [NeutronL3Base, role_data, logging_groups]} step_config: &step_config get_attr: [NeutronL3Base, role_data, step_config] puppet_config: diff --git a/docker/services/neutron-metadata.yaml b/docker/services/neutron-metadata.yaml index a5a7c34b..9fe839e9 100644 --- a/docker/services/neutron-metadata.yaml +++ b/docker/services/neutron-metadata.yaml @@ -58,6 +58,8 @@ outputs: value: service_name: {get_attr: [NeutronMetadataBase, role_data, service_name]} config_settings: {get_attr: [NeutronMetadataBase, role_data, config_settings]} + logging_source: {get_attr: [NeutronMetadataBase, role_data, logging_source]} + logging_groups: {get_attr: [NeutronMetadataBase, role_data, logging_groups]} step_config: &step_config get_attr: [NeutronMetadataBase, role_data, step_config] puppet_config: diff --git a/docker/services/neutron-ovs-agent.yaml b/docker/services/neutron-ovs-agent.yaml index 81bb1c20..e6faf34d 100644 --- a/docker/services/neutron-ovs-agent.yaml +++ b/docker/services/neutron-ovs-agent.yaml @@ -36,6 +36,10 @@ parameters: description: Mapping of service endpoint -> protocol. Typically set via parameter_defaults in the resource registry. type: json + UpgradeRemoveUnusedPackages: + default: false + description: Remove package if the service is being disabled during upgrade + type: boolean resources: @@ -58,6 +62,8 @@ outputs: value: service_name: {get_attr: [NeutronOvsAgentBase, role_data, service_name]} config_settings: {get_attr: [NeutronOvsAgentBase, role_data, config_settings]} + logging_source: {get_attr: [NeutronOvsAgentBase, role_data, logging_source]} + logging_groups: {get_attr: [NeutronOvsAgentBase, role_data, logging_groups]} step_config: &step_config get_attr: [NeutronOvsAgentBase, role_data, step_config] puppet_config: @@ -136,3 +142,8 @@ outputs: - name: Stop and disable neutron_ovs_agent service tags: step2 service: name=neutron-openvswitch-agent state=stopped enabled=no + - name: Remove openstack-neutron-openvswitch package if operator requests it + yum: name=openstack-neutron-openvswitch state=removed + tags: step2 + ignore_errors: True + when: {get_param: UpgradeRemoveUnusedPackages} diff --git a/docker/services/neutron-plugin-ml2.yaml b/docker/services/neutron-plugin-ml2.yaml index 8d12e0de..88d46ca2 100644 --- a/docker/services/neutron-plugin-ml2.yaml +++ b/docker/services/neutron-plugin-ml2.yaml @@ -53,6 +53,8 @@ outputs: config_settings: map_merge: - get_attr: [NeutronBase, role_data, config_settings] + logging_source: {get_attr: [NeutronBase, role_data, logging_source]} + logging_groups: {get_attr: [NeutronBase, role_data, logging_groups]} step_config: &step_config get_attr: [NeutronBase, role_data, step_config] service_config_settings: {get_attr: [NeutronBase, role_data, service_config_settings]} diff --git a/docker/services/nova-api.yaml b/docker/services/nova-api.yaml index 9f1ae865..f262bcb1 100644 --- a/docker/services/nova-api.yaml +++ b/docker/services/nova-api.yaml @@ -39,6 +39,10 @@ parameters: EnableInternalTLS: type: boolean default: false + UpgradeRemoveUnusedPackages: + default: false + description: Remove package if the service is being disabled during upgrade + type: boolean conditions: @@ -71,6 +75,8 @@ outputs: map_merge: - get_attr: [NovaApiBase, role_data, config_settings] - apache::default_vhost: false + logging_source: {get_attr: [NovaApiBase, role_data, logging_source]} + logging_groups: {get_attr: [NovaApiBase, role_data, logging_groups]} step_config: &step_config list_join: - "\n" @@ -234,6 +240,11 @@ outputs: - name: Stop and disable nova_api service tags: step2 service: name=openstack-nova-api state=stopped enabled=no + - name: Remove openstack-nova-api package if operator requests it + yum: name=openstack-nova-api state=removed + tags: step2 + ignore_errors: True + when: {get_param: UpgradeRemoveUnusedPackages} - name: remove old nova cron jobs file: path: /var/spool/cron/nova diff --git a/docker/services/nova-compute.yaml b/docker/services/nova-compute.yaml index bf7841be..883f438b 100644 --- a/docker/services/nova-compute.yaml +++ b/docker/services/nova-compute.yaml @@ -45,6 +45,10 @@ parameters: type: string description: Nova Compute upgrade level default: '' + UpgradeRemoveUnusedPackages: + default: false + description: Remove package if the service is being disabled during upgrade + type: boolean resources: @@ -63,7 +67,6 @@ resources: DefaultPasswords: {get_param: DefaultPasswords} RoleName: {get_param: RoleName} RoleParameters: {get_param: RoleParameters} - MigrationSshPort: {get_param: DockerNovaMigrationSshdPort} outputs: role_data: @@ -72,6 +75,8 @@ outputs: service_name: {get_attr: [NovaComputeBase, role_data, service_name]} config_settings: get_attr: [NovaComputeBase, role_data, config_settings] + logging_source: {get_attr: [NovaComputeBase, role_data, logging_source]} + logging_groups: {get_attr: [NovaComputeBase, role_data, logging_groups]} step_config: &step_config list_join: - "\n" @@ -156,3 +161,8 @@ outputs: - name: Stop and disable nova-compute service tags: step2 service: name=openstack-nova-compute state=stopped enabled=no + - name: Remove openstack-nova-compute package if operator requests it + yum: name=openstack-nova-compute state=removed + tags: step2 + ignore_errors: True + when: {get_param: UpgradeRemoveUnusedPackages} diff --git a/docker/services/nova-conductor.yaml b/docker/services/nova-conductor.yaml index 17d137cc..f15c3a68 100644 --- a/docker/services/nova-conductor.yaml +++ b/docker/services/nova-conductor.yaml @@ -40,6 +40,11 @@ parameters: type: string description: Nova Compute upgrade level default: '' + UpgradeRemoveUnusedPackages: + default: false + description: Remove package if the service is being disabled during upgrade + type: boolean + resources: @@ -65,6 +70,8 @@ outputs: value: service_name: {get_attr: [NovaConductorBase, role_data, service_name]} config_settings: {get_attr: [NovaConductorBase, role_data, config_settings]} + logging_source: {get_attr: [NovaConductorBase, role_data, logging_source]} + logging_groups: {get_attr: [NovaConductorBase, role_data, logging_groups]} step_config: &step_config list_join: - "\n" @@ -121,3 +128,8 @@ outputs: - name: Stop and disable nova_conductor service tags: step2 service: name=openstack-nova-conductor state=stopped enabled=no + - name: Remove openstack-nova-conductor package if operator requests it + yum: name=openstack-nova-conductor state=removed + tags: step2 + ignore_errors: True + when: {get_param: UpgradeRemoveUnusedPackages} diff --git a/docker/services/nova-consoleauth.yaml b/docker/services/nova-consoleauth.yaml index 715a861b..069b09bc 100644 --- a/docker/services/nova-consoleauth.yaml +++ b/docker/services/nova-consoleauth.yaml @@ -36,6 +36,10 @@ parameters: default: {} description: Parameters specific to the role type: json + UpgradeRemoveUnusedPackages: + default: false + description: Remove package if the service is being disabled during upgrade + type: boolean resources: @@ -61,6 +65,8 @@ outputs: value: service_name: {get_attr: [NovaConsoleauthPuppetBase, role_data, service_name]} config_settings: {get_attr: [NovaConsoleauthPuppetBase, role_data, config_settings]} + logging_source: {get_attr: [NovaConsoleauthPuppetBase, role_data, logging_source]} + logging_groups: {get_attr: [NovaConsoleauthPuppetBase, role_data, logging_groups]} step_config: &step_config list_join: - "\n" @@ -110,3 +116,8 @@ outputs: - name: Stop and disable nova_consoleauth service tags: step2 service: name=openstack-nova-consoleauth state=stopped enabled=no + - name: Remove openstack-nova-console package if operator requests it + yum: name=openstack-nova-console state=removed + tags: step2 + ignore_errors: True + when: {get_param: UpgradeRemoveUnusedPackages} diff --git a/docker/services/nova-ironic.yaml b/docker/services/nova-ironic.yaml index 543758a1..1bed40ec 100644 --- a/docker/services/nova-ironic.yaml +++ b/docker/services/nova-ironic.yaml @@ -61,6 +61,8 @@ outputs: value: service_name: {get_attr: [NovaIronicBase, role_data, service_name]} config_settings: {get_attr: [NovaIronicBase, role_data, config_settings]} + logging_source: {get_attr: [NovaIronicBase, role_data, logging_source]} + logging_groups: {get_attr: [NovaIronicBase, role_data, logging_groups]} step_config: &step_config list_join: - "\n" diff --git a/docker/services/nova-libvirt.yaml b/docker/services/nova-libvirt.yaml index d20c093d..df168945 100644 --- a/docker/services/nova-libvirt.yaml +++ b/docker/services/nova-libvirt.yaml @@ -105,7 +105,6 @@ resources: DefaultPasswords: {get_param: DefaultPasswords} RoleName: {get_param: RoleName} RoleParameters: {get_param: RoleParameters} - MigrationSshPort: {get_param: DockerNovaMigrationSshdPort} outputs: role_data: @@ -117,6 +116,8 @@ outputs: - get_attr: [NovaLibvirtBase, role_data, config_settings] - tripleo::profile::base::certmonger_user::libvirt_postsave_cmd: "true" # TODO: restart the libvirt container here + logging_source: {get_attr: [NovaLibvirtBase, role_data, logging_source]} + logging_groups: {get_attr: [NovaLibvirtBase, role_data, logging_groups]} step_config: &step_config list_join: - "\n" diff --git a/docker/services/nova-metadata.yaml b/docker/services/nova-metadata.yaml index 53ae7910..54d9312b 100644 --- a/docker/services/nova-metadata.yaml +++ b/docker/services/nova-metadata.yaml @@ -60,6 +60,8 @@ outputs: config_settings: map_merge: - get_attr: [NovaMetadataBase, role_data, config_settings] + logging_source: {get_attr: [NovaMetadataBase, role_data, logging_source]} + logging_groups: {get_attr: [NovaMetadataBase, role_data, logging_groups]} step_config: &step_config get_attr: [NovaMetadataBase, role_data, step_config] service_config_settings: {get_attr: [NovaMetadataBase, role_data, service_config_settings]} diff --git a/docker/services/nova-migration-target.yaml b/docker/services/nova-migration-target.yaml index 385343a0..cb3b950e 100644 --- a/docker/services/nova-migration-target.yaml +++ b/docker/services/nova-migration-target.yaml @@ -41,6 +41,29 @@ parameters: description: Port that dockerized nova migration target sshd service binds to. type: number + MigrationSshKey: + type: json + description: > + SSH key for migration. + Expects a dictionary with keys 'public_key' and 'private_key'. + Values should be identical to SSH public/private key files. + default: + public_key: '' + private_key: '' + MigrationSshPort: + default: 2022 + description: Target port for migration over ssh + type: number + +conditions: + + # During Ocata->Pike upgrade initially configure the ssh service on port 22 + # to proxy migration commands to the containerized sshd on port 2022. + # When the upgrade converges we can switch migrations over to port 2022. + enable_migration_proxy: + equals: + - {get_param: MigrationSshPort} + - 22 resources: @@ -74,10 +97,17 @@ outputs: map_merge: - get_attr: [SshdBase, role_data, config_settings] - get_attr: [NovaMigrationTargetBase, role_data, config_settings] - - tripleo.nova_migration_target.firewall_rules: - '113 nova_migration_target': - dport: - - {get_param: DockerNovaMigrationSshdPort} + # NB this prevents the baremetal ssh from listening on port 2022 + # It doesn't affect the sshd port in the container as we override it below on the sshd cli + - tripleo::profile::base::sshd::port: 22 + - if: + - enable_migration_proxy + - tripleo::profile::base::nova::migration::proxy::ssh_private_key: {get_param: [ MigrationSshKey, private_key ]} + tripleo::profile::base::nova::migration::proxy::target_port: {get_param: DockerNovaMigrationSshdPort} + tripleo::profile::base::nova::migration::proxy::target_host: "%{hiera('live_migration_ssh_inbound_addr')}" + - {} + logging_source: {get_attr: [NovaMigrationTargetBase, role_data, logging_source]} + logging_groups: {get_attr: [NovaMigrationTargetBase, role_data, logging_groups]} step_config: &step_config list_join: - "\n" diff --git a/docker/services/nova-placement.yaml b/docker/services/nova-placement.yaml index d66a6fb8..bd5ae731 100644 --- a/docker/services/nova-placement.yaml +++ b/docker/services/nova-placement.yaml @@ -39,6 +39,10 @@ parameters: EnableInternalTLS: type: boolean default: false + UpgradeRemoveUnusedPackages: + default: false + description: Remove package if the service is being disabled during upgrade + type: boolean conditions: @@ -71,6 +75,8 @@ outputs: map_merge: - get_attr: [NovaPlacementBase, role_data, config_settings] - apache::default_vhost: false + logging_source: {get_attr: [NovaPlacementBase, role_data, logging_source]} + logging_groups: {get_attr: [NovaPlacementBase, role_data, logging_groups]} step_config: &step_config list_join: - "\n" @@ -138,3 +144,9 @@ outputs: - name: Stop and disable nova_placement service (running under httpd) tags: step2 service: name=httpd state=stopped enabled=no + - name: Remove httpd package if operator requests it + yum: name=httpd state=removed + tags: step2 + ignore_errors: True + when: {get_param: UpgradeRemoveUnusedPackages} + diff --git a/docker/services/nova-scheduler.yaml b/docker/services/nova-scheduler.yaml index 8d8a6358..f8109b96 100644 --- a/docker/services/nova-scheduler.yaml +++ b/docker/services/nova-scheduler.yaml @@ -36,6 +36,10 @@ parameters: default: {} description: Parameters specific to the role type: json + UpgradeRemoveUnusedPackages: + default: false + description: Remove package if the service is being disabled during upgrade + type: boolean resources: @@ -61,6 +65,8 @@ outputs: value: service_name: {get_attr: [NovaSchedulerBase, role_data, service_name]} config_settings: {get_attr: [NovaSchedulerBase, role_data, config_settings]} + logging_source: {get_attr: [NovaSchedulerBase, role_data, logging_source]} + logging_groups: {get_attr: [NovaSchedulerBase, role_data, logging_groups]} step_config: &step_config list_join: - "\n" @@ -111,3 +117,8 @@ outputs: - name: Stop and disable nova_scheduler service tags: step2 service: name=openstack-nova-scheduler state=stopped enabled=no + - name: Remove openstack-nova-scheduler package if operator requests it + yum: name=openstack-nova-scheduler state=removed + tags: step2 + ignore_errors: True + when: {get_param: UpgradeRemoveUnusedPackages} diff --git a/docker/services/nova-vnc-proxy.yaml b/docker/services/nova-vnc-proxy.yaml index c5f651d2..b1da294b 100644 --- a/docker/services/nova-vnc-proxy.yaml +++ b/docker/services/nova-vnc-proxy.yaml @@ -36,6 +36,10 @@ parameters: default: {} description: Parameters specific to the role type: json + UpgradeRemoveUnusedPackages: + default: false + description: Remove package if the service is being disabled during upgrade + type: boolean resources: @@ -61,6 +65,8 @@ outputs: value: service_name: {get_attr: [NovaVncProxyPuppetBase, role_data, service_name]} config_settings: {get_attr: [NovaVncProxyPuppetBase, role_data, config_settings]} + logging_source: {get_attr: [NovaVncProxyPuppetBase, role_data, logging_source]} + logging_groups: {get_attr: [NovaVncProxyPuppetBase, role_data, logging_groups]} step_config: &step_config list_join: - "\n" @@ -110,3 +116,8 @@ outputs: - name: Stop and disable nova_vnc_proxy service tags: step2 service: name=openstack-nova-novncproxy state=stopped enabled=no + - name: Remove openstack-nova-novncproxy package if operator requests it + yum: name=openstack-nova-novncproxy state=removed + tags: step2 + ignore_errors: True + when: {get_param: UpgradeRemoveUnusedPackages} diff --git a/docker/services/octavia-api.yaml b/docker/services/octavia-api.yaml index da698991..c5e729c4 100644 --- a/docker/services/octavia-api.yaml +++ b/docker/services/octavia-api.yaml @@ -69,6 +69,8 @@ outputs: value: service_name: {get_attr: [OctaviaApiPuppetBase, role_data, service_name]} config_settings: {get_attr: [OctaviaApiPuppetBase, role_data, config_settings]} + logging_source: {get_attr: [OctaviaApiPuppetBase, role_data, logging_source]} + logging_groups: {get_attr: [OctaviaApiPuppetBase, role_data, logging_groups]} step_config: &step_config list_join: - "\n" diff --git a/docker/services/octavia-health-manager.yaml b/docker/services/octavia-health-manager.yaml index f5e1eda5..5180e416 100644 --- a/docker/services/octavia-health-manager.yaml +++ b/docker/services/octavia-health-manager.yaml @@ -36,7 +36,10 @@ parameters: default: {} description: Parameters specific to the role type: json - + UpgradeRemoveUnusedPackages: + default: false + description: Remove package if the service is being disabled during upgrade + type: boolean resources: @@ -59,6 +62,8 @@ outputs: value: service_name: {get_attr: [OctaviaHealthManagerPuppetBase, role_data, service_name]} config_settings: {get_attr: [OctaviaHealthManagerPuppetBase, role_data, config_settings]} + logging_source: {get_attr: [OctaviaHealthManagerPuppetBase, role_data, logging_source]} + logging_groups: {get_attr: [OctaviaHealthManagerPuppetBase, role_data, logging_groups]} step_config: &step_config get_attr: [OctaviaHealthManagerPuppetBase, role_data, step_config] service_config_settings: {get_attr: [OctaviaHealthManagerPuppetBase, role_data, service_config_settings]} @@ -115,3 +120,8 @@ outputs: - name: Stop and disable octavia_health_manager service tags: step2 service: name=openstack-octavia-health-manager state=stopped enabled=no + - name: Remove openstack-octavia-health-manager package if operator requests it + yum: name=openstack-octavia-health-manager state=removed + tags: step2 + ignore_errors: True + when: {get_param: UpgradeRemoveUnusedPackages} diff --git a/docker/services/octavia-housekeeping.yaml b/docker/services/octavia-housekeeping.yaml index 1dc0db37..64e4f480 100644 --- a/docker/services/octavia-housekeeping.yaml +++ b/docker/services/octavia-housekeeping.yaml @@ -37,7 +37,6 @@ parameters: description: Parameters specific to the role type: json - resources: ContainersCommon: @@ -59,6 +58,8 @@ outputs: value: service_name: {get_attr: [OctaviaHousekeepingPuppetBase, role_data, service_name]} config_settings: {get_attr: [OctaviaHousekeepingPuppetBase, role_data, config_settings]} + logging_source: {get_attr: [OctaviaHousekeepingPuppetBase, role_data, logging_source]} + logging_groups: {get_attr: [OctaviaHousekeepingPuppetBase, role_data, logging_groups]} step_config: &step_config get_attr: [OctaviaHousekeepingPuppetBase, role_data, step_config] service_config_settings: {get_attr: [OctaviaHousekeepingPuppetBase, role_data, service_config_settings]} diff --git a/docker/services/octavia-worker.yaml b/docker/services/octavia-worker.yaml index d29e1a3a..e00f6bb8 100644 --- a/docker/services/octavia-worker.yaml +++ b/docker/services/octavia-worker.yaml @@ -37,7 +37,6 @@ parameters: description: Parameters specific to the role type: json - resources: ContainersCommon: @@ -59,6 +58,8 @@ outputs: value: service_name: {get_attr: [OctaviaWorkerPuppetBase, role_data, service_name]} config_settings: {get_attr: [OctaviaWorkerPuppetBase, role_data, config_settings]} + logging_source: {get_attr: [OctaviaWorkerPuppetBase, role_data, logging_source]} + logging_groups: {get_attr: [OctaviaWorkerPuppetBase, role_data, logging_groups]} step_config: &step_config get_attr: [OctaviaWorkerPuppetBase, role_data, step_config] service_config_settings: {get_attr: [OctaviaWorkerPuppetBase, role_data, service_config_settings]} diff --git a/docker/services/opendaylight-api.yaml b/docker/services/opendaylight-api.yaml index 2a6fcfe8..dbe49e9b 100644 --- a/docker/services/opendaylight-api.yaml +++ b/docker/services/opendaylight-api.yaml @@ -60,6 +60,8 @@ outputs: config_settings: map_merge: - get_attr: [OpenDaylightBase, role_data, config_settings] + logging_source: {get_attr: [OpenDaylightBase, role_data, logging_source]} + logging_groups: {get_attr: [OpenDaylightBase, role_data, logging_groups]} step_config: &step_config get_attr: [OpenDaylightBase, role_data, step_config] # BEGIN DOCKER SETTINGS diff --git a/docker/services/ovn-controller.yaml b/docker/services/ovn-controller.yaml index c5c365e2..285d14bb 100644 --- a/docker/services/ovn-controller.yaml +++ b/docker/services/ovn-controller.yaml @@ -60,6 +60,8 @@ outputs: config_settings: map_merge: - get_attr: [OvnControllerBase, role_data, config_settings] + logging_source: {get_attr: [OvnControllerBase, role_data, logging_source]} + logging_groups: {get_attr: [OvnControllerBase, role_data, logging_groups]} step_config: &step_config get_attr: [OvnControllerBase, role_data, step_config] service_config_settings: {get_attr: [OvnControllerBase, role_data, service_config_settings]} diff --git a/docker/services/ovn-dbs.yaml b/docker/services/ovn-dbs.yaml index f6ac62ed..977f95fb 100644 --- a/docker/services/ovn-dbs.yaml +++ b/docker/services/ovn-dbs.yaml @@ -63,6 +63,8 @@ outputs: config_settings: map_merge: - get_attr: [OVNDbsBase, role_data, config_settings] + logging_source: {get_attr: [OVNDbsBase, role_data, logging_source]} + logging_groups: {get_attr: [OVNDbsBase, role_data, logging_groups]} step_config: &step_config get_attr: [OVNDbsBase, role_data, step_config] # BEGIN DOCKER SETTINGS diff --git a/docker/services/pacemaker/cinder-backup.yaml b/docker/services/pacemaker/cinder-backup.yaml index cdb8c1bc..4a99184f 100644 --- a/docker/services/pacemaker/cinder-backup.yaml +++ b/docker/services/pacemaker/cinder-backup.yaml @@ -85,6 +85,8 @@ outputs: - 'pcmklatest' cinder::backup::manage_service: false cinder::backup::enabled: false + logging_source: {get_attr: [CinderBackupBase, role_data, logging_source]} + logging_groups: {get_attr: [CinderBackupBase, role_data, logging_groups]} step_config: "" service_config_settings: {get_attr: [CinderBackupBase, role_data, service_config_settings]} # BEGIN DOCKER SETTINGS @@ -205,3 +207,33 @@ outputs: - name: Disable cinder_backup service tags: step2 service: name=openstack-cinder-backup enabled=no + update_tasks: + - name: Get docker Cinder-Backup image + set_fact: + docker_image: {get_param: DockerCinderBackupImage} + docker_image_latest: *cinder_backup_image_pcmklatest + when: step == '2' + - name: Pull latest Cinder-Backup images + command: "docker pull {{docker_image}}" + when: step == "2" + - name: Get previous Cinder-Backup image id + shell: "docker images | awk '/cinder-backup.* pcmklatest/{print $3}'" + register: cinder_backup_image_id + - block: + - name: Get a list of container using Cinder-Backup image + shell: "docker ps -q -f 'ancestor={{cinder_backup_image_id.stdout}}'" + register: cinder_backup_containers_to_destroy + # It will be recreated with the delpoy step. + - name: Remove any container using the same Cinder-Backup image + shell: "docker rm -fv {{item}}" + with_items: "{{ cinder_backup_containers_to_destroy.stdout_lines }}" + - name: Remove previous Cinder-Backup images + shell: "docker rmi -f {{cinder_backup_image_id.stdout}}" + when: + - step == '2' + - cinder_backup_image_id.stdout != '' + - name: Retag pcmklatest to latest Cinder-Backup image + shell: "docker tag {{docker_image}} {{docker_image_latest}}" + when: step == "2" + # Got to check that pacemaker_is_active is working fine with bundle. + # TODO: pacemaker_is_active resource doesn't support bundle. diff --git a/docker/services/pacemaker/cinder-volume.yaml b/docker/services/pacemaker/cinder-volume.yaml index 15c5e099..ce93e5f1 100644 --- a/docker/services/pacemaker/cinder-volume.yaml +++ b/docker/services/pacemaker/cinder-volume.yaml @@ -79,6 +79,8 @@ outputs: cinder::volume::manage_service: false cinder::volume::enabled: false cinder::host: hostgroup + logging_source: {get_attr: [CinderBase, role_data, logging_source]} + logging_groups: {get_attr: [CinderBase, role_data, logging_groups]} step_config: "" service_config_settings: {get_attr: [CinderBase, role_data, service_config_settings]} # BEGIN DOCKER SETTINGS @@ -223,6 +225,33 @@ outputs: - name: Disable cinder_volume service from boot tags: step2 service: name=openstack-cinder-volume enabled=no - - - + update_tasks: + - name: Get docker Cinder-Volume image + set_fact: + docker_image: {get_param: DockerCinderVolumeImage} + docker_image_latest: *cinder_volume_image_pcmklatest + when: step == '2' + - name: Get previous Cinder-Volume image id + shell: "docker images | awk '/cinder-volume.* pcmklatest/{print $3}'" + register: cinder_volume_image_id + - block: + - name: Get a list of container using Cinder-Volume image + shell: "docker ps -q -f 'ancestor={{cinder_volume_image_id.stdout}}'" + register: cinder_volume_containers_to_destroy + # It will be recreated with the delpoy step. + - name: Remove any container using the same Cinder-Volume image + shell: "docker rm -fv {{item}}" + with_items: "{{ cinder_volume_containers_to_destroy.stdout_lines }}" + - name: Remove previous Cinder-Volume images + shell: "docker rmi -f {{cinder_volume_image_id.stdout}}" + when: + - step == '2' + - cinder_volume_image_id.stdout != '' + - name: Pull latest Cinder-Volume images + command: "docker pull {{docker_image}}" + when: step == "2" + - name: Retag pcmklatest to latest Cinder-Volume image + shell: "docker tag {{docker_image}} {{docker_image_latest}}" + when: step == "2" + # Got to check that pacemaker_is_active is working fine with bundle. + # TODO: pacemaker_is_active resource doesn't support bundle. diff --git a/docker/services/pacemaker/clustercheck.yaml b/docker/services/pacemaker/clustercheck.yaml index c7c316a4..b5d128d4 100644 --- a/docker/services/pacemaker/clustercheck.yaml +++ b/docker/services/pacemaker/clustercheck.yaml @@ -60,6 +60,8 @@ outputs: value: service_name: clustercheck config_settings: {get_attr: [MysqlPuppetBase, role_data, config_settings]} + logging_source: {get_attr: [MysqlPuppetBase, role_data, logging_source]} + logging_groups: {get_attr: [MysqlPuppetBase, role_data, logging_groups]} step_config: "include ::tripleo::profile::pacemaker::clustercheck" # BEGIN DOCKER SETTINGS # puppet_config: @@ -93,3 +95,5 @@ outputs: - KOLLA_CONFIG_STRATEGY=COPY_ALWAYS host_prep_tasks: upgrade_tasks: + update_tasks: + # Nothing: It's not managed by pacemaker, so let paunch do it. diff --git a/docker/services/pacemaker/database/mysql.yaml b/docker/services/pacemaker/database/mysql.yaml index 9dace271..a65117fc 100644 --- a/docker/services/pacemaker/database/mysql.yaml +++ b/docker/services/pacemaker/database/mysql.yaml @@ -97,6 +97,12 @@ outputs: - 4567 - 4568 - 9200 + tripleo::profile::pacemaker::database::mysql_bundle::bind_address: + str_replace: + template: + "%{hiera('fqdn_$NETWORK')}" + params: + $NETWORK: {get_param: [ServiceNetMap, MysqlNetwork]} - if: - internal_tls_enabled @@ -104,6 +110,8 @@ outputs: tripleo::profile::pacemaker::database::mysql_bundle::ca_file: get_param: InternalTLSCAFile - {} + logging_source: {get_attr: [MysqlPuppetBase, role_data, logging_source]} + logging_groups: {get_attr: [MysqlPuppetBase, role_data, logging_groups]} step_config: "" # BEGIN DOCKER SETTINGS # puppet_config: @@ -305,3 +313,33 @@ outputs: - name: Restart xinetd service after clustercheck removal tags: step2 service: name=xinetd state=restarted + update_tasks: + - name: Get docker Mariadb image + set_fact: + docker_image: {get_param: DockerMysqlImage} + docker_image_latest: *mysql_image_pcmklatest + when: step == '2' + - name: Get previous Mariadb image id + shell: "docker images | awk '/mariadb.* pcmklatest/{print $3}'" + register: mariadb_image_id + - block: + - name: Get a list of container using Mariadb image + shell: "docker ps -q -f 'ancestor={{mariadb_image_id.stdout}}'" + register: mariadb_containers_to_destroy + # It will be recreated with the delpoy step. + - name: Remove any container using the same Mariadb image + shell: "docker rm -fv {{item}}" + with_items: "{{ mariadb_containers_to_destroy.stdout_lines }}" + - name: Remove previous Mariadb images + shell: "docker rmi -f {{mariadb_image_id.stdout}}" + when: + - step == '2' + - mariadb_image_id.stdout != '' + - name: Pull latest Mariadb images + command: "docker pull {{docker_image}}" + when: step == "2" + - name: Retag pcmklatest to latest Mariadb image + shell: "docker tag {{docker_image}} {{docker_image_latest}}" + when: step == "2" + # Got to check that pacemaker_is_active is working fine with bundle. + # TODO: pacemaker_is_active resource doesn't support bundle. diff --git a/docker/services/pacemaker/database/redis.yaml b/docker/services/pacemaker/database/redis.yaml index 4d26a084..fe69bb00 100644 --- a/docker/services/pacemaker/database/redis.yaml +++ b/docker/services/pacemaker/database/redis.yaml @@ -86,6 +86,8 @@ outputs: - 26379 tripleo::stunnel::manage_service: false tripleo::stunnel::foreground: 'yes' + logging_source: {get_attr: [RedisBase, role_data, logging_source]} + logging_groups: {get_attr: [RedisBase, role_data, logging_groups]} step_config: "" service_config_settings: {get_attr: [RedisBase, role_data, service_config_settings]} # BEGIN DOCKER SETTINGS @@ -253,3 +255,33 @@ outputs: - name: Disable redis service tags: step2 service: name=redis enabled=no + update_tasks: + - name: Get docker Redis image + set_fact: + docker_image: {get_param: DockerRedisImage} + docker_image_latest: *redis_image_pcmklatest + when: step == '2' + - name: Get previous Redis image id + shell: "docker images | awk '/redis.* pcmklatest/{print $3}'" + register: redis_image_id + - block: + - name: Get a list of container using Redis image + shell: "docker ps -q -f 'ancestor={{redis_image_id.stdout}}'" + register: redis_containers_to_destroy + # It will be recreated with the delpoy step. + - name: Remove any container using the same Redis image + shell: "docker rm -fv {{item}}" + with_items: "{{ redis_containers_to_destroy.stdout_lines }}" + - name: Remove previous Redis images + shell: "docker rmi -f {{redis_image_id.stdout}}" + when: + - step == '2' + - redis_image_id.stdout != '' + - name: Pull latest Redis images + command: "docker pull {{docker_image}}" + when: step == "2" + - name: Retag pcmklatest to latest Redis image + shell: "docker tag {{docker_image}} {{docker_image_latest}}" + when: step == "2" + # Got to check that pacemaker_is_active is working fine with bundle. + # TODO: pacemaker_is_active resource doesn't support bundle. diff --git a/docker/services/pacemaker/haproxy.yaml b/docker/services/pacemaker/haproxy.yaml index 2cc04e96..f1c8f905 100644 --- a/docker/services/pacemaker/haproxy.yaml +++ b/docker/services/pacemaker/haproxy.yaml @@ -99,6 +99,8 @@ outputs: data: {get_param: DockerHAProxyImage} expression: $.data.rightSplit(separator => ":", maxSplits => 1)[0] - 'pcmklatest' + logging_source: {get_attr: [HAProxyBase, role_data, logging_source]} + logging_groups: {get_attr: [HAProxyBase, role_data, logging_groups]} step_config: "" service_config_settings: {get_attr: [HAProxyBase, role_data, service_config_settings]} # BEGIN DOCKER SETTINGS @@ -251,3 +253,33 @@ outputs: retries: 5 until: output.rc == 0 when: is_bootstrap_node and haproxy_res|succeeded + update_tasks: + - name: Get docker Haproxy image + set_fact: + docker_image: {get_param: DockerHAProxyImage} + docker_image_latest: *haproxy_image_pcmklatest + when: step == '2' + - name: Get previous Haproxy image id + shell: "docker images | awk '/haproxy.* pcmklatest/{print $3}'" + register: haproxy_image_id + - block: + - name: Get a list of container using Haproxy image + shell: "docker ps -q -f 'ancestor={{haproxy_image_id.stdout}}'" + register: haproxy_containers_to_destroy + # It will be recreated with the delpoy step. + - name: Remove any container using the same Haproxy image + shell: "docker rm -fv {{item}}" + with_items: "{{ haproxy_containers_to_destroy.stdout_lines }}" + - name: Remove previous Haproxy images + shell: "docker rmi -f {{haproxy_image_id.stdout}}" + when: + - step == '2' + - haproxy_image_id.stdout != '' + - name: Pull latest Haproxy images + command: "docker pull {{docker_image}}" + when: step == "2" + - name: Retag pcmklatest to latest Haproxy image + shell: "docker tag {{docker_image}} {{docker_image_latest}}" + when: step == "2" + # Got to check that pacemaker_is_active is working fine with bundle. + # TODO: pacemaker_is_active resource doesn't support bundle. diff --git a/docker/services/pacemaker/manila-share.yaml b/docker/services/pacemaker/manila-share.yaml index 805f101c..55f66b9b 100644 --- a/docker/services/pacemaker/manila-share.yaml +++ b/docker/services/pacemaker/manila-share.yaml @@ -69,6 +69,8 @@ outputs: manila::share::manage_service: false manila::share::enabled: false manila::host: hostgroup + logging_source: {get_attr: [ManilaBase, role_data, logging_source]} + logging_groups: {get_attr: [ManilaBase, role_data, logging_groups]} step_config: "" service_config_settings: {get_attr: [ManilaBase, role_data, service_config_settings]} # BEGIN DOCKER SETTINGS @@ -164,3 +166,33 @@ outputs: - name: Stop and disable manila_share service tags: step2 service: name=openstack-manila-share state=stopped enabled=no + update_tasks: + - name: Get docker Manila-Share image + set_fact: + docker_image: {get_param: DockerManilaShareImage} + docker_image_latest: *manila_share_image_pcmklatest + when: step == '2' + - name: Get previous Manila-Share image id + shell: "docker images | awk '/manila-share.* pcmklatest/{print $3}'" + register: manila_share_image_id + - block: + - name: Get a list of container using Manila-Share image + shell: "docker ps -q -f 'ancestor={{manila_share_image_id.stdout}}'" + register: manila-share_containers_to_destroy + # It will be recreated with the delpoy step. + - name: Remove any container using the same Manila-Share image + shell: "docker rm -fv {{item}}" + with_items: "{{ manila_share_containers_to_destroy.stdout_lines }}" + - name: Remove previous Manila-Share images + shell: "docker rmi -f {{manila_share_image_id.stdout}}" + when: + - step == '2' + - manila_share_image_id.stdout != '' + - name: Pull latest Manila-Share images + command: "docker pull {{docker_image}}" + when: step == "2" + - name: Retag pcmklatest to latest Manila-Share image + shell: "docker tag {{docker_image}} {{docker_image_latest}}" + when: step == "2" + # Got to check that pacemaker_is_active is working fine with bundle. + # TODO: pacemaker_is_active resource doesn't support bundle. diff --git a/docker/services/pacemaker/ovn-dbs.yaml b/docker/services/pacemaker/ovn-dbs.yaml index 03c5a397..1658b093 100644 --- a/docker/services/pacemaker/ovn-dbs.yaml +++ b/docker/services/pacemaker/ovn-dbs.yaml @@ -73,6 +73,8 @@ outputs: - tripleo::profile::pacemaker::ovn_dbs_bundle::ovn_dbs_docker_image: {get_param: DockerOvnDbsImage} - tripleo::profile::pacemaker::ovn_dbs_bundle::nb_db_port: {get_param: OVNNorthboundServerPort} - tripleo::profile::pacemaker::ovn_dbs_bundle::sb_db_port: {get_param: OVNSouthboundServerPort} + logging_source: {get_attr: [OVNDbsBase, role_data, logging_source]} + logging_groups: {get_attr: [OVNDbsBase, role_data, logging_groups]} step_config: '' service_config_settings: {get_attr: [OVNDbsBase, role_data, service_config_settings]} # BEGIN DOCKER SETTINGS diff --git a/docker/services/pacemaker/rabbitmq.yaml b/docker/services/pacemaker/rabbitmq.yaml index 7333689c..f17747c0 100644 --- a/docker/services/pacemaker/rabbitmq.yaml +++ b/docker/services/pacemaker/rabbitmq.yaml @@ -77,6 +77,8 @@ outputs: - 4369 - 5672 - 25672 + logging_source: {get_attr: [RabbitmqBase, role_data, logging_source]} + logging_groups: {get_attr: [RabbitmqBase, role_data, logging_groups]} step_config: &step_config get_attr: [RabbitmqBase, role_data, step_config] service_config_settings: {get_attr: [RabbitmqBase, role_data, service_config_settings]} @@ -246,3 +248,33 @@ outputs: - name: Disable rabbitmq service tags: step2 service: name=rabbitmq-server enabled=no + update_tasks: + - name: Get docker Rabbitmq image + set_fact: + docker_image: {get_param: DockerRabbitmqImage} + docker_image_latest: *rabbitmq_image_pcmklatest + when: step == '2' + - name: Get previous Rabbitmq image id + shell: "docker images | awk '/rabbitmq.* pcmklatest/{print $3}'" + register: rabbitmq_image_id + - block: + - name: Get a list of container using Rabbitmq image + shell: "docker ps -q -f 'ancestor={{rabbitmq_image_id.stdout}}'" + register: rabbitmq_containers_to_destroy + # It will be recreated with the delpoy step. + - name: Remove any container using the same Rabbitmq image + shell: "docker rm -fv {{item}}" + with_items: "{{ rabbitmq_containers_to_destroy.stdout_lines }}" + - name: Remove previous Rabbitmq images + shell: "docker rmi -f {{rabbitmq_image_id.stdout}}" + when: + - step == '2' + - rabbitmq_image_id.stdout != '' + - name: Pull latest Rabbitmq images + command: "docker pull {{docker_image}}" + when: step == "2" + - name: Retag pcmklatest to latest Rabbitmq image + shell: "docker tag {{docker_image}} {{docker_image_latest}}" + when: step == "2" + # Got to check that pacemaker_is_active is working fine with bundle. + # TODO: pacemaker_is_active resource doesn't support bundle. diff --git a/docker/services/panko-api.yaml b/docker/services/panko-api.yaml index 3edd9049..7987c8dc 100644 --- a/docker/services/panko-api.yaml +++ b/docker/services/panko-api.yaml @@ -73,6 +73,8 @@ outputs: map_merge: - get_attr: [PankoApiPuppetBase, role_data, config_settings] - apache::default_vhost: false + logging_source: {get_attr: [PankoApiPuppetBase, role_data, logging_source]} + logging_groups: {get_attr: [PankoApiPuppetBase, role_data, logging_groups]} step_config: &step_config list_join: - "\n" diff --git a/docker/services/rabbitmq.yaml b/docker/services/rabbitmq.yaml index add78879..237995b9 100644 --- a/docker/services/rabbitmq.yaml +++ b/docker/services/rabbitmq.yaml @@ -82,6 +82,8 @@ outputs: - internal_tls_enabled - tripleo::certmonger::rabbitmq::postsave_cmd: "true" # TODO: restart the rabbitmq container here - {} + logging_source: {get_attr: [RabbitmqBase, role_data, logging_source]} + logging_groups: {get_attr: [RabbitmqBase, role_data, logging_groups]} step_config: &step_config list_join: - "\n" @@ -218,3 +220,9 @@ outputs: - name: Stop and disable rabbitmq service tags: step2 service: name=rabbitmq-server state=stopped enabled=no + update_tasks: + # TODO: Are we sure we want to support this. Rolling update + # without pacemaker may fail. Do we test this ? In any case, + # this is under paunch control so the latest image should be + # pulled in by the deploy steps. Same question for other + # usually managed by pacemaker container. diff --git a/docker/services/sahara-api.yaml b/docker/services/sahara-api.yaml index b0c3736c..cf7eae85 100644 --- a/docker/services/sahara-api.yaml +++ b/docker/services/sahara-api.yaml @@ -36,6 +36,10 @@ parameters: default: {} description: Parameters specific to the role type: json + UpgradeRemoveUnusedPackages: + default: false + description: Remove package if the service is being disabled during upgrade + type: boolean resources: @@ -62,6 +66,8 @@ outputs: map_merge: - get_attr: [SaharaApiPuppetBase, role_data, config_settings] - sahara::sync_db: false + logging_source: {get_attr: [SaharaApiPuppetBase, role_data, logging_source]} + logging_groups: {get_attr: [SaharaApiPuppetBase, role_data, logging_groups]} step_config: &step_config list_join: - "\n" @@ -136,3 +142,8 @@ outputs: - name: Stop and disable sahara_api service tags: step2 service: name=openstack-sahara-api state=stopped enabled=no + - name: Remove openstack-sahara-api package if operator requests it + yum: name=openstack-sahara-api state=removed + tags: step2 + ignore_errors: True + when: {get_param: UpgradeRemoveUnusedPackages} diff --git a/docker/services/sahara-engine.yaml b/docker/services/sahara-engine.yaml index b1660296..0a061bd3 100644 --- a/docker/services/sahara-engine.yaml +++ b/docker/services/sahara-engine.yaml @@ -36,6 +36,10 @@ parameters: default: {} description: Parameters specific to the role type: json + UpgradeRemoveUnusedPackages: + default: false + description: Remove package if the service is being disabled during upgrade + type: boolean resources: @@ -62,6 +66,8 @@ outputs: map_merge: - get_attr: [SaharaEnginePuppetBase, role_data, config_settings] - sahara::sync_db: false + logging_source: {get_attr: [SaharaEnginePuppetBase, role_data, logging_source]} + logging_groups: {get_attr: [SaharaEnginePuppetBase, role_data, logging_groups]} step_config: &step_config list_join: - "\n" @@ -119,3 +125,8 @@ outputs: - name: Stop and disable sahara_engine service tags: step2 service: name=openstack-sahara-engine state=stopped enabled=no + - name: Remove openstack-sahara-engine package if operator requests it + yum: name=openstack-sahara-engine state=removed + tags: step2 + ignore_errors: True + when: {get_param: UpgradeRemoveUnusedPackages} diff --git a/docker/services/sensu-client.yaml b/docker/services/sensu-client.yaml index b64231cd..a535af46 100644 --- a/docker/services/sensu-client.yaml +++ b/docker/services/sensu-client.yaml @@ -39,13 +39,17 @@ parameters: SensuDockerCheckCommand: type: string default: | + output='' for i in $(docker ps --format '{{.ID}}'); do if result=$(docker inspect --format='{{.State.Health.Status}}' $i 2>/dev/null); then if [ "$result" != 'healthy' ]; then - echo "$(docker inspect --format='{{.Name}}' $i) ($i): $(docker inspect --format='{{json .State}}' $i)" && exit 2; + output="${output} ; $(docker inspect --format='{{.Name}}' $i) ($i): $(docker inspect --format='{{(index .State.Health.Log 0).Output}}' $i)"; fi fi done + if [ ! -z "${output}" ]; then + echo ${output:3} && exit 2; + fi SensuDockerCheckInterval: type: number description: The frequency in seconds the docker health check is executed. diff --git a/docker/services/sshd.yaml b/docker/services/sshd.yaml new file mode 100644 index 00000000..6f57f13d --- /dev/null +++ b/docker/services/sshd.yaml @@ -0,0 +1,72 @@ +heat_template_version: pike + +description: > + Configure sshd_config + +parameters: + ServiceData: + default: {} + description: Dictionary packing service data + type: json + ServiceNetMap: + default: {} + description: Mapping of service_name -> network name. Typically set + via parameter_defaults in the resource registry. This + mapping overrides those in ServiceNetMapDefaults. + type: json + DefaultPasswords: + default: {} + type: json + RoleName: + default: '' + description: Role name on which the service is applied + type: string + RoleParameters: + default: {} + description: Parameters specific to the role + type: json + EndpointMap: + default: {} + description: Mapping of service endpoint -> protocol. Typically set + via parameter_defaults in the resource registry. + type: json + MigrationSshPort: + default: 2022 + description: Target port for migration over ssh + type: number + +conditions: + + # During Ocata->Pike upgrade initially configure the ssh service on port 22 + # to proxy migration commands to the containerized sshd on port 2022. + # When the upgrade converges we can switch migrations over to port 2022. + enable_migration_proxy: + equals: + - {get_param: MigrationSshPort} + - 22 + +resources: + SshdBase: + type: ../../puppet/services/sshd.yaml + properties: + EndpointMap: {get_param: EndpointMap} + ServiceNetMap: {get_param: ServiceNetMap} + DefaultPasswords: {get_param: DefaultPasswords} + RoleName: {get_param: RoleName} + RoleParameters: {get_param: RoleParameters} + +outputs: + role_data: + description: Role data for the ssh + value: + service_name: sshd + config_settings: {get_attr: [SshdBase, role_data, config_settings]} + step_config: + list_join: + - "\n" + - - get_attr: [SshdBase, role_data, step_config] + - if: + - enable_migration_proxy + - | + include tripleo::profile::base::nova::migration::proxy + - '' diff --git a/docker/services/swift-proxy.yaml b/docker/services/swift-proxy.yaml index 86871210..3a27ab85 100644 --- a/docker/services/swift-proxy.yaml +++ b/docker/services/swift-proxy.yaml @@ -39,6 +39,10 @@ parameters: EnableInternalTLS: type: boolean default: false + UpgradeRemoveUnusedPackages: + default: false + description: Remove package if the service is being disabled during upgrade + type: boolean conditions: @@ -67,6 +71,8 @@ outputs: config_settings: {get_attr: [SwiftProxyBase, role_data, config_settings]} step_config: &step_config get_attr: [SwiftProxyBase, role_data, step_config] + logging_source: {get_attr: [SwiftProxyBase, role_data, logging_source]} + logging_groups: {get_attr: [SwiftProxyBase, role_data, logging_groups]} service_config_settings: {get_attr: [SwiftProxyBase, role_data, service_config_settings]} # BEGIN DOCKER SETTINGS puppet_config: @@ -145,5 +151,10 @@ outputs: - name: Stop and disable swift_proxy service tags: step2 service: name=openstack-swift-proxy state=stopped enabled=no + - name: Remove openstack-swift-proxy package if operator requests it + yum: name=openstack-swift-proxy state=removed + tags: step2 + ignore_errors: True + when: {get_param: UpgradeRemoveUnusedPackages} metadata_settings: get_attr: [SwiftProxyBase, role_data, metadata_settings] diff --git a/docker/services/swift-ringbuilder.yaml b/docker/services/swift-ringbuilder.yaml index 2a44f703..bfb57edd 100644 --- a/docker/services/swift-ringbuilder.yaml +++ b/docker/services/swift-ringbuilder.yaml @@ -91,6 +91,8 @@ outputs: map_merge: - {get_attr: [SwiftRingbuilderBase, role_data, config_settings]} - tripleo::profile::base::swift::ringbuilder:skip_consistency_check: true + logging_source: {get_attr: [SwiftRingbuilderBase, role_data, logging_source]} + logging_groups: {get_attr: [SwiftRingbuilderBase, role_data, logging_groups]} step_config: &step_config get_attr: [SwiftRingbuilderBase, role_data, step_config] service_config_settings: {get_attr: [SwiftRingbuilderBase, role_data, service_config_settings]} diff --git a/docker/services/swift-storage.yaml b/docker/services/swift-storage.yaml index e879b25d..e0c1194a 100644 --- a/docker/services/swift-storage.yaml +++ b/docker/services/swift-storage.yaml @@ -50,7 +50,10 @@ parameters: default: {} description: 'A hash of additional raw devices to use as Swift backend (eg. {sdb: {}})' type: json - + UpgradeRemoveUnusedPackages: + default: false + description: Remove package if the service is being disabled during upgrade + type: boolean resources: @@ -77,6 +80,8 @@ outputs: - {get_attr: [SwiftStorageBase, role_data, config_settings]} # FIXME (cschwede): re-enable this once checks works inside containers - swift::storage::all::mount_check: false + logging_source: {get_attr: [SwiftStorageBase, role_data, logging_source]} + logging_groups: {get_attr: [SwiftStorageBase, role_data, logging_groups]} step_config: &step_config get_attr: [SwiftStorageBase, role_data, step_config] service_config_settings: {get_attr: [SwiftStorageBase, role_data, service_config_settings]} @@ -466,3 +471,12 @@ outputs: - openstack-swift-object-replicator - openstack-swift-object-updater - openstack-swift-object + - name: Remove openstack-swift-container,object,account packages if operator requests it + yum: name={{ item }} state=removed + tags: step2 + ignore_errors: True + when: {get_param: UpgradeRemoveUnusedPackages} + with_items: + - openstack-swift-container + - openstack-swift-object + - openstack-swift-account diff --git a/docker/services/tacker.yaml b/docker/services/tacker.yaml index 1b7d78ca..9bd5de26 100644 --- a/docker/services/tacker.yaml +++ b/docker/services/tacker.yaml @@ -63,6 +63,8 @@ outputs: config_settings: map_merge: - get_attr: [TackerBase, role_data, config_settings] + logging_source: {get_attr: [TackerBase, role_data, logging_source]} + logging_groups: {get_attr: [TackerBase, role_data, logging_groups]} step_config: &step_config list_join: - "\n" diff --git a/docker/services/zaqar.yaml b/docker/services/zaqar.yaml index ab30ab5a..ff40cb1a 100644 --- a/docker/services/zaqar.yaml +++ b/docker/services/zaqar.yaml @@ -73,6 +73,8 @@ outputs: value: service_name: {get_attr: [ZaqarBase, role_data, service_name]} config_settings: {get_attr: [ZaqarBase, role_data, config_settings]} + logging_source: {get_attr: [ZaqarBase, role_data, logging_source]} + logging_groups: {get_attr: [ZaqarBase, role_data, logging_groups]} step_config: &step_config list_join: - "\n" |