Age | Commit message (Collapse) | Author | Files | Lines |
|
Kolla provides a way to set ownership of files and directory inside the
containers. Use it instead of running an additional container to do the
job.
Change-Id: I554faf7c797f3997dd3ca854da032437acecf490
|
|
|
|
Simplify the config of the containerized services by bind mounting in
the configurations instead of specifying them all in kolla config.
This is change is useful to limit the side effects of generating the
config files and running the container is two separate steps as config
directories are now bind-mounted inside the container instead of having
files being copied to the container. We've seen examples of Apache's
mod_ssl configuration file present on the container preventing it to
start when puppet configured apache not to load the ssl module (in case
TLS is disabled).
Co-Authored-By: Ian Main <imain@redhat.com>
Change-Id: I4ec5dd8b360faea71a044894a61790997f54d48a
|
|
This output gets nova metadata into the servers this is deployed to and
is necessary for the TLS-everywhere work.
bp tls-via-certmonger-containers
Change-Id: Iff54f7af9c63a529f88c6455047f6584d29154b4
|
|
For both containers and classic deployments, allow to configure
policy.json for all OpenStack APIs with new parameters (hash,
empty by default).
Example of new parameter: NovaApiPolicies.
See environments/nova-api-policy.yaml for how the feature can be used.
Note: use it with extreme caution.
Partial-implement: blueprint modify-policy-json
Change-Id: I1144f339da3836c3e8c8ae4e5567afc4d1a83e95
|
|
Simplify the config of the keystone service by mounting in the
configurations instead of specifying them all in kolla config.
This is change is useful to limit the side effects of generating the
config files and running the container is two separate steps as config
directories are now bind-mounted inside the container instead of having
files being copied to the container. We've seen examples of Apache's
mod_ssl configuration file present on the container preventing it to
start when puppet configured apache not to load the ssl module (in case
TLS is disabled).
Co-Authored-By: Martin André <m.andre@redhat.com>
Change-Id: Ie33ffc7c2b1acf3e4e505d38efb104bf013f2ce6
|
|
|
|
Previously only the first two intial fernet keys were mounted into the
container. This is not practical, however, as doing key rotation will
generate more entries in this repository. So instead we mount the whole
directory, which would allow us to do rotation in the base host and
seamlessly affect the container as well.
Change-Id: I7763a09e57fe6a7867ffd079ab0b9222374c38c8
|
|
|
|
|
|
|
|
|
|
Also add upgrade_tasks to disable corresponding host
services in order to not data race with containers
Change-Id: I19c16aaa3e5a73436ca7aa7d06facf64feee2327
Signed-off-by: Bogdan Dobrelya <bdobreli@redhat.com>
|
|
|
|
The previous code had a race condition where nova-api host discovery
and nova-compute where run at the same step. This commit ensures host
discovery happens after nova-compute has started.
Change-Id: Id2fc795a64783d958d98d4ac523a19079e8a4fab
Closes-Bug: #1675011
|
|
A previous commit [1] added support for fernet in the keystone docker
service; however, this was not set as the default token provider. This
patch makes it the default.
[1] Id92039b3bad9ecda169323e01de7bebae70f2ba0
Change-Id: Ib44ab61eba0be8ba54bc7d0bdb22437d769cb960
|
|
This allows to optionally add volumes, where we could use a heat
conditional to either put the volume path we want or put an empty string
which should be safely skipped.
Change-Id: I68f91ffdd8ceb14735adad1322fcf124c47b160c
|
|
|
|
|
|
|
|
Use mounts instead of docker volumes, and preserve existing data when
moving from baremetal to containerized ironic-conductor.
We cannot keep the data in the same directory to avoid hard-linking
errors in ironic, because of this issue:
https://github.com/docker/docker/issues/7457
This means we need to copy the data over to a new location before we
start the containers.
Change-Id: If98460120212f887b06adf117c5d88b97682638e
|
|
|
|
|
|
|
|
Co-Authored-By: Pradeep Kilambi <pkilambi@redhat.com>
Closes-bug: #1668918
Change-Id: Ie1ebd25965bd2dbad2a22161da0022bad0b9e554
|
|
|
|
|
|
This is used for the TLS-everywhere bits. It will be taken into account
by a metadata hook that outputs relevant entries for the nova-metadata
service; and subsequently kerberos principals will be created from
these.
Subsequent patches will add support for TLS in the internal network for
the containerized keystone.
Change-Id: Ic747ad9c8d6e76c8c16e347c1cdcabc899dd9f9a
|
|
Use mounts instead of docker volumes to preserve existing data when
moving from baremetal to containerized Libvirt.
Change-Id: I2215d451a4ef4023741f0750ac1b45a94652026a
|
|
Use mounts instead of docker volumes to preserve existing data when
moving from baremetal to containerized Swift.
Change-Id: Ib7cbca2ef674a0245a67b69ee2c77f574d74c181
|
|
Change-Id: I936b31fd24c43e35092b3bfef4454a8da81d19c8
|
|
Since the 'file' resource is included in the tags that puppet takes into
account, we already generate the fernet keys if it's enabled as a token
provider.
This merely adds the keys to the container. However, if fernet is not
the provider, we make this file addition optional.
Change-Id: Id92039b3bad9ecda169323e01de7bebae70f2ba0
|
|
Use mounts instead of docker volumes to preserve existing data when
moving from baremetal to containerized RabbitMQ.
Change-Id: I8de6610d13d2d878ffba12eb742880eed694eb3e
|
|
We used named Docker volume for MongoDB storage, which meant that when
moving from bare metal to containerized, we lost data and reinitialized
the storage from scratch.
With this commit we keep the data by mounting the original data into the
container. We also need make sure that file ownership is correct
according to the uid/gid used within MongoDB container image.
Change-Id: I86ef2cb37a068b767462d6d50fe451389b7cbb58
|
|
We used named Docker volume for MariaDB storage, which meant that when
moving from BM to containerized wit MariaDB, we lost data and
reinitialized the storage from scratch.
With this commit we keep the data by mounting the original data into the
container.
We also need to make sure that file ownership is correct according to
the MariaDB container image used, and that Kolla bootstrap mechanisms
aren't retriggered, as they aren't idempotent.
Change-Id: I1fc955021c6dd83f1a366495dd8c7281fb9e7cc5
|
|
|
|
|
|
|
|
Closes-bug: #1668928
Change-Id: I291df31be97c3d55cddb3924482aa5976a79c2b1
|
|
This implements a host_prep_tasks hook where we can specify Ansible
tasks to perform on the host before deploying containerized
services. The hook runs in a single step, the assumption is that we will
mostly use the hook for creating per-service directories on the host to
ensure we are able to mount them into the containers. (We cannot do this
operation via Puppet because all containerized services run their Puppet
within a config container, so Puppet doesn't have access to host's
filesystem.)
Change-Id: I7d8bac39e0cd422fd651eefe29f7d10941ab4a1a
|
|
Add an example build script, and link the
current overrides template which can be
used to build Kolla packages that work with
TripleO.
Change-Id: I2ca122bfe797ed7c38a01ed9462cd880681d21f1
Signed-off-by: Bogdan Dobrelya <bdobreli@redhat.com>
|
|
Closes-bug: #1668930
Change-Id: If5dff4388b255373083e164a74aaacd529a94111
|
|
Use yaml anchors wherever possible for image definition and drop unused
anchors.
Renamed parameters to Docker*ConfigImage to clarify that an image is
specifically used to generate configuration files.
Change-Id: I388bd59de7f1d36a3a881fbb723ba5bcba09e637
|
|
We don't use docker_image for anything. It is a remant of the
pre-composable docker templates and we can now remove it.
This patch removes references to the 'docker_image' section
from docker/post.yaml and all of the docker/services* templates.
Change-Id: I208c1ef1550ab39ab0ee47ab282f9b1937379810
|
|
This updates the docker/service README so that it
correctly documents the current requirements of the new
puppet_config interface.
Change-Id: I0f3e00ea3cce24152475abf6df34f4836e32c9c8
|
|
Currently returncodes are ignored from docker puppet workers, so a
failed puppet apply may not manifest until later in the stack
deployment due to some other failure.
This change logs any failures at the end of the run and returns a
failure code if any worker returns a failure code.
Change-Id: I6a504dbeb4c0ac465ce10e7647830524fe0a1160
|
|
This is now required per the puppet_config interfaces for docker
services (per I208c1ef1550ab39ab0ee47ab282f9b1937379810)
Change-Id: Iab96919cb0a6b15942f3c19f8d28205261174edc
|
|
A recent commit [1] change how docker is installed and configured on
the overcloud nodes, from a cloud-init script to a proper puppet
profile in puppet-tripleo but forgot to enable the docker service on
the compute nodes.
[1] Ia50169819cb959025866348b11337728f8ed5c9e
Change-Id: I202723d0e48f110e5b0dbfe3dcf6646da9f37948
|
|
This patch makes the neutron-l3 docker service adhere
to the new puppet_config interface.
Change-Id: If5b73ec90637e878af55c8404d1eff8c18e857c3
|
|
|