aboutsummaryrefslogtreecommitdiffstats
AgeCommit message (Collapse)AuthorFilesLines
2016-04-20Merge "Increase galera sync timeout in yum_update.sh"Jenkins1-1/+1
2016-04-19Merge "Add ping_retry function"Jenkins1-5/+22
2016-04-19Merge "Make HeatWorkers param affect the engine workers"Jenkins1-0/+1
2016-04-18Merge "Reload haproxy after injecting certs w/o pcmk too"Jenkins1-0/+8
2016-04-18Fix ControllerExtraConfig parameter nameJiri Stransky2-5/+24
We've had a typo for a while that a parameter is named "controllerExtraConfig" with lowercase c, which can be quite confusing for users because the other similar parameters (e.g. NovaComputeExtraConfig) consistently start with an upper case letter. We'll support both variants from now on, marking the typoed variant as deprecated. Change-Id: Ic67a4297e7fa08308889b95ba35389a01f70f5a4
2016-04-15Enable client address in Horizon's logs.Dimitri Savineau4-0/+9
Horizon's backends (httpd) see IP address of the haproxy in the logs instead of the client address. This patch allows to: - Install the remoteip httpd module [1]. - Use the X-Forwarded-For HTTP header and override the haproxy address. - Configure the Horizon's logs with the client address via httpd logformat. [1] https://httpd.apache.org/docs/2.4/mod/mod_remoteip.html [2] https://httpd.apache.org/docs/2.4/mod/mod_log_config.html#logformat Change-Id: Ib2f215913065426848b48f6293f33a75aff3d328 Depends-On: I54f0f5549d64768dacca71539c71a28cc99d9d95
2016-04-15Merge "Make sure openstack services are dependent on openstack-core"Jenkins2-9/+63
2016-04-15Make HeatWorkers param affect the engine workersJuan Antonio Osorio Robles1-0/+1
With the addition of the num_engine_workers param in puppet-heat, we can now wire the HeatWorkers parameter to also set that value, as with the other workers. Change-Id: I169b648737f797ccd45d12b66705d111e7b95bb7 Depends-On: I53a4333ca16df516294c733f85546c0b0a6a0b88
2016-04-14Fix Neutron enable_*_agent* Hiera parametersEmilien Macchi1-1/+1
This change will fix a logic error when L3 agent was disabled, where a Pacemaker constraint (neutron-dhcp-agent-to-l3-agent-constraint) were still looking for l3_agent_service in the Puppet catalog, but could not because L3 agent was disabled. It was sending this Puppet error: Error: Could not find dependency Pacemaker::Resource::Service[neutron-l3-agent] for Pacemaker::Constraint::Base[neutron-dhcp-agent-to-l3-agent-constraint] Change-Id: I0e5d24d844810c58a3205303399d1c20773af3dd
2016-04-14Merge "Add GlanceRegistry to the endpoint map"Jenkins4-0/+47
2016-04-14Merge "Use a different ceph key for admin/client user"Jenkins1-1/+2
2016-04-14Add GlanceRegistry to the endpoint mapDan Prince4-0/+47
This patch adds GlanceRegistry to the endpoint map. This will make accessing Glance registry setings via the endpoint map possible. Change-Id: I9186e56cd4746a60e65dc5ac12e6595ac56505f0
2016-04-14Keep setting backend_host to 'hostgroup' for rbd backendsJiri Stransky2-0/+2
There are backwards incompatible patches [1][2] in puppet-cinder which break upgrade scenarios, but at this point they made it to liberty and mitaka, so workaround in t-h-t is easier than revert [1] https://review.openstack.org/#/c/209412/ [2] https://review.openstack.org/#/c/231068/ Change-Id: Ic82258bf0893ebd4e595e5df73ffbc4c6443f9e8 Closes-Bug: #1570265
2016-04-13Add ping_retry functionDan Prince1-5/+22
This patch cleans up the retry logic so that it is all consolidated in the same function. Change-Id: I003afe4963e2af8d55f11a4ae4867e563a22134f Related-bug: #1567011
2016-04-13Refactor HAproxy and VIP creation.Sofer Athlan-Guyot1-161/+24
This part in overcloud_controller_pacemaker.pp has a lot of duplicate code to define haproxy and vip creation. This is an attempt to refactor this. Change-Id: Icbd560de08999e48cfb54c6f3c94f8b96cddd6ba Depends-On: I4cc6711911c1bfa1bc6063979e2b2a7ab5b8d37b
2016-04-13Make sure openstack services are dependent on openstack-coreJiri Stransky2-9/+63
Previously ceilometer-notification, aodh-listener and sahara-engine didn't have constraints that would anchor them under openstack-core dummy resource. Such constraints are added now. (sahara-engine starting after sahara-api, aodh-listener after aodh-evaluator, and ceilometer-notification after openstack-core.) Openstack-core -> heat-api constraint has been removed because heat-api depends on ceilometer-notification, so there's a transitive dependency on openstack-core already. Change-Id: Ided7321ebbf2c3556726343b4bb466fd8759b43a Closes-Bug: #1569444
2016-04-12Add net-config-static.yamlJames Slagle1-0/+82
Add a new network config for configuring a static IP on a single interface. Similar to net-config-static-bridge.yaml, except that it does not create a bridge and add the specificed interface to that bridge. Where net-config-static-bridge.yaml would be used as the controller network config for the scenario of configuring a static IP, net-config-static.yaml would be used for the compute node when you want a static IP, but do not need a bridge. Change-Id: Ide3be3b90fcf5e4b6045be3128dfb5c812fbb2e8
2016-04-12Add missing ManagementIpSubnetJames Slagle1-0/+4
Change 15bb67261a333f140f21208e20a112b99eeb609c added the management network, but the ManagementIpSubnet parameter was missed being added net-config-static-bridge.yaml. This makes the template not work by default since Heat will error when the parameter is passed in as a property. This adds the parameter which fixes the template. Change-Id: Ie745103e596c9fe2d5562acfff157157be0ff0e2
2016-04-11Document IPv6 syntax for GlanceFilePcmkDeviceIan Pilcher1-0/+2
Change-Id: I1734a9755c4254221033cf2245ce9da8b2eeb924 Closes-Bug: 1568995
2016-04-11Always use parameter_defaults in environment filesJiri Stransky6-7/+7
In the environments/ subdirectory of tripleo-heat-templates, we mostly use parameter_defaults, but some of the environment files still use parameters. This can lead to confusing behavior with respect to parameter priority when passing environment files to deploy/update commands. Users might expect that subsequent environment files take priority over preceding ones, but that might not be the case if the preceding environment files use `parameters`, while the subsequent ones use `parameter_defaults`. This commit switches all `parameters:` uses in environments/ subdirectory to `parameter_defaults:`. Change-Id: Ie4c03c7e7f5a5004a0384d35817135f357e9719b Closes-Bug: #1567837
2016-04-11Deploy Gnocchi as a Ceilometer metrics storage backendPradeep Kilambi17-4/+382
* Deploy Gnocchi API. * Storage backends: swift, rbd and file. * Indexer backend default to mysql * Configure Ceilometer to send metrics datas to Gnocchi * Pacemaker config Depends-On: Ic8778a3104e0ed0460423e4bf857682220dc5802 Depends-On: I7d2eb9405e0171fc54fa0b616122f69db5f51ce2 Co-Authored-By: Pradeep Kilambi <pkilambi@redhat.com> Change-Id: Ifde17b1ab8fa2b30544633e455e1c7eb475705aa
2016-04-11Merge "composable keystone services"Jenkins8-280/+178
2016-04-11Fix distinguishing between stack-create and stack-updateJiri Stransky3-5/+8
Previously we tried to use UpdateIdentifier for two different things: tell whether to perform package update, and also to tell whether the top-level stack is being created or updated (which was incorrect and resulted in bug 1567384, and an attempt to work around that bug resulted in bug 1567385). We cannot use Heat's "action" conditionals in some cases, because they refer to the direct parent stack, which can yield undesirable results when introducing new nested stacks or temporarily no-opping something and then adding it back (in both these cases, "action" would be considered "CREATE", even though the top-level stack is in "UPDATE"). So tripleoclient passes a new parameter StackAction to tell whether the top-level stack is being created or updated, and we make use of that. (It seems there's no better way of getting this info from within the nested Heat stacks.) Change-Id: Ie14ddbff15e7ed21aaa3fcdacf36e0040f912382 Depends-On: I9dc3b4cd8a6a71df34d8babf0e4c6505041f5311 Closes-Bug: #1567384 Related-Bug: #1567385
2016-04-11Update .sh references from openstack-keystone to openstack-coreGiulio Fidente4-115/+8
The update and upgrade shell scripts were still referencing the old openstack-keystone service which got removed with Ie26908ac9bfc0b84b6b65ae3bda711236b03d9d4 Also removes kilo and liberty specific workarounds and config changes. Change-Id: Icc80904908ee3558930d4639a21812f14b2fd12e
2016-04-11Merge "Don't have separate protocols/ports for Keystone v3"Jenkins3-51/+32
2016-04-11Merge "Change /etc/hosts format and add domain"Jenkins5-60/+60
2016-04-11Don't have separate protocols/ports for Keystone v3Zane Bitter3-51/+32
The change in ab068a824ed51e78bf111387223e58e885ec5c84 is described as temporary, so it would be better if it did not affect the EndpointMap parameter (which is effectively a public interface, since it may be overridden in an environment file). No configuration should end up with different ports/protocols/hosts for Keystone v2 and v3, and somebody customising them should not have to account for them separately. Nor should things break when the need to distinguish between v2 and v3 endpoints goes away. This change removes the KeystoneV3* keys from the EndpointMap input and uses the Keystone* keys instead, so that any change to the internal organisation becomes transparent to the user. Change-Id: If4cdd9232f4dbc9f2af651bbdfe68f09dc26ed2e
2016-04-11Merge "Replace extraconfig/tasks/noop.yaml w/ Heat::None"Jenkins2-29/+3
2016-04-09Merge "Add EndpointMap as output"Jenkins1-0/+6
2016-04-09composable keystone servicesDan Prince8-280/+178
Adds new puppet and puppet pacemaker specific services for Keystone. The puppet manifests for keystone now live in puppet-tripleo. Hiera settings are driven by the nested stack heat templates and used to control puppet-keystone and puppet-tripleo directly. The Pacemaker template extends the default keystone service and swaps in the pacemaker specific puppet-tripleo profile instead. Change-Id: I8b30438a27e9d5ec4e7d335e0bd1a931a20b03a2 Depends-On: I2faf5a78db802549053ec41678bf83bf28108189
2016-04-09Merge "ha/glance-fs: avoid a race condition"Jenkins1-11/+12
2016-04-08Replace extraconfig/tasks/noop.yaml w/ Heat::NoneDan Prince2-29/+3
Removes the old noop nested stack template for extraconfig tasks and instead uses OS::Heat::None. This should avoid a few extra resource checks on create and update. Change-Id: I5a42fc78ece2553e86385236e214aa1e3c91cd85
2016-04-08Remove network/noop.yaml, use OS::Heat::NoneDan Prince5-13/+9
Removes the old noop nested stack template for networks and instead uses OS::Heat::None instead. This should avoid a few extra resource checks on create and update. Change-Id: Ia3d7f62dbda2705ffc3d9edcddebcd3ece3cc9d2
2016-04-07ha/glance-fs: avoid a race conditionEmilien Macchi1-11/+12
Create the glance-fs Pacemaker resource on one node (pacemaker master) instead of all nodes, and set verify_on_create to True. * It will avoid a race condition if Puppet is applied on 2 nodes on the same time, so the filesystem is attempted to be created once. * Verify with psc that the resource has been correctly created. The full context of the bug is decribed here: https://bugzilla.redhat.com/show_bug.cgi?id=1319384 Change-Id: I625f0879ae56e814664d1433ae47e27148779f12
2016-04-07Add removal of the /etc/resolv.conf.save file for +bug/1567004marios1-0/+3
The change at https://review.openstack.org/#/c/302352/ should stop the if up/down scripts from making changes to resolv.conf as discussed in that review and the related bug below. However during upgrades, as we are moving from a version of the ifcfg-vlanXX files that don't have the PEERDNS=no added by /#/c/302352 the if up script will restore the /etc/resolv.conf.save to /etc/resolv.conf and overwrite it. This removes the .save file during the upgrade init command which gets delivered to all nodes as the first stage of a major upgrade. Change-Id: I91dd139f43be4912c20d8661691bee2b662964d4 Related-Bug: 1567004
2016-04-06Revert "Ping retry"Dan Prince1-13/+7
This reverts commit 570c690bfb118e0cf130b7dbed7992676519ed9b. This patch broke the ping_gateway_function when using IPv6 network isolation. Change-Id: I57850a527804f2e753270fd9063d119d41a83b17 Closes-bug: #1567011
2016-04-06Use a different ceph key for admin/client userDimitri Savineau1-1/+2
By default only the admin user key is generated and this key is used for both admin and openstack user. Because the mode of the client's key file is 644, any user with a valid shell on the controller/compute/ceph nodes can made admin operations on the ceph cluster. This patch allows to used the random key generated by tripleoclient for the openstack user. Change-Id: I771bbee81c0acfe593e92a99ad12d6f1f7f445ef Closes-bug: #1566927 Depends-On: I404665c09084f0a6cd2d8872940ee90220dc5f69
2016-04-06Increase corosync token timeoutJiri Stransky2-2/+3
This might prevent dropping members from corosync cluster on high load environments. Symptoms of this problem happening can sometimes be found in corosync log: dub 05 17:23:45 overcloud-controller-0 corosync[14152]: [MAIN ] Corosync main process was not scheduled for 3691.8391 ms (threshold is 1320.0000 ms). Consider token timeout increase. The default in the Puppet manifest is 1 second, which matches the corosync default, and we override it with hiera to 10 seconds. Change-Id: I5ea850ada657e5eecafa3e8b28613a0ac48e78f3
2016-04-05Reload haproxy after injecting certs w/o pcmk tooBen Nemec1-0/+8
This was accidentally dropped from Id5ed05b3a20d06af8ae7a3d6f859b03399b0d77d but we should handle the non-pacemaker case as well. Change-Id: Ia06746f9c536159cd7b62259e450b3dec331cdb0
2016-04-05Merge "Filter for local nodes in check_resource function"Jenkins1-1/+2
2016-04-05Merge "Ping retry"Jenkins1-7/+13
2016-04-05Merge "Nova needs the proper volumes to use Cinder"Jenkins1-1/+7
2016-04-04Merge "Enable galera replication for Mariadb 10.1"Jenkins1-0/+2
2016-04-04Change /etc/hosts format and add domainJuan Antonio Osorio Robles5-60/+60
Right now, the service-related IPs assosiated with the machine are registered in the /etc/hosts with different hostnames. This is fine, except if you need to register that hostname in a third party service (such as FreeIPA), since the current configuration is not assigning a domain to those IP addresses. So the current implementation requires DNS to be properly working, which is not ideal for testing purposes. Since the current hostnames are not currently being used; it's still trivial to change this mapping and the format of them. instead of having entries such as: <INTERNAL IP> <node>-internalapi <STORAGE IP> <node>-storage ... in /etc/hosts; This changes the format to: <INTERNAL IP> <node>.internalapi.<domain> <node>.internalapi <STORAGE IP> <node>.storage.<domain> <node>.storage ... So the network (external, internal, storage, etc...) is now represented as a subdomain. For simplicity, the format without the domain is still available through an alias. Change-Id: I6502959a974546e5de757935acea15df6326acda
2016-04-04Nova needs the proper volumes to use CinderRyan Hallisey1-1/+7
Kolla has been using ceph. For a while, cinder had iscsi build into it, but it was removed. In order to get this to work with containers again, nova-compute and libvirt containers need /dev and /lib/udev mounted into their containers. We also need to copy nova's rootwrap.conf into the nova. It was missing this config file. Change-Id: Ie77f56b4576d5393ad3756b0f5ecc3eeff844d1f
2016-04-04Filter for local nodes in check_resource functionRaoul Scarazzini1-1/+2
While having extra customizations inside a TripleO deployed Pacemaker environment, say you have instance HA with pacemaker_remoted or you need to configure an external arbitrator for something, then the status of the resources for remote nodes is "Stopped". This leads to failures while, for example, scaling up. This fixes the way status is checked, filtering just local nodes. Co-Authored-By: Giulio Fidente <gfidente@redhat.com> Change-Id: I8dc25f5d7031c265858afd5a266fda5315ae37a0
2016-04-03Merge "Restart haproxy after configuring SSL certs"Jenkins2-7/+21
2016-04-03Merge "Configure ControllerServices via resource chains"Jenkins8-2/+132
2016-04-01Restart haproxy after configuring SSL certsBen Nemec2-7/+21
If a certificate expires, the user will need to update it. However, because we only restart services at the end of a stack-update the new certificate doesn't take effect until after puppet has run. This is a problem because puppet makes OpenStack calls, which will fail if the certificate is expired. In that case we never get to the service restart so the stack is wedged until the user manually restart haproxy. This patch addresses the problem by reloading haproxy before puppet runs. This is done in a pre-puppet script for pacemaker after pacemaker is maintenance mode because we need to make sure it happens after all of the certs have been installed on the controllers, but before puppet runs. For non-pacemaker, haproxy is simply reloaded. Change-Id: Id5ed05b3a20d06af8ae7a3d6f859b03399b0d77d
2016-04-01Merge "Disable Nova v3 API"Jenkins3-121/+0