Make nova ephemeral storage backend configurable per-role

When multiple Compute roles are used, admins may want to use different storage
backends on each role.

This change turns NovaEnableRbdBackend into a role specific param.
Any other config that is implicitly enabled by the global NovaEnableRbdBackend
now requires a dedicated param.

Co-Authored-By: ratailor@redhat.com
Change-Id: I9f40a2a3561fcb1d1fec9d9c3c1f9cabaf02650c
Implements: blueprint nova-backend-per-role
(cherry picked from commit 65d7e55f54)
(cherry picked from commit ed8d9da9b6)
(cherry picked from commit b1febf785d)

docker/services/nova-libvirt.yaml

@@ -58,8 +58,10 @@ parameters:
     type: number
   NovaEnableRbdBackend:
     default: false
-    description: Whether to enable or not the Rbd backend for Nova
+    description: Whether to enable the Rbd backend for Nova ephemeral storage.
     type: boolean
+    tags:
+      - role_specific
   CinderEnableRbdBackend:
     default: false
     description: Whether to enable or not the Rbd backend for Cinder
@@ -148,12 +150,19 @@ conditions:
 
   need_libvirt_secret:
     or:
-    - equals:
+      - equals:
-      - {get_param: NovaEnableRbdBackend}
+        - {get_param: [RoleParameters, NovaEnableRbdBackend]}
-      - true
+        - true
-    - equals:
+      - and:
-      - {get_param: CinderEnableRbdBackend}
+        - equals:
-      - true
+          - {get_param: [RoleParameters, NovaEnableRbdBackend]}
+          - ''
+        - equals:
+          - {get_param: NovaEnableRbdBackend}
+          - true
+      - equals:
+        - {get_param: CinderEnableRbdBackend}
+        - true
 
   use_tls_for_vnc:
     and:

docker/services/octavia/octavia-deployment-config.yaml

@@ -67,8 +67,10 @@ parameters:
       provides a convenient way to e.g. debug load balancing services.
   NovaEnableRbdBackend:
     default: false
-    description: Whether to enable or not the Rbd backend for Nova
+    description: Whether to enable the Rbd backend for Nova ephemeral storage.
     type: boolean
+    tags:
+      - role_specific
   OctaviaControlNetwork:
     description: The name for the neutron network used for the amphora
                  control network

environments/ceph-ansible/ceph-ansible-per-role.yaml

@@ -0,0 +1,14 @@
+resource_registry:
+  OS::TripleO::Services::CephMgr: ../../docker/services/ceph-ansible/ceph-mgr.yaml
+  OS::TripleO::Services::CephMon: ../../docker/services/ceph-ansible/ceph-mon.yaml
+  OS::TripleO::Services::CephOSD: ../../docker/services/ceph-ansible/ceph-osd.yaml
+  OS::TripleO::Services::CephClient: ../../docker/services/ceph-ansible/ceph-client.yaml
+
+parameter_defaults:
+  CinderEnableIscsiBackend: false
+  CinderEnableRbdBackend: true
+  CinderBackupBackend: ceph
+  GlanceBackend: rbd
+  GnocchiBackend: rbd
+  GlanceShowMultipleLocations: true
+  # NovaEnableRbdBackend can be set on individual roles to choose RBD or local ephemeral storage

puppet/services/glance-api.yaml

@@ -129,7 +129,15 @@ parameters:
     type: string
   NovaEnableRbdBackend:
     default: false
-    description: Whether to enable or not the Rbd backend for Nova
+    description: Whether to enable the Rbd backend for Nova ephemeral storage.
+    type: boolean
+    tags:
+      - role_specific
+  GlanceShowMultipleLocations:
+    default: false
+    description: |
+      Whether to show multiple image locations e.g for copy-on-write support on
+      RBD or Netapp backends. Potential security risk, see glance.conf for more information.
     type: boolean
   GlanceEnabledImportMethods:
     default: 'web-download'
@@ -193,13 +201,17 @@ conditions:
   service_debug_unset: {equals : [{get_param: GlanceDebug}, '']}
   cinder_backend_enabled: {equals: [{get_param: GlanceBackend}, cinder]}
   glance_multiple_locations:
-    and:
+    or:
-    - equals:
+    - {equals : [{get_param: GlanceShowMultipleLocations}, true]}
-      - get_param: GlanceBackend
+    - and:
-      - rbd
+      # Keep this for compat, but ignore NovaEnableRbdBackend if it's a role param
-    - equals:
+      - equals:
-      - get_param: NovaEnableRbdBackend
+        - get_param: GlanceBackend
-      - true
+        - rbd
+      - equals:
+        - get_param: NovaEnableRbdBackend
+        - true
+
 
 resources:
 

puppet/services/nova-compute.yaml

@@ -95,8 +95,10 @@ parameters:
     type: boolean
   NovaEnableRbdBackend:
     default: false
-    description: Whether to enable or not the Rbd backend for Nova
+    description: Whether to enable the Rbd backend for Nova ephemeral storage.
     type: boolean
+    tags:
+      - role_specific
   NovaComputeLibvirtVifDriver:
     default: ''
     description: Libvirt VIF driver configuration for the network
@@ -217,7 +219,10 @@ conditions:
         - equals: [{get_param: NovaNfsEnabled}, true]
         - equals: [{get_param: [RoleParameters, NovaNfsEnabled]}, '']
       - equals: [{get_param: [RoleParameters, NovaNfsEnabled]}, true]
-      - equals: [{get_param: NovaEnableRbdBackend}, true]
+      - equals: [{get_param: [RoleParameters, NovaEnableRbdBackend]}, true]
+      - and:
+        - equals: [{get_param: [RoleParameters, NovaEnableRbdBackend]}, '']
+        - equals: [{get_param: NovaEnableRbdBackend}, true]
 
 resources:
   NovaBase:
@@ -253,6 +258,7 @@ resources:
               nova::compute::libvirt::mem_stats_period_seconds: NovaLibvirtMemStatsPeriodSeconds
               nova::compute::resume_guests_state_on_host_boot: NovaResumeGuestsStateOnHostBoot
               resume_guests_state_on_host_boot: NovaResumeGuestsStateOnHostBoot
+              nova::compute::rbd::ephemeral_storage: NovaEnableRbdBackend
             - values: {get_param: [RoleParameters]}
           - values:
               NovaVcpuPinSet: {get_param: NovaVcpuPinSet}
@@ -267,6 +273,7 @@ resources:
               NovaNfsVersion: {get_param: NovaNfsVersion}
               NovaLibvirtMemStatsPeriodSeconds: {get_param: NovaLibvirtMemStatsPeriodSeconds}
               NovaResumeGuestsStateOnHostBoot: {get_param: NovaResumeGuestsStateOnHostBoot}
+              NovaEnableRbdBackend: {get_param: NovaEnableRbdBackend}
 
 outputs:
   role_data:

roles/ComputeLocalEphemeral.yaml

@@ -0,0 +1,62 @@
+###############################################################################
+# Role: ComputeLocalEphemeral                                                 #
+###############################################################################
+- name: ComputeLocalEphemeral
+  description: |
+    Per-role compute storage backend - basic Compute Node with local ephemeral disks
+  CountDefault: 0
+  networks:
+    - InternalApi
+    - Tenant
+    - Storage
+  HostnameFormatDefault: '%stackname%-novacompute-local-%index%'
+  RoleParametersDefault:
+    TunedProfileName: "virtual-host"
+    NovaEnableRbdBackend: false
+  ServicesDefault:
+    - OS::TripleO::Services::Aide
+    - OS::TripleO::Services::AuditD
+    - OS::TripleO::Services::CACerts
+    - OS::TripleO::Services::CephClient
+    - OS::TripleO::Services::CephExternal
+    - OS::TripleO::Services::CertmongerUser
+    - OS::TripleO::Services::Collectd
+    - OS::TripleO::Services::ComputeCeilometerAgent
+    - OS::TripleO::Services::ComputeNeutronCorePlugin
+    - OS::TripleO::Services::ComputeNeutronL3Agent
+    - OS::TripleO::Services::ComputeNeutronMetadataAgent
+    - OS::TripleO::Services::ComputeNeutronOvsAgent
+    - OS::TripleO::Services::Docker
+    - OS::TripleO::Services::Fluentd
+    - OS::TripleO::Services::IpaClient
+    - OS::TripleO::Services::Ipsec
+    - OS::TripleO::Services::Iscsid
+    - OS::TripleO::Services::Kernel
+    - OS::TripleO::Services::LoginDefs
+    - OS::TripleO::Services::MetricsQdr
+    - OS::TripleO::Services::MySQLClient
+    - OS::TripleO::Services::NeutronBgpVpnBagpipe
+    - OS::TripleO::Services::NeutronLinuxbridgeAgent
+    - OS::TripleO::Services::NeutronVppAgent
+    - OS::TripleO::Services::NovaCompute
+    - OS::TripleO::Services::NovaLibvirt
+    - OS::TripleO::Services::NovaLibvirtGuests
+    - OS::TripleO::Services::NovaMigrationTarget
+    - OS::TripleO::Services::Ntp
+    - OS::TripleO::Services::ContainersLogrotateCrond
+    - OS::TripleO::Services::OpenDaylightOvs
+    - OS::TripleO::Services::Rhsm
+    - OS::TripleO::Services::RsyslogSidecar
+    - OS::TripleO::Services::Securetty
+    - OS::TripleO::Services::SensuClient
+    - OS::TripleO::Services::SkydiveAgent
+    - OS::TripleO::Services::Snmp
+    - OS::TripleO::Services::Sshd
+    - OS::TripleO::Services::Timezone
+    - OS::TripleO::Services::TripleoFirewall
+    - OS::TripleO::Services::TripleoPackages
+    - OS::TripleO::Services::Tuned
+    - OS::TripleO::Services::Vpp
+    - OS::TripleO::Services::OVNController
+    - OS::TripleO::Services::OVNMetadataAgent
+    - OS::TripleO::Services::Ptp

roles/ComputeRBDEphemeral.yaml

@@ -0,0 +1,62 @@
+###############################################################################
+# Role: ComputeRBDEphemeral                                                   #
+###############################################################################
+- name: ComputeRBDEphemeral
+  description: |
+    Per-role compute storage backend - basic Compute Node with RBD ephemeral disks
+  CountDefault: 0
+  networks:
+    - InternalApi
+    - Tenant
+    - Storage
+  HostnameFormatDefault: '%stackname%-novacompute-rbd-%index%'
+  RoleParametersDefault:
+    TunedProfileName: "virtual-host"
+    NovaEnableRbdBackend: true
+  ServicesDefault:
+    - OS::TripleO::Services::Aide
+    - OS::TripleO::Services::AuditD
+    - OS::TripleO::Services::CACerts
+    - OS::TripleO::Services::CephClient
+    - OS::TripleO::Services::CephExternal
+    - OS::TripleO::Services::CertmongerUser
+    - OS::TripleO::Services::Collectd
+    - OS::TripleO::Services::ComputeCeilometerAgent
+    - OS::TripleO::Services::ComputeNeutronCorePlugin
+    - OS::TripleO::Services::ComputeNeutronL3Agent
+    - OS::TripleO::Services::ComputeNeutronMetadataAgent
+    - OS::TripleO::Services::ComputeNeutronOvsAgent
+    - OS::TripleO::Services::Docker
+    - OS::TripleO::Services::Fluentd
+    - OS::TripleO::Services::IpaClient
+    - OS::TripleO::Services::Ipsec
+    - OS::TripleO::Services::Iscsid
+    - OS::TripleO::Services::Kernel
+    - OS::TripleO::Services::LoginDefs
+    - OS::TripleO::Services::MetricsQdr
+    - OS::TripleO::Services::MySQLClient
+    - OS::TripleO::Services::NeutronBgpVpnBagpipe
+    - OS::TripleO::Services::NeutronLinuxbridgeAgent
+    - OS::TripleO::Services::NeutronVppAgent
+    - OS::TripleO::Services::NovaCompute
+    - OS::TripleO::Services::NovaLibvirt
+    - OS::TripleO::Services::NovaLibvirtGuests
+    - OS::TripleO::Services::NovaMigrationTarget
+    - OS::TripleO::Services::Ntp
+    - OS::TripleO::Services::ContainersLogrotateCrond
+    - OS::TripleO::Services::OpenDaylightOvs
+    - OS::TripleO::Services::Rhsm
+    - OS::TripleO::Services::RsyslogSidecar
+    - OS::TripleO::Services::Securetty
+    - OS::TripleO::Services::SensuClient
+    - OS::TripleO::Services::SkydiveAgent
+    - OS::TripleO::Services::Snmp
+    - OS::TripleO::Services::Sshd
+    - OS::TripleO::Services::Timezone
+    - OS::TripleO::Services::TripleoFirewall
+    - OS::TripleO::Services::TripleoPackages
+    - OS::TripleO::Services::Tuned
+    - OS::TripleO::Services::Vpp
+    - OS::TripleO::Services::OVNController
+    - OS::TripleO::Services::OVNMetadataAgent
+    - OS::TripleO::Services::Ptp

tools/yaml-validate.py

@@ -351,7 +351,7 @@ def validate_controller_no_ceph_role(filename, tpl):
                 return 1
     return 0
 
-def validate_with_compute_role_services(role_filename, role_tpl, exclude_service):
+def validate_with_compute_role_services(role_filename, role_tpl, exclude_service=()):
     cmpt_filename = os.path.join(os.path.dirname(role_filename),
                                  './Compute.yaml')
     cmpt_tpl = yaml.load(open(cmpt_filename).read())
@@ -777,6 +777,10 @@ def validate(filename, param_map):
         if filename.startswith('./roles/ControllerNoCeph.yaml'):
             retval = validate_controller_no_ceph_role(filename, tpl)
 
+        if filename in ('./roles/ComputeLocalEphemeral.yaml',
+                        './roles/ComputeRBDEphemeral.yaml'):
+            retval |= validate_with_compute_role_services(filename, tpl)
+
         if filename.startswith('./network_data_'):
             retval = validate_network_data_file(filename)