Merge "Make nova ephemeral storage backend configurable per-role" into stable/rocky

docker/services/nova-libvirt.yaml

@@ -58,8 +58,10 @@ parameters:
     type: number
   NovaEnableRbdBackend:
     default: false
-    description: Whether to enable or not the Rbd backend for Nova
+    description: Whether to enable the Rbd backend for Nova ephemeral storage.
     type: boolean
+    tags:
+      - role_specific
   CinderEnableRbdBackend:
     default: false
     description: Whether to enable or not the Rbd backend for Cinder
@@ -148,12 +150,19 @@ conditions:
 
   need_libvirt_secret:
     or:
-    - equals:
+      - equals:
-      - {get_param: NovaEnableRbdBackend}
+        - {get_param: [RoleParameters, NovaEnableRbdBackend]}
-      - true
+        - true
-    - equals:
+      - and:
-      - {get_param: CinderEnableRbdBackend}
+        - equals:
-      - true
+          - {get_param: [RoleParameters, NovaEnableRbdBackend]}
+          - ''
+        - equals:
+          - {get_param: NovaEnableRbdBackend}
+          - true
+      - equals:
+        - {get_param: CinderEnableRbdBackend}
+        - true
 
   use_tls_for_vnc:
     and:

docker/services/octavia/octavia-deployment-config.yaml

@@ -69,8 +69,10 @@ parameters:
       provides a convenient way to e.g. debug load balancing services.
   NovaEnableRbdBackend:
     default: false
-    description: Whether to enable or not the Rbd backend for Nova
+    description: Whether to enable the Rbd backend for Nova ephemeral storage.
     type: boolean
+    tags:
+      - role_specific
   OctaviaControlNetwork:
     description: The name for the neutron network used for the amphora
                  control network

environments/ceph-ansible/ceph-ansible-per-role.yaml

@@ -0,0 +1,18 @@
+resource_registry:
+  OS::TripleO::Services::CephMgr: ../../docker/services/ceph-ansible/ceph-mgr.yaml
+  OS::TripleO::Services::CephMon: ../../docker/services/ceph-ansible/ceph-mon.yaml
+  OS::TripleO::Services::CephOSD: ../../docker/services/ceph-ansible/ceph-osd.yaml
+  OS::TripleO::Services::CephClient: ../../docker/services/ceph-ansible/ceph-client.yaml
+
+parameter_defaults:
+  # Ensure that if user overrides CephAnsiblePlaybook via some env
+  # file, we go back to default when they stop passing their env file.
+  CephAnsiblePlaybook: ['default']
+
+  CinderEnableIscsiBackend: false
+  CinderEnableRbdBackend: true
+  CinderBackupBackend: ceph
+  GlanceBackend: rbd
+  GnocchiBackend: rbd
+  GlanceShowMultipleLocations: true
+  # NovaEnableRbdBackend can be set on individual roles to choose RBD or local ephemeral storage

puppet/services/glance-api.yaml

@@ -129,7 +129,15 @@ parameters:
     type: string
   NovaEnableRbdBackend:
     default: false
-    description: Whether to enable or not the Rbd backend for Nova
+    description: Whether to enable the Rbd backend for Nova ephemeral storage.
+    type: boolean
+    tags:
+      - role_specific
+  GlanceShowMultipleLocations:
+    default: false
+    description: |
+      Whether to show multiple image locations e.g for copy-on-write support on
+      RBD or Netapp backends. Potential security risk, see glance.conf for more information.
     type: boolean
   GlanceImageImportPlugins:
     default: []
@@ -208,18 +216,26 @@ parameters:
 conditions:
 
   rbd_backend_enabled: {equals: [{get_param: GlanceBackend}, rbd]}
+  enable_image_conversion:
+    and:
+      - equals: [{get_param: GlanceBackend}, rbd]
+      - equals: [{get_param: NovaEnableRbdBackend}, true]
   use_tls_proxy: {equals : [{get_param: EnableInternalTLS}, true]}
   glance_workers_unset: {equals : [{get_param: GlanceWorkers}, '']}
   service_debug_unset: {equals : [{get_param: GlanceDebug}, '']}
   cinder_backend_enabled: {equals: [{get_param: GlanceBackend}, cinder]}
   glance_multiple_locations:
-    and:
+    or:
-    - equals:
+    - {equals : [{get_param: GlanceShowMultipleLocations}, true]}
-      - get_param: GlanceBackend
+    - and:
-      - rbd
+      # Keep this for compat, but ignore NovaEnableRbdBackend if it's a role param
-    - equals:
+      - equals:
-      - get_param: NovaEnableRbdBackend
+        - get_param: GlanceBackend
-      - true
+        - rbd
+      - equals:
+        - get_param: NovaEnableRbdBackend
+        - true
+
 
 resources:
 
@@ -283,7 +299,7 @@ outputs:
             glance::api::node_staging_uri: {get_param: GlanceNodeStagingUri}
             glance::api::image_import_plugins:
               if:
-              - rbd_backend_enabled
+              - enable_image_conversion
               - list_concat_unique:
                 - {get_param: GlanceImageImportPlugins}
                 - ['image_conversion']

puppet/services/nova-compute.yaml

@@ -95,8 +95,10 @@ parameters:
     type: boolean
   NovaEnableRbdBackend:
     default: false
-    description: Whether to enable or not the Rbd backend for Nova
+    description: Whether to enable the Rbd backend for Nova ephemeral storage.
     type: boolean
+    tags:
+      - role_specific
   NovaComputeLibvirtVifDriver:
     default: ''
     description: Libvirt VIF driver configuration for the network
@@ -246,7 +248,10 @@ conditions:
         - equals: [{get_param: NovaNfsEnabled}, true]
         - equals: [{get_param: [RoleParameters, NovaNfsEnabled]}, '']
       - equals: [{get_param: [RoleParameters, NovaNfsEnabled]}, true]
-      - equals: [{get_param: NovaEnableRbdBackend}, true]
+      - equals: [{get_param: [RoleParameters, NovaEnableRbdBackend]}, true]
+      - and:
+        - equals: [{get_param: [RoleParameters, NovaEnableRbdBackend]}, '']
+        - equals: [{get_param: NovaEnableRbdBackend}, true]
 
 resources:
   NovaBase:
@@ -285,6 +290,7 @@ resources:
               nfs_vers: NovaNfsVersion
               nova::compute::libvirt::mem_stats_period_seconds: NovaLibvirtMemStatsPeriodSeconds
               resume_guests_state_on_host_boot: NovaResumeGuestsStateOnHostBoot
+              nova::compute::rbd::ephemeral_storage: NovaEnableRbdBackend
             - values: {get_param: [RoleParameters]}
           - values:
               NovaVcpuPinSet: {get_param: NovaVcpuPinSet}
@@ -302,6 +308,7 @@ resources:
               NovaNfsOptions: {get_param: NovaNfsOptions}
               NovaNfsVersion: {get_param: NovaNfsVersion}
               NovaLibvirtMemStatsPeriodSeconds: {get_param: NovaLibvirtMemStatsPeriodSeconds}
+              NovaEnableRbdBackend: {get_param: NovaEnableRbdBackend}
 
 outputs:
   role_data:

roles/ComputeLocalEphemeral.yaml

@@ -0,0 +1,62 @@
+###############################################################################
+# Role: ComputeLocalEphemeral                                                 #
+###############################################################################
+- name: ComputeLocalEphemeral
+  description: |
+    Per-role compute storage backend - basic Compute Node with local ephemeral disks
+  CountDefault: 0
+  networks:
+    - InternalApi
+    - Tenant
+    - Storage
+  HostnameFormatDefault: '%stackname%-novacompute-local-%index%'
+  RoleParametersDefault:
+    TunedProfileName: "virtual-host"
+    NovaEnableRbdBackend: false
+  ServicesDefault:
+    - OS::TripleO::Services::Aide
+    - OS::TripleO::Services::AuditD
+    - OS::TripleO::Services::CACerts
+    - OS::TripleO::Services::CephClient
+    - OS::TripleO::Services::CephExternal
+    - OS::TripleO::Services::CertmongerUser
+    - OS::TripleO::Services::Collectd
+    - OS::TripleO::Services::ComputeCeilometerAgent
+    - OS::TripleO::Services::ComputeNeutronCorePlugin
+    - OS::TripleO::Services::ComputeNeutronL3Agent
+    - OS::TripleO::Services::ComputeNeutronMetadataAgent
+    - OS::TripleO::Services::ComputeNeutronOvsAgent
+    - OS::TripleO::Services::Docker
+    - OS::TripleO::Services::Fluentd
+    - OS::TripleO::Services::IpaClient
+    - OS::TripleO::Services::Ipsec
+    - OS::TripleO::Services::Iscsid
+    - OS::TripleO::Services::Kernel
+    - OS::TripleO::Services::LoginDefs
+    - OS::TripleO::Services::MetricsQdr
+    - OS::TripleO::Services::MySQLClient
+    - OS::TripleO::Services::NeutronBgpVpnBagpipe
+    - OS::TripleO::Services::NeutronLinuxbridgeAgent
+    - OS::TripleO::Services::NeutronVppAgent
+    - OS::TripleO::Services::NovaCompute
+    - OS::TripleO::Services::NovaLibvirt
+    - OS::TripleO::Services::NovaLibvirtGuests
+    - OS::TripleO::Services::NovaMigrationTarget
+    - OS::TripleO::Services::Ntp
+    - OS::TripleO::Services::ContainersLogrotateCrond
+    - OS::TripleO::Services::OpenDaylightOvs
+    - OS::TripleO::Services::Rhsm
+    - OS::TripleO::Services::RsyslogSidecar
+    - OS::TripleO::Services::Securetty
+    - OS::TripleO::Services::SensuClient
+    - OS::TripleO::Services::SkydiveAgent
+    - OS::TripleO::Services::Snmp
+    - OS::TripleO::Services::Sshd
+    - OS::TripleO::Services::Timezone
+    - OS::TripleO::Services::TripleoFirewall
+    - OS::TripleO::Services::TripleoPackages
+    - OS::TripleO::Services::Tuned
+    - OS::TripleO::Services::Vpp
+    - OS::TripleO::Services::OVNController
+    - OS::TripleO::Services::OVNMetadataAgent
+    - OS::TripleO::Services::Ptp

roles/ComputeRBDEphemeral.yaml

@@ -0,0 +1,62 @@
+###############################################################################
+# Role: ComputeRBDEphemeral                                                   #
+###############################################################################
+- name: ComputeRBDEphemeral
+  description: |
+    Per-role compute storage backend - basic Compute Node with RBD ephemeral disks
+  CountDefault: 0
+  networks:
+    - InternalApi
+    - Tenant
+    - Storage
+  HostnameFormatDefault: '%stackname%-novacompute-rbd-%index%'
+  RoleParametersDefault:
+    TunedProfileName: "virtual-host"
+    NovaEnableRbdBackend: true
+  ServicesDefault:
+    - OS::TripleO::Services::Aide
+    - OS::TripleO::Services::AuditD
+    - OS::TripleO::Services::CACerts
+    - OS::TripleO::Services::CephClient
+    - OS::TripleO::Services::CephExternal
+    - OS::TripleO::Services::CertmongerUser
+    - OS::TripleO::Services::Collectd
+    - OS::TripleO::Services::ComputeCeilometerAgent
+    - OS::TripleO::Services::ComputeNeutronCorePlugin
+    - OS::TripleO::Services::ComputeNeutronL3Agent
+    - OS::TripleO::Services::ComputeNeutronMetadataAgent
+    - OS::TripleO::Services::ComputeNeutronOvsAgent
+    - OS::TripleO::Services::Docker
+    - OS::TripleO::Services::Fluentd
+    - OS::TripleO::Services::IpaClient
+    - OS::TripleO::Services::Ipsec
+    - OS::TripleO::Services::Iscsid
+    - OS::TripleO::Services::Kernel
+    - OS::TripleO::Services::LoginDefs
+    - OS::TripleO::Services::MetricsQdr
+    - OS::TripleO::Services::MySQLClient
+    - OS::TripleO::Services::NeutronBgpVpnBagpipe
+    - OS::TripleO::Services::NeutronLinuxbridgeAgent
+    - OS::TripleO::Services::NeutronVppAgent
+    - OS::TripleO::Services::NovaCompute
+    - OS::TripleO::Services::NovaLibvirt
+    - OS::TripleO::Services::NovaLibvirtGuests
+    - OS::TripleO::Services::NovaMigrationTarget
+    - OS::TripleO::Services::Ntp
+    - OS::TripleO::Services::ContainersLogrotateCrond
+    - OS::TripleO::Services::OpenDaylightOvs
+    - OS::TripleO::Services::Rhsm
+    - OS::TripleO::Services::RsyslogSidecar
+    - OS::TripleO::Services::Securetty
+    - OS::TripleO::Services::SensuClient
+    - OS::TripleO::Services::SkydiveAgent
+    - OS::TripleO::Services::Snmp
+    - OS::TripleO::Services::Sshd
+    - OS::TripleO::Services::Timezone
+    - OS::TripleO::Services::TripleoFirewall
+    - OS::TripleO::Services::TripleoPackages
+    - OS::TripleO::Services::Tuned
+    - OS::TripleO::Services::Vpp
+    - OS::TripleO::Services::OVNController
+    - OS::TripleO::Services::OVNMetadataAgent
+    - OS::TripleO::Services::Ptp

tools/yaml-validate.py

@@ -453,7 +453,7 @@ def validate_controller_no_ceph_role(filename, tpl):
                 return 1
     return 0
 
-def validate_with_compute_role_services(role_filename, role_tpl, exclude_service):
+def validate_with_compute_role_services(role_filename, role_tpl, exclude_service=()):
     cmpt_filename = os.path.join(os.path.dirname(role_filename),
                                  './Compute.yaml')
     cmpt_tpl = yaml.load(open(cmpt_filename).read())
@@ -1111,6 +1111,10 @@ def validate(filename, param_map):
         if filename == './roles/Compute.yaml':
             retval |= validate_multiarch_compute_roles(filename, tpl)
 
+        if filename in ('./roles/ComputeLocalEphemeral.yaml',
+                        './roles/ComputeRBDEphemeral.yaml'):
+            retval |= validate_with_compute_role_services(filename, tpl)
+
         # NOTE(hjensas): The routed network data example is very different ...
         # We need to develop a more advanced validator, probably using a schema
         # definition instead.