docker/services/pacemaker/database/mysql.yaml

   1 heat_template_version: pike
   2
   3 description: >
   4   MySQL service deployment with pacemaker bundle
   5
   6 parameters:
   7   DockerMysqlImage:
   8     description: image
   9     type: string
  10   DockerMysqlConfigImage:
  11     description: The container image to use for the mysql config_volume
  12     type: string
  13   EndpointMap:
  14     default: {}
  15     description: Mapping of service endpoint -> protocol. Typically set
  16                  via parameter_defaults in the resource registry.
  17     type: json
  18   ServiceData:
  19     default: {}
  20     description: Dictionary packing service data
  21     type: json
  22   ServiceNetMap:
  23     default: {}
  24     description: Mapping of service_name -> network name. Typically set
  25                  via parameter_defaults in the resource registry.  This
  26                  mapping overrides those in ServiceNetMapDefaults.
  27     type: json
  28   DefaultPasswords:
  29     default: {}
  30     type: json
  31   MysqlRootPassword:
  32     type: string
  33     hidden: true
  34     default: ''
  35   MysqlClustercheckPassword:
  36     type: string
  37     hidden: true
  38   RoleName:
  39     default: ''
  40     description: Role name on which the service is applied
  41     type: string
  42   RoleParameters:
  43     default: {}
  44     description: Parameters specific to the role
  45     type: json
  46   EnableInternalTLS:
  47     type: boolean
  48     default: false
  49   InternalTLSCAFile:
  50     default: '/etc/ipa/ca.crt'
  51     type: string
  52     description: Specifies the default CA cert to use if TLS is used for
  53                  services in the internal network.
  54
  55 resources:
  56
  57   ContainersCommon:
  58     type: ../../containers-common.yaml
  59
  60   MysqlPuppetBase:
  61     type: ../../../../puppet/services/pacemaker/database/mysql.yaml
  62     properties:
  63       EndpointMap: {get_param: EndpointMap}
  64       ServiceData: {get_param: ServiceData}
  65       ServiceNetMap: {get_param: ServiceNetMap}
  66       DefaultPasswords: {get_param: DefaultPasswords}
  67       RoleName: {get_param: RoleName}
  68       RoleParameters: {get_param: RoleParameters}
  69
  70 conditions:
  71
  72   internal_tls_enabled: {equals: [{get_param: EnableInternalTLS}, true]}
  73
  74 outputs:
  75   role_data:
  76     description: Containerized service MySQL using composable services.
  77     value:
  78       service_name: {get_attr: [MysqlPuppetBase, role_data, service_name]}
  79       config_settings:
  80         map_merge:
  81           - {get_attr: [MysqlPuppetBase, role_data, config_settings]}
  82           - tripleo::profile::pacemaker::database::mysql_bundle::mysql_docker_image: &mysql_image_pcmklatest
  83               list_join:
  84                 - ':'
  85                 - - yaql:
  86                       data: {get_param: DockerMysqlImage}
  87                       expression: $.data.rightSplit(separator => ":", maxSplits => 1)[0]
  88                   - 'pcmklatest'
  89             tripleo::profile::pacemaker::database::mysql_bundle::control_port: 3123
  90             tripleo.mysql.firewall_rules:
  91               '104 mysql galera-bundle':
  92                 dport:
  93                   - 873
  94                   - 3123
  95                   - 3306
  96                   - 4444
  97                   - 4567
  98                   - 4568
  99                   - 9200
 100           -
 101             if:
 102             - internal_tls_enabled
 103             -
 104               tripleo::profile::pacemaker::database::mysql_bundle::ca_file:
 105                 get_param: InternalTLSCAFile
 106             - {}
 107       step_config: ""
 108       # BEGIN DOCKER SETTINGS #
 109       puppet_config:
 110         config_volume: mysql
 111         puppet_tags: file # set this even though file is the default
 112         step_config:
 113           list_join:
 114             - "\n"
 115             - - "['Mysql_datadir', 'Mysql_user', 'Mysql_database', 'Mysql_grant', 'Mysql_plugin'].each |String $val| { noop_resource($val) }"
 116               - "exec {'wait-for-settle': command => '/bin/true' }"
 117               - "include ::tripleo::profile::pacemaker::database::mysql_bundle"
 118         config_image: {get_param: DockerMysqlConfigImage}
 119       kolla_config:
 120         /var/lib/kolla/config_files/mysql.json:
 121           command: /usr/sbin/pacemaker_remoted
 122           config_files:
 123             - dest: /etc/libqb/force-filesystem-sockets
 124               source: /dev/null
 125               owner: root
 126               perm: '0644'
 127             - source: "/var/lib/kolla/config_files/src/*"
 128               dest: "/"
 129               merge: true
 130               preserve_properties: true
 131             - source: "/var/lib/kolla/config_files/src-tls/*"
 132               dest: "/"
 133               merge: true
 134               optional: true
 135               preserve_properties: true
 136           permissions:
 137             - path: /etc/pki/tls/certs/mysql.crt
 138               owner: mysql:mysql
 139               perm: '0600'
 140               optional: true
 141             - path: /etc/pki/tls/private/mysql.key
 142               owner: mysql:mysql
 143               perm: '0600'
 144               optional: true
 145       docker_config:
 146         step_1:
 147           mysql_data_ownership:
 148             start_order: 0
 149             detach: false
 150             image: {get_param: DockerMysqlImage}
 151             net: host
 152             user: root
 153             # Kolla does only non-recursive chown
 154             command: ['chown', '-R', 'mysql:', '/var/lib/mysql']
 155             volumes:
 156               - /var/lib/mysql:/var/lib/mysql
 157           mysql_bootstrap:
 158             start_order: 1
 159             detach: false
 160             image: {get_param: DockerMysqlImage}
 161             net: host
 162             # Kolla bootstraps aren't idempotent, explicitly checking if bootstrap was done
 163             command:
 164               - 'bash'
 165               - '-ec'
 166               -
 167                 list_join:
 168                   - "\n"
 169                   - - 'if [ -e /var/lib/mysql/mysql ]; then exit 0; fi'
 170                     - 'kolla_start'
 171                     - 'mysqld_safe --skip-networking --wsrep-on=OFF &'
 172                     - 'timeout ${DB_MAX_TIMEOUT} /bin/bash -c ''until mysqladmin -uroot -p"${DB_ROOT_PASSWORD}" ping 2>/dev/null; do sleep 1; done'''
 173                     - 'mysql -uroot -p"${DB_ROOT_PASSWORD}" -e "CREATE USER ''clustercheck''@''localhost'' IDENTIFIED BY ''${DB_CLUSTERCHECK_PASSWORD}'';"'
 174                     - 'mysql -uroot -p"${DB_ROOT_PASSWORD}" -e "GRANT PROCESS ON *.* TO ''clustercheck''@''localhost'' WITH GRANT OPTION;"'
 175                     - 'timeout ${DB_MAX_TIMEOUT} mysqladmin -uroot -p"${DB_ROOT_PASSWORD}" shutdown'
 176             volumes: &mysql_volumes
 177               list_concat:
 178                 - {get_attr: [ContainersCommon, volumes]}
 179                 -
 180                   - /var/lib/kolla/config_files/mysql.json:/var/lib/kolla/config_files/config.json
 181                   - /var/lib/config-data/puppet-generated/mysql/:/var/lib/kolla/config_files/src:ro
 182                   - /var/lib/mysql:/var/lib/mysql
 183             environment:
 184               - KOLLA_CONFIG_STRATEGY=COPY_ALWAYS
 185               - KOLLA_BOOTSTRAP=True
 186               # NOTE(mandre) skip wsrep cluster status check
 187               - KOLLA_KUBERNETES=True
 188               - DB_MAX_TIMEOUT=60
 189               -
 190                 list_join:
 191                   - '='
 192                   - - 'DB_CLUSTERCHECK_PASSWORD'
 193                     - {get_param: MysqlClustercheckPassword}
 194               -
 195                 list_join:
 196                   - '='
 197                   - - 'DB_ROOT_PASSWORD'
 198                     -
 199                       yaql:
 200                         expression: $.data.passwords.where($ != '').first()
 201                         data:
 202                           passwords:
 203                             - {get_param: MysqlRootPassword}
 204                             - {get_param: [DefaultPasswords, mysql_root_password]}
 205           mysql_image_tag:
 206             start_order: 2
 207             detach: false
 208             net: host
 209             user: root
 210             command:
 211               - '/bin/bash'
 212               - '-c'
 213               - str_replace:
 214                   template:
 215                     "/usr/bin/docker tag 'MYSQL_IMAGE' 'MYSQL_IMAGE_PCMKLATEST'"
 216                   params:
 217                     MYSQL_IMAGE: {get_param: DockerMysqlImage}
 218                     MYSQL_IMAGE_PCMKLATEST: *mysql_image_pcmklatest
 219             image: {get_param: DockerMysqlImage}
 220             volumes:
 221               - /etc/hosts:/etc/hosts:ro
 222               - /etc/localtime:/etc/localtime:ro
 223               - /dev/shm:/dev/shm:rw
 224               - /etc/sysconfig/docker:/etc/sysconfig/docker:ro
 225               - /usr/bin:/usr/bin:ro
 226               - /var/run/docker.sock:/var/run/docker.sock:rw
 227         step_2:
 228           mysql_init_bundle:
 229             start_order: 1
 230             detach: false
 231             net: host
 232             user: root
 233             command:
 234               - '/bin/bash'
 235               - '-c'
 236               - str_replace:
 237                   template:
 238                     list_join:
 239                       - '; '
 240                       - - "cp -a /tmp/puppet-etc/* /etc/puppet; echo '{\"step\": 2}' > /etc/puppet/hieradata/docker.json"
 241                         - "FACTER_uuid=docker puppet apply --tags file,file_line,concat,augeas,TAGS -v -e 'CONFIG'"
 242                   params:
 243                     TAGS: 'pacemaker::resource::bundle,pacemaker::property,pacemaker::resource::ocf,pacemaker::constraint::order,pacemaker::constraint::colocation,galera_ready,mysql_database,mysql_grant,mysql_user'
 244                     CONFIG: 'include ::tripleo::profile::base::pacemaker;include ::tripleo::profile::pacemaker::database::mysql_bundle'
 245             image: {get_param: DockerMysqlImage}
 246             volumes:
 247               - /etc/hosts:/etc/hosts:ro
 248               - /etc/localtime:/etc/localtime:ro
 249               - /etc/puppet:/tmp/puppet-etc:ro
 250               - /usr/share/openstack-puppet/modules:/usr/share/openstack-puppet/modules:ro
 251               - /etc/corosync/corosync.conf:/etc/corosync/corosync.conf:ro
 252               - /dev/shm:/dev/shm:rw
 253               - /var/lib/mysql:/var/lib/mysql:rw
 254       host_prep_tasks:
 255         - name: create /var/lib/mysql
 256           file:
 257             path: /var/lib/mysql
 258             state: directory
 259       metadata_settings:
 260         get_attr: [MysqlPuppetBase, role_data, metadata_settings]
 261       upgrade_tasks:
 262         - name: get bootstrap nodeid
 263           tags: common
 264           command: hiera -c /etc/puppet/hiera.yaml bootstrap_nodeid
 265           register: bootstrap_node
 266         - name: set is_bootstrap_node fact
 267           tags: common
 268           set_fact: is_bootstrap_node={{bootstrap_node.stdout|lower == ansible_hostname|lower}}
 269         - name: Disable the galera cluster resource
 270           tags: step2
 271           pacemaker_resource:
 272             resource: galera
 273             state: disable
 274             wait_for_resource: true
 275           when: is_bootstrap_node
 276         - name: Delete the stopped galera cluster resource.
 277           tags: step2
 278           pacemaker_resource:
 279             resource: galera
 280             state: delete
 281             wait_for_resource: true
 282           when: is_bootstrap_node
 283         - name: Disable mysql service
 284           tags: step2
 285           service: name=mariadb enabled=no
 286         - name: Remove clustercheck service from xinetd
 287           tags: step2
 288           file: state=absent path=/etc/xinetd.d/galera-monitor
 289         - name: Restart xinetd service after clustercheck removal
 290           tags: step2
 291           service: name=xinetd state=restarted