aboutsummaryrefslogtreecommitdiffstats
path: root/docker
AgeCommit message (Collapse)AuthorFilesLines
2017-08-11Internal TLS support for mongodb containerJuan Antonio Osorio Robles1-7/+45
This bind mounts the necessary files for the mongodb container to serve TLS in the internal network. bp tls-via-certmonger-containers Change-Id: Ieef2a456a397f7d5df368ddd5003273cb0bb7259 Co-Authored-By: Damien Ciabrini <dciabrin@redhat.com>
2017-08-11Enable TLS for nova api and placement containersJuan Antonio Osorio Robles2-0/+34
With these two services running over httpd in the containers, we can now enable TLS for them. bp tls-via-certmonger-containers Change-Id: Ib8fc37a391e3b32feef0ac6492492c0088866d21
2017-08-11Make containerized nova-api run with httpdJuan Antonio Osorio Robles1-6/+3
The non-containerized version will run over httpd [1], and for the containerized TLS work, it is needed in the container version as well. [1] Iac35b7ddcd8a800901548c75ca8d5083ad17e4d3 bp tls-via-certmonger-containers Depends-On: I1c5f13039414f17312f91a5e0fd02019aa08e00e Change-Id: I2c39a2957fd95dd261b5b8c4df5e66e00a68d2f7
2017-08-11Enable TLS configuration for containerized GaleraDamien Ciabrini1-0/+35
In non-containerized deployments, Galera can be configured to use TLS for gcomm group communication when enable_internal_tls is set to true. Fix the metadata service definition and update the Kolla configuration to make gcomm use TLS in containers, if configured. bp tls-via-certmonger-containers Change-Id: Ibead27be81910f946d64b8e5421bcc41210d7430 Co-Authored-By: Juan Antonio Osorio Robles <jaosorior@redhat.com> Closes-Bug: #1708135 Depends-On: If845baa7b0a437c28148c817b7f94d540ca15814
2017-08-10Mount NFS volume to docker container.Pranali Deore1-0/+11
After creating glance image successfully, share location was remaining empty because the NFS volume on controller was not mounted to docker container. Now, connecting NFS volume to the docker container. Change-Id: Ib45f117cbbf2b7b2c0faf024e9a8b049c440d872 Closes-Bug: 1708629
2017-08-09Enable TLS configuration for containerized HAProxyDamien Ciabrini1-5/+52
In non-containerized deployments, HAProxy can be configured to use TLS for proxying internal services. Fix the creation of the of the haproxy bundle resource to enable TLS when configured. The keys and certs files are all passed as configuration files and must be copied by Kolla at container startup. For the time being, disable the use of the CRL file until we find a means of restarting the containerized HAProxy service when that file expires. Change-Id: If307e3357dccb7e96bdb80c9c06d66a09b55f3bd Depends-On: I4b72739446c63f0f0ac9f859314a4d6746e20255 Closes-Bug: #1709563
2017-08-09Set virsh secret with an init step when using CephGiulio Fidente1-4/+52
Run virsh secret-define and secret-set-value in an init step instead of relying on the puppet-nova exec. Co-Authored-By: Jiri Stransky <jistr@redhat.com> Change-Id: Ic950e290af1c66d34b40791defbdf4f8afaa11da Closes-Bug: #1709583
2017-08-09Enable TLS configuration for containerized RabbitMQDamien Ciabrini1-0/+15
In non-containerized deployments, RabbitMQ can be configured to use TLS for serving and mirroring traffic. Fix the creation of the rabbitmq bundle resource to enable TLS when configured. The key and cert are passed as other configuration files and must be copied by Kolla at container startup. Change-Id: I8af63a1cb710e687a593505c0202d717842d5496 Depends-On: Ia64d79462de7012e5bceebf0ffe478a1cccdd6c9 Closes-Bug: #1709558
2017-08-08Merge "MariaDB: create clustercheck user at container bootstrap"Jenkins1-1/+22
2017-08-04Merge "Run gnocchi upgrade with sacks in docker template"Jenkins1-1/+9
2017-08-04Merge "Fix up multipath docker indentation"Jenkins1-5/+5
2017-08-03Remove baremetal cron jobs on docker upgradeDan Prince4-0/+16
Change-Id: I072a3f582cdb978187d14233ea1ba636d12a1293 Closes-bug: #1708466
2017-08-03Merge "Fix CA file bind mounting in containers"Jenkins1-1/+5
2017-08-03Merge "Cinder volume/backup containers shouldn't mount two paths at same point"Jenkins2-2/+0
2017-08-03Merge "Fix keystone, cinder, heat-api cron containers"Jenkins3-1/+7
2017-08-02Fix up multipath docker indentationMichele Baldessari1-5/+5
Deploying a multipathd container gives the following error: failed: [localhost] (item={'key': u'config_files', 'value': [{u'dest': u'/', u'merge': True, u'source': u'/var/lib/kolla/config_files/src-iscsid/*', u'preserve_properties': True}]}) => {\"checksum\": \"72ad81489381571c5043b7613f6828b06ae364bd\", \"failed\": true, \"item\": {\"key\": \"config_files\", \"value\": [{\"dest\": \"/\", \"merge\": true, \"preserve_properties\": true, \"source\": \"/var/lib/kolla/config_files/src-iscsid/*\"}]}, \"msg\": \"Destination directory does not exist\"} The reason is the wrong indentation of the config_files key in the multipath docker service. Change-Id: I0e1fbb9eb188a903994b9e5da90ab4a6fb81f00a Closes-Bug: #1708129
2017-08-02Cinder volume/backup containers shouldn't mount two paths at same pointJohn Fulton2-2/+0
Docker refuses to start the container because config_files/src-ceph:ro is mounted at both /etc/ceph and config-data/puppet-generated/ceph. The mount to /var/lib/config-data/puppet-generated/ceph should have been removed in commit ed0b77ff93a1a1e071d32f6a758e04c6d0b041ef. Change-Id: I411b4764a54fc21e97e4c41a5fef00c7e6e2b64d Closes-Bug: #1707956
2017-08-02Merge "Remove empty metadata_settings from iscsid and multipathd templates"Jenkins2-2/+0
2017-08-01Merge "Generate MySQL client config if service requires database"Jenkins42-100/+280
2017-08-01Run gnocchi upgrade with sacks in docker templatePradeep Kilambi1-1/+9
Without this gnocchi is not initializing the sacks like puppet does and gnocchi containers dont respond properly. Change-Id: I2c53b00793f99420fd12ccc0b5646cf21d528e46
2017-08-01Merge "Add missing metadata_settings from docker services"Jenkins3-0/+6
2017-08-01Fix keystone, cinder, heat-api cron containersDan Prince3-1/+7
The cron containers need to run as root in order to create PID files correctly. Additionally, the keystone_cron container was misconfigured to use /usr/bin/cron instead of the correct /usr/bin/crond. Additionally we have an issue where the Kolla keystone container has hard coded ARGS for the docker container which causes -DFOREGROUND (an Apache specific argument) to get appended onto the kolla_start command thus causing crond to fail to startup correctly. This works around the issue by overriding the command and calling kolla_set_configs manually. Once we fix this in Kolla we can revisit this. Change-Id: Ib8fb2bef9a3bb89131265051e9ea304525b58374 Related-bug: 1707785
2017-08-01Fix CA file bind mounting in containersJuan Antonio Osorio Robles1-1/+5
The syntax was wrong and wasn't actually bind mounting the CA file. This fixes it. Change-Id: Icfa2118ccd2a32fdc3d1af27e3e3ee02bdfbb13b
2017-08-01Remove empty metadata_settings from iscsid and multipathd templatesJuan Antonio Osorio Robles2-2/+0
metadata_settings is meant to have a specific format or be completely absent. Unfortunately the hook [1] doesn't an empty value for this. So we remove it as an easy fix before figuring out how to add such a functionality to the hook. [1] https://github.com/openstack/tripleo-heat-templates/blob/master/extraconfig/nova_metadata/krb-service-principals.yaml Co-Authored-By: Thomas Herve <therve@redhat.com> Change-Id: Ieac62a8076e421b5c4843a3cbe1c8fa9e3825b38
2017-07-31MariaDB: create clustercheck user at container bootstrapDamien Ciabrini1-1/+22
In HA overclouds, the helper script clustercheck is called by HAProxy to poll the state of the galera cluster. Make sure that a dedicated clustercheck user is created at deployment, like it is currently done in Ocata. The creation of the clustercheck user happens on all controller nodes, right after the database creation. This way, it does not need to wait for the galera cluster to be up and running. Partial-Bug: #1707683 Change-Id: If8e0b3f9e4f317fde5328e71115aab87a5fa655f
2017-07-31Merge "Fix creation of iptables rules for non-HA containerized HAproxy"Jenkins1-2/+38
2017-07-31Add missing metadata_settings from docker servicesJuan Antonio Osorio Robles3-0/+6
These are needed for the TLS everywhere bits. Change-Id: I81fcf453fc1aaa2545e0ed24013f0f13b240a102
2017-07-28Merge "Also log docker-puppet.py puppet output to console"Jenkins1-1/+1
2017-07-28Merge "Enable Zaqar API SSL"Jenkins1-0/+17
2017-07-28Also log docker-puppet.py puppet output to consoleBogdan Dobrelya1-1/+1
Running puppet apply with --logdest syslog results in all the output being redirected to syslog. You get no error messages. In the case where this fails, the subsequent debug task shows nothing useful as there was no stdout/stderr. Also pass --logdest console to docker-puppet's puppet apply so that we get the output for the debug task. Related-Bug: #1707030 Change-Id: I67df5eee9916237420ca646a16e188f26c828c0e Signed-off-by: Bogdan Dobrelya <bdobreli@redhat.com>
2017-07-27Also log puppet output to consoleJames Slagle1-1/+1
Running puppet apply with --logdest syslog results in all the output being redirected to syslog. You get no error messages. In the case where this ansible task fails, the subsequent debug task shows nothing useful as there was no stdout/stderr. Also pass --logdest console to puppet apply so that we get the output for the debug task. My local testing showed that when specifying logdest twice, both values were honored, and the output went to syslog and the console. Change-Id: Id5212b3ed27b6299e33e81ecf71ead554f9bdd29 Closes-Bug: #1707030
2017-07-27Generate MySQL client config if service requires databaseDamien Ciabrini42-100/+280
Services that access database have to read an extra MySQL configuration file /etc/my.cnf.d/tripleo.cnf which holds client-only settings, like client bind address and SSL configuration. The configuration file is thus used by containerized services, but also by non-containerized services that still run on the host. In order to generate that client configuration file appropriately both on the host and for containers, 1) the MySQLClient service must be included by the role; 2) every containerized service which uses the database must include the mysql::client profile in the docker-puppet config generation step. By including the mysql::client profile in each containerized service, we ensure that any change in configuration file will be reflected in the service's /var/lib/config-data/{service}, and that paunch will restart the service's container automatically. We now only rely on MySQLClient from puppet/services, to make it possible to generate /etc/my.cnf.d/tripleo.cnf on the host, and to set the hiera keys that drive the generation of that config file in containers via docker-puppet. We include a new YAML validation step to ensure that any service which depends on MySQL will initialize the mysql::client profile during the docker-puppet step. Change-Id: I0dab1dc9caef1e749f1c42cfefeba179caebc8d7
2017-07-27Do not run clustercheck on the host after O->P upgradeDamien Ciabrini1-0/+6
Once an Ocata overcloud is upgraded to Pike, clustercheck should only be running in a dedicated container, and xinetd should no longer manage it on the host. Fix the mysql upgrade_task accordingly. Change-Id: I01acacc2ff7bcc867760b298fad6ff11742a2afb Closes-Bug: #1706612
2017-07-27Merge "Add PCI to nova compute container for passthrough support"Jenkins1-0/+2
2017-07-27Merge "Enable libvirtd_config puppet tag in nova-libvirtd docker service"Jenkins1-1/+1
2017-07-27Enable Zaqar API SSLThomas Herve1-0/+17
This sets the SSL flag in the docker service and expose the parameter in the docker service. Depends-On: I4c68a662c2433398249f770ac50ba0791449fe71 Change-Id: Ic3df2b9ab7432ffbed5434943e04085a781774a0
2017-07-27Merge "Deploy Ceph in containers using ceph-ansible via external workflow"Jenkins4-0/+424
2017-07-27Merge "Make collectd run as root inside the container"Jenkins1-1/+3
2017-07-26Deploy Ceph in containers using ceph-ansible via external workflowGiulio Fidente4-0/+424
Add docker profiles to deploy Ceph in containers via ceph-ansible. This is implemented by triggering a Mistral workflow during one of the overcloud deployment steps, as provided by [1]. Some new service-specific parameters are available to determine the workflow to execute and the ansible playbook to use. A new `CephAnsibleExtraConfig` parameter can be used to provide arbitrary config variables consumed by `ceph-ansible`. The pre-existing template params consumed up until the Pike release to drive `puppet-ceph` continue to work and are translated, when possible, into the equivalent `ceph-ansible` variable. A new environment file is added to enable use of ceph-ansible; the pre-existing puppet-ceph implementation remains unchanged and usable for non-containerized deployments. 1. https://review.openstack.org/#/c/463324/ Change-Id: I81d44a1e198c83a4ef8b109b4eb6c611555dcdc5
2017-07-26Merge "Provides Ceph config into OpenStack clients"Jenkins7-20/+59
2017-07-26Merge "Stop Heat WSGI services on docker upgrade"Jenkins2-4/+38
2017-07-26Merge "Replace outdated instruction with link to upstream doc"Jenkins1-57/+2
2017-07-26Merge "Open up firewall for the control-ports in the bundles"Jenkins3-1/+26
2017-07-26Merge "Make various password descriptions consistent"Jenkins1-1/+1
2017-07-26Merge "Stop also openstack-swift-object-expirer when upgrading swift services"Jenkins1-0/+1
2017-07-26Merge "Add keystone cron container to run token_flush"Jenkins1-0/+26
2017-07-26Merge "nova_api_cron docker fix: add /var/spool/cron/nova"Jenkins1-4/+20
2017-07-26Fix creation of iptables rules for non-HA containerized HAproxyDamien Ciabrini1-2/+38
The introduction of I90253412a5e2cd8e56e74cce3548064c06d022b1 broke the HAproxy service due to some HAproxy-specific iptables rules being executed during the puppet config step. Ensure that no iptables call is performed during the generation of configuration files. Move those calls to step 1, as implemented in the pacemaker-based HAproxy service (Ib5a083ba3299a82645f1a0f9da0d482c6b89ee23). Depends-On: I2d6274d061039a9793ad162ed8e750bd87bf71e9 Closes-Bug: #1697921 Change-Id: Ica3a432ff4a9e7a46df22cddba9ad96e1390b665
2017-07-25Merge "Add cinder cron container to run db purge"Jenkins1-0/+26
2017-07-25Provides Ceph config into OpenStack clientsGiulio Fidente7-20/+59
Given ceph-ansible or puppet-ceph will have created the Ceph config files and keyrings in /etc/ceph on baremetal, this change copies into the OpenStack containers the necessary files for the services to be able to connect to the Ceph cluster. Change-Id: Ibc9964902637429209d4e1c1563b462c60090365