summaryrefslogtreecommitdiffstats
path: root/docker/services
AgeCommit message (Collapse)AuthorFilesLines
2017-05-05Mount hostpath logs on /var/logFlavio Percoco37-60/+501
Some containers are using the logs named volume for collecting logs written to `/var/log`. We should make this consistent for all the containers. This patch also cleans up some mounts that weren't needed for some services. For example, glance-api doesn't need `/run` to be mounted. Other changes: * Rework log volumes to hostpath mounts to omit slow COW writes. * Add kolla_config's permission and host_prep_tasks create and manage hostpath mounted log dirs permissions. * Rework data owning init containers to kolla_config permissions * When a step wants KOLLA_BOOTSTRAP or DB sync, use logs data owning init containers to set permissions for logs. This is required because kolla bootsrap and DB sync runs before the kolla config stage and there is yet permissions set for logs. * In order to address hybrid cases for host services vs containerized ones to access logs having different UIDs, persist containerized services' logs into separate directories (an upgrade impact) * Ensure host prep tasks to create /var/log/containers/ and /var/lib/ sub-directories for services * Fix missing /etc/httpd, /var/www config-data mounts for zaqar/ironic * Fix YAML indentation and drop strings quotation. Co-authored-by: Bogdan Dobrelya <bdobreli@redhat.com> Partial blueprint containerized-services-logs Change-Id: I53e737120bf0121bd28667f355b6f29f1b2a6b82
2017-05-03Use httpd in Heat docker servicesThomas Herve2-16/+22
This switches heat-api and heat-api-cfn to use httpd in containerized overcloud. Co-Authored-By: Martin André <m.andre@redhat.com> Change-Id: I2fe6e25474279c7c91a69d9df7b28e12b1d8ac00
2017-05-03Merge "Move containers common volumes from yaql to list_concat"Jenkins35-593/+477
2017-05-02Add deprecation notes for panko servicePradeep Kilambi1-1/+3
Change-Id: Ic218a753e0cede2ba3951bcaec843f487dce0c71
2017-05-02Move containers common volumes from yaql to list_concatJuan Antonio Osorio Robles35-593/+477
list_concat was introduced recently and is able to replace the yaql calls for concatenating lists. Change-Id: Id3a80a0e1e4c25b6d838898757c69ec99d0cd826
2017-04-28Merge "Fix redis container"Jenkins1-2/+17
2017-04-27Merge "Add missing tag to nova-placement docker image"Jenkins1-1/+1
2017-04-27Fix redis containerMartin André1-2/+17
The puppet-redis module makes use of the exec puppet tag to copy the /etc/redis.conf.puppet file to /etc/redis.conf. We need to explicitly enable it otherwise our redis container will pick up the default redis configuration and not the one that was generated with puppet. Also creates the /var/run/redis directory on the host since we bind mount /run, and ensure the container sets the correct ownership on the directory. Finally, configure redis to not daemonize otherwise the container ends up in a restart loop. Change-Id: Ia1dce2120ca7479eef8bc77dedf9431adbe210cc Closes-Bug: #1686707
2017-04-27Merge "Fix etcd_init_task volume"Jenkins1-1/+1
2017-04-26Merge "Containerize Redis service"Jenkins1-0/+78
2017-04-26Fix etcd_init_task volumeBogdan Dobrelya1-1/+1
Docker puppet hook writes to /etc of containers. Mount /etc as rw for etcd container. Change-Id: I8e45de18a91022690c19888cbfaa68d2fdfe46ce Signed-off-by: Bogdan Dobrelya <bdobreli@redhat.com>
2017-04-25Merge "Containerize etcd service"Jenkins1-0/+105
2017-04-24Merge "Fix containerized RabbitMQ service deployment"Jenkins1-3/+16
2017-04-24Containerize etcd serviceBogdan Dobrelya1-0/+105
Depends-On: I3ad463217ed3f2d6374627248236b274cfed72fb Depends-On: If4b01934a9a5cb6ca2ff6c1831e4fe073f1b04ea Closes-bug: #1668938 Change-Id: I6cb902d712849bf11f331ed776cd0ed6e200dcd9 Signed-off-by: Bogdan Dobrelya <bdobreli@redhat.com>
2017-04-24Merge "Don't attempt to configure live migration"Jenkins2-2/+18
2017-04-24Fix containerized RabbitMQ service deploymentBogdan Dobrelya1-3/+16
* Use default puppet tags instead of the 'file' tag only * Noop user/policy providers for puppet_config docker step and move them into docker_puppet_tasks (init container) Change-Id: I98a54808aae6fca060b23f074b71178f2d4c815e Closes-bug: #1684138 Signed-off-by: Bogdan Dobrelya <bdobreli@redhat.com>
2017-04-24Merge "Containers: disable downloading rabbitmqadmin"Jenkins1-1/+4
2017-04-21Containerize Redis servicePradeep Kilambi1-0/+78
Closes-bug: #1668919 Change-Id: Ie750caa34c6fa22ca6eae6834b9ca20e15d97f7f
2017-04-21Don't attempt to configure live migrationJiri Stransky2-2/+18
When configuring nova containers via puppet, the puppet class chain includes a class for live migration, which configures live migration aspects in nova and libvirt. Some of the libvirt config parts try to notify Service[libvirt], but that service definition is only included in nova-libvirt service, it's not included in the control plan nova services. However, our hieradata is currently global on the node, it's not per-service, which means even though only nova-compute and nova-libvirt service set tripleo::profile::base::nova::manage_migration: true this hiera setting is applied to all containers running puppet, most notably the ones which configure nova control plane services. As a result, configuration of nova control plane services failed, and in turn the whole deployment failed. This commit disables the libvirt part of live migration config until we implement some better solution (e.g. hieradata separation between different puppet containers, or move the libvirt config parts only to nova-compute manifests in puppet-tripleo). Change-Id: I0328406607d451e6bdce4d92c441c03648925fa7 Closes-Bug: #1684107
2017-04-19Containers: disable downloading rabbitmqadminJiri Stransky1-1/+4
There's no need for puppet to download rabbitmqadmin script from rabbitmq, as the script would be immediately deleted together with the ephemeral puppet container. Also, since rabbitmq isn't running at the time we run the puppet container (rabbitmq doesn't have config files generated at that point), puppet couldn't connect to rabbitmq anyway. Change-Id: Ia59e1013c24ab02037246135024418cc9b674606 Closes-Bug: #1684104
2017-04-19Add missing tag to nova-placement docker imageMartin André1-1/+1
This is not really an issue, but this is now consistent with other images and is generally nicer to people with OCD. Also, this helps generating a consistent overcloud_containers.yaml from parsing the heat templates. Change-Id: I24b41dea51d2a8e862f43e9092c94ba07431af4a
2017-04-19containers: TLS in the internal network for telemetry servicesJuan Antonio Osorio Robles3-0/+57
This covers aodh, gnocchi and panko. cp tls-via-certmonger-containers Change-Id: I6dabb0d82755c28b8940c0baab0e23cfcc587c42
2017-04-19Merge "Introduce common CAs to be mounted to the containers"Jenkins1-0/+5
2017-04-19Merge "Introduce common resources for docker templates"Jenkins36-349/+644
2017-04-19Merge "Use underscore for Aodh and Gnocchi's container names"Jenkins2-4/+4
2017-04-18Merge "Fix nova-compute service name in upgrade steps"Jenkins2-2/+2
2017-04-18Introduce common CAs to be mounted to the containersJuan Antonio Osorio Robles1-0/+5
When TLS is enabled, the containers need to trust the CAs that the host trusts. Change-Id: I0434b0ac10290970857cad3d1a89d00f5b054196
2017-04-18Introduce common resources for docker templatesJuan Antonio Osorio Robles36-349/+644
This enables common resources that the docker templates might need. The initial resource only is common volumes, and two volumes are introduced (localtime and hosts). Change-Id: Ic55af32803f9493a61f9b57aff849bfc6187d992
2017-04-16Revert "Use httpd in Zaqar docker service"Dan Prince1-6/+3
This reverts commit 57a26486128982c9887edd02eb8897045215b10a. Change-Id: I1bbe16a1a7a382ae0c898bd19cd64d3d49aa84c7 Closes-bug: #1683210
2017-04-13Fix nova-compute service name in upgrade stepsJiri Stransky2-2/+2
Previously Ansible upgrade steps failed with: Could not find the requested service nova-compute: cannot disable. Change-Id: I14e8bc89aca0a3f7308d88488b431e23251cc043 Closes-Bug: #1682373
2017-04-13Use underscore for Aodh and Gnocchi's container namesJuan Antonio Osorio Robles2-4/+4
The rest of the services are using underscores, so this helps uniformity. Change-Id: I4ce3cc76f430a19fa08c77b004b86ecad02119ae
2017-04-12Merge "Add upgrade tasks for gnocchi container services"Jenkins3-0/+12
2017-04-12Merge "Use httpd in Zaqar docker service"Jenkins1-3/+6
2017-04-12Merge "Bind mount directories that contain the key/certs for keystone"Jenkins1-0/+17
2017-04-12Bind mount directories that contain the key/certs for keystoneJuan Antonio Osorio Robles1-0/+17
This is only done when TLS-everywhere is enabled, and depends on those directories being exclusive for services that run over httpd. Which is the commit this is on top of. Also, an environment file was added that's similar to environments/docker.yaml. The difference is that this one will contain the services that can run containerized with TLS-everywhere. This file will be updated as more services get support for this. bp tls-via-certmonger-containers Change-Id: I87bf59f2c33de6cf2d4ce0679a5e0e22bc24bf78
2017-04-11docker: use noop_resource for Nova_cell_v2Dan Prince1-1/+4
Per puppet-nova commit 2c743a6bff5b17a85d1e0500f3a9ecb21468204e there is now a custom resource for Nova_cell_v2 configuration. As this resource runs automatically regardless of our use of puppet tags we need to explicitly disable it to be able to generate Nova API configs for docker. Change-Id: Id675dc124464acddc3fc5a88b017a351e93ba685 Closes-bug: #1681841
2017-04-10Add upgrade tasks for gnocchi container servicesPradeep Kilambi3-0/+12
Change-Id: I43c35bbf959e5dcdd7e87a8f6a604d5fe5b4f2a9
2017-04-06Merge "Use kolla api to set ownership"Jenkins2-21/+10
2017-04-05Ironic containers: chown /var/lib/ironic correctlyDan Prince1-4/+1
This updates the docker version of ironic-conductor.yaml so that it sets permissions on the entire /var/lib/ironic tree correctly. Since 1a4ece16cea40075fe7332ed048b9c289b3ff424 we bind mount in /var/lib/ironic from the host (created via Ansible if it didn't already exist). This caused a subtle permissions issue in that the Ironic conductor service can no longer create sub-directories it needs to operate. Change-Id: I1eb6b5ddad7cd89ee887e2e429ebe245aa7b80dc Closes-bug: 1677086
2017-04-05Use httpd in Zaqar docker serviceThomas Herve1-3/+6
Move the Zaqar WSGI service to use httpd in docker deployment. Co-Authored-By: Martin André <m.andre@redhat.com> Change-Id: If9b16c1aa3529386e68961e3dda5f613ac57b44b
2017-04-05Use kolla api to set ownershipMartin André2-21/+10
Kolla provides a way to set ownership of files and directory inside the containers. Use it instead of running an additional container to do the job. Change-Id: I554faf7c797f3997dd3ca854da032437acecf490
2017-04-04Merge "Remove kolla_config copy from services"Jenkins36-473/+133
2017-04-03Remove kolla_config copy from servicesMartin André36-473/+133
Simplify the config of the containerized services by bind mounting in the configurations instead of specifying them all in kolla config. This is change is useful to limit the side effects of generating the config files and running the container is two separate steps as config directories are now bind-mounted inside the container instead of having files being copied to the container. We've seen examples of Apache's mod_ssl configuration file present on the container preventing it to start when puppet configured apache not to load the ssl module (in case TLS is disabled). Co-Authored-By: Ian Main <imain@redhat.com> Change-Id: I4ec5dd8b360faea71a044894a61790997f54d48a
2017-03-30Output service_metadata_settings in docker services.yamlJuan Antonio Osorio Robles1-0/+2
This output gets nova metadata into the servers this is deployed to and is necessary for the TLS-everywhere work. bp tls-via-certmonger-containers Change-Id: Iff54f7af9c63a529f88c6455047f6584d29154b4
2017-03-28Allow to configure policy.json for OpenStack projectsEmilien Macchi1-1/+1
For both containers and classic deployments, allow to configure policy.json for all OpenStack APIs with new parameters (hash, empty by default). Example of new parameter: NovaApiPolicies. See environments/nova-api-policy.yaml for how the feature can be used. Note: use it with extreme caution. Partial-implement: blueprint modify-policy-json Change-Id: I1144f339da3836c3e8c8ae4e5567afc4d1a83e95
2017-03-27Remove kolla_config copy from keystone service.Ian Main1-47/+3
Simplify the config of the keystone service by mounting in the configurations instead of specifying them all in kolla config. This is change is useful to limit the side effects of generating the config files and running the container is two separate steps as config directories are now bind-mounted inside the container instead of having files being copied to the container. We've seen examples of Apache's mod_ssl configuration file present on the container preventing it to start when puppet configured apache not to load the ssl module (in case TLS is disabled). Co-Authored-By: Martin André <m.andre@redhat.com> Change-Id: Ie33ffc7c2b1acf3e4e505d38efb104bf013f2ce6
2017-03-27Merge "Run nova-api hosts discovery after nova-compute start"Jenkins1-1/+2
2017-03-27docker/keystone: Bind mount entire fernet keys repositoryJuan Antonio Osorio Robles1-10/+5
Previously only the first two intial fernet keys were mounted into the container. This is not practical, however, as doing key rotation will generate more entries in this repository. So instead we mount the whole directory, which would allow us to do rotation in the base host and seamlessly affect the container as well. Change-Id: I7763a09e57fe6a7867ffd079ab0b9222374c38c8
2017-03-26Merge "docker/keystone: Actually set fernet as the default token provider"Jenkins1-1/+1
2017-03-25Merge "Rework container volumes as hostpath mounts"Jenkins4-3/+15