puppet-tripleo/manifests/pacemaker/haproxy_with_vip.pp
Michele Baldessari dd1d17da38 Allow to specify a nic for the VIPs + Fix nic selection when no nic is specified
This review is a merge of:
Revert of Revert "Cleanup old workaround for ipv6 VIPs": Ia41046f148e0593ea773e8409494ce5dcca4b7a2
Fix nic selection when no nic is specified : I14bfaf0060093811cddf0cdd9a130b91a3cd0477
Allow to specify a nic for the VIPs : Iaa2676655d97a66237a3bd6066985f87d3565a4d↲

We do this merge only for ussuri and train because in master and
victoria we landed "Allow to specify a nic for the VIPs" before doing
the revert of the "Cleanup old workaround for ipv6 VIPs".

So this change restores the exact state as we have in master and
victoria with a single review. We do not split the reviews because
if the Ia41046f148e0593ea773e8409494ce5dcca4b7a2 merges without
the other two we will have ipv6 broken.

This review allows the operator to specify a nic to bind to a VIP to.
It does so in two different ways:
1) Via a global 'tripleo::pacemaker::force_nic' hiera key.
For example setting 'tripleo::pacemaker::force_nic: lo'
will make sure all VIPs are added to the 'lo' network interface.

2) The global setting can be overriden via a custom hiera
hash called 'force_vip_nic_overrides' so that we can
override the binding nic for specific VIPs. For example:

  force_vip_nic_overrides:
    redis_vip: vip-test-nic
    ovn_dbs_vip: vip-test-nic

Will make sure that the redis_vip and the ovn_dbs_vip will
be bound to the 'vip-test-nic'.

Tested with:
  tripleo::pacemaker::force_nic: lo
  force_vip_nic_overrides:
    redis_vip: vip-test-nic
    ovn_dbs_vip: vip-test-nic

And correctly got all VIPs running on lo:
1: lo    inet 192.168.24.9/32 scope global lo\       valid_lft forever preferred_lft forever
1: lo    inet 172.23.1.9/32 scope global lo\       valid_lft forever preferred_lft forever

except for redis and ovn_dbs which are on the vip-test-nic:
5: vip-test-nic    inet 172.25.1.7/32 scope global vip-test-nic\       valid_lft forever preferred_lft forever

Note: The interface is intentionally kept in hiera as this change
will only be needed whenever BGP runs on all nodes and advertises the
VIPs across the ASN (i.e. we do not want to make it very exposed just
yet)

NB: Small conflict during chrry-pick due to context differences

Change-Id: I0630ae124dac304614431e67975767206555e9aa
(cherry picked from commit d632847311)
2020-12-22 08:44:48 +00:00

136 lines
4.1 KiB
Puppet

# Copyright 2016 Red Hat, Inc.
# All Rights Reserved.
#
# Licensed under the Apache License, Version 2.0 (the "License"); you may
# not use this file except in compliance with the License. You may obtain
# a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
# License for the specific language governing permissions and limitations
# under the License.
#
# == Define: tripleo::pacemaker::haproxy_with_vip
#
# Configure the vip with the haproxy under pacemaker
#
# === Parameters:
#
# [*vip_name*]
# (String) Logical name of the vip (control, public, storage ...)
# Required
#
# [*ip_address*]
# (String) IP address on which HAProxy is colocated
# Required
#
# [*location_rule*]
# (optional) Add a location constraint before actually enabling
# the resource. Must be a hash like the following example:
# location_rule => {
# resource_discovery => 'exclusive', # optional
# role => 'master|slave', # optional
# score => 0, # optional
# score_attribute => foo, # optional
# # Multiple expressions can be used
# expression => ['opsrole eq controller']
# }
# Defaults to undef
#
# [*meta_params*]
# (optional) Additional meta parameters to pass to "pcs resource create" for the VIP
# Defaults to ''
#
# [*op_params*]
# (optional) Additional op parameters to pass to "pcs resource create" for the VIP
# Defaults to ''
#
# [*pcs_tries*]
# (Optional) The number of times pcs commands should be retried.
# Defaults to 1
#
# [*nic*]
# (Optional) Specifies the nic interface on which the VIP should be added
# Defaults to undef
#
# [*ensure*]
# (Boolean) Create the all the resources only if true. False won't
# destroy the resource, it will just not create them.
# Default to true
#
define tripleo::pacemaker::haproxy_with_vip(
$vip_name,
$ip_address,
$location_rule = undef,
$meta_params = '',
$op_params = '',
$pcs_tries = 1,
$nic = undef,
$ensure = true)
{
if($ensure) {
if !is_ip_addresses($ip_address) {
fail("Haproxy VIP: ${ip_address} is not a proper IP address.")
}
if is_ipv6_address($ip_address) {
$netmask = '128'
$vip_nic = interface_for_ip($ip_address)
$ipv6_addrlabel = '99'
} else {
$netmask = '32'
$vip_nic = ''
$ipv6_addrlabel = ''
}
if $nic != undef {
$nic_real = $nic
} else {
$nic_real = $vip_nic
}
$haproxy_in_container = hiera('haproxy_docker', false)
$constraint_target_name = $haproxy_in_container ? {
true => 'haproxy-bundle',
default => 'haproxy-clone'
}
pacemaker::resource::ip { "${vip_name}_vip":
ip_address => $ip_address,
cidr_netmask => $netmask,
nic => $nic_real,
ipv6_addrlabel => $ipv6_addrlabel,
meta_params => "resource-stickiness=INFINITY ${meta_params}",
location_rule => $location_rule,
op_params => $op_params,
tries => $pcs_tries,
}
pacemaker::constraint::order { "${vip_name}_vip-then-haproxy":
first_resource => "ip-${ip_address}",
second_resource => $constraint_target_name,
first_action => 'start',
second_action => 'start',
constraint_params => 'kind=Optional',
tries => $pcs_tries,
}
pacemaker::constraint::colocation { "${vip_name}_vip-with-haproxy":
source => "ip-${ip_address}",
target => $constraint_target_name,
score => 'INFINITY',
tries => $pcs_tries,
}
$service_resource = $haproxy_in_container ? {
true => Pacemaker::Resource::Bundle['haproxy-bundle'],
default => Pacemaker::Resource::Service['haproxy']
}
Pacemaker::Resource::Ip["${vip_name}_vip"]
-> $service_resource
-> Pacemaker::Constraint::Order["${vip_name}_vip-then-haproxy"]
-> Pacemaker::Constraint::Colocation["${vip_name}_vip-with-haproxy"]
}
}