aboutsummaryrefslogtreecommitdiff
path: root/ansible/roles/keystone/tasks
AgeCommit message (Collapse)AuthorFilesLines
2016-11-15Remove Ansible from KollaSteven Dake13-401/+0
Change-Id: I5396e4b9927d3e65b6aa4185238a43a4765a996b
2016-11-12Fix placement of policy.jsonDuong Ha-Quang1-1/+4
Currently, policy.json is put in "{{ node_config_directory }}/{{ service_name }}" in target nodes. Relocation policy.json to "{{ node_config_directory }}/{{ item }}" with item is corresponding service compoment config directory. Currently, the policy.json is copied to all services, but it should be reviewed and left only in neccesary service (at many cases, only API service needs that). Redundant files will be removed in follow up patchset. Change-Id: I0e997dccf4ec438c9c0436db71ec2fd06650f50d Closes-Bug: #1639686
2016-11-04Merge "Custom policy files"Jenkins1-1/+1
2016-11-03Move precheck into its own roleJeffrey Zhang1-0/+1
* Merge prechecks.yml and site.yml playbook * Create empty precheck.yml into all roles. Change-Id: I8a138558a26c0a2a66c5fd48ed37be657c99c1dd Implements: blueprint condition-pre-check
2016-10-28Custom policy filesEduardo Gonzalez1-1/+1
Allow operators to use their custom policy files. Avoid maintain policy files in kolla repos, only copying the files when an operator add their custom config. Implements: blueprint custom-policies Change-Id: Icf3c961b87cbc7a1f1dd2ffbfffcf271d151d862
2016-10-24Fix fernet related components added to fact var properly.Tomoya Goto1-1/+5
Previous version of keystone reconfigure fails at adding fernet components to fact variable "keystone_item". Ansible can not create fact variable using newly created variable in a same task. This patch set split this task into two tasks, first create variable containing fernet components, then merge it to "keystone_item". Change-Id: I15571ab20d6104d30350e8b922401b462336fca0 Closes-Bug: #1636047
2016-10-19Add validate no new line at end of fileJeffrey Zhang3-3/+3
TrivialFix Change-Id: I817aa52caf56b7d54b266e553db6db1ceb38b773 Signed-off-by: Jeffrey Zhang <zhang.lei.fly@gmail.com>
2016-10-13Merge "Remove do_reconfigure.yml file for all roles"Jenkins2-77/+74
2016-10-12Fix keystone fernet file exchange via sshChristian Berendt1-2/+2
* install openssh client in keystone-fernet container * install rsync in keystone-ssh container * fix syntax issue in ssh configuration * copy ssh configuration into keystone-fernet container * copy id_rsa.pub into keystone-ssh container * copy id_rsa into keystone-fernet container * use full path to ssh binary in used scripts * add missing newlines at EOF * when using type source set /var/lib/keystone as home directory for the user keystone Co-Authored-By: Jeffrey Zhang <jeffrey.zhang@99cloud.net> Change-Id: Id6b41030056a69f6516a054beb2fc0e08226e876 Closes-bug: #1623013
2016-09-29Fix typo in start.ymlzhangyanxian1-1/+1
TrivialFix Change-Id: I23d74821c7f65cdf20c214f7622f4df0d3c0e172
2016-09-27Remove do_reconfigure.yml file for all rolesJeffrey Zhang2-77/+74
do_reconfigure.yml is introduced to use serial directive. But we use it in wrong. Now serial has moved to playbook file. So it is time to remove the do_reconfigure.yml file Closes-Bug: #1628152 Change-Id: I8d42d27e6bc302a0e575b0353956eaef9b2ca9fd
2016-09-26Use keystone-paste.ini template for keystoneChristian Berendt1-0/+8
The use of the admin_token_auth middleware presents a security risk and was removed from [pipeline:api_v3], [pipeline:admin_api], and [pipeline:public_api]. Change-Id: I3a3ca2e74c0ae341105d3481f97956c6da473046 Closes-bug: #1587747
2016-09-17Fix reconfiguration issue for Keystone roleJeffrey Zhang1-5/+6
Closes-Bug: #1624598 Change-Id: If66d82c782e6c8255b94cb00cdf0893630db596c
2016-09-13Added serial option to site.yml.Mick Thompson2-2/+0
Useful for upgrade etc., which is preferablly done serially. Example usage: tools/kolla-ansible deploy OR tools/kolla-ansible upgrade Closes-Bug: #1576708 DocImpact Change-Id: I34b2e16f8ce53e472a4682a4738c4ac0f5abf00c
2016-08-25Add full support for fernetShaun Smekel6-11/+131
This addresses the ansible aspects of fernet key bootstrapping as well as distributed key rotation. - Bootstrapping is handled in the same way as keystone bootstrap. - A new keystone-fernet and keystone-ssh container is created to allow the nodes to communicate with each other (taken from nova-ssh). - The keystone-fernet is a keystone container with crontab installed. This will handle key rotations through keystone-manage and trigger an rsync to push new tokens to other nodes. - Key rotation is setup to be balanced across the keystone nodes using a round-robbin style. This ensures that any node failures will not stop the keys from rotating. This is configured by a desired token expiration time which then determines the cron scheduling for each node as well as the number of fernet tokens in rotation. - Ability for recovered node to resync with the cluster. When a node starts it will run sanity checks to ensure that its fernet tokens are not stale. If they are it will rsync with other nodes to ensure its tokens are up to date. The Docker component is implemented in: https://review.openstack.org/#/c/349366 Change-Id: I15052c25a1d1149d364236f10ced2e2346119738 Implements: blueprint keystone-fernet-token
2016-08-09Port with_ loop variable syntax to Ansbile 2Duong Ha-Quang1-4/+4
Migrate to full variable syntax in with_ loop instead of bare variables for: - ceph - ceilometer - glance - heat - horizon - keystone - mariadb - memcached - neutron - nova - rabbitmq Change-Id: Ib925b4ecea47ac758a77739c9c7e140f06933b08 Partial-Implements: blueprint ansible2
2016-08-04Replace keystone's wsgi config with custom configjackning1-1/+5
Ansible's template action supports replacing keystone's wsgi default config with custom config, it should only add with_first_found param to config.yml to support this. Change-Id: Id66302802db9a57188067982ea697f16faa1d8eb Closes-Bug: #1609655
2016-07-19Configurable policy.json for keystoneNenad Radojevic1-0/+11
Copy custom policy.json into keystone container Change-Id: I58787c3dd7adbeff47d0898c23db95f5919510d3 Closes-Bug: #1604431
2016-07-14Support Keystone Domain specific filesDave Walker (Daviey)1-0/+20
Currently, it is not possible to make use of Keystone Domain specific settings. Such as different domains using different LDAP servers or SQL. To enable for example domain ACME - domain settings would be put into: {{ node_custom_config }}keystone/domains/keystone.ACME.conf Change-Id: I23620978c618dd4a3598d7cb74c3e9cf8c2394ac Closes-Bug: #1599868 Signed-off-by: Dave Walker (Daviey) <email@daviey.com>
2016-05-26Merge "add support for non-default database_port in kolla/ansible"Jenkins1-2/+2
2016-05-23Make configurable the location where config files are mergedRyan Hallisey1-5/+5
An operator may want to specify the location of custom config files so that kolla can detect their location and merge them with the default configs generated. Partially implements: blueprint multi-project-config Change-Id: Ibfb38d07a36dfa7fe25381adc34cc1d3cbe7d1e1
2016-05-13add support for non-default database_port in kolla/ansibleWaldemar Znoinski1-2/+2
This change makes each step of the kolla deployment aware of the port database was configured to listen on. It defaults mariadb_port to database_port. Change-Id: I8e85d5732015afc0a5481cb33e0b629fdfa84a1b Closes-Bug: #1576151 DocImpact
2016-05-03Merge "map the host localtime to the container"Jenkins2-0/+2
2016-05-03map the host localtime to the containerJeffrey Zhang2-0/+2
Closes-Bug: #1577148 Change-Id: I636cefc63cf532434a41af3898b63dffa711e280
2016-05-02Remove unecessary blank linesMauricio Lima1-2/+1
TrivialFix Change-Id: I1f03d428c380dfdbde5ef33e7ea43cbf5e9154ce
2016-04-19Disable tty for keystone register scriptPaul Bourke1-1/+1
There seems to be a bug regarding the interaction between the Red Hat based images and docker exec, where output is missed when attaching a tty. This can be replicated using the following: $ docker run -d --name test centos /bin/sleep infinity $ docker exec -t test echo hi Repeat the second command over and over, "hi" will only be printed out every couple of runs. This affects the keystone register task as sometimes it will not print it's final json result to stdout, causing ansible to fall over with a difficult to diagnose error (despite the register having run successfully). Disabling the tty fixes this for me, it should not be needed in this case regardless. Change-Id: Ie7eb7c01c34ee3c59bd843651195fbcb7259d2c8 Closes-Bug: #1572082
2016-03-17Allow per node configuration with augmentsSamYaple1-0/+1
This type of per node configuration is required to support things like availability zones for nova. As always, if this file doesnt exist it doesnt get used so this change is safe. TrivialFix Change-Id: Iff8172af522c2c96e5f2c173b24a5dfd4d522ed2
2016-03-03Fix Keystone v3 and HorizonSamYaple1-1/+1
After our switch to keystone-manage bootstrap Horizon is not happy due to v3 not being setup correctly. This patch fixes that This also includes removal of unused variables (transforms them into endpoint url variables) TrivialFix Change-Id: I1e04db8c24049f80e974c063f03068a2ab32a563
2016-03-02Add kolla_docker action for reconfigureJeffrey Zhang1-20/+45
add three actions used for reconfigure * restart_container * get_container_env * get_container_state Partially-implements: bp kolla-reconfig Change-Id: I63609ce47f044926ff276ab1188b10f44270a0b5
2016-03-01Remove keystone admin tokenSamYaple1-37/+5
Admin token has been deprecated upstream. It will be removed in O. We switch over to the new `keystone-manage bootstrap` method for creating the initial admin user, role, and project. Co-Authored-By: Sam Yaple <sam@yaple.net> Change-Id: I6ca90e8d4c3b71009e24b049b2efbc08c05ebfbf
2016-02-29Run the keystone reconfigure only on keystone group hostJeffrey Zhang1-0/+1
Run the keystone reconfigure only when inventory_hostname in groups['keystone'] Partially-implements: bp kolla-reconfig Change-Id: I9d4b5f39f2d68cfd2ae087e3f8a2ee4785eb9586
2016-02-28Merge "Reconfigure keystone service"Jenkins2-0/+41
2016-02-27Reconfigure keystone serviceJeffrey Zhang2-0/+41
Partially-implements: bp kolla-reconfig Change-Id: Ied293e59bf4531e88a0e5e5bf9a5f5f495d2a0e7
2016-02-26Change kolla_internal_address variableSamYaple1-3/+3
Due to poor planning on our variable names we have a situation where we have "internal_address" which must be a VIP, but "external_address" which should be a DNS name. Now with two vips "external_vip_address" is a new variable. This corrects that issue by deprecating kolla_internal_address and replacing it with 4 nicely named variables. kolla_internal_vip_address kolla_internal_fqdn kolla_external_vip_address kolla_external_fqdn The default behaviour will remain the same, and the way the variable inheritance is setup the kolla_internal_address variable can still be set in globals.yml and propogate out to these 4 new variables like it normally would, but all reference to kolla_internal_address has been completely removed. Change-Id: I4556dcdbf4d91a8d2751981ef9c64bad44a719e5 Partially-Implements: blueprint ssl-kolla
2016-02-25Add the default empty reconfigure.yml file to all rolesJeffrey Zhang1-0/+1
DocImpact Partially-implements: bp kolla-reconfig Change-Id: I9738e80960bcfbef18d1ef1b7942f81c45684e85
2016-02-19Make Heka collect Keystone logsÉric Lemoine2-2/+4
Partially implements: blueprint heka Change-Id: I940143876981a04464af67aff65c09a06926701d
2016-02-17Merge "Move socket binding to named_volume"Jenkins1-1/+1
2016-02-16Move socket binding to named_volumeSamYaple1-1/+1
The extend_start.sh script for rsyslog is removed as it is no longer needed. Docker no longer binds to /dev/log or /run/kolla/log Closes-Bug: #1544545 Change-Id: Ic0a323a26ee4e9e15baf4598285844a8a4955f23
2016-02-15Use variables to specify http or https when constructing URLsDave McCowan1-3/+3
To allow for TLS to protect the service endpoints, the protocol in the URLs for the endpoints will be either http or https. This patch removes the hardcoded values of http and replaces them with variables that can be adjusted accordingly in future patches. Change-Id: Ibca6f8aac09c65115d1ac9957410e7f81ac7671e Partially-implements: blueprint ssl-kolla
2016-02-06Fix gate for docker 1.10SamYaple1-1/+1
Docker 1.10 has broken the gate and this patch will correct that breakage. The issue comes with rsyslog. Due to a commit in Docker 1.10 [1] we must change the way we get the log socket for rsyslog. The /dev/ folder will no longer populate as we used it. So instead we simply make a new socket in a path we control and share that to the correct location in the containers. Additionally, adjust the gate for new Docker daemon. [1] https://github.com/docker/docker/pull/16639 Partially-Implements: blueprint kolla-upgrade Change-Id: I881a2ecdf6d7b35991e1d38a3f3e60d022d6577f
2016-02-02Rename kolla_ansible to kolla_toolboxSamYaple3-5/+5
This change is needed for clarity. We have a kolla-ansible script. We have a kolla-mesos repo. We plan to have a kolla-ansible repo. Already we have had far too much confusion about whether we are talking about the container or the project. Naming this kolla-toolbox eliminates all of that confusion and its probably a bit more accurate of a name too. Closes-Bug: #1541053 Change-Id: I8fd1f49d5a22b36ede5b10f46b9fe02ddda9007e
2016-01-28Update all bootstraps to use LabelSamYaple1-0/+2
Add bootstrap label to all bootstrap containers to ensure that when the a new container is launched a difference is seen between it and the bootstrap container since we cannot rely on ENV variables for this. This only affects mariadb at this stage, but it is needed to ensure rabbitmq works when we switch to named volumes. Change-Id: Ia022af26212d2e5445c06149848831037a508407 Closes-Bug: #1538136
2016-01-13Playbook for keystone upgradeMichal Jastrzebski3-14/+23
New playbook for keystone release upgrade. Co-Authored-By: SamYaple <sam@yaple.net> Change-Id: I387abb30e5ead0033430848164d250fce739d2fd Implements: blueprint upgrade-keystone Partially-Implements: blueprint upgrade-kolla
2016-01-06Allow keystone role to pull imagesSamYaple3-13/+22
Change-Id: I64aff93368da7580b6cc1369a42be0904a670f98 Partially-Implements: blueprint pre-pull-images
2015-12-31Convert Keystone to kolla_dockerSamYaple2-47/+14
Change-Id: Ia1beaf8205317f8c628fa1efcb65be90a9ad8237 Partially-Implements: blueprint kolla-docker-module
2015-12-23Merge "Simplify config creation"Jenkins1-18/+25
2015-12-22Remove unneeded variables passed into keystoneSamYaple1-7/+0
During the bootstrap we no longer need to pass in this info TrivialFix Related-Bug: #1526251 Related-Id: Ieee215b9de1618b3d31f3d1a766a9d0ebafdee4d Change-Id: I82460cf11dea4692c0469bf2b9afddd794a30ec1
2015-12-22Simplify config creationSamYaple1-18/+25
Convert config creation from a playbook to an action_plugin. This reduces the complexity and confusion while retaining the same augment structure and flexibility. This allows us to remove the 0-byte files as requirements. They will still be used if they are present (this means we require additional documentation around them). DocImpact Closes-Bug: #1528430 Change-Id: I2c789f6be9f195c7771ca093a6d59499564b4740
2015-12-15Move the admin account creation to register.ymlJeffrey Zhang3-0/+45
Create the admin project, user, role and keystone service info by using ansible task rather than shell script Closes-Bug: #1526251 Change-Id: Ieee215b9de1618b3d31f3d1a766a9d0ebafdee4d
2015-12-02Sanity check for glanceMichal Jastrzebski1-1/+1
This runs first sanity check for glance. After glance is deployed it checks images.list(). Also consist few fixes for previous patches Change-Id: I03d05d246302d8411b2e94c94ca7fe046c00d735 Partially-Implements: blueprint sanity-check-container
generated by cgit v1.2.3 (git 2.39.1) at 2026-11-06 02:08:04 +0000