From 028ce51f9f224d68fdeb62b7e6494e296efec31f Mon Sep 17 00:00:00 2001 From: Todd Willey Date: Fri, 12 Nov 2010 14:07:46 -0500 Subject: [PATCH] Add sample puppet scripts. --- contrib/puppet/files/etc/default/nova-compute | 1 + contrib/puppet/files/etc/default/nova-volume | 1 + contrib/puppet/files/etc/issue | 5 + contrib/puppet/files/etc/libvirt/qemu.conf | 170 +++++++ contrib/puppet/files/etc/lvm/lvm.conf | 463 +++++++++++++++++ contrib/puppet/files/etc/nova.conf | 28 ++ contrib/puppet/files/production/boto.cfg | 3 + contrib/puppet/files/production/genvpn.sh | 35 ++ .../production/libvirt.qemu.xml.template | 35 ++ contrib/puppet/files/production/my.cnf | 137 ++++++ contrib/puppet/files/production/nova-iptables | 185 +++++++ .../puppet/files/production/nova-iscsi-dev.sh | 19 + contrib/puppet/files/production/setup_data.sh | 6 + contrib/puppet/files/production/slap.sh | 261 ++++++++++ contrib/puppet/fileserver.conf | 8 + contrib/puppet/manifests/classes/apt.pp | 1 + contrib/puppet/manifests/classes/issue.pp | 14 + .../puppet/manifests/classes/kern_module.pp | 34 ++ contrib/puppet/manifests/classes/loopback.pp | 6 + contrib/puppet/manifests/classes/lvm.pp | 8 + contrib/puppet/manifests/classes/lvmconf.pp | 8 + contrib/puppet/manifests/classes/nova.pp | 464 ++++++++++++++++++ contrib/puppet/manifests/classes/swift.pp | 7 + contrib/puppet/manifests/site.pp | 120 +++++ contrib/puppet/manifests/templates.pp | 21 + contrib/puppet/puppet.conf | 11 + contrib/puppet/templates/haproxy.cfg.erb | 39 ++ contrib/puppet/templates/monitrc-nova-api.erb | 138 ++++++ contrib/puppet/templates/nova-iptables.erb | 10 + .../templates/production/nova-common.conf.erb | 56 +++ .../templates/production/nova-nova.conf.erb | 21 + 31 files changed, 2315 insertions(+) create mode 100644 contrib/puppet/files/etc/default/nova-compute create mode 100644 contrib/puppet/files/etc/default/nova-volume create mode 100644 contrib/puppet/files/etc/issue create mode 100644 contrib/puppet/files/etc/libvirt/qemu.conf create mode 100644 contrib/puppet/files/etc/lvm/lvm.conf create mode 100644 contrib/puppet/files/etc/nova.conf create mode 100644 contrib/puppet/files/production/boto.cfg create mode 100644 contrib/puppet/files/production/genvpn.sh create mode 100644 contrib/puppet/files/production/libvirt.qemu.xml.template create mode 100644 contrib/puppet/files/production/my.cnf create mode 100755 contrib/puppet/files/production/nova-iptables create mode 100644 contrib/puppet/files/production/nova-iscsi-dev.sh create mode 100755 contrib/puppet/files/production/setup_data.sh create mode 100755 contrib/puppet/files/production/slap.sh create mode 100644 contrib/puppet/fileserver.conf create mode 100644 contrib/puppet/manifests/classes/apt.pp create mode 100644 contrib/puppet/manifests/classes/issue.pp create mode 100644 contrib/puppet/manifests/classes/kern_module.pp create mode 100644 contrib/puppet/manifests/classes/loopback.pp create mode 100644 contrib/puppet/manifests/classes/lvm.pp create mode 100644 contrib/puppet/manifests/classes/lvmconf.pp create mode 100644 contrib/puppet/manifests/classes/nova.pp create mode 100644 contrib/puppet/manifests/classes/swift.pp create mode 100644 contrib/puppet/manifests/site.pp create mode 100644 contrib/puppet/manifests/templates.pp create mode 100644 contrib/puppet/puppet.conf create mode 100644 contrib/puppet/templates/haproxy.cfg.erb create mode 100644 contrib/puppet/templates/monitrc-nova-api.erb create mode 100644 contrib/puppet/templates/nova-iptables.erb create mode 100644 contrib/puppet/templates/production/nova-common.conf.erb create mode 100644 contrib/puppet/templates/production/nova-nova.conf.erb diff --git a/contrib/puppet/files/etc/default/nova-compute b/contrib/puppet/files/etc/default/nova-compute new file mode 100644 index 000000000000..8bd7d091ca77 --- /dev/null +++ b/contrib/puppet/files/etc/default/nova-compute @@ -0,0 +1 @@ +ENABLED=true diff --git a/contrib/puppet/files/etc/default/nova-volume b/contrib/puppet/files/etc/default/nova-volume new file mode 100644 index 000000000000..8bd7d091ca77 --- /dev/null +++ b/contrib/puppet/files/etc/default/nova-volume @@ -0,0 +1 @@ +ENABLED=true diff --git a/contrib/puppet/files/etc/issue b/contrib/puppet/files/etc/issue new file mode 100644 index 000000000000..8c567221bb91 --- /dev/null +++ b/contrib/puppet/files/etc/issue @@ -0,0 +1,5 @@ +----------------------------------------------- + + Welcome to your OpenStack installation! + +----------------------------------------------- diff --git a/contrib/puppet/files/etc/libvirt/qemu.conf b/contrib/puppet/files/etc/libvirt/qemu.conf new file mode 100644 index 000000000000..7839f12e5199 --- /dev/null +++ b/contrib/puppet/files/etc/libvirt/qemu.conf @@ -0,0 +1,170 @@ +# Master configuration file for the QEMU driver. +# All settings described here are optional - if omitted, sensible +# defaults are used. + +# VNC is configured to listen on 127.0.0.1 by default. +# To make it listen on all public interfaces, uncomment +# this next option. +# +# NB, strong recommendation to enable TLS + x509 certificate +# verification when allowing public access +# +# vnc_listen = "0.0.0.0" + + +# Enable use of TLS encryption on the VNC server. This requires +# a VNC client which supports the VeNCrypt protocol extension. +# Examples include vinagre, virt-viewer, virt-manager and vencrypt +# itself. UltraVNC, RealVNC, TightVNC do not support this +# +# It is necessary to setup CA and issue a server certificate +# before enabling this. +# +# vnc_tls = 1 + + +# Use of TLS requires that x509 certificates be issued. The +# default it to keep them in /etc/pki/libvirt-vnc. This directory +# must contain +# +# ca-cert.pem - the CA master certificate +# server-cert.pem - the server certificate signed with ca-cert.pem +# server-key.pem - the server private key +# +# This option allows the certificate directory to be changed +# +# vnc_tls_x509_cert_dir = "/etc/pki/libvirt-vnc" + + +# The default TLS configuration only uses certificates for the server +# allowing the client to verify the server's identity and establish +# and encrypted channel. +# +# It is possible to use x509 certificates for authentication too, by +# issuing a x509 certificate to every client who needs to connect. +# +# Enabling this option will reject any client who does not have a +# certificate signed by the CA in /etc/pki/libvirt-vnc/ca-cert.pem +# +# vnc_tls_x509_verify = 1 + + +# The default VNC password. Only 8 letters are significant for +# VNC passwords. This parameter is only used if the per-domain +# XML config does not already provide a password. To allow +# access without passwords, leave this commented out. An empty +# string will still enable passwords, but be rejected by QEMU +# effectively preventing any use of VNC. Obviously change this +# example here before you set this +# +# vnc_password = "XYZ12345" + + +# Enable use of SASL encryption on the VNC server. This requires +# a VNC client which supports the SASL protocol extension. +# Examples include vinagre, virt-viewer and virt-manager +# itself. UltraVNC, RealVNC, TightVNC do not support this +# +# It is necessary to configure /etc/sasl2/qemu.conf to choose +# the desired SASL plugin (eg, GSSPI for Kerberos) +# +# vnc_sasl = 1 + + +# The default SASL configuration file is located in /etc/sasl2/ +# When running libvirtd unprivileged, it may be desirable to +# override the configs in this location. Set this parameter to +# point to the directory, and create a qemu.conf in that location +# +# vnc_sasl_dir = "/some/directory/sasl2" + + + + +# The default security driver is SELinux. If SELinux is disabled +# on the host, then the security driver will automatically disable +# itself. If you wish to disable QEMU SELinux security driver while +# leaving SELinux enabled for the host in general, then set this +# to 'none' instead +# +# security_driver = "selinux" + + +# The user ID for QEMU processes run by the system instance +user = "root" + +# The group ID for QEMU processes run by the system instance +group = "root" + +# Whether libvirt should dynamically change file ownership +# to match the configured user/group above. Defaults to 1. +# Set to 0 to disable file ownership changes. +#dynamic_ownership = 1 + + +# What cgroup controllers to make use of with QEMU guests +# +# - 'cpu' - use for schedular tunables +# - 'devices' - use for device whitelisting +# +# NB, even if configured here, they won't be used unless +# the adminsitrator has mounted cgroups. eg +# +# mkdir /dev/cgroup +# mount -t cgroup -o devices,cpu none /dev/cgroup +# +# They can be mounted anywhere, and different controlers +# can be mounted in different locations. libvirt will detect +# where they are located. +# +# cgroup_controllers = [ "cpu", "devices" ] + +# This is the basic set of devices allowed / required by +# all virtual machines. +# +# As well as this, any configured block backed disks, +# all sound device, and all PTY devices are allowed. +# +# This will only need setting if newer QEMU suddenly +# wants some device we don't already know a bout. +# +#cgroup_device_acl = [ +# "/dev/null", "/dev/full", "/dev/zero", +# "/dev/random", "/dev/urandom", +# "/dev/ptmx", "/dev/kvm", "/dev/kqemu", +# "/dev/rtc", "/dev/hpet", "/dev/net/tun", +#] + +# The default format for Qemu/KVM guest save images is raw; that is, the +# memory from the domain is dumped out directly to a file. If you have +# guests with a large amount of memory, however, this can take up quite +# a bit of space. If you would like to compress the images while they +# are being saved to disk, you can also set "lzop", "gzip", "bzip2", or "xz" +# for save_image_format. Note that this means you slow down the process of +# saving a domain in order to save disk space; the list above is in descending +# order by performance and ascending order by compression ratio. +# +# save_image_format = "raw" + +# If provided by the host and a hugetlbfs mount point is configured, +# a guest may request huge page backing. When this mount point is +# unspecified here, determination of a host mount point in /proc/mounts +# will be attempted. Specifying an explicit mount overrides detection +# of the same in /proc/mounts. Setting the mount point to "" will +# disable guest hugepage backing. +# +# NB, within this mount point, guests will create memory backing files +# in a location of $MOUNTPOINT/libvirt/qemu + +# hugetlbfs_mount = "/dev/hugepages" + +# mac_filter enables MAC addressed based filtering on bridge ports. +# This currently requires ebtables to be installed. +# +# mac_filter = 1 + +# By default, PCI devices below non-ACS switch are not allowed to be assigned +# to guests. By setting relaxed_acs_check to 1 such devices will be allowed to +# be assigned to guests. +# +# relaxed_acs_check = 1 diff --git a/contrib/puppet/files/etc/lvm/lvm.conf b/contrib/puppet/files/etc/lvm/lvm.conf new file mode 100644 index 000000000000..4e814ad49968 --- /dev/null +++ b/contrib/puppet/files/etc/lvm/lvm.conf @@ -0,0 +1,463 @@ +# This is an example configuration file for the LVM2 system. +# It contains the default settings that would be used if there was no +# /etc/lvm/lvm.conf file. +# +# Refer to 'man lvm.conf' for further information including the file layout. +# +# To put this file in a different directory and override /etc/lvm set +# the environment variable LVM_SYSTEM_DIR before running the tools. + + +# This section allows you to configure which block devices should +# be used by the LVM system. +devices { + + # Where do you want your volume groups to appear ? + dir = "/dev" + + # An array of directories that contain the device nodes you wish + # to use with LVM2. + scan = [ "/dev" ] + + # If several entries in the scanned directories correspond to the + # same block device and the tools need to display a name for device, + # all the pathnames are matched against each item in the following + # list of regular expressions in turn and the first match is used. + preferred_names = [ ] + + # Try to avoid using undescriptive /dev/dm-N names, if present. + # preferred_names = [ "^/dev/mpath/", "^/dev/mapper/mpath", "^/dev/[hs]d" ] + + # A filter that tells LVM2 to only use a restricted set of devices. + # The filter consists of an array of regular expressions. These + # expressions can be delimited by a character of your choice, and + # prefixed with either an 'a' (for accept) or 'r' (for reject). + # The first expression found to match a device name determines if + # the device will be accepted or rejected (ignored). Devices that + # don't match any patterns are accepted. + + # Be careful if there there are symbolic links or multiple filesystem + # entries for the same device as each name is checked separately against + # the list of patterns. The effect is that if any name matches any 'a' + # pattern, the device is accepted; otherwise if any name matches any 'r' + # pattern it is rejected; otherwise it is accepted. + + # Don't have more than one filter line active at once: only one gets used. + + # Run vgscan after you change this parameter to ensure that + # the cache file gets regenerated (see below). + # If it doesn't do what you expect, check the output of 'vgscan -vvvv'. + + + # By default we accept every block device: + filter = [ "r|/dev/etherd/.*|", "r|/dev/block/.*|", "a/.*/" ] + + # Exclude the cdrom drive + # filter = [ "r|/dev/cdrom|" ] + + # When testing I like to work with just loopback devices: + # filter = [ "a/loop/", "r/.*/" ] + + # Or maybe all loops and ide drives except hdc: + # filter =[ "a|loop|", "r|/dev/hdc|", "a|/dev/ide|", "r|.*|" ] + + # Use anchors if you want to be really specific + # filter = [ "a|^/dev/hda8$|", "r/.*/" ] + + # The results of the filtering are cached on disk to avoid + # rescanning dud devices (which can take a very long time). + # By default this cache is stored in the /etc/lvm/cache directory + # in a file called '.cache'. + # It is safe to delete the contents: the tools regenerate it. + # (The old setting 'cache' is still respected if neither of + # these new ones is present.) + cache_dir = "/etc/lvm/cache" + cache_file_prefix = "" + + # You can turn off writing this cache file by setting this to 0. + write_cache_state = 1 + + # Advanced settings. + + # List of pairs of additional acceptable block device types found + # in /proc/devices with maximum (non-zero) number of partitions. + # types = [ "fd", 16 ] + + # If sysfs is mounted (2.6 kernels) restrict device scanning to + # the block devices it believes are valid. + # 1 enables; 0 disables. + sysfs_scan = 1 + + # By default, LVM2 will ignore devices used as components of + # software RAID (md) devices by looking for md superblocks. + # 1 enables; 0 disables. + md_component_detection = 1 + + # By default, if a PV is placed directly upon an md device, LVM2 + # will align its data blocks with the md device's stripe-width. + # 1 enables; 0 disables. + md_chunk_alignment = 1 + + # By default, the start of a PV's data area will be a multiple of + # the 'minimum_io_size' or 'optimal_io_size' exposed in sysfs. + # - minimum_io_size - the smallest request the device can perform + # w/o incurring a read-modify-write penalty (e.g. MD's chunk size) + # - optimal_io_size - the device's preferred unit of receiving I/O + # (e.g. MD's stripe width) + # minimum_io_size is used if optimal_io_size is undefined (0). + # If md_chunk_alignment is enabled, that detects the optimal_io_size. + # This setting takes precedence over md_chunk_alignment. + # 1 enables; 0 disables. + data_alignment_detection = 1 + + # Alignment (in KB) of start of data area when creating a new PV. + # If a PV is placed directly upon an md device and md_chunk_alignment or + # data_alignment_detection is enabled this parameter is ignored. + # Set to 0 for the default alignment of 64KB or page size, if larger. + data_alignment = 0 + + # By default, the start of the PV's aligned data area will be shifted by + # the 'alignment_offset' exposed in sysfs. This offset is often 0 but + # may be non-zero; e.g.: certain 4KB sector drives that compensate for + # windows partitioning will have an alignment_offset of 3584 bytes + # (sector 7 is the lowest aligned logical block, the 4KB sectors start + # at LBA -1, and consequently sector 63 is aligned on a 4KB boundary). + # 1 enables; 0 disables. + data_alignment_offset_detection = 1 + + # If, while scanning the system for PVs, LVM2 encounters a device-mapper + # device that has its I/O suspended, it waits for it to become accessible. + # Set this to 1 to skip such devices. This should only be needed + # in recovery situations. + ignore_suspended_devices = 0 +} + +# This section that allows you to configure the nature of the +# information that LVM2 reports. +log { + + # Controls the messages sent to stdout or stderr. + # There are three levels of verbosity, 3 being the most verbose. + verbose = 0 + + # Should we send log messages through syslog? + # 1 is yes; 0 is no. + syslog = 1 + + # Should we log error and debug messages to a file? + # By default there is no log file. + #file = "/var/log/lvm2.log" + + # Should we overwrite the log file each time the program is run? + # By default we append. + overwrite = 0 + + # What level of log messages should we send to the log file and/or syslog? + # There are 6 syslog-like log levels currently in use - 2 to 7 inclusive. + # 7 is the most verbose (LOG_DEBUG). + level = 0 + + # Format of output messages + # Whether or not (1 or 0) to indent messages according to their severity + indent = 1 + + # Whether or not (1 or 0) to display the command name on each line output + command_names = 0 + + # A prefix to use before the message text (but after the command name, + # if selected). Default is two spaces, so you can see/grep the severity + # of each message. + prefix = " " + + # To make the messages look similar to the original LVM tools use: + # indent = 0 + # command_names = 1 + # prefix = " -- " + + # Set this if you want log messages during activation. + # Don't use this in low memory situations (can deadlock). + # activation = 0 +} + +# Configuration of metadata backups and archiving. In LVM2 when we +# talk about a 'backup' we mean making a copy of the metadata for the +# *current* system. The 'archive' contains old metadata configurations. +# Backups are stored in a human readeable text format. +backup { + + # Should we maintain a backup of the current metadata configuration ? + # Use 1 for Yes; 0 for No. + # Think very hard before turning this off! + backup = 1 + + # Where shall we keep it ? + # Remember to back up this directory regularly! + backup_dir = "/etc/lvm/backup" + + # Should we maintain an archive of old metadata configurations. + # Use 1 for Yes; 0 for No. + # On by default. Think very hard before turning this off. + archive = 1 + + # Where should archived files go ? + # Remember to back up this directory regularly! + archive_dir = "/etc/lvm/archive" + + # What is the minimum number of archive files you wish to keep ? + retain_min = 10 + + # What is the minimum time you wish to keep an archive file for ? + retain_days = 30 +} + +# Settings for the running LVM2 in shell (readline) mode. +shell { + + # Number of lines of history to store in ~/.lvm_history + history_size = 100 +} + + +# Miscellaneous global LVM2 settings +global { + + # The file creation mask for any files and directories created. + # Interpreted as octal if the first digit is zero. + umask = 077 + + # Allow other users to read the files + #umask = 022 + + # Enabling test mode means that no changes to the on disk metadata + # will be made. Equivalent to having the -t option on every + # command. Defaults to off. + test = 0 + + # Default value for --units argument + units = "h" + + # Since version 2.02.54, the tools distinguish between powers of + # 1024 bytes (e.g. KiB, MiB, GiB) and powers of 1000 bytes (e.g. + # KB, MB, GB). + # If you have scripts that depend on the old behaviour, set this to 0 + # temporarily until you update them. + si_unit_consistency = 1 + + # Whether or not to communicate with the kernel device-mapper. + # Set to 0 if you want to use the tools to manipulate LVM metadata + # without activating any logical volumes. + # If the device-mapper kernel driver is not present in your kernel + # setting this to 0 should suppress the error messages. + activation = 1 + + # If we can't communicate with device-mapper, should we try running + # the LVM1 tools? + # This option only applies to 2.4 kernels and is provided to help you + # switch between device-mapper kernels and LVM1 kernels. + # The LVM1 tools need to be installed with .lvm1 suffices + # e.g. vgscan.lvm1 and they will stop working after you start using + # the new lvm2 on-disk metadata format. + # The default value is set when the tools are built. + # fallback_to_lvm1 = 0 + + # The default metadata format that commands should use - "lvm1" or "lvm2". + # The command line override is -M1 or -M2. + # Defaults to "lvm2". + # format = "lvm2" + + # Location of proc filesystem + proc = "/proc" + + # Type of locking to use. Defaults to local file-based locking (1). + # Turn locking off by setting to 0 (dangerous: risks metadata corruption + # if LVM2 commands get run concurrently). + # Type 2 uses the external shared library locking_library. + # Type 3 uses built-in clustered locking. + # Type 4 uses read-only locking which forbids any operations that might + # change metadata. + locking_type = 1 + + # Set to 0 to fail when a lock request cannot be satisfied immediately. + wait_for_locks = 1 + + # If using external locking (type 2) and initialisation fails, + # with this set to 1 an attempt will be made to use the built-in + # clustered locking. + # If you are using a customised locking_library you should set this to 0. + fallback_to_clustered_locking = 1 + + # If an attempt to initialise type 2 or type 3 locking failed, perhaps + # because cluster components such as clvmd are not running, with this set + # to 1 an attempt will be made to use local file-based locking (type 1). + # If this succeeds, only commands against local volume groups will proceed. + # Volume Groups marked as clustered will be ignored. + fallback_to_local_locking = 1 + + # Local non-LV directory that holds file-based locks while commands are + # in progress. A directory like /tmp that may get wiped on reboot is OK. + locking_dir = "/var/lock/lvm" + + # Whenever there are competing read-only and read-write access requests for + # a volume group's metadata, instead of always granting the read-only + # requests immediately, delay them to allow the read-write requests to be + # serviced. Without this setting, write access may be stalled by a high + # volume of read-only requests. + # NB. This option only affects locking_type = 1 viz. local file-based + # locking. + prioritise_write_locks = 1 + + # Other entries can go here to allow you to load shared libraries + # e.g. if support for LVM1 metadata was compiled as a shared library use + # format_libraries = "liblvm2format1.so" + # Full pathnames can be given. + + # Search this directory first for shared libraries. + # library_dir = "/lib/lvm2" + + # The external locking library to load if locking_type is set to 2. + # locking_library = "liblvm2clusterlock.so" +} + +activation { + # Set to 0 to disable udev syncronisation (if compiled into the binaries). + # Processes will not wait for notification from udev. + # They will continue irrespective of any possible udev processing + # in the background. You should only use this if udev is not running + # or has rules that ignore the devices LVM2 creates. + # The command line argument --nodevsync takes precedence over this setting. + # If set to 1 when udev is not running, and there are LVM2 processes + # waiting for udev, run 'dmsetup udevcomplete_all' manually to wake them up. + udev_sync = 1 + + # How to fill in missing stripes if activating an incomplete volume. + # Using "error" will make inaccessible parts of the device return + # I/O errors on access. You can instead use a device path, in which + # case, that device will be used to in place of missing stripes. + # But note that using anything other than "error" with mirrored + # or snapshotted volumes is likely to result in data corruption. + missing_stripe_filler = "error" + + # How much stack (in KB) to reserve for use while devices suspended + reserved_stack = 256 + + # How much memory (in KB) to reserve for use while devices suspended + reserved_memory = 8192 + + # Nice value used while devices suspended + process_priority = -18 + + # If volume_list is defined, each LV is only activated if there is a + # match against the list. + # "vgname" and "vgname/lvname" are matched exactly. + # "@tag" matches any tag set in the LV or VG. + # "@*" matches if any tag defined on the host is also set in the LV or VG + # + # volume_list = [ "vg1", "vg2/lvol1", "@tag1", "@*" ] + + # Size (in KB) of each copy operation when mirroring + mirror_region_size = 512 + + # Setting to use when there is no readahead value stored in the metadata. + # + # "none" - Disable readahead. + # "auto" - Use default value chosen by kernel. + readahead = "auto" + + # 'mirror_image_fault_policy' and 'mirror_log_fault_policy' define + # how a device failure affecting a mirror is handled. + # A mirror is composed of mirror images (copies) and a log. + # A disk log ensures that a mirror does not need to be re-synced + # (all copies made the same) every time a machine reboots or crashes. + # + # In the event of a failure, the specified policy will be used to determine + # what happens. This applies to automatic repairs (when the mirror is being + # monitored by dmeventd) and to manual lvconvert --repair when + # --use-policies is given. + # + # "remove" - Simply remove the faulty device and run without it. If + # the log device fails, the mirror would convert to using + # an in-memory log. This means the mirror will not + # remember its sync status across crashes/reboots and + # the entire mirror will be re-synced. If a + # mirror image fails, the mirror will convert to a + # non-mirrored device if there is only one remaining good + # copy. + # + # "allocate" - Remove the faulty device and try to allocate space on + # a new device to be a replacement for the failed device. + # Using this policy for the log is fast and maintains the + # ability to remember sync state through crashes/reboots. + # Using this policy for a mirror device is slow, as it + # requires the mirror to resynchronize the devices, but it + # will preserve the mirror characteristic of the device. + # This policy acts like "remove" if no suitable device and + # space can be allocated for the replacement. + # + # "allocate_anywhere" - Not yet implemented. Useful to place the log device + # temporarily on same physical volume as one of the mirror + # images. This policy is not recommended for mirror devices + # since it would break the redundant nature of the mirror. This + # policy acts like "remove" if no suitable device and space can + # be allocated for the replacement. + + mirror_log_fault_policy = "allocate" + mirror_device_fault_policy = "remove" +} + + +#################### +# Advanced section # +#################### + +# Metadata settings +# +# metadata { + # Default number of copies of metadata to hold on each PV. 0, 1 or 2. + # You might want to override it from the command line with 0 + # when running pvcreate on new PVs which are to be added to large VGs. + + # pvmetadatacopies = 1 + + # Approximate default size of on-disk metadata areas in sectors. + # You should increase this if you have large volume groups or + # you want to retain a large on-disk history of your metadata changes. + + # pvmetadatasize = 255 + + # List of directories holding live copies of text format metadata. + # These directories must not be on logical volumes! + # It's possible to use LVM2 with a couple of directories here, + # preferably on different (non-LV) filesystems, and with no other + # on-disk metadata (pvmetadatacopies = 0). Or this can be in + # addition to on-disk metadata areas. + # The feature was originally added to simplify testing and is not + # supported under low memory situations - the machine could lock up. + # + # Never edit any files in these directories by hand unless you + # you are absolutely sure you know what you are doing! Use + # the supplied toolset to make changes (e.g. vgcfgrestore). + + # dirs = [ "/etc/lvm/metadata", "/mnt/disk2/lvm/metadata2" ] +#} + +# Event daemon +# +dmeventd { + # mirror_library is the library used when monitoring a mirror device. + # + # "libdevmapper-event-lvm2mirror.so" attempts to recover from + # failures. It removes failed devices from a volume group and + # reconfigures a mirror as necessary. If no mirror library is + # provided, mirrors are not monitored through dmeventd. + + mirror_library = "libdevmapper-event-lvm2mirror.so" + + # snapshot_library is the library used when monitoring a snapshot device. + # + # "libdevmapper-event-lvm2snapshot.so" monitors the filling of + # snapshots and emits a warning through syslog, when the use of + # snapshot exceedes 80%. The warning is repeated when 85%, 90% and + # 95% of the snapshot are filled. + + snapshot_library = "libdevmapper-event-lvm2snapshot.so" +} diff --git a/contrib/puppet/files/etc/nova.conf b/contrib/puppet/files/etc/nova.conf new file mode 100644 index 000000000000..a0d64078c8ea --- /dev/null +++ b/contrib/puppet/files/etc/nova.conf @@ -0,0 +1,28 @@ +--ec2_url=http://192.168.255.1:8773/services/Cloud +--rabbit_host=192.168.255.1 +--redis_host=192.168.255.1 +--s3_host=192.168.255.1 +--vpn_ip=192.168.255.1 +--datastore_path=/var/lib/nova/keeper +--networks_path=/var/lib/nova/networks +--instances_path=/var/lib/nova/instances +--buckets_path=/var/lib/nova/objectstore/buckets +--images_path=/var/lib/nova/objectstore/images +--ca_path=/var/lib/nova/CA +--keys_path=/var/lib/nova/keys +--vlan_start=2000 +--vlan_end=3000 +--private_range=192.168.0.0/16 +--public_range=10.0.0.0/24 +--volume_group=vgdata +--storage_dev=/dev/sdc +--bridge_dev=eth2 +--aoe_eth_dev=eth2 +--public_interface=vlan0 +--default_kernel=aki-DEFAULT +--default_ramdisk=ari-DEFAULT +--vpn_image_id=ami-cloudpipe +--daemonize +--verbose +--syslog +--prefix=nova diff --git a/contrib/puppet/files/production/boto.cfg b/contrib/puppet/files/production/boto.cfg new file mode 100644 index 000000000000..f4a2de2b678b --- /dev/null +++ b/contrib/puppet/files/production/boto.cfg @@ -0,0 +1,3 @@ +[Boto] +debug = 0 +num_retries = 1 diff --git a/contrib/puppet/files/production/genvpn.sh b/contrib/puppet/files/production/genvpn.sh new file mode 100644 index 000000000000..538c3cd33ed8 --- /dev/null +++ b/contrib/puppet/files/production/genvpn.sh @@ -0,0 +1,35 @@ +#!/bin/bash +# vim: tabstop=4 shiftwidth=4 softtabstop=4 + +# Copyright 2010 United States Government as represented by the +# Administrator of the National Aeronautics and Space Administration. +# All Rights Reserved. +# +# Licensed under the Apache License, Version 2.0 (the "License"); you may +# not use this file except in compliance with the License. You may obtain +# a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT +# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the +# License for the specific language governing permissions and limitations +# under the License. + +# This gets zipped and run on the cloudpipe-managed OpenVPN server +NAME=$1 +SUBJ=$2 + +mkdir -p projects/$NAME +cd projects/$NAME + +# generate a server priv key +openssl genrsa -out server.key 2048 + +# generate a server CSR +openssl req -new -key server.key -out server.csr -batch -subj "$SUBJ" + +if [ "`id -u`" != "`grep nova /etc/passwd | cut -d':' -f3`" ]; then + sudo chown -R nova:nogroup . +fi diff --git a/contrib/puppet/files/production/libvirt.qemu.xml.template b/contrib/puppet/files/production/libvirt.qemu.xml.template new file mode 100644 index 000000000000..114dfdc01d87 --- /dev/null +++ b/contrib/puppet/files/production/libvirt.qemu.xml.template @@ -0,0 +1,35 @@ + + %(name)s + + hvm + %(basepath)s/kernel + %(basepath)s/ramdisk + root=/dev/vda1 console=ttyS0 + + + + + %(memory_kb)s + %(vcpus)s + + + + + + + + + + + + + + + + + diff --git a/contrib/puppet/files/production/my.cnf b/contrib/puppet/files/production/my.cnf new file mode 100644 index 000000000000..8777bc4806bd --- /dev/null +++ b/contrib/puppet/files/production/my.cnf @@ -0,0 +1,137 @@ +# +# The MySQL database server configuration file. +# +# You can copy this to one of: +# - "/etc/mysql/my.cnf" to set global options, +# - "~/.my.cnf" to set user-specific options. +# +# One can use all long options that the program supports. +# Run program with --help to get a list of available options and with +# --print-defaults to see which it would actually understand and use. +# +# For explanations see +# http://dev.mysql.com/doc/mysql/en/server-system-variables.html + +# This will be passed to all mysql clients +# It has been reported that passwords should be enclosed with ticks/quotes +# escpecially if they contain "#" chars... +# Remember to edit /etc/mysql/debian.cnf when changing the socket location. +[client] +port = 3306 +socket = /var/run/mysqld/mysqld.sock + +# Here is entries for some specific programs +# The following values assume you have at least 32M ram + +# This was formally known as [safe_mysqld]. Both versions are currently parsed. +[mysqld_safe] +socket = /var/run/mysqld/mysqld.sock +nice = 0 + +[mysqld] +# +# * Basic Settings +# + +# +# * IMPORTANT +# If you make changes to these settings and your system uses apparmor, you may +# also need to also adjust /etc/apparmor.d/usr.sbin.mysqld. +# + +user = mysql +socket = /var/run/mysqld/mysqld.sock +port = 3306 +basedir = /usr +datadir = /var/lib/mysql +tmpdir = /tmp +skip-external-locking +# +# Instead of skip-networking the default is now to listen only on +# localhost which is more compatible and is not less secure. +# bind-address = 127.0.0.1 +# +# * Fine Tuning +# +innodb_buffer_pool_size = 12G +#innodb_log_file_size = 256M +innodb_log_buffer_size=4M +innodb_flush_log_at_trx_commit=2 +innodb_thread_concurrency=8 +innodb_flush_method=O_DIRECT +key_buffer = 128M +max_allowed_packet = 256M +thread_stack = 8196K +thread_cache_size = 32 +# This replaces the startup script and checks MyISAM tables if needed +# the first time they are touched +myisam-recover = BACKUP +max_connections = 1000 +table_cache = 1024 +#thread_concurrency = 10 +# +# * Query Cache Configuration +# +query_cache_limit = 32M +query_cache_size = 256M +# +# * Logging and Replication +# +# Both location gets rotated by the cronjob. +# Be aware that this log type is a performance killer. +# As of 5.1 you can enable the log at runtime! +#general_log_file = /var/log/mysql/mysql.log +#general_log = 1 + +log_error = /var/log/mysql/error.log + +# Here you can see queries with especially long duration +log_slow_queries = /var/log/mysql/mysql-slow.log +long_query_time = 2 +#log-queries-not-using-indexes +# +# The following can be used as easy to replay backup logs or for replication. +# note: if you are setting up a replication slave, see README.Debian about +# other settings you may need to change. +server-id = 1 +log_bin = /var/log/mysql/mysql-bin.log +expire_logs_days = 10 +max_binlog_size = 50M +#binlog_do_db = include_database_name +#binlog_ignore_db = include_database_name +# +# * InnoDB +# +sync_binlog=1 +# InnoDB is enabled by default with a 10MB datafile in /var/lib/mysql/. +# Read the manual for more InnoDB related options. There are many! +# +# * Security Features +# +# Read the manual, too, if you want chroot! +# chroot = /var/lib/mysql/ +# +# For generating SSL certificates I recommend the OpenSSL GUI "tinyca". +# +# ssl-ca=/etc/mysql/cacert.pem +# ssl-cert=/etc/mysql/server-cert.pem +# ssl-key=/etc/mysql/server-key.pem + + + +[mysqldump] +quick +quote-names +max_allowed_packet = 256M + +[mysql] +#no-auto-rehash # faster start of mysql but no tab completition + +[isamchk] +key_buffer = 128M + +# +# * IMPORTANT: Additional settings that can override those from this file! +# The files must end with '.cnf', otherwise they'll be ignored. +# +!includedir /etc/mysql/conf.d/ diff --git a/contrib/puppet/files/production/nova-iptables b/contrib/puppet/files/production/nova-iptables new file mode 100755 index 000000000000..b7b52df87753 --- /dev/null +++ b/contrib/puppet/files/production/nova-iptables @@ -0,0 +1,185 @@ +#! /bin/sh + +# vim: tabstop=4 shiftwidth=4 softtabstop=4 + +# Copyright 2010 United States Government as represented by the +# Administrator of the National Aeronautics and Space Administration. +# All Rights Reserved. +# +# Licensed under the Apache License, Version 2.0 (the "License"); you may +# not use this file except in compliance with the License. You may obtain +# a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT +# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the +# License for the specific language governing permissions and limitations +# under the License. + +# NOTE(vish): This script sets up some reasonable defaults for iptables and +# creates nova-specific chains. If you use this script you should +# run nova-network and nova-compute with --use_nova_chains=True + + +# NOTE(vish): If you run public nova-api on a different port, make sure to +# change the port here + +if [ -f /etc/default/nova-iptables ] ; then + . /etc/default/nova-iptables +fi + +API_PORT=${API_PORT:-"8773"} + +if [ ! -n "$IP" ]; then + # NOTE(vish): IP address is what address the services ALLOW on. + # This will just get the first ip in the list, so if you + # have more than one eth device set up, this will fail, and + # you should explicitly pass in the ip of the instance + IP=`ifconfig | grep -m 1 'inet addr:'| cut -d: -f2 | awk '{print $1}'` +fi + +if [ ! -n "$PRIVATE_RANGE" ]; then + #NOTE(vish): PRIVATE_RANGE: range is ALLOW to access DHCP + PRIVATE_RANGE="192.168.0.0/12" +fi + +if [ ! -n "$MGMT_IP" ]; then + # NOTE(vish): Management IP is the ip over which to allow ssh traffic. It + # will also allow traffic to nova-api + MGMT_IP="$IP" +fi + +if [ ! -n "$DMZ_IP" ]; then + # NOTE(vish): DMZ IP is the ip over which to allow api & objectstore access + DMZ_IP="$IP" +fi + +clear_nova_iptables() { + iptables -P INPUT ACCEPT + iptables -P FORWARD ACCEPT + iptables -P OUTPUT ACCEPT + iptables -F + iptables -t nat -F + iptables -F services + iptables -X services + # HACK: re-adding fail2ban rules :( + iptables -N fail2ban-ssh + iptables -A INPUT -p tcp -m multiport --dports 22 -j fail2ban-ssh + iptables -A fail2ban-ssh -j RETURN +} + +load_nova_iptables() { + + iptables -P INPUT DROP + iptables -A INPUT -m state --state INVALID -j DROP + iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT + # NOTE(ja): allow localhost for everything + iptables -A INPUT -d 127.0.0.1/32 -j ACCEPT + # NOTE(ja): 22 only allowed MGMT_IP before, but we widened it to any + # address, since ssh should be listening only on internal + # before we re-add this rule we will need to add + # flexibility for RSYNC between omega/stingray + iptables -A INPUT -m tcp -p tcp --dport 22 -j ACCEPT + iptables -A INPUT -m udp -p udp --dport 123 -j ACCEPT + iptables -A INPUT -p icmp -j ACCEPT + iptables -N services + iptables -A INPUT -j services + iptables -A INPUT -p tcp -j REJECT --reject-with tcp-reset + iptables -A INPUT -j REJECT --reject-with icmp-port-unreachable + + iptables -P FORWARD DROP + iptables -A FORWARD -m state --state INVALID -j DROP + iptables -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT + iptables -A FORWARD -p tcp -m tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu + + # NOTE(vish): DROP on output is too restrictive for now. We need to add + # in a bunch of more specific output rules to use it. + # iptables -P OUTPUT DROP + iptables -A OUTPUT -m state --state INVALID -j DROP + iptables -A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT + + if [ -n "$GANGLIA" ] || [ -n "$ALL" ]; then + iptables -A services -m tcp -p tcp -d $IP --dport 8649 -j ACCEPT + iptables -A services -m udp -p udp -d $IP --dport 8649 -j ACCEPT + fi + + # if [ -n "$WEB" ] || [ -n "$ALL" ]; then + # # NOTE(vish): This opens up ports for web access, allowing web-based + # # dashboards to work. + # iptables -A services -m tcp -p tcp -d $IP --dport 80 -j ACCEPT + # iptables -A services -m tcp -p tcp -d $IP --dport 443 -j ACCEPT + # fi + + if [ -n "$OBJECTSTORE" ] || [ -n "$ALL" ]; then + # infrastructure + iptables -A services -m tcp -p tcp -d $IP --dport 3333 -j ACCEPT + # clients + iptables -A services -m tcp -p tcp -d $DMZ_IP --dport 3333 -j ACCEPT + fi + + if [ -n "$API" ] || [ -n "$ALL" ]; then + iptables -A services -m tcp -p tcp -d $IP --dport $API_PORT -j ACCEPT + if [ "$IP" != "$DMZ_IP" ]; then + iptables -A services -m tcp -p tcp -d $DMZ_IP --dport $API_PORT -j ACCEPT + fi + if [ "$IP" != "$MGMT_IP" ] && [ "$DMZ_IP" != "$MGMT_IP" ]; then + iptables -A services -m tcp -p tcp -d $MGMT_IP --dport $API_PORT -j ACCEPT + fi + fi + + if [ -n "$REDIS" ] || [ -n "$ALL" ]; then + iptables -A services -m tcp -p tcp -d $IP --dport 6379 -j ACCEPT + fi + + if [ -n "$MYSQL" ] || [ -n "$ALL" ]; then + iptables -A services -m tcp -p tcp -d $IP --dport 3306 -j ACCEPT + fi + + if [ -n "$RABBITMQ" ] || [ -n "$ALL" ]; then + iptables -A services -m tcp -p tcp -d $IP --dport 4369 -j ACCEPT + iptables -A services -m tcp -p tcp -d $IP --dport 5672 -j ACCEPT + iptables -A services -m tcp -p tcp -d $IP --dport 53284 -j ACCEPT + fi + + if [ -n "$DNSMASQ" ] || [ -n "$ALL" ]; then + # NOTE(vish): this could theoretically be setup per network + # for each host, but it seems like overkill + iptables -A services -m tcp -p tcp -s $PRIVATE_RANGE --dport 53 -j ACCEPT + iptables -A services -m udp -p udp -s $PRIVATE_RANGE --dport 53 -j ACCEPT + iptables -A services -m udp -p udp --dport 67 -j ACCEPT + fi + + if [ -n "$LDAP" ] || [ -n "$ALL" ]; then + iptables -A services -m tcp -p tcp -d $IP --dport 389 -j ACCEPT + fi + + if [ -n "$ISCSI" ] || [ -n "$ALL" ]; then + iptables -A services -m tcp -p tcp -d $IP --dport 3260 -j ACCEPT + iptables -A services -m tcp -p tcp -d 127.0.0.0/16 --dport 3260 -j ACCEPT + fi +} + + +case "$1" in + start) + echo "Starting nova-iptables: " + load_nova_iptables + ;; + stop) + echo "Clearing nova-iptables: " + clear_nova_iptables + ;; + restart) + echo "Restarting nova-iptables: " + clear_nova_iptables + load_nova_iptables + ;; + *) + echo "Usage: $NAME {start|stop|restart}" >&2 + exit 1 + ;; +esac + +exit 0 diff --git a/contrib/puppet/files/production/nova-iscsi-dev.sh b/contrib/puppet/files/production/nova-iscsi-dev.sh new file mode 100644 index 000000000000..8eda10d2e331 --- /dev/null +++ b/contrib/puppet/files/production/nova-iscsi-dev.sh @@ -0,0 +1,19 @@ +#!/bin/sh + +# FILE: /etc/udev/scripts/iscsidev.sh + +BUS=${1} +HOST=${BUS%%:*} + +[ -e /sys/class/iscsi_host ] || exit 1 + +file="/sys/class/iscsi_host/host${HOST}/device/session*/iscsi_session*/session*/targetname" + +target_name=$(cat ${file}) + +# This is not an open-scsi drive +if [ -z "${target_name}" ]; then + exit 1 +fi + +echo "${target_name##*:}" diff --git a/contrib/puppet/files/production/setup_data.sh b/contrib/puppet/files/production/setup_data.sh new file mode 100755 index 000000000000..1fbbac41c4d9 --- /dev/null +++ b/contrib/puppet/files/production/setup_data.sh @@ -0,0 +1,6 @@ +#!/bin/bash +/root/slap.sh +mysql -e "DROP DATABASE nova" +mysql -e "CREATE DATABASE nova" +mysql -e "GRANT ALL on nova.* to nova@'%' identified by 'TODO:CHANGEME:CMON'" +touch /root/installed diff --git a/contrib/puppet/files/production/slap.sh b/contrib/puppet/files/production/slap.sh new file mode 100755 index 000000000000..f8ea16949588 --- /dev/null +++ b/contrib/puppet/files/production/slap.sh @@ -0,0 +1,261 @@ +#!/usr/bin/env bash +# vim: tabstop=4 shiftwidth=4 softtabstop=4 + +# Copyright 2010 United States Government as represented by the +# Administrator of the National Aeronautics and Space Administration. +# All Rights Reserved. +# +# Licensed under the Apache License, Version 2.0 (the "License"); you may +# not use this file except in compliance with the License. You may obtain +# a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT +# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the +# License for the specific language governing permissions and limitations +# under the License. +# LDAP INSTALL SCRIPT - SHOULD BE IDEMPOTENT, but it SCRUBS all USERS + +apt-get install -y slapd ldap-utils python-ldap + +cat >/etc/ldap/schema/openssh-lpk_openldap.schema < +# +# Based on the proposal of : Mark Ruijter +# + + +# octetString SYNTAX +attributetype ( 1.3.6.1.4.1.24552.500.1.1.1.13 NAME 'sshPublicKey' + DESC 'MANDATORY: OpenSSH Public key' + EQUALITY octetStringMatch + SYNTAX 1.3.6.1.4.1.1466.115.121.1.40 ) + +# printableString SYNTAX yes|no +objectclass ( 1.3.6.1.4.1.24552.500.1.1.2.0 NAME 'ldapPublicKey' SUP top AUXILIARY + DESC 'MANDATORY: OpenSSH LPK objectclass' + MAY ( sshPublicKey $ uid ) + ) +LPK_SCHEMA_EOF + +cat >/etc/ldap/schema/nova.schema < +# +# + +# using internet experimental oid arc as per BP64 3.1 +objectidentifier novaSchema 1.3.6.1.3.1.666.666 +objectidentifier novaAttrs novaSchema:3 +objectidentifier novaOCs novaSchema:4 + +attributetype ( + novaAttrs:1 + NAME 'accessKey' + DESC 'Key for accessing data' + EQUALITY caseIgnoreMatch + SUBSTR caseIgnoreSubstringsMatch + SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 + SINGLE-VALUE + ) + +attributetype ( + novaAttrs:2 + NAME 'secretKey' + DESC 'Secret key' + EQUALITY caseIgnoreMatch + SUBSTR caseIgnoreSubstringsMatch + SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 + SINGLE-VALUE + ) + +attributetype ( + novaAttrs:3 + NAME 'keyFingerprint' + DESC 'Fingerprint of private key' + EQUALITY caseIgnoreMatch + SUBSTR caseIgnoreSubstringsMatch + SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 + SINGLE-VALUE + ) + +attributetype ( + novaAttrs:4 + NAME 'isAdmin' + DESC 'Is user an administrator?' + EQUALITY booleanMatch + SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 + SINGLE-VALUE + ) + +attributetype ( + novaAttrs:5 + NAME 'projectManager' + DESC 'Project Managers of a project' + SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 + ) + +objectClass ( + novaOCs:1 + NAME 'novaUser' + DESC 'access and secret keys' + AUXILIARY + MUST ( uid ) + MAY ( accessKey $ secretKey $ isAdmin ) + ) + +objectClass ( + novaOCs:2 + NAME 'novaKeyPair' + DESC 'Key pair for User' + SUP top + STRUCTURAL + MUST ( cn $ sshPublicKey $ keyFingerprint ) + ) + +objectClass ( + novaOCs:3 + NAME 'novaProject' + DESC 'Container for project' + SUP groupOfNames + STRUCTURAL + MUST ( cn $ projectManager ) + ) + +NOVA_SCHEMA_EOF + +mv /etc/ldap/slapd.conf /etc/ldap/slapd.conf.orig +cat >/etc/ldap/slapd.conf </etc/ldap/ldap.conf </etc/ldap/base.ldif < "/usr/bin/apt-get update" } diff --git a/contrib/puppet/manifests/classes/issue.pp b/contrib/puppet/manifests/classes/issue.pp new file mode 100644 index 000000000000..8bb37ee3f826 --- /dev/null +++ b/contrib/puppet/manifests/classes/issue.pp @@ -0,0 +1,14 @@ +class issue { + file { "/etc/issue": + owner => "root", + group => "root", + mode => 444, + source => "puppet://${puppet_server}/files/etc/issue", + } + file { "/etc/issue.net": + owner => "root", + group => "root", + mode => 444, + source => "puppet://${puppet_server}/files/etc/issue", + } +} diff --git a/contrib/puppet/manifests/classes/kern_module.pp b/contrib/puppet/manifests/classes/kern_module.pp new file mode 100644 index 000000000000..00ec0636c8c7 --- /dev/null +++ b/contrib/puppet/manifests/classes/kern_module.pp @@ -0,0 +1,34 @@ +# via http://projects.puppetlabs.com/projects/puppet/wiki/Kernel_Modules_Patterns + +define kern_module ($ensure) { + $modulesfile = $operatingsystem ? { ubuntu => "/etc/modules", redhat => "/etc/rc.modules" } + case $operatingsystem { + redhat: { file { "/etc/rc.modules": ensure => file, mode => 755 } } + } + case $ensure { + present: { + exec { "insert_module_${name}": + command => $operatingsystem ? { + ubuntu => "/bin/echo '${name}' >> '${modulesfile}'", + redhat => "/bin/echo '/sbin/modprobe ${name}' >> '${modulesfile}' " + }, + unless => "/bin/grep -qFx '${name}' '${modulesfile}'" + } + exec { "/sbin/modprobe ${name}": unless => "/bin/grep -q '^${name} ' '/proc/modules'" } + } + absent: { + exec { "/sbin/modprobe -r ${name}": onlyif => "/bin/grep -q '^${name} ' '/proc/modules'" } + exec { "remove_module_${name}": + command => $operatingsystem ? { + ubuntu => "/usr/bin/perl -ni -e 'print unless /^\\Q${name}\\E\$/' '${modulesfile}'", + redhat => "/usr/bin/perl -ni -e 'print unless /^\\Q/sbin/modprobe ${name}\\E\$/' '${modulesfile}'" + }, + onlyif => $operatingsystem ? { + ubuntu => "/bin/grep -qFx '${name}' '${modulesfile}'", + redhat => "/bin/grep -q '^/sbin/modprobe ${name}' '${modulesfile}'" + } + } + } + default: { err ( "unknown ensure value ${ensure}" ) } + } +} diff --git a/contrib/puppet/manifests/classes/loopback.pp b/contrib/puppet/manifests/classes/loopback.pp new file mode 100644 index 000000000000..e0fa9d541868 --- /dev/null +++ b/contrib/puppet/manifests/classes/loopback.pp @@ -0,0 +1,6 @@ +define loopback($num) { + exec { "mknod -m 0660 /dev/loop${num} b 7 ${num}; chown root:disk /dev/loop${num}": + creates => "/dev/loop${num}", + path => ["/usr/bin", "/usr/sbin", "/bin"] + } +} diff --git a/contrib/puppet/manifests/classes/lvm.pp b/contrib/puppet/manifests/classes/lvm.pp new file mode 100644 index 000000000000..5a407abcba95 --- /dev/null +++ b/contrib/puppet/manifests/classes/lvm.pp @@ -0,0 +1,8 @@ +class lvm { + file { "/etc/lvm/lvm.conf": + owner => "root", + group => "root", + mode => 444, + source => "puppet://${puppet_server}/files/etc/lvm.conf", + } +} diff --git a/contrib/puppet/manifests/classes/lvmconf.pp b/contrib/puppet/manifests/classes/lvmconf.pp new file mode 100644 index 000000000000..4aa7ddfdc314 --- /dev/null +++ b/contrib/puppet/manifests/classes/lvmconf.pp @@ -0,0 +1,8 @@ +class lvmconf { + file { "/etc/lvm/lvm.conf": + owner => "root", group => "root", mode => 644, + source => "puppet://${puppet_server}/files/etc/lvm/lvm.conf", + ensure => present + } +} + diff --git a/contrib/puppet/manifests/classes/nova.pp b/contrib/puppet/manifests/classes/nova.pp new file mode 100644 index 000000000000..e942860f41d7 --- /dev/null +++ b/contrib/puppet/manifests/classes/nova.pp @@ -0,0 +1,464 @@ +import "kern_module" +import "apt" +import "loopback" + +#$head_node_ip = "undef" +#$rabbit_ip = "undef" +#$vpn_ip = "undef" +#$public_interface = "undef" +#$vlan_start = "5000" +#$vlan_end = "6000" +#$private_range = "10.0.0.0/16" +#$public_range = "192.168.177.0/24" + +define nova_iptables($services, $ip="", $private_range="", $mgmt_ip="", $dmz_ip="") { + file { "/etc/init.d/nova-iptables": + owner => "root", mode => 755, + source => "puppet://${puppet_server}/files/production/nova-iptables", + } + + file { "/etc/default/nova-iptables": + owner => "root", mode => 644, + content => template("nova-iptables.erb") + } +} + +define nova_conf_pointer($name) { + file { "/etc/nova/nova-${name}.conf": + owner => "nova", mode => 400, + content => "--flagfile=/etc/nova/nova.conf" + } +} + +class novaconf { + file { "/etc/nova/nova.conf": + owner => "nova", mode => 400, + content => template("production/nova-common.conf.erb", "production/nova-${cluster_name}.conf.erb") + } + nova_conf_pointer{'manage': name => 'manage'} +} + +class novadata { + package { "rabbitmq-server": ensure => present } + + file { "/etc/rabbitmq/rabbitmq.conf": + owner => "root", mode => 644, + content => "NODENAME=rabbit@localhost", + } + + service { "rabbitmq-server": + ensure => running, + enable => true, + hasstatus => true, + require => [ + File["/etc/rabbitmq/rabbitmq.conf"], + Package["rabbitmq-server"] + ] + } + + package { "mysql-server": ensure => present } + + file { "/etc/mysql/my.cnf": + owner => "root", mode => 644, + source => "puppet://${puppet_server}/files/production/my.cnf", + } + + service { "mysql": + ensure => running, + enable => true, + hasstatus => true, + require => [ + File["/etc/mysql/my.cnf"], + Package["mysql-server"] + ] + } + + file { "/root/slap.sh": + owner => "root", mode => 755, + source => "puppet://${puppet_server}/files/production/slap.sh", + } + + file { "/root/setup_data.sh": + owner => "root", mode => 755, + source => "puppet://${puppet_server}/files/production/setup_data.sh", + } + + # setup compute data + exec { "setup_data": + command => "/root/setup_data.sh", + path => "/usr/bin:/bin", + unless => "test -f /root/installed", + require => [ + Service["mysql"], + File["/root/slap.sh"], + File["/root/setup_data.sh"] + ] + } +} + +define nscheduler($version) { + package { "nova-scheduler": ensure => $version, require => Exec["update-apt"] } + nova_conf_pointer{'scheduler': name => 'scheduler'} + exec { "update-rc.d -f nova-scheduler remove; update-rc.d nova-scheduler defaults 50": + path => "/usr/bin:/usr/sbin:/bin", + onlyif => "test -f /etc/init.d/nova-scheduler", + unless => "test -f /etc/rc2.d/S50nova-scheduler" + } + service { "nova-scheduler": + ensure => running, + hasstatus => true, + subscribe => [ + Package["nova-scheduler"], + File["/etc/nova/nova.conf"], + File["/etc/nova/nova-scheduler.conf"] + ] + } + +} + +define napi($version, $api_servers, $api_base_port) { + file { "/etc/boto.cfg": + owner => "root", mode => 644, + source => "puppet://${puppet_server}/files/production/boto.cfg", + } + + file { "/var/lib/nova/CA/genvpn.sh": + owner => "nova", mode => 755, + source => "puppet://${puppet_server}/files/production/genvpn.sh", + } + + package { "python-greenlet": ensure => present } + package { "nova-api": ensure => $version, require => [Exec["update-apt"], Package["python-greenlet"]] } + nova_conf_pointer{'api': name => 'api'} + + exec { "update-rc.d -f nova-api remove; update-rc.d nova-api defaults 50": + path => "/usr/bin:/usr/sbin:/bin", + onlyif => "test -f /etc/init.d/nova-api", + unless => "test -f /etc/rc2.d/S50nova-api" + } + + service { "nova-netsync": + start => "/usr/bin/nova-netsync --pidfile=/var/run/nova/nova-netsync.pid --lockfile=/var/run/nova/nova-netsync.pid.lock start", + stop => "/usr/bin/nova-netsync --pidfile=/var/run/nova/nova-netsync.pid --lockfile=/var/run/nova/nova-netsync.pid.lock stop", + ensure => running, + hasstatus => false, + pattern => "nova-netsync", + require => Service["nova-api"], + subscribe => File["/etc/nova/nova.conf"] + } + service { "nova-api": + start => "monit start all -g nova_api", + stop => "monit stop all -g nova_api", + restart => "monit restart all -g nova_api", + # ensure => running, + # hasstatus => true, + require => Service["monit"], + subscribe => [ + Package["nova-objectstore"], + File["/etc/boto.cfg"], + File["/etc/nova/nova.conf"], + File["/etc/nova/nova-objectstore.conf"] + ] + } + + # the haproxy & monit's template use $api_servers and $api_base_port + + package { "haproxy": ensure => present } + file { "/etc/default/haproxy": + owner => "root", mode => 644, + content => "ENABLED=1", + require => Package['haproxy'] + } + file { "/etc/haproxy/haproxy.cfg": + owner => "root", mode => 644, + content => template("/srv/cloud/puppet/templates/haproxy.cfg.erb"), + require => Package['haproxy'] + } + service { "haproxy": + ensure => true, + enable => true, + hasstatus => true, + subscribe => [ + Package["haproxy"], + File["/etc/default/haproxy"], + File["/etc/haproxy/haproxy.cfg"], + ] + } + + package { "socat": ensure => present } + + file { "/usr/local/bin/gmetric_haproxy.sh": + owner => "root", mode => 755, + source => "puppet://${puppet_server}/files/production/ganglia/gmetric_scripts/gmetric_haproxy.sh", + } + + cron { "gmetric_haproxy": + command => "/usr/local/bin/gmetric_haproxy.sh", + user => root, + minute => "*/3", + } + + package { "monit": ensure => present } + + file { "/etc/default/monit": + owner => "root", mode => 644, + content => "startup=1", + require => Package['monit'] + } + file { "/etc/monit/monitrc": + owner => "root", mode => 600, + content => template("/srv/cloud/puppet/templates/monitrc-nova-api.erb"), + require => Package['monit'] + } + service { "monit": + ensure => true, + pattern => "sbin/monit", + subscribe => [ + Package["monit"], + File["/etc/default/monit"], + File["/etc/monit/monitrc"], + ] + } + +} + + +define nnetwork($version) { + # kill the default network added by the package + exec { "kill-libvirt-default-net": + command => "virsh net-destroy default; rm /etc/libvirt/qemu/networks/autostart/default.xml", + path => "/usr/bin:/bin", + onlyif => "test -f /etc/libvirt/qemu/networks/autostart/default.xml" + } + + # EVIL HACK: custom binary because dnsmasq 2.52 segfaulted accessing dereferenced object + file { "/usr/sbin/dnsmasq": + owner => "root", group => "root", + source => "puppet://${puppet_server}/files/production/dnsmasq", + } + + package { "nova-network": ensure => $version, require => Exec["update-apt"] } + nova_conf_pointer{'dhcpbridge': name => 'dhcpbridge'} + nova_conf_pointer{'network': name => "network" } + + exec { "update-rc.d -f nova-network remove; update-rc.d nova-network defaults 50": + path => "/usr/bin:/usr/sbin:/bin", + onlyif => "test -f /etc/init.d/nova-network", + unless => "test -f /etc/rc2.d/S50nova-network" + } + service { "nova-network": + ensure => running, + hasstatus => true, + subscribe => [ + Package["nova-network"], + File["/etc/nova/nova.conf"], + File["/etc/nova/nova-network.conf"] + ] + } +} + +define nobjectstore($version) { + package { "nova-objectstore": ensure => $version, require => Exec["update-apt"] } + nova_conf_pointer{'objectstore': name => 'objectstore'} + exec { "update-rc.d -f nova-objectstore remove; update-rc.d nova-objectstore defaults 50": + path => "/usr/bin:/usr/sbin:/bin", + onlyif => "test -f /etc/init.d/nova-objectstore", + unless => "test -f /etc/rc2.d/S50nova-objectstore" + } + service { "nova-objectstore": + ensure => running, + hasstatus => true, + subscribe => [ + Package["nova-objectstore"], + File["/etc/nova/nova.conf"], + File["/etc/nova/nova-objectstore.conf"] + ] + } +} + +define ncompute($version) { + include ganglia-python + include ganglia-compute + + # kill the default network added by the package + exec { "kill-libvirt-default-net": + command => "virsh net-destroy default; rm /etc/libvirt/qemu/networks/autostart/default.xml", + path => "/usr/bin:/bin", + onlyif => "test -f /etc/libvirt/qemu/networks/autostart/default.xml" + } + + + # LIBVIRT has to be restarted when ebtables / gawk is installed + service { "libvirt-bin": + ensure => running, + pattern => "sbin/libvirtd", + subscribe => [ + Package["ebtables"], + Kern_module["kvm_intel"] + ], + require => [ + Package["libvirt-bin"], + Package["ebtables"], + Package["gawk"], + Kern_module["kvm_intel"], + File["/dev/kvm"] + ] + } + + package { "libvirt-bin": ensure => "0.8.3-1ubuntu14~ppalucid2" } + package { "ebtables": ensure => present } + package { "gawk": ensure => present } + + # ensure proper permissions on /dev/kvm + file { "/dev/kvm": + owner => "root", + group => "kvm", + mode => 660 + } + + # require hardware virt + kern_module { "kvm_intel": + ensure => present, + } + + # increase loopback devices + file { "/etc/modprobe.d/loop.conf": + owner => "root", mode => 644, + content => "options loop max_loop=40" + } + + nova_conf_pointer{'compute': name => 'compute'} + + loopback{loop0: num => 0} + loopback{loop1: num => 1} + loopback{loop2: num => 2} + loopback{loop3: num => 3} + loopback{loop4: num => 4} + loopback{loop5: num => 5} + loopback{loop6: num => 6} + loopback{loop7: num => 7} + loopback{loop8: num => 8} + loopback{loop9: num => 9} + loopback{loop10: num => 10} + loopback{loop11: num => 11} + loopback{loop12: num => 12} + loopback{loop13: num => 13} + loopback{loop14: num => 14} + loopback{loop15: num => 15} + loopback{loop16: num => 16} + loopback{loop17: num => 17} + loopback{loop18: num => 18} + loopback{loop19: num => 19} + loopback{loop20: num => 20} + loopback{loop21: num => 21} + loopback{loop22: num => 22} + loopback{loop23: num => 23} + loopback{loop24: num => 24} + loopback{loop25: num => 25} + loopback{loop26: num => 26} + loopback{loop27: num => 27} + loopback{loop28: num => 28} + loopback{loop29: num => 29} + loopback{loop30: num => 30} + loopback{loop31: num => 31} + loopback{loop32: num => 32} + loopback{loop33: num => 33} + loopback{loop34: num => 34} + loopback{loop35: num => 35} + loopback{loop36: num => 36} + loopback{loop37: num => 37} + loopback{loop38: num => 38} + loopback{loop39: num => 39} + + package { "python-libvirt": ensure => "0.8.3-1ubuntu14~ppalucid2" } + + package { "nova-compute": + ensure => "$version", + require => Package["python-libvirt"] + } + + #file { "/usr/share/nova/libvirt.qemu.xml.template": + # owner => "nova", mode => 400, + # source => "puppet://${puppet_server}/files/production/libvirt.qemu.xml.template", + #} + + # fix runlevels: using enable => true adds it as 20, which is too early + exec { "update-rc.d -f nova-compute remove": + path => "/usr/bin:/usr/sbin:/bin", + onlyif => "test -f /etc/rc2.d/S??nova-compute" + } + service { "nova-compute": + ensure => running, + hasstatus => true, + subscribe => [ + Package["nova-compute"], + File["/etc/nova/nova.conf"], + File["/etc/nova/nova-compute.conf"], + #File["/usr/share/nova/libvirt.qemu.xml.template"], + Service["libvirt-bin"], + Kern_module["kvm_intel"] + ] + } +} + +define nvolume($version) { + + package { "nova-volume": ensure => $version, require => Exec["update-apt"] } + + nova_conf_pointer{'volume': name => 'volume'} + + # fix runlevels: using enable => true adds it as 20, which is too early + exec { "update-rc.d -f nova-volume remove": + path => "/usr/bin:/usr/sbin:/bin", + onlyif => "test -f /etc/rc2.d/S??nova-volume" + } + + file { "/etc/default/iscsitarget": + owner => "root", mode => 644, + content => "ISCSITARGET_ENABLE=true" + } + + package { "iscsitarget": ensure => present } + + file { "/dev/iscsi": ensure => directory } # FIXME(vish): owner / mode? + file { "/usr/sbin/nova-iscsi-dev.sh": + owner => "root", mode => 755, + source => "puppet://${puppet_server}/files/production/nova-iscsi-dev.sh" + } + file { "/etc/udev/rules.d/55-openiscsi.rules": + owner => "root", mode => 644, + content => 'KERNEL=="sd*", BUS=="scsi", PROGRAM="/usr/sbin/nova-iscsi-dev.sh %b",SYMLINK+="iscsi/%c%n"' + } + + service { "iscsitarget": + ensure => running, + enable => true, + hasstatus => true, + require => [ + File["/etc/default/iscsitarget"], + Package["iscsitarget"] + ] + } + + service { "nova-volume": + ensure => running, + hasstatus => true, + subscribe => [ + Package["nova-volume"], + File["/etc/nova/nova.conf"], + File["/etc/nova/nova-volume.conf"] + ] + } +} + +class novaspool { + # This isn't in release yet + #cron { logspool: + # command => "/usr/bin/nova-logspool /var/log/nova.log /var/lib/nova/spool", + # user => "nova" + #} + #cron { spoolsentry: + # command => "/usr/bin/nova-spoolsentry ${sentry_url} ${sentry_key} /var/lib/nova/spool", + # user => "nova" + #} +} diff --git a/contrib/puppet/manifests/classes/swift.pp b/contrib/puppet/manifests/classes/swift.pp new file mode 100644 index 000000000000..64ffb6fa3877 --- /dev/null +++ b/contrib/puppet/manifests/classes/swift.pp @@ -0,0 +1,7 @@ +class swift { + package { "memcached": ensure => present } + service { "memcached": require => Package['memcached'] } + + package { "swift-proxy": ensure => present } +} + diff --git a/contrib/puppet/manifests/site.pp b/contrib/puppet/manifests/site.pp new file mode 100644 index 000000000000..ca07a34ad41b --- /dev/null +++ b/contrib/puppet/manifests/site.pp @@ -0,0 +1,120 @@ +# site.pp + +import "templates" +import "classes/*" + +node novabase inherits default { +# $puppet_server = "192.168.0.10" + $cluster_name = "openstack001" + $ganglia_udp_send_channel = "openstack001.example.com" + $syslog = "192.168.0.10" + + # THIS STUFF ISN'T IN RELEASE YET + #$sentry_url = "http://192.168.0.19/sentry/store/" + #$sentry_key = "TODO:SENTRYPASS" + + $local_network = "192.168.0.0/16" + $vpn_ip = "192.168.0.2" + $public_interface = "eth0" + include novanode +# include nova-common + include opsmetrics + +# non-nova stuff such as nova-dash inherit from novanode +# novaspool needs a better home +# include novaspool +} + +# Builder +node "nova000.example.com" inherits novabase { + $syslog = "server" + include ntp + include syslog-server +} + +# Non-Nova nodes + +node + "blog.example.com", + "wiki.example.com" +inherits novabase { + include ganglia-python + include ganglia-apache + include ganglia-mysql +} + + +node "nova001.example.com" +inherits novabase { + include novabase + + nova_iptables { nova: + services => [ + "ganglia", + "mysql", + "rabbitmq", + "ldap", + "api", + "objectstore", + "nrpe", + ], + ip => "192.168.0.10", + } + + nobjectstore { nova: version => "0.9.0" } + nscheduler { nova: version => "0.9.0" } + napi { nova: + version => "0.9.0", + api_servers => 10, + api_base_port => 8000 + } +} + +node "nova002.example.com" +inherits novabase { + include novaconf + + nova_iptables { nova: + services => [ + "ganglia", + "dnsmasq", + "nrpe" + ], + ip => "192.168.4.2", + private_range => "192.168.0.0/16", + } + + nnetwork { nova: version => "0.9.0" } +} + +node + "nova003.example.com", + "nova004.example.com", + "nova005.example.com", + "nova006.example.com", + "nova007.example.com", + "nova008.example.com", + "nova009.example.com", + "nova010.example.com", + "nova011.example.com", + "nova012.example.com", + "nova013.example.com", + "nova014.example.com", + "nova015.example.com", + "nova016.example.com", + "nova017.example.com", + "nova018.example.com", + "nova019.example.com", +inherits novabase { + include novaconf + ncompute { nova: version => "0.9.0" } + nvolume { nova: version => "0.9.0" } +} + +#node +# "nova020.example.com" +# "nova021.example.com" +#inherits novanode { +# include novaconf + #ncompute { nova: version => "0.9.0" } +#} diff --git a/contrib/puppet/manifests/templates.pp b/contrib/puppet/manifests/templates.pp new file mode 100644 index 000000000000..90e433013878 --- /dev/null +++ b/contrib/puppet/manifests/templates.pp @@ -0,0 +1,21 @@ +# templates.pp + +import "classes/*" + +class baseclass { +# include dns-client # FIXME: missing resolv.conf.erb?? + include issue +} + +node default { + $nova_site = "undef" + $nova_ns1 = "undef" + $nova_ns2 = "undef" +# include baseclass +} + +# novanode handles the system-level requirements for Nova/Swift nodes +class novanode { + include baseclass + include lvmconf +} diff --git a/contrib/puppet/puppet.conf b/contrib/puppet/puppet.conf new file mode 100644 index 000000000000..92af920e34ef --- /dev/null +++ b/contrib/puppet/puppet.conf @@ -0,0 +1,11 @@ +[main] +logdir=/var/log/puppet +vardir=/var/lib/puppet +ssldir=/var/lib/puppet/ssl +rundir=/var/run/puppet +factpath=$vardir/lib/facter +pluginsync=false + +[puppetmasterd] +templatedir=/var/lib/nova/contrib/puppet/templates +autosign=true diff --git a/contrib/puppet/templates/haproxy.cfg.erb b/contrib/puppet/templates/haproxy.cfg.erb new file mode 100644 index 000000000000..bd9991de7ebf --- /dev/null +++ b/contrib/puppet/templates/haproxy.cfg.erb @@ -0,0 +1,39 @@ +# this config needs haproxy-1.1.28 or haproxy-1.2.1 + +global + log 127.0.0.1 local0 + log 127.0.0.1 local1 notice + #log loghost local0 info + maxconn 4096 + #chroot /usr/share/haproxy + stats socket /var/run/haproxy.sock + user haproxy + group haproxy + daemon + #debug + #quiet + +defaults + log global + mode http + option httplog + option dontlognull + retries 3 + option redispatch + stats enable + stats uri /haproxy + maxconn 2000 + contimeout 5000 + clitimeout 50000 + srvtimeout 50000 + + +listen nova-api 0.0.0.0:8773 + option httpchk GET / HTTP/1.0\r\nHost:\ example.com + option forwardfor + reqidel ^X-Forwarded-For:.* + balance roundrobin +<% api_servers.to_i.times do |offset| %><% port = api_base_port.to_i + offset -%> + server api_<%= port %> 127.0.0.1:<%= port %> maxconn 1 check +<% end -%> + option httpclose # disable keep-alive diff --git a/contrib/puppet/templates/monitrc-nova-api.erb b/contrib/puppet/templates/monitrc-nova-api.erb new file mode 100644 index 000000000000..fe26263271ea --- /dev/null +++ b/contrib/puppet/templates/monitrc-nova-api.erb @@ -0,0 +1,138 @@ +############################################################################### +## Monit control file +############################################################################### +## +## Comments begin with a '#' and extend through the end of the line. Keywords +## are case insensitive. All path's MUST BE FULLY QUALIFIED, starting with '/'. +## +## Below you will find examples of some frequently used statements. For +## information about the control file, a complete list of statements and +## options please have a look in the monit manual. +## +## +############################################################################### +## Global section +############################################################################### +## +## Start monit in the background (run as a daemon): +# +set daemon 60 # check services at 1-minute intervals + with start delay 30 # optional: delay the first check by half a minute + # (by default check immediately after monit start) + + +## Set syslog logging with the 'daemon' facility. If the FACILITY option is +## omitted, monit will use 'user' facility by default. If you want to log to +## a stand alone log file instead, specify the path to a log file +# +set logfile syslog facility log_daemon +# +# +### Set the location of monit id file which saves the unique id specific for +### given monit. The id is generated and stored on first monit start. +### By default the file is placed in $HOME/.monit.id. +# +# set idfile /var/.monit.id +# +### Set the location of monit state file which saves the monitoring state +### on each cycle. By default the file is placed in $HOME/.monit.state. If +### state file is stored on persistent filesystem, monit will recover the +### monitoring state across reboots. If it is on temporary filesystem, the +### state will be lost on reboot. +# +# set statefile /var/.monit.state +# +## Set the list of mail servers for alert delivery. Multiple servers may be +## specified using comma separator. By default monit uses port 25 - this +## is possible to override with the PORT option. +# +# set mailserver mail.bar.baz, # primary mailserver +# backup.bar.baz port 10025, # backup mailserver on port 10025 +# localhost # fallback relay +# +# +## By default monit will drop alert events if no mail servers are available. +## If you want to keep the alerts for a later delivery retry, you can use the +## EVENTQUEUE statement. The base directory where undelivered alerts will be +## stored is specified by the BASEDIR option. You can limit the maximal queue +## size using the SLOTS option (if omitted, the queue is limited by space +## available in the back end filesystem). +# +# set eventqueue +# basedir /var/monit # set the base directory where events will be stored +# slots 100 # optionaly limit the queue size +# +# +## Send status and events to M/Monit (Monit central management: for more +## informations about M/Monit see http://www.tildeslash.com/mmonit). +# +# set mmonit http://monit:monit@192.168.1.10:8080/collector +# +# +## Monit by default uses the following alert mail format: +## +## --8<-- +## From: monit@$HOST # sender +## Subject: monit alert -- $EVENT $SERVICE # subject +## +## $EVENT Service $SERVICE # +## # +## Date: $DATE # +## Action: $ACTION # +## Host: $HOST # body +## Description: $DESCRIPTION # +## # +## Your faithful employee, # +## monit # +## --8<-- +## +## You can override this message format or parts of it, such as subject +## or sender using the MAIL-FORMAT statement. Macros such as $DATE, etc. +## are expanded at runtime. For example, to override the sender: +# +# set mail-format { from: monit@foo.bar } +# +# +## You can set alert recipients here whom will receive alerts if/when a +## service defined in this file has errors. Alerts may be restricted on +## events by using a filter as in the second example below. +# +# set alert sysadm@foo.bar # receive all alerts +# set alert manager@foo.bar only on { timeout } # receive just service- +# # timeout alert +# +# +## Monit has an embedded web server which can be used to view status of +## services monitored, the current configuration, actual services parameters +## and manage services from a web interface. +# + set httpd port 2812 and + use address localhost # only accept connection from localhost + allow localhost # allow localhost to connect to the server and +# allow admin:monit # require user 'admin' with password 'monit' +# allow @monit # allow users of group 'monit' to connect (rw) +# allow @users readonly # allow users of group 'users' to connect readonly +# +# +############################################################################### +## Services +############################################################################### + +<% api_servers.to_i.times do |offset| %><% port = api_base_port.to_i + offset %> + +check process nova_api_<%= port %> with pidfile /var/run/nova/nova-api-<%= port %>.pid + group nova_api + start program = "/usr/bin/nova-api --flagfile=/etc/nova/nova.conf --pidfile=/var/run/nova/nova-api-<%= port %>.pid --api_listen_port=<%= port %> --lockfile=/var/run/nova/nova-api-<%= port %>.pid.lock start" + as uid nova + stop program = "/usr/bin/nova-api --flagfile=/etc/nova/nova.conf --pidfile=/var/run/nova/nova-api-<%= port %>.pid --api_listen_port=<%= port %> --lockfile=/var/run/nova/nova-api-<%= port %>.pid.lock stop" + as uid nova + if failed port <%= port %> protocol http + with timeout 15 seconds + for 4 cycles + then restart + if totalmem > 300 Mb then restart + if cpu is greater than 60% for 2 cycles then alert + if cpu > 80% for 3 cycles then restart + if 3 restarts within 5 cycles then timeout + +<% end %> diff --git a/contrib/puppet/templates/nova-iptables.erb b/contrib/puppet/templates/nova-iptables.erb new file mode 100644 index 000000000000..2fc0663055f9 --- /dev/null +++ b/contrib/puppet/templates/nova-iptables.erb @@ -0,0 +1,10 @@ +<% services.each do |service| -%> +<%= service.upcase %>=1 +<% end -%> +<% if ip && ip != "" %>IP="<%=ip%>"<% end %> +<% if private_range && private_range != "" %>PRIVATE_RANGE="<%=private_range%>"<% end %> +<% if mgmt_ip && mgmt_ip != "" %>MGMT_IP="<%=mgmt_ip%>"<% end %> +<% if dmz_ip && dmz_ip != "" %>DMZ_IP="<%=dmz_ip%>"<% end %> + +# warning: this file is auto-generated by puppet + diff --git a/contrib/puppet/templates/production/nova-common.conf.erb b/contrib/puppet/templates/production/nova-common.conf.erb new file mode 100644 index 000000000000..00c110781941 --- /dev/null +++ b/contrib/puppet/templates/production/nova-common.conf.erb @@ -0,0 +1,56 @@ +# global +--dmz_net=192.168.0.0 +--dmz_mask=255.255.0.0 +--dmz_cidr=192.168.0.0/16 +--ldap_user_dn=cn=Administrators,dc=example,dc=com +--ldap_user_unit=Users +--ldap_user_subtree=ou=Users,dc=example,dc=com +--ldap_project_subtree=ou=Groups,dc=example,dc=com +--role_project_subtree=ou=Groups,dc=example,dc=com +--ldap_cloudadmin=cn=NovaAdmins,ou=Groups,dc=example,dc=com +--ldap_itsec=cn=NovaSecurity,ou=Groups,dc=example,dc=com +--ldap_sysadmin=cn=Administrators,ou=Groups,dc=example,dc=com +--ldap_netadmin=cn=Administrators,ou=Groups,dc=example,dc=com +--ldap_developer=cn=developers,ou=Groups,dc=example,dc=com +--verbose +--daemonize +--syslog +--networks_path=/var/lib/nova/networks +--instances_path=/var/lib/nova/instances +--buckets_path=/var/lib/nova/objectstore/buckets +--images_path=/var/lib/nova/objectstore/images +--scheduler_driver=nova.scheduler.simple.SimpleScheduler +--libvirt_xml_template=/usr/share/nova/libvirt.qemu.xml.template +--credentials_template=/usr/share/nova/novarc.template +--boot_script_template=/usr/share/nova/bootscript.template +--vpn_client_template=/usr/share/nova/client.ovpn.template +--max_cores=40 +--max_gigabytes=2000 +--ca_path=/var/lib/nova/CA +--keys_path=/var/lib/nova/keys +--vpn_start=11000 +--volume_group=vgdata +--volume_manager=nova.volume.manager.ISCSIManager +--volume_driver=nova.volume.driver.ISCSIDriver +--default_kernel=aki-DEFAULT +--default_ramdisk=ari-DEFAULT +--dhcpbridge=/usr/bin/nova-dhcpbridge +--vpn_image_id=ami-cloudpipe +--dhcpbridge_flagfile=/etc/nova/nova.conf +--credential_cert_subject=/C=US/ST=Texas/L=Bexar/O=NovaDev/OU=NOVA/CN=%s-%s +--auth_driver=nova.auth.ldapdriver.LdapDriver +--quota_cores=17 +--quota_floating_ips=5 +--quota_instances=6 +--quota_volumes=10 +--quota_gigabytes=100 +--use_nova_chains=True +--input_chain=services +--FAKE_subdomain=ec2 +--use_project_ca=True +--fixed_ip_disassociate_timeout=300 +--api_max_requests=1 +--api_listen_ip=127.0.0.1 +--user_cert_subject=/C=US/ST=Texas/L=Bexar/O=NovaDev/OU=Nova/CN=%s-%s-%s +--project_cert_subject=/C=US/ST=Texas/L=Bexar/O=NovaDev/OU=Nova/CN=project-ca-%s-%s +--vpn_cert_subject=/C=US/ST=Texas/L=Bexar/O=NovaDev/OU=Nova/CN=project-vpn-%s-%s diff --git a/contrib/puppet/templates/production/nova-nova.conf.erb b/contrib/puppet/templates/production/nova-nova.conf.erb new file mode 100644 index 000000000000..8683fefde694 --- /dev/null +++ b/contrib/puppet/templates/production/nova-nova.conf.erb @@ -0,0 +1,21 @@ +--fixed_range=192.168.0.0/16 +--iscsi_ip_prefix=192.168.4 +--floating_range=10.0.0.0/24 +--rabbit_host=192.168.0.10 +--s3_host=192.168.0.10 +--cc_host=192.168.0.10 +--cc_dmz=192.168.24.10 +--s3_dmz=192.168.24.10 +--ec2_url=http://192.168.0.1:8773/services/Cloud +--vpn_ip=192.168.0.2 +--ldap_url=ldap://192.168.0.10 +--sql_connection=mysql://nova:TODO-MYPASS@192.168.0.10/nova +--other_sql_connection=mysql://nova:TODO-MYPASS@192.168.0.10/nova +--routing_source_ip=192.168.0.2 +--bridge_dev=eth1 +--public_interface=eth0 +--vlan_start=3100 +--num_networks=700 +--rabbit_userid=TODO:RABBIT +--rabbit_password=TODO:CHANGEME +--ldap_password=TODO:CHANGEME