aboutsummaryrefslogtreecommitdiffstats
AgeCommit message (Collapse)AuthorFilesLines
2016-10-13Merge "Add flag for internal TLS"Jenkins2-0/+6
2016-10-13Merge "Add HAProxy TLS handled by certmonger as composable service"Jenkins7-10/+183
2016-10-13Merge "Disable IPv6 RAs & Autoconf For All (Not Just Default)"Jenkins1-0/+4
2016-10-13Merge "Remove duplicate metadata keys from nova-api.yaml"Jenkins1-2/+0
2016-10-12Merge "Special case non-matching ObjectStorage role port names"Jenkins1-1/+10
2016-10-12Disable IPv6 RAs & Autoconf For All (Not Just Default)Dan Sneddon1-0/+4
The current kernel sysctl settings modify the net.ipv6.conf.default.accept_ra and net.ipv6.conf.default.autoconf to both be '0'. However, this is overridden by the settings in net.ipv6.conf.all, so no matter what setting is in the ifcfg file for the IPv6 interface, autoconfiguration and accept_ra will be enabled. This causes a security vulnerability where rogue RAs could be used to intercept traffic from the controllers. This change sets both default and all settings to '0' for IPv6 accept_ra and autoconf. Closes-Bug: 1632830 Change-Id: I95b86c5c6feed30dfa5103ffbddb9e85ac567bbb
2016-10-12Merge "Allow Glance API and Registry to be split"Jenkins3-140/+197
2016-10-12Remove duplicate metadata keys from nova-api.yamlDan Prince1-2/+0
These keys are already specified in nova-metadata.yaml where they get set correctly per the network management local IP (based on 'service_name' list). Depends-On: I94f985e719a3bf7408655fbbb5ab1aeaf15e994e Change-Id: I5d57561b732783118efd2a637aa137f5f7bcddbc Partial-bug: #1631133
2016-10-12Merge "Add parameters to run nova over httpd"Jenkins1-0/+18
2016-10-12Special case non-matching ObjectStorage role port namesSteven Hardy1-1/+10
Unfortunately we use "SwiftStorage" in the ObjectStorage role template, so we have to special-case this for backwards compatibility or deployments enabling the ObjectStorage role will fail. Ideally we'd align the port names in the objectstorage-role.yaml, but we can't becauuse all the ports would be replaced in existing deployments on update. Change-Id: Ia07e193d2b9a4d33c6272c2b4448133584b81350 Closes-Bug: #1632663
2016-10-12Allow Glance API and Registry to be splitDan Prince3-140/+197
The glance-api and glance-registry services are currently coupled in that some of the hiera settings in the API are required for the registry to run correctly (the backend settings). This patch moves some of the common settings into glance-base and then updates the glance-api and glance-registry services to supply that service. Change-Id: Ie3d7e24c7fd475e3f6ad542c1654eb7dbd9d9b35 Closes-bug: #1628582
2016-10-12Merge "Set the notification driver for glance"Jenkins1-0/+1
2016-10-11Merge "Actually start the systemd services in step3 of the major-upgrade step"Jenkins1-1/+1
2016-10-10Merge "Remove unneeded *_enable_backend hiera from Manila backends"Jenkins6-15/+0
2016-10-10Actually start the systemd services in step3 of the major-upgrade stepMichele Baldessari1-1/+1
We have the following function in the upgrade process after we updated the packages and called the db-sync commands: services=$(services_to_migrate) ... for service in $(services); do manage_systemd_service start "${service%%-clone}" check_resource_systemd "${service%%-clone}" started 600 done The above is broken because $services contains a list of services to start, so $(services) will return gibberish and the for loop will never execute anything. One of the symptoms for this is the openstack-nova-compute service not restarting on the compute nodes during the yum -y upgrade. The reason for this is that during the service restart, nova-compute waits for nova-conductor to show up in the rabbitmq queues, which cannot happen since the service was actually never started. Change-Id: I811ff19d7b44a935b2ec5c5e66e5b5191b259eb3 Closes-Bug: #1630580
2016-10-10Set the notification driver for glancePradeep Kilambi1-0/+1
Need to set the right default notification driver for glance so telemetry receives them accordingly. Without this tempest tests fail. Closes-bug: #1631939 Change-Id: I1cee5467d077eea6142076925646f7d0cdae96c7
2016-10-10Merge "Add new environment for debug"Jenkins1-0/+5
2016-10-10Merge "Make step an integer on the pacemaker controller"Jenkins1-0/+3
2016-10-07Merge "Add cloud names to hosts output"Jenkins1-1/+30
2016-10-07Make step an integer on the pacemaker controllerDan Prince1-0/+3
This resolves the issue causing the 'step' hiera setting to get written as a string (thus causing puppet failures) on a pacemaker controller. Change-Id: I70037889e499846460357928f8637a35ac97bc7a Closes-bug: #1631488
2016-10-07Add new environment for debugWes Hayutin1-0/+5
Introduce a new environment template that enables the Debug parameter. By default the value is set to "true". Change-Id: Ieac59de42ffef6afa5d8f10ef1925c32c7dc8551
2016-10-07Merge "Renames OpenDaylight to OpenDaylightApi and splits out OVS configuration"Jenkins5-15/+5
2016-10-07Remove unneeded *_enable_backend hiera from Manila backendsGiulio Fidente6-15/+0
Depends-On: I04e28a95e8d69a24cd3df109bf1802bfcbd941db Change-Id: I4ada033155e5fde0add08ec9aa8f6af7c31d53f3
2016-10-07Merge "Ceilometer Wsgi Mitaka->Newton upgrades"Jenkins4-16/+173
2016-10-07Add cloud names to hosts outputJuan Antonio Osorio Robles1-1/+30
Closes-Bug: #1631277 Change-Id: I126b3ed2afdf03ffabb7e57f8792b9f7ecc06a09
2016-10-07Merge "Serialize AllNodesDeployment and UpdateWorkflow"Jenkins1-0/+4
2016-10-07Ceilometer Wsgi Mitaka->Newton upgradesPradeep Kilambi4-16/+173
In Newton, ceilometer api is changed to run under apache wsgi instead of eventlet. This will require upgrades for mitaka deployments to switch to wsgi. Closes-Bug: 1631297 Change-Id: If9d6987cd0a8fc5d3f9de518ba422d97d5149732
2016-10-07Serialize AllNodesDeployment and UpdateWorkflowSteven Hardy1-0/+4
Otherwise there may be a race between updating the hiera and running the UpdateWorkflow Change-Id: I22cd893e0db3df6d39504fbd61d7d9024cebb1c5 Related-Bug: 1631297
2016-10-07Merge "Specify the Ceph packages to be installed"Jenkins1-0/+6
2016-10-06Merge "Add Select per-network hostnames for service_node_names to ↵Jenkins1-0/+45
role.role.j2.yaml"
2016-10-06Specify the Ceph packages to be installedJohn Fulton1-0/+6
The puppet-ceph module defaults to 'ceph' but that is a metapacakge which isn't provided in all repos. Depends-On: I13462219522386f8740b0d70916a44f3474115e4 Change-Id: Ie55d22301dd22102d471e6002dfcaad4bfadd5f6 Related-Bug: 1629933
2016-10-06Enable firewalling by default on compute nodesEmilien Macchi5-8/+13
- Move VXLAN and VRRP rules from Neutron Server to the right services. - Enable Firewall by default on Compute nodes. Change-Id: I99d172dcedaf6be297aad184cc51fe9f292a57e1
2016-10-06Re-enable ManageFirewall by default.Dan Prince4-6/+6
This default setting got lots in the composable roles/services patches. Re-enable the ManageFirewall setting by default per what we did in git commit 73c76b867ddc8a23a30b9a3cac4031189d4178c6. We also fix a typo in neutron-api.yaml so that the firewall rules matches to service_name. (otherwise it won't get loaded). Also, drops the environments/manage-firewall.yaml which is no longer needed if we enable firewall management by default. Change-Id: Ie198e4efd190131d0722085b10ef77da9005bc1b Closes-bug: 1629934
2016-10-06Add Select per-network hostnames for service_node_names to role.role.j2.yamlCarlos Camacho1-0/+45
This will wire up the per-network hostnames in the generic role. Needs to land after https://review.openstack.org/#/c/378764 Partial-Bug: #1626976 Change-Id: I595f35cce03d9f416a1768aa5c349a1bb20b0e19
2016-10-06Merge "restore missing fluentd client functionality"Jenkins9-44/+26
2016-10-06Merge "Add generic template for custom roles."Jenkins2-0/+417
2016-10-06Merge "Set proper ceph config path for manila"Jenkins2-2/+2
2016-10-06Merge "Select per-network hostnames for service_node_names"Jenkins8-1/+271
2016-10-06Merge "Fix OpendaylightApiNetwork key naming"Jenkins1-1/+9
2016-10-06Add generic template for custom roles.Carlos Camacho2-0/+417
This submission creates a generic template file to deploy custom roles. Also adds a file to specify an exclusion role list in order to avoid not to generate the template for those roles. Partial-Bug: #1626976 Depends-On: I6d7247bbb8702eb0ab9bdf133b5ab1c6e8349d98 Change-Id: I3e11c089023b793a5063d9e1714527a3fe2b7458
2016-10-05Set proper ceph config path for manilaTom Barron2-2/+2
When deploying manila with cephfs backend, /etc/manila/manila.conf should define cephfs_conf_path = /etc/ceph/ceph.conf in the cephfs native backend since this is the conventional path that ceph operators expect and since we document that path upstream. Change-Id: I4abf5c33b675b1102413a84d64f4ce23b07b4485 Closes-Bug: 1630777
2016-10-05Merge "Open tripleo-heat-templates for Ocata"Jenkins0-0/+0
2016-10-05Merge "Adds Environment File for Removing Sahara during M/N upgrade"Jenkins5-4/+28
2016-10-05restore missing fluentd client functionalityLars Kellogg-Stedman9-44/+26
in the great rebase following the JINJA ALL THE THINGS changes we lost critical functionality in the fluentd client service. This review restores the missing features. Change-Id: I7c23f16f81e75f3da6a24587b2eb8385b3e920a4 Closes-bug: 1630692
2016-10-05Renames OpenDaylight to OpenDaylightApi and splits out OVS configurationTim Rozet5-15/+5
This patch modifies the service name to be more appropriately called "OpenDaylightApi" along side the "OpenDaylightOvs" service used to configure OpenVSwitch. It also splits out the OVS configuration for controller nodes into the composable OpenDaylightOvs service. Related-Bug: #1629408 Change-Id: I15221401acdfb2a9ef81107b54a8005348f8372f Signed-off-by: Tim Rozet <trozet@redhat.com>
2016-10-05Fix OpendaylightApiNetwork key namingSteven Hardy1-1/+9
This captialization won't work with the CamelCase to snake_case conversion we do, as the required name is opendaylight_api_network Adds some clarification to the ServiceNetMap description to hopefully avoid future confusion. Change-Id: Ife04ee2185e81009ebef55ad521aef799251e002 Closes-Bug: #1629408
2016-10-05Merge "Fixing resources path in OpenDaylight"Jenkins2-4/+4
2016-10-05Open tripleo-heat-templates for OcataJohn Trowbridge0-0/+0
To avoid pushing an artificial alpha tag, following PBR semver keyword bumps major version. See http://docs.openstack.org/developer/pbr/#version Change-Id: Ic47869c96217269806daac9c3c888603e4e5d00a Sem-Ver: api-break
2016-10-05Adds Environment File for Removing Sahara during M/N upgrademarios5-4/+28
The default path if the operator does nothing is to keep the sahara services on mitaka to newton upgrades. If the operator wishes to remove sahara services then they need to specify the provided major-upgrade-remove-sahara.yaml environment file in the stack upgrade commands. The existing migration to ha arch already removes the constraints and pcs resource for sahara api/engine so we just need to stop it from starting again if we want to remove it. This adds a KeepSaharaServiceOnUpgrade parameter to determine if Sahara is disabled from starting up after the controllers are upgraded (defaults true). Finally it is worth noting that we default the sahara services as 'on' during converge here in the resource_registry of the converge environment file; any subsequent stack updates where the deployment contains sahara services will need to include the -e /environments/services/sahara.yaml environment file. Related-Bug: 1630247 Change-Id: I59536cae3260e3df52589289b4f63e9ea0129407
2016-10-05Select per-network hostnames for service_node_namesSteven Hardy8-1/+271
Co-Authored-By: Juan Antonio Osorio Robles <jaosorior@redhat.com> Depends-On: Ic6fec1057439ed9122d44ef294be890d3ff8a8ee Change-Id: I754c4a41d8a294a4c7c18bd282ae014efd4b9b16 Closes-Bug: #1628521