aboutsummaryrefslogtreecommitdiffstats
AgeCommit message (Collapse)AuthorFilesLines
2016-04-09Merge "ha/glance-fs: avoid a race condition"Jenkins1-11/+12
2016-04-08Replace extraconfig/tasks/noop.yaml w/ Heat::NoneDan Prince2-29/+3
Removes the old noop nested stack template for extraconfig tasks and instead uses OS::Heat::None. This should avoid a few extra resource checks on create and update. Change-Id: I5a42fc78ece2553e86385236e214aa1e3c91cd85
2016-04-08Remove network/noop.yaml, use OS::Heat::NoneDan Prince5-13/+9
Removes the old noop nested stack template for networks and instead uses OS::Heat::None instead. This should avoid a few extra resource checks on create and update. Change-Id: Ia3d7f62dbda2705ffc3d9edcddebcd3ece3cc9d2
2016-04-07ha/glance-fs: avoid a race conditionEmilien Macchi1-11/+12
Create the glance-fs Pacemaker resource on one node (pacemaker master) instead of all nodes, and set verify_on_create to True. * It will avoid a race condition if Puppet is applied on 2 nodes on the same time, so the filesystem is attempted to be created once. * Verify with psc that the resource has been correctly created. The full context of the bug is decribed here: https://bugzilla.redhat.com/show_bug.cgi?id=1319384 Change-Id: I625f0879ae56e814664d1433ae47e27148779f12
2016-04-07Add removal of the /etc/resolv.conf.save file for +bug/1567004marios1-0/+3
The change at https://review.openstack.org/#/c/302352/ should stop the if up/down scripts from making changes to resolv.conf as discussed in that review and the related bug below. However during upgrades, as we are moving from a version of the ifcfg-vlanXX files that don't have the PEERDNS=no added by /#/c/302352 the if up script will restore the /etc/resolv.conf.save to /etc/resolv.conf and overwrite it. This removes the .save file during the upgrade init command which gets delivered to all nodes as the first stage of a major upgrade. Change-Id: I91dd139f43be4912c20d8661691bee2b662964d4 Related-Bug: 1567004
2016-04-06Revert "Ping retry"Dan Prince1-13/+7
This reverts commit 570c690bfb118e0cf130b7dbed7992676519ed9b. This patch broke the ping_gateway_function when using IPv6 network isolation. Change-Id: I57850a527804f2e753270fd9063d119d41a83b17 Closes-bug: #1567011
2016-04-06Use a different ceph key for admin/client userDimitri Savineau1-1/+2
By default only the admin user key is generated and this key is used for both admin and openstack user. Because the mode of the client's key file is 644, any user with a valid shell on the controller/compute/ceph nodes can made admin operations on the ceph cluster. This patch allows to used the random key generated by tripleoclient for the openstack user. Change-Id: I771bbee81c0acfe593e92a99ad12d6f1f7f445ef Closes-bug: #1566927 Depends-On: I404665c09084f0a6cd2d8872940ee90220dc5f69
2016-04-06Increase corosync token timeoutJiri Stransky2-2/+3
This might prevent dropping members from corosync cluster on high load environments. Symptoms of this problem happening can sometimes be found in corosync log: dub 05 17:23:45 overcloud-controller-0 corosync[14152]: [MAIN ] Corosync main process was not scheduled for 3691.8391 ms (threshold is 1320.0000 ms). Consider token timeout increase. The default in the Puppet manifest is 1 second, which matches the corosync default, and we override it with hiera to 10 seconds. Change-Id: I5ea850ada657e5eecafa3e8b28613a0ac48e78f3
2016-04-05Reload haproxy after injecting certs w/o pcmk tooBen Nemec1-0/+8
This was accidentally dropped from Id5ed05b3a20d06af8ae7a3d6f859b03399b0d77d but we should handle the non-pacemaker case as well. Change-Id: Ia06746f9c536159cd7b62259e450b3dec331cdb0
2016-04-05Merge "Filter for local nodes in check_resource function"Jenkins1-1/+2
2016-04-05Merge "Ping retry"Jenkins1-7/+13
2016-04-05Merge "Nova needs the proper volumes to use Cinder"Jenkins1-1/+7
2016-04-04Merge "Enable galera replication for Mariadb 10.1"Jenkins1-0/+2
2016-04-04Change /etc/hosts format and add domainJuan Antonio Osorio Robles5-60/+60
Right now, the service-related IPs assosiated with the machine are registered in the /etc/hosts with different hostnames. This is fine, except if you need to register that hostname in a third party service (such as FreeIPA), since the current configuration is not assigning a domain to those IP addresses. So the current implementation requires DNS to be properly working, which is not ideal for testing purposes. Since the current hostnames are not currently being used; it's still trivial to change this mapping and the format of them. instead of having entries such as: <INTERNAL IP> <node>-internalapi <STORAGE IP> <node>-storage ... in /etc/hosts; This changes the format to: <INTERNAL IP> <node>.internalapi.<domain> <node>.internalapi <STORAGE IP> <node>.storage.<domain> <node>.storage ... So the network (external, internal, storage, etc...) is now represented as a subdomain. For simplicity, the format without the domain is still available through an alias. Change-Id: I6502959a974546e5de757935acea15df6326acda
2016-04-04Nova needs the proper volumes to use CinderRyan Hallisey1-1/+7
Kolla has been using ceph. For a while, cinder had iscsi build into it, but it was removed. In order to get this to work with containers again, nova-compute and libvirt containers need /dev and /lib/udev mounted into their containers. We also need to copy nova's rootwrap.conf into the nova. It was missing this config file. Change-Id: Ie77f56b4576d5393ad3756b0f5ecc3eeff844d1f
2016-04-04Filter for local nodes in check_resource functionRaoul Scarazzini1-1/+2
While having extra customizations inside a TripleO deployed Pacemaker environment, say you have instance HA with pacemaker_remoted or you need to configure an external arbitrator for something, then the status of the resources for remote nodes is "Stopped". This leads to failures while, for example, scaling up. This fixes the way status is checked, filtering just local nodes. Co-Authored-By: Giulio Fidente <gfidente@redhat.com> Change-Id: I8dc25f5d7031c265858afd5a266fda5315ae37a0
2016-04-03Merge "Restart haproxy after configuring SSL certs"Jenkins2-7/+21
2016-04-03Merge "Configure ControllerServices via resource chains"Jenkins8-2/+132
2016-04-01Restart haproxy after configuring SSL certsBen Nemec2-7/+21
If a certificate expires, the user will need to update it. However, because we only restart services at the end of a stack-update the new certificate doesn't take effect until after puppet has run. This is a problem because puppet makes OpenStack calls, which will fail if the certificate is expired. In that case we never get to the service restart so the stack is wedged until the user manually restart haproxy. This patch addresses the problem by reloading haproxy before puppet runs. This is done in a pre-puppet script for pacemaker after pacemaker is maintenance mode because we need to make sure it happens after all of the certs have been installed on the controllers, but before puppet runs. For non-pacemaker, haproxy is simply reloaded. Change-Id: Id5ed05b3a20d06af8ae7a3d6f859b03399b0d77d
2016-04-01Merge "Disable Nova v3 API"Jenkins3-121/+0
2016-04-01Disable Nova v3 APIJiri Stransky3-121/+0
Microversions since Nova API v2.1 are aimed to replace the v3 work. The /v2.1 is backwards compatible with the legacy /v2 endpoint. What we called in the past /v3 is now something defunct in-tree. The /v2.1 API is based on the v3 work, but there are many things that differ, in particular with the backwards-compat thing. We keep the /v2 path in api-paste.ini for making sure an upgrade doesn't trample operators and users but if you look in tree, that's redirecting to the v2.1 codepath (just not asking for microversions). In summary, we only need one endpoint, ie. /v2.1. Additional information at https://bugzilla.redhat.com/show_bug.cgi?id=1291291 Related-Bug: #1564372 Change-Id: I1654665663bc5a19c201f7d25407910654ac1308 Depends-On: I6d64b8bcd0f79f1f298ddc809e6d92fbc2985c45
2016-03-31Configure ControllerServices via resource chainsDan Prince8-2/+132
This patch wires in a new for Mitaka Heat feature that allows us to dynamically include a set of nested stacks representing individual services via a Heat resource chain. Follow on patches will use this interface to decompose the controller role into isolated services. Co-Authored-By: Steve Hardy <shardy@redhat.com> Depends-On: If510abe260ea7852dfe2d1f7f92b529979483068 Change-Id: I84c97a76159704c2d6c963bc4b26e365764b1366
2016-03-31Add EndpointMap as outputJuan Antonio Osorio Robles1-0/+6
The endpoint map contains, not only the hosts and protocols that the resulting services will use, but also the ports. This information is useful, and the aim of this patch is to make it available for the tripleoclient to use it. Change-Id: I4cc5bbf2e7200f78cd90b93659c326a9200278d7
2016-03-31Updates ControlPlaneSubnetCidr to be a stringRhys Oxenham1-1/+1
Heat is unable to execute the following join when creating the os-net-config definition (OsNetConfigImpl): addresses: - ip_netmask: list_join: - '/' - - {get_param: ControlPlaneIp} - {get_param: ControlPlaneSubnetCidr} In the default network-environment.yaml environment file the ControlPlaneSubnetCidr is defaulted as a non-string "24", e.g. ControlPlaneSubnetCidr: 24 Resulting in the following error, upon deploymnet: 2016-03-30 22:44:17 [overcloud-Controller-wazxxjc6dq22-2-2ictqfdx2nuo]: CREATE_FAILED Resource CREATE failed: resources.NetworkConfig: Property error: resources.OsNetConfigImpl.properties.config: Items to join must be strings not 24 This patch simply updates the default value to '24', to match other templates. This allows a deployment to succeed as expected. Change-Id: I5f75b02dba5c35a9856c6ceff9cf6c24a0cb56d8
2016-03-30Remove hack the pulls latest dockerRyan Hallisey1-13/+0
Atomic is set to Docker 1.8.2. We no longer need to pull the latest Docker to make our template work. Change-Id: I8ab4e135ed4891763f8ced596116b14101466160 Co-Authored-By: Ian Main <imain@redhat.com>
2016-03-30Centos gives /dev/pts/ptmx the wrong permsRyan Hallisey1-0/+3
In order to use cinder, we need to be able to use /dev/pts/ptmx. Centos sets this to 000 when on Fedora it's 666. Change-Id: I76dc5adc64d2da0d27204ea31175244bc1b94428
2016-03-30Enable galera replication for Mariadb 10.1Damien Ciabrini1-0/+2
The generated galera config has to include additional settings for galera to be active on MariaDB 10.1. wsrep_on must be explicitely set to ON. On MariaDB 5.5, this was implicitely set as soon as wsrep_provider was specified. a valid wsrep_cluster_address must be configured in addition to wsrep_on, otherwise recovery command mysqld_safe --wsrep-recover cannot retrieve replication state, and cluster cannot be bootstrapped. These explicit settings are backward compatible with MariaDB 5.5 since the two variables exist in both versions of MariaDB. Change-Id: I4ab4f4eeb8679899f194399ba8695155e9a2f4a5 Closes-Bug: 1563751
2016-03-30Merge "compute: restart OVS agent on neutron.conf changes"Jenkins1-0/+10
2016-03-30Merge "change the default satellite tools rpm repo."Jenkins3-1/+6
2016-03-29Ping retryJoe Talerico1-7/+13
The single ping method in the validation script is causing for deployments to fail. When reviewing the network connectivity, we are finding we actually do have connectivity ( https://gist.github.com/jtaleric/0276a117625e44993be0 ). This patch is to change the ping count from 1 to 10, to ensure the network is up. Closes-Bug: 1563521 Change-Id: I9772407554dffa91978a49a16490ef9ed448a054
2016-03-29compute: restart OVS agent on neutron.conf changesEmilien Macchi1-0/+10
Some options in neutron.conf are used bu OVS agent, like logging & messaging. During the upgrade process, you need to restart the agent if these options change. We could patch puppet-neutron to add a notify, but the community won't like it because Neutron OVS agent is not able to restart gracefully until [1] got merged. Until that, we can fix it in TripleO, where we suppose Puppet runs happenning during bootstraps and upgrades. Later, we'll drop this code from here and move it in puppet-neutron. [1] https://review.openstack.org/#/c/297211 Change-Id: I02b17b66e93331ddfb1a7abd8adff672bc7a32d6 Closes-Bug: #1563437
2016-03-29Merge "PLUMgrid Neutron integration"Jenkins6-3/+176
2016-03-29change the default satellite tools rpm repo.Mike Burns3-1/+6
Change-Id: I60ab36b04b8932e4dbee58e21998dc984178b41c Bugzilla: https://bugzilla.redhat.com/1275281
2016-03-29Merge "Increment step count to include ringbuilder"Jenkins6-42/+44
2016-03-29Merge "Don't restart Pacemaker-managed services from Puppet"Jenkins1-0/+18
2016-03-29Merge "Add quotes around the cinder_iscsi_ip_address value"Jenkins2-2/+10
2016-03-29Don't restart Pacemaker-managed services from PuppetJiri Stransky1-0/+18
We need to reload/restart services on updates/upgrades to apply any config changes, but restarting services managed from Pacemaker from Puppet causes problems. For now we no-op the restart and rely on the catch-all restart after Puppet phase. In the future we should have a service provider for pacemaker resources that will be using pcs. We still might have to restart services outside Puppet due to cluster-wide orchestration issues, but we might be able to do the restarts selectively rather than restart everything. We also no-op the start/stop commands to be safe, as it also doesn't make sense for Puppet to try start and stop those services when it doesn't have knowledge about Pacemaker. Change-Id: I95e21e10471cd7575f28c095c48150325f1414b3 Closes-Bug: #1562922
2016-03-29Merge "Set UpdateIdentifier for upgrade converge, to prevent services down"Jenkins2-6/+4
2016-03-28Merge "Remove password default for AodhPassword"Jenkins2-2/+0
2016-03-25Increment step count to include ringbuilderDan Prince6-42/+44
This patch wires in ringbuilder.pp so that it is always asserted like the other manifests and it fixes the misaligned step sequencing in calling our overcloud controller manifests. Previously it was called as a separate software deployment outside of the hiera step sequence. This made things confusing in controller-post.yaml since the deployment names didn't align with the step hiera variables after step 3. Now that we call it just like the other modules it should make gradually moving this code to puppet-tripleo more straightforward as well. Change-Id: Ibd4f51f65da475bb20a6b08d7bda673f330a5464
2016-03-24Set UpdateIdentifier for upgrade converge, to prevent services downMathieu Bultel2-6/+4
We'd like to let the post puppet pacemaker controller services restart to happen for the convergence step so set the UpdateIdentifier. However also set the PackageUpdate to noop so the yum_update.sh doesn't happen. Since a full haproxy restart is expected, we no longer need the systemctl reload added at Iae3bad745ecdf952a7a0314fe1375d07eb47c454 so remove that too. Some more context at https://bugzilla.redhat.com/show_bug.cgi?id=1321036 Co-Authored-By: marios <marios@redhat.com> Change-Id: I31c2d97d68c97b435f63863fae2c89f18f99681d
2016-03-24Remove password default for AodhPasswordPradeep Kilambi2-2/+0
Change-Id: Ibf37bfd6150d212fadcc4d2e2e2d0a89cdd76c91
2016-03-24Merge "Fix satellite registration for http or https"Jenkins1-4/+5
2016-03-24Merge "Add systemctl reload haproxy to the pacemaker_resource_restart.sh"Jenkins1-0/+6
2016-03-24Merge "Deploy Aodh services, replacing Ceilometer Alarm"Jenkins13-3/+328
2016-03-24Add quotes around the cinder_iscsi_ip_address valueGiulio Fidente2-2/+10
In I783e939ae304385674909bfd9f1cac95e04cef22 we add brackets around the cinder_iscsi_ip_address if IPv6 but that causes hiera to try mapping the value into an array, while it isn't. This change adds quotes around the brackets. Change-Id: Id9bb4b12542f1943e9df702486d68424539c7a59 Closes-Bug: 1560934
2016-03-24Merge "Remove unused user resource."Jenkins1-3/+0
2016-03-24Wire redis_password to the tripleo moduleGiulio Fidente1-0/+1
Without this the HAProxy monitoring for Redis would fail to poll the backends. Change-Id: Id0826c6b04e471844c7bef69480af263cf2b3bd4
2016-03-24Merge "Pass iSCSI bind address in brackets to Cinder when IPv6"Jenkins1-1/+1
2016-03-24Merge "Remove the glance/rbd user name from static hieradata"Jenkins1-1/+0