RETIRED, A Python library for code common to TripleO CLI and TripleO UI.
Go to file
Gregory Thiemonge 734315ed7c Increase validity period of Octavia CA and certificates
Current validity period of Octavia CA and certificates is one year, this
is too short for cloud deployments: Octavia services can no longer
control a load balancer that has been running for more than one year
(dataplane still works, but cannot be configured).

This commit defines these values:
- Octavia CA validity period is 50 years.
- Octavia client certificate validity period is 10 years.

For existing deployment, the existing CA private key is fetched from
controllers, is updated using AES256 cipher if needed, then the key is
used to generate a new CA. Using an existing private key for this CA
allows to keep compability with existing client certificates.

Change-Id: I435c86306ecd5e0cafeda9d8d468483b7a34f040
Related-Bug: #1869203
(cherry picked from commit 0f168dc9ca5b01fe616f196c2f49001d7882a2c8)
(cherry picked from commit f69dfefd055642f0fddfdf5e4bf910dbf98dea40)
Note-Queens: cherry picked from tripleo-ansible/stein
(cherry picked from commit f09b55266feffc4b25dd386575e7a78be4d15f42)
2020-08-19 14:43:19 +02:00
ansible_plugins/callback Ansible json error callback plugin 2019-02-21 10:23:40 -05:00
container-images Bump ceph/daemon container image to v3.2.14 2020-06-22 16:01:53 +00:00
contrib Rename contrib to container-images for packaging 2017-04-07 16:56:29 +12:00
doc/source Update the documentation link for doc migration 2017-07-25 15:00:27 +08:00
healthcheck Silent file descriptor checks 2020-03-18 07:56:10 +01:00
heat_docker_agent Remove /etc/os-net-config/config.json in os-apply-config 2018-03-27 18:07:12 +00:00
image-yaml overcloud: include openssh element 2019-09-30 17:36:30 +00:00
playbooks Increase validity period of Octavia CA and certificates 2020-08-19 14:43:19 +02:00
releasenotes Fix Octavia certificate file path and content 2020-02-07 23:08:19 +00:00
roles Use blockinfile for tripleo-ssh-known-hosts 2019-09-10 18:08:39 +00:00
scripts container_update: Retry removing containers. 2020-02-14 19:37:03 +00:00
tools Avoid tox_install.sh for constraints support 2017-12-02 22:47:24 +00:00
tripleo_common Bump ceph/daemon container image to v3.2.14 2020-06-22 16:01:53 +00:00
undercloud_heat_plugins Add custom subclass to revert mapping 2018-04-18 15:02:16 +00:00
workbooks Scan existing controllers on update to pick up existing certs/private keys 2020-08-19 14:43:12 +02:00
zuul.d Switch scenarios to non-voting 2018-11-30 18:55:27 +00:00
.coveragerc Make coverage tests work 2015-11-30 23:01:07 +00:00
.gitignore Add ansible playbook for configuring octavia 2018-01-10 14:37:01 +00:00
.gitreview OpenDev Migration Patch 2019-04-19 19:36:53 +00:00
.mailmap Initial Cookiecutter Commit. 2015-04-29 13:34:49 +02:00
.testr.conf Initial Cookiecutter Commit. 2015-04-29 13:34:49 +02:00
CONTRIBUTING.rst Update and replace http with https for doc links 2017-10-06 13:54:31 +00:00
HACKING.rst Update the documentation link for doc migration 2017-07-25 15:00:27 +08:00
LICENSE Initial Cookiecutter Commit. 2015-04-29 13:34:49 +02:00
README.rst Fix readme doc 2018-05-31 18:17:22 +00:00
babel.cfg Initial Cookiecutter Commit. 2015-04-29 13:34:49 +02:00
requirements.txt Updated from global requirements 2018-03-03 21:06:28 +00:00
setup.cfg Workflow and action for deployment failures 2019-02-28 13:21:10 -05:00
setup.py Updated from global requirements 2017-03-10 03:40:32 +00:00
sudoers Add --xattrs to sudoers. 2018-07-18 11:19:20 +00:00
test-requirements.txt Updated from global requirements 2018-01-24 01:39:30 +00:00
tox.ini Update UPPER_CONSTRAINTS_FILE for stable/queens 2018-03-03 11:41:50 +00:00

README.rst

Team and repository tags

image

tripleo-common

A common library for TripleO workflows.

Action Development

When developing new actions, you will checkout a copy of tripleo-common to an undercloud machine and add actions as needed. To test the actions they need to be installed and selected services need to be restarted. Use the following code to accomplish these tasks. :

sudo rm -Rf /usr/lib/python2.7/site-packages/tripleo_common*
sudo python setup.py install
sudo cp /usr/share/tripleo-common/sudoers /etc/sudoers.d/tripleo-common
sudo systemctl restart openstack-mistral-executor
sudo systemctl restart openstack-mistral-engine
# this loads the actions via entrypoints
sudo mistral-db-manage populate
# make sure the new actions got loaded
mistral action-list | grep tripleo

Workflow Development

When developing new workflows, you will need to reload the modified workflows, e.g the following will reload all the workflows from the default packaged location, or you can use a similar approach to replace only a single workbook while under development. :

for workbook in $(openstack workbook list -f value -c Name | grep tripleo); do
    openstack workbook delete $workbook
done
for workflow in $(openstack workflow list -f value -c Name | grep tripleo); do
    openstack workflow delete $workflow
done
for workbook in $(ls /usr/share/openstack-tripleo-common/workbooks/*); do
    openstack workbook create $workbook
done

Validations

Prerequisites

If you haven't installed the undercloud with the enable_validations set to true, you will have to prepare your undercloud to run the validations:

$ sudo pip install git+https://git.openstack.org/openstack/tripleo-validations
$ sudo yum install ansible
$ sudo useradd validations

Finally you need to generate an SSH keypair for the validation user and copy it to the overcloud's authorized_keys files:

$ mistral execution-create tripleo.validations.v1.copy_ssh_key

Running validations using the mistral workflow

Create a context.json file containing the arguments passed to the workflow:

{
  "validation_names": ["512e", "rabbitmq-limits"]
}

Run the tripleo.validations.v1.run_validations workflow with mistral client:

mistral execution-create tripleo.validations.v1.run_validations context.json

Running groups of validations

Create a context.json file containing the arguments passed to the workflow:

{
  "group_names": ["network", "post-deployment"]
}

Run the tripleo.validations.v1.run_groups workflow with mistral client:

mistral execution-create tripleo.validations.v1.run_groups context.json