tripleo-heat-templates/docker/services/nova-scheduler.yaml
Cédric Jeanneret d70d128aa0 Enable virt_sandbox_use_netlink SELinux boolean for port healthchecks
As healthchecks are using "ss" command, we need to allow contaier_t
to access a tcp diagnostic socket, at least for the port healthchecks.

This follows change I9ebdf09c36fd2c69d05128b584593b41d9144e56, triggered
by the neutron healthchecks. A second pass was necessary in order to
further check the calls of ss.

Change-Id: I27e4c860948667abc2c21df5ec9e01627f58465a
Related-Bug: #1810512
2019-01-11 08:19:18 +01:00

185 lines
6.3 KiB
YAML

heat_template_version: rocky
description: >
OpenStack containerized Nova Scheduler service
parameters:
DockerNovaSchedulerImage:
description: image
type: string
DockerNovaConfigImage:
description: The container image to use for the nova config_volume
type: string
NovaSchedulerLoggingSource:
type: json
default:
tag: openstack.nova.scheduler
path: /var/log/containers/nova/nova-scheduler.log
EndpointMap:
default: {}
description: Mapping of service endpoint -> protocol. Typically set
via parameter_defaults in the resource registry.
type: json
ServiceData:
default: {}
description: Dictionary packing service data
type: json
ServiceNetMap:
default: {}
description: Mapping of service_name -> network name. Typically set
via parameter_defaults in the resource registry. This
mapping overrides those in ServiceNetMapDefaults.
type: json
DefaultPasswords:
default: {}
type: json
RoleName:
default: ''
description: Role name on which the service is applied
type: string
RoleParameters:
default: {}
description: Parameters specific to the role
type: json
UpgradeRemoveUnusedPackages:
default: false
description: Remove package if the service is being disabled during upgrade
type: boolean
resources:
ContainersCommon:
type: ./containers-common.yaml
MySQLClient:
type: ../../puppet/services/database/mysql-client.yaml
NovaSchedulerBase:
type: ../../puppet/services/nova-scheduler.yaml
properties:
EndpointMap: {get_param: EndpointMap}
ServiceData: {get_param: ServiceData}
ServiceNetMap: {get_param: ServiceNetMap}
DefaultPasswords: {get_param: DefaultPasswords}
RoleName: {get_param: RoleName}
RoleParameters: {get_param: RoleParameters}
NovaLogging:
type: OS::TripleO::Services::Logging::NovaCommon
properties:
DockerNovaImage: {get_param: DockerNovaSchedulerImage}
NovaServiceName: 'scheduler'
outputs:
role_data:
description: Role data for the Nova Scheduler service.
value:
service_name: {get_attr: [NovaSchedulerBase, role_data, service_name]}
config_settings:
map_merge:
- {get_attr: [NovaSchedulerBase, role_data, config_settings]}
- {get_attr: [NovaLogging, config_settings]}
service_config_settings:
map_merge:
- get_attr: [NovaSchedulerBase, role_data, service_config_settings]
- fluentd:
tripleo_fluentd_groups_nova_scheduler:
- nova
tripleo_fluentd_sources_nova_scheduler:
- {get_param: NovaSchedulerLoggingSource}
# BEGIN DOCKER SETTINGS
puppet_config:
config_volume: nova
puppet_tags: nova_config
step_config:
list_join:
- "\n"
- - {get_attr: [NovaSchedulerBase, role_data, step_config]}
- {get_attr: [MySQLClient, role_data, step_config]}
config_image: {get_param: DockerNovaConfigImage}
kolla_config:
/var/lib/kolla/config_files/nova_scheduler.json:
command:
list_join:
- ' '
- - /usr/bin/nova-scheduler
- get_attr: [NovaLogging, cmd_extra_args]
config_files:
- source: "/var/lib/kolla/config_files/src/*"
dest: "/"
merge: true
preserve_properties: true
permissions:
- path: /var/log/nova
owner: nova:nova
recurse: true
docker_config:
step_4:
nova_scheduler:
image: {get_param: DockerNovaSchedulerImage}
net: host
privileged: false
restart: always
healthcheck:
test:
list_join:
- ' '
- - '/openstack/healthcheck'
- yaql:
expression: str($.data.port)
data:
port: {get_attr: [NovaSchedulerBase, role_data, config_settings, 'nova::rabbit_port']}
volumes:
list_concat:
- {get_attr: [ContainersCommon, volumes]}
- {get_attr: [NovaLogging, volumes]}
-
- /var/lib/kolla/config_files/nova_scheduler.json:/var/lib/kolla/config_files/config.json:ro
- /var/lib/config-data/puppet-generated/nova/:/var/lib/kolla/config_files/src:ro
- /run:/run
environment:
- KOLLA_CONFIG_STRATEGY=COPY_ALWAYS
host_prep_tasks:
list_concat:
- {get_attr: [NovaLogging, host_prep_tasks]}
- - name: enable virt_sandbox_use_netlink for healthcheck
seboolean:
name: virt_sandbox_use_netlink
persistent: yes
state: yes
upgrade_tasks:
- when: step|int == 3
block:
- name: Set fact for removal of openstack-nova-scheduler package
set_fact:
remove_nova_scheduler_package: {get_param: UpgradeRemoveUnusedPackages}
- name: Remove openstack-nova-scheduler package if operator requests it
package: name=openstack-nova-scheduler state=removed
ignore_errors: True
when: remove_nova_scheduler_package|bool
fast_forward_upgrade_tasks:
- when:
- step|int == 0
- release == 'ocata'
block:
- name: Check if nova_scheduler is deployed
command: systemctl is-enabled --quiet openstack-nova-scheduler
ignore_errors: True
register: nova_scheduler_enabled_result
- name: Set fact nova_scheduler_enabled
set_fact:
nova_scheduler_enabled: "{{ nova_scheduler_enabled_result.rc == 0 }}"
- name: Stop and disable nova-scheduler service
service: name=openstack-nova-scheduler state=stopped
when:
- step|int == 1
- release == 'ocata'
- nova_scheduler_enabled|bool
post_upgrade_tasks:
- when: step|int == 1
import_role:
name: tripleo-docker-rm
vars:
containers_to_rm:
- nova_scheduler