tripleo-heat-templates/deployment
Alan Bishop e2936d7604 Add cinder RBD support for multiple ceph clusters
The CinderRbdMultiConfig parameter provides a mechanism for
configuring cinder RBD backends associated with external ceph
clusters defined by CephExternalMultiConfig.

A new nova_libvirt_init_secret.sh script handles the creation of
the libvirt secret that is required for nova to connect to volumes
on the cinder RBD backends.

Depends-On: I040e25341c9869ad289d7e7c98e831caef23fece
Change-Id: I73af5b868de629870a35d38f8436e7025aae791e
2021-04-14 12:44:45 -07:00
..
aide Use 'wallaby' heat_template_version 2021-03-31 17:35:12 +05:30
aodh Merge "Add missing KOLLA_CONFIG_STRATEGY for the aodh_api_cron container" 2021-04-06 22:32:33 +00:00
apache Simplify apache service conditions 2021-04-06 16:03:30 +05:30
auditd Use 'wallaby' heat_template_version 2021-03-31 17:35:12 +05:30
backup-and-restore Use 'wallaby' heat_template_version 2021-03-31 17:35:12 +05:30
barbican Add new options for Barbican PKCS#11 backend 2021-04-12 08:04:18 -05:00
ceilometer Simplify ceilometer service template conditions 2021-04-06 16:04:46 +05:30
ceph-ansible Simplify ceph-ansible service templates 2021-04-14 10:25:57 +05:30
cephadm Merge "Move Ceph services to linux-system-roles.certificate" 2021-04-09 01:40:34 +00:00
certs Use 'wallaby' heat_template_version 2021-03-31 17:35:12 +05:30
cinder Add cinder RBD support for multiple ceph clusters 2021-04-14 12:44:45 -07:00
clients Use 'wallaby' heat_template_version 2021-03-31 17:35:12 +05:30
container-image-prepare Use 'wallaby' heat_template_version 2021-03-31 17:35:12 +05:30
database Merge "Ensure SELinux context persist across restorecon and reboot" 2021-04-07 03:59:53 +00:00
deprecated Use 'wallaby' heat_template_version 2021-03-31 17:35:12 +05:30
etcd Use 'wallaby' heat_template_version 2021-03-31 17:35:12 +05:30
experimental Generate bind pool and bind configuration using deployment info 2021-04-09 15:04:22 -02:30
frr Move frr setup steps to pre_deploy_step_tasks 2021-04-06 20:25:58 +00:00
glance Use 'wallaby' heat_template_version 2021-03-31 17:35:12 +05:30
gnocchi Merge "Enable exec resource to generate policy.yaml for Gnocchi" 2021-04-07 10:28:19 +00:00
haproxy Merge "Enable ansible-lint" 2021-04-13 19:06:05 +00:00
heat Fix some template conditions 2021-04-06 16:05:35 +05:30
horizon Use 'wallaby' heat_template_version 2021-03-31 17:35:12 +05:30
image-serve Use 'wallaby' heat_template_version 2021-03-31 17:35:12 +05:30
ipa Ensure ansible_fqdn is set 2021-04-12 12:35:34 -05:00
ipsec Use 'wallaby' heat_template_version 2021-03-31 17:35:12 +05:30
ironic Merge "Ensure SELinux context persist across restorecon and reboot" 2021-04-07 03:59:53 +00:00
iscsid Merge "Add parameter to set iscsid CHAP algorithms" 2021-04-07 11:06:05 +00:00
kernel Use 'wallaby' heat_template_version 2021-03-31 17:35:12 +05:30
keystone Merge "Remove or fix outdated/incorrect keystone hieradata definitions" 2021-04-14 01:51:27 +00:00
logging Merge "Enable debug logging of libvirt services when Debug is true" 2021-04-06 23:27:43 +00:00
login-defs Use 'wallaby' heat_template_version 2021-03-31 17:35:12 +05:30
logrotate Merge "Use 'wallaby' heat_template_version" 2021-04-01 18:57:13 +00:00
manila Merge "Ensure SELinux context persist across restorecon and reboot" 2021-04-07 03:59:53 +00:00
masquerade-networks Use 'wallaby' heat_template_version 2021-03-31 17:35:12 +05:30
memcached Use 'wallaby' heat_template_version 2021-03-31 17:35:12 +05:30
messaging Merge "Ensure SELinux context persist across restorecon and reboot" 2021-04-07 03:59:53 +00:00
metrics Merge "Simplify internal_tls_enabled conditions" 2021-04-03 13:20:28 +00:00
multipathd Use 'wallaby' heat_template_version 2021-03-31 17:35:12 +05:30
neutron Merge "Remove the OVNVifType parameter" 2021-04-09 05:18:51 +00:00
nova Add cinder RBD support for multiple ceph clusters 2021-04-14 12:44:45 -07:00
octavia Use 'wallaby' heat_template_version 2021-03-31 17:35:12 +05:30
openvswitch Use 'wallaby' heat_template_version 2021-03-31 17:35:12 +05:30
ovn Merge "Remove ovn-cms-options from OVS when OVNCMSOptions is set to """ 2021-04-13 17:49:09 +00:00
pacemaker Merge "HA: fix race when moving VIP during minor update" 2021-04-07 15:37:00 +00:00
placement Use 'wallaby' heat_template_version 2021-03-31 17:35:12 +05:30
podman Use 'wallaby' heat_template_version 2021-03-31 17:35:12 +05:30
qdr Merge "Ensure SELinux context persist across restorecon and reboot" 2021-04-07 03:59:53 +00:00
rabbitmq Disable RabbitMQ busy-wait for dirty cpu and dirty i/o schedulers 2021-04-09 16:44:52 +00:00
rhsm Use 'wallaby' heat_template_version 2021-03-31 17:35:12 +05:30
securetty Use 'wallaby' heat_template_version 2021-03-31 17:35:12 +05:30
snmp Use 'wallaby' heat_template_version 2021-03-31 17:35:12 +05:30
sshd Use 'wallaby' heat_template_version 2021-03-31 17:35:12 +05:30
swift Merge "Remove usage of the wrong puppet parameter" 2021-04-13 21:30:49 +00:00
tests Use 'wallaby' heat_template_version 2021-03-31 17:35:12 +05:30
time Use 'wallaby' heat_template_version 2021-03-31 17:35:12 +05:30
timemaster Use 'wallaby' heat_template_version 2021-03-31 17:35:12 +05:30
timesync Use 'wallaby' heat_template_version 2021-03-31 17:35:12 +05:30
tls Ensure ansible_fqdn is set 2021-04-12 12:35:34 -05:00
tripleo-firewall Use 'wallaby' heat_template_version 2021-03-31 17:35:12 +05:30
tripleo-packages Use 'wallaby' heat_template_version 2021-03-31 17:35:12 +05:30
tuned Use 'wallaby' heat_template_version 2021-03-31 17:35:12 +05:30
unbound Use 'wallaby' heat_template_version 2021-03-31 17:35:12 +05:30
undercloud Use 'wallaby' heat_template_version 2021-03-31 17:35:12 +05:30
validations Use 'wallaby' heat_template_version 2021-03-31 17:35:12 +05:30
veritas-hyperscale Use 'wallaby' heat_template_version 2021-03-31 17:35:12 +05:30
vpp Use 'wallaby' heat_template_version 2021-03-31 17:35:12 +05:30
README.rst Remove DefaultPasswords interface 2021-02-12 11:38:44 +05:30
containers-common.yaml Use 'wallaby' heat_template_version 2021-03-31 17:35:12 +05:30

README.rst

TripleO Deployments

This directory contains files that represent individual service deployments, orchestration tools, and the configuration tools used to deploy them.

Directory Structure

Each logical grouping of services will have a directory. Example: 'timesync'. Within this directory related timesync services would exist to for example configure timesync services on baremetal or via containers.

Filenaming conventions

As a convention each deployments service filename will reflect both the deployment engine (baremetal, or containers) along with the config tool used to deploy that service.

The convention is <service-name>-<engine>-<config management tool>.

Examples:

deployment/aodh/aodh-api-container-puppet.yaml (containerized Aodh service configured with Puppet)

deployment/aodh/aodh-api-container-ansible.yaml (containerized Aodh service configured with Ansible)

deployment/timesync/chrony-baremetal-ansible.yaml (baremetal Chrony service configured with Ansible)

deployment/timesync/chrony-baremetal-puppet.yaml (baremetal Chrony service configured with Puppet)

Building Kolla Images

TripleO currently relies on Kolla(Dockerfile) containers. Kolla supports container customization and we are making use of this feature within TripleO to inject puppet (our configuration tool of choice) into the Kolla base images. A variety of other customizations are being made via the tripleo-common/container-images/tripleo_kolla_template_overrides.j2 file.

To build Kolla images for TripleO adjust your kolla config1 to build your centos base image with puppet using the example below:

$ cat template-overrides.j2 {% extends parent_template %} {% set base_centos_binary_packages_append = ['puppet'] %} {% set nova_scheduler_packages_append = ['openstack-tripleo-common'] %}

kolla-build --base centos --template-override template-overrides.j2

Containerized Deployment Template Structure

Each deployment template may define a set of output values control the underlying service deployment in a variety of ways. These output sections are specific to the TripleO deployment architecture. The following sections are available for containerized services.

  • config_settings: This section contains service specific hiera data can be used to generate config files for each service. This data is ultimately processed via the container_puppet_config module in tripleo-ansible which generates config files for each service according to the settings here.

  • kolla_config: Contains YAML that represents how to map config files into the kolla container. This config file is typically mapped into the container itself at the /var/lib/kolla/config_files/config.json location and drives how kolla's external config mechanisms work.

  • docker_config: Data that is passed to tripleo_container_manage role to configure a container, or step of containers at each step. See the available steps documented below which are implemented by TripleO's cluster deployment architecture. If you want the tasks executed only once for the bootstrap node per a role in the cluster, use the /usr/bin/bootstrap_host_exec wrapper.

  • puppet_config: This section is a nested set of key value pairs that drive the creation of config files using puppet. Required parameters include:

    • puppet_tags: Puppet resource tag names that are used to generate config files with puppet. Only the named config resources are used to generate a config file. Any service that specifies tags will have the default tags of 'file,concat,file_line,augeas,cron' appended to the setting. Example: keystone_config
    • config_volume: The name of the volume (directory) where config files will be generated for this service. Use this as the location to bind mount into the running Kolla container for configuration.
    • config_image: The name of the container image that will be used for generating configuration files. This is often the same container that the runtime service uses. Some services share a common set of config files which are generated in a common base container.
    • step_config: This setting controls the manifest that is used to create container config files via puppet. The puppet tags below are used along with this manifest to generate a config directory for this container.
  • container_puppet_tasks: This section provides data to drive the puppet containers tooling directly. The task is executed for the defined steps before the corresponding docker_config's step. Puppet always sees the step number overrided as the step #6. It might be useful for initialization of things. Note that the tasks are executed only once for the bootstrap node per a role in the cluster. Make sure the puppet manifest ensures the wanted "at most once" semantics. That may be achieved via the <service_name>_short_bootstrap_node_name hiera parameters automatically evaluated for each service.

  • global_config_settings: the hiera keys will be distributed to all roles

  • service_config_settings: Takes an extra key to wire in values that are defined for a service that need to be consumed by some other service. For example: service_config_settings: haproxy: foo: bar This will set the hiera key 'foo' on all roles where haproxy is included.

Deployment steps

Similar to baremetal containers are brought up in a stepwise manner. The current architecture supports bringing up baremetal services alongside of containers. For each step the baremetal puppet manifests are executed first and then any containers are brought up afterwards.

Steps correlate to the following:

Pre) Containers config files generated per hiera settings. 1) Load Balancer configuration baremetal a) step 1 baremetal b) step 1 containers 2) Core Services (Database/Rabbit/NTP/etc.) a) step 2 baremetal b) step 2 containers 3) Early Openstack Service setup (Ringbuilder, etc.) a) step 3 baremetal b) step 3 containers 4) General OpenStack Services a) step 4 baremetal b) step 4 containers c) Keystone containers post initialization (tenant,service,endpoint creation) 5) Service activation (Pacemaker), online data migration a) step 5 baremetal b) step 5 containers

Update steps:

All services have an associated update_tasks output that is an ansible snippet that will be run during update in an rolling update that is expected to run in a rolling update fashion (one node at a time)

For Controller (where pacemaker is running) we have the following states:
  1. Step=1: stop the cluster on the updated node;
  2. Step=2: Pull the latest image and retag the it pcmklatest
  3. Step=3: yum upgrade happens on the host.
  4. Step=4: Restart the cluster on the node
  5. Step=5: Verification: Currently we test that the pacemaker services are running.

Then the usual deploy steps are run which pull in the latest image for all containerized services and the updated configuration if any.

Note: as pacemaker is not containerized, the points 1 and 4 happen in deployment/pacemaker/pacemaker-baremetal-puppet.yaml.

Input Parameters

Each service may define its own input parameters and defaults. Operators will use the parameter_defaults section of any Heat environment to set per service parameters.

Apart from sevice specific inputs, there are few default parameters for all the services. Following are the list of default parameters:

  • ServiceData: Mapping of service specific data. It is used to encapsulate all the service specific data. As of now, it contains net_cidr_map, which contains the CIDR map for all the networks. Additional data will be added as and when required.

  • ServiceNetMap: Mapping of service_name -> network name. Default mappings for service to network names are defined in ../network/service_net_map.j2.yaml, which may be overridden via ServiceNetMap values added to a user environment file via parameter_defaults.

  • EndpointMap: Mapping of service endpoint -> protocol. Contains a mapping of endpoint data generated for all services, based on the data included in ../network/endpoints/endpoint_data.yaml.

  • RoleName: Name of the role on which this service is deployed. A service can be deployed in multiple roles. This is an internal parameter (should not be set via environment file), which is fetched from the name attribute of the roles_data.yaml template.

  • RoleParameters: Parameter specific to a role on which the service is applied. Using the format "<RoleName>Parameters" in the parameter_defaults of user environment file, parameters can be provided for a specific role. For example, in order to provide a parameter specific to "Compute" role, below is the format:

    parameter_defaults:
      ComputeParameters:
        Param1: value

Update Steps

Each service template may optionally define a update_tasks key, which is a list of ansible tasks to be performed during the minor update process. These are executed in a rolling manner node-by-node.

We allow a series of steps for the per-service update sequence via conditionals referencing a step variable e.g when: step|int == 2.

Pre-upgrade Rolling Steps

Each service template may optionally define a pre_upgrade_rolling_tasks key, which is a list of ansible tasks to be performed before the main upgrade phase, and these tasks are executed in a node-by-node rolling manner on the overcloud, similarly as update_tasks.

Upgrade Steps

Each service template may optionally define a upgrade_tasks key, which is a list of ansible tasks to be performed during the upgrade process.

Similar to the update_tasks, we allow a series of steps for the per-service upgrade sequence, defined as ansible tasks with a "when: step|int == 1" for the first step, "== 2" for the second, etc.

Steps correlate to the following:

  1. Perform any pre-upgrade validations.
  2. Stop the control-plane services, e.g disable LoadBalancer, stop pacemaker cluster and stop any managed resources. The exact order is controlled by the cluster constraints.
  3. Perform a package update and install new packages: A general upgrade is done, and only new package should go into service ansible tasks.
  4. Start services needed for migration tasks (e.g DB)
  5. Perform any migration tasks, e.g DB sync commands

Note that the services are not started in the upgrade tasks - we instead re-run puppet which does any reconfiguration required for the new version, then starts the services.

When running an OS upgrade via the tags system_upgrade_prepare and system_upgrade_run, or the combined tag system_upgrade, the steps corellate to the following:

  1. Any pre-service-stop actions. (system_upgrade_prepare)
  2. Stop all services. (system_upgrade_prepare)
  3. Post-service-stop actions like removing packages before the upgrade. (system_upgrade_prepare)
  4. Step reserved for the tripleo-packages service. Only package download for upgrade (under system_upgrade_prepare tag), and reboot for performing the offline upgrade (under system_upgrade_run tag) happens here.
  5. Any post-upgrade tasks (system_upgrade_run).

Nova Server Metadata Settings

One can use the hook of type OS::TripleO::ServiceServerMetadataHook to pass entries to the nova instances' metadata. It is, however, disabled by default. In order to overwrite it one needs to define it in the resource registry. An implementation of this hook needs to conform to the following:

  • It needs to define an input called RoleData of json type. This gets as input the contents of the role_data for each role's ServiceChain.
  • This needs to define an output called metadata which will be given to the Nova Server resource as the instance's metadata.

Keystone resources management

Keystone resources, such as users, roles, domains, endpoints, services, role assignments, are now managed by tripleo-keystone-resources Ansible role.


  1. See the override file which can be used to build Kolla packages that work with TripleO.↩︎