diff options
Diffstat (limited to 'ansible')
236 files changed, 2248 insertions, 304 deletions
diff --git a/ansible/action_plugins/merge_configs.py b/ansible/action_plugins/merge_configs.py index dd4e382db..7218a2ac9 100644 --- a/ansible/action_plugins/merge_configs.py +++ b/ansible/action_plugins/merge_configs.py @@ -49,7 +49,7 @@ class ActionModule(action.ActionBase): if not tmp and len(make_tmp_path_args) == 1: tmp = self._make_tmp_path() if not tmp and len(make_tmp_path_args) == 2: - remote_user = (task_vars.get('ansible_ssh_user') + remote_user = (task_vars.get('ansible_user') or self._play_context.remote_user) tmp = self._make_tmp_path(remote_user) diff --git a/ansible/action_plugins/merge_yaml.py b/ansible/action_plugins/merge_yaml.py index 76410833b..34ba7fb8d 100755 --- a/ansible/action_plugins/merge_yaml.py +++ b/ansible/action_plugins/merge_yaml.py @@ -57,7 +57,7 @@ class ActionModule(action.ActionBase): if not tmp and len(make_tmp_path_args) == 1: tmp = self._make_tmp_path() if not tmp and len(make_tmp_path_args) == 2: - remote_user = (task_vars.get('ansible_ssh_user') + remote_user = (task_vars.get('ansible_user') or self._play_context.remote_user) tmp = self._make_tmp_path(remote_user) # save template args. diff --git a/ansible/group_vars/all.yml b/ansible/group_vars/all.yml index ea386d44d..24772f765 100644 --- a/ansible/group_vars/all.yml +++ b/ansible/group_vars/all.yml @@ -26,7 +26,7 @@ orchestration_engine: "ANSIBLE" # Valid options are [ COPY_ONCE, COPY_ALWAYS ] config_strategy: "COPY_ALWAYS" -# Valid options are [ centos, fedora, oraclelinux, ubuntu ] +# Valid options are [ centos, oraclelinux, ubuntu ] kolla_base_distro: "centos" # Valid options are [ binary, source ] kolla_install_type: "binary" @@ -200,6 +200,10 @@ etcd_peer_port: "2380" kuryr_port: "23750" +searchlight_api_port: "9393" + +grafana_server_port: "3000" + public_protocol: "{{ 'https' if kolla_enable_tls_external | bool else 'http' }}" internal_protocol: "http" admin_protocol: "http" @@ -263,6 +267,8 @@ enable_iscsid: "{{ enable_cinder_backend_iscsi | bool or enable_cinder_backend_l enable_kuryr: "no" enable_magnum: "no" enable_manila: "no" +enable_manila_backend_generic: "no" +enable_manila_backend_hnas: "no" enable_mistral: "no" enable_mongodb: "no" enable_multipathd: "no" @@ -274,6 +280,7 @@ enable_neutron_qos: "no" enable_neutron_agent_ha: "no" enable_rally: "no" enable_sahara: "no" +enable_searchlight: "no" enable_senlin: "no" enable_swift: "no" enable_telegraf: "no" @@ -315,6 +322,7 @@ haproxy_user: "openstack" haproxy_enable_external_vip: "{{ 'no' if kolla_external_vip_address == kolla_internal_vip_address else 'yes' }}" kolla_enable_tls_external: "no" kolla_external_fqdn_cert: "{{ node_config_directory }}/certificates/haproxy.pem" +kolla_external_fqdn_cacert: "{{ node_config_directory }}/certificates/haproxy-ca.crt" #################### @@ -412,9 +420,3 @@ ceph_nova_pool_name: "vms" ceph_erasure_profile: "k=4 m=2 ruleset-failure-domain=host" ceph_rule: "default host {{ 'indep' if ceph_pool_type == 'erasure' else 'firstn' }}" ceph_cache_rule: "cache host firstn" - - -####################################### -# Manila - Shared File Systems Options -####################################### -driver_handles_share_servers: "True" diff --git a/ansible/inventory/all-in-one b/ansible/inventory/all-in-one index 8d6a009ee..d75b3e2fe 100644 --- a/ansible/inventory/all-in-one +++ b/ansible/inventory/all-in-one @@ -20,6 +20,9 @@ localhost ansible_connection=local [collectd:children] compute +[baremetal:children] +control + [grafana:children] monitoring @@ -132,6 +135,9 @@ control [rally:children] control +[searchlight:children] +control + # Additional control implemented here. These groups allow you to control which # services run on which hosts at a per-service level. # @@ -236,6 +242,9 @@ manila [manila-share:children] storage +[manila-data:children] +storage + # Swift [swift-proxy-server:children] swift @@ -382,3 +391,10 @@ senlin [senlin-engine:children] senlin + +# Searchlight +[searchlight-api:children] +searchlight + +[searchlight-listener:children] +searchlight diff --git a/ansible/inventory/multinode b/ansible/inventory/multinode index 95d0edc94..9580f6819 100644 --- a/ansible/inventory/multinode +++ b/ansible/inventory/multinode @@ -7,7 +7,7 @@ control02 control03 # The above can also be specified as follows: -#control[01:03] ansible_ssh_user=kolla +#control[01:03] ansible_user=kolla # The network nodes are where your l3-agent and loadbalancers will run # This can be the same as a host in the control group @@ -150,6 +150,9 @@ control [rally:children] control +[searchlight:children] +control + # Additional control implemented here. These groups allow you to control which # services run on which hosts at a per-service level. # @@ -254,6 +257,9 @@ manila [manila-share:children] storage +[manila-data:children] +storage + # Swift [swift-proxy-server:children] swift @@ -400,3 +406,10 @@ senlin [senlin-engine:children] senlin + +# Searchlight +[searchlight-api:children] +searchlight + +[searchlight-listener:children] +searchlight diff --git a/ansible/prechecks.yml b/ansible/prechecks.yml deleted file mode 100644 index 49903a95b..000000000 --- a/ansible/prechecks.yml +++ /dev/null @@ -1,4 +0,0 @@ ---- -- hosts: all - roles: - - prechecks diff --git a/ansible/roles/aodh/tasks/config.yml b/ansible/roles/aodh/tasks/config.yml index d420bd6c6..90179933a 100644 --- a/ansible/roles/aodh/tasks/config.yml +++ b/ansible/roles/aodh/tasks/config.yml @@ -45,3 +45,14 @@ dest: "{{ node_config_directory }}/{{ item }}/wsgi-aodh.conf" with_items: - "aodh-api" + +- name: Check if policies shall be overwritten + local_action: stat path="{{ node_custom_config }}/aodh/policy.json" + register: aodh_policy + +- name: Copying over existing policy.json + template: + src: "{{ node_custom_config }}/aodh/policy.json" + dest: "{{ node_config_directory }}/aodh/policy.json" + when: + aodh_policy.stat.exists diff --git a/ansible/roles/aodh/tasks/precheck.yml b/ansible/roles/aodh/tasks/precheck.yml new file mode 100644 index 000000000..ed97d539c --- /dev/null +++ b/ansible/roles/aodh/tasks/precheck.yml @@ -0,0 +1 @@ +--- diff --git a/ansible/roles/aodh/tasks/pull.yml b/ansible/roles/aodh/tasks/pull.yml index 20030c261..dae4426a5 100644 --- a/ansible/roles/aodh/tasks/pull.yml +++ b/ansible/roles/aodh/tasks/pull.yml @@ -25,4 +25,4 @@ action: "pull_image" common_options: "{{ docker_common_options }}" image: "{{ aodh_notifier_image_full }}" - when: inventory_hostname in groups['aodh-notifier']
\ No newline at end of file + when: inventory_hostname in groups['aodh-notifier'] diff --git a/ansible/roles/aodh/templates/wsgi-aodh.conf.j2 b/ansible/roles/aodh/templates/wsgi-aodh.conf.j2 index 448820469..e09266198 100644 --- a/ansible/roles/aodh/templates/wsgi-aodh.conf.j2 +++ b/ansible/roles/aodh/templates/wsgi-aodh.conf.j2 @@ -19,7 +19,7 @@ Listen {{ hostvars[inventory_hostname]['ansible_' + api_interface]['ipv4']['addr ServerSignature Off CustomLog "/var/log/kolla/aodh/aodh_wsgi_access.log" combined WSGIApplicationGroup %{GLOBAL} - WSGIDaemonProcess aodh group=aodh processes=2 threads=2 user=aodh python-path={{ python_path }} + WSGIDaemonProcess aodh group=aodh processes={{ openstack_service_workers }} threads=1 user=aodh python-path={{ python_path }} WSGIProcessGroup aodh WSGIScriptAlias / "/var/www/cgi-bin/aodh/app.wsgi" </VirtualHost> diff --git a/ansible/roles/barbican/tasks/config.yml b/ansible/roles/barbican/tasks/config.yml index 38383d544..fab9b3dda 100644 --- a/ansible/roles/barbican/tasks/config.yml +++ b/ansible/roles/barbican/tasks/config.yml @@ -51,3 +51,14 @@ - "barbican-api" - "barbican-keystone-listener" - "barbican-worker" + +- name: Check if policies shall be overwritten + local_action: stat path="{{ node_custom_config }}/barbican/policy.json" + register: barbican_policy + +- name: Copying over existing policy.json + template: + src: "{{ node_custom_config }}/barbican/policy.json" + dest: "{{ node_config_directory }}/barbican/policy.json" + when: + barbican_policy.stat.exists diff --git a/ansible/roles/barbican/tasks/precheck.yml b/ansible/roles/barbican/tasks/precheck.yml new file mode 100644 index 000000000..ed97d539c --- /dev/null +++ b/ansible/roles/barbican/tasks/precheck.yml @@ -0,0 +1 @@ +--- diff --git a/ansible/roles/barbican/templates/barbican.conf.j2 b/ansible/roles/barbican/templates/barbican.conf.j2 index 17e3080c1..55c6b2210 100644 --- a/ansible/roles/barbican/templates/barbican.conf.j2 +++ b/ansible/roles/barbican/templates/barbican.conf.j2 @@ -10,6 +10,7 @@ backlog = 4096 max_allowed_secret_in_bytes = 10000 max_allowed_request_size_in_bytes = 1000000 +db_auto_create = False sql_connection = mysql://{{ barbican_database_user }}:{{ barbican_database_password }}@{{ barbican_database_address }}/{{ barbican_database_name }} transport_url = rabbit://{% for host in groups['rabbitmq'] %}{{ rabbitmq_user }}:{{ rabbitmq_password }}@{{ hostvars[host]['ansible_' + hostvars[host]['api_interface']]['ipv4']['address'] }}:{{ rabbitmq_port }}{% if not loop.last %},{% endif %}{% endfor %} @@ -17,15 +18,6 @@ transport_url = rabbit://{% for host in groups['rabbitmq'] %}{{ rabbitmq_user }} [keystone_notifications] enable = True -control_exchange = 'openstack' -topic = 'notifications' -allow_requeue = False - -version = '1.0' - -thread_pool_size = 10 - - [keystone_authtoken] auth_uri = {{ internal_protocol }}://{{ kolla_internal_fqdn }}:{{ keystone_public_port }} project_domain_id = default diff --git a/ansible/roles/baremetal/tasks/install.yml b/ansible/roles/baremetal/tasks/install.yml index 3c9b0f539..f6ee106b1 100644 --- a/ansible/roles/baremetal/tasks/install.yml +++ b/ansible/roles/baremetal/tasks/install.yml @@ -1,16 +1,16 @@ --- -- name: update apt cache +- name: Update apt cache command: apt-get update become: True when: ansible_os_family == 'Debian' -- name: install apt packages +- name: Install apt packages package: name={{item}} state=present become: True with_items: "{{ debian_pkg_install }}" when: ansible_os_family == 'Debian' -- name: install wily kernel +- name: Install wily kernel package: name=linux-generic-lts-wily state=latest register: kernel_updated become: True @@ -18,27 +18,27 @@ - ansible_distribution|lower == "ubuntu" | bool - ansible_distribution_release|lower == "trusty" | bool -- name: set reboot required +- name: Set reboot required set_fact: reboot_required: True when: - kernel_updated is defined - kernel_updated.changed -- name: install deltarpm packages +- name: Install deltarpm packages package: name={{item}} state=installed become: True with_items: - deltarpm when: ansible_os_family == 'RedHat' -- name: install yum packages +- name: Install yum packages package: name={{item}} state=present become: True with_items: "{{ redhat_pkg_install }}" when: ansible_os_family == 'RedHat' -- name: install pip +- name: Install pip easy_install: name=pip become: True @@ -46,13 +46,13 @@ pip: name=docker-py state=latest become: True -- name: remove packages +- name: Remove packages package: name={{item}} state=absent with_items: "{{ ubuntu_pkg_removals }}" become: True when: ansible_distribution|lower == "ubuntu" | bool -- name: remove packages +- name: Remove packages package: name={{item}} state=absent with_items: "{{ redhat_pkg_removals }}" become: True diff --git a/ansible/roles/baremetal/tasks/post-install.yml b/ansible/roles/baremetal/tasks/post-install.yml index b5b88cae9..f74577662 100644 --- a/ansible/roles/baremetal/tasks/post-install.yml +++ b/ansible/roles/baremetal/tasks/post-install.yml @@ -1,5 +1,4 @@ --- - - name: Ensure docker service directory exists file: path=/etc/systemd/system/docker.service.d @@ -9,7 +8,7 @@ when: (ansible_distribution == "Ubuntu" and ansible_distribution_major_version > "14") or (ansible_os_family == "RedHat") or (ansible_distribution == "Debian") -- name: configure docker service +- name: Configure docker service become: True template: src=docker_systemd_service.j2 @@ -17,42 +16,42 @@ when: (ansible_distribution == "Ubuntu" and ansible_distribution_major_version > "14") or (ansible_os_family == "RedHat") or (ansible_distribution == "Debian") -- name: reload docker service file +- name: Reload docker service file become: True command: systemctl daemon-reload when: (ansible_distribution == "Ubuntu" and ansible_distribution_major_version > "14") or (ansible_os_family == "RedHat") or (ansible_distribution == "Debian") -- name: configure docker service +- name: Configure docker service become: True template: src=docker_defaults.j2 dest=/etc/default/docker when: (ansible_distribution == "Ubuntu" and ansible_distribution_major_version < "15") -- name: docker mount shared +- name: Docker mount shared command: mount --make-shared /run become: True when: (ansible_distribution == "Ubuntu" and ansible_distribution_major_version < "15") -- name: get stat of libvirtd apparmor profile +- name: Get stat of libvirtd apparmor profile stat: path=/etc/apparmor.d/usr.sbin.libvirtd register: apparmor_libvirtd_profile when: ansible_distribution == "Ubuntu" -- name: remove apparmor profile for libvirt +- name: Remove apparmor profile for libvirt command: apparmor_parser -R /etc/apparmor.d/usr.sbin.libvirtd become: True when: - ansible_distribution == "Ubuntu" - apparmor_libvirtd_profile.stat.exists == True -- name: create docker group +- name: Create docker group group: name: docker become: True -- name: add kolla user to docker group +- name: Add kolla user to docker group user: name: kolla append: yes @@ -60,25 +59,25 @@ become: True when: create_kolla_user | bool == True -- name: start docker +- name: Start docker service: name: docker state: started become: yes -- name: restart docker +- name: Restart docker service: name: docker state: restarted become: yes -- name: enable docker +- name: Enable docker service: name: docker enabled: yes become: yes -- name: reboot +- name: Reboot command: reboot -f become: yes when: diff --git a/ansible/roles/baremetal/tasks/pre-install.yml b/ansible/roles/baremetal/tasks/pre-install.yml index 43993229a..0ea5e5a18 100644 --- a/ansible/roles/baremetal/tasks/pre-install.yml +++ b/ansible/roles/baremetal/tasks/pre-install.yml @@ -1,26 +1,22 @@ --- # NOTE: raw install is required to support cloud images which do not have python installed -- name: "install python2 and python-simplejson" +- name: "Install python2 and python-simplejson" become: true raw: "yum install -y python python-simplejson || (apt-get update && apt-get install -y python2.7 python-simplejson)" -- name: gather facts +- name: Gather facts setup: -- name: get node hostname - shell: echo $(hostname) - register: node_hostname - -- name: update /etc/hosts with hostname +- name: Ensure localhost in /etc/hosts lineinfile: dest: /etc/hosts - regexp: "127.0.0.1 {{ node_hostname.stdout }} localhost" - line: "127.0.0.1 {{ node_hostname.stdout }} localhost" + regexp: "^127.0.0.1.*" + line: "127.0.0.1 localhost" state: present become: True when: customize_etc_hosts | bool == True -- name: Generate etc/hosts +- name: Generate /etc/hosts for all of the nodes blockinfile: dest: /etc/hosts marker: "# {mark} ANSIBLE GENERATED HOSTS" @@ -28,18 +24,19 @@ {% for host in groups['all'] %} {{ hostvars[host]['ansible_' + hostvars[host]['api_interface']]['ipv4']['address'] }} {{ hostvars[host]['ansible_hostname'] }} {% endfor %} - when: customize_etc_hosts | bool + become: True + when: customize_etc_hosts | bool == True -- name: ensure sudo group is present +- name: Ensure sudo group is present group: name=sudo state=present become: True -- name: ensure kolla group is present +- name: Ensure kolla group is present group: name=kolla state=present become: True when: create_kolla_user | bool == True -- name: create kolla user +- name: Create kolla user user: name: kolla state: present @@ -48,7 +45,7 @@ become: True when: create_kolla_user | bool == True -- name: grant kolla user passwordless sudo +- name: Grant kolla user passwordless sudo lineinfile: dest: /etc/sudoers state: present @@ -57,19 +54,19 @@ become: True when: create_kolla_user | bool == True -- name: add public key to kolla user authorized keys +- name: Add public key to kolla user authorized keys authorized_key: user: kolla key: "{{ kolla_ssh_key.public_key }}" become: True when: create_kolla_user | bool == True -- name: install apt packages +- name: Install apt packages command: apt-get update become: True when: ansible_os_family == 'Debian' -- name: install ubuntu ca certs +- name: Install ubuntu ca certs package: name={{item}} state=latest become: True with_items: @@ -83,14 +80,14 @@ become: True when: ansible_os_family == 'Debian' -- name: enable docker repo apt +- name: Enable docker repo apt template: src: docker_apt_repo.j2 dest: /etc/apt/sources.list.d/docker.list become: True when: ansible_os_family == 'Debian' -- name: install docker apt gpg key +- name: Install docker apt gpg key apt_key: url: "{{ docker_apt_url }}/gpg" id: "{{ docker_apt_key_id }}" @@ -105,14 +102,14 @@ become: True when: ansible_os_family == 'RedHat' -- name: enable docker repo yum +- name: Enable docker repo yum become: True template: src: docker_yum_repo.j2 dest: /etc/yum.repos.d/docker.repo when: ansible_os_family == 'RedHat' -- name: install docker rpm gpg key +- name: Install docker rpm gpg key rpm_key: state: present key: "{{ docker_yum_url }}/gpg" diff --git a/ansible/roles/baremetal/tasks/precheck.yml b/ansible/roles/baremetal/tasks/precheck.yml new file mode 100644 index 000000000..ed97d539c --- /dev/null +++ b/ansible/roles/baremetal/tasks/precheck.yml @@ -0,0 +1 @@ +--- diff --git a/ansible/roles/bifrost/tasks/bootstrap.yml b/ansible/roles/bifrost/tasks/bootstrap.yml index 8332c1d9e..3d505b3c8 100644 --- a/ansible/roles/bifrost/tasks/bootstrap.yml +++ b/ansible/roles/bifrost/tasks/bootstrap.yml @@ -7,7 +7,7 @@ ansible-playbook -vvvv -i /bifrost/playbooks/inventory/localhost /bifrost/playbooks/install.yaml -e @/etc/bifrost/bifrost.yml -e @/etc/bifrost/dib.yml -e skip_package_install=true' -- name: installing ssh keys +- name: Installing ssh keys command: > docker exec bifrost_deploy bash -c 'mkdir /root/.ssh ; mkdir /home/ironic/.ssh; diff --git a/ansible/roles/bifrost/tasks/config.yml b/ansible/roles/bifrost/tasks/config.yml index 14bcbb267..717c4dead 100644 --- a/ansible/roles/bifrost/tasks/config.yml +++ b/ansible/roles/bifrost/tasks/config.yml @@ -19,7 +19,7 @@ - "dib" - "servers" -- name: template ssh keys +- name: Template ssh keys template: src: "{{ item.src }}" dest: "{{ node_config_directory }}/bifrost/{{ item.dest }}" @@ -27,4 +27,3 @@ - { src: "id_rsa", dest: "id_rsa" } - { src: "id_rsa.pub", dest: "id_rsa.pub" } - { src: "ssh_config", dest: "ssh_config" } - diff --git a/ansible/roles/bifrost/tasks/deploy-servers.yml b/ansible/roles/bifrost/tasks/deploy-servers.yml index 6a6a990eb..e8d98abda 100644 --- a/ansible/roles/bifrost/tasks/deploy-servers.yml +++ b/ansible/roles/bifrost/tasks/deploy-servers.yml @@ -9,7 +9,7 @@ /bifrost/playbooks/enroll-dynamic.yaml -e "ansible_python_interpreter=/var/lib/kolla/venv/bin/python" -e @/etc/bifrost/bifrost.yml' -- name: deploy physical servers with ironic +- name: Deploy physical servers with ironic command: > docker exec bifrost_deploy bash -c 'source /bifrost/env-vars @@ -18,4 +18,3 @@ ansible-playbook -vvvv -i /bifrost/playbooks/inventory/bifrost_inventory.py /bifrost/playbooks/deploy-dynamic.yaml -e "ansible_python_interpreter=/var/lib/kolla/venv/bin/python" -e @/etc/bifrost/bifrost.yml' - diff --git a/ansible/roles/bifrost/tasks/deploy.yml b/ansible/roles/bifrost/tasks/deploy.yml index c1a47564f..fe58cc3f7 100644 --- a/ansible/roles/bifrost/tasks/deploy.yml +++ b/ansible/roles/bifrost/tasks/deploy.yml @@ -1,5 +1,6 @@ --- - include: config.yml + - include: start.yml -- include: bootstrap.yml +- include: bootstrap.yml diff --git a/ansible/roles/bifrost/tasks/precheck.yml b/ansible/roles/bifrost/tasks/precheck.yml new file mode 100644 index 000000000..ed97d539c --- /dev/null +++ b/ansible/roles/bifrost/tasks/precheck.yml @@ -0,0 +1 @@ +--- diff --git a/ansible/roles/bifrost/tasks/reconfigure.yml b/ansible/roles/bifrost/tasks/reconfigure.yml index ed97d539c..fdd316fcc 100644 --- a/ansible/roles/bifrost/tasks/reconfigure.yml +++ b/ansible/roles/bifrost/tasks/reconfigure.yml @@ -1 +1,64 @@ --- +- name: Ensuring the containers up + kolla_docker: + name: "{{ item.name }}" + action: "get_container_state" + register: container_state + failed_when: container_state.Running == false + when: inventory_hostname in groups[item.group] + with_items: + - { name: bifrost-deploy, group: bifrost-deploy } + +- include: config.yml + +- name: Check the configs + command: docker exec {{ item.name }} /usr/local/bin/kolla_set_configs --check + changed_when: false + failed_when: false + register: check_results + when: inventory_hostname in groups[item.group] + with_items: + - { name: bifrost-deploy, group: bifrost-deploy } + +# NOTE(jeffrey4l): when config_strategy == 'COPY_ALWAYS' +# and container env['KOLLA_CONFIG_STRATEGY'] == 'COPY_ONCE', +# just remove the container and start again +- name: Containers config strategy + kolla_docker: + name: "{{ item.name }}" + action: "get_container_env" + register: container_envs + when: inventory_hostname in groups[item.group] + with_items: + - { name: bifrost-deploy, group: bifrost-deploy } + +- name: Remove the containers + kolla_docker: + name: "{{ item[0]['name'] }}" + action: "remove_container" + register: remove_containers + when: + - inventory_hostname in groups[item[0]['group']] + - config_strategy == "COPY_ONCE" or item[1]['KOLLA_CONFIG_STRATEGY'] == 'COPY_ONCE' + - item[2]['rc'] == 1 + with_together: + - [{ name: bifrost-deploy, group: bifrost-deploy }] + - "{{ container_envs.results }}" + - "{{ check_results.results }}" + +- include: start.yml + when: remove_containers.changed + +- name: Restart containers + kolla_docker: + name: "{{ item[0]['name'] }}" + action: "restart_container" + when: + - inventory_hostname in groups[item[0]['group']] + - config_strategy == 'COPY_ALWAYS' + - item[1]['KOLLA_CONFIG_STRATEGY'] != 'COPY_ONCE' + - item[2]['rc'] == 1 + with_together: + - [{ name: bifrost-deploy, group: bifrost-deploy }] + - "{{ container_envs.results }}" + - "{{ check_results.results }}" diff --git a/ansible/roles/bifrost/tasks/start.yml b/ansible/roles/bifrost/tasks/start.yml index 251ceb94c..58b247b66 100644 --- a/ansible/roles/bifrost/tasks/start.yml +++ b/ansible/roles/bifrost/tasks/start.yml @@ -10,4 +10,3 @@ - "{{ node_config_directory }}/bifrost/:/etc/bifrost:ro" - "/etc/localtime:/etc/localtime:ro" - "/dev:/dev" - diff --git a/ansible/roles/bifrost/tasks/upgrade.yml b/ansible/roles/bifrost/tasks/upgrade.yml index ed97d539c..1f16915ad 100644 --- a/ansible/roles/bifrost/tasks/upgrade.yml +++ b/ansible/roles/bifrost/tasks/upgrade.yml @@ -1 +1,4 @@ --- +- include: config.yml + +- include: start.yml diff --git a/ansible/roles/ceilometer/defaults/main.yml b/ansible/roles/ceilometer/defaults/main.yml index b914e62d9..e3d015df6 100644 --- a/ansible/roles/ceilometer/defaults/main.yml +++ b/ansible/roles/ceilometer/defaults/main.yml @@ -7,9 +7,10 @@ project_name: "ceilometer" #################### ceilometer_database_name: "ceilometer" ceilometer_database_user: "ceilometer" +ceilometer_database_port: "{{ mondodb_port if ceilometer_database_type == 'mongodb' else database_port }}" -ceilometer_database_mongodb_address: "{% for host in groups['mongodb'] %}{{ hostvars[host]['ansible_' + hostvars[host]['api_interface']]['ipv4']['address'] }}:{{ mongodb_port }}{% if not loop.last %},{% endif %}{% endfor %}" -ceilometer_database_mysql_address: "{{ kolla_internal_fqdn }}:{{ database_port }}" +ceilometer_database_mongodb_address: "{% for host in groups['mongodb'] %}{{ hostvars[host]['ansible_' + hostvars[host]['api_interface']]['ipv4']['address'] }}:{{ ceilometer_database_port }}{% if not loop.last %},{% endif %}{% endfor %}" +ceilometer_database_mysql_address: "{{ kolla_internal_fqdn }}:{{ ceilometer_database_port }}" #################### diff --git a/ansible/roles/ceilometer/tasks/bootstrap.yml b/ansible/roles/ceilometer/tasks/bootstrap.yml index a70e46004..7078709ed 100644 --- a/ansible/roles/ceilometer/tasks/bootstrap.yml +++ b/ansible/roles/ceilometer/tasks/bootstrap.yml @@ -1,37 +1,53 @@ --- - name: Creating Ceilometer MongoDB database - command: docker exec -t mongodb mongo --host {{ ceilometer_database_mongodb_address }} --eval 'db = db.getSiblingDB("{{ ceilometer_database_name }}"); db.addUser({user':' "{{ ceilometer_database_user }}", pwd':' "{{ ceilometer_database_password}}", roles':' [ "readWrite", "dbAdmin" ]})' - register: database + command: docker exec -t mongodb mongo --host {{ ceilometer_database_mongodb_address }} --eval 'db = db.getSiblingDB("{{ ceilometer_database_name }}"); db.createUser({user':' "{{ ceilometer_database_user }}", pwd':' "{{ ceilometer_database_password}}", roles':' [ "readWrite", "dbAdmin" ]})' + register: mongodb_ceilometer_database run_once: true failed_when: - - "'already' not in database.stdout" - - database.stdout.split()[4] != 'connecting' + - "'already' not in mongodb_ceilometer_database.stdout" + - mongodb_ceilometer_database.stdout.split()[4] != 'connecting' delegate_to: "{{ groups['mongodb'][0] }}" when: - ceilometer_database_type == "mongodb" +- name: Checking Ceilometer mysql database + command: docker exec -t kolla_toolbox /usr/bin/ansible localhost + -m mysql_db + -a "login_host='{{ ceilometer_database_mysql_address }}' + login_port='{{ ceilometer_database_port }}' + login_user='{{ ceilometer_database_user }}' + login_password='{{ ceilometer_database_password }}' + name='{{ ceilometer_database_name }}'" + register: mysql_access + failed_when: False + changed_when: False + run_once: True + when: + - ceilometer_database_type == "mysql" + - name: Creating Ceilometer mysql database command: docker exec -t kolla_toolbox /usr/bin/ansible localhost -m mysql_db - -a "login_host='{{ database_address }}' - login_port='{{ database_port }}' + -a "login_host='{{ ceilometer_database_mysql_address }}' + login_port='{{ ceilometer_database_port }}' login_user='{{ database_user }}' login_password='{{ database_password }}' name='{{ ceilometer_database_name }}'" - register: database - changed_when: "{{ database.stdout.find('localhost | SUCCESS => ') != -1 and - (database.stdout.split('localhost | SUCCESS => ')[1]|from_json).changed }}" - failed_when: database.stdout.split()[2] != 'SUCCESS' + register: mysql_ceilometer_database + changed_when: "{{ mysql_ceilometer_database.stdout.find('localhost | SUCCESS => ') != -1 and + (mysql_ceilometer_database.stdout.split('localhost | SUCCESS => ')[1]|from_json).changed }}" + failed_when: mysql_ceilometer_database.stdout.split()[2] != 'SUCCESS' run_once: True delegate_to: "{{ groups['ceilometer-api'][0] }}" when: - ceilometer_database_type == "mysql" + - "'FAILED' in mysql_access.stdout" - name: Creating Ceilometer database user and setting permissions command: docker exec -t kolla_toolbox /usr/bin/ansible localhost -m mysql_user - -a "login_host='{{ database_address }}' - login_port='{{ database_port }}' + -a "login_host='{{ ceilometer_database_mysql_address }}' + login_port='{{ ceilometer_database_port }}' login_user='{{ database_user }}' login_password='{{ database_password }}' name='{{ ceilometer_database_name }}' @@ -47,5 +63,11 @@ delegate_to: "{{ groups['ceilometer-api'][0] }}" when: - ceilometer_database_type == "mysql" + - "'FAILED' in mysql_access.stdout" +# TODO(Jeffrey4l): fix idempotent when ceilomter_database_type == "gnocchi" +# NOTE(vbel): bootstrapping of mysql db for ceilometer is idempotent - include: bootstrap_service.yml + when: ((ceilometer_database_type == "mongodb" and mongodb_ceilometer_database.changed) + or ceilometer_database_type == "mysql" + or ceilometer_database_type == "gnocchi") diff --git a/ansible/roles/ceilometer/tasks/config.yml b/ansible/roles/ceilometer/tasks/config.yml index bb3519ceb..63c77f38d 100644 --- a/ansible/roles/ceilometer/tasks/config.yml +++ b/ansible/roles/ceilometer/tasks/config.yml @@ -40,8 +40,7 @@ - "{{ node_custom_config }}/global.conf" - "{{ node_custom_config }}/database.conf" - "{{ node_custom_config }}/messaging.conf" - - "{{ node_custom_config }}/glance.conf" - - "{{ node_custom_config }}/glance/{{ item }}.conf" + - "{{ node_custom_config }}/ceilometer.conf" - "{{ node_custom_config }}/ceilometer/{{ item }}.conf" - "{{ node_custom_config }}/ceilometer/{{ inventory_hostname }}/ceilometer.conf" dest: "{{ node_config_directory }}/{{ item }}/ceilometer.conf" @@ -60,3 +59,14 @@ - "event_definitions.yaml" - "event_pipeline.yaml" - "pipeline.yaml" + +- name: Check if policies shall be overwritten + local_action: stat path="{{ node_custom_config }}/ceilometer/policy.json" + register: ceilometer_policy + +- name: Copying over existing policy.json + template: + src: "{{ node_custom_config }}/ceilometer/policy.json" + dest: "{{ node_config_directory }}/ceilometer/policy.json" + when: + ceilometer_policy.stat.exists diff --git a/ansible/roles/ceilometer/tasks/precheck.yml b/ansible/roles/ceilometer/tasks/precheck.yml new file mode 100644 index 000000000..ed97d539c --- /dev/null +++ b/ansible/roles/ceilometer/tasks/precheck.yml @@ -0,0 +1 @@ +--- diff --git a/ansible/roles/ceilometer/tasks/start.yml b/ansible/roles/ceilometer/tasks/start.yml index 0d87ae607..4cd760e5b 100644 --- a/ansible/roles/ceilometer/tasks/start.yml +++ b/ansible/roles/ceilometer/tasks/start.yml @@ -60,7 +60,7 @@ volumes: - "{{ node_config_directory }}/ceilometer-compute/:{{ container_config_directory }}/:ro" - "/etc/localtime:/etc/localtime:ro" - - "/run/:/run/" + - "/run/:/run/:shared" - "ceilometer:/var/lib/ceilometer/" - "kolla_logs:/var/log/kolla/" - "nova_libvirt:/var/lib/libvirt" diff --git a/ansible/roles/ceilometer/templates/ceilometer.conf.j2 b/ansible/roles/ceilometer/templates/ceilometer.conf.j2 index 2bffb57e4..1a4515830 100644 --- a/ansible/roles/ceilometer/templates/ceilometer.conf.j2 +++ b/ansible/roles/ceilometer/templates/ceilometer.conf.j2 @@ -26,7 +26,6 @@ metering_connection = mysql+pymysql://{{ ceilometer_database_user }}:{{ ceilomet {% endif %} [keystone_authtoken] -memcached_servers = {{ kolla_internal_fqdn }}:{{ memcached_port }} auth_uri = {{ internal_protocol }}://{{ kolla_internal_fqdn }}:{{ keystone_public_port }} project_domain_name = Default project_name = service @@ -36,6 +35,11 @@ password = {{ ceilometer_keystone_password }} auth_url = {{ admin_protocol }}://{{ kolla_internal_fqdn }}:{{ keystone_admin_port }} auth_type = password +memcache_security_strategy = ENCRYPT +memcache_secret_key = {{ memcache_secret_key }} +memcached_servers = {% for host in groups['memcached'] %}{{ hostvars[host]['ansible_' + hostvars[host]['api_interface']]['ipv4']['address'] }}:{{ memcached_port }}{% if not loop.last %},{% endif %}{% endfor %} + + [notification] store_events = true diff --git a/ansible/roles/ceilometer/templates/wsgi-ceilometer-api.conf.j2 b/ansible/roles/ceilometer/templates/wsgi-ceilometer-api.conf.j2 index c91167f3e..4adb84bf2 100644 --- a/ansible/roles/ceilometer/templates/wsgi-ceilometer-api.conf.j2 +++ b/ansible/roles/ceilometer/templates/wsgi-ceilometer-api.conf.j2 @@ -7,7 +7,7 @@ Listen {{ api_interface_address }}:{{ ceilometer_api_port }} CustomLog /var/log/kolla/ceilometer/ceilometer-api-access.log combined WSGIScriptReloading On - WSGIDaemonProcess ceilometer-api processes=5 threads=1 user=ceilometer group=ceilometer display-name=%{GROUP} python-path={{ python_path }} + WSGIDaemonProcess ceilometer-api processes={{ openstack_service_workers }} threads=1 user=ceilometer group=ceilometer display-name=%{GROUP} python-path={{ python_path }} WSGIProcessGroup ceilometer-api WSGIScriptAlias / {{ python_path }}/ceilometer/api/app.wsgi diff --git a/ansible/roles/ceph/tasks/precheck.yml b/ansible/roles/ceph/tasks/precheck.yml new file mode 100644 index 000000000..ed97d539c --- /dev/null +++ b/ansible/roles/ceph/tasks/precheck.yml @@ -0,0 +1 @@ +--- diff --git a/ansible/roles/certificates/tasks/precheck.yml b/ansible/roles/certificates/tasks/precheck.yml new file mode 100644 index 000000000..ed97d539c --- /dev/null +++ b/ansible/roles/certificates/tasks/precheck.yml @@ -0,0 +1 @@ +--- diff --git a/ansible/roles/cinder/tasks/config.yml b/ansible/roles/cinder/tasks/config.yml index f40187816..800401615 100644 --- a/ansible/roles/cinder/tasks/config.yml +++ b/ansible/roles/cinder/tasks/config.yml @@ -38,3 +38,14 @@ - "cinder-backup" - "cinder-scheduler" - "cinder-volume" + +- name: Check if policies shall be overwritten + local_action: stat path="{{ node_custom_config }}/cinder/policy.json" + register: cinder_policy + +- name: Copying over existing policy.json + template: + src: "{{ node_custom_config }}/cinder/policy.json" + dest: "{{ node_config_directory }}/cinder/policy.json" + when: + cinder_policy.stat.exists diff --git a/ansible/roles/cinder/tasks/precheck.yml b/ansible/roles/cinder/tasks/precheck.yml new file mode 100644 index 000000000..ed97d539c --- /dev/null +++ b/ansible/roles/cinder/tasks/precheck.yml @@ -0,0 +1 @@ +--- diff --git a/ansible/roles/cinder/tasks/start.yml b/ansible/roles/cinder/tasks/start.yml index 1940141c6..db2e19bed 100644 --- a/ansible/roles/cinder/tasks/start.yml +++ b/ansible/roles/cinder/tasks/start.yml @@ -29,7 +29,7 @@ - "{{ node_config_directory }}/cinder-volume/:{{ container_config_directory }}/:ro" - "/etc/localtime:/etc/localtime:ro" - "/dev/:/dev/" - - "/run/:/run/" + - "/run/:/run/:shared" - "{% if enable_iscsid | bool %}cinder:/var/lib/cinder{% endif %}" - "{% if enable_iscsid | bool %}iscsi_info:/etc/iscsi{% endif %}" - "kolla_logs:/var/log/kolla/" @@ -51,7 +51,7 @@ - "{{ node_config_directory }}/cinder-backup/:{{ container_config_directory }}/:ro" - "/etc/localtime:/etc/localtime:ro" - "/dev/:/dev/" - - "/run/:/run/" + - "/run/:/run/:shared" - "{% if enable_cinder_backend_lvm | bool %}cinder:/var/lib/cinder{% endif %}" - "{% if enable_cinder_backend_lvm | bool %}iscsi_info:/etc/iscsi{% endif %}" - "kolla_logs:/var/log/kolla/" diff --git a/ansible/roles/cinder/templates/cinder-api.json.j2 b/ansible/roles/cinder/templates/cinder-api.json.j2 index 7ffaf6fca..27825ed50 100644 --- a/ansible/roles/cinder/templates/cinder-api.json.j2 +++ b/ansible/roles/cinder/templates/cinder-api.json.j2 @@ -7,5 +7,17 @@ "owner": "cinder", "perm": "0600" } + ], + "permissions": [ + { + "path": "/var/lib/cinder", + "owner": "cinder:cinder", + "recurse": true + }, + { + "path": "/var/log/kolla/cinder", + "owner": "cinder:cinder", + "recurse": true + } ] } diff --git a/ansible/roles/cinder/templates/cinder-backup.json.j2 b/ansible/roles/cinder/templates/cinder-backup.json.j2 index fefb9d9c5..d42428ac1 100644 --- a/ansible/roles/cinder/templates/cinder-backup.json.j2 +++ b/ansible/roles/cinder/templates/cinder-backup.json.j2 @@ -14,5 +14,17 @@ "perm": "0700", "optional": {{ (not cinder_backend_ceph | bool) | string | lower }} }{% endif %} + ], + "permissions": [ + { + "path": "/var/lib/cinder", + "owner": "cinder:cinder", + "recurse": true + }, + { + "path": "/var/log/kolla/cinder", + "owner": "cinder:cinder", + "recurse": true + } ] } diff --git a/ansible/roles/cinder/templates/cinder-scheduler.json.j2 b/ansible/roles/cinder/templates/cinder-scheduler.json.j2 index 89f521d5a..b5ef7b548 100644 --- a/ansible/roles/cinder/templates/cinder-scheduler.json.j2 +++ b/ansible/roles/cinder/templates/cinder-scheduler.json.j2 @@ -7,5 +7,17 @@ "owner": "cinder", "perm": "0600" } + ], + "permissions": [ + { + "path": "/var/lib/cinder", + "owner": "cinder:cinder", + "recurse": true + }, + { + "path": "/var/log/kolla/cinder", + "owner": "cinder:cinder", + "recurse": true + } ] } diff --git a/ansible/roles/cinder/templates/cinder-volume.json.j2 b/ansible/roles/cinder/templates/cinder-volume.json.j2 index e82912ad0..db3891119 100644 --- a/ansible/roles/cinder/templates/cinder-volume.json.j2 +++ b/ansible/roles/cinder/templates/cinder-volume.json.j2 @@ -19,5 +19,17 @@ "owner": "cinder", "perm": "0600" }{% endif %} + ], + "permissions": [ + { + "path": "/var/lib/cinder", + "owner": "cinder:cinder", + "recurse": true + }, + { + "path": "/var/log/kolla/cinder", + "owner": "cinder:cinder", + "recurse": true + } ] } diff --git a/ansible/roles/cloudkitty/tasks/config.yml b/ansible/roles/cloudkitty/tasks/config.yml index 234109eba..ea3d13cbb 100644 --- a/ansible/roles/cloudkitty/tasks/config.yml +++ b/ansible/roles/cloudkitty/tasks/config.yml @@ -32,3 +32,14 @@ with_items: - "cloudkitty-api" - "cloudkitty-processor" + +- name: Check if policies shall be overwritten + local_action: stat path="{{ node_custom_config }}/cloudkitty/policy.json" + register: cloudkitty_policy + +- name: Copying over existing policy.json + template: + src: "{{ node_custom_config }}/cloudkitty/policy.json" + dest: "{{ node_config_directory }}/cloudkitty/policy.json" + when: + cloudkitty_policy.stat.exists diff --git a/ansible/roles/cloudkitty/tasks/precheck.yml b/ansible/roles/cloudkitty/tasks/precheck.yml new file mode 100644 index 000000000..ed97d539c --- /dev/null +++ b/ansible/roles/cloudkitty/tasks/precheck.yml @@ -0,0 +1 @@ +--- diff --git a/ansible/roles/collectd/tasks/precheck.yml b/ansible/roles/collectd/tasks/precheck.yml new file mode 100644 index 000000000..ed97d539c --- /dev/null +++ b/ansible/roles/collectd/tasks/precheck.yml @@ -0,0 +1 @@ +--- diff --git a/ansible/roles/common/defaults/main.yml b/ansible/roles/common/defaults/main.yml index 81b457cf8..8e9316051 100644 --- a/ansible/roles/common/defaults/main.yml +++ b/ansible/roles/common/defaults/main.yml @@ -17,3 +17,11 @@ heka_image_full: "{{ heka_image }}:{{ heka_tag }}" cron_image: "{{ docker_registry ~ '/' if docker_registry else '' }}{{ docker_namespace }}/{{ kolla_base_distro }}-{{ kolla_install_type }}-cron" cron_tag: "{{ openstack_release }}" cron_image_full: "{{ cron_image }}:{{ cron_tag }}" + +fluentd_image: "{{ docker_registry ~ '/' if docker_registry else '' }}{{ docker_namespace }}/{{ kolla_base_distro }}-{{ kolla_install_type }}-fluentd" +fluentd_tag: "{{ openstack_release }}" +fluentd_image_full: "{{ fluentd_image }}:{{ fluentd_tag }}" + +kubetoolbox_image: "{{ docker_registry ~ '/' if docker_registry else '' }}{{ docker_namespace }}/{{ kolla_base_distro }}-{{ kolla_install_type }}-kubetoolbox" +kubetoolbox_tag: "{{ openstack_release }}" +kubetoolbox_image_full: "{{ kubetoolbox_image }}:{{ kubetoolbox_tag }}" diff --git a/ansible/roles/common/tasks/config.yml b/ansible/roles/common/tasks/config.yml index fa6f3df77..6124aa2b3 100644 --- a/ansible/roles/common/tasks/config.yml +++ b/ansible/roles/common/tasks/config.yml @@ -27,9 +27,10 @@ with_items: - { name: "aodh", enabled: "{{ enable_aodh }}" } - { name: "barbican", enabled: "{{ enable_barbican }}"} - - { name: "elasticsearch", enabled: "{{ enable_central_logging }}" } + - { name: "elasticsearch", enabled: "{{ enable_elasticsearch }}" } - { name: "global", enabled: "yes" } - { name: "gnocchi", enabled: "{{ enable_gnocchi }}" } + - { name: "grafana", enabled: "{{ enable_grafana }}" } - { name: "haproxy", enabled: "{{ enable_haproxy }}" } - { name: "horizon", enabled: "{{ enable_horizon }}" } - { name: "keepalived", enabled: "{{ enable_haproxy }}" } @@ -72,11 +73,14 @@ - { name: "ansible", enabled: "yes" } - { name: "aodh", enabled: "{{ enable_aodh }}" } - { name: "barbican", enabled: "{{ enable_barbican }}" } + - { name: "ceilometer", enabled: "{{ enable_ceilometer }}" } - { name: "cinder", enabled: "{{ enable_cinder }}" } - { name: "cloudkitty", enabled: "{{ enable_cloudkitty }}" } + - { name: "elasticsearch", enabled: "{{ enable_elasticsearch }}" } - { name: "glance", enabled: "{{ enable_glance }}" } - { name: "global", enabled: "yes" } - { name: "gnocchi", enabled: "{{ enable_gnocchi }}" } + - { name: "grafana", enabled: "{{ enable_grafana }}" } - { name: "haproxy", enabled: "{{ enable_haproxy }}" } - { name: "heat", enabled: "{{ enable_heat }}" } - { name: "iscsid", enabled: "{{ enable_iscsid }}" } @@ -90,6 +94,8 @@ - { name: "neutron", enabled: "{{ enable_neutron }}" } - { name: "nova", enabled: "{{ enable_nova }}" } - { name: "rabbitmq", enabled: "{{ enable_rabbitmq }}" } + - { name: "sahara", enabled: "{{ enable_sahara }}" } + - { name: "searchlight", enabled: "{{ enable_searchlight }}" } - { name: "senlin", enabled: "{{ enable_senlin }}" } - { name: "swift", enabled: "{{ enable_swift }}" } - { name: "watcher", enabled: "{{ enable_watcher }}" } diff --git a/ansible/roles/common/tasks/precheck.yml b/ansible/roles/common/tasks/precheck.yml new file mode 100644 index 000000000..ed97d539c --- /dev/null +++ b/ansible/roles/common/tasks/precheck.yml @@ -0,0 +1 @@ +--- diff --git a/ansible/roles/common/tasks/start.yml b/ansible/roles/common/tasks/start.yml index 38943b1ea..963cd5de1 100644 --- a/ansible/roles/common/tasks/start.yml +++ b/ansible/roles/common/tasks/start.yml @@ -29,7 +29,7 @@ - "{{ node_config_directory }}/kolla-toolbox/:{{ container_config_directory }}/:ro" - "/etc/localtime:/etc/localtime:ro" - "/dev/:/dev/" - - "/run/:/run/" + - "/run/:/run/:shared" - "kolla_logs:/var/log/kolla/" - name: Initializing toolbox container using normal user diff --git a/ansible/roles/common/templates/admin-openrc.sh.j2 b/ansible/roles/common/templates/admin-openrc.sh.j2 index 7b5a3939b..ef3890043 100644 --- a/ansible/roles/common/templates/admin-openrc.sh.j2 +++ b/ansible/roles/common/templates/admin-openrc.sh.j2 @@ -6,3 +6,6 @@ export OS_USERNAME=admin export OS_PASSWORD={{ keystone_admin_password }} export OS_AUTH_URL={{ admin_protocol }}://{{ kolla_internal_fqdn }}:{{ keystone_admin_port }}/v3 export OS_IDENTITY_API_VERSION=3 +{% if kolla_enable_tls_external | bool and kolla_external_fqdn_cacert %} +export OS_CACERT={{ kolla_external_fqdn_cacert }} +{% endif %} diff --git a/ansible/roles/common/templates/cron-logrotate-ceilometer.conf.j2 b/ansible/roles/common/templates/cron-logrotate-ceilometer.conf.j2 new file mode 100644 index 000000000..5993500a5 --- /dev/null +++ b/ansible/roles/common/templates/cron-logrotate-ceilometer.conf.j2 @@ -0,0 +1,3 @@ +"/var/log/kolla/ceilometer/*.log" +{ +} diff --git a/ansible/roles/common/templates/cron-logrotate-elasticsearch.conf.j2 b/ansible/roles/common/templates/cron-logrotate-elasticsearch.conf.j2 new file mode 100644 index 000000000..cbdd2c780 --- /dev/null +++ b/ansible/roles/common/templates/cron-logrotate-elasticsearch.conf.j2 @@ -0,0 +1,3 @@ +"/var/log/kolla/elasticsearch/*.log" +{ +} diff --git a/ansible/roles/common/templates/cron-logrotate-grafana.conf.j2 b/ansible/roles/common/templates/cron-logrotate-grafana.conf.j2 new file mode 100644 index 000000000..2a3a0889a --- /dev/null +++ b/ansible/roles/common/templates/cron-logrotate-grafana.conf.j2 @@ -0,0 +1,3 @@ +"/var/log/kolla/grafana/*.log" +{ +} diff --git a/ansible/roles/common/templates/cron-logrotate-searchlight.conf.j2 b/ansible/roles/common/templates/cron-logrotate-searchlight.conf.j2 new file mode 100644 index 000000000..da916664a --- /dev/null +++ b/ansible/roles/common/templates/cron-logrotate-searchlight.conf.j2 @@ -0,0 +1,3 @@ +"/var/log/kolla/searchlight/*.log" +{ +} diff --git a/ansible/roles/common/templates/cron.json.j2 b/ansible/roles/common/templates/cron.json.j2 index e90ab4f9c..8a338195e 100644 --- a/ansible/roles/common/templates/cron.json.j2 +++ b/ansible/roles/common/templates/cron.json.j2 @@ -3,10 +3,13 @@ ( 'ansible', 'yes' ), ( 'aodh', enable_aodh ), ( 'barbican', enable_barbican ), + ( 'ceilometer', enable_ceilometer ), ( 'cinder', enable_cinder ), ( 'cloudkitty', enable_cloudkitty ), + ( 'elasticsearch', enable_elasticsearch ), ( 'glance', enable_glance ), ( 'gnocchi', enable_gnocchi ), + ( 'grafana', enable_grafana ), ( 'haproxy', enable_haproxy ), ( 'heat', enable_heat ), ( 'iscsid', enable_iscsid ), @@ -21,6 +24,7 @@ ( 'nova', enable_nova ), ( 'rabbitmq', enable_rabbitmq ), ( 'sahara', enable_sahara ), + ( 'searchlight', enable_searchlight ), ( 'senlin', enable_senlin ), ( 'swift', enable_swift ) ] %} diff --git a/ansible/roles/common/templates/heka-ceilometer.toml.j2 b/ansible/roles/common/templates/heka-ceilometer.toml.j2 new file mode 100644 index 000000000..cb2cb538e --- /dev/null +++ b/ansible/roles/common/templates/heka-ceilometer.toml.j2 @@ -0,0 +1,13 @@ +[ceilometer_apache_log_decoder] +type = "SandboxDecoder" +filename = "lua_decoders/os_ceilometer_apache_log.lua" + [ceilometer_apache_log_decoder.config] + apache_log_pattern = '%{X-Forwarded-For}i %l %u %t \"%r\" %>s %b %D \"%{Referer}i\" \"%{User-Agent}i\"' + +[ceilometer_apache_logstreamer_input] +type = "LogstreamerInput" +decoder = "ceilometer_apache_log_decoder" +log_directory = "/var/log/kolla" +file_match = 'ceilometer/(?P<Service>ceilometer-api.*)\.log\.?(?P<Seq>\d*)$' +priority = ["^Seq"] +differentiator = ["Service"] diff --git a/ansible/roles/common/templates/heka-grafana.toml.j2 b/ansible/roles/common/templates/heka-grafana.toml.j2 new file mode 100644 index 000000000..7565c083e --- /dev/null +++ b/ansible/roles/common/templates/heka-grafana.toml.j2 @@ -0,0 +1,18 @@ +[grafana_log_decoder] +type = "SandboxDecoder" +filename = "lua_decoders/os_grafana_log.lua" + +[grafana_log_splitter] +type = "RegexSplitter" +delimiter = '\n\n(=[^=]+====)' +delimiter_eol = false +deliver_incomplete_final = true + +[grafana_logstreamer_input] +type = "LogstreamerInput" +decoder = "grafana_log_decoder" +splitter = "grafana_log_splitter" +log_directory = "/var/log/kolla" +file_match = 'grafana/(?P<Service>grafana.*)\.log\.?(?P<Seq>\d*)$' +priority = ["^Seq"] +differentiator = ["Service"] diff --git a/ansible/roles/common/templates/heka-openstack.toml.j2 b/ansible/roles/common/templates/heka-openstack.toml.j2 index 51a1535f4..ef6334dc1 100644 --- a/ansible/roles/common/templates/heka-openstack.toml.j2 +++ b/ansible/roles/common/templates/heka-openstack.toml.j2 @@ -6,6 +6,6 @@ filename = "lua_decoders/os_openstack_log.lua" type = "LogstreamerInput" decoder = "openstack_log_decoder" log_directory = "/var/log/kolla" -file_match = '(?P<Service>cloudkitty|nova|glance|keystone|neutron|ceph|cinder|heat|murano|magnum|mistral|manila|senlin|sahara)/(?P<Program>.*)\.log\.?(?P<Seq>\d*)$' +file_match = '(?P<Service>cloudkitty|nova|glance|keystone|neutron|ceilometer|ceph|cinder|heat|murano|magnum|mistral|manila|searchlight|senlin|sahara)/(?P<Program>.*)\.log\.?(?P<Seq>\d*)$' priority = ["^Seq"] differentiator = ["Service", "_", "Program"] diff --git a/ansible/roles/common/templates/heka.json.j2 b/ansible/roles/common/templates/heka.json.j2 index bb2ae3504..a49258e4a 100644 --- a/ansible/roles/common/templates/heka.json.j2 +++ b/ansible/roles/common/templates/heka.json.j2 @@ -30,6 +30,13 @@ "optional": {{ (not enable_gnocchi | bool) | string | lower }} }, { + "source": "{{ container_config_directory }}/heka-grafana.toml", + "dest": "/etc/heka/heka-grafana.toml", + "owner": "heka", + "perm": "0600", + "optional": {{ (not enable_grafana | bool) | string | lower }} + }, + { "source": "{{ container_config_directory }}/heka-barbican.toml", "dest": "/etc/heka/heka-barbican.toml", "owner": "heka", @@ -101,5 +108,32 @@ }{% if not loop.last %},{% endif %} {% endfor %} + ], + "permissions": [ + { + "path": "/var/cache/hekad", + "owner": "heka:heka", + "recurse": true + }, + { + "path": "/var/lib/kolla/heka", + "owner": "heka:heka", + "recurse": true + }, + { + "path": "/var/log/kolla/haproxy", + "owner": "heka:kolla", + "recurse": true + }, + { + "path": "/var/log/kolla/keepalived", + "owner": "heka:kolla", + "recurse": true + }, + { + "path": "/var/log/kolla/swift", + "owner": "heka:kolla", + "recurse": true + } ] } diff --git a/ansible/roles/common/templates/kolla-toolbox.json.j2 b/ansible/roles/common/templates/kolla-toolbox.json.j2 index 220022a9d..7f0dc0519 100644 --- a/ansible/roles/common/templates/kolla-toolbox.json.j2 +++ b/ansible/roles/common/templates/kolla-toolbox.json.j2 @@ -1,4 +1,10 @@ { "command": "sleep infinity", - "config_files": [] + "config_files": [], + "permissions": [ + { + "path": "/var/log/kolla/ansible.log", + "owner": "ansible:ansible" + } + ] } diff --git a/ansible/roles/congress/tasks/config.yml b/ansible/roles/congress/tasks/config.yml index 832a2da86..0e9a63135 100644 --- a/ansible/roles/congress/tasks/config.yml +++ b/ansible/roles/congress/tasks/config.yml @@ -35,3 +35,14 @@ - "congress-api" - "congress-policy-engine" - "congress-datasource" + +- name: Check if policies shall be overwritten + local_action: stat path="{{ node_custom_config }}/congress/policy.json" + register: congress_policy + +- name: Copying over existing policy.json + template: + src: "{{ node_custom_config }}/congress/policy.json" + dest: "{{ node_config_directory }}/congress/policy.json" + when: + congress_policy.stat.exists diff --git a/ansible/roles/congress/tasks/precheck.yml b/ansible/roles/congress/tasks/precheck.yml new file mode 100644 index 000000000..ed97d539c --- /dev/null +++ b/ansible/roles/congress/tasks/precheck.yml @@ -0,0 +1 @@ +--- diff --git a/ansible/roles/congress/templates/congress-api.json.j2 b/ansible/roles/congress/templates/congress-api.json.j2 index 58e15a1fb..a7b2cae57 100644 --- a/ansible/roles/congress/templates/congress-api.json.j2 +++ b/ansible/roles/congress/templates/congress-api.json.j2 @@ -7,5 +7,12 @@ "owner": "congress", "perm": "0600" } + ], + "permissions": [ + { + "path": "/var/log/kolla/congress", + "owner": "congress:congress", + "recurse": true + } ] } diff --git a/ansible/roles/congress/templates/congress-datasource.json.j2 b/ansible/roles/congress/templates/congress-datasource.json.j2 index 2825fc7f2..9b4f9865e 100644 --- a/ansible/roles/congress/templates/congress-datasource.json.j2 +++ b/ansible/roles/congress/templates/congress-datasource.json.j2 @@ -7,5 +7,12 @@ "owner": "congress", "perm": "0600" } + ], + "permissions": [ + { + "path": "/var/log/kolla/congress", + "owner": "congress:congress", + "recurse": true + } ] } diff --git a/ansible/roles/congress/templates/congress-policy-engine.json.j2 b/ansible/roles/congress/templates/congress-policy-engine.json.j2 index 691fdbcba..f9b2e69e5 100644 --- a/ansible/roles/congress/templates/congress-policy-engine.json.j2 +++ b/ansible/roles/congress/templates/congress-policy-engine.json.j2 @@ -7,5 +7,12 @@ "owner": "congress", "perm": "0600" } + ], + "permissions": [ + { + "path": "/var/log/kolla/congress", + "owner": "congress:congress", + "recurse": true + } ] } diff --git a/ansible/roles/destroy/tasks/precheck.yml b/ansible/roles/destroy/tasks/precheck.yml new file mode 100644 index 000000000..ed97d539c --- /dev/null +++ b/ansible/roles/destroy/tasks/precheck.yml @@ -0,0 +1 @@ +--- diff --git a/ansible/roles/elasticsearch/tasks/precheck.yml b/ansible/roles/elasticsearch/tasks/precheck.yml new file mode 100644 index 000000000..ed97d539c --- /dev/null +++ b/ansible/roles/elasticsearch/tasks/precheck.yml @@ -0,0 +1 @@ +--- diff --git a/ansible/roles/elasticsearch/templates/elasticsearch.json.j2 b/ansible/roles/elasticsearch/templates/elasticsearch.json.j2 index d87adeb3f..f34d2ea3b 100644 --- a/ansible/roles/elasticsearch/templates/elasticsearch.json.j2 +++ b/ansible/roles/elasticsearch/templates/elasticsearch.json.j2 @@ -7,5 +7,17 @@ "owner": "elasticsearch", "perm": "0600" } + ], + "permissions": [ + { + "path": "/var/lib/elasticsearch", + "owner": "elasticsearch:elasticsearch", + "recurse": true + }, + { + "path": "/var/log/kolla/elasticsearch", + "owner": "elasticsearch:elasticsearch", + "recurse": true + } ] } diff --git a/ansible/roles/elasticsearch/templates/elasticsearch.yml.j2 b/ansible/roles/elasticsearch/templates/elasticsearch.yml.j2 index b792eebf7..14f1bc471 100644 --- a/ansible/roles/elasticsearch/templates/elasticsearch.yml.j2 +++ b/ansible/roles/elasticsearch/templates/elasticsearch.yml.j2 @@ -15,5 +15,5 @@ gateway.recover_after_time: "5m" gateway.recover_after_nodes: {{ recover_after_nodes }} path.conf: "/etc/elasticsearch" path.data: "/var/lib/elasticsearch/data" -path.logs: "/var/log/elasticsearch" +path.logs: "/var/log/kolla/elasticsearch" path.scripts: "/etc/elasticsearch/scripts" diff --git a/ansible/roles/etcd/tasks/precheck.yml b/ansible/roles/etcd/tasks/precheck.yml new file mode 100644 index 000000000..ed97d539c --- /dev/null +++ b/ansible/roles/etcd/tasks/precheck.yml @@ -0,0 +1 @@ +--- diff --git a/ansible/roles/glance/tasks/config.yml b/ansible/roles/glance/tasks/config.yml index e943f54d7..743815ba8 100644 --- a/ansible/roles/glance/tasks/config.yml +++ b/ansible/roles/glance/tasks/config.yml @@ -28,4 +28,15 @@ - "{{ node_custom_config }}/glance/{{ inventory_hostname }}/{{ item.service }}.conf" dest: "{{ node_config_directory }}/{{ item.service }}/{{ item.service }}.conf" when: inventory_hostname in groups[item.group] - with_items: "{{ glance_service_groups }}"
\ No newline at end of file + with_items: "{{ glance_service_groups }}" + +- name: Check if policies shall be overwritten + local_action: stat path="{{ node_custom_config }}/glance/policy.json" + register: glance_policy + +- name: Copying over existing policy.json + template: + src: "{{ node_custom_config }}/glance/policy.json" + dest: "{{ node_config_directory }}/glance/policy.json" + when: + glance_policy.stat.exists diff --git a/ansible/roles/glance/tasks/precheck.yml b/ansible/roles/glance/tasks/precheck.yml new file mode 100644 index 000000000..ed97d539c --- /dev/null +++ b/ansible/roles/glance/tasks/precheck.yml @@ -0,0 +1 @@ +--- diff --git a/ansible/roles/glance/templates/glance-api.conf.j2 b/ansible/roles/glance/templates/glance-api.conf.j2 index fd01f2b19..9d5373594 100644 --- a/ansible/roles/glance/templates/glance-api.conf.j2 +++ b/ansible/roles/glance/templates/glance-api.conf.j2 @@ -61,7 +61,7 @@ flavor = keystone [glance_store] {% if enable_ceph | bool and glance_backend_ceph | bool %} default_store = rbd -stores = rbd +stores = rbd,http rbd_store_user = glance rbd_store_pool = {{ ceph_glance_pool_name }} rbd_store_chunk_size = 8 diff --git a/ansible/roles/glance/templates/glance-api.json.j2 b/ansible/roles/glance/templates/glance-api.json.j2 index 2d3c4cc9f..2b6caebbd 100644 --- a/ansible/roles/glance/templates/glance-api.json.j2 +++ b/ansible/roles/glance/templates/glance-api.json.j2 @@ -14,5 +14,17 @@ "perm": "0700" } {% endif %} + ], + "permissions": [ + { + "path": "/var/lib/glance", + "owner": "glance:glance", + "recurse": true + }, + { + "path": "/var/log/kolla/glance", + "owner": "glance:glance", + "recurse": true + } ] } diff --git a/ansible/roles/glance/templates/glance-registry.json.j2 b/ansible/roles/glance/templates/glance-registry.json.j2 index 43d9055b6..bfd60c507 100644 --- a/ansible/roles/glance/templates/glance-registry.json.j2 +++ b/ansible/roles/glance/templates/glance-registry.json.j2 @@ -7,5 +7,12 @@ "owner": "glance", "perm": "0600" } + ], + "permissions": [ + { + "path": "/var/log/kolla/glance", + "owner": "glance:glance", + "recurse": true + } ] } diff --git a/ansible/roles/gnocchi/tasks/config.yml b/ansible/roles/gnocchi/tasks/config.yml index 2e7a75a8a..b6fa16dd0 100644 --- a/ansible/roles/gnocchi/tasks/config.yml +++ b/ansible/roles/gnocchi/tasks/config.yml @@ -50,3 +50,14 @@ dest: "{{ node_config_directory }}/{{ item }}/wsgi-gnocchi.conf" with_items: - "gnocchi-api" + +- name: Check if policies shall be overwritten + local_action: stat path="{{ node_custom_config }}/gnocchi/policy.json" + register: gnocchi_policy + +- name: Copying over existing policy.json + template: + src: "{{ node_custom_config }}/gnocchi/policy.json" + dest: "{{ node_config_directory }}/gnocchi/policy.json" + when: + gnocchi_policy.stat.exists diff --git a/ansible/roles/gnocchi/tasks/precheck.yml b/ansible/roles/gnocchi/tasks/precheck.yml new file mode 100644 index 000000000..ed97d539c --- /dev/null +++ b/ansible/roles/gnocchi/tasks/precheck.yml @@ -0,0 +1 @@ +--- diff --git a/ansible/roles/gnocchi/templates/gnocchi-api.json.j2 b/ansible/roles/gnocchi/templates/gnocchi-api.json.j2 index 373cb2154..583e6e9a2 100644 --- a/ansible/roles/gnocchi/templates/gnocchi-api.json.j2 +++ b/ansible/roles/gnocchi/templates/gnocchi-api.json.j2 @@ -34,5 +34,16 @@ "perm": "0600" }{% endif %} + ], + "permissions": [ + { + "path": "/var/lib/gnocchi", + "owner": "gnocchi:gnocchi", + "recurse": true + }, + { + "path": "/var/log/kolla/gnocchi", + "owner": "gnocchi:kolla" + } ] } diff --git a/ansible/roles/gnocchi/templates/gnocchi-metricd.json.j2 b/ansible/roles/gnocchi/templates/gnocchi-metricd.json.j2 index 1d41f8e79..9188a1c8e 100644 --- a/ansible/roles/gnocchi/templates/gnocchi-metricd.json.j2 +++ b/ansible/roles/gnocchi/templates/gnocchi-metricd.json.j2 @@ -19,5 +19,20 @@ "owner": "gnocchi", "perm": "0600" }{% endif %} + ], + "permissions": [ + { + "path": "/var/lib/gnocchi", + "owner": "gnocchi:gnocchi", + "recurse": true + }, + { + "path": "/var/log/kolla/gnocchi", + "owner": "gnocchi:kolla" + }, + { + "path": "/var/log/kolla/gnocchi/gnocchi-metricd.*", + "owner": "gnocchi:gnocchi" + } ] } diff --git a/ansible/roles/gnocchi/templates/gnocchi-statsd.json.j2 b/ansible/roles/gnocchi/templates/gnocchi-statsd.json.j2 index 141e05f7f..83073147b 100644 --- a/ansible/roles/gnocchi/templates/gnocchi-statsd.json.j2 +++ b/ansible/roles/gnocchi/templates/gnocchi-statsd.json.j2 @@ -19,5 +19,20 @@ "owner": "gnocchi", "perm": "0600" }{% endif %} + ], + "permissions": [ + { + "path": "/var/lib/gnocchi", + "owner": "gnocchi:gnocchi", + "recurse": true + }, + { + "path": "/var/log/kolla/gnocchi", + "owner": "gnocchi:kolla" + }, + { + "path": "/var/log/kolla/gnocchi/gnocchi-statsd.*", + "owner": "gnocchi:gnocchi" + } ] } diff --git a/ansible/roles/gnocchi/templates/wsgi-gnocchi.conf.j2 b/ansible/roles/gnocchi/templates/wsgi-gnocchi.conf.j2 index 5d1317ec0..3257eb237 100644 --- a/ansible/roles/gnocchi/templates/wsgi-gnocchi.conf.j2 +++ b/ansible/roles/gnocchi/templates/wsgi-gnocchi.conf.j2 @@ -6,7 +6,7 @@ Listen {{ hostvars[inventory_hostname]['ansible_' + api_interface]['ipv4']['addr ErrorLog "/var/log/kolla/gnocchi/gnocchi-api-error.log" CustomLog "/var/log/kolla/gnocchi/gnocchi-api-access.log" combined WSGIApplicationGroup %{GLOBAL} - WSGIDaemonProcess gnocchi group=gnocchi processes=5 threads=1 user=gnocchi python-path={{ python_path }} + WSGIDaemonProcess gnocchi group=gnocchi processes={{ openstack_service_workers }} threads=1 user=gnocchi python-path={{ python_path }} WSGIProcessGroup gnocchi WSGIScriptAlias / "{{ python_path }}/gnocchi/rest/app.wsgi" diff --git a/ansible/roles/grafana/tasks/precheck.yml b/ansible/roles/grafana/tasks/precheck.yml new file mode 100644 index 000000000..ed97d539c --- /dev/null +++ b/ansible/roles/grafana/tasks/precheck.yml @@ -0,0 +1 @@ +--- diff --git a/ansible/roles/grafana/templates/grafana.ini.j2 b/ansible/roles/grafana/templates/grafana.ini.j2 index d049e8a3e..6128a48d1 100644 --- a/ansible/roles/grafana/templates/grafana.ini.j2 +++ b/ansible/roles/grafana/templates/grafana.ini.j2 @@ -6,7 +6,7 @@ plugins = /var/lib/grafana/plugins [server] protocol = http http_addr = {{ hostvars[inventory_hostname]['ansible_' + api_interface]['ipv4']['address'] }} -http_port = 3000 +http_port = {{ grafana_server_port }} router_logging = true @@ -24,7 +24,7 @@ ssl_mode = disable [session] provider = mysql -provider_config = grafana:{{ grafana_database_password }}@tcp({{ grafana_database_address }}/grafana +provider_config = grafana:{{ grafana_database_password }}@tcp({{ grafana_database_address }})/grafana cookie_name = grafana_sess cookie_secure = false diff --git a/ansible/roles/grafana/templates/grafana.json.j2 b/ansible/roles/grafana/templates/grafana.json.j2 index 1e26464af..d9a75b8bc 100644 --- a/ansible/roles/grafana/templates/grafana.json.j2 +++ b/ansible/roles/grafana/templates/grafana.json.j2 @@ -7,5 +7,17 @@ "owner": "grafana", "perm": "0600" } + ], + "permissions": [ + { + "path": "/var/lib/grafana", + "owner": "grafana:grafana", + "recurse": true + }, + { + "path": "/var/log/kolla/grafana", + "owner": "grafana:grafana", + "recurse": true + } ] } diff --git a/ansible/roles/haproxy/tasks/precheck.yml b/ansible/roles/haproxy/tasks/precheck.yml new file mode 100644 index 000000000..ed97d539c --- /dev/null +++ b/ansible/roles/haproxy/tasks/precheck.yml @@ -0,0 +1 @@ +--- diff --git a/ansible/roles/haproxy/templates/haproxy.cfg.j2 b/ansible/roles/haproxy/templates/haproxy.cfg.j2 index ae8526ee0..89b7997c6 100644 --- a/ansible/roles/haproxy/templates/haproxy.cfg.j2 +++ b/ansible/roles/haproxy/templates/haproxy.cfg.j2 @@ -289,6 +289,26 @@ listen heat_api_cfn_external {% endif %} {% endif %} +{% if enable_grafana | bool %} +listen grafana_server + bind {{ kolla_internal_vip_address }}:{{ grafana_server_port }} + http-request del-header X-Forwarded-Proto + http-request set-header X-Forwarded-Proto https if { ssl_fc } +{% for host in groups['grafana'] %} + server {{ hostvars[host]['ansible_hostname'] }} {{ hostvars[host]['ansible_' + hostvars[host]['api_interface']]['ipv4']['address'] }}:{{ grafana_server_port }} check inter 2000 rise 2 fall 5 +{% endfor %} +{% if haproxy_enable_external_vip | bool %} + +listen grafana_server_external + bind {{ kolla_external_vip_address }}:{{ grafana_server_port }} {{ tls_bind_info }} + http-request del-header X-Forwarded-Proto + http-request set-header X-Forwarded-Proto https if { ssl_fc } +{% for host in groups['grafana'] %} + server {{ hostvars[host]['ansible_hostname'] }} {{ hostvars[host]['ansible_' + hostvars[host]['api_interface']]['ipv4']['address'] }}:{{ grafana_server_port }} check inter 2000 rise 2 fall 5 +{% endfor %} +{% endif %} +{% endif %} + {% if enable_ironic | bool %} listen ironic_api bind {{ kolla_internal_vip_address }}:{{ ironic_api_port }} @@ -417,6 +437,21 @@ listen sahara_api_external {% endif %} {% endif %} +{% if enable_searchlight | bool %} +listen searchlight_api + bind {{ kolla_internal_vip_address }}:{{ searchlight_api_port }} +{% for host in groups['searchlight-api'] %} + server {{ hostvars[host]['ansible_hostname'] }} {{ hostvars[host]['ansible_' + hostvars[host]['api_interface']]['ipv4']['address'] }}:{{ searchlight_api_port }} check inter 2000 rise 2 fall 5 +{% endfor %} +{% if haproxy_enable_external_vip | bool %} + +listen searchlight_api_external + bind {{ kolla_external_vip_address }}:{{ searchlight_api_port }} {{ tls_bind_info }} +{% for host in groups['searchlight-api'] %} + server {{ hostvars[host]['ansible_hostname'] }} {{ hostvars[host]['ansible_' + hostvars[host]['api_interface']]['ipv4']['address'] }}:{{ searchlight_api_port }} check inter 2000 rise 2 fall 5 +{% endfor %} +{% endif %} +{% endif %} {% if enable_ceph | bool and enable_ceph_rgw | bool %} listen radosgw @@ -568,7 +603,7 @@ listen mistral_api_external {% endif %} {% endif %} -# (NOTE): This defaults section deletes forwardfor as recomended by: +# (NOTE): This defaults section deletes forwardfor as recommended by: # https://marc.info/?l=haproxy&m=141684110710132&w=1 defaults @@ -596,4 +631,3 @@ listen mariadb {% endfor %} {% endif %} - diff --git a/ansible/roles/heat/tasks/config.yml b/ansible/roles/heat/tasks/config.yml index 41b9effaf..dca462a50 100644 --- a/ansible/roles/heat/tasks/config.yml +++ b/ansible/roles/heat/tasks/config.yml @@ -42,3 +42,14 @@ - "heat-api" - "heat-api-cfn" - "heat-engine" + +- name: Check if policies shall be overwritten + local_action: stat path="{{ node_custom_config }}/heat/policy.json" + register: heat_policy + +- name: Copying over existing policy.json + template: + src: "{{ node_custom_config }}/heat/policy.json" + dest: "{{ node_config_directory }}/heat/policy.json" + when: + heat_policy.stat.exists diff --git a/ansible/roles/heat/tasks/precheck.yml b/ansible/roles/heat/tasks/precheck.yml new file mode 100644 index 000000000..ed97d539c --- /dev/null +++ b/ansible/roles/heat/tasks/precheck.yml @@ -0,0 +1 @@ +--- diff --git a/ansible/roles/heat/templates/heat-api-cfn.json.j2 b/ansible/roles/heat/templates/heat-api-cfn.json.j2 index 6d10c115f..30f266582 100644 --- a/ansible/roles/heat/templates/heat-api-cfn.json.j2 +++ b/ansible/roles/heat/templates/heat-api-cfn.json.j2 @@ -7,5 +7,12 @@ "owner": "heat", "perm": "0600" } + ], + "permissions": [ + { + "path": "/var/log/kolla/heat", + "owner": "heat:heat", + "recurse": true + } ] } diff --git a/ansible/roles/heat/templates/heat-api.json.j2 b/ansible/roles/heat/templates/heat-api.json.j2 index 495ba4ec2..c198cbf4b 100644 --- a/ansible/roles/heat/templates/heat-api.json.j2 +++ b/ansible/roles/heat/templates/heat-api.json.j2 @@ -7,5 +7,12 @@ "owner": "heat", "perm": "0600" } - ] + ], + "permissions": [ + { + "path": "/var/log/kolla/heat", + "owner": "heat:heat", + "recurse": true + } + ] } diff --git a/ansible/roles/heat/templates/heat-engine.json.j2 b/ansible/roles/heat/templates/heat-engine.json.j2 index 19bf349e9..40d76a08f 100644 --- a/ansible/roles/heat/templates/heat-engine.json.j2 +++ b/ansible/roles/heat/templates/heat-engine.json.j2 @@ -13,5 +13,12 @@ "owner": "heat", "perm": "0600" } + ], + "permissions": [ + { + "path": "/var/log/kolla/heat", + "owner": "heat:heat", + "recurse": true + } ] } diff --git a/ansible/roles/heat/templates/heat.conf.j2 b/ansible/roles/heat/templates/heat.conf.j2 index b2fad08c4..c68e4453f 100644 --- a/ansible/roles/heat/templates/heat.conf.j2 +++ b/ansible/roles/heat/templates/heat.conf.j2 @@ -65,7 +65,7 @@ auth_url = {{ keystone_admin_url }} auth_uri = {{ internal_protocol }}://{{ kolla_internal_fqdn }}:{{ keystone_public_port }} auth_url = {{ admin_protocol }}://{{ kolla_internal_fqdn }}:{{ keystone_admin_port }} {% endif %} -auth_plugin = password +auth_type = password user_domain_id = default username = {{ heat_keystone_user }} password = {{ heat_keystone_password }} diff --git a/ansible/roles/horizon/tasks/precheck.yml b/ansible/roles/horizon/tasks/precheck.yml new file mode 100644 index 000000000..ed97d539c --- /dev/null +++ b/ansible/roles/horizon/tasks/precheck.yml @@ -0,0 +1 @@ +--- diff --git a/ansible/roles/horizon/templates/local_settings.j2 b/ansible/roles/horizon/templates/local_settings.j2 index c5abb28d3..891b19441 100644 --- a/ansible/roles/horizon/templates/local_settings.j2 +++ b/ansible/roles/horizon/templates/local_settings.j2 @@ -192,7 +192,7 @@ EMAIL_BACKEND = 'django.core.mail.backends.console.EmailBackend' OPENSTACK_HOST = "{% if orchestration_engine == 'KUBERNETES' %}{{ api_interface_address }}{% else %}{{ kolla_internal_fqdn }}{% endif %}" -OPENSTACK_KEYSTONE_URL = "{{ keystone_public_url }}" +OPENSTACK_KEYSTONE_URL = "{{ keystone_internal_url }}" OPENSTACK_KEYSTONE_DEFAULT_ROLE = "{{ horizon_openstack_keystone_default_role }}" # Enables keystone web single-sign-on if set to True. diff --git a/ansible/roles/influxdb/tasks/precheck.yml b/ansible/roles/influxdb/tasks/precheck.yml new file mode 100644 index 000000000..ed97d539c --- /dev/null +++ b/ansible/roles/influxdb/tasks/precheck.yml @@ -0,0 +1 @@ +--- diff --git a/ansible/roles/influxdb/templates/influxdb.json.j2 b/ansible/roles/influxdb/templates/influxdb.json.j2 index 2c4c6b3b0..3ffa2fe3a 100644 --- a/ansible/roles/influxdb/templates/influxdb.json.j2 +++ b/ansible/roles/influxdb/templates/influxdb.json.j2 @@ -7,5 +7,17 @@ "owner": "influxdb", "perm": "0600" } + ], + "permissions": [ + { + "path": "/var/lib/influxdb", + "owner": "influxdb:influxdb", + "recurse": true + }, + { + "path": "/var/log/kolla/influxdb", + "owner": "influxdb:influxdb", + "recurse": true + } ] } diff --git a/ansible/roles/ironic/tasks/config.yml b/ansible/roles/ironic/tasks/config.yml index 89ac3b51c..797b49482 100644 --- a/ansible/roles/ironic/tasks/config.yml +++ b/ansible/roles/ironic/tasks/config.yml @@ -37,3 +37,14 @@ - "ironic-api" - "ironic-conductor" - "ironic-inspector" + +- name: Check if policies shall be overwritten + local_action: stat path="{{ node_custom_config }}/ironic/policy.json" + register: ironic_policy + +- name: Copying over existing policy.json + template: + src: "{{ node_custom_config }}/ironic/policy.json" + dest: "{{ node_config_directory }}/ironic/policy.json" + when: + ironic_policy.stat.exists diff --git a/ansible/roles/ironic/tasks/precheck.yml b/ansible/roles/ironic/tasks/precheck.yml new file mode 100644 index 000000000..ed97d539c --- /dev/null +++ b/ansible/roles/ironic/tasks/precheck.yml @@ -0,0 +1 @@ +--- diff --git a/ansible/roles/ironic/tasks/start.yml b/ansible/roles/ironic/tasks/start.yml index 7c1fbe899..874f3e176 100644 --- a/ansible/roles/ironic/tasks/start.yml +++ b/ansible/roles/ironic/tasks/start.yml @@ -35,7 +35,7 @@ - "/etc/localtime:/etc/localtime:ro" - "/sys:/sys" - "/dev:/dev" - - "/run:/run" + - "/run:/run:shared" - "kolla_logs:/var/log/kolla" - "ironic:/var/lib/ironic" - "ironic_pxe:/tftpboot/" diff --git a/ansible/roles/ironic/templates/ironic-api.json.j2 b/ansible/roles/ironic/templates/ironic-api.json.j2 index 621f0e29d..bf10f3105 100644 --- a/ansible/roles/ironic/templates/ironic-api.json.j2 +++ b/ansible/roles/ironic/templates/ironic-api.json.j2 @@ -7,5 +7,12 @@ "owner": "ironic", "perm": "0600" } + ], + "permissions": [ + { + "path": "/var/log/kolla/ironic", + "owner": "ironic:ironic", + "recurse": true + } ] } diff --git a/ansible/roles/ironic/templates/ironic-conductor.json.j2 b/ansible/roles/ironic/templates/ironic-conductor.json.j2 index 68e5596f6..46aa5ed6b 100644 --- a/ansible/roles/ironic/templates/ironic-conductor.json.j2 +++ b/ansible/roles/ironic/templates/ironic-conductor.json.j2 @@ -7,5 +7,22 @@ "owner": "ironic", "perm": "0600" } + ], + "permissions": [ + { + "path": "/var/log/kolla/ironic", + "owner": "ironic:ironic", + "recurse": true + }, + { + "path": "/var/lib/ironic", + "owner": "ironic:ironic", + "recurse": true + }, + { + "path": "/tftpboot", + "owner": "ironic:ironic", + "recurse": true + } ] } diff --git a/ansible/roles/iscsi/tasks/config.yml b/ansible/roles/iscsi/tasks/config.yml index 4393db15f..0ebe3dd74 100644 --- a/ansible/roles/iscsi/tasks/config.yml +++ b/ansible/roles/iscsi/tasks/config.yml @@ -23,7 +23,9 @@ path: "{{ node_config_directory }}/{{ item }}" state: "directory" recurse: yes - when: inventory_hostname in groups['tgtd'] + when: + - inventory_hostname in groups['tgtd'] + - enable_cinder_backend_lvm | bool with_items: - "tgtd" @@ -31,6 +33,8 @@ template: src: "{{ item }}.json.j2" dest: "{{ node_config_directory }}/{{ item }}/config.json" - when: inventory_hostname in groups['tgtd'] + when: + - inventory_hostname in groups['tgtd'] + - enable_cinder_backend_lvm | bool with_items: - "tgtd" diff --git a/ansible/roles/iscsi/tasks/precheck.yml b/ansible/roles/iscsi/tasks/precheck.yml new file mode 100644 index 000000000..ed97d539c --- /dev/null +++ b/ansible/roles/iscsi/tasks/precheck.yml @@ -0,0 +1 @@ +--- diff --git a/ansible/roles/iscsi/tasks/start.yml b/ansible/roles/iscsi/tasks/start.yml index caf7f2afd..f1135188a 100644 --- a/ansible/roles/iscsi/tasks/start.yml +++ b/ansible/roles/iscsi/tasks/start.yml @@ -12,7 +12,7 @@ - "kolla_logs:/var/log/kolla/" - "/etc/localtime:/etc/localtime:ro" - "/dev/:/dev/" - - "/run/:/run/" + - "/run/:/run/:shared" - "/sys/fs/cgroup:/sys/fs/cgroup:ro" - "/lib/modules:/lib/modules:ro" - "/sys/kernel/config:/configfs" @@ -34,7 +34,7 @@ - "kolla_logs:/var/log/kolla/" - "/etc/localtime:/etc/localtime:ro" - "/dev/:/dev/" - - "/run/:/run/" + - "/run/:/run/:shared" - "/sys/fs/cgroup:/sys/fs/cgroup:ro" - "/lib/modules:/lib/modules:ro" - "/sys/kernel/config:/configfs" diff --git a/ansible/roles/keystone/tasks/config.yml b/ansible/roles/keystone/tasks/config.yml index e39e7d618..e531d6869 100644 --- a/ansible/roles/keystone/tasks/config.yml +++ b/ansible/roles/keystone/tasks/config.yml @@ -1,5 +1,5 @@ --- -- name: Check if Policies shall be overwritten +- name: Check if policies shall be overwritten local_action: stat path="{{ node_custom_config }}/keystone/policy.json" register: keystone_policy diff --git a/ansible/roles/keystone/tasks/init_fernet.yml b/ansible/roles/keystone/tasks/init_fernet.yml index 0d2bb0076..c608202ab 100644 --- a/ansible/roles/keystone/tasks/init_fernet.yml +++ b/ansible/roles/keystone/tasks/init_fernet.yml @@ -12,4 +12,4 @@ - name: Run key distribution command: docker exec -t keystone_fernet /usr/bin/fernet-rotate.sh run_once: True - delegate_to: "{{ groups['keystone'][0] }}"
\ No newline at end of file + delegate_to: "{{ groups['keystone'][0] }}" diff --git a/ansible/roles/keystone/tasks/precheck.yml b/ansible/roles/keystone/tasks/precheck.yml new file mode 100644 index 000000000..ed97d539c --- /dev/null +++ b/ansible/roles/keystone/tasks/precheck.yml @@ -0,0 +1 @@ +--- diff --git a/ansible/roles/keystone/tasks/pull.yml b/ansible/roles/keystone/tasks/pull.yml index 544940070..c9152b148 100644 --- a/ansible/roles/keystone/tasks/pull.yml +++ b/ansible/roles/keystone/tasks/pull.yml @@ -22,4 +22,4 @@ image: "{{ keystone_ssh_image_full }}" when: - inventory_hostname in groups['keystone'] - - keystone_token_provider == 'fernet'
\ No newline at end of file + - keystone_token_provider == 'fernet' diff --git a/ansible/roles/keystone/tasks/reconfigure.yml b/ansible/roles/keystone/tasks/reconfigure.yml index 7cfeded61..6ef22ad9f 100644 --- a/ansible/roles/keystone/tasks/reconfigure.yml +++ b/ansible/roles/keystone/tasks/reconfigure.yml @@ -4,11 +4,15 @@ keystone_items: - { name: keystone, group: keystone } -- name: Add fernet related components to variable if fernet is enabled +- name: Create fernet related components for variable if fernet is enabled set_fact: keystone_fernet_items: - { name: keystone_fernet, group: keystone } - { name: keystone_ssh, group: keystone } + when: keystone_token_provider == 'fernet' + +- name: Merge fernet related components to variable if fernet is enabled + set_fact: keystone_items: "{{ keystone_items + keystone_fernet_items }}" when: keystone_token_provider == 'fernet' diff --git a/ansible/roles/keystone/tasks/start.yml b/ansible/roles/keystone/tasks/start.yml index 0470b3c11..382a0d1e6 100644 --- a/ansible/roles/keystone/tasks/start.yml +++ b/ansible/roles/keystone/tasks/start.yml @@ -46,4 +46,4 @@ - "/etc/localtime:/etc/localtime:ro" - "kolla_logs:/var/log/kolla/" - "keystone_fernet_tokens:/etc/keystone/fernet-keys" - when: keystone_token_provider == 'fernet'
\ No newline at end of file + when: keystone_token_provider == 'fernet' diff --git a/ansible/roles/keystone/templates/keystone.json.j2 b/ansible/roles/keystone/templates/keystone.json.j2 index ba5cc52a0..3cd792111 100644 --- a/ansible/roles/keystone/templates/keystone.json.j2 +++ b/ansible/roles/keystone/templates/keystone.json.j2 @@ -35,5 +35,15 @@ "owner": "keystone", "perm": "0644" } + ], + "permissions": [ + { + "path": "/var/log/kolla", + "owner": "keystone:kolla" + }, + { + "path": "/var/log/kolla/keystone/keystone.log", + "owner": "keystone:keystone" + } ] } diff --git a/ansible/roles/keystone/templates/wsgi-keystone.conf.j2 b/ansible/roles/keystone/templates/wsgi-keystone.conf.j2 index e1bb125dc..a3f98173a 100644 --- a/ansible/roles/keystone/templates/wsgi-keystone.conf.j2 +++ b/ansible/roles/keystone/templates/wsgi-keystone.conf.j2 @@ -4,7 +4,7 @@ Listen {{ api_interface_address }}:{{ keystone_public_port }} Listen {{ api_interface_address }}:{{ keystone_admin_port }} <VirtualHost *:{{ keystone_public_port }}> - WSGIDaemonProcess keystone-public processes=5 threads=1 user=keystone group=keystone display-name=%{GROUP} python-path={{ python_path }} + WSGIDaemonProcess keystone-public processes={{ openstack_service_workers }} threads=1 user=keystone group=keystone display-name=%{GROUP} python-path={{ python_path }} WSGIProcessGroup keystone-public WSGIScriptAlias / /var/www/cgi-bin/keystone/main WSGIApplicationGroup %{GLOBAL} @@ -18,7 +18,7 @@ Listen {{ api_interface_address }}:{{ keystone_admin_port }} </VirtualHost> <VirtualHost *:{{ keystone_admin_port }}> - WSGIDaemonProcess keystone-admin processes=5 threads=1 user=keystone group=keystone display-name=%{GROUP} python-path={{ python_path }} + WSGIDaemonProcess keystone-admin processes={{ openstack_service_workers }} threads=1 user=keystone group=keystone display-name=%{GROUP} python-path={{ python_path }} WSGIProcessGroup keystone-admin WSGIScriptAlias / /var/www/cgi-bin/keystone/admin WSGIApplicationGroup %{GLOBAL} diff --git a/ansible/roles/kibana/tasks/precheck.yml b/ansible/roles/kibana/tasks/precheck.yml new file mode 100644 index 000000000..ed97d539c --- /dev/null +++ b/ansible/roles/kibana/tasks/precheck.yml @@ -0,0 +1 @@ +--- diff --git a/ansible/roles/kibana/tasks/reconfigure.yml b/ansible/roles/kibana/tasks/reconfigure.yml index ed97d539c..54cfea05d 100644 --- a/ansible/roles/kibana/tasks/reconfigure.yml +++ b/ansible/roles/kibana/tasks/reconfigure.yml @@ -1 +1,64 @@ --- +- name: Ensuring the containers up + kolla_docker: + name: "{{ item.name }}" + action: "get_container_state" + register: container_state + failed_when: container_state.Running == false + when: inventory_hostname in groups[item.group] + with_items: + - { name: kibana, group: kibana } + +- include: config.yml + +- name: Check the configs + command: docker exec {{ item.name }} /usr/local/bin/kolla_set_configs --check + changed_when: false + failed_when: false + register: check_results + when: inventory_hostname in groups[item.group] + with_items: + - { name: kibana, group: kibana } + +# NOTE(jeffrey4l): when config_strategy == 'COPY_ALWAYS' +# and container env['KOLLA_CONFIG_STRATEGY'] == 'COPY_ONCE', +# just remove the container and start again +- name: Containers config strategy + kolla_docker: + name: "{{ item.name }}" + action: "get_container_env" + register: container_envs + when: inventory_hostname in groups[item.group] + with_items: + - { name: kibana, group: kibana } + +- name: Remove the containers + kolla_docker: + name: "{{ item[0]['name'] }}" + action: "remove_container" + register: remove_containers + when: + - config_strategy == "COPY_ONCE" or item[1]['KOLLA_CONFIG_STRATEGY'] == 'COPY_ONCE' + - item[2]['rc'] == 1 + - inventory_hostname in groups[item[0]['group']] + with_together: + - [{ name: kibana, group: kibana }] + - "{{ container_envs.results }}" + - "{{ check_results.results }}" + +- include: start.yml + when: remove_containers.changed + +- name: Restart containers + kolla_docker: + name: "{{ item[0]['name'] }}" + action: "restart_container" + when: + - config_strategy == 'COPY_ALWAYS' + - item[1]['KOLLA_CONFIG_STRATEGY'] != 'COPY_ONCE' + - item[2]['rc'] == 1 + - inventory_hostname in groups[item[0]['group']] + with_together: + - [{ name: kibana, group: kibana }] + - "{{ container_envs.results }}" + - "{{ check_results.results }}" diff --git a/ansible/roles/kibana/templates/kibana.yml.j2 b/ansible/roles/kibana/templates/kibana.yml.j2 index 7d9fcbe14..9d161b0fb 100644 --- a/ansible/roles/kibana/templates/kibana.yml.j2 +++ b/ansible/roles/kibana/templates/kibana.yml.j2 @@ -1,4 +1,5 @@ kibana.defaultAppId: "{{ kibana_default_app_id }}" +logging.dest: /var/log/kolla/kibana/kibana.log server.port: {{ kibana_server_port }} server.host: "{% if orchestration_engine == 'KUBERNETES' %}0.0.0.0{% else %}{{ hostvars[inventory_hostname]['ansible_' + api_interface]['ipv4']['address'] }}{% endif %}" elasticsearch.url: "{{ internal_protocol }}://{% if orchestration_engine == 'KUBERNETES' %}elasticsearch{% else %}{{ hostvars[inventory_hostname]['ansible_' + api_interface]['ipv4']['address'] }}{% endif %}:{{ elasticsearch_port }}" diff --git a/ansible/roles/kuryr/tasks/bootstrap.yml b/ansible/roles/kuryr/tasks/bootstrap.yml index 72a30a5b4..0962484c2 100644 --- a/ansible/roles/kuryr/tasks/bootstrap.yml +++ b/ansible/roles/kuryr/tasks/bootstrap.yml @@ -15,5 +15,5 @@ volumes: - "{{ node_config_directory }}/kuryr/:{{ container_config_directory }}/:ro" - "/etc/localtime:/etc/localtime:ro" - - "/run:/run" + - "/run:/run:shared" - "/usr/lib/docker:/usr/lib/docker" diff --git a/ansible/roles/kuryr/tasks/config.yml b/ansible/roles/kuryr/tasks/config.yml index 8b31c7ab1..001793780 100644 --- a/ansible/roles/kuryr/tasks/config.yml +++ b/ansible/roles/kuryr/tasks/config.yml @@ -23,3 +23,14 @@ template: src: "kuryr.spec.j2" dest: "{{ node_config_directory }}/kuryr/kuryr.spec" + +- name: Check if policies shall be overwritten + local_action: stat path="{{ node_custom_config }}/kuryr/policy.json" + register: kuryr_policy + +- name: Copying over existing policy.json + template: + src: "{{ node_custom_config }}/kuryr/policy.json" + dest: "{{ node_config_directory }}/kuryr/policy.json" + when: + kuryr_policy.stat.exists diff --git a/ansible/roles/kuryr/tasks/precheck.yml b/ansible/roles/kuryr/tasks/precheck.yml new file mode 100644 index 000000000..ed97d539c --- /dev/null +++ b/ansible/roles/kuryr/tasks/precheck.yml @@ -0,0 +1 @@ +--- diff --git a/ansible/roles/kuryr/tasks/start.yml b/ansible/roles/kuryr/tasks/start.yml index d5a4896a6..fe93383bf 100644 --- a/ansible/roles/kuryr/tasks/start.yml +++ b/ansible/roles/kuryr/tasks/start.yml @@ -14,6 +14,6 @@ volumes: - "{{ node_config_directory }}/kuryr/:{{ container_config_directory }}/:ro" - "/etc/localtime:/etc/localtime:ro" - - "/run:/run" + - "/run:/run:shared" - "/usr/lib/docker:/usr/lib/docker" when: inventory_hostname in groups['compute'] diff --git a/ansible/roles/magnum/tasks/config.yml b/ansible/roles/magnum/tasks/config.yml index 183b6bb43..5baa4a6ca 100644 --- a/ansible/roles/magnum/tasks/config.yml +++ b/ansible/roles/magnum/tasks/config.yml @@ -32,3 +32,14 @@ with_items: - "magnum-api" - "magnum-conductor" + +- name: Check if policies shall be overwritten + local_action: stat path="{{ node_custom_config }}/magnum/policy.json" + register: magnum_policy + +- name: Copying over existing policy.json + template: + src: "{{ node_custom_config }}/magnum/policy.json" + dest: "{{ node_config_directory }}/magnum/policy.json" + when: + magnum_policy.stat.exists diff --git a/ansible/roles/magnum/tasks/precheck.yml b/ansible/roles/magnum/tasks/precheck.yml new file mode 100644 index 000000000..ed97d539c --- /dev/null +++ b/ansible/roles/magnum/tasks/precheck.yml @@ -0,0 +1 @@ +--- diff --git a/ansible/roles/magnum/templates/magnum-api.json.j2 b/ansible/roles/magnum/templates/magnum-api.json.j2 index c4af2d218..b79de7005 100644 --- a/ansible/roles/magnum/templates/magnum-api.json.j2 +++ b/ansible/roles/magnum/templates/magnum-api.json.j2 @@ -7,5 +7,12 @@ "owner": "magnum", "perm": "0600" } + ], + "permissions": [ + { + "path": "/var/log/kolla/magnum", + "owner": "magnum:magnum", + "recurse": true + } ] } diff --git a/ansible/roles/magnum/templates/magnum-conductor.json.j2 b/ansible/roles/magnum/templates/magnum-conductor.json.j2 index 179182991..40a6fa265 100644 --- a/ansible/roles/magnum/templates/magnum-conductor.json.j2 +++ b/ansible/roles/magnum/templates/magnum-conductor.json.j2 @@ -7,5 +7,17 @@ "owner": "magnum", "perm": "0600" } + ], + "permissions": [ + { + "path": "/var/lib/magnum", + "owner": "magnum:magnum", + "recurse": true + }, + { + "path": "/var/log/kolla/magnum", + "owner": "magnum:magnum", + "recurse": true + } ] } diff --git a/ansible/roles/manila/defaults/main.yml b/ansible/roles/manila/defaults/main.yml index 9f68ef5b2..2ba966595 100644 --- a/ansible/roles/manila/defaults/main.yml +++ b/ansible/roles/manila/defaults/main.yml @@ -24,6 +24,9 @@ manila_api_image: "{{ docker_registry ~ '/' if docker_registry else '' }}{{ dock manila_api_tag: "{{ openstack_release }}" manila_api_image_full: "{{ manila_api_image }}:{{ manila_api_tag }}" +manila_data_image: "{{ docker_registry ~ '/' if docker_registry else '' }}{{ docker_namespace }}/{{ kolla_base_distro }}-{{ kolla_install_type }}-manila-data" +manila_data_tag: "{{ openstack_release }}" +manila_data_image_full: "{{ manila_data_image }}:{{ manila_data_tag }}" ##################### ## OpenStack @@ -42,3 +45,16 @@ manila_service_instance_user: "manila" manila_service_instance_password: "manila" openstack_manila_auth: "{'auth_url':'{{ openstack_auth.auth_url }}','username':'{{ openstack_auth.username }}','password':'{{ openstack_auth.password }}','project_name':'{{ openstack_auth.project_name }}'}" + +#################### +# Manila +#################### +manila_backends: + - name: "generic" + driver: "generic" + enabled: "{{ enable_manila_backend_generic | bool }}" + - name: "hnas1" + driver: "hnas" + enabled: "{{ enable_manila_backend_hnas | bool }}" + +manila_enabled_backends: "{{ manila_backends|selectattr('enabled', 'equalto', true)|list }}" diff --git a/ansible/roles/manila/tasks/config.yml b/ansible/roles/manila/tasks/config.yml index 4f83ff55b..5e03b4d47 100644 --- a/ansible/roles/manila/tasks/config.yml +++ b/ansible/roles/manila/tasks/config.yml @@ -6,6 +6,7 @@ recurse: yes with_items: - "manila-api" + - "manila-data" - "manila-scheduler" - "manila-share" @@ -15,6 +16,7 @@ dest: "{{ node_config_directory }}/{{ item }}/config.json" with_items: - "manila-api" + - "manila-data" - "manila-scheduler" - "manila-share" @@ -33,6 +35,7 @@ dest: "{{ node_config_directory }}/{{ item }}/manila.conf" with_items: - "manila-api" + - "manila-data" - "manila-scheduler" - name: Copying over manila-share.conf @@ -52,3 +55,14 @@ dest: "{{ node_config_directory }}/{{ item }}/manila.conf" with_items: - "manila-share" + +- name: Check if policies shall be overwritten + local_action: stat path="{{ node_custom_config }}/manila/policy.json" + register: manila_policy + +- name: Copying over existing policy.json + template: + src: "{{ node_custom_config }}/manila/policy.json" + dest: "{{ node_config_directory }}/manila/policy.json" + when: + manila_policy.stat.exists diff --git a/ansible/roles/manila/tasks/deploy.yml b/ansible/roles/manila/tasks/deploy.yml index c4e32b6e4..37135a409 100644 --- a/ansible/roles/manila/tasks/deploy.yml +++ b/ansible/roles/manila/tasks/deploy.yml @@ -4,6 +4,7 @@ - include: config.yml when: inventory_hostname in groups['manila-api'] or + inventory_hostname in groups['manila-data'] or inventory_hostname in groups['manila-share'] or inventory_hostname in groups['manila-scheduler'] @@ -12,5 +13,6 @@ - include: start.yml when: inventory_hostname in groups['manila-api'] or + inventory_hostname in groups['manila-data'] or inventory_hostname in groups['manila-share'] or inventory_hostname in groups['manila-scheduler'] diff --git a/ansible/roles/manila/tasks/precheck.yml b/ansible/roles/manila/tasks/precheck.yml new file mode 100644 index 000000000..ed97d539c --- /dev/null +++ b/ansible/roles/manila/tasks/precheck.yml @@ -0,0 +1 @@ +--- diff --git a/ansible/roles/manila/tasks/pull.yml b/ansible/roles/manila/tasks/pull.yml index 608646f69..520e29c08 100644 --- a/ansible/roles/manila/tasks/pull.yml +++ b/ansible/roles/manila/tasks/pull.yml @@ -19,3 +19,10 @@ common_options: "{{ docker_common_options }}" image: "{{ manila_share_image_full }}" when: inventory_hostname in groups['manila-share'] + +- name: Pulling manila-data image + kolla_docker: + action: "pull_image" + common_options: "{{ docker_common_options }}" + image: "{{ manila_data_image_full }}" + when: inventory_hostname in groups['manila-data'] diff --git a/ansible/roles/manila/tasks/reconfigure.yml b/ansible/roles/manila/tasks/reconfigure.yml index 3c265fb0d..90ab18104 100644 --- a/ansible/roles/manila/tasks/reconfigure.yml +++ b/ansible/roles/manila/tasks/reconfigure.yml @@ -8,6 +8,7 @@ when: inventory_hostname in groups[item.group] with_items: - { name: manila_api, group: manila-api } + - { name: manila_data, group: manila-data } - { name: manila_scheduler, group: manila-scheduler } - { name: manila_share, group: manila-share } @@ -21,6 +22,7 @@ when: inventory_hostname in groups[item.group] with_items: - { name: manila_api, group: manila-api } + - { name: manila_data, group: manila-data } - { name: manila_scheduler, group: manila-scheduler } - { name: manila_share, group: manila-share } @@ -35,6 +37,7 @@ when: inventory_hostname in groups[item.group] with_items: - { name: manila_api, group: manila-api } + - { name: manila_data, group: manila-data } - { name: manila_scheduler, group: manila-scheduler } - { name: manila_share, group: manila-share } @@ -49,6 +52,7 @@ - item[2]['rc'] == 1 with_together: - [{ name: manila_api, group: manila-api }, + { name: manila_data, group: manila-data }, { name: manila_scheduler, group: manila-scheduler }, { name: manila_share, group: manila-share }] - "{{ container_envs.results }}" @@ -68,6 +72,7 @@ - item[2]['rc'] == 1 with_together: - [{ name: manila_api, group: manila-api }, + { name: manila_data, group: manila-data }, { name: manila_scheduler, group: manila-scheduler }, { name: manila_share, group: manila-share }] - "{{ container_envs.results }}" diff --git a/ansible/roles/manila/tasks/start.yml b/ansible/roles/manila/tasks/start.yml index 461b81ab0..103b9f506 100644 --- a/ansible/roles/manila/tasks/start.yml +++ b/ansible/roles/manila/tasks/start.yml @@ -33,6 +33,20 @@ volumes: - "{{ node_config_directory }}/manila-share/:{{ container_config_directory }}/:ro" - "/etc/localtime:/etc/localtime:ro" - - "/run/:/run/" + - "/run/:/run/:shared" - "kolla_logs:/var/log/kolla/" when: inventory_hostname in groups['manila-share'] + +- name: Starting manila-data container + kolla_docker: + action: "start_container" + common_options: "{{ docker_common_options }}" + name: "manila_data" + image: "{{ manila_data_image_full }}" + privileged: True + volumes: + - "{{ node_config_directory }}/manila-data/:{{ container_config_directory }}/:ro" + - "/etc/localtime:/etc/localtime:ro" + - "/run/:/run/:shared" + - "kolla_logs:/var/log/kolla/" + when: inventory_hostname in groups['manila-data'] diff --git a/ansible/roles/manila/templates/manila-api.json.j2 b/ansible/roles/manila/templates/manila-api.json.j2 index 07e86dd75..2d6196459 100644 --- a/ansible/roles/manila/templates/manila-api.json.j2 +++ b/ansible/roles/manila/templates/manila-api.json.j2 @@ -7,5 +7,12 @@ "owner": "manila", "perm": "0600" } + ], + "permissions": [ + { + "path": "/var/log/kolla/manila", + "owner": "manila:manila", + "recurse": true + } ] } diff --git a/ansible/roles/manila/templates/manila-data.json.j2 b/ansible/roles/manila/templates/manila-data.json.j2 new file mode 100644 index 000000000..b5a8ce2bb --- /dev/null +++ b/ansible/roles/manila/templates/manila-data.json.j2 @@ -0,0 +1,18 @@ +{ + "command": "manila-data --config-file /etc/manila/manila.conf", + "config_files": [ + { + "source": "{{ container_config_directory }}/manila.conf", + "dest": "/etc/manila/manila.conf", + "owner": "manila", + "perm": "0600" + } + ], + "permissions": [ + { + "path": "/var/log/kolla/manila", + "owner": "manila:manila", + "recurse": true + } + ] +} diff --git a/ansible/roles/manila/templates/manila-scheduler.json.j2 b/ansible/roles/manila/templates/manila-scheduler.json.j2 index b2c19b27b..e59e85b5b 100644 --- a/ansible/roles/manila/templates/manila-scheduler.json.j2 +++ b/ansible/roles/manila/templates/manila-scheduler.json.j2 @@ -7,5 +7,12 @@ "owner": "manila", "perm": "0600" } + ], + "permissions": [ + { + "path": "/var/log/kolla/manila", + "owner": "manila:manila", + "recurse": true + } ] } diff --git a/ansible/roles/manila/templates/manila-share.conf.j2 b/ansible/roles/manila/templates/manila-share.conf.j2 index 1bca31cc8..cd15fd10e 100644 --- a/ansible/roles/manila/templates/manila-share.conf.j2 +++ b/ansible/roles/manila/templates/manila-share.conf.j2 @@ -1,10 +1,8 @@ [DEFAULT] -# Following opt is used for definition of share backends that should be enabled. -# Values are conf groupnames that contain per manila-share service opts. -enabled_share_backends = generic +{% if manila_enabled_backends %} +enabled_share_backends = {{ manila_enabled_backends|map(attribute='name')|join(',') }} +{% endif %} -# Manila requires 'share-type' for share creation. -# So, set here name of some share-type that will be used by default. default_share_type = default_share_type [cinder] @@ -17,6 +15,9 @@ region_name = {{ openstack_region_name }} project_name = service username = cinder password = {{ cinder_keystone_password }} + +memcache_security_strategy = ENCRYPT +memcache_secret_key = {{ memcache_secret_key }} memcached_servers = {% for host in groups['memcached'] %}{{ hostvars[host]['ansible_' + hostvars[host]['api_interface']]['ipv4']['address'] }}:{{ memcached_port }}{% if not loop.last %},{% endif %}{% endfor %} [nova] @@ -29,6 +30,9 @@ region_name = {{ openstack_region_name }} project_name = service username = {{ nova_keystone_user }} password = {{ nova_keystone_password }} + +memcache_security_strategy = ENCRYPT +memcache_secret_key = {{ memcache_secret_key }} memcached_servers = {% for host in groups['memcached'] %}{{ hostvars[host]['ansible_' + hostvars[host]['api_interface']]['ipv4']['address'] }}:{{ memcached_port }}{% if not loop.last %},{% endif %}{% endfor %} [neutron] @@ -42,35 +46,38 @@ region_name = {{ openstack_region_name }} project_name = service username = {{ neutron_keystone_user }} password = {{ neutron_keystone_password }} + +memcache_security_strategy = ENCRYPT +memcache_secret_key = {{ memcache_secret_key }} memcached_servers = {% for host in groups['memcached'] %}{{ hostvars[host]['ansible_' + hostvars[host]['api_interface']]['ipv4']['address'] }}:{{ memcached_port }}{% if not loop.last %},{% endif %}{% endfor %} +{% if enable_manila_backend_generic | bool %} [generic] -# This is custom opt group that is used for storing opts of share-service. -# This one is used only when enabled using opt `enabled_share_backends` -# from DEFAULT group. - -# Set usage of Generic driver which uses Cinder as backend. share_driver = manila.share.drivers.generic.GenericShareDriver - -# Vif driver. Used only with Neutron. (string value) {% if neutron_plugin_agent == "openvswitch" %} interface_driver = manila.network.linux.interface.OVSInterfaceDriver {% elif neutron_plugin_agent == "linuxbridge" %} interface_driver = manila.network.linux.interface.BridgeInterfaceDriver {% endif %} -# Generic driver supports both driver modes - with and without handling -# of share servers. So, we need to define explicitly which one we are -# enabling using this driver. -driver_handles_share_servers = {{ driver_handles_share_servers }} +driver_handles_share_servers = True -# Generic driver is the only driver that uses image from Glance for building -# service VMs in Nova. And following are data for some specific image. -# We used one defined in [1] -# [1] https://git.openstack.org/cgit/openstack/manila/tree/devstack/plugin.sh?id=6785cad9#n86 service_instance_password = {{ manila_service_instance_password }} service_instance_user = {{ manila_service_instance_user }} service_image_name = manila-service-image -# Custom name for share backend. share_backend_name = GENERIC +{% endif %} + +{% if enable_manila_backend_hnas | bool %} +[hnas1] +share_backend_name = HNAS1 +share_driver = manila.share.drivers.hitachi.hnas.driver.HitachiHNASDriver +driver_handles_share_servers = False +hitachi_hnas_ip = {{ hnas_ip }} +hitachi_hnas_user = {{ hnas_user }} +hitachi_hnas_password = {{ hnas_password }} +hitachi_hnas_evs_id = {{ hnas_evs_id }} +hitachi_hnas_evs_ip = {{ hnas_evs_ip }} +hitachi_hnas_file_system_name = {{ hnas_file_system_name }} +{% endif %} diff --git a/ansible/roles/manila/templates/manila-share.json.j2 b/ansible/roles/manila/templates/manila-share.json.j2 index f3c28532a..310815655 100644 --- a/ansible/roles/manila/templates/manila-share.json.j2 +++ b/ansible/roles/manila/templates/manila-share.json.j2 @@ -7,5 +7,12 @@ "owner": "manila", "perm": "0600" } + ], + "permissions": [ + { + "path": "/var/log/kolla/manila", + "owner": "manila:manila", + "recurse": true + } ] } diff --git a/ansible/roles/manila/templates/manila.conf.j2 b/ansible/roles/manila/templates/manila.conf.j2 index 2c286558d..08f518e09 100644 --- a/ansible/roles/manila/templates/manila.conf.j2 +++ b/ansible/roles/manila/templates/manila.conf.j2 @@ -30,7 +30,7 @@ max_retries = -1 signing_dir = /var/cache/manila auth_uri = {{ internal_protocol }}://{{ kolla_internal_fqdn }}:{{ keystone_public_port }} auth_url = {{ admin_protocol }}://{{ kolla_internal_fqdn }}:{{ keystone_admin_port }} -auth_plugin = password +auth_type = password project_domain_id = default user_domain_id = default project_name = service diff --git a/ansible/roles/mariadb/tasks/do_upgrade.yml b/ansible/roles/mariadb/tasks/do_upgrade.yml deleted file mode 100644 index 3f395feec..000000000 --- a/ansible/roles/mariadb/tasks/do_upgrade.yml +++ /dev/null @@ -1,4 +0,0 @@ ---- -- include: start.yml - -- include: register.yml diff --git a/ansible/roles/mariadb/tasks/precheck.yml b/ansible/roles/mariadb/tasks/precheck.yml new file mode 100644 index 000000000..ed97d539c --- /dev/null +++ b/ansible/roles/mariadb/tasks/precheck.yml @@ -0,0 +1 @@ +--- diff --git a/ansible/roles/mariadb/tasks/upgrade.yml b/ansible/roles/mariadb/tasks/upgrade.yml index 1a2825230..fafc44ff3 100644 --- a/ansible/roles/mariadb/tasks/upgrade.yml +++ b/ansible/roles/mariadb/tasks/upgrade.yml @@ -3,6 +3,6 @@ - include: lookup_cluster.yml -- include: do_upgrade.yml +- include: start.yml - include: check.yml diff --git a/ansible/roles/mariadb/templates/mariadb.json.j2 b/ansible/roles/mariadb/templates/mariadb.json.j2 index cfee62e4d..1b77f5e88 100644 --- a/ansible/roles/mariadb/templates/mariadb.json.j2 +++ b/ansible/roles/mariadb/templates/mariadb.json.j2 @@ -14,5 +14,17 @@ "owner": "mysql", "perm": "0700" } + ], + "permissions": [ + { + "path": "/var/log/kolla/mariadb", + "owner": "mysql:mysql", + "recurse": true + }, + { + "path": "/var/lib/mysql", + "owner": "mysql:mysql", + "recurse": true + } ] } diff --git a/ansible/roles/memcached/defaults/main.yml b/ansible/roles/memcached/defaults/main.yml index 9c219d4fb..8377b77d4 100644 --- a/ansible/roles/memcached/defaults/main.yml +++ b/ansible/roles/memcached/defaults/main.yml @@ -7,3 +7,8 @@ project_name: "memcached" memcached_image: "{{ docker_registry ~ '/' if docker_registry else '' }}{{ docker_namespace }}/{{ kolla_base_distro }}-{{ kolla_install_type }}-memcached" memcached_tag: "{{ openstack_release }}" memcached_image_full: "{{ memcached_image }}:{{ memcached_tag }}" + +#################### +# Memcached options +#################### +memcached_connection_limit: "5000" diff --git a/ansible/roles/memcached/tasks/precheck.yml b/ansible/roles/memcached/tasks/precheck.yml new file mode 100644 index 000000000..ed97d539c --- /dev/null +++ b/ansible/roles/memcached/tasks/precheck.yml @@ -0,0 +1 @@ +--- diff --git a/ansible/roles/memcached/templates/memcached.json.j2 b/ansible/roles/memcached/templates/memcached.json.j2 index fc59fd01c..dcad615a6 100644 --- a/ansible/roles/memcached/templates/memcached.json.j2 +++ b/ansible/roles/memcached/templates/memcached.json.j2 @@ -1,4 +1,4 @@ { - "command": "/usr/bin/memcached -vv -l {{ api_interface_address }} -p {{ memcached_port }}", + "command": "/usr/bin/memcached -vv -l {{ api_interface_address }} -p {{ memcached_port }} -c {{ memcached_connection_limit }}", "config_files": [] } diff --git a/ansible/roles/mistral/tasks/config.yml b/ansible/roles/mistral/tasks/config.yml index 8c6d0d616..723074eac 100644 --- a/ansible/roles/mistral/tasks/config.yml +++ b/ansible/roles/mistral/tasks/config.yml @@ -35,3 +35,14 @@ - "mistral-api" - "mistral-engine" - "mistral-executor" + +- name: Check if policies shall be overwritten + local_action: stat path="{{ node_custom_config }}/mistral/policy.json" + register: mistral_policy + +- name: Copying over existing policy.json + template: + src: "{{ node_custom_config }}/mistral/policy.json" + dest: "{{ node_config_directory }}/mistral/policy.json" + when: + mistral_policy.stat.exists diff --git a/ansible/roles/mistral/tasks/precheck.yml b/ansible/roles/mistral/tasks/precheck.yml new file mode 100644 index 000000000..ed97d539c --- /dev/null +++ b/ansible/roles/mistral/tasks/precheck.yml @@ -0,0 +1 @@ +--- diff --git a/ansible/roles/mistral/templates/mistral-api.json.j2 b/ansible/roles/mistral/templates/mistral-api.json.j2 index bb9c5d868..3fdb47082 100644 --- a/ansible/roles/mistral/templates/mistral-api.json.j2 +++ b/ansible/roles/mistral/templates/mistral-api.json.j2 @@ -7,5 +7,12 @@ "owner": "mistral", "perm": "0644" } + ], + "permissions": [ + { + "path": "/var/log/kolla/mistral", + "owner": "mistral:mistral", + "recurse": true + } ] } diff --git a/ansible/roles/mistral/templates/mistral-engine.json.j2 b/ansible/roles/mistral/templates/mistral-engine.json.j2 index 68151098e..a37250fac 100644 --- a/ansible/roles/mistral/templates/mistral-engine.json.j2 +++ b/ansible/roles/mistral/templates/mistral-engine.json.j2 @@ -7,5 +7,12 @@ "owner": "mistral", "perm": "0644" } + ], + "permissions": [ + { + "path": "/var/log/kolla/mistral", + "owner": "mistral:mistral", + "recurse": true + } ] } diff --git a/ansible/roles/mistral/templates/mistral-executor.json.j2 b/ansible/roles/mistral/templates/mistral-executor.json.j2 index 09a5c53e1..405a20183 100644 --- a/ansible/roles/mistral/templates/mistral-executor.json.j2 +++ b/ansible/roles/mistral/templates/mistral-executor.json.j2 @@ -7,5 +7,12 @@ "owner": "mistral", "perm": "0644" } + ], + "permissions": [ + { + "path": "/var/log/kolla/mistral", + "owner": "mistral:mistral", + "recurse": true + } ] } diff --git a/ansible/roles/mongodb/defaults/main.yml b/ansible/roles/mongodb/defaults/main.yml index d57ce5f20..9bf44a583 100644 --- a/ansible/roles/mongodb/defaults/main.yml +++ b/ansible/roles/mongodb/defaults/main.yml @@ -13,5 +13,4 @@ mongodb_image_full: "{{ mongodb_image }}:{{ mongodb_tag }}" #################### # Mongodb #################### - mongodb_replication_set_name: "rs0" diff --git a/ansible/roles/mongodb/tasks/precheck.yml b/ansible/roles/mongodb/tasks/precheck.yml new file mode 100644 index 000000000..ed97d539c --- /dev/null +++ b/ansible/roles/mongodb/tasks/precheck.yml @@ -0,0 +1 @@ +--- diff --git a/ansible/roles/mongodb/tasks/upgrade.yml b/ansible/roles/mongodb/tasks/upgrade.yml index ed97d539c..1f16915ad 100644 --- a/ansible/roles/mongodb/tasks/upgrade.yml +++ b/ansible/roles/mongodb/tasks/upgrade.yml @@ -1 +1,4 @@ --- +- include: config.yml + +- include: start.yml diff --git a/ansible/roles/mongodb/templates/mongodb.json.j2 b/ansible/roles/mongodb/templates/mongodb.json.j2 index 12a25fc5c..5dccb78b9 100644 --- a/ansible/roles/mongodb/templates/mongodb.json.j2 +++ b/ansible/roles/mongodb/templates/mongodb.json.j2 @@ -7,5 +7,17 @@ "owner": "mongodb", "perm": "0644" } + ], + "permissions": [ + { + "path": "/var/lib/kolla/mongodb", + "owner": "mongodb:mongodb", + "recurse": true + }, + { + "path": "/var/log/kolla/mongodb", + "owner": "mongodb:mongodb", + "recurse": true + } ] } diff --git a/ansible/roles/multipathd/tasks/precheck.yml b/ansible/roles/multipathd/tasks/precheck.yml new file mode 100644 index 000000000..ed97d539c --- /dev/null +++ b/ansible/roles/multipathd/tasks/precheck.yml @@ -0,0 +1 @@ +--- diff --git a/ansible/roles/multipathd/tasks/start.yml b/ansible/roles/multipathd/tasks/start.yml index 0bd7012f3..2bf69eab2 100644 --- a/ansible/roles/multipathd/tasks/start.yml +++ b/ansible/roles/multipathd/tasks/start.yml @@ -12,7 +12,7 @@ - "kolla_logs:/var/log/kolla/" - "/etc/localtime:/etc/localtime:ro" - "/dev/:/dev/" - - "/run/:/run/" + - "/run/:/run/:shared" - "/sys/fs/cgroup:/sys/fs/cgroup:ro" - "/lib/modules:/lib/modules:ro" - "/sys/kernel/config:/configfs" diff --git a/ansible/roles/murano/tasks/config.yml b/ansible/roles/murano/tasks/config.yml index a544a4a08..779c277d5 100644 --- a/ansible/roles/murano/tasks/config.yml +++ b/ansible/roles/murano/tasks/config.yml @@ -32,3 +32,14 @@ with_items: - "murano-api" - "murano-engine" + +- name: Check if policies shall be overwritten + local_action: stat path="{{ node_custom_config }}/murano/policy.json" + register: murano_policy + +- name: Copying over existing policy.json + template: + src: "{{ node_custom_config }}/murano/policy.json" + dest: "{{ node_config_directory }}/murano/policy.json" + when: + murano_policy.stat.exists diff --git a/ansible/roles/murano/tasks/precheck.yml b/ansible/roles/murano/tasks/precheck.yml new file mode 100644 index 000000000..ed97d539c --- /dev/null +++ b/ansible/roles/murano/tasks/precheck.yml @@ -0,0 +1 @@ +--- diff --git a/ansible/roles/murano/tasks/start.yml b/ansible/roles/murano/tasks/start.yml index 5d8282f12..a4311b105 100644 --- a/ansible/roles/murano/tasks/start.yml +++ b/ansible/roles/murano/tasks/start.yml @@ -23,9 +23,9 @@ - "kolla_logs:/var/log/kolla/" when: inventory_hostname in groups['murano-api'] -- name: Waiting for Murano API service to be ready +- name: Waiting for Murano API service to be ready on first node wait_for: - host: "{{ hostvars[inventory_hostname]['ansible_' + api_interface]['ipv4']['address'] }}" + host: "{{ api_interface_address }}" port: "{{ murano_api_port }}" connect_timeout: 1 timeout: 60 @@ -34,7 +34,7 @@ until: check_murano_port | success retries: 10 delay: 6 - when: inventory_hostname in groups['murano-api'] + delegate_to: "{{ groups['murano-api'][0] }}" - name: Checking if Murano core library package exists command: "docker exec murano_api murano \ @@ -43,11 +43,13 @@ --os-project-name admin \ --os-auth-url \ {{ admin_protocol }}://{{ kolla_internal_fqdn }}:{{ keystone_admin_port }}/v3 \ + --murano-url \ + {{ admin_protocol }}://{{ api_interface_address }}:{{ murano_api_port }} \ package-list" register: status changed_when: False run_once: True - when: inventory_hostname in groups['murano-api'] + delegate_to: "{{ groups['murano-api'][0] }}" - name: Importing Murano core library package command: "docker exec murano_api murano \ @@ -56,8 +58,10 @@ --os-project-name admin \ --os-auth-url \ {{ admin_protocol }}://{{ kolla_internal_fqdn }}:{{ keystone_admin_port }}/v3 \ + --murano-url \ + {{ admin_protocol }}://{{ api_interface_address }}:{{ murano_api_port }} \ package-import --is-public /io.murano.zip" run_once: True + delegate_to: "{{ groups['murano-api'][0] }}" when: - - inventory_hostname in groups['murano-api'] - status.stdout.find("io.murano") == -1 diff --git a/ansible/roles/murano/templates/murano-api.json.j2 b/ansible/roles/murano/templates/murano-api.json.j2 index c67b1ef1f..07a6b8693 100644 --- a/ansible/roles/murano/templates/murano-api.json.j2 +++ b/ansible/roles/murano/templates/murano-api.json.j2 @@ -5,7 +5,14 @@ "source": "{{ container_config_directory }}/murano.conf", "dest": "/etc/murano/murano.conf", "owner": "murano", - "perm": "0644" + "perm": "0600" + } + ], + "permissions": [ + { + "path": "/var/log/kolla/murano", + "owner": "murano:murano", + "recurse": true } ] } diff --git a/ansible/roles/murano/templates/murano-engine.json.j2 b/ansible/roles/murano/templates/murano-engine.json.j2 index a56bc16d4..98a328e72 100644 --- a/ansible/roles/murano/templates/murano-engine.json.j2 +++ b/ansible/roles/murano/templates/murano-engine.json.j2 @@ -5,7 +5,14 @@ "source": "{{ container_config_directory }}/murano.conf", "dest": "/etc/murano/murano.conf", "owner": "murano", - "perm": "0644" + "perm": "0600" + } + ], + "permissions": [ + { + "path": "/var/log/kolla/murano", + "owner": "murano:murano", + "recurse": true } ] } diff --git a/ansible/roles/murano/templates/murano.conf.j2 b/ansible/roles/murano/templates/murano.conf.j2 index 7b0cfd408..5e95df866 100644 --- a/ansible/roles/murano/templates/murano.conf.j2 +++ b/ansible/roles/murano/templates/murano.conf.j2 @@ -11,7 +11,7 @@ bind_port = {{ murano_api_port }} transport_url = rabbit://{% for host in groups['rabbitmq'] %}{{ rabbitmq_user }}:{{ rabbitmq_password }}@{{ hostvars[host]['ansible_' + hostvars[host]['api_interface']]['ipv4']['address'] }}:{{ rabbitmq_port }}{% if not loop.last %},{% endif %}{% endfor %} [engine] -workers = {{ openstack_service_workers }} +engine_workers = {{ openstack_service_workers }} [database] connection = mysql+pymysql://{{ murano_database_user }}:{{ murano_database_password }}@{{ murano_database_address }}/{{ murano_database_name }} @@ -36,6 +36,7 @@ memcached_servers = {% for host in groups['memcached'] %}{{ hostvars[host]['ansi [murano] url = {{ internal_protocol }}://{{ kolla_internal_fqdn }}:{{ murano_api_port }} +api_workers = {{ openstack_service_workers }} [oslo_messaging_notifications] diff --git a/ansible/roles/neutron/tasks/config.yml b/ansible/roles/neutron/tasks/config.yml index 1c7d0238b..82921cd96 100644 --- a/ansible/roles/neutron/tasks/config.yml +++ b/ansible/roles/neutron/tasks/config.yml @@ -183,3 +183,14 @@ dest: "{{ node_config_directory }}/{{ item }}/vpnaas_agent.ini" with_items: - "neutron-vpnaas-agent" + +- name: Check if policies shall be overwritten + local_action: stat path="{{ node_custom_config }}/neutron/policy.json" + register: neutron_policy + +- name: Copying over existing policy.json + template: + src: "{{ node_custom_config }}/neutron/policy.json" + dest: "{{ node_config_directory }}/neutron/policy.json" + when: + neutron_policy.stat.exists diff --git a/ansible/roles/neutron/tasks/precheck.yml b/ansible/roles/neutron/tasks/precheck.yml new file mode 100644 index 000000000..ed97d539c --- /dev/null +++ b/ansible/roles/neutron/tasks/precheck.yml @@ -0,0 +1 @@ +--- diff --git a/ansible/roles/neutron/tasks/start.yml b/ansible/roles/neutron/tasks/start.yml index e90d4a176..95f5e65d4 100644 --- a/ansible/roles/neutron/tasks/start.yml +++ b/ansible/roles/neutron/tasks/start.yml @@ -8,7 +8,7 @@ volumes: - "{{ node_config_directory }}/openvswitch-db-server/:{{ container_config_directory }}/:ro" - "/etc/localtime:/etc/localtime:ro" - - "/run:/run" + - "/run:/run:shared" - "kolla_logs:/var/log/kolla/" - "openvswitch_db:/var/lib/openvswitch/" when: @@ -63,7 +63,7 @@ - "{{ node_config_directory }}/openvswitch-vswitchd/:{{ container_config_directory }}/:ro" - "/etc/localtime:/etc/localtime:ro" - "/lib/modules:/lib/modules:ro" - - "/run:/run" + - "/run:/run:shared" - "kolla_logs:/var/log/kolla/" when: - (inventory_hostname in groups['compute'] @@ -97,7 +97,7 @@ - "{{ node_config_directory }}/neutron-openvswitch-agent/:{{ container_config_directory }}/:ro" - "/etc/localtime:/etc/localtime:ro" - "/lib/modules:/lib/modules:ro" - - "/run:/run" + - "/run:/run:shared" - "kolla_logs:/var/log/kolla/" when: - ( @@ -129,7 +129,7 @@ - "{{ node_config_directory }}/neutron-sfc-agent/:{{ container_config_directory }}/:ro" - "/etc/localtime:/etc/localtime:ro" - "/lib/modules:/lib/modules:ro" - - "/run:/run" + - "/run:/run:shared" - "kolla_logs:/var/log/kolla/" when: - ( @@ -159,7 +159,7 @@ - "{{ node_config_directory }}/neutron-openvswitch-agent-fake-{{ item }}/:{{ container_config_directory }}/:ro" - "/etc/localtime:/etc/localtime:ro" - "/lib/modules:/lib/modules:ro" - - "/run:/run" + - "/run:/run:shared" - "kolla_logs:/var/log/kolla/" with_sequence: start=1 end={{ num_nova_fake_per_node }} when: @@ -178,7 +178,7 @@ - "{{ node_config_directory }}/neutron-sfc-agent-fake-{{ item }}/:{{ container_config_directory }}/:ro" - "/etc/localtime:/etc/localtime:ro" - "/lib/modules:/lib/modules:ro" - - "/run:/run" + - "/run:/run:shared" - "kolla_logs:/var/log/kolla/" with_sequence: start=1 end={{ num_nova_fake_per_node }} when: @@ -201,7 +201,7 @@ - "{{ node_config_directory }}/neutron-linuxbridge-agent/:{{ container_config_directory }}/:ro" - "/etc/localtime:/etc/localtime:ro" - "/lib/modules:/lib/modules:ro" - - "/run:/run" + - "/run:/run:shared" - "kolla_logs:/var/log/kolla/" when: - (inventory_hostname in groups['compute'] @@ -222,7 +222,7 @@ volumes: - "{{ node_config_directory }}/neutron-dhcp-agent/:{{ container_config_directory }}/:ro" - "/etc/localtime:/etc/localtime:ro" - - "/run/:/run/" + - "/run/:/run/:shared" - "/run/netns/:/run/netns/:shared" - "neutron_metadata_socket:/var/lib/neutron/kolla/" - "kolla_logs:/var/log/kolla/" @@ -239,7 +239,7 @@ volumes: - "{{ node_config_directory }}/neutron-l3-agent/:{{ container_config_directory }}/:ro" - "/etc/localtime:/etc/localtime:ro" - - "/run:/run" + - "/run:/run:shared" - "/run/netns/:/run/netns/:shared" - "neutron_metadata_socket:/var/lib/neutron/kolla/" - "kolla_logs:/var/log/kolla/" @@ -258,7 +258,7 @@ volumes: - "{{ node_config_directory }}/neutron-lbaas-agent/:{{ container_config_directory }}/:ro" - "/etc/localtime:/etc/localtime:ro" - - "/run:/run" + - "/run:/run:shared" - "/run/netns/:/run/netns/:shared" - "neutron_metadata_socket:/var/lib/neutron/kolla/" - "kolla_logs:/var/log/kolla/" @@ -293,7 +293,7 @@ volumes: - "{{ node_config_directory }}/neutron-vpnaas-agent/:{{ container_config_directory }}/:ro" - "/etc/localtime:/etc/localtime:ro" - - "/run:/run" + - "/run:/run:shared" - "/run/netns/:/run/netns/:shared" - "neutron_metadata_socket:/var/lib/neutron/kolla/" - "kolla_logs:/var/log/kolla/" diff --git a/ansible/roles/neutron/templates/l3_agent.ini.j2 b/ansible/roles/neutron/templates/l3_agent.ini.j2 index 679730f20..7b513d4eb 100644 --- a/ansible/roles/neutron/templates/l3_agent.ini.j2 +++ b/ansible/roles/neutron/templates/l3_agent.ini.j2 @@ -1,12 +1,11 @@ #jinja2: trim_blocks: False [DEFAULT] {% if enable_neutron_dvr | bool %} - {% if inventory_hostname in groups['network'] %} +{% if inventory_hostname in groups['network'] %} agent_mode = dvr_snat - {% elif inventory_hostname in groups['compute'] %} +{% elif inventory_hostname in groups['compute'] %} agent_mode = dvr - {% endif %} +{% endif %} {% else %} agent_mode = legacy {% endif %} -external_network_bridge = diff --git a/ansible/roles/neutron/templates/neutron-dhcp-agent.json.j2 b/ansible/roles/neutron/templates/neutron-dhcp-agent.json.j2 index bdd30c42e..f5eed2a52 100644 --- a/ansible/roles/neutron/templates/neutron-dhcp-agent.json.j2 +++ b/ansible/roles/neutron/templates/neutron-dhcp-agent.json.j2 @@ -25,5 +25,17 @@ "owner": "neutron", "perm": "0600" } + ], + "permissions": [ + { + "path": "/var/log/kolla/neutron", + "owner": "neutron:neutron", + "recurse": true + }, + { + "path": "/var/lib/neutron/kolla", + "owner": "neutron:neutron", + "recurse": true + } ] } diff --git a/ansible/roles/neutron/templates/neutron-l3-agent.json.j2 b/ansible/roles/neutron/templates/neutron-l3-agent.json.j2 index 24bcc2849..d3ef7653f 100644 --- a/ansible/roles/neutron/templates/neutron-l3-agent.json.j2 +++ b/ansible/roles/neutron/templates/neutron-l3-agent.json.j2 @@ -25,5 +25,17 @@ "owner": "neutron", "perm": "0600" } + ], + "permissions": [ + { + "path": "/var/log/kolla/neutron", + "owner": "neutron:neutron", + "recurse": true + }, + { + "path": "/var/lib/neutron/kolla", + "owner": "neutron:neutron", + "recurse": true + } ] } diff --git a/ansible/roles/neutron/templates/neutron-lbaas-agent.json.j2 b/ansible/roles/neutron/templates/neutron-lbaas-agent.json.j2 index 6bb45cdee..0955c3051 100644 --- a/ansible/roles/neutron/templates/neutron-lbaas-agent.json.j2 +++ b/ansible/roles/neutron/templates/neutron-lbaas-agent.json.j2 @@ -19,5 +19,17 @@ "owner": "neutron", "perm": "0600" } + ], + "permissions": [ + { + "path": "/var/log/kolla/neutron", + "owner": "neutron:neutron", + "recurse": true + }, + { + "path": "/var/lib/neutron/kolla", + "owner": "neutron:neutron", + "recurse": true + } ] } diff --git a/ansible/roles/neutron/templates/neutron-linuxbridge-agent.json.j2 b/ansible/roles/neutron/templates/neutron-linuxbridge-agent.json.j2 index 0da4f5a16..6055414af 100644 --- a/ansible/roles/neutron/templates/neutron-linuxbridge-agent.json.j2 +++ b/ansible/roles/neutron/templates/neutron-linuxbridge-agent.json.j2 @@ -13,5 +13,12 @@ "owner": "neutron", "perm": "0600" } + ], + "permissions": [ + { + "path": "/var/log/kolla/neutron", + "owner": "neutron:neutron", + "recurse": true + } ] } diff --git a/ansible/roles/neutron/templates/neutron-metadata-agent.json.j2 b/ansible/roles/neutron/templates/neutron-metadata-agent.json.j2 index ba0d1b9c9..205ad3bd3 100644 --- a/ansible/roles/neutron/templates/neutron-metadata-agent.json.j2 +++ b/ansible/roles/neutron/templates/neutron-metadata-agent.json.j2 @@ -19,5 +19,17 @@ "owner": "neutron", "perm": "0600" } + ], + "permissions": [ + { + "path": "/var/log/kolla/neutron", + "owner": "neutron:neutron", + "recurse": true + }, + { + "path": "/var/lib/neutron/kolla", + "owner": "neutron:neutron", + "recurse": true + } ] } diff --git a/ansible/roles/neutron/templates/neutron-openvswitch-agent.json.j2 b/ansible/roles/neutron/templates/neutron-openvswitch-agent.json.j2 index 36a9a03f7..853db8108 100644 --- a/ansible/roles/neutron/templates/neutron-openvswitch-agent.json.j2 +++ b/ansible/roles/neutron/templates/neutron-openvswitch-agent.json.j2 @@ -13,5 +13,12 @@ "owner": "neutron", "perm": "0600" } + ], + "permissions": [ + { + "path": "/var/log/kolla/neutron", + "owner": "neutron:neutron", + "recurse": true + } ] } diff --git a/ansible/roles/neutron/templates/neutron-server.json.j2 b/ansible/roles/neutron/templates/neutron-server.json.j2 index 54fed2e00..36402f0a5 100644 --- a/ansible/roles/neutron/templates/neutron-server.json.j2 +++ b/ansible/roles/neutron/templates/neutron-server.json.j2 @@ -25,5 +25,12 @@ "owner": "neutron", "perm": "0600" } + ], + "permissions": [ + { + "path": "/var/log/kolla/neutron", + "owner": "neutron:neutron", + "recurse": true + } ] } diff --git a/ansible/roles/neutron/templates/neutron-vpnaas-agent.json.j2 b/ansible/roles/neutron/templates/neutron-vpnaas-agent.json.j2 index dff9c44d9..2c0853d48 100644 --- a/ansible/roles/neutron/templates/neutron-vpnaas-agent.json.j2 +++ b/ansible/roles/neutron/templates/neutron-vpnaas-agent.json.j2 @@ -31,5 +31,17 @@ "owner": "neutron", "perm": "0600" } + ], + "permissions": [ + { + "path": "/var/log/kolla/neutron", + "owner": "neutron:neutron", + "recurse": true + }, + { + "path": "/var/lib/neutron/kolla", + "owner": "neutron:neutron", + "recurse": true + } ] } diff --git a/ansible/roles/neutron/templates/neutron.conf.j2 b/ansible/roles/neutron/templates/neutron.conf.j2 index 6b899ed0c..d9f625622 100644 --- a/ansible/roles/neutron/templates/neutron.conf.j2 +++ b/ansible/roles/neutron/templates/neutron.conf.j2 @@ -72,7 +72,7 @@ connection = mysql+pymysql://{{ neutron_database_user }}:{{ neutron_database_pas max_retries = -1 [keystone_authtoken] -auth_uri = {{ keystone_public_url }} +auth_uri = {{ keystone_internal_url }} auth_url = {{ keystone_admin_url }} auth_type = password project_domain_id = default diff --git a/ansible/roles/nova/defaults/main.yml b/ansible/roles/nova/defaults/main.yml index 2d80abf33..bf24c02f7 100644 --- a/ansible/roles/nova/defaults/main.yml +++ b/ansible/roles/nova/defaults/main.yml @@ -13,6 +13,10 @@ nova_pool_name: "{{ ceph_nova_pool_name }}" nova_pool_type: "{{ ceph_nova_pool_type }}" nova_cache_mode: "{{ ceph_nova_cache_mode }}" +# Discard option for nova managed disks. Requires libvirt (1, 0, 6) or later and +# qemu (1, 6, 0) or later. Set to "" to disable. +nova_hw_disk_discard: "unmap" + #################### # Database diff --git a/ansible/roles/nova/tasks/config.yml b/ansible/roles/nova/tasks/config.yml index 884163570..b8750b930 100644 --- a/ansible/roles/nova/tasks/config.yml +++ b/ansible/roles/nova/tasks/config.yml @@ -83,3 +83,14 @@ - { src: "id_rsa", dest: "id_rsa" } - { src: "id_rsa.pub", dest: "id_rsa.pub" } - { src: "ssh_config.j2", dest: "ssh_config" } + +- name: Check if policies shall be overwritten + local_action: stat path="{{ node_custom_config }}/nova/policy.json" + register: nova_policy + +- name: Copying over existing policy.json + template: + src: "{{ node_custom_config }}/nova/policy.json" + dest: "{{ node_config_directory }}/nova/policy.json" + when: + nova_policy.stat.exists diff --git a/ansible/roles/nova/tasks/precheck.yml b/ansible/roles/nova/tasks/precheck.yml new file mode 100644 index 000000000..ed97d539c --- /dev/null +++ b/ansible/roles/nova/tasks/precheck.yml @@ -0,0 +1 @@ +--- diff --git a/ansible/roles/nova/tasks/start_compute.yml b/ansible/roles/nova/tasks/start_compute.yml index df7674793..1ba3c47c8 100644 --- a/ansible/roles/nova/tasks/start_compute.yml +++ b/ansible/roles/nova/tasks/start_compute.yml @@ -11,7 +11,7 @@ - "{{ node_config_directory }}/nova-libvirt/:{{ container_config_directory }}/:ro" - "/etc/localtime:/etc/localtime:ro" - "/lib/modules:/lib/modules:ro" - - "/run/:/run/" + - "/run/:/run/:shared" - "/dev:/dev" - "/sys/fs/cgroup:/sys/fs/cgroup" - "kolla_logs:/var/log/kolla/" @@ -19,9 +19,9 @@ - "nova_compute:/var/lib/nova/" - "nova_libvirt_qemu:/etc/libvirt/qemu" register: start_nova_libvirt_container - # NOTE(Jeffrey4l): retry 1 to remove nova_libvirt container because when + # NOTE(Jeffrey4l): retry 5 to remove nova_libvirt container because when # guests running, nova_libvirt will raise error even though it is removed. - retries: 1 + retries: 5 until: start_nova_libvirt_container|success when: inventory_hostname in groups['compute'] @@ -31,7 +31,7 @@ - "{{ node_config_directory }}/nova-compute/:{{ container_config_directory }}/:ro" - "/etc/localtime:/etc/localtime:ro" - "/lib/modules:/lib/modules:ro" - - "/run:/run" + - "/run:/run:shared" - "/dev:/dev" - "kolla_logs:/var/log/kolla/" - "{% if enable_iscsid | bool %}iscsi_info:/etc/iscsi{% endif %}" @@ -76,7 +76,7 @@ - "{{ node_config_directory }}/nova-compute-fake-{{ item }}/:{{ container_config_directory }}/:ro" - "/etc/localtime:/etc/localtime:ro" - "/lib/modules:/lib/modules:ro" - - "/run:/run" + - "/run:/run:shared" - "kolla_logs:/var/log/kolla/" with_sequence: start=1 end={{ num_nova_fake_per_node }} when: diff --git a/ansible/roles/nova/templates/nova-api.json.j2 b/ansible/roles/nova/templates/nova-api.json.j2 index f9cb27e9a..28642bd59 100644 --- a/ansible/roles/nova/templates/nova-api.json.j2 +++ b/ansible/roles/nova/templates/nova-api.json.j2 @@ -7,5 +7,12 @@ "owner": "nova", "perm": "0600" } + ], + "permissions": [ + { + "path": "/var/log/kolla/nova", + "owner": "nova:nova", + "recurse": true + } ] } diff --git a/ansible/roles/nova/templates/nova-compute-ironic.json.j2 b/ansible/roles/nova/templates/nova-compute-ironic.json.j2 index 35ae7cfe4..94e2b5fae 100644 --- a/ansible/roles/nova/templates/nova-compute-ironic.json.j2 +++ b/ansible/roles/nova/templates/nova-compute-ironic.json.j2 @@ -7,5 +7,12 @@ "owner": "nova", "perm": "0600" } + ], + "permissions": [ + { + "path": "/var/log/kolla/nova", + "owner": "nova:nova", + "recurse": true + } ] } diff --git a/ansible/roles/nova/templates/nova-compute.json.j2 b/ansible/roles/nova/templates/nova-compute.json.j2 index a3fd495de..018bf7a80 100644 --- a/ansible/roles/nova/templates/nova-compute.json.j2 +++ b/ansible/roles/nova/templates/nova-compute.json.j2 @@ -13,5 +13,17 @@ "owner": "nova", "perm": "0700" }{% endif %} + ], + "permissions": [ + { + "path": "/var/log/kolla/nova", + "owner": "nova:nova", + "recurse": true + }, + { + "path": "/var/lib/nova", + "owner": "nova:nova", + "recurse": true + } ] } diff --git a/ansible/roles/nova/templates/nova-conductor.json.j2 b/ansible/roles/nova/templates/nova-conductor.json.j2 index 1e214ad8b..6a7328713 100644 --- a/ansible/roles/nova/templates/nova-conductor.json.j2 +++ b/ansible/roles/nova/templates/nova-conductor.json.j2 @@ -7,5 +7,12 @@ "owner": "nova", "perm": "0600" } + ], + "permissions": [ + { + "path": "/var/log/kolla/nova", + "owner": "nova:nova", + "recurse": true + } ] } diff --git a/ansible/roles/nova/templates/nova-consoleauth.json.j2 b/ansible/roles/nova/templates/nova-consoleauth.json.j2 index 17837a86d..9cc3240d7 100644 --- a/ansible/roles/nova/templates/nova-consoleauth.json.j2 +++ b/ansible/roles/nova/templates/nova-consoleauth.json.j2 @@ -7,5 +7,12 @@ "owner": "nova", "perm": "0600" } + ], + "permissions": [ + { + "path": "/var/log/kolla/nova", + "owner": "nova:nova", + "recurse": true + } ] } diff --git a/ansible/roles/nova/templates/nova-novncproxy.json.j2 b/ansible/roles/nova/templates/nova-novncproxy.json.j2 index e2f98ec05..d34efb3d6 100644 --- a/ansible/roles/nova/templates/nova-novncproxy.json.j2 +++ b/ansible/roles/nova/templates/nova-novncproxy.json.j2 @@ -7,5 +7,12 @@ "owner": "nova", "perm": "0600" } + ], + "permissions": [ + { + "path": "/var/log/kolla/nova", + "owner": "nova:nova", + "recurse": true + } ] } diff --git a/ansible/roles/nova/templates/nova-scheduler.json.j2 b/ansible/roles/nova/templates/nova-scheduler.json.j2 index 1a533aaf2..36638987a 100644 --- a/ansible/roles/nova/templates/nova-scheduler.json.j2 +++ b/ansible/roles/nova/templates/nova-scheduler.json.j2 @@ -7,5 +7,12 @@ "owner": "nova", "perm": "0600" } + ], + "permissions": [ + { + "path": "/var/log/kolla/nova", + "owner": "nova:nova", + "recurse": true + } ] } diff --git a/ansible/roles/nova/templates/nova-spicehtml5proxy.json.j2 b/ansible/roles/nova/templates/nova-spicehtml5proxy.json.j2 index 223bb78b0..e12354bf4 100644 --- a/ansible/roles/nova/templates/nova-spicehtml5proxy.json.j2 +++ b/ansible/roles/nova/templates/nova-spicehtml5proxy.json.j2 @@ -7,5 +7,12 @@ "owner": "nova", "perm": "0600" } + ], + "permissions": [ + { + "path": "/var/log/kolla/nova", + "owner": "nova:nova", + "recurse": true + } ] } diff --git a/ansible/roles/nova/templates/nova.conf.j2 b/ansible/roles/nova/templates/nova.conf.j2 index 82c991e94..6706d16e9 100644 --- a/ansible/roles/nova/templates/nova.conf.j2 +++ b/ansible/roles/nova/templates/nova.conf.j2 @@ -5,7 +5,6 @@ debug = {{ nova_logging_debug }} log_dir = /var/log/kolla/nova use_forwarded_for = true -api_paste_config = /etc/nova/api-paste.ini state_path = /var/lib/nova {% if kolla_enable_tls_external | bool %} @@ -112,7 +111,7 @@ api_servers = {% for host in groups['glance-api'] %}{{ internal_protocol }}://{% num_retries = {{ groups['glance-api'] | length }} [cinder] -catalog_info = volume:cinder:internalURL +catalog_info = volumev2:cinderv2:internalURL [neutron] {% if orchestration_engine == 'KUBERNETES' %} @@ -175,14 +174,15 @@ images_rbd_pool = {{ ceph_nova_pool_name }} images_rbd_ceph_conf = /etc/ceph/ceph.conf rbd_user = nova disk_cachemodes="network=writeback" -hw_disk_discard = unmap +{% if nova_hw_disk_discard != '' %} +hw_disk_discard = {{ nova_hw_disk_discard }} +{% endif %} {% endif %} {% if nova_backend == "rbd" %} rbd_secret_uuid = {{ rbd_secret_uuid }} {% endif %} - [upgrade_levels] compute = auto @@ -196,3 +196,12 @@ driver = noop [privsep_entrypoint] helper_command=sudo nova-rootwrap /etc/nova/rootwrap.conf privsep-helper --config-file /etc/nova/nova.conf + +[glance] +debug = {{ nova_logging_debug }} + +[guestfs] +debug = {{ nova_logging_debug }} + +[wsgi] +api_paste_config = /etc/nova/api-paste.ini diff --git a/ansible/roles/prechecks/tasks/port_checks.yml b/ansible/roles/prechecks/tasks/port_checks.yml index 15a12a53a..9ed04e591 100644 --- a/ansible/roles/prechecks/tasks/port_checks.yml +++ b/ansible/roles/prechecks/tasks/port_checks.yml @@ -5,7 +5,9 @@ port: "{{ aodh_api_port }}" connect_timeout: 1 state: stopped - when: inventory_hostname in groups['aodh-api'] + when: + - inventory_hostname in groups['aodh-api'] + - enable_aodh | bool - name: Checking free port for Aodh API HAProxy wait_for: @@ -13,7 +15,9 @@ port: "{{ aodh_api_port }}" connect_timeout: 1 state: stopped - when: inventory_hostname in groups['haproxy'] + when: + - inventory_hostname in groups['haproxy'] + - enable_aodh | bool - name: Checking free port for Barbican API wait_for: @@ -21,7 +25,9 @@ port: "{{ barbican_api_port }}" connect_timeout: 1 state: stopped - when: inventory_hostname in groups['barbican-api'] + when: + - inventory_hostname in groups['barbican-api'] + - enable_barbican | bool - name: Checking free port for Barbican API HAProxy wait_for: @@ -29,7 +35,9 @@ port: "{{ barbican_api_port }}" connect_timeout: 1 state: stopped - when: inventory_hostname in groups['haproxy'] + when: + - inventory_hostname in groups['haproxy'] + - enable_barbican | bool - name: Checking free port for Ceilometer API wait_for: @@ -37,7 +45,9 @@ port: "{{ ceilometer_api_port }}" connect_timeout: 1 state: stopped - when: inventory_hostname in groups['ceilometer-api'] + when: + - inventory_hostname in groups['ceilometer-api'] + - enable_ceilometer | bool - name: Checking free port for Ceilometer API HAProxy wait_for: @@ -45,7 +55,9 @@ port: "{{ ceilometer_api_port }}" connect_timeout: 1 state: stopped - when: inventory_hostname in groups['haproxy'] + when: + - inventory_hostname in groups['haproxy'] + - enable_ceilometer | bool - name: Checking free port for Congress API wait_for: @@ -53,7 +65,9 @@ port: "{{ congress_api_port }}" connect_timeout: 1 state: stopped - when: inventory_hostname in groups['congress-api'] + when: + - inventory_hostname in groups['congress-api'] + - enable_congress | bool - name: Checking free port for Congress API HAProxy wait_for: @@ -61,7 +75,9 @@ port: "{{ congress_api_port }}" connect_timeout: 1 state: stopped - when: inventory_hostname in groups['haproxy'] + when: + - inventory_hostname in groups['haproxy'] + - enable_congress | bool - name: Checking free port for Cinder API wait_for: @@ -69,7 +85,9 @@ port: "{{ cinder_api_port }}" connect_timeout: 1 state: stopped - when: inventory_hostname in groups['cinder-api'] + when: + - inventory_hostname in groups['cinder-api'] + - enable_cinder | bool - name: Checking free port for Cinder API HAProxy wait_for: @@ -77,7 +95,9 @@ port: "{{ cinder_api_port }}" connect_timeout: 1 state: stopped - when: inventory_hostname in groups['haproxy'] + when: + - inventory_hostname in groups['haproxy'] + - enable_cinder | bool - name: Checking free port for Cloudkitty API wait_for: @@ -85,7 +105,9 @@ port: "{{ cloudkitty_api_port }}" connect_timeout: 1 state: stopped - when: inventory_hostname in groups['cloudkitty-api'] + when: + - inventory_hostname in groups['cloudkitty-api'] + - enable_cloudkitty | bool - name: Checking free port for Cloudkitty API HAProxy wait_for: @@ -93,7 +115,29 @@ port: "{{ cloudkitty_api_port }}" connect_timeout: 1 state: stopped - when: inventory_hostname in groups['haproxy'] + when: + - inventory_hostname in groups['haproxy'] + - enable_cloudkitty | bool + +- name: Checking free port for Etcd Peer + wait_for: + host: "{{ hostvars[inventory_hostname]['ansible_' + api_interface]['ipv4']['address'] }}" + port: "{{ etcd_peer_port }}" + connect_timeout: 1 + state: stopped + when: + - inventory_hostname in groups['etcd'] + - enable_etcd | bool + +- name: Checking free port for Etcd Client + wait_for: + host: "{{ hostvars[inventory_hostname]['ansible_' + api_interface]['ipv4']['address'] }}" + port: "{{ etcd_client_port }}" + connect_timeout: 1 + state: stopped + when: + - inventory_hostname in groups['etcd'] + - enable_etcd | bool - name: Checking free port for Glance API wait_for: @@ -101,7 +145,9 @@ port: "{{ glance_api_port }}" connect_timeout: 1 state: stopped - when: inventory_hostname in groups['glance-api'] + when: + - inventory_hostname in groups['glance-api'] + - enable_glance | bool - name: Checking free port for Glance API HAProxy wait_for: @@ -109,7 +155,9 @@ port: "{{ glance_api_port }}" connect_timeout: 1 state: stopped - when: inventory_hostname in groups['haproxy'] + when: + - inventory_hostname in groups['haproxy'] + - enable_glance | bool - name: Checking free port for Glance Registry wait_for: @@ -117,7 +165,9 @@ port: "{{ glance_registry_port }}" connect_timeout: 1 state: stopped - when: inventory_hostname in groups['glance-registry'] + when: + - inventory_hostname in groups['glance-registry'] + - enable_glance | bool - name: Checking free port for Glance Registry HAProxy wait_for: @@ -125,7 +175,9 @@ port: "{{ glance_registry_port }}" connect_timeout: 1 state: stopped - when: inventory_hostname in groups['haproxy'] + when: + - inventory_hostname in groups['haproxy'] + - enable_glance | bool - name: Checking free port for Gnocchi API wait_for: @@ -133,7 +185,9 @@ port: "{{ gnocchi_api_port }}" connect_timeout: 1 state: stopped - when: inventory_hostname in groups['gnocchi-api'] + when: + - inventory_hostname in groups['gnocchi-api'] + - enable_gnocchi | bool - name: Checking free port for Gnocchi API HAProxy wait_for: @@ -141,7 +195,19 @@ port: "{{ gnocchi_api_port }}" connect_timeout: 1 state: stopped - when: inventory_hostname in groups['haproxy'] + when: + - inventory_hostname in groups['haproxy'] + - enable_gnocchi | bool + +- name: Checking free port for Kuryr + wait_for: + host: "{{ hostvars[inventory_hostname]['ansible_' + api_interface]['ipv4']['address'] }}" + port: "{{ kuryr_port }}" + connect_timeout: 1 + state: stopped + when: + - inventory_hostname in groups['compute'] + - enable_kuryr | bool - name: Checking free port for Sahara API wait_for: @@ -149,7 +215,9 @@ port: "{{ sahara_api_port }}" connect_timeout: 1 state: stopped - when: inventory_hostname in groups['sahara-api'] + when: + - inventory_hostname in groups['sahara-api'] + - enable_sahara | bool - name: Checking free port for Sahara API HAProxy wait_for: @@ -157,7 +225,9 @@ port: "{{ sahara_api_port }}" connect_timeout: 1 state: stopped - when: inventory_hostname in groups['haproxy'] + when: + - inventory_hostname in groups['haproxy'] + - enable_sahara | bool - name: Checking free port for HAProxy stats wait_for: @@ -165,7 +235,9 @@ port: "{{ haproxy_stats_port }}" connect_timeout: 1 state: stopped - when: inventory_hostname in groups['haproxy'] + when: + - inventory_hostname in groups['haproxy'] + - enable_haproxy | bool - name: Checking free port for Heat API wait_for: @@ -173,7 +245,9 @@ port: "{{ heat_api_port }}" connect_timeout: 1 state: stopped - when: inventory_hostname in groups['heat-api'] + when: + - inventory_hostname in groups['heat-api'] + - enable_heat | bool - name: Checking free port for Heat API HAProxy wait_for: @@ -181,7 +255,9 @@ port: "{{ heat_api_port }}" connect_timeout: 1 state: stopped - when: inventory_hostname in groups['haproxy'] + when: + - inventory_hostname in groups['haproxy'] + - enable_heat | bool - name: Checking free port for Heat API CFN wait_for: @@ -189,7 +265,9 @@ port: "{{ heat_api_cfn_port }}" connect_timeout: 1 state: stopped - when: inventory_hostname in groups['heat-api-cfn'] + when: + - inventory_hostname in groups['heat-api-cfn'] + - enable_heat | bool - name: Checking free port for Heat API CFN HAProxy wait_for: @@ -197,7 +275,9 @@ port: "{{ heat_api_cfn_port }}" connect_timeout: 1 state: stopped - when: inventory_hostname in groups['haproxy'] + when: + - inventory_hostname in groups['haproxy'] + - enable_heat | bool - name: Checking free port for Horizon wait_for: @@ -205,7 +285,9 @@ port: "80" connect_timeout: 1 state: stopped - when: inventory_hostname in groups['horizon'] + when: + - inventory_hostname in groups['horizon'] + - enable_horizon | bool - name: Checking free port for Horizon HAProxy wait_for: @@ -213,7 +295,9 @@ port: "80" connect_timeout: 1 state: stopped - when: inventory_hostname in groups['haproxy'] + when: + - inventory_hostname in groups['haproxy'] + - enable_horizon | bool - name: Checking free port for Ironic wait_for: @@ -221,7 +305,9 @@ port: "{{ ironic_api_port }}" connect_timeout: 1 state: stopped - when: inventory_hostname in groups['ironic-api'] + when: + - inventory_hostname in groups['ironic-api'] + - enable_ironic | bool - name: Checking free port for Ironic HAProxy wait_for: @@ -229,7 +315,29 @@ port: "{{ ironic_api_port }}" connect_timeout: 1 state: stopped - when: inventory_hostname in groups['haproxy'] + when: + - inventory_hostname in groups['haproxy'] + - enable_ironic | bool + +- name: Checking free port for Influxdb Admin + wait_for: + host: "{{ hostvars[inventory_hostname]['ansible_' + api_interface]['ipv4']['address'] }}" + port: "{{ influxdb_admin_port }}" + connect_timeout: 1 + state: stopped + when: + - inventory_hostname in groups['influxdb'] + - enable_influxdb | bool + +- name: Checking free port for Influxdb Http + wait_for: + host: "{{ hostvars[inventory_hostname]['ansible_' + api_interface]['ipv4']['address'] }}" + port: "{{ influxdb_http_port }}" + connect_timeout: 1 + state: stopped + when: + - inventory_hostname in groups['influxdb'] + - enable_influxdb | bool - name: Checking free port for Keystone Admin wait_for: @@ -237,7 +345,9 @@ port: "{{ keystone_admin_port }}" connect_timeout: 1 state: stopped - when: inventory_hostname in groups['keystone'] + when: + - inventory_hostname in groups['keystone'] + - enable_keystone | bool - name: Checking free port for Keystone Admin HAProxy wait_for: @@ -245,7 +355,9 @@ port: "{{ keystone_admin_port }}" connect_timeout: 1 state: stopped - when: inventory_hostname in groups['haproxy'] + when: + - inventory_hostname in groups['haproxy'] + - enable_keystone | bool - name: Checking free port for Keystone Public wait_for: @@ -253,7 +365,9 @@ port: "{{ keystone_public_port }}" connect_timeout: 1 state: stopped - when: inventory_hostname in groups['keystone'] + when: + - inventory_hostname in groups['keystone'] + - enable_keystone | bool - name: Checking free port for Keystone Public HAProxy wait_for: @@ -261,7 +375,9 @@ port: "{{ keystone_public_port }}" connect_timeout: 1 state: stopped - when: inventory_hostname in groups['haproxy'] + when: + - inventory_hostname in groups['haproxy'] + - enable_keystone | bool - name: Checking free port for iscsi wait_for: @@ -269,7 +385,29 @@ port: "{{ iscsi_port }}" connect_timeout: 1 state: stopped - when: inventory_hostname in groups['tgtd'] + when: + - inventory_hostname in groups['tgtd'] + - enable_iscsid | bool + +- name: Checking free port for Magnum API + wait_for: + host: "{{ hostvars[inventory_hostname]['ansible_' + api_interface]['ipv4']['address'] }}" + port: "{{ magnum_api_port }}" + connect_timeout: 1 + state: stopped + when: + - inventory_hostname in groups['magnum-api'] + - enable_magnum | bool + +- name: Checking free port for Magnum API HAProxy + wait_for: + host: "{{ kolla_internal_vip_address }}" + port: "{{ magnum_api_port }}" + connect_timeout: 1 + state: stopped + when: + - inventory_hostname in groups['haproxy'] + - enable_magnum | bool - name: Checking free port for MariaDB wait_for: @@ -277,7 +415,9 @@ port: "{{ database_port }}" connect_timeout: 1 state: stopped - when: inventory_hostname in groups['mariadb'] + when: + - inventory_hostname in groups['mariadb'] + - enable_mariadb | bool - name: Checking free port for MariaDB HAProxy wait_for: @@ -285,7 +425,9 @@ port: "{{ database_port }}" connect_timeout: 1 state: stopped - when: inventory_hostname in groups['haproxy'] + when: + - inventory_hostname in groups['haproxy'] + - enable_mariadb | bool - name: Checking free port for MariaDB WSREP wait_for: @@ -293,7 +435,9 @@ port: "{{ mariadb_wsrep_port }}" connect_timeout: 1 state: stopped - when: inventory_hostname in groups['mariadb'] + when: + - inventory_hostname in groups['mariadb'] + - enable_mariadb | bool - name: Checking free port for MariaDB IST wait_for: @@ -301,7 +445,9 @@ port: "{{ mariadb_ist_port }}" connect_timeout: 1 state: stopped - when: inventory_hostname in groups['mariadb'] + when: + - inventory_hostname in groups['mariadb'] + - enable_mariadb | bool - name: Checking free port for MariaDB SST wait_for: @@ -309,7 +455,9 @@ port: "{{ mariadb_sst_port }}" connect_timeout: 1 state: stopped - when: inventory_hostname in groups['mariadb'] + when: + - inventory_hostname in groups['mariadb'] + - enable_mariadb | bool - name: Checking free port for Manila API wait_for: @@ -317,7 +465,9 @@ port: "{{ manila_api_port }}" connect_timeout: 1 state: stopped - when: inventory_hostname in groups['manila-api'] + when: + - inventory_hostname in groups['manila-api'] + - enable_manila | bool - name: Checking free port for Manila API HAProxy wait_for: @@ -325,7 +475,9 @@ port: "{{ manila_api_port }}" connect_timeout: 1 state: stopped - when: inventory_hostname in groups['haproxy'] + when: + - inventory_hostname in groups['haproxy'] + - enable_manila | bool - name: Checking free port for Memcached wait_for: @@ -333,7 +485,9 @@ port: "{{ memcached_port }}" connect_timeout: 1 state: stopped - when: inventory_hostname in groups['memcached'] + when: + - inventory_hostname in groups['memcached'] + - enable_memcached | bool - name: Checking free port for Murano API wait_for: @@ -341,7 +495,9 @@ port: "{{ murano_api_port }}" connect_timeout: 1 state: stopped - when: inventory_hostname in groups['murano-api'] + when: + - inventory_hostname in groups['murano-api'] + - enable_murano | bool - name: Checking free port for Murano API HAProxy wait_for: @@ -349,7 +505,9 @@ port: "{{ murano_api_port }}" connect_timeout: 1 state: stopped - when: inventory_hostname in groups['haproxy'] + when: + - inventory_hostname in groups['haproxy'] + - enable_murano | bool - name: Checking free port for Neutron Server wait_for: @@ -357,7 +515,9 @@ port: "{{ neutron_server_port }}" connect_timeout: 1 state: stopped - when: inventory_hostname in groups['neutron-server'] + when: + - inventory_hostname in groups['neutron-server'] + - enable_neutron | bool - name: Checking free port for Neutron Server HAProxy wait_for: @@ -365,7 +525,9 @@ port: "{{ neutron_server_port }}" connect_timeout: 1 state: stopped - when: inventory_hostname in groups['haproxy'] + when: + - inventory_hostname in groups['haproxy'] + - enable_neutron | bool - name: Checking free port for Nova API wait_for: @@ -373,7 +535,9 @@ port: "{{ nova_api_port }}" connect_timeout: 1 state: stopped - when: inventory_hostname in groups['nova-api'] + when: + - inventory_hostname in groups['nova-api'] + - enable_nova | bool - name: Checking free port for Nova API HAProxy wait_for: @@ -381,7 +545,9 @@ port: "{{ nova_api_port }}" connect_timeout: 1 state: stopped - when: inventory_hostname in groups['haproxy'] + when: + - inventory_hostname in groups['haproxy'] + - enable_nova | bool - name: Checking free port for Nova Metadata wait_for: @@ -389,7 +555,9 @@ port: "{{ nova_metadata_port }}" connect_timeout: 1 state: stopped - when: inventory_hostname in groups['nova-api'] + when: + - inventory_hostname in groups['nova-api'] + - enable_nova | bool - name: Checking free port for Nova Metadata HAProxy wait_for: @@ -397,7 +565,9 @@ port: "{{ nova_metadata_port }}" connect_timeout: 1 state: stopped - when: inventory_hostname in groups['haproxy'] + when: + - inventory_hostname in groups['haproxy'] + - enable_nova | bool - name: Checking free port for Nova NoVNC Proxy wait_for: @@ -405,7 +575,10 @@ port: "{{ nova_novncproxy_port }}" connect_timeout: 1 state: stopped - when: inventory_hostname in groups['nova-novncproxy'] + when: + - inventory_hostname in groups['nova-novncproxy'] + - enable_nova | bool + - nova_console == 'novnc' - name: Checking free port for Nova NoVNC HAProxy wait_for: @@ -413,7 +586,10 @@ port: "{{ nova_novncproxy_port }}" connect_timeout: 1 state: stopped - when: inventory_hostname in groups['haproxy'] + when: + - inventory_hostname in groups['haproxy'] + - enable_nova | bool + - nova_console == 'novnc' - name: Checking free port for Nova Spice HTML5 Proxy wait_for: @@ -421,7 +597,10 @@ port: "{{ nova_spicehtml5proxy_port }}" connect_timeout: 1 state: stopped - when: inventory_hostname in groups['nova-spicehtml5proxy'] + when: + - inventory_hostname in groups['nova-spicehtml5proxy'] + - enable_nova | bool + - nova_console == 'spice' - name: Checking free port for Nova Spice HTML5 HAProxy wait_for: @@ -429,7 +608,10 @@ port: "{{ nova_spicehtml5proxy_port }}" connect_timeout: 1 state: stopped - when: inventory_hostname in groups['haproxy'] + when: + - inventory_hostname in groups['haproxy'] + - enable_nova | bool + - nova_console == 'spice' - name: Checking free port for RabbitMQ wait_for: @@ -437,7 +619,9 @@ port: "{{ rabbitmq_port }}" connect_timeout: 1 state: stopped - when: inventory_hostname in groups['rabbitmq'] + when: + - inventory_hostname in groups['rabbitmq'] + - enable_rabbitmq | bool - name: Checking free port for RabbitMQ Management wait_for: @@ -445,7 +629,9 @@ port: "{{ rabbitmq_management_port }}" connect_timeout: 1 state: stopped - when: inventory_hostname in groups['rabbitmq'] + when: + - inventory_hostname in groups['rabbitmq'] + - enable_rabbitmq | bool - name: Checking free port for RabbitMQ Management HAProxy wait_for: @@ -453,7 +639,9 @@ port: "{{ rabbitmq_management_port }}" connect_timeout: 1 state: stopped - when: inventory_hostname in groups['haproxy'] + when: + - inventory_hostname in groups['haproxy'] + - enable_rabbitmq | bool - name: Checking free port for RabbitMQ Cluster wait_for: @@ -461,7 +649,9 @@ port: "{{ rabbitmq_cluster_port }}" connect_timeout: 1 state: stopped - when: inventory_hostname in groups['rabbitmq'] + when: + - inventory_hostname in groups['rabbitmq'] + - enable_rabbitmq | bool - name: Checking free port for RabbitMQ EPMD wait_for: @@ -469,17 +659,22 @@ port: "{{ rabbitmq_epmd_port }}" connect_timeout: 1 state: stopped - when: inventory_hostname in groups['rabbitmq'] + when: + - inventory_hostname in groups['rabbitmq'] + - enable_rabbitmq | bool - name: Check if all rabbit hostnames are resolvable command: "getent ahostsv4 {{ hostvars[item]['ansible_hostname'] }}" changed_when: false register: rabbitmq_hostnames with_items: "{{ groups['rabbitmq'] }}" + when: enable_rabbitmq | bool - fail: msg="Hostname has to resolve to IP address of api_interface" with_items: "{{ rabbitmq_hostnames.results }}" - when: "'{{ hostvars[item['item']]['ansible_' + hostvars[item['item']]['api_interface']]['ipv4']['address'] }}' not in '{{ item.stdout }}'" + when: + - "'{{ hostvars[item['item']]['ansible_' + hostvars[item['item']]['api_interface']]['ipv4']['address'] }}' not in '{{ item.stdout }}'" + - enable_rabbitmq | bool - name: Checking free port for Mongodb wait_for: @@ -487,7 +682,9 @@ port: "{{ mongodb_port }}" connect_timeout: 1 state: stopped - when: inventory_hostname in groups['mongodb'] + when: + - inventory_hostname in groups['mongodb'] + - enable_mongodb | bool - name: Checking free port for Mongodb Web wait_for: @@ -495,7 +692,9 @@ port: "{{ mongodb_web_port }}" connect_timeout: 1 state: stopped - when: inventory_hostname in groups['mongodb'] + when: + - inventory_hostname in groups['mongodb'] + - enable_mongodb | bool - name: Checking free port for Mongodb HAProxy wait_for: @@ -503,7 +702,19 @@ port: "{{ mongodb_port }}" connect_timeout: 1 state: stopped - when: inventory_hostname in groups['haproxy'] + when: + - inventory_hostname in groups['haproxy'] + - enable_mongodb | bool + +- name: Checking free port for Kibana Server + wait_for: + host: "{{ hostvars[inventory_hostname]['ansible_' + storage_interface]['ipv4']['address'] }}" + port: "{{ kibana_server_port }}" + connect_timeout: 1 + state: stopped + when: + - inventory_hostname in groups['kibana'] + - enable_kibana | bool - name: Checking free port for Rsync wait_for: @@ -511,7 +722,9 @@ port: "873" connect_timeout: 1 state: stopped - when: inventory_hostname in groups['swift-object-server'] + when: + - inventory_hostname in groups['swift-object-server'] + - enable_swift | bool - name: Checking free port for Swift Object Server wait_for: @@ -519,7 +732,9 @@ port: "{{ swift_object_server_port }}" connect_timeout: 1 state: stopped - when: inventory_hostname in groups['swift-object-server'] + when: + - inventory_hostname in groups['swift-object-server'] + - enable_swift | bool - name: Checking free port for Swift Account Server wait_for: @@ -527,7 +742,9 @@ port: "{{ swift_account_server_port }}" connect_timeout: 1 state: stopped - when: inventory_hostname in groups['swift-account-server'] + when: + - inventory_hostname in groups['swift-account-server'] + - enable_swift | bool - name: Checking free port for Swift Container Server wait_for: @@ -535,7 +752,9 @@ port: "{{ swift_container_server_port }}" connect_timeout: 1 state: stopped - when: inventory_hostname in groups['swift-container-server'] + when: + - inventory_hostname in groups['swift-container-server'] + - enable_swift | bool - name: Checking free port for Swift Proxy Server wait_for: @@ -543,7 +762,9 @@ port: "{{ swift_proxy_server_port }}" connect_timeout: 1 state: stopped - when: inventory_hostname in groups['swift-proxy-server'] + when: + - inventory_hostname in groups['swift-proxy-server'] + - enable_swift | bool - name: Checking free port for Swift Proxy Server HAProxy wait_for: @@ -551,7 +772,9 @@ port: "{{ swift_proxy_server_port }}" connect_timeout: 1 state: stopped - when: inventory_hostname in groups['haproxy'] + when: + - inventory_hostname in groups['haproxy'] + - enable_swift | bool - name: Checking free port for RadosGW wait_for: @@ -559,7 +782,9 @@ port: "{{ rgw_port }}" connect_timeout: 1 state: stopped - when: inventory_hostname in groups['ceph-rgw'] + when: + - inventory_hostname in groups['ceph-rgw'] + - enable_ceph_rgw | bool - name: Checking free port for RadosGW HAProxy wait_for: @@ -567,7 +792,29 @@ port: "{{ rgw_port }}" connect_timeout: 1 state: stopped - when: inventory_hostname in groups['haproxy'] + when: + - inventory_hostname in groups['haproxy'] + - enable_ceph_rgw | bool + +- name: Checking free port for Grafana server + wait_for: + host: "{{ hostvars[inventory_hostname]['ansible_' + api_interface]['ipv4']['address'] }}" + port: "{{ grafana_server_port }}" + connect_timeout: 1 + state: stopped + when: + - inventory_hostname in groups['grafana'] + - enable_grafana | bool + +- name: Checking free port for Grafana server HAProxy + wait_for: + host: "{{ kolla_internal_vip_address }}" + port: "{{ grafana_server_port }}" + connect_timeout: 1 + state: stopped + when: + - inventory_hostname in groups['haproxy'] + - enable_grafana | bool - name: Checking free port for Senlin API wait_for: @@ -575,7 +822,9 @@ port: "{{ senlin_api_port }}" connect_timeout: 1 state: stopped - when: inventory_hostname in groups['senlin-api'] + when: + - inventory_hostname in groups['senlin-api'] + - enable_senlin | bool - name: Checking free port for Senlin API HAProxy wait_for: @@ -583,7 +832,9 @@ port: "{{ senlin_api_port }}" connect_timeout: 1 state: stopped - when: inventory_hostname in groups['haproxy'] + when: + - inventory_hostname in groups['haproxy'] + - enable_senlin | bool - name: Checking free port for Mistral API wait_for: @@ -591,7 +842,9 @@ port: "{{ mistral_api_port }}" connect_timeout: 1 state: stopped - when: inventory_hostname in groups['mistral-api'] + when: + - inventory_hostname in groups['mistral-api'] + - enable_mistral | bool - name: Checking free port for Mistral API HAProxy wait_for: @@ -599,25 +852,49 @@ port: "{{ mistral_api_port }}" connect_timeout: 1 state: stopped - when: inventory_hostname in groups['haproxy'] + when: + - inventory_hostname in groups['haproxy'] + - enable_mistral | bool -- name: Checking if kolla_internal_vip_address and kolla_external_vip_address are not pingable from any node - command: ping -c 3 {{ item }} - register: ping_output - changed_when: false - with_items: - - "{{ kolla_internal_vip_address }}" - - "{{ kolla_external_vip_address }}" - failed_when: ping_output.rc != 1 - when: enable_haproxy | bool +- name: Checking free port for Watcher API + wait_for: + host: "{{ hostvars[inventory_hostname]['ansible_' + api_interface]['ipv4']['address'] }}" + port: "{{ watcher_api_port }}" + connect_timeout: 1 + state: stopped + when: + - inventory_hostname in groups['watcher-api'] + - enable_watcher | bool -- name: Checking if kolla_internal_vip_address is in the same network as network_interface on all nodes - command: ip -4 -o addr show dev {{ network_interface }} - register: ip_addr_output - changed_when: false - failed_when: "'169.254.' not in kolla_internal_vip_address and \ - kolla_internal_vip_address | ipaddr(ip_addr_output.stdout.split()[3]) is none" - when: enable_haproxy | bool +- name: Checking free port for Watcher API HAProxy + wait_for: + host: "{{ kolla_internal_vip_address }}" + port: "{{ watcher_api_port }}" + connect_timeout: 1 + state: stopped + when: + - inventory_hostname in groups['haproxy'] + - enable_watcher | bool + +- name: Checking free port for Searchlight API + wait_for: + host: "{{ hostvars[inventory_hostname]['ansible_' + api_interface]['ipv4']['address'] }}" + port: "{{ searchlight_api_port }}" + connect_timeout: 1 + state: stopped + when: + - inventory_hostname in groups['searchlight-api'] + - enable_searchlight | bool + +- name: Checking free port for Searchlight API HAProxy + wait_for: + host: "{{ kolla_internal_vip_address }}" + port: "{{ searchlight_api_port }}" + connect_timeout: 1 + state: stopped + when: + - inventory_hostname in groups['haproxy'] + - enable_searchlight | bool - name: Checking the network_interface is present fail: "msg='Please check the network_interface property - interface {{ network_interface }} not found'" @@ -634,3 +911,21 @@ - name: Checking the network_interface ip address configuration fail: "msg='Please check the network_interface settings - interface {{ network_interface }} ip address problem'" when: hostvars[inventory_hostname]['ansible_' + network_interface]['ipv4']['address'] is not defined + +- name: Checking if kolla_internal_vip_address and kolla_external_vip_address are not pingable from any node + command: ping -c 3 {{ item }} + register: ping_output + changed_when: false + with_items: + - "{{ kolla_internal_vip_address }}" + - "{{ kolla_external_vip_address }}" + failed_when: ping_output.rc != 1 + when: enable_haproxy | bool + +- name: Checking if kolla_internal_vip_address is in the same network as network_interface on all nodes + command: ip -4 -o addr show dev {{ network_interface }} + register: ip_addr_output + changed_when: false + failed_when: "'169.254.' not in kolla_internal_vip_address and \ + kolla_internal_vip_address | ipaddr(ip_addr_output.stdout.split()[3]) is none" + when: enable_haproxy | bool diff --git a/ansible/roles/prechecks/tasks/precheck.yml b/ansible/roles/prechecks/tasks/precheck.yml new file mode 100644 index 000000000..ed97d539c --- /dev/null +++ b/ansible/roles/prechecks/tasks/precheck.yml @@ -0,0 +1 @@ +--- diff --git a/ansible/roles/rabbitmq/tasks/precheck.yml b/ansible/roles/rabbitmq/tasks/precheck.yml new file mode 100644 index 000000000..ed97d539c --- /dev/null +++ b/ansible/roles/rabbitmq/tasks/precheck.yml @@ -0,0 +1 @@ +--- diff --git a/ansible/roles/rally/tasks/bootstrap_service.yml b/ansible/roles/rally/tasks/bootstrap_service.yml index 6d5f1f086..47a7c8f7f 100644 --- a/ansible/roles/rally/tasks/bootstrap_service.yml +++ b/ansible/roles/rally/tasks/bootstrap_service.yml @@ -17,4 +17,4 @@ - "/etc/localtime:/etc/localtime:ro" - "kolla_logs:/var/log/kolla/" run_once: True - delegate_to: "{{ groups['rally'][0] }}"
\ No newline at end of file + delegate_to: "{{ groups['rally'][0] }}" diff --git a/ansible/roles/rally/tasks/config.yml b/ansible/roles/rally/tasks/config.yml index c210dc338..3304915de 100644 --- a/ansible/roles/rally/tasks/config.yml +++ b/ansible/roles/rally/tasks/config.yml @@ -24,3 +24,14 @@ dest: "{{ node_config_directory }}/{{ item }}/rally.conf" with_items: - "rally" + +- name: Check if policies shall be overwritten + local_action: stat path="{{ node_custom_config }}/rally/policy.json" + register: rally_policy + +- name: Copying over existing policy.json + template: + src: "{{ node_custom_config }}/rally/policy.json" + dest: "{{ node_config_directory }}/rally/policy.json" + when: + rally_policy.stat.exists diff --git a/ansible/roles/rally/tasks/precheck.yml b/ansible/roles/rally/tasks/precheck.yml new file mode 100644 index 000000000..ed97d539c --- /dev/null +++ b/ansible/roles/rally/tasks/precheck.yml @@ -0,0 +1 @@ +--- diff --git a/ansible/roles/rally/templates/rally.json.j2 b/ansible/roles/rally/templates/rally.json.j2 index 3c656054d..3db0d8810 100644 --- a/ansible/roles/rally/templates/rally.json.j2 +++ b/ansible/roles/rally/templates/rally.json.j2 @@ -7,5 +7,12 @@ "owner": "rally", "perm": "0600" } + ], + "permissions": [ + { + "path": "/var/log/kolla/rally", + "owner": "rally:rally", + "recurse": true + } ] } diff --git a/ansible/roles/sahara/tasks/config.yml b/ansible/roles/sahara/tasks/config.yml index b3a3405cc..a83df50ca 100644 --- a/ansible/roles/sahara/tasks/config.yml +++ b/ansible/roles/sahara/tasks/config.yml @@ -32,3 +32,14 @@ with_items: - "sahara-api" - "sahara-engine" + +- name: Check if policies shall be overwritten + local_action: stat path="{{ node_custom_config }}/sahara/policy.json" + register: sahara_policy + +- name: Copying over existing policy.json + template: + src: "{{ node_custom_config }}/sahara/policy.json" + dest: "{{ node_config_directory }}/sahara/policy.json" + when: + sahara_policy.stat.exists diff --git a/ansible/roles/sahara/tasks/precheck.yml b/ansible/roles/sahara/tasks/precheck.yml new file mode 100644 index 000000000..ed97d539c --- /dev/null +++ b/ansible/roles/sahara/tasks/precheck.yml @@ -0,0 +1 @@ +--- diff --git a/ansible/roles/sahara/templates/sahara-api.json.j2 b/ansible/roles/sahara/templates/sahara-api.json.j2 index 73a0c983d..33e45f49e 100644 --- a/ansible/roles/sahara/templates/sahara-api.json.j2 +++ b/ansible/roles/sahara/templates/sahara-api.json.j2 @@ -7,5 +7,17 @@ "owner": "sahara", "perm": "0600" } + ], + "permissions": [ + { + "path": "/var/lib/sahara", + "owner": "sahara:sahara", + "recurse": true + }, + { + "path": "/var/log/kolla/sahara", + "owner": "sahara:sahara", + "recurse": true + } ] } diff --git a/ansible/roles/sahara/templates/sahara-engine.json.j2 b/ansible/roles/sahara/templates/sahara-engine.json.j2 index f7ac43e1c..f677b503d 100644 --- a/ansible/roles/sahara/templates/sahara-engine.json.j2 +++ b/ansible/roles/sahara/templates/sahara-engine.json.j2 @@ -7,5 +7,17 @@ "owner": "sahara", "perm": "0600" } + ], + "permissions": [ + { + "path": "/var/lib/sahara", + "owner": "sahara:sahara", + "recurse": true + }, + { + "path": "/var/log/kolla/sahara", + "owner": "sahara:sahara", + "recurse": true + } ] } diff --git a/ansible/roles/searchlight/defaults/main.yml b/ansible/roles/searchlight/defaults/main.yml new file mode 100644 index 000000000..303094363 --- /dev/null +++ b/ansible/roles/searchlight/defaults/main.yml @@ -0,0 +1,32 @@ +--- +project_name: "searchlight" + +#################### +# Elasticsearch +#################### +searchlight_elasticsearch_url: "{{ kolla_internal_fqdn }}:{{ elasticsearch_port }}" + +#################### +# Docker +#################### +searchlight_listener_image: "{{ docker_registry ~ '/' if docker_registry else '' }}{{ docker_namespace }}/{{ kolla_base_distro }}-{{ kolla_install_type }}-searchlight-listener" +searchlight_listener_tag: "{{ openstack_release }}" +searchlight_listener_image_full: "{{ searchlight_listener_image }}:{{ searchlight_listener_tag }}" + +searchlight_api_image: "{{ docker_registry ~ '/' if docker_registry else '' }}{{ docker_namespace }}/{{ kolla_base_distro }}-{{ kolla_install_type }}-searchlight-api" +searchlight_api_tag: "{{ openstack_release }}" +searchlight_api_image_full: "{{ searchlight_api_image }}:{{ searchlight_api_tag }}" + + +#################### +# OpenStack +#################### +searchlight_admin_endpoint: "{{ admin_protocol }}://{{ kolla_internal_fqdn }}:{{ searchlight_api_port }}" +searchlight_internal_endpoint: "{{ internal_protocol }}://{{ kolla_internal_fqdn }}:{{ searchlight_api_port }}" +searchlight_public_endpoint: "{{ public_protocol }}://{{ kolla_external_fqdn }}:{{ searchlight_api_port }}" + +searchlight_logging_debug: "{{ openstack_logging_debug }}" + +searchlight_keystone_user: "searchlight" + +openstack_searchlight_auth: "{'auth_url':'{{ openstack_auth.auth_url }}','username':'{{ openstack_auth.username }}','password':'{{ openstack_auth.password }}','project_name':'{{ openstack_auth.project_name }}'}" diff --git a/ansible/roles/searchlight/meta/main.yml b/ansible/roles/searchlight/meta/main.yml new file mode 100644 index 000000000..6b4fff8fe --- /dev/null +++ b/ansible/roles/searchlight/meta/main.yml @@ -0,0 +1,3 @@ +--- +dependencies: + - { role: common } diff --git a/ansible/roles/searchlight/tasks/bootstrap.yml b/ansible/roles/searchlight/tasks/bootstrap.yml new file mode 100644 index 000000000..a537e12f7 --- /dev/null +++ b/ansible/roles/searchlight/tasks/bootstrap.yml @@ -0,0 +1,2 @@ +--- +- include: bootstrap_service.yml diff --git a/ansible/roles/searchlight/tasks/bootstrap_service.yml b/ansible/roles/searchlight/tasks/bootstrap_service.yml new file mode 100644 index 000000000..7f114924b --- /dev/null +++ b/ansible/roles/searchlight/tasks/bootstrap_service.yml @@ -0,0 +1,20 @@ +--- +- name: Running Searchlight bootstrap container + kolla_docker: + action: "start_container" + common_options: "{{ docker_common_options }}" + detach: False + environment: + KOLLA_BOOTSTRAP: + KOLLA_CONFIG_STRATEGY: "{{ config_strategy }}" + image: "{{ searchlight_api_image_full }}" + labels: + BOOTSTRAP: + name: "bootstrap_searchlight" + restart_policy: "never" + volumes: + - "{{ node_config_directory }}/searchlight-api/:{{ container_config_directory }}/:ro" + - "/etc/localtime:/etc/localtime:ro" + - "kolla_logs:/var/log/kolla/" + run_once: True + delegate_to: "{{ groups['searchlight-api'][0] }}" diff --git a/ansible/roles/searchlight/tasks/config.yml b/ansible/roles/searchlight/tasks/config.yml new file mode 100644 index 000000000..4237b6bdd --- /dev/null +++ b/ansible/roles/searchlight/tasks/config.yml @@ -0,0 +1,43 @@ +--- +- name: Ensuring config directories exist + file: + path: "{{ node_config_directory }}/{{ item }}" + state: "directory" + recurse: yes + with_items: + - "searchlight-api" + - "searchlight-listener" + +- name: Copying over config.json files for services + template: + src: "{{ item }}.json.j2" + dest: "{{ node_config_directory }}/{{ item }}/config.json" + with_items: + - "searchlight-api" + - "searchlight-listener" + +- name: Copying over searchlight.conf + merge_configs: + vars: + service_name: "{{ item }}" + sources: + - "{{ role_path }}/templates/searchlight.conf.j2" + - "{{ node_custom_config }}/global.conf" + - "{{ node_custom_config }}/messaging.conf" + - "{{ node_custom_config }}/searchlight.conf" + - "{{ node_custom_config }}/searchlight/{{ inventory_hostname }}/searchlight.conf" + dest: "{{ node_config_directory }}/{{ item }}/searchlight.conf" + with_items: + - "searchlight-api" + - "searchlight-listener" + +- name: Check if policies shall be overwritten + local_action: stat path="{{ node_custom_config }}/searchlight/policy.json" + register: searchlight_policy + +- name: Copying over existing policy.json + template: + src: "{{ node_custom_config }}/searchlight/policy.json" + dest: "{{ node_config_directory }}/searchlight/policy.json" + when: + searchlight_policy.stat.exists diff --git a/ansible/roles/searchlight/tasks/deploy.yml b/ansible/roles/searchlight/tasks/deploy.yml new file mode 100644 index 000000000..ea73ba9f3 --- /dev/null +++ b/ansible/roles/searchlight/tasks/deploy.yml @@ -0,0 +1,12 @@ +--- +- include: register.yml + when: inventory_hostname in groups['searchlight'] + +- include: config.yml + when: inventory_hostname in groups['searchlight'] + +- include: bootstrap.yml + when: inventory_hostname in groups['searchlight'] + +- include: start.yml + when: inventory_hostname in groups['searchlight'] diff --git a/ansible/roles/searchlight/tasks/main.yml b/ansible/roles/searchlight/tasks/main.yml new file mode 100644 index 000000000..b017e8b4a --- /dev/null +++ b/ansible/roles/searchlight/tasks/main.yml @@ -0,0 +1,2 @@ +--- +- include: "{{ action }}.yml" diff --git a/ansible/roles/searchlight/tasks/precheck.yml b/ansible/roles/searchlight/tasks/precheck.yml new file mode 100644 index 000000000..ed97d539c --- /dev/null +++ b/ansible/roles/searchlight/tasks/precheck.yml @@ -0,0 +1 @@ +--- diff --git a/ansible/roles/searchlight/tasks/pull.yml b/ansible/roles/searchlight/tasks/pull.yml new file mode 100644 index 000000000..738965381 --- /dev/null +++ b/ansible/roles/searchlight/tasks/pull.yml @@ -0,0 +1,14 @@ +--- +- name: Pulling searchlight-api image + kolla_docker: + action: "pull_image" + common_options: "{{ docker_common_options }}" + image: "{{ searchlight_api_image_full }}" + when: inventory_hostname in groups['searchlight-api'] + +- name: Pulling searchlight-listener image + kolla_docker: + action: "pull_image" + common_options: "{{ docker_common_options }}" + image: "{{ searchlight_listener_image_full }}" + when: inventory_hostname in groups['searchlight-listener'] diff --git a/ansible/roles/searchlight/tasks/reconfigure.yml b/ansible/roles/searchlight/tasks/reconfigure.yml new file mode 100644 index 000000000..c1a1403fc --- /dev/null +++ b/ansible/roles/searchlight/tasks/reconfigure.yml @@ -0,0 +1,66 @@ +--- +- name: Ensuring the containers up + kolla_docker: + name: "{{ item.name }}" + action: "get_container_state" + register: container_state + failed_when: container_state.Running == false + when: inventory_hostname in groups[item.group] + with_items: + - { name: searchlight_api, group: searchlight-api } + - { name: searchlight_listener, group: searchlight-listener } + +- include: config.yml + +- name: Check the configs + command: docker exec {{ item.name }} /usr/local/bin/kolla_set_configs --check + changed_when: false + failed_when: false + register: check_results + when: inventory_hostname in groups[item.group] + with_items: + - { name: searchlight_api, group: searchlight-api } + - { name: searchlight_listener, group: searchlight-listener } + +- name: Containers config strategy + kolla_docker: + name: "{{ item.name }}" + action: "get_container_env" + register: container_envs + when: inventory_hostname in groups[item.group] + with_items: + - { name: searchlight_api, group: searchlight-api } + - { name: searchlight_listener, group: searchlight-listener } + +- name: Remove the containers + kolla_docker: + name: "{{ item[0]['name'] }}" + action: "remove_container" + register: remove_containers + when: + - config_strategy == "COPY_ONCE" or item[1]['KOLLA_CONFIG_STRATEGY'] == 'COPY_ONCE' + - item[2]['rc'] == 1 + - inventory_hostname in groups[item[0]['group']] + with_together: + - [{ name: searchlight_api, group: searchlight-api }, + { name: searchlight_listener, group: searchlight-listener }] + - "{{ container_envs.results }}" + - "{{ check_results.results }}" + +- include: start.yml + when: remove_containers.changed + +- name: Restart containers + kolla_docker: + name: "{{ item[0]['name'] }}" + action: "restart_container" + when: + - config_strategy == 'COPY_ALWAYS' + - item[1]['KOLLA_CONFIG_STRATEGY'] != 'COPY_ONCE' + - item[2]['rc'] == 1 + - inventory_hostname in groups[item[0]['group']] + with_together: + - [{ name: searchlight_api, group: searchlight-api }, + { name: searchlight_listener, group: searchlight-listener }] + - "{{ container_envs.results }}" + - "{{ check_results.results }}" diff --git a/ansible/roles/searchlight/tasks/register.yml b/ansible/roles/searchlight/tasks/register.yml new file mode 100644 index 000000000..4724e7b96 --- /dev/null +++ b/ansible/roles/searchlight/tasks/register.yml @@ -0,0 +1,40 @@ +--- +- name: Creating the Searchlight service and endpoint + command: docker exec -t kolla_toolbox /usr/bin/ansible localhost + -m kolla_keystone_service + -a "service_name=searchlight + service_type=search + description='Openstack Index Service' + endpoint_region={{ openstack_region_name }} + url='{{ item.url }}' + interface='{{ item.interface }}' + region_name={{ openstack_region_name }} + auth={{ '{{ openstack_searchlight_auth }}' }}" + -e "{'openstack_searchlight_auth':{{ openstack_searchlight_auth }}}" + register: searchlight_endpoint + changed_when: "{{ searchlight_endpoint.stdout.find('localhost | SUCCESS => ') != -1 and (searchlight_endpoint.stdout.split('localhost | SUCCESS => ')[1]|from_json).changed }}" + until: searchlight_endpoint.stdout.split()[2] == 'SUCCESS' + retries: 10 + delay: 5 + run_once: True + with_items: + - {'interface': 'admin', 'url': '{{ searchlight_admin_endpoint }}'} + - {'interface': 'internal', 'url': '{{ searchlight_internal_endpoint }}'} + - {'interface': 'public', 'url': '{{ searchlight_public_endpoint }}'} + +- name: Creating the Searchlight project, user, and role + command: docker exec -t kolla_toolbox /usr/bin/ansible localhost + -m kolla_keystone_user + -a "project=service + user=searchlight + password={{ searchlight_keystone_password }} + role=admin + region_name={{ openstack_region_name }} + auth={{ '{{ openstack_searchlight_auth }}' }}" + -e "{'openstack_searchlight_auth':{{ openstack_searchlight_auth }}}" + register: searchlight_user + changed_when: "{{ searchlight_user.stdout.find('localhost | SUCCESS => ') != -1 and (searchlight_user.stdout.split('localhost | SUCCESS => ')[1]|from_json).changed }}" + until: searchlight_user.stdout.split()[2] == 'SUCCESS' + retries: 10 + delay: 5 + run_once: True diff --git a/ansible/roles/searchlight/tasks/start.yml b/ansible/roles/searchlight/tasks/start.yml new file mode 100644 index 000000000..f97e789d0 --- /dev/null +++ b/ansible/roles/searchlight/tasks/start.yml @@ -0,0 +1,24 @@ +--- +- name: Starting searchlight-api container + kolla_docker: + action: "start_container" + common_options: "{{ docker_common_options }}" + image: "{{ searchlight_api_image_full }}" + name: "searchlight_api" + volumes: + - "{{ node_config_directory }}/searchlight-api/:{{ container_config_directory }}/:ro" + - "/etc/localtime:/etc/localtime:ro" + - "kolla_logs:/var/log/kolla/" + when: inventory_hostname in groups['searchlight-api'] + +- name: Starting searchlight-listener container + kolla_docker: + action: "start_container" + common_options: "{{ docker_common_options }}" + image: "{{ searchlight_listener_image_full }}" + name: "searchlight_listener" + volumes: + - "{{ node_config_directory }}/searchlight-listener/:{{ container_config_directory }}/:ro" + - "/etc/localtime:/etc/localtime:ro" + - "kolla_logs:/var/log/kolla/" + when: inventory_hostname in groups['searchlight-listener'] diff --git a/ansible/roles/searchlight/tasks/upgrade.yml b/ansible/roles/searchlight/tasks/upgrade.yml new file mode 100644 index 000000000..308053080 --- /dev/null +++ b/ansible/roles/searchlight/tasks/upgrade.yml @@ -0,0 +1,6 @@ +--- +- include: config.yml + +- include: bootstrap_service.yml + +- include: start.yml diff --git a/ansible/roles/searchlight/templates/searchlight-api.json.j2 b/ansible/roles/searchlight/templates/searchlight-api.json.j2 new file mode 100644 index 000000000..a003291ba --- /dev/null +++ b/ansible/roles/searchlight/templates/searchlight-api.json.j2 @@ -0,0 +1,18 @@ +{ + "command": "searchlight-api", + "config_files": [ + { + "source": "{{ container_config_directory }}/searchlight.conf", + "dest": "/etc/searchlight/searchlight.conf", + "owner": "searchlight", + "perm": "0600" + } + ], + "permissions": [ + { + "path": "/var/log/kolla/searchlight", + "owner": "searchlight:searchlight", + "recurse": true + } + ] +} diff --git a/ansible/roles/searchlight/templates/searchlight-listener.json.j2 b/ansible/roles/searchlight/templates/searchlight-listener.json.j2 new file mode 100644 index 000000000..5f06a0499 --- /dev/null +++ b/ansible/roles/searchlight/templates/searchlight-listener.json.j2 @@ -0,0 +1,18 @@ +{ + "command": "searchlight-listener", + "config_files": [ + { + "source": "{{ container_config_directory }}/searchlight.conf", + "dest": "/etc/searchlight/searchlight.conf", + "owner": "searchlight", + "perm": "0600" + } + ], + "permissions": [ + { + "path": "/var/log/kolla/searchlight", + "owner": "searchlight:searchlight", + "recurse": true + } + ] +} diff --git a/ansible/roles/searchlight/templates/searchlight.conf.j2 b/ansible/roles/searchlight/templates/searchlight.conf.j2 new file mode 100644 index 000000000..3317fca1f --- /dev/null +++ b/ansible/roles/searchlight/templates/searchlight.conf.j2 @@ -0,0 +1,90 @@ +[DEFAULT] +debug = {{ searchlight_logging_debug }} + +policy_file = /etc/searchlight/policy.json +log_dir = /var/log/kolla/searchlight +transport_url = rabbit://{% for host in groups['rabbitmq'] %}{{ rabbitmq_user }}:{{ rabbitmq_password }}@{% if orchestration_engine == 'KUBERNETES' %}rabbitmq{% else %}{{ hostvars[host]['ansible_' + hostvars[host]['api_interface']]['ipv4']['address'] }}{% endif %}:{{ rabbitmq_port }}{% if not loop.last %},{% endif %}{% endfor %} + + +[api] +port = {{ searchlight_api_port }} +bind_host = {{ hostvars[inventory_hostname]['ansible_' + api_interface]['ipv4']['address'] }} +public_endpoint = {{ public_protocol }}://{{ kolla_external_fqdn }}:{{ searchlight_api_port }} + +[elasticsearch] +hosts = {{ searchlight_elasticsearch_url }} + +[listener] +workers = {{ openstack_service_workers }} +notifications_pool = searchlight-listener + +[paste_deploy] +flavor = keystone + +[keystone_authtoken] +auth_uri = {{ internal_protocol }}://{{ kolla_internal_fqdn }}:{{ keystone_public_port }} +auth_url = {{ admin_protocol }}://{{ kolla_internal_fqdn }}:{{ keystone_admin_port }} +project_domain_name = default +project_name = service +user_domain_name = default +username = {{ searchlight_keystone_user }} +password = {{ searchlight_keystone_password }} +auth_type = password + +memcache_security_strategy = ENCRYPT +memcache_secret_key = {{ memcache_secret_key }} +memcached_servers = {% for host in groups['memcached'] %}{% if orchestration_engine == 'KUBERNETES' %}memcached{% else %}{{ hostvars[host]['ansible_' + hostvars[host]['api_interface']]['ipv4']['address'] }}{% endif %}:{{ memcached_port }}{% if not loop.last %},{% endif %}{% endfor %} + +[service_credentials] +auth_uri = {{ internal_protocol }}://{{ kolla_internal_fqdn }}:{{ keystone_public_port }} +auth_url = {{ admin_protocol }}://{{ kolla_internal_fqdn }}:{{ keystone_admin_port }} +region_name = {{ openstack_region_name }} +project_domain_name = default +project_name = service +user_domain_name = default +username = {{ searchlight_keystone_user }} +password = {{ searchlight_keystone_password }} +auth_type = password +auth_plugin = password + +memcache_security_strategy = ENCRYPT +memcache_secret_key = {{ memcache_secret_key }} +memcached_servers = {% for host in groups['memcached'] %}{% if orchestration_engine == 'KUBERNETES' %}memcached{% else %}{{ hostvars[host]['ansible_' + hostvars[host]['api_interface']]['ipv4']['address'] }}{% endif %}:{{ memcached_port }}{% if not loop.last %},{% endif %}{% endfor %} + +[resource_plugin:os_designate_zone] +enabled = False + +[resource_plugin:os_designate_recordset] +enabled = False + +{% if not enable_swift | bool %} +[resource_plugin:os_swift_account] +enabled = False + +[resource_plugin:os_swift_container] +enabled = False + +[resource_plugin:os_swift_object] +enabled = False +{% endif %} + +{% if not enable_nova | bool %} +[resource_plugin:os_server_nova] +enabled = False +{% endif %} + +{% if not enable_glance | bool %} +[resource_plugin:os_glance_image] +enabled = False + +[resource_plugin:os_glance_metadef] +enabled = False +{% endif %} + +{% if not enable_neutron | bool %} +[resource_plugin:os_neutron_net] +enabled = False + +[resource_plugin:os_neutron_port] +enabled = False +{% endif %} diff --git a/ansible/roles/senlin/tasks/config.yml b/ansible/roles/senlin/tasks/config.yml index fa714f550..17ff0f83a 100644 --- a/ansible/roles/senlin/tasks/config.yml +++ b/ansible/roles/senlin/tasks/config.yml @@ -32,3 +32,14 @@ with_items: - "senlin-api" - "senlin-engine" + +- name: Check if policies shall be overwritten + local_action: stat path="{{ node_custom_config }}/senlin/policy.json" + register: senlin_policy + +- name: Copying over existing policy.json + template: + src: "{{ node_custom_config }}/senlin/policy.json" + dest: "{{ node_config_directory }}/senlin/policy.json" + when: + senlin_policy.stat.exists diff --git a/ansible/roles/senlin/tasks/precheck.yml b/ansible/roles/senlin/tasks/precheck.yml new file mode 100644 index 000000000..ed97d539c --- /dev/null +++ b/ansible/roles/senlin/tasks/precheck.yml @@ -0,0 +1 @@ +--- diff --git a/ansible/roles/senlin/templates/senlin-api.json.j2 b/ansible/roles/senlin/templates/senlin-api.json.j2 index 7f77a9b91..0e287719b 100644 --- a/ansible/roles/senlin/templates/senlin-api.json.j2 +++ b/ansible/roles/senlin/templates/senlin-api.json.j2 @@ -7,5 +7,12 @@ "owner": "senlin", "perm": "0600" } + ], + "permissions": [ + { + "path": "/var/log/kolla/senlin", + "owner": "senlin:senlin", + "recurse": true + } ] } diff --git a/ansible/roles/senlin/templates/senlin-engine.json.j2 b/ansible/roles/senlin/templates/senlin-engine.json.j2 index de63916f6..bc643475e 100644 --- a/ansible/roles/senlin/templates/senlin-engine.json.j2 +++ b/ansible/roles/senlin/templates/senlin-engine.json.j2 @@ -7,5 +7,12 @@ "owner": "senlin", "perm": "0600" } + ], + "permissions": [ + { + "path": "/var/log/kolla/senlin", + "owner": "senlin:senlin", + "recurse": true + } ] } diff --git a/ansible/roles/swift/defaults/main.yml b/ansible/roles/swift/defaults/main.yml index 7171d8760..e10f8cda9 100644 --- a/ansible/roles/swift/defaults/main.yml +++ b/ansible/roles/swift/defaults/main.yml @@ -20,6 +20,10 @@ swift_object_image: "{{ docker_registry ~ '/' if docker_registry else '' }}{{ do swift_object_tag: "{{ openstack_release }}" swift_object_image_full: "{{ swift_object_image }}:{{ swift_object_tag }}" +swift_object_expirer_image: "{{ docker_registry ~ '/' if docker_registry else '' }}{{ docker_namespace }}/{{ kolla_base_distro }}-{{ kolla_install_type }}-swift-object-expirer" +swift_object_expirer_tag: "{{ openstack_release }}" +swift_object_expirer_image_full: "{{ swift_object_expirer_image }}:{{ swift_object_expirer_tag }}" + swift_rsyncd_image: "{{ docker_registry ~ '/' if docker_registry else '' }}{{ docker_namespace }}/{{ kolla_base_distro }}-{{ kolla_install_type }}-swift-rsyncd" swift_rsyncd_tag: "{{ openstack_release }}" swift_rsyncd_image_full: "{{ swift_rsyncd_image }}:{{ swift_rsyncd_tag }}" diff --git a/ansible/roles/swift/tasks/check.yml b/ansible/roles/swift/tasks/check.yml index 15e438c9d..e655ac0e7 100644 --- a/ansible/roles/swift/tasks/check.yml +++ b/ansible/roles/swift/tasks/check.yml @@ -16,4 +16,4 @@ retries: 10 delay: 5 run_once: True - when: kolla_enable_sanity_swift | bool
\ No newline at end of file + when: kolla_enable_sanity_swift | bool diff --git a/ansible/roles/swift/tasks/config.yml b/ansible/roles/swift/tasks/config.yml index dc04ffaff..10c26de5a 100644 --- a/ansible/roles/swift/tasks/config.yml +++ b/ansible/roles/swift/tasks/config.yml @@ -152,3 +152,14 @@ - "container.ring.gz" - "object.builder" - "object.ring.gz" + +- name: Check if policies shall be overwritten + local_action: stat path="{{ node_custom_config }}/swift/policy.json" + register: swift_policy + +- name: Copying over existing policy.json + template: + src: "{{ node_custom_config }}/swift/policy.json" + dest: "{{ node_config_directory }}/swift/policy.json" + when: + swift_policy.stat.exists diff --git a/ansible/roles/swift/tasks/precheck.yml b/ansible/roles/swift/tasks/precheck.yml new file mode 100644 index 000000000..ed97d539c --- /dev/null +++ b/ansible/roles/swift/tasks/precheck.yml @@ -0,0 +1 @@ +--- diff --git a/ansible/roles/swift/tasks/start.yml b/ansible/roles/swift/tasks/start.yml index 891f92ed7..39b08f174 100644 --- a/ansible/roles/swift/tasks/start.yml +++ b/ansible/roles/swift/tasks/start.yml @@ -218,7 +218,7 @@ kolla_docker: action: "start_container" common_options: "{{ docker_common_options }}" - image: "{{ swift_object_image_full }}" + image: "{{ swift_object_expirer_image_full }}" name: "swift_object_expirer" volumes: - "{{ node_config_directory }}/swift/:/var/lib/kolla/swift/:ro" diff --git a/ansible/roles/swift/templates/object.conf.j2 b/ansible/roles/swift/templates/object.conf.j2 index ae4f08fd5..bd8b25fa9 100644 --- a/ansible/roles/swift/templates/object.conf.j2 +++ b/ansible/roles/swift/templates/object.conf.j2 @@ -23,8 +23,8 @@ use = egg:swift#object [object-auditor] {% endif %} -{% if service_name == 'swift-object-replicator' %} [object-replicator] +{% if service_name == 'swift-object-replicator' %} sync_module = {replication_ip}:{meta}:object {% endif %} diff --git a/ansible/roles/telegraf/tasks/precheck.yml b/ansible/roles/telegraf/tasks/precheck.yml new file mode 100644 index 000000000..ed97d539c --- /dev/null +++ b/ansible/roles/telegraf/tasks/precheck.yml @@ -0,0 +1 @@ +--- diff --git a/ansible/roles/telegraf/tasks/start.yml b/ansible/roles/telegraf/tasks/start.yml index 443b07249..b50cec453 100644 --- a/ansible/roles/telegraf/tasks/start.yml +++ b/ansible/roles/telegraf/tasks/start.yml @@ -15,5 +15,4 @@ - "/sys:/rootfs/sys:ro" - "/proc:/rootfs/proc:ro" - "/var/run/docker.sock:/var/run/docker.sock:ro" - - "haproxy_socket:/var/lib/kolla/haproxy/:rw" pid_mode: "host" diff --git a/ansible/roles/telegraf/templates/telegraf.conf.j2 b/ansible/roles/telegraf/templates/telegraf.conf.j2 index 0788f854d..1f81ad91c 100644 --- a/ansible/roles/telegraf/templates/telegraf.conf.j2 +++ b/ansible/roles/telegraf/templates/telegraf.conf.j2 @@ -17,8 +17,6 @@ retention_policy = "default" write_consistency = "any" timeout = "5s" -[[inputs.filestat]] -files = ["/var/log/kolla/**.log"] [[inputs.cpu]] percpu = true totalcpu = true @@ -33,21 +31,21 @@ files = ["/var/log/kolla/**.log"] [[inputs.system]] [[inputs.net]] interfaces = [] -{% if enable_haproxy | bool %} +{% if inventory_hostname in groups['haproxy'] and enable_haproxy | bool %} [[inputs.haproxy]] servers = ["{{ haproxy_proto }}://{{ haproxy_user }}:{{ haproxy_password }}@{{ hostvars[inventory_hostname]['ansible_' + api_interface]['ipv4']['address'] }}:{{ haproxy_stats_port }}"] {% endif %} -{% if enable_memcached | bool %} +{% if inventory_hostname in groups['memcached'] and enable_memcached | bool %} [[inputs.memcached]] servers = ["{{ hostvars[inventory_hostname]['ansible_' + api_interface]['ipv4']['address'] }}:{{ memcached_port }}"] {% endif %} -{% if enable_elasticsearch | bool %} +{% if inventory_hostname in groups['elasticsearch'] and enable_elasticsearch | bool %} [[inputs.elasticsearch]] servers = ["{{ elasticsearch_proto }}://{{ hostvars[inventory_hostname]['ansible_' + api_interface]['ipv4']['address'] }}:{{ elasticsearch_port }}"] local = true cluster_health = true {% endif %} -{% if inventory_hostname in groups['rabbitmq'] %} +{% if inventory_hostname in groups['rabbitmq'] and enable_rabbitmq | bool %} [[inputs.rabbitmq]] url = "{{ rabbitmq_proto }}://{{ hostvars[inventory_hostname]['ansible_' + api_interface]['ipv4']['address'] }}:{{ rabbitmq_management_port }}" username = "{{ rabbitmq_user }}" diff --git a/ansible/roles/telegraf/templates/telegraf.json.j2 b/ansible/roles/telegraf/templates/telegraf.json.j2 index 324d4efb8..74ed2e928 100644 --- a/ansible/roles/telegraf/templates/telegraf.json.j2 +++ b/ansible/roles/telegraf/templates/telegraf.json.j2 @@ -13,5 +13,12 @@ "owner": "telegraf", "perm": "0600" } + ], + "permissions": [ + { + "path": "/var/log/kolla/telegraf", + "owner": "telegraf:telegraf", + "recurse": true + } ] } diff --git a/ansible/roles/tempest/tasks/config.yml b/ansible/roles/tempest/tasks/config.yml index 3375790f9..6422270d3 100644 --- a/ansible/roles/tempest/tasks/config.yml +++ b/ansible/roles/tempest/tasks/config.yml @@ -24,3 +24,14 @@ dest: "{{ node_config_directory }}/{{ item }}/tempest.conf" with_items: - "tempest" + +- name: Check if policies shall be overwritten + local_action: stat path="{{ node_custom_config }}/tempest/policy.json" + register: tempest_policy + +- name: Copying over existing policy.json + template: + src: "{{ node_custom_config }}/tempest/policy.json" + dest: "{{ node_config_directory }}/tempest/policy.json" + when: + tempest_policy.stat.exists diff --git a/ansible/roles/tempest/tasks/precheck.yml b/ansible/roles/tempest/tasks/precheck.yml new file mode 100644 index 000000000..ed97d539c --- /dev/null +++ b/ansible/roles/tempest/tasks/precheck.yml @@ -0,0 +1 @@ +--- diff --git a/ansible/roles/vmtp/tasks/main.yml b/ansible/roles/vmtp/tasks/main.yml index bef222f6a..b017e8b4a 100644 --- a/ansible/roles/vmtp/tasks/main.yml +++ b/ansible/roles/vmtp/tasks/main.yml @@ -1,2 +1,2 @@ --- -- include: "{{ action }}.yml"
\ No newline at end of file +- include: "{{ action }}.yml" diff --git a/ansible/roles/vmtp/tasks/precheck.yml b/ansible/roles/vmtp/tasks/precheck.yml new file mode 100644 index 000000000..ed97d539c --- /dev/null +++ b/ansible/roles/vmtp/tasks/precheck.yml @@ -0,0 +1 @@ +--- diff --git a/ansible/roles/watcher/tasks/config.yml b/ansible/roles/watcher/tasks/config.yml index 5116c3ebb..9d4ae9f7a 100644 --- a/ansible/roles/watcher/tasks/config.yml +++ b/ansible/roles/watcher/tasks/config.yml @@ -35,3 +35,14 @@ - "watcher-api" - "watcher-engine" - "watcher-applier" + +- name: Check if policies shall be overwritten + local_action: stat path="{{ node_custom_config }}/watcher/policy.json" + register: watcher_policy + +- name: Copying over existing policy.json + template: + src: "{{ node_custom_config }}/watcher/policy.json" + dest: "{{ node_config_directory }}/watcher/policy.json" + when: + watcher_policy.stat.exists diff --git a/ansible/roles/watcher/tasks/precheck.yml b/ansible/roles/watcher/tasks/precheck.yml new file mode 100644 index 000000000..ed97d539c --- /dev/null +++ b/ansible/roles/watcher/tasks/precheck.yml @@ -0,0 +1 @@ +--- diff --git a/ansible/roles/watcher/templates/watcher-api.json.j2 b/ansible/roles/watcher/templates/watcher-api.json.j2 index 6834e719d..422313e77 100644 --- a/ansible/roles/watcher/templates/watcher-api.json.j2 +++ b/ansible/roles/watcher/templates/watcher-api.json.j2 @@ -7,5 +7,12 @@ "owner": "watcher", "perm": "0644" } + ], + "permissions": [ + { + "path": "/var/log/kolla/watcher", + "owner": "watcher:watcher", + "recurse": true + } ] } diff --git a/ansible/roles/watcher/templates/watcher-applier.json.j2 b/ansible/roles/watcher/templates/watcher-applier.json.j2 index f53d8ba81..2fae81a0e 100644 --- a/ansible/roles/watcher/templates/watcher-applier.json.j2 +++ b/ansible/roles/watcher/templates/watcher-applier.json.j2 @@ -7,5 +7,12 @@ "owner": "watcher", "perm": "0644" } + ], + "permissions": [ + { + "path": "/var/log/kolla/watcher", + "owner": "watcher:watcher", + "recurse": true + } ] } diff --git a/ansible/roles/watcher/templates/watcher-engine.json.j2 b/ansible/roles/watcher/templates/watcher-engine.json.j2 index ee8a2aec1..acf60e930 100644 --- a/ansible/roles/watcher/templates/watcher-engine.json.j2 +++ b/ansible/roles/watcher/templates/watcher-engine.json.j2 @@ -7,5 +7,12 @@ "owner": "watcher", "perm": "0644" } + ], + "permissions": [ + { + "path": "/var/log/kolla/watcher", + "owner": "watcher:watcher", + "recurse": true + } ] } diff --git a/ansible/site.yml b/ansible/site.yml index dbe0f757c..49f6f89d1 100644 --- a/ansible/site.yml +++ b/ansible/site.yml @@ -14,6 +14,12 @@ tags: always - hosts: + - all + roles: + - role: prechecks + when: action == "precheck" + +- hosts: - ceph-mon - ceph-osd - ceph-rgw @@ -140,6 +146,17 @@ when: enable_glance | bool } - hosts: + - ironic-api + - ironic-conductor + - ironic-inspector + - ironic-pxe + serial: '{{ serial|default("0") }}' + roles: + - { role: ironic, + tags: ironic, + when: enable_ironic | bool } + +- hosts: - ceph-mon - compute - nova-api @@ -217,17 +234,6 @@ when: enable_murano | bool } - hosts: - - ironic-api - - ironic-conductor - - ironic-inspector - - ironic-pxe - serial: '{{ serial|default("0") }}' - roles: - - { role: ironic, - tags: ironic, - when: enable_ironic | bool } - -- hosts: - magnum-api - magnum-conductor serial: '{{ serial|default("0") }}' @@ -265,6 +271,7 @@ - hosts: - manila-api + - manila-data - manila-share - manila-scheduler serial: '{{ serial|default("0") }}' @@ -378,3 +385,12 @@ - { role: senlin, tags: senlin, when: enable_senlin | bool } + +- hosts: + - searchlight-api + - searchlight-listener + serial: '{{ serial|default("0") }}' + roles: + - { role: searchlight, + tags: searchlight, + when: enable_searchlight | bool } |