tripleo-heat-templates/deployment/tacker/tacker-container-puppet.yaml
Jose Luis Franco Arza d1035703b7 Force removal of docker container in tripleo-docker-rm.
The tripleo-docker-rm role has been replaced by tripleo-container-rm [0].
This role will identify the docker engine via the container_cli variable
and perform a deletion of that container. However, these tasks inside the
post_upgrade_tasks section were thought to remove the old docker containers
after upgrading from rocky to stein, in which podman starts to be the
container engine by default.

For that reason, we need to ensure that the container engine in which the
containers are removed is docker, as otherwise we will be removing the
podman container and the deployment steps will fail.

Closes-Bug: #1836531
[0] - 2135446a35

Depends-On: https://review.opendev.org/#/c/671698/
Change-Id: Ib139a1d77f71fc32a49c9878d1b4a6d07564e9dc
2019-07-19 12:37:35 +00:00

230 lines
8.3 KiB
YAML

heat_template_version: rocky
description: >
OpenStack containerized Tacker service
parameters:
ContainerTackerImage:
description: image
type: string
ContainerTackerConfigImage:
description: The container image to use for the tacker config_volume
type: string
EndpointMap:
default: {}
description: Mapping of service endpoint -> protocol. Typically set
via parameter_defaults in the resource registry.
type: json
ServiceData:
default: {}
description: Dictionary packing service data
type: json
ServiceNetMap:
default: {}
description: Mapping of service_name -> network name. Typically set
via parameter_defaults in the resource registry. This
mapping overrides those in ServiceNetMapDefaults.
type: json
DefaultPasswords:
default: {}
type: json
RoleName:
default: ''
description: Role name on which the service is applied
type: string
RoleParameters:
default: {}
description: Parameters specific to the role
type: json
TackerPassword:
description: The password for the tacker service account.
type: string
hidden: true
Debug:
type: boolean
default: false
description: Set to True to enable debugging on all services.
TackerDebug:
default: ''
description: Set to True to enable debugging Tacker service.
type: string
constraints:
- allowed_values: [ '', 'true', 'True', 'TRUE', 'false', 'False', 'FALSE']
KeystoneRegion:
type: string
default: 'regionOne'
description: Keystone region for endpoint
TackerPolicies:
description: |
A hash of policies to configure for Tacker.
e.g. { tacker-context_is_admin: { key: context_is_admin, value: 'role:admin' } }
default: {}
type: json
NotificationDriver:
type: string
default: 'messagingv2'
description: Driver or drivers to handle sending notifications.
conditions:
service_debug_unset: {equals : [{get_param: TackerDebug}, '']}
resources:
ContainersCommon:
type: ../containers-common.yaml
MySQLClient:
type: ../database/mysql-client.yaml
outputs:
role_data:
description: Role data for the Tacker role.
value:
service_name: tacker
config_settings:
tacker_password: {get_param: TackerPassword}
tacker::db::database_connection:
make_url:
scheme: {get_param: [EndpointMap, MysqlInternal, protocol]}
username: tacker
password: {get_param: TackerPassword}
host: {get_param: [EndpointMap, MysqlInternal, host]}
path: /tacker
query:
read_default_file: /etc/my.cnf.d/tripleo.cnf
read_default_group: tripleo
tacker::logging::debug:
if:
- service_debug_unset
- {get_param: Debug }
- {get_param: TackerDebug }
tacker::notification_driver: {get_param: NotificationDriver}
tacker::server::bind_host:
str_replace:
template:
"%{hiera('$NETWORK')}"
params:
$NETWORK: {get_param: [ServiceNetMap, TackerApiNetwork]}
tacker::keystone::authtoken::project_name: 'service'
tacker::keystone::authtoken::user_domain_name: 'Default'
tacker::keystone::authtoken::project_domain_name: 'Default'
tacker::keystone::authtoken::password: {get_param: TackerPassword}
tacker::keystone::authtoken::auth_url: {get_param: [EndpointMap, KeystoneInternal, uri_no_suffix]}
tacker::keystone::authtoken::www_authenticate_uri: {get_param: [EndpointMap, KeystoneInternal, uri_no_suffix]}
tacker::keystone::authtoken::auth_uri: {get_param: [EndpointMap, KeystoneInternal, uri_no_suffix]}
tacker::db::mysql::password: {get_param: TackerPassword}
tacker::db::mysql::user: tacker
tacker::db::mysql::host: {get_param: [EndpointMap, MysqlInternal, host_nobrackets]}
tacker::db::mysql::dbname: tacker
tacker::db::mysql::allowed_hosts:
- '%'
- {get_param: [EndpointMap, MysqlInternal, host_nobrackets]}
tacker::policy::policies: {get_param: TackerPolicies}
tripleo::tacker::firewall_rules:
'113 tacker':
dport:
- 9890
- 13989
service_config_settings:
keystone:
tacker::keystone::auth::tenant: 'service'
tacker::keystone::auth::region: {get_param: KeystoneRegion}
tacker::keystone::auth::password: {get_param: TackerPassword}
tacker::keystone::auth::public_url: {get_param: [EndpointMap, TackerPublic, uri]}
tacker::keystone::auth::internal_url: {get_param: [EndpointMap, TackerInternal, uri]}
tacker::keystone::auth::admin_url: {get_param: [EndpointMap, TackerAdmin, uri]}
# BEGIN DOCKER SETTINGS
puppet_config:
config_volume: tacker
puppet_tags: tacker_config
step_config:
list_join:
- "\n"
- - "include ::tripleo::profile::base::tacker"
- {get_attr: [MySQLClient, role_data, step_config]}
config_image: {get_param: ContainerTackerConfigImage}
kolla_config:
/var/lib/kolla/config_files/tacker_api.json:
command: /usr/bin/tacker-server --config-file=/etc/tacker/tacker.conf --log-file=/var/log/tacker/api.log
config_files:
- source: "/var/lib/kolla/config_files/src/*"
dest: "/"
merge: true
preserve_properties: true
permissions:
- path: /var/log/tacker
owner: tacker:tacker
recurse: true
docker_config:
# db sync runs before permissions set by kolla_config
step_2:
tacker_init_logs:
image: &tacker_image {get_param: ContainerTackerImage}
net: none
privileged: false
user: root
volumes:
- /var/log/containers/tacker:/var/log/tacker
command: ['/bin/bash', '-c', 'chown -R tacker:tacker /var/log/tacker']
step_3:
tacker_db_sync:
image: *tacker_image
net: host
privileged: false
detach: false
user: root
volumes:
list_concat:
- {get_attr: [ContainersCommon, volumes]}
-
# FIXME(mandre) mounting /etc rw to workaround LP1696283
# This should go away anyway and mount the exact files it
# needs or use kolla set_configs.py
- /var/lib/config-data/tacker/etc/:/etc/
- /var/log/containers/tacker:/var/log/tacker
command: "/usr/bin/bootstrap_host_exec tacker su tacker -s /bin/bash -c 'tacker-db-manage --config-file /etc/tacker/tacker.conf upgrade head'"
step_4:
tacker_api:
image: *tacker_image
net: host
privileged: false
restart: always
healthcheck:
test: /openstack/healthcheck
volumes:
list_concat:
- {get_attr: [ContainersCommon, volumes]}
-
- /var/lib/kolla/config_files/tacker_api.json:/var/lib/kolla/config_files/config.json:ro
- /var/lib/config-data/puppet-generated/tacker/:/var/lib/kolla/config_files/src:ro
- /var/log/containers/tacker:/var/log/tacker
environment:
- KOLLA_CONFIG_STRATEGY=COPY_ALWAYS
host_prep_tasks:
- name: create persistent directories
file:
path: "{{ item.path }}"
state: directory
setype: "{{ item.setype }}"
with_items:
- { 'path': /var/log/tacker, 'setype': svirt_sandbox_file_t }
- { 'path': /var/log/containers/tacker, 'setype': svirt_sandbox_file_t }
- name: tacker logs readme
copy:
dest: /var/log/tacker/readme.txt
content: |
Log files from tacker containers can be found under
/var/log/containers/tacker.
ignore_errors: true
upgrade_tasks: []
post_upgrade_tasks:
- when: step|int == 1
import_role:
name: tripleo-docker-rm
vars:
containers_to_rm:
- tacker_api
tripleo_container_cli: "docker"