summaryrefslogtreecommitdiffstats
path: root/docker
AgeCommit message (Collapse)AuthorFilesLines
2017-05-17Consolidate writing json configs with HostPrepTasksSteven Hardy2-98/+56
We already have an ansible deployment that applies the per-service host_prep_tasks, so we can simplify the dependencies here by just doing the docker-steps host preparation at the same time. The motivation behind this is to both simplify the depends_on web we have here, reduce the number of discrete deployments, and also to potentially make running ansible directly e.g for debugging easier. In a future patch we'll convert the configuration steps to work in a similar way, such that they can be more easily reapplied e.g for rolling minor updates, possibly outside of heat. Change-Id: I9a201fc5a9e82c7fba4c2de36eb5332e21a81d37
2017-05-17Merge "Containerize Ceilometer Agents"Jenkins3-0/+317
2017-05-16Containerize Ceilometer AgentsPradeep Kilambi3-0/+317
Depends-on: I30ba93f76171e5993b5f0e1d7f1f5533acb25740 Closes-bug: #1668925 Change-Id: I3cb61d2d8765f9c2601bb00c4bfa24162883b96a
2017-05-16Use neutron-server image for neutron servicesJuan Antonio Osorio Robles5-7/+14
For TLS everywhere, neutron-server needs httpd in the image, since it'll use a separate container that runs a TLS proxy to terminate the connection. This requires the image where the configuration is ran to have httpd installed, since there are several directories and the user/group that's needed. So, we then switch the image to be used to be neutron-server instead of the openvswitch-agent image. Change-Id: Ie16de3004925b7624f106d6c015ec04ef6031a06 Depends-On: I82f10ac0e7e692e6ba4a06dc10da9eaf79c60e7e
2017-05-15Add missing type for RoleParameters parameterMartin André42-1/+42
This was forgotten in I72376a803ec6b2ed93903cc0c95a6ffce718b6dc and broke containerized deployment. Change-Id: I599a87bf06efbfefd3067c77ed6ca866505900f9 Closes-Bug: #1690870
2017-05-15Add role specific information to the service templateSaravanan KR43-0/+387
When a service is enabled on multiple roles, the parameters for the service will be global. This change enables an option to provide role specific parameter to services and other templates. Two new parameters - RoleName and RoleParameters, are added to the service template. RoleName provides the role name of on which the current instance of the service is being applied on. RoleParameters provides the list of parameters which are configured specific to the role in the environment file, like below: parameters_default: # Default value for applied to all roles NovaReservedHostMemory: 2048 ComputeDpdkParameters: # Applied only to ComputeDpdk role NovaReservedHostMemory: 4096 In above sample, the cluster contains 2 roles - Compute, ComputeDpdk. The values of ComputeDpdkParameters will be passed on to the templates as RoleParameters while creating the stack for ComputeDpdk role. The parameter which supports role specific configuration, should find the parameter first in in the RoleParameters list, if not found, then the default (for all roles) should be used. Implements: blueprint tripleo-derive-parameters Change-Id: I72376a803ec6b2ed93903cc0c95a6ffce718b6dc
2017-05-12Merge "docker/internal TLS: spawn extra container for glance API's TLS proxy"Jenkins1-9/+38
2017-05-12Merge "docker/internal TLS: spawn extra container for swift's TLS proxy"Jenkins1-19/+47
2017-05-12docker/internal TLS: spawn extra container for glance API's TLS proxyJuan Antonio Osorio Robles1-9/+38
This spawns an extra container that runs httpd to run the TLS proxy that will go in front of glance-api. bp tls-via-certmonger-containers Change-Id: If902ac732479832b9aa3e4a8d063b5be68a42a9b
2017-05-12docker/internal TLS: spawn extra container for swift's TLS proxyJuan Antonio Osorio Robles1-19/+47
This spawns an extra container that runs httpd to run the TLS proxy that will go in front of swift. bp tls-via-certmonger-containers Depends-On: Ib01137cd0d98e6f5a3e49579c080ab18d8905b0d Change-Id: I9639af8b46b8e865cc1fa7249bf1d8b1b978adfe
2017-05-11Merge "Make docker-puppet.sh a static file."Jenkins1-21/+22
2017-05-10Merge "Use httpd in Zaqar docker service"Jenkins1-3/+5
2017-05-10Merge "Containers: Bind mount directories with the key/certs for heat"Jenkins2-0/+32
2017-05-10Make docker-puppet.sh a static file.Steve Baker1-21/+22
Variables are now passed in with --env in the docker run call. This will allow docker-puppet.sh to be baked into the image instead of having it as a custom entrypoint. Change-Id: Icbaefe033becc6b2226535f28ee202917bdc1074
2017-05-09Use httpd in Zaqar docker serviceDan Prince1-3/+5
Move the Zaqar WSGI service to use httpd in docker deployment. Depends-On: I35cfd1c2320eb972890b44668c8f9f0a047a65dc Change-Id: I56a6469a9179b5c023738f447e7665d0d3c73d0b Co-Authored-By: Martin André <m.andre@redhat.com> Co-Authored-By: Thomas Herve <therve@redhat.com>
2017-05-08Containers: Bind mount directories with the key/certs for heatJuan Antonio Osorio Robles2-0/+32
This is only done when TLS-everywhere is enabled, and depends on those directories being exclusive for services that run over httpd. bp tls-via-certmonger-containers Change-Id: I194c33992c7f3628f7858ecf5e472ecfdee969ed
2017-05-08Add syslog socket to common containers volumesBogdan Dobrelya1-0/+2
Partial blueprint containerized-services-logs Change-Id: Idbf1884226503aca9072b12d050500af407973cf Signed-off-by: Bogdan Dobrelya <bdobreli@redhat.com>
2017-05-05Mount hostpath logs on /var/logFlavio Percoco37-60/+501
Some containers are using the logs named volume for collecting logs written to `/var/log`. We should make this consistent for all the containers. This patch also cleans up some mounts that weren't needed for some services. For example, glance-api doesn't need `/run` to be mounted. Other changes: * Rework log volumes to hostpath mounts to omit slow COW writes. * Add kolla_config's permission and host_prep_tasks create and manage hostpath mounted log dirs permissions. * Rework data owning init containers to kolla_config permissions * When a step wants KOLLA_BOOTSTRAP or DB sync, use logs data owning init containers to set permissions for logs. This is required because kolla bootsrap and DB sync runs before the kolla config stage and there is yet permissions set for logs. * In order to address hybrid cases for host services vs containerized ones to access logs having different UIDs, persist containerized services' logs into separate directories (an upgrade impact) * Ensure host prep tasks to create /var/log/containers/ and /var/lib/ sub-directories for services * Fix missing /etc/httpd, /var/www config-data mounts for zaqar/ironic * Fix YAML indentation and drop strings quotation. Co-authored-by: Bogdan Dobrelya <bdobreli@redhat.com> Partial blueprint containerized-services-logs Change-Id: I53e737120bf0121bd28667f355b6f29f1b2a6b82
2017-05-03Use httpd in Heat docker servicesThomas Herve2-16/+22
This switches heat-api and heat-api-cfn to use httpd in containerized overcloud. Co-Authored-By: Martin André <m.andre@redhat.com> Change-Id: I2fe6e25474279c7c91a69d9df7b28e12b1d8ac00
2017-05-03Merge "Move containers common volumes from yaql to list_concat"Jenkins35-593/+477
2017-05-02Add deprecation notes for panko servicePradeep Kilambi1-1/+3
Change-Id: Ic218a753e0cede2ba3951bcaec843f487dce0c71
2017-05-02Move containers common volumes from yaql to list_concatJuan Antonio Osorio Robles35-593/+477
list_concat was introduced recently and is able to replace the yaql calls for concatenating lists. Change-Id: Id3a80a0e1e4c25b6d838898757c69ec99d0cd826
2017-05-02Improve logging for docker-puppet.pyBogdan Dobrelya1-36/+50
Log prepared docker command Use logger stdout instead of print command Log stderr as debug as well Change-Id: I3d48fbf4fa3381d325e3be3788b041e06d4bb294 Signed-off-by: Bogdan Dobrelya <bdobreli@redhat.com>
2017-04-28Merge "Fix redis container"Jenkins1-2/+17
2017-04-27Merge "Add missing tag to nova-placement docker image"Jenkins1-1/+1
2017-04-27Fix redis containerMartin André1-2/+17
The puppet-redis module makes use of the exec puppet tag to copy the /etc/redis.conf.puppet file to /etc/redis.conf. We need to explicitly enable it otherwise our redis container will pick up the default redis configuration and not the one that was generated with puppet. Also creates the /var/run/redis directory on the host since we bind mount /run, and ensure the container sets the correct ownership on the directory. Finally, configure redis to not daemonize otherwise the container ends up in a restart loop. Change-Id: Ia1dce2120ca7479eef8bc77dedf9431adbe210cc Closes-Bug: #1686707
2017-04-27Merge "Fix etcd_init_task volume"Jenkins1-1/+1
2017-04-26Merge "Containerize Redis service"Jenkins1-0/+78
2017-04-26Fix etcd_init_task volumeBogdan Dobrelya1-1/+1
Docker puppet hook writes to /etc of containers. Mount /etc as rw for etcd container. Change-Id: I8e45de18a91022690c19888cbfaa68d2fdfe46ce Signed-off-by: Bogdan Dobrelya <bdobreli@redhat.com>
2017-04-25Merge "Fix dependencies for PreConfig/PostConfig resources"Jenkins1-17/+6
2017-04-25Merge "Containerize etcd service"Jenkins1-0/+105
2017-04-25Fix dependencies for PreConfig/PostConfig resourcesSteven Hardy1-17/+6
We have a circular dependency errror since https://review.openstack.org/#/c/452734/ landed. This adjusts the dependencies to ensure we run pre-config before the first puppet deploy step, and removes the duplicate declaration of the ControllerPostConfig resource. Also we ensure the first container step always depends on the same step puppet deploy. Change-Id: I70c5a39fb36b951bdeb04c15bddac7d00eebf08a Closes-Bug: #1686098
2017-04-24Merge "Merge pre|post puppet resources into pre|post config."Jenkins1-4/+4
2017-04-24Merge "Fix containerized RabbitMQ service deployment"Jenkins1-3/+16
2017-04-24Containerize etcd serviceBogdan Dobrelya1-0/+105
Depends-On: I3ad463217ed3f2d6374627248236b274cfed72fb Depends-On: If4b01934a9a5cb6ca2ff6c1831e4fe073f1b04ea Closes-bug: #1668938 Change-Id: I6cb902d712849bf11f331ed776cd0ed6e200dcd9 Signed-off-by: Bogdan Dobrelya <bdobreli@redhat.com>
2017-04-24Merge "Don't attempt to configure live migration"Jenkins2-2/+18
2017-04-24Merge pre|post puppet resources into pre|post config.Carlos Camacho1-4/+4
The [Pre|Post]Puppet resources were renamed in https://review.openstack.org/#/c/365763. This was intended for having a pre/post deployment steps using an agnostic name instead of being attached to a technology. The renaming was unintentionally reverted in https://review.openstack.org/#/c/393644/ and https://review.openstack.org/#/c/434451. This submission merge both resources into one, and remove the old pre|post hooks. Closes-bug: #1669756 Change-Id: Ic9d97f172efd2db74255363679b60f1d2dc4e064
2017-04-24Fix containerized RabbitMQ service deploymentBogdan Dobrelya1-3/+16
* Use default puppet tags instead of the 'file' tag only * Noop user/policy providers for puppet_config docker step and move them into docker_puppet_tasks (init container) Change-Id: I98a54808aae6fca060b23f074b71178f2d4c815e Closes-bug: #1684138 Signed-off-by: Bogdan Dobrelya <bdobreli@redhat.com>
2017-04-24Merge "Containers: disable downloading rabbitmqadmin"Jenkins1-1/+4
2017-04-21Containerize Redis servicePradeep Kilambi1-0/+78
Closes-bug: #1668919 Change-Id: Ie750caa34c6fa22ca6eae6834b9ca20e15d97f7f
2017-04-21Don't attempt to configure live migrationJiri Stransky2-2/+18
When configuring nova containers via puppet, the puppet class chain includes a class for live migration, which configures live migration aspects in nova and libvirt. Some of the libvirt config parts try to notify Service[libvirt], but that service definition is only included in nova-libvirt service, it's not included in the control plan nova services. However, our hieradata is currently global on the node, it's not per-service, which means even though only nova-compute and nova-libvirt service set tripleo::profile::base::nova::manage_migration: true this hiera setting is applied to all containers running puppet, most notably the ones which configure nova control plane services. As a result, configuration of nova control plane services failed, and in turn the whole deployment failed. This commit disables the libvirt part of live migration config until we implement some better solution (e.g. hieradata separation between different puppet containers, or move the libvirt config parts only to nova-compute manifests in puppet-tripleo). Change-Id: I0328406607d451e6bdce4d92c441c03648925fa7 Closes-Bug: #1684107
2017-04-21Merge "Use -net=host for docker-puppet.py config gen"Jenkins1-0/+4
2017-04-21Merge "Add defaults for docker puppet tasks"Jenkins1-4/+10
2017-04-20Add defaults for docker puppet tasksSteven Hardy1-4/+10
Currently we're referencing some steps that don't exist in the output from the OS::Heat::Value resource, but as noted in the heat bug #1681749 I think this isn't valid and probably should not be allowed, so instead merge defaults with the non-empty step tasks. To avoid further duplication of the loop variables, I made the max step a variable. Change-Id: Icf3d639b53c97006a0c370c12600449fba6f3323 Related-Bug: #1681749
2017-04-19Containers: disable downloading rabbitmqadminJiri Stransky1-1/+4
There's no need for puppet to download rabbitmqadmin script from rabbitmq, as the script would be immediately deleted together with the ephemeral puppet container. Also, since rabbitmq isn't running at the time we run the puppet container (rabbitmq doesn't have config files generated at that point), puppet couldn't connect to rabbitmq anyway. Change-Id: Ia59e1013c24ab02037246135024418cc9b674606 Closes-Bug: #1684104
2017-04-19Add missing tag to nova-placement docker imageMartin André1-1/+1
This is not really an issue, but this is now consistent with other images and is generally nicer to people with OCD. Also, this helps generating a consistent overcloud_containers.yaml from parsing the heat templates. Change-Id: I24b41dea51d2a8e862f43e9092c94ba07431af4a
2017-04-19containers: TLS in the internal network for telemetry servicesJuan Antonio Osorio Robles3-0/+57
This covers aodh, gnocchi and panko. cp tls-via-certmonger-containers Change-Id: I6dabb0d82755c28b8940c0baab0e23cfcc587c42
2017-04-19Merge "Introduce common CAs to be mounted to the containers"Jenkins1-0/+5
2017-04-19Merge "Introduce common resources for docker templates"Jenkins36-349/+644
2017-04-19Merge "Use underscore for Aodh and Gnocchi's container names"Jenkins2-4/+4