puppet/manifests/overcloud_controller_pacemaker.pp

   1 # Copyright 2015 Red Hat, Inc.
   2 # All Rights Reserved.
   3 #
   4 # Licensed under the Apache License, Version 2.0 (the "License"); you may
   5 # not use this file except in compliance with the License. You may obtain
   6 # a copy of the License at
   7 #
   8 #     http://www.apache.org/licenses/LICENSE-2.0
   9 #
  10 # Unless required by applicable law or agreed to in writing, software
  11 # distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
  12 # WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
  13 # License for the specific language governing permissions and limitations
  14 # under the License.
  15
  16 # TODO(jistr): use pcs resource provider instead of just no-ops
  17 Service <|
  18   tag == 'aodh-service' or
  19   tag == 'gnocchi-service'
  20 |> {
  21   hasrestart => true,
  22   restart    => '/bin/true',
  23   start      => '/bin/true',
  24   stop       => '/bin/true',
  25 }
  26
  27 include ::tripleo::packages
  28 include ::tripleo::firewall
  29
  30 if $::hostname == downcase(hiera('bootstrap_nodeid')) {
  31   $pacemaker_master = true
  32   $sync_db = true
  33 } else {
  34   $pacemaker_master = false
  35   $sync_db = false
  36 }
  37
  38 if hiera('step') >= 1 {
  39   # Galera
  40   if str2bool(hiera('enable_galera', true)) {
  41     $mysql_config_file = '/etc/my.cnf.d/galera.cnf'
  42   } else {
  43     $mysql_config_file = '/etc/my.cnf.d/server.cnf'
  44   }
  45   $galera_nodes = downcase(hiera('galera_node_names', $::hostname))
  46   $galera_nodes_count = count(split($galera_nodes, ','))
  47
  48   # FIXME: due to https://bugzilla.redhat.com/show_bug.cgi?id=1298671 we
  49   # set bind-address to a hostname instead of an ip address; to move Mysql
  50   # from internal_api on another network we'll have to customize both
  51   # MysqlNetwork and ControllerHostnameResolveNetwork in ServiceNetMap
  52   $mysql_bind_host = hiera('mysql_bind_host')
  53   $mysqld_options = {
  54     'mysqld' => {
  55       'skip-name-resolve'             => '1',
  56       'binlog_format'                 => 'ROW',
  57       'default-storage-engine'        => 'innodb',
  58       'innodb_autoinc_lock_mode'      => '2',
  59       'innodb_locks_unsafe_for_binlog'=> '1',
  60       'query_cache_size'              => '0',
  61       'query_cache_type'              => '0',
  62       'bind-address'                  => $::hostname,
  63       'max_connections'               => hiera('mysql_max_connections'),
  64       'open_files_limit'              => '-1',
  65       'wsrep_on'                      => 'ON',
  66       'wsrep_provider'                => '/usr/lib64/galera/libgalera_smm.so',
  67       'wsrep_cluster_name'            => 'galera_cluster',
  68       'wsrep_cluster_address'         => "gcomm://${galera_nodes}",
  69       'wsrep_slave_threads'           => '1',
  70       'wsrep_certify_nonPK'           => '1',
  71       'wsrep_max_ws_rows'             => '131072',
  72       'wsrep_max_ws_size'             => '1073741824',
  73       'wsrep_debug'                   => '0',
  74       'wsrep_convert_LOCK_to_trx'     => '0',
  75       'wsrep_retry_autocommit'        => '1',
  76       'wsrep_auto_increment_control'  => '1',
  77       'wsrep_drupal_282555_workaround'=> '0',
  78       'wsrep_causal_reads'            => '0',
  79       'wsrep_sst_method'              => 'rsync',
  80       'wsrep_provider_options'        => "gmcast.listen_addr=tcp://[${mysql_bind_host}]:4567;",
  81     },
  82   }
  83
  84   class { '::mysql::server':
  85     create_root_user        => false,
  86     create_root_my_cnf      => false,
  87     config_file             => $mysql_config_file,
  88     override_options        => $mysqld_options,
  89     remove_default_accounts => $pacemaker_master,
  90     service_manage          => false,
  91     service_enabled         => false,
  92   }
  93
  94 }
  95
  96 if hiera('step') >= 2 {
  97
  98
  99   # NOTE(gfidente): the following vars are needed on all nodes so they
 100   # need to stay out of pacemaker_master conditional.
 101   # The addresses mangling will hopefully go away when we'll be able to
 102   # configure the connection string via hostnames, until then, we need to pass
 103   # the list of IPv6 addresses *with* port and without the brackets as 'members'
 104   # argument for the 'mongodb_replset' resource.
 105   if str2bool(hiera('mongodb::server::ipv6', false)) {
 106     $mongo_node_ips_with_port_prefixed = prefix(hiera('mongo_node_ips'), '[')
 107     $mongo_node_ips_with_port = suffix($mongo_node_ips_with_port_prefixed, ']:27017')
 108     $mongo_node_ips_with_port_nobr = suffix(hiera('mongo_node_ips'), ':27017')
 109   } else {
 110     $mongo_node_ips_with_port = suffix(hiera('mongo_node_ips'), ':27017')
 111     $mongo_node_ips_with_port_nobr = suffix(hiera('mongo_node_ips'), ':27017')
 112   }
 113   $mongodb_replset = hiera('mongodb::server::replset')
 114
 115   if $pacemaker_master {
 116     pacemaker::resource::ocf { 'galera' :
 117       ocf_agent_name  => 'heartbeat:galera',
 118       op_params       => 'promote timeout=300s on-fail=block',
 119       master_params   => '',
 120       meta_params     => "master-max=${galera_nodes_count} ordered=true",
 121       resource_params => "additional_parameters='--open-files-limit=16384' enable_creation=true wsrep_cluster_address='gcomm://${galera_nodes}'",
 122       require         => Class['::mysql::server'],
 123       before          => Exec['galera-ready'],
 124     }
 125
 126     exec { 'galera-ready' :
 127       command     => '/usr/bin/clustercheck >/dev/null',
 128       timeout     => 30,
 129       tries       => 180,
 130       try_sleep   => 10,
 131       environment => ['AVAILABLE_WHEN_READONLY=0'],
 132       require     => Exec['create-root-sysconfig-clustercheck'],
 133     }
 134
 135     # We add a clustercheck db user and we will switch /etc/sysconfig/clustercheck
 136     # to it in a later step. We do this only on one node as it will replicate on
 137     # the other members. We also make sure that the permissions are the minimum necessary
 138     mysql_user { 'clustercheck@localhost':
 139       ensure        => 'present',
 140       password_hash => mysql_password(hiera('mysql_clustercheck_password')),
 141       require       => Exec['galera-ready'],
 142     }
 143
 144     mysql_grant { 'clustercheck@localhost/*.*':
 145       ensure     => 'present',
 146       options    => ['GRANT'],
 147       privileges => ['PROCESS'],
 148       table      => '*.*',
 149       user       => 'clustercheck@localhost',
 150     }
 151
 152     class { '::aodh::db::mysql':
 153         require => Exec['galera-ready'],
 154     }
 155   }
 156   # This step is to create a sysconfig clustercheck file with the root user and empty password
 157   # on the first install only (because later on the clustercheck db user will be used)
 158   # We are using exec and not file in order to not have duplicate definition errors in puppet
 159   # when we later set the the file to contain the clustercheck data
 160   exec { 'create-root-sysconfig-clustercheck':
 161     command => "/bin/echo 'MYSQL_USERNAME=root\nMYSQL_PASSWORD=\'\'\nMYSQL_HOST=localhost\n' > /etc/sysconfig/clustercheck",
 162     unless  => '/bin/test -e /etc/sysconfig/clustercheck && grep -q clustercheck /etc/sysconfig/clustercheck',
 163   }
 164
 165   xinetd::service { 'galera-monitor' :
 166     port           => '9200',
 167     server         => '/usr/bin/clustercheck',
 168     per_source     => 'UNLIMITED',
 169     log_on_success => '',
 170     log_on_failure => 'HOST',
 171     flags          => 'REUSE',
 172     service_type   => 'UNLISTED',
 173     user           => 'root',
 174     group          => 'root',
 175     require        => Exec['create-root-sysconfig-clustercheck'],
 176   }
 177
 178 } #END STEP 2
 179
 180 if hiera('step') >= 4 or ( hiera('step') >= 3 and $sync_db ) {
 181   # At this stage we are guaranteed that the clustercheck db user exists
 182   # so we switch the resource agent to use it.
 183   $mysql_clustercheck_password = hiera('mysql_clustercheck_password')
 184   file { '/etc/sysconfig/clustercheck' :
 185     ensure  => file,
 186     mode    => '0600',
 187     owner   => 'root',
 188     group   => 'root',
 189     content => "MYSQL_USERNAME=clustercheck\n
 190 MYSQL_PASSWORD='${mysql_clustercheck_password}'\n
 191 MYSQL_HOST=localhost\n",
 192   }
 193
 194   $nova_ipv6 = hiera('nova::use_ipv6', false)
 195   if $nova_ipv6 {
 196     $memcached_servers = suffix(hiera('memcache_node_ips_v6'), ':11211')
 197   } else {
 198     $memcached_servers = suffix(hiera('memcache_node_ips'), ':11211')
 199   }
 200
 201   class { '::nova' :
 202     memcached_servers => $memcached_servers
 203   }
 204
 205   include ::nova::config
 206
 207   # Aodh
 208   class { '::aodh' :
 209     database_connection => hiera('aodh_mysql_conn_string'),
 210   }
 211   include ::aodh::config
 212   include ::aodh::auth
 213   include ::aodh::client
 214   include ::aodh::wsgi::apache
 215   class { '::aodh::api':
 216     manage_service => false,
 217     enabled        => false,
 218     service_name   => 'httpd',
 219   }
 220   class { '::aodh::evaluator':
 221     manage_service => false,
 222     enabled        => false,
 223   }
 224   class { '::aodh::notifier':
 225     manage_service => false,
 226     enabled        => false,
 227   }
 228   class { '::aodh::listener':
 229     manage_service => false,
 230     enabled        => false,
 231   }
 232
 233   hiera_include('controller_classes')
 234
 235 } #END STEP 4
 236
 237 if hiera('step') >= 5 {
 238   # We now make sure that the root db password is set to a random one
 239   # At first installation /root/.my.cnf will be empty and we connect without a root
 240   # password. On second runs or updates /root/.my.cnf will already be populated
 241   # with proper credentials. This step happens on every node because this sql
 242   # statement does not automatically replicate across nodes.
 243   $mysql_root_password = hiera('mysql::server::root_password')
 244   exec { 'galera-set-root-password':
 245     command => "/bin/touch /root/.my.cnf && /bin/echo \"UPDATE mysql.user SET Password = PASSWORD('${mysql_root_password}') WHERE user = 'root'; flush privileges;\" | /bin/mysql --defaults-extra-file=/root/.my.cnf -u root",
 246   }
 247   file { '/root/.my.cnf' :
 248     ensure  => file,
 249     mode    => '0600',
 250     owner   => 'root',
 251     group   => 'root',
 252     content => "[client]
 253 user=root
 254 password=\"${mysql_root_password}\"
 255
 256 [mysql]
 257 user=root
 258 password=\"${mysql_root_password}\"",
 259     require => Exec['galera-set-root-password'],
 260   }
 261
 262   $nova_enable_db_purge = hiera('nova_enable_db_purge', true)
 263
 264   if $nova_enable_db_purge {
 265     include ::nova::cron::archive_deleted_rows
 266   }
 267
 268   if $pacemaker_master {
 269
 270     pacemaker::constraint::base { 'openstack-core-then-httpd-constraint':
 271       constraint_type => 'order',
 272       first_resource  => 'openstack-core-clone',
 273       second_resource => "${::apache::params::service_name}-clone",
 274       first_action    => 'start',
 275       second_action   => 'start',
 276       require         => [Pacemaker::Resource::Service[$::apache::params::service_name],
 277                           Pacemaker::Resource::Ocf['openstack-core']],
 278     }
 279     pacemaker::constraint::base { 'galera-then-openstack-core-constraint':
 280       constraint_type => 'order',
 281       first_resource  => 'galera-master',
 282       second_resource => 'openstack-core-clone',
 283       first_action    => 'promote',
 284       second_action   => 'start',
 285       require         => [Pacemaker::Resource::Ocf['galera'],
 286                           Pacemaker::Resource::Ocf['openstack-core']],
 287     }
 288
 289     # Nova
 290     pacemaker::constraint::base { 'keystone-then-nova-consoleauth-constraint':
 291       constraint_type => 'order',
 292       first_resource  => 'openstack-core-clone',
 293       second_resource => "${::nova::params::consoleauth_service_name}-clone",
 294       first_action    => 'start',
 295       second_action   => 'start',
 296       require         => [Pacemaker::Resource::Service[$::nova::params::consoleauth_service_name],
 297                           Pacemaker::Resource::Ocf['openstack-core']],
 298     }
 299     pacemaker::constraint::colocation { 'nova-consoleauth-with-openstack-core':
 300       source  => "${::nova::params::consoleauth_service_name}-clone",
 301       target  => 'openstack-core-clone',
 302       score   => 'INFINITY',
 303       require => [Pacemaker::Resource::Service[$::nova::params::consoleauth_service_name],
 304                   Pacemaker::Resource::Ocf['openstack-core']],
 305     }
 306     pacemaker::constraint::base { 'nova-consoleauth-then-nova-vncproxy-constraint':
 307       constraint_type => 'order',
 308       first_resource  => "${::nova::params::consoleauth_service_name}-clone",
 309       second_resource => "${::nova::params::vncproxy_service_name}-clone",
 310       first_action    => 'start',
 311       second_action   => 'start',
 312       require         => [Pacemaker::Resource::Service[$::nova::params::consoleauth_service_name],
 313                           Pacemaker::Resource::Service[$::nova::params::vncproxy_service_name]],
 314     }
 315     pacemaker::constraint::colocation { 'nova-vncproxy-with-nova-consoleauth-colocation':
 316       source  => "${::nova::params::vncproxy_service_name}-clone",
 317       target  => "${::nova::params::consoleauth_service_name}-clone",
 318       score   => 'INFINITY',
 319       require => [Pacemaker::Resource::Service[$::nova::params::consoleauth_service_name],
 320                   Pacemaker::Resource::Service[$::nova::params::vncproxy_service_name]],
 321     }
 322     pacemaker::constraint::base { 'nova-vncproxy-then-nova-api-constraint':
 323       constraint_type => 'order',
 324       first_resource  => "${::nova::params::vncproxy_service_name}-clone",
 325       second_resource => "${::nova::params::api_service_name}-clone",
 326       first_action    => 'start',
 327       second_action   => 'start',
 328       require         => [Pacemaker::Resource::Service[$::nova::params::vncproxy_service_name],
 329                           Pacemaker::Resource::Service[$::nova::params::api_service_name]],
 330     }
 331     pacemaker::constraint::colocation { 'nova-api-with-nova-vncproxy-colocation':
 332       source  => "${::nova::params::api_service_name}-clone",
 333       target  => "${::nova::params::vncproxy_service_name}-clone",
 334       score   => 'INFINITY',
 335       require => [Pacemaker::Resource::Service[$::nova::params::vncproxy_service_name],
 336                   Pacemaker::Resource::Service[$::nova::params::api_service_name]],
 337     }
 338     pacemaker::constraint::base { 'nova-api-then-nova-scheduler-constraint':
 339       constraint_type => 'order',
 340       first_resource  => "${::nova::params::api_service_name}-clone",
 341       second_resource => "${::nova::params::scheduler_service_name}-clone",
 342       first_action    => 'start',
 343       second_action   => 'start',
 344       require         => [Pacemaker::Resource::Service[$::nova::params::api_service_name],
 345                           Pacemaker::Resource::Service[$::nova::params::scheduler_service_name]],
 346     }
 347     pacemaker::constraint::colocation { 'nova-scheduler-with-nova-api-colocation':
 348       source  => "${::nova::params::scheduler_service_name}-clone",
 349       target  => "${::nova::params::api_service_name}-clone",
 350       score   => 'INFINITY',
 351       require => [Pacemaker::Resource::Service[$::nova::params::api_service_name],
 352                   Pacemaker::Resource::Service[$::nova::params::scheduler_service_name]],
 353     }
 354     pacemaker::constraint::base { 'nova-scheduler-then-nova-conductor-constraint':
 355       constraint_type => 'order',
 356       first_resource  => "${::nova::params::scheduler_service_name}-clone",
 357       second_resource => "${::nova::params::conductor_service_name}-clone",
 358       first_action    => 'start',
 359       second_action   => 'start',
 360       require         => [Pacemaker::Resource::Service[$::nova::params::scheduler_service_name],
 361                           Pacemaker::Resource::Service[$::nova::params::conductor_service_name]],
 362     }
 363     pacemaker::constraint::colocation { 'nova-conductor-with-nova-scheduler-colocation':
 364       source  => "${::nova::params::conductor_service_name}-clone",
 365       target  => "${::nova::params::scheduler_service_name}-clone",
 366       score   => 'INFINITY',
 367       require => [Pacemaker::Resource::Service[$::nova::params::scheduler_service_name],
 368                   Pacemaker::Resource::Service[$::nova::params::conductor_service_name]],
 369     }
 370
 371     # Fedora doesn't know `require-all` parameter for constraints yet
 372     if $::operatingsystem == 'Fedora' {
 373       $redis_aodh_constraint_params = undef
 374     } else {
 375       $redis_aodh_constraint_params = 'require-all=false'
 376     }
 377     pacemaker::constraint::base { 'redis-then-aodh-evaluator-constraint':
 378       constraint_type   => 'order',
 379       first_resource    => 'redis-master',
 380       second_resource   => "${::aodh::params::evaluator_service_name}-clone",
 381       first_action      => 'promote',
 382       second_action     => 'start',
 383       constraint_params => $redis_aodh_constraint_params,
 384       require           => [Pacemaker::Resource::Ocf['redis'],
 385                             Pacemaker::Resource::Service[$::aodh::params::evaluator_service_name]],
 386     }
 387     # Aodh
 388     pacemaker::resource::service { $::aodh::params::evaluator_service_name :
 389       clone_params => 'interleave=true',
 390     }
 391     pacemaker::resource::service { $::aodh::params::notifier_service_name :
 392       clone_params => 'interleave=true',
 393     }
 394     pacemaker::resource::service { $::aodh::params::listener_service_name :
 395       clone_params => 'interleave=true',
 396     }
 397     pacemaker::constraint::base { 'aodh-evaluator-then-aodh-notifier-constraint':
 398       constraint_type => 'order',
 399       first_resource  => "${::aodh::params::evaluator_service_name}-clone",
 400       second_resource => "${::aodh::params::notifier_service_name}-clone",
 401       first_action    => 'start',
 402       second_action   => 'start',
 403       require         => [Pacemaker::Resource::Service[$::aodh::params::evaluator_service_name],
 404                           Pacemaker::Resource::Service[$::aodh::params::notifier_service_name]],
 405     }
 406     pacemaker::constraint::colocation { 'aodh-notifier-with-aodh-evaluator-colocation':
 407       source  => "${::aodh::params::notifier_service_name}-clone",
 408       target  => "${::aodh::params::evaluator_service_name}-clone",
 409       score   => 'INFINITY',
 410       require => [Pacemaker::Resource::Service[$::aodh::params::evaluator_service_name],
 411                   Pacemaker::Resource::Service[$::aodh::params::notifier_service_name]],
 412     }
 413     pacemaker::constraint::base { 'aodh-evaluator-then-aodh-listener-constraint':
 414       constraint_type => 'order',
 415       first_resource  => "${::aodh::params::evaluator_service_name}-clone",
 416       second_resource => "${::aodh::params::listener_service_name}-clone",
 417       first_action    => 'start',
 418       second_action   => 'start',
 419       require         => [Pacemaker::Resource::Service[$::aodh::params::evaluator_service_name],
 420                           Pacemaker::Resource::Service[$::aodh::params::listener_service_name]],
 421     }
 422     pacemaker::constraint::colocation { 'aodh-listener-with-aodh-evaluator-colocation':
 423       source  => "${::aodh::params::listener_service_name}-clone",
 424       target  => "${::aodh::params::evaluator_service_name}-clone",
 425       score   => 'INFINITY',
 426       require => [Pacemaker::Resource::Service[$::aodh::params::evaluator_service_name],
 427                   Pacemaker::Resource::Service[$::aodh::params::listener_service_name]],
 428     }
 429
 430     # Horizon and Keystone
 431     pacemaker::resource::service { $::apache::params::service_name:
 432       clone_params     => 'interleave=true',
 433       verify_on_create => true,
 434       require          => [File['/etc/keystone/ssl/certs/ca.pem'],
 435       File['/etc/keystone/ssl/private/signing_key.pem'],
 436       File['/etc/keystone/ssl/certs/signing_cert.pem']],
 437     }
 438
 439     #VSM
 440     if 'cisco_n1kv' in hiera('neutron::plugins::ml2::mechanism_drivers') {
 441       pacemaker::resource::ocf { 'vsm-p' :
 442         ocf_agent_name  => 'heartbeat:VirtualDomain',
 443         resource_params => 'force_stop=true config=/var/spool/cisco/vsm/vsm_primary_deploy.xml',
 444         require         => Class['n1k_vsm'],
 445         meta_params     => 'resource-stickiness=INFINITY',
 446       }
 447       if str2bool(hiera('n1k_vsm::pacemaker_control', true)) {
 448         pacemaker::resource::ocf { 'vsm-s' :
 449           ocf_agent_name  => 'heartbeat:VirtualDomain',
 450           resource_params => 'force_stop=true config=/var/spool/cisco/vsm/vsm_secondary_deploy.xml',
 451           require         => Class['n1k_vsm'],
 452           meta_params     => 'resource-stickiness=INFINITY',
 453         }
 454         pacemaker::constraint::colocation { 'vsm-colocation-contraint':
 455           source  => 'vsm-p',
 456           target  => 'vsm-s',
 457           score   => '-INFINITY',
 458           require => [Pacemaker::Resource::Ocf['vsm-p'],
 459                       Pacemaker::Resource::Ocf['vsm-s']],
 460         }
 461       }
 462     }
 463
 464   }
 465
 466 } #END STEP 5
 467
 468 $package_manifest_name = join(['/var/lib/tripleo/installed-packages/overcloud_controller_pacemaker', hiera('step')])
 469 package_manifest{$package_manifest_name: ensure => present}