Glance-registry has been deprecated since Queens and were removed
from the upstream source in Train.
Change-Id: Ia993bfce039cd46ced3442c9064e4af8547fa54f
Some services were disabled in the install hook and then started during
the init phase without being enabled. Thus, after a machine restart they
were not brought back up by systemd.
Change-Id: I27f7d7fa6b8df104567b91b5bc998ebe98b478a2
* Add a connection-string based workflow to MicroStack;
* microstack add-compute command can be run at the Control node in
order to generate a connection string (an ASCII blob for the user);
* the connection string contains:
* an address of the control node;
* a sha256 fingerprint of the TLS certificate used by the clustering
service at the control node (which is used during verification
similar to the Certificate Pinning approach);
* an application credential id;
* an application credential secret (short expiration time, reader
role on the service project, restricted to listing the service
catalog);
* a MicroStack admin is expected to have ssh access to all nodes that
will participate in a cluster - prior trust establishment is on
them to figure out which is normal since they provision the nodes;
* a MicroStack admin is expected to securely copy a connection string
to a compute node via ssh. Since it is short-lived and does not
carry service secrets, there is no risk of a replay at a later time;
* If the compute role is specified during microstack.init, a
connection string is requested and used to perform a request to the
clustering service and validate the certificate fingerprint. The
credential ID and secret are POSTed for verification to the
clustering service which responds with the necessary config data
for the compute node upon successful authorization.
* Set up TLS termination for the clustering service;
* run the flask app as a UWSGI daemon behind nginx;
* configure nginx to use a TLS certificate;
* generate a self-signed TLS certificate.
This setup does not require PKI to be present for its own purposes of
joining compute nodes to the cluster. However, this does not mean that
PKI will not be used for TLS termination of the OpenStack endpoints.
Control node init workflow (non-interactive):
sudo microstack init --auto --control
microstack add-compute
<the connection string to be used at the compute node>
Compute node init workflow (non-interactive):
sudo microstack init --auto --compute --join <connection-string>
Change-Id: I9596fe1e6e5c1a325cc71fd3bf0c78b660b9a83e
* The prototype stage hard-coding of passwords is replaced by random
generation of passwords for:
* all API services;
* RabbitMQ;
* MySQL;
* OpenStack admin user;
* OpenStack service users;
* Passwords are not replaced upon successive microstack.init calls to
preserve idempotency.
Change-Id: Ic3d6108a81d09bdd09e986f80b3040b030605178
The previous work included incorrect handling of
configuration for the multi-node case in terms of
OVN configuration.
This change addresses that in addition to other
minor fixes related to the clustering setup.
Change-Id: Ibf04af95271d1746f59192d11831d6129ba5b8d0
Major changes:
* Plumbing necessary for strict confinement with
the microstack-support interface
https://github.com/snapcore/snapd/pull/8926
* Until the interface is merged, devmode will be used and kernel
modules will be loaded via an auxiliary service.
* upgraded OpenStack components to Focal (20.04) and OpenStack Ussuri;
* reworked the old patches;
* added the Placement service since it is now separate;
* addressed various build issues due to changes in snapcraft and
built dependencies:
* e.g. libvirt requires the build directory to be separate from the
source directory) and LP: #1882255;
* LP: #1882535 and https://github.com/pypa/pip/issues/8414
* LP: #1882839
* LP: #1885294
* https://storyboard.openstack.org/#!/story/2007806
* LP: #1864589
* LP: #1777121
* LP: #1881590
* ML2/OVS replated with ML2/OVN;
* dnsmasq is not used anymore;
* neutron l3 and DHCP agents are not used anymore;
* Linux network namespaces are only used for
neutron-ovn-metadata-agent.
* ML2 DNS support is done via native OVN mechanisms;
* OVN-related database services (southbound and northbound dbs);
* OVN-related control plane services (ovn-controller, ovn-northd);
* core20 base support (bionic hosts are supported);
* the removal procedure now relies on the "remove" hook since `snap
remove` cannot be used from the confined environment anymore;
* prerequisites to enabling AppArmor confinement for QEMU processes
created by the confined libvirtd.
* Added the Spice html5 console proxy service to enable clients to
retrieve and use it via
`microstack.openstack console url show --spice <servername>`.
* Added missing Cinder templates and DB migrations for the Cinder DB.
* Added experimental support for a loop device-based LVM backend for
Cinder. Due to LP: #1892895 this is not recommended to be used in
production except for tempest testing with an applied workaround;
* includes iscsid and iscsi-tcp kernel module loading;
* includes LIO and loading of relevant kernel modules;
* An LVM PV is created on top of a loop device with a backing file
present in $SNAP_COMMON/cinder-lvm.img;
* A VG is created on top of the PV;
* LVs are created by Cinder and exported via LIO over iscsi to iscsid
which hot-plugs new SCSI devices. Those SCSI devices are then
propagated by Nova to libvirt and QEMU during volume attachment;
* Added post-deployment testing via rally and tempest (via the
microstack-test snap). A set of tests included into Refstack 2018.02
is executed (except for object storage tests due to the lack of object
storage support).
Change-Id: Ic70770095860a57d5e0a55a8a9451f9db6be7448
Make MicroStack strictly confined, albeit in devmode for now.
Addresses unpredictable breakages with apt package upgrades in eoan
and focal, and sets the stage for a better isolated, less fragile snap
going forward.
We now use layouts to handle libvirt and qemu setting paths at compile
time. This is cleaner than the organize hack.
Moved away from calls to systemctl in init, as a strictly confined
snap cannot call systemctl on a non snappy system.
Disabled call to sysctl to set ipv4_fowarding, as we don't have access
to sysctl in a strictly confined snap. This may break some users, and
we need to figure out a way to address the breakage.
Got rid of questions.shell.shell routine, moving rabbitmq setup into a
bash script instead (it's just cleaner).
Moved keypair creation into launch script, as it's difficult to do
sensible things with keypair creation in the init script, which is
running using sudo, and therefore doesn't have access to
/home/<someuser>/snap
Added (but commented out) code that will check to verify that plugs
are connected before running microstack.init or ovs-vsctl. This code
may go away entirely, as we plan on auto connecting all of our
interfaces, and don't technically need to guard against not having
them connected.
Added temporary local upper-constraints file, to fix an issue where
upstream upper-constraints was breaking pip install by setting a
neutron version. This needs a better long term fix, but works for now.
Closes-bug: 1860660
Change-Id: Iaf1f1482609f05285ed9061317b32e90bffd2da0
This reverts commit ce5e82e319.
MicroStack cannot currently install due to a missing ovs-related
library. This is possibly due to recent changes in spacraft, or
possibly due to the workarounds for those changes. Regardless, it
appears that backing out the DPDK changes gets us back to a state
where we can install.
Partial-Bug: 1862911
Change-Id: I060c1a0095470639f9158cb9e9ebe8281a65a678
Addresses requests to make it easier to avoid conflicts between the
Horizon dashboard and http services that might already be running on
the machine.
Configurable via snap config. Exposing via arguments to .init and
testing post init configuration is left for a separate PR.
Eventually, these may move to non standard ports by default. This PR
sets the stage for that, but further discussion is needed before we
decide whether to implement.
(This commit also contains a sneaky fix for the username display at the
end of the launch script.)
Closes-Bug: 1814829
Change-Id: If728d6ec8024bca4d3e809637fbdcc03ed4e6934
Broke default config settings into a separate script, which the
install hook always called, and post-refresh calls if it can't find
the new config hierarchy.
This fixes issues w/ upgrading from beta to edge.
Change-Id: I6b11109c2a2f6aca142a18c9fa274b332891d5c8
Added a question which allows off host access to horizon
dashboard. Activated it by default, as that's probably what people are
going to actually want.
Change-Id: I0d5bccb3b2eb2b409072d8ae5f8b923942386119
This enables basic clustering functionality. We add:
tools/cluster/cluster/daemon.py: A server that handles validation of
cluster passwords.
tools/cluster/cluster/client.py: A client for this server.
Important Note: This prototype does not support TLS, and the
functionality in the client and server is basic. Before we roll
clustering out to production, we need to have those two chat over TLS,
and be much more careful about verifying credentials.
Also included ...
Various fixes and changes to the init script and config templates to
support cluster configuration, and allow for the fact that we may have
endpoint references for two network ips.
Updates to snapcraft.yaml, adding the new tooling.
A more formalized config infrastructure. It's still a TODO to move the
specification out of the implicit definition in the install hook, and
into a nice, explicit, well documented yaml file.
Added nesting to the Question classes in the init script, as well as
strings pointing at config keys, rather than having the config be
implicitly indicated by the Question subclass' name. (This allows us
to put together a config spec that doesn't require the person reading
the spec to understand what Questions are, and how they are
implemented.)
Renamed and unified the "unit" and "lint" tox environments, to allow
for the multiple Python tools that we want to lint and test.
Added hooks in the init script to make it possible to do automated
testing, and added an automated test for a cluster. Run with "tox -e
cluster".
Added cirros image to snap, to work around sporadic issues downloading
it from download.cirros.net.
Removed ping logic from snap, to workaround failures in gate. Need to
add it back in once we fix them.
Change-Id: I44ccd16168a7ed41486464df8c9e22a14d71ccfd
Moved security rules and keypair creation into init first.
Launch script now takes image name as positional argument, and name of
instance as a named argument. This makes it work more like launch in
other Canonical tools.
Written in Python, for ease of maintenance.
--retry and --wait args allow it to behave like tests expect it to,
while humans will get a much more intuitive (and much less noisy)
experience.
Also increased time we wait for a ping on the host, to allow for
slower, pure qemu, emulation times, and bring it in line with what
Tempest does in similar situations.
Change-Id: I11dcc098012468e9c88dcc7af78cde6920f31ecd
This lays the groundwork for interactive init, as well as being able
to specify control and compute nodes.
Added preliminary config lists for control and compute nodes. Added
appropriate default snapctl config settings in install script.
Also changed "binary" questions to "boolean" questions, as that's
better wording, and it means that my docstrings are not a confusing
mix of "boolean" and "binary" when I forget which term I used.
Snuck in a fix for the "basic" testing environment -- it was missing
the Python requirements, and was therefore failing!
Change-Id: I7f95ab68f924fa4d4280703c372b807cc7c77758
We want to allow operators to override Horizon's default
settings. This involves moving local_settings.d out of the read only
snap filesystem, and into $SNAP_COMMON. This is a little bit tricky.
First, we patch settings.py and local_settings.py as we're building the
snap, to include a LOCAL_PATH in $SNAP_COMMON.
Then, we add a template with the rest of our default overrides,
and write it out to $SNAP_COMMON/horizon/local_settings.d
Finally we tweak our tests so that we can give our overrides a
spin. As a bonus, this makes test_horizonglogin.py a lot easier to run
in our multipass testing scenario!
`tox -e basic` now also runs selenium tests, as well.
Change-Id: Ic0ce18cfa1b97a93191da749095d8aa2270d5aeb
Renamed the old and outdated "configure-openstack" script to "init.sh"
Updated init.sh and folded most of the configure hook into it.
Removed database installation step from install hook.
We can now install microstack without a database dump, which helps
immensely in updating. And we have a logical place to put additional
configuraiton, including some of the manual steps in DEMO.md, which
could be scripted if we gave users a chance to skip the system changes
that they wanted to skip.
Also updated README and DEMO file to match new flow. Updated test
files.
Future cleanup and features documented in Trello, but not included in
this PR, which is big enough already :-)
Change-Id: I8d926a8b463124494ddb7a4696adbe86f89db7d5
Moved openstack env variables out of snapcraft.yaml, and into a
"microtack.rc".
Made openstack-wrapper, which auto sources microstack.rc.
Key off of revised snap.openstack, which supports snapctl config
values in templates. Moved a lot of the overlay into
snap-overlay/templates, and added config values to them. Also writes
templates just once, when you run snap-openstack setup.
Change-Id: Ib0f2e3fc97f491d9ed9dfbafc61dc8e27a8a2b48
Refactor snap to work with core18.
Giving the snapcraft.yaml a base property helps tremendously with the
efficiency of the build process, and I believe that it puts us in a
better position to reliably support non Ubuntu distros going forward.
This also bases us on long supported bionic libraries, and gives us a
nice place to work from as we add Python 3 and Stein support, as well
as general polish and fixes.
Dropped a command to change the endpoints from localhost to 10.20.20.1
in the configure hook.
This is a temporary solution, pending automation of the database
update. (I was burning too much time getting a manual dump to work for
now.)
Addresses the issue where services such as a juju controller cannot
access endpoints from within an instance.
Updated all references to localhost to 10.20.20.1, and added the
address to ALLOWED_HOSTS.
Also updated version of qemu lib.
Fixes lp#1812415
Prior to this fix, instances spun up by microstack could not
successfully route to and from the Internet. Setting a rule for ipv4
forwarding and iptables rules for the nat fix the issue.
This fixes an issue where we weren't creating a netplan config and/or
and entry in /etc/network/interfaces for br-ex, and thus losing
external access to our virtual networks after reboot.
Since we don't actually want to touch the host system's networking
config, we just drop a oneshot daemon into place that sets br-ex up
each time the snap services are started.
* Fix some common errors when starting up.
Added more polls for services that we want to make sure are up and running.
Fixed issue where launch script wouldn't run when /snap/bin wasn't in the PATH.
* Added very basic resiliance to launch.sh script.
Tears down a machine and attempts to rebuild it if the build drops into an error state.
* Preseed mysql data dir with something useful
* Configure fernet keys on first install
* Update missing instances directory
* Updated mysql.tar.xz
* Folded configure command into configure hook.
Moved configure-the-things.sh code into configure hook.
Updated references to executables that can be found inside of the snap context.
Fixed up rabbitmq issues (possibly).
* Added install hooks for keystone.
* Fixed merge conflicts related to mysql reorg.
* Resolved more mysql merge conflicts.
* Resolved merge conflicts related to rabbitmq refactor.
* Added configure-the-things script to tests
* Turned off horizon for now.
* Disabled a bunch of daemons -- can reenable one by one as we verify them to be working.
* Added configure script, but exit 0 before configuring mysql -- there's something broken about the pathing.
* Fixed stray 'sudo' in configure hook, which was causing problems.
* Split uwsgi daemons into service specific directories
Enable all daemons again.
* Add .d configuration for nova, keystone and glance
* Misc updates
* Drop nova-consoleauth as its deprecated at rocky
* Rename neutron-manage -> neutron-db-manage
* Add neutron and nova hypervisor agents and configuration
* Add configuration files for new agents
* Update worker configuration
* Add libvirt support to nova parts
* Add fake sudo command to unconfuse things
Initial smooshing of existing snaps together. Contains all the basic openstack components that are snapped, plus libvirt/qemu parts borrowed from multipass.
Corey Bryant
Dmitrii Shcherbakov
Pete Vander Giessen
Gabor Meszaros
Pete Vander Giessen
James Page