openstack/tripleo-heat-templates
Code Issues Proposed changes

Support for Ocata-Pike live-migration over ssh

Browse Source 
In Ocata all live-migration over ssh is performed on the default ssh port (22).
In Pike the containerized live-migration over ssh is on port 2022 as the
docker host's sshd is using port 22.

To allow live migration during upgrade we need to temporarily pin the Pike
computes to port 22 and in the final converge we can switch over to port 2022.

This also changes the default port to 2022 for baremetal computes in Pike to
enable live-migration between baremetal and containerized computes.

Change-Id: Icb9bfdd9a99dc1dce28eb95c50a9a36bffa621b1
Depends-On: I0b80b81711f683be539939e7d084365ff63546d3
Closes-Bug: 1714171
This commit is contained in:
Oliver Walsh 2017-09-06 11:35:07 +01:00
parent 520f889a31
commit 17fd16b9f2
14 changed files with 145 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
docker/services/nova-compute.yaml
View File

@ -63,7 +63,6 @@ resources:
DefaultPasswords: {get_param: DefaultPasswords}
RoleName: {get_param: RoleName}
RoleParameters: {get_param: RoleParameters}
MigrationSshPort: {get_param: DockerNovaMigrationSshdPort}
outputs:
role_data:

1
docker/services/nova-libvirt.yaml
View File

@ -105,7 +105,6 @@ resources:
DefaultPasswords: {get_param: DefaultPasswords}
RoleName: {get_param: RoleName}
RoleParameters: {get_param: RoleParameters}
MigrationSshPort: {get_param: DockerNovaMigrationSshdPort}
outputs:
role_data:

36
docker/services/nova-migration-target.yaml
View File

@ -41,6 +41,29 @@ parameters:
description: Port that dockerized nova migration target sshd service
binds to.
type: number
MigrationSshKey:
type: json
description: >
SSH key for migration.
Expects a dictionary with keys 'public_key' and 'private_key'.
Values should be identical to SSH public/private key files.
default:
public_key: ''
private_key: ''
MigrationSshPort:
default: 2022
description: Target port for migration over ssh
type: number
conditions:
# During Ocata->Pike upgrade initially configure the ssh service on port 22
# to proxy migration commands to the containerized sshd on port 2022.
# When the upgrade converges we can switch migrations over to port 2022.
enable_migration_proxy:
equals:
- {get_param: MigrationSshPort}
- 22
resources:
@ -74,10 +97,15 @@ outputs:
map_merge:
- get_attr: [SshdBase, role_data, config_settings]
- get_attr: [NovaMigrationTargetBase, role_data, config_settings]
- tripleo.nova_migration_target.firewall_rules:
'113 nova_migration_target':
dport:
- {get_param: DockerNovaMigrationSshdPort}
# NB this prevents the baremetal ssh from listening on port 2022
# It doesn't affect the sshd port in the container as we override it below on the sshd cli
- tripleo::profile::base::sshd::port: 22
- if:
- enable_migration_proxy
- tripleo::profile::base::nova::migration::proxy::ssh_private_key: {get_param: [ MigrationSshKey, private_key ]}
tripleo::profile::base::nova::migration::proxy::target_port: {get_param: DockerNovaMigrationSshdPort}
tripleo::profile::base::nova::migration::proxy::target_host: "%{hiera('live_migration_ssh_inbound_addr')}"
- {}
step_config: &step_config
list_join:
- "\n"

72
docker/services/sshd.yaml Normal file
View File

@ -0,0 +1,72 @@
heat_template_version: pike
description: >
Configure sshd_config
parameters:
ServiceData:
default: {}
description: Dictionary packing service data
type: json
ServiceNetMap:
default: {}
description: Mapping of service_name -> network name. Typically set
via parameter_defaults in the resource registry. This
mapping overrides those in ServiceNetMapDefaults.
type: json
DefaultPasswords:
default: {}
type: json
RoleName:
default: ''
description: Role name on which the service is applied
type: string
RoleParameters:
default: {}
description: Parameters specific to the role
type: json
EndpointMap:
default: {}
description: Mapping of service endpoint -> protocol. Typically set
via parameter_defaults in the resource registry.
type: json
MigrationSshPort:
default: 2022
description: Target port for migration over ssh
type: number
conditions:
# During Ocata->Pike upgrade initially configure the ssh service on port 22
# to proxy migration commands to the containerized sshd on port 2022.
# When the upgrade converges we can switch migrations over to port 2022.
enable_migration_proxy:
equals:
- {get_param: MigrationSshPort}
- 22
resources:
SshdBase:
type: ../../puppet/services/sshd.yaml
properties:
EndpointMap: {get_param: EndpointMap}
ServiceNetMap: {get_param: ServiceNetMap}
DefaultPasswords: {get_param: DefaultPasswords}
RoleName: {get_param: RoleName}
RoleParameters: {get_param: RoleParameters}
outputs:
role_data:
description: Role data for the ssh
value:
service_name: sshd
config_settings: {get_attr: [SshdBase, role_data, config_settings]}
step_config:
list_join:
- "\n"
- - get_attr: [SshdBase, role_data, step_config]
- if:
- enable_migration_proxy
- |
include tripleo::profile::base::nova::migration::proxy
- ''

1
environments/docker-services-tls-everywhere.yaml
View File

@ -49,6 +49,7 @@ resource_registry:
OS::TripleO::Services::PankoApi: ../docker/services/panko-api.yaml
OS::TripleO::Services::RabbitMQ: ../docker/services/rabbitmq.yaml
OS::TripleO::Services::Redis: ../docker/services/database/redis.yaml
OS::TripleO::Services::Sshd: ../docker/services/sshd.yaml
OS::TripleO::Services::SwiftProxy: ../docker/services/swift-proxy.yaml
OS::TripleO::Services::SwiftRingBuilder: ../docker/services/swift-ringbuilder.yaml
OS::TripleO::Services::SwiftStorage: ../docker/services/swift-storage.yaml

1
environments/docker.yaml
View File

@ -33,6 +33,7 @@ resource_registry:
OS::TripleO::Services::MongoDb: ../docker/services/database/mongodb.yaml
OS::TripleO::Services::Redis: ../docker/services/database/redis.yaml
OS::TripleO::Services::Memcached: ../docker/services/memcached.yaml
OS::TripleO::Services::Sshd: ../docker/services/sshd.yaml
OS::TripleO::Services::SwiftProxy: ../docker/services/swift-proxy.yaml
OS::TripleO::Services::SwiftStorage: ../docker/services/swift-storage.yaml
OS::TripleO::Services::SwiftRingBuilder: ../docker/services/swift-ringbuilder.yaml

1
environments/major-upgrade-composable-steps-docker.yaml
View File

@ -9,3 +9,4 @@ parameter_defaults:
set -eu
# Ocata to Pike, put any needed host-level workarounds here
yum install -y ansible-pacemaker
MigrationSshPort: 22

1
environments/major-upgrade-composable-steps.yaml
View File

@ -14,3 +14,4 @@ parameter_defaults:
rm -f /usr/libexec/os-apply-config/templates/etc/puppet/hiera.yaml
rm -f /usr/libexec/os-refresh-config/configure.d/40-hiera-datafiles
rm -f /etc/puppet/hieradata/*.yaml
MigrationSshPort: 22

1
environments/major-upgrade-converge-docker.yaml
View File

@ -8,3 +8,4 @@ parameter_defaults:
UpgradeLevelNovaCompute: ''
UpgradeInitCommonCommand: ''
UpgradeInitCommand: ''
MigrationSshPort: 2022

1
environments/major-upgrade-converge.yaml
View File

@ -8,3 +8,4 @@ parameter_defaults:
UpgradeLevelNovaCompute: ''
UpgradeInitCommonCommand: ''
UpgradeInitCommand: ''
MigrationSshPort: 2022

2
puppet/services/nova-compute.yaml
View File

@ -108,7 +108,7 @@ parameters:
public_key: ''
private_key: ''
MigrationSshPort:
default: 22
default: 2022
description: Target port for migration over ssh
type: number

2
puppet/services/nova-libvirt.yaml
View File

@ -94,7 +94,7 @@ parameters:
public_key: ''
private_key: ''
MigrationSshPort:
default: 22
default: 2022
description: Target port for migration over ssh
type: number

11
puppet/services/nova-migration-target.yaml
View File

@ -39,6 +39,10 @@ parameters:
default:
public_key: ''
private_key: ''
MigrationSshPort:
default: 2022
description: Target port for migration over ssh
type: number
outputs:
role_data:
@ -53,5 +57,12 @@ outputs:
- "%{hiera('live_migration_ssh_inbound_addr')}"
live_migration_ssh_inbound_addr: {get_param: [ServiceNetMap, NovaLibvirtNetwork]}
cold_migration_ssh_inbound_addr: {get_param: [ServiceNetMap, NovaColdMigrationNetwork]}
tripleo::profile::base::sshd::port:
- 22
- {get_param: MigrationSshPort}
tripleo.nova_migration_target.firewall_rules:
'113 nova_migration_target':
dport:
- {get_param: MigrationSshPort}
step_config: |
include tripleo::profile::base::nova::migration::target

26
tools/yaml-validate.py
View File

@ -113,6 +113,22 @@ PREFERRED_CAMEL_CASE = {
'haproxy': 'HAProxy',
}
# Overrides for docker/puppet validation
# <filename>: True explicitly enables validation
# <filename>: False explicitly disables validation
#
# If a filename is not found in the overrides then the top level directory is
# used to determine which validation method to use.
VALIDATE_PUPPET_OVERRIDE = {
# docker/service/sshd.yaml is a variation of the puppet sshd service
'./docker/services/sshd.yaml': True,
# qdr aliases rabbitmq service to provide alternative messaging backend
'./puppet/services/qdr.yaml': False,
}
VALIDATE_DOCKER_OVERRIDE = {
# docker/service/sshd.yaml is a variation of the puppet sshd service
'./docker/services/sshd.yaml': False,
}
def exit_usage():
print('Usage %s <yaml file or directory>' % sys.argv[0])
@ -433,12 +449,14 @@ def validate(filename, param_map):
% filename)
return 1
# qdr aliases rabbitmq service to provide alternative messaging backend
if (filename.startswith('./puppet/services/') and
filename not in ['./puppet/services/qdr.yaml']):
if VALIDATE_PUPPET_OVERRIDE.get(filename, False) or (
filename.startswith('./puppet/services/') and
VALIDATE_PUPPET_OVERRIDE.get(filename, True)):
retval = validate_service(filename, tpl)
if filename.startswith('./docker/services/'):
if VALIDATE_DOCKER_OVERRIDE.get(filename, False) or (
filename.startswith('./docker/services/') and
VALIDATE_DOCKER_OVERRIDE.get(filename, True)):
retval = validate_docker_service(filename, tpl)
if filename.endswith('hyperconverged-ceph.yaml'):