From 5838bd0b3c12eed1514e59852564006f044f241b Mon Sep 17 00:00:00 2001 From: "Michal (inc0) Jastrzebski" Date: Thu, 9 Jun 2016 20:29:54 +0000 Subject: [PATCH] Enable kolla k8s to override bind api bind address in genconfig It's good if k8s reuses ansible templates, but we need to abstract all ansible specific variables to achieve that. - Implements ansible override variable api_interface_address. - Adds api_interface_address setting and comments to globals.yml - Makes changes to mariadb templates to accept this new setting. - Disabled Galera when api_interface_address==0.0.0.0 in the case of Kubernetes. Otherwise, mariadb fails to start. - Tested with and without setting to ensure kolla genconfig output does not change when setting is disabled or undefined. Change-Id: Ia0e4951c327be01b717aebb86ef4c3a4e7ed170e Partially-implements: blueprint api-interface-bind-address-override Co-authored-by: David Wang Co-authored-by: Ryan Hallisey Co-authored-by: Kevin Fox --- ansible/group_vars/all.yml | 17 +++++++++++++++++ ansible/roles/mariadb/templates/galera.cnf.j2 | 15 ++++++++++----- .../roles/mariadb/templates/wsrep-notify.sh.j2 | 2 +- 3 files changed, 28 insertions(+), 6 deletions(-) diff --git a/ansible/group_vars/all.yml b/ansible/group_vars/all.yml index ed6b6c15f4..e5ff91e3be 100644 --- a/ansible/group_vars/all.yml +++ b/ansible/group_vars/all.yml @@ -19,6 +19,10 @@ node_config_directory: "/etc/kolla/{{ project }}" ################### # Kolla options ################### + +# Which orchestration engine to use. Valid options are [ ANSIBLE, KUBERNETES ] +orchestration_engine: "ANSIBLE" + # Valid options are [ COPY_ONCE, COPY_ALWAYS ] config_strategy: "COPY_ALWAYS" @@ -39,6 +43,19 @@ kolla_enable_sanity_glance: "{{ kolla_enable_sanity_checks }}" kolla_enable_sanity_cinder: "{{ kolla_enable_sanity_checks }}" kolla_enable_sanity_swift: "{{ kolla_enable_sanity_checks }}" + +#################### +# kolla-kubernetes +#################### +# By default, Kolla API services bind to the network address assigned +# to the api_interface. Allow the bind address to be an override. In +# some cases (Kubernetes), the api_interface address is not known +# until container runtime, and thus it is necessary to bind to all +# interfaces "0.0.0.0". When used outside of Kubernetes, binding to +# all interfaces may present a security issue, and thus is not +# recommended. +api_interface_address: "{{ hostvars[inventory_hostname]['ansible_' + api_interface]['ipv4']['address'] if orchestration_engine == 'ANSIBLE' else '0.0.0.0' }}" + #################### # Database options #################### diff --git a/ansible/roles/mariadb/templates/galera.cnf.j2 b/ansible/roles/mariadb/templates/galera.cnf.j2 index 7ffcb26a05..3dcb5f8670 100644 --- a/ansible/roles/mariadb/templates/galera.cnf.j2 +++ b/ansible/roles/mariadb/templates/galera.cnf.j2 @@ -1,6 +1,11 @@ -{% set wsrep_driver = '/usr/lib/galera/libgalera_smm.so' if kolla_base_distro == 'ubuntu' else '/usr/lib64/galera/libgalera_smm.so' %} +{%- set wsrep_driver = '/usr/lib/galera/libgalera_smm.so' if kolla_base_distro == 'ubuntu' else '/usr/lib64/galera/libgalera_smm.so' %} + +{#- Disable Galera in the case of of Kubernetes as its not supported yet. Otherwise, #} +{#- mariadb will fail to start #} +{%- set wsrep_driver = 'none' if orchestration_engine == 'KUBERNETES' else wsrep_driver %} + [mysqld] -bind-address={{ hostvars[inventory_hostname]['ansible_' + api_interface]['ipv4']['address'] }} +bind-address={{ api_interface_address }} port={{ mariadb_port }} log-error=/var/log/kolla/mariadb/mariadb.log @@ -13,10 +18,10 @@ datadir=/var/lib/mysql/ wsrep_cluster_address=gcomm://{% if (groups['mariadb'] | length) > 1 %}{% for host in groups['mariadb'] %}{{ hostvars[host]['ansible_' + hostvars[host]['api_interface']]['ipv4']['address'] }}:{{ mariadb_wsrep_port }}{% if not loop.last %},{% endif %}{% endfor %}{% endif %} -wsrep_provider_options=gmcast.listen_addr=tcp://{{ hostvars[inventory_hostname]['ansible_' + api_interface]['ipv4']['address'] }}:{{ mariadb_wsrep_port }};ist.recv_addr={{ hostvars[inventory_hostname]['ansible_' + api_interface]['ipv4']['address'] }}:{{ mariadb_ist_port }} +wsrep_provider_options=gmcast.listen_addr=tcp://{{ api_interface_address }}:{{ mariadb_wsrep_port }};ist.recv_addr={{ api_interface_address }}:{{ mariadb_ist_port }} -wsrep_node_address={{ hostvars[inventory_hostname]['ansible_' + api_interface]['ipv4']['address'] }}:{{ mariadb_wsrep_port }} -wsrep_sst_receive_address={{ hostvars[inventory_hostname]['ansible_' + api_interface]['ipv4']['address'] }}:{{ mariadb_sst_port }} +wsrep_node_address={{ api_interface_address }}:{{ mariadb_wsrep_port }} +wsrep_sst_receive_address={{ api_interface_address }}:{{ mariadb_sst_port }} wsrep_provider={{ wsrep_driver }} wsrep_cluster_name="{{ database_cluster_name }}" diff --git a/ansible/roles/mariadb/templates/wsrep-notify.sh.j2 b/ansible/roles/mariadb/templates/wsrep-notify.sh.j2 index babd29e86e..73acde3fe6 100644 --- a/ansible/roles/mariadb/templates/wsrep-notify.sh.j2 +++ b/ansible/roles/mariadb/templates/wsrep-notify.sh.j2 @@ -3,7 +3,7 @@ # Edit parameters below to specify the address and login to server. USER={{ database_user }} PSWD={{ database_password }} -HOST={{ hostvars[inventory_hostname]['ansible_' + api_interface]['ipv4']['address'] }} +HOST={{ api_interface_address }} PORT={{ mariadb_port }} LB_USER=haproxy