diff options
Diffstat (limited to 'deploy/adapters/ansible/roles')
9 files changed, 94 insertions, 37 deletions
diff --git a/deploy/adapters/ansible/roles/common/tasks/main.yml b/deploy/adapters/ansible/roles/common/tasks/main.yml index 3114e638..3097d092 100644 --- a/deploy/adapters/ansible/roles/common/tasks/main.yml +++ b/deploy/adapters/ansible/roles/common/tasks/main.yml @@ -5,11 +5,6 @@ apt: pkg=landscape-common state=absent purge=yes when: ansible_os_family == "Debian" - -- name: install pip packages - pip: name={{ item }} state=present extra_args='--pre' - with_items: pip_packages - - name: update hosts files to all hosts template: src=hosts dest=/etc/hosts backup=yes @@ -42,6 +37,10 @@ - name: update pip.conf template: src=pip.conf dest=~/.pip/{{ pip_conf }} +- name: install pip packages + pip: name={{ item }} state=present extra_args='--pre' + with_items: pip_packages + - name: update ntp conf template: src=ntp.conf dest=/etc/ntp.conf backup=yes diff --git a/deploy/adapters/ansible/roles/common/vars/RedHat.yml b/deploy/adapters/ansible/roles/common/vars/RedHat.yml index 10aa7715..6618748f 100644 --- a/deploy/adapters/ansible/roles/common/vars/RedHat.yml +++ b/deploy/adapters/ansible/roles/common/vars/RedHat.yml @@ -5,7 +5,7 @@ packages: pip_packages: - crudini -pip_conf: .pip.conf +pip_conf: pip.conf services: - openvswitch diff --git a/deploy/adapters/ansible/roles/neutron-compute/tasks/main.yml b/deploy/adapters/ansible/roles/neutron-compute/tasks/main.yml index e7ee13fc..640692ff 100644 --- a/deploy/adapters/ansible/roles/neutron-compute/tasks/main.yml +++ b/deploy/adapters/ansible/roles/neutron-compute/tasks/main.yml @@ -36,7 +36,7 @@ file: src=/etc/neutron/plugins/ml2/ml2_conf.ini dest=/etc/neutron/plugin.ini state=link - name: config neutron - template: src=templates/neutron-network.conf + template: src=templates/neutron.conf dest=/etc/neutron/neutron.conf backup=yes notify: - restart neutron compute service diff --git a/deploy/adapters/ansible/roles/neutron-network/files/vpnaas.filters b/deploy/adapters/ansible/roles/neutron-network/files/vpnaas.filters new file mode 100644 index 00000000..c5eaa80c --- /dev/null +++ b/deploy/adapters/ansible/roles/neutron-network/files/vpnaas.filters @@ -0,0 +1,7 @@ +[Filters] +ip: IpFilter, ip, root +ip_exec: IpNetnsExecFilter, ip, root +ipsec: CommandFilter, ipsec, root +strongswan: CommandFilter, strongswan, root +neutron_netns_wrapper: CommandFilter, neutron-vpn-netns-wrapper, root +neutron_netns_wrapper_local: CommandFilter, /usr/local/bin/neutron-vpn-netns-wrapper, root diff --git a/deploy/adapters/ansible/roles/neutron-network/handlers/main.yml b/deploy/adapters/ansible/roles/neutron-network/handlers/main.yml index 7e67b76e..945724b4 100644 --- a/deploy/adapters/ansible/roles/neutron-network/handlers/main.yml +++ b/deploy/adapters/ansible/roles/neutron-network/handlers/main.yml @@ -1,15 +1,19 @@ --- -- name: restart common neutron network relation service - service: name={{ item }} state=restarted enabled=yes - with_items: services_noarch - - name: restart neutron network relation service service: name={{ item }} state=restarted enabled=yes - with_items: services + with_flattened: + - services_noarch + - services - name: restart openvswitch agent service service: name=neutron-openvswitch-agent state=restarted enabled=yes +- name: restart vpn agent service + service: name={{ item }} state=restarted enabled=yes + with_items: + - neutron-vpn-agent + - strongswan + - name: kill dnsmasq command: killall dnsmasq ignore_errors: True diff --git a/deploy/adapters/ansible/roles/neutron-network/tasks/firewall.yml b/deploy/adapters/ansible/roles/neutron-network/tasks/firewall.yml new file mode 100755 index 00000000..16624a4c --- /dev/null +++ b/deploy/adapters/ansible/roles/neutron-network/tasks/firewall.yml @@ -0,0 +1,9 @@ +--- +- include_vars: "{{ ansible_os_family }}.yml" + +- name: install firewall packages + action: "{{ ansible_pkg_mgr }} name={{ item }} state=present" + with_items: firewall_packages + +- name: update firewall related conf + shell: crudini --set --list /etc/neutron/neutron.conf DEFAULT service_plugins firewall diff --git a/deploy/adapters/ansible/roles/neutron-network/tasks/main.yml b/deploy/adapters/ansible/roles/neutron-network/tasks/main.yml index 7d643d5a..f8e9e8c4 100644 --- a/deploy/adapters/ansible/roles/neutron-network/tasks/main.yml +++ b/deploy/adapters/ansible/roles/neutron-network/tasks/main.yml @@ -13,6 +13,24 @@ sysctl: name=net.ipv4.conf.default.rp_filter value=0 state=present reload=yes +- name: assert kernel support for vxlan + command: modinfo -F version vxlan + when: "'vxlan' in {{ NEUTRON_TUNNEL_TYPES }}" + +- name: assert iproute2 suppport for vxlan + command: ip link add type vxlan help + register: iproute_out + failed_when: iproute_out.rc == 255 + when: "'vxlan' in {{ NEUTRON_TUNNEL_TYPES }}" + +- name: update epel-release + shell: yum install -y http://dl.fedoraproject.org/pub/epel/7/x86_64/e/epel-release-7-5.noarch.rpm + ignore_errors: True + +- name: update rdo-release-kilo repo + shell: yum install -y http://rdo.fedorapeople.org/openstack-kilo/rdo-release-kilo.rpm + ignore_errors: True + - name: install neutron network related packages action: "{{ ansible_pkg_mgr }} name={{ item }} state=present" with_items: packages | union(packages_noarch) @@ -48,36 +66,23 @@ dest=/etc/neutron/plugins/ml2/ml2_conf.ini backup=yes -- name: config neutron - template: src=templates/neutron-network.conf - dest=/etc/neutron/neutron.conf backup=yes - notify: - - restart common neutron network relation service - - restart neutron network relation service - - kill dnsmasq - -- meta: flush_handlers - - name: ln plugin.ini file: src=/etc/neutron/plugins/ml2/ml2_conf.ini dest=/etc/neutron/plugin.ini state=link -- name: restart openvswitch-agent service - service: name={{ openvswitch_agent }} state=restarted enabled=yes - -- meta: flush_handlers - -#- include: igmp-router.yml -# when: "'vxlan' in {{ NEUTRON_TUNNEL_TYPES }} and ansible_os_family == 'Debian'" +- name: config neutron + template: src=templates/neutron.conf + dest=/etc/neutron/neutron.conf backup=yes -- name: assert kernel support for vxlan - command: modinfo -F version vxlan - when: "'vxlan' in {{ NEUTRON_TUNNEL_TYPES }}" +- include: firewall.yml + when: enable_fwaas == True -- name: assert iproute2 suppport for vxlan - command: ip link add type vxlan help - register: iproute_out - failed_when: iproute_out.rc == 255 - when: "'vxlan' in {{ NEUTRON_TUNNEL_TYPES }}" +- include: vpn.yml + when: enable_vpnaas == True - include: odl.yml when: "'opendaylight' in {{ NEUTRON_MECHANISM_DRIVERS }}" + +- name: restart neutron services + debug: msg="restart neutron services" + notify: + - restart neutron network relation service diff --git a/deploy/adapters/ansible/roles/neutron-network/tasks/vpn.yml b/deploy/adapters/ansible/roles/neutron-network/tasks/vpn.yml new file mode 100755 index 00000000..6f70a68b --- /dev/null +++ b/deploy/adapters/ansible/roles/neutron-network/tasks/vpn.yml @@ -0,0 +1,26 @@ +--- +- include_vars: "{{ ansible_os_family }}.yml" + +- name: install vpn packages + action: "{{ ansible_pkg_mgr }} name={{ item }} state=present" + with_items: vpn_packages + +- name: update vpn related conf + shell: crudini --set /etc/neutron/l3_agent.ini vpnagent vpn_device_driver neutron_vpnaas.services.vpn.device_drivers.strongswan_ipsec.StrongSwanDriver; + crudini --set --list /etc/neutron/neutron.conf DEFAULT service_plugins vpnaas + crudini --set /etc/neutron/neutron_vpnaas.conf service_providers service_provider 'VPN:strongswan:neutron_vpnaas.services.vpn.service_drivers.ipsec.IPsecVPNDriver:default' + +- name: make sure rootwrap.d dir exist + file: path=/etc/neutron/rootwrap.d state=directory mode=0755 + +- name: update rootwrap + copy: src=vpnaas.filters dest=/etc/neutron/rootwrap.d/vpnaas.filters + +- name: enable vpn service + service: name={{ item }} state=started enabled=yes + with_items: + - neutron-vpn-agent + - strongswan + notify: + - restart vpn agent service + diff --git a/deploy/adapters/ansible/roles/neutron-network/vars/RedHat.yml b/deploy/adapters/ansible/roles/neutron-network/vars/RedHat.yml index 14fd7731..f5e03090 100644 --- a/deploy/adapters/ansible/roles/neutron-network/vars/RedHat.yml +++ b/deploy/adapters/ansible/roles/neutron-network/vars/RedHat.yml @@ -3,6 +3,13 @@ packages: - openstack-neutron-ml2 - openstack-neutron-openvswitch +vpn_packages: + - openstack-neutron-vpn-agent + - strongswan + +firewall_packages: + - openstack-neutron-fwaas + services: - openvswitch - neutron-openvswitch-agent |