aboutsummaryrefslogtreecommitdiffstats
AgeCommit message (Collapse)AuthorFilesLines
2016-12-20FreeIPA: Make OTP and FreeIPA server parameters optionalJuan Antonio Osorio Robles1-5/+16
In the freeipa-enroll.yaml, it can be the case that the node has been enrolled (via a cloud-init script); in this case, the OTP and the FreeIPA server are optional. However, we still need to get a kerberos ticket, which is the last step of this script, since this ticket is what certmonger will use to request the certificates in subsequent steps. Change-Id: I7e9d6a747cdcbe81c9a74a17db5e91aa9d459f65
2016-12-19Merge "Remove unused attr from templates"Jenkins1-1/+0
2016-12-19Merge "Revert "Switch mistral to use authtoken configuration""Jenkins1-4/+2
2016-12-19Revert "Switch mistral to use authtoken configuration"Ben Nemec1-4/+2
It turns out the puppet-mistral change this depends on broke introspection, so we need to back it out for now. This reverts commit ed029e5bf279945e82bff8766af4093856a7ac6a. Change-Id: I828478267935cdc68aa24de8c9dc2d12fcadb631
2016-12-19Merge "Switch mistral to use authtoken configuration"Jenkins1-2/+4
2016-12-19Use overcloud-full instead of atomic-imageSteve Baker3-131/+29
This switches to using overcloud-full as the OS image for containerized compute. It includes the following changes: - install docker, until this change lands I1eab2a6de721c8f3c21c7df0019f2d4d1cc3775f - agent image pull has been removed. This avoids a race between docker starting and the current call to pull. This relies on "docker run" to do the initial pull and leaves open the option of some other prefetch mechanism to do the initial pull - rely on unit Conflicts= to ensure heat-docker-agents and os-collect-config do not run at the same time - tweaks to host bind mounts - removal of commands which only apply to atomic Co-Authored-By: Martin André <m.andre@redhat.com> Change-Id: I2e82634785834a877a4dbdbdcd788a9ac1c14a9d
2016-12-19Introduce role-specific NodeUserData, use for dockerSteve Baker8-1/+47
Currently when the docker environments are invoked, every node has the boot script run which replaces os-collect-config with the heat-agents container. This should only be happening on Compute nodes currently, and each role will be converted to heat-agents one at a time. This change implements a role-specific NodeUserData resource and uses that mechanism to run docker/firstboot/install_docker_agents.yaml only on Compute nodes. Change-Id: Id81811dbcaf0e661c3980aa25f3ca80db5ef0954
2016-12-19Add bind mounts for agent stateSteve Baker1-0/+3
These ensure that software configuration tasks are not re-run when the heat-agents container is restarted. Change-Id: Ieb84fe1f6dd849737ff22f51daa12ddc467dcdde
2016-12-19Merge "Add a type for the ControlVirtualIP resource"Jenkins2-1/+2
2016-12-19Merge "Correction to SRIOV THT Examples"Jenkins1-2/+3
2016-12-19Move UpgradeInitCommand to role templatesSteven Hardy7-37/+169
We can't run this during the upgrade steps, because there are things which need to happen before any role configuration happens, e.g installing the new hiera heat-config hook, which must be done before e.g "ControllerDeployment" runs or the stack update hangs. Partially-Implements: blueprint overcloud-upgrades-per-service Change-Id: I365b57513590662c3f78a33dc625747f457c48c5
2016-12-19Run upgrade steps before post-deploy configSteven Hardy2-8/+15
For some upgrade scenarios, e.g all-in-one deployments, it may be possible to run the upgrade steps, then apply puppet in one stack update, so reverse the order here. For normal deployments the upgrade steps are mapped to OS::Heat::None so this will have no effect. Partially-Implements: blueprint overcloud-upgrades-per-service Change-Id: I3c78751349a6ac2bc5dff82f67bffe13750ac21c
2016-12-19Merge "Set rabbitmq's port and IP via the config file and not the env file"Jenkins1-1/+3
2016-12-19Merge "Introduce role-specific nova-server-metadata"Jenkins6-12/+84
2016-12-19Merge "Enable SECURE_PROXY_SSL_HEADER option for horizon"Jenkins1-0/+1
2016-12-19Split OVN northd and ml2 pluginSteven Hardy6-11/+47
This allows us to take advantage of the composable roles hiera settings to connect the plugin to the northd/ovndb API without needing to hard-code the IP of the node running the service. Change-Id: I2508d48f81c1819ae3521fff271c0bdc50724604 Depends-On: I9af7bd837c340c3df016fc7ad4238b2941ba7a95 Closes-Bug: #1634171
2016-12-17Merge "Use hostname -s instead of hostnamectl --transient"Jenkins1-1/+1
2016-12-17Add "deployed server" fake neutron portsDan Prince5-29/+78
This patch swaps out the noop ctlplane port for a more proper fake neutron port stack. This stack is a swap in for the OS::Neutron::Port heat resource and can be controlled via the DeployedServerPortMap parameter. By relying on <hostname>-<network> naming conventions in the map we can map IPs to specific servers without using the Neutron API. This will allow us to inject IP information into the Heat stack within the new t-h-t undercloud installer which currently does not run a Neutron service. Change-Id: I29fbc720c3d582cbb94385e65e4b64b101f7eac9
2016-12-17net-conf: make bridge and interface name optionalDan Prince1-5/+5
Update the run-os-net-config.sh so that we make the bridge_name and interface_name parameters (supplied by the SoftwareConfig) optional. This allows operators to create custom network templates to be used on roles other than compute and controller which appear to be the only two roles which set bridge_name and interface_name parameters. Change-Id: I8997cf8177c1bf0e1f19de5f93dc4e81da1a951f
2016-12-16Increase libvirt/qemu.conf max_files and max_processesGiulio Fidente1-0/+3
When Nova and/or Cinder are using Ceph as backend, qemu will need to open a connection and two threads for each and every Ceph OSD. This change raises the max_files (set to 1024 by default) to 32768 and the max_processes (set to 4096 by default) to 131072. The max number of FDs is per-process, while the max number of processes is per-user. The values can be overridden via ExtraConfig, no params are added to the templates. A more detailed description of the values were chosen can be found at: https://access.redhat.com/solutions/1602683 Change-Id: I1e79675f6aac1b0fe6cc7269550fa6bc8586e1fb Depends-On: I258afd3ee6633e4b2ebc45aa8611be652476be0c
2016-12-16Introduce role-specific nova-server-metadataJuan Antonio Osorio Robles6-12/+84
We could already pass metadata to the nova server instances (on creation) via the ServerMetadata parameter, however, there was no way of doing this per-role. This introduces that by adding a {{role}}ServerMetadata parameter for each role. This parameter gets merged with the ServerMetadata parameter and allows this functionality. Note that both default to {}, and so does the result of merging those parameters with their default values. So nothing changes for the default settings. Change-Id: I334edcc51ce7ee82fc13b6cf4c0d74ccb7db099c
2016-12-15Add ZaqarApiNetwork to the service net mapDan Prince1-0/+1
Without this Zaqar API will fail to run due to a missing bind IP address in the config file. Change-Id: Icd0a6e85b7455e89f37f05399146d5e743359da8 Closes-bug: #1650307
2016-12-15Add pre-network hook and example showing config-then-rebootSteven Hardy8-0/+85
There are some requirements for early configuration that involves e.g setting kernel parameters then rebooting. Currently this can be done via cloud-init, e.g firstboot templates, but there's been discussion around enabling a SoftwareDeployment approach instead. The main advantage of doing it this way is there's an error path if something goes wrong with the config (except triggering the reboot as we have to use NO_SIGNAL for that). Change-Id: Ia54ee654f755631b8062eb5c209a60c6f9161500
2016-12-15Merge "Deployed server: switch to apply-config hook"Jenkins1-1/+1
2016-12-14Use hostname -s instead of hostnamectl --transientDan Prince1-1/+1
This patch updates the deployed-server interface to use a simple hostname -s. The previous hostnamectl --transient can pick up extra domain name configuration in some cases that can cause very odd hostname generation if used with the tripleo-heat-template host file generation. This would actually break the new undercloud t-h-t installer in that some of the /etc/hosts entries would be invalid (no IP address) due to substring replacements failing in a variety of odd hostname situations. Simplifying the hostname of deployed servers to just the short version seems the most sensable way to avoid all this. Change-Id: Ia7e636d021f948ea5234475cef02f666d8ce6999
2016-12-14Make the openvswitch 2.4->2.5 upgrade more robustmarios10-80/+57
In I9b1f0eaa0d36a28e20b507bec6a4e9b3af1781ae and I11fcf688982ceda5eef7afc8904afae44300c2d9 we added a manual step for upgrading openvswitch in order to specify the --nopostun as discussed in the bug below. This change adds a minor update to make this workaround more robust. It removes any existing rpms that may be around from an earlier run, and also checks that the rpms installed are at least newer than the version we are on. This also refactors the code into a common definition in the pacemaker_common_functions.sh which is included even for the heredocs generating upgrade scripts during init. Thanks Sofer Athlan-Guyot and Jirka Stransky for help with that. Change-Id: Idc863de7b5a8c116c990ee8c1472cfe377836d37 Related-Bug: 1635205
2016-12-14Set rabbitmq's port and IP via the config file and not the env fileJuan Antonio Osorio Robles1-1/+3
The RabbitMQ's puppet manifest configures the node's IP and port through environment variables. While this would usually be fine, it doesn't allow us to use TLS-only, since it will always try to start a TCP listener. So, by setting these values through the config file, when setting ssl_only for rabbitmq, they will effectively be discarded and thus allow us to use an SSL listener on the same port. Change-Id: I33d051a8c740baf69b99517378e1f9b0f3cc1681
2016-12-14Enable SECURE_PROXY_SSL_HEADER option for horizonJuan Antonio Osorio Robles1-0/+1
This reads makes Django take the X-Forwarded-Proto header into account when forming URLs. Change-Id: Ice64de9a11d7819ae7f380279ff356342d9b6673 Depends-On: Ifed7d4c3409419c01c5b20c707221c1fc76ea09e
2016-12-13Synchronize NetworkDeployment inputs for generic rolesJames Slagle1-0/+7
The inputs on the NetworkDeployment SoftwareDeployment resource were not the same for generic roles as they were for the default roles (role.role.js.yaml vs. controller-role.yaml). This patch synchronizes the input between the 2 so that the interface is the same for deployers. Change-Id: Id14cf7ca219aee61f5b9d21171a5c41dea765f98 Implements: blueprint multinode-ci-os-net-config
2016-12-13Use OS::Heat::DeployedServerJames Slagle4-42/+10
The new DeployedServer resource in Heat will provide a native resource for Server resources that are not orchestrated via Nova. This will allow associating SoftwareDeployment's with servers that have not been launched with Nova with Heat directly. With the new resource, all of the SoftwareConfigTransport methods are available, including POLL_TEMP_URL. This patch also updates the get-occ-config.sh script to configure the requests collector in os-collect-config.conf on the deployed servers. Change-Id: I4b80421088acca709fe3f92741c5c052be483131 Partially-implements: blueprint split-stack-software-configuration Depends-On: I07b9a053ecd3ef4411b602bbc6ef985224834cf8
2016-12-13Merge "Don't rely on lsb_release for hosts template write"Jenkins1-11/+3
2016-12-13Merge "docker: don't use custom run-os-net-config"Jenkins2-22/+2
2016-12-13Manage disallow_iframe_embedLuke Hinds1-0/+1
disallow_iframe_embed can be used to prevent Horizon from being embedded within an iframe. Legacy browsers are still vulnerable to a Cross-Frame Scripting (XFS) vulnerability, so this option allows extra security hardening where iframes are not used in deployment Change-Id: I2fe6b243250608b340ee555062060dbdad1a49c4 Depends-On: I5c540e552efe738bdec8598f9257fa22ae651a76 Closes-Bug: #1641882
2016-12-12Use df instead of findmnt in cephstorage upgrade scriptsGiulio Fidente1-1/+1
There are scenarios in which findmnt will return a list of all mounted filesystems, which causes the upgrade script to fail in recognizing if the Ceph OSD is backed by ext4. Change-Id: Iadebdc32b523c05216202b782ceb54bec4389413 Closes-Bug: #1649407
2016-12-12Merge "Add FreeIPA enrollment template"Jenkins1-0/+72
2016-12-11Decouple swift-proxy from ceilometerDan Prince4-21/+46
This patch updates the swift-proxy base profile so that we now explicitly set the rabbit_port. This allows us to remove the use of puppet-ceilometer default settings in the puppet-tripleo modules change ID here: I8d9f69f5e9160543b372bd9886800f16f625fdc6 It also adds a new boolean parameter that allows the end user to disable the swift ceilometer pipeline by setting SwiftCeilometerPipelineEnabled to false. This two settings allow Swift to once again be installed on a machine without configuring Ceilometer. Depends-On: Id1584df5e5bb90f8087ae25eecc4834179b6fc21 Change-Id: Ief5399d7ea4d26e96ce54903a69d660fa4fe3ce9 Related-bug: #1648736
2016-12-11Add a type for the ControlVirtualIP resourceDan Prince2-1/+2
This patch adds a new type called: OS::TripleO::Network::Ports::ControlPlaneVipPort This defaults to a normal OS::Neutron::Port object but can be mocked out for some implementations like when installing the undercloud where neutron doesn't exist. Change-Id: Iebf2428432a98a9d789b206ce973599adbc0af8f
2016-12-10Switch mistral to use authtoken configurationAlex Schultz1-2/+4
The upstream puppet module is adding the proper keystone authtoken middleware support. This change updates THT to use the keystone authtoken class rather than the deprecated settings. This also allows for proper keystone v3 integration. Change-Id: Iaf82716122a25e3e0785de1250d24edaaa5e4d04 Depends-On: I71969ef09018f9daa5f81c4f3bcbdb0b0974446c
2016-12-10Merge "Add NIC config for compute role for DVR with multiple NICs"Jenkins1-0/+162
2016-12-09Expose param to enable legacy ceilometer apiPradeep Kilambi1-0/+5
Change-Id: I75815a4bcbf421597abb86226238b74a9afffc0d Depends-On: Iffb8c2cfed53d8b29e777c35cee44921194239e9
2016-12-09Add FreeIPA enrollment templateJuan Antonio Osorio Robles1-0/+72
This is based on previous work [1] and it's what I've been using to test the TLS-everywhere work. This introduces a template that will run on every node to enroll them to FreeIPA and acquire a ticket (authenticate) in order to be able to request certificates. Enrollment is done via the ipa-client-install command and it does the following: * Get FreeIPA's CA certificate and trust it. * Authenticate to FreeIPA using an OTP and get a kerberos keytab. * Set up several configurations that are needed for FreeIPA (sssd, kerberos, certmonger) The keytab is then used to authenticate and get an actual TGT (Ticket-Granting-Ticket) from Kerberos The previous implementation used a PreConfig hook, however, here it was modified to use NodeTLSCAData. This has the advantage that it runs on every node as opposed to the PreConfig hook where we had to specify the role type so it's a usability improvement. And, on the other hand, this does set up necessary things for the usage of FreeIPA as a CA, such as getting the certificate and enrolling to the CA. [1] https://github.com/JAORMX/freeipa-tripleo-incubator bp tls-via-certmonger Change-Id: Iac94b3b047dca1bcabd464ea8eed6f1220c844f1
2016-12-08Don't rely on lsb_release for hosts template writeSteve Baker1-11/+3
This is problematic for the containerised heat-agents, lsb_release has to be bind-mounted in, and atomic host doesn't even have lsb_release installed. Instead just write to every /etc/cloud/templates/hosts.*.tmpl file. Change-Id: If2aab7e9b1e03aa657baf1c33aa4392ef7044075
2016-12-08docker: don't use custom run-os-net-configSteve Baker2-22/+2
The script run-os-net-config[1] copies in ifcfg-* from the host before running os-net-config. Apparently it was done this way because the other scripts in /etc/sysconfig/network-scripts/ differed between host and agent container. This should be less of an issue now that host and heat-agents run centos-7 (even when the host is atomic) tripleo-heat-templates recently changed to running os-net-config in a deployment script instead of an os-refresh-config script [2]. This means that our current run-os-net-config approach is currently resulting in os-net-config being executed twice. Another issue with run-os-net-config is that it copies ifcfg-* from host to container, but not back again. This means that rebooting the server will result in unconfigured interfaces until os-net-config is somehow run again. This change bind mounts /etc/sysconfig/network-scripts/ from the host and uses the conventional approach to running os-refresh-config. This may fix the issue where compute nodes are losing network connectivity, so Closes-Bug: #1646897 [1] http://git.openstack.org/cgit/openstack/tripleo-common/tree/heat_docker_agent/run-os-net-config [2] I0ed08332cfc49a579de2e83960f0d8047690b97a Change-Id: I763fc8d8e3eb10ac64d33e46c92888d211003e72
2016-12-08Merge "Enable haproxy internal TLS through enable-internal-tls.yaml"Jenkins1-0/+1
2016-12-08Correction to SRIOV THT ExamplesSanjay Upadhyay1-2/+3
example for - NeutronSriovNumVFs - NeutronPhysicalDevMappings as given, causes parsing error. Change-Id: I71fb42f10dac70afa02244cd6629b3439f418d63 Closes-Bug: #1648351
2016-12-08Merge "Make get-occ-config.sh support custom roles"Jenkins2-12/+25
2016-12-07Merge "neutron: don't set router_delete_namespaces"Jenkins1-2/+1
2016-12-07Enable haproxy internal TLS through enable-internal-tls.yamlJuan Antonio Osorio Robles1-0/+1
For usability and to reduce the number of environments that need to be given when enabling TLS in the internal network, it's convenient to add the enabling of TLS in the internal front-ends for HAProxy, instead of doing that in a separate environment file. bp tls-via-certmonger Change-Id: Icef0c70b4b166ce2108315d5cf0763d4e8585ae1
2016-12-06Remove unused attr from templatesPradeep Kilambi1-1/+0
Change-Id: I299f8f33b0bac40d331084df37f690dc2a279677
2016-12-06neutron: don't set router_delete_namespacesIhar Hrachyshka1-2/+1
It's no longer available in Neutron (removed in Mitaka). See: I2a879213c3b095a007a4531f430a33cea9fdf1bd Change-Id: I044c648eb8c4933667b8ea2c9159a30e5ebb7df3