summaryrefslogtreecommitdiffstats
path: root/puppet
AgeCommit message (Collapse)AuthorFilesLines
2017-02-08Re-organizes Contrail services to the correct rolesMichael Henkel14-296/+344
In current setup some Contrail services belong to the wrong roles. The Contrail control plane can be impacted if the Analytics database has problems. Change-Id: I0d57a2324c38b5b20cc687c6217a7a364941f7e6 Depends-On: Id0dd35b95c5fe9d0fcc1e16c4b7d6cc601f10818 Closes-Bug: #1659560
2017-02-02Merge "Allow the override of pacemaker::corosync::settle_tries"Jenkins1-0/+7
2017-02-02Merge "Temporary UCSM mapping files should be opened with write mode"Jenkins1-2/+6
2017-02-02Merge "Don't run ceilometer-upgrade via upgrade_tasks"Jenkins1-3/+0
2017-02-01Don't run ceilometer-upgrade via upgrade_tasksSteven Hardy1-3/+0
This needs to be run by puppet or ansible runs it as root and the later run by puppet fails due to permissions on the logfile. Probably we need to remove the *sync calls for most services to avoid similar issues, now that we're running puppet as part of the pre-converge upgrade process but that will be done in another patch. Change-Id: I808db2c175325a25058226842684558ea06fb5c5 Partially-Implements: blueprint overcloud-upgrades-per-service
2017-01-31Add ability to toggle swift's ceilometer transport_url SSLJuan Antonio Osorio Robles1-0/+7
So, if RabbitClientUseSSL is set, this will enable TLS for the swift's ceilometer message broker connection. Change-Id: Ide70a509aefc9e7eb9d7cc5b3a60520fa42b4010 Depends-On: I8b7457b6233c4f88af2d7bc1b9304fcccb6edf61
2017-01-31Merge "Configure DPDK options to isolate PMD cores and ovs process cores"Jenkins1-1/+7
2017-01-30Merge "Add upgrade support for CephRGW service"Jenkins1-0/+11
2017-01-27Merge "Add AuditD composable service"Jenkins1-0/+34
2017-01-27Merge "Pass parameters for TLS proxy in front of neutron server"Jenkins1-1/+32
2017-01-27Merge "Remove create-legacy-resource-types opts"Jenkins1-1/+1
2017-01-27Pass parameters for TLS proxy in front of neutron serverJuan Antonio Osorio Robles1-1/+32
If TLS in the internal network is enabled, we run neutron-server behind a TLS proxy (which is actually httpd's mod_proxy). This passes the necessary hieradata. bp tls-via-certmonger Depends-On: I6dfbf49f45aef9f47e58b5c0dbedd2b4e239979e Change-Id: I9252512dbf9cf2e3eec50c41bf10629d36070bbd
2017-01-27Add AuditD composable serviceSteven Hardy1-0/+34
This patch allows the management of the AuditD service and its associated files (such as `audit.rules`) This is achieved by means of the `puppet-auditd` puppet module. Also places ssh banner capabilities map on top of patch Change-Id: Ib8bb52dde88304cb58b051bced9779c97a314d0d Depends-On: Ie31c063b674075e35e1bfa28d1fc07f3f897407b
2017-01-27Merge "Adds a pre-upgrade check that service is running (step0)"Jenkins30-1/+92
2017-01-27Merge "Adds SSH Banner text into sshd_config"Jenkins1-0/+34
2017-01-27Adds a pre-upgrade check that service is running (step0)marios30-1/+92
Adds a step0 for most services to check that the state is running before continuing with any of the other upgrades steps (these are tagged step0). You can skip this service check by overriding the SkipUpgradeConfigTags parameter as follows: parameter_defaults: SkipUpgradeConfigTags: validation Co-Authored-By: Steven Hardy <shardy@redhat.com> Change-Id: Ie276f153015f671b720b6ed5beaac1b921661909
2017-01-27Allow the override of pacemaker::corosync::settle_triesMichele Baldessari1-0/+7
When replacing a controller node, Exec['wait-for-settle'] needs to timeout, which means that the command pcs cluster auth will be executed 360 times with 10 seconds in between. So that means waiting for an hour for no reason. Let's allow to override the settle_tries counter so an operator can shorten it accordingly. Tested this by setting CorosyncSettleTries to 100 and I correctly get proper hiera settings: $ hiera pacemaker::corosync::settle_tries 100 And effectively we try a number of 100 times as opposed to the 360 default: /Stage[main]/Pacemaker::Corosync/Exec[reauthenticate-across-all-nodes]/returns (debug): Exec try 1/100 Change-Id: I5e21b4215cb0b8686d2059b3d71e2444a96719dc Closes-Bug: #1659741
2017-01-26Allow to separate Horizon from NeutronEmilien Macchi1-0/+3
Allow to deploy 2 different nodes with Neutron and another with Horizon. Horizon will get the right hieradata to collect the mechanism driver and configure the dashboard correctly. Change-Id: I24621f6a7d053cff487984bab0d10a4a97204675 Closes-Bug: 1659662
2017-01-26Merge "Add telemetry service support for composable upgrades"Jenkins13-0/+64
2017-01-26Merge "Do not try to update the 'ceph' metapackage from CephMon role"Jenkins2-1/+7
2017-01-26Remove create-legacy-resource-types optsPradeep Kilambi1-1/+1
This flag is quite old and doesnt work as expected anymore. Let ceilometer upgrade create these reource types instead. Change-Id: I71ea6e2fd9418095de658d709c14bb3006ca2753
2017-01-26Merge "Conform CephExternal template to the new hiera hook"Jenkins1-17/+17
2017-01-26Merge "Add Ceph RBD mirror Pacemaker profile"Jenkins1-0/+47
2017-01-26Merge "Allow dnsmasq_dns_servers to be configured for DHCP Agent"Jenkins1-0/+5
2017-01-26Merge "Use versionless keystone endpoint for barbican-related configurations"Jenkins1-2/+2
2017-01-26Add upgrade support for CephRGW serviceGiulio Fidente1-0/+11
Implements minor upgrade of the ceph-radosgw service. Change-Id: I4c064bf996ec6bb7eba41ab6384bd953a8ec920f Partially-Implements: blueprint overcloud-upgrades-per-service
2017-01-26Merge "Set the correct default for gnocchi workers"Jenkins1-1/+1
2017-01-26Do not try to update the 'ceph' metapackage from CephMon roleGiulio Fidente2-1/+7
The 'ceph' metapackage is only provided by some repos so we should not explicitly pull it. Also adds a validation step to the CephMon and CephOSD roles to stop upgrade if the Ceph cluster is in error state. Change-Id: I5aa275677ada47a352a327b9be21927b852d16f3
2017-01-26Merge "Add ironic service support for composable upgrades"Jenkins2-0/+11
2017-01-26Merge "Skip upgrade steps where no tasks are defined"Jenkins1-0/+21
2017-01-26Merge "Add upgrade support for ceph OSD service"Jenkins1-0/+41
2017-01-26Merge "Add upgrade support for ceph-mon service"Jenkins1-0/+21
2017-01-26Merge "Add support for batched upgrades to composable upgrades"Jenkins3-3/+83
2017-01-26Add Ceph RBD mirror Pacemaker profileGiulio Fidente1-0/+47
This change adds a profile to deploy the Ceph RBD mirroring daemon as a Pacemaker resource. Change-Id: Ib07e5bca6a45f0c6c59a3acf07f4e3ae9d2f8948 Depends-On: Ic63dc5cffece38942d305f538f71dd58a5d50789 Closes-Bug: #1652177
2017-01-26Merge "Add snmp service support for composable upgrades"Jenkins1-0/+4
2017-01-26Adds SSH Banner text into sshd_configLuke Hinds1-0/+34
Allow use of ooo template to populate banner text into /etc/issue Change-Id: If5b2da9415f10652a0a64503b2da4b63d1018640 Depends-On: Ie9f8afdfa9930428f06c9669fedb460dc1064d5e Closes-Bug: #1640306
2017-01-26Add SkipUpgradeConfigTags for upgrade configSteven Hardy2-0/+12
It may be that we want ways to selectively disable certain tasks, such as pre-flight validations that might fail when restarting an upgrade from a failed state. This shows a way we might do that. Depends-On: I18214f80be9f3ad6c2d385fc00f3b786d3e7dda3 Change-Id: Ibffaaf1de0baf47a0450daa5b7cbb57d38746556
2017-01-25Merge "Manage password_validator regex"Jenkins1-0/+10
2017-01-25Merge "Auto-set SwiftMountCheck and SwiftUseLocalDir settings"Jenkins2-2/+23
2017-01-25Add telemetry service support for composable upgradesSteven Hardy13-0/+64
Change-Id: I62735676b45a881a7dac24171b26d88d6eb60d4a Partially-Implements: blueprint overcloud-upgrades-per-service
2017-01-25Add ironic service support for composable upgradesSteven Hardy2-0/+11
Change-Id: Ie1fe7db081d69db4b99869057352367e8e01760c Partially-Implements: blueprint overcloud-upgrades-per-service
2017-01-25Skip upgrade steps where no tasks are definedSteven Hardy1-0/+21
Use heat conditions to skip resources (conditionally create them) when there are no tasks to deploy. This requires the heat fix Iefae1fcea720bee4ed69ad1a5fe403d52d54433c Partially-Implements: blueprint overcloud-upgrades-per-service Change-Id: I2f43fb922d122ffade20e35738f0ba3bb56a4492
2017-01-25Add upgrade support for ceph OSD serviceSteven Hardy1-0/+41
This takes a subset of the logic from major_upgrade_ceph_storage.sh and ports it into ansible tasks, which will be applied in a rolling upgrade after the mon services are upgraded (in the step0 batch). Change-Id: I6e87969add301e78bb665d7748e5f0df8eeae819 Partially-Implements: blueprint overcloud-upgrades-per-service
2017-01-25Add upgrade support for ceph-mon serviceSteven Hardy1-0/+21
Initial support for a rolling upgrade of ceph-mon services which happens before the OpenStack services are upgraded. Change-Id: Ifaebbe2ae884bd899cdc6f1c288274e5838792a6 Partially-Implements: blueprint overcloud-upgrades-per-service
2017-01-25Add support for batched upgrades to composable upgradesSteven Hardy3-3/+83
Some services (e.g ceph mon) require upgrading in batches (the old upgrade architecture did the ceph mon upgrade one controller at a time). This interface enables doing the same, and over time we can probably move more services into this interface (e.g when services support rolling upgrades) to reduce downtime. Change-Id: If581f301a5493ef33ac1386bdc22f9fca4f2544e Partially-Implements: blueprint overcloud-upgrades-per-service
2017-01-25Use versionless keystone endpoint for barbican-related configurationsJuan Antonio Osorio Robles1-2/+2
castellan (the key manager interface used by nova and cinder) is no longer tied to keystone v3 [1]. So now it's possible to use versionless endpoints for keystone. [1] I124c0ea2d9403d6b530b33f18896c4e7bf4eabb5 Change-Id: Id5d893a6a41077ab76ca59295593a27be5c3004c
2017-01-25Set the correct default for gnocchi workersPradeep Kilambi1-1/+1
The current default is empty which overrides the puppet-gnocchi os_workers calculated value. Instead default to the os_workers. Change-Id: I9bf9a107c03172500f7c8c5e4353c20305c8e6b5
2017-01-25Merge "Add Octavia API service definitions"Jenkins2-0/+159
2017-01-25Merge "Add ec2-api service"Jenkins1-0/+118
2017-01-25Merge "Add metadata settings for needed kerberos principals"Jenkins17-20/+91