Merge "Introduce nova virtlogd wrapper"
This commit is contained in:
Zuul
Gerrit Code Review
commit
0b30e7428a
|
|
@ -281,6 +281,22 @@ parameters:
|
||||||
default: "/var/lib/tripleo-config/ceph"
|
default: "/var/lib/tripleo-config/ceph"
|
||||||
description: |
|
description: |
|
||||||
The path where the Ceph Cluster config files are stored on the host.
|
The path where the Ceph Cluster config files are stored on the host.
|
||||||
|
NovaEnableVirtlogdContainerWrapper:
|
||||||
|
description: Generate a virtlogd wrapper script so that virtlogd launches
|
||||||
|
in a separate container and won't get restarted e.g. on minor
|
||||||
|
updates.
|
||||||
|
type: boolean
|
||||||
|
default: true
|
||||||
|
VirtlogdWrapperDebug:
|
||||||
|
type: boolean
|
||||||
|
default: false
|
||||||
|
description: Controls debugging for the wrapper scripts.
|
||||||
|
DeployIdentifier:
|
||||||
|
default: ''
|
||||||
|
type: string
|
||||||
|
description: >
|
||||||
|
Setting this to a unique value will re-run any deployment tasks which
|
||||||
|
perform configuration on a Heat stack-update.
|
||||||
|
|
||||||
conditions:
|
conditions:
|
||||||
|
|
||||||
|
|
@ -362,6 +378,9 @@ conditions:
|
||||||
key_size_qemu_client_override_unset: {equals: [{get_param: QemuClientCertificateKeySize}, '']}
|
key_size_qemu_client_override_unset: {equals: [{get_param: QemuClientCertificateKeySize}, '']}
|
||||||
key_size_qemu_server_override_unset: {equals: [{get_param: QemuServerCertificateKeySize}, '']}
|
key_size_qemu_server_override_unset: {equals: [{get_param: QemuServerCertificateKeySize}, '']}
|
||||||
|
|
||||||
|
virtlogd_wrapper_enabled: {equals: [{get_param: NovaEnableVirtlogdContainerWrapper}, true]}
|
||||||
|
service_debug_unset: {equals : [{get_param: VirtlogdWrapperDebug}, false]}
|
||||||
|
|
||||||
resources:
|
resources:
|
||||||
RoleParametersValue:
|
RoleParametersValue:
|
||||||
type: OS::Heat::Value
|
type: OS::Heat::Value
|
||||||
|
|
@ -415,6 +434,15 @@ outputs:
|
||||||
- get_attr: [NovaLibvirtLogging, config_settings]
|
- get_attr: [NovaLibvirtLogging, config_settings]
|
||||||
# we include ::nova::compute::libvirt::services in nova/libvirt profile
|
# we include ::nova::compute::libvirt::services in nova/libvirt profile
|
||||||
- nova::compute::libvirt::manage_libvirt_services: false
|
- nova::compute::libvirt::manage_libvirt_services: false
|
||||||
|
tripleo::profile::base::nova::virtlogd_wrapper::enable_wrapper: {get_param: NovaEnableVirtlogdContainerWrapper}
|
||||||
|
# don't think this is a good place as /var/lib/nova can also be shared storage
|
||||||
|
tripleo::profile::base::nova::virtlogd_wrapper::virtlogd_process_wrapper: '/var/lib/container-config-scripts/virtlogd_wrapper'
|
||||||
|
tripleo::profile::base::nova::virtlogd_wrapper::virtlogd_image: {get_param: ContainerNovaLibvirtImage}
|
||||||
|
tripleo::profile::base::nova::virtlogd_wrapper::debug:
|
||||||
|
if:
|
||||||
|
- service_debug_unset
|
||||||
|
- {get_attr: [NovaBase, role_data, config_settings, 'nova::logging::debug']}
|
||||||
|
- {get_param: VirtlogdWrapperDebug}
|
||||||
# we manage migration in nova common puppet profile
|
# we manage migration in nova common puppet profile
|
||||||
nova::compute::libvirt::migration_support: false
|
nova::compute::libvirt::migration_support: false
|
||||||
nova::compute::rbd::libvirt_images_rbd_ceph_conf:
|
nova::compute::rbd::libvirt_images_rbd_ceph_conf:
|
||||||
|
|
@ -543,7 +571,13 @@ outputs:
|
||||||
default_user: {get_param: CephClientUserName}
|
default_user: {get_param: CephClientUserName}
|
||||||
multiconfig: {get_param: CinderRbdMultiConfig}
|
multiconfig: {get_param: CinderRbdMultiConfig}
|
||||||
/var/lib/kolla/config_files/nova_virtlogd.json:
|
/var/lib/kolla/config_files/nova_virtlogd.json:
|
||||||
command: /usr/sbin/virtlogd --config /etc/libvirt/virtlogd.conf
|
# IF virtlogd_wrapper_enabled run the wrapper script
|
||||||
|
# if not use current command
|
||||||
|
command:
|
||||||
|
if:
|
||||||
|
- virtlogd_wrapper_enabled
|
||||||
|
- /usr/local/bin/virtlogd_wrapper
|
||||||
|
- /usr/sbin/virtlogd --config /etc/libvirt/virtlogd.conf
|
||||||
config_files:
|
config_files:
|
||||||
- source: "/var/lib/kolla/config_files/src/*"
|
- source: "/var/lib/kolla/config_files/src/*"
|
||||||
dest: "/"
|
dest: "/"
|
||||||
|
|
@ -571,134 +605,172 @@ outputs:
|
||||||
mode: "0755"
|
mode: "0755"
|
||||||
content: { get_file: ../../container_config_scripts/nova_libvirt_init_secret.sh }
|
content: { get_file: ../../container_config_scripts/nova_libvirt_init_secret.sh }
|
||||||
docker_config:
|
docker_config:
|
||||||
step_3:
|
step_2:
|
||||||
nova_virtlogd:
|
create_virtlogd_wrapper:
|
||||||
start_order: 0
|
|
||||||
image: {get_param: ContainerNovaLibvirtImage}
|
|
||||||
ulimit: {get_param: ContainerNovaLibvirtUlimit}
|
|
||||||
net: host
|
|
||||||
pid: host
|
|
||||||
security_opt: label=disable
|
|
||||||
privileged: true
|
|
||||||
restart: always
|
|
||||||
healthcheck:
|
|
||||||
test: '/openstack/healthcheck virtlogd'
|
|
||||||
volumes:
|
|
||||||
list_concat:
|
|
||||||
- {get_attr: [ContainersCommon, volumes]}
|
|
||||||
- {get_attr: [NovaLibvirtLogging, volumes]}
|
|
||||||
-
|
|
||||||
- /var/lib/kolla/config_files/nova_virtlogd.json:/var/lib/kolla/config_files/config.json:ro
|
|
||||||
- /var/lib/config-data/puppet-generated/nova_libvirt:/var/lib/kolla/config_files/src:ro
|
|
||||||
- /lib/modules:/lib/modules:ro
|
|
||||||
- /dev:/dev
|
|
||||||
- /run:/run
|
|
||||||
- /sys/fs/cgroup:/sys/fs/cgroup
|
|
||||||
- /run/libvirt:/run/libvirt:shared
|
|
||||||
- /var/lib/libvirt:/var/lib/libvirt
|
|
||||||
- /etc/libvirt/qemu:/etc/libvirt/qemu:ro
|
|
||||||
- /var/log/libvirt/qemu:/var/log/libvirt/qemu
|
|
||||||
- /var/lib/nova:/var/lib/nova:shared
|
|
||||||
environment:
|
|
||||||
KOLLA_CONFIG_STRATEGY: COPY_ALWAYS
|
|
||||||
nova_libvirt:
|
|
||||||
start_order: 1
|
start_order: 1
|
||||||
image: {get_param: ContainerNovaLibvirtImage}
|
detach: false
|
||||||
ulimit: {get_param: ContainerNovaLibvirtUlimit}
|
|
||||||
net: host
|
net: host
|
||||||
pid: host
|
pid: host
|
||||||
pids_limit: {get_param: ContainerNovaLibvirtPidsLimit}
|
user: root
|
||||||
privileged: true
|
command: # '/container_puppet_apply.sh "STEP" "TAGS" "CONFIG" "DEBUG"'
|
||||||
security_opt:
|
list_concat:
|
||||||
- label=level:s0
|
-
|
||||||
- label=type:spc_t
|
- '/container_puppet_apply.sh'
|
||||||
- label=filetype:container_share_t
|
- '4'
|
||||||
restart: always
|
- 'file'
|
||||||
depends_on:
|
- 'include ::tripleo::profile::base::nova::virtlogd_wrapper'
|
||||||
- tripleo_nova_virtlogd.service
|
image: {get_param: ContainerNovaLibvirtImage}
|
||||||
healthcheck:
|
|
||||||
test: '/openstack/healthcheck libvirtd'
|
|
||||||
volumes:
|
volumes:
|
||||||
list_concat:
|
list_concat:
|
||||||
- {get_attr: [ContainersCommon, volumes]}
|
- {get_attr: [ContainersCommon, container_puppet_apply_volumes]}
|
||||||
- {get_attr: [NovaLibvirtLogging, volumes]}
|
|
||||||
- {get_attr: [RoleParametersValue, value, nova_libvirt_opt_volumes]}
|
|
||||||
-
|
-
|
||||||
- /etc/ssh/ssh_known_hosts:/etc/ssh/ssh_known_hosts:ro
|
- /var/lib/container-config-scripts:/var/lib/container-config-scripts:shared,z
|
||||||
- /var/lib/kolla/config_files/nova_libvirt.json:/var/lib/kolla/config_files/config.json:ro
|
|
||||||
- /var/lib/config-data/puppet-generated/nova_libvirt:/var/lib/kolla/config_files/src:ro
|
|
||||||
- /var/lib/container-config-scripts/nova_libvirt_launcher.sh:/nova_libvirt_launcher.sh:ro
|
|
||||||
- list_join:
|
|
||||||
- ':'
|
|
||||||
- - {get_param: CephConfigPath}
|
|
||||||
- - '/var/lib/kolla/config_files/src-ceph'
|
|
||||||
- - 'ro'
|
|
||||||
- /lib/modules:/lib/modules:ro
|
|
||||||
- /dev:/dev
|
|
||||||
- /run:/run
|
|
||||||
- /sys/fs/cgroup:/sys/fs/cgroup
|
|
||||||
- /etc/libvirt:/etc/libvirt
|
|
||||||
- /run/libvirt:/run/libvirt:shared
|
|
||||||
- /var/lib/libvirt:/var/lib/libvirt:shared
|
|
||||||
- /var/cache/libvirt:/var/cache/libvirt:shared
|
|
||||||
- /var/log/libvirt/qemu:/var/log/libvirt/qemu:ro
|
|
||||||
- /var/lib/vhost_sockets:/var/lib/vhost_sockets
|
|
||||||
- /var/lib/nova:/var/lib/nova:shared
|
|
||||||
- /sys/fs/selinux:/sys/fs/selinux
|
|
||||||
- /etc/selinux/config:/etc/selinux/config:ro
|
|
||||||
-
|
|
||||||
if:
|
|
||||||
- use_tls_for_live_migration
|
|
||||||
-
|
|
||||||
- /etc/pki/libvirt:/etc/pki/libvirt/:ro
|
|
||||||
- /etc/pki/libvirt-nbd:/etc/pki/libvirt-nbd:ro
|
|
||||||
- str_replace:
|
|
||||||
template: "CACERT:/etc/pki/CA/cacert.pem:ro"
|
|
||||||
params:
|
|
||||||
CACERT:
|
|
||||||
if:
|
|
||||||
- libvirt_specific_ca_unset
|
|
||||||
- get_param: InternalTLSCAFile
|
|
||||||
- get_param: LibvirtCACert
|
|
||||||
- str_replace:
|
|
||||||
template: "CACERT:/etc/pki/qemu/ca-cert.pem:ro"
|
|
||||||
params:
|
|
||||||
CACERT:
|
|
||||||
if:
|
|
||||||
- libvirt_nbd_specific_ca_unset
|
|
||||||
- get_param: InternalTLSNbdCAFile
|
|
||||||
- get_param: LibvirtNbdCACert
|
|
||||||
- /etc/pki/qemu/server-cert.pem:/etc/pki/qemu/server-cert.pem:ro
|
|
||||||
- /etc/pki/qemu/server-key.pem:/etc/pki/qemu/server-key.pem:ro
|
|
||||||
- /etc/pki/qemu/server-cert.pem:/etc/pki/qemu/client-cert.pem:ro
|
|
||||||
- /etc/pki/qemu/server-key.pem:/etc/pki/qemu/client-key.pem:ro
|
|
||||||
- null
|
|
||||||
-
|
|
||||||
if:
|
|
||||||
- use_tls_for_vnc
|
|
||||||
-
|
|
||||||
- /etc/pki/libvirt-vnc/server-cert.pem:/etc/pki/libvirt-vnc/server-cert.pem:ro
|
|
||||||
- /etc/pki/libvirt-vnc/server-key.pem:/etc/pki/libvirt-vnc/server-key.pem:ro
|
|
||||||
- str_replace:
|
|
||||||
template: "CACERT:/etc/pki/libvirt-vnc/ca-cert.pem:ro"
|
|
||||||
params:
|
|
||||||
CACERT:
|
|
||||||
if:
|
|
||||||
- libvirt_vnc_specific_ca_unset
|
|
||||||
- get_param: InternalTLSVncCAFile
|
|
||||||
- get_param: LibvirtVncCACert
|
|
||||||
- null
|
|
||||||
-
|
|
||||||
if:
|
|
||||||
- memory_backing_dir_set
|
|
||||||
-
|
|
||||||
- str_replace:
|
|
||||||
template: "MEMORY_BACKING_DIR:MEMORY_BACKING_DIR"
|
|
||||||
params:
|
|
||||||
MEMORY_BACKING_DIR: {get_attr: [RoleParametersValue, value, memory_backing_dir]}
|
|
||||||
- null
|
|
||||||
environment:
|
environment:
|
||||||
KOLLA_CONFIG_STRATEGY: COPY_ALWAYS
|
# NOTE: this should force this container to re-run on each
|
||||||
|
# update (scale-out, etc.)
|
||||||
|
TRIPLEO_DEPLOY_IDENTIFIER: {get_param: DeployIdentifier}
|
||||||
|
step_3:
|
||||||
|
map_merge:
|
||||||
|
- if:
|
||||||
|
- virtlogd_wrapper_enabled
|
||||||
|
- nova_virtlogd_wrapper: &virtlog_container_config
|
||||||
|
start_order: 0
|
||||||
|
image: {get_param: ContainerNovaLibvirtImage}
|
||||||
|
ulimit: {get_param: ContainerNovaLibvirtUlimit}
|
||||||
|
net: host
|
||||||
|
pid: host
|
||||||
|
security_opt: label=disable
|
||||||
|
privileged: true
|
||||||
|
restart: always
|
||||||
|
healthcheck:
|
||||||
|
test: '/openstack/healthcheck virtlogd'
|
||||||
|
volumes:
|
||||||
|
list_concat:
|
||||||
|
- {get_attr: [ContainersCommon, volumes]}
|
||||||
|
- {get_attr: [NovaLibvirtLogging, volumes]}
|
||||||
|
-
|
||||||
|
- /var/lib/kolla/config_files/nova_virtlogd.json:/var/lib/kolla/config_files/config.json:ro
|
||||||
|
- /var/lib/config-data/puppet-generated/nova_libvirt:/var/lib/kolla/config_files/src:ro
|
||||||
|
- /lib/modules:/lib/modules:ro
|
||||||
|
- /dev:/dev
|
||||||
|
- /run:/run
|
||||||
|
- /sys/fs/cgroup:/sys/fs/cgroup
|
||||||
|
- /run/libvirt:/run/libvirt:shared
|
||||||
|
- /var/lib/libvirt:/var/lib/libvirt
|
||||||
|
- /etc/libvirt/qemu:/etc/libvirt/qemu:ro
|
||||||
|
- /var/log/libvirt/qemu:/var/log/libvirt/qemu
|
||||||
|
- /var/lib/nova:/var/lib/nova:shared
|
||||||
|
-
|
||||||
|
if:
|
||||||
|
- virtlogd_wrapper_enabled
|
||||||
|
-
|
||||||
|
- /var/lib/container-config-scripts/virtlogd_wrapper:/usr/local/bin/virtlogd_wrapper:ro
|
||||||
|
- null
|
||||||
|
environment:
|
||||||
|
KOLLA_CONFIG_STRATEGY: COPY_ALWAYS
|
||||||
|
- nova_virtlogd: *virtlog_container_config
|
||||||
|
- nova_libvirt:
|
||||||
|
start_order: 1
|
||||||
|
image: {get_param: ContainerNovaLibvirtImage}
|
||||||
|
ulimit: {get_param: ContainerNovaLibvirtUlimit}
|
||||||
|
net: host
|
||||||
|
pid: host
|
||||||
|
pids_limit: {get_param: ContainerNovaLibvirtPidsLimit}
|
||||||
|
privileged: true
|
||||||
|
security_opt:
|
||||||
|
- label=level:s0
|
||||||
|
- label=type:spc_t
|
||||||
|
- label=filetype:container_share_t
|
||||||
|
restart: always
|
||||||
|
depends_on:
|
||||||
|
-
|
||||||
|
if:
|
||||||
|
- virtlogd_wrapper_enabled
|
||||||
|
- tripleo_nova_virtlogd_wrapper.service
|
||||||
|
- tripleo_nova_virtlogd.service
|
||||||
|
healthcheck:
|
||||||
|
test: '/openstack/healthcheck libvirtd'
|
||||||
|
volumes:
|
||||||
|
list_concat:
|
||||||
|
- {get_attr: [ContainersCommon, volumes]}
|
||||||
|
- {get_attr: [NovaLibvirtLogging, volumes]}
|
||||||
|
- {get_attr: [RoleParametersValue, value, nova_libvirt_opt_volumes]}
|
||||||
|
-
|
||||||
|
- /etc/ssh/ssh_known_hosts:/etc/ssh/ssh_known_hosts:ro
|
||||||
|
- /var/lib/kolla/config_files/nova_libvirt.json:/var/lib/kolla/config_files/config.json:ro
|
||||||
|
- /var/lib/config-data/puppet-generated/nova_libvirt:/var/lib/kolla/config_files/src:ro
|
||||||
|
- /var/lib/container-config-scripts/nova_libvirt_launcher.sh:/nova_libvirt_launcher.sh:ro
|
||||||
|
- list_join:
|
||||||
|
- ':'
|
||||||
|
- - {get_param: CephConfigPath}
|
||||||
|
- - '/var/lib/kolla/config_files/src-ceph'
|
||||||
|
- - 'ro'
|
||||||
|
- /lib/modules:/lib/modules:ro
|
||||||
|
- /dev:/dev
|
||||||
|
- /run:/run
|
||||||
|
- /sys/fs/cgroup:/sys/fs/cgroup
|
||||||
|
- /etc/libvirt:/etc/libvirt
|
||||||
|
- /run/libvirt:/run/libvirt:shared
|
||||||
|
- /var/lib/libvirt:/var/lib/libvirt:shared
|
||||||
|
- /var/cache/libvirt:/var/cache/libvirt:shared
|
||||||
|
- /var/log/libvirt/qemu:/var/log/libvirt/qemu:ro
|
||||||
|
- /var/lib/vhost_sockets:/var/lib/vhost_sockets
|
||||||
|
- /var/lib/nova:/var/lib/nova:shared
|
||||||
|
- /sys/fs/selinux:/sys/fs/selinux
|
||||||
|
- /etc/selinux/config:/etc/selinux/config:ro
|
||||||
|
-
|
||||||
|
if:
|
||||||
|
- use_tls_for_live_migration
|
||||||
|
-
|
||||||
|
- /etc/pki/libvirt:/etc/pki/libvirt/:ro
|
||||||
|
- /etc/pki/libvirt-nbd:/etc/pki/libvirt-nbd:ro
|
||||||
|
- str_replace:
|
||||||
|
template: "CACERT:/etc/pki/CA/cacert.pem:ro"
|
||||||
|
params:
|
||||||
|
CACERT:
|
||||||
|
if:
|
||||||
|
- libvirt_specific_ca_unset
|
||||||
|
- get_param: InternalTLSCAFile
|
||||||
|
- get_param: LibvirtCACert
|
||||||
|
- str_replace:
|
||||||
|
template: "CACERT:/etc/pki/qemu/ca-cert.pem:ro"
|
||||||
|
params:
|
||||||
|
CACERT:
|
||||||
|
if:
|
||||||
|
- libvirt_nbd_specific_ca_unset
|
||||||
|
- get_param: InternalTLSNbdCAFile
|
||||||
|
- get_param: LibvirtNbdCACert
|
||||||
|
- /etc/pki/qemu/server-cert.pem:/etc/pki/qemu/server-cert.pem:ro
|
||||||
|
- /etc/pki/qemu/server-key.pem:/etc/pki/qemu/server-key.pem:ro
|
||||||
|
- /etc/pki/qemu/server-cert.pem:/etc/pki/qemu/client-cert.pem:ro
|
||||||
|
- /etc/pki/qemu/server-key.pem:/etc/pki/qemu/client-key.pem:ro
|
||||||
|
- null
|
||||||
|
-
|
||||||
|
if:
|
||||||
|
- use_tls_for_vnc
|
||||||
|
-
|
||||||
|
- /etc/pki/libvirt-vnc/server-cert.pem:/etc/pki/libvirt-vnc/server-cert.pem:ro
|
||||||
|
- /etc/pki/libvirt-vnc/server-key.pem:/etc/pki/libvirt-vnc/server-key.pem:ro
|
||||||
|
- str_replace:
|
||||||
|
template: "CACERT:/etc/pki/libvirt-vnc/ca-cert.pem:ro"
|
||||||
|
params:
|
||||||
|
CACERT:
|
||||||
|
if:
|
||||||
|
- libvirt_vnc_specific_ca_unset
|
||||||
|
- get_param: InternalTLSVncCAFile
|
||||||
|
- get_param: LibvirtVncCACert
|
||||||
|
- null
|
||||||
|
-
|
||||||
|
if:
|
||||||
|
- memory_backing_dir_set
|
||||||
|
-
|
||||||
|
- str_replace:
|
||||||
|
template: "MEMORY_BACKING_DIR:MEMORY_BACKING_DIR"
|
||||||
|
params:
|
||||||
|
MEMORY_BACKING_DIR: {get_attr: [RoleParametersValue, value, memory_backing_dir]}
|
||||||
|
- null
|
||||||
|
environment:
|
||||||
|
KOLLA_CONFIG_STRATEGY: COPY_ALWAYS
|
||||||
step_4:
|
step_4:
|
||||||
if:
|
if:
|
||||||
- need_libvirt_secret
|
- need_libvirt_secret
|
||||||
|
|
|
||||||
|
|
@ -0,0 +1,17 @@
|
||||||
|
---
|
||||||
|
features:
|
||||||
|
- |
|
||||||
|
When nova_virtlogd container gets restarted the instance console auth files
|
||||||
|
will not be reopened again by virtlogd. As a result either instances need
|
||||||
|
to be restarted or live migrated to a different compute node to get new
|
||||||
|
console logs messages logged again.
|
||||||
|
Usually on receipt of SIGUSR1, virtlogd will re-exec() its binary, while
|
||||||
|
maintaining all current logs and clients. This allows for live upgrades of
|
||||||
|
the virtlogd service on non containerized environments where updates just
|
||||||
|
by doing an RPM update.
|
||||||
|
To reduce the likelihood in a containerized environment virtlogd should
|
||||||
|
only be restarted on manual request, or on compute node reboot. It should
|
||||||
|
not be restarted on a minor update without migration off instances.
|
||||||
|
This introduces a nova_virtlogd_wrapper container and virtlogd wrapper
|
||||||
|
script, to only restart virtlogd on either manual or compute node restart.
|
||||||
|
|
||||||
Loading…
Reference in New Issue