openstack
/
tripleo-heat-templates
Code Issues Proposed changes
RETIRED, Heat templates for deploying OpenStack
13,350 Commits 3 Branches 28 Tags 322 MiB
Go to file
Alan Bishop bc39ac89d2 Fix cinder's cephx keyring file permissions 
This patch updates cinder's kolla permissions so that cinder can
access any cephx keyring associated with CephExternalMultiConfig
ceph clusters. The new approach parses the cluster names out of the
CephExternalMultiConfig array, and uses a wildcard to grant access
to all keys (regardless of the key name) defined for each cluster.
There is no risk of the wildcard granting improper access to a
privileged key (e.g. the admin key), because CephExternalMultiConfig
doesn't include privileged keys.

This patch replaces similar (but more restrictive) code added in
I73af5b868de629870a35d38f8436e7025aae791e. That patch allowed cinder
to access cephx keyrings associated with a new CinderRbdMultiConfig
parameter, but it didn't cover all potential use cases. For example,
in a DCN/Edge deployment, cinder services running at the edge need
access to the central site's client key in order to perform operations
like offline volume migration.

NOTE (pre-Wallaby):
The >= Wallaby versions of this patch tweaks code that was introduced
in Wallaby by I73af5b868de629870a35d38f8436e7025aae791e. Pre-Wallaby
versions of this patch _adds_ the tweaked code.

Closes-Bug: #1930620
Resolves: rhbz#1962304
Change-Id: I4423fcbd62b09ef323590fc740dd29e1a17777f5
(cherry picked from commit f1cd8006fe)
(cherry picked from commit 74e3884b4a)
Conflicts:
	deployment/cinder/cinder-common-container-puppet.yaml
 		2021-06-09 14:14:56 -07:00
ci Add delegate_fact_hosts: false on ci scenarios 2021-03-10 05:37:15 +00:00
common Merge "Restore PreNetworkConfig resources" into stable/victoria 2021-05-17 18:49:22 +00:00
container_config_scripts Upgrade mariadb storage during upgrade tasks 2021-03-01 13:19:24 +00:00
deployed-server Set tags on all OS::Neutron::Port resources 2021-05-21 09:00:29 +02:00
deployment Fix cinder's cephx keyring file permissions 2021-06-09 14:14:56 -07:00
environments Add new options for Barbican PKCS#11 backend 2021-05-19 15:03:28 +00:00
extraconfig Set dns_name propery on ports and networks 2020-04-03 08:57:38 +02:00
firstboot os-net-config-mappings move out of firsboot 2020-09-07 13:26:08 +00:00
network Merge "Fix network_cidrs when ManageNetworks: false" into stable/victoria 2021-06-01 20:24:37 +00:00
plan-samples Merge "Update plan-sample to reference new interface" 2020-09-19 00:07:13 +00:00
puppet Set tags on all OS::Neutron::Port resources 2021-05-21 09:00:29 +02:00
releasenotes Merge "Add new options for Barbican PKCS#11 backend" into stable/victoria 2021-05-22 14:06:43 +00:00
roles Add OVNCMSOptions to Controller and Networker roles 2021-06-07 01:28:14 +00:00
sample-env-generator Deprecate environments/dcn-hci.yaml for dcn-storage.yaml 2021-01-31 22:01:12 +00:00
scripts Fix typos 2020-09-16 15:45:12 +05:30
tools Add tags to THT network resources 2021-05-19 19:25:04 +02:00
tripleo_heat_templates Fix typos 2020-09-16 15:45:12 +05:30
zuul.d Add openstack-tox-tht to the gate 2021-05-13 14:53:19 +00:00
.gitignore Remove mac_hostname & random_string 2019-07-18 19:10:31 +00:00
.gitreview Update .gitreview for stable/victoria 2020-10-30 15:51:34 +00:00
.testr.conf Improve nova statedir ownership logic 2018-07-09 17:07:30 +01:00
LICENSE Add license file 2014-01-20 11:58:20 +01:00
README.rst Add scenario013: Octavia standalone without Ceph 2020-07-14 08:04:34 +00:00
babel.cfg Add release configuration. 2013-10-22 17:49:35 +01:00
bindep.txt include gcc,python36-devel in bindep, for tests 2020-10-03 19:24:53 +10:00
config-download-software.yaml Don't use POLL_SERVER_CFN transport for DeployedServer 2020-10-17 10:21:11 +05:30
config-download-structured.yaml Don't use POLL_SERVER_CFN transport for DeployedServer 2020-10-17 10:21:11 +05:30
default_passwords.yaml Change template names to rocky 2018-05-09 08:28:42 +02:00
j2_excludes.yaml Remove ipv6 specific network templates 2017-08-31 13:12:17 -07:00
net-config-bond.j2.yaml Replace bridge_name and interface_name in config 2020-09-24 09:22:59 +05:30
net-config-bridge.j2.yaml Replace bridge_name and interface_name in config 2020-09-24 09:22:59 +05:30
net-config-linux-bridge.j2.yaml Replace bridge_name and interface_name in config 2020-09-24 09:22:59 +05:30
net-config-noop.j2.yaml Network config with ansible for ci jobs using multi-nics 2020-10-02 12:23:17 +05:30
net-config-standalone.j2.yaml Create NetworkConfig per-role in overcloud.yaml 2020-09-29 14:13:51 +02:00
net-config-static-bridge-with-external-dhcp.j2.yaml Replace bridge_name and interface_name in config 2020-09-24 09:22:59 +05:30
net-config-static-bridge.j2.yaml Replace bridge_name and interface_name in config 2020-09-24 09:22:59 +05:30
net-config-static.j2.yaml Replace bridge_name and interface_name in config 2020-09-24 09:22:59 +05:30
net-config-undercloud.j2.yaml Create NetworkConfig per-role in overcloud.yaml 2020-09-29 14:13:51 +02:00
network_data.yaml Add external_resource_vip_id property to network_data.yaml 2019-03-25 10:48:40 -04:00
network_data_dashboard.yaml Add a StorageDashboard network used by CephGrafana service 2019-08-30 19:16:47 +02:00
network_data_ganesha.yaml Use appropriate allocation pools for StorageNFS 2020-08-26 15:27:52 +00:00
network_data_routed.yaml Merge "Allow overlay tunnel endpoints on IPv6 address" 2019-01-10 21:13:19 +00:00
network_data_subnets_routed.yaml L3 routed networks - data + env (1/3) 2018-12-30 19:24:29 +01:00
network_data_undercloud.yaml Add network data for the undercloud 2019-01-21 19:35:37 +01:00
overcloud-resource-registry-puppet.j2.yaml Merge "Config parameters for timemaster service" into stable/victoria 2021-05-19 20:05:50 +00:00
overcloud.j2.yaml Merge "Set tags on all OS::Neutron::Port resources" into stable/victoria 2021-05-31 14:35:42 +00:00
plan-environment.yaml Add name and description fields to plan-environment.yaml 2017-04-12 17:25:40 +02:00
requirements.txt Deprecate EnablePaunch and remove Paunch support 2020-06-03 17:53:40 +00:00
roles_data.yaml Add OVNCMSOptions to Controller and Networker roles 2021-06-07 01:28:14 +00:00
roles_data_undercloud.yaml Concatenate host_routes and default route in overcloud.yaml 2020-10-04 12:28:22 +02:00
setup.cfg Replace git.openstack.org URLs with opendev.org URLs 2019-06-26 02:43:46 +00:00
setup.py Updated from global requirements 2017-03-28 13:03:01 +00:00
test-ansible-requirements.txt Ansible lint check in THT 2019-10-30 04:56:05 -04:00
test-requirements.txt Fix Flakes and lower-constraints errors 2020-09-10 11:10:54 +02:00
tox.ini Merge "Update TOX_CONSTRAINTS_FILE for stable/victoria" into stable/victoria 2021-03-19 12:21:42 +00:00

README.rst

Team and repository tags

image

tripleo-heat-templates

Heat templates to deploy OpenStack using OpenStack.

Features

The ability to deploy a multi-node, role based OpenStack deployment using OpenStack Heat. Notable features include:

  • Choice of deployment/configuration tooling: puppet, (soon) docker
  • Role based deployment: roles for the controller, compute, ceph, swift, and cinder storage
  • physical network configuration: support for isolated networks, bonding, and standard ctlplane networking

Directories

A description of the directory layout in TripleO Heat Templates.

  • environments: contains heat environment files that can be used with -e

    on the command like to enable features, etc.

  • extraconfig: templates used to enable 'extra' functionality. Includes

    functionality for distro specific registration and upgrades.

  • firstboot: example first_boot scripts that can be used when initially

    creating instances.

  • network: heat templates to help create isolated networks and ports
  • puppet: templates mostly driven by configuration with puppet. To use these

    templates you can use the overcloud-resource-registry-puppet.yaml.

  • validation-scripts: validation scripts useful to all deployment

    configurations

  • roles: example roles that can be used with the tripleoclient to generate

    a roles_data.yaml for a deployment See the roles/README.rst for additional details.

Service testing matrix

The configuration for the CI scenarios will be defined in tripleo-heat-templates/ci/ and should be executed according to the following table:

- scn000 scn001 scn002 scn003 scn004 scn006 scn007 scn009 scn010 scn013 non-ha ovh-ha
keystone

X

X

X

X

X

X

X

X

X

X

X
glance

rbd

 swift

file

rgw

file

file

rbd

file

file

file
cinder

rbd

 iscsi
heat

X

X
ironic

X
mysql

X

X

X

X

X

X

X

X

X

X

X
neutron

ovn

ovn

ovn

ovn

ovn

ovs

ovn

ovn

ovn

ovn
neutron-bgpvpn

wip
ovn

X
neutron-l2gw

wip
om-rpc rabbit rabbit

amqp1

 rabbit rabbit rabbit rabbit rabbit rabbit rabbit
om-notify rabbit rabbit rabbit rabbit rabbit rabbit rabbit rabbit rabbit rabbit
redis

X

X
haproxy

X

X

X

X

X

X

X

X

X

X
memcached

X

X

X

X

X

X

X

X

X

X
pacemaker

X

X

X

X

X

X

X

X

X

X
nova

qemu

qemu

qemu

qemu

 ironic

qemu

qemu

qemu

qemu

qemu
placement

X

X

X

X

X

X

X

X

X

X
ntp

X

X

X

X

X

X

X

X

X

X

X

X
snmp

X

X

X

X

X

X

X

X

X

X

X

X
timezone

X

X

X

X

X

X

X

X

X

X

X

X
sahara

X
mistral

X
swift

X
aodh

X

X
ceilometer

X

X
gnocchi

rbd

swift
barbican

X
zaqar

X
cephrgw

X
cephmds

X
manila

X
collectd

X
designate

X
octavia

X

X
rear

X
Extra Firewall

X