aboutsummaryrefslogtreecommitdiffstats
path: root/puppet/services
AgeCommit message (Collapse)AuthorFilesLines
2016-10-13Enable proxy headers parsing for AodhJuan Antonio Osorio Robles1-0/+1
http_proxy_to_wsgi middleware was recently added to Aodh [1] and in order to take it into use, we need to enable it via hiera. [1] If2ada8a94c8e1ceacd4509605b4cd766a78f71d5 Depends-On: I0981e152700ed4511b797011ebe18e857c1fed71 Related-Bug: #1590608 Change-Id: Ie9605ae1e5437f488802b03ca23a325866f0ceb5
2016-10-13Enable proxy headers parsing for GnocchiJuan Antonio Osorio Robles1-0/+1
http_proxy_to_wsgi middleware was recently added to Gnocchi [1] and in order to take it into use, we need to enable it via hiera. [1] Ic5526cf37e70335fa2cc70946a271253f227f129 Related-Bug: #1590608 Change-Id: I145dcfa3455ca1541cbf6b5fc4b601f0813619c0
2016-10-13Merge "Remove duplicate metadata keys from nova-api.yaml"Jenkins1-2/+0
2016-10-12Disable IPv6 RAs & Autoconf For All (Not Just Default)Dan Sneddon1-0/+4
The current kernel sysctl settings modify the net.ipv6.conf.default.accept_ra and net.ipv6.conf.default.autoconf to both be '0'. However, this is overridden by the settings in net.ipv6.conf.all, so no matter what setting is in the ifcfg file for the IPv6 interface, autoconfiguration and accept_ra will be enabled. This causes a security vulnerability where rogue RAs could be used to intercept traffic from the controllers. This change sets both default and all settings to '0' for IPv6 accept_ra and autoconf. Closes-Bug: 1632830 Change-Id: I95b86c5c6feed30dfa5103ffbddb9e85ac567bbb
2016-10-12Merge "Allow Glance API and Registry to be split"Jenkins3-140/+197
2016-10-12Only set NovaWorkers in the non-default caseDan Prince3-48/+69
This patch updates the t-h-t templates for nova services so that we only set the value of workers in the non-default case. TripleO has always defaulted the workers count to 0 and there was recently a regression in nova where they treat the default of 0 as invalid (a bug that may get fixed in nova but we don't want to wait on it) This patch avoids the issue by allowing the default value to be unset if the TripleO default of 0 is configured. Change-Id: I175977b88129d87caeb32332d47eb14816a6d5d4 Closes-bug: #1631133
2016-10-12Remove duplicate metadata keys from nova-api.yamlDan Prince1-2/+0
These keys are already specified in nova-metadata.yaml where they get set correctly per the network management local IP (based on 'service_name' list). Depends-On: I94f985e719a3bf7408655fbbb5ab1aeaf15e994e Change-Id: I5d57561b732783118efd2a637aa137f5f7bcddbc Partial-bug: #1631133
2016-10-12Merge "Add parameters to run nova over httpd"Jenkins1-0/+18
2016-10-12Allow Glance API and Registry to be splitDan Prince3-140/+197
The glance-api and glance-registry services are currently coupled in that some of the hiera settings in the API are required for the registry to run correctly (the backend settings). This patch moves some of the common settings into glance-base and then updates the glance-api and glance-registry services to supply that service. Change-Id: Ie3d7e24c7fd475e3f6ad542c1654eb7dbd9d9b35 Closes-bug: #1628582
2016-10-12Merge "Set the notification driver for glance"Jenkins1-0/+1
2016-10-11Enable object versioning in Swift proxyChristian Schwede1-0/+2
Tempest expects object versioning to be enabled by default in Swift; if not it has to be disabled explicitly in the Tempest config. This is a commonly used middleware, therefore it should be enabled in the overcloud proxy nodes as well. Closes-Bug: 1632215 Depends-On: I07a206473ff7939749e3eba1dfe3ea8c4526eb5c Change-Id: I4eae08ff3f9a3a2f829c3497c1c2aaee8e7f8554
2016-10-10Merge "Remove unneeded *_enable_backend hiera from Manila backends"Jenkins3-12/+0
2016-10-10Fix default Swift ring partition powerChristian Schwede1-2/+2
Looks like swift::ringbuilder::part_power is not used at all; actually the partition power on the overcloud is 18, which is the default in puppet-swift if nothing else is defined. Closes-Bug: 1631926 Depends-On: I78049105adf52226d47cc6764b1ba6c2c06e91e5 Change-Id: I65335c8d31ed1130e71f1e193eb519b9f7f2438e
2016-10-10Set the notification driver for glancePradeep Kilambi1-0/+1
Need to set the right default notification driver for glance so telemetry receives them accordingly. Without this tempest tests fail. Closes-bug: #1631939 Change-Id: I1cee5467d077eea6142076925646f7d0cdae96c7
2016-10-07Merge "Renames OpenDaylight to OpenDaylightApi and splits out OVS configuration"Jenkins1-11/+0
2016-10-07Remove unneeded *_enable_backend hiera from Manila backendsGiulio Fidente3-12/+0
Depends-On: I04e28a95e8d69a24cd3df109bf1802bfcbd941db Change-Id: I4ada033155e5fde0add08ec9aa8f6af7c31d53f3
2016-10-07Merge "Specify the Ceph packages to be installed"Jenkins1-0/+6
2016-10-06Specify the Ceph packages to be installedJohn Fulton1-0/+6
The puppet-ceph module defaults to 'ceph' but that is a metapacakge which isn't provided in all repos. Depends-On: I13462219522386f8740b0d70916a44f3474115e4 Change-Id: Ie55d22301dd22102d471e6002dfcaad4bfadd5f6 Related-Bug: 1629933
2016-10-06Enable firewalling by default on compute nodesEmilien Macchi4-5/+12
- Move VXLAN and VRRP rules from Neutron Server to the right services. - Enable Firewall by default on Compute nodes. Change-Id: I99d172dcedaf6be297aad184cc51fe9f292a57e1
2016-10-06Re-enable ManageFirewall by default.Dan Prince2-3/+3
This default setting got lots in the composable roles/services patches. Re-enable the ManageFirewall setting by default per what we did in git commit 73c76b867ddc8a23a30b9a3cac4031189d4178c6. We also fix a typo in neutron-api.yaml so that the firewall rules matches to service_name. (otherwise it won't get loaded). Also, drops the environments/manage-firewall.yaml which is no longer needed if we enable firewall management by default. Change-Id: Ie198e4efd190131d0722085b10ef77da9005bc1b Closes-bug: 1629934
2016-10-06Merge "restore missing fluentd client functionality"Jenkins2-2/+2
2016-10-05Set proper ceph config path for manilaTom Barron1-1/+1
When deploying manila with cephfs backend, /etc/manila/manila.conf should define cephfs_conf_path = /etc/ceph/ceph.conf in the cephfs native backend since this is the conventional path that ceph operators expect and since we document that path upstream. Change-Id: I4abf5c33b675b1102413a84d64f4ce23b07b4485 Closes-Bug: 1630777
2016-10-05restore missing fluentd client functionalityLars Kellogg-Stedman2-2/+2
in the great rebase following the JINJA ALL THE THINGS changes we lost critical functionality in the fluentd client service. This review restores the missing features. Change-Id: I7c23f16f81e75f3da6a24587b2eb8385b3e920a4 Closes-bug: 1630692
2016-10-05Renames OpenDaylight to OpenDaylightApi and splits out OVS configurationTim Rozet1-11/+0
This patch modifies the service name to be more appropriately called "OpenDaylightApi" along side the "OpenDaylightOvs" service used to configure OpenVSwitch. It also splits out the OVS configuration for controller nodes into the composable OpenDaylightOvs service. Related-Bug: #1629408 Change-Id: I15221401acdfb2a9ef81107b54a8005348f8372f Signed-off-by: Tim Rozet <trozet@redhat.com>
2016-10-04Include redis/mongo hiera when using pacemakerDan Prince2-2/+2
This patch updates the pacemaker composable service templates for mongo and redis to extend the proper base (redis.yaml and mongo.yaml) templates instead of the -base.yaml versions. This was causing some missing hiera settings for these services which caused symptoms like missing firewall rules for these services. Change-Id: I3f94acbf4d1baadbb151b1c4d34b4a0ab28ad5e5 Partial-bug: #1629934
2016-10-03Merge "Cinder volume service is not managed by Pacemaker on BlockStorage"Jenkins2-1/+1
2016-10-03Merge "Balance Rabbitmq Queue Master Location on queue declaration with ↵Jenkins1-0/+1
min-masters strategy"
2016-10-01Change rabbitmq queues HA mode from ha-all to ha-exactlyMichele Baldessari1-0/+9
It turns out that reducing number of rabbitmq queues in cluster significantly improves performance of cluster especially in the case of failover recovery time. Right now the cluster uses ha-all mode for rabbitmq queues. It is best to change this to "ha-exactly" mode and reduce the number of queue copies to ceil(N/2) where N is number of controllers in the cluster - so in typical scenario of 3 controller It would be 2 by default. It does not make much sense to keep the copies of queues over whole cluster since if the quorum of nodes is lost then the rest of cluster nodes will be stopped anyway. We let the user override this with a parameter. I.e. for a 3 node controlplane cluster we will go from this: pcs resource show rabbitmq Resource: rabbitmq (class=ocf provider=heartbeat type=rabbitmq-cluster) Attributes: set_policy="ha-all ^(?!amq\.).* {"ha-mode":"all"}" To this: pcs resource show rabbitmq Resource: rabbitmq (class=ocf provider=heartbeat type=rabbitmq-cluster) Attributes: set_policy="ha-all ^(?!amq\.).* {"ha-mode":"exactly","ha-params":2}" According to Marin Krcmarik's testing recovery time from failure was reduced significantly. Partial-Bug: #1628998 Change-Id: Iace6daf27a76cb8ef1050ada0de7ff1f530916c6
2016-09-30telemetry: remove coordination_url hiera settingsEmilien Macchi3-25/+1
They are now normalized and set in puppet-tripleo. Change-Id: I197481c577b85894178e7899a55869da47847755 Closes-Bug: #1629279 Depends-On: Ic6de09acf0d36ca90cc2041c0add1bc2b4a369a5
2016-09-30Telemetry: add redis_password hiera parameterEmilien Macchi3-0/+3
Add redis_password parameter in Hiera so we can re-use it from puppet-tripleo later for Aodh, Ceilometer and Gnocchi. Change-Id: I038e2bac22e3bfa5047d2e76e23cff664546464d Partial-Bug: #1629279
2016-09-29Add HAProxy TLS handled by certmonger as composable serviceJuan Antonio Osorio Robles3-10/+121
This adds some basic pieces to get certmonger to manage the certificates for HAProxy. The aim is to be flexible enough that we will be able to manage both public and internal certificates. This also adds a relevant environment to get the endpoints to have TLS everywhere. bp tls-via-certmonger Depends-On: I89001ae32f46c9682aecc118753ef6cd647baa62 Change-Id: Ife5f8c2f07233295bc15b4c605acf3d9bd62f162
2016-09-29Balance Rabbitmq Queue Master Location on queue declaration with min-masters ↵Michele Baldessari1-0/+1
strategy It may happen that one of the controllers may become unavailable and Queue Masters will be located on available controllers during queue declarations. Once a lost controller will be become available masters of newly declared queues are not placed with priority to such controller with obviously lower number of queue masters and thus the distribution may be unbalanced and one of the controllers may become under significantly higher load in some circumstances of multiple fail-overs. With rabbit 3.6.0 rabbitmq introduced a new HA feature of Queue masters distribution - one of the strategies is min-masters, which picks the node hosting the minimum number of masters. One of the ways how to turn such min-masters strategy on is by adding following into configuration file - rabbitmq.config {rabbit,[ .. {queue_master_locator, <<"min-masters">>}, .. ]}, Change-Id: I61bcab0e93027282b62f2a97bec87cbb0a6e6551 Closes-Bug: #1629010
2016-09-29Add parameters to run nova over httpdJuan Antonio Osorio Robles1-0/+18
This adds the necessary hieradata to run nova over httpd instead of eventlet. Change-Id: I57fb20cf0d58b3376243ba4aeb04e995e7152ce3
2016-09-29Cinder volume service is not managed by Pacemaker on BlockStorageGiulio Fidente2-1/+1
We do not want cinder-volume to be managed by Pacemaker on BlockStorage nodes, where Pacemaker is not running at all. This change adds a new BlockStorageCinderVolume service name which can (and is, by default) mapped to the non Pacemaker implementation of the service. The error was: Could not find dependency Exec[wait-for-settle] for Pacemaker::Resource::Systemd[openstack-cinder-volume] Also moves cinder::host setting into the Pacemaker specific service definition because we only want to set a shared host= string when the service is managed by Pacemaker. Closes-Bug: #1628912 Change-Id: I2f7e82db4fdfd5f161e44d65d17893c3e19a89c9
2016-09-28Move db::mysql into service_config_settingsDan Prince23-105/+111
This patch movs the various db::mysql hiera settings into a 'mysql' specific service_config_settings section for each service so that these will only get applied on the MySQL service node. This follows a similar puppet-tripleo change where we create the actual databases for all services locally on the MySQL service node to avoid permission issues. Change-Id: Ic0692b1f7aa8409699630ef3924c4be98ca6ffb2 Closes-bug: #1620595 Depends-On: I05cc0afa9373429a3197c194c3e8f784ae96de5f Depends-On: I5e1ef2dc6de6f67d7c509e299855baec371f614d
2016-09-28Merge "Deprecate the NeutronL3HA parameter"Jenkins1-7/+23
2016-09-27Use correct password for keystone bootstrapAlex Schultz1-0/+1
In upstream puppet-keystone, the boostrap process should use an admin password not the admin token for the bootstrapping of keystone. The admin password option is being added to the upstream class so we will need to provide it to properly have keystone bootstrapped. Change-Id: Icab4b0cb70d6caf2f2792c4fe730f060b807fbc1 Depends-On: I7a706d93b43ec025bdb4b29667f64ff2f7dd52a0 Related-Bug: #1621959
2016-09-27Fix NTP servers hieradataMarius Cornea1-1/+1
This patch enables correctly setting the NTP server passed via --ntp-server in the overcloud nodes' /etc/ntp.conf. Change-Id: Iff644b9da51fb8cd1946ad9d297ba0e94d3d782b
2016-09-27Merge "Add metricd workers support in gnocchi"Jenkins1-0/+5
2016-09-27Merge "Use parameter name to configure gmcast_listen_addr"Jenkins1-0/+8
2016-09-26Set manila::keystone::auth::tenantTom Barron1-0/+1
Without setting this parameter, overcloud deploy fails and 'openstack stack failures list overcloud' reveals the following error: Error: Puppet::Type::Keystone_user_role::ProviderOpenstack: Could not find project with name [services] and domain [Default] Error: /Stage[main]/Manila::Keystone::Auth/Keystone::Resource::Service_identity[manilav2]/Keystone_user_role[manilav2@services]: Could not evaluate: undefined method `[]' for nil:NilClass When we set manila::keystone::auth::tenant to 'service', analogous to cinder, nova, etc., the overcloud deploy completes successfully. Change-Id: I996ac2ff602c632a9f9ea9c293472a6f2f92fd72
2016-09-27Merge "Add integration with Manila CephFS Native driver"Jenkins1-0/+61
2016-09-27Merge "Neutron metadata agent worker count fix"Jenkins1-3/+10
2016-09-27Merge "Remove double definition of config_settings key in keystone"Jenkins1-1/+0
2016-09-26Merge "Bind MySQL address to hostname appropriate to its network"Jenkins2-1/+14
2016-09-26Use parameter name to configure gmcast_listen_addrJuan Antonio Osorio Robles1-0/+8
This used to used mysql_bind_ip, but this parameter is quite misleading since what it actually configures is not the bind-ip itself, but the gmcast.listen_addr parameter. This fixes that confusion. Depends-On: Iea4bd67074824e5dc6732fd7e408743e693d80b3 Change-Id: I2b114600e622491ccff08a07946926734b50ac70
2016-09-26Remove double definition of config_settings key in keystoneJuan Antonio Osorio Robles1-1/+0
Change-Id: I291bfb1e5736864ea504cd82eea1d4001fcdd931
2016-09-26Bind MySQL address to hostname appropriate to its networkJuan Antonio Osorio Robles2-1/+14
This now takes into use the mysql_bind_host key, to set an appropriate fqdn for mysql to bind to. Closes-Bug: #1627060 Change-Id: I50f4082ea968d93b240b6b5541d84f27afd6e2a3 Depends-On: I316acfd514aac63b84890e20283c4ca611ccde8b
2016-09-26Add metricd workers support in gnocchiCarlos Camacho1-0/+5
Depending on the environment, gnocchi workers uses several controller resources RAM/CPU, this option makes it configurable. Also, configured to 1 in environments/low-memory-usage.yaml which will reduce the service footprint in i.e. CI Change-Id: Ia008b32151f4d8fec586cf89994ac836751b7cce Closes-bug: #1626473
2016-09-23Add integration with Manila CephFS Native driverErno Kuvaja1-0/+61
Enables configuring CephFS Native backend for Manila. This change is based on the usage of environments like in review https://review.openstack.org/#/c/354019 for Netapp driver. Co-Authored-By: Marios Andreou <marios@redhat.com> Change-Id: If013d796bcdfe48b2c995bcab462c89c360b7367 Depends-On: I918f6f23ae0bd3542bcfe1bf0c797d4e6aa8f4d9 Depends-On: I2b537f735b8d1be8f39e8c274be3872b193c1014