Run iptables in service playbooks instead of base
It's the only part of base that's important to run when we run a service. Run it in the service playbooks and get rid of the dependency on infra-prod-base. Continue running it in base so that new nodes are brought up with iptables in place. Bump the timeout for the mirror job, because the iptables addition seems to have just bumped it over the edge. Change-Id: I4608216f7a59cfa96d3bdb191edd9bc7bb9cca39
This commit is contained in:
Monty Taylor
parent
807b083735
commit
d93a661ae4
playbooks
base.yaml
roles
service-backup.yamlservice-bridge.yamlservice-codesearch.yamlservice-eavesdrop.yamlservice-etherpad.yamlservice-gitea-lb.yamlservice-gitea.yamlservice-letsencrypt.yamlservice-meetpad.yamlservice-mirror-update.yamlservice-mirror.yamlservice-nameserver.yamlservice-nodepool.yamlservice-registry.yamlservice-review-dev.yamlservice-review.yamlservice-static.yamlservice-zookeeper.yamlservice-zuul-preview.yamlservice-zuul.yamltestinfra
zuul.d
@ -8,4 +8,4 @@
|
||||
- base/unbound
|
||||
- base/exim
|
||||
- base/snmpd
|
||||
- base/iptables
|
||||
- iptables
|
||||
|
||||
0
playbooks/roles/base/iptables/templates/rules.v4.j2 → playbooks/roles/iptables/templates/rules.v4.j2
0
playbooks/roles/base/iptables/templates/rules.v4.j2 → playbooks/roles/iptables/templates/rules.v4.j2
0
playbooks/roles/base/iptables/templates/rules.v6.j2 → playbooks/roles/iptables/templates/rules.v6.j2
0
playbooks/roles/base/iptables/templates/rules.v6.j2 → playbooks/roles/iptables/templates/rules.v6.j2
@ -1,4 +1,6 @@
|
||||
# Use include_role instead of roles: so that we can late-bind the roles list
|
||||
- include_role:
|
||||
name: iptables
|
||||
- include_role:
|
||||
name: install-ansible-roles
|
||||
- include_role:
|
||||
|
||||
@ -3,8 +3,10 @@
|
||||
- hosts: "backup:!disabled"
|
||||
name: "Base: Generate backup users and keys"
|
||||
roles:
|
||||
- iptables
|
||||
- backup
|
||||
- hosts: "backup-server:!disabled"
|
||||
name: "Generate bup configuration"
|
||||
roles:
|
||||
- iptables
|
||||
- backup-server
|
||||
|
||||
@ -1,6 +1,7 @@
|
||||
- hosts: bridge.openstack.org:!disabled
|
||||
name: "Bridge: configure the bastion host"
|
||||
roles:
|
||||
- iptables
|
||||
- edit-secrets-script
|
||||
- install-docker
|
||||
tasks:
|
||||
|
||||
@ -2,6 +2,7 @@
|
||||
name: "codesearch: run puppet on codesearch"
|
||||
strategy: free
|
||||
roles:
|
||||
- iptables
|
||||
- sync-project-config
|
||||
- name: run-puppet
|
||||
manifest: /opt/system-config/production/manifests/codesearch.pp
|
||||
|
||||
@ -2,6 +2,7 @@
|
||||
name: "eavesdrop: run puppet on eavesdrop"
|
||||
strategy: free
|
||||
roles:
|
||||
- iptables
|
||||
- zuul-user
|
||||
- sync-project-config
|
||||
- install-docker
|
||||
|
||||
@ -1,5 +1,6 @@
|
||||
- hosts: "etherpad01.opendev.org:!disabled"
|
||||
name: "Base: configure etherpad"
|
||||
roles:
|
||||
- iptables
|
||||
- install-docker
|
||||
- etherpad
|
||||
|
||||
@ -1,5 +1,6 @@
|
||||
- hosts: "gitea-lb:!disabled"
|
||||
name: "Base: configure gitea load balancer"
|
||||
roles:
|
||||
- iptables
|
||||
- install-docker
|
||||
- haproxy
|
||||
|
||||
@ -2,5 +2,6 @@
|
||||
name: "Base: configure gitea"
|
||||
serial: 1
|
||||
roles:
|
||||
- iptables
|
||||
- install-docker
|
||||
- gitea
|
||||
|
||||
@ -5,7 +5,7 @@
|
||||
roles:
|
||||
- install-certcheck
|
||||
- hosts: "letsencrypt:!disabled"
|
||||
name: "Base: deploy and renew certificates"
|
||||
name: "Deploy and renew certificates"
|
||||
roles:
|
||||
- letsencrypt-acme-sh-install
|
||||
- letsencrypt-request-certs
|
||||
|
||||
@ -1,12 +1,14 @@
|
||||
- hosts: "meetpad:!disabled"
|
||||
name: "Configure meetpad"
|
||||
roles:
|
||||
- iptables
|
||||
- install-docker
|
||||
- jitsi-meet
|
||||
|
||||
- hosts: "jvb:!disabled"
|
||||
name: "Configure extra jitsi video bridges"
|
||||
roles:
|
||||
- iptables
|
||||
- install-docker
|
||||
- role: jitsi-meet
|
||||
docker_compose_file: jvb-docker-compose.yaml
|
||||
|
||||
@ -1,6 +1,7 @@
|
||||
- hosts: "mirror-update:!disabled"
|
||||
name: "Configure mirror-update"
|
||||
roles:
|
||||
- role: iptables
|
||||
- role: kerberos-client
|
||||
kerberos_realm: 'OPENSTACK.ORG'
|
||||
kerberos_admin_server: 'kdc.openstack.org'
|
||||
|
||||
@ -1,6 +1,7 @@
|
||||
- hosts: "mirror:!disabled"
|
||||
name: "Configure per region opendev mirrors"
|
||||
roles:
|
||||
- role: iptables
|
||||
- role: kerberos-client
|
||||
kerberos_realm: 'OPENSTACK.ORG'
|
||||
kerberos_admin_server: 'kdc.openstack.org'
|
||||
|
||||
@ -1,10 +1,12 @@
|
||||
- hosts: adns:!disabled
|
||||
name: "Base: configure adns server"
|
||||
roles:
|
||||
- iptables
|
||||
- master-nameserver
|
||||
|
||||
- hosts: "ns1.opendev.org:ns2.opendev.org:!disabled"
|
||||
name: "Base: configure authoritative nameservers"
|
||||
roles:
|
||||
- iptables
|
||||
- nameserver
|
||||
|
||||
|
||||
@ -2,6 +2,7 @@
|
||||
name: "Configure nodepool builders"
|
||||
strategy: free
|
||||
roles:
|
||||
- iptables
|
||||
- install-docker
|
||||
- nodepool-base
|
||||
- configure-openstacksdk
|
||||
@ -11,6 +12,7 @@
|
||||
name: "run puppet on all older servers"
|
||||
strategy: free
|
||||
roles:
|
||||
- iptables
|
||||
- nodepool-base-legacy
|
||||
- configure-openstacksdk
|
||||
- configure-kubectl
|
||||
@ -20,6 +22,7 @@
|
||||
name: "Configure nodepool launchers"
|
||||
strategy: free
|
||||
roles:
|
||||
- iptables
|
||||
- install-docker
|
||||
- nodepool-base
|
||||
- configure-openstacksdk
|
||||
|
||||
@ -1,5 +1,6 @@
|
||||
- hosts: "registry:!disabled"
|
||||
name: "Base: configure registry"
|
||||
roles:
|
||||
- iptables
|
||||
- install-docker
|
||||
- registry
|
||||
|
||||
@ -1,6 +1,7 @@
|
||||
- hosts: "review-dev:!disabled"
|
||||
name: "Configure gerrit on review-dev"
|
||||
roles:
|
||||
- iptables
|
||||
- install-docker
|
||||
- role: gerrit
|
||||
gerrit_ssh_rsa_key_contents: "{{ gerrit_dev_ssh_rsa_key_contents }}"
|
||||
|
||||
@ -1,5 +1,6 @@
|
||||
- hosts: "review:!disabled"
|
||||
name: "Configure gerrit"
|
||||
roles:
|
||||
- iptables
|
||||
- install-docker
|
||||
- gerrit
|
||||
|
||||
@ -1,6 +1,7 @@
|
||||
- hosts: "static:!disabled"
|
||||
name: "Static webserver"
|
||||
roles:
|
||||
- role: iptables
|
||||
- role: kerberos-client
|
||||
kerberos_realm: 'OPENSTACK.ORG'
|
||||
kerberos_admin_server: 'kdc.openstack.org'
|
||||
|
||||
@ -12,5 +12,6 @@
|
||||
name: "Configure Zookeeper"
|
||||
serial: 1
|
||||
roles:
|
||||
- iptables
|
||||
- install-docker
|
||||
- zookeeper
|
||||
|
||||
@ -1,5 +1,6 @@
|
||||
- hosts: "zuul-preview:!disabled"
|
||||
name: "Base: configure zuul-preview"
|
||||
roles:
|
||||
- iptables
|
||||
- install-docker
|
||||
- zuul-preview
|
||||
|
||||
@ -11,6 +11,7 @@
|
||||
- hosts: "zuul:!disabled"
|
||||
name: "Configure zuul servers"
|
||||
roles:
|
||||
- iptables
|
||||
- install-docker
|
||||
- zuul
|
||||
|
||||
|
||||
@ -14,7 +14,6 @@
|
||||
|
||||
import socket
|
||||
|
||||
|
||||
testinfra_hosts = ['all']
|
||||
|
||||
|
||||
|
||||
73
testinfra/test_zuul.py
Normal file
73
testinfra/test_zuul.py
Normal file
@ -0,0 +1,73 @@
|
||||
# Copyright 2018 Red Hat, Inc.
|
||||
#
|
||||
# Licensed under the Apache License, Version 2.0 (the "License"); you may
|
||||
# not use this file except in compliance with the License. You may obtain
|
||||
# a copy of the License at
|
||||
#
|
||||
# http://www.apache.org/licenses/LICENSE-2.0
|
||||
#
|
||||
# Unless required by applicable law or agreed to in writing, software
|
||||
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
|
||||
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
|
||||
# License for the specific language governing permissions and limitations
|
||||
# under the License.
|
||||
|
||||
import socket
|
||||
|
||||
|
||||
testinfra_hosts = [
|
||||
'ze01.opendev.org',
|
||||
'zm01.openstack.org',
|
||||
'zuul01.openstack.org',
|
||||
]
|
||||
|
||||
|
||||
def get_ips(value, family=None):
|
||||
ret = set()
|
||||
try:
|
||||
addr_info = socket.getaddrinfo(value, None, family)
|
||||
except socket.gaierror:
|
||||
return ret
|
||||
for addr in addr_info:
|
||||
ret.add(addr[4][0])
|
||||
return ret
|
||||
|
||||
|
||||
def test_iptables(host):
|
||||
rules = host.iptables.rules()
|
||||
rules = [x.strip() for x in rules]
|
||||
|
||||
needed_rules = [
|
||||
'-P INPUT ACCEPT',
|
||||
'-P FORWARD DROP',
|
||||
'-P OUTPUT ACCEPT',
|
||||
'-N openstack-INPUT',
|
||||
'-A INPUT -j openstack-INPUT',
|
||||
'-A openstack-INPUT -i lo -j ACCEPT',
|
||||
'-A openstack-INPUT -p icmp -m icmp --icmp-type any -j ACCEPT',
|
||||
'-A openstack-INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT',
|
||||
'-A openstack-INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT',
|
||||
'-A openstack-INPUT -j REJECT --reject-with icmp-host-prohibited'
|
||||
]
|
||||
for rule in needed_rules:
|
||||
assert rule in rules
|
||||
|
||||
# Make sure that the gearman port is open to executors on the scheduler
|
||||
if host.backend.get_hostname() == 'zuul01.openstack.org':
|
||||
for ip in get_ips('ze01.opendev.org', socket.AF_INET):
|
||||
zuul = ('-A openstack-INPUT -s %s/32 -p tcp -m state --state NEW'
|
||||
' -m tcp --dport 4730 -j ACCEPT' % ip)
|
||||
assert zuul in rules
|
||||
|
||||
# Ensure all IPv4+6 addresses for cacti are allowed
|
||||
for ip in get_ips('cacti.openstack.org', socket.AF_INET):
|
||||
snmp = ('-A openstack-INPUT -s %s/32 -p udp -m udp'
|
||||
' --dport 161 -j ACCEPT' % ip)
|
||||
assert snmp in rules
|
||||
|
||||
# TODO(ianw) add ip6tables support to testinfra iptables module
|
||||
ip6rules = host.check_output('ip6tables -S')
|
||||
for ip in get_ips('cacti.openstack.org', socket.AF_INET6):
|
||||
snmp = ('-A openstack-INPUT -s %s/128 -p udp -m udp'
|
||||
' --dport 161 -j ACCEPT' % ip)
|
||||
assert snmp in ip6rules
|
||||
@ -69,8 +69,6 @@
|
||||
dependencies:
|
||||
- name: infra-prod-install-ansible
|
||||
soft: true
|
||||
- name: infra-prod-base
|
||||
soft: true
|
||||
files:
|
||||
- inventory/
|
||||
- playbooks/service-letsencrypt.yaml
|
||||
@ -105,8 +103,6 @@
|
||||
dependencies:
|
||||
- name: infra-prod-install-ansible
|
||||
soft: true
|
||||
- name: infra-prod-base
|
||||
soft: true
|
||||
- name: infra-prod-service-letsencrypt
|
||||
soft: true
|
||||
|
||||
@ -120,6 +116,7 @@
|
||||
- inventory/
|
||||
- playbooks/service-bridge.yaml
|
||||
- playbooks/host_vars/bridge.openstack.org.yaml
|
||||
- playbooks/roles/iptables/
|
||||
- playbooks/roles/logrotate/
|
||||
- playbooks/roles/edit-secrets-script/
|
||||
- playbooks/roles/install-kubectl/
|
||||
@ -138,6 +135,7 @@
|
||||
- playbooks/service-gitea-lb.yaml
|
||||
- playbooks/group_vars/gitea-lb.yaml
|
||||
- playbooks/roles/pip3/
|
||||
- playbooks/roles/iptables/
|
||||
- playbooks/roles/install-docker/
|
||||
- playbooks/roles/haproxy/
|
||||
|
||||
@ -157,6 +155,7 @@
|
||||
- playbooks/group_vars/ns.yaml
|
||||
- playbooks/roles/master-nameserver/
|
||||
- playbooks/roles/nameserver/
|
||||
- playbooks/roles/iptables/
|
||||
|
||||
- job:
|
||||
name: infra-prod-service-nodepool
|
||||
@ -179,6 +178,7 @@
|
||||
- playbooks/roles/configure-kubectl/
|
||||
- playbooks/roles/configure-openstacksdk/
|
||||
- playbooks/roles/install-docker/
|
||||
- playbooks/roles/iptables/
|
||||
- playbooks/roles/nodepool
|
||||
- playbooks/templates/clouds/nodepool_
|
||||
|
||||
@ -197,6 +197,7 @@
|
||||
- playbooks/roles/pip3/
|
||||
- playbooks/roles/etherpad
|
||||
- playbooks/roles/logrotate
|
||||
- playbooks/roles/iptables/
|
||||
|
||||
- job:
|
||||
name: infra-prod-service-meetpad
|
||||
@ -205,8 +206,6 @@
|
||||
dependencies:
|
||||
- name: infra-prod-install-ansible
|
||||
soft: true
|
||||
- name: infra-prod-base
|
||||
soft: true
|
||||
- name: infra-prod-service-letsencrypt
|
||||
soft: true
|
||||
- name: system-config-promote-image-jitsi-meet
|
||||
@ -220,6 +219,7 @@
|
||||
- playbooks/group_vars/meetpad.yaml
|
||||
- playbooks/roles/pip3/
|
||||
- playbooks/roles/install-docker/
|
||||
- playbooks/roles/iptables/
|
||||
- playbooks/roles/jitsi-meet/
|
||||
|
||||
- job:
|
||||
@ -234,6 +234,7 @@
|
||||
- playbooks/roles/kerberos-client/
|
||||
- playbooks/roles/openafs-client/
|
||||
- playbooks/roles/mirror-update/
|
||||
- playbooks/roles/iptables/
|
||||
- playbooks/roles/logrotate/
|
||||
|
||||
- job:
|
||||
@ -251,6 +252,7 @@
|
||||
- playbooks/roles/mirror/
|
||||
- playbooks/roles/afs-release/
|
||||
- playbooks/roles/afsmon/
|
||||
- playbooks/roles/iptables/
|
||||
- playbooks/roles/logrotate/
|
||||
|
||||
- job:
|
||||
@ -264,6 +266,7 @@
|
||||
- playbooks/service-static.yaml
|
||||
- playbooks/host_vars/static01.opendev.org.yaml
|
||||
- playbooks/group_vars/static.yaml
|
||||
- playbooks/roles/iptables/
|
||||
- playbooks/roles/kerberos-client/
|
||||
- playbooks/roles/openafs-client/
|
||||
- playbooks/roles/static/
|
||||
@ -280,6 +283,7 @@
|
||||
- playbooks/service-backup.yaml
|
||||
- playbooks/roles/backup/
|
||||
- playbooks/roles/backup-server/
|
||||
- playbooks/roles/iptables/
|
||||
|
||||
- job:
|
||||
name: infra-prod-service-registry
|
||||
@ -293,6 +297,7 @@
|
||||
- playbooks/group_vars/registry.yaml
|
||||
- playbooks/roles/pip3/
|
||||
- playbooks/roles/install-docker/
|
||||
- playbooks/roles/iptables/
|
||||
- playbooks/roles/registry/
|
||||
|
||||
- job:
|
||||
@ -307,6 +312,7 @@
|
||||
- playbooks/group_vars/zuul-preview.yaml
|
||||
- playbooks/roles/pip3/
|
||||
- playbooks/roles/install-docker/
|
||||
- playbooks/roles/iptables/
|
||||
- playbooks/roles/zuul-preview/
|
||||
|
||||
- job:
|
||||
@ -321,6 +327,7 @@
|
||||
- ^playbooks/host_vars/zk\d+\..*
|
||||
- playbooks/roles/pip3/
|
||||
- playbooks/roles/install-docker/
|
||||
- playbooks/roles/iptables/
|
||||
- playbooks/roles/zookeeper/
|
||||
|
||||
- job:
|
||||
@ -337,8 +344,6 @@
|
||||
dependencies:
|
||||
- name: infra-prod-install-ansible
|
||||
soft: true
|
||||
- name: infra-prod-base
|
||||
soft: true
|
||||
- name: infra-prod-service-letsencrypt
|
||||
soft: true
|
||||
- name: infra-prod-manage-projects
|
||||
@ -352,6 +357,7 @@
|
||||
- playbooks/host_vars/zk\d+
|
||||
- playbooks/host_vars/zuul01.openstack.org
|
||||
- playbooks/roles/install-docker/
|
||||
- playbooks/roles/iptables/
|
||||
- playbooks/roles/zookeeper/
|
||||
- playbooks/roles/zuul
|
||||
|
||||
@ -364,8 +370,6 @@
|
||||
dependencies: &infra_prod_service_review_deps
|
||||
- name: infra-prod-install-ansible
|
||||
soft: true
|
||||
- name: infra-prod-base
|
||||
soft: true
|
||||
- name: infra-prod-service-letsencrypt
|
||||
soft: true
|
||||
- name: system-config-promote-image-gerrit-2.13
|
||||
@ -377,6 +381,7 @@
|
||||
- playbooks/host_vars/review01.openstack.org.yaml
|
||||
- playbooks/roles/pip3/
|
||||
- playbooks/roles/install-docker/
|
||||
- playbooks/roles/iptables/
|
||||
- playbooks/roles/gerrit/
|
||||
|
||||
- job:
|
||||
@ -393,6 +398,7 @@
|
||||
- playbooks/host_vars/review-dev01.opendev.org.yaml
|
||||
- playbooks/roles/pip3/
|
||||
- playbooks/roles/install-docker/
|
||||
- playbooks/roles/iptables/
|
||||
- playbooks/roles/gerrit/
|
||||
|
||||
- job:
|
||||
@ -404,8 +410,6 @@
|
||||
dependencies:
|
||||
- name: infra-prod-install-ansible
|
||||
soft: true
|
||||
- name: infra-prod-base
|
||||
soft: true
|
||||
- name: infra-prod-service-letsencrypt
|
||||
soft: true
|
||||
- name: system-config-promote-image-gitea-init
|
||||
@ -420,6 +424,7 @@
|
||||
- playbooks/roles/install-docker/
|
||||
- playbooks/roles/pip3/
|
||||
- playbooks/roles/gitea/
|
||||
- playbooks/roles/iptables/
|
||||
- playbooks/roles/logrotate/
|
||||
- docker/gitea/
|
||||
- docker/gitea-init/
|
||||
@ -443,6 +448,7 @@
|
||||
- playbooks/group_vars/puppet.yaml
|
||||
- playbooks/roles/run-puppet/
|
||||
- playbooks/roles/install-ansible-roles/
|
||||
- playbooks/roles/iptables/
|
||||
- playbooks/roles/sync-project-config
|
||||
- playbooks/roles/puppet-install/
|
||||
- playbooks/roles/disable-puppet-agent/
|
||||
@ -461,8 +467,6 @@
|
||||
dependencies:
|
||||
- name: infra-prod-install-ansible
|
||||
soft: true
|
||||
- name: infra-prod-base
|
||||
soft: true
|
||||
- name: infra-prod-service-letsencrypt
|
||||
soft: true
|
||||
- name: system-config-promote-image-accessbot
|
||||
@ -479,6 +483,7 @@
|
||||
- playbooks/roles/install-ansible-roles/
|
||||
- playbooks/roles/zuul-user
|
||||
- playbooks/roles/install-docker
|
||||
- playbooks/roles/iptables/
|
||||
- playbooks/roles/puppet-install/
|
||||
- playbooks/roles/disable-puppet-agent/
|
||||
- playbooks/roles/accessbot
|
||||
@ -526,6 +531,7 @@
|
||||
- playbooks/roles/install-ansible-roles/
|
||||
- playbooks/roles/puppet-install/
|
||||
- playbooks/roles/disable-puppet-agent/
|
||||
- playbooks/roles/iptables/
|
||||
- playbooks/roles/vos-release/
|
||||
- modules/
|
||||
- manifests/
|
||||
@ -551,6 +557,7 @@
|
||||
- playbooks/roles/install-ansible-roles/
|
||||
- playbooks/roles/puppet-install/
|
||||
- playbooks/roles/disable-puppet-agent/
|
||||
- playbooks/roles/iptables/
|
||||
- modules/
|
||||
- manifests/
|
||||
|
||||
|
||||
@ -204,8 +204,6 @@
|
||||
dependencies:
|
||||
- name: infra-prod-install-ansible
|
||||
soft: true
|
||||
- name: infra-prod-base
|
||||
soft: true
|
||||
- name: infra-prod-service-letsencrypt
|
||||
soft: true
|
||||
- name: system-config-promote-image-etherpad
|
||||
|
||||
@ -374,6 +374,7 @@
|
||||
- job:
|
||||
name: system-config-run-mirror-x86
|
||||
parent: system-config-run-mirror-base
|
||||
timeout: 3600
|
||||
nodeset:
|
||||
nodes:
|
||||
- name: bridge.openstack.org
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user