diff --git a/Makefile b/Makefile index 988c6876..9e7abb72 100644 --- a/Makefile +++ b/Makefile @@ -6,6 +6,8 @@ images: docker build images/heat --target heat-api-cfn -t vexxhost/heat-api-cfn:latest docker build images/heat --target heat-engine -t vexxhost/heat-engine:latest docker build images/chronyd -t vexxhost/chronyd:latest + docker build images/magnum --target magnum-api -t vexxhost/magnum-api:latest + docker build images/magnum --target magnum-conductor -t vexxhost/magnum-conductor:latest docker build images/mcrouter -t vexxhost/mcrouter:latest docker build images/mcrouter-exporter -t vexxhost/mcrouter-exporter:latest docker build images/memcached -t vexxhost/memcached:latest diff --git a/chart/test-values.yaml b/chart/test-values.yaml index 5438b500..494adcb5 100644 --- a/chart/test-values.yaml +++ b/chart/test-values.yaml @@ -10,4 +10,6 @@ configMap: configDir: /etc/keystone heat: configDir: /etc/heat + magnum: + configDir: /etc/magnum chronyd: {} \ No newline at end of file diff --git a/config/samples/operator-config.yaml b/config/samples/operator-config.yaml index dad93b00..115059f8 100644 --- a/config/samples/operator-config.yaml +++ b/config/samples/operator-config.yaml @@ -17,4 +17,6 @@ data: host: api: "h-api.vexxhost.com" api-cfn: "h-api-cfn.vexxhost.com" + magnum: + configDir: /etc/magnum chronyd: {} \ No newline at end of file diff --git a/devstack/lib/magnum b/devstack/lib/magnum new file mode 100644 index 00000000..cc517c1f --- /dev/null +++ b/devstack/lib/magnum @@ -0,0 +1,410 @@ +#!/bin/bash +# +# lib/magnum +# Functions to control the configuration and operation of the **magnum** service + +# Dependencies: +# +# - ``functions`` file +# - ``DEST``, ``DATA_DIR``, ``STACK_USER`` must be defined +# - ``SERVICE_{TENANT_NAME|PASSWORD}`` must be defined + +# ``stack.sh`` calls the entry points in this order: +# +# - install_magnum +# - configure_magnum +# - create_magnum_conf +# - init_magnum +# - magnum_register_image +# - magnum_configure_flavor +# - start_magnum +# - configure_iptables_magnum +# - configure_apache_magnum +# - stop_magnum +# - cleanup_magnum + +# Save trace setting +XTRACE=$(set +o | grep xtrace) +set +o xtrace + + +# Defaults +# -------- + +# Set up default directories +MAGNUM_REPO=${MAGNUM_REPO:-${GIT_BASE}/openstack/magnum.git} +MAGNUM_BRANCH=${MAGNUM_BRANCH:-master} +MAGNUM_DIR=$DEST/magnum + +GITREPO["python-magnumclient"]=${MAGNUMCLIENT_REPO:-${GIT_BASE}/openstack/python-magnumclient.git} +GITBRANCH["python-magnumclient"]=${MAGNUMCLIENT_BRANCH:-master} +GITDIR["python-magnumclient"]=$DEST/python-magnumclient + +MAGNUM_STATE_PATH=${MAGNUM_STATE_PATH:=$DATA_DIR/magnum} +MAGNUM_AUTH_CACHE_DIR=${MAGNUM_AUTH_CACHE_DIR:-/var/cache/magnum} +MAGNUM_CERTIFICATE_CACHE_DIR=${MAGNUM_CERTIFICATE_CACHE_DIR:-/var/lib/magnum/certificate-cache} + +MAGNUM_CONF_DIR=/etc/magnum +MAGNUM_CONF=$MAGNUM_CONF_DIR/magnum.conf +MAGNUM_API_PASTE=$MAGNUM_CONF_DIR/api-paste.ini +MAGNUM_K8S_KEYSTONE_AUTH_DEFAULT_POLICY=$MAGNUM_CONF_DIR/k8s_keystone_auth_default_policy.json +MAGNUM_POLICY=$MAGNUM_CONF_DIR/policy.yaml + +if is_ssl_enabled_service "magnum" || is_service_enabled tls-proxy; then + MAGNUM_SERVICE_PROTOCOL="https" +fi + +# Public facing bits +MAGNUM_SERVICE_HOST=${MAGNUM_SERVICE_HOST:-$HOST_IP} +MAGNUM_SERVICE_PORT=${MAGNUM_SERVICE_PORT:-9511} +MAGNUM_SERVICE_PORT_INT=${MAGNUM_SERVICE_PORT_INT:-19511} +MAGNUM_SERVICE_PROTOCOL=${MAGNUM_SERVICE_PROTOCOL:-$SERVICE_PROTOCOL} + +MAGNUM_TRUSTEE_DOMAIN_ADMIN_PASSWORD=${MAGNUM_TRUSTEE_DOMAIN_ADMIN_PASSWORD:-secret} + +MAGNUM_SWIFT_REGISTRY_CONTAINER=${MAGNUM_SWIFT_REGISTRY_CONTAINER:-docker_registry} + +# Support entry points installation of console scripts +if [[ -d $MAGNUM_DIR/bin ]]; then + MAGNUM_BIN_DIR=$MAGNUM_DIR/bin +else + MAGNUM_BIN_DIR=$(get_python_exec_prefix) +fi + +MAGNUM_CONFIGURE_IPTABLES=${MAGNUM_CONFIGURE_IPTABLES:-True} + +# Functions +# --------- + +# Test if any magnum services are enabled +# is_magnum_enabled +function is_magnum_enabled { + [[ ,${ENABLED_SERVICES} =~ ,"magnum-" ]] && return 0 + return 1 +} +# cleanup_magnum() - Remove residual data files, anything left over from previous +# runs that a clean run would need to clean up +function cleanup_magnum { + echo noop +} + +# configure_magnum() - Set config files, create data dirs, etc +function configure_magnum { + # Put config files in ``/etc/magnum`` for everyone to find + if [[ ! -d $MAGNUM_CONF_DIR ]]; then + sudo mkdir -p $MAGNUM_CONF_DIR + sudo chown $STACK_USER $MAGNUM_CONF_DIR + fi + + # Rebuild the config file from scratch + create_magnum_conf + + create_api_paste_conf + + create_k8s_keystone_auth_default_poliy +} + +# create_magnum_accounts() - Set up common required magnum accounts +# +# Project User Roles +# ------------------------------------------------------------------ +# SERVICE_PROJECT_NAME magnum service +function create_magnum_accounts { + + create_service_user "magnum" "admin" + + get_or_create_service "magnum" "container-infra" "Container Infrastructure Management Service" + get_or_create_endpoint "container-infra" \ + "$REGION_NAME" \ + "$MAGNUM_SERVICE_PROTOCOL://$MAGNUM_SERVICE_HOST:$MAGNUM_SERVICE_PORT/v1" \ + "$MAGNUM_SERVICE_PROTOCOL://$MAGNUM_SERVICE_HOST:$MAGNUM_SERVICE_PORT/v1" \ + "$MAGNUM_SERVICE_PROTOCOL://$MAGNUM_SERVICE_HOST:$MAGNUM_SERVICE_PORT/v1" + + # Create for Kubernetes Keystone auth + get_or_create_role k8s_admin + get_or_create_role k8s_developer + get_or_create_role k8s_viewer +} + +# create_magnum_conf() - Create a new magnum.conf file +function create_magnum_conf { + + # (Re)create ``magnum.conf`` + rm -f $MAGNUM_CONF + HOSTNAME=`hostname` + iniset $MAGNUM_CONF DEFAULT debug "$ENABLE_DEBUG_LOG_LEVEL" + iniset $MAGNUM_CONF DEFAULT transport_url $(get_transport_url) + iniset $MAGNUM_CONF DEFAULT host "$HOSTNAME" + + iniset $MAGNUM_CONF database connection `database_connection_url magnum` + iniset $MAGNUM_CONF api host "$MAGNUM_SERVICE_HOST" + if is_service_enabled tls-proxy; then + iniset $MAGNUM_CONF api port "$MAGNUM_SERVICE_PORT_INT" + iniset $MAGNUM_CONF drivers verify_ca true + iniset $MAGNUM_CONF drivers openstack_ca_file $SSL_BUNDLE_FILE + else + iniset $MAGNUM_CONF api port "$MAGNUM_SERVICE_PORT" + iniset $MAGNUM_CONF drivers verify_ca false + fi + + iniset $MAGNUM_CONF cluster temp_cache_dir $MAGNUM_CERTIFICATE_CACHE_DIR + + iniset $MAGNUM_CONF oslo_policy policy_file $MAGNUM_POLICY + + iniset $MAGNUM_CONF keystone_auth auth_type password + iniset $MAGNUM_CONF keystone_auth username magnum + iniset $MAGNUM_CONF keystone_auth password $SERVICE_PASSWORD + iniset $MAGNUM_CONF keystone_auth project_name $SERVICE_PROJECT_NAME + iniset $MAGNUM_CONF keystone_auth project_domain_id default + iniset $MAGNUM_CONF keystone_auth user_domain_id default + + configure_auth_token_middleware $MAGNUM_CONF magnum + + iniset $MAGNUM_CONF keystone_auth auth_url $KEYSTONE_AUTH_URI_V3 + + # FIXME(pauloewerton): keystone_authtoken section is deprecated. Remove it + # after deprecation period. + iniset $MAGNUM_CONF keystone_authtoken www_authenticate_uri $KEYSTONE_SERVICE_URI_V3 + iniset $MAGNUM_CONF keystone_authtoken auth_url $KEYSTONE_AUTH_URI_V3 + iniset $MAGNUM_CONF keystone_authtoken auth_version v3 + + if is_fedora || is_suse; then + # magnum defaults to /usr/local/bin, but fedora and suse pip like to + # install things in /usr/bin + iniset $MAGNUM_CONF DEFAULT bindir "/usr/bin" + fi + + if [ -n "$MAGNUM_STATE_PATH" ]; then + iniset $MAGNUM_CONF DEFAULT state_path "$MAGNUM_STATE_PATH" + iniset $MAGNUM_CONF oslo_concurrency lock_path "$MAGNUM_STATE_PATH" + fi + + if [ "$USE_SYSTEMD" != "False" ]; then + setup_systemd_logging $MAGNUM_CONF + fi + + # Format logging + if [ "$LOG_COLOR" == "True" ] && [ "$USE_SYSTEMD" == "False" ]; then + setup_colorized_logging $MAGNUM_CONF DEFAULT + fi + + # Register SSL certificates if provided + if is_ssl_enabled_service magnum; then + ensure_certificates MAGNUM + + iniset $MAGNUM_CONF DEFAULT ssl_cert_file "$MAGNUM_SSL_CERT" + iniset $MAGNUM_CONF DEFAULT ssl_key_file "$MAGNUM_SSL_KEY" + + iniset $MAGNUM_CONF DEFAULT enabled_ssl_apis "$MAGNUM_ENABLED_APIS" + fi + + if is_service_enabled ceilometer; then + iniset $MAGNUM_CONF oslo_messaging_notifications driver "messaging" + fi + + if is_service_enabled barbican; then + iniset $MAGNUM_CONF certificates cert_manager_type "barbican" + else + iniset $MAGNUM_CONF certificates cert_manager_type "x509keypair" + fi + + trustee_domain_id=$(get_or_create_domain magnum 'Owns users and projects created by magnum') + trustee_domain_admin_id=$(get_or_create_user trustee_domain_admin $MAGNUM_TRUSTEE_DOMAIN_ADMIN_PASSWORD $trustee_domain_id) + openstack --os-auth-url $KEYSTONE_SERVICE_URI_V3 \ + --os-identity-api-version 3 role add \ + --user $trustee_domain_admin_id --domain $trustee_domain_id \ + admin + iniset $MAGNUM_CONF trust cluster_user_trust True + iniset $MAGNUM_CONF trust trustee_domain_name magnum + iniset $MAGNUM_CONF trust trustee_domain_admin_name trustee_domain_admin + iniset $MAGNUM_CONF trust trustee_domain_admin_password $MAGNUM_TRUSTEE_DOMAIN_ADMIN_PASSWORD + iniset $MAGNUM_CONF trust trustee_keystone_interface public + iniset $MAGNUM_CONF cinder_client region_name $REGION_NAME + + if is_service_enabled swift; then + iniset $MAGNUM_CONF docker_registry swift_region $REGION_NAME + iniset $MAGNUM_CONF docker_registry swift_registry_container $MAGNUM_SWIFT_REGISTRY_CONTAINER + fi + + # Get the default volume type from cinder.conf and set the coresponding + # default in magnum.conf + default_volume_type=$(iniget /etc/cinder/cinder.conf DEFAULT default_volume_type) + iniset $MAGNUM_CONF cinder default_docker_volume_type $default_volume_type + iniset $MAGNUM_CONF drivers send_cluster_metrics False + + iniset $MAGNUM_CONF kubernetes keystone_auth_default_policy $MAGNUM_K8S_KEYSTONE_AUTH_DEFAULT_POLICY +} + +function create_api_paste_conf { + # copy api_paste.ini + cp $MAGNUM_DIR/etc/magnum/api-paste.ini $MAGNUM_API_PASTE +} + +function create_k8s_keystone_auth_default_poliy { + cp $MAGNUM_DIR/etc/magnum/keystone_auth_default_policy.sample $MAGNUM_K8S_KEYSTONE_AUTH_DEFAULT_POLICY +} + +# create_magnum_cache_dir() - Part of the init_magnum() process +function create_magnum_cache_dir { + # Create cache dir + sudo mkdir -p $1 + sudo chown $STACK_USER $1 + rm -f $1/* +} + + +# init_magnum() - Initialize databases, etc. +function init_magnum { + # NOTE: Permissions here are bad but it's temporary so we don't care as much. + sudo chmod -Rv 777 /etc/heat + # Only do this step once on the API node for an entire cluster. + if is_service_enabled $DATABASE_BACKENDS; then + # (Re)create magnum database + recreate_database magnum + + # Migrate magnum database + time_start "dbsync" + sudo docker run -v $MAGNUM_CONF_DIR:$MAGNUM_CONF_DIR vexxhost/magnum-conductor:latest magnum-db-manage upgrade + time_stop "dbsync" + fi +} + +# magnum_register_image - Register heat image for magnum with property os_distro +function magnum_register_image { + local magnum_image_property="--property os_distro=" + + local atomic="$(echo $MAGNUM_GUEST_IMAGE_URL | grep -io 'atomic' || true;)" + if [ ! -z "$atomic" ]; then + magnum_image_property=$magnum_image_property"fedora-atomic --property hw_rng_model=virtio" + fi + local ubuntu="$(echo $MAGNUM_GUEST_IMAGE_URL | grep -io "ubuntu" || true;)" + if [ ! -z "$ubuntu" ]; then + magnum_image_property=$magnum_image_property"ubuntu" + fi + local coreos="$(echo $MAGNUM_GUEST_IMAGE_URL | grep -io "^coreos" || true;)" + if [ ! -z "$coreos" ]; then + magnum_image_property=$magnum_image_property"coreos" + fi + local fedora_coreos="$(echo $MAGNUM_GUEST_IMAGE_URL | grep -io "fedora-coreos" || true;)" + if [ ! -z "$fedora_coreos" ]; then + magnum_image_property=$magnum_image_property"fedora-coreos" + fi + # os_distro property for fedora ironic image + local fedora_ironic="$(echo $MAGNUM_GUEST_IMAGE_URL | grep -i "ironic" \ + | grep -io "fedora" || true;)" + if [ ! -z "$fedora_ironic" ]; then + magnum_image_property=$magnum_image_property"fedora" + fi + + # get the image name + local image_filename=$(basename "$MAGNUM_GUEST_IMAGE_URL") + local image_name="" + for extension in "tgz" "img" "qcow2" "iso" "vhd" "vhdx" "tar.gz" "img.gz" "img.bz2" "vhd.gz" "vhdx.gz" "qcow2.xz" + do + if [ $(expr match "${image_filename}" ".*\.${extension}$") -ne 0 ]; then + image_name=$(basename "$image_filename" ".${extension}") + break + fi + done + if [ -z ${image_name} ]; then + echo "Unknown image extension in $image_filename, supported extensions: tgz, img, qcow2, iso, vhd, vhdx, tar.gz, img.gz, img.bz2, vhd.gz, vhdx.gz, qcow2.xz"; false + fi + + openstack image set $image_name $magnum_image_property +} + +#magnum_configure_flavor - set hw_rng property for flavor to address the potential entropy issue +function magnum_configure_flavor { + local magnum_flavor_property="--property hw_rng:allowed=True --property hw_rng:rate_bytes=1024 --property hw_rng:rate_period=1" + + local FLAVOR_LIST=$(openstack flavor list -c Name -f value) + for flavor in ${FLAVOR_LIST}; do + openstack flavor set $flavor $magnum_flavor_property + done +} + +# install_magnumclient() - Collect source and prepare +function install_magnumclient { + pip_install "python-magnumclient" +} + +# install_magnum() - Collect source and prepare +function install_magnum { + echo noop +} + +# configure_iptables_magnum() - Configure the IP table rules for Magnum +function configure_iptables_magnum { + if [ "$MAGNUM_CONFIGURE_IPTABLES" != "False" ]; then + ROUTE_TO_INTERNET=$(ip route get 8.8.8.8) + OBOUND_DEV=$(echo ${ROUTE_TO_INTERNET#*dev} | awk '{print $1}') + sudo iptables -t nat -A POSTROUTING -o $OBOUND_DEV -j MASQUERADE + # bay nodes will access magnum-api (port $MAGNUM_SERVICE_PORT) to get CA certificate. + sudo iptables -I INPUT -d $HOST_IP -p tcp --dport $MAGNUM_SERVICE_PORT -j ACCEPT || true + # allow access to keystone etc (http and https) + sudo iptables -I INPUT -d $HOST_IP -p tcp --dport 80 -j ACCEPT || true + sudo iptables -I INPUT -d $HOST_IP -p tcp --dport 443 -j ACCEPT || true + fi +} + + +function configure_apache_magnum { + # Set redirection for kubernetes openstack cloud provider + # FIXME: When [1] is in kubernetes, we won't need the redirection anymore. + # [1] https://github.com/gophercloud/gophercloud/pull/423 + HTACCESS_PATH=/var/www/html + if is_ubuntu; then + OVERRIDE_CONF_FILE=/etc/apache2/apache2.conf + elif is_fedora; then + OVERRIDE_CONF_FILE=/etc/httpd/conf/httpd.conf + fi + # If horizon is enabled then we need + if is_service_enabled horizon; then + HTACCESS_PATH=$DEST/horizon/.blackhole + sudo tee -a $APACHE_CONF_DIR/horizon.conf < +Options Indexes FollowSymLinks +AllowOverride all +Require all granted + +EOF + else + sudo tee -a $OVERRIDE_CONF_FILE < + Options Indexes FollowSymLinks + AllowOverride all + Require all granted + +EOF + fi + + sudo mkdir -p $HTACCESS_PATH + sudo tee $HTACCESS_PATH/.htaccess <