2021-03-25 16:52:04 +05:30
|
|
|
heat_template_version: wallaby
|
2018-02-08 15:48:26 -05:00
|
|
|
|
|
|
|
description: >
|
2020-04-27 13:30:18 -07:00
|
|
|
Provides the list of common container volumes and environment used by
|
|
|
|
various cinder services.
|
2018-02-08 15:48:26 -05:00
|
|
|
|
|
|
|
parameters:
|
|
|
|
EndpointMap:
|
|
|
|
default: {}
|
|
|
|
description: Mapping of service endpoint -> protocol. Typically set
|
|
|
|
via parameter_defaults in the resource registry.
|
|
|
|
type: json
|
|
|
|
ServiceData:
|
|
|
|
default: {}
|
|
|
|
description: Dictionary packing service data
|
|
|
|
type: json
|
|
|
|
ServiceNetMap:
|
|
|
|
default: {}
|
|
|
|
description: Mapping of service_name -> network name. Typically set
|
|
|
|
via parameter_defaults in the resource registry. This
|
|
|
|
mapping overrides those in ServiceNetMapDefaults.
|
|
|
|
type: json
|
|
|
|
RoleName:
|
|
|
|
default: ''
|
|
|
|
description: Role name on which the service is applied
|
|
|
|
type: string
|
|
|
|
RoleParameters:
|
|
|
|
default: {}
|
|
|
|
description: Parameters specific to the role
|
|
|
|
type: json
|
|
|
|
CinderVolumeOptVolumes:
|
|
|
|
default: []
|
|
|
|
description: list of optional volumes to be mounted
|
|
|
|
type: comma_delimited_list
|
2020-10-27 21:42:43 -04:00
|
|
|
CinderBackupOptVolumes:
|
|
|
|
default: []
|
|
|
|
description: list of optional volumes to be mounted
|
|
|
|
type: comma_delimited_list
|
2018-02-08 15:48:26 -05:00
|
|
|
CinderVolumeOptEnvVars:
|
2019-10-07 23:36:43 -04:00
|
|
|
default: {}
|
|
|
|
description: hash of optional environment variables
|
|
|
|
type: json
|
2018-08-28 14:27:57 -04:00
|
|
|
CinderEnableIscsiBackend:
|
|
|
|
default: true
|
|
|
|
description: Whether to enable or not the Iscsi backend for Cinder
|
|
|
|
type: boolean
|
|
|
|
CinderLVMLoopDeviceSize:
|
|
|
|
default: 10280
|
|
|
|
description: The size of the loopback file used by the cinder LVM driver.
|
|
|
|
type: number
|
2019-06-24 12:03:55 -07:00
|
|
|
MultipathdEnable:
|
|
|
|
default: false
|
|
|
|
description: Whether to enable the multipath daemon
|
|
|
|
type: boolean
|
2020-04-27 13:30:18 -07:00
|
|
|
CinderVolumeCluster:
|
|
|
|
default: ''
|
|
|
|
description: >
|
|
|
|
The cluster name used for deploying the cinder-volume service in an
|
|
|
|
active-active (A/A) configuration. This configuration requires the
|
|
|
|
Cinder backend drivers support A/A, and the cinder-volume service not
|
|
|
|
be managed by pacemaker. If these criteria are not met then the cluster
|
|
|
|
name must be left blank.
|
|
|
|
type: string
|
|
|
|
EnableInternalTLS:
|
|
|
|
type: boolean
|
|
|
|
default: false
|
|
|
|
EnableEtcdInternalTLS:
|
|
|
|
description: Controls whether etcd and the cinder-volume service use TLS
|
|
|
|
for cinder's lock manager, even when the rest of the internal
|
|
|
|
API network is using TLS.
|
|
|
|
type: boolean
|
2021-01-08 11:43:16 -08:00
|
|
|
default: true
|
2020-11-20 14:54:13 +01:00
|
|
|
CephConfigPath:
|
|
|
|
type: string
|
2020-11-02 14:10:52 +01:00
|
|
|
default: "/var/lib/tripleo-config/ceph"
|
2020-11-20 14:54:13 +01:00
|
|
|
description: |
|
|
|
|
The path where the Ceph Cluster config files are stored on the host.
|
2021-02-03 08:50:21 -08:00
|
|
|
CephClientUserName:
|
|
|
|
default: openstack
|
|
|
|
type: string
|
|
|
|
CephClusterName:
|
|
|
|
type: string
|
|
|
|
default: ceph
|
|
|
|
description: The Ceph cluster name.
|
|
|
|
constraints:
|
|
|
|
- allowed_pattern: "[a-zA-Z0-9]+"
|
|
|
|
description: >
|
|
|
|
The Ceph cluster name must be at least 1 character and contain only
|
|
|
|
letters and numbers.
|
2019-06-24 12:03:55 -07:00
|
|
|
|
|
|
|
conditions:
|
|
|
|
|
2020-11-24 09:09:04 -08:00
|
|
|
cinder_iscsi_backend_enabled: {equals: [{get_param: CinderEnableIscsiBackend}, true]}
|
2019-06-24 12:03:55 -07:00
|
|
|
multipathd_enabled: {equals: [{get_param: MultipathdEnable}, true]}
|
2020-04-27 13:30:18 -07:00
|
|
|
cvol_active_active_tls_enabled:
|
|
|
|
and:
|
|
|
|
- not: {equals: [{get_param: CinderVolumeCluster}, '']}
|
|
|
|
- equals: [{get_param: EnableInternalTLS}, true]
|
|
|
|
- equals: [{get_param: EnableEtcdInternalTLS}, true]
|
2018-02-08 15:48:26 -05:00
|
|
|
|
|
|
|
resources:
|
|
|
|
|
|
|
|
ContainersCommon:
|
2019-04-05 12:16:13 -04:00
|
|
|
type: ../containers-common.yaml
|
2018-02-08 15:48:26 -05:00
|
|
|
|
|
|
|
outputs:
|
2018-12-10 09:14:49 -05:00
|
|
|
cinder_common_host_prep_tasks:
|
|
|
|
description: Common host prep tasks for cinder-volume and cinder-backup services
|
|
|
|
value: &cinder_common_host_prep_tasks
|
Ensure SELinux context persist across restorecon and reboot
Until now, we only relied on the ":z" flag in order to set container
volumes label to container_file_t.
While it works fine, it has multiple issues:
- if an operator runs a restorecon, it might break the container service
- if an SELinux related package is updated, it might reset the label,
and break the container service
- it requires a container stop&start to reset the label to the expected
value
- in case of deep tree or huge amount of file, relabelling takes time
This change ensures the system sets the expected context on the specific
locations, instead of following the content of selinux-policy-targeted
rulesets.
It has an equivalent for some locations in tripleo-ansible repository:
https://review.opendev.org/c/openstack/tripleo-ansible/+/782393
Note about swift locations:
Since openstack-selinux already sets fcontext rules for, at least, once
swift location, we can't override it here. The following
openstack-selinux patch is being pushed in order to work around this
specific case:
https://github.com/redhat-openstack/openstack-selinux/pull/73
Change-Id: Icb7f58004e281b42141c70a9a4895905dc32b45d
Resolves: rhbz#1941922
2021-03-23 12:42:06 +01:00
|
|
|
- name: create fcontext entry for cinder data
|
|
|
|
sefcontext:
|
|
|
|
target: "/var/lib/cinder(/.*)?"
|
|
|
|
setype: container_file_t
|
|
|
|
state: present
|
2018-08-28 14:27:57 -04:00
|
|
|
- name: create persistent directories
|
|
|
|
file:
|
|
|
|
path: "{{ item.path }}"
|
|
|
|
state: directory
|
|
|
|
setype: "{{ item.setype }}"
|
2020-04-06 23:15:44 +02:00
|
|
|
mode: "{{ item.mode|default(omit) }}"
|
2018-08-28 14:27:57 -04:00
|
|
|
with_items:
|
2020-02-07 13:33:20 +01:00
|
|
|
- { 'path': /var/log/containers/cinder, 'setype': container_file_t, 'mode': '0750' }
|
|
|
|
- { 'path': /var/lib/cinder, 'setype': container_file_t }
|
2018-08-28 14:27:57 -04:00
|
|
|
- name: ensure ceph configurations exist
|
|
|
|
file:
|
2020-11-20 14:54:13 +01:00
|
|
|
path: {get_param: CephConfigPath}
|
2018-08-28 14:27:57 -04:00
|
|
|
state: directory
|
|
|
|
|
2020-04-27 13:30:18 -07:00
|
|
|
cinder_common_volumes:
|
|
|
|
description: Common volumes for all cinder services
|
|
|
|
value: &cinder_common_volumes
|
|
|
|
list_concat:
|
|
|
|
- {get_attr: [ContainersCommon, volumes]}
|
|
|
|
-
|
|
|
|
- /var/lib/config-data/puppet-generated/cinder:/var/lib/kolla/config_files/src:ro
|
|
|
|
- /var/log/containers/cinder:/var/log/cinder:z
|
|
|
|
-
|
|
|
|
if:
|
|
|
|
- cvol_active_active_tls_enabled
|
|
|
|
-
|
2020-07-13 13:18:59 -07:00
|
|
|
- /etc/pki/tls/certs/etcd.crt:/var/lib/kolla/config_files/src-tls/etc/pki/tls/certs/etcd.crt:ro
|
|
|
|
- /etc/pki/tls/private/etcd.key:/var/lib/kolla/config_files/src-tls/etc/pki/tls/private/etcd.key:ro
|
2020-04-27 13:30:18 -07:00
|
|
|
- []
|
|
|
|
|
2021-02-03 08:50:21 -08:00
|
|
|
cinder_common_kolla_config_files:
|
|
|
|
description: Common kolla config_files for cinder-volume and cinder-backup services
|
|
|
|
value:
|
|
|
|
- source: "/var/lib/kolla/config_files/src/*"
|
|
|
|
dest: "/"
|
|
|
|
merge: true
|
|
|
|
preserve_properties: true
|
|
|
|
- source: "/var/lib/kolla/config_files/src-ceph/"
|
|
|
|
dest: "/etc/ceph/"
|
|
|
|
merge: true
|
|
|
|
preserve_properties: true
|
|
|
|
- source: "/var/lib/kolla/config_files/src-iscsid/*"
|
|
|
|
dest: "/etc/iscsi/"
|
|
|
|
merge: true
|
|
|
|
preserve_properties: true
|
|
|
|
- source: "/var/lib/kolla/config_files/src-tls/*"
|
|
|
|
dest: "/"
|
|
|
|
merge: true
|
|
|
|
preserve_properties: true
|
|
|
|
optional: true
|
|
|
|
|
|
|
|
cinder_common_kolla_permissions:
|
|
|
|
description: Common kolla permissions for cinder-volume and cinder-backup services
|
|
|
|
value:
|
|
|
|
- path: /var/log/cinder
|
|
|
|
owner: cinder:cinder
|
|
|
|
recurse: true
|
|
|
|
- path:
|
|
|
|
str_replace:
|
|
|
|
template: /etc/ceph/CLUSTER.client.USER.keyring
|
|
|
|
params:
|
|
|
|
CLUSTER: {get_param: CephClusterName}
|
|
|
|
USER: {get_param: CephClientUserName}
|
|
|
|
owner: cinder:cinder
|
|
|
|
perm: '0600'
|
|
|
|
- path: /etc/pki/tls/certs/etcd.crt
|
|
|
|
owner: cinder:cinder
|
|
|
|
- path: /etc/pki/tls/private/etcd.key
|
|
|
|
owner: cinder:cinder
|
|
|
|
|
2018-12-10 09:14:49 -05:00
|
|
|
cinder_volume_host_prep_tasks:
|
|
|
|
description: Host prep tasks for the cinder-volume service (HA or non-HA)
|
|
|
|
value:
|
|
|
|
list_concat:
|
|
|
|
- *cinder_common_host_prep_tasks
|
|
|
|
-
|
|
|
|
- name: cinder_enable_iscsi_backend fact
|
|
|
|
set_fact:
|
2020-11-24 09:09:04 -08:00
|
|
|
cinder_enable_iscsi_backend: {if: [cinder_iscsi_backend_enabled, true, false]}
|
2019-06-14 10:29:15 -06:00
|
|
|
- when: cinder_enable_iscsi_backend|bool
|
2018-12-10 09:14:49 -05:00
|
|
|
block:
|
2019-04-10 11:06:09 -06:00
|
|
|
- name: ensure LVM rpm dependencies are installed
|
|
|
|
package:
|
|
|
|
name: lvm2
|
|
|
|
state: latest
|
2018-12-10 09:14:49 -05:00
|
|
|
- name: cinder create LVM volume group dd
|
|
|
|
command:
|
|
|
|
list_join:
|
|
|
|
- ''
|
|
|
|
- - 'dd if=/dev/zero of=/var/lib/cinder/cinder-volumes bs=1 count=0 seek='
|
|
|
|
- str_replace:
|
|
|
|
template: VALUE
|
|
|
|
params:
|
|
|
|
VALUE: {get_param: CinderLVMLoopDeviceSize}
|
|
|
|
- 'M'
|
|
|
|
args:
|
|
|
|
creates: /var/lib/cinder/cinder-volumes
|
2020-04-20 18:27:02 +01:00
|
|
|
- name: Get or create LVM loopback device
|
|
|
|
shell: |-
|
|
|
|
exit_code=0
|
|
|
|
existing_device=$(losetup -j /var/lib/cinder/cinder-volumes -l -n -O NAME)
|
|
|
|
if [[ -z "${existing_device}" ]]; then
|
|
|
|
losetup -f /var/lib/cinder/cinder-volumes --show
|
|
|
|
exit_code=2
|
|
|
|
else
|
2020-04-23 15:18:48 +01:00
|
|
|
echo ${existing_device%$'\n'*}
|
2018-12-10 09:14:49 -05:00
|
|
|
fi
|
2020-04-20 18:27:02 +01:00
|
|
|
exit ${exit_code}
|
2018-12-10 09:14:49 -05:00
|
|
|
args:
|
|
|
|
executable: /bin/bash
|
2020-04-20 18:27:02 +01:00
|
|
|
register: _loopback_device
|
|
|
|
changed_when: _loopback_device.rc == 2
|
|
|
|
failed_when: _loopback_device.rc not in [0,2]
|
|
|
|
- name: Create LVM volume group
|
|
|
|
lvg:
|
|
|
|
vg: "cinder-volumes"
|
|
|
|
pvs: "{{ _loopback_device.stdout }}"
|
|
|
|
state: present
|
2020-06-11 09:51:45 -04:00
|
|
|
when:
|
|
|
|
- not (ansible_check_mode | bool)
|
2018-12-10 09:14:49 -05:00
|
|
|
- name: cinder create service to run losetup for LVM on startup
|
|
|
|
copy:
|
|
|
|
dest: /etc/systemd/system/cinder-lvm-losetup.service
|
|
|
|
content: |
|
|
|
|
[Unit]
|
|
|
|
Description=Cinder LVM losetup
|
2020-04-20 18:27:02 +01:00
|
|
|
DefaultDependencies=no
|
|
|
|
Conflicts=umount.target
|
2020-11-24 09:09:04 -08:00
|
|
|
Requires=lvm2-monitor.service systemd-udev-settle.service
|
2020-04-20 18:27:02 +01:00
|
|
|
Before=local-fs.target umount.target
|
2020-11-24 09:09:04 -08:00
|
|
|
After=var.mount lvm2-monitor.service systemd-udev-settle.service
|
2018-12-10 09:14:49 -05:00
|
|
|
|
|
|
|
[Service]
|
|
|
|
Type=oneshot
|
2020-04-20 18:27:02 +01:00
|
|
|
ExecStart=/sbin/losetup {{ _loopback_device.stdout }} /var/lib/cinder/cinder-volumes
|
|
|
|
ExecStop=/sbin/losetup -d {{ _loopback_device.stdout }}
|
2018-12-10 09:14:49 -05:00
|
|
|
RemainAfterExit=yes
|
2018-08-28 14:27:57 -04:00
|
|
|
|
2018-12-10 09:14:49 -05:00
|
|
|
[Install]
|
2020-04-20 18:27:02 +01:00
|
|
|
WantedBy=local-fs-pre.target
|
2020-06-11 09:51:45 -04:00
|
|
|
when:
|
|
|
|
- not (ansible_check_mode | bool)
|
2018-12-10 09:14:49 -05:00
|
|
|
- name: cinder enable the LVM losetup service
|
|
|
|
systemd:
|
|
|
|
name: cinder-lvm-losetup
|
|
|
|
enabled: yes
|
|
|
|
daemon_reload: yes
|
2018-08-28 14:27:57 -04:00
|
|
|
|
2018-02-08 15:48:26 -05:00
|
|
|
cinder_volume_volumes:
|
|
|
|
description: Volumes for the cinder-volume container (HA or non-HA)
|
|
|
|
value:
|
|
|
|
list_concat:
|
2020-04-27 13:30:18 -07:00
|
|
|
- *cinder_common_volumes
|
2018-02-08 15:48:26 -05:00
|
|
|
- {get_param: CinderVolumeOptVolumes}
|
|
|
|
-
|
|
|
|
- /var/lib/kolla/config_files/cinder_volume.json:/var/lib/kolla/config_files/config.json:ro
|
|
|
|
- /etc/iscsi:/var/lib/kolla/config_files/src-iscsid:ro
|
2020-11-20 14:54:13 +01:00
|
|
|
- list_join:
|
|
|
|
- ':'
|
|
|
|
- - {get_param: CephConfigPath}
|
|
|
|
- - '/var/lib/kolla/config_files/src-ceph'
|
|
|
|
- - 'ro'
|
2018-02-08 15:48:26 -05:00
|
|
|
- /lib/modules:/lib/modules:ro
|
|
|
|
- /dev/:/dev/
|
|
|
|
- /run/:/run/
|
|
|
|
- /sys:/sys
|
2019-01-03 16:29:21 +00:00
|
|
|
- /var/lib/cinder:/var/lib/cinder:z
|
|
|
|
- /var/lib/iscsi:/var/lib/iscsi:z
|
2020-11-24 09:09:04 -08:00
|
|
|
-
|
|
|
|
if:
|
|
|
|
- cinder_iscsi_backend_enabled
|
|
|
|
- - /etc/target:/etc/target:z
|
|
|
|
- []
|
2019-06-24 12:03:55 -07:00
|
|
|
-
|
|
|
|
if:
|
|
|
|
- multipathd_enabled
|
|
|
|
- - /etc/multipath:/etc/multipath:z
|
2019-07-24 10:27:26 -07:00
|
|
|
- /etc/multipath.conf:/etc/multipath.conf:ro
|
2019-06-24 12:03:55 -07:00
|
|
|
- []
|
2018-02-08 15:48:26 -05:00
|
|
|
|
|
|
|
cinder_volume_environment:
|
|
|
|
description: Docker environment for the cinder-volume container (HA or non-HA)
|
|
|
|
value:
|
2019-10-07 23:36:43 -04:00
|
|
|
map_merge:
|
2018-02-08 15:48:26 -05:00
|
|
|
- {get_param: CinderVolumeOptEnvVars}
|
2019-10-07 23:36:43 -04:00
|
|
|
- KOLLA_CONFIG_STRATEGY: COPY_ALWAYS
|
2018-02-08 15:48:26 -05:00
|
|
|
|
2018-12-10 09:14:49 -05:00
|
|
|
cinder_backup_host_prep_tasks:
|
|
|
|
description: Host prep tasks for the cinder-backup service (HA or non-HA)
|
|
|
|
value: *cinder_common_host_prep_tasks
|
|
|
|
|
2018-02-08 15:48:26 -05:00
|
|
|
cinder_backup_volumes:
|
|
|
|
description: Volumes for the cinder-backup container (HA or non-HA)
|
|
|
|
value:
|
|
|
|
list_concat:
|
2020-04-27 13:30:18 -07:00
|
|
|
- *cinder_common_volumes
|
2020-10-27 21:42:43 -04:00
|
|
|
- {get_param: CinderBackupOptVolumes}
|
2018-02-08 15:48:26 -05:00
|
|
|
-
|
|
|
|
- /var/lib/kolla/config_files/cinder_backup.json:/var/lib/kolla/config_files/config.json:ro
|
|
|
|
- /etc/iscsi:/var/lib/kolla/config_files/src-iscsid:ro
|
2020-11-20 14:54:13 +01:00
|
|
|
- list_join:
|
|
|
|
- ':'
|
|
|
|
- - {get_param: CephConfigPath}
|
|
|
|
- - '/var/lib/kolla/config_files/src-ceph'
|
|
|
|
- - 'ro'
|
2018-02-08 15:48:26 -05:00
|
|
|
- /dev/:/dev/
|
|
|
|
- /run/:/run/
|
|
|
|
- /sys:/sys
|
|
|
|
- /lib/modules:/lib/modules:ro
|
2018-10-19 10:15:01 +02:00
|
|
|
- /var/lib/cinder:/var/lib/cinder:z
|
2019-01-03 16:29:21 +00:00
|
|
|
- /var/lib/iscsi:/var/lib/iscsi:z
|
2019-06-24 12:03:55 -07:00
|
|
|
-
|
|
|
|
if:
|
|
|
|
- multipathd_enabled
|
|
|
|
- - /etc/multipath:/etc/multipath:z
|
|
|
|
- []
|
2018-02-08 15:48:26 -05:00
|
|
|
|
|
|
|
cinder_backup_environment:
|
|
|
|
description: Docker environment for the cinder-backup container (HA or non-HA)
|
|
|
|
value:
|
2019-10-07 23:36:43 -04:00
|
|
|
KOLLA_CONFIG_STRATEGY: COPY_ALWAYS
|