aboutsummaryrefslogtreecommitdiffstats
AgeCommit message (Collapse)AuthorFilesLines
2016-12-14Set rabbitmq's port and IP via the config file and not the env fileJuan Antonio Osorio Robles1-1/+3
The RabbitMQ's puppet manifest configures the node's IP and port through environment variables. While this would usually be fine, it doesn't allow us to use TLS-only, since it will always try to start a TCP listener. So, by setting these values through the config file, when setting ssl_only for rabbitmq, they will effectively be discarded and thus allow us to use an SSL listener on the same port. Change-Id: I33d051a8c740baf69b99517378e1f9b0f3cc1681
2016-12-13Merge "Don't rely on lsb_release for hosts template write"Jenkins1-11/+3
2016-12-13Merge "docker: don't use custom run-os-net-config"Jenkins2-22/+2
2016-12-12Merge "Add FreeIPA enrollment template"Jenkins1-0/+72
2016-12-10Merge "Add NIC config for compute role for DVR with multiple NICs"Jenkins1-0/+162
2016-12-09Add FreeIPA enrollment templateJuan Antonio Osorio Robles1-0/+72
This is based on previous work [1] and it's what I've been using to test the TLS-everywhere work. This introduces a template that will run on every node to enroll them to FreeIPA and acquire a ticket (authenticate) in order to be able to request certificates. Enrollment is done via the ipa-client-install command and it does the following: * Get FreeIPA's CA certificate and trust it. * Authenticate to FreeIPA using an OTP and get a kerberos keytab. * Set up several configurations that are needed for FreeIPA (sssd, kerberos, certmonger) The keytab is then used to authenticate and get an actual TGT (Ticket-Granting-Ticket) from Kerberos The previous implementation used a PreConfig hook, however, here it was modified to use NodeTLSCAData. This has the advantage that it runs on every node as opposed to the PreConfig hook where we had to specify the role type so it's a usability improvement. And, on the other hand, this does set up necessary things for the usage of FreeIPA as a CA, such as getting the certificate and enrolling to the CA. [1] https://github.com/JAORMX/freeipa-tripleo-incubator bp tls-via-certmonger Change-Id: Iac94b3b047dca1bcabd464ea8eed6f1220c844f1
2016-12-08Don't rely on lsb_release for hosts template writeSteve Baker1-11/+3
This is problematic for the containerised heat-agents, lsb_release has to be bind-mounted in, and atomic host doesn't even have lsb_release installed. Instead just write to every /etc/cloud/templates/hosts.*.tmpl file. Change-Id: If2aab7e9b1e03aa657baf1c33aa4392ef7044075
2016-12-08docker: don't use custom run-os-net-configSteve Baker2-22/+2
The script run-os-net-config[1] copies in ifcfg-* from the host before running os-net-config. Apparently it was done this way because the other scripts in /etc/sysconfig/network-scripts/ differed between host and agent container. This should be less of an issue now that host and heat-agents run centos-7 (even when the host is atomic) tripleo-heat-templates recently changed to running os-net-config in a deployment script instead of an os-refresh-config script [2]. This means that our current run-os-net-config approach is currently resulting in os-net-config being executed twice. Another issue with run-os-net-config is that it copies ifcfg-* from host to container, but not back again. This means that rebooting the server will result in unconfigured interfaces until os-net-config is somehow run again. This change bind mounts /etc/sysconfig/network-scripts/ from the host and uses the conventional approach to running os-refresh-config. This may fix the issue where compute nodes are losing network connectivity, so Closes-Bug: #1646897 [1] http://git.openstack.org/cgit/openstack/tripleo-common/tree/heat_docker_agent/run-os-net-config [2] I0ed08332cfc49a579de2e83960f0d8047690b97a Change-Id: I763fc8d8e3eb10ac64d33e46c92888d211003e72
2016-12-08Merge "Enable haproxy internal TLS through enable-internal-tls.yaml"Jenkins1-0/+1
2016-12-08Merge "Make get-occ-config.sh support custom roles"Jenkins2-12/+25
2016-12-07Merge "neutron: don't set router_delete_namespaces"Jenkins1-2/+1
2016-12-07Enable haproxy internal TLS through enable-internal-tls.yamlJuan Antonio Osorio Robles1-0/+1
For usability and to reduce the number of environments that need to be given when enabling TLS in the internal network, it's convenient to add the enabling of TLS in the internal front-ends for HAProxy, instead of doing that in a separate environment file. bp tls-via-certmonger Change-Id: Icef0c70b4b166ce2108315d5cf0763d4e8585ae1
2016-12-06neutron: don't set router_delete_namespacesIhar Hrachyshka1-2/+1
It's no longer available in Neutron (removed in Mitaka). See: I2a879213c3b095a007a4531f430a33cea9fdf1bd Change-Id: I044c648eb8c4933667b8ea2c9159a30e5ebb7df3
2016-12-06Fix SwiftStorage role.Chris Jones1-2/+2
We now fetch the name argument from the correctly named SwiftStorage object. Change-Id: I885505eadfc778ab57793c97af4d1c6739ec9614 Closes-Bug: #1647716
2016-12-05Merge "Support multiple meter dispatchers in ceilometer config"Jenkins1-3/+3
2016-12-05Merge "Move nodes' fqdns to a map to remove clutter"Jenkins6-679/+660
2016-12-05Merge "Use transient hostname for deployed servers"Jenkins1-17/+2
2016-12-05Merge "Fix bug when using multiple DeployArtifactURLs"Jenkins1-1/+1
2016-12-02Merge "No longer hard coding to a specifc network interface name."Jenkins1-2/+2
2016-12-02Add NIC config for compute role for DVR with multiple NICsDan Sneddon1-0/+162
This change adds a NIC config to the multiple-nics sample NIC config templates for a compute node running DVR. In order for DVR to work on the compute nodes, they must share an external bridge with the controllers. All of the other sample NIC configs already have an external bridge (defaults to 'br-ex'), but the multiple-nics compute role does not, so now the compute-dvr.yaml NIC template will demonstrate DVR with multiple NICs. Change-Id: I80fe2e5842a67984e1d4d8aa295c7607c4f340ad
2016-12-02Merge "Revert "Use FQDN for rabbitmq's nodename env variable""Jenkins1-7/+1
2016-12-02Merge "Add zaqar to the controller's list of services in roles_data.yaml"Jenkins1-0/+1
2016-12-02Fix bug when using multiple DeployArtifactURLsChristian Schwede1-1/+1
The script tries to download all artifact URLs with a single request, instead of downloading each URL on its own if multiple DeployArtifactURLs were given. Change-Id: I6a8be699aff7023a67702bb1d3ddc2273984cd08
2016-12-02Revert "Use FQDN for rabbitmq's nodename env variable"Ben Nemec1-7/+1
This seems to have broken the updates job, causing it to fail with following error: Can't set long node name!\nPlease check your configuration\n Related-Bug: 1646873 This reverts commit 3e9fcfd09320ace07bc1bd4cb57feb98cd057332. Change-Id: I72ba891cd9cd8c4f1bc204144f46aaabbdfd3647
2016-12-02Merge "scenario001: deploy Cinder with RBD backend"Jenkins2-1/+15
2016-12-02Add zaqar to the controller's list of services in roles_data.yamlJuan Antonio Osorio Robles1-0/+1
Change-Id: Iecafa7878fec20c707e94bdaca55f1489f3e338a
2016-12-02Merge "Add Zaqar to scenario002"Jenkins2-1/+9
2016-12-02Merge "Composable Zaqar services"Jenkins8-0/+597
2016-12-02Move nodes' fqdns to a map to remove clutterJuan Antonio Osorio Robles6-679/+660
There were several instances where the short-names/FQDNs where being gotten in the same way in the role's templates. So this introduces a mapping to get these values in order to reduce clutter. Change-Id: Ie7df360bb69d56655f3e0fcbbf4d297db39b7a26
2016-12-02Merge "Use FQDN for rabbitmq's nodename env variable"Jenkins1-1/+7
2016-12-02Merge "Use network-based fqdn entry from hiera instead of the custom fact"Jenkins11-21/+21
2016-12-02Merge "scenario001: deploy Ceph"Jenkins1-3/+24
2016-12-02Merge "Implement scenario004 with Ceph Rados Gateway scenario"Jenkins2-0/+189
2016-12-01Merge "scenario003: configure Keystone tokens with Fernet provider"Jenkins1-0/+1
2016-12-01Make get-occ-config.sh support custom rolesJames Slagle2-12/+25
Updates the get-occ-config.sh script used with the deployed-server environment to support custom roles. Any custom role name, and a corresponding set of hosts (ip addresses or hostnames) can now be passed to the script and it will query for the proper nested stack uuid's and configure os-collect-config appropriately on the respective nodes. Change-Id: I8fc39e6d18cd70ff881e2a284234b26261018d67
2016-12-01scenario001: deploy Cinder with RBD backendEmilien Macchi2-1/+15
Improve scenario001 with Cinder + RBD coverage. Also remove Barbican bits, we don't deploy Barbican in scenario001, but 002. Change-Id: Ib9cadbefcb3ddcdb4812f47ff5496e74b2bd888d
2016-12-01Merge "ceph-rgw: add missing user parameter"Jenkins1-0/+1
2016-12-01Merge "scenario001/pingtest: remove gnocchi_res_alarm"Jenkins1-13/+15
2016-12-01scenario003: configure Keystone tokens with Fernet providerEmilien Macchi1-0/+1
Improve scenario003 to configure Keystone tokens with Fernet provider. Scenario001 and scenario002 will still deploy uuid for now. Change-Id: I8c671d0371b2c3590b58b9623bb0df0b0c625a5b
2016-12-01Implement scenario004 with Ceph Rados Gateway scenarioEmilien Macchi2-0/+189
Like Puppet OpenStack CI, implement scenario004 with Ceph RGW scenario, where Glance uses it as a image storage backend. Change-Id: If055ca225c456a738c5726ef1e76a4a4f9c566a8
2016-12-01ceph-rgw: add missing user parameterEmilien Macchi1-0/+1
'user' is required or puppet-ceph will complain that the Keystone_user has no title: Evaluation Error: Missing title. The title expression resulted in undef at /etc/puppet/modules/ceph/manifests/rgw/keystone/auth.pp The value is set to Swift, as we use the same credentials as Swift service. Closes-Bug: #1642524 Change-Id: Ib4a7c07086b0b3354c8e589612f330ecdffdc637
2016-12-01Merge "Initial support for composable upgrades with Heat+Ansible"Jenkins13-3/+253
2016-12-01Merge "Introduce network-based FQDNs via hiera"Jenkins6-0/+217
2016-12-01Merge "Make pep8 task run template generation"Jenkins1-2/+4
2016-12-01Merge "Add local template generation tox task"Jenkins5-0/+150
2016-12-01scenario001: deploy CephEmilien Macchi1-3/+24
Add Ceph to scenario001 and use it as a backend for Nova, Glance and Gnocchi. Change-Id: I29065d4b2ac39db40984873fda550d7adbe904fe
2016-12-01scenario001/pingtest: remove gnocchi_res_alarmEmilien Macchi1-13/+15
The resource is failing and it prevents us to add more coverage. Until we figure what's wrong with it, let's disable it. Change-Id: If89775bf67d686327d0d27222e0c9179be74a668
2016-12-01Merge "Make scenario template paths relative"Jenkins1-5/+5
2016-12-01Merge "Configure /etc/hosts via os-collect-config script"Jenkins3-7/+64
2016-12-01Merge "Show team and repo badges on README"Jenkins1-0/+9