450 lines
22 KiB
Python
450 lines
22 KiB
Python
# Copyright 2016 Cisco Systems, Inc.
|
|
#
|
|
# Licensed under the Apache License, Version 2.0 (the "License");
|
|
# you may not use this file except in compliance with the License.
|
|
# You may obtain a copy of the License at
|
|
#
|
|
# http://www.apache.org/licenses/LICENSE-2.0
|
|
#
|
|
# Unless required by applicable law or agreed to in writing, software
|
|
# distributed under the License is distributed on an "AS IS" BASIS,
|
|
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
# See the License for the specific language governing permissions and
|
|
# limitations under the License.
|
|
|
|
from oslo_config import cfg
|
|
from oslo_log import log as logging
|
|
|
|
from ironic_python_agent import netutils
|
|
from ironic_python_agent import utils
|
|
|
|
LOG = logging.getLogger(__name__)
|
|
CONF = cfg.CONF
|
|
|
|
APARAMS = utils.get_agent_params()
|
|
|
|
INSPECTION_DEFAULT_COLLECTORS = 'default,logs'
|
|
INSPECTION_DEFAULT_DHCP_WAIT_TIMEOUT = 60
|
|
|
|
cli_opts = [
|
|
cfg.StrOpt('api_url',
|
|
default=APARAMS.get('ipa-api-url'),
|
|
regex='^(mdns|http(s?):\\/\\/.+)',
|
|
help='URL(s) of the Ironic API. '
|
|
'Can be supplied as "ipa-api-url" kernel parameter.'
|
|
'The value(s) must start with either http:// or https://. '
|
|
'A special value "mdns" can be specified to fetch the '
|
|
'URL using multicast DNS service discovery. If several '
|
|
'URLs are provided, all of them are tried until one '
|
|
'does not return a connection error.'),
|
|
|
|
cfg.StrOpt('global_request_id',
|
|
default=APARAMS.get('ipa-global-request-id'),
|
|
help='Global request ID header to provide to Ironic API. '
|
|
'Can be supplied as "ipa-global-request-id" kernel '
|
|
'parameter. The value must be in form "req-<UUID>".'),
|
|
|
|
cfg.StrOpt('listen_host',
|
|
default=APARAMS.get('ipa-listen-host',
|
|
netutils.get_wildcard_address()),
|
|
sample_default='::',
|
|
help='The IP address to listen on. '
|
|
'Can be supplied as "ipa-listen-host" kernel parameter.'),
|
|
|
|
cfg.PortOpt('listen_port',
|
|
default=int(APARAMS.get('ipa-listen-port', 9999)),
|
|
help='The port to listen on. '
|
|
'Can be supplied as "ipa-listen-port" kernel parameter.'),
|
|
|
|
# This is intentionally not settable via kernel command line, as it
|
|
# requires configuration parameters from oslo_service which are not
|
|
# configurable over the command line and require files-on-disk.
|
|
# Operators who want to use this support should configure it statically
|
|
# as part of a ramdisk build.
|
|
cfg.BoolOpt('listen_tls',
|
|
default=False,
|
|
help='When true, IPA will host API behind TLS. You will also '
|
|
'need to configure [ssl] group options for cert_file, '
|
|
'key_file, and, if desired, ca_file to validate client '
|
|
'certificates.'),
|
|
|
|
cfg.BoolOpt('enable_auto_tls',
|
|
default=True,
|
|
help='Enables auto-generating TLS parameters when listen_tls '
|
|
'is False and ironic API version indicates support for '
|
|
'automatic agent TLS.'),
|
|
|
|
cfg.IntOpt('auto_tls_allowed_clock_skew',
|
|
default=3600, min=0,
|
|
help='Clock skew (in seconds) allowed in the generated TLS '
|
|
'certificate.'),
|
|
|
|
cfg.StrOpt('advertise_host',
|
|
default=APARAMS.get('ipa-advertise-host', None),
|
|
help='The host to tell Ironic to reply and send '
|
|
'commands to. '
|
|
'Can be supplied as "ipa-advertise-host" '
|
|
'kernel parameter.'),
|
|
|
|
cfg.PortOpt('advertise_port',
|
|
default=int(APARAMS.get('ipa-advertise-port', 9999)),
|
|
help='The port to tell Ironic to reply and send '
|
|
'commands to. '
|
|
'Can be supplied as "ipa-advertise-port" '
|
|
'kernel parameter.'),
|
|
|
|
cfg.StrOpt('advertise_protocol',
|
|
default=APARAMS.get('ipa-advertise-protocol', 'http'),
|
|
choices=['http', 'https'],
|
|
help='Protocol to use for the callback URL. HTTP is used by '
|
|
'default, set to "https" if you have HTTPS configured.'),
|
|
|
|
cfg.IntOpt('ip_lookup_attempts',
|
|
min=1,
|
|
default=int(APARAMS.get('ipa-ip-lookup-attempts', 6)),
|
|
help='The number of times to try and automatically '
|
|
'determine the agent IPv4 address. '
|
|
'Can be supplied as "ipa-ip-lookup-attempts" '
|
|
'kernel parameter.'),
|
|
|
|
cfg.IntOpt('ip_lookup_sleep',
|
|
min=0,
|
|
default=int(APARAMS.get('ipa-ip-lookup-timeout', 10)),
|
|
help='The amount of time to sleep between attempts '
|
|
'to determine IP address. '
|
|
'Can be supplied as "ipa-ip-lookup-timeout" '
|
|
'kernel parameter.'),
|
|
|
|
cfg.StrOpt('network_interface',
|
|
default=APARAMS.get('ipa-network-interface', None),
|
|
help='The interface to use when looking for an IP address. '
|
|
'Can be supplied as "ipa-network-interface" '
|
|
'kernel parameter.'),
|
|
|
|
cfg.IntOpt('lookup_timeout',
|
|
min=0,
|
|
default=int(APARAMS.get('ipa-lookup-timeout', 600)),
|
|
help='The amount of time to retry the initial lookup '
|
|
'call to Ironic. After the timeout, the agent '
|
|
'will exit with a non-zero exit code. '
|
|
'Can be supplied as "ipa-lookup-timeout" '
|
|
'kernel parameter.'),
|
|
|
|
cfg.IntOpt('lookup_interval',
|
|
min=0,
|
|
default=int(APARAMS.get('ipa-lookup-interval', 1)),
|
|
help='The initial interval for retries on the initial '
|
|
'lookup call to Ironic. The interval will be '
|
|
'doubled after each failure until timeout is '
|
|
'exceeded. '
|
|
'Can be supplied as "ipa-lookup-interval" '
|
|
'kernel parameter.'),
|
|
|
|
cfg.FloatOpt('lldp_timeout',
|
|
default=APARAMS.get('ipa-lldp-timeout', 30.0),
|
|
help='The amount of seconds to wait for LLDP packets. '
|
|
'Can be supplied as "ipa-lldp-timeout" '
|
|
'kernel parameter.'),
|
|
|
|
cfg.BoolOpt('collect_lldp',
|
|
default=APARAMS.get('ipa-collect-lldp', False),
|
|
help='Whether IPA should attempt to receive LLDP packets for '
|
|
'each network interface it discovers in the inventory. '
|
|
'Can be supplied as "ipa-collect-lldp" '
|
|
'kernel parameter.',
|
|
deprecated_for_removal=True,
|
|
deprecated_reason="Use the lldp collector instead"),
|
|
|
|
cfg.StrOpt('inspection_callback_url',
|
|
default=APARAMS.get('ipa-inspection-callback-url'),
|
|
help='Endpoint(s) to send inspection data to. If set, hardware '
|
|
'inventory will be collected and sent there on start up. '
|
|
'A special value "mdns" can be specified to fetch the '
|
|
'URL using multicast DNS service discovery. '
|
|
'Can be supplied as "ipa-inspection-callback-url" '
|
|
'kernel parameter. If the URL is not provided but '
|
|
'inspection_collectors is not empty, the URL is detected '
|
|
'from api_url.'),
|
|
|
|
cfg.StrOpt('inspection_collectors',
|
|
default=APARAMS.get('ipa-inspection-collectors'),
|
|
help='Comma-separated list of plugins providing additional '
|
|
'hardware data for inspection. The default are %s. '
|
|
'Can be supplied as "ipa-inspection-collectors" '
|
|
'kernel parameter.'
|
|
% INSPECTION_DEFAULT_COLLECTORS),
|
|
|
|
cfg.IntOpt('inspection_dhcp_wait_timeout',
|
|
min=0,
|
|
default=APARAMS.get('ipa-inspection-dhcp-wait-timeout',
|
|
INSPECTION_DEFAULT_DHCP_WAIT_TIMEOUT),
|
|
help='Maximum time (in seconds) to wait for the PXE NIC '
|
|
'(or all NICs if inspection_dhcp_all_interfaces is True) '
|
|
'to get its IP address via DHCP before inspection. '
|
|
'Set to 0 to disable waiting completely. '
|
|
'Can be supplied as "ipa-inspection-dhcp-wait-timeout" '
|
|
'kernel parameter.'),
|
|
|
|
cfg.BoolOpt('inspection_dhcp_all_interfaces',
|
|
default=APARAMS.get('ipa-inspection-dhcp-all-interfaces',
|
|
False),
|
|
help='Whether to wait for all interfaces to get their IP '
|
|
'addresses before inspection. If set to false '
|
|
'(the default), only waits for the PXE interface. '
|
|
'Can be supplied as '
|
|
'"ipa-inspection-dhcp-all-interfaces" '
|
|
'kernel parameter.'),
|
|
|
|
cfg.IntOpt('hardware_initialization_delay',
|
|
min=0,
|
|
default=APARAMS.get('ipa-hardware-initialization-delay', 0),
|
|
help='How much time (in seconds) to wait for hardware to '
|
|
'initialize before proceeding with any actions. '
|
|
'Can be supplied as "ipa-hardware-initialization-delay" '
|
|
'kernel parameter.'),
|
|
|
|
cfg.IntOpt('disk_wait_attempts',
|
|
min=0,
|
|
default=APARAMS.get('ipa-disk-wait-attempts', 10),
|
|
help='The number of times to try and check to see if '
|
|
'at least one suitable disk has appeared in inventory '
|
|
'before proceeding with any actions. '
|
|
'Can be supplied as "ipa-disk-wait-attempts" '
|
|
'kernel parameter.'),
|
|
|
|
cfg.IntOpt('disk_wait_delay',
|
|
min=0,
|
|
default=APARAMS.get('ipa-disk-wait-delay', 3),
|
|
help='How much time (in seconds) to wait between attempts '
|
|
'to check if at least one suitable disk has appeared '
|
|
'in inventory. Set to zero to disable. '
|
|
'Can be supplied as "ipa-disk-wait-delay" '
|
|
'kernel parameter.'),
|
|
cfg.BoolOpt('insecure',
|
|
default=APARAMS.get('ipa-insecure', False),
|
|
help='Verify HTTPS connections. Can be supplied as '
|
|
'"ipa-insecure" kernel parameter.'),
|
|
cfg.StrOpt('cafile',
|
|
help='Path to PEM encoded Certificate Authority file '
|
|
'to use when verifying HTTPS connections. '
|
|
'Default is to use available system-wide configured CAs.'),
|
|
cfg.StrOpt('certfile',
|
|
help='Path to PEM encoded client certificate cert file. '
|
|
'Must be provided together with "keyfile" option. '
|
|
'Default is to not present any client certificates to '
|
|
'the server.'),
|
|
cfg.StrOpt('keyfile',
|
|
help='Path to PEM encoded client certificate key file. '
|
|
'Must be provided together with "certfile" option. '
|
|
'Default is to not present any client certificates to '
|
|
'the server.'),
|
|
cfg.BoolOpt('introspection_daemon',
|
|
default=False,
|
|
help='When the ``ironic-collect-introspection-data`` '
|
|
'command is executed, continue running as '
|
|
'a background process and continue to post data '
|
|
'to the bare metal inspection service.'),
|
|
cfg.IntOpt('introspection_daemon_post_interval',
|
|
default=300,
|
|
help='The interval in seconds by which to transmit data to '
|
|
'the bare metal introspection service when the '
|
|
'``ironic-collect-introspection-data`` program is '
|
|
'executing in daemon mode.'),
|
|
cfg.StrOpt('ntp_server',
|
|
default=APARAMS.get('ipa-ntp-server', None),
|
|
help='Address of a single NTP server against which the '
|
|
'agent should sync the hardware clock prior to '
|
|
'rebooting to an instance.'),
|
|
cfg.BoolOpt('fail_if_clock_not_set',
|
|
default=False,
|
|
help='If operations should fail if the clock time sync '
|
|
'fails to complete successfully.'),
|
|
cfg.StrOpt('agent_token',
|
|
default=APARAMS.get('ipa-agent-token'),
|
|
help='Pre-shared token to use when working with the '
|
|
'ironic API. This value is typically supplied by '
|
|
'ironic automatically.'),
|
|
cfg.StrOpt('image_server_user',
|
|
default=None,
|
|
help='Pre-shared username used in Basic Auth process '
|
|
'against the http(s) server that hosts the disk image.'
|
|
'This variable can be also configured via image_info.'
|
|
'Value coming from image_info takes precedence over'
|
|
'value coming from command line or configuration file.'),
|
|
cfg.StrOpt('image_server_password',
|
|
default=None,
|
|
help='Pre-shared password used in Basic Auth process '
|
|
'against the http(s) server that hosts the disk image.'
|
|
'This variable can be also configured via image_info.'
|
|
'Value coming from image_info takes precedence over'
|
|
'value coming from command line or configuration file.'),
|
|
cfg.StrOpt('image_server_auth_strategy',
|
|
default="noauth",
|
|
help='Option to select authentication strategy used during'
|
|
'communication with the server that hosts the disk images'
|
|
'and related checksums. This option also turns'
|
|
'image_server_password and image_server_user'
|
|
'into mandatory variables for those authentication'
|
|
'strategies that require username + password credentials.'
|
|
'This variable can be also configured via image_info.'
|
|
'Value coming from image_info takes precedence over'
|
|
'value coming from command line or configuration file.'),
|
|
cfg.BoolOpt('agent_token_required',
|
|
default=APARAMS.get('ipa-agent-token-required', False),
|
|
help='Control to enforce if API command requests should '
|
|
'enforce token validation. The configuration provided '
|
|
'by the conductor MAY override this and force this '
|
|
'setting to be changed to True in memory.'),
|
|
cfg.IntOpt('image_download_connection_timeout', min=1,
|
|
default=APARAMS.get(
|
|
'ipa-image-download-connection-timeout', 60),
|
|
help='The connection timeout (in seconds) when downloading '
|
|
'an image. Does not affect the whole download.'),
|
|
cfg.IntOpt('image_download_connection_retries', min=0,
|
|
default=APARAMS.get('ipa-image-download-connection-retries', 9),
|
|
help='How many times to retry the connection when downloading '
|
|
'an image. Also retries on failure HTTP statuses.'),
|
|
cfg.IntOpt('image_download_connection_retry_interval', min=0,
|
|
default=APARAMS.get(
|
|
'ipa-image-download-connection-retry-interval', 10),
|
|
help='Interval (in seconds) between two attempts to establish '
|
|
'connection when downloading an image.'),
|
|
cfg.StrOpt('ironic_api_version',
|
|
default=APARAMS.get('ipa-ironic-api-version', None),
|
|
help='Ironic API version in format "x.x". If not set, the API '
|
|
'version will be auto-detected. Defining an API version '
|
|
'using this setting is not advisiable nor recommended as '
|
|
'it blocks auto-detection of the API version. '
|
|
'This is an advanced override setting which may only '
|
|
'be useful if the environment requires API version '
|
|
'auto-detection to be disabled or blocked.'),
|
|
cfg.StrOpt('enable_vlan_interfaces',
|
|
default=APARAMS.get('ipa-enable-vlan-interfaces', ''),
|
|
help='Comma-separated list of VLAN interfaces to enable, '
|
|
'in the format "interface.vlan". If only an '
|
|
'interface is provided, then IPA should attempt to '
|
|
'bring up all VLANs on that interface detected '
|
|
'via lldp. If "all" is set then IPA should attempt '
|
|
'to bring up all VLANs from lldp on all interfaces. '
|
|
'By default, no VLANs will be brought up.'),
|
|
cfg.BoolOpt('ignore_bootloader_failure',
|
|
default=APARAMS.get('ipa-ignore-bootloader-failure'),
|
|
help='If the agent should ignore failures to install a '
|
|
'bootloader configuration into UEFI NVRAM. This '
|
|
'option should only be considered if the hardware '
|
|
'is automatically searching and adding UEFI '
|
|
'bootloaders from partitions. Use on a system '
|
|
'which is NOT doing this will likely cause the '
|
|
'deployment to fail. This setting should only be '
|
|
'used if you are absolutely sure of what you are '
|
|
'doing and that your hardware supports '
|
|
'such functionality. Hint: Most hardware does not.'),
|
|
cfg.IntOpt('inject_files_priority',
|
|
default=APARAMS.get('ipa-inject-files-priority', 0),
|
|
min=0, max=99, # 100 is when IPA is booted
|
|
help='Priority of the inject_files deploy step (disabled '
|
|
'by default), an integer between 1 and .'),
|
|
cfg.BoolOpt('guard-special-filesystems',
|
|
default=APARAMS.get('ipa-guard-special-filesystems', True),
|
|
help='Guard "special" shared device filesystems from '
|
|
'cleaning by the stock hardware manager\'s cleaning '
|
|
'methods. If one of these filesystems is detected '
|
|
'during cleaning, the cleaning process will be aborted '
|
|
'and infrastructure operator intervention may be '
|
|
'required as this option is intended to prevent '
|
|
'cleaning from inadvertently destroying a running '
|
|
'cluster which may be visible over a storage fabric '
|
|
'such as FibreChannel.'),
|
|
cfg.BoolOpt('md5_enabled',
|
|
default=True,
|
|
help='If the MD5 algorithm is enabled for file checksums. '
|
|
'Will be changed to False in the future.'),
|
|
cfg.IntOpt('http_request_timeout',
|
|
default=APARAMS.get('ipa-http-request-timeout', 30),
|
|
min=1,
|
|
help='Time in seconds to wait for an HTTP request TCP socket '
|
|
'used by an API request to a remote service to enter '
|
|
'a state where a request can be transmitted.'),
|
|
cfg.BoolOpt('config_drive_rebuild',
|
|
default=False,
|
|
help='If the agent should rebuild the configuration drive '
|
|
'using a local filesystem, instead of letting Ironic '
|
|
'determine if this action is necessary.'),
|
|
]
|
|
|
|
disk_utils_opts = [
|
|
cfg.IntOpt('efi_system_partition_size',
|
|
default=550,
|
|
help='Size of EFI system partition in MiB when configuring '
|
|
'UEFI systems for local boot. A common minimum is ~200 '
|
|
'megabytes, however OS driven firmware updates and '
|
|
'unikernel usage generally requires more space on the '
|
|
'efi partition.'),
|
|
cfg.IntOpt('bios_boot_partition_size',
|
|
default=1,
|
|
help='Size of BIOS Boot partition in MiB when configuring '
|
|
'GPT partitioned systems for local boot in BIOS.'),
|
|
cfg.StrOpt('dd_block_size',
|
|
default='1M',
|
|
help='Block size to use when writing to the nodes disk.'),
|
|
cfg.IntOpt('partition_detection_attempts',
|
|
default=3,
|
|
min=1,
|
|
help='Maximum attempts to detect a newly created partition.'),
|
|
cfg.IntOpt('partprobe_attempts',
|
|
default=10,
|
|
help='Maximum number of attempts to try to read the '
|
|
'partition.'),
|
|
]
|
|
|
|
disk_part_opts = [
|
|
cfg.IntOpt('check_device_interval',
|
|
default=1,
|
|
help='After Ironic has completed creating the partition table, '
|
|
'it continues to check for activity on the attached iSCSI '
|
|
'device status at this interval prior to copying the image'
|
|
' to the node, in seconds'),
|
|
cfg.IntOpt('check_device_max_retries',
|
|
default=20,
|
|
help='The maximum number of times to check that the device is '
|
|
'not accessed by another process. If the device is still '
|
|
'busy after that, the disk partitioning will be treated as'
|
|
' having failed.')
|
|
]
|
|
|
|
CONF.register_cli_opts(cli_opts)
|
|
CONF.register_opts(disk_utils_opts, group='disk_utils')
|
|
CONF.register_opts(disk_part_opts, group='disk_partitioner')
|
|
|
|
|
|
def list_opts():
|
|
return [('DEFAULT', cli_opts),
|
|
('disk_utils', disk_utils_opts),
|
|
('disk_partitioner', disk_part_opts)]
|
|
|
|
|
|
def override(params):
|
|
"""Override configuration with values from a dictionary.
|
|
|
|
This is used for configuration overrides from mDNS.
|
|
|
|
:param params: new configuration parameters as a dict.
|
|
"""
|
|
if not params:
|
|
return
|
|
|
|
LOG.debug('Overriding configuration with %s', params)
|
|
for key, value in params.items():
|
|
if key.startswith('ipa_'):
|
|
key = key[4:]
|
|
else:
|
|
LOG.warning('Skipping unknown configuration option %s', key)
|
|
continue
|
|
|
|
try:
|
|
CONF.set_override(key, value)
|
|
except Exception as exc:
|
|
LOG.warning('Unable to override configuration option %(key)s '
|
|
'with %(value)r: %(exc)s',
|
|
{'key': key, 'value': value, 'exc': exc})
|