aboutsummaryrefslogtreecommitdiffstats
path: root/docker/services
AgeCommit message (Collapse)AuthorFilesLines
2017-09-13Merge "Enable redis TLS proxy in HA deployments" into stable/pikeJenkins1-26/+67
2017-09-13Merge "Add CephConfigOverrides to allow arbitrary configs in ceph.conf" into ↵Jenkins2-11/+19
stable/pike
2017-09-13Merge "Enable selinux in containers" into stable/pikeJenkins1-0/+1
2017-09-13Merge "Add verbose output to containerized cell_v2 host discovery" into ↵Jenkins1-1/+1
stable/pike
2017-09-12Add CephConfigOverrides to allow arbitrary configs in ceph.confGiulio Fidente2-11/+19
We need to reuse the ceph_conf_overrides structure provided by ceph-ansible for both user provided configs and TripleO managed configs. This change merges the special user facing parameter with the TripleO generated configs. Also adds osd_scenario and osd_objectstore params for compatibility with newer ceph-ansible versions. Change-Id: I29c689c6c689590da5b6a3f581fdbec98a52e207 Closes-Bug: #1715321 (cherry picked from commit 32bc2abf14af4ca1449e18b848e2be3cff013987)
2017-09-12Merge "Add panko config to ceilometer notification agent container" into ↵Jenkins1-0/+9
stable/pike
2017-09-12Merge "Persist containerized services httpd logs" into stable/pikeJenkins18-22/+118
2017-09-11Enable selinux in containersOliver Walsh1-0/+1
We cannot use the --selinux-enabled docker daemon option on CentOS/RHEL 7.3. It will fail if security_inode_copy_up is not found in the kernel symbols: https://github.com/projectatomic/docker/blob/docker-1.12.6/daemon/daemon_unix.go#L661 NB this has been reduced to a warning upstream: https://github.com/moby/moby/commit/885b29df096db1d6746ece4b3a298a1ffe85716d Instead this just bind mounts /sys/fs/selinux in containers-common.yaml. Everything appears to work at initial glance. Pingtest succeeds, and live-migration between baremetal and containerized computes works. Change-Id: I018221bf7ae9ab9ece193b55f1ce31eb1591046c Closes-bug: #1715171 (cherry picked from commit 520f889a31f1ea6ee2bad86d1dbb3c0435604d10)
2017-09-11Add verbose output to containerized cell_v2 host discoveryOliver Walsh1-1/+1
Required to debug issues. Change-Id: I4d86c8d9ecc353a916475977eb6f2d842c812556 (cherry picked from commit dc64a1108e7bc23f92d77e75001fb42549731e3b)
2017-09-11Add panko config to ceilometer notification agent containerPradeep Kilambi1-0/+9
Without this, ceilometer notification agent cant find panko and skips posting events to it. Change-Id: Ibfeef5c557d1ceb11a999aa947597014ca94ec34 (cherry picked from commit 5437086ee744469b9daf8cd9edd600f7aa98dde6)
2017-09-11Enable redis TLS proxy in HA deploymentsMartin André1-26/+67
Redis does not have TLS out of the box. Let's use a proxy container for TLS termination. This commit enables redis TLS proxy for the HA deployment. bp tls-via-certmonger Change-Id: I45e539872a03878337def33c681c4577c1a5629e (cherry picked from commit c6d8df01d7aa8b44af9ac152b3bb08f07e2e02b7)
2017-09-11Merge "Add defaults for ceilometer-agent-compute upgrade tasks" into stable/pikeJenkins1-3/+3
2017-09-11Merge "Enable Ceilometer agent logging for containers" into stable/pikeJenkins3-3/+20
2017-09-11Merge "Add Neutron SR-IOV agent container" into stable/pikeJenkins1-0/+108
2017-09-11Persist containerized services httpd logsBogdan Dobrelya18-22/+118
Store the httpd logs under dedicated /var/log/containers/httpd/ paths. Additionally, add release notes describing upgrade impact for containerized services logs. Closes-bug: #1700045 Change-Id: I8120c56f2315700862bd0f708b8baa8910275b09 Signed-off-by: Bogdan Dobrelya <bdobreli@redhat.com> (cherry picked from commit 287e84585ca9170570ce8d06eebd7f9a3ec3345c)
2017-09-11Enable Ceilometer agent logging for containersPradeep Kilambi3-3/+20
Change-Id: Ibeb28d7c497b02253d00a74257989cefba2b0cc4 (cherry picked from commit fc44ee6ff3553754c618349df3be7544b17e9c5f)
2017-09-11Add defaults for ceilometer-agent-compute upgrade tasksMarius Cornea1-3/+3
This change allows the upgrade non controller script, which loops throug all steps, to complete by adding default values to be evaluated in the steps where the vars are not registered. Closes-Bug: 1715574 Change-Id: Ic056fc556240d1acc9f28a75f63c7628cc64da03 (cherry picked from commit d109c1d7a7d2f6302c39369de8a601bc0b2f6704)
2017-09-08Mount vhost_sockets directory for vhost-user socket creationSaravanan KR1-0/+25
For DPDK, vhost-user sockets are created on the host at /var/lib/vhost_sockets directory, which will be used by libvirt and openvswitch. This directory has the necessary permissions and SELinux policies. Mount this folder for libvirt container. Change-Id: Id8be208d1b05886ac45dfdcf48fe766ee5724d1c Partial-Bug: #1712732 (cherry picked from commit 3ea04744c22ae4cd2e1f2b77fc7d5ade012899e0)
2017-09-07Merge "Add tags in upgrade_tasks for mongodb services." into stable/pikeJenkins1-0/+1
2017-09-07Merge "Add CephExternal role for ceph-ansible" into stable/pikeJenkins1-0/+66
2017-09-07Merge "Support HA for OVN DBs containers using pacemaker bundle" into ↵Jenkins1-0/+140
stable/pike
2017-09-07Add tags in upgrade_tasks for mongodb services.Jose Luis Franco Arza1-0/+1
Patch Ie09ce2a52128eef157e4d768c1c4776fc49f2324 added a new set of upgrade tasks which were missing the 'tags' keyword. Closes-Bug: 1715631 Change-Id: Ib1c1aadfbf58c9bccc18667934c8b3c5f38fafa4 (cherry picked from commit 7897d38274cb6435289bc4f4928f96b111e5b4f4)
2017-09-07Add Neutron SR-IOV agent containerBrent Eagles1-0/+108
This patch adds support for running the neutron SR-IOV agent in a container. Depends-On: I4a63845a97c890d7d408731ec5509c320289f18f Depends-On: Ie5d8cd7863c0d042cc6a4e1fc52602d8a03a1935 Depends-On: I1b5ab0a64ae1f5735f1bd5a68e6ae8bdcf47ddec Closes-Bug: #1715388 Change-Id: I7ee603b32eddacd02d846dff00dd1b786d4a7ad9 (cherry picked from commit 94c9c2f954e85de0ab895926a969587b90bc4191)
2017-09-07Add CephExternal role for ceph-ansibleGiulio Fidente1-0/+66
Previously it was only possible to configure the overcloud with an external Ceph cluster via puppet-ceph-external. This submission adds a CephExternal implementation which uses ceph-ansible. Change-Id: Id0d375f88e27e91e9d89f25a0cd7388b6e45df8b Depends-On: Ifc57c9cf6ca8017a2abc78d6320c0675ad49ca9f Closes-Bug: #1714271 (cherry picked from commit 01e55c314de74579196518d958bf5be30e390409)
2017-09-07Add support for deploying RGW with ceph-ansibleKeith Schincke2-0/+116
This patch allows usage of ceph-ansible to configure the RGW service in the overcloud. Still uses puppet-keystone to create the necessary user and endpoint in the catalog. Co-Authored-By: Giulio Fidente <gfidente@redhat.com> Change-Id: Iafa17bb64c54e40350b2ba7d76dea3d82fcab0e4 (cherry picked from commit 5b3cd1dcacff408bcb482bdea6cded8755a39ebb)
2017-09-07Merge "Containerized mongodb, disable by default, fix upgrade" into stable/pikeJenkins1-0/+4
2017-09-06Merge "Mount folders and log file" into stable/pikeJenkins1-2/+13
2017-09-06Merge "Mount public certificate in haproxy init container" into stable/pikeJenkins1-0/+1
2017-09-06Merge "Unset default value for the DockerCephDaemonImage" into stable/pikeJenkins1-1/+0
2017-09-06Merge "TLS proxy for redis" into stable/pikeJenkins1-23/+64
2017-09-06Mount public certificate in haproxy init containerJuan Antonio Osorio Robles1-0/+1
It's being mounted on the actual haproxy container, but not the init one. Change-Id: I66b69e0bb3642dbfeec767ef5216d515786b5b19 Closes-Bug: #1715132 (cherry picked from commit 03622e89ac3037b4d69d913586823e689b210688)
2017-09-06Mount folders and log fileJanki Chhatbar1-2/+13
journal and snapshots folders hold data needed for update. This patch mounts these folders and adds ODL log file in /var/log/containers/opendaylight Change-Id: I65c6183c2867b2ced6e6ef25896d80154857b7dc Closes:Bug: #1714231 (cherry picked from commit 81dd0808d2a180d108f1159bc67f345fe6bf27d4)
2017-09-06Merge "Escape ceph capabilities for manila client" into stable/pikeJenkins1-1/+1
2017-09-06Unset default value for the DockerCephDaemonImageGiulio Fidente1-1/+0
We do not want a default value for the container image name parameters and expect deployers to set this value instead. Change-Id: I9377b7c3564360353aa6da2d2457b2cfacd4e9d6 Closes-Bug: #1714221 (cherry picked from commit fcc3259891ee67956d63c37217acdb999bc4bb65)
2017-09-06TLS proxy for redisMartin André1-23/+64
Redis does not have TLS out of the box. Let's use a proxy container for TLS termination. bp tls-via-certmonger Co-Authored-By: Juan Antonio Osorio Robles <jaosorior@redhat.com> Change-Id: Ie2ae0d048a71e1b1b4edb10c74bc0395a1a9d5c9 Depends-On: I078567c831ade540cf704f81564e2b7654c85c0b Depends-On: Ia50933da9e59268b17f56db34d01dcc6b6c38147 (cherry picked from commit c2a93cf4c5d9d6b5ee0536380751a7a9540927cc)
2017-09-06Containerized mongodb, disable by default, fix upgradeSteve Baker1-0/+4
This change removes the entry to containerise docker by default because it should now be disabled since the change Id2e6550fb7c319fc52469644ea022cf35757e0ce. Removing the entry means the default mapping to mongodb-disabled.yaml takes effect. This change also modifies the upgrade_tasks so that the mongod service is only disabled when the service exists. There appears to be upgrade scenarios which fail because mongodb was never installed in the first place. Change-Id: Ie09ce2a52128eef157e4d768c1c4776fc49f2324 Closes-Bug: #1715031 (cherry picked from commit cb81cbe3b5f3887f5d690c590e52b728f74d43c3)
2017-09-06Escape ceph capabilities for manila clientJan Provaznik1-1/+1
Capabilities were not properly escaped and ignored by ceph. Change-Id: I099c3d9bad95ec69ac85fe406e3e1d4685ede439 Closes: #1713928
2017-09-06Allow upgrade tasks to run when looping through stepsMarius Cornea1-2/+2
Currently for non controller upgrades we're looping through the upgrade steps and run the upgrade tasks based on when conditionals including the step number and the existing upgrade task condition. Some of tasks fail because the variables used in when conditionals are not available through all steps. This change adds default values to these vars where possible or creates them for all steps to avoid failures. Related-Bug: 1708115 Change-Id: I5c731043cec8e31fc82ca98972a301baa7294c4f (cherry picked from commit e2f00ef1dc98140087c81e202a520f549f9a0970)
2017-09-04Merge "Manually set healthchecks for _cron services" into stable/pikeJenkins4-0/+8
2017-09-04Merge "Fix containerized zaqar-api db_sync" into stable/pikeJenkins1-1/+2
2017-09-03Fix containerized zaqar-api db_syncBogdan Dobrelya1-1/+2
Correct the zaqar service name to match the bootstrap host id name Closes-bug: #1714253 Change-Id: Iced8f3a7e64d9023bd46a50629a56e087d1f6f24 Signed-off-by: Bogdan Dobrelya <bdobreli@redhat.com> (cherry picked from commit d782f687cb7794e0491c0d0f6dc3d9b28196dc96)
2017-09-02Separate config_volume for ringbuilderJames Slagle1-3/+20
Use a separate config_volume for swift_ringbuilder puppet_config tasks. This is necessary so that the swift_ringbuilder and swift-storage services don't both rsync files to the same bind mounted directory. The rsync command from docker-puppet.py uses --delete-after, so when they both use the same config_volume, they can end up deleting the files generated by the other (depending on the order of execution). Even though a separate config_volume is used, the rings must still end up in /etc/swift for the swift services containers. An additional container init task is used to copy the ring files into /var/lib/config-data/puppet-generated/swift/etc/swift so that they will be present when the actual swift services containers are started. Change-Id: I05821e76191f64212704ca8e3b7428cda6b3a4b7 Closes-Bug: #1710952 (cherry picked from commit cba00abb7517efa6a8d9b8fb954563204323ffed)
2017-09-02Manually set healthchecks for _cron servicesDan Prince4-0/+8
The docker _cron services show up as (unhealthy) due to them sharing the containers for the OpenStack services. As such we need to manually override the health checks for these services. By setting them to /bin/true the services should show up has healthy. Change-Id: I46e12bcec226fbe2768c7fe8f0e7719df46401a9 Closes-bug: #1713183 (cherry picked from commit d1aaf0aadf487ccfcdecb47f3cfbf6087401242b)
2017-09-01Merge "Add --wsrep-provider=none to the mysql_bootstrap container" into ↵Jenkins1-2/+2
stable/pike
2017-08-31Remove puppet run and workarounds from tripleo_upgrade_node.shmarios2-1/+22
For bug 1708115 and the O..P upgrade, and for the upgrade of 'non-controlers' we are now generating ansible playbooks from collected service upgrade_tasks and these are executed instead of the legacy tripleo_upgrade_node.sh. To clarify, by 'non-controllers' it is meant any node for which the corresponding roles_data.yaml role has the disable_upgrade_deployment flag set True. As a first pass, I am removing the workarounds from the script but keeping its delivery mechanism for now in case it is needed still. We can either update here to remove it or keep it until next cycle The most important part for now is that we no longer 'manually' run puppet here. Instead the post_deploy_steps are also collected into a playbook and will be executed after the upgrade_tasks (see the bug for discussion of the mechanism and related reviews) Change-Id: Ib017b0ab435ca9558cf8659d434489cdf01df955 Related-Bug: 1708115 (cherry picked from commit 4c5b9c5c967105536106fa4a7e1ec2352b14b08c)
2017-08-31Add --wsrep-provider=none to the mysql_bootstrap containerMichele Baldessari1-2/+2
Depending on the version of mariadb/galera installed the mysql_bootstrap command might fail. With the following unrevealing error: openstack-mariadb-docker:2017-08-28.10 "bash -ec 'if [ -e /v" 3 hours ago Exited (124) 3 hours ago The timeout is actually due to the fact that the following snippets does not complete within 60 seconds: """ if [ -e /var/lib/mysql/mysql ]; then exit 0; fi kolla_start mysqld_safe --skip-networking --wsrep-on=OFF & timeout ${DB_MAX_TIMEOUT} /bin/bash -c ''until mysqladmin -uroot -p"${DB_ROOT_PASSWORD}" ping 2>/dev/null; do sleep 1; done'' mysql -uroot -p"${DB_ROOT_PASSWORD}" -e "CREATE USER ''clustercheck''@''localhost'' IDENTIFIED BY '${DB_CLUSTERCHECK_PASSWORD}'';" mysql -uroot -p"${DB_ROOT_PASSWORD}" -e "GRANT PROCESS ON *.* TO ''clustercheck' """ The problem is that with older mariadb versions: galera-25.3.16-3.el7ost.x86_64 mariadb-5.5.56-2.el7.x86_64 The mysqld_safe process starts in galera mode (as opposed as to single local mode): 170830 17:03:05 [Note] WSREP: Start replication 170830 17:03:05 [Note] WSREP: GMCast version 0 ... 170830 17:03:05 [ERROR] WSREP: wsrep::connect() failed: 7 170830 17:03:05 [ERROR] Aborting That means that even though we specified --wsrep-on=OFF it is still starting in cluster mode. Let's add the extra --wsrep-provider=none which older versions required. Let's also add a '-x' to this transient container as that would have helped a bit because we would have understood right away that it was mysqld_safe that was not starting. I tested this successfully on an environment that showed the problem. The new option is still accepted by newer DB versions in any case. Closes-Bug: #1714057 Change-Id: Icf67fd2fbf520e8a62405b4d49e8d5169ff3925b Co-Authored-By: Mike Bayer <mbayer@redhat.com> (cherry picked from commit c19968ca852ab608513fe692aab958af25276220)
2017-08-31Support HA for OVN DBs containers using pacemaker bundleNuman Siddique1-0/+140
ovn-dbs pacemaker bundle resources are created for supporting Master/Slave HA. puppet-tripleo already supports creating ovn-dbs bundle resources. The heat template added in this patch makes use of this. Closes-bug: #1699085 Change-Id: I23c2d312cfb144f9afc14f0982a92670dc29d74c (cherry picked from commit 444a39f5983e71e3222b6b7f8f523fce60aeece7)
2017-08-31Merge "Remove src_ceph from manila kolla_config" into stable/pikeJenkins1-5/+0
2017-08-31Merge "Use switch to containers instead of take over playbook for ↵Jenkins1-1/+2
ceph-ansible" into stable/pike
2017-08-30container ovs-agent, ensure br-ex existsSteve Baker1-0/+31
Currently the container neutron-ovs-agent is stuck in a restart loop in many environments because the bridge br-ex is missing. This bridge is created by running the puppet class neutron::agents::ml2::ovs but limiting that run to tag neutron::plugins::ovs::bridge. The hiera neutron::agents::ml2::ovs::bridge_mappings should already exists to create the bridge with the required settings. This change should ensure br-ex exists after step 3. Since br-ex is created regardless of the chosen network config, environments/docker-network.yaml is not longer required. It can be deleted once there are no more references to it in CI and documentation. Change-Id: Ie425148b0ad0f38e149c5fa0a97d98ec35d0a5bb Closes-Bug: #1699261 Closes-Bug: #1691403 Closes-Bug: #1689556 (cherry picked from commit 76f130d6e8f7434433b2602af9794f1e9c742e1f)