aboutsummaryrefslogtreecommitdiff
path: root/ansible/roles/haproxy
AgeCommit message (Collapse)AuthorFilesLines
2016-03-23Merge "Reconfigure for haproxy"Jenkins2-0/+77
2016-03-19Fix 'optional' config.json valuesSamYaple1-1/+1
These values are optional only when the services are not enabled. If the file does not exist we should not warn, but rather inform. Ceph-mon is an exception here since its bootstrap process means the files may or may not exist initially. TrivialFix Change-Id: Ic02bece76d480e99deecf612036f37abb5604135
2016-03-17Reconfigure for haproxyMD NADEEM2-0/+77
Add reconfiguration for haproxy Co-Authored-By: Jeffrey Zhang <jeffrey.zhang@99cloud.net> Closes-Bug: #1553528 Change-Id: Ibe9266dfac8e79c5aa56a17eb908ff12cd81cc05
2016-03-15Move sysctl out of haproxy containerSamYaple1-2/+5
sysctl was improperly set in the contaienr itself which is not correct TrivialFix Change-Id: If2ffca6d2a40e86db4af2f103a27b280bc5fa2ff
2016-03-14Merge "Use nopreempt for keepalived"Jenkins1-2/+4
2016-03-14Use nopreempt for keepalivedSamYaple1-2/+4
Without this option the vip will always bounce to the highest priority node that is up. So if you reboot the highest priority node the vip will fail to the second highest. When the highest priority node recovers it will claim the vip again leaving you will two fail overs rather than one. TrivialFix Change-Id: I4a3c6c10eee391cdbdd80c44a71a9fafd1069944
2016-03-14haproxy formatting was incorrectSamYaple1-2/+4
haproxy 1.6+ does not allow the formatting that was used for stats listener. We need to adjust it to the correct syntax TrivialFix Change-Id: I5f0111c756d40a0cf7385e6963ebbb57adb36b35
2016-03-09Do not make Kibana available at the external VIPÉric Lemoine1-8/+0
Kibana is a tool for operators. It should not be accessible though the external VIP. Closes-Bug: #1554977 Change-Id: I1dc101de18e4e01ebde9d317ab7e3193e307a14e
2016-03-07Glance registry should only be accessible from internal networkDave McCowan1-6/+0
When configured with a separate external VIP, glance registry should listen on only the internal VIP. TrivialFix Change-Id: Ie186f2ea391b53b9ea0cb230c573c9e09efd44b2
2016-03-05Merge "Make Heka send logs to Elasticsearch"Jenkins1-0/+23
2016-03-05Make Heka send logs to ElasticsearchÉric Lemoine1-0/+23
This patch includes changes relative to integrating Heka with Elasticsearch and Kibana. The main change is the addition of an Heka ElasticSearchOutput plugin to make Heka send the logs it collects to Elasticsearch. Since Logstash is not used the enable_elk deploy variable is renamed to enable_central_logging. If enable_central_logging is false then Elasticsearch and Kibana are not started, and Heka won't attempt to send logs to Elasticsearch. By default enable_central_logging is set to false. If enable_central_logging is set to true after deployment then the Heka container needs to be recreated (for Heka to get the new configuration). The Kibana configuration used property names that are deprecated in Kibana 4.2. This is changed to use non-deprecated property names. Previously logs read from files and from Syslog had a different Type in Heka. This is changed to always use "log" for the Type. In this way just one index instead of two is used in Elasticsearch, making things easier to the user on the visualization side. The HAProxy configuration is changed to add entries for Kibana. Kibana server is now accessible via the internal VIP, and also via the external VIP if there's one configured. The HAProxy configuration is changed to add an entry for Elasticsearch. So Elasticsearch is now accessible via the internal VIP. Heka uses that channel for communicating with Elasticsearch. Note that currently the Heka logs include "Plugin elasticsearch_output" errors when Heka starts. This occurs when Heka starts processing logs while Elasticsearch is not yet started. These are transient errors that go away when Elasticsearch is ready. And with buffering enabled on the ElasticSearchOuput plugin logs will be buffered and then retransmitted when Elasticsearch is ready. Change-Id: I6ff7a4f0ad04c4c666e174693a35ff49914280bb Implements: blueprint central-logging-service
2016-03-04Merge "Fix horizon with ssl"Jenkins1-1/+1
2016-03-04Fix horizon with sslSamYaple1-1/+1
Ubuntu did not have mod_headers enabled by default Remove unused variable and adjust 'when' conditional positioning TrivialFix Change-Id: I82b8724526c24f4481a80165520d624f6a02c336
2016-03-04Add authentication for keepalivedJeffrey Zhang1-0/+8
TrivialFix Closes-Bug: #1551314 Change-Id: Id85859500aec283703b6b6714abf213a42286182
2016-03-03Add TLS protection on external API endpointsDave McCowan3-17/+80
TLS can be used to encrypt and authenticate the connection with OpenStack endpoints. This patch provides the necessary parameters and changes the resulting service configurations to enable TLS for the Kolla deployed OpenStack cloud. The new input parameters are: kolla_enable_tls_external: "yes" or "no" (default is "no") kolla_external_fqdn_cert: "/etc/kolla/certificates/haproxy.pem" kolla_external_fqdn_cacert: "/etc/kolla/certificates/haproxy-ca.crt" Implements: blueprint kolla-ssl Change-Id: I48ef8a781c3035d58817f9bf6f36d59a488bab41
2016-02-26Change kolla_internal_address variableSamYaple4-30/+32
Due to poor planning on our variable names we have a situation where we have "internal_address" which must be a VIP, but "external_address" which should be a DNS name. Now with two vips "external_vip_address" is a new variable. This corrects that issue by deprecating kolla_internal_address and replacing it with 4 nicely named variables. kolla_internal_vip_address kolla_internal_fqdn kolla_external_vip_address kolla_external_fqdn The default behaviour will remain the same, and the way the variable inheritance is setup the kolla_internal_address variable can still be set in globals.yml and propogate out to these 4 new variables like it normally would, but all reference to kolla_internal_address has been completely removed. Change-Id: I4556dcdbf4d91a8d2751981ef9c64bad44a719e5 Partially-Implements: blueprint ssl-kolla
2016-02-25Merge "HAProxy and Keepalived upgrade"Jenkins1-0/+18
2016-02-25Merge "Add the default empty reconfigure.yml file to all roles"Jenkins1-0/+1
2016-02-25HAProxy and Keepalived upgradeMichal (inc0) Jastrzebski1-0/+18
This is single task to upgrade both haproxy and keepalived. It stops slave nodes of keepalived and upgrades them separately to avoid VIP migration and allow nearly no-downtime upgrade Change-Id: I06124635a3f3553a4e8e91013cefbf897dd7179f Implements: blueprint upgrade-haproxy Implements: blueprint upgrade-keepalived Partially-implements: blueprint upgrade-kolla
2016-02-25Add the default empty reconfigure.yml file to all rolesJeffrey Zhang1-0/+1
DocImpact Partially-implements: bp kolla-reconfig Change-Id: I9738e80960bcfbef18d1ef1b7942f81c45684e85
2016-02-24Merge "Use passed client IP address in various audit logs"Jenkins1-0/+1
2016-02-24Use passed client IP address in various audit logsDave McCowan1-0/+1
HAProxy: change to use option forwardfor to pass origin IP address to backend via X-Forwarded-For header Keystone: Apache does the audit logs for keystone. Change the LogFormat to display the passed address instead of the connection address which is that of the load balancer. Nova, Cinder, Glance: these services can make use of the address passed in X-Forwarded-For. With this setting the API logs for these services include the client IP address. Change-Id: Ia861ecc11a7c7d463d0366586926d1a842853f69 Closes-Bug: #1548935
2016-02-24Implement Option for Two VIPs to separate API trafficDave McCowan2-2/+152
To improve security, operators have asked for two VIPs for their cloud. VIP 1 is the internal VIP that can reach internal and admin endpoints. In addition, the internal VIP can also reach other internal services, such as the database and message services. VIP 2 is the external VIP that can only reach public endpoints. With one VIP only, all services are reached at the same address. To add a second VIP, this patch adds two new configuration parameters. kolla_external_vip_address: is an IPv4 address to use for created VIP kolla_external_vip_interface: is the network interface to use for VIP In this scenario, the first VIP (the internal VIP), is defined by the original parameters (kolla_internal address and network_interface). When using two VIPs, the existing kolla_external_address parameter should be/point to/resolve to the kolla_external_vip_address. Closes-bug: 1535333 Change-Id: I5bfcefaf7899298455cdade8209c34324aebfecb
2016-02-19Make Heka collect HAProxy and Keepalived logsÉric Lemoine2-0/+6
Partially implements: blueprint heka Change-Id: I7e2bf4e520fa14fd40e3b329f3b2998ae6ea47f4
2016-02-17Move haproxy socket to volumeSamYaple2-12/+12
Partial-Bug: #1544545 Change-Id: I292bcaeacb080ff4c5ab6b42b7d899039d6b19c4
2016-01-27Add an ansible role for mongodbHui Kang1-0/+8
Change-Id: Ia6ac371845d1f2b545406d096b35a6d5f68be5f6 Implements: blueprint ansible-mongodb
2016-01-26Add stub upgrade.ymlMichal Jastrzebski1-0/+1
After introduction of pull action and turing every main.yml into {{action}}.yml we lost ability to perform upgrade Change-Id: Ie9fa2cd083b061033abc733fba53d54f9c55e393 Fixes-Bug: #1538210
2016-01-19Consistency changes in configsMaciej Szankin1-4/+8
TrivialFix Change-Id: Iafd92e4e962dec5a225582ff058ab3603e5a50bb
2016-01-06Allow haproxy role to pull imagesSamYaple3-5/+21
Change-Id: I094f1d35f60bf566ba7382504a7425f16ae975d8 Partially-Implements: blueprint pre-pull-images
2015-12-31Convert haproxy to kolla_dockerSamYaple1-29/+9
Change-Id: Iff39395010f47099e7dbbb9ddf7c014756455e91 Partially-Implements: blueprint kolla-docker-module
2015-12-29Add RadosGW containerAndrey Shestakov1-0/+8
Implements blueprint radosgw-container Change-Id: Idc88a67a0979be626d3eaa9b2b9a527010aa2006
2015-12-26Fix file permissionsSamYaple4-0/+0
Throughout the project overtime some of these file permissions have changed to have an executable bit. They should not have this bit set. TrivialFix Change-Id: I1748b5bde813a0fcac36aeecdfd83245b8ee5be3
2015-12-23Merge "Simplify config creation"Jenkins1-23/+18
2015-12-22Simplify config creationSamYaple1-23/+18
Convert config creation from a playbook to an action_plugin. This reduces the complexity and confusion while retaining the same augment structure and flexibility. This allows us to remove the 0-byte files as requirements. They will still be used if they are present (this means we require additional documentation around them). DocImpact Closes-Bug: #1528430 Change-Id: I2c789f6be9f195c7771ca093a6d59499564b4740
2015-12-16Fix retrieving api_interfaceOTSUKA, Yuanying1-20/+20
In heterogeneous environment, api_interfaces are different each other. So we should specify it from hostvars. Implements: bp configure-network-interface Change-Id: Id15d70bfb9ebb62a64a3847a6b77407efb171dbe
2015-11-13Merge "Add Ansible support for Magnum"Jenkins1-0/+8
2015-11-13Add Ansible support for MagnumMichal Rostecki1-0/+8
Change-Id: Idb25ac4d3148c9b9400cf675ac2e47d35cce6224 Implements: blueprint ansible-magnum
2015-11-06Merge "Finish implementation of spice"Jenkins1-0/+8
2015-11-06Finish implementation of spiceSam Yaple1-0/+8
Due bad rebases there is a huge section of the spice patch missing from the implementation unfortunately. This patch finishes the rest of this patch out properly. Change-Id: I693c6745e9594fd91eb6453f6de9dfcbd410e89c Paritally-Implements: blueprint nova-proxies
2015-11-06Merge "bootstrap takes place on the wrong node"Jenkins1-2/+2
2015-11-06Merge "Allow disabling of sysctl values"Jenkins1-0/+1
2015-11-05bootstrap takes place on the wrong nodeSam Yaple1-2/+2
The bootstrap must occur on the nova-api node due to binding in the nova-api directory (same goes for all other services) Closes-Bug: #1513439 Backport: Liberty Change-Id: Iab88b49712828085e4d7e7f85e6d8f0b7999a9bf
2015-11-05Allow disabling of sysctl valuesSam Yaple1-0/+1
The main reason for this change is to allow the DinD stuff to work. It has limited use outside of that use case, but it may still be useful to others in the future. Change-Id: Ib3a4639cfb3fc0d378d33fc8b9ff8eb597f818ab Partially-Implements: blueprint multinode-gate
2015-11-05Remove vip for rabbitmqSam Yaple1-8/+0
Adjust all the configs to list all the rabbitmq hosts rather than running rabbitmq through the VIP. This is made possible by clusterer which has already merged. Change-Id: I5db48f5f10ec68f4c8863a29bc13984f6845a4f9 Partially-Implements: blueprint rabbitmq-clusterer
2015-11-01HAProxy does not have murano-api configurationVladislav Belogrudov1-0/+8
This commit fixes configuration for murano-api HA Change-Id: I6b6f2c266cbb4c8131a949e31094572dad91fc40 Closes-Bug: #1510921 Backport: Liberty
2015-10-14Add tty to containersSam Yaple1-0/+2
sudo requires a tty to function by default on centos. Instead of tweaking the sudo conf we can just add a tty. This has the added advantage of making the containers more friendly if you have to `docker exec -i <container> bash` into them. Change-Id: If97a02ca1d37c243a787d98ade54bde8d641aecd backport: liberty Partially-Implements: blueprint functional-testing-gate
2015-10-13Bump ansible to 1.9.2Sam Yaple1-2/+0
Ansible 1.9.2 contains the fix needed for docker-py >1.2.0 This is needed for some gate reasons, but it is also a good version bump because it fixes a few issues with delegate_to. Change-Id: Iafbabb3b0232620849d0548c5cd9d8d316c2b0f3 backport: liberty Partially-Implements: blueprint functional-testing-gate
2015-10-06Updated haproxy config to include swift apiJames McCarthy1-0/+8
Closes-bug: #1503197 backport: liberty Change-Id: I5c233298312dabeb43efa4821855c77fd81aae67
2015-10-06Bring Kolla inline with FHSSam Yaple3-5/+5
This brings Kolla images inline with FHS and should make finding locations of things more consistent and reliable with the linux world at large. Change-Id: Iece5b4da4bace0fb8b1f41a65ab2c852ec73e6f8 Closes-Bug: #1485742
2015-09-28Add Ansible support for IronicJeff Peeler1-0/+8
Configuration based off upstream documentation here: http://docs.openstack.org/developer/ironic/deploy/install-guide.html A few notes: -ironic-api is not configured to use mod_wsgi -several places it's noted that discoverd is going away and needs to be replaced with ironic-inspector - (sqlite connection should be changed too) -currently enabling ironic reconfigures nova compute (driver and scheduler) as well as changes neutron network settings -a nice enhancement would be to configure the web console Required post-deployment configuration: Create the flat network to launch the instances: neutron net-create --tenant-id $TENANT_ID sharednet1 --shared \ --provider:network_type flat --provider:physical_network physnet1 neutron subnet-create sharednet1 $NETWORK_CIDR --name $SUBNET_NAME \ --ip-version=4 --gateway=$GATEWAY_IP --allocation-pool \ start=$START_IP,end=$END_IP --enable-dhcp And then the above ID is used to set cleaning_network_uuid in the neutron section of ironic.conf. Change-Id: I572e7ff1f23c4e57a2c50817cafe9269fd9950dd Implements: blueprint ironic-container
generated by cgit v1.2.3 (git 2.39.1) at 2026-11-06 00:17:11 +0000