[baremetal] Containerize MaaS

- replace mas01 VM with a Docker container;
- drop `mcpcontrol` virsh-managed network, including special handling
  previously required for it across all scripts;
- drop infrastructure VMs handling from scripts, the only VMs we still
  handle are cluster VMs for virtual and/or hybrid deployments;
- drop SSH server from mas01;
- stop running linux state on mas01, as all prerequisites are properly
  handled durin Docker build or via entrypoint.sh - for completeness,
  we still keep pillar data in sync with the actual contents of mas01
  configuration, so running the state manually would still work;
- make port 5240 available on the jumpserver for MaaS dashboard access;
- docs: update diagrams and text to reflect the new changes;

Change-Id: I6d9424995e9a90c530fd7577edf401d552bab929
Signed-off-by: Alexandru Avadanii <Alexandru.Avadanii@enea.com>

1 files changed, 32 insertions, 33 deletions

diff --git a/mcp/scripts/lib_jump_deploy.sh b/mcp/scripts/lib_jump_deploy.sh
index 9c4d8fb5a..bce54ade2 100644
--- a/mcp/scripts/lib_jump_deploy.sh
+++ b/mcp/scripts/lib_jump_deploy.sh
@@ -216,9 +216,6 @@ function prepare_vms {
   local image=base_image_opnfv_fuel.img
   local vcp_image=${image%.*}_vcp.img
   local _o=${base_image/*\/}
-  local _h=$(echo "${repos_pkgs_str}.$(md5sum "${image_dir}/${_o}")" | \
-             md5sum | cut -c -8)
-  local _tmp
   [ -n "${image_dir}" ] || exit 1
 
   cleanup_uefi
@@ -226,8 +223,10 @@ function prepare_vms {
   __get_base_image "${base_image}" "${image_dir}"
   IFS='^' read -r -a repos_pkgs <<< "${repos_pkgs_str}"
 
+  local _h=$(echo "${repos_pkgs_str}.$(md5sum "${image_dir}/${_o}")" | \
+             md5sum | cut -c -8)
+  local _tmp="${image%.*}.${_h}.img"
   echo "[INFO] Lookup cache / build patched base image for fingerprint: ${_h}"
-  _tmp="${image%.*}.${_h}.img"
   if [ "${image_dir}/${_tmp}" -ef "${image_dir}/${image}" ]; then
     echo "[INFO] Patched base image found"
   else
@@ -278,9 +277,9 @@ function prepare_vms {
 }
 
 function create_networks {
-  local all_vnode_networks=("mcpcontrol" "$@")
-  # create required networks, including constant "mcpcontrol"
-  for net in "${all_vnode_networks[@]}"; do
+  local all_vnode_networks=("$@")
+  # create required networks
+  for net in "mcpcontrol" "${all_vnode_networks[@]}"; do
     if ${VIRSH} net-info "${net}" >/dev/null 2>&1; then
       ${VIRSH} net-destroy "${net}" || true
       ${VIRSH} net-undefine "${net}"
@@ -293,8 +292,8 @@ function create_networks {
       ${VIRSH} net-start "${net}"
     fi
   done
-  # create veth pairs for relevant networks (mcpcontrol, pxebr, mgmt)
-  for i in $(seq 0 2 4); do
+  # create veth pairs for relevant networks (pxebr, mgmt)
+  for i in $(seq 0 2 2); do
     sudo ip link del "veth_mcp$i" || true
     sudo ip link add "veth_mcp$i" type veth peer name "veth_mcp$((i+1))"
     sudo ip link set "veth_mcp$i" up mtu 9000
@@ -337,14 +336,8 @@ function create_vms {
 
     # prepare network args
     local vnode_networks=("$@")
-    if [[ "${vnode_data[0]}" =~ ^(cfg01|mas01) ]]; then
-      net_args=" --network network=mcpcontrol,model=virtio"
-      # 3rd interface gets connected to PXE/Admin Bridge (cfg01, mas01)
-      vnode_networks[2]="${vnode_networks[0]}"
-    else
-      net_args=" --network bridge=${vnode_networks[0]},model=virtio"
-    fi
-    for net in "${vnode_networks[@]:1}"; do
+    local net_args=
+    for net in "${vnode_networks[@]}"; do
       net_args="${net_args} --network bridge=${net},model=virtio"
     done
 
@@ -370,27 +363,16 @@ function create_vms {
   done
 }
 
-function update_mcpcontrol_network {
-  # set static ip address for salt master node, MaaS node
-  local amac=$(${VIRSH} domiflist mas01 2>&1| awk '/mcpcontrol/ {print $5; exit}')
-  [ -z "${amac}" ] || ${VIRSH} net-update "mcpcontrol" add ip-dhcp-host \
-    "<host mac='${amac}' name='mas01' ip='${MAAS_IP}'/>" --live --config
-}
-
 function reset_vms {
   local vnodes=("$@")
   local cmd_str="ssh ${SSH_OPTS} ${SSH_SALT}"
 
   # reset non-infrastructure vms, wait for them to come back online
   for node in "${vnodes[@]}"; do
-    if [[ ! "${node}" =~ (cfg01|mas01) ]]; then
-      ${VIRSH} reset "${node}"
-    fi
+    ${VIRSH} reset "${node}"
   done
   for node in "${vnodes[@]}"; do
-    if [[ ! "${node}" =~ (cfg01|mas01) ]]; then
-      wait_for 20.0 "${cmd_str} sudo salt -C '${node}*' saltutil.sync_all"
-    fi
+    wait_for 20.0 "${cmd_str} sudo salt -C '${node}*' saltutil.sync_all"
   done
 }
 
@@ -414,9 +396,26 @@ function prepare_containers {
   if [[ ! "${MCP_DOCKER_TAG}" =~ 'verify' ]]; then
     "${COMPOSE_PREFIX}docker-compose" -f docker-compose/docker-compose.yaml pull
   fi
-  sudo rm -rf "${image_dir}/"{salt,hosts,pki} "${image_dir}/nodes/"*
-  mkdir -p "${image_dir}/salt/"{master.d,minion.d}
-  touch "${image_dir}/hosts"
+  # overwrite hosts only on first container up, to preserve cluster nodes
+  sudo cp docker-compose/files/hosts "${image_dir}/hosts"
+  sudo rm -rf "${image_dir}/"{salt,pki,mas01/etc} "${image_dir}/nodes/"*
+  find "${image_dir}/mas01/var/lib/" \
+    -mindepth 2 -maxdepth 2 -not -name boot-resources \
+    -exec sudo rm -rf {} \; || true
+  mkdir -p "${image_dir}/"{salt/master.d,salt/minion.d}
+
+  if grep -q -e 'maas' 'docker-compose/docker-compose.yaml'; then
+    chmod +x docker-compose/files/entrypoint*.sh
+    # Apparmor workaround for bind9 inside Docker containers using AUFS
+    for profile in 'usr.sbin.ntpd' 'usr.sbin.named' \
+                   'usr.sbin.dhcpd' 'usr.bin.tcpdump'; do
+      if [ -e "/etc/apparmor.d/${profile}" ] && \
+       [ ! -e "/etc/apparmor.d/disable/${profile}" ]; then
+        sudo ln -sf "/etc/apparmor.d/${profile}" "/etc/apparmor.d/disable/"
+        sudo apparmor_parser -R "/etc/apparmor.d/${profile}" || true
+      fi
+    done
+  fi
 }
 
 function start_containers {