2021-03-25 11:22:04 +00:00
|
|
|
heat_template_version: wallaby
|
2017-06-07 01:17:30 +00:00
|
|
|
|
|
|
|
description: >
|
|
|
|
OpenStack containerized Manila Share service
|
|
|
|
|
|
|
|
parameters:
|
2019-05-13 14:13:04 +00:00
|
|
|
ContainerManilaShareImage:
|
2017-06-07 01:17:30 +00:00
|
|
|
description: image
|
|
|
|
type: string
|
2019-05-13 14:13:04 +00:00
|
|
|
ContainerManilaConfigImage:
|
2017-06-07 01:17:30 +00:00
|
|
|
description: image
|
|
|
|
type: string
|
|
|
|
EndpointMap:
|
|
|
|
default: {}
|
|
|
|
description: Mapping of service endpoint -> protocol. Typically set
|
|
|
|
via parameter_defaults in the resource registry.
|
|
|
|
type: json
|
2017-06-22 15:25:03 +00:00
|
|
|
ServiceData:
|
|
|
|
default: {}
|
|
|
|
description: Dictionary packing service data
|
|
|
|
type: json
|
2017-06-07 01:17:30 +00:00
|
|
|
ServiceNetMap:
|
|
|
|
default: {}
|
|
|
|
description: Mapping of service_name -> network name. Typically set
|
2021-04-08 11:01:10 +00:00
|
|
|
via parameter_defaults in the resource registry. Use
|
|
|
|
parameter_merge_strategies to merge it with the defaults.
|
2017-06-07 01:17:30 +00:00
|
|
|
type: json
|
|
|
|
RoleName:
|
|
|
|
default: ''
|
|
|
|
description: Role name on which the service is applied
|
|
|
|
type: string
|
|
|
|
RoleParameters:
|
|
|
|
default: {}
|
|
|
|
description: Parameters specific to the role
|
|
|
|
type: json
|
2017-10-02 19:22:08 +00:00
|
|
|
ManilaCephClientUserName:
|
|
|
|
default: manila
|
|
|
|
type: string
|
2018-02-07 10:56:12 +00:00
|
|
|
CephClusterName:
|
|
|
|
type: string
|
|
|
|
default: ceph
|
|
|
|
description: The Ceph cluster name.
|
|
|
|
constraints:
|
|
|
|
- allowed_pattern: "[a-zA-Z0-9]+"
|
|
|
|
description: >
|
|
|
|
The Ceph cluster name must be at least 1 character and contain only
|
|
|
|
letters and numbers.
|
2020-11-20 13:54:13 +00:00
|
|
|
CephConfigPath:
|
|
|
|
type: string
|
2020-11-02 13:10:52 +00:00
|
|
|
default: "/var/lib/tripleo-config/ceph"
|
2020-11-20 13:54:13 +00:00
|
|
|
description: |
|
|
|
|
The path where the Ceph Cluster config files are stored on the host.
|
2019-01-25 20:46:35 +00:00
|
|
|
MonitoringSubscriptionManilaShare:
|
|
|
|
default: 'overcloud-manila-share'
|
|
|
|
type: string
|
|
|
|
ManilaPassword:
|
|
|
|
description: The password for the manila service account.
|
|
|
|
type: string
|
|
|
|
hidden: true
|
2020-04-26 15:23:05 +00:00
|
|
|
KeystoneRegion:
|
|
|
|
type: string
|
|
|
|
default: 'regionOne'
|
|
|
|
description: Keystone region for endpoint
|
2017-06-07 01:17:30 +00:00
|
|
|
|
|
|
|
resources:
|
|
|
|
ContainersCommon:
|
2019-04-05 16:16:13 +00:00
|
|
|
type: ../containers-common.yaml
|
2017-06-07 01:17:30 +00:00
|
|
|
|
2017-07-07 14:44:26 +00:00
|
|
|
MySQLClient:
|
2019-01-30 14:38:32 +00:00
|
|
|
type: ../../deployment/database/mysql-client.yaml
|
2017-07-07 14:44:26 +00:00
|
|
|
|
2017-06-07 01:17:30 +00:00
|
|
|
ManilaBase:
|
2019-01-25 20:46:35 +00:00
|
|
|
type: ./manila-base.yaml
|
2017-06-07 01:17:30 +00:00
|
|
|
properties:
|
|
|
|
EndpointMap: {get_param: EndpointMap}
|
2017-06-22 15:25:03 +00:00
|
|
|
ServiceData: {get_param: ServiceData}
|
2017-06-07 01:17:30 +00:00
|
|
|
ServiceNetMap: {get_param: ServiceNetMap}
|
|
|
|
RoleName: {get_param: RoleName}
|
|
|
|
RoleParameters: {get_param: RoleParameters}
|
|
|
|
|
2019-01-25 20:46:35 +00:00
|
|
|
ManilaShareCommon:
|
|
|
|
type: ./manila-share-common.yaml
|
2018-07-05 13:32:33 +00:00
|
|
|
|
2017-06-07 01:17:30 +00:00
|
|
|
outputs:
|
|
|
|
role_data:
|
|
|
|
description: Role data for the Manila Share role.
|
|
|
|
value:
|
2019-01-25 20:46:35 +00:00
|
|
|
service_name: manila_share
|
|
|
|
monitoring_subscription: {get_param: MonitoringSubscriptionManilaShare}
|
|
|
|
config_settings:
|
|
|
|
map_merge:
|
|
|
|
- get_attr: [ManilaBase, role_data, config_settings]
|
2019-03-06 16:25:22 +00:00
|
|
|
# keystone_authtoken
|
2021-04-27 04:31:12 +00:00
|
|
|
- manila::keystone::authtoken::password: {get_param: ManilaPassword}
|
2019-01-25 20:46:35 +00:00
|
|
|
manila::keystone::authtoken::www_authenticate_uri: {get_param: [EndpointMap, KeystoneInternal, uri]}
|
|
|
|
manila::keystone::authtoken::auth_url: { get_param: [EndpointMap, KeystoneInternal, uri_no_suffix] }
|
|
|
|
manila::keystone::authtoken::project_name: 'service'
|
2020-04-26 15:23:05 +00:00
|
|
|
manila::keystone::authtoken::user_domain_name: 'Default'
|
|
|
|
manila::keystone::authtoken::project_domain_name: 'Default'
|
|
|
|
manila::keystone::authtoken::region_name: {get_param: KeystoneRegion}
|
2020-10-10 15:51:06 +00:00
|
|
|
manila::keystone::authtoken::interface: 'internal'
|
2019-03-06 16:25:22 +00:00
|
|
|
# compute
|
|
|
|
manila::compute::nova::username: 'manila'
|
|
|
|
manila::compute::nova::password: {get_param: ManilaPassword}
|
|
|
|
manila::compute::nova::auth_type: 'password'
|
|
|
|
manila::compute::nova::project_name: 'service'
|
|
|
|
manila::compute::nova::user_domain_name: 'Default'
|
|
|
|
manila::compute::nova::project_domain_name: 'Default'
|
|
|
|
manila::compute::nova::auth_url: {get_param: [EndpointMap, KeystoneInternal, uri_no_suffix]}
|
2020-04-26 15:23:05 +00:00
|
|
|
manila::compute::nova::region_name: {get_param: KeystoneRegion}
|
2019-03-06 16:25:22 +00:00
|
|
|
# network
|
|
|
|
manila::network::neutron::username: 'manila'
|
|
|
|
manila::network::neutron::password: {get_param: ManilaPassword}
|
|
|
|
manila::network::neutron::auth_type: 'password'
|
|
|
|
manila::network::neutron::project_name: 'service'
|
|
|
|
manila::network::neutron::user_domain_name: 'Default'
|
|
|
|
manila::network::neutron::project_domain_name: 'Default'
|
|
|
|
manila::network::neutron::auth_url: {get_param: [EndpointMap, KeystoneInternal, uri_no_suffix]}
|
2020-04-26 15:23:05 +00:00
|
|
|
manila::network::neutron::region_name: {get_param: KeystoneRegion}
|
2020-04-26 15:18:58 +00:00
|
|
|
# volume
|
|
|
|
manila::volume::cinder::username: 'manila'
|
|
|
|
manila::volume::cinder::password: {get_param: ManilaPassword}
|
|
|
|
manila::volume::cinder::auth_type: 'password'
|
|
|
|
manila::volume::cinder::project_name: 'service'
|
|
|
|
manila::volume::cinder::user_domain_name: 'Default'
|
|
|
|
manila::volume::cinder::project_domain_name: 'Default'
|
|
|
|
manila::volume::cinder::auth_url: {get_param: [EndpointMap, KeystoneInternal, uri_no_suffix]}
|
|
|
|
manila::volume::cinder::region_name: {get_param: KeystoneRegion}
|
2019-01-25 20:46:35 +00:00
|
|
|
service_config_settings:
|
|
|
|
{get_attr: [ManilaBase, role_data, service_config_settings]}
|
2017-06-07 01:17:30 +00:00
|
|
|
# BEGIN DOCKER SETTINGS
|
|
|
|
puppet_config:
|
|
|
|
config_volume: manila
|
2018-07-27 15:51:47 +00:00
|
|
|
puppet_tags: manila_config,file,concat,file_line
|
2017-11-13 19:51:37 +00:00
|
|
|
step_config:
|
|
|
|
list_join:
|
|
|
|
- "\n"
|
2020-04-09 12:07:34 +00:00
|
|
|
- - "include tripleo::profile::base::manila::share"
|
2017-11-13 19:51:37 +00:00
|
|
|
- {get_attr: [MySQLClient, role_data, step_config]}
|
2019-05-13 14:13:04 +00:00
|
|
|
config_image: {get_param: ContainerManilaConfigImage}
|
2017-06-07 01:17:30 +00:00
|
|
|
kolla_config:
|
|
|
|
/var/lib/kolla/config_files/manila_share.json:
|
2021-09-17 08:17:32 +00:00
|
|
|
command: /usr/bin/manila-share --config-file /etc/manila/manila.conf
|
2017-06-07 01:17:30 +00:00
|
|
|
config_files:
|
|
|
|
- source: "/var/lib/kolla/config_files/src/*"
|
|
|
|
dest: "/"
|
|
|
|
merge: true
|
|
|
|
preserve_properties: true
|
2017-07-11 10:20:05 +00:00
|
|
|
- source: "/var/lib/kolla/config_files/src-ceph/"
|
|
|
|
dest: "/etc/ceph/"
|
2017-06-07 01:17:30 +00:00
|
|
|
merge: true
|
|
|
|
preserve_properties: true
|
|
|
|
permissions:
|
|
|
|
- path: /var/log/manila
|
|
|
|
owner: manila:manila
|
|
|
|
recurse: true
|
2019-08-30 00:38:15 +00:00
|
|
|
- path: /var/lib/manila
|
|
|
|
owner: manila:manila
|
|
|
|
recurse: true
|
2017-10-02 19:22:08 +00:00
|
|
|
- path:
|
|
|
|
str_replace:
|
2018-02-07 10:56:12 +00:00
|
|
|
template: /etc/ceph/CLUSTER.client.USER.keyring
|
2017-10-02 19:22:08 +00:00
|
|
|
params:
|
2018-02-07 10:56:12 +00:00
|
|
|
CLUSTER: {get_param: CephClusterName}
|
2017-10-02 19:22:08 +00:00
|
|
|
USER: {get_param: ManilaCephClientUserName}
|
|
|
|
owner: manila:manila
|
|
|
|
perm: '0600'
|
2017-06-07 01:17:30 +00:00
|
|
|
docker_config:
|
|
|
|
step_4:
|
|
|
|
manila_share:
|
2019-05-13 14:13:04 +00:00
|
|
|
image: &manila_share_image {get_param: ContainerManilaShareImage}
|
2017-06-07 01:17:30 +00:00
|
|
|
net: host
|
2019-08-30 00:38:15 +00:00
|
|
|
ipc: host
|
|
|
|
user: root
|
2017-06-07 01:17:30 +00:00
|
|
|
restart: always
|
2019-01-25 20:46:35 +00:00
|
|
|
volumes: {get_attr: [ManilaShareCommon, manila_share_volumes]}
|
|
|
|
environment: {get_attr: [ManilaShareCommon, manila_share_environment]}
|
2017-06-07 01:17:30 +00:00
|
|
|
host_prep_tasks:
|
Ensure SELinux context persist across restorecon and reboot
Until now, we only relied on the ":z" flag in order to set container
volumes label to container_file_t.
While it works fine, it has multiple issues:
- if an operator runs a restorecon, it might break the container service
- if an SELinux related package is updated, it might reset the label,
and break the container service
- it requires a container stop&start to reset the label to the expected
value
- in case of deep tree or huge amount of file, relabelling takes time
This change ensures the system sets the expected context on the specific
locations, instead of following the content of selinux-policy-targeted
rulesets.
It has an equivalent for some locations in tripleo-ansible repository:
https://review.opendev.org/c/openstack/tripleo-ansible/+/782393
Note about swift locations:
Since openstack-selinux already sets fcontext rules for, at least, once
swift location, we can't override it here. The following
openstack-selinux patch is being pushed in order to work around this
specific case:
https://github.com/redhat-openstack/openstack-selinux/pull/73
Change-Id: Icb7f58004e281b42141c70a9a4895905dc32b45d
Resolves: rhbz#1941922
2021-03-23 11:42:06 +00:00
|
|
|
- name: create fcontext entry for manila data
|
2021-06-10 12:17:07 +00:00
|
|
|
community.general.sefcontext:
|
Ensure SELinux context persist across restorecon and reboot
Until now, we only relied on the ":z" flag in order to set container
volumes label to container_file_t.
While it works fine, it has multiple issues:
- if an operator runs a restorecon, it might break the container service
- if an SELinux related package is updated, it might reset the label,
and break the container service
- it requires a container stop&start to reset the label to the expected
value
- in case of deep tree or huge amount of file, relabelling takes time
This change ensures the system sets the expected context on the specific
locations, instead of following the content of selinux-policy-targeted
rulesets.
It has an equivalent for some locations in tripleo-ansible repository:
https://review.opendev.org/c/openstack/tripleo-ansible/+/782393
Note about swift locations:
Since openstack-selinux already sets fcontext rules for, at least, once
swift location, we can't override it here. The following
openstack-selinux patch is being pushed in order to work around this
specific case:
https://github.com/redhat-openstack/openstack-selinux/pull/73
Change-Id: Icb7f58004e281b42141c70a9a4895905dc32b45d
Resolves: rhbz#1941922
2021-03-23 11:42:06 +00:00
|
|
|
target: "/var/lib/manila(/.*)?"
|
|
|
|
setype: container_file_t
|
|
|
|
state: present
|
2017-06-07 01:17:30 +00:00
|
|
|
- name: create persistent directories
|
|
|
|
file:
|
2018-10-19 08:15:01 +00:00
|
|
|
path: "{{ item.path }}"
|
2017-06-07 01:17:30 +00:00
|
|
|
state: directory
|
2018-10-19 08:15:01 +00:00
|
|
|
setype: "{{ item.setype }}"
|
2020-04-06 21:15:44 +00:00
|
|
|
mode: "{{ item.mode|default(omit) }}"
|
2018-01-19 12:43:57 +00:00
|
|
|
with_items:
|
2020-02-07 12:33:20 +00:00
|
|
|
- { 'path': /var/log/containers/manila, 'setype': container_file_t, 'mode': '0750' }
|
|
|
|
- { 'path': /var/lib/manila, 'setype': container_file_t }
|
2017-07-11 10:20:05 +00:00
|
|
|
- name: ensure ceph configurations exist
|
|
|
|
file:
|
2020-11-20 13:54:13 +00:00
|
|
|
path: {get_param:CephConfigPath}
|
2017-07-11 10:20:05 +00:00
|
|
|
state: directory
|
2018-12-04 19:36:12 +00:00
|
|
|
upgrade_tasks: []
|
2021-02-15 01:02:23 +00:00
|
|
|
external_upgrade_tasks:
|
|
|
|
- when:
|
|
|
|
- step|int == 1
|
|
|
|
tags:
|
|
|
|
- never
|
|
|
|
- system_upgrade_transfer_data
|
|
|
|
- system_upgrade_stop_services
|
|
|
|
block:
|
|
|
|
- name: Stop manila share container
|
|
|
|
import_role:
|
|
|
|
name: tripleo_container_stop
|
|
|
|
vars:
|
|
|
|
tripleo_containers_to_stop:
|
|
|
|
- manila_share
|
|
|
|
tripleo_delegate_to: "{{ groups['manila_share'] | default([]) }}"
|