Container Infrastructure Management Service for OpenStack
You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

423 lines
15KB

  1. #!/bin/bash
  2. #
  3. # lib/magnum
  4. # Functions to control the configuration and operation of the **magnum** service
  5. # Dependencies:
  6. #
  7. # - ``functions`` file
  8. # - ``DEST``, ``DATA_DIR``, ``STACK_USER`` must be defined
  9. # - ``SERVICE_{TENANT_NAME|PASSWORD}`` must be defined
  10. # ``stack.sh`` calls the entry points in this order:
  11. #
  12. # - install_magnum
  13. # - configure_magnum
  14. # - create_magnum_conf
  15. # - init_magnum
  16. # - magnum_register_image
  17. # - magnum_configure_flavor
  18. # - start_magnum
  19. # - configure_iptables_magnum
  20. # - configure_apache_magnum
  21. # - stop_magnum
  22. # - cleanup_magnum
  23. # Save trace setting
  24. XTRACE=$(set +o | grep xtrace)
  25. set +o xtrace
  26. # Defaults
  27. # --------
  28. # Set up default directories
  29. MAGNUM_REPO=${MAGNUM_REPO:-${GIT_BASE}/openstack/magnum.git}
  30. MAGNUM_BRANCH=${MAGNUM_BRANCH:-master}
  31. MAGNUM_DIR=$DEST/magnum
  32. GITREPO["python-magnumclient"]=${MAGNUMCLIENT_REPO:-${GIT_BASE}/openstack/python-magnumclient.git}
  33. GITBRANCH["python-magnumclient"]=${MAGNUMCLIENT_BRANCH:-master}
  34. GITDIR["python-magnumclient"]=$DEST/python-magnumclient
  35. MAGNUM_STATE_PATH=${MAGNUM_STATE_PATH:=$DATA_DIR/magnum}
  36. MAGNUM_AUTH_CACHE_DIR=${MAGNUM_AUTH_CACHE_DIR:-/var/cache/magnum}
  37. MAGNUM_CERTIFICATE_CACHE_DIR=${MAGNUM_CERTIFICATE_CACHE_DIR:-/var/lib/magnum/certificate-cache}
  38. MAGNUM_CONF_DIR=/etc/magnum
  39. MAGNUM_CONF=$MAGNUM_CONF_DIR/magnum.conf
  40. MAGNUM_API_PASTE=$MAGNUM_CONF_DIR/api-paste.ini
  41. MAGNUM_POLICY=$MAGNUM_CONF_DIR/policy.yaml
  42. if is_ssl_enabled_service "magnum" || is_service_enabled tls-proxy; then
  43. MAGNUM_SERVICE_PROTOCOL="https"
  44. fi
  45. # Public facing bits
  46. MAGNUM_SERVICE_HOST=${MAGNUM_SERVICE_HOST:-$HOST_IP}
  47. MAGNUM_SERVICE_PORT=${MAGNUM_SERVICE_PORT:-9511}
  48. MAGNUM_SERVICE_PORT_INT=${MAGNUM_SERVICE_PORT_INT:-19511}
  49. MAGNUM_SERVICE_PROTOCOL=${MAGNUM_SERVICE_PROTOCOL:-$SERVICE_PROTOCOL}
  50. MAGNUM_TRUSTEE_DOMAIN_ADMIN_PASSWORD=${MAGNUM_TRUSTEE_DOMAIN_ADMIN_PASSWORD:-secret}
  51. MAGNUM_SWIFT_REGISTRY_CONTAINER=${MAGNUM_SWIFT_REGISTRY_CONTAINER:-docker_registry}
  52. # Support entry points installation of console scripts
  53. if [[ -d $MAGNUM_DIR/bin ]]; then
  54. MAGNUM_BIN_DIR=$MAGNUM_DIR/bin
  55. else
  56. MAGNUM_BIN_DIR=$(get_python_exec_prefix)
  57. fi
  58. MAGNUM_CONFIGURE_IPTABLES=${MAGNUM_CONFIGURE_IPTABLES:-True}
  59. # Functions
  60. # ---------
  61. # Test if any magnum services are enabled
  62. # is_magnum_enabled
  63. function is_magnum_enabled {
  64. [[ ,${ENABLED_SERVICES} =~ ,"magnum-" ]] && return 0
  65. return 1
  66. }
  67. # cleanup_magnum() - Remove residual data files, anything left over from previous
  68. # runs that a clean run would need to clean up
  69. function cleanup_magnum {
  70. sudo rm -rf $MAGNUM_STATE_PATH $MAGNUM_AUTH_CACHE_DIR $MAGNUM_CERTIFICATE_CACHE_DIR
  71. }
  72. # configure_magnum() - Set config files, create data dirs, etc
  73. function configure_magnum {
  74. # Put config files in ``/etc/magnum`` for everyone to find
  75. if [[ ! -d $MAGNUM_CONF_DIR ]]; then
  76. sudo mkdir -p $MAGNUM_CONF_DIR
  77. sudo chown $STACK_USER $MAGNUM_CONF_DIR
  78. fi
  79. # Rebuild the config file from scratch
  80. create_magnum_conf
  81. create_api_paste_conf
  82. }
  83. # create_magnum_accounts() - Set up common required magnum accounts
  84. #
  85. # Project User Roles
  86. # ------------------------------------------------------------------
  87. # SERVICE_PROJECT_NAME magnum service
  88. function create_magnum_accounts {
  89. create_service_user "magnum" "admin"
  90. local magnum_service=$(get_or_create_service "magnum" \
  91. "container-infra" "Container Infrastructure Management Service")
  92. get_or_create_endpoint $magnum_service \
  93. "$REGION_NAME" \
  94. "$MAGNUM_SERVICE_PROTOCOL://$MAGNUM_SERVICE_HOST:$MAGNUM_SERVICE_PORT/v1" \
  95. "$MAGNUM_SERVICE_PROTOCOL://$MAGNUM_SERVICE_HOST:$MAGNUM_SERVICE_PORT/v1" \
  96. "$MAGNUM_SERVICE_PROTOCOL://$MAGNUM_SERVICE_HOST:$MAGNUM_SERVICE_PORT/v1"
  97. }
  98. # create_magnum_conf() - Create a new magnum.conf file
  99. function create_magnum_conf {
  100. # (Re)create ``magnum.conf``
  101. rm -f $MAGNUM_CONF
  102. HOSTNAME=`hostname`
  103. iniset $MAGNUM_CONF DEFAULT debug "$ENABLE_DEBUG_LOG_LEVEL"
  104. iniset $MAGNUM_CONF DEFAULT transport_url \
  105. "rabbit://$RABBIT_USERID:$RABBIT_PASSWORD@$RABBIT_HOST"
  106. iniset $MAGNUM_CONF DEFAULT host "$HOSTNAME"
  107. iniset $MAGNUM_CONF database connection `database_connection_url magnum`
  108. iniset $MAGNUM_CONF api host "$MAGNUM_SERVICE_HOST"
  109. if is_service_enabled tls-proxy; then
  110. iniset $MAGNUM_CONF api port "$MAGNUM_SERVICE_PORT_INT"
  111. iniset $MAGNUM_CONF drivers verify_ca true
  112. iniset $MAGNUM_CONF drivers openstack_ca_file $SSL_BUNDLE_FILE
  113. else
  114. iniset $MAGNUM_CONF api port "$MAGNUM_SERVICE_PORT"
  115. iniset $MAGNUM_CONF drivers verify_ca false
  116. fi
  117. iniset $MAGNUM_CONF cluster temp_cache_dir $MAGNUM_CERTIFICATE_CACHE_DIR
  118. iniset $MAGNUM_CONF oslo_policy policy_file $MAGNUM_POLICY
  119. iniset $MAGNUM_CONF keystone_auth auth_type password
  120. iniset $MAGNUM_CONF keystone_auth username magnum
  121. iniset $MAGNUM_CONF keystone_auth password $SERVICE_PASSWORD
  122. iniset $MAGNUM_CONF keystone_auth project_name $SERVICE_PROJECT_NAME
  123. iniset $MAGNUM_CONF keystone_auth project_domain_id default
  124. iniset $MAGNUM_CONF keystone_auth user_domain_id default
  125. # FIXME(pauloewerton): keystone_authtoken section is deprecated. Remove it
  126. # after deprecation period.
  127. iniset $MAGNUM_CONF keystone_authtoken admin_user magnum
  128. iniset $MAGNUM_CONF keystone_authtoken admin_password $SERVICE_PASSWORD
  129. iniset $MAGNUM_CONF keystone_authtoken admin_tenant_name $SERVICE_PROJECT_NAME
  130. configure_auth_token_middleware $MAGNUM_CONF magnum $MAGNUM_AUTH_CACHE_DIR
  131. iniset $MAGNUM_CONF keystone_auth auth_url $KEYSTONE_AUTH_URI_V3
  132. iniset $MAGNUM_CONF keystone_authtoken www_authenticate_uri $KEYSTONE_SERVICE_URI_V3
  133. iniset $MAGNUM_CONF keystone_authtoken auth_url $KEYSTONE_AUTH_URI_V3
  134. iniset $MAGNUM_CONF keystone_authtoken auth_version v3
  135. if is_fedora || is_suse; then
  136. # magnum defaults to /usr/local/bin, but fedora and suse pip like to
  137. # install things in /usr/bin
  138. iniset $MAGNUM_CONF DEFAULT bindir "/usr/bin"
  139. fi
  140. if [ -n "$MAGNUM_STATE_PATH" ]; then
  141. iniset $MAGNUM_CONF DEFAULT state_path "$MAGNUM_STATE_PATH"
  142. iniset $MAGNUM_CONF oslo_concurrency lock_path "$MAGNUM_STATE_PATH"
  143. fi
  144. if [ "$USE_SYSTEMD" != "False" ]; then
  145. setup_systemd_logging $MAGNUM_CONF
  146. fi
  147. # Format logging
  148. if [ "$LOG_COLOR" == "True" ] && [ "$USE_SYSTEMD" == "False" ]; then
  149. setup_colorized_logging $MAGNUM_CONF DEFAULT
  150. fi
  151. # Register SSL certificates if provided
  152. if is_ssl_enabled_service magnum; then
  153. ensure_certificates MAGNUM
  154. iniset $MAGNUM_CONF DEFAULT ssl_cert_file "$MAGNUM_SSL_CERT"
  155. iniset $MAGNUM_CONF DEFAULT ssl_key_file "$MAGNUM_SSL_KEY"
  156. iniset $MAGNUM_CONF DEFAULT enabled_ssl_apis "$MAGNUM_ENABLED_APIS"
  157. fi
  158. if is_service_enabled ceilometer; then
  159. iniset $MAGNUM_CONF oslo_messaging_notifications driver "messaging"
  160. fi
  161. if is_service_enabled barbican; then
  162. iniset $MAGNUM_CONF certificates cert_manager_type "barbican"
  163. else
  164. iniset $MAGNUM_CONF certificates cert_manager_type "x509keypair"
  165. fi
  166. trustee_domain_id=$(get_or_create_domain magnum 'Owns users and projects created by magnum')
  167. trustee_domain_admin_id=$(get_or_create_user trustee_domain_admin $MAGNUM_TRUSTEE_DOMAIN_ADMIN_PASSWORD $trustee_domain_id)
  168. openstack --os-auth-url $KEYSTONE_SERVICE_URI_V3 \
  169. --os-identity-api-version 3 role add \
  170. --user $trustee_domain_admin_id --domain $trustee_domain_id \
  171. admin
  172. iniset $MAGNUM_CONF trust cluster_user_trust True
  173. iniset $MAGNUM_CONF trust trustee_domain_name magnum
  174. iniset $MAGNUM_CONF trust trustee_domain_admin_name trustee_domain_admin
  175. iniset $MAGNUM_CONF trust trustee_domain_admin_password $MAGNUM_TRUSTEE_DOMAIN_ADMIN_PASSWORD
  176. iniset $MAGNUM_CONF trust trustee_keystone_interface public
  177. iniset $MAGNUM_CONF cinder_client region_name $REGION_NAME
  178. if is_service_enabled swift; then
  179. iniset $MAGNUM_CONF docker_registry swift_region $REGION_NAME
  180. iniset $MAGNUM_CONF docker_registry swift_registry_container $MAGNUM_SWIFT_REGISTRY_CONTAINER
  181. fi
  182. # Get the default volume type from cinder.conf and set the coresponding
  183. # default in magnum.conf
  184. default_volume_type=$(iniget /etc/cinder/cinder.conf DEFAULT default_volume_type)
  185. iniset $MAGNUM_CONF cinder default_docker_volume_type $default_volume_type
  186. iniset $MAGNUM_CONF drivers send_cluster_metrics False
  187. }
  188. function create_api_paste_conf {
  189. # copy api_paste.ini
  190. cp $MAGNUM_DIR/etc/magnum/api-paste.ini $MAGNUM_API_PASTE
  191. }
  192. # create_magnum_cache_dir() - Part of the init_magnum() process
  193. function create_magnum_cache_dir {
  194. # Create cache dir
  195. sudo mkdir -p $1
  196. sudo chown $STACK_USER $1
  197. rm -f $1/*
  198. }
  199. # init_magnum() - Initialize databases, etc.
  200. function init_magnum {
  201. # Only do this step once on the API node for an entire cluster.
  202. if is_service_enabled $DATABASE_BACKENDS && is_service_enabled magnum-api; then
  203. # (Re)create magnum database
  204. recreate_database magnum
  205. # Migrate magnum database
  206. $MAGNUM_BIN_DIR/magnum-db-manage upgrade
  207. fi
  208. create_magnum_cache_dir $MAGNUM_AUTH_CACHE_DIR
  209. create_magnum_cache_dir $MAGNUM_CERTIFICATE_CACHE_DIR
  210. }
  211. # magnum_register_image - Register heat image for magnum with property os_distro
  212. function magnum_register_image {
  213. local magnum_image_property="--property os_distro="
  214. local atomic="$(echo $MAGNUM_GUEST_IMAGE_URL | grep -io 'atomic' || true;)"
  215. if [ ! -z "$atomic" ]; then
  216. magnum_image_property=$magnum_image_property"fedora-atomic --property hw_rng_model=virtio"
  217. fi
  218. local ubuntu="$(echo $MAGNUM_GUEST_IMAGE_URL | grep -io "ubuntu" || true;)"
  219. if [ ! -z "$ubuntu" ]; then
  220. magnum_image_property=$magnum_image_property"ubuntu"
  221. fi
  222. local coreos="$(echo $MAGNUM_GUEST_IMAGE_URL | grep -io "coreos" || true;)"
  223. if [ ! -z "$coreos" ]; then
  224. magnum_image_property=$magnum_image_property"coreos"
  225. fi
  226. # os_distro property for fedora ironic image
  227. local fedora_ironic="$(echo $MAGNUM_GUEST_IMAGE_URL | grep -i "ironic" \
  228. | grep -io "fedora" || true;)"
  229. if [ ! -z "$fedora_ironic" ]; then
  230. magnum_image_property=$magnum_image_property"fedora"
  231. fi
  232. # get the image name
  233. local image_filename=$(basename "$MAGNUM_GUEST_IMAGE_URL")
  234. local image_name=""
  235. for extension in "tgz" "img" "qcow2" "iso" "vhd" "vhdx" "tar.gz" "img.gz" "img.bz2" "vhd.gz" "vhdx.gz"
  236. do
  237. if [ $(expr match "${image_filename}" ".*\.${extension}$") -ne 0 ]; then
  238. image_name=$(basename "$image_filename" ".${extension}")
  239. break
  240. fi
  241. done
  242. if [ -z ${image_name} ]; then
  243. echo "Unknown image extension in $image_filename, supported extensions: tgz, img, qcow2, iso, vhd, vhdx, tar.gz, img.gz, img.bz2, vhd.gz, vhdx.gz"; false
  244. fi
  245. openstack --os-url $GLANCE_SERVICE_PROTOCOL://$GLANCE_HOSTPORT --os-image-api-version 2 image set $image_name $magnum_image_property
  246. }
  247. #magnum_configure_flavor - set hw_rng property for flavor to address the potential entropy issue
  248. function magnum_configure_flavor {
  249. local magnum_flavor_property="--property hw_rng:allowed=True --property hw_rng:rate_bytes=1024 --property hw_rng:rate_period=1"
  250. local FLAVOR_LIST=$(openstack --os-url $NOVA_SERVICE_PROTOCOL://$NOVA_HOSTPORT --os-compute-api-version 2.1 flavor list -c Name -f value)
  251. for flavor in ${FLAVOR_LIST}; do
  252. openstack --os-url $NOVA_SERVICE_PROTOCOL://$NOVA_HOSTPORT --os-compute-api-version 2.1 flavor set $flavor $magnum_flavor_property
  253. done
  254. }
  255. # install_magnumclient() - Collect source and prepare
  256. function install_magnumclient {
  257. if use_library_from_git "python-magnumclient"; then
  258. git_clone_by_name "python-magnumclient"
  259. setup_dev_lib "python-magnumclient"
  260. sudo install -D -m 0644 -o $STACK_USER {${GITDIR["python-magnumclient"]}/tools/,/etc/bash_completion.d/}magnum.bash_completion
  261. fi
  262. }
  263. # install_magnum() - Collect source and prepare
  264. function install_magnum {
  265. git_clone $MAGNUM_REPO $MAGNUM_DIR $MAGNUM_BRANCH
  266. setup_develop $MAGNUM_DIR
  267. }
  268. # start_magnum_api() - Start the API process ahead of other things
  269. function start_magnum_api {
  270. # Get right service port for testing
  271. local service_port=$MAGNUM_SERVICE_PORT
  272. local service_protocol=$MAGNUM_SERVICE_PROTOCOL
  273. if is_service_enabled tls-proxy; then
  274. service_port=$MAGNUM_SERVICE_PORT_INT
  275. service_protocol="http"
  276. fi
  277. run_process magnum-api "$MAGNUM_BIN_DIR/magnum-api"
  278. echo "Waiting for magnum-api to start..."
  279. if ! wait_for_service $SERVICE_TIMEOUT $service_protocol://$MAGNUM_SERVICE_HOST:$service_port; then
  280. die $LINENO "magnum-api did not start"
  281. fi
  282. # Start proxies if enabled
  283. if is_service_enabled tls-proxy; then
  284. start_tls_proxy magnum '*' $MAGNUM_SERVICE_PORT $MAGNUM_SERVICE_HOST $MAGNUM_SERVICE_PORT_INT &
  285. fi
  286. }
  287. # configure_iptables_magnum() - Configure the IP table rules for Magnum
  288. function configure_iptables_magnum {
  289. if [ "$MAGNUM_CONFIGURE_IPTABLES" != "False" ]; then
  290. ROUTE_TO_INTERNET=$(ip route get 8.8.8.8)
  291. OBOUND_DEV=$(echo ${ROUTE_TO_INTERNET#*dev} | awk '{print $1}')
  292. sudo iptables -t nat -A POSTROUTING -o $OBOUND_DEV -j MASQUERADE
  293. # bay nodes will access magnum-api (port $MAGNUM_SERVICE_PORT) to get CA certificate.
  294. sudo iptables -I INPUT -d $HOST_IP -p tcp --dport $MAGNUM_SERVICE_PORT -j ACCEPT || true
  295. # allow access to keystone etc (http and https)
  296. sudo iptables -I INPUT -d $HOST_IP -p tcp --dport 80 -j ACCEPT || true
  297. sudo iptables -I INPUT -d $HOST_IP -p tcp --dport 443 -j ACCEPT || true
  298. fi
  299. }
  300. function configure_apache_magnum {
  301. # Set redirection for kubernetes openstack cloud provider
  302. # FIXME: When [1] is in kubernetes, we won't need the redirection anymore.
  303. # [1] https://github.com/gophercloud/gophercloud/pull/423
  304. HTACCESS_PATH=/var/www/html
  305. if is_ubuntu; then
  306. OVERRIDE_CONF_FILE=/etc/apache2/apache2.conf
  307. elif is_fedora; then
  308. OVERRIDE_CONF_FILE=/etc/httpd/conf/httpd.conf
  309. fi
  310. # If horizon is enabled then we need
  311. if is_service_enabled horizon; then
  312. HTACCESS_PATH=$DEST/horizon/.blackhole
  313. sudo tee -a $APACHE_CONF_DIR/horizon.conf <<EOF
  314. <Directory $HTACCESS_PATH>
  315. Options Indexes FollowSymLinks
  316. AllowOverride all
  317. Require all granted
  318. </Directory>
  319. EOF
  320. else
  321. sudo tee -a $OVERRIDE_CONF_FILE <<EOF
  322. <Directory $HTACCESS_PATH>
  323. Options Indexes FollowSymLinks
  324. AllowOverride all
  325. Require all granted
  326. </Directory>
  327. EOF
  328. fi
  329. sudo mkdir -p $HTACCESS_PATH
  330. sudo tee $HTACCESS_PATH/.htaccess <<EOF
  331. RewriteEngine on
  332. RewriteRule ^v2\.0(.*) /identity/v2.0\$1
  333. RewriteRule ^v3(.*) /identity/v3\$1
  334. EOF
  335. enable_apache_mod rewrite
  336. }
  337. # start_magnum() - Start running processes, including screen
  338. function start_magnum {
  339. # ``run_process`` checks ``is_service_enabled``, it is not needed here
  340. start_magnum_api
  341. run_process magnum-cond "$MAGNUM_BIN_DIR/magnum-conductor"
  342. }
  343. # stop_magnum() - Stop running processes (non-screen)
  344. function stop_magnum {
  345. for serv in magnum-api magnum-cond; do
  346. stop_process $serv
  347. done
  348. }
  349. # Restore xtrace
  350. $XTRACE