Make kdc03 the master kerberos kdc and admin server
This change will convert kdc03 to a master from a hot standby and will remove kdc01 from management. Cutover plan: Disable kdc01 in ansible emergeny file Stop run-kprop cron on kdc01 Stop kadmind on kdc01 Execute run-kprop.sh on kdc01 Merge this change Wait for puppet to convert kdc03 to the master Confirm that run-kprop works from kdc03 to kdc04 Update dns records as documented in our kerberos docs Test kadmin works Delete old kdc01 server Change-Id: Ib14b11fa1f0a6bc11b0f615ce5b6f6be214b5629
This commit is contained in:
Clark Boylan
parent
d96623934c
commit
9c465131db
@ -45,10 +45,8 @@ admin principals and host principles need to be set up.
|
||||
Set up host principals for slave propagation::
|
||||
|
||||
# execute kadmin.local then run these commands
|
||||
addprinc -randkey host/kdc01.openstack.org
|
||||
addprinc -randkey host/kdc03.openstack.org
|
||||
addprinc -randkey host/kdc04.openstack.org
|
||||
ktadd host/kdc01.openstack.org
|
||||
ktadd host/kdc03.openstack.org
|
||||
ktadd host/kdc04.openstack.org
|
||||
|
||||
@ -116,20 +114,19 @@ Should you need perform maintenance on the kerberos server that requires
|
||||
taking kerberos processes offline you can do this by performing your
|
||||
updates on a single server at a time.
|
||||
|
||||
`kdc01.openstack.org` is our primary server and `kdc0[34].openstack.org`
|
||||
is the hot standby. Perform your maintenance on `kdc0[34].openstack.org`
|
||||
`kdc03.openstack.org` is our primary server and `kdc04.openstack.org`
|
||||
is the hot standby. Perform your maintenance on `kdc04.openstack.org`
|
||||
first. Then once that is done we can prepare for taking down the
|
||||
primary. On `kdc01.openstack.org` run::
|
||||
primary. On `kdc03.openstack.org` run::
|
||||
|
||||
root@kdc01:~# /usr/local/bin/run-kprop.sh
|
||||
root@kdc03:~# /usr/local/bin/run-kprop.sh
|
||||
|
||||
You should see::
|
||||
|
||||
Database propagation to kdc03.openstack.org: SUCCEEDED
|
||||
Database propagation to kdc04.openstack.org: SUCCEEDED
|
||||
|
||||
Once this is done the standby server is ready and we can take kdc01
|
||||
offline. When kdc01 is back online rerun `run-kprop.sh` to ensure
|
||||
Once this is done the standby server is ready and we can take kdc03
|
||||
offline. When kdc03 is back online rerun `run-kprop.sh` to ensure
|
||||
everything is working again.
|
||||
|
||||
DNS Entries
|
||||
@ -137,15 +134,14 @@ DNS Entries
|
||||
|
||||
Kerberos uses the following DNS entries::
|
||||
|
||||
_kpasswd._udp.openstack.org. 300 IN SRV 0 0 464 kdc01.openstack.org.
|
||||
_kerberos-adm._tcp.openstack.org. 300 IN SRV 0 0 749 kdc01.openstack.org.
|
||||
_kerberos-master._udp.openstack.org. 300 IN SRV 0 0 88 kdc01.openstack.org.
|
||||
_kerberos._udp.openstack.org. 300 IN SRV 0 0 88 kdc04.openstack.org.
|
||||
_kpasswd._udp.openstack.org. 300 IN SRV 0 0 464 kdc03.openstack.org.
|
||||
_kerberos-adm._tcp.openstack.org. 300 IN SRV 0 0 749 kdc03.openstack.org.
|
||||
_kerberos-master._udp.openstack.org. 300 IN SRV 0 0 88 kdc03.openstack.org.
|
||||
_kerberos._udp.openstack.org. 300 IN SRV 0 0 88 kdc03.openstack.org.
|
||||
_kerberos._udp.openstack.org. 300 IN SRV 0 0 88 kdc01.openstack.org.
|
||||
_kerberos._udp.openstack.org. 300 IN SRV 0 0 88 kdc04.openstack.org.
|
||||
_kerberos.openstack.org. 300 IN TXT "OPENSTACK.ORG"
|
||||
|
||||
Be sure to update them if kdc servers change. We also maintain a
|
||||
CNAME for convenience which points to the master kdc::
|
||||
|
||||
kdc.openstack.org. 300 IN CNAME kdc01.openstack.org.
|
||||
kdc.openstack.org. 300 IN CNAME kdc03.openstack.org.
|
||||
|
||||
@ -261,7 +261,6 @@ cacti_hosts:
|
||||
- groups-dev.openstack.org
|
||||
- groups.openstack.org
|
||||
- health.openstack.org
|
||||
- kdc01.openstack.org
|
||||
- kdc03.openstack.org
|
||||
- kdc04.openstack.org
|
||||
- lists.openstack.org
|
||||
|
||||
@ -294,13 +294,6 @@ all:
|
||||
region_name: DFW
|
||||
public_v4: 104.130.132.79
|
||||
public_v6: 2001:4800:7818:101:be76:4eff:fe04:67f5
|
||||
kdc01.openstack.org:
|
||||
ansible_host: 2001:4800:7818:103:fc6b:fcd5:e132:b4f5
|
||||
location:
|
||||
cloud: openstackci-rax
|
||||
region_name: DFW
|
||||
public_v4: 104.130.154.186
|
||||
public_v6: 2001:4800:7818:103:fc6b:fcd5:e132:b4f5
|
||||
kdc03.openstack.org:
|
||||
ansible_host: 2001:4800:7817:104:be76:4eff:fe01:491e
|
||||
location:
|
||||
|
||||
@ -1169,21 +1169,11 @@ node 'single-node-ci.test.only' {
|
||||
include ::openstackci::single_node_ci
|
||||
}
|
||||
|
||||
# Node-OS: trusty
|
||||
node /^kdc01\.open.*\.org$/ {
|
||||
class { 'openstack_project::server': }
|
||||
|
||||
class { 'openstack_project::kdc': }
|
||||
}
|
||||
|
||||
# Node-OS: xenial
|
||||
# This node will become the new master when we retire kdc01
|
||||
node /^kdc03\.open.*\.org$/ {
|
||||
class { 'openstack_project::server': }
|
||||
|
||||
class { 'openstack_project::kdc':
|
||||
slave => true,
|
||||
}
|
||||
class { 'openstack_project::kdc': }
|
||||
}
|
||||
|
||||
# Node-OS: xenial
|
||||
|
||||
@ -5,13 +5,11 @@ class openstack_project::kdc (
|
||||
class { 'kerberos::server':
|
||||
realm => 'OPENSTACK.ORG',
|
||||
kdcs => [
|
||||
'kdc01.openstack.org',
|
||||
'kdc03.openstack.org',
|
||||
'kdc04.openstack.org',
|
||||
],
|
||||
admin_server => 'kdc.openstack.org',
|
||||
slaves => [
|
||||
'kdc03.openstack.org',
|
||||
'kdc04.openstack.org',
|
||||
],
|
||||
slave => $slave,
|
||||
|
||||
@ -24,7 +24,6 @@ class openstack_project::server (
|
||||
admin_server => 'kdc.openstack.org',
|
||||
cache_size => $afs_cache_size,
|
||||
kdcs => [
|
||||
'kdc01.openstack.org',
|
||||
'kdc03.openstack.org',
|
||||
'kdc04.openstack.org',
|
||||
],
|
||||
|
||||
@ -5,8 +5,8 @@
|
||||
kerberos_realm: 'OPENSTACK.ORG'
|
||||
kerberos_admin_server: 'kdc.openstack.org'
|
||||
kerberos_kdcs:
|
||||
- kdc01.openstack.org
|
||||
- kdc02.openstack.org
|
||||
- kdc03.openstack.org
|
||||
- kdc04.openstack.org
|
||||
|
||||
- role: openafs-client
|
||||
|
||||
|
||||
Loading…
Reference in New Issue
Block a user