diff options
15 files changed, 210 insertions, 290 deletions
diff --git a/ci/build.sh b/ci/build.sh index f15c52951..ec0040e7d 100755 --- a/ci/build.sh +++ b/ci/build.sh @@ -62,17 +62,17 @@ PYTHON_BIN_PATH="$(python -m site --user-base)/bin" PATH="$PATH:$PYTHON_BIN_PATH" notify "[NOTE] Installing required build-time distro and pip pkgs" 2 jumpserver_pkg_install 'build' -pip install pipenv --user +python -m pip install --upgrade pipenv --user docker_install popd > /dev/null pushd "${DOCKER_DIR}" > /dev/null -pipenv --two -pipenv install -pipenv install invoke +python -m pipenv --two +env VIRTUALENV_ALWAYS_COPY=1 python -m pipenv install +env VIRTUALENV_ALWAYS_COPY=1 python -m pipenv install invoke # shellcheck disable=SC2086 -pipenv run \ +python -m pipenv run \ invoke build saltmaster-reclass \ --require 'salt salt-formulas opnfv reclass tini-saltmaster' \ --dist=ubuntu \ diff --git a/mcp/patches/salt-formula-linux/0002-Set-ovs-bridges-as-L3-interfaces.patch b/mcp/patches/salt-formula-linux/0001-Set-ovs-bridges-as-L3-interfaces.patch index 390a0bfcd..390a0bfcd 100644 --- a/mcp/patches/salt-formula-linux/0002-Set-ovs-bridges-as-L3-interfaces.patch +++ b/mcp/patches/salt-formula-linux/0001-Set-ovs-bridges-as-L3-interfaces.patch diff --git a/mcp/patches/salt-formula-linux/0001-system.repo-Debian-Use-proxy-for-keyservers.patch b/mcp/patches/salt-formula-linux/0001-system.repo-Debian-Use-proxy-for-keyservers.patch deleted file mode 100644 index 4ad51e3e0..000000000 --- a/mcp/patches/salt-formula-linux/0001-system.repo-Debian-Use-proxy-for-keyservers.patch +++ /dev/null @@ -1,157 +0,0 @@ -:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: -: Copyright (c) 2018 Mirantis Inc., Enea AB and others. -: -: All rights reserved. This program and the accompanying materials -: are made available under the terms of the Apache License, Version 2.0 -: which accompanies this distribution, and is available at -: http://www.apache.org/licenses/LICENSE-2.0 -:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: -From: Alexandru Avadanii <Alexandru.Avadanii@enea.com> -Date: Sun, 3 Jun 2018 19:28:18 +0200 -Subject: [PATCH] system.repo: Debian: Use proxy for keyservers - -Previously, when fetching GPG keys for APT keyring, either using -public key download & import (as for default repos) or via keyserver, -we relied on simple `curl` calls or passed it down to Salt aptpkg -module. -To be able to retrieve APT keys behind a proxy, one used to have to -configure the proxy for the Salt minion, which does not yet have -`no_proxy` support (either *all* or *no* traffic hits the proxy). - -When `linux:system:proxy` http(s) proxies are set: -- no longer pass key configuration to Salt aptpkg (until it properly - supports `no_proxy`); -- handle all keys explicitly with `curl` and `apt-key`; -- set 'http(s)_proxy' env vars for `cmd.wait` calls; - -If `linux:system:proxy` is not defined, the behavior is -unchanged for backwards compatibility. - -NOTE: If present, per-repo proxies are also used for keyserver access. - -system.repo: Fix conditions order for Debian proxy - -Signed-off-by: Alexandru Avadanii <Alexandru.Avadanii@enea.com> ---- - linux/system/repo.sls | 55 ++++++++++++++++++++++++++++++++++++------- - 1 file changed, 47 insertions(+), 8 deletions(-) - -diff --git a/linux/system/repo.sls b/linux/system/repo.sls -index 0c0b026..82661f0 100644 ---- a/linux/system/repo.sls -+++ b/linux/system/repo.sls -@@ -7,18 +7,27 @@ linux_repo_prereq_pkgs: - - pkgs: {{ system.pkgs }} - {%- endif %} - -+ {%- set proxies = {'system': {}, 'repo': {}} %} -+ - # global proxy setup - {%- if grains.os_family == 'Debian' %} -+ - {%- if system.proxy.get('pkg', {}).get('enabled', False) %} -+ -+ {%- do proxies.system.update({'https': system.proxy.get('pkg', {}).get('https', None) | default(system.proxy.get('https', None), true)}) %} -+ {%- do proxies.system.update({'http': system.proxy.get('pkg', {}).get('http', None) | default(system.proxy.get('http', None), true)}) %} -+ {%- do proxies.system.update({'ftp': system.proxy.get('pkg', {}).get('ftp', None) | default(system.proxy.get('ftp', None), true)}) %} -+ - /etc/apt/apt.conf.d/99proxies-salt: - file.managed: - - template: jinja - - source: salt://linux/files/apt.conf.d_proxies - - defaults: - external_host: False -- https: {{ system.proxy.get('pkg', {}).get('https', None) | default(system.proxy.get('https', None), true) }} -- http: {{ system.proxy.get('pkg', {}).get('http', None) | default(system.proxy.get('http', None), true) }} -- ftp: {{ system.proxy.get('pkg', {}).get('ftp', None) | default(system.proxy.get('ftp', None), true) }} -+ https: {{ proxies.system.https }} -+ http: {{ proxies.system.http }} -+ ftp: {{ proxies.system.ftp }} -+ - {%- else %} - /etc/apt/apt.conf.d/99proxies-salt: - file.absent -@@ -43,16 +52,20 @@ purge_sources_list_d_repos: - # per repository proxy setup - {%- if repo.get('proxy', {}).get('enabled', False) %} - {%- set external_host = repo.proxy.get('host', None) or repo.source.split('/')[2] %} -+ {%- do proxies.repo.update({'https': repo.proxy.get('https', None) or system.proxy.get('pkg', {}).get('https', None) | default(system.proxy.get('https', None), true)}) %} -+ {%- do proxies.repo.update({'http': repo.proxy.get('http', None) or system.proxy.get('pkg', {}).get('http', None) | default(system.proxy.get('http', None), true)}) %} -+ {%- do proxies.repo.update({'ftp': repo.proxy.get('ftp', None) or system.proxy.get('pkg', {}).get('ftp', None) | default(system.proxy.get('ftp', None), true)}) %} - /etc/apt/apt.conf.d/99proxies-salt-{{ name }}: - file.managed: - - template: jinja - - source: salt://linux/files/apt.conf.d_proxies - - defaults: - external_host: {{ external_host }} -- https: {{ repo.proxy.get('https', None) or system.proxy.get('pkg', {}).get('https', None) | default(system.proxy.get('https', None), True) }} -- http: {{ repo.proxy.get('http', None) or system.proxy.get('pkg', {}).get('http', None) | default(system.proxy.get('http', None), True) }} -- ftp: {{ repo.proxy.get('ftp', None) or system.proxy.get('pkg', {}).get('ftp', None) | default(system.proxy.get('ftp', None), True) }} -+ https: {{ proxies.repo.https }} -+ http: {{ proxies.repo.http }} -+ ftp: {{ proxies.repo.ftp }} - {%- else %} -+ {%- do proxies.repo.update({'https': None, 'http': None, 'ftp': None}) %} - /etc/apt/apt.conf.d/99proxies-salt-{{ name }}: - file.absent - {%- endif %} -@@ -104,6 +117,13 @@ linux_repo_{{ name }}_key: - {% else %} - - pkgrepo: linux_repo_{{ name }} - {% endif %} -+ - env: -+ {%- if proxies.repo.get('https', None) or proxies.system.get('https', None) %} -+ - https_proxy: {{ proxies.repo.get('https', None) or proxies.system.get('https', None) }} -+ {%- endif %} -+ {%- if proxies.repo.get('http', None) or proxies.system.get('http', None) %} -+ - http_proxy: {{ proxies.repo.get('http', None) or proxies.system.get('http', None) }} -+ {%- endif %} - {%- endif %} - - {%- if repo.get('default', False) %} -@@ -111,6 +131,9 @@ linux_repo_{{ name }}_key: - {%- else %} - - {%- if repo.get('enabled', True) %} -+ {%- set use_proxy = ( ( proxies.repo.get('https', None) or proxies.system.get('https', None) or -+ proxies.repo.get('http', None) or proxies.system.get('http', None) ) and -+ repo.key_id is defined and repo.key_server is defined ) %} - linux_repo_{{ name }}: - pkgrepo.managed: - - refresh_db: False -@@ -126,10 +149,10 @@ linux_repo_{{ name }}: - {%- endif %} - - file: /etc/apt/sources.list.d/{{ name }}.list - - clean_file: {{ repo.get('clean_file', True) }} -- {%- if repo.key_id is defined %} -+ {%- if not use_proxy and repo.key_id is defined %} - - keyid: {{ repo.key_id }} - {%- endif %} -- {%- if repo.key_server is defined %} -+ {%- if not use_proxy and repo.key_server is defined %} - - keyserver: {{ repo.key_server }} - {%- endif %} - {%- if repo.key_url is defined and (grains['saltversioninfo'] >= [2017, 7] or repo.key_url.startswith('salt://')) %} -@@ -143,6 +166,22 @@ linux_repo_{{ name }}: - - file: purge_sources_list_d_repos - {%- endif %} - {%- endif %} -+ {%- if use_proxy and repo.key_id is defined and repo.key_server is defined %} -+linux_repo_{{ name }}_key: -+ cmd.run: -+ - name: "apt-key adv --keyserver {{ repo.key_server }} --recv {{ repo.key_id }}" -+ - unless: 'test -e /etc/apt/sources.list.d/{{ name }}.list' -+ - require_in: -+ - pkgrepo: linux_repo_{{ name }} -+ - env: -+ {%- if proxies.repo.get('https', None) or proxies.system.get('https', None) %} -+ - https_proxy: {{ proxies.repo.get('https', None) or proxies.system.get('https', None) }} -+ {%- endif %} -+ {%- if proxies.repo.get('http', None) or proxies.system.get('http', None) %} -+ - http_proxy: {{ proxies.repo.get('http', None) or proxies.system.get('http', None) }} -+ {%- endif %} -+ {%- endif %} -+ {#- repo.enabled is false #} - {%- else %} - linux_repo_{{ name }}: - pkgrepo.absent: diff --git a/mcp/reclass/classes/cluster/all-mcp-arch-common/infra/maas.yml.j2 b/mcp/reclass/classes/cluster/all-mcp-arch-common/infra/maas.yml.j2 index efa04cecf..9d5115844 100644 --- a/mcp/reclass/classes/cluster/all-mcp-arch-common/infra/maas.yml.j2 +++ b/mcp/reclass/classes/cluster/all-mcp-arch-common/infra/maas.yml.j2 @@ -25,8 +25,6 @@ parameters: pxe_admin_interface_mtu: 1500 linux_system_codename: xenial maas_admin_username: opnfv - maas_admin_password: opnfv_secret - maas_db_password: opnfv_secret dns_server01: '{{ nm.dns_public[0] }}' single_address: ${_param:infra_maas_node01_deploy_address} hwe_kernel: 'hwe-16.04' @@ -86,26 +84,7 @@ parameters: distributions: '${_param:openstack_version}-armband' components: 'main' arches: 'arm64' - key: &armband_key | - -----BEGIN PGP PUBLIC KEY BLOCK----- - Version: GnuPG v2.0.14 (GNU/Linux) - - mQENBFagAroBCADWboNIjuF6lB1mWv2+EbvqY3lKl5mLKhr2DnSUkKeHUPBv8gNM - qK8Q00AMIyPiyEhgjA+dWizZ+5aBgxoiY7oMeLJ2Xym36U/8SYq2BWd3SGCbMNoz - SJDxDUSM/HFVs6atF1M3DY9oN65hSVnu4uy5Tu6asf6k4rhAyk0z4+pRcPBCu2vq - mnGi3COM/+9PShrEKeVOx5W2vRJywUFuq8EDvQnRoJ0GvM28JiJIanw17YwIPxhg - BKZVpZjan5X+ihVMXwA2h/G/FS5Omhd50RqV6LWSYs94VJJgYqHx8UMm7izcxI+P - ct3IcbD195bPbJ+SbuiFe45ZLsdY1MyGiU2BABEBAAG0K0VuZWEgQXJtYmFuZCBE - ZXZvcHMgVGVhbSA8YXJtYmFuZEBlbmVhLmNvbT6JATgEEwECACICGwMGCwkIBwMC - BhUIAgkKCwQWAgMBAh4BAheABQJaY3bYAAoJEN6rkLp5irHRoQMH/0PYl0A/6eWw - nQ/szhEFrr76Ln6wA4vEO+PiuWj9kTkZM2NaCnkisrIuHSPIVvOLfFmztbE6sKGe - t+a2b7Jqw48DZ/gq508aZE4Q307ookxdCOrzIu/796hFO34yXg3sqZoJh3VmKIjY - 4DL8yG1iAiQ5vOw3IFWQnATwIZUgaCcjmE7HGap+9ePuJfFuQ8mIG5cy28t8qocx - AB/B2tucfBMwomYxKqgbLI5AG7iSt58ajvrrNa9f8IX7Ihj/jiuXhUwX+geEp98K - IWVI1ftEthZvfBpZW4BS98J4z//dEPi31L4jb9RQXq3afF2RpXchDeUN85bW45nu - W/9PMAlgE/U= - =m+zE - -----END PGP PUBLIC KEY BLOCK----- + key: ${_param:armband_key} {%- endif %} salt_master_ip: ${_param:reclass_config_master} domain: ${_param:cluster_domain} diff --git a/mcp/reclass/classes/cluster/all-mcp-arch-common/init.yml.j2 b/mcp/reclass/classes/cluster/all-mcp-arch-common/init.yml.j2 index eb0a538f6..84c82b738 100644 --- a/mcp/reclass/classes/cluster/all-mcp-arch-common/init.yml.j2 +++ b/mcp/reclass/classes/cluster/all-mcp-arch-common/init.yml.j2 @@ -9,6 +9,7 @@ classes: - system.linux.system.single - cluster.all-mcp-arch-common.opnfv + - cluster.all-mcp-arch-common.passwords parameters: _param: openstack_version: queens @@ -46,3 +47,24 @@ parameters: ntp_strata_host1: {{ conf.idf.fuel.network.ntp_strata_host1 or '1.pool.ntp.org' }} ntp_strata_host2: {{ conf.idf.fuel.network.ntp_strata_host2 or '0.pool.ntp.org' }} + + armband_key: | + -----BEGIN PGP PUBLIC KEY BLOCK----- + Version: GnuPG v2.0.14 (GNU/Linux) + + mQENBFagAroBCADWboNIjuF6lB1mWv2+EbvqY3lKl5mLKhr2DnSUkKeHUPBv8gNM + qK8Q00AMIyPiyEhgjA+dWizZ+5aBgxoiY7oMeLJ2Xym36U/8SYq2BWd3SGCbMNoz + SJDxDUSM/HFVs6atF1M3DY9oN65hSVnu4uy5Tu6asf6k4rhAyk0z4+pRcPBCu2vq + mnGi3COM/+9PShrEKeVOx5W2vRJywUFuq8EDvQnRoJ0GvM28JiJIanw17YwIPxhg + BKZVpZjan5X+ihVMXwA2h/G/FS5Omhd50RqV6LWSYs94VJJgYqHx8UMm7izcxI+P + ct3IcbD195bPbJ+SbuiFe45ZLsdY1MyGiU2BABEBAAG0K0VuZWEgQXJtYmFuZCBE + ZXZvcHMgVGVhbSA8YXJtYmFuZEBlbmVhLmNvbT6JATgEEwECACICGwMGCwkIBwMC + BhUIAgkKCwQWAgMBAh4BAheABQJaY3bYAAoJEN6rkLp5irHRoQMH/0PYl0A/6eWw + nQ/szhEFrr76Ln6wA4vEO+PiuWj9kTkZM2NaCnkisrIuHSPIVvOLfFmztbE6sKGe + t+a2b7Jqw48DZ/gq508aZE4Q307ookxdCOrzIu/796hFO34yXg3sqZoJh3VmKIjY + 4DL8yG1iAiQ5vOw3IFWQnATwIZUgaCcjmE7HGap+9ePuJfFuQ8mIG5cy28t8qocx + AB/B2tucfBMwomYxKqgbLI5AG7iSt58ajvrrNa9f8IX7Ihj/jiuXhUwX+geEp98K + IWVI1ftEthZvfBpZW4BS98J4z//dEPi31L4jb9RQXq3afF2RpXchDeUN85bW45nu + W/9PMAlgE/U= + =m+zE + -----END PGP PUBLIC KEY BLOCK----- diff --git a/mcp/reclass/classes/cluster/all-mcp-arch-common/passwords.yml b/mcp/reclass/classes/cluster/all-mcp-arch-common/passwords.yml new file mode 100644 index 000000000..0c6d274b4 --- /dev/null +++ b/mcp/reclass/classes/cluster/all-mcp-arch-common/passwords.yml @@ -0,0 +1,63 @@ +############################################################################## +# Copyright (c) 2018 Mirantis Inc., Enea AB and others. +# All rights reserved. This program and the accompanying materials +# are made available under the terms of the Apache License, Version 2.0 +# which accompanies this distribution, and is available at +# http://www.apache.org/licenses/LICENSE-2.0 +############################################################################## +--- +parameters: + _param: + opnfv_main_password: opnfv_secret + + maas_admin_password: ${_param:opnfv_main_password} + maas_db_password: ${_param:opnfv_main_password} + infra_maas_database_password: ${_param:opnfv_main_password} + + galera_server_maintenance_password: ${_param:opnfv_main_password} + galera_server_admin_password: ${_param:opnfv_main_password} + rabbitmq_secret_key: ${_param:opnfv_main_password} + rabbitmq_admin_password: ${_param:opnfv_main_password} + rabbitmq_openstack_password: ${_param:opnfv_main_password} + rabbitmq_cold_password: ${_param:opnfv_main_password} + mysql_admin_password: ${_param:opnfv_main_password} + mysql_cinder_password: ${_param:opnfv_main_password} + mysql_ceilometer_password: ${_param:opnfv_main_password} + mysql_glance_password: ${_param:opnfv_main_password} + mysql_grafana_password: ${_param:opnfv_main_password} + mysql_heat_password: ${_param:opnfv_main_password} + mysql_keystone_password: ${_param:opnfv_main_password} + mysql_neutron_password: ${_param:opnfv_main_password} + mysql_nova_password: ${_param:opnfv_main_password} + mysql_aodh_password: ${_param:opnfv_main_password} + mysql_designate_password: ${_param:opnfv_main_password} + keystone_aodh_password: ${_param:opnfv_main_password} + keystone_service_token: ${_param:opnfv_main_password} + keystone_admin_password: ${_param:opnfv_main_password} + keystone_ceilometer_password: ${_param:opnfv_main_password} + keystone_cinder_password: ${_param:opnfv_main_password} + keystone_glance_password: ${_param:opnfv_main_password} + keystone_heat_password: ${_param:opnfv_main_password} + keystone_keystone_password: ${_param:opnfv_main_password} + keystone_neutron_password: ${_param:opnfv_main_password} + keystone_nova_password: ${_param:opnfv_main_password} + keystone_designate_password: ${_param:opnfv_main_password} + mysql_barbican_password: ${_param:opnfv_main_password} + keystone_barbican_password: ${_param:opnfv_main_password} + metadata_password: ${_param:opnfv_main_password} + openstack_telemetry_keepalived_password: ${_param:opnfv_main_password} + mysql_panko_password: ${_param:opnfv_main_password} + keystone_panko_password: ${_param:opnfv_main_password} + mysql_gnocchi_password: ${_param:opnfv_main_password} + keystone_gnocchi_password: ${_param:opnfv_main_password} + mysql_tacker_password: ${_param:opnfv_main_password} + keystone_tacker_password: ${_param:opnfv_main_password} + heat_domain_admin_password: ${_param:opnfv_main_password} + ceilometer_influxdb_password: ${_param:opnfv_main_password} + ceilometer_secret_key: ${_param:opnfv_main_password} + + opendaylight_password: admin + + barbican_simple_crypto_kek: "YWJjZGVmZ2hpamtsbW5vcHFyc3R1dnd4eXoxMjM0NTY=" + horizon_secret_key: opaesee8Que2yahJoh9fo0eefo1Aeyo6ahyei8zeiboh3aeth5loth7ieNa5xi5e + designate_bind9_rndc_key: 4pc+X4PDqb2q+5o72dISm72LM1Ds9X2EYZjqg+nmsS7FhdTwzFFY8l/iEDmHxnyjkA33EQC8H+z0fLLBunoitw== diff --git a/mcp/reclass/classes/cluster/all-mcp-arch-common/uca_repo.yml b/mcp/reclass/classes/cluster/all-mcp-arch-common/uca_repo.yml new file mode 100644 index 000000000..9c806560f --- /dev/null +++ b/mcp/reclass/classes/cluster/all-mcp-arch-common/uca_repo.yml @@ -0,0 +1,68 @@ +############################################################################## +# Copyright (c) 2018 Mirantis Inc., Enea AB and others. +# All rights reserved. This program and the accompanying materials +# are made available under the terms of the Apache License, Version 2.0 +# which accompanies this distribution, and is available at +# http://www.apache.org/licenses/LICENSE-2.0 +############################################################################## +--- +parameters: + linux: + system: + repo: + uca: + # yamllint disable-line rule:line-length + source: "deb http://ubuntu-cloud.archive.canonical.com/ubuntu xenial-updates/${_param:openstack_version} main" + key: | + -----BEGIN PGP PUBLIC KEY BLOCK----- + Version: GnuPG v1 + + mQINBFAqSlgBEADPKwXUwqbgoDYgR20zFypxSZlSbrttOKVPEMb0HSUx9Wj8VvNC + r+mT4E9wAyq7NTIs5ad2cUhXoyenrjcfGqK6k9R6yRHDbvAxCSWTnJjw7mzsajDN + ocXC6THKVW8BSjrh0aOBLpht6d5QCO2vyWxw65FKM65GOsbX03ZngUPMuOuiOEHQ + Zo97VSH2pSB+L+B3d9B0nw3QnU8qZMne+nVWYLYRXhCIxSv1/h39SXzHRgJoRUFH + vL2aiiVrn88NjqfDW15HFhVJcGOFuACZnRA0/EqTq0qNo3GziQO4mxuZi3bTVL5s + GABiYW9uIlokPqcS7Fa0FRVIU9R+bBdHZompcYnKAeGag+uRvuTqC3MMRcLUS9Oi + /P9I8fPARXUPwzYN3fagCGB8ffYVqMunnFs0L6td08BgvWwer+Buu4fPGsQ5OzMc + lgZ0TJmXyOlIW49lc1UXnORp4sm7HS6okA7P6URbqyGbaplSsNUVTgVbi+vc8/jY + dfExt/3HxVqgrPlq9htqYgwhYvGIbBAxmeFQD8Ak/ShSiWb1FdQ+f7Lty+4mZLfN + 8x4zPZ//7fD5d/PETPh9P0msF+lLFlP564+1j75wx+skFO4v1gGlBcDaeipkFzeo + zndAgpegydKSNTF4QK9iTYobTIwsYfGuS8rV21zE2saLM0CE3T90aHYB/wARAQAB + tD1DYW5vbmljYWwgQ2xvdWQgQXJjaGl2ZSBTaWduaW5nIEtleSA8ZnRwbWFzdGVy + QGNhbm9uaWNhbC5jb20+iQI3BBMBCAAhBQJQKkpYAhsDBQsJCAcDBRUKCQgLBRYC + AwEAAh4BAheAAAoJEF7bG2LsSSbqKxkQAIKtgImrk02YCDldg6tLt3b69ZK0kIVI + 3Xso/zCBZbrYFmgGQEFHAa58mIgpv5GcgHHxWjpX3n4tu2RM9EneKvFjFBstTTgo + yuCgFr7iblvs/aMW4jFJAiIbmjjXWVc0CVB/JlLqzBJ/MlHdR9OWmojN9ZzoIA+i + +tWlypgUot8iIxkR6JENxit5v9dN8i6anmnWybQ6PXFMuNi6GzQ0JgZIVs37n0ks + 2wh0N8hBjAKuUgqu4MPMwvNtz8FxEzyKwLNSMnjLAhzml/oje/Nj1GBB8roj5dmw + 7PSul5pAqQ5KTaXzl6gJN5vMEZzO4tEoGtRpA0/GTSXIlcx/SGkUK5+lqdQIMdyS + n8bImU6V6rDSoOaI9YWHZtpv5WeUsNTdf68jZsFCRD+2+NEmIqBVm11yhmUoasC6 + dYw5l9P/PBdwmFm6NBUSEwxb+ROfpL1ICaZk9Jy++6akxhY//+cYEPLin02r43Z3 + o5Piqujrs1R2Hs7kX84gL5SlBzTM4Ed+ob7KVtQHTefpbO35bQllkPNqfBsC8AIC + 8xvTP2S8FicYOPATEuiRWs7Kn31TWC2iwswRKEKVRmN0fdpu/UPdMikyoNu9szBZ + RxvkRAezh3WheJ6MW6Fmg9d+uTFJohZt5qHdpxYa4beuN4me8LF0TYzgfEbFT6b9 + D6IyTFoT0LequQINBFAqSlgBEADmL3TEq5ejBYrA+64zo8FYvCF4gziPa5rCIJGZ + /gZXQ7pm5zek/lOe9C80mhxNWeLmrWMkMOWKCeaDMFpMBOQhZZmRdakOnH/xxO5x + +fRdOOhy+5GTRJiwkuGOV6rB9eYJ3UN9caP2hfipCMpJjlg3j/GwktjhuqcBHXhA + HMhzxEOIDE5hmpDqZ051f8LGXld9aSL8RctoYFM8sgafPVmICTCq0Wh03dr5c2JA + gEXy3ushYm/8i2WFmyldo7vbtTfx3DpmJc/EMpGKV+GxcI3/ERqSkde0kWlmfPZb + o/5+hRqSryqfQtRKnFEQgAqAhPIwXwOkjCpPnDNfrkvzVEtl2/BWP/1/SOqzXjk9 + TIb1Q7MHANeFMrTCprzPLX6IdC4zLp+LpV91W2zygQJzPgWqH/Z/WFH4gXcBBqmI + 8bFpMPONYc9/67AWUABo2VOCojgtQmjxuFn+uGNw9PvxJAF3yjl781PVLUw3n66d + wHRmYj4hqxNDLywhhnL/CC7KUDtBnUU/CKn/0Xgm9oz3thuxG6i3F3pQgpp7MeMn + tKhLFWRXo9Bie8z/c0NV4K5HcpbGa8QPqoDseB5WaO4yGIBOt+nizM4DLrI+v07y + Xe3Jm7zBSpYSrGarZGK68qamS3XPzMshPdoXXz33bkQrTPpivGYQVRZuzd/R6b+6 + IurV+QARAQABiQIfBBgBCAAJBQJQKkpYAhsMAAoJEF7bG2LsSSbq59EP/1U3815/ + yHV3cf/JeHgh6WS/Oy2kRHp/kJt3ev/l/qIxfMIpyM3u/D6siORPTUXHPm3AaZrb + w0EDWByA3jHQEzlLIbsDGZgrnl+mxFuHwC1yEuW3xrzgjtGZCJureZ/BD6xfRuRc + mvnetAZv/z98VN/oj3rvYhUi71NApqSvMExpNBGrdO6gQlI5azhOu8xGNy4OSke8 + J6pAsMUXIcEwjVEIvewJuqBW/3rj3Hh14tmWjQ7shNnYBuSJwbLeUW2e8bURnfXE + TxrCmXzDmQldD5GQWCcD5WDosk/HVHBmHlqrqy0VO2nE3c73dQlNcI4jVWeC4b4Q + SpYVsFz/6Iqy5ZQkCOpQ57MCf0B6P5nF92c5f3TYPMxHf0x3DrjDbUVZytxDiZZa + XsbZzsejbbc1bSNp4hb+IWhmWoFnq/hNHXzKPHBTapObnQju+9zUlQngV0BlPT62 + hOHOw3Pv7suOuzzfuOO7qpz0uAy8cFKe7kBtLSFVjBwaG5JX89mgttYW+lw9Rmsb + p9Iw4KKFHIBLOwk7s+u0LUhP3d8neBI6NfkOYKZZCm3CuvkiOeQP9/2okFjtj+29 + jEL+9KQwrGNFEVNe85Un5MJfYIjgyqX3nJcwypYxidntnhMhr2VD3HL2R/4CiswB + Oa4g9309p/+af/HU1smBrOfIeRoxb8jQoHu3 + =xg4S + -----END PGP PUBLIC KEY BLOCK----- diff --git a/mcp/reclass/classes/cluster/mcp-common-ha/glusterfs_repo.yml b/mcp/reclass/classes/cluster/mcp-common-ha/glusterfs_repo.yml index ecf0e2dc4..b28cfe74a 100644 --- a/mcp/reclass/classes/cluster/mcp-common-ha/glusterfs_repo.yml +++ b/mcp/reclass/classes/cluster/mcp-common-ha/glusterfs_repo.yml @@ -6,17 +6,17 @@ # http://www.apache.org/licenses/LICENSE-2.0 ############################################################################## --- +classes: + - system.linux.system.repo.keystorage.glusterfs parameters: _param: glusterfs_version: "3.13" linux: system: repo: - glusterfs-ppa: + mcp_glusterfs: # yamllint disable-line rule:line-length source: "deb http://ppa.launchpad.net/gluster/glusterfs-${_param:glusterfs_version}/ubuntu ${_param:linux_system_codename} main" - key_id: 3FE869A9 - key_server: keyserver.ubuntu.com pin: - package: '*' pin: release o=LP-PPA-gluster-glusterfs-${_param:glusterfs_version} diff --git a/mcp/reclass/classes/cluster/mcp-common-ha/infra/init.yml.j2 b/mcp/reclass/classes/cluster/mcp-common-ha/infra/init.yml.j2 index 05b96e40b..2f4686767 100644 --- a/mcp/reclass/classes/cluster/mcp-common-ha/infra/init.yml.j2 +++ b/mcp/reclass/classes/cluster/mcp-common-ha/infra/init.yml.j2 @@ -19,7 +19,6 @@ parameters: reclass_config_master: ${_param:opnfv_infra_config_pxe_admin_address} cluster_public_host: ${_param:openstack_proxy_address} infra_config_hostname: cfg01 - infra_maas_database_password: opnfv_secret # infra service addresses infra_config_address: ${_param:opnfv_infra_config_address} diff --git a/mcp/reclass/classes/cluster/mcp-common-ha/openstack_init.yml.j2 b/mcp/reclass/classes/cluster/mcp-common-ha/openstack_init.yml.j2 index 79eafcd10..b08837876 100644 --- a/mcp/reclass/classes/cluster/mcp-common-ha/openstack_init.yml.j2 +++ b/mcp/reclass/classes/cluster/mcp-common-ha/openstack_init.yml.j2 @@ -7,6 +7,8 @@ ############################################################################## {%- import 'net_map.j2' as nm with context %} --- +classes: + - cluster.all-mcp-arch-common.uca_repo parameters: _param: # openstack service addresses @@ -131,23 +133,16 @@ parameters: neutron_compute_agent_mode: legacy neutron_compute_external_access: 'True' galera_server_cluster_name: openstack_cluster - galera_server_maintenance_password: opnfv_secret - galera_server_admin_password: opnfv_secret - rabbitmq_secret_key: opnfv_secret - rabbitmq_admin_password: opnfv_secret - rabbitmq_openstack_password: opnfv_secret glance_version: ${_param:openstack_version} glance_service_host: ${_param:openstack_control_address} keystone_version: ${_param:openstack_version} keystone_service_host: ${_param:openstack_control_address} heat_version: ${_param:openstack_version} heat_service_host: ${_param:openstack_control_address} - heat_domain_admin_password: opnfv_secret cinder_version: ${_param:openstack_version} cinder_service_host: ${_param:openstack_control_address} ceilometer_version: ${_param:openstack_version} ceilometer_service_host: ${_param:openstack_telemetry_address} - ceilometer_influxdb_password: opnfv_secret nova_version: ${_param:openstack_version} nova_service_host: ${_param:openstack_control_address} neutron_version: ${_param:openstack_version} @@ -158,59 +153,22 @@ parameters: glusterfs_service_host: ${_param:openstack_control_address} {%- endif %} mysql_admin_user: root - mysql_admin_password: opnfv_secret - mysql_cinder_password: opnfv_secret - mysql_ceilometer_password: opnfv_secret - mysql_glance_password: opnfv_secret - mysql_grafana_password: opnfv_secret - mysql_heat_password: opnfv_secret - mysql_keystone_password: opnfv_secret - mysql_neutron_password: opnfv_secret - mysql_nova_password: opnfv_secret - mysql_aodh_password: opnfv_secret - mysql_designate_password: opnfv_secret - aodh_version: ${_param:openstack_version} - keystone_aodh_password: opnfv_secret - keystone_service_token: opnfv_secret - keystone_admin_password: opnfv_secret - keystone_ceilometer_password: opnfv_secret - keystone_cinder_password: opnfv_secret - keystone_glance_password: opnfv_secret - keystone_heat_password: opnfv_secret - keystone_keystone_password: opnfv_secret - keystone_neutron_password: opnfv_secret - keystone_nova_password: opnfv_secret - keystone_designate_password: opnfv_secret - barbican_version: ${_param:openstack_version} barbican_service_host: ${_param:openstack_control_address} - mysql_barbican_password: opnfv_secret - keystone_barbican_password: opnfv_secret - barbican_simple_crypto_kek: "YWJjZGVmZ2hpamtsbW5vcHFyc3R1dnd4eXoxMjM0NTY=" barbican_integration_enabled: true - - ceilometer_secret_key: opnfv_secret horizon_version: ${_param:openstack_version} - horizon_secret_key: opaesee8Que2yahJoh9fo0eefo1Aeyo6ahyei8zeiboh3aeth5loth7ieNa5xi5e horizon_identity_host: ${_param:openstack_control_address} horizon_identity_encryption: none horizon_identity_version: 3 - metadata_password: opnfv_secret - openstack_telemetry_keepalived_password: opnfv_secret aodh_service_host: ${_param:openstack_telemetry_address} gnocchi_version: 4.2 gnocchi_service_host: ${_param:openstack_telemetry_address} - mysql_gnocchi_password: opnfv_secret - keystone_gnocchi_password: opnfv_secret panko_version: ${_param:openstack_version} panko_service_host: ${_param:openstack_telemetry_address} - mysql_panko_password: opnfv_secret - keystone_panko_password: opnfv_secret ceilometer_agent_default_polling_interval: 180 ceilometer_agent_default_polling_meters: - "*" designate_service_host: ${_param:openstack_control_address} - designate_bind9_rndc_key: 4pc+X4PDqb2q+5o72dISm72LM1Ds9X2EYZjqg+nmsS7FhdTwzFFY8l/iEDmHxnyjkA33EQC8H+z0fLLBunoitw== designate_domain_id: 5186883b-91fb-4891-bd49-e6769234a8fc designate_pool_ns_records: - hostname: 'ns1.example.org.' @@ -250,9 +208,6 @@ parameters: system: repo: uca: - source: "deb http://ubuntu-cloud.archive.canonical.com/ubuntu xenial-updates/${_param:openstack_version} main" - key_id: EC4926EA - key_server: keyserver.ubuntu.com pin: - pin: 'release o=Canonical' priority: 1200 @@ -260,8 +215,7 @@ parameters: {%- if 'aarch64' in nm.cluster.arch %} armband_3: # Should be in sync with the repo config generated via curtin/MaaS source: "deb http://linux.enea.com/mcp-repos/${_param:openstack_version}/${_param:linux_system_codename} ${_param:openstack_version}-armband main" - key_id: 798AB1D1 - key_server: keys.gnupg.net + key: ${_param:armband_key} pin: - pin: 'release a=${_param:openstack_version}-armband' priority: 1201 diff --git a/mcp/reclass/classes/cluster/mcp-common-noha/infra/init.yml.j2 b/mcp/reclass/classes/cluster/mcp-common-noha/infra/init.yml.j2 index 339d81889..e1e62981f 100644 --- a/mcp/reclass/classes/cluster/mcp-common-noha/infra/init.yml.j2 +++ b/mcp/reclass/classes/cluster/mcp-common-noha/infra/init.yml.j2 @@ -12,7 +12,6 @@ classes: parameters: _param: cluster_domain: ${_param:cluster_name}.local - infra_maas_database_password: opnfv_secret reclass_config_master: ${_param:opnfv_infra_config_pxe_admin_address} infra_maas_node01_hostname: mas01 infra_maas_node01_address: ${_param:opnfv_infra_maas_node01_address} diff --git a/mcp/reclass/classes/cluster/mcp-common-noha/openstack_init.yml.j2 b/mcp/reclass/classes/cluster/mcp-common-noha/openstack_init.yml.j2 index 5aae27c41..c4542d32c 100644 --- a/mcp/reclass/classes/cluster/mcp-common-noha/openstack_init.yml.j2 +++ b/mcp/reclass/classes/cluster/mcp-common-noha/openstack_init.yml.j2 @@ -7,6 +7,8 @@ ############################################################################## {%- import 'net_map.j2' as nm with context %} --- +classes: + - cluster.all-mcp-arch-common.uca_repo parameters: _param: openstack_region: RegionOne @@ -24,8 +26,6 @@ parameters: neutron_compute_agent_mode: legacy neutron_compute_external_access: 'False' galera_server_cluster_name: openstack_cluster - galera_server_maintenance_password: opnfv_secret - galera_server_admin_password: opnfv_secret cluster_vip_address: ${_param:cluster_public_host} cluster_local_address: ${_param:openstack_control_address} cluster_node01_hostname: ctl01 @@ -34,17 +34,12 @@ parameters: cluster_node02_address: ${_param:opnfv_openstack_control_node02_address} cluster_node03_hostname: ctl03 cluster_node03_address: ${_param:opnfv_openstack_control_node03_address} - rabbitmq_secret_key: opnfv_secret - rabbitmq_admin_password: opnfv_secret - rabbitmq_openstack_password: opnfv_secret - rabbitmq_cold_password: opnfv_secret glance_version: ${_param:openstack_version} glance_service_host: ${_param:cluster_local_address} keystone_version: ${_param:openstack_version} keystone_service_host: ${_param:cluster_local_address} heat_version: ${_param:openstack_version} heat_service_host: ${_param:cluster_local_address} - heat_domain_admin_password: opnfv_secret ceilometer_version: ${_param:openstack_version} ceilometer_service_host: ${_param:cluster_local_address} ceilometer_database_host: ${_param:cluster_local_address} @@ -56,27 +51,6 @@ parameters: neutron_version: ${_param:openstack_version} neutron_service_host: ${_param:cluster_local_address} mysql_admin_user: root - mysql_admin_password: opnfv_secret - mysql_cinder_password: opnfv_secret - mysql_ceilometer_password: opnfv_secret - mysql_glance_password: opnfv_secret - mysql_grafana_password: opnfv_secret - mysql_heat_password: opnfv_secret - mysql_keystone_password: opnfv_secret - mysql_neutron_password: opnfv_secret - mysql_nova_password: opnfv_secret - mysql_aodh_password: opnfv_secret - keystone_service_token: opnfv_secret - keystone_admin_password: opnfv_secret - keystone_ceilometer_password: opnfv_secret - keystone_cinder_password: opnfv_secret - keystone_glance_password: opnfv_secret - keystone_heat_password: opnfv_secret - keystone_keystone_password: opnfv_secret - keystone_neutron_password: opnfv_secret - keystone_nova_password: opnfv_secret - ceilometer_secret_key: opnfv_secret - metadata_password: opnfv_secret horizon_version: ${_param:openstack_version} horizon_secret_key: opaesee8Que2yahJoh9fo0eefo1Aeyo6ahyei8zeiboh3aeth5loth7ieNa5xi5e horizon_identity_host: ${_param:cluster_vip_address} @@ -86,28 +60,19 @@ parameters: barbican_version: ${_param:openstack_version} barbican_service_host: ${_param:cluster_local_address} apache_barbican_api_address: ${_param:single_address} - mysql_barbican_password: opnfv_secret - keystone_barbican_password: opnfv_secret barbican_simple_crypto_kek: "YWJjZGVmZ2hpamtsbW5vcHFyc3R1dnd4eXoxMjM0NTY=" barbican_integration_enabled: true {%- if '-sfc-' in conf.MCP_DEPLOY_SCENARIO %} tacker_service_host: ${_param:cluster_local_address} - keystone_tacker_password: opnfv_secret - mysql_tacker_password: opnfv_secret {%- endif %} aodh_version: ${_param:openstack_version} - keystone_aodh_password: opnfv_secret aodh_service_host: ${_param:cluster_local_address} gnocchi_version: 4.2 gnocchi_service_host: ${_param:cluster_local_address} - mysql_gnocchi_password: opnfv_secret - keystone_gnocchi_password: opnfv_secret panko_version: ${_param:openstack_version} panko_service_host: ${_param:cluster_local_address} - mysql_panko_password: opnfv_secret - keystone_panko_password: opnfv_secret ceilometer_agent_default_polling_interval: 180 ceilometer_agent_default_polling_meters: - "*" @@ -120,9 +85,6 @@ parameters: net.ipv4.tcp_fin_timeout: 30 repo: uca: - source: "deb http://ubuntu-cloud.archive.canonical.com/ubuntu xenial-updates/${_param:openstack_version} main" - key_id: EC4926EA - key_server: keyserver.ubuntu.com pin: - pin: 'release o=Canonical' priority: 1200 diff --git a/mcp/reclass/classes/cluster/mcp-odl-ha/openstack/control.yml b/mcp/reclass/classes/cluster/mcp-odl-ha/openstack/control.yml index e2912fa3b..cd0d498f3 100644 --- a/mcp/reclass/classes/cluster/mcp-odl-ha/openstack/control.yml +++ b/mcp/reclass/classes/cluster/mcp-odl-ha/openstack/control.yml @@ -18,6 +18,6 @@ parameters: # For HA, all public services are available through nginx on prx sdn_controller_ip: ${_param:cluster_public_host} sdn_controller_user: admin # Hardcoded to default ODL values for now - sdn_controller_password: admin + sdn_controller_password: ${_param:opendaylight_password} sdn_controller_webport: ${_param:opendaylight_rest_port} sdn_controller_restconfport: ${_param:opendaylight_rest_port} diff --git a/mcp/reclass/classes/cluster/mcp-odl-noha/openstack/control.yml b/mcp/reclass/classes/cluster/mcp-odl-noha/openstack/control.yml index 03bd1efd4..a41a8b220 100644 --- a/mcp/reclass/classes/cluster/mcp-odl-noha/openstack/control.yml +++ b/mcp/reclass/classes/cluster/mcp-odl-noha/openstack/control.yml @@ -31,6 +31,6 @@ parameters: # For noHA, all public services are available through haproxy on ctl sdn_controller_ip: ${_param:cluster_vip_address} sdn_controller_user: admin # Hardcoded to default ODL values for now - sdn_controller_password: admin + sdn_controller_password: ${_param:opendaylight_password} sdn_controller_webport: ${_param:opendaylight_rest_port} sdn_controller_restconfport: ${_param:opendaylight_rest_port} diff --git a/mcp/salt-formulas/salt-formula-opendaylight/opendaylight/server.sls b/mcp/salt-formulas/salt-formula-opendaylight/opendaylight/server.sls index e0fb0912c..1ae23d61a 100644 --- a/mcp/salt-formulas/salt-formula-opendaylight/opendaylight/server.sls +++ b/mcp/salt-formulas/salt-formula-opendaylight/opendaylight/server.sls @@ -10,18 +10,43 @@ {%- if server.enabled %} +# NOTE: starting with Salt 2018.3, key_text might be used instead opendaylight_repo_key: + # Launchpad PPA for ODL Team + # pub 4096R/44C05248 2017-01-26 cmd.run: - - name: "apt-key adv --keyserver keyserver.ubuntu.com --recv 44C05248" -{%- if system.proxy is defined and system.proxy.pkg is defined %} - - env: -{%- if system.proxy.pkg.http is defined %} - - http_proxy: {{ system.proxy.pkg.http }} -{%- endif %} -{%- if system.proxy.pkg.https is defined %} - - https_proxy: {{ system.proxy.pkg.https }} -{%- endif %} -{%- endif %} + - name: | + cat <<-EOF | sudo apt-key add - + -----BEGIN PGP PUBLIC KEY BLOCK----- + Version: GnuPG v1 + + mQINBFiKaBEBEADpCtIj8utf/bUfN6iQ+sxGiOPLnXVYoYyKifHDazD4o1Jevfiu + EpcDIx9EdnhrCpvKTU+jaw2B7K3pkdqbjbzjZY+2CDENSQXfRHuuI/nWDaYI0stx + Tf/evip3cxdutnZNAklzkxppHP+4UZm9HAd7uZsEyff4H9DIsHzZIA4Z++Hx2+lt + w9K0iCKh2k6Pon/VVo8Bir3JuKIIdLRAuHmyniYlHDswQnu+1nQHE0F/oboD0Q9Z + hOvXAr1L7LWu0hkLV7BqmeI0SPcRA3b5MU3dfaTK8MaPAo8anQTpCyYUnoIBqX8h + y324T/dvpFKq2/X3RL+wOSYTA8TLgyhH0fhdIKZg3G8m9kxuAHZYHIHnDtvgJ5yd + 72tNY+w8UIX8U2ark/WdkAMZr3O0AuTDlvHcasxO5+puAu8jh0EgtqItqrvKwiF7 + dmlHVW41Rt+su2fmsUkk4Z0IhWrn3PdrSWAcH2eL6vjuqx6CccpjsjyiSQ90dUox + EoMpY+viX59aF0kU4BLt76mQO6YZtCpicLxFGCu97v1mNn+FWjhBOIF08pVsbNlq + oMl2j0N8NKZxJvkkmsA/i//ch5FsjzvUy3xajlSzq9ruWS4SlWq2Vzdx/acvF7Oa + ABA11wIjzLc9vmhzQNiRa53fJQwi+w/Or9LtH2msKCbcPVHoZ5OT4t6S8QARAQAB + tBpMYXVuY2hwYWQgUFBBIGZvciBPREwgVGVhbYkCOAQTAQIAIgUCWIpoEQIbAwYL + CQgHAwIGFQgCCQoLBBYCAwECHgECF4AACgkQe4qho0TAUkgAmg//XY/RqU4WcT+p + 13oDc3+Dp4aL+rwaNz0o56i0z0cYPxd8GPicCuS8d/di07GnQiBcZ5DZgegnnaYm + OUF+phxk4q+jYO/t2GHQlYSf/QyUv7OimidLOHN1FiahmcGobliwih70o6ZcMT84 + ggSu8jBzA/HLFBIkgStKD/staR5zJ2HfK298yVhiffyrPA+I3nPe7pvTaGa2e8AP + BYs5zB5n27upSZIokXFvqlmS4HEKDmPcY061wgmg1cNY1Y+mIuGjxY1Igbi6kAe0 + yaLN2AN4c2ImhpwOcuazKTe/q2ZhoPTpYvuzmogwau8LBjRBhVS6fkTpSBPEkcwn + f/QYmmVLygmpMDHuHapyH8iaUoksq7gd64iBRDJQN7giQSjkTVvcGBqoKG8lbUMV + MDT4FGuYYsObWUg7kmHlNq9nIVlAxmxv8ZTg9+8xy3f53aId/51m+gW9LGRAT94T + ZIWrF9cBvsPWoHgHkV1At/fPprOvNXqeQiJ7UzC3ikDNCu2AjPEbA4sb019RNgtj + jUI6g6RZdzbeKVpptxILCtT3yKbfKj8AfrfaRzS0yMhVudgLolIUA4S6g46p0Cgy + gITO49wxxBu6UAOsAG3psDRlsZmmrT4AH09Yt2RzmY0FBWValqpoPagheQqeU+2W + FKnV9Lw1SKMtWZbYMvIlB0rwts3k9lE= + =xkZ9 + -----END PGP PUBLIC KEY BLOCK----- + EOF opendaylight_repo: pkgrepo.managed: @@ -91,6 +116,12 @@ opendaylight: org.ops4j.pax.web.listening.addresses: {{ server.odl_bind_ip }} org.osgi.service.http.port: {{ server.odl_rest_port }} +/opt/opendaylight/etc/org.opendaylight.openflowplugin.cfg_present: + file.managed: + - name: /opt/opendaylight/etc/org.opendaylight.openflowplugin.cfg + - require_in: + - ini: /opt/opendaylight/etc/org.opendaylight.openflowplugin.cfg + /opt/opendaylight/etc/org.opendaylight.openflowplugin.cfg: ini.options_present: - sections: |