aboutsummaryrefslogtreecommitdiffstats
path: root/puppet/services
AgeCommit message (Collapse)AuthorFilesLines
2017-04-21SSHD Service extensionsLuke Hinds1-1/+30
This change implements a MOTD message and provides a hash of sshd config options which are sourced to the puppet-ssh module as a hash. The SSHD puppet service is enabled by default, as it is required for Idb56acd1e1ecb5a5fd4d942969be428cc9cbe293. Also added the service to the CI roles. Change-Id: Ie2e01d93082509b8ede37297067eab03bb1ab06e Depends-On: I1d09530d69e42c0c36311789166554a889e46556 Closes-Bug: #1668543 Co-Authored-By: Oliver Walsh <owalsh@redhat.com> (cherry picked from commit 5e14f95a4a46fcf88293f1b0fa93327566614d43)
2017-04-21Merge "N->O Manual puppet commands have the right modulepath." into stable/ocataJenkins1-1/+1
2017-04-21Merge "Run token flush cron job hourly by default" into stable/ocataJenkins1-1/+1
2017-04-21Merge "Add composable role support for NetApp Cinder back end" into stable/ocataJenkins1-0/+129
2017-04-21Merge "Replace references to the 192.0.2 network" into stable/ocataJenkins1-1/+1
2017-04-20Add migration SSH tunneling supportOliver Walsh2-1/+8
This enables nova cold migration. This also switches to SSH as the default transport for live-migration. The tripleo-common mistral action that generates passwords supplies the MigrationSshKey parameter that enables this. The TCP transport is no longer used for live-migration and the firewall port has been closed. Change-Id: I4e55a987c93673796525988a2e4cc264a6b5c24f Depends-On: I367757cbe8757d11943af7e41af620f9ce919a06 Depends-On: I9e7a1862911312ad942233ac8fc828f4e1be1dcf Depends-On: Iac1763761c652bed637cb7cf85bc12347b5fe7ec (cherry picked from commit 0271a63e52b961eab0da2f5c6a61811a7a1498f7)
2017-04-20Merge "Use comma_delimited_list for token flush cron time settings" into ↵Jenkins1-5/+5
stable/ocata
2017-04-20N->O Manual puppet commands have the right modulepath.Sofer Athlan-Guyot1-1/+1
In two places during upgrade we manually trigger puppet. There can be a problem when new puppet modules are added, and their corresponding symlinks in /etc/puppet/modules are not created during the installation as their are installed in /usr/share/openstack-puppet/modules. To prevent the issue tripleo set modulepath in the templates. We must use the same modulepath to make sure that we don't fail because of missing module in the manual puppet run. This particulary happens when you upgrade from M->N->O, as the base image in Mitaka doesn't have the proper symlinks and they are not created during the installation of the package. Closes-Bug: #1684587 Change-Id: I79df6ea33f1c58e13309176a6de41b7572541fd6 (cherry picked from commit 79c2d0f3d411da9e57731d9da79d25a3e0364eb2)
2017-04-19Merge "Decouple Swift ringbuilding logic" into stable/ocataJenkins1-0/+10
2017-04-19Merge "Modify pci_passthrough hiera value as string" into stable/ocataJenkins1-2/+6
2017-04-19Run token flush cron job hourly by defaultJuan Antonio Osorio Robles1-1/+1
Running this job once a day has proven problematic for large deployments as seen in the bug report. Setting it to run hourly would be an improvement to the current situation, as the flushes wouldn't need to process as much data. Note that this only affects people using UUID as the token provider. Change-Id: I462e4da2bfdbcba0403ecde5d613386938e2283a Related-Bug: #1649616 (cherry picked from commit 65e643aca2202f031db94f1ccd3d44e195e5e772)
2017-04-19Use comma_delimited_list for token flush cron time settingsJuan Antonio Osorio Robles1-5/+5
This allows us to better configure these parametes, e.g. we could set the cron job to run more times per day, and not just one. Change-Id: I0a151808804809c0742bcfa8ac876e22f5ce5570 Closes-Bug: #1682097 (cherry picked from commit df36f221dd402a5b93585a6851fb1eb43de91967)
2017-04-18Fix bogus parameters in get_paramBogdan Dobrelya2-2/+2
Change-Id: I1b5658efaaa26c473ceef184a962ec320f267ffe Signed-off-by: Bogdan Dobrelya <bdobreli@redhat.com> (cherry picked from commit e88dfbc4ca115be9522ee0fc0bdb5b60f9ddd7a7)
2017-04-17Merge "Add params to tweak memory limit on mongodb" into stable/ocataJenkins1-0/+5
2017-04-17Add params to tweak memory limit on mongodbPradeep Kilambi1-0/+5
The puppet-tripleo change was added in Ie9391aa39532507c5de8dd668a70d5b66e17c891. Closes-bug: #1656558 Change-Id: Ibe2e4be5b5dc953d8d4b14f680a460409db95585 (cherry picked from commit 75d48838020ad9ff2bbd739212599ec8eb932649)
2017-04-12Add composable role support for NetApp Cinder back endAlan Bishop1-0/+129
Convert NetApp Cinder back end to support composable roles via new "CinderBackendNetApp" service. Closes-Bug: #1680568 Change-Id: Ia3a78a48c32997c9d3cbe1629c2043cfc5249e1c (cherry picked from commit c533a3219e47c5a6155e85e089b9f8acdb4a3dd6)
2017-04-12Replace references to the 192.0.2 networkGiulio Fidente1-1/+1
Following change I1393d65ffb20b1396ff068def237418958ed3289 the ctlplane network will be 192.168.24 by default and not 192.0.2 anymore. This change removes old references left to 192.0.2 network from the overcloud templates. (cherry picked from commit b5b6681a74e001448a836e7eea5e75fba859b88c) Closes-Bug: #1682144 Change-Id: I49bd1ac8d594105665010bd898670b17e72fa763
2017-04-11Update ceph-rgw acccepted roles to fix OSP upgradeKeith Schincke1-1/+1
This patch updates ceph::keystone::auth::roles to remove "member" and add "Member". The previous entry breaks OSP N to O upgrades when ceph-rgw is enabled. This patch fixes: https://bugs.launchpad.net/tripleo/+bug/1678126 Closes-bug: 1678126 (cherry picked from commit 4656323fc30e67f43d3dbd1ada42b608aa6f79e7) Change-Id: I70e70f96c4aba2c89a9f81973f732d4348b91515
2017-04-11Decouple Swift ringbuilding logicChristian Schwede1-0/+10
This reverts commit b323f8a16035549d84cdec4718380bde3d23d6c3 and uses the new logic in puppet-tripleo, basically doing the same. Closes-Bug: 1665641 Depends-On: Ifd6fa5b398d98e8998630ea0c9a2ce9867ceba2b Change-Id: Ib5cb0578be2993af0a0b8675005d838640bdb139 (cherry picked from commit 76c1c0cbba38b2f25290f5ad80e38ddd97ae834b)
2017-04-08Merge "Add missing ec2api::api::keystone_ec2_tokens_url config" into ↵Jenkins1-0/+5
stable/ocata
2017-04-07Add trigger to setup a LDAP backend as keystone domaineCyril Lopez1-0/+27
It is using a trigger tripleo::profile::base::keystone::ldap_backend_enable in puppet-tripleo who will call a define in puppet-keysone ldap_backend.pp. Given the following environment: parameter_defaults: KeystoneLDAPDomainEnable: true KeystoneLDAPBackendConfigs: tripleoldap: url: ldap://192.0.2.250 user: cn=openstack,ou=Users,dc=redhat,dc=example,dc=com password: Secrete suffix: dc=redhat,dc=example,dc=com user_tree_dn: ou=Users,dc=redhat,dc=example,dc=com user_filter: "(memberOf=cn=OSuser,ou=Groups,dc=redhat,dc=example,dc=com)" user_objectclass: person user_id_attribute: cn user_allow_create: false user_allow_update: false user_allow_delete: false ControllerExtraConfig: nova::keystone::authtoken::auth_version: v3 cinder::keystone::authtoken::auth_version: v3 It would then create a domain called tripleoldap with an LDAP configuration as defined by the hash. The parameters from the hash are defined by the keystone::ldap_backend resource in puppet-keystone. More backends can be added as more entries to that hash. This also enables multi-domain support for horizon. Conflicts: puppet/services/keystone.yaml Closes-Bug: 1677603 Co-Authored-By: Juan Antonio Osorio Robles <jaosorior@redhat.com> Depends-On: I1593c6a33ed1a0ea51feda9dfb6e1690eaeac5db Change-Id: I6c815e4596d595bfa2a018127beaf21249a10643 Signed-off-by: Cyril Lopez <cylopez@redhat.com> (cherry picked from commit 347f5434b3e3793b9fdf2a94f49ab7734c5d923b)
2017-04-06Add manual ovs upgrade script for workaround ovs upgrade issueMathieu Bultel4-26/+100
When we upgrade OVS from 2.5 to 2.6, the postrun package update restart the services and drop the connectivity We need to push this manual upgrade script and executed to the nodes for newton to ocata The special case is needed for 2.5.0-14 specifically see related bug for more info (or, older where the postun tries restart). See related review at [1] for the minor update/manual upgrade. Related-Bug: 1669714 Depends-On: I3227189691df85f265cf84bd4115d8d4c9f979f3 Co-Authored-By: Sofer Athlan-Guyot <sathlang@redhat.com> [1] https://review.openstack.org/#/c/450607/ Change-Id: If998704b3c4199bbae8a1d068c31a71763f5c8a2 (cherry picked from commit d2d319ec0ead06b860f8464b001048fb4f723788)
2017-04-06Merge "Make neutron dhcp agents per network conditional" into stable/ocataJenkins1-16/+23
2017-04-06Merge "Fixes port binding controller for OpenDaylight" into stable/ocataJenkins1-0/+45
2017-04-05Merge "Add OpenDaylightConnectionProtocol parameter to opendaylight-api ↵Jenkins1-0/+5
service" into stable/ocata
2017-04-04Set auth flag so ceilometer auth is enabledPradeep Kilambi1-0/+7
Ceilometer Auth should be enabled even if ceilometer api is not. Lets decouple these, this flag will be used in puppet-tripleo where ceilometer::keystone::auth class is initialized. Change-Id: Iffebd40752eafb1d30b5962da8b5624fb9df7d48 Closes-bug: #1677354 (cherry picked from commit 0d04302abd19f98df3cd700f9cc4ec47273e5dac)
2017-04-04Merge "Setting keystone region for tacker" into stable/ocataJenkins1-0/+1
2017-04-03Merge "Setting keystone region for congress" into stable/ocataJenkins1-0/+1
2017-04-03Merge "Re-Add bigswitch agent support" into stable/ocataJenkins1-0/+31
2017-04-03Fixes port binding controller for OpenDaylightTim Rozet1-0/+45
In Ocata and later, the port binding controller for ODL was changed by default to be the pseudo agent controller, which requires a new feature "host config" for OVS. This patch modifies the default to use network-topology, which will work without any new host config features implemented (previous way of port binding). Closes-Bug: 1675211 Depends-On: I5004fdeb238dea81bc4f7e9437843a8a080d5b46 Change-Id: I6a6969d1d6b8d8b8ac31fecd57af85eb653245d2 Signed-off-by: Tim Rozet <trozet@redhat.com> (cherry picked from commit 502b3459d9c2b32beba31b37814d7625cd007775)
2017-04-03Merge "Don't check haproxy if external load-balancer is used." into stable/ocataJenkins1-1/+13
2017-04-03Add missing ec2api::api::keystone_ec2_tokens_url configSven Anderson1-0/+5
Change-Id: I9a19aff24dede2bea3bf2959afa7adde00817ee0 Related-Bug: #1676491 (cherry picked from commit 10cb0cfdef9b3a4719f89bcc2cdf1dae4a14dcca)
2017-04-03Setting keystone region for tackerDan Radez1-0/+1
Change-Id: I170b7e4cff66f0a4b1b6d5735f93c9f0295a5ac5 (cherry picked from commit eb426db63c8cc48990a832f8e1b972feb93e7e92)
2017-04-02Include panko in the default dispatcherPradeep Kilambi1-1/+1
panko is enabled by default, we might as well make it the default dispatcher along with gnocchi. Closes-bug: #1676900 Change-Id: Icb6c98ed0810724e4445d78f3d34d8b71db826ae (cherry picked from commit 568573b9b054c3804d9d1be2ce6ec2668ca2dbfb)
2017-04-02Merge "[N->O] Fix wrong database connection for cell0 during upgrade." into ↵Jenkins2-1/+11
stable/ocata
2017-04-01Don't check haproxy if external load-balancer is used.Sofer Athlan-Guyot1-1/+13
Change-Id: Ia65796b04be9f7cadc57af30ef66788dd8cb7de8 Closes-Bug: 1677539 (cherry picked from commit 56535c89ad6a5db718dc0fb89c19dda9fba251ca)
2017-03-31Merge "Stop openstack-nova-compute during nova-ironic upgrade" into stable/ocataJenkins1-0/+4
2017-03-31Re-Add bigswitch agent supportAlex Schultz1-0/+31
The agent configuration was lost in newton during the puppet-tripleo and THT role conversion. This change adds support for including the bigswitch agent service for composable roles. Change-Id: I46896389e48cdbe2864bf5b609a786f1c84ef908 Closes-Bug: #1673126 (cherry picked from commit 8eaa5f8e10a801be8fc45eeaaa479e7774d97997)
2017-03-31[N->O] Fix wrong database connection for cell0 during upgrade.Sofer Athlan-Guyot2-1/+11
During upgrade the cell0 database has the connection pointing to mysql+pymysql://nova:c2cdagE8PyAbnpers3AD88Hge@10.0.0.19/nova_cell0?bind_address=10.0.0.20 where 10.0.0.20 was the ip of the bootstrap node. This makes the nova-api fails on 2/3 node at the end of the major-upgrade-composable-steps.yaml step. We do have the right value in the hiera database so make sure we use it for cell0 creation and not the nova.conf file which hasn't been updated yet. Change-Id: I09775206cb8fc5e15934f7e4475506a7fe17271e Closes-Bug: #1675359 (cherry picked from commit c9c3813b6a0811a262068d0aab28d0bd535be3e1)
2017-03-31Merge "[N->O] is creating 2 default cell_v2 cells" into stable/ocataJenkins1-4/+4
2017-03-30Stop openstack-nova-compute during nova-ironic upgradeMarius Cornea1-0/+4
This change ensures that that openstack-nova-compute is stopped and disabled during the upgrade process. Closes-Bug: 1675814 Change-Id: Ifd2557b11e4317f1e76e459e8de4162116578eff (cherry picked from commit 276aca7a8145570301e566a8fb3253f57601d171)
2017-03-30Merge "N->O upgrade, blanks ipv6 rules before activating it." into stable/ocataJenkins1-0/+6
2017-03-29Merge "Enables increasing mariadb open files for noha deployments" into ↵Jenkins1-0/+6
stable/ocata
2017-03-29Modify pci_passthrough hiera value as stringSaravanan KR1-2/+6
Hiera value of nova::compute::pci_passthrough should be a string. It has been modified to JSON with the heira hook changes. Modifying it again back to string. Closes-Bug: #1675036 Change-Id: I441907ff313ecc5b7b4da562c6be195687fc6c76 (cherry picked from commit 57c06ddefd4d7ff87de02dab9d1c5e92eb8e6eef)
2017-03-29Merge "Only set EnableConfigPurge on major upgrades" into stable/ocataJenkins3-9/+9
2017-03-28Merge "Fixes missing firewall rules for neutron_ovs_dpdk_agent service" into ↵Jenkins1-1/+4
stable/ocata
2017-03-28Only set EnableConfigPurge on major upgradesSteven Hardy3-9/+9
Bug #1611800 fixed an upgrade issue by enabling purging configs for some services, but this causes issues such as longer updates and restarting services in the minor update case, so only do this for major upgrades, and default to false. Conflicts: (don't exist on this branch) environments/major-upgrade-composable-steps-docker.yaml environments/major-upgrade-converge-docker.yaml Related-Bug: #1611800 Closes-Bug: #1674858 Change-Id: Iff7d715f6730c5633f1146008504b4309ef3133d (cherry picked from commit 947a7148e807e74daf9e30e4e8c891d5bdacc69f)
2017-03-28[N->O] is creating 2 default cell_v2 cellsOliver Walsh1-4/+4
A side-effect of running map_cell_and_hosts is that a default cell is created (unless host mappings already exists). As we are explicitly creating the default cell we need to run discover_hosts to create the host mappings. Change-Id: I1a28e9b85a7c43561700faf692248c5fc06b8ad8 Closes-Bug: #1675418 (cherry picked from commit ab4adb9fb1b1ba003a8045ce4c3879f88ea243b3)
2017-03-27Setting keystone region for congressDan Radez1-0/+1
Change-Id: I4958b886cbd6c2b34da0c265e8774105474ace13 (cherry picked from commit 32be46f508423c822208e3c9f3afb32902f1c1ae)
2017-03-27N->O upgrade, blanks ipv6 rules before activating it.Sofer Athlan-Guyot1-0/+6
When the firewall is enabled with ipv6, the default rules set is taken as not ipv6 firewall was present for Newton. This make communication impossible until puppet is run again. This ensures that no rules are loaded when the firewall is enabled. This mimic this patch[1] [1] https://github.com/openstack/tripleo-heat-templates/commit/ae8aac36143d5dadb08af0d275f513678909dcc7 Change-Id: Id878b5caae666a799c89c8466ce46b9ecb86d9f7 Closes-Bug: #1675782 (cherry picked from commit 670399a2caeecd9259bea454e9518ab6c92cff49)