Merge "docker/internal TLS: spawn extra container for neutron server's TLS proxy"
authorJenkins <jenkins@review.openstack.org>
Wed, 17 May 2017 17:39:30 +0000 (17:39 +0000)
committerGerrit Code Review <review@openstack.org>
Wed, 17 May 2017 17:39:30 +0000 (17:39 +0000)
13 files changed:
ci/environments/scenario001-multinode.yaml
docker/docker-puppet.py
docker/services/ceilometer-agent-central.yaml [new file with mode: 0644]
docker/services/ceilometer-agent-compute.yaml [new file with mode: 0644]
docker/services/ceilometer-agent-notification.yaml [new file with mode: 0644]
environments/docker.yaml
environments/services-docker/undercloud-ceilometer.yaml [new file with mode: 0644]
overcloud-resource-registry-puppet.j2.yaml
puppet/objectstorage-role.yaml
puppet/services/apache.yaml
puppet/services/ceilometer-base.yaml
puppet/services/kernel.yaml
roles_data_undercloud.yaml

index a5c85aa..437d7c3 100644 (file)
@@ -19,8 +19,8 @@ resource_registry:
   OS::TripleO::Tasks::ControllerPreConfig: ../../extraconfig/tasks/pre_puppet_pacemaker.yaml
   OS::TripleO::Tasks::ControllerPostConfig: ../../extraconfig/tasks/post_puppet_pacemaker.yaml
   OS::TripleO::Tasks::ControllerPostPuppetRestart: ../../extraconfig/tasks/post_puppet_pacemaker_restart.yaml
-  OS::TripleO::Services::FluentdClient: /usr/share/openstack-tripleo-heat-templates/puppet/services/logging/fluentd-client.yaml
-  OS::TripleO::Services::SensuClient: /usr/share/openstack-tripleo-heat-templates/puppet/services/monitoring/sensu-client.yaml
+  OS::TripleO::Services::FluentdClient: ../../puppet/services/logging/fluentd-client.yaml
+  OS::TripleO::Services::SensuClient: ../../puppet/services/monitoring/sensu-client.yaml
 
 parameter_defaults:
   ControllerServices:
index f1594d2..49dd00c 100755 (executable)
@@ -253,7 +253,9 @@ def mp_puppet_config((config_volume, puppet_tags, manifest, config_image, volume
             log.debug(cmd_stderr)
         if subproc.returncode != 0:
             log.error('Failed running docker-puppet.py for %s' % config_volume)
-        rm_container('docker-puppet-%s' % config_volume)
+        else:
+            # only delete successful runs, for debugging
+            rm_container('docker-puppet-%s' % config_volume)
         return subproc.returncode
 
 # Holds all the information for each process to consume.
diff --git a/docker/services/ceilometer-agent-central.yaml b/docker/services/ceilometer-agent-central.yaml
new file mode 100644 (file)
index 0000000..94caded
--- /dev/null
@@ -0,0 +1,113 @@
+heat_template_version: pike
+
+description: >
+  OpenStack containerized Ceilometer Agent Central service
+
+parameters:
+  DockerNamespace:
+    description: namespace
+    default: 'tripleoupstream'
+    type: string
+  DockerCeilometerCentralImage:
+    description: image
+    default: 'centos-binary-ceilometer-central:latest'
+    type: string
+  EndpointMap:
+    default: {}
+    description: Mapping of service endpoint -> protocol. Typically set
+                 via parameter_defaults in the resource registry.
+    type: json
+  ServiceNetMap:
+    default: {}
+    description: Mapping of service_name -> network name. Typically set
+                 via parameter_defaults in the resource registry.  This
+                 mapping overrides those in ServiceNetMapDefaults.
+    type: json
+  DefaultPasswords:
+    default: {}
+    type: json
+  RoleName:
+    default: ''
+    description: Role name on which the service is applied
+    type: string
+  RoleParameters:
+    default: {}
+    description: Parameters specific to the role
+    type: json
+
+resources:
+
+  ContainersCommon:
+   type: ./containers-common.yaml
+
+  CeilometerAgentCentralBase:
+    type: ../../puppet/services/ceilometer-agent-central.yaml
+    properties:
+      EndpointMap: {get_param: EndpointMap}
+      ServiceNetMap: {get_param: ServiceNetMap}
+      DefaultPasswords: {get_param: DefaultPasswords}
+      RoleName: {get_param: RoleName}
+      RoleParameters: {get_param: RoleParameters}
+
+outputs:
+  role_data:
+    description: Role data for the Ceilometer Agent Central role.
+    value:
+      service_name: {get_attr: [CeilometerAgentCentralBase, role_data, service_name]}
+      config_settings: {get_attr: [CeilometerAgentCentralBase, role_data, config_settings]}
+      step_config: &step_config
+        get_attr: [CeilometerAgentCentralBase, role_data, step_config]
+      service_config_settings: {get_attr: [CeilometerAgentCentralBase, role_data, service_config_settings]}
+      # BEGIN DOCKER SETTINGS
+      puppet_config:
+        config_volume: ceilometer
+        puppet_tags: ceilometer_config
+        step_config: *step_config
+        config_image: &ceilometer_agent_central_image
+          list_join:
+            - '/'
+            - [ {get_param: DockerNamespace}, {get_param: DockerCeilometerCentralImage} ]
+      kolla_config:
+        /var/lib/kolla/config_files/ceilometer-agent-central.json:
+          command: /usr/bin/ceilometer-polling --polling-namespaces central
+      docker_config:
+        step_3:
+          ceilometer_init_log:
+            start_order: 0
+            image: *ceilometer_agent_central_image
+            user: root
+            command: ['/bin/bash', '-c', 'chown -R ceilometer:ceilometer /var/log/ceilometer']
+            volumes:
+              - /var/log/containers/ceilometer:/var/log/ceilometer
+        step_4:
+          ceilometer_agent_central:
+            image: *ceilometer_agent_central_image
+            net: host
+            privileged: false
+            restart: always
+            volumes:
+              list_concat:
+                - {get_attr: [ContainersCommon, volumes]}
+                -
+                  - /var/lib/kolla/config_files/ceilometer-agent-central.json:/var/lib/kolla/config_files/config.json:ro
+                  - /var/lib/config-data/ceilometer/etc/ceilometer/:/etc/ceilometer/:ro
+            environment:
+              - KOLLA_CONFIG_STRATEGY=COPY_ALWAYS
+        step_5:
+          ceilometer_gnocchi_upgrade:
+            start_order: 1
+            image: *ceilometer_agent_central_image
+            net: host
+            detach: false
+            privileged: false
+            volumes:
+              list_concat:
+                - {get_attr: [ContainersCommon, volumes]}
+                -
+                  - /var/lib/config-data/ceilometer/etc/ceilometer/:/etc/ceilometer/:ro
+                  - /var/log/containers/ceilometer:/var/log/ceilometer
+            command: ["/usr/bin/ceilometer-upgrade", "--skip-metering-database"]
+      upgrade_tasks:
+        - name: Stop and disable ceilometer agent central service
+          tags: step2
+          service: name=openstack-ceilometer-agent-central state=stopped enabled=no
diff --git a/docker/services/ceilometer-agent-compute.yaml b/docker/services/ceilometer-agent-compute.yaml
new file mode 100644 (file)
index 0000000..9033cf4
--- /dev/null
@@ -0,0 +1,91 @@
+heat_template_version: pike
+
+description: >
+  OpenStack containerized Ceilometer Agent Compute service
+
+parameters:
+  DockerNamespace:
+    description: namespace
+    default: 'tripleoupstream'
+    type: string
+  DockerCeilometerComputeImage:
+    description: image
+    default: 'centos-binary-ceilometer-compute:latest'
+    type: string
+  EndpointMap:
+    default: {}
+    description: Mapping of service endpoint -> protocol. Typically set
+                 via parameter_defaults in the resource registry.
+    type: json
+  ServiceNetMap:
+    default: {}
+    description: Mapping of service_name -> network name. Typically set
+                 via parameter_defaults in the resource registry.  This
+                 mapping overrides those in ServiceNetMapDefaults.
+    type: json
+  DefaultPasswords:
+    default: {}
+    type: json
+  RoleName:
+    default: ''
+    description: Role name on which the service is applied
+    type: string
+  RoleParameters:
+    default: {}
+    description: Parameters specific to the role
+    type: json
+
+resources:
+
+  ContainersCommon:
+    type: ./containers-common.yaml
+
+  CeilometerAgentComputeBase:
+    type: ../../puppet/services/ceilometer-agent-compute.yaml
+    properties:
+      EndpointMap: {get_param: EndpointMap}
+      ServiceNetMap: {get_param: ServiceNetMap}
+      DefaultPasswords: {get_param: DefaultPasswords}
+      RoleName: {get_param: RoleName}
+      RoleParameters: {get_param: RoleParameters}
+
+outputs:
+  role_data:
+    description: Role data for the Ceilometer Agent Compute role.
+    value:
+      service_name: {get_attr: [CeilometerAgentComputeBase, role_data, service_name]}
+      config_settings: {get_attr: [CeilometerAgentComputeBase, role_data, config_settings]}
+      step_config: &step_config
+        get_attr: [CeilometerAgentComputeBase, role_data, step_config]
+      service_config_settings: {get_attr: [CeilometerAgentComputeBase, role_data, service_config_settings]}
+      # BEGIN DOCKER SETTINGS
+      puppet_config:
+        config_volume: ceilometer
+        puppet_tags: ceilometer_config
+        step_config: *step_config
+        config_image: &ceilometer_agent_compute_image
+          list_join:
+            - '/'
+            - [ {get_param: DockerNamespace}, {get_param: DockerCeilometerComputeImage} ]
+      kolla_config:
+        /var/lib/kolla/config_files/ceilometer-agent-compute.json:
+          command: /usr/bin/ceilometer-polling --polling-namespaces compute
+      docker_config:
+        step_4:
+          ceilometer_agent-compute:
+            image: *ceilometer_agent_compute_image
+            net: host
+            privileged: false
+            restart: always
+            volumes:
+              list_concat:
+                - {get_attr: [ContainersCommon, volumes]}
+                -
+                  - /var/lib/kolla/config_files/ceilometer-agent-compute.json:/var/lib/kolla/config_files/config.json:ro
+                  - /var/lib/config-data/ceilometer/etc/ceilometer/:/etc/ceilometer/:ro
+            environment:
+              - KOLLA_CONFIG_STRATEGY=COPY_ALWAYS
+      upgrade_tasks:
+        - name: Stop and disable ceilometer-agent-compute service
+          tags: step2
+          service: name=openstack-ceilometer-agent-compute state=stopped enabled=no
diff --git a/docker/services/ceilometer-agent-notification.yaml b/docker/services/ceilometer-agent-notification.yaml
new file mode 100644 (file)
index 0000000..79df330
--- /dev/null
@@ -0,0 +1,113 @@
+heat_template_version: pike
+
+description: >
+  OpenStack containerized Ceilometer Agent Notification service
+
+parameters:
+  DockerNamespace:
+    description: namespace
+    default: 'tripleoupstream'
+    type: string
+  DockerCeilometerNotificationImage:
+    description: image
+    default: 'centos-binary-ceilometer-notification:latest'
+    type: string
+  EndpointMap:
+    default: {}
+    description: Mapping of service endpoint -> protocol. Typically set
+                 via parameter_defaults in the resource registry.
+    type: json
+  ServiceNetMap:
+    default: {}
+    description: Mapping of service_name -> network name. Typically set
+                 via parameter_defaults in the resource registry.  This
+                 mapping overrides those in ServiceNetMapDefaults.
+    type: json
+  DefaultPasswords:
+    default: {}
+    type: json
+  RoleName:
+    default: ''
+    description: Role name on which the service is applied
+    type: string
+  RoleParameters:
+    default: {}
+    description: Parameters specific to the role
+    type: json
+
+resources:
+
+  ContainersCommon:
+    type: ./containers-common.yaml
+
+  CeilometerAgentNotificationBase:
+    type: ../../puppet/services/ceilometer-agent-notification.yaml
+    properties:
+      EndpointMap: {get_param: EndpointMap}
+      ServiceNetMap: {get_param: ServiceNetMap}
+      DefaultPasswords: {get_param: DefaultPasswords}
+      RoleName: {get_param: RoleName}
+      RoleParameters: {get_param: RoleParameters}
+
+outputs:
+  role_data:
+    description: Role data for the Ceilometer Agent Notification role.
+    value:
+      service_name: {get_attr: [CeilometerAgentNotificationBase, role_data, service_name]}
+      config_settings: {get_attr: [CeilometerAgentNotificationBase, role_data, config_settings]}
+      step_config: &step_config
+        get_attr: [CeilometerAgentNotificationBase, role_data, step_config]
+      service_config_settings: {get_attr: [CeilometerAgentNotificationBase, role_data, service_config_settings]}
+      # BEGIN DOCKER SETTINGS
+      puppet_config:
+        config_volume: ceilometer
+        puppet_tags: ceilometer_config
+        step_config: *step_config
+        config_image: &ceilometer_agent_notification_image
+          list_join:
+            - '/'
+            - [ {get_param: DockerNamespace}, {get_param: DockerCeilometerNotificationImage} ]
+      kolla_config:
+        /var/lib/kolla/config_files/ceilometer-agent-notification.json:
+          command: /usr/bin/ceilometer-agent-notification
+      docker_config:
+        step_3:
+          ceilometer_init_log:
+            start_order: 0
+            image: *ceilometer_agent_notification_image
+            user: root
+            command: ['/bin/bash', '-c', 'chown -R ceilometer:ceilometer /var/log/ceilometer']
+            volumes:
+              - /var/log/containers/ceilometer:/var/log/ceilometer
+        step_4:
+          ceilometer_agent-notification:
+            image: *ceilometer_agent_notification_image
+            net: host
+            privileged: false
+            restart: always
+            volumes:
+              list_concat:
+                - {get_attr: [ContainersCommon, volumes]}
+                -
+                  - /var/lib/kolla/config_files/ceilometer-agent-notification.json:/var/lib/kolla/config_files/config.json:ro
+                  - /var/lib/config-data/ceilometer/etc/ceilometer/:/etc/ceilometer/:ro
+            environment:
+              - KOLLA_CONFIG_STRATEGY=COPY_ALWAYS
+        step_5:
+          ceilometer_gnocchi_upgrade:
+            start_order: 1
+            image: *ceilometer_agent_notification_image
+            net: host
+            detach: false
+            privileged: false
+            volumes:
+              list_concat:
+                - {get_attr: [ContainersCommon, volumes]}
+                -
+                  - /var/lib/config-data/ceilometer/etc/ceilometer/:/etc/ceilometer/:ro
+                  - /var/log/containers/ceilometer:/var/log/ceilometer
+            command: ["/usr/bin/ceilometer-upgrade", "--skip-metering-database"]
+      upgrade_tasks:
+        - name: Stop and disable ceilometer agent notification service
+          tags: step2
+          service: name=openstack-ceilometer-notification state=stopped enabled=no
index 0c6028d..991e991 100644 (file)
@@ -41,6 +41,9 @@ resource_registry:
   OS::TripleO::Services::AodhNotifier: ../docker/services/aodh-notifier.yaml
   OS::TripleO::Services::AodhListener: ../docker/services/aodh-listener.yaml
   OS::TripleO::Services::PankoApi: ../docker/services/panko-api.yaml
+  OS::TripleO::Services::CeilometerAgentCentral: ../docker/services/ceilometer-agent-central.yaml
+  OS::TripleO::Services::CeilometerAgentCompute: ../docker/services/ceilometer-agent-compute.yaml
+  OS::TripleO::Services::CeilometerAgentNotification: ../docker/services/ceilometer-agent-notification.yaml
 
   OS::TripleO::PostDeploySteps: ../docker/post.yaml
   OS::TripleO::PostUpgradeSteps: ../docker/post-upgrade.yaml
@@ -58,3 +61,4 @@ parameter_defaults:
     - OS::TripleO::Services::NovaLibvirt
     - OS::TripleO::Services::ComputeNeutronOvsAgent
     - OS::TripleO::Services::Docker
+    - OS::TripleO::Services::CeilometerAgentCompute
diff --git a/environments/services-docker/undercloud-ceilometer.yaml b/environments/services-docker/undercloud-ceilometer.yaml
new file mode 100644 (file)
index 0000000..07a61c2
--- /dev/null
@@ -0,0 +1,3 @@
+resource_registry:
+  OS::TripleO::Services::UndercloudCeilometerAgentCentral: ../../docker/services/ceilometer-agent-central.yaml
+  OS::TripleO::Services::UndercloudCeilometerAgentNotification: ../../docker/services/ceilometer-agent-notification.yaml
index 74776e7..450e611 100644 (file)
@@ -195,6 +195,10 @@ resource_registry:
   OS::TripleO::Services::ComputeCeilometerAgent: puppet/services/ceilometer-agent-compute.yaml
   OS::TripleO::Services::CeilometerAgentIpmi: puppet/services/ceilometer-agent-ipmi.yaml
   OS::TripleO::Services::Horizon: puppet/services/horizon.yaml
+  # Undercloud Telemetry services
+  OS::TripleO::Services::UndercloudCeilometerAgentCentral: OS::Heat::None
+  OS::TripleO::Services::UndercloudCeilometerAgentNotification: OS::Heat::None
+
   #Gnocchi services
   OS::TripleO::Services::GnocchiApi: puppet/services/gnocchi-api.yaml
   OS::TripleO::Services::GnocchiMetricd: puppet/services/gnocchi-metricd.yaml
index 84b646a..fb60d2b 100644 (file)
@@ -127,7 +127,7 @@ parameters:
 resources:
 
   SwiftStorage:
-    type: OS::Nova::ObjectStorageServer
+    type: OS::TripleO::ObjectStorageServer
     metadata:
       os-collect-config:
         command: {get_param: ConfigCommand}
index ac37192..f302106 100644 (file)
@@ -84,21 +84,24 @@ outputs:
             apache::mod::prefork::serverlimit: { get_param: ApacheServerLimit }
             apache::mod::remoteip::proxy_ips:
               - "%{hiera('apache_remote_proxy_ips_network')}"
-          -
-            generate_service_certificates: true
-            tripleo::certmonger::apache_dirs::certificate_dir: '/etc/pki/tls/certs/httpd'
-            tripleo::certmonger::apache_dirs::key_dir: '/etc/pki/tls/private/httpd'
-            apache_certificates_specs:
-              map_merge:
-                repeat:
-                  template:
-                    httpd-NETWORK:
-                      service_certificate: '/etc/pki/tls/certs/httpd/httpd-NETWORK.crt'
-                      service_key: '/etc/pki/tls/private/httpd/httpd-NETWORK.key'
-                      hostname: "%{hiera('fqdn_NETWORK')}"
-                      principal: "HTTP/%{hiera('fqdn_NETWORK')}"
-                  for_each:
-                    NETWORK: {get_attr: [ApacheNetworks, value]}
+          - if:
+            - internal_tls_enabled
+            -
+              generate_service_certificates: true
+              tripleo::certmonger::apache_dirs::certificate_dir: '/etc/pki/tls/certs/httpd'
+              tripleo::certmonger::apache_dirs::key_dir: '/etc/pki/tls/private/httpd'
+              apache_certificates_specs:
+                map_merge:
+                  repeat:
+                    template:
+                      httpd-NETWORK:
+                        service_certificate: '/etc/pki/tls/certs/httpd/httpd-NETWORK.crt'
+                        service_key: '/etc/pki/tls/private/httpd/httpd-NETWORK.key'
+                        hostname: "%{hiera('fqdn_NETWORK')}"
+                        principal: "HTTP/%{hiera('fqdn_NETWORK')}"
+                    for_each:
+                      NETWORK: {get_attr: [ApacheNetworks, value]}
+            - {}
       metadata_settings:
         if:
           - internal_tls_enabled
index d2f08be..e60eb42 100644 (file)
@@ -38,9 +38,27 @@ parameters:
     default: 0
     description: Number of workers for Ceilometer service.
     type: number
+  ManageEventPipeline:
+    default: false
+    description: Whether to manage event_pipeline.yaml.
+    type: boolean
   EventPipelinePublishers:
-    default: ['notifier://?topic=alarm.all']
-    description: A list of publishers to put in event_pipeline.yaml.
+    default: ['gnocchi://']
+    description: >
+        A list of publishers to put in event_pipeline.yaml. When the
+        collector is used, override this with notifier:// publisher.
+        Set ManageEventPipeline to true for override to take effect.
+    type: comma_delimited_list
+  ManagePipeline:
+    default: false
+    description: Whether to manage pipeline.yaml.
+    type: boolean
+  PipelinePublishers:
+    default: ['gnocchi://']
+    description: >
+        A list of publishers to put in pipeline.yaml. When the
+        collector is used, override this with notifier:// publisher.
+        Set ManagePipeline to true for override to take effect.
     type: comma_delimited_list
   Debug:
     default: ''
@@ -97,7 +115,10 @@ outputs:
         ceilometer::keystone::authtoken::auth_url: { get_param: [EndpointMap, KeystoneInternal, uri_no_suffix] }
         ceilometer::agent::auth::auth_password: {get_param: CeilometerPassword}
         ceilometer::agent::auth::auth_url: {get_param: [EndpointMap, KeystoneInternal, uri_no_suffix] }
+        ceilometer::agent::notification::manage_event_pipeline: {get_param: ManageEventPipeline}
         ceilometer::agent::notification::event_pipeline_publishers: {get_param: EventPipelinePublishers}
+        ceilometer::agent::notification::manage_pipeline: {get_param: ManagePipeline}
+        ceilometer::agent::notification::pipeline_publishers: {get_param: PipelinePublishers}
         ceilometer::agent::auth::auth_region: {get_param: KeystoneRegion}
         ceilometer::agent::auth::auth_tenant_name: 'service'
         ceilometer::agent::auth::auth_user_domain_name: 'Default'
index 697ec22..8121454 100644 (file)
@@ -34,6 +34,28 @@ parameters:
     default: 0
     description: Configures sysctl net.ipv6.{default/all}.disable_ipv6 keys
     type: number
+  NeighbourGcThreshold1:
+    default: 1024
+    description: Configures sysctl net.ipv4.neigh.default.gc_thresh1 value.
+                 This is the minimum number of entries to keep in the ARP
+                 cache. The garbage collector will not run if there are
+                 fewer than this number of entries in the cache.
+    type: number
+  NeighbourGcThreshold2:
+    default: 2048
+    description: Configures sysctl net.ipv4.neigh.default.gc_thresh2 value.
+                 This is the soft maximum number of entries to keep in the
+                 ARP cache. The garbage collector will  allow the number of
+                 entries to exceed this for 5 seconds before collection will
+                 be performed.
+    type: number
+  NeighbourGcThreshold3:
+    default: 4096
+    description: Configures sysctl net.ipv4.neigh.default.gc_thresh3 value.
+                 This is the hard maximum number of entries to keep in the
+                 ARP cache. The garbage collector will always run if there
+                 are more than this number of entries in the cache.
+    type: number
 
 outputs:
   role_data:
@@ -94,5 +116,12 @@ outputs:
             value: 1
           fs.suid_dumpable:
             value: 0
+          #avoid neighbour table overflow on large deployments
+          net.ipv4.neigh.default.gc_thresh1:
+            value: {get_param: NeighbourGcThreshold1}
+          net.ipv4.neigh.default.gc_thresh2:
+            value: {get_param: NeighbourGcThreshold2}
+          net.ipv4.neigh.default.gc_thresh3:
+            value: {get_param: NeighbourGcThreshold3}
       step_config: |
         include ::tripleo::profile::base::kernel
index 9894f00..d57c8fc 100644 (file)
@@ -45,3 +45,5 @@
     - OS::TripleO::Services::UndercloudGnocchiMetricd
     - OS::TripleO::Services::UndercloudGnocchiStatsd
     - OS::TripleO::Services::UndercloudPankoApi
+    - OS::TripleO::Services::UndercloudCeilometerAgentCentral
+    - OS::TripleO::Services::UndercloudCeilometerAgentNotification