openstack/puppet-tripleo
Code Issues Proposed changes

Allow to specify a nic for the VIPs

Browse Source 
This review allows the operator to specify a nic to bind to a VIP to.
It does so in two different ways:
1) Via a global 'tripleo::pacemaker::force_nic' hiera key.
For example setting 'tripleo::pacemaker::force_nic: lo'
will make sure all VIPs are added to the 'lo' network interface.

2) The global setting can be overriden via a custom hiera
hash called 'force_vip_nic_overrides' so that we can
override the binding nic for specific VIPs. For example:

  force_vip_nic_overrides:
    redis_vip: vip-test-nic
    ovn_dbs_vip: vip-test-nic

Will make sure that the redis_vip and the ovn_dbs_vip will
be bound to the 'vip-test-nic'.

Tested with:
  tripleo::pacemaker::force_nic: lo
  force_vip_nic_overrides:
    redis_vip: vip-test-nic
    ovn_dbs_vip: vip-test-nic

And correctly got all VIPs running on lo:
1: lo    inet 192.168.24.9/32 scope global lo\       valid_lft forever preferred_lft forever
1: lo    inet 172.23.1.9/32 scope global lo\       valid_lft forever preferred_lft forever

except for redis and ovn_dbs which are on the vip-test-nic:
5: vip-test-nic    inet 172.25.1.7/32 scope global vip-test-nic\       valid_lft forever preferred_lft forever

Note: The interface is intentionally kept in hiera as this change
will only be needed whenever BGP runs on all nodes and advertises the
VIPs across the ASN (i.e. we do not want to make it very exposed just
yet)

Change-Id: Iaa2676655d97a66237a3bd6066985f87d3565a4d
This commit is contained in:
Michele Baldessari
2020-10-30 17:53:14 +01:00
parent b6626ab6cf
commit 881084d6c8
4 changed files with 72 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
manifests/pacemaker/haproxy_with_vip.pp
View File

@@ -52,6 +52,10 @@
# (Optional) The number of times pcs commands should be retried.
# Defaults to 1
#
# [*nic*]
# (Optional) Specifies the nic interface on which the VIP should be added
# Defaults to undef
#
# [*ensure*]
# (Boolean) Create the all the resources only if true. False won't
# destroy the resource, it will just not create them.
@@ -64,12 +68,18 @@ define tripleo::pacemaker::haproxy_with_vip(
$meta_params = '',
$op_params = '',
$pcs_tries = 1,
$nic = undef,
$ensure = true)
{
if($ensure) {
if !is_ip_addresses($ip_address) {
fail("Haproxy VIP: ${ip_address} is not a proper IP address.")
}
if $nic != undef {
$nic_real = $nic
} else {
$nic_real = ''
}
if is_ipv6_address($ip_address) {
$netmask = '128'
$ipv6_addrlabel = '99'
@@ -87,6 +97,7 @@ define tripleo::pacemaker::haproxy_with_vip(
pacemaker::resource::ip { "${vip_name}_vip":
ip_address => $ip_address,
cidr_netmask => $netmask,
nic => $nic_real,
ipv6_addrlabel => $ipv6_addrlabel,
meta_params => "resource-stickiness=INFINITY ${meta_params}",
location_rule => $location_rule,

33
manifests/profile/pacemaker/haproxy_bundle.pp
View File

@@ -98,6 +98,12 @@
# (optional) Set the --user= switch to be passed to pcmk
# Defaults to 'root'
#
# [*force_nic*]
# (optional) Force a specific nic interface name when creating all the VIPs
# The listening nic can be customized on a per-VIP basis by creating a hiera
# dict called: force_vip_nic_overrides[<vip/network name>] = 'dummy'
# Defaults to hiera('tripleo::pacemaker::force_nic', undef)
#
class tripleo::profile::pacemaker::haproxy_bundle (
$haproxy_docker_image = hiera('tripleo::profile::pacemaker::haproxy::haproxy_docker_image', undef),
$bootstrap_node = hiera('haproxy_short_bootstrap_node_name'),
@@ -113,6 +119,7 @@ class tripleo::profile::pacemaker::haproxy_bundle (
$container_backend = 'docker',
$tls_priorities = hiera('tripleo::pacemaker::tls_priorities', undef),
$bundle_user = 'root',
$force_nic = hiera('tripleo::pacemaker::force_nic', undef),
$log_driver = undef,
$log_file = '/var/log/containers/stdouts/haproxy-bundle.log',
$step = Integer(hiera('step')),
@@ -140,6 +147,8 @@ class tripleo::profile::pacemaker::haproxy_bundle (
} else {
$log_file_real = ''
}
$force_vip_nic_overrides = hiera('force_vip_nic_overrides', {})
validate_legacy(Hash, 'validate_hash', $force_vip_nic_overrides)
if $step >= 2 and $enable_load_balancer {
if $pacemaker_master {
@@ -296,16 +305,27 @@ class tripleo::profile::pacemaker::haproxy_bundle (
tries => $pcs_tries,
}
$control_vip = hiera('controller_virtual_ip')
if has_key($force_vip_nic_overrides, 'controller_virtual_ip') {
$control_vip_nic = $force_vip_nic_overrides['controller_virtual_ip']
} else {
$control_vip_nic = $force_nic
}
tripleo::pacemaker::haproxy_with_vip { 'haproxy_and_control_vip':
vip_name => 'control',
ip_address => $control_vip,
location_rule => $haproxy_location_rule,
meta_params => $meta_params,
op_params => $op_params,
nic => $control_vip_nic,
pcs_tries => $pcs_tries,
}
$public_vip = hiera('public_virtual_ip')
if has_key($force_vip_nic_overrides, 'public_virtual_ip') {
$public_vip_nic = $force_vip_nic_overrides['public_virtual_ip']
} else {
$public_vip_nic = $force_nic
}
tripleo::pacemaker::haproxy_with_vip { 'haproxy_and_public_vip':
ensure => $public_vip and $public_vip != $control_vip,
vip_name => 'public',
@@ -313,12 +333,18 @@ class tripleo::profile::pacemaker::haproxy_bundle (
location_rule => $haproxy_location_rule,
meta_params => $meta_params,
op_params => $op_params,
nic => $public_vip_nic,
pcs_tries => $pcs_tries,
}
$redis = hiera('redis_enabled', false)
if $redis {
$redis_vip = hiera('redis_vip')
if has_key($force_vip_nic_overrides, 'redis_vip') {
$redis_vip_nic = $force_vip_nic_overrides['redis_vip']
} else {
$redis_vip_nic = $force_nic
}
tripleo::pacemaker::haproxy_with_vip { 'haproxy_and_redis_vip':
ensure => $redis_vip and $redis_vip != $control_vip,
vip_name => 'redis',
@@ -326,6 +352,7 @@ class tripleo::profile::pacemaker::haproxy_bundle (
location_rule => $haproxy_location_rule,
meta_params => $meta_params,
op_params => $op_params,
nic => $redis_vip_nic,
pcs_tries => $pcs_tries,
}
}
@@ -334,6 +361,11 @@ class tripleo::profile::pacemaker::haproxy_bundle (
$network_vips = hiera('network_virtual_ips', {})
$network_vips.each |String $net_name, $vip_info| {
$virtual_ip = $vip_info[ip_address]
if has_key($force_vip_nic_overrides, $net_name) {
$vip_nic = $force_vip_nic_overrides[$net_name]
} else {
$vip_nic = $force_nic
}
tripleo::pacemaker::haproxy_with_vip {"haproxy_and_${net_name}_vip":
ensure => $virtual_ip and $virtual_ip != $control_vip,
vip_name => $net_name,
@@ -341,6 +373,7 @@ class tripleo::profile::pacemaker::haproxy_bundle (
location_rule => $haproxy_location_rule,
meta_params => $meta_params,
op_params => $op_params,
nic => $vip_nic,
pcs_tries => $pcs_tries,
}
}

21
manifests/profile/pacemaker/ovn_dbs_bundle.pp
View File

@@ -104,6 +104,13 @@
# [*force_ocf*]
# (optional) Use --force when creating the ocf resource via pcs
# Defaults to false
#
# [*force_nic*]
# (optional) Force a specific nic interface name when creating all the VIPs
# The listening nic can be customized on a per-VIP basis by creating a hiera
# dict called: force_vip_nic_overrides[<vip/network name>] = 'dummy'
# Defaults to hiera('tripleo::pacemaker::force_nic', undef)
#
class tripleo::profile::pacemaker::ovn_dbs_bundle (
$ovn_dbs_docker_image = undef,
@@ -126,6 +133,7 @@ class tripleo::profile::pacemaker::ovn_dbs_bundle (
$dbs_timeout = 60,
$listen_on_master_ip_only = 'yes',
$force_ocf = false,
$force_nic = hiera('tripleo::pacemaker::force_nic', undef),
) {
if $bootstrap_node and $::hostname == downcase($bootstrap_node) {
@@ -148,6 +156,8 @@ class tripleo::profile::pacemaker::ovn_dbs_bundle (
} else {
$log_file_real = ''
}
$force_vip_nic_overrides = hiera('force_vip_nic_overrides', {})
validate_legacy(Hash, 'validate_hash', $force_vip_nic_overrides)
if $step >= 3 {
if $pacemaker_master {
@@ -295,11 +305,18 @@ monitor interval=30s role=Slave timeout=${dbs_timeout}s",
$old_vip = $net_vip_map[$ovn_dbs_network]['ip_address']
if $old_vip != $ovn_dbs_vip {
$ovn_separate_vip = true
if has_key($force_vip_nic_overrides, 'ovn_dbs_vip') {
$ovn_dbs_vip_nic = $force_vip_nic_overrides['ovn_dbs_vip']
} else {
$ovn_dbs_vip_nic = $force_nic
}
} else {
$ovn_separate_vip = false
$ovn_dbs_vip_nic = $force_nic
}
} else {
$ovn_separate_vip = false
$ovn_dbs_vip_nic = $force_nic
}
# We create a separate VIP only in case OVN has been configured so via THT
@@ -307,18 +324,16 @@ monitor interval=30s role=Slave timeout=${dbs_timeout}s",
if $ovn_separate_vip {
if is_ipv6_address($ovn_dbs_vip) {
$netmask = '128'
$nic = interface_for_ip($ovn_dbs_vip)
$ipv6_addrlabel = '99'
} else {
$netmask = '32'
$nic = ''
$ipv6_addrlabel = ''
}
pacemaker::resource::ip { "${ovndb_vip_resource_name}":
ip_address => $ovn_dbs_vip,
cidr_netmask => $netmask,
nic => $nic,
nic => $ovn_dbs_vip_nic,
ipv6_addrlabel => $ipv6_addrlabel,
location_rule => $ovn_dbs_location_rule,
meta_params => "resource-stickiness=INFINITY ${meta_params}",

10
releasenotes/notes/vip-bind-nic-11e80207fcb78a20.yaml Normal file
View File

@@ -0,0 +1,10 @@
---
features:
- |
This change introduces two hiera keys that allow an operator to specify
which NIC (or NICs) the VIPs will be bound to. One hiera key has global effect
(tripleo::pacemaker::force_nic) and forces all VIPs to listen to that NIC.
There is also the possibility to override that for specific VIPs with the
force_vip_nic_overrides hiera hash.
This change is only useful for deployments where BGP is used to advertise
IP addresses from the host across multiple L3 networks.