aboutsummaryrefslogtreecommitdiffstats
path: root/mcp/reclass/classes/cluster/all-mcp-arch-common/infra/maas.yml.j2
AgeCommit message (Collapse)AuthorFilesLines
2020-06-18Update saltstack repo archive URL, centos base imgAlexandru Avadanii1-1/+1
- centos: Update qcow2 URL for aarch64 image after upstream refactored its repository structure; - saltstack: Update repo URLs after upstream archived Saltstack 2017.7 release artifacts due to recently discovered CVEs (which do not affect us since we run Salt Master in a Docker container without exposing its ports to the public network); Change-Id: I022ba0739386734eec931c35bad51805a61b964d Signed-off-by: Alexandru Avadanii <Alexandru.Avadanii@enea.com>
2020-01-29aarch64: Add kpti=off similar to x86_64 noptiAlexandru Avadanii1-1/+2
arm64 kernels use a different kernel option (kpti=off vs nopti) to disable PTI, so sync the two platform configurations. Conveniently, this also bypasses kernel 4.15 issues described in [1], so apply the kernel option customisation via MaaS too, to allow aarch64 deployments to bootstrap using 4.15 kernel (with the downside of these args being duplicated by Salt later in HA scenarios). PTI is now disabled for baremetal nodes (via MaaS, no matter the scenario) and/or for kvm/cmp hosts (in HA scenarios only). While at it, install missing thin provisioning tools in aarch64 bootstrap image for MaaS deploy stage to succeed. [1] https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1857074 Change-Id: Ibd1f57f24abc690b0f13b6298f25d7e8a1af1567 Signed-off-by: Alexandru Avadanii <Alexandru.Avadanii@enea.com>
2020-01-28cfg01, mas01: Switch to Ubuntu BionicAlexandru Avadanii1-0/+4
Pin salt-formula-nfs to a commit before 'mount.opts' was introduced. Adapt salt-formula-maas bits for MaaS 2.4 (shipped by default in Bionic) compatibility. Change-Id: I42f436203d3fbdb777d6b3eff9ac185240088742 Signed-off-by: Alexandru Avadanii <Alexandru.Avadanii@enea.com>
2020-01-28maas: Switch back to ga-18.04 kernel during deployAlexandru Avadanii1-2/+1
hwe-18.04, currently based on 5.3 kernel in Bionic, has issues on both x86_64 and aarch64 nodes, so use ga-18.04, currently based on 4.15. If MCP_KERNEL_VER is set (currently pinned to 5.0), the ga-18.04 kernel is replaced by the specified version after the MaaS commissioning, initial MaaS deployment. Change-Id: Ibe8e27217025290c1263f8dca9496b2cde24368c Signed-off-by: Alexandru Avadanii <Alexandru.Avadanii@enea.com>
2020-01-21all: Pin Ubuntu kernel to 5.0.0-37 for BionicAlexandru Avadanii1-0/+17
Ubuntu kernel meta packages are all broken on at least one platform architecture, so pin the kernel version to 5.0.0-37, which is known to be stable. Make the kernel version configurable via a new enviroment variable, MCP_KERNEL_VER in globals.sh. If not defined, the ga-18.04 kernel is left unchanged (based on upstream kernel 4.15), except for baremetal nodes providioned by MaaS which currently use the HWE kernel (based on 5.3 in Bionic). Change-Id: I648d09b22f6080efd2bce26b6a06fecc3f6b4599 Signed-off-by: Alexandru Avadanii <Alexandru.Avadanii@enea.com>
2020-01-16all: Actually honor public DNS set in IDFAlexandru Avadanii1-6/+0
We currently do not configure linux:network:resolv:dns via reclass pillar data, so we don't actually enforce the public DNS set in the IDF file, but instead leave it to the OS to figure it out, which most of the time works fine, but it's not completely reliable. Change that behavior to instead enforce it via linux.network.resolv state across all cluster nodes. Change-Id: I4f82315a473fcbdc8573380cfcac1e30b44c3dd4 Signed-off-by: Alexandru Avadanii <Alexandru.Avadanii@enea.com>
2020-01-09baremetal, virtual: Bump kernel to hwe-18.04 (5.0)Alexandru Avadanii1-1/+2
On some aarch64 platforms (e.g. ThunderX 1), lvcreate manifests some spurious timing issues resulting in incomplete/corrupted LVM thin creation and eventually to transaction ID mismatch between userspace and kernel space. This eventually leads to cinder-volume issues, either when creating the thin storage pool (vgroot-pool) and/or when creating the LVs inside said pool. The issue manifests spuriously on Ubuntu Bionic + UCA, so until a working combination of userspace/kernel is found, work around this by bumping the kernel package to hwe-18.04 (kernel 5.0), effectively bypassing the timing issues during volume creation. This affects all cluster machines (both HA and NOHA scenarios, baremetal and virtual, x86_64 and aarch64, baremetal and virtualized nodes). Note: Ubuntu Bionic cloud image partition handling requires e2fsprogs 1.43, not currently available on Ubuntu Xenial / CentOS 7. Change-Id: I839e03080104c391fe18185b9544c9df43c114e6 Signed-off-by: Alexandru Avadanii <Alexandru.Avadanii@enea.com>
2020-01-03aarch64: Workaround broken lshw CPU detectionAlexandru Avadanii1-1/+1
On some aarch64 platforms (e.g. ThunderX), the DMI tables parsed by lshw lead to wrong CPU capabilities detection, breaking our MaaS tag filtering (which used to rely solely on CPU having asimd caps). Extend the tag filtering condition to also include nodes that report `cp15_barrier` platform capability. Note that not all aarch64 systems include this cap explicitly (especially since it's been deprecated in ARM v8), but it is currently reported by the platforms where asimd is not properly detected. This is merely a workaround for the broken lshw version in Ubuntu Bionic (B.02.18). Change-Id: I4a5c0d6af4d863d2ca094d6926a65ee90dee0e07 Signed-off-by: Alexandru Avadanii <Alexandru.Avadanii@enea.com>
2019-10-25[baremetal] Stein, Bionic, py3 supportAlexandru Avadanii1-9/+8
Change-Id: If3f8cb6bfeedeb766a050d5a271b21c90bb3ba1c Signed-off-by: Alexandru Avadanii <Alexandru.Avadanii@enea.com>
2019-03-27Rectify system reclass after updateMichael Polenchuk1-0/+1
* add opendaylight password (removed from system level) * get updated ovn system class w/o mysql settings * enable ceilometer user back (removed along with outdated service/endpoints) * adjsut check interval of haproxy for noha scenarios since there is only one backend for services, i.e. failover ain't expected Change-Id: Iedee290e1cfcf838998bd44dc09a729d143974ac Signed-off-by: Michael Polenchuk <mpolenchuk@mirantis.com>
2019-02-14[baremetal] Containerize MaaSAlexandru Avadanii1-40/+13
- replace mas01 VM with a Docker container; - drop `mcpcontrol` virsh-managed network, including special handling previously required for it across all scripts; - drop infrastructure VMs handling from scripts, the only VMs we still handle are cluster VMs for virtual and/or hybrid deployments; - drop SSH server from mas01; - stop running linux state on mas01, as all prerequisites are properly handled durin Docker build or via entrypoint.sh - for completeness, we still keep pillar data in sync with the actual contents of mas01 configuration, so running the state manually would still work; - make port 5240 available on the jumpserver for MaaS dashboard access; - docs: update diagrams and text to reflect the new changes; Change-Id: I6d9424995e9a90c530fd7577edf401d552bab929 Signed-off-by: Alexandru Avadanii <Alexandru.Avadanii@enea.com>
2019-01-03[MaaS] Implement aarch64 tags for kernel_optsAlexandru Avadanii1-0/+7
On AArch64, 1G hugepages need to be enabled via kernel cmdline before mounting hugetlbfs [1]. Leverage MaaS tags to apply custom kernel args to AArch64 nodes. [1] https://wiki.debian.org/Hugepages Change-Id: Ie68ddf805836ee62f725019b0b873082b1d40948 Signed-off-by: Alexandru Avadanii <Alexandru.Avadanii@enea.com>
2018-12-23[armband] Parameterize aarch64 specific repo compAlexandru Avadanii1-2/+2
Factor out armband repository component name based on openstack_version parameter. However, since 'rocky-armband' repo is not available yet, reuse the 'queens-armband' on. Change-Id: Ibd17808059542ace14724776f8686fc2afd9de6a Signed-off-by: Alexandru Avadanii <Alexandru.Avadanii@enea.com>
2018-12-17[mas01] Fix iptables pillar compatibility formatAlexandru Avadanii1-17/+25
Sync our reclass pillar data for mas01's iptables with latest formula changes [1]. [1] https://github.com/salt-formulas/salt-formula-iptables/commit/e353ce3c Change-Id: I66b2a75066ed512ab5ab4cc213d13d15c5c8cc7f Signed-off-by: Alexandru Avadanii <Alexandru.Avadanii@enea.com>
2018-12-14[maas] Adopt maas, maasng proposed functionsAlexandru Avadanii1-0/+28
JIRA: FUEL-364 Change-Id: Ia470fc8103713e7a06cd9647675b0edfb4342bf8 Signed-off-by: Alexandru Avadanii <Alexandru.Avadanii@enea.com>
2018-12-12Make MTU cluster-level configurable via IDFAlexandru Avadanii1-4/+3
JIRA: FUEL-336 Change-Id: I1c8d22b8322f700eb727d9077035ba4c9f9f9753 Signed-off-by: Alexandru Avadanii <Alexandru.Avadanii@enea.com>
2018-10-23Enable IPv6 on entire cluster by defaultMichael Polenchuk1-5/+0
IPv6 has been enabled back by commenting out the cis-3-3-3 yaml/class source in linux service reclass. Change-Id: Ia8f4e2ddbb98f9316e6ce5136badbb14ecb277c5 Signed-off-by: Michael Polenchuk <mpolenchuk@mirantis.com>
2018-09-26[reclass] Ensure pxe_admin_address is set for allAlexandru Avadanii1-1/+2
Some nodes did not rely on the _param:pxe_admin_address internal reclass param, although all of them do have an IP address in the PXE/admin network segment. Ensure all nodes define this param, so we can query all nodes with: $ salt '*' pillar.item _param:pxe_admin_address JIRA: FUEL-394 Change-Id: I7575934752c8b459c52af8a8c98c2b0327756428 Signed-off-by: Alexandru Avadanii <Alexandru.Avadanii@enea.com>
2018-09-25[reclass] Consolidate all passwordsGuillermo Herrero1-2/+0
JIRA: FUEL-378 Change-Id: I00832d697d83c374628fa9d759c125e0b6ca64cf Signed-off-by: Guillermo Herrero <guillermo.herrero@enea.com>
2018-09-23[repos] Replace keyserver accesses with pillar GPGAlexandru Avadanii1-20/+1
JIRA: FUEL-392 Change-Id: Ia21840c7561a14a5eeed3d08bf89eb2dbf9acc3a Signed-off-by: Alexandru Avadanii <Alexandru.Avadanii@enea.com>
2018-09-21[maas] Override broken default main_archive URLAlexandru Avadanii1-1/+5
Upstream reclass.system introduced a regression for us in [1]. [1] https://github.com/Mirantis/reclass-system-salt-model/commit/99490e7d Change-Id: I5cedcbb5c528a8bf59b4f917b422ed433d2ceea3 Signed-off-by: Alexandru Avadanii <Alexandru.Avadanii@enea.com>
2018-09-20[maas] Fix class ordering for ipv6.disable dupAlexandru Avadanii1-0/+1
Include class disabling IPv6 first, so our override is last. Change-Id: I91f8cb48ab2eaef54eb98705fc97ab9910c3666f Signed-off-by: Alexandru Avadanii <Alexandru.Avadanii@enea.com>
2018-09-20[maas] Enable back IPv6 for MaaS nodeAlexandru Avadanii1-0/+4
IPv6 has been disabled recently by default to reduce the attack surface of the system, however MaaS rackd service relies on other libraries that require an INET6 socket by design. Change-Id: I6c633e9790e75d53437f400790d0e528f0a792b3 Signed-off-by: Michael Polenchuk <mpolenchuk@mirantis.com> Signed-off-by: Alexandru Avadanii <Alexandru.Avadanii@enea.com>
2018-09-06[submodule] Bump Pharos for maas:machines syncAlexandru Avadanii1-31/+0
Drop duplicate maas:machines definitions which could cause conflicts in rare corner cases. Slightly refactor j2 template expansion to make `conf.virtual.nodes` available during first stage. Change-Id: I04d56e346b12c6eb97da5c0c0ab1e3446e5fc1b8 Signed-off-by: Alexandru Avadanii <Alexandru.Avadanii@enea.com>
2018-08-09[IDF] infra VMs: Allow trunking mgmt networkAlexandru Avadanii1-1/+11
Due to design limitations in idf.net_config, for a hybrid POD we need to trunk certain network segments for the VMs running on the jumpserver, including mgmt network going to cfg01, mas01. Add mgmt VLAN support for cfg01, mas01 gated by a flag in IDF: idf.fuel.jumphost.trunks.mgmt: True JIRA: FUEL-338 Change-Id: I6903f9b70e5f8a88618bce28e21c7c0631a05065 Signed-off-by: Alexandru Avadanii <Alexandru.Avadanii@enea.com>
2018-08-09Update Salt version to 2017.7Michael Polenchuk1-1/+1
Salt 2016.x has a bug with states ordering coming from 'include' statement. Glance/Heat DB sync is applied before package setup although clearly specified 'require' in state. Change-Id: Ic5f7ce4a7623fb208c0a5ba366802b7e02fa8b9f Signed-off-by: Michael Polenchuk <mpolenchuk@mirantis.com>
2018-08-07[maas] Adopt node role from scenario definitionsAlexandru Avadanii1-2/+4
Instead of hardcoding kvm hostnames in maas machine definitions, read node roles/hostnames from current scenario and map them accodingly. JIRA: FUEL-382 Change-Id: I15d52e299e0353971f8d0c7da853c571ad5410da Signed-off-by: Alexandru Avadanii <Alexandru.Avadanii@enea.com>
2018-08-06[reclass] Move MaaS classes to common dir for NOHAAlexandru Avadanii1-0/+176
Prepare for reusing MaaS-related reclass classes for NOHA scenarios. JIRA: FUEL-338 Change-Id: Ic8ddd5915563f58643ef8c7ac4055a1000db7d45 Signed-off-by: Alexandru Avadanii <Alexandru.Avadanii@enea.com>