Commit Graph

45 Commits

Author SHA1 Message Date
Keigo Noha
866645db1d Add OVNCMSOptions to Controller and Networker roles
OVN is a default networking service for Neutron.
The default configurations for OVN were implemented but OVNCMSOptions
was missing.
This change introduces OVNCMSOptions to Controller and Networker roles.

Closes-Bug: #1928901
Change-Id: I441f16f5e596dcbc6f5e567b07d3cd19a57c21e2
2021-05-19 14:05:49 +09:00
Zuul
82a95ab73d Merge "Add ReaR service to all roles" 2021-04-23 14:12:20 +00:00
Michele Baldessari
97016b2012 Add FRR service
This adds support for BGP via the OS::TripleO::Services::Frr service.
Spec: https://review.opendev.org/c/openstack/tripleo-specs/+/758249

We create the frr configuration via the corresponding tripleo_frr
ansible role at step0. We start the FRR container at deployment step
1 before pacemaker gets configured as the routing to all the other nodes
needs to be functional before setting up the cluster.

Co-Authored-By: Carlos Gonçalves <cgoncalves@redhat.com>

Change-Id: I7cef73c57e7b69f4d031e220c954803afd5e0b8c
2021-03-13 18:25:42 +00:00
Grzegorz Grasza
e329ca915e Generate certificates using ansible role
This is using linux-system-roles.certificate ansible role,
which replaces puppet-certmonger for submitting certificate
requests to certmonger. Each service is configured through
it's heat template.

Partial-Implements: blueprint ansible-certmonger
Depends-On: https://review.rdoproject.org/r/31713
Change-Id: Ib868465c20d97c62cbcb214bfc62d949bd6efc62
2021-03-10 16:28:22 +01:00
Takashi Kajinami
6ff238199d Add ReaR service to all roles
This patch adds ReaR service to some roles currently without it,
because this service is expected to be added to all roles when rear
service templates were introduced initially[1].

[1] 79bd7c447b

Note that this patch doesn't add ReaR service to Ceph roles because
generally we don't expect taking backup of Ceph nodes by ReaR.

Change-Id: I8222c39925a3ba3172fa03ae8931a6de3fb021a1
2020-08-14 14:55:05 +09:00
Takashi Kajinami
8213618f33 Remove support for Neutron FUJITSU plugin
It seems that netwokring-fujitsu is no longer maintained[1], and it's
not compatible with Python 3.6 which currently all OpenStack services
require.

[1] https://opendev.org/x/networking-fujitsu

Change-Id: Iae639864cce8e3add635944f157ecde074312e74
2020-05-08 00:09:58 +00:00
Emilien Macchi
ac2711c72b Switch to Podman by default
- Remove Docker service from all the roles; not needed anymore
- Switch ContainerCli to podman for docker-ha environment. Note; this
  environment might be renamed at some point to, container-ha.yaml. But
  for backward compatibility we still use it now.
  Also switch EnablePaunch to false since we were waiting for the podman
  switch to do it.
- In the overcloud registry, disable Docker by default and enable Podman
  by default.

This patch will only work for centos8/rhel8 based deployments.

Change-Id: I561c52ce09c66a7f79763c59cd25f15949c054af
2020-03-18 09:27:36 -04:00
Alex Schultz
bac746b25b Remove skydive
We're dropping this as it has no testing and is not currentily available
for CentOS 8.

Change-Id: I408490346840d5a2e3ae29f53cbc100edcf72ee7
Depends-On: https://review.opendev.org/#/c/712517/
2020-03-12 14:02:52 -06:00
Saravanan KR
9c3638b8a1 Remove OpenDaylight templates and environments
OpenDaylight deployment has been deprecated in Stein. In Train,
the tempaltes are removed.

Change-Id: I9711ef977d045f1dbcdc631fe2655294109031b8
2019-10-18 11:39:41 +05:30
Zuul
adae981b14 Merge "Remove sensu-client service" 2019-10-10 22:59:46 +00:00
Carlos Goncalves
3fca17839c Fix placement of Octavia services in roles
Octavia health manager, worker and housekeeping services belong to
networker nodes.

Change-Id: I014a3a5ac2b0b5f32866fa9d5c09ac7e79475e79
2019-10-02 12:06:59 +02:00
Martin Magr
b3ffd695fd Remove sensu-client service
Sensu client has been deprecated and it's functionality substituted
by collectd-sensubility. This patch removes sensu-client composable
service

Change-Id: I4be68eb7319b2c92cc7d0fc9df7a5c87dfb5106c
2019-10-01 12:07:46 +02:00
Martin Magr
5ccf8951e5 Remove fluentd composable service
This patch removes fluentd composable service in favor of rsyslog composable service
and modifies *LoggingSource configuration accordingly.

Change-Id: I1e12470b4eea86d8b7a971875d28a2a5e50d5e07
2019-08-29 13:52:55 +01:00
Martin Magr
8727ef050c Rsyslog composable service
This patch adds rsyslogd composable service with the same behaviour
the fluentd composable service currently has.

Co-Authored-By: Juan Badia Payno <jbadiapa@redhat.com>
Change-Id: I18e349c450a42dc7e9867d200e777a324e2d12bc
2019-07-18 15:41:28 +00:00
Mathieu Bultel
a59a188a6b Force ansible serial to 1 for the Controller
By introducing update_serial variable we parallelize update
execution on non-pacemaker enabled nodes. Custom role data users
need to update their role files. By default we do serial 1 making
sure nothing changes for users who didn't update their role data.

Resolves: rhbz#1652057
Closes-Bug: #1831617

Change-Id: I4ee0110a6c2b9466d81e37e5df27f5f81a6eceb5
2019-06-07 14:25:54 +02:00
Zuul
ebcc709330 Merge "Add creating br-ex for compute node in ovn" 2019-06-06 16:22:28 +00:00
Kamil Sambor
ff7cce93eb Add creating br-ex for compute node in ovn
For ovn compute nodes we need br-ex exactly like with
ComputeDVR role. Now we can do this in jinja templates
using new tag external_bridge

Change-Id: If44e9cbad714ce3954928407c42a8dc2473fed2e
Closes-Bug: #1822367
2019-06-05 10:15:39 +02:00
Carlos Goncalves
14436f915b Remove Neutron LBaaS
The project has been retired and there will be no Train release [1].
This patch removes Neutron LBaaS support in tripleo-heat-templates.

[1] https://review.opendev.org/#/c/658494/

Closes-Bug: #1831618
Change-Id: If13bbcdea82045d816485412f252c9b52bcf45a7
2019-06-04 15:12:38 +02:00
Mauro S. Oddi
37ea330370 Add SSHD composable service to Networker role definition
The composable service OS::TripleO::Services::Sshd is
enabled by default in the overcloud but it is not included
in the default Networker.yaml role definition.

Change-Id: I20d35affba9da511ed4a9566013868146d3fbf4c
2019-02-23 17:53:12 +01:00
Ade Lee
2a83856585 Move ipa enrollment to host_prep_tasks
This addresses a possible bug when using FreeIPA to do TLS
everywhere.

It is possible that the IPA server is not on the ctlplane.
In this case, when the nodes start up, the registration of the node
with IPA will fail, resulting in failed certificate issuance requests
later on.

We introduce a composable service to run in host_prep_tasks.
This will always run once the networks have been set up.  If the
instance has already been enrolled (by cloud-init or in an update),
then the script executed by the service will just exit.

In this iteration, we simply execute the code that the cloud-init
would have done.  In later releases, we will execute all the code
performed by novajoin-server here in ansible - and deprecate the
novajoin server.

Change-Id: I31f64c3cbd1d151e3c2a436cc3e2ec5316535087
Co-Authored-By: Juan Antonio Osorio Robles <jaosorior@redhat.com>
Resolves: rhbz#1661635
Closes-Bug: #1815924
2019-02-14 16:07:17 +00:00
Harald Jensås
2f2d8183e6 L3 routed networks - subnet fixed_ips (3/3)
When using neutron routed networks we need to specify
either the subnet or a ip address in the fixed-ips-request
when creating neutron ports.

a) For the Vip's:

Adds VipSubnetMap and VipSubnetMapDefaults parameters in
service_net_map.yaml. The two maps are merged, so that the
operator can override the subnet where VIP port should be
hosted. For example:

parameter_defaults:
  VipSubnetMap:
    ctlplane: ctlplane-leaf1
    InternalApi: internal_api_leaf1
    Storage: storage_leaf1
    redis: internal_api_leaf1

b) For overcloud node ports:

Enrich 'networks' in roles defenition to include both
network and subnet data. Changes the list to a map
instead of a list of strings. New schema:

- name: <role_name>
  networks:
    <network_name>
      subnet: <subnet_name>

For backward compatibility a conditional is used to check
if the data is a map or not. In either case the internal
list of role networks is created as '_role_networks' in
the jinja2 templates.

When the data is a map, and the map contains the 'subnet'
key the subnet specified in roles_data.yaml is used as
the subnet in the fixed-ips-reqest when ports are created.
If subnet is not set (or role.networks is not a map) the
default will be {{network.name_lower}}_subnet.

Also, since the fixed_ips request passed to Vip ports are no
longer [] by default, the conditinal has been updated to
test for 'ip_address' entries in the request.

Partial: blueprint tripleo-routed-networks-templates
Depends-On: I773a38fd903fe287132151a4d178326a46890969
Change-Id: I77edc82723d00bfece6752b5dd2c79137db93443
2019-01-03 19:07:20 +01:00
karthik s
512c032a0b Add bootparams service for all roles
NIC partitioning requires IOMMU to be enabled on roles using it.
By adding the BootParams service to all the roles, we could
enable IOMMU selectively by supplying the role specific parameter
"KernelArgs". If a role doesn't use NIC Partitioning then
"KernelArgs" shall be not be set and backward compatibility would
be retained.

Change-Id: I2eb078d9860d9a46d6bffd0fe2f799298538bf73
2018-11-19 05:02:07 -05:00
Emilien Macchi
7bebdefda8 Introduce OS::TripleO::Services::Podman
Podman service will be in charge of installing, configuring, upgrading
and updating podman in TripleO.

For now, the service is disabled by default but included in all roles.
In the cycle, we'll make it the default.

Note: when Podman will be able to run in TripleO without Docker,
we'll do like https://review.openstack.org/#/c/586679/ and make it as
a generic service that can be switched to either podman or docker.
But for now, we need podman & docker working side by side.

Depends-On: Ie9f5d3b6380caa6824ca940ca48ed0fcf6308608
Change-Id: If9e311df2fc7b808982ee54224cc0ea27e21c830
2018-10-02 01:47:46 +00:00
Alex Schultz
f7f9053963 Create a Timesync service declaration
In order to support switching between multiple timesync backends, let's
simplify the service configurations for the roles so that there is a
single timesync service.  This timesync service should point to the
expected backend (ntp/ptp/chrony).

Change-Id: I986d39398b6143f6c11be29200a4ce364575e402
Related-Blueprint: tripleo-chrony
2018-09-04 21:00:56 +00:00
Martin Mágr
b76d7623ac QDR for metrics collection purposes
This patch adds composable new service (QDR) for containerized deployments.
Metrics QDR will run on each overcloud node in 'edge' mode. This basically
means that there is a possibility that there will be two QDRs running
on controllers in case that oslo messaging is deployed. This is a reason why
we need separate composable service for this use case.

Depends-On: If9e3658d304c3071f53ecb1c42796d2603875fcd
Depends-On: I68f39b6bda02ba3920f2ab1cf2df0bd54ad7453f
Depends-On: I73f988d05840eca44949f13f248f86d094a57c46
Change-Id: I1353020f874b348afd98e7ed3832033f85a5267f
2018-07-31 21:55:45 +00:00
Harald Jensas
5203e43979 Add Ironic Networking Baremetal Templates
Ironic neutron agent will be installed on controller nodes, or
networker nodes, when environments/services/ironic.yaml or
environments/services-docker/ironic.yaml is used.

It should also be enabled on undercloud.

Also enables ``baremetal`` ML2 mechanism driver on undercloud.

Depends-On: Ic1f44414e187393d35e1382a42d384760d5757ef
Depends-On: I3c40f84052a41ed440758b971975c5c81ace4225
Change-Id: I0b4ef83a5383ff9726f6d69e0394fc544c381a7e
2018-04-12 23:59:34 +02:00
Daniel Alvarez
b4c11103bf Add OVNController service to Networker role
If Networker role is used, we want to deploy OVNController service
on such nodes and configure the right CMS options in OVN.

Change-Id: I09de4a764fa1a2bb7dff6056e903173220300cb4
Signed-off-by: Daniel Alvarez <dalvarez@redhat.com>
2018-01-25 15:45:27 +01:00
lhinds
7e68dbdf8c Implements AIDE Intrusion Detection System
Introduces a service to configure AIDE Intrusion Detection.

This service init's the database and copies the new database
to the active naming. It also sets a cron job, using email if
`AideEmail` is populated, otherwise the reports are sent to
`/var/log/aide/`.

AIDE rules can be supplied as a hash, and should the rules ever
be changed, the service will populate the new rules and re-init
a fresh integrity database.

Related-Blueprint: tripleo-aide-database
Depends-On: Iac2ceb7fc6b610f8920ae6f75faa2885f3edf6eb
Change-Id: I23d8ba2c43e907372fe079026df1fca5fa1c9881
2018-01-15 13:10:16 +00:00
Emilien Macchi
6a6872f390 Introduce OS::TripleO::Services::Rhsm
Background:
extraconfig/pre_deploy/rhel-registration interface has been maintained
for some time now but it's missing some features and the code overlaps
with ongoing efforts to convert everything to Ansible.

Plan:
Consume ansible-role-redhat-subscription from TripleO, so all the logics
goes into the Ansible role, and not in TripleO anymore.
The single parameter exposed to TripleO is RhsmVars and any Ansible
parameter can be given to make the role working.
The parameter can be overriden per roles, so we can think at specific
cases were some Director roles would have specific RHSM configs.
Once we have feature parity between what is done and what was here
before, we'll deprecate the old interface.

Testing:
Because RHSM can't be tested on CentOS, this code was manually tested on
RHEL against the public subscription portal. Also, we verified that
generated Ansible playbooks were correct and called the role with the
right parameters.

Documentation:
We'll work on documentation during the following weeks and explain
how to switch from the previous interface to the new one, and also
document new uses requested by our users.

Change-Id: I8610e4f1f8478f2dcbe3afc319981df914ce1780
2017-12-27 11:03:49 -08:00
Juan Antonio Osorio Robles
898ad4f54b Add IPSEC composable service
This service is tied to the external_deploy_tasks (such as the k8s
service); and it deploys IPSEC in the overcloud.

bp ipsec

Change-Id: Ie3b7af92c0ec97241de6d8badec13b9e93ee9305
2017-12-05 13:10:18 +00:00
lhinds
502fde7a64 Implements management of /etc/login.defs
Enables management of shadow password directives in login.defs

By allowing operators to set values in login.defs, they are able
to improve password security for newly created system accounts.

This change will in turn allow operators to adhere with security
hardening frameworks, such as STIG DISA & CIS Security Benchmarks.

bp login-defs

Change-Id: Id4fe88cb9569f18f27f94c35b5c27a85fe7947ae
Depends-On: Iec8c032adb44593da3770d3c6bb5a4655e463637
2017-11-29 09:23:25 +00:00
Lars Kellogg-Stedman
f982eb55c4 logging: merge fluentd-client and fluentd-base
The fluentd implementation was originally split across multiple files
in order to support both client and server services. we ultimately
decided to only implement the client as part of tripleo so this
division is no longer necessary.  This commit merges
fluentd-client.yaml and fluentd-base.yaml into fluentd.yaml, and
renames things appropriately.

Partial-bug: #1715187
Depends-On: Iace34b7baae8822d2233d97adabf6ebc8833adab
Change-Id: Idb9886f04d56ffc75a78c4059ff319b58b4acf9f
2017-11-17 11:04:52 +01:00
Jenkins
efd86fb1a8 Merge "Add a Skydive composable service" 2017-10-13 20:37:59 +00:00
Sylvain Baubeau
d31bc3a573 Add a Skydive composable service
This commits adds one service for the agent, and one
other for the analyzer. When using multiple controller nodes,
the analyzers are deployed in cluster mode, with a single etcd node.
These services are deployed as containers using a Mistral
workflow with Ansible.

Depends-on: I0442d2a75a4931a4bd8399c58ff6b016d5486945
Change-Id: I56c53158f9ed294dac95dbd7087d057e427f16a1
2017-10-04 10:32:07 +02:00
Michele Baldessari
f4bdf655f7 Remove pacemaker remote from the Networker role
It currently surves no purpose, as there are no
pacemaker managed resource in this role.

Change-Id: I0ea0d28e651646acb8bdd1ee53bfb7c8b16fe75b
2017-09-22 16:33:36 +02:00
Alex Schultz
964a5d738b Move neutron api services to ControllerOpenstack
The Networker role should not have the api services run on it. Instead
these services should run as part of the ControllerOpenstack role that
should be used with this role.

Change-Id: Iabfe276fe700843f3a8da0b9e9220b2f82e20ec9
Closes-Bug: #1718299
2017-09-19 15:50:06 -06:00
Alex Schultz
50c975d159 Add missing Docker service
The example composable roles are missing the docker service declaration
so they currently do not work when trying to deploy with containerized
services.

Change-Id: I986ae561b950e74aacea10bce84673e8d0c9bd97
Closes-Bug: #1713755
2017-08-29 09:31:03 -06:00
Bogdan Dobrelya
8a03456056 Add logrotate with crond service
Add a docker service template to provide containerized services
logs rotation with a crond job.
Add OS::TripleO::Services::LogrotateCrond to CI multinode-containers
and to all environments among with generic services like Ntp or Kernel.
Set it to OS::Heat::None for non containerized environments and
only enable it to the environments/docker.yaml.

Closes-bug: #1700912

Change-Id: Ic94373f0a0758e9959e1f896481780674437147d
Signed-off-by: Bogdan Dobrelya <bdobreli@redhat.com>
2017-08-21 08:56:29 +02:00
Juan Antonio Osorio Robles
0bf9c789c7 Add certmonger user profile to all overcloud roles
This is needed for TLS everywhere, else the certs won't be requested.

Change-Id: I9849e009843683a75fefa6e9f4b8213bcff3a889
Closes-Bug: #1711424
2017-08-17 20:40:19 +03:00
Joe Talerico
c2b2cc555a Adding Tuned Service
Allow the user to set a specific Tuned profile on a given host.

Defaults to throughput-performance

Change-Id: I0c66193d2733b7a82ad44b1cd0d2187dd732065a
2017-07-25 17:08:37 +00:00
Jenkins
25caba5ce8 Merge "Enable Neutron LBaaS Integration" 2017-07-06 10:54:32 +00:00
Steven Hardy
b25a576757 Fix typo in roles/Networker.yaml
The captialization mismatch here means the role currently doesn't
work.

Change-Id: Iced5004f993f8c100268361d87580d922e47f983
2017-07-04 15:11:27 +01:00
Ryan Hefner
6a151ec697 Enable Neutron LBaaS Integration
Allows the configuration of the Neutron LBaaS agent.

Implements: blueprint lbaasv2-service-integration
Change-Id: Iae2bf7faeea93d5275994b2ee10f9bf863ed6152
Depends-On: Ieeb21fafd340fdfbaddbe7633946fe0f05c640c9
2017-07-04 13:53:03 +00:00
Steven Hardy
cba5288867 Make network-isolation environment rendered for all roles
Currently there's some hard-coded references to roles here, rendering
from the roles_data.yaml is a step towards making the use of isolated
networks for custom roles easier.

Partial-Bug: #1633090
Depends-On: Ib681729cc2728ca4b0486c14166b6b702edfcaab
Change-Id: If3989f24f077738845d2edbee405bd9198e7b7db
2017-06-13 11:19:02 +01:00
Alex Schultz
0b259c8d39 Standardize example role definitions
As we create new standard roles, we should include them from a single
location for ease of use and to reduce the duplication of the role
definitions elsewhere. This change adds a roles folder to the THT that
can be used with the new roles commands in python-tripleoclient by the
end user to generate a roles_data.yaml from a standard set of roles.

Depends-On: I326bae5bdee088e03aa89128d253612ef89e5c0c
Change-Id: Iad3e9b215c6f21ba761c8360bb7ed531e34520e6
Related-Blueprint: example-custom-role-environments
2017-06-07 20:20:03 +00:00