Commit Graph

252 Commits

Author SHA1 Message Date
Harald Jensås
a120ada72e Refactor OVN bridge MAC addresses
Moving the network and port management for OVN
bridge MAC addresses to ansible.

Removes the heat resources, and adds an external
deploy task at step 0 in the ovn controller service
templates which uses the 'tripleo_ovn_mac_addresses'
ansible module to create/remove OVN mac address ports.

Adds parameter role_specific OVNStaticBridgeMacMappings,
parameter that can be used to set static bridge mac
mappings. When this is set no neutron resources will be
created by the tripleo_ovn_mac_addresses ansible module.
OVNStaticBridgeMacMappings must be used for standalone
deployments.

Implements: blueprint network-data-v2-port
Depends-On: https://review.opendev.org/782891
Depends-On: https://review.opendev.org/783137
Change-Id: I6ce29d2908e76044c55eb96d0d3779fe67ba9169
2021-05-04 11:49:50 +05:30
Takashi Kajinami
2da8297c86 cinder: remove support for the Veritas HyperScale driver
The Veritas HyperScale driver has been removed from cinder[1], thus
we should remove its support from TripleO as well.

[1] 9aca21f5cec8f03a3bb410acb21399955144fe0f

Because the implementation was removed a while ago, this change doesn't
deprecate the feature but directly remove it.

Change-Id: I5dd448ac0a7c9a786b9239290d1690d51f50f71c
2021-04-23 00:28:06 +09:00
Harald Jensås
23cdf4dd17 Refactor Service VIPs redis and ovn_dbs
With this change a Heat resource is no longer used to
create an undercloud neutron API port resource for the
redis and ovn_dbs service virtual IPs. Instead an
external deploy task at step 0 in the individual service
template uses the "tripleo_service_vip" ansible module
to mange a neutron API port resource for each service.

The interfaces to control the IP address and service
network (RedisVirtualFixedIPs, OVNDBsVirtualFixedIPs
and ServiceNetMap) remains the same.

It is also possible to include the 'use_neutron' boolean
in the FixedIPs parameter to instruct the ansible module
not to create a neutron API resource, and simply "echo"
the ip_address given in the FixedIPs parameter. For
example:
  RedisVirtualFixedIPs:
    - ip_address: 1.0.0.5
      use_neutron: false

Alternatively the fixed-ips can be set using the
'ServiceVips' parameter, like this:

 ServiceVips:
   redis: 1.0.0.5
   ovs_dbs: 1.0.0.6

NOTE: If the neutron service is not available the
      tripleo_service_vip ansible module will "echo"
      the IP provided in %service%VirtualFixedIPs.

Related: blueprint network-data-v2-ports
Depends-On: https://review.opendev.org/777307
Depends-On: https://review.opendev.org/779883
Change-Id: I4794418546363888e7a555a16b45b7a4417f1ef8
2021-04-14 10:22:59 +02:00
Brent Eagles
7de18e52cd Generate bind pool and bind configuration using deployment info
The bind pool information is now automatically generated and the
variables and sample config files are no longer needed. Matching bind9
and rndc key configuration is also generated.

Note: this patch also removes the use of puppet-dns which is problematic
when bind and the worker aren't on the same host and is awkward to use
with respect to rndc keys. It also modifies yaml-validate.py to correct
a rule changed with respect rndc_allowed_addresses.

Depends-On: Ib121888061b8bfcc4155528a8a209c7e274fafcb
Depends-On: I3383c19f80e70553ae71e644a01dda0f250d19da
Depends-On: I1b6674acbd6f999474cd66cb44357cf6b756a7d0

Change-Id: Ib89bcafe9f65431aee5756a32b2a82adc3d384dc
2021-04-09 15:04:22 -02:30
Zuul
aa601a280f Merge "Designate: split bind instance into separate template" 2021-03-30 00:43:03 +00:00
Sorin Sbarnea
27788212cc Remove duplicate keys from yaml files
- removes duplicate keys from yaml files by assuming that the last
  one was the desired one (matches current loader behavior)
- prevent regressions by activating yaml lint rule that detects them
  (yaml skip was silencing all yaml checks, so the long list seen
  is in fact shorter than just 'yaml')
- includes sorting of some of the keys, was needed in order to spot
  the duplicates.

Change-Id: Idf5c0041a0c6d3ed7d5d49fb68be856719916663
2021-03-29 13:56:31 +00:00
Brent Eagles
56b8ec4e18 Designate: split bind instance into separate template
There isn't a 1:1 correlation between the designate worker and bind
instances nor is it always desirable to run them on the same host.

Depends-On: If97e16a125537c1b5d9f5cfac1de0ffae0edb99a
Change-Id: I624299476a2911f12b1f5ce01964e5d926c6b38e
2021-03-22 15:55:00 -02:30
Michael Johnson
773fccb7c1 Add the Unbound DNS resolver service
This patch addes TripleO support for the Unbound DNS resolver service.
This service will initially be used by the Designate service.

Change-Id: I8135ce4f344aeb7c0cf7521e0ba42335c4c7bbc8
2021-03-18 17:12:35 +00:00
Grzegorz Grasza
e329ca915e Generate certificates using ansible role
This is using linux-system-roles.certificate ansible role,
which replaces puppet-certmonger for submitting certificate
requests to certmonger. Each service is configured through
it's heat template.

Partial-Implements: blueprint ansible-certmonger
Depends-On: https://review.rdoproject.org/r/31713
Change-Id: Ib868465c20d97c62cbcb214bfc62d949bd6efc62
2021-03-10 16:28:22 +01:00
Zuul
15aabbb6c3 Merge "Make the default transport POLL_SERVER_HEAT" 2021-02-04 12:16:40 +00:00
ramishra
cff1618e40 Make the default transport POLL_SERVER_HEAT
Change it to POLL_SERVER_HEAT (Attempt 2, Earlier attempt had
issues when changing this as simultaneously deleting a bunch
of SoftwareDeployment resources). This is required to remove
swift from undercloud.

Change-Id: I639f5626013cd0ef61c1f9066fab7a7b8806287f
2021-01-28 10:49:34 +05:30
John Fulton
d4ae25e2fd Deprecate environments/dcn-hci.yaml for dcn-storage.yaml
Rename the file in the environments directory so that it
reflects its expanded scope. This file is used when
deploying storage with DCN sites regardless of if those
sites use HCI. We are now supporting non-HCI DCN sites
with storage so the old name is confusing.

Old name : dcn-hci.yaml
New name : dcn-storage.yaml

dcn-hci.yaml is depreacated but will remain in the environments
directory for backwards compatibility. dcn-hci.yaml will be
removed during the X cycle.

Change-Id: Ice5e1cfbc158eb6705988706c8625bedb80d7de2
2021-01-27 08:41:21 -05:00
Alan Bishop
2d60799c49 Define a new CinderVolumeEdge service
CinderVolumeEdge is an optional service (defaults to OS::Heat::None)
that can be enabled on DCN/Edge nodes for edge sites that support
persistent block storage (i.e. cinder). The dcn-hci.yaml environment
file enables the service.

The new service supports the following edge deployment models:
1. Edge site with no block storage
   - Deploy DistributedCompute nodes
   - Use dcn.yaml environment file (the CinderVolumeEdge service
     remains disabled)
2. Edge site with traditional HCI storage
   - Deploy DistributedComputeHCI nodes
   - Use dcn-hci.yaml env file to enable the CinderVolumeEdge service
   - Use ceph-ansible.yaml env file to deploy ceph for the RBD backend
3. Edge site with quasi-hyperconverged storage
   - Deploy DistributedCompute nodes
   - Use dcn-hci.yaml env file to enable the CinderVolumeEdge service
   - Use ceph-ansible-external.yaml env file so the RBD backend can
     access an external ceph cluster

This patch adds support for number 3, which is a new capability. Whereas
traditional HCI means ceph and cinder services run on compute nodes, the
new model is still quasi-hyperconverged because cinder (as well as
glance) runs on the compute nodes.

Change-Id: I56b5792c1d53bb8659e440f598006e471894ff2e
2020-12-08 06:17:02 -08:00
Zuul
0519978254 Merge "Remove Sahara support" 2020-11-06 03:12:06 +00:00
Oliver Walsh
b756944d45 Add NovaDisableImageDownloadToRbd parameter
This exposes the nova workaround to disable downloading images from glance to
rbd (vs a cheap COW clone) when nova-compute and glance are not backed by the
same ceph cluster.

Related nova change: I069b6b1d28eaf1eee5c7fb8d0fdef9c0c229a1bf
Depends-On: I8329810d6c047c0d94e7b123e7cdc1263a7856cd

Change-Id: Ib5478e53eb1f216bf6924ff30ea8502cb8529d00
2020-10-23 17:52:58 +01:00
Takashi Kajinami
4a7d56947a Remove Sahara support
Sahara support was deprecated during previous Ussuri cycle[1], so we
can remove it completely now.

[1] f1d9b15c85
Change-Id: Id047221cb912c09984cc3bf864196a26fd36736f
2020-10-19 09:39:36 +09:00
Rabi Mishra
e9e0eb3d97 Make NetworkConfigWithAnsible parameter non-role specific
This changes the parameter to non-role specific and by default
true. The dependant python-tripleoclient patch adds a check
to ensure that we only allow usage of old heat nic congigs with
'NetworkConfigWithAnsible: false'.

Change-Id: Ie37bdfe64eb1b33afe326161fc6f99601addb7b5
2020-10-15 19:41:27 +05:30
Rabi Mishra
ab760a1ba1 Use native ansible for nic config of undercloud minion
This switches minion to use native ansible for nic config.

Change-Id: I247bf54c7cf4b75e6352b402aae923ddb2c3ebd6
2020-10-06 10:16:40 +05:30
Zuul
69d475d446 Merge "Use OS::Heat::None in place of net-config-noop.yaml" 2020-10-05 17:10:11 +00:00
Zuul
f9eb8d4cf0 Merge "Map NetworkConfig resource to net-config-noop.yaml" 2020-10-04 18:14:39 +00:00
Zuul
ba5638660a Merge "Also configure Ironic for UC minions" 2020-10-02 19:56:52 +00:00
Rabi Mishra
6f0c7a1090 Use OS::Heat::None in place of net-config-noop.yaml
This replaces net-config-noop.yaml mappings to OS::Heat::None.

Also removes all unnecessary setting of it in environments as
we map them in overcloud-resource-registry-puppet.j2.yaml.
Normally that should be enough but we override them in so many
places, so there will be some redundancy.

Depends-On: https://review.opendev.org/755275
Change-Id: Ib4d07c835568cb3072770f81a082b5a5e1c790ea
2020-10-02 12:41:23 +05:30
Rabi Mishra
be06f959cd Map NetworkConfig resource to net-config-noop.yaml
This maps undercloud and standalone NetworkConfig resources to
net-config-noop.yaml

Also changes the standalone to actually use ansible for config
generation which was missed in https://review.opendev.org/752368
with env generation.

Change-Id: Ia8e3bec4a64c8317e0b6996c1b7e587789311ad2
2020-10-02 12:41:15 +05:30
Zuul
21ae1bfc0f Merge "Create NetworkConfig per-role in overcloud.yaml" 2020-10-02 05:32:42 +00:00
Zuul
ffb37bf736 Merge "Add redis to designate environment" 2020-10-01 22:21:26 +00:00
Zuul
5540877689 Merge "Deprecate novajoin" 2020-10-01 18:14:49 +00:00
Ade Lee
bf910512c3 Deprecate novajoin
Deprecate the services related to novajoin.

Depends-On: https://review.opendev.org/#/c/753856/
Change-Id: I7803cccc4b4bf8c7cc201372ec91f9254cef7eb3
2020-09-30 01:23:38 -04:00
Brent Eagles
a9f264436b Add redis to designate environment
Designate deployments now require the redis service to be deployed.

Change-Id: I4160f8fcc6d7bc40c199bcd8bd31e43ee9d5b0f8
2020-09-29 12:38:33 +00:00
Harald Jensås
ff30e794d1 Create NetworkConfig per-role in overcloud.yaml
For each role create a network config resource
{role.name}}NetworkConfig. Remove per node
NetworkConfig resource from puppet/role.role.j2.yaml.

NOTE: CI nic config templates was updated with using
      tools/merge-new-params-nic-config-script.py

Depends-On: https://review.opendev.org/753930
Change-Id: Iff4bf742947a5a8170938372a8075519850b6f63
2020-09-29 14:13:51 +02:00
Bogdan Dobrelya
31831cf4eb Also configure Ironic for UC minions
There appears to be an inconsistency in the ironic configuration
between the undercloud vs the minion.

The minion has:
enabled_inspect_interfaces=no-inspect

The undercloud has:
enabled_inspect_interfaces=idrac,ilo,inspector,no-inspect,redfish

Fix this by adding the same default params for Ironic on UC minions as
the main undercloud environment defines it.

Change-Id: I0aaf6a9e5ac0a2f7ed95c8f046a4df6147ff0edb
Signed-off-by: Bogdan Dobrelya <bdobreli@redhat.com>
2020-09-28 12:05:50 +02:00
Rabi Mishra
02f80c05d0 Use ansible for undercloud/standalone network config
This patch changes undercloud and standalone roles to
generate network config with only ansible and
not depend on downloaded network config from
heat stack.

Depends-On: https://review.opendev.org/#/c/753958/
Change-Id: Ibcb0f0a65cfd04d677a4b861d9f647af13611b24
2020-09-26 13:34:01 +05:30
Zuul
bc199530de Merge "Fix typos" 2020-09-23 19:37:27 +00:00
Emilien Macchi
2d1e769456 use os_net_config Ansible module to configure networking
This uses the new ansible module for network configuration
on the nodes. Aso, converts the net-config-multinode.yaml to
use os-net-config.

Next patch in this series would change the NetworkConfig
resource type to OS::Heat::Value and drop run-os-net-config.sh.

Depends-On: https://review.opendev.org/748754
Change-Id: Ie48da5cfffe21eee6060a6d22045d09524283138
2020-09-22 08:18:22 +05:30
Zuul
ff3945a7cc Merge "Create OVNMacAddrNet network on Undercloud" 2020-09-21 05:27:18 +00:00
Rajesh Tailor
a672bedfc2 Fix typos
Change-Id: Ia9b0410d1ade1abc2d29d3634379b9128016d0e9
2020-09-16 15:45:12 +05:30
Harald Jensås
2082099332 Create OVNMacAddrNet network on Undercloud
A network used to allocate MAC addresses for OVN chassis.
Ports without and IP allocation will be created on this
network, the MAC addresses of the ports will by used to
configure the ovn-chassis-mac-mappings.

NOTE, we may want to change the 'base_mac' option of the
undercloud, so that we don't have collissions with the
overcloud 'base_mac'.

Related-Bug: #1881593
Change-Id: If495b5d5c1e6beff02b48507051cccfb70fd995c
2020-08-28 18:23:54 +02:00
Giulio Fidente
c7ec726276 Use container_file_t for Cinder*NfsMountOptions by default
This is so that share content is usable by cinder-volume and other
containers mounting the same share.

Closes-Bug: 1890291
Change-Id: Iacf7c9c368b26106e9921b35996c134aacb9acd7
2020-08-26 13:04:10 +02:00
Takashi Kajinami
6d5ecfcdfa Remove all UIConfig endpoints
UIConfig endpoints were introduced for TripleO UI[1], but TripleO UI
has been removed thus these endpoints are no longer used.

[1] https://review.opendev.org/#/c/528679/

Change-Id: I74f5ede7bff9064889a4b7aaa978127ab456d88f
2020-08-22 00:16:39 +09:00
Harald Jensås
94997223b6 Fix endpoint map tls - zaqar wss port
We open port: `` 3000 #SSL for websocket`` in the
zaqar service defenition:
  deployment/zaqar/zaqar-container-puppet.yaml:L130

But SSL environment files use port 9000 for the public
endpoint.

Using 9000 also for SSL can cause issues in haproxy.
We may want to revert or relax the check in
https://review.opendev.org/664224 as duplicate IP's
is'nt the actual problem.

Related-Bug: #1832168
Related-RHBZ: #1868910
Change-Id: I05f31885ade46d47ff5d384dabbd5561f4df9278
2020-08-20 07:26:16 +00:00
Alex Schultz
b5dad0cf10 Switch host sshd configuration to ansible
This change updates the baremetal host sshd management to use ansible
instead of puppet. It should still be noted that the nova-migration
container still uses puppet to manage sshd.

Change-Id: Iedd149c123d807dee229160f8e9f1b17bf379368
Depends-On: https://review.opendev.org/#/c/742970/
2020-08-10 12:41:57 +00:00
Rabi Mishra
2acb0d376b Add new parameter PublicTLSCACert
We've been using InternalTLSCAFile parameter when enabling
public TLS for undercloud and is quite confusing. We recently
changed to use it in clouds.yaml and it would break when
both public and internal TLS are enabled for overcloud and both
use different CA certs. This adds a new parameter which we
will use in clouds.yaml, that would default to empty string
assuming that the certificates are trusted.

Closes-Bug: #1883818
Change-Id: Id6f612a91255b3158be821c363ca852c6b5d7496
Depends-On: https://review.opendev.org/737998
2020-06-25 09:31:00 -04:00
Zuul
9f5bee1bff Merge "Remove support for Neutron FUJITSU plugin" 2020-06-18 10:28:56 +00:00
Dave Wilde (d34dh0r53)
0e99ceda4b Add composible service for tls enrollment
This commit attempts to build out a composible service that enrolls the
undercloud as a FreeIPA host using an OTP. This is similar to what we've
done in the past for tls-everywhere except we're not using novajoin.

Change-Id: I770227b2f4f1ea447cf0138f57a6ed66c034d225
2020-06-09 15:49:50 -05:00
Zuul
8e014d5390 Merge "Remove some deprecated services" 2020-06-08 11:04:47 +00:00
Emilien Macchi
4f198c32cb Remove some deprecated services
- Docker isn't supported anymore.
- Clients are now installed by Ansible, not Puppet
- Neutron SRIOV host isn't supported and operators should deploy with
  sriov_pf network object in nic configs.
- firewall is now managed by Ansible, not Puppet

Change-Id: I2b6068a719563a53bc255dcce72a92465e7df468
2020-06-04 09:16:04 -04:00
Rabi Mishra
cf5382daf7 Use empty string for overcloud InternalTLSCAFile param
Not all deployments have the file in the current default location
and rather use trusted certs for public tls. This also creates
issues in downstream jobs that don't inject overcloud ca with
environment/inject-trust-anchor.yaml

This default will ensure that it works in those scenarios.

Change-Id: Ib71c3e2be2b8dc57f3c9107c6ddab47cd6594202
Related-Bug: #1880936
2020-06-03 11:15:04 +05:30
Zuul
8471fceb6c Merge "Include copy-image for GlanceEnabledImportMethods for dcn-hci" 2020-05-31 23:09:24 +00:00
Rabi Mishra
7f2ee8566a Set default InternalTLSCAFile in enable-tls.yaml
Default like undercloud for public TLS. Though this
is little confusing we're using the same parameter
for both undercloud and overclud.

For classic public TLS and certmonger-based internal
TLS, where we use both enable-tls.yaml and
enable-internal-tls.yaml, we reset it back to use the
default ipa cacert.

Change-Id: Icfef2768ebb90c1818f157c762b6981d24393ac3
Closes-Bug: #1880936
2020-05-28 10:08:19 +05:30
John Fulton
161071f2d8 Include copy-image for GlanceEnabledImportMethods for dcn-hci
If you are using environments/dcn-hci.yaml, then you very likely
have more than one Glance server and will want to use the copy-image
feature. Thus, enable it by default for deployments which use this
environment file.

Also because GlanceCacheEnabled defaults to False and because
GlanceImageCacheMaxSize defaults to 10737418240 we don't need
to explicitly set them in environments/dcn{,-hci}.yaml.

Change-Id: If745aa0824098950367525170eaf6cb4e3804482
2020-05-20 14:41:05 -04:00
Takashi Kajinami
8213618f33 Remove support for Neutron FUJITSU plugin
It seems that netwokring-fujitsu is no longer maintained[1], and it's
not compatible with Python 3.6 which currently all OpenStack services
require.

[1] https://opendev.org/x/networking-fujitsu

Change-Id: Iae639864cce8e3add635944f157ecde074312e74
2020-05-08 00:09:58 +00:00