+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-- name: restart aodh services
- service: name={{ item }} state=restarted enabled=yes
- with_items: "{{ services | union(services_noarch) }}"
-
-- name: aodh reload apache
- service: name={{ item }} state=reloaded
- with_items: "{{ http_service_name }}"
-
-- name: aodh restart apache
- service: name={{ item }} state=restarted enabled=yes
- with_items: "{{ http_service_name }}"
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-- name: aodh db sync
- shell: su -s /bin/sh -c "aodh-dbsync" aodh
- notify:
- - restart aodh services
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-- include_vars: "{{ ansible_os_family }}.yml"
-
-- name: install aodh packages
- action: "{{ ansible_pkg_mgr }} name={{ item }} state=present"
- with_items: "{{ packages | union(packages_noarch) }}"
-
-- name: update aodh conf
- template: src={{ item }} dest=/etc/aodh/aodh.conf backup=yes
- with_items:
- - aodh.conf.j2
- notify:
- - restart aodh services
-
-- name: write services to monitor list
- lineinfile: dest=/opt/service create=yes line={{ item }}
- with_items: "{{ services | union(services_noarch) }}"
-
-- name: remove default sqlite db
- shell: rm /var/lib/aodh/aodh.sqlite || touch aodh.sqllite.db.removed
-
-- name: disable aodh-api service
- service: name={{ item }} state=stopped enabled=no
- with_items: "{{ api_service }}"
-
-- name: add listen port
- lineinfile:
- dest: '{{ apache_config_dir }}/ports.conf'
- regexp: "^Listen {{ internal_ip }}:8042"
- line: "Listen {{ internal_ip }}:8042"
- notify: aodh restart apache
-
-- name: create WSGIScriptAlias Path
- file:
- path: /var/www/cgi-bin/aodh
- state: directory
- mode: 0755
-
-- name: copy WSGIScriptAlias file
- shell: |
- cp {{WSGIScriptAlias_file}} /var/www/cgi-bin/aodh/app;
-
-- name: update apache2 configs
- template:
- src: wsgi-aodh.conf.j2
- dest: '{{ apache_config_dir }}/sites-available/aodh.conf'
- when: ansible_os_family == 'Debian'
- notify: aodh reload apache
-
-- name: enable aodh server
- file:
- src: "{{ apache_config_dir }}/sites-available/aodh.conf"
- dest: "{{ apache_config_dir }}/sites-enabled/aodh.conf"
- state: "link"
- when: ansible_os_family == 'Debian'
- notify: aodh reload apache
-
-- name: update apache2 configs
- template:
- src: wsgi-aodh.conf.j2
- dest: '{{ apache_config_dir }}/aodh.conf'
- when: ansible_os_family == 'RedHat'
- notify: aodh reload apache
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-- include: aodh_install.yml
- tags:
- - install
- - aodh_install
- - aodh
-
-- include: aodh_config.yml
- when: inventory_hostname == groups['controller'][0]
- tags:
- - config
- - aodh_config
- - aodh
-
-- meta: flush_handlers
+++ /dev/null
-{% set memcached_servers = [] %}
-{% for host in haproxy_hosts.values() %}
-{% set _ = memcached_servers.append('%s:11211'% host) %}
-{% endfor %}
-{% set memcached_servers = memcached_servers|join(',') %}
-
-[DEFAULT]
-transport_url = rabbit://{{ RABBIT_USER }}:{{ RABBIT_PASS }}@{{ rabbit_host }}
-rpc_backend = rabbit
-
-bind_host = {{ internal_ip }}
-bind_port = 8042
-auth_strategy = keystone
-debug = True
-
-[api]
-host = {{ internal_ip }}
-
-[database]
-connection = mysql://aodh:{{ AODH_DBPASS }}@{{ db_host }}/aodh
-
-[keystone_authtoken]
-auth_uri = http://{{ internal_vip.ip }}:5000
-auth_url = http://{{ internal_vip.ip }}:35357
-memcached_servers = {{ memcached_servers }}
-auth_type = password
-project_domain_name = default
-user_domain_name = default
-project_name = service
-username = aodh
-password = {{ AODH_PASS }}
-
-identity_uri = http://{{ internal_vip.ip }}:35357
-auth_plugin = password
-project_domain_id = default
-user_domain_id = default
-token_cache_time = 300
-revocation_cache_time = 60
-
-[oslo_messaging_rabbit]
-rabbit_hosts = {{ internal_vip.ip }}
-rabbit_userid = {{ RABBIT_USER }}
-rabbit_password = {{ RABBIT_PASS }}
-
-[service_credentials]
-auth_type = password
-auth_url = http://{{ internal_vip.ip }}:5000/v3
-project_domain_name = default
-user_domain_name = default
-project_name = service
-username = aodh
-password = {{ AODH_PASS }}
-interface = internalURL
-region_name = RegionOne
-
-endpoint_type = internalURL
+++ /dev/null
-{% set work_threads = (ansible_processor_vcpus + 1) // 2 %}
-{% if work_threads > 10 %}
-{% set work_threads = 10 %}
-{% endif %}
-
-<VirtualHost {{ internal_ip }}:8042>
- WSGIDaemonProcess aodh-api processes=4 threads={{ work_threads }} user=aodh group=aodh display-name=%{GROUP}
- WSGIProcessGroup aodh-api
- WSGIScriptAlias / /var/www/cgi-bin/aodh/app
- WSGIApplicationGroup %{GLOBAL}
- <IfVersion >= 2.4>
- ErrorLogFormat "%{cu}t %M"
- </IfVersion>
- ErrorLog /var/log/{{ http_service_name }}/aodh.log
- CustomLog /var/log/{{ http_service_name }}/aodh_access.log combined
-
- <Directory /usr/lib/python2.7/dist-packages/aodh/api/>
- <IfVersion >= 2.4>
- Require all granted
- </IfVersion>
- <IfVersion < 2.4>
- Order allow,deny
- Allow from all
- </IfVersion>
- </Directory>
-</VirtualHost>
-
-WSGISocketPrefix /var/run/{{ http_service_name }}
+++ /dev/null
-#############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-#############################################################################
----
-packages:
- - aodh-api
- - aodh-evaluator
- - aodh-notifier
- - aodh-listener
- - aodh-expirer
- - python-aodhclient
-
-services:
- - aodh-notifier
- - aodh-evaluator
- - aodh-listener
-
-api_service: aodh-api
-
-apache_config_dir: /etc/apache2
-http_service_name: apache2
-WSGIScriptAlias_file: /usr/lib/python2.7/dist-packages/aodh/api/app.wsgi
+++ /dev/null
-#############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-#############################################################################
----
-packages:
- - openstack-aodh-api
- - openstack-aodh-evaluator
- - openstack-aodh-notifier
- - openstack-aodh-listener
- - openstack-aodh-expirer
- - python-aodhclient
-
-services:
- - openstack-aodh-notifier
- - openstack-aodh-evaluator
- - openstack-aodh-listener
-
-api_service: openstack-aodh-api
-
-apache_config_dir: /etc/httpd/conf.d
-http_service_name: httpd
-WSGIScriptAlias_file: /usr/lib/python2.7/site-packages/aodh/api/app.wsgi
+++ /dev/null
-##############################################################################
-## Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-##
-## All rights reserved. This program and the accompanying materials
-## are made available under the terms of the Apache License, Version 2.0
-## which accompanies this distribution, and is available at
-## http://www.apache.org/licenses/LICENSE-2.0
-###############################################################################
----
-packages_noarch: []
-
-services_noarch: []
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-- name: restart apache related services
- service: name={{ item }} state=restarted enabled=yes
- with_items: "{{ services| union(services_noarch) }}"
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-- include_vars: "{{ ansible_os_family }}.yml"
-
-- name: install packages
- action: "{{ ansible_pkg_mgr }} name={{ item }} state=latest update_cache=yes"
- with_items: "{{ packages | union(packages_noarch) }}"
-
-- name: assure listen port exist
- template:
- dest: '{{ apache_config_dir }}/ports.conf'
- src: ports.conf.j2
- notify:
- - restart apache related services
-
-- name: remove default listen port on centos
- lineinfile:
- dest: /etc/httpd/conf/httpd.conf
- state: absent
- regexp: 'Listen 80'
- when: ansible_os_family == 'RedHat'
-
-- meta: flush_handlers
+++ /dev/null
-{% set work_threads = (ansible_processor_vcpus + 1) // 2 %}
-
-<VirtualHost {{ internal_ip }}:80>
- WSGIScriptAlias /horizon {{ horizon_dir }}/wsgi/django.wsgi
- WSGIDaemonProcess horizon user=horizon group=horizon processes={{ work_threads }} threads={{ work_threads }}
- WSGIProcessGroup horizon
- Alias /static {{ horizon_dir }}/static/
- Alias /horizon/static {{ horizon_dir }}/static/
- <Directory {{ horizon_dir }}/wsgi>
- Order allow,deny
- Allow from all
- </Directory>
-</VirtualHost>
-
-
+++ /dev/null
-Listen {{ internal_ip }}:80
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-packages:
- - apache2
- - libapache2-mod-wsgi
-
-services:
- - apache2
-
-apache_config_dir: /etc/apache2
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-packages:
- - mod_wsgi
- - httpd
-
-services:
- - httpd
-
-apache_config_dir: /etc/httpd/conf.d
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-packages_noarch: []
-
-services_noarch: []
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-- name: Register RECOVERY
- set_fact: RECOVERY_ENV={{RECOVERY_ENV | default('False')}}
- tags:
- - recovery-stop-service
-
-- include_vars: "{{ ansible_os_family }}.yml"
- when: RECOVERY_ENV
- tags:
- - recovery-stop-service
-
-- name: stop controller services
- service: name={{ item }} state=stopped enabled=yes
- with_items: "{{ controller_services | union(controller_services_noarch) }}"
- when: RECOVERY_ENV
- tags:
- - recovery-stop-service
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-controller_services:
- - cron
- - aodh-expirer
- - neutron-openvswitch-agent
- - mysql
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-controller_services:
- - cron
- - neutron-openvswitch-agent
- - openstack-aodh-expirer
- - mysql
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-controller_services_noarch: []
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-- name: restart ceilometer service
- service: name={{ item }} state=restarted enabled=yes
- with_items: "{{ ceilometer_services }}"
-
-- name: restart nova service
- service: name={{ item }} state=restarted enabled=yes
- with_items: "{{ nova_services }}"
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-- include_vars: "{{ ansible_os_family }}.yml"
-
-- name: copy configs
- template:
- src: "{{ item }}"
- dest: /opt/os_templates
- with_items:
- - ceilometer.conf.j2
- - nova.conf.j2
-
-- name: update ceilometer configs
- shell: crudini --merge {{ item.dest }} < /opt/os_templates/{{ item.src }}
- with_items:
- - src: nova.conf.j2
- dest: /etc/nova/nova.conf
- notify: restart nova service
-
-- name: delete config
- file:
- path: /opt/os_templates/nova.conf.j2
- state: absent
-
-- name: write services to monitor list
- lineinfile: dest=/opt/service create=yes line='{{ item }}'
- with_items: "{{ ceilometer_services }}"
-
-- meta: flush_handlers
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-- include_vars: "{{ ansible_os_family }}.yml"
-
-- name: disable auto start
- copy:
- content: "#!/bin/sh\nexit 101"
- dest: "/usr/sbin/policy-rc.d"
- mode: 0755
- when: ansible_os_family == "Debian"
-
-- name: install ceilometer packages
- action: "{{ ansible_pkg_mgr }} name={{ item }} state=present"
- with_items: "{{ ceilometer_packages | union(packages_noarch) }}"
-
-- name: enable auto start
- file:
- path=/usr/sbin/policy-rc.d
- state=absent
- when: ansible_os_family == "Debian"
-
-- name: update ceilometer configs
- template:
- src: ceilometer.conf.j2
- dest: /etc/ceilometer/ceilometer.conf
- backup: "yes"
- notify: restart ceilometer service
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-- include: ceilometer_install.yml
- tags:
- - install
- - ceilometer_install
- - ceilometer
-
-- include: ceilometer_config.yml
- tags:
- - config
- - ceilometer_config
- - ceilometer
-
-- meta: flush_handlers
+++ /dev/null
-[DEFAULT]
-verbose = True
-rpc_backend = rabbit
-auth_strategy = keystone
-
-[publisher]
-metering_secret = {{ metering_secret }}
-
-[keystone_authtoken]
-auth_uri = http://{{ internal_vip.ip }}:5000
-auth_url = http://{{ internal_vip.ip }}:35357
-auth_type = password
-project_domain_name = default
-user_domain_name = default
-project_name = service
-username = ceilometer
-password = {{ CEILOMETER_PASS }}
-
-auth_plugin = password
-project_domain_id = default
-user_domain_id = default
-
-[oslo_messaging_rabbit]
-rabbit_host = {{ rabbit_host }}
-rabbit_userid = {{ RABBIT_USER }}
-rabbit_password = {{ RABBIT_PASS }}
-
-[service_credentials]
-auth_url = http://{{ internal_vip.ip }}:5000
-project_domain_id = default
-user_domain_id = default
-auth_type = password
-username = ceilometer
-project_name = service
-password = {{ CEILOMETER_PASS }}
-interface = internalURL
-region_name = RegionOne
-
+++ /dev/null
-[DEFAULT]
-instance_usage_audit = True
-instance_usage_audit_period = hour
-notify_on_state_change = vm_and_task_state
-
-[oslo_messaging_notifications]
-driver = messagingv2
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-ceilometer_packages:
- - ceilometer-agent-compute
-
-ceilometer_services:
- - ceilometer-agent-compute
-
-nova_services:
- - nova-compute
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-ceilometer_packages:
- - openstack-ceilometer-compute
- - python-ceilometerclient
- - python-pecan
-
-ceilometer_services:
- - openstack-ceilometer-compute
- - openstack-nova-compute
-
-nova_services:
- - openstack-nova-compute
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-packages_noarch: []
-metering_secret: 1c5df72079b31fb47747
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-- name: restart ceilometer service
- service: name={{ item }} state=restarted enabled=yes
- with_items: "{{ ceilometer_services }}"
-
-- name: restart glance_cinder service
- service: name={{ item }} state=restarted enabled=yes
- with_items: "{{ glance_cinder_services }}"
-
-- name: reload apache server
- service: name={{ item }} state=reloaded
- with_items: "{{ services }}"
-
-- name: restart apache server
- service: name={{ item }} state=restarted enabled=yes
- with_items: "{{ services }}"
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-- include_vars: "{{ ansible_os_family }}.yml"
-
-- name: assure listen port exist
- lineinfile:
- dest: '{{ apache_config_dir }}/ports.conf'
- regexp: "^Listen {{ internal_ip }}:8777"
- line: "Listen {{ internal_ip }}:8777"
- notify: restart apache server
-
-- name: create WSGIScriptAlias Path
- file:
- path: /var/www/cgi-bin/ceilometer
- state: directory
- mode: 0755
-
-- name: copy WSGIScriptAlias file
- shell: |
- cp {{WSGIScriptAlias_file}} /var/www/cgi-bin/ceilometer/app;
-
-- name: update apache2 configs
- template:
- src: wsgi-ceilometer.conf.j2
- dest: '{{ apache_config_dir }}/sites-available/ceilometer.conf'
- when: ansible_os_family == 'Debian'
- notify: reload apache server
-
-- name: enable ceilometer server
- file:
- src: "{{ apache_config_dir }}/sites-available/ceilometer.conf"
- dest: "{{ apache_config_dir }}/sites-enabled/ceilometer.conf"
- state: "link"
- when: ansible_os_family == 'Debian'
- notify: reload apache server
-
-- name: update apache2 configs
- template:
- src: wsgi-ceilometer.conf.j2
- dest: '{{ apache_config_dir }}/ceilometer.conf'
- when: ansible_os_family == 'RedHat'
- notify: reload apache server
-
-- name: copy glance & cinder configs
- template:
- src: "{{ item }}"
- dest: /opt/os_templates
- with_items:
- - cinder.conf.j2
- - glance-api.conf.j2
- - glance-registry.conf.j2
-
-- name: update configs
- shell: crudini --merge {{ item.dest }} < /opt/os_templates/{{ item.src }}
- with_items:
- - src: cinder.conf.j2
- dest: /etc/cinder/cinder.conf
- - src: glance-api.conf.j2
- dest: /etc/glance/glance-api.conf
- - src: glance-registry.conf.j2
- dest: /etc/glance/glance-registry.conf
- notify: restart glance_cinder service
-
-- name: delete configs
- file:
- path: /opt/os_templates/{{ item }}
- state: absent
- with_items:
- - cinder.conf.j2
- - glance-api.conf.j2
- - glance-registry.conf.j2
-
-- name: change meter polling interval to 300s
- replace:
- dest: /etc/ceilometer/pipeline.yaml
- regexp: 'interval: .+'
- replace: 'interval: 300'
- notify: restart ceilometer service
-
-- name: write services to monitor list
- lineinfile: dest=/opt/service create=yes line='{{ item }}'
- with_items: "{{ ceilometer_services }}"
-
-- meta: flush_handlers
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-- include_vars: "{{ ansible_os_family }}.yml"
-
-- name: disable auto start
- copy:
- content: "#!/bin/sh\nexit 101"
- dest: "/usr/sbin/policy-rc.d"
- mode: 0755
- when: ansible_os_family == "Debian"
-
-- name: install ceilometer packages
- action: "{{ ansible_pkg_mgr }} name={{ item }} state=present"
- with_items: "{{ ceilometer_packages | union(packages_noarch) }}"
-
-- name: enable auto start
- file:
- path=/usr/sbin/policy-rc.d
- state=absent
- when: ansible_os_family == "Debian"
-
-- name: update ceilometer configs
- template:
- src: ceilometer.conf.j2
- dest: /etc/ceilometer/ceilometer.conf
- backup: "yes"
- notify: restart ceilometer service
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-- include: ceilometer_install.yml
- tags:
- - install
- - ceilometer_install
- - ceilometer
-
-- include: ceilometer_config.yml
- tags:
- - config
- - ceilometer_config
- - ceilometer
-
-- meta: flush_handlers
+++ /dev/null
-{% set memcached_servers = [] %}
-{% for host in haproxy_hosts.values() %}
-{% set _ = memcached_servers.append('%s:11211'% host) %}
-{% endfor %}
-{% set memcached_servers = memcached_servers|join(',') %}
-
-[DEFAULT]
-rpc_backend = rabbit
-auth_strategy = keystone
-verbose = True
-
-[api]
-host = {{ internal_ip }}
-
-[database]
-connection = mongodb://ceilometer:{{ CEILOMETER_DBPASS }}@{{ internal_vip.ip }}:27017/ceilometer
-
-[keystone_authtoken]
-auth_uri = http://{{ internal_vip.ip }}:5000
-auth_url = http://{{ internal_vip.ip }}:35357
-memcached_servers = {{ memcached_servers }}
-auth_type = password
-project_domain_name = default
-user_domain_name = default
-project_name = service
-username = ceilometer
-password = {{ CEILOMETER_PASS }}
-
-identity_uri = http://{{ internal_vip.ip }}:35357
-auth_plugin = password
-project_domain_id = default
-user_domain_id = default
-
-[oslo_messaging_rabbit]
-rabbit_host = {{ rabbit_host }}
-rabbit_userid = {{ RABBIT_USER }}
-rabbit_password = {{ RABBIT_PASS }}
-
-[publisher]
-metering_secret = {{ metering_secret }}
-
-[service_credentials]
-auth_type = password
-auth_url = http://{{ internal_vip.ip }}:5000/v3
-project_domain_name = default
-user_domain_name = default
-project_name = service
-username = ceilometer
-password = {{ CEILOMETER_PASS }}
-interface = internalURL
-region_name = RegionOne
-
+++ /dev/null
-[oslo_messaging_notifications]
-driver = messagingv2
+++ /dev/null
-[oslo_messaging_notifications]
-driver = messagingv2
+++ /dev/null
-[oslo_messaging_notifications]
-driver = messagingv2
+++ /dev/null
-{% set work_threads = (ansible_processor_vcpus + 1) // 2 %}
-{% if work_threads > 10 %}
-{% set work_threads = 10 %}
-{% endif %}
-
-<VirtualHost {{ internal_ip }}:8777>
- WSGIDaemonProcess ceilometer-api processes=4 threads={{ work_threads }} user=ceilometer group=ceilometer display-name=%{GROUP}
- WSGIProcessGroup ceilometer-api
- WSGIScriptAlias / /var/www/cgi-bin/ceilometer/app
- WSGIApplicationGroup %{GLOBAL}
- ErrorLog /var/log/{{ http_service_name }}/ceilometer_error.log
- CustomLog /var/log/{{ http_service_name }}/ceilometer_access.log combined
-
- <Directory /usr/lib/python2.7/dist-packages/ceilometer/api/>
- <IfVersion >= 2.4>
- Require all granted
- </IfVersion>
- <IfVersion < 2.4>
- Order allow,deny
- Allow from all
- </IfVersion>
- </Directory>
-</VirtualHost>
-
-WSGISocketPrefix /var/run/{{ http_service_name }}
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-ceilometer_packages:
- - ceilometer-api
- - ceilometer-collector
- - ceilometer-agent-central
- - ceilometer-agent-notification
- - ceilometer-agent-compute
- - python-ceilometerclient
-
-ceilometer_services:
- - ceilometer-agent-central
- - ceilometer-agent-notification
- - ceilometer-collector
-
-glance_cinder_services:
- - glance-registry
- - glance-api
- - cinder-api
- - cinder-scheduler
-
-services:
- - apache2
-
-apache_config_dir: /etc/apache2
-http_service_name: apache2
-WSGIScriptAlias_file: /usr/lib/python2.7/dist-packages/ceilometer/api/app.wsgi
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-ceilometer_packages:
- - openstack-ceilometer-api
- - openstack-ceilometer-collector
- - openstack-ceilometer-central
- - openstack-ceilometer-notification
- - openstack-ceilometer-compute
- - python-ceilometerclient
-
-ceilometer_services:
- - openstack-ceilometer-central
- - openstack-ceilometer-notification
- - openstack-ceilometer-collector
-
-glance_cinder_services:
- - openstack-glance-registry
- - openstack-glance-api
- - openstack-cinder-api
- - openstack-cinder-scheduler
-
-services:
- - httpd
-
-apache_config_dir: /etc/httpd/conf.d
-http_service_name: httpd
-WSGIScriptAlias_file: /usr/lib/python2.7/site-packages/ceilometer/api/app.wsgi
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-packages_noarch: []
-metering_secret: 1c5df72079b31fb47747
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
-if [ -d "/var/local/osd" ]; then
-echo "clear /var/local/osd"
-rm -r /var/local/osd/
-umount /var/local/osd
-rm -r /var/local/osd
-fi
-
-
-#safe check
-ps -ef |grep lvremove |awk '{print $2}' |xargs kill -9
-ps -ef |grep vgremove |awk '{print $2}' |xargs kill -9
-ps -ef |grep vgcreate |awk '{print $2}' |xargs kill -9
-ps -ef |grep lvcreate |awk '{print $2}' |xargs kill -9
-
-if [ -L "/dev/storage-volumes/ceph0" ]; then
-echo "remove lv vg"
-lvremove -f /dev/storage-volumes/ceph0
-fi
-
-
-echo "lvcreate"
-lvcreate -l 100%FREE -nceph0 storage-volumes
-echo "mkfs"
-mkfs.xfs -f /dev/storage-volumes/ceph0
-
-if [ ! -d "/var/local/osd" ]; then
-echo "mount osd"
-mkdir -p /var/local/osd
-mount /dev/storage-volumes/ceph0 /var/local/osd
-fi
-
+++ /dev/null
----
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
-- name: gen ceph fsid
- shell: uuidgen
- register: ceph_fsid
- when: inventory_hostname in groups['ceph_adm']
-
-- name: gen ceph conf
- local_action:
- module: "template"
- src: "ceph.j2"
- dest: "/tmp/ceph.conf"
- when: inventory_hostname in groups['ceph_adm']
-
-- name: fetch ceph conf from ceph_adm
- fetch: src="/etc/ceph/ceph.conf" dest="/tmp/ceph.conf" flat=yes
- delegate_to: "{{ public_vip.ip }}"
- when: compute_expansion
-
-- name: "make directory for ceph config file"
- file: path="/etc/ceph" state="directory"
-
-- name: copy ceph conf to dest mon node
- copy: src="/tmp/ceph.conf" dest="/etc/ceph/ceph.conf"
-
-- name: install ceph-related packages
- action: "{{ ansible_pkg_mgr }} name={{ item }} state=present"
- with_items:
- - ceph
-
-- name: gen create monmap script
- local_action: template src="create_monmap.j2" dest="/tmp/create_monmap.sh" mode=0755
- when: inventory_hostname in groups['ceph_adm']
-
-- name: create monmap
- script: /tmp/create_monmap.sh
- when: inventory_hostname in groups['ceph_mon']
-
-- name: create mon.keyring
- shell: "ceph-authtool --create-keyring /tmp/ceph.mon.keyring \
- --gen-key -n mon. --cap mon 'allow *'"
- when: inventory_hostname in groups['ceph_adm']
-
-- name: create admin.keyring
- shell: "ceph-authtool --create-keyring /etc/ceph/ceph.client.admin.keyring \
- --gen-key -n client.admin --set-uid=0 \
- --cap mon 'allow *' --cap osd 'allow *' --cap mds 'allow'"
- when: inventory_hostname in groups['ceph_adm']
-
-- name: Add the client.admin key to the ceph.mon.keyring
- shell: "ceph-authtool /tmp/ceph.mon.keyring \
- --import-keyring /etc/ceph/ceph.client.admin.keyring"
- when: inventory_hostname in groups['ceph_adm']
-
-- name: fetch mon.keyring to local
- fetch: src="/tmp/ceph.mon.keyring" dest="/tmp/ceph.mon.keyring" flat=yes
- when: inventory_hostname in groups['ceph_adm']
-
-- name: fetch mon.keyring from ceph_adm
- fetch: src="/tmp/ceph.mon.keyring" dest="/tmp/ceph.mon.keyring" flat=yes
- delegate_to: "{{ public_vip.ip }}"
- when: compute_expansion
-
-- name: fetch client.admin.keyring to local
- fetch:
- src: "/etc/ceph/ceph.client.admin.keyring"
- dest: "/tmp/ceph.client.admin.keyring"
- flat: "yes"
- when: inventory_hostname in groups['ceph_adm']
-
-- name: fetch mon.keyring from ceph_adm
- fetch:
- src: "/etc/ceph/ceph.client.admin.keyring"
- dest: "/tmp/ceph.client.admin.keyring"
- flat: "yes"
- delegate_to: "{{ public_vip.ip }}"
- when: compute_expansion
-
-- name: copy mon.keyring to remote nodes
- copy: src="/tmp/ceph.mon.keyring" dest="/tmp/ceph.mon.keyring"
-
-- name: copy admin.keyring to remote nodes
- copy:
- src: "/tmp/ceph.client.admin.keyring"
- dest: "/etc/ceph/ceph.client.admin.keyring"
-
-- meta: flush_handlers
+++ /dev/null
----
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
-- include: create_config.yml
- tags:
- - ceph_config
- - ceph_deploy
- - ceph_mon
+++ /dev/null
-[global]
-fsid = {{ ceph_fsid.stdout }}
-mon initial members = {{ groups["ceph_mon"] | join(", ")}}
-mon host =
-{%- for host in groups["ceph_mon"] -%}
-{{ ', ' if not loop.first else ''}}{{ ip_settings[host].mgmt.ip }}
-{%- endfor %}
-
-public network = {{ mgmt_cidr }}
-cluster network = {{ storage_cidr }}
-
-auth cluster required = cephx
-auth service required = cephx
-auth client required = cephx
-
-osd journal size = 1024
-filestore xattr use omap = true
-osd pool default size = 1
-osd pool default min size = 1
-osd pool default pg num = 333
-osd pool default pgp num = 333
-osd crush chooseleaf type = 1
-
-debug mon = 1
-debug ms = 0
+++ /dev/null
-monmaptool --create --clobber --fsid {{ ceph_fsid.stdout }}
-{%- for host in groups['ceph_mon']%}
- --add {{host}} {{ ip_settings[host].mgmt.ip }}:6789
-{%- endfor %}
- /tmp/monmap
+++ /dev/null
-HOSTVARS (ANSIBLE GATHERED, group_vars, host_vars) :
-
-{{ hostvars[inventory_hostname] | to_yaml }}
-
-PLAYBOOK VARS:
-
-{{ vars | to_yaml }}
-
+++ /dev/null
----
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
-
-- include_vars: "{{ ansible_os_family }}.yml"
-
-- name: Create a default data directory
- file: path="/var/lib/ceph/mon/ceph-{{ inventory_hostname }}" state="directory"
-
-- name: Populate the monitor daemon
- shell: "ceph-mon --mkfs -i {{ inventory_hostname }} --monmap /tmp/monmap \
- --keyring /tmp/ceph.mon.keyring"
-
-- name: Change ceph/mon dir owner to ceph
- shell: "chown -R ceph:ceph /var/lib/ceph/mon"
- when: ansible_os_family == "Debian"
-
-- name: copy templates
- template:
- src: ceph-mon.service
- dest: /lib/systemd/system/ceph-mon.service
- mode: 0755
- when: ansible_os_family == "Debian"
-
-- name: Touch the done and auto start file
- file:
- path: "/var/lib/ceph/mon/ceph-{{ inventory_hostname }}/{{ item }}"
- state: "touch"
- with_items:
- - "done"
- - "{{ ceph_start_type }}"
-
-- name: start mon daemon
- shell: "{{ ceph_start_script }}"
-
-- name: wait for creating osd keyring
- wait_for: path=/var/lib/ceph/bootstrap-osd/ceph.keyring
-
-- name: fetch osd keyring
- fetch:
- src: "/var/lib/ceph/bootstrap-osd/ceph.keyring"
- dest: "/tmp/ceph.osd.keyring"
- flat: "yes"
- run_once: "True"
+++ /dev/null
----
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
-- include: install_mon.yml
- when: inventory_hostname in groups["ceph_mon"]
- tags:
- - ceph_mon
- - ceph_deploy
+++ /dev/null
-[Unit]
-Description=Ceph cluster monitor daemon
-Documentation=man:ceph-mon
-
-After=network-online.target local-fs.target ceph-create-keys.service
-Wants=network-online.target local-fs.target ceph-create-keys.service
-
-PartOf=ceph.target
-
-[Service]
-LimitNOFILE=1048576
-LimitNPROC=1048576
-EnvironmentFile=-/etc/default/ceph
-Environment=CLUSTER=ceph
-ExecStart=/usr/bin/ceph-mon -f --cluster ${CLUSTER} --id {{ inventory_hostname }} --setuser ceph --setgroup ceph
-ExecReload=/bin/kill -HUP $MAINPID
-Restart=on-failure
-RestartSec=30
-TasksMax=infinity
-
-[Install]
-WantedBy=multi-user.target
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-
-ceph_start_script: "service ceph-mon start"
-ceph_start_type: "systemd"
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-
-ceph_start_script: "/etc/init.d/ceph start mon.{{ inventory_hostname }}"
-ceph_start_type: "sysvinit"
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-- name: chown of glance/api.log
- shell: chown -R glance:glance /var/log/glance
- when: inventory_hostname in groups['controller']
- tags:
- - ceph_conf_glance
- ignore_errors: "True"
-
-- name: modify glance-api.conf for ceph
- shell: |
- sed -i 's/^\(default_store\).*/\1 = rbd/g' /etc/glance/glance-api.conf;
- sed -i '/^\[glance_store/a rbd_store_pool = images' \
- /etc/glance/glance-api.conf;
- sed -i '/^\[glance_store/a rbd_store_user = glance' \
- /etc/glance/glance-api.conf;
- sed -i '/^\[glance_store/a rbd_store_ceph_conf = /etc/ceph/ceph.conf' \
- /etc/glance/glance-api.conf;
- sed -i '/^\[glance_store/a rbd_store_chunk_size = 8' \
- /etc/glance/glance-api.conf;
- sed -i '/^\[glance_store/a show_image_direct_url=True' \
- /etc/glance/glance-api.conf;
- when: inventory_hostname in groups['controller']
- tags:
- - ceph_conf_glance
-
-- name: remove glance-api log
- shell: |
- rm -f /var/log/glance/api.log;
- chown -R glance:glance /var/log/glance;
- when: inventory_hostname in groups['controller']
- tags:
- - ceph_conf_glance
- ignore_errors: "True"
-
-- name: restart glance service
- shell: service {{ glance_service }} restart
- register: result
- until: result.rc == 0
- retries: 10
- delay: 3
- when: inventory_hostname in groups['controller']
- tags:
- - ceph_conf_glance
-
-- name: modify cinder.conf for ceph
- shell: |
- sed -i 's/^\(volume_driver\).*/\1 = cinder.volume.drivers.rbd.RBDDriver/g' \
- /etc/cinder/cinder.conf;
- sed -i 's/^\(rbd_secret_uuid\).*/\1 = {{ ceph_uuid }}/g' \
- /etc/cinder/cinder.conf;
- crudini --set /etc/cinder/cinder.conf DEFAULT enabled_backends \
- ceph;
- crudini --del /etc/cinder/cinder.conf lvm
- crudini --set /etc/cinder/cinder.conf ceph volume_driver \
- cinder.volume.drivers.rbd.RBDDriver;
- crudini --set /etc/cinder/cinder.conf ceph volume_backend_name \
- ceph;
- crudini --set /etc/cinder/cinder.conf ceph rbd_pool volumes;
- crudini --set /etc/cinder/cinder.conf ceph rbd_ceph_conf \
- /etc/ceph/ceph.conf;
- crudini --set /etc/cinder/cinder.conf ceph rbd_flatten_volume_from_snapshot \
- false;
- crudini --set /etc/cinder/cinder.conf ceph rbd_max_clone_depth \
- 5;
- crudini --set /etc/cinder/cinder.conf ceph rbd_store_chunk_size \
- 4;
- crudini --set /etc/cinder/cinder.conf ceph rados_connect_timeout \
- -1;
- crudini --set /etc/cinder/cinder.conf ceph glance_api_version \
- 2;
- crudini --set /etc/cinder/cinder.conf ceph rbd_user \
- cinder;
- crudini --set /etc/cinder/cinder.conf ceph rbd_secret_uuid \
- {{ ceph_uuid }};
- when: inventory_hostname in groups['compute']
- tags:
- - ceph_conf_cinder
-
-- name: restart cinder service
- shell: service {{ cinder_service }} restart
- register: result
- until: result.rc == 0
- retries: 10
- delay: 3
- when: inventory_hostname in groups['compute']
- tags:
- - ceph_conf_cinder
-
-- name: modify nova.conf for ceph
- shell: |
- sed -i 's/^\(images_type\).*/\1 = rbd/g' \
- /etc/nova/nova-compute.conf;
- sed -i 's/^\(rbd_secret_uuid\).*/\1 = {{ ceph_uuid }}/g' \
- /etc/nova/nova-compute.conf;
- when: inventory_hostname in groups['compute']
- tags:
- - ceph_conf_nova
-
-- name: modify nova.conf libvirt for ceph
- blockinfile:
- dest: /etc/nova/nova-compute.conf
- insertafter: "libvirt"
- block: |
- images_rbd_pool = vms
- images_rbd_ceph_conf = /etc/ceph/ceph.conf
- rbd_user = cinder
- rbd_secret_uuid = {{ ceph_uuid }}
- disk_cachemodes = "network=writeback"
- live_migration_flag = "{{ live_migration_flag | join(',') }}"
- when: inventory_hostname in groups['compute']
- tags:
- - ceph_conf_nova
-
-- name: restart nova service
- shell: service {{ nova_service }} restart
- register: result
- until: result.rc == 0
- retries: 10
- delay: 3
- when: inventory_hostname in groups['compute']
- tags:
- - ceph_conf_nova
+++ /dev/null
-##############################################################################
-## Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-##
-## All rights reserved. This program and the accompanying materials
-## are made available under the terms of the Apache License, Version 2.0
-## which accompanies this distribution, and is available at
-## http://www.apache.org/licenses/LICENSE-2.0
-###############################################################################
----
-- name: get mount info
- command: mount
- register: mount_info
-
-- name: try unmount image nfs directory
- shell: |
- umount /var/lib/glance/images
- sed -i '/\/var\/lib\/glance\/images/d' /etc/fstab
- when: mount_info.stdout.find('images') != -1
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-- name: gen ceph uuid
- shell: uuidgen
- register: ceph_uuid_out
- run_once: true
- tags:
- - ceph_copy_secret
-
-- name: set ceph uuid var
- set_fact:
- ceph_uuid: "{{ ceph_uuid_out.stdout_lines[0] }}"
- when: not compute_expansion
- tags:
- - ceph_copy_secret
-
-- name: save ceph uuid for expansion
- copy: content="{{ ceph_uuid }}" dest=/etc/ceph/ceph.uuid.libvirt
- when: not compute_expansion and inventory_hostname in groups['controller']
- tags:
- - ceph_copy_secret
-
-- name: fetch ceph uuid from controller node for expansion
- shell: cat /etc/ceph/ceph.uuid.libvirt
- register: ceph_uuid_out
- delegate_to: "{{ public_vip.ip }}"
- when: compute_expansion and inventory_hostname in groups['compute']
- tags:
- - ceph_copy_secret
-
-- name: set ceph uuid var for expansion
- set_fact:
- ceph_uuid: "{{ ceph_uuid_out.stdout_lines[0] }}"
- when: compute_expansion and inventory_hostname in groups['compute']
- tags:
- - ceph_copy_secret
-
-- name: gen template secret.xml
- local_action:
- module: "template"
- src: "secret.j2"
- dest: "/tmp/secret.xml"
- mode: "0777"
- when: inventory_hostname in groups['ceph_adm']
- tags:
- - ceph_copy_secret
-
-- name: create pool
- shell: ceph osd pool create {{ item }} 50
- with_items:
- - volumes
- - images
- - backups
- - vms
- when: inventory_hostname in groups['ceph_adm']
-
-# yamllint disable rule:line-length
-- name: create ceph users for openstack
- shell: |
- ceph auth get-or-create client.cinder mon 'allow r' osd \
- 'allow class-read object_prefix rbd_children, allow rwx pool=volumes, allow rwx pool=vms, allow rx pool=images';
- ceph auth get-or-create client.glance mon 'allow r' osd \
- 'allow class-read object_prefix rbd_children, allow rwx pool=images';
- when: inventory_hostname in groups['ceph_adm']
-# yamllint enable rule:line-length
-
-- name: send glance key to controller nodes
- shell: |
- ceph auth get-or-create client.glance | \
- tee /etc/ceph/ceph.client.glance.keyring;
- chown glance:glance /etc/ceph/ceph.client.glance.keyring;
- when: inventory_hostname in groups['controller']
-
-- name: send cinder key to compute nodes
- shell: |
- ceph auth get-or-create client.cinder | \
- tee /etc/ceph/ceph.client.cinder.keyring;
- chown cinder:cinder /etc/ceph/ceph.client.cinder.keyring;
- when: inventory_hostname in groups['compute']
- tags:
- - ceph_send_key
-
-- name: copy cinder key to compute node
- shell: ceph auth get-key client.cinder | tee client.cinder.key
- when: inventory_hostname in groups['compute']
- tags:
- - ceph_copy_secret
-
-- name: copy secret.xml to compute nodes
- copy: src="/tmp/secret.xml" dest="~/secret.xml"
- when: inventory_hostname in groups['compute']
- tags:
- - ceph_copy_secret
-
-- name: undefine libvirt secret in case of repeatedly execute ceph_deploy
- shell: |
- virsh secret-list | awk '$1 ~ /[0-9]+/ {print $1}' | \
- xargs virsh secret-undefine
- when: inventory_hostname in groups['compute']
- tags:
- - ceph_copy_secret
- ignore_errors: "True"
-
-
-- name: create key for libvirt on compute nodes
- shell: |
- virsh secret-define --file ~/secret.xml;
- virsh secret-set-value --secret {{ ceph_uuid }} \
- --base64 $(cat client.cinder.key);
- when: inventory_hostname in groups['compute']
- tags:
- - ceph_copy_secret
- ignore_errors: "True"
+++ /dev/null
----
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
-- include_vars: "{{ ansible_os_family }}.yml"
- tags:
- - ceph_deploy
- - ceph_openstack_pre
- - ceph_openstack_conf
- - ceph_openstack_post
- - ceph_openstack
-
-- include: ceph_openstack_pre.yml
- tags:
- - ceph_deploy
- - ceph_openstack_pre
- - ceph_openstack
-
-- include: ceph_openstack_conf.yml
- tags:
- - ceph_deploy
- - ceph_openstack_conf
- - ceph_openstack
-
-- include: ceph_openstack_post.yml
- tags:
- - ceph_deploy
- - ceph_openstack_post
- - ceph_openstack
+++ /dev/null
-<secret ephemeral='no' private='no'>
- <uuid>{{ ceph_uuid }}</uuid>
- <usage type='ceph'>
- <name>client.cinder secret</name>
- </usage>
-</secret>
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-packages:
- - ceph-deploy
- - python-flask
- - libgoogle-perftools4
- - libleveldb1v5
- - liblttng-ust0
- - libsnappy1v5
- - librbd1
- - librados2
- - python-ceph
- - ceph
- - ceph-mds
- - ceph-common
- - ceph-fs-common
- - gdisk
-
-services: []
-
-cinder_service: cinder-volume
-nova_service: nova-compute
-glance_service: glance-api
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-packages:
- - ceph-radosgw
- - fcgi
- - ceph
-
-services: []
-
-cinder_service: openstack-cinder-volume
-nova_service: openstack-nova-compute
-glance_service: openstack-glance-api
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-packages_noarch: []
-
-ceph_cluster_dir:
- - /root/ceph-cluster
-
-live_migration_flag:
- - 'VIR_MIGRATE_UNDEFINE_SOURCE'
- - 'VIR_MIGRATE_PEER2PEER'
- - 'VIR_MIGRATE_LIVE'
- - 'VIR_MIGRATE_PERSIST_DEST'
- - 'VIR_MIGRATE_TUNNELLED'
+++ /dev/null
-#!/bin/sh
-#
-# Generate a CRUSH location for the given entity
-#
-# The CRUSH location consists of a list of key=value pairs, separated
-# by spaces, all on a single line. This describes where in CRUSH
-# hierarhcy this entity should be placed.
-#
-# Arguments:
-# --cluster <clustername> name of the cluster (see /etc/ceph/$cluster.conf)
-# --type <osd|mds|client> daemon/entity type
-# --id <id> id (osd number, mds name, client name)
-#
-
-# if we start up as ./ceph-crush-location, assume everything else is
-# in the current directory too.
-if [ `dirname $0` = "." ] && [ $PWD != "/usr/bin" ]; then
- BINDIR=.
- SBINDIR=.
- LIBDIR=.
- ETCDIR=.
-else
- BINDIR=@bindir@
- SBINDIR=@prefix@/sbin
- LIBDIR=@libdir@/ceph
- ETCDIR=@sysconfdir@/ceph
-fi
-
-usage_exit() {
- echo "usage: $0 [--cluster <cluster>] --id <id> --type <osd|mds|client>"
- exit
-}
-
-cluster="ceph"
-type=""
-id=""
-while [ $# -ge 1 ]; do
- case $1 in
- --cluster | -C)
- shift
- cluster="$1"
- shift
- ;;
- --id | -i)
- shift
- id="$1"
- shift
- ;;
- --type | -t)
- shift
- type="$1"
- shift
- ;;
- *)
- echo "unrecognized option '$1'"
- usage_exit
- ;;
- esac
-done
-
-if [ -z "$type" ]; then
- echo "must specify entity type"
- usage_exit
-fi
-
-if [ -z "$id" ]; then
- echo "must specify id"
- usage_exit
-fi
-
-# try a generic location
-location="$($BINDIR/ceph-conf --cluster=${cluster:-ceph} --name=$type.$id --lookup crush_location || :)"
-if [ -n "$location" ]; then
- echo $location
- exit 0
-fi
-
-# spit out something generic
-echo "host=$(hostname -s) root=default"
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
-if [ -d "/var/local/osd" ]; then
-echo "clear /var/local/osd"
-rm -r /var/local/osd/
-umount /var/local/osd
-rm -r /var/local/osd
-fi
-
-
-#safe check
-ps -ef |grep lvremove |awk '{print $2}' |xargs kill -9
-ps -ef |grep vgremove |awk '{print $2}' |xargs kill -9
-ps -ef |grep vgcreate |awk '{print $2}' |xargs kill -9
-ps -ef |grep lvcreate |awk '{print $2}' |xargs kill -9
-
-if [ -L "/dev/storage-volumes/ceph0" ]; then
-echo "remove lv vg"
-lvremove -f /dev/storage-volumes/ceph0
-fi
-
-
-echo "lvcreate"
-lvcreate -l 100%FREE -nceph0 storage-volumes
-echo "mkfs"
-mkfs.xfs -f /dev/storage-volumes/ceph0
-
-if [ ! -d "/var/local/osd" ]; then
-echo "mount osd"
-mkdir -p /var/local/osd
-mount /dev/storage-volumes/ceph0 /var/local/osd
-fi
-
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-- name: create osd lv and mount it on /var/local/osd
- script: create_osd.sh
-
-- name: fetch osd keyring from ceph_adm
- fetch:
- src: "/var/lib/ceph/bootstrap-osd/ceph.keyring"
- dest: "/tmp/ceph.osd.keyring"
- flat: "yes"
- delegate_to: "{{ public_vip.ip }}"
- when: compute_expansion
-
-- name: copy osd keyring
- copy:
- src: "/tmp/ceph.osd.keyring"
- dest: "/var/lib/ceph/bootstrap-osd/ceph.keyring"
-
-- name: prepare osd disk
- shell: ceph-disk prepare --fs-type xfs /var/local/osd
-
-- name: change local/osd dir owner to ceph
- shell: chown -R ceph:ceph /var/local/osd
- when: ansible_os_family == "Debian"
-
-- name: copy ceph-crush-location to osd host
- copy:
- src: ceph-crush-location.in
- dest: /usr/bin/ceph-crush-location
- mode: 0755
- when: ansible_os_family == "RedHat"
-
-- name: activate osd node
- shell: ceph-disk activate /var/local/osd
-
-- name: enable ceph service
- service: name=ceph enabled=yes
-
-- name: rebuild osd after reboot
- blockinfile:
- dest: /etc/init/ceph-osd-all-starter.conf
- insertafter: "^task"
- block: |
- pre-start script
- set -e
- /opt/setup_storage/losetup.sh
- sleep 3
- mount /dev/storage-volumes/ceph0 /var/local/osd
- end script
- when: ansible_os_family == "Debian"
-
-- name: rebuild osd after reboot for centos
- lineinfile:
- dest: /etc/init.d/ceph
- insertafter: "^### END INIT INFO"
- line: "\nsleep 1\nmount /dev/storage-volumes/ceph0 /var/local/osd"
- when: ansible_os_family == "RedHat"
+++ /dev/null
----
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
-- include: install_osd.yml
- when: inventory_hostname in groups["ceph_osd"]
- tags:
- - ceph_osd
- - ceph_deploy
+++ /dev/null
----
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
-- name: clear tmp files
- local_action: shell rm -rf /tmp/ceph*
- tags:
- - ceph_purge
- - ceph_deploy
-
-- name: install ceph-related packages
- action: "{{ ansible_pkg_mgr }} name={{ item }} state=present"
- with_items:
- - ceph-deploy
- tags:
- - ceph_purge
- - ceph_deploy
- when: ansible_os_family == "Debian"
-
-- name: purge ceph
- shell: |
- ceph-deploy purge {{ inventory_hostname }};
- ceph-deploy purgedata {{ inventory_hostname }};
- ceph-deploy forgetkeys
- tags:
- - ceph_purge
- - ceph_deploy
- when: ansible_os_family == "Debian"
-
-- name: remove monmap
- file: path="/tmp/monmap" state="absent"
- tags:
- - ceph_purge
- - ceph_deploy
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-- name: restart cinder control serveice
- service: name={{ item }} state=restarted enabled=yes
- with_items: "{{ services | union(services_noarch) }}"
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-- name: upload cinder conf
- template: src=cinder.conf dest=/etc/cinder/cinder.conf
-
-- name: sync cinder db
- shell: su -s /bin/sh -c 'cinder-manage db sync' cinder
- ignore_errors: true
- changed_when: true
- notify:
- - restart cinder control serveice
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-- name: disable auto start
- copy:
- content: "#!/bin/sh\nexit 101"
- dest: "/usr/sbin/policy-rc.d"
- mode: 0755
- when: ansible_os_family == "Debian"
-
-- name: install cinder packages
- action: "{{ ansible_pkg_mgr }} name={{ item }} state=present"
- with_items: "{{ packages | union(packages_noarch) }}"
-
-- name: enable auto start
- file:
- path=/usr/sbin/policy-rc.d
- state=absent
- when: ansible_os_family == "Debian"
-
-- name: generate common cinder service list
- lineinfile: dest=/opt/service create=yes line='{{ item }}'
- with_items: "{{ services | union(services_noarch) }}"
-
-- name: upload cinder conf
- template: src=cinder.conf dest=/etc/cinder/cinder.conf
- notify:
- - restart cinder control serveice
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-- include_vars: "{{ ansible_os_family }}.yml"
-
-- include: cinder_install.yml
- tags:
- - install
- - cinder-install
- - cinder
-
-- include: cinder_config.yml
- when: inventory_hostname == groups['controller'][0]
- tags:
- - config
- - cinder-config
- - cinder
-
-- meta: flush_handlers
+++ /dev/null
-#############
-# OpenStack #
-#############
-
-[composite:osapi_volume]
-use = call:cinder.api:root_app_factory
-/: apiversions
-/v1: openstack_volume_api_v1
-/v2: openstack_volume_api_v2
-
-[composite:openstack_volume_api_v1]
-use = call:cinder.api.middleware.auth:pipeline_factory
-noauth = request_id faultwrap sizelimit osprofiler noauth apiv1
-keystone = request_id faultwrap sizelimit osprofiler authtoken keystonecontext apiv1
-keystone_nolimit = request_id faultwrap sizelimit osprofiler authtoken keystonecontext apiv1
-
-[composite:openstack_volume_api_v2]
-use = call:cinder.api.middleware.auth:pipeline_factory
-noauth = request_id faultwrap sizelimit osprofiler noauth apiv2
-keystone = request_id faultwrap sizelimit osprofiler authtoken keystonecontext apiv2
-keystone_nolimit = request_id faultwrap sizelimit osprofiler authtoken keystonecontext apiv2
-
-[filter:request_id]
-paste.filter_factory = cinder.openstack.common.middleware.request_id:RequestIdMiddleware.factory
-
-[filter:faultwrap]
-paste.filter_factory = cinder.api.middleware.fault:FaultWrapper.factory
-
-[filter:osprofiler]
-paste.filter_factory = osprofiler.web:WsgiMiddleware.factory
-hmac_keys = SECRET_KEY
-enabled = yes
-
-[filter:noauth]
-paste.filter_factory = cinder.api.middleware.auth:NoAuthMiddleware.factory
-
-[filter:sizelimit]
-paste.filter_factory = cinder.api.middleware.sizelimit:RequestBodySizeLimiter.factory
-
-[app:apiv1]
-paste.app_factory = cinder.api.v1.router:APIRouter.factory
-
-[app:apiv2]
-paste.app_factory = cinder.api.v2.router:APIRouter.factory
-
-[pipeline:apiversions]
-pipeline = faultwrap osvolumeversionapp
-
-[app:osvolumeversionapp]
-paste.app_factory = cinder.api.versions:Versions.factory
-
-[filter:authtoken]
-paste.filter_factory = keystoneclient.middleware.auth_token:filter_factory
-# auth_host = 127.0.0.1
-# auth_port = 35357
-# auth_protocol = http
-auth_uri = http://{{ internal_vip.ip }}:5000/v2.0
-identity_uri = http://{{ internal_vip.ip }}:35357
-admin_tenant_name = service
-admin_user = cinder
-admin_password = {{ CINDER_PASS }}
-
-##########
-# Shared #
-##########
-
-[filter:keystonecontext]
-paste.filter_factory = cinder.api.middleware.auth:CinderKeystoneContext.factory
-
-[filter:authtoken]
-paste.filter_factory = keystonemiddleware.auth_token:filter_factory
+++ /dev/null
-{% set memcached_servers = [] %}
-{% for host in haproxy_hosts.values() %}
-{% set _ = memcached_servers.append('%s:11211'% host) %}
-{% endfor %}
-{% set memcached_servers = memcached_servers|join(',') %}
-
-[DEFAULT]
-rootwrap_config = /etc/cinder/rootwrap.conf
-api_paste_confg = /etc/cinder/api-paste.ini
-iscsi_helper = tgtadm
-volume_name_template = volume-%s
-volume_group = storage-volumes
-verbose = {{ VERBOSE }}
-debug = {{ DEBUG }}
-auth_strategy = keystone
-state_path = /var/lib/cinder
-lock_path = /var/lock/cinder
-notification_driver = cinder.openstack.common.notifier.rpc_notifier
-volumes_dir = /var/lib/cinder/volumes
-transport_url = rabbit://{{ RABBIT_USER }}:{{ RABBIT_PASS }}@{{ rabbit_host }}
-log_file = /var/log/cinder/cinder.log
-
-control_exchange = cinder
-rpc_backend = rabbit
-my_ip = {{ storage_controller_host }}
-
-glance_host = {{ internal_vip.ip }}
-glance_port = 9292
-api_rate_limit = False
-storage_availability_zone = nova
-
-quota_volumes = 10
-quota_gigabytes = 1000
-quota_driver = cinder.quota.DbQuotaDriver
-
-osapi_volume_listen = {{ storage_controller_host }}
-osapi_volume_listen_port = 8776
-osapi_volume_workers = {{ api_workers }}
-
-db_backend = sqlalchemy
-volume_name_template = volume-%s
-snapshot_name_template = snapshot-%s
-
-max_gigabytes = 10000
-
-volume_clear = zero
-volume_clear_size = 10
-
-iscsi_ip_address = {{ storage_controller_host }}
-iscsi_port = 3260
-iscsi_helper = tgtadm
-
-volumes_dir = /var/lib/cinder/volumes
-
-[database]
-connection = mysql://cinder:{{ CINDER_DBPASS }}@{{ db_host }}/cinder
-idle_timeout = 30
-
-[keystone_authtoken]
-auth_uri = http://{{ internal_vip.ip }}:5000
-auth_url = http://{{ internal_vip.ip }}:35357
-memcached_servers = {{ memcached_servers }}
-auth_type = password
-project_domain_name = default
-user_domain_name = default
-project_name = service
-username = cinder
-password = {{ CINDER_PASS }}
-
-identity_uri = http://{{ internal_vip.ip }}:35357
-admin_tenant_name = service
-admin_user = cinder
-admin_password = {{ CINDER_PASS }}
-
-[keymgr]
-encryption_auth_url=http://{{ internal_vip.ip }}:5000/v3
-
-[oslo_messaging_rabbit]
-rabbit_host = {{ rabbit_host }}
-rabbit_port = 5672
-rabbit_userid = {{ RABBIT_USER }}
-rabbit_password = {{ RABBIT_PASS }}
-
-[oslo_concurrency]
-lock_path = /var/lib/cinder/tmp
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-
-packages:
- - cinder-api
- - cinder-scheduler
-
-services:
- - cinder-api
- - cinder-scheduler
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-packages:
- - openstack-cinder
- - python-oslo-db
-
-services:
- - openstack-cinder-api
- - openstack-cinder-scheduler
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-packages_noarch:
- - python-cinderclient
-
-services_noarch: []
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-- name: restart cinder-volume services
- service: name={{ item }} state=restarted enabled=yes
- with_items: "{{ services | union(services_noarch) }}"
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-- include_vars: "{{ ansible_os_family }}.yml"
-
-- name: disable auto start
- copy:
- content: "#!/bin/sh\nexit 101"
- dest: "/usr/sbin/policy-rc.d"
- mode: 0755
- when: ansible_os_family == "Debian"
-
-- name: install cinder-volume and lvm2 packages
- action: "{{ ansible_pkg_mgr }} name={{ item }} state=present"
- with_items: "{{ packages | union(packages_noarch) }}"
-
-- name: enable auto start
- file:
- path=/usr/sbin/policy-rc.d
- state=absent
- when: ansible_os_family == "Debian"
-
-- name: generate cinder volume service list
- lineinfile: dest=/opt/service create=yes line='{{ item }}'
- with_items: "{{ services | union(services_noarch) }}"
-
-- name: upload cinder-volume configuration
- template: src=cinder.conf dest=/etc/cinder/cinder.conf backup=yes
- notify:
- - restart cinder-volume services
-
-- meta: flush_handlers
+++ /dev/null
-[DEFAULT]
-rootwrap_config = /etc/cinder/rootwrap.conf
-api_paste_confg = /etc/cinder/api-paste.ini
-iscsi_helper = tgtadm
-volume_name_template = volume-%s
-volume_group = storage-volumes
-verbose = True
-auth_strategy = keystone
-state_path = /var/lib/cinder
-lock_path = /var/lib/cinder/tmp
-notification_driver=cinder.openstack.common.notifier.rpc_notifier
-volumes_dir = /var/lib/cinder/volumes
-transport_url = rabbit://{{ RABBIT_USER }}:{{ RABBIT_PASS }}@{{ rabbit_host }}
-log_file=/var/log/cinder/cinder.log
-
-control_exchange = cinder
-rpc_backend = rabbit
-my_ip = {{ storage_controller_host }}
-
-enabled_backends = lvm
-
-glance_host = {{ internal_vip.ip }}
-glance_port = 9292
-glance_api_servers = http://{{ internal_vip.ip }}:9292
-api_rate_limit = False
-storage_availability_zone = nova
-
-quota_volumes = 10
-quota_gigabytes = 1000
-quota_driver = cinder.quota.DbQuotaDriver
-
-osapi_volume_listen = {{ storage_controller_host }}
-osapi_volume_listen_port = 8776
-
-db_backend = sqlalchemy
-volume_name_template = volume-%s
-snapshot_name_template = snapshot-%s
-
-max_gigabytes = 10000
-
-volume_clear = zero
-volume_clear_size = 10
-
-iscsi_ip_address = {{ storage_controller_host }}
-iscsi_port=3260
-iscsi_helper=tgtadm
-
-volumes_dir=/var/lib/cinder/volumes
-
-[database]
-connection = mysql://cinder:{{ CINDER_DBPASS }}@{{ db_host }}/cinder
-idle_timeout = 30
-
-[keystone_authtoken]
-auth_uri = http://{{ internal_vip.ip }}:5000
-auth_url = http://{{ internal_vip.ip }}:35357
-auth_type = password
-project_domain_name = default
-user_domain_name = default
-project_name = service
-username = cinder
-password = {{ CINDER_PASS }}
-
-identity_uri = http://{{ internal_vip.ip }}:35357
-admin_tenant_name = service
-admin_user = cinder
-admin_password = {{ CINDER_PASS }}
-
-[lvm]
-volume_driver = cinder.volume.drivers.lvm.LVMVolumeDriver
-volume_group = storage-volumes
-iscsi_protocol = iscsi
-iscsi_helper = tgtadm
-
-[oslo_concurrency]
-lock_path = /var/lib/cinder/tmp
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-packages:
- - cinder-volume
-
-services:
- - cinder-volume
- - tgt
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-packages:
- - openstack-cinder
- - targetcli
- - python-oslo-db
- - MySQL-python
- - lvm2
-
-services:
- - openstack-cinder-volume
- - lvm2-lvmetad
- - target
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-packages_noarch:
- - lvm2
-
-services_noarch: []
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-- include_vars: "{{ ansible_os_family }}.yml"
-
-- name: speed up ansible by purging landscape-common
- apt: pkg=landscape-common state=absent purge=yes
- when: ansible_os_family == "Debian"
-
-- name: update hosts files to all hosts
- template: src=hosts dest=/etc/hosts backup=yes
-
-- name: get compass-core hostname
- local_action: shell hostname
- register: name
-
-- name: get compass-core addr
- shell: awk -F'=' '/compass_server/ {print $2}' /etc/compass.conf
- register: COMPASS_SERVER
-
-- name: add yum repository for openstack
- template: src=openstack_ppa_repo.repo.j2 dest=/etc/yum.repos.d/openstack_ppa_repo.repo
- when: ansible_os_family == "RedHat"
-
-- name: update compass-core name and ip to hosts files
- shell: |
- echo "# compass" >> /etc/hosts;
- echo {{ COMPASS_SERVER.stdout_lines[0] }} {{ name.stdout_lines[0] }} \
- >> /etc/hosts;
-
-- name: install python-crypto
- yum: name=python-crypto state=present
- register: python_crypto_result
- ignore_errors: "yes"
- when: ansible_os_family == "RedHat"
-
-- name: remove python crypt egg file to work-around
- shell: rm -rf /usr/lib64/python2.7/site-packages/pycrypto-2.6.1-py2.7.egg-info
- when: ansible_os_family == "RedHat"
- and python_crypto_result.msg | match("Error unpack.*crypto-2.6.1-9.*")
-
-- name: install packages
- action: "{{ ansible_pkg_mgr }} name={{ item }} state=latest update_cache=yes"
- with_items: "{{ packages | union(packages_noarch) }}"
-
-- name: make config template dir exist
- file: path=/opt/os_templates state=directory mode=0755
-
-- name: create pip config directory
- file: path=~/.pip state=directory
-
-- name: update pip.conf
- template: src=pip.conf dest=~/.pip/{{ pip_conf }}
-
-- name: upgrade pip
- pip: name=pip state=latest
-
-- name: install pip packages
- pip: name={{ item }} state=present extra_args='--pre'
- with_items: "{{ pip_packages }}"
-
-- name: install keyczar for accelerate
- pip: name=python-keyczar state=present extra_args='--pre'
- delegate_to: 127.0.0.1
- run_once: true
-
-- name: update ntp conf
- template: src=ntp.conf dest=/etc/ntp.conf backup=yes
-
-- name: use ntpdate once for initial sync time
- shell: ntpdate {{ ntp_server }}
- ignore_errors: "True"
-
-- name: sync sys clock to hard clock
- shell: hwclock --systohc
- ignore_errors: "True"
-
-- name: create fireball keys dir
- file: path=~/.fireball.keys state=directory mode=0700
- delegate_to: 127.0.0.1
- run_once: true
-
-- name: restart services
- service: name={{ item }} state=restarted enabled=yes
- with_items: "{{ services| union(services_noarch) }}"
-
-- name: write services to monitor list
- lineinfile: dest=/opt/service create=yes line='{{ item }}'
- with_items: "{{ services| union(services_noarch) }}"
-
-- name: kill daemon for accelerate
- shell: lsof -ni :5099|grep LISTEN|awk '{print $2}'|xargs kill -9
- ignore_errors: true
-
-- meta: flush_handlers
+++ /dev/null
-# /etc/ntp.conf, configuration for ntpd; see ntp.conf(5) for help
-
-driftfile /var/lib/ntp/ntp.drift
-
-
-# Enable this if you want statistics to be logged.
-#statsdir /var/log/ntpstats/
-
-statistics loopstats peerstats clockstats
-filegen loopstats file loopstats type day enable
-filegen peerstats file peerstats type day enable
-filegen clockstats file clockstats type day enable
-
-# Specify one or more NTP servers.
-
-# Use servers from the NTP Pool Project. Approved by Ubuntu Technical Board
-# on 2011-02-08 (LP: #104525). See http://www.pool.ntp.org/join.html for
-# more information.
-server {{ ntp_server }}
-server {{ internal_vip.ip }}
-
-# Use local server as a fallback.
-server 127.127.1.0 # local clock
-fudge 127.127.1.0 stratum 10
-
-# Access control configuration; see /usr/share/doc/ntp-doc/html/accopt.html for
-# details. The web page <http://support.ntp.org/bin/view/Support/AccessRestrictions>
-# might also be helpful.
-#
-# Note that "restrict" applies to both servers and clients, so a configuration
-# that might be intended to block requests from certain clients could also end
-# up blocking replies from your own upstream servers.
-
-# By default, exchange time with everybody, but don't allow configuration.
-restrict -4 default kod notrap nomodify
-restrict -6 default kod notrap nomodify
-
-# Local users may interrogate the ntp server more closely.
-restrict 127.0.0.1
-restrict ::1
-
-# Clients from this (example!) subnet have unlimited access, but only if
-# cryptographically authenticated.
-#restrict 192.168.123.0 mask 255.255.255.0 notrust
-
-
-# If you want to provide time to your local subnet, change the next line.
-# (Again, the address is an example only.)
-#broadcast 192.168.123.255
-
-# If you want to listen to time broadcasts on your local subnet, de-comment the
-# next lines. Please do this only if you trust everybody on the network!
-#disable auth
-#broadcastclient
+++ /dev/null
-[openstack_ppa_repo]
-name=openstack - openstack_repo
-proxy=_none_
-baseurl=http://{{ COMPASS_SERVER.stdout_lines[0] }}/cblr/repo_mirror/centos7-newton-ppa
-enabled=1
-gpgcheck=0
-skip_if_unavailable=1
+++ /dev/null
-[global]
-find-links = http://{{ COMPASS_SERVER.stdout_lines[0] }}/pip-openstack
-no-index = true
-[install]
-trusted-host={{ COMPASS_SERVER.stdout_lines[0] }}
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-packages:
- - ubuntu-cloud-keyring
- - python-dev
- - openvswitch-switch
- - openvswitch-switch-dpdk
- - python-memcache
- - python-iniparse
- - python-lxml
- - python-crypto
-
-pip_packages:
- - crudini
- - python-keyczar
- - yang2tosca
-
-pip_conf: pip.conf
-
-services:
- - ntp
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-packages:
- - openvswitch
- - python-devel
- - python-memcached
- - gcc
- - redhat-lsb-core
- - python-crypto
- - wget
- - yum-plugin-priorities
- - vim
- - lsof
- - strace
- - net-tools
-
-pip_packages:
- - crudini
- - python-keyczar
-
-pip_conf: pip.conf
-
-services:
- - openvswitch
- - ntpd
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-packages_noarch:
- - python-pip
- - ntp
-
-services_noarch: []
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-- name: Register RECOVERY
- set_fact: RECOVERY_ENV={{RECOVERY_ENV | default('False')}}
- tags:
- - recovery
-
-- include_vars: "{{ ansible_os_family }}.yml"
- when: RECOVERY_ENV
- tags:
- - recovery
-
-- name: restart compute services
- service: name={{ item }} state=restarted enabled=yes
- with_items: "{{ compute_services | union(compute_services_noarch) }}"
- when: RECOVERY_ENV
- tags:
- - recovery
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-compute_services:
- - nova-compute
- - neutron-openvswitch-agent
- - cinder-volume
- - ceilometer-agent-compute
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-compute_services:
- - openstack-nova-compute
- - neutron-openvswitch-agent
- - openstack-cinder-volume
- - openstack-ceilometer-compute
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-compute_services_noarch: []
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-- name: restart congress services
- service: name={{ item }} state=restarted enabled=yes
- with_items: "{{ services | union(services_noarch) }}"
+++ /dev/null
-#############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-- name: create congress db
- mysql_db:
- login_unix_socket: /var/run/mysqld/mysqld.sock
- name: "{{ item.db }}"
- state: present
- with_items: "{{ congress_database }}"
-
-- name: create congress db user
- mysql_user:
- login_unix_socket: /var/run/mysqld/mysqld.sock
- name: "{{ item[0].user }}"
- password: "{{ item[0].password }}"
- priv: "*.*:ALL,GRANT"
- host: "{{ item[1] }}"
- state: present
- with_nested:
- - "{{ congress_database }}"
- - ['%', 'localhost']
-
-- name: congress db sync
- shell: |
- "{{ congress_path }}"/congress-db-manage \
- --config-file /etc/congress/congress.conf upgrade head
- notify:
- - restart congress services
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-- name: install congress packages
- pip: name={{ item }} state=present
- with_items: "{{ pip_packages | union(packages_noarch) }}"
-
-- name: create congress etc directory
- file: path=/etc/congress state=directory
-
-- name: update congress conf
- template: src={{ item }} dest=/etc/congress/{{ item }}
- backup=yes
- with_items:
- - congress.conf
- - api-paste.ini
- - policy.json
- notify:
- - restart congress services
-
-- name: create congress service
- template: src=congress.service dest=/lib/systemd/system/
- notify:
- - restart congress services
-
-- name: create congress service work dir
- file: path=/var/lib/congress state=directory
-
-- name: link the congress service
- file:
- src: /lib/systemd/system/congress.service
- dest: /etc/systemd/system/multi-user.target.wants/congress.service
- state: link
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-###############################################################################
----
-- name: add service
- os_keystone_service:
- cloud: opnfv
- name: "{{ item.name }}"
- description: "{{ item.description }}"
- service_type: "{{ item.type }}"
- with_items: "{{ congress_service }}"
-
-- name: add user
- os_user:
- cloud: opnfv
- domain: default
- name: "{{ item.user }}"
- password: "{{ item.password }}"
- default_project: "{{ item.tenant }}"
- email: "{{ item.email }}"
- with_items: "{{ congress_user }}"
-
-- name: grant roles
- os_user_role:
- cloud: opnfv
- user: "{{ item.user }}"
- role: "{{ item.role }}"
- project: "{{ item.tenant }}"
- with_items: "{{ congress_user }}"
-
-- name: create admin url for service's endpoint
- keystone_endpoint:
- cloud: opnfv
- endpoint_type: admin
- name: "{{ item.name }}"
- service_type: "{{ item.type }}"
- state: present
- interface: admin
- region: "{{ item.region}}"
- url: "{{ item.adminurl }}"
- with_items: "{{ congress_service }}"
-
-- name: create internal url for service's endpoint
- keystone_endpoint:
- cloud: opnfv
- endpoint_type: admin
- name: "{{ item.name }}"
- service_type: "{{ item.type }}"
- state: present
- interface: internal
- region: "{{ item.region}}"
- url: "{{ item.internalurl }}"
- with_items: "{{ congress_service }}"
-
-- name: create public url for service'e endpoint
- keystone_endpoint:
- cloud: opnfv
- endpoint_type: admin
- name: "{{ item.name }}"
- service_type: "{{ item.type }}"
- state: present
- interface: public
- region: "{{ item.region}}"
- url: "{{ item.publicurl }}"
- with_items: "{{ congress_service }}"
+++ /dev/null
-##############################################################################
-## Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-##
-## All rights reserved. This program and the accompanying materials
-## are made available under the terms of the Apache License, Version 2.0
-## which accompanies this distribution, and is available at
-## http://www.apache.org/licenses/LICENSE-2.0
-###############################################################################
----
-- name: start congress services
- service: name={{ item }} state=started enabled=yes
- with_items: "{{ services | union(services_noarch) }}"
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-- include_vars: "{{ ansible_os_family }}.yml"
- tags:
- - install
- - start
-
-- include: congress_install.yml
- tags:
- - install
-
-- include: congress_keystone.yml
- when:
- - inventory_hostname == haproxy_hosts.keys()[0]
- tags:
- - keystone
-
-- include: congress_database.yml
- when:
- - inventory_hostname == haproxy_hosts.keys()[0]
- tags:
- - database
-
-- include: congress_start.yml
- tags:
- - start
-
-- meta: flush_handlers
- tags:
- - install
- - keystone
- - database
+++ /dev/null
-[composite:congress]
-use = egg:Paste#urlmap
-/: congressversions
-/v1: congress_api_v1
-
-[pipeline:congressversions]
-pipeline = cors catch_errors congressversionapp
-
-[app:congressversionapp]
-paste.app_factory = congress.api.versions:Versions.factory
-
-[composite:congress_api_v1]
-use = call:congress.auth:pipeline_factory
-keystone = cors request_id catch_errors authtoken keystonecontext congress_api
-noauth = cors request_id catch_errors congress_api
-
-[app:congress_api]
-paste.app_factory = congress.service:congress_app_factory
-
-[filter:request_id]
-paste.filter_factory = oslo_middleware:RequestId.factory
-
-[filter:catch_errors]
-paste.filter_factory = oslo_middleware:CatchErrors.factory
-
-[filter:keystonecontext]
-paste.filter_factory = congress.auth:CongressKeystoneContext.factory
-
-[filter:authtoken]
-paste.filter_factory = keystonemiddleware.auth_token:filter_factory
-
-[filter:cors]
-paste.filter_factory = oslo_middleware.cors:filter_factory
-oslo_config_project = congress
+++ /dev/null
-{% set memcached_servers = [] %}
-{% set rabbitmq_servers = [] %}
-{% for host in haproxy_hosts.values() %}
-{% set _ = memcached_servers.append('%s:11211'% host) %}
-{% set _ = rabbitmq_servers.append('%s:5672'% host) %}
-{% endfor %}
-{% set memcached_servers = memcached_servers|join(',') %}
-{% set rabbitmq_servers = rabbitmq_servers|join(',') %}
-[DEFAULT]
-
-#
-# From congress
-#
-# The host IP to bind to (string tmq_serversvalue)
-bind_host = {{ internal_ip }}
-
-# The port to bind to (port value)
-# Minimum value: 0
-# Maximum value: 65535
-bind_port = 1789
-
-# Thread pool size for eventlet. (integer value)
-#max_simultaneous_requests = 1024
-
-# Set this to true to enable TCP_KEEALIVE socket option on connections received
-# by the API server. (boolean value)
-#tcp_keepalive = false
-
-# Sets the value of TCP_KEEPIDLE in seconds for each server socket. Only
-# applies if tcp_keepalive is true. Not supported on OS X. (integer value)
-#tcp_keepidle = 600
-
-# The path to the latest policy dump (string value)
-policy_path = /etc/congress/policy.json
-
-# The file containing datasource configuration (string value)
-#datasource_file = <None>
-
-# The absolute path to the congress repo (string value)
-#root_path = <None>
-
-# The number of worker processes to serve the congress API application.
-# (integer value)
-#api_workers = 1
-
-# The API paste config file to use (string value)
-#api_paste_config = api-paste.ini
-
-# The type of authentication to use (string value)
-auth_strategy = keystone
-
-# List of driver class paths to import. (list value)
-drivers = congress.datasources.neutronv2_driver.NeutronV2Driver,congress.datasources.glancev2_driver.GlanceV2Driver,congress.datasources.nova_driver.NovaDriver,congress.datasources.keystone_driver.KeystoneDriver,congress.datasources.ceilometer_driver.CeilometerDriver,congress.datasources.cinder_driver.CinderDriver,congress.datasources.swift_driver.SwiftDriver,congress.datasources.plexxi_driver.PlexxiDriver,congress.datasources.vCenter_driver.VCenterDriver,congress.datasources.cloudfoundryv2_driver.CloudFoundryV2Driver,congress.datasources.murano_driver.MuranoDriver,congress.datasources.ironic_driver.IronicDriver
-
-
-# The number of seconds to wait between synchronizing datasource config from
-# the database (integer value)
-#datasource_sync_period = 0
-
-# Sets the flag to False if you don't want the congress to execute actions.
-# (boolean value)
-#enable_execute_action = true
-
-# The flag to use congress new distributed architecture.Don't set it to True in
-# L release since the new architecture is under implementation. (boolean value)
-#distributed_architecture = false
-
-# Explicitly specify the temporary working directory (string value)
-#tempdir = <None>
-
-# Make exception message format errors fatal (boolean value)
-#fatal_exception_format_errors = false
-
-#
-# From oslo.log
-#
-
-# If set to true, the logging level will be set to DEBUG instead of the default
-# INFO level. (boolean value)
-# Note: This option can be changed without restarting.
-debug = True
-
-# DEPRECATED: If set to false, the logging level will be set to WARNING instead
-# of the default INFO level. (boolean value)
-# This option is deprecated for removal.
-# Its value may be silently ignored in the future.
-#verbose = true
-
-# The name of a logging configuration file. This file is appended to any
-# existing logging configuration files. For details about logging configuration
-# files, see the Python logging module documentation. Note that when logging
-# configuration files are used then all logging configuration is set in the
-# configuration file and other logging configuration options are ignored (for
-# example, logging_context_format_string). (string value)
-# Note: This option can be changed without restarting.
-# Deprecated group/name - [DEFAULT]/log_config
-#log_config_append = <None>
-
-# Defines the format string for %%(asctime)s in log records. Default:
-# %(default)s . This option is ignored if log_config_append is set. (string
-# value)
-#log_date_format = %Y-%m-%d %H:%M:%S
-
-# (Optional) Name of log file to send logging output to. If no default is set,
-# logging will go to stderr as defined by use_stderr. This option is ignored if
-# log_config_append is set. (string value)
-# Deprecated group/name - [DEFAULT]/logfile
-log_file = congress.log
-
-# (Optional) The base directory used for relative log_file paths. This option
-# is ignored if log_config_append is set. (string value)
-# Deprecated group/name - [DEFAULT]/logdir
-log_dir = /var/log/congress
-
-# Uses logging handler designed to watch file system. When log file is moved or
-# removed this handler will open a new log file with specified path
-# instantaneously. It makes sense only if log_file option is specified and
-# Linux platform is used. This option is ignored if log_config_append is set.
-# (boolean value)
-#watch_log_file = false
-
-# Use syslog for logging. Existing syslog format is DEPRECATED and will be
-# changed later to honor RFC5424. This option is ignored if log_config_append
-# is set. (boolean value)
-#use_syslog = false
-
-# Syslog facility to receive log lines. This option is ignored if
-# log_config_append is set. (string value)
-#syslog_log_facility = LOG_USER
-
-# Log output to standard error. This option is ignored if log_config_append is
-# set. (boolean value)
-#use_stderr = true
-
-# Format string to use for log messages with context. (string value)
-#logging_context_format_string = %(asctime)s.%(msecs)03d %(process)d %(levelname)s %(name)s [%(request_id)s %(user_identity)s] %(instance)s%(message)s
-
-# Format string to use for log messages when context is undefined. (string
-# value)
-#logging_default_format_string = %(asctime)s.%(msecs)03d %(process)d %(levelname)s %(name)s [-] %(instance)s%(message)s
-
-# Additional data to append to log message when logging level for the message
-# is DEBUG. (string value)
-#logging_debug_format_suffix = %(funcName)s %(pathname)s:%(lineno)d
-
-# Prefix each line of exception output with this format. (string value)
-#logging_exception_prefix = %(asctime)s.%(msecs)03d %(process)d ERROR %(name)s %(instance)s
-
-# Defines the format string for %(user_identity)s that is used in
-# logging_context_format_string. (string value)
-#logging_user_identity_format = %(user)s %(tenant)s %(domain)s %(user_domain)s %(project_domain)s
-
-# List of package logging levels in logger=LEVEL pairs. This option is ignored
-# if log_config_append is set. (list value)
-#default_log_levels = amqp=WARN,amqplib=WARN,boto=WARN,qpid=WARN,sqlalchemy=WARN,suds=INFO,oslo.messaging=INFO,iso8601=WARN,requests.packages.urllib3.connectionpool=WARN,urllib3.connectionpool=WARN,websocket=WARN,requests.packages.urllib3.util.retry=WARN,urllib3.util.retry=WARN,keystonemiddleware=WARN,routes.middleware=WARN,stevedore=WARN,taskflow=WARN,keystoneauth=WARN,oslo.cache=INFO,dogpile.core.dogpile=INFO
-
-# Enables or disables publication of error events. (boolean value)
-#publish_errors = false
-
-# The format for an instance that is passed with the log message. (string
-# value)
-#instance_format = "[instance: %(uuid)s] "
-
-# The format for an instance UUID that is passed with the log message. (string
-# value)
-#instance_uuid_format = "[instance: %(uuid)s] "
-
-# Enables or disables fatal status of deprecations. (boolean value)
-#fatal_deprecations = false
-
-
-[cors]
-
-#
-# From oslo.middleware.cors
-#
-
-# Indicate whether this resource may be shared with the domain received in the
-# requests "origin" header. Format: "<protocol>://<host>[:<port>]", no trailing
-# slash. Example: https://horizon.example.com (list value)
-#allowed_origin = <None>
-
-# Indicate that the actual request can include user credentials (boolean value)
-#allow_credentials = true
-
-# Indicate which headers are safe to expose to the API. Defaults to HTTP Simple
-# Headers. (list value)
-#expose_headers = X-Auth-Token,X-OpenStack-Request-ID,X-Subject-Token,X-Service-Token
-
-# Maximum cache age of CORS preflight requests. (integer value)
-#max_age = 3600
-
-# Indicate which methods can be used during the actual request. (list value)
-#allow_methods = GET,PUT,POST,DELETE,PATCH
-
-# Indicate which header field names may be used during the actual request.
-# (list value)
-#allow_headers = X-Auth-Token,X-OpenStack-Request-ID,X-Identity-Status,X-Roles,X-Service-Catalog,X-User-Id,X-Tenant-Id
-
-
-[cors.subdomain]
-
-#
-# From oslo.middleware.cors
-#
-
-# Indicate whether this resource may be shared with the domain received in the
-# requests "origin" header. Format: "<protocol>://<host>[:<port>]", no trailing
-# slash. Example: https://horizon.example.com (list value)
-#allowed_origin = <None>
-
-# Indicate that the actual request can include user credentials (boolean value)
-#allow_credentials = true
-
-# Indicate which headers are safe to expose to the API. Defaults to HTTP Simple
-# Headers. (list value)
-#expose_headers = X-Auth-Token,X-OpenStack-Request-ID,X-Subject-Token,X-Service-Token
-
-# Maximum cache age of CORS preflight requests. (integer value)
-#max_age = 3600
-
-# Indicate which methods can be used during the actual request. (list value)
-#allow_methods = GET,PUT,POST,DELETE,PATCH
-
-# Indicate which header field names may be used during the actual request.
-# (list value)
-#allow_headers = X-Auth-Token,X-OpenStack-Request-ID,X-Identity-Status,X-Roles,X-Service-Catalog,X-User-Id,X-Tenant-Id
-
-
-[database]
-
-#
-# From oslo.db
-#
-
-# DEPRECATED: The file name to use with SQLite. (string value)
-# Deprecated group/name - [DEFAULT]/sqlite_db
-# This option is deprecated for removal.
-# Its value may be silently ignored in the future.
-# Reason: Should use config option connection or slave_connection to connect
-# the database.
-#sqlite_db = oslo.sqlite
-
-# If True, SQLite uses synchronous mode. (boolean value)
-# Deprecated group/name - [DEFAULT]/sqlite_synchronous
-#sqlite_synchronous = true
-
-# The back end to use for the database. (string value)
-# Deprecated group/name - [DEFAULT]/db_backend
-#backend = sqlalchemy
-
-# The SQLAlchemy connection string to use to connect to the database. (string
-# value)
-# Deprecated group/name - [DEFAULT]/sql_connection
-# Deprecated group/name - [DATABASE]/sql_connection
-# Deprecated group/name - [sql]/connection
-connection = mysql+pymysql://congress:{{ CONGRESS_DBPASS }}@{{ db_host }}/congress
-
-# The SQLAlchemy connection string to use to connect to the slave database.
-# (string value)
-#slave_connection = <None>
-
-# The SQL mode to be used for MySQL sessions. This option, including the
-# default, overrides any server-set SQL mode. To use whatever SQL mode is set
-# by the server configuration, set this to no value. Example: mysql_sql_mode=
-# (string value)
-#mysql_sql_mode = TRADITIONAL
-
-# Timeout before idle SQL connections are reaped. (integer value)
-# Deprecated group/name - [DEFAULT]/sql_idle_timeout
-# Deprecated group/name - [DATABASE]/sql_idle_timeout
-# Deprecated group/name - [sql]/idle_timeout
-#idle_timeout = 3600
-
-# Minimum number of SQL connections to keep open in a pool. (integer value)
-# Deprecated group/name - [DEFAULT]/sql_min_pool_size
-# Deprecated group/name - [DATABASE]/sql_min_pool_size
-#min_pool_size = 1
-
-# Maximum number of SQL connections to keep open in a pool. Setting a value of
-# 0 indicates no limit. (integer value)
-# Deprecated group/name - [DEFAULT]/sql_max_pool_size
-# Deprecated group/name - [DATABASE]/sql_max_pool_size
-#max_pool_size = 5
-
-# Maximum number of database connection retries during startup. Set to -1 to
-# specify an infinite retry count. (integer value)
-# Deprecated group/name - [DEFAULT]/sql_max_retries
-# Deprecated group/name - [DATABASE]/sql_max_retries
-#max_retries = 10
-
-# Interval between retries of opening a SQL connection. (integer value)
-# Deprecated group/name - [DEFAULT]/sql_retry_interval
-# Deprecated group/name - [DATABASE]/reconnect_interval
-#retry_interval = 10
-
-# If set, use this value for max_overflow with SQLAlchemy. (integer value)
-# Deprecated group/name - [DEFAULT]/sql_max_overflow
-# Deprecated group/name - [DATABASE]/sqlalchemy_max_overflow
-#max_overflow = 50
-
-# Verbosity of SQL debugging information: 0=None, 100=Everything. (integer
-# value)
-# Minimum value: 0
-# Maximum value: 100
-# Deprecated group/name - [DEFAULT]/sql_connection_debug
-#connection_debug = 0
-
-# Add Python stack traces to SQL as comment strings. (boolean value)
-# Deprecated group/name - [DEFAULT]/sql_connection_trace
-#connection_trace = false
-
-# If set, use this value for pool_timeout with SQLAlchemy. (integer value)
-# Deprecated group/name - [DATABASE]/sqlalchemy_pool_timeout
-#pool_timeout = <None>
-
-# Enable the experimental use of database reconnect on connection lost.
-# (boolean value)
-#use_db_reconnect = false
-
-# Seconds between retries of a database transaction. (integer value)
-#db_retry_interval = 1
-
-# If True, increases the interval between retries of a database operation up to
-# db_max_retry_interval. (boolean value)
-#db_inc_retry_interval = true
-
-# If db_inc_retry_interval is set, the maximum seconds between retries of a
-# database operation. (integer value)
-#db_max_retry_interval = 10
-
-# Maximum retries in case of connection error or deadlock error before error is
-# raised. Set to -1 to specify an infinite retry count. (integer value)
-#db_max_retries = 20
-
-
-[keystone_authtoken]
-
-#
-# From keystonemiddleware.auth_token
-#
-
-# Complete "public" Identity API endpoint. This endpoint should not be an
-# "admin" endpoint, as it should be accessible by all end users.
-# Unauthenticated clients are redirected to this endpoint to authenticate.
-# Although this endpoint should ideally be unversioned, client support in the
-# wild varies. If you're using a versioned v2 endpoint here, then this should
-# *not* be the same endpoint the service user utilizes for validating tokens,
-# because normal end users may not be able to reach that endpoint. (string
-# value)
-auth_uri = http://{{ internal_vip.ip }}:5000
-auth_url = http://{{ internal_vip.ip }}:35357
-memcached_servers = {{ memcached_servers }}
-project_name = service
-password = {{ CONGRESS_PASS }}
-username = congress
-auth_type = password
-# API version of the admin Identity API endpoint. (string value)
-
-# Do not handle authorization requests within the middleware, but delegate the
-# authorization decision to downstream WSGI components. (boolean value)
-#delay_auth_decision = false
-
-# Request timeout value for communicating with Identity API server. (integer
-# value)
-#http_connect_timeout = <None>
-
-# How many times are we trying to reconnect when communicating with Identity
-# API Server. (integer value)
-#http_request_max_retries = 3
-
-# Request environment key where the Swift cache object is stored. When
-# auth_token middleware is deployed with a Swift cache, use this option to have
-# the middleware share a caching backend with swift. Otherwise, use the
-# ``memcached_servers`` option instead. (string value)
-#cache = <None>
-
-# Required if identity server requires client certificate (string value)
-#certfile = <None>
-
-# Required if identity server requires client certificate (string value)
-#keyfile = <None>
-
-# A PEM encoded Certificate Authority to use when verifying HTTPs connections.
-# Defaults to system CAs. (string value)
-#cafile = <None>
-
-# Verify HTTPS connections. (boolean value)
-#insecure = false
-
-# The region in which the identity server can be found. (string value)
-#region_name = <None>
-
-# Directory used to cache files related to PKI tokens. (string value)
-#signing_dir = <None>
-
-# Optionally specify a list of memcached server(s) to use for caching. If left
-# undefined, tokens will instead be cached in-process. (list value)
-# Deprecated group/name - [keystone_authtoken]/memcache_servers
-#memcached_servers = <None>
-
-# In order to prevent excessive effort spent validating tokens, the middleware
-# caches previously-seen tokens for a configurable duration (in seconds). Set
-# to -1 to disable caching completely. (integer value)
-#token_cache_time = 300
-
-# Determines the frequency at which the list of revoked tokens is retrieved
-# from the Identity service (in seconds). A high number of revocation events
-# combined with a low cache duration may significantly reduce performance. Only
-# valid for PKI tokens. (integer value)
-#revocation_cache_time = 10
-
-# (Optional) If defined, indicate whether token data should be authenticated or
-# authenticated and encrypted. If MAC, token data is authenticated (with HMAC)
-# in the cache. If ENCRYPT, token data is encrypted and authenticated in the
-# cache. If the value is not one of these options or empty, auth_token will
-# raise an exception on initialization. (string value)
-# Allowed values: None, MAC, ENCRYPT
-#memcache_security_strategy = None
-
-# (Optional, mandatory if memcache_security_strategy is defined) This string is
-# used for key derivation. (string value)
-#memcache_secret_key = <None>
-
-# (Optional) Number of seconds memcached server is considered dead before it is
-# tried again. (integer value)
-#memcache_pool_dead_retry = 300
-
-# (Optional) Maximum total number of open connections to every memcached
-# server. (integer value)
-#memcache_pool_maxsize = 10
-
-# (Optional) Socket timeout in seconds for communicating with a memcached
-# server. (integer value)
-#memcache_pool_socket_timeout = 3
-
-# (Optional) Number of seconds a connection to memcached is held unused in the
-# pool before it is closed. (integer value)
-#memcache_pool_unused_timeout = 60
-
-# (Optional) Number of seconds that an operation will wait to get a memcached
-# client connection from the pool. (integer value)
-#memcache_pool_conn_get_timeout = 10
-
-# (Optional) Use the advanced (eventlet safe) memcached client pool. The
-# advanced pool will only work under python 2.x. (boolean value)
-#memcache_use_advanced_pool = false
-
-# (Optional) Indicate whether to set the X-Service-Catalog header. If False,
-# middleware will not ask for service catalog on token validation and will not
-# set the X-Service-Catalog header. (boolean value)
-#include_service_catalog = true
-
-# Used to control the use and type of token binding. Can be set to: "disabled"
-# to not check token binding. "permissive" (default) to validate binding
-# information if the bind type is of a form known to the server and ignore it
-# if not. "strict" like "permissive" but if the bind type is unknown the token
-# will be rejected. "required" any form of token binding is needed to be
-# allowed. Finally the name of a binding method that must be present in tokens.
-# (string value)
-#enforce_token_bind = permissive
-
-# If true, the revocation list will be checked for cached tokens. This requires
-# that PKI tokens are configured on the identity server. (boolean value)
-#check_revocations_for_cached = false
-
-# Hash algorithms to use for hashing PKI tokens. This may be a single algorithm
-# or multiple. The algorithms are those supported by Python standard
-# hashlib.new(). The hashes will be tried in the order given, so put the
-# preferred one first for performance. The result of the first hash will be
-# stored in the cache. This will typically be set to multiple values only while
-# migrating from a less secure algorithm to a more secure one. Once all the old
-# tokens are expired this option should be set to a single value for better
-# performance. (list value)
-#hash_algorithms = md5
-
-# Authentication type to load (string value)
-# Deprecated group/name - [keystone_authtoken]/auth_plugin
-#auth_type = <None>
-
-# Config Section from which to load plugin specific options (string value)
-#auth_section = <None>
-
-
-[oslo_policy]
-
-#
-# From oslo.policy
-#
-
-# The JSON file that defines policies. (string value)
-# Deprecated group/name - [DEFAULT]/policy_file
-#policy_file = policy.json
-
-# Default rule. Enforced when a requested rule is not found. (string value)
-# Deprecated group/name - [DEFAULT]/policy_default_rule
-#policy_default_rule = default
-
-# Directories where policy configuration files are stored. They can be relative
-# to any directory in the search path defined by the config_dir option, or
-# absolute paths. The file defined by policy_file must exist for these
-# directories to be searched. Missing or empty directories are ignored. (multi
-# valued)
-# Deprecated group/name - [DEFAULT]/policy_dirs
-#policy_dirs = policy.d
-
-[oslo_messaging_rabbit]
-rabbit_userid = {{ RABBIT_USER }}
-rabbit_password = {{ RABBIT_PASS }}
-rabbit_hosts = {{ rabbitmq_servers }}
+++ /dev/null
-[Unit]
-Description=OpenStack Congress server
-After=
-
-[Service]
-User=root
-Group=root
-Type=simple
-WorkingDirectory=/var/lib/congress
-PermissionsStartOnly=true
-ExecStartPre=/bin/mkdir -p /var/lock/congress /var/log/congress /var/lib/congress
-ExecStartPre=/usr/bin/touch /var/log/congress/congress.log
-ExecStart={{ congress_path }}/congress-server --config-file /etc/congress/congress.conf
-Restart=on-failure
-LimitNOFILE=65535
-TimeoutStopSec=15
-
-[Install]
-WantedBy=multi-user.target
+++ /dev/null
-{
- "context_is_admin": "role:admin",
- "admin_only": "rule:context_is_admin",
- "regular_user": "",
- "default": "rule:admin_only"
-}
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-pip_packages:
- - congress
- - python-congressclient
- - python-cloudfoundryclient
-
-services:
- - congress
-
-congress_path: /usr/local/bin
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-pip_packages:
- - congress
- - python-congressclient
- - python-cloudfoundryclient
-
-services:
- - congress
-
-congress_path: /usr/bin
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-packages_noarch: []
-
-services_noarch: []
-
-congress_service:
- - name: congress
- type: policy
- region: RegionOne
- description: "OpenStack Policy Service"
- publicurl: "http://{{ public_vip.ip }}:1789"
- internalurl: "http://{{ internal_vip.ip }}:1789"
- adminurl: "http://{{ internal_vip.ip }}:1789"
-
-congress_user:
- - user: congress
- password: "{{ CONGRESS_PASS }}"
- email: congress@admin.com
- role: admin
- tenant: service
- tenant_description: "Service Tenant"
-
-congress_database:
- - user: congress
- db: congress
- password: "{{ CONGRESS_DBPASS }}"
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-- name: Register RECOVERY
- set_fact: RECOVERY_ENV={{RECOVERY_ENV | default('False')}}
- tags:
- - recovery
-
-- include_vars: "{{ ansible_os_family }}.yml"
- when: RECOVERY_ENV
- tags:
- - recovery
-
-- name: restart controller services
- service: name={{ item }} state=restarted enabled=yes
- with_items: "{{ controller_services | union(controller_services_noarch) }}"
- when: RECOVERY_ENV
- tags:
- - recovery
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-controller_services:
- - keepalived
- - apache2
- - nova-api
- - nova-cert
- - nova-conductor
- - nova-consoleauth
- - nova-novncproxy
- - nova-scheduler
- - neutron-server
- - cinder-api
- - cinder-scheduler
- - glance-registry
- - glance-api
- - openvswitch-switch
- - neutron-openvswitch-agent
- - neutron-l3-agent
- - neutron-dhcp-agent
- - neutron-metadata-agent
- - ceilometer-agent-central
- - ceilometer-agent-notification
- - ceilometer-api
- - ceilometer-collector
- - heat-api
- - heat-api-cfn
- - heat-engine
- - aodh-api
- - aodh-notifier
- - aodh-evaluator
- - aodh-listener
- - cron
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-controller_services:
- - keepalived
- - httpd
- - openstack-nova-api
- - openstack-nova-cert
- - openstack-nova-conductor
- - openstack-nova-consoleauth
- - openstack-nova-novncproxy
- - openstack-nova-scheduler
- - neutron-server
- - openstack-cinder-api
- - openstack-cinder-scheduler
- - openstack-glance-api
- - openstack-glance-registry
- - neutron-openvswitch-agent
- - neutron-l3-agent
- - neutron-dhcp-agent
- - neutron-metadata-agent
- - openstack-ceilometer-central
- - openstack-ceilometer-notification
- - openstack-ceilometer-api
- - openstack-ceilometer-collector
- - openstack-heat-api
- - openstack-heat-api-cfn
- - openstack-heat-engine
- - openstack-aodh-api
- - openstack-aodh-notifier
- - openstack-aodh-evaluator
- - openstack-aodh-listener
- - cron
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-controller_services_noarch: []
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-- name: restart dashboard services
- service: name={{ item }} state=restarted enabled=yes
- with_items: "{{ services | union(services_noarch) }}"
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-- include_vars: "{{ ansible_os_family }}.yml"
- tags:
- - horizon_theme
-
-- name: disable auto start
- copy:
- content: "#!/bin/sh\nexit 101"
- dest: "/usr/sbin/policy-rc.d"
- mode: 0755
- when: ansible_os_family == "Debian"
-
-- name: install dashboard packages
- action: "{{ ansible_pkg_mgr }} name={{ item }} state=present"
- with_items: "{{ packages | union(packages_noarch) }}"
-
-- name: enable auto start
- file:
- path=/usr/sbin/policy-rc.d
- state=absent
- when: ansible_os_family == "Debian"
-
-- name: remove default apache2 config
- file:
- path: '{{ item }}'
- state: absent
- when: ansible_os_family == 'Debian'
- with_items:
- - '{{ apache_config_dir }}/conf-available/openstack-dashboard.conf'
- - '{{ apache_config_dir }}/conf-enabled/openstack-dashboard.conf'
- - '{{ apache_config_dir }}/sites-available/000-default.conf'
- - '{{ apache_config_dir }}/sites-enabled/000-default.conf'
- notify:
- - restart dashboard services
-
-- name: update apache2 configs
- template:
- src: openstack-dashboard.conf.j2
- dest: '{{ apache_config_dir }}/sites-available/openstack-dashboard.conf'
- when: ansible_os_family == 'Debian'
- notify:
- - restart dashboard services
-
-- name: update apache2 configs redhat
- template:
- src: openstack-dashboard-redhat.conf.j2
- dest: '{{ apache_config_dir }}/conf.d/openstack-dashboard.conf'
- when: ansible_os_family == 'RedHat'
- notify:
- - restart dashboard services
-
-- name: enable dashboard
- file:
- src: "/etc/apache2/sites-available/openstack-dashboard.conf"
- dest: "/etc/apache2/sites-enabled/openstack-dashboard.conf"
- state: "link"
- when: ansible_os_family == 'Debian'
- notify:
- - restart dashboard services
-
-- name: update ubuntu horizon settings
- template:
- src: local_settings.py.j2
- dest: "/etc/openstack-dashboard/local_settings.py"
- when: ansible_os_family == 'Debian'
- notify:
- - restart dashboard services
- tags:
- - horizon_theme
-
-- name: precompile horizon css
- shell: |
- /usr/bin/python /usr/share/openstack-dashboard/manage.py compress --force
- ignore_errors: "True"
- when: ansible_os_family == 'Debian'
- notify:
- - restart dashboard services
-
-- name: update redhat version horizon settings
- lineinfile:
- dest: /etc/openstack-dashboard/local_settings
- regexp: '{{ item.regexp }}'
- line: '{{ item.line }}'
- with_items:
- - regexp: '^WEBROOT[ \t]*=.*'
- line: 'WEBROOT = "/horizon"'
- - regexp: '^COMPRESS_OFFLINE[ \t]*=.*'
- line: 'COMPRESS_OFFLINE=False'
- - regexp: '^ALLOWED_HOSTS[ \t]*=.*'
- line: 'ALLOWED_HOSTS = ["*"]'
- - regexp: '^OPENSTACK_HOST[ \t]*=.*'
- line: 'OPENSTACK_HOST = "{{ internal_ip }}"'
- when: ansible_os_family == 'RedHat'
- notify:
- - restart dashboard services
-
-- meta: flush_handlers
+++ /dev/null
-# -*- coding: utf-8 -*-
-
-import os
-
-from django.utils.translation import ugettext_lazy as _
-
-from horizon.utils import secret_key
-
-from openstack_dashboard import exceptions
-from openstack_dashboard.settings import HORIZON_CONFIG
-
-DEBUG = False
-
-WEBROOT = '/'
-
-LOCAL_PATH = os.path.dirname(os.path.abspath(__file__))
-
-SECRET_KEY = secret_key.generate_or_read_from_file('/var/lib/openstack-dashboard/secret_key')
-
-SESSION_ENGINE = 'django.contrib.sessions.backends.cache'
-
-CACHES = {
- 'default': {
- 'BACKEND': 'django.core.cache.backends.memcached.MemcachedCache',
- 'LOCATION': '{{ internal_vip.ip }}:11211',
- },
-}
-
-EMAIL_BACKEND = 'django.core.mail.backends.console.EmailBackend'
-
-OPENSTACK_HOST = "{{ internal_ip }}"
-OPENSTACK_KEYSTONE_URL = "http://%s:5000/v3" % OPENSTACK_HOST
-OPENSTACK_KEYSTONE_DEFAULT_DOMAIN = "default"
-OPENSTACK_KEYSTONE_DEFAULT_ROLE = "_member_"
-OPENSTACK_KEYSTONE_MULTIDOMAIN_SUPPORT = True
-
-OPENSTACK_API_VERSIONS = {
- "identity": 3,
- "image": 2,
- "volume": 2,
-}
-
-OPENSTACK_KEYSTONE_BACKEND = {
- 'name': 'native',
- 'can_edit_user': True,
- 'can_edit_group': True,
- 'can_edit_project': True,
- 'can_edit_domain': True,
- 'can_edit_role': True,
-}
-
-OPENSTACK_HYPERVISOR_FEATURES = {
- 'can_set_mount_point': False,
- 'can_set_password': False,
- 'requires_keypair': False,
- 'enable_quotas': True
-}
-
-OPENSTACK_CINDER_FEATURES = {
- 'enable_backup': False,
-}
-
-OPENSTACK_NEUTRON_NETWORK = {
- 'enable_router': True,
- 'enable_quotas': True,
- 'enable_ipv6': True,
- 'enable_distributed_router': False,
- 'enable_ha_router': False,
- 'enable_lb': True,
- 'enable_firewall': True,
- 'enable_vpn': True,
- 'enable_fip_topology_check': True,
- 'profile_support': None,
- 'supported_vnic_types': ['*'],
-}
-
-OPENSTACK_HEAT_STACK = {
- 'enable_user_pass': True,
-}
-
-IMAGE_CUSTOM_PROPERTY_TITLES = {
- "architecture": _("Architecture"),
- "kernel_id": _("Kernel ID"),
- "ramdisk_id": _("Ramdisk ID"),
- "image_state": _("Euca2ools state"),
- "project_id": _("Project ID"),
- "image_type": _("Image Type"),
-}
-
-IMAGE_RESERVED_CUSTOM_PROPERTIES = []
-
-API_RESULT_LIMIT = 1000
-API_RESULT_PAGE_SIZE = 20
-SWIFT_FILE_TRANSFER_CHUNK_SIZE = 512 * 1024
-INSTANCE_LOG_LENGTH = 35
-DROPDOWN_MAX_ITEMS = 30
-
-TIME_ZONE = "UTC"
-
-{% if enable_ubuntu_theme == False %}
-AVAILABLE_THEMES = [
- ('default', 'Default', 'themes/default'),
- ('material', 'Material', 'themes/material'),
-]
-{% endif %}
-
-LOGGING = {
- 'version': 1,
- 'disable_existing_loggers': False,
- 'formatters': {
- 'operation': {
- 'format': '%(asctime)s %(message)s'
- },
- },
- 'handlers': {
- 'null': {
- 'level': 'DEBUG',
- 'class': 'logging.NullHandler',
- },
- 'console': {
- 'level': 'INFO',
- 'class': 'logging.StreamHandler',
- },
- 'operation': {
- 'level': 'INFO',
- 'class': 'logging.StreamHandler',
- 'formatter': 'operation',
- },
- },
- 'loggers': {
- 'django.db.backends': {
- 'handlers': ['null'],
- 'propagate': False,
- },
- 'requests': {
- 'handlers': ['null'],
- 'propagate': False,
- },
- 'horizon': {
- 'handlers': ['console'],
- 'level': 'DEBUG',
- 'propagate': False,
- },
- 'horizon.operation_log': {
- 'handlers': ['operation'],
- 'level': 'INFO',
- 'propagate': False,
- },
- 'openstack_dashboard': {
- 'handlers': ['console'],
- 'level': 'DEBUG',
- 'propagate': False,
- },
- 'novaclient': {
- 'handlers': ['console'],
- 'level': 'DEBUG',
- 'propagate': False,
- },
- 'cinderclient': {
- 'handlers': ['console'],
- 'level': 'DEBUG',
- 'propagate': False,
- },
- 'keystoneclient': {
- 'handlers': ['console'],
- 'level': 'DEBUG',
- 'propagate': False,
- },
- 'glanceclient': {
- 'handlers': ['console'],
- 'level': 'DEBUG',
- 'propagate': False,
- },
- 'neutronclient': {
- 'handlers': ['console'],
- 'level': 'DEBUG',
- 'propagate': False,
- },
- 'heatclient': {
- 'handlers': ['console'],
- 'level': 'DEBUG',
- 'propagate': False,
- },
- 'ceilometerclient': {
- 'handlers': ['console'],
- 'level': 'DEBUG',
- 'propagate': False,
- },
- 'swiftclient': {
- 'handlers': ['console'],
- 'level': 'DEBUG',
- 'propagate': False,
- },
- 'openstack_auth': {
- 'handlers': ['console'],
- 'level': 'DEBUG',
- 'propagate': False,
- },
- 'nose.plugins.manager': {
- 'handlers': ['console'],
- 'level': 'DEBUG',
- 'propagate': False,
- },
- 'django': {
- 'handlers': ['console'],
- 'level': 'DEBUG',
- 'propagate': False,
- },
- 'iso8601': {
- 'handlers': ['null'],
- 'propagate': False,
- },
- 'scss': {
- 'handlers': ['null'],
- 'propagate': False,
- },
- },
-}
-
-SECURITY_GROUP_RULES = {
- 'all_tcp': {
- 'name': _('All TCP'),
- 'ip_protocol': 'tcp',
- 'from_port': '1',
- 'to_port': '65535',
- },
- 'all_udp': {
- 'name': _('All UDP'),
- 'ip_protocol': 'udp',
- 'from_port': '1',
- 'to_port': '65535',
- },
- 'all_icmp': {
- 'name': _('All ICMP'),
- 'ip_protocol': 'icmp',
- 'from_port': '-1',
- 'to_port': '-1',
- },
- 'ssh': {
- 'name': 'SSH',
- 'ip_protocol': 'tcp',
- 'from_port': '22',
- 'to_port': '22',
- },
- 'smtp': {
- 'name': 'SMTP',
- 'ip_protocol': 'tcp',
- 'from_port': '25',
- 'to_port': '25',
- },
- 'dns': {
- 'name': 'DNS',
- 'ip_protocol': 'tcp',
- 'from_port': '53',
- 'to_port': '53',
- },
- 'http': {
- 'name': 'HTTP',
- 'ip_protocol': 'tcp',
- 'from_port': '80',
- 'to_port': '80',
- },
- 'pop3': {
- 'name': 'POP3',
- 'ip_protocol': 'tcp',
- 'from_port': '110',
- 'to_port': '110',
- },
- 'imap': {
- 'name': 'IMAP',
- 'ip_protocol': 'tcp',
- 'from_port': '143',
- 'to_port': '143',
- },
- 'ldap': {
- 'name': 'LDAP',
- 'ip_protocol': 'tcp',
- 'from_port': '389',
- 'to_port': '389',
- },
- 'https': {
- 'name': 'HTTPS',
- 'ip_protocol': 'tcp',
- 'from_port': '443',
- 'to_port': '443',
- },
- 'smtps': {
- 'name': 'SMTPS',
- 'ip_protocol': 'tcp',
- 'from_port': '465',
- 'to_port': '465',
- },
- 'imaps': {
- 'name': 'IMAPS',
- 'ip_protocol': 'tcp',
- 'from_port': '993',
- 'to_port': '993',
- },
- 'pop3s': {
- 'name': 'POP3S',
- 'ip_protocol': 'tcp',
- 'from_port': '995',
- 'to_port': '995',
- },
- 'ms_sql': {
- 'name': 'MS SQL',
- 'ip_protocol': 'tcp',
- 'from_port': '1433',
- 'to_port': '1433',
- },
- 'mysql': {
- 'name': 'MYSQL',
- 'ip_protocol': 'tcp',
- 'from_port': '3306',
- 'to_port': '3306',
- },
- 'rdp': {
- 'name': 'RDP',
- 'ip_protocol': 'tcp',
- 'from_port': '3389',
- 'to_port': '3389',
- },
-}
-
-REST_API_REQUIRED_SETTINGS = ['OPENSTACK_HYPERVISOR_FEATURES',
- 'LAUNCH_INSTANCE_DEFAULTS',
- 'OPENSTACK_IMAGE_FORMATS']
-
-DEFAULT_THEME = 'ubuntu'
-WEBROOT='/horizon/'
-ALLOWED_HOSTS = ['*',]
-COMPRESS_OFFLINE = True
-ALLOWED_PRIVATE_SUBNET_CIDR = {'ipv4': [], 'ipv6': []}
+++ /dev/null
-{% set work_threads = (ansible_processor_vcpus + 1) // 2 %}
-
-WSGIDaemonProcess horizon processes={{ work_threads }} threads={{ work_threads }}
-WSGIProcessGroup horizon
-WSGISocketPrefix run/wsgi
-
-WSGIScriptAlias /horizon {{ horizon_dir }}/openstack_dashboard/wsgi/django.wsgi
-Alias /horizon/static {{ horizon_dir }}/static
-
-<Directory {{ horizon_dir }}/openstack_dashboard/wsgi>
- Options All
- AllowOverride All
- Require all granted
-</Directory>
-
-<Directory {{ horizon_dir }}/static>
- Options All
- AllowOverride All
- Require all granted
-</Directory>
-
+++ /dev/null
-<VirtualHost *:80>
-
-WSGIScriptAlias / /usr/share/openstack-dashboard/openstack_dashboard/wsgi/django.wsgi
-WSGIDaemonProcess horizon user=www-data group=www-data processes=3 threads=10
-Alias /static /usr/share/openstack-dashboard/openstack_dashboard/static/
-
-<Directory /usr/share/openstack-dashboard/openstack_dashboard/wsgi>
-Order allow,deny
-Allow from all
-</Directory>
-
-
-</VirtualHost>
-
+++ /dev/null
-{% set work_threads = (ansible_processor_vcpus + 1) // 2 %}
-{% if work_threads > 10 %}
-{% set work_threads = 10 %}
-{% endif %}
-
-<VirtualHost {{ internal_ip }}:80>
- WSGIScriptAlias /horizon {{ horizon_dir }}/wsgi/django.wsgi
- WSGIDaemonProcess horizon user=horizon group=horizon processes=4 threads={{ work_threads }}
- WSGIProcessGroup horizon
- Alias /static {{ horizon_dir }}/static/
- Alias /horizon/static {{ horizon_dir }}/static/
- <Directory {{ horizon_dir }}/wsgi>
- Order allow,deny
- Allow from all
- </Directory>
-</VirtualHost>
-
-
+++ /dev/null
-# if you just change the port or add more ports here, you will likely also
-# have to change the VirtualHost statement in
-# /etc/apache2/sites-enabled/000-default.conf
-
-Listen {{ internal_ip }}:80
-
-<IfModule ssl_module>
- Listen 443
-</IfModule>
-
-<IfModule mod_gnutls.c>
- Listen 443
-</IfModule>
-
-# vim: syntax=apache ts=4 sw=4 sts=4 sr noet
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-packages: []
-
-services:
- - memcached
- - apache2
-
-apache_config_dir: /etc/apache2
-horizon_dir: /usr/share/openstack-dashboard/openstack_dashboard
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-packages:
- - mod_wsgi
- - httpd
-
-services:
- - httpd
-
-http_config_file: "/etc/httpd/conf/httpd.conf"
-apache_config_dir: /etc/httpd
-horizon_dir: /usr/share/openstack-dashboard
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-packages_noarch:
- - openstack-dashboard
-
-services_noarch: []
+++ /dev/null
-#!/bin/sh
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
-
-mysql -uroot -Dmysql <<EOF
-use mysql;
-delete from user where user='';
-EOF
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-- include_vars: "{{ ansible_os_family }}.yml"
- tags:
- - test_mongo
- - recovery
-
-- include: mariadb_install.yml
-
-- include: mariadb_cluster.yml
- tags:
- - recovery
-
-- include: mariadb_config.yml
- when:
- - inventory_hostname == haproxy_hosts.keys()[0]
-
-- include: mongodb_install.yml
- tags:
- - test_mongo
-
-- include: mongodb_config.yml
- when:
- - inventory_hostname == haproxy_hosts.keys()[0]
- tags:
- - test_mongo
-
-- meta: flush_handlers
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-- include: mariadb_cluster_debian.yml
- when: ansible_os_family == "Debian"
-
-- include: mariadb_cluster_redhat.yml
- when: ansible_os_family == "RedHat"
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-- name: get cluster status
- shell: |
- mysql --silent --skip-column-names -e 'SHOW STATUS LIKE "wsrep_evs_state"' \
- | awk '{print $2}'
- register: cluster_status
- when:
- - inventory_hostname == haproxy_hosts.keys()[0]
-
-- name: start first node to create new cluster
- shell: >
- service mysql bootstrap;
- service mysql start;
- when: |
- inventory_hostname == haproxy_hosts.keys()[0]
- and not cluster_status.stdout | search("OPERATIONAL")
-
-- name: wait for cluster ready
- shell: |
- mysql --silent --skip-column-names -e 'SHOW STATUS LIKE "wsrep_evs_state"' \
- | awk '{print $2}'
- register: cluster_status
- until: cluster_status|success
- failed_when: not cluster_status.stdout | search("OPERATIONAL")
- retries: 10
- delay: 3
- when: |
- inventory_hostname == haproxy_hosts.keys()[0]
- and not cluster_status.stdout | search("OPERATIONAL")
-
-- name: if I in the cluster nodes
- shell: |
- mysql --silent --skip-column-names \
- -e 'SHOW STATUS LIKE "wsrep_incoming_addresses"' | awk '{print $2}'
- register: cluster_nodes
- changed_when: false
-
-- name: restart other nodes and join cluster1
- shell: service mysql restart;
- when: |
- inventory_hostname != haproxy_hosts.keys()[0]
- and not cluster_nodes.stdout | search( "{{ internal_ip }}" )
- ignore_errors: "True"
-
-- name: delay 60 seconds
- shell: sleep 60
-
-- name: restart other nodes and join cluster2
- shell: service mysql restart;
- when: |
- inventory_hostname != haproxy_hosts.keys()[0]
- and not cluster_nodes.stdout | search( "{{ internal_ip }}" )
-
-- name: chmod directory
- shell: >
- chmod 755 -R /var/lib/mysql/;
- chmod 755 -R /var/log/mysql/;
- chmod 755 -R /etc/mysql/conf.d/;
-
-- name: restart first nodes
- shell: service mysql restart
- when: |
- (inventory_hostname == haproxy_hosts.keys()[0]
- and haproxy_hosts|length > 1
- and not cluster_nodes.stdout | search( '{{ internal_ip }}' ))
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-- name: Register RECOVERY
- set_fact: RECOVERY_ENV={{RECOVERY_ENV | default('False')}}
-
-- name: killall mysqld processes
- shell: sudo killall -9 mysqld
- when: RECOVERY_ENV
- ignore_errors: "True"
-
-- name: get cluster status
- shell: |
- mysql --silent --skip-column-names -e 'SHOW STATUS LIKE "wsrep_evs_state"' \
- | awk '{print $2}'
- register: cluster_status
- when:
- - inventory_hostname == haproxy_hosts.keys()[0]
-
-- name: start first node to create new cluster
- shell: service mysql start --wsrep-new-cluster
- when: |
- inventory_hostname == haproxy_hosts.keys()[0]
- and not cluster_status.stdout | search("OPERATIONAL")
-
-- name: wait for cluster ready
- shell: |
- mysql --silent --skip-column-names -e 'SHOW STATUS LIKE "wsrep_evs_state"' \
- | awk '{print $2}'
- register: cluster_status
- until: cluster_status|success
- failed_when: not cluster_status.stdout | search("OPERATIONAL")
- retries: 10
- delay: 3
- when: |
- inventory_hostname == haproxy_hosts.keys()[0]
- and not cluster_status.stdout | search("OPERATIONAL")
-
-- name: if I in the cluster nodes
- shell: |
- mysql --silent --skip-column-names \
- -e 'SHOW STATUS LIKE "wsrep_incoming_addresses"' | awk '{print $2}'
- register: cluster_nodes
- changed_when: false
-
-- name: restart other nodes and join cluster
- service:
- name: mysql
- state: restarted
- enabled: "yes"
- when: |
- inventory_hostname != haproxy_hosts.keys()[0]
- and not cluster_nodes.stdout | search( "{{ internal_ip }}")
-
-- name: remove unused user
- script: remove_user.sh
- when: ansible_os_family == "RedHat"
-
-- name: restart first nodes
- service:
- name: mysql
- state: restarted
- when: |
- inventory_hostname == haproxy_hosts.keys()[0]
- and haproxy_hosts|length > 1
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-- name: create all needed db
- mysql_db:
- login_unix_socket=/var/run/mysqld/mysqld.sock
- name={{ item.db }}
- state=present
- with_items: "{{ credentials }}"
- tags:
- - test_db
-
-- name: create service db user
- mysql_user:
- login_unix_socket=/var/run/mysqld/mysqld.sock
- name={{ item[0].user }}
- password={{ item[0].password }}
- priv=*.*:ALL,GRANT
- host={{ item[1] }}
- state=present
- with_nested:
- - "{{ credentials }}"
- - ['%', 'localhost']
- tags:
- - test_user
-
-- name: create wsrep db user
- mysql_user:
- login_unix_socket=/var/run/mysqld/mysqld.sock
- name={{ WSREP_SST_USER }}
- password={{ WSREP_SST_PASS }}
- priv=*.*:ALL,GRANT
- host={{ item }}
- state=present
- with_items: ['%', 'localhost']
-
-- name: remove unused user
- script: remove_user.sh
- when: ansible_os_family == "RedHat"
-
-- name: restart mysql for centos noha
- service:
- name: mysql
- state: restarted
- when: >
- inventory_hostname == haproxy_hosts.keys()[0]
- and haproxy_hosts|length == 1
- and ansible_os_family == "RedHat"
-
-- name: restart mysql second time for centos noha
- service:
- name: mysql
- state: restarted
- when: >
- inventory_hostname == haproxy_hosts.keys()[0]
- and haproxy_hosts|length == 1
- and ansible_os_family == "RedHat"
-
-- name: restart first nodes
- service:
- name: mysql
- state: restarted
- when: inventory_hostname == haproxy_hosts.keys()[0]
- and haproxy_hosts|length > 1
-
-- name: wait for cluster ready
- command: mysql -e"show status like 'wsrep%'"
- register: cluster_status
- until: cluster_status|success
- failed_when: not cluster_status.stdout | search("ON")
- retries: 10
- delay: 3
- when:
- - inventory_hostname == haproxy_hosts.keys()[0]
-
-- name: restart other nodes
- service:
- name: mysql
- state: restarted
- enabled: "yes"
- when:
- - inventory_hostname != haproxy_hosts.keys()[0]
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-- name: disable auto start
- copy:
- content: "#!/bin/sh\nexit 101"
- dest: "/usr/sbin/policy-rc.d"
- mode: 0755
- when: ansible_os_family == "Debian"
-
-- name: change open file limit
- copy:
- content: "* - nofile 65536 }}"
- dest: "/etc/security/limits.conf"
- mode: 0755
-
-- name: install python-mysqldb
- action: "{{ ansible_pkg_mgr }} name={{ item }} state=present"
- with_items: "{{ maridb_packages | union(packages_noarch) }}"
-
-- name: create conf dir for wsrep
- file: path=/etc/my.cnf.d state=directory mode=0755
- when: ansible_os_family == "RedHat"
-
-- name: update mariadb config file
- template:
- src: '{{ item.src }}'
- dest: '{{ item.dest }}'
- backup: "yes"
- mode: 0644
- with_items: "{{ mysql_config }}"
-
-- name: bugfix for rsync version 3.1
- lineinfile:
- dest: /usr/bin/wsrep_sst_rsync
- state: absent
- regexp: '{{ item }}'
- with_items:
- - "\\s*uid = \\$MYUID$"
- - "\\s*gid = \\$MYGID$"
-
-- name: enable auto start
- file:
- path=/usr/sbin/policy-rc.d
- state=absent
- when: ansible_os_family == "Debian"
-
-- name: set owner
- file:
- path: /var/lib/mysql
- owner: mysql
- group: mysql
- recurse: "yes"
- state: directory
- mode: 0755
-
-- name: get logfile stat
- stat: path='{{ mysql_data_dir }}/ib_logfile0'
- register: logfile_stat
-
-- debug: msg='{{ logfile_stat.stat.exists}}'
-- debug: msg='{{ logfile_stat.stat.size }}'
- when: logfile_stat.stat.exists
-
-- name: rm logfile if exist and size mismatch
- shell: 'rm -rf {{ mysql_data_dir }}/ib_logfile*'
- when: |
- logfile_stat.stat.exists
- and logfile_stat.stat.size != 1073741824
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-- name: copy mongo js
- template:
- src: '{{ item.src }}'
- dest: '{{ item.dest }}'
- with_items:
- - src: replica.js
- dest: /opt/replica.js
-
-- name: init replica servers
- shell: mongo compass /opt/replica.js
-
-- name: wait replica servers are ready
- shell: |
- mongo compass --eval 'printjson(rs.status())'| \
- grep -E 'PRIMARY|SECONDARY'| wc -l
- register: servers
- until: servers.stdout|int == {{ haproxy_hosts|length }}
- retries: 60
- delay: 10
-
-- debug: msg='{{ servers.stdout |int }}'
-
-- name: wait replica servers are ready
- shell: mongo compass --eval 'printjson(rs.status())'|grep -E 'PRIMARY'|wc -l
- register: servers
- until: servers.stdout|int == 1
- retries: 60
- delay: 10
-
-- debug: msg='{{ servers.stdout |int }}'
-
-- name: Add admin user
- mongodb_user:
- login_host: "{{ internal_vip.ip }}"
- database: admin
- name: root
- password: root
- roles: 'root'
- state: present
-
-- name: create mongodb user and db
- mongodb_user:
- login_host: "{{ internal_vip.ip }}"
- login_user: root
- login_password: root
- database: ceilometer
- name: ceilometer
- password: "{{ CEILOMETER_DBPASS }}"
- roles: 'readWrite,dbAdmin'
- state: present
-
-- name: grant user privilege
- mongodb_user:
- login_host: "{{ internal_vip.ip }}"
- login_user: root
- login_password: root
- database: ceilometer
- name: ceilometer
- password: "{{ CEILOMETER_DBPASS }}"
- roles: 'readWrite,dbAdmin'
- state: present
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-- name: install mongodb packages
- action: "{{ ansible_pkg_mgr }} name={{ item }} state=present"
- with_items: "{{ mongodb_packages | union(packages_noarch) }}"
-
-- name: install pymongod packages
- pip: name={{ item }} state=present extra_args='--pre'
- with_items: "{{ pip_packages }}"
-
-- name: copy ceilometer configs
- template: src=mongodb.conf dest=/opt/os_templates backup=yes
-
-- name: update mongodb config file
- shell: |
- crudini --merge {{ mongodb_config.dest }} < /opt/os_templates/mongodb.conf
-
-- name: rm prealloc files
- file:
- dest: "{{ item }}"
- state: absent
- with_fileglob:
- - "{{ mongodb_config.journal }}"
-
-- name: manually restart mongodb server
- service: name={{ mongodb_service }} state=restarted enabled=yes
- ignore_errors: true
-
-- name: write mongodb to monitor list
- lineinfile: dest=/opt/service create=yes line={{ mongodb_service}}
-
-- name: wait for mongod ready
- wait_for: host=0.0.0.0 port=27017 delay=10
+++ /dev/null
-#!/bin/sh
-mysql -uroot -Dmysql <<EOF
-drop database if exists keystone;
-drop database if exists glance;
-drop database if exists neutron;
-drop database if exists nova;
-drop database if exists cinder;
-drop database if exists heat;
-drop database if exists aodh;
-
-CREATE DATABASE keystone;
-{% for host in ['%', 'localhost', inventory_hostname] %}
-GRANT ALL ON keystone.* TO 'keystone'@'{{ host }}' IDENTIFIED BY '{{ KEYSTONE_DBPASS }}';
-{% endfor %}
-
-CREATE DATABASE glance;
-{% for host in ['%', 'localhost', inventory_hostname] %}
-GRANT ALL ON glance.* TO 'glance'@'{{ host }}' IDENTIFIED BY '{{ GLANCE_DBPASS }}';
-{% endfor %}
-
-CREATE DATABASE neutron;
-{% for host in ['%', 'localhost', inventory_hostname] %}
-GRANT ALL ON neutron.* TO 'neutron'@'{{ host }}' IDENTIFIED BY '{{ NEUTRON_DBPASS }}';
-{% endfor %}
-
-CREATE DATABASE nova;
-{% for host in ['%', 'localhost', inventory_hostname] %}
-GRANT ALL ON nova.* TO 'nova'@'{{ host }}' IDENTIFIED BY '{{ NOVA_DBPASS }}';
-{% endfor %}
-
-CREATE DATABASE cinder;
-{% for host in ['%', 'localhost', inventory_hostname] %}
-GRANT ALL ON cinder.* TO 'cinder'@'{{ host }}' IDENTIFIED BY '{{ CINDER_DBPASS }}';
-{% endfor %}
-
-CREATE DATABASE heat;
-{% for host in ['%', 'localhost', inventory_hostname] %}
-GRANT ALL ON heat.* TO 'heat'@'{{ host }}' IDENTIFIED BY '{{ HEAT_DBPASS }}';
-{% endfor %}
-
-CREATE DATABASE aodh;
-{% for host in ['%', 'localhost', inventory_hostname] %}
-GRANT ALL ON aodh.* TO 'aodh'@'{{ host }}' IDENTIFIED BY '{{ AODH_DBPASS }}';
-{% endfor %}
-
-{% if WSREP_SST_USER is defined %}
-{% for host in ['%', 'localhost', inventory_hostname] %}
-GRANT ALL ON *.* TO '{{ WSREP_SST_USER }}'@'{{ host }}' IDENTIFIED BY '{{ WSREP_SST_PASS }}';
-{% endfor %}
-{% endif %}
-EOF
+++ /dev/null
-# mongodb.conf
-bind_ip = 0.0.0.0
-replSet = compass
-port = 27017
-smallfiles = true
-oplogSize = 10240
+++ /dev/null
-[client]
-port = 3306
-socket = /var/run/mysqld/mysqld.sock
-
-
-[mysqld_safe]
-socket = /var/run/mysqld/mysqld.sock
-nice = 0
-
-
-[mysql]
-default-character-set = utf8
-
-[mysqld]
-user = mysql
-collation-server = utf8_unicode_ci
-init-connect = 'SET NAMES utf8'
-character-set-server = utf8
-datadir = /var/lib/mysql
-bind-address = {{ internal_ip }}
-
-max-allowed-packet = 16M
-max-connect-errors = 1000000
-
-max_connections = {{ ansible_processor_vcpus * 100 }}
-
-wait_timeout = 28800
-tmp-table-size = 32M
-max-heap-table-size = 32M
-query-cache-type = 0
-query-cache-size = 0M
-thread-cache-size = {{ ansible_processor_vcpus * 10 }}
-open-files-limit = 65535
-table-definition-cache = 4096
-table-open-cache = 10240
-
-innodb-flush-method = O_DIRECT
-innodb-additional-mem-pool-size = 24M
-innodb-log-file-size = 1024M
-innodb-file-per-table = 1
-innodb-buffer-pool-size = 4096M
-
-innodb-read-io-threads = 4
-innodb-write-io-threads = 4
-innodb-doublewrite = 1
-innodb-log-buffer-size = 1024M
-innodb-buffer-pool-instances = 8
-innodb-log-files-in-group = 2
-innodb-thread-concurrency = {{ ansible_processor_vcpus * 2 }}
-
-innodb_stats_on_metadata = 0
-
-[mysqldump]
-quick
-quote-names
-max_allowed_packet = 16M
-
-
-!includedir {{ mysql_config_dir }}
+++ /dev/null
-config = { _id:"compass", members:[
-{% for hostname, host in haproxy_hosts.items() %}
-{% set pair = '%s:27017' % host %}
- {_id:{{ loop.index0 }},host:"{{ pair }}",priority:{{ host_index[hostname] + 1 }}},
- {% endfor %}
- ]
-};
-rs.initiate(config);
+++ /dev/null
-[mysqld]
-binlog_format=ROW
-innodb_autoinc_lock_mode=2
-innodb_locks_unsafe_for_binlog=1
-
-# Query Cache is not supported with wsrep
-query_cache_size=0
-query_cache_type=0
-
-default_storage_engine = InnoDB
-
-##
-## WSREP options
-##
-
-# Full path to wsrep provider library or 'none'
-wsrep_provider={{ wsrep_provider_file }}
-
-# Provider specific configuration options
-wsrep_provider_options="gcache.size=1024M"
-
-# Logical cluster name. Should be the same for all nodes.
-wsrep_cluster_name="my_wsrep_cluster"
-
-# Group communication system handle
-{% if haproxy_hosts|length == 1 %}
-wsrep_cluster_address=gcomm://
-{% else %}
-wsrep_cluster_address=gcomm://{{ haproxy_hosts.values()|join(",") }}
-{% endif %}
-
-# Human-readable node name (non-unique). Hostname by default.
-#wsrep_node_name=
-
-# Base replication <address|hostname>[:port] of the node.
-# The values supplied will be used as defaults for state transfer receiving,
-# listening ports and so on. Default: address of the first network interface.
-wsrep_node_address={{ internal_ip }}
-
-# Address for incoming client connections. Autodetect by default.
-#wsrep_node_incoming_address=
-
-# How many threads will process writesets from other nodes
-wsrep_slave_threads={{ ansible_processor_vcpus }}
-
-# DBUG options for wsrep provider
-#wsrep_dbug_option
-
-# Generate fake primary keys for non-PK tables (required for multi-master
-# and parallel applying operation)
-wsrep_certify_nonPK=1
-
-# Maximum number of rows in write set
-wsrep_max_ws_rows=131072
-
-# Maximum size of write set
-wsrep_max_ws_size=1073741824
-
-# to enable debug level logging, set this to 1
-wsrep_debug=1
-
-# convert locking sessions into transactions
-wsrep_convert_LOCK_to_trx=0
-
-# how many times to retry deadlocked autocommits
-wsrep_retry_autocommit=3
-
-# change auto_increment_increment and auto_increment_offset automatically
-wsrep_auto_increment_control=1
-
-# retry autoinc insert, which failed for duplicate key error
-wsrep_drupal_282555_workaround=0
-
-# enable "strictly synchronous" semantics for read operations
-wsrep_causal_reads=0
-
-# Command to call when node status or cluster membership changes.
-# Will be passed all or some of the following options:
-# --status - new status of this node
-# --uuid - UUID of the cluster
-# --primary - whether the component is primary or not ("yes"/"no")
-# --members - comma-separated list of members
-# --index - index of this node in the list
-wsrep_notify_cmd=
-
-##
-## WSREP State Transfer options
-##
-
-# State Snapshot Transfer method
-wsrep_sst_method=rsync
-
-# Address on THIS node to receive SST at. DON'T SET IT TO DONOR ADDRESS!!!
-# (SST method dependent. Defaults to the first IP of the first interface)
-#wsrep_sst_receive_address=
-
-# SST authentication string. This will be used to send SST to joining nodes.
-# Depends on SST method. For mysqldump method it is root:<root password>
-wsrep_sst_auth={{ WSREP_SST_USER }}:{{ WSREP_SST_PASS }}
-
-# Desired SST donor name.
-#wsrep_sst_donor=
-
-# Protocol version to use
-# wsrep_protocol_version=
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-mongodb_packages:
- - mongodb-server
- - mongodb-clients
- - python-pymongo
-
-mysql_packages:
- - python-mysqldb
- - mysql-server
-
-maridb_packages:
- - apt-transport-https
- - debconf-utils
- - libaio1
- - libc6
- - libdbd-mysql-perl
- - libgcc1
- - libgcrypt20
- - libstdc++6
- - python-software-properties
- - mariadb-client
- - galera-3
- - rsync
- - socat
- - mariadb-galera-server-10.0
- - python-mysqldb
-
-pip_packages: []
-
-services: []
-
-mongodb_service: mongodb
-mysql_config:
- - dest: /etc/mysql/my.cnf
- src: my.cnf
- - dest: /etc/mysql/conf.d/wsrep.cnf
- src: wsrep.cnf
-
-mysql_config_dir: /etc/mysql/conf.d
-mysql_data_dir: /var/lib/mysql
-
-mongodb_config:
- dest: /etc/mongodb.conf
- src: mongodb.conf
- journal: /var/lib/mongodb/journal/*
-
-wsrep_provider_file: "/usr/lib/galera/libgalera_smm.so"
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-mysql_packages:
- - MySQL-python
- - mysql-server
-
-maridb_packages:
- - MySQL-python
- - MariaDB-Galera-server
- - MariaDB-client
- - galera
-
-mongodb_packages:
- - mongo-10gen-server
- - mongo-10gen
-
-pip_packages:
- - pymongo
-
-services: []
-
-mongodb_service: mongod
-
-mysql_config:
- - dest: /etc/my.cnf
- src: my.cnf
- - dest: /etc/my.cnf.d/wsrep.cnf
- src: wsrep.cnf
-
-mysql_config_dir: /etc/my.cnf.d
-mysql_data_dir: /var/lib/mysql
-
-mongodb_config:
- dest: /etc/mongod.conf
- src: mongodb.conf
- journal: /var/lib/mongo/journal/*
-
-wsrep_provider_file: "/usr/lib64/galera/libgalera_smm.so"
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-packages_noarch: []
-
-services_noarch:
- - mysql
-
-credentials:
- - user: keystone
- db: keystone
- password: "{{ KEYSTONE_DBPASS }}"
- - user: neutron
- db: neutron
- password: "{{ NEUTRON_DBPASS }}"
- - user: glance
- db: glance
- password: "{{ GLANCE_DBPASS }}"
- - user: nova
- db: nova_api
- password: "{{ NOVA_DBPASS }}"
- - user: nova
- db: nova
- password: "{{ NOVA_DBPASS }}"
- - user: cinder
- db: cinder
- password: "{{ CINDER_DBPASS }}"
- - user: heat
- db: heat
- password: "{{ HEAT_DBPASS }}"
- - user: aodh
- db: aodh
- password: "{{ AODH_DBPASS }}"
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-- name: restart neutron-plugin-openvswitch-agent
- service: name=neutron-openvswitch-agent state=restarted enabled=yes
- when: "'opendaylight' not in {{ NEUTRON_MECHANISM_DRIVERS }}"
-
-- name: restart neutron-l3-agent
- service: name=neutron-l3-agent state=restarted enabled=yes
-
-- name: kill dnsmasq
- command: killall dnsmasq
- ignore_errors: "True"
-
-- name: restart neutron-dhcp-agent
- service: name=neutron-dhcp-agent state=restarted enabled=yes
-
-- name: restart neutron-metadata-agent
- service: name=neutron-metadata-agent state=restarted enabled=yes
-
-- name: restart xorp
- service: name=xorp state=restarted enabled=yes sleep=10
- ignore_errors: "True"
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-- include_vars: "{{ ansible_os_family }}.yml"
-
-# FIXME: temporary workaround for openstack api access random failure
-- name: restart api server
- service: name={{ item }} state=restarted enabled=yes
- with_items: api_services | union(api_services_noarch)
- ignore_errors: "True"
-
-- name: restart neutron server
- service: name=neutron-server state=restarted enabled=yes
-
-- name: wait for neutron ready
- wait_for: port=9696 delay=10 timeout=60 host={{ internal_ip }}
-
-- name: create external net
- os_network:
- cloud: opnfv
- name: "{{ public_net_info.network }}"
- provider_network_type: "{{ public_net_info.type }}"
- provider_physical_network: "{{ public_net_info.provider_network }}"
- shared: false
- external: "yes"
- state: present
- run_once: true
- when: public_net_info.enable == "True"
- and public_net_info.type == "flat"
-
-- name: create external net
- os_network:
- cloud: opnfv
- name: "{{ public_net_info.network }}"
- provider_network_type: "{{ public_net_info.type }}"
- provider_segmentation_id: "{{ public_net_info.segment_id }}"
- shared: false
- external: "yes"
- state: present
- run_once: true
- when: public_net_info.enable == "True"
- and public_net_info.type != "flat"
-
-- name: create external subnet
- os_subnet:
- cloud: opnfv
- name: "{{ public_net_info.subnet }}"
- network_name: "{{ public_net_info.network }}"
- cidr: "{{ public_net_info.floating_ip_cidr }}"
- enable_dhcp: "{{ public_net_info.enable_dhcp }}"
- no_gateway_ip: "{{ public_net_info.no_gateway }}"
- gateway_ip: "{{ public_net_info.external_gw }}"
- allocation_pool_start: "{{ public_net_info.floating_ip_start }}"
- allocation_pool_end: "{{ public_net_info.floating_ip_end }}"
- state: present
- run_once: true
- when: public_net_info.enable == "True"
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-api_services:
- - nova-api
- - glance-api
- - heat-api
- - heat-api-cfn
- - cinder-api
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-api_services:
- - openstack-nova-api
- - openstack-glance-api
- - openstack-heat-api
- - openstack-heat-api-cfn
- - openstack-cinder-api
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-api_services_noarch: []
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-- name: restart glance services
- service: name={{ item }} state=restarted enabled=yes
- with_items: "{{ services | union(services_noarch) }}"
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-- name: sync glance db
- shell: su -s /bin/sh -c 'glance-manage db sync' glance
- ignore_errors: "True"
- notify:
- - restart glance services
-
-- meta: flush_handlers
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-- name: install glance packages
- action: "{{ ansible_pkg_mgr }} name={{ item }} state=latest"
- with_items: "{{ packages | union(packages_noarch) }}"
-
-- name: generate glance service list
- lineinfile: dest=/opt/service create=yes line='{{ item }}'
- with_items: "{{ services | union(services_noarch) }}"
-
-- name: update glance conf
- template: src={{ item }} dest=/etc/glance/{{ item }}
- backup=yes
- with_items:
- - glance-api.conf
- - glance-registry.conf
-
-- name: remove default sqlite db
- shell: rm /var/lib/glance/glance.sqlite || touch glance.sqllite.db.removed
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-- include_vars: "{{ ansible_os_family }}.yml"
- tags:
- - recovery
-
-- include: glance_install.yml
- tags:
- - install
- - glance_install
- - glance
-
-- include: nfs.yml
- tags:
- - nfs
-
-- include: glance_config.yml
- when: inventory_hostname == groups['controller'][0]
- tags:
- - config
- - glance_config
- - glance
-
-- meta: flush_handlers
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-- name: install nfs packages
- action: "{{ ansible_pkg_mgr }} name={{ item }} state=present"
- with_items: "{{ nfs_packages }}"
-
-- name: install nfs
- local_action: yum name={{ item }} state=present
- with_items:
- - rpcbind
- - nfs-utils
- run_once: "True"
-
-- name: create image directory
- local_action: file path=/opt/images state=directory mode=0777
- run_once: "True"
-
-- name: remove nfs config item if exist
- local_action: lineinfile dest=/etc/exports state=absent
- regexp="^/opt/images"
- run_once: "True"
-
-- name: update nfs config
- local_action: lineinfile dest=/etc/exports state=present
- line="/opt/images *(rw,insecure,sync,all_squash)"
- run_once: "True"
-
-- name: restart compass nfs service
- local_action: service name={{ item }} state=restarted enabled=yes
- with_items:
- - rpcbind
- - nfs-server
- run_once: "True"
-
-- name: get mount info
- command: mount
- register: mount_info
- tags:
- - recovery
-
-- name: get nfs server
- shell: awk -F'=' '/compass_server/ {print $2}' /etc/compass.conf
- register: ip_info
- tags:
- - recovery
-
-- name: restart host nfs service
- service: name={{ item }} state=restarted enabled=yes
- with_items: '{{ nfs_services }}'
-
-- name: mount image directory
- shell: |
- mkdir -p /var/lib/glance/images;
- mount -t nfs -onfsvers=3 {{ ip_info.stdout_lines[0] }}:/opt/images \
- /var/lib/glance/images;
- sed -i '/\/var\/lib\/glance\/images/d' /etc/fstab;
- echo {{ ip_info.stdout_lines[0] }}:/opt/images /var/lib/glance/images/ nfs \
- fsvers=3 >> /etc/fstab;
- when: mount_info.stdout.find('images') == -1
- retries: 5
- delay: 3
- tags:
- - recovery
+++ /dev/null
-{% set workers = ansible_processor_vcpus // 2 %}
-{% set workers = workers if workers else 1 %}
-{% set memcached_servers = [] %}
-{% set rabbitmq_servers = [] %}
-{% for host in haproxy_hosts.values() %}
-{% set _ = memcached_servers.append('%s:11211'% host) %}
-{% set _ = rabbitmq_servers.append('%s:5672'% host) %}
-{% endfor %}
-{% set memcached_servers = memcached_servers|join(',') %}
-{% set rabbitmq_servers = rabbitmq_servers|join(',') %}
-
-[DEFAULT]
-verbose = {{ VERBOSE }}
-debug = {{ DEBUG }}
-log_file = /var/log/glance/api.log
-bind_host = {{ image_host }}
-bind_port = 9292
-backlog = 4096
-workers = {{ workers }}
-registry_host = {{ internal_ip }}
-registry_port = 9191
-registry_client_protocol = http
-cinder_catalog_info = volume:cinder:internalURL
-
-enable_v1_api = True
-enable_v1_registry = True
-enable_v2_api = True
-enable_v2_registry = True
-
-notification_driver = messagingv2
-rpc_backend = rabbit
-
-delayed_delete = False
-scrubber_datadir = /var/lib/glance/scrubber
-scrub_time = 43200
-image_cache_dir = /var/lib/glance/image-cache/
-show_image_direct_url = True
-
-[database]
-backend = sqlalchemy
-connection = mysql://glance:{{ GLANCE_DBPASS }}@{{ db_host }}/glance?charset=utf8
-idle_timeout = 30
-sqlite_db = /var/lib/glance/glance.sqlite
-
-[task]
-task_executor = taskflow
-
-[glance_store]
-default_store = file
-stores = file,http,cinder,rbd
-filesystem_store_datadir = /var/lib/glance/images/
-
-[image_format]
-disk_formats = ami,ari,aki,vhd,vhdx,vmdk,raw,qcow2,vdi,iso,root-tar
-
-[profiler]
-enabled = True
-
-[keystone_authtoken]
-auth_uri = http://{{ internal_vip.ip }}:5000
-auth_url = http://{{ internal_vip.ip }}:35357
-memcached_servers = {{ memcached_servers }}
-auth_type = password
-project_domain_name = default
-user_domain_name = default
-project_name = service
-username = glance
-password = {{ GLANCE_PASS }}
-token_cache_time = 300
-revocation_cache_time = 60
-
-identity_uri = http://{{ internal_vip.ip }}:35357
-admin_tenant_name = service
-admin_user = glance
-admin_password = {{ GLANCE_PASS }}
-
-[paste_deploy]
-flavor= keystone
-
-[oslo_messaging_amqp]
-idle_timeout = 7200
-
-[oslo_messaging_rabbit]
-rabbit_hosts = {{ rabbitmq_servers }}
-rabbit_use_ssl = false
-rabbit_userid = {{ RABBIT_USER }}
-rabbit_password = {{ RABBIT_PASS }}
-rabbit_virtual_host = /
-default_notification_exchange = glance
-
-rabbit_notification_exchange = glance
-rabbit_notification_topic = notifications
-rabbit_durable_queues = False
+++ /dev/null
-{% set workers = ansible_processor_vcpus // 2 %}
-{% set workers = workers if workers else 1 %}
-{% set memcached_servers = [] %}
-{% set rabbitmq_servers = [] %}
-{% for host in haproxy_hosts.values() %}
-{% set _ = memcached_servers.append('%s:11211'% host) %}
-{% set _ = rabbitmq_servers.append('%s:5672'% host) %}
-{% endfor %}
-{% set memcached_servers = memcached_servers|join(',') %}
-{% set rabbitmq_servers = rabbitmq_servers|join(',') %}
-
-[DEFAULT]
-verbose = {{ VERBOSE }}
-debug = {{ DEBUG }}
-log_file = /var/log/glance/api.log
-bind_host = {{ image_host }}
-bind_port = 9191
-backlog = 4096
-workers = {{ workers }}
-
-notification_driver = messagingv2
-rpc_backend = rabbit
-
-[database]
-backend = sqlalchemy
-connection = mysql://glance:{{ GLANCE_DBPASS }}@{{ db_host }}/glance?charset=utf8
-idle_timeout = 30
-
-[profiler]
-enabled = True
-
-[keystone_authtoken]
-auth_uri = http://{{ internal_vip.ip }}:5000
-auth_url = http://{{ internal_vip.ip }}:35357
-memcached_servers = {{ memcached_servers }}
-auth_type = password
-project_domain_name = default
-user_domain_name = default
-project_name = service
-username = glance
-password = {{ GLANCE_PASS }}
-
-identity_uri = http://{{ internal_vip.ip }}:35357
-admin_tenant_name = service
-admin_user = glance
-admin_password = {{ GLANCE_PASS }}
-token_cache_time = 300
-revocation_cache_time = 60
-
-[paste_deploy]
-flavor= keystone
-
-[oslo_messaging_amqp]
-idle_timeout = 7200
-
-[oslo_messaging_rabbit]
-rabbit_hosts = {{ rabbitmq_servers }}
-rabbit_use_ssl = false
-rabbit_userid = {{ RABBIT_USER }}
-rabbit_password = {{ RABBIT_PASS }}
-rabbit_virtual_host = /
-rabbit_notification_exchange = glance
-rabbit_notification_topic = notifications
-rabbit_durable_queues = False
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
-sleep 10
-glance --os-username=admin --os-password={{ ADMIN_PASS }} --os-tenant-name=admin --os-auth-url=http://{{ internal_vip.ip }}:35357/v2.0 image-create --name="cirros" --disk-format=qcow2 --container-format=bare --is-public=true < /opt/{{ build_in_image_name }} && touch glance.import.completed
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-packages:
- - glance
- - nfs-common
-
-nfs_packages:
- - nfs-common
-
-nfs_services: []
-
-services:
- - glance-registry
- - glance-api
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-packages:
- - openstack-glance
- - rpcbind
-
-nfs_packages:
- - nfs-utils
- - rpcbind
-
-nfs_services:
- - rpcbind
-
-services:
- - openstack-glance-api
- - openstack-glance-registry
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-packages_noarch:
- - python-glanceclient
-
-services_noarch: []
+++ /dev/null
-#! /bin/sh
-
-code=`mysql -uroot -e "show status" | awk '/Threads_running/{print $2}'`
-
-if [ "$code"=="1" ]
-then
- echo "HTTP/1.1 200 OK\r\n"
-else
- echo "HTTP/1.1 503 Service Unavailable\r\n"
-fi
+++ /dev/null
-# default: off
-# description: An xinetd internal service which echo's characters back to
-# clients.
-# This is the tcp version.
-service mysqlchk
-{
- disable = no
- flags = REUSE
- socket_type = stream
- protocol = tcp
- user = root
- wait = no
- server = /usr/local/bin/galera_chk
- port = 9200
-}
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-- name: restart haproxy
- service: name=haproxy state=restarted enabled=yes
-
-- name: restart xinetd
- service: name=xinetd state=restarted enabled=yes
-
-- name: restart keepalived
- service: name=keepalived state=restarted enabled=yes
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-- include_vars: "{{ ansible_os_family }}.yml"
-
-- name: install keepalived xinet haproxy
- action: "{{ ansible_pkg_mgr }} name={{ item }} state=present"
- with_items: "{{ packages | union(packages_noarch) }}"
-
-- name: generate ha service list
- lineinfile: dest=/opt/service create=yes line='{{ item }}'
- with_items: "{{ services | union(services_noarch) }}"
-
-- name: install pexpect
- pip: name=pexpect state=present extra_args='--pre'
-
-- name: activate ip_nonlocal_bind
- sysctl: name=net.ipv4.ip_nonlocal_bind value=1
- state=present reload=yes
-
-- name: set net.ipv4.tcp_keepalive_intvl
- sysctl: name=net.ipv4.tcp_keepalive_intvl value=1
- state=present reload=yes
-
-- name: set net.ipv4.tcp_keepalive_probes
- sysctl: name=net.ipv4.tcp_keepalive_probes value=5
- state=present reload=yes
-
-- name: set net.ipv4.tcp_keepalive_time
- sysctl: name=net.ipv4.tcp_keepalive_time value=5
- state=present reload=yes
-
-- name: update haproxy cfg
- template: src=haproxy.cfg dest=/etc/haproxy/haproxy.cfg
- notify: restart haproxy
-
-- name: set haproxy enable flag
- lineinfile: dest=/etc/default/haproxy state=present
- regexp="ENABLED=*"
- line="ENABLED=1"
- notify: restart haproxy
- when: ansible_os_family == "Debian"
-
-- name: set haproxy log
- lineinfile: dest=/etc/rsyslog.conf state=present
- regexp="local0.* /var/log/haproxy.log"
- line="local0.* /var/log/haproxy.log"
-
-- name: set rsyslog udp module
- lineinfile: dest=/etc/rsyslog.conf state=present
- regexp="^#$ModLoad imudp"
- line="$ModLoad imudp"
-
-- name: set rsyslog udp port
- lineinfile: dest=/etc/rsyslog.conf state=present
- regexp="^#$UDPServerRun 514"
- line="$UDPServerRun 514"
-
-- name: copy galera_chk file
- copy: src=galera_chk dest=/usr/local/bin/galera_chk mode=0777
-
-- name: add network service
- lineinfile: dest=/etc/services state=present
- line="mysqlchk 9200/tcp"
- insertafter="Local services"
- notify: restart xinetd
-
-- name: copy mysqlchk file
- copy: src=mysqlchk dest=/etc/xinetd.d/mysqlchk mode=0777
- notify: restart xinetd
-
-- name: set keepalived start param
- lineinfile: dest=/etc/default/keepalived state=present
- regexp="^DAEMON_ARGS=*"
- line="DAEMON_ARGS=\"-D -d -S 1\""
- when: ansible_os_family == "Debian"
-
-- name: set keepalived log
- lineinfile: dest=/etc/rsyslog.conf state=present
- regexp="local1.* /var/log/keepalived.log"
- line="local1.* /var/log/keepalived.log"
-
-- name: update keepalived info
- template: src=keepalived.conf dest=/etc/keepalived/keepalived.conf
- notify: restart keepalived
-
-- name: restart rsyslog
- shell: service rsyslog restart
-
-- meta: flush_handlers
+++ /dev/null
-
-global
- #chroot /var/run/haproxy
- daemon
- user haproxy
- group haproxy
- maxconn 4000
- pidfile /var/run/haproxy/haproxy.pid
- #log 127.0.0.1 local0
- tune.bufsize 1000000
- stats socket /var/run/haproxy.sock
- stats timeout 2m
-
-defaults
- log global
- maxconn 8000
- option redispatch
- option dontlognull
- option splice-auto
- timeout http-request 10s
- timeout queue 1m
- timeout connect 10s
- timeout client 50s
- timeout server 50s
- timeout check 10s
- retries 3
-
-listen proxy-mysql
- bind {{ internal_vip.ip }}:3306
- option tcpka
- option tcplog
- balance source
-{% for host, ip in haproxy_hosts.items() %}
-{% if loop.index == 1 %}
- server {{ host }} {{ ip }}:3306 weight 1 check inter 2000 rise 2 fall 5
-{% else %}
- server {{ host }} {{ ip }}:3306 weight 1 check inter 2000 rise 2 fall 5 backup
-{% endif %}
-{% endfor %}
-
-listen proxy-rabbit
- bind {{ internal_vip.ip }}:5672
- bind {{ public_vip.ip }}:5672
-
- option tcpka
- option tcplog
- timeout client 3h
- timeout server 3h
- balance source
-{% for host,ip in haproxy_hosts.items() %}
- server {{ host }} {{ ip }}:5672 weight 1 check inter 2000 rise 2 fall 5
-{% endfor %}
-
-listen proxy-glance_registry_cluster
- bind {{ internal_vip.ip }}:9191
- bind {{ public_vip.ip }}:9191
- option tcpka
- option tcplog
- balance source
-{% for host,ip in haproxy_hosts.items() %}
- server {{ host }} {{ ip }}:9191 weight 1 check inter 2000 rise 2 fall 5
-{% endfor %}
-
-listen proxy-glance_api_cluster
- bind {{ internal_vip.ip }}:9292
- bind {{ public_vip.ip }}:9292
- option tcpka
- option tcplog
- option httpchk
- balance source
-{% for host,ip in haproxy_hosts.items() %}
- server {{ host }} {{ ip }}:9292 weight 1 check inter 2000 rise 2 fall 5
-{% endfor %}
-
-listen proxy-nova-novncproxy
- bind {{ internal_vip.ip }}:6080
- bind {{ public_vip.ip }}:6080
- option tcpka
- option tcplog
- balance source
-{% for host,ip in haproxy_hosts.items() %}
- server {{ host }} {{ ip }}:6080 weight 1 check inter 2000 rise 2 fall 5
-{% endfor %}
-
-listen proxy-network
- bind {{ internal_vip.ip }}:9696
- bind {{ public_vip.ip }}:9696
- option tcpka
- option tcplog
- balance source
- option httpchk
-{% for host,ip in haproxy_hosts.items() %}
- server {{ host }} {{ ip }}:9696 weight 1 check inter 2000 rise 2 fall 5
-{% endfor %}
-
-listen proxy-volume
- bind {{ internal_vip.ip }}:8776
- bind {{ public_vip.ip }}:8776
- option tcpka
- option httpchk
- option tcplog
- balance source
-{% for host,ip in haproxy_hosts.items() %}
- server {{ host }} {{ ip }}:8776 weight 1 check inter 2000 rise 2 fall 5
-{% endfor %}
-
-listen proxy-keystone_admin_cluster
- bind {{ internal_vip.ip }}:35357
- bind {{ public_vip.ip }}:35357
- option tcpka
- option httpchk
- option tcplog
- balance source
-{% for host,ip in haproxy_hosts.items() %}
- server {{ host }} {{ ip }}:35357 weight 1 check inter 2000 rise 2 fall 5
-{% endfor %}
-
-listen proxy-keystone_public_internal_cluster
- bind {{ internal_vip.ip }}:5000
- bind {{ public_vip.ip }}:5000
- option tcpka
- option httpchk
- option tcplog
- balance source
-{% for host,ip in haproxy_hosts.items() %}
- server {{ host }} {{ ip }}:5000 weight 1 check inter 2000 rise 2 fall 5
-{% endfor %}
-
-listen proxy-nova_compute_api_cluster
- bind {{ internal_vip.ip }}:8774
- bind {{ public_vip.ip }}:8774
- mode tcp
- option httpchk
- option tcplog
- balance source
-{% for host,ip in haproxy_hosts.items() %}
- server {{ host }} {{ ip }}:8774 weight 1 check inter 2000 rise 2 fall 5
-{% endfor %}
-
-listen proxy-nova_metadata_api_cluster
- bind {{ internal_vip.ip }}:8775
- bind {{ public_vip.ip }}:8775
- option tcpka
- option tcplog
- balance source
-{% for host,ip in haproxy_hosts.items() %}
- server {{ host }} {{ ip }}:8775 weight 1 check inter 2000 rise 2 fall 5
-{% endfor %}
-
-listen proxy-cinder_api_cluster
- bind {{ internal_vip.ip }}:8776
- bind {{ public_vip.ip }}:8776
- mode tcp
- option httpchk
- option tcplog
- balance source
-{% for host,ip in haproxy_hosts.items() %}
- server {{ host }} {{ ip }}:8776 weight 1 check inter 2000 rise 2 fall 5
-{% endfor %}
-
-#listen proxy-swift-proxy
-# bind {{ internal_vip.ip }}:8080
-# bind {{ public_vip.ip }}:8080
-# balance source
-# option tcpka
-# option tcplog
-#{% for host,ip in haproxy_hosts.items() %}
-# server {{ host }} {{ ip }}:8080 weight 1 check inter 2000 rise 2 fall 5
-#{% endfor %}
-
-listen proxy-ceilometer_api_cluster
- bind {{ internal_vip.ip }}:8777
- bind {{ public_vip.ip }}:8777
- mode tcp
- option tcp-check
- option tcplog
- balance source
-{% for host,ip in haproxy_hosts.items() %}
- server {{ host }} {{ ip }}:8777 weight 1 check inter 2000 rise 2 fall 5
-{% endfor %}
-
-listen proxy-aodh_api_cluster
- bind {{ internal_vip.ip }}:8042
- bind {{ public_vip.ip }}:8042
- mode tcp
- option tcp-check
- option tcplog
- balance source
-{% for host,ip in haproxy_hosts.items() %}
- server {{ host }} {{ ip }}:8042 weight 1 check inter 2000 rise 2 fall 5
-{% endfor %}
-
-listen proxy-congress_api_cluster
- bind {{ internal_vip.ip }}:1789
- bind {{ public_vip.ip }}:1789
- mode tcp
- option tcp-check
- option tcplog
- balance source
-{% for host,ip in haproxy_hosts.items() %}
- server {{ host }} {{ ip }}:1789 weight 1 check inter 2000 rise 2 fall 5
-{% endfor %}
-
-listen proxy-dashboarad
- bind {{ public_vip.ip }}:80
- mode http
- balance source
- capture cookie vgnvisitor= len 32
- cookie SERVERID insert indirect nocache
- option forwardfor
- option httpchk
- option httpclose
- rspidel ^Set-cookie:\ IP=
-{% for host,ip in haproxy_hosts.items() %}
- server {{ host }} {{ ip }}:80 cookie {{ host }} weight 1 check inter 2000 rise 2 fall 5
-{% endfor %}
-
-listen stats
- mode http
- bind 0.0.0.0:9999
- stats enable
- stats refresh 30s
- stats uri /
- stats realm Global\ statistics
- stats auth admin:admin
-
-
+++ /dev/null
-global_defs {
- router_id {{ inventory_hostname }}
-}
-
-vrrp_sync_group VG1 {
- group {
- internal_vip
- public_vip
- }
-}
-
-vrrp_instance internal_vip {
- interface {{ internal_vip.interface }}
- virtual_router_id {{ vrouter_id_internal }}
- state BACKUP
- nopreempt
- advert_int 1
- priority {{ 50 + (host_index[inventory_hostname] * 50) }}
-
- authentication {
- auth_type PASS
- auth_pass 1234
- }
-
- virtual_ipaddress {
- {{ internal_vip.ip }}/{{ internal_vip.netmask }} dev {{ internal_vip.interface }}
- }
-}
-
-vrrp_instance public_vip {
- interface {{ network_cfg.public_vip.interface }}
- virtual_router_id {{ vrouter_id_public }}
- state BACKUP
- nopreempt
- advert_int 1
- priority {{ 50 + (host_index[inventory_hostname] * 50) }}
-
- authentication {
- auth_type PASS
- auth_pass 4321
- }
-
- virtual_ipaddress {
- {{ network_cfg.public_vip.ip }}/{{ network_cfg.public_vip.netmask }} dev {{ network_cfg.public_vip.interface }}
- }
-
-}
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-services: []
-packages: []
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-services: []
-packages: []
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-packages_noarch:
- - keepalived
- - xinetd
- - haproxy
-
-services_noarch:
- - keepalived
- - xinetd
- - haproxy
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-- name: restart heat service
- service: name={{ item }} state=restarted enabled=yes
- with_items: "{{ services | union(services_noarch) }}"
-
-- name: remove heat-sqlite-db
- shell: rm /var/lib/heat/heat.sqlite || touch heat.sqlite.db.removed
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-- name: heat db sync
- shell: su -s /bin/sh -c "heat-manage db_sync" heat
- notify:
- - restart heat service
-
-- meta: flush_handlers
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-- include_vars: "{{ ansible_os_family }}.yml"
-
-- name: install heat related packages
- action: "{{ ansible_pkg_mgr }} name={{ item }} state=present"
- with_items: "{{ packages | union(packages_noarch) }}"
-
-- name: generate heat service list
- lineinfile: dest=/opt/service create=yes line='{{ item }}'
- with_items: "{{ services | union(services_noarch) }}"
-
-- name: create heat domain
- os_keystone_domain:
- cloud: opnfv
- name: heat
- state: present
- description: "Stack projects and users"
- register: heat_domain
- when: inventory_hostname == groups['controller'][0]
-
-- name: create heat user
- os_user:
- cloud: opnfv
- domain: heat
- name: heat_domain_admin
- password: "{{ HEAT_PASS }}"
- when: inventory_hostname == groups['controller'][0]
-
-- name: grant heat admin role
- shell: |
- . /opt/admin-openrc.sh
- openstack role assignment list | grep "{{ heat_domain.id }}" \
- || openstack role add --domain heat --user-domain heat \
- --user heat_domain_admin admin;
- when: inventory_hostname == groups['controller'][0]
-
-- name: create heat role
- os_keystone_role:
- cloud: opnfv
- name: heat_stack_owner
- when: inventory_hostname == groups['controller'][0]
-
-- name: grant heat demo role
- os_user_role:
- cloud: opnfv
- user: demo
- project: demo
- role: heat_stack_owner
- when: inventory_hostname == groups['controller'][0]
-
-- name: create member role
- os_keystone_role:
- cloud: opnfv
- name: _member_
- when: inventory_hostname == groups['controller'][0]
-
-- name: update heat conf
- template: src=heat.j2
- dest=/etc/heat/heat.conf
- backup=yes
- notify:
- - restart heat service
- - remove heat-sqlite-db
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-- include: heat_install.yml
- tags:
- - install
- - heat_install
- - heat
-
-- include: heat_config.yml
- when: inventory_hostname == groups['controller'][0]
- tags:
- - config
- - heat_config
- - heat
-
-- meta: flush_handlers
+++ /dev/null
-{% set memcached_servers = [] %}
-{% for host in haproxy_hosts.values() %}
-{% set _ = memcached_servers.append('%s:11211'% host) %}
-{% endfor %}
-{% set memcached_servers = memcached_servers|join(',') %}
-
-[DEFAULT]
-heat_metadata_server_url = http://{{ internal_vip.ip }}:8000
-heat_waitcondition_server_url = http://{{ internal_vip.ip }}:8000/v1/waitcondition
-rpc_backend = rabbit
-log_dir = /var/log/heat
-stack_domain_admin = heat_domain_admin
-stack_domain_admin_password = {{ HEAT_PASS }}
-stack_user_domain_name = heat
-num_engine_workers = {{ api_workers}}
-
-[heat_api]
-workers = {{ api_workers }}
-
-[database]
-connection = mysql://heat:{{ HEAT_DBPASS }}@{{ db_host }}/heat
-idle_timeout = 30
-use_db_reconnect = True
-pool_timeout = 10
-
-[ec2authtoken]
-auth_uri = http://{{ internal_vip.ip }}:5000
-
-[clients_keystone]
-auth_uri = http://{{ internal_vip.ip }}:35357
-
-[keystone_authtoken]
-auth_uri = http://{{ internal_vip.ip }}:5000
-auth_url = http://{{ internal_vip.ip }}:35357
-memcached_servers = {{ memcached_servers }}
-auth_type = password
-project_domain_name = default
-user_domain_name = default
-project_name = service
-username = heat
-password = {{ HEAT_PASS }}
-
-identity_uri = http://{{ internal_vip.ip }}:35357
-admin_tenant_name = service
-admin_user = heat
-admin_password = {{ HEAT_PASS }}
-
-[oslo_messaging_rabbit]
-rabbit_host = {{ rabbit_host }}
-rabbit_userid = {{ RABBIT_USER }}
-rabbit_password = {{ RABBIT_PASS }}
-
-[trustee]
-auth_type = password
-auth_url = http://{{ internal_vip.ip }}:35357
-username = heat
-password = {{ HEAT_PASS }}
-user_domain_name = default
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-packages:
- - heat-api
- - heat-api-cfn
- - heat-engine
- - python-heatclient
-
-services:
- - heat-api
- - heat-api-cfn
- - heat-engine
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-services:
- - openstack-heat-api
- - openstack-heat-api-cfn
- - openstack-heat-engine
-
-packages:
- - openstack-heat-api
- - openstack-heat-api-cfn
- - openstack-heat-engine
- - python-heatclient
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-packages_noarch: []
-
-services_noarch: []
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-- name: restart keystone services
- service: name={{ item }} state=restarted enabled=yes
- with_items: "{{ services | union(services_noarch) }}"
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-- include_vars: "{{ ansible_os_family }}.yml"
-
-- name: keystone-manage db-sync
- shell: su -s /bin/sh -c 'keystone-manage db_sync' keystone
-
-- name: Check if fernet keys already exist
- stat:
- path: "/etc/keystone/fernet-keys/0"
- register: fernet_keys_0
-
-- name: Create fernet keys for Keystone
- command:
- keystone-manage fernet_setup
- --keystone-user keystone
- --keystone-group keystone
- when: not fernet_keys_0.stat.exists
- notify:
- - restart keystone services
-
-- name: Rotate fernet keys for Keystone
- command:
- keystone-manage fernet_rotate
- --keystone-user keystone
- --keystone-group keystone
- when: fernet_keys_0.stat.exists
- notify:
- - restart keystone services
-
-- name: Distribute the fernet key repository
- shell: |
- rsync -e 'ssh -o StrictHostKeyChecking=no' \
- -avz \
- --delete \
- /etc/keystone/fernet-keys \
- root@{{ hostvars[ item ].ansible_eth0.ipv4.address }}:/etc/keystone/
- with_items: "{{ groups['controller'][1:] }}"
- notify:
- - restart keystone services
-
-- name: Check if credential keys already exist
- stat:
- path: "/etc/keystone/credential-keys/0"
- register: credential_keys_0
-
-- name: Create credential keys for Keystone
- command:
- keystone-manage credential_setup
- --keystone-user keystone
- --keystone-group keystone
- when: not credential_keys_0.stat.exists
- notify:
- - restart keystone services
-
-- name: Rotate credential keys for Keystone
- command:
- keystone-manage credential_rotate
- --keystone-user keystone
- --keystone-group keystone
- when: credential_keys_0.stat.exists
- notify:
- - restart keystone services
-
-- name: Distribute the credential key repository
- shell: |
- rsync -e 'ssh -o StrictHostKeyChecking=no' \
- -avz \
- --delete \
- /etc/keystone/credential-keys \
- root@{{ hostvars[ item ].ansible_eth0.ipv4.address }}:/etc/keystone/
- with_items: "{{ groups['controller'][1:] }}"
- notify:
- - restart keystone services
-
-- name: Bootstrap the Identity service
- shell:
- keystone-manage bootstrap \
- --bootstrap-password {{ ADMIN_PASS }} \
- --bootstrap-admin-url http://{{ internal_ip }}:35357/v3/ \
- --bootstrap-internal-url http://{{ internal_ip }}:35357/v3/ \
- --bootstrap-public-url http://{{ internal_ip }}:5000/v3/
- --bootstrap-region-id RegionOne \
- notify:
- - restart keystone services
-
-- meta: flush_handlers
-
-- name: wait for keystone ready
- wait_for: port=35357 delay=15 timeout=60 host={{ internal_ip }}
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-- name: set admin url for keystone endpoint
- keystone_endpoint:
- cloud: opnfv
- endpoint_type: admin
- name: "{{ item.name }}"
- service_type: "{{ item.type }}"
- state: present
- interface: admin
- region: "{{ item.region}}"
- url: "{{ item.adminurl }}"
- with_items: "{{ os_services[0:1] }}"
-
-- name: set internal url for keystone endpointl
- keystone_endpoint:
- cloud: opnfv
- endpoint_type: admin
- name: "{{ item.name }}"
- service_type: "{{ item.type }}"
- state: present
- interface: internal
- region: "{{ item.region}}"
- url: "{{ item.internalurl }}"
- with_items: "{{ os_services[0:1] }}"
-
-- name: set public url for keystone endpoint
- keystone_endpoint:
- cloud: opnfv
- endpoint_type: admin
- name: "{{ item.name }}"
- service_type: "{{ item.type }}"
- state: present
- interface: public
- region: "{{ item.region}}"
- url: "{{ item.publicurl }}"
- with_items: "{{ os_services[0:1] }}"
-
-- name: add service
- os_keystone_service:
- cloud: opnfv
- name: "{{ item.name }}"
- description: "{{ item.description }}"
- service_type: "{{ item.type }}"
- with_items: "{{ os_services }}"
-
-- name: add project
- os_project:
- cloud: opnfv
- domain_id: default
- name: "{{ item.tenant }}"
- description: "{{ item.tenant_description }}"
- with_items: "{{ os_users }}"
-
-- name: add user
- os_user:
- cloud: opnfv
- domain: default
- name: "{{ item.user }}"
- password: "{{ item.password }}"
- default_project: "{{ item.tenant }}"
- email: "{{ item.email }}"
- with_items: "{{ os_users }}"
-
-- name: add roles
- os_keystone_role:
- cloud: opnfv
- name: "{{ item.role }}"
- with_items: "{{ os_users }}"
-
-- name: grant roles
- os_user_role:
- cloud: opnfv
- user: "{{ item.user }}"
- role: "{{ item.role }}"
- project: "{{ item.tenant }}"
- with_items: "{{ os_users }}"
-
-- name: create admin url for service's endpoint
- keystone_endpoint:
- cloud: opnfv
- endpoint_type: admin
- name: "{{ item.name }}"
- service_type: "{{ item.type }}"
- state: present
- interface: admin
- region: "{{ item.region}}"
- url: "{{ item.adminurl }}"
- with_items: "{{ os_services[1:] }}"
-
-- name: create internal url for service's endpoint
- keystone_endpoint:
- cloud: opnfv
- endpoint_type: admin
- name: "{{ item.name }}"
- service_type: "{{ item.type }}"
- state: present
- interface: internal
- region: "{{ item.region}}"
- url: "{{ item.internalurl }}"
- with_items: "{{ os_services[1:] }}"
-
-- name: create public url for service'e endpoint
- keystone_endpoint:
- cloud: opnfv
- endpoint_type: admin
- name: "{{ item.name }}"
- service_type: "{{ item.type }}"
- state: present
- interface: public
- region: "{{ item.region}}"
- url: "{{ item.publicurl }}"
- with_items: "{{ os_services[1:] }}"
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-- include_vars: "{{ ansible_os_family }}.yml"
-
-- name: disable auto start
- copy:
- content: "#!/bin/sh\nexit 101"
- dest: "/usr/sbin/policy-rc.d"
- mode: 0755
- when: ansible_os_family == "Debian"
-
-- name: install keystone packages
- action: "{{ ansible_pkg_mgr }} name={{ item }} state=present"
- with_items: "{{ packages | union(packages_noarch) }}"
-
-- name: enable auto start
- file:
- path=/usr/sbin/policy-rc.d
- state=absent
- when: ansible_os_family == "Debian"
-
-- name: disable boot auto start
- file:
- path={{ item }}
- state=absent
- with_items:
- - /etc/init.d/keystone
- - /etc/init/keystone.conf
- - /lib/systemd/system/keystone.service
- when: ansible_os_family == "Debian"
-
-- name: generate keystone service list
- lineinfile: dest=/opt/service create=yes line='{{ item }}'
- with_items: "{{ services | union(services_noarch) }}"
-
-- name: delete sqlite database
- file:
- path: /var/lib/keystone/keystone.db
- state: absent
-
-- name: update keystone conf
- template: src=keystone.conf dest=/etc/keystone/keystone.conf backup=yes
- notify:
- - restart keystone services
-
-- name: assure listen port exist
- lineinfile:
- dest: '{{ apache_config_dir }}/ports.conf'
- regexp: '{{ item.regexp }}'
- line: '{{ item.line}}'
- with_items:
- - regexp: "^Listen {{ internal_ip }}:5000"
- line: "Listen {{ internal_ip }}:5000"
- - regexp: "^Listen {{ internal_ip }}:35357"
- line: "Listen {{ internal_ip }}:35357"
- notify:
- - restart keystone services
-
-- name: update apache2 configs
- template:
- src: wsgi-keystone.conf.j2
- dest: '{{ apache_config_dir }}/sites-available/keystone.conf'
- when: ansible_os_family == 'Debian'
- notify:
- - restart keystone services
-
-- name: update apache2 configs
- template:
- src: wsgi-keystone.conf.j2
- dest: '{{ apache_config_dir }}/keystone.conf'
- when: ansible_os_family == 'RedHat'
- notify:
- - restart keystone services
-
-- name: enable keystone server
- file:
- src: "{{ apache_config_dir }}/sites-available/keystone.conf"
- dest: "{{ apache_config_dir }}/sites-enabled/keystone.conf"
- state: "link"
- when: ansible_os_family == 'Debian'
- notify:
- - restart keystone services
-
-- name: install shade
- pip: name=shade state=present
-
-- name: create path for os-client-config
- file:
- path: /etc/openstack
- state: directory
- mode: 0755
-
-- name: copy os-client-config
- template:
- src: clouds.yml.j2
- dest: /etc/openstack/clouds.yml
-
-- name: keystone source files
- template: src={{ item }} dest=/opt/{{ item }}
- with_items:
- - admin-openrc.sh
- - admin-openrc-v2.sh
- - demo-openrc.sh
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-- include: keystone_install.yml
- tags:
- - install
- - keystone_install
- - keystone
-
-- include: keystone_config.yml
- when: inventory_hostname == groups['controller'][0]
- tags:
- - config
- - keystone_config
- - keystone
-
-- meta: flush_handlers
-
-- include: keystone_create.yml
- when: inventory_hostname == groups['controller'][0]
- tags:
- - config
- - keystone_create
- - keystone
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
-# Verify the Identity Service installation
-export OS_PASSWORD={{ ADMIN_PASS }}
-export OS_TENANT_NAME=admin
-export OS_AUTH_URL=http://{{ internal_vip.ip }}:35357/v2.0
-export OS_USERNAME=admin
-export OS_VOLUME_API_VERSION=2
-
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
-# Verify the Identity Service installation
-export OS_PROJECT_DOMAIN_NAME=default
-export OS_USER_DOMAIN_NAME=default
-export OS_TENANT_NAME=admin
-export OS_PROJECT_NAME=admin
-export OS_USERNAME=admin
-export OS_PASSWORD={{ ADMIN_PASS }}
-export OS_AUTH_URL=http://{{ internal_vip.ip }}:35357/v3
-export OS_IDENTITY_API_VERSION=3
-export OS_IMAGE_API_VERSION=2
+++ /dev/null
----
-clouds:
- opnfv:
- auth:
- username: 'admin'
- password: {{ ADMIN_PASS }}
- project_name: 'admin'
- auth_url: 'http://{{ internal_vip.ip }}:35357/v3'
- project_domain_name: default
- user_domain_name: default
- identity_api_version: 3
- region_name: RegionOne
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
-export OS_PROJECT_DOMAIN_NAME=default
-export OS_USER_DOMAIN_NAME=default
-export OS_TENANT_NAME=demo
-export OS_PROJECT_NAME=demo
-export OS_USERNAME=demo
-export OS_PASSWORD={{ DEMO_PASS }}
-export OS_AUTH_URL=http://{{ internal_vip.ip }}:5000/v3
-export OS_IDENTITY_API_VERSION=3
-export OS_IMAGE_API_VERSION=2
+++ /dev/null
-{% set memcached_servers = [] %}
-{% set rabbitmq_servers = [] %}
-{% for host in haproxy_hosts.values() %}
-{% set _ = memcached_servers.append('%s:11211'% host) %}
-{% set _ = rabbitmq_servers.append('%s:5672'% host) %}
-{% endfor %}
-{% set memcached_servers = memcached_servers|join(',') %}
-{% set rabbitmq_servers = rabbitmq_servers|join(',') %}
-[DEFAULT]
-debug={{ DEBUG }}
-log_dir = /var/log/keystone
-
-[cache]
-backend = keystone.cache.memcache_pool
-memcache_servers = {{ memcached_servers}}
-enabled=true
-
-[revoke]
-driver = sql
-expiration_buffer = 3600
-caching = true
-
-[database]
-connection = mysql://keystone:{{ KEYSTONE_DBPASS }}@{{ db_host }}/keystone?charset=utf8
-idle_timeout = 30
-min_pool_size = 5
-max_pool_size = 120
-pool_timeout = 30
-
-[fernet_tokens]
-key_repository = /etc/keystone/fernet-keys/
-
-[identity]
-default_domain_id = default
-driver = sql
-
-[assignment]
-driver = sql
-
-[resource]
-driver = sql
-caching = true
-cache_time = 3600
-
-[token]
-enforce_token_bind = permissive
-expiration = 43200
-provider = fernet
-driver = sql
-caching = true
-cache_time = 3600
-
-[eventlet_server]
-public_bind_host = {{ identity_host }}
-admin_bind_host = {{ identity_host }}
-
-[oslo_messaging_rabbit]
-rabbit_userid = {{ RABBIT_USER }}
-rabbit_password = {{ RABBIT_PASS }}
-rabbit_hosts = {{ rabbitmq_servers }}
+++ /dev/null
-{% set work_threads = (ansible_processor_vcpus + 1) // 2 %}
-{% if work_threads > 10 %}
-{% set work_threads = 10 %}
-{% endif %}
-
-<VirtualHost {{ internal_ip }}:5000>
- WSGIDaemonProcess keystone-public processes=4 threads={{ work_threads }} user=keystone group=keystone display-name=%{GROUP}
- WSGIProcessGroup keystone-public
- WSGIScriptAlias / /usr/bin/keystone-wsgi-public
- WSGIApplicationGroup %{GLOBAL}
- WSGIPassAuthorization On
- <IfVersion >= 2.4>
- ErrorLogFormat "%{cu}t %M"
- </IfVersion>
- ErrorLog /var/log/{{ http_service_name }}/keystone.log
- CustomLog /var/log/{{ http_service_name }}/keystone_access.log combined
-
- <Directory /usr/bin>
- <IfVersion >= 2.4>
- Require all granted
- </IfVersion>
- <IfVersion < 2.4>
- Order allow,deny
- Allow from all
- </IfVersion>
- </Directory>
-</VirtualHost>
-
-<VirtualHost {{ internal_ip }}:35357>
- WSGIDaemonProcess keystone-admin processes=4 threads={{ work_threads }} user=keystone group=keystone display-name=%{GROUP}
- WSGIProcessGroup keystone-admin
- WSGIScriptAlias / /usr/bin/keystone-wsgi-admin
- WSGIApplicationGroup %{GLOBAL}
- WSGIPassAuthorization On
- <IfVersion >= 2.4>
- ErrorLogFormat "%{cu}t %M"
- </IfVersion>
- ErrorLog /var/log/{{ http_service_name }}/keystone.log
- CustomLog /var/log/{{ http_service_name }}/keystone_access.log combined
-
- <Directory /usr/bin>
- <IfVersion >= 2.4>
- Require all granted
- </IfVersion>
- <IfVersion < 2.4>
- Order allow,deny
- Allow from all
- </IfVersion>
- </Directory>
-</VirtualHost>
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-
-cron_path: "/var/spool/cron/crontabs"
-
-packages:
- - apache2
- - libapache2-mod-wsgi
- - python-keystone
- - python-openstackclient
- - keystone
-
-services:
- - apache2
-
-apache_config_dir: /etc/apache2
-http_service_name: apache2
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-cron_path: "/var/spool/cron"
-
-packages:
- - openstack-keystone
- - python-openstackclient
-
-services:
- - httpd
-
-apache_config_dir: /etc/httpd/conf.d
-http_service_name: httpd
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-packages_noarch:
- - python-keystoneclient
-
-services_noarch: []
-os_services:
- - name: keystone
- type: identity
- region: RegionOne
- description: "OpenStack Identity"
- publicurl: "http://{{ public_vip.ip }}:5000/v3"
- internalurl: "http://{{ internal_vip.ip }}:5000/v3"
- adminurl: "http://{{ internal_vip.ip }}:35357/v3"
-
- - name: glance
- type: image
- region: RegionOne
- description: "OpenStack Image Service"
- publicurl: "http://{{ public_vip.ip }}:9292"
- internalurl: "http://{{ internal_vip.ip }}:9292"
- adminurl: "http://{{ internal_vip.ip }}:9292"
-
- - name: nova
- type: compute
- region: RegionOne
- description: "OpenStack Compute"
- publicurl: "http://{{ public_vip.ip }}:8774/v2.1/%(tenant_id)s"
- internalurl: "http://{{ internal_vip.ip }}:8774/v2.1/%(tenant_id)s"
- adminurl: "http://{{ internal_vip.ip }}:8774/v2.1/%(tenant_id)s"
-
- - name: neutron
- type: network
- region: RegionOne
- description: "OpenStack Networking"
- publicurl: "http://{{ public_vip.ip }}:9696"
- internalurl: "http://{{ internal_vip.ip }}:9696"
- adminurl: "http://{{ internal_vip.ip }}:9696"
-
- - name: ceilometer
- type: metering
- region: RegionOne
- description: "OpenStack Telemetry"
- publicurl: "http://{{ public_vip.ip }}:8777"
- internalurl: "http://{{ internal_vip.ip }}:8777"
- adminurl: "http://{{ internal_vip.ip }}:8777"
-
- - name: aodh
- type: alarming
- region: RegionOne
- description: "OpenStack Telemetry"
- publicurl: "http://{{ public_vip.ip }}:8042"
- internalurl: "http://{{ internal_vip.ip }}:8042"
- adminurl: "http://{{ internal_vip.ip }}:8042"
-
- - name: cinder
- type: volume
- region: RegionOne
- description: "OpenStack Block Storage"
- publicurl: "http://{{ public_vip.ip }}:8776/v1/%(tenant_id)s"
- internalurl: "http://{{ internal_vip.ip }}:8776/v1/%(tenant_id)s"
- adminurl: "http://{{ internal_vip.ip }}:8776/v1/%(tenant_id)s"
-
- - name: cinderv2
- type: volumev2
- region: RegionOne
- description: "OpenStack Block Storage v2"
- publicurl: "http://{{ public_vip.ip }}:8776/v2/%(tenant_id)s"
- internalurl: "http://{{ internal_vip.ip }}:8776/v2/%(tenant_id)s"
- adminurl: "http://{{ internal_vip.ip }}:8776/v2/%(tenant_id)s"
-
- - name: heat
- type: orchestration
- region: RegionOne
- description: "OpenStack Orchestration"
- publicurl: "http://{{ public_vip.ip }}:8004/v1/%(tenant_id)s"
- internalurl: "http://{{ internal_vip.ip }}:8004/v1/%(tenant_id)s"
- adminurl: "http://{{ internal_vip.ip }}:8004/v1/%(tenant_id)s"
-
- - name: heat-cfn
- type: cloudformation
- region: RegionOne
- description: "OpenStack CloudFormation Orchestration"
- publicurl: "http://{{ public_vip.ip }}:8000/v1"
- internalurl: "http://{{ internal_vip.ip }}:8000/v1"
- adminurl: "http://{{ internal_vip.ip }}:8000/v1"
-
-# - name: congress
-# type: policy
-# region: RegionOne
-# description: "OpenStack Policy Service"
-# publicurl: "http://{{ public_vip.ip }}:1789"
-# internalurl: "http://{{ internal_vip.ip }}:1789"
-# adminurl: "http://{{ internal_vip.ip }}:1789"
-
-# - name: swift
-# type: object-store
-# region: RegionOne
-# description: "OpenStack Object Storage"
-# publicurl: "http://{{ public_vip.ip }}:8080/v1/AUTH_%(tenant_id)s"
-# internalurl: "http://{{ internal_vip.ip }}:8080/v1/AUTH_%(tenant_id)s"
-# adminurl: "http://{{ internal_vip.ip }}:8080/v1/AUTH_%(tenant_id)s"
-
-os_users:
- - user: admin
- password: "{{ ADMIN_PASS }}"
- email: admin@admin.com
- role: admin
- tenant: admin
- tenant_description: "Admin Tenant"
-
- - user: glance
- password: "{{ GLANCE_PASS }}"
- email: glance@admin.com
- role: admin
- tenant: service
- tenant_description: "Service Tenant"
-
- - user: nova
- password: "{{ NOVA_PASS }}"
- email: nova@admin.com
- role: admin
- tenant: service
- tenant_description: "Service Tenant"
-
- - user: keystone
- password: "{{ KEYSTONE_PASS }}"
- email: keystone@admin.com
- role: admin
- tenant: service
- tenant_description: "Service Tenant"
-
- - user: neutron
- password: "{{ NEUTRON_PASS }}"
- email: neutron@admin.com
- role: admin
- tenant: service
- tenant_description: "Service Tenant"
-
- - user: ceilometer
- password: "{{ CEILOMETER_PASS }}"
- email: ceilometer@admin.com
- role: admin
- tenant: service
- tenant_description: "Service Tenant"
-
- - user: cinder
- password: "{{ CINDER_PASS }}"
- email: cinder@admin.com
- role: admin
- tenant: service
- tenant_description: "Service Tenant"
-
- - user: aodh
- password: "{{ AODH_PASS }}"
- email: aodh@admin.com
- role: admin
- tenant: service
- tenant_description: "Service Tenant"
-
- - user: heat
- password: "{{ HEAT_PASS }}"
- email: heat@admin.com
- role: admin
- tenant: service
- tenant_description: "Service Tenant"
-
- - user: demo
- password: "{{ DEMO_PASS }}"
- email: heat@demo.com
- role: heat_stack_user
- tenant: demo
- tenant_description: "Demo Tenant"
-
-# - user: congress
-# password: "{{ CONGRESS_PASS }}"
-# email: congress@admin.com
-# role: admin
-# tenant: service
-# tenant_description: "Service Tenant"
+++ /dev/null
-##############################################################################
-## Copyright (c) 2015 Nokia and others.
-##
-## All rights reserved. This program and the accompanying materials
-## are made available under the terms of the Apache License, Version 2.0
-## which accompanies this distribution, and is available at
-## http://www.apache.org/licenses/LICENSE-2.0
-###############################################################################
----
-
-packages:
- - qemu-kvm
- - grub-pc
- - zlib1g
- - libglib2.0
+++ /dev/null
-##############################################################################
-## Copyright (c) 2015 Nokia and others.
-##
-## All rights reserved. This program and the accompanying materials
-## are made available under the terms of the Apache License, Version 2.0
-## which accompanies this distribution, and is available at
-## http://www.apache.org/licenses/LICENSE-2.0
-###############################################################################
----
-
-packages:
- - zlib
- - glib2
- - gettext
- - qemu-kvm
- - grub2
+++ /dev/null
-##############################################################################
-## Copyright (c) 2015 Nokia and others.
-##
-## All rights reserved. This program and the accompanying materials
-## are made available under the terms of the Apache License, Version 2.0
-## which accompanies this distribution, and is available at
-## http://www.apache.org/licenses/LICENSE-2.0
-###############################################################################
----
-
-path: /tmp/kvmfornfv
-kernel_path: "{{ path }}/kernel"
-qemu_path: "{{ path }}/qemu"
-qemu_build_dir: "{{ qemu_path }}/build"
-package: kvmfornfv.tar.gz
+++ /dev/null
-##############################################################################
-## Copyright (c) 2015 Nokia and others.
-##
-## All rights reserved. This program and the accompanying materials
-## are made available under the terms of the Apache License, Version 2.0
-## which accompanies this distribution, and is available at
-## http://www.apache.org/licenses/LICENSE-2.0
-###############################################################################
----
-- name: get package http server
- shell: awk -F'=' '/compass_server/ {print $2}' /etc/compass.conf
- register: http_server
-
-- name: download kvmfornfv package file
- get_url:
- url: "http://{{ http_server.stdout_lines[0] }}/packages/kvmfornfv/{{ package }}"
- dest: /tmp/{{ package }}
-
-- name: extract kvmfornfv files
- command: su -s /bin/sh -c "tar xzf /tmp/{{ package }} -C /"
-
-- name: Update grub on Centos
- shell: grub2-mkconfig -o /boot/grub2/grub.conf
- when: ansible_os_family == 'RedHat'
-
-- name: Update grub on Ubuntu
- shell: grub-mkconfig -o /boot/grub/grub.conf
- when: ansible_os_family == 'Debian'
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-- name: restart memcahed services
- service: name={{ item }} state=restarted enabled=yes
- with_items: "{{ services| union(services_noarch) }}"
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-- include_vars: "{{ ansible_os_family }}.yml"
-
-- name: disable auto start
- copy:
- content: "#!/bin/sh\nexit 101"
- dest: "/usr/sbin/policy-rc.d"
- mode: 0755
- when: ansible_os_family == "Debian"
-
-- name: install packages
- action: "{{ ansible_pkg_mgr }} name={{ item }} state=latest update_cache=yes"
- with_items: "{{ packages | union(packages_noarch) }}"
- notify:
- - restart memcahed services
-
-- name: enable auto start
- file:
- path=/usr/sbin/policy-rc.d
- state=absent
- when: ansible_os_family == "Debian"
-
-- name: change memcache listen ip
- lineinfile: dest=/etc/memcached.conf regexp="^-l " line="-l 0.0.0.0"
- when: ansible_os_family == "Debian"
- notify:
- - restart memcahed services
-
-- name: change memcache listen ip
- lineinfile:
- dest=/etc/sysconfig/memcached
- regexp="^OPTIONS=.*"
- line="OPTIONS=\"-l 0.0.0.0\""
- when: ansible_os_family == "RedHat"
- notify:
- - restart memcahed services
-
-- name: generate memcached service list
- lineinfile: dest=/opt/service create=yes line='{{ item }}'
- with_items: "{{ services | union(services_noarch) }}"
-
-- meta: flush_handlers
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-packages:
- - python-memcache
-
-services: []
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-packages:
- - python-memcached
-
-pip_packages: []
-
-services: []
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-packages_noarch:
- - memcached
-
-services_noarch:
- - memcached
+++ /dev/null
-#!/bin/bash
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
-services=`cat /opt/service | uniq`
-for service in $services; do
- if [ `/sbin/initctl list|awk '/stop\/waiting/{print $1}'|uniq | grep $service` ]; then
- /sbin/start $service
- fi
-done
+++ /dev/null
-#!/bin/bash
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
-services=`cat /opt/service | uniq`
-for service in $services; do
- /usr/sbin/service $service status >/dev/null 2>&1
- if [[ $? -ne 0 ]]; then
- /usr/sbin/service $service start
- fi
-done
+++ /dev/null
-#!/bin/bash
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
-services=`cat /opt/service | uniq`
-for service in $services; do
- if [ `/sbin/initctl list|awk '/stop\/waiting/{print $1}'|uniq | grep $service` ]; then
- /sbin/start $service
- fi
-done
+++ /dev/null
-* * * * * /usr/local/bin/check_service.sh >> /var/log/check_service.log 2>&1
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-- include_vars: "{{ ansible_os_family }}.yml"
-
-- name: copy service check file
- copy:
- src: check_{{ ansible_os_family }}_service.sh
- dest: /usr/local/bin/check_service.sh
- mode: 0777
-
-- name: copy cron file
- copy: src=root dest={{ cron_path }}/root mode=0600
-
-- name: restart cron
- service: name={{ cron }} state=restarted
-
-- meta: flush_handlers
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-cron: cron
-cron_path: "/var/spool/cron/crontabs"
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-cron: crond
-cron_path: "/var/spool/cron"
+++ /dev/null
-# Copyright 2015 Open Platform for NFV Project, Inc. and its contributors
-# This software is distributed under the terms and conditions of the
-# 'Apache-2.0' license which can be found in the file 'LICENSE' in this
-# package distribution or at 'http://www.apache.org/licenses/LICENSE-2.0'.
-
-from keystone.common import controller
-from keystone import config
-from keystone import exception
-from keystone.models import token_model
-from keystone.contrib.moon.exception import * # noqa: F403
-from oslo_log import log
-from uuid import uuid4
-import requests
-
-
-CONF = config.CONF
-LOG = log.getLogger(__name__)
-
-
-@dependency.requires('configuration_api') # noqa: 405
-class Configuration(controller.V3Controller):
- collection_name = 'configurations'
- member_name = 'configuration'
-
- def __init__(self):
- super(Configuration, self).__init__()
-
- def _get_user_id_from_token(self, token_id):
- response = self.token_provider_api.validate_token(token_id)
- token_ref = token_model.KeystoneToken(
- token_id=token_id, token_data=response)
- return token_ref.get('user')
-
- @controller.protected()
- def get_policy_templates(self, context, **kw):
- user_id = self._get_user_id_from_token(context.get('token_id'))
- return self.configuration_api.get_policy_templates_dict(user_id)
-
- @controller.protected()
- def get_aggregation_algorithms(self, context, **kw):
- user_id = self._get_user_id_from_token(context.get('token_id'))
- return self.configuration_api.get_aggregation_algorithms_dict(user_id)
-
- @controller.protected()
- def get_sub_meta_rule_algorithms(self, context, **kw):
- user_id = self._get_user_id_from_token(context.get('token_id'))
- return self.configuration_api.get_sub_meta_rule_algorithms_dict(
- user_id)
-
-
-@dependency.requires('tenant_api', 'resource_api') # noqa: 405
-class Tenants(controller.V3Controller):
-
- def __init__(self):
- super(Tenants, self).__init__()
-
- def _get_user_id_from_token(self, token_id):
- response = self.token_provider_api.validate_token(token_id)
- token_ref = token_model.KeystoneToken(
- token_id=token_id, token_data=response)
- return token_ref.get('user')
-
- @controller.protected()
- def get_tenants(self, context, **kw):
- user_id = self._get_user_id_from_token(context.get('token_id'))
- return self.tenant_api.get_tenants_dict(user_id)
-
- def __get_keystone_tenant_dict(
- self, tenant_id="", tenant_name="", tenant_description="", domain="default"): # noqa
- tenants = self.resource_api.list_projects()
- for tenant in tenants:
- if tenant_id and tenant_id == tenant['id']:
- return tenant
- if tenant_name and tenant_name == tenant['name']:
- return tenant
- if not tenant_id:
- tenant_id = uuid4().hex
- if not tenant_name:
- tenant_name = tenant_id
- tenant = {
- "id": tenant_id,
- "name": tenant_name,
- "description": tenant_description,
- "enabled": True,
- "domain_id": domain
- }
- keystone_tenant = self.resource_api.create_project(
- tenant["id"], tenant)
- return keystone_tenant
-
- @controller.protected()
- def add_tenant(self, context, **kw):
- user_id = self._get_user_id_from_token(context.get('token_id'))
- k_tenant_dict = self.__get_keystone_tenant_dict(
- tenant_name=kw.get('tenant_name'),
- tenant_description=kw.get(
- 'tenant_description', kw.get('tenant_name')),
- domain=kw.get('tenant_domain', "default"),
-
- )
- tenant_dict = dict()
- tenant_dict['id'] = k_tenant_dict['id']
- tenant_dict['name'] = kw.get('tenant_name', None)
- tenant_dict['description'] = kw.get('tenant_description', None)
- tenant_dict['intra_authz_extension_id'] = kw.get(
- 'tenant_intra_authz_extension_id', None)
- tenant_dict['intra_admin_extension_id'] = kw.get(
- 'tenant_intra_admin_extension_id', None)
- return self.tenant_api.add_tenant_dict(
- user_id, tenant_dict['id'], tenant_dict)
-
- @controller.protected()
- def get_tenant(self, context, **kw):
- user_id = self._get_user_id_from_token(context.get('token_id'))
- tenant_id = kw.get('tenant_id', None)
- return self.tenant_api.get_tenant_dict(user_id, tenant_id)
-
- @controller.protected()
- def del_tenant(self, context, **kw):
- user_id = self._get_user_id_from_token(context.get('token_id'))
- tenant_id = kw.get('tenant_id', None)
- return self.tenant_api.del_tenant(user_id, tenant_id)
-
- @controller.protected()
- def set_tenant(self, context, **kw):
- user_id = self._get_user_id_from_token(context.get('token_id'))
- # Next line will raise an error if tenant doesn't exist
- k_tenant_dict = self.resource_api.get_project(
- kw.get('tenant_id', None))
- tenant_id = kw.get('tenant_id', None)
- tenant_dict = dict()
- tenant_dict['name'] = k_tenant_dict.get('name', None)
- if 'tenant_description' in kw:
- tenant_dict['description'] = kw.get('tenant_description', None)
- if 'tenant_intra_authz_extension_id' in kw:
- tenant_dict['intra_authz_extension_id'] = kw.get(
- 'tenant_intra_authz_extension_id', None)
- if 'tenant_intra_admin_extension_id' in kw:
- tenant_dict['intra_admin_extension_id'] = kw.get(
- 'tenant_intra_admin_extension_id', None)
- self.tenant_api.set_tenant_dict(user_id, tenant_id, tenant_dict)
-
-
-def callback(self, context, prep_info, *args, **kwargs):
- token_ref = ""
- if context.get('token_id') is not None:
- token_ref = token_model.KeystoneToken(
- token_id=context['token_id'],
- token_data=self.token_provider_api.validate_token(
- context['token_id']))
- if not token_ref:
- raise exception.Unauthorized
-
-
-@dependency.requires('authz_api') # noqa: 405
-class Authz_v3(controller.V3Controller):
-
- def __init__(self):
- super(Authz_v3, self).__init__()
-
- @controller.protected(callback)
- def get_authz(self, context, tenant_id, subject_k_id,
- object_name, action_name):
- try:
- return self.authz_api.authz(
- tenant_id, subject_k_id, object_name, action_name)
- except Exception as e:
- return {'authz': False, 'comment': unicode(e)}
-
-
-@dependency.requires('admin_api', 'root_api') # noqa: 405
-class IntraExtensions(controller.V3Controller):
- collection_name = 'intra_extensions'
- member_name = 'intra_extension'
-
- def __init__(self):
- super(IntraExtensions, self).__init__()
-
- def _get_user_id_from_token(self, token_id):
- response = self.token_provider_api.validate_token(token_id)
- token_ref = token_model.KeystoneToken(
- token_id=token_id, token_data=response)
- return token_ref.get('user')['id']
-
- # IntraExtension functions
- @controller.protected()
- def get_intra_extensions(self, context, **kw):
- user_id = self._get_user_id_from_token(context.get('token_id'))
- return self.admin_api.get_intra_extensions_dict(user_id)
-
- @controller.protected()
- def add_intra_extension(self, context, **kw):
- user_id = self._get_user_id_from_token(context.get('token_id'))
- intra_extension_dict = dict()
- intra_extension_dict['name'] = kw.get('intra_extension_name', None)
- intra_extension_dict['model'] = kw.get('intra_extension_model', None)
- intra_extension_dict['genre'] = kw.get('intra_extension_genre', None)
- intra_extension_dict['description'] = kw.get(
- 'intra_extension_description', None)
- intra_extension_dict['subject_categories'] = kw.get(
- 'intra_extension_subject_categories', dict())
- intra_extension_dict['object_categories'] = kw.get(
- 'intra_extension_object_categories', dict())
- intra_extension_dict['action_categories'] = kw.get(
- 'intra_extension_action_categories', dict())
- intra_extension_dict['subjects'] = kw.get(
- 'intra_extension_subjects', dict())
- intra_extension_dict['objects'] = kw.get(
- 'intra_extension_objects', dict())
- intra_extension_dict['actions'] = kw.get(
- 'intra_extension_actions', dict())
- intra_extension_dict['subject_scopes'] = kw.get(
- 'intra_extension_subject_scopes', dict())
- intra_extension_dict['object_scopes'] = kw.get(
- 'intra_extension_object_scopes', dict())
- intra_extension_dict['action_scopes'] = kw.get(
- 'intra_extension_action_scopes', dict())
- intra_extension_dict['subject_assignments'] = kw.get(
- 'intra_extension_subject_assignments', dict())
- intra_extension_dict['object_assignments'] = kw.get(
- 'intra_extension_object_assignments', dict())
- intra_extension_dict['action_assignments'] = kw.get(
- 'intra_extension_action_assignments', dict())
- intra_extension_dict['aggregation_algorithm'] = kw.get(
- 'intra_extension_aggregation_algorithm', dict())
- intra_extension_dict['sub_meta_rules'] = kw.get(
- 'intra_extension_sub_meta_rules', dict())
- intra_extension_dict['rules'] = kw.get('intra_extension_rules', dict())
- ref = self.admin_api.load_intra_extension_dict(
- user_id, intra_extension_dict=intra_extension_dict)
- return self.admin_api.populate_default_data(ref)
-
- @controller.protected()
- def get_intra_extension(self, context, **kw):
- user_id = self._get_user_id_from_token(context.get('token_id'))
- intra_extension_id = kw.get('intra_extension_id', None)
- return self.admin_api.get_intra_extension_dict(
- user_id, intra_extension_id)
-
- @controller.protected()
- def del_intra_extension(self, context, **kw):
- user_id = self._get_user_id_from_token(context.get('token_id'))
- intra_extension_id = kw.get('intra_extension_id', None)
- self.admin_api.del_intra_extension(user_id, intra_extension_id)
-
- @controller.protected()
- def set_intra_extension(self, context, **kw):
- user_id = self._get_user_id_from_token(context.get('token_id'))
- intra_extension_id = kw.get('intra_extension_id', None)
- intra_extension_dict = dict()
- intra_extension_dict['name'] = kw.get('intra_extension_name', None)
- intra_extension_dict['model'] = kw.get('intra_extension_model', None)
- intra_extension_dict['genre'] = kw.get('intra_extension_genre', None)
- intra_extension_dict['description'] = kw.get(
- 'intra_extension_description', None)
- return self.admin_api.set_intra_extension_dict(
- user_id, intra_extension_id, intra_extension_dict)
-
- @controller.protected()
- def load_root_intra_extension(self, context, **kw):
- self.root_api.load_root_intra_extension_dict()
-
- # Metadata functions
- @controller.protected()
- def get_subject_categories(self, context, **kw):
- user_id = self._get_user_id_from_token(context.get('token_id'))
- intra_extension_id = kw.get('intra_extension_id', None)
- return self.admin_api.get_subject_categories_dict(
- user_id, intra_extension_id)
-
- @controller.protected()
- def add_subject_category(self, context, **kw):
- user_id = self._get_user_id_from_token(context.get('token_id'))
- intra_extension_id = kw.get('intra_extension_id', None)
- subject_category_dict = dict()
- subject_category_dict['name'] = kw.get('subject_category_name', None)
- subject_category_dict['description'] = kw.get(
- 'subject_category_description', None)
- return self.admin_api.add_subject_category_dict(
- user_id, intra_extension_id, subject_category_dict)
-
- @controller.protected()
- def get_subject_category(self, context, **kw):
- user_id = self._get_user_id_from_token(context.get('token_id'))
- intra_extension_id = kw.get('intra_extension_id', None)
- subject_category_id = kw.get('subject_category_id', None)
- return self.admin_api.get_subject_category_dict(
- user_id, intra_extension_id, subject_category_id)
-
- @controller.protected()
- def del_subject_category(self, context, **kw):
- user_id = self._get_user_id_from_token(context.get('token_id'))
- intra_extension_id = kw.get('intra_extension_id', None)
- subject_category_id = kw.get('subject_category_id', None)
- self.admin_api.del_subject_category(
- user_id, intra_extension_id, subject_category_id)
-
- @controller.protected()
- def set_subject_category(self, context, **kw):
- user_id = self._get_user_id_from_token(context.get('token_id'))
- intra_extension_id = kw.get('intra_extension_id', None)
- subject_category_id = kw.get('subject_category_id', None)
- subject_category_dict = dict()
- subject_category_dict['name'] = kw.get('subject_category_name', None)
- subject_category_dict['description'] = kw.get(
- 'subject_category_description', None)
- return self.admin_api.set_subject_category_dict(
- user_id, intra_extension_id, subject_category_id, subject_category_dict) # noqa
-
- @controller.protected()
- def get_object_categories(self, context, **kw):
- user_id = self._get_user_id_from_token(context.get('token_id'))
- intra_extension_id = kw.get('intra_extension_id', None)
- return self.admin_api.get_object_categories_dict(
- user_id, intra_extension_id)
-
- @controller.protected()
- def add_object_category(self, context, **kw):
- user_id = self._get_user_id_from_token(context.get('token_id'))
- intra_extension_id = kw.get('intra_extension_id', None)
- object_category_dict = dict()
- object_category_dict['name'] = kw.get('object_category_name', None)
- object_category_dict['description'] = kw.get(
- 'object_category_description', None)
- return self.admin_api.add_object_category_dict(
- user_id, intra_extension_id, object_category_dict)
-
- @controller.protected()
- def get_object_category(self, context, **kw):
- user_id = self._get_user_id_from_token(context.get('token_id'))
- intra_extension_id = kw.get('intra_extension_id', None)
- object_category_id = kw.get('object_category_id', None)
- return self.admin_api.get_object_categories_dict(
- user_id, intra_extension_id, object_category_id)
-
- @controller.protected()
- def del_object_category(self, context, **kw):
- user_id = self._get_user_id_from_token(context.get('token_id'))
- intra_extension_id = kw.get('intra_extension_id', None)
- object_category_id = kw.get('object_category_id', None)
- self.admin_api.del_object_category(
- user_id, intra_extension_id, object_category_id)
-
- @controller.protected()
- def set_object_category(self, context, **kw):
- user_id = self._get_user_id_from_token(context.get('token_id'))
- intra_extension_id = kw.get('intra_extension_id', None)
- object_category_id = kw.get('object_category_id', None)
- object_category_dict = dict()
- object_category_dict['name'] = kw.get('object_category_name', None)
- object_category_dict['description'] = kw.get(
- 'object_category_description', None)
- return self.admin_api.set_object_category_dict(
- user_id, intra_extension_id, object_category_id, object_category_dict) # noqa
-
- @controller.protected()
- def get_action_categories(self, context, **kw):
- user_id = self._get_user_id_from_token(context.get('token_id'))
- intra_extension_id = kw.get('intra_extension_id', None)
- return self.admin_api.get_action_categories_dict(
- user_id, intra_extension_id)
-
- @controller.protected()
- def add_action_category(self, context, **kw):
- user_id = self._get_user_id_from_token(context.get('token_id'))
- intra_extension_id = kw.get('intra_extension_id', None)
- action_category_dict = dict()
- action_category_dict['name'] = kw.get('action_category_name', None)
- action_category_dict['description'] = kw.get(
- 'action_category_description', None)
- return self.admin_api.add_action_category_dict(
- user_id, intra_extension_id, action_category_dict)
-
- @controller.protected()
- def get_action_category(self, context, **kw):
- user_id = self._get_user_id_from_token(context.get('token_id'))
- intra_extension_id = kw.get('intra_extension_id', None)
- action_category_id = kw.get('action_category_id', None)
- return self.admin_api.get_action_categories_dict(
- user_id, intra_extension_id, action_category_id)
-
- @controller.protected()
- def del_action_category(self, context, **kw):
- user_id = self._get_user_id_from_token(context.get('token_id'))
- intra_extension_id = kw.get('intra_extension_id', None)
- action_category_id = kw.get('action_category_id', None)
- self.admin_api.del_action_category(
- user_id, intra_extension_id, action_category_id)
-
- @controller.protected()
- def set_action_category(self, context, **kw):
- user_id = self._get_user_id_from_token(context.get('token_id'))
- intra_extension_id = kw.get('intra_extension_id', None)
- action_category_id = kw.get('action_category_id', None)
- action_category_dict = dict()
- action_category_dict['name'] = kw.get('action_category_name', None)
- action_category_dict['description'] = kw.get(
- 'action_category_description', None)
- return self.admin_api.set_action_category_dict(
- user_id, intra_extension_id, action_category_id, action_category_dict) # noqa
-
- # Perimeter functions
- @controller.protected()
- def get_subjects(self, context, **kw):
- user_id = self._get_user_id_from_token(context.get('token_id'))
- intra_extension_id = kw.get('intra_extension_id', None)
- return self.admin_api.get_subjects_dict(user_id, intra_extension_id)
-
- @controller.protected()
- def add_subject(self, context, **kw):
- user_id = self._get_user_id_from_token(context.get('token_id'))
- intra_extension_id = kw.get('intra_extension_id', None)
- subject_dict = dict()
- subject_dict['name'] = kw.get('subject_name', None)
- subject_dict['description'] = kw.get('subject_description', None)
- subject_dict['password'] = kw.get('subject_password', None)
- subject_dict['email'] = kw.get('subject_email', None)
- return self.admin_api.add_subject_dict(
- user_id, intra_extension_id, subject_dict)
-
- @controller.protected()
- def get_subject(self, context, **kw):
- user_id = self._get_user_id_from_token(context.get('token_id'))
- intra_extension_id = kw.get('intra_extension_id', None)
- subject_id = kw.get('subject_id', None)
- return self.admin_api.get_subject_dict(
- user_id, intra_extension_id, subject_id)
-
- @controller.protected()
- def del_subject(self, context, **kw):
- user_id = self._get_user_id_from_token(context.get('token_id'))
- intra_extension_id = kw.get('intra_extension_id', None)
- subject_id = kw.get('subject_id', None)
- self.admin_api.del_subject(user_id, intra_extension_id, subject_id)
-
- @controller.protected()
- def set_subject(self, context, **kw):
- user_id = self._get_user_id_from_token(context.get('token_id'))
- intra_extension_id = kw.get('intra_extension_id', None)
- subject_id = kw.get('subject_id', None)
- subject_dict = dict()
- subject_dict['name'] = kw.get('subject_name', None)
- subject_dict['description'] = kw.get('subject_description', None)
- return self.admin_api.set_subject_dict(
- user_id, intra_extension_id, subject_id, subject_dict)
-
- @controller.protected()
- def get_objects(self, context, **kw):
- user_id = self._get_user_id_from_token(context.get('token_id'))
- intra_extension_id = kw.get('intra_extension_id', None)
- return self.admin_api.get_objects_dict(user_id, intra_extension_id)
-
- @controller.protected()
- def add_object(self, context, **kw):
- user_id = self._get_user_id_from_token(context.get('token_id'))
- intra_extension_id = kw.get('intra_extension_id', None)
- object_dict = dict()
- object_dict['name'] = kw.get('object_name', None)
- object_dict['description'] = kw.get('object_description', None)
- return self.admin_api.add_object_dict(
- user_id, intra_extension_id, object_dict)
-
- @controller.protected()
- def get_object(self, context, **kw):
- user_id = self._get_user_id_from_token(context.get('token_id'))
- intra_extension_id = kw.get('intra_extension_id', None)
- object_id = kw.get('object_id', None)
- return self.admin_api.get_object_dict(
- user_id, intra_extension_id, object_id)
-
- @controller.protected()
- def del_object(self, context, **kw):
- user_id = self._get_user_id_from_token(context.get('token_id'))
- intra_extension_id = kw.get('intra_extension_id', None)
- object_id = kw.get('object_id', None)
- self.admin_api.del_object(user_id, intra_extension_id, object_id)
-
- @controller.protected()
- def set_object(self, context, **kw):
- user_id = self._get_user_id_from_token(context.get('token_id'))
- intra_extension_id = kw.get('intra_extension_id', None)
- object_id = kw.get('object_id', None)
- object_dict = dict()
- object_dict['name'] = kw.get('object_name', None)
- object_dict['description'] = kw.get('object_description', None)
- return self.admin_api.set_object_dict(
- user_id, intra_extension_id, object_id, object_dict)
-
- @controller.protected()
- def get_actions(self, context, **kw):
- user_id = self._get_user_id_from_token(context.get('token_id'))
- intra_extension_id = kw.get('intra_extension_id', None)
- return self.admin_api.get_actions_dict(user_id, intra_extension_id)
-
- @controller.protected()
- def add_action(self, context, **kw):
- user_id = self._get_user_id_from_token(context.get('token_id'))
- intra_extension_id = kw.get('intra_extension_id', None)
- action_dict = dict()
- action_dict['name'] = kw.get('action_name', None)
- action_dict['description'] = kw.get('action_description', None)
- return self.admin_api.add_action_dict(
- user_id, intra_extension_id, action_dict)
-
- @controller.protected()
- def get_action(self, context, **kw):
- user_id = self._get_user_id_from_token(context.get('token_id'))
- intra_extension_id = kw.get('intra_extension_id', None)
- action_id = kw.get('action_id', None)
- return self.admin_api.get_action_dict(
- user_id, intra_extension_id, action_id)
-
- @controller.protected()
- def del_action(self, context, **kw):
- user_id = self._get_user_id_from_token(context.get('token_id'))
- intra_extension_id = kw.get('intra_extension_id', None)
- action_id = kw.get('action_id', None)
- self.admin_api.del_action(user_id, intra_extension_id, action_id)
-
- @controller.protected()
- def set_action(self, context, **kw):
- user_id = self._get_user_id_from_token(context.get('token_id'))
- intra_extension_id = kw.get('intra_extension_id', None)
- action_id = kw.get('action_id', None)
- action_dict = dict()
- action_dict['name'] = kw.get('action_name', None)
- action_dict['description'] = kw.get('action_description', None)
- return self.admin_api.set_action_dict(
- user_id, intra_extension_id, action_id, action_dict)
-
- # Scope functions
- @controller.protected()
- def get_subject_scopes(self, context, **kw):
- user_id = self._get_user_id_from_token(context.get('token_id'))
- intra_extension_id = kw.get('intra_extension_id', None)
- subject_category_id = kw.get('subject_category_id', None)
- return self.admin_api.get_subject_scopes_dict(
- user_id, intra_extension_id, subject_category_id)
-
- @controller.protected()
- def add_subject_scope(self, context, **kw):
- user_id = self._get_user_id_from_token(context.get('token_id'))
- intra_extension_id = kw.get('intra_extension_id', None)
- subject_category_id = kw.get('subject_category_id', None)
- subject_scope_dict = dict()
- subject_scope_dict['name'] = kw.get('subject_scope_name', None)
- subject_scope_dict['description'] = kw.get(
- 'subject_scope_description', None)
- return self.admin_api.add_subject_scope_dict(
- user_id, intra_extension_id, subject_category_id, subject_scope_dict) # noqa
-
- @controller.protected()
- def get_subject_scope(self, context, **kw):
- user_id = self._get_user_id_from_token(context.get('token_id'))
- intra_extension_id = kw.get('intra_extension_id', None)
- subject_category_id = kw.get('subject_category_id', None)
- subject_scope_id = kw.get('subject_scope_id', None)
- return self.admin_api.get_subject_scope_dict(
- user_id, intra_extension_id, subject_category_id, subject_scope_id)
-
- @controller.protected()
- def del_subject_scope(self, context, **kw):
- user_id = self._get_user_id_from_token(context.get('token_id'))
- intra_extension_id = kw.get('intra_extension_id', None)
- subject_category_id = kw.get('subject_category_id', None)
- subject_scope_id = kw.get('subject_scope_id', None)
- self.admin_api.del_subject_scope(
- user_id,
- intra_extension_id,
- subject_category_id,
- subject_scope_id)
-
- @controller.protected()
- def set_subject_scope(self, context, **kw):
- user_id = self._get_user_id_from_token(context.get('token_id'))
- intra_extension_id = kw.get('intra_extension_id', None)
- subject_category_id = kw.get('subject_category_id', None)
- subject_scope_id = kw.get('subject_scope_id', None)
- subject_scope_dict = dict()
- subject_scope_dict['name'] = kw.get('subject_scope_name', None)
- subject_scope_dict['description'] = kw.get(
- 'subject_scope_description', None)
- return self.admin_api.set_subject_scope_dict(
- user_id, intra_extension_id, subject_category_id, subject_scope_id, subject_scope_dict) # noqa
-
- @controller.protected()
- def get_object_scopes(self, context, **kw):
- user_id = self._get_user_id_from_token(context.get('token_id'))
- intra_extension_id = kw.get('intra_extension_id', None)
- object_category_id = kw.get('object_category_id', None)
- return self.admin_api.get_object_scopes_dict(
- user_id, intra_extension_id, object_category_id)
-
- @controller.protected()
- def add_object_scope(self, context, **kw):
- user_id = self._get_user_id_from_token(context.get('token_id'))
- intra_extension_id = kw.get('intra_extension_id', None)
- object_category_id = kw.get('object_category_id', None)
- object_scope_dict = dict()
- object_scope_dict['name'] = kw.get('object_scope_name', None)
- object_scope_dict['description'] = kw.get(
- 'object_scope_description', None)
- return self.admin_api.add_object_scope_dict(
- user_id, intra_extension_id, object_category_id, object_scope_dict)
-
- @controller.protected()
- def get_object_scope(self, context, **kw):
- user_id = self._get_user_id_from_token(context.get('token_id'))
- intra_extension_id = kw.get('intra_extension_id', None)
- object_category_id = kw.get('object_category_id', None)
- object_scope_id = kw.get('object_scope_id', None)
- return self.admin_api.get_object_scope_dict(
- user_id, intra_extension_id, object_category_id, object_scope_id)
-
- @controller.protected()
- def del_object_scope(self, context, **kw):
- user_id = self._get_user_id_from_token(context.get('token_id'))
- intra_extension_id = kw.get('intra_extension_id', None)
- object_category_id = kw.get('object_category_id', None)
- object_scope_id = kw.get('object_scope_id', None)
- self.admin_api.del_object_scope(
- user_id,
- intra_extension_id,
- object_category_id,
- object_scope_id)
-
- @controller.protected()
- def set_object_scope(self, context, **kw):
- user_id = self._get_user_id_from_token(context.get('token_id'))
- intra_extension_id = kw.get('intra_extension_id', None)
- object_category_id = kw.get('object_category_id', None)
- object_scope_id = kw.get('object_scope_id', None)
- object_scope_dict = dict()
- object_scope_dict['name'] = kw.get('object_scope_name', None)
- object_scope_dict['description'] = kw.get(
- 'object_scope_description', None)
- return self.admin_api.set_object_scope_dict(
- user_id, intra_extension_id, object_category_id, object_scope_id, object_scope_dict) # noqa
-
- @controller.protected()
- def get_action_scopes(self, context, **kw):
- user_id = self._get_user_id_from_token(context.get('token_id'))
- intra_extension_id = kw.get('intra_extension_id', None)
- action_category_id = kw.get('action_category_id', None)
- return self.admin_api.get_action_scopes_dict(
- user_id, intra_extension_id, action_category_id)
-
- @controller.protected()
- def add_action_scope(self, context, **kw):
- user_id = self._get_user_id_from_token(context.get('token_id'))
- intra_extension_id = kw.get('intra_extension_id', None)
- action_category_id = kw.get('action_category_id', None)
- action_scope_dict = dict()
- action_scope_dict['name'] = kw.get('action_scope_name', None)
- action_scope_dict['description'] = kw.get(
- 'action_scope_description', None)
- return self.admin_api.add_action_scope_dict(
- user_id, intra_extension_id, action_category_id, action_scope_dict)
-
- @controller.protected()
- def get_action_scope(self, context, **kw):
- user_id = self._get_user_id_from_token(context.get('token_id'))
- intra_extension_id = kw.get('intra_extension_id', None)
- action_category_id = kw.get('action_category_id', None)
- action_scope_id = kw.get('action_scope_id', None)
- return self.admin_api.get_action_scope_dict(
- user_id, intra_extension_id, action_category_id, action_scope_id)
-
- @controller.protected()
- def del_action_scope(self, context, **kw):
- user_id = self._get_user_id_from_token(context.get('token_id'))
- intra_extension_id = kw.get('intra_extension_id', None)
- action_category_id = kw.get('action_category_id', None)
- action_scope_id = kw.get('action_scope_id', None)
- self.admin_api.del_action_scope(
- user_id,
- intra_extension_id,
- action_category_id,
- action_scope_id)
-
- @controller.protected()
- def set_action_scope(self, context, **kw):
- user_id = self._get_user_id_from_token(context.get('token_id'))
- intra_extension_id = kw.get('intra_extension_id', None)
- action_category_id = kw.get('action_category_id', None)
- action_scope_id = kw.get('action_scope_id', None)
- action_scope_dict = dict()
- action_scope_dict['name'] = kw.get('action_scope_name', None)
- action_scope_dict['description'] = kw.get(
- 'action_scope_description', None)
- return self.admin_api.set_action_scope_dict(
- user_id, intra_extension_id, action_category_id, action_scope_id, action_scope_dict) # noqa
-
- # Assignment functions
-
- @controller.protected()
- def add_subject_assignment(self, context, **kw):
- user_id = self._get_user_id_from_token(context.get('token_id'))
- intra_extension_id = kw.get('intra_extension_id', None)
- subject_id = kw.get('subject_id', None)
- subject_category_id = kw.get('subject_category_id', None)
- subject_scope_id = kw.get('subject_scope_id', None)
- return self.admin_api.add_subject_assignment_list(
- user_id, intra_extension_id, subject_id, subject_category_id, subject_scope_id) # noqa
-
- @controller.protected()
- def get_subject_assignment(self, context, **kw):
- user_id = self._get_user_id_from_token(context.get('token_id'))
- intra_extension_id = kw.get('intra_extension_id', None)
- subject_id = kw.get('subject_id', None)
- subject_category_id = kw.get('subject_category_id', None)
- return self.admin_api.get_subject_assignment_list(
- user_id, intra_extension_id, subject_id, subject_category_id)
-
- @controller.protected()
- def del_subject_assignment(self, context, **kw):
- user_id = self._get_user_id_from_token(context.get('token_id'))
- intra_extension_id = kw.get('intra_extension_id', None)
- subject_id = kw.get('subject_id', None)
- subject_category_id = kw.get('subject_category_id', None)
- subject_scope_id = kw.get('subject_scope_id', None)
- self.admin_api.del_subject_assignment(
- user_id,
- intra_extension_id,
- subject_id,
- subject_category_id,
- subject_scope_id)
-
- @controller.protected()
- def add_object_assignment(self, context, **kw):
- user_id = self._get_user_id_from_token(context.get('token_id'))
- intra_extension_id = kw.get('intra_extension_id', None)
- object_id = kw.get('object_id', None)
- object_category_id = kw.get('object_category_id', None)
- object_scope_id = kw.get('object_scope_id', None)
- return self.admin_api.add_object_assignment_list(
- user_id, intra_extension_id, object_id, object_category_id, object_scope_id) # noqa
-
- @controller.protected()
- def get_object_assignment(self, context, **kw):
- user_id = self._get_user_id_from_token(context.get('token_id'))
- intra_extension_id = kw.get('intra_extension_id', None)
- object_id = kw.get('object_id', None)
- object_category_id = kw.get('object_category_id', None)
- return self.admin_api.get_object_assignment_list(
- user_id, intra_extension_id, object_id, object_category_id)
-
- @controller.protected()
- def del_object_assignment(self, context, **kw):
- user_id = self._get_user_id_from_token(context.get('token_id'))
- intra_extension_id = kw.get('intra_extension_id', None)
- object_id = kw.get('object_id', None)
- object_category_id = kw.get('object_category_id', None)
- object_scope_id = kw.get('object_scope_id', None)
- self.admin_api.del_object_assignment(
- user_id,
- intra_extension_id,
- object_id,
- object_category_id,
- object_scope_id)
-
- @controller.protected()
- def add_action_assignment(self, context, **kw):
- user_id = self._get_user_id_from_token(context.get('token_id'))
- intra_extension_id = kw.get('intra_extension_id', None)
- action_id = kw.get('action_id', None)
- action_category_id = kw.get('action_category_id', None)
- action_scope_id = kw.get('action_scope_id', None)
- return self.admin_api.add_action_assignment_list(
- user_id, intra_extension_id, action_id, action_category_id, action_scope_id) # noqa
-
- @controller.protected()
- def get_action_assignment(self, context, **kw):
- user_id = self._get_user_id_from_token(context.get('token_id'))
- intra_extension_id = kw.get('intra_extension_id', None)
- action_id = kw.get('action_id', None)
- action_category_id = kw.get('action_category_id', None)
- return self.admin_api.get_action_assignment_list(
- user_id, intra_extension_id, action_id, action_category_id)
-
- @controller.protected()
- def del_action_assignment(self, context, **kw):
- user_id = self._get_user_id_from_token(context.get('token_id'))
- intra_extension_id = kw.get('intra_extension_id', None)
- action_id = kw.get('action_id', None)
- action_category_id = kw.get('action_category_id', None)
- action_scope_id = kw.get('action_scope_id', None)
- self.admin_api.del_action_assignment(
- user_id,
- intra_extension_id,
- action_id,
- action_category_id,
- action_scope_id)
-
- # Metarule functions
-
- @controller.protected()
- def get_aggregation_algorithm(self, context, **kw):
- user_id = self._get_user_id_from_token(context.get('token_id'))
- intra_extension_id = kw.get('intra_extension_id', None)
- return self.admin_api.get_aggregation_algorithm_id(
- user_id, intra_extension_id)
-
- @controller.protected()
- def set_aggregation_algorithm(self, context, **kw):
- user_id = self._get_user_id_from_token(context.get('token_id'))
- intra_extension_id = kw.get('intra_extension_id', None)
- aggregation_algorithm_id = kw.get('aggregation_algorithm_id', None)
- return self.admin_api.set_aggregation_algorithm_id(
- user_id, intra_extension_id, aggregation_algorithm_id)
-
- @controller.protected()
- def get_sub_meta_rules(self, context, **kw):
- user_id = self._get_user_id_from_token(context.get('token_id'))
- intra_extension_id = kw.get('intra_extension_id', None)
- return self.admin_api.get_sub_meta_rules_dict(
- user_id, intra_extension_id)
-
- @controller.protected()
- def add_sub_meta_rule(self, context, **kw):
- user_id = self._get_user_id_from_token(context.get('token_id'))
- intra_extension_id = kw.get('intra_extension_id', None)
- sub_meta_rule_dict = dict()
- sub_meta_rule_dict['name'] = kw.get('sub_meta_rule_name', None)
- sub_meta_rule_dict['algorithm'] = kw.get(
- 'sub_meta_rule_algorithm', None)
- sub_meta_rule_dict['subject_categories'] = kw.get(
- 'sub_meta_rule_subject_categories', None)
- sub_meta_rule_dict['object_categories'] = kw.get(
- 'sub_meta_rule_object_categories', None)
- sub_meta_rule_dict['action_categories'] = kw.get(
- 'sub_meta_rule_action_categories', None)
- return self.admin_api.add_sub_meta_rule_dict(
- user_id, intra_extension_id, sub_meta_rule_dict)
-
- @controller.protected()
- def get_sub_meta_rule(self, context, **kw):
- user_id = self._get_user_id_from_token(context.get('token_id'))
- intra_extension_id = kw.get('intra_extension_id', None)
- sub_meta_rule_id = kw.get('sub_meta_rule_id', None)
- return self.admin_api.get_sub_meta_rule_dict(
- user_id, intra_extension_id, sub_meta_rule_id)
-
- @controller.protected()
- def del_sub_meta_rule(self, context, **kw):
- user_id = self._get_user_id_from_token(context.get('token_id'))
- intra_extension_id = kw.get('intra_extension_id', None)
- sub_meta_rule_id = kw.get('sub_meta_rule_id', None)
- self.admin_api.del_sub_meta_rule(
- user_id, intra_extension_id, sub_meta_rule_id)
-
- @controller.protected()
- def set_sub_meta_rule(self, context, **kw):
- user_id = self._get_user_id_from_token(context.get('token_id'))
- intra_extension_id = kw.get('intra_extension_id', None)
- sub_meta_rule_id = kw.get('sub_meta_rule_id', None)
- sub_meta_rule_dict = dict()
- sub_meta_rule_dict['name'] = kw.get('sub_meta_rule_name', None)
- sub_meta_rule_dict['algorithm'] = kw.get(
- 'sub_meta_rule_algorithm', None)
- sub_meta_rule_dict['subject_categories'] = kw.get(
- 'sub_meta_rule_subject_categories', None)
- sub_meta_rule_dict['object_categories'] = kw.get(
- 'sub_meta_rule_object_categories', None)
- sub_meta_rule_dict['action_categories'] = kw.get(
- 'sub_meta_rule_action_categories', None)
- return self.admin_api.set_sub_meta_rule_dict(
- user_id, intra_extension_id, sub_meta_rule_id, sub_meta_rule_dict)
-
- # Rules functions
- @controller.protected()
- def get_rules(self, context, **kw):
- user_id = self._get_user_id_from_token(context.get('token_id'))
- intra_extension_id = kw.get('intra_extension_id', None)
- sub_meta_rule_id = kw.get('sub_meta_rule_id', None)
- return self.admin_api.get_rules_dict(
- user_id, intra_extension_id, sub_meta_rule_id)
-
- @controller.protected()
- def add_rule(self, context, **kw):
- user_id = self._get_user_id_from_token(context.get('token_id'))
- intra_extension_id = kw.get('intra_extension_id', None)
- sub_meta_rule_id = kw.get('sub_meta_rule_id', None)
- subject_category_list = kw.get('subject_categories', [])
- object_category_list = kw.get('object_categories', [])
- action_category_list = kw.get('action_categories', [])
- enabled_bool = kw.get('enabled', True)
- rule_list = subject_category_list + action_category_list + \
- object_category_list + [enabled_bool, ]
- return self.admin_api.add_rule_dict(
- user_id, intra_extension_id, sub_meta_rule_id, rule_list)
-
- @controller.protected()
- def get_rule(self, context, **kw):
- user_id = self._get_user_id_from_token(context.get('token_id'))
- intra_extension_id = kw.get('intra_extension_id', None)
- sub_meta_rule_id = kw.get('sub_meta_rule_id', None)
- rule_id = kw.get('rule_id', None)
- return self.admin_api.get_rule_dict(
- user_id, intra_extension_id, sub_meta_rule_id, rule_id)
-
- @controller.protected()
- def del_rule(self, context, **kw):
- user_id = self._get_user_id_from_token(context.get('token_id'))
- intra_extension_id = kw.get('intra_extension_id', None)
- sub_meta_rule_id = kw.get('sub_meta_rule_id', None)
- rule_id = kw.get('rule_id', None)
- self.admin_api.del_rule(
- user_id,
- intra_extension_id,
- sub_meta_rule_id,
- rule_id)
-
- @controller.protected()
- def set_rule(self, context, **kw):
- user_id = self._get_user_id_from_token(context.get('token_id'))
- intra_extension_id = kw.get('intra_extension_id', None)
- sub_meta_rule_id = kw.get('sub_meta_rule_id', None)
- rule_id = kw.get('rule_id', None)
- rule_list = list()
- subject_category_list = kw.get('subject_categories', [])
- object_category_list = kw.get('object_categories', [])
- action_category_list = kw.get('action_categories', [])
- rule_list = subject_category_list + action_category_list + object_category_list # noqa
- return self.admin_api.set_rule_dict(
- user_id, intra_extension_id, sub_meta_rule_id, rule_id, rule_list)
-
-
-@dependency.requires('authz_api') # noqa: 405
-class InterExtensions(controller.V3Controller):
-
- def __init__(self):
- super(InterExtensions, self).__init__()
-
- def _get_user_from_token(self, token_id):
- response = self.token_provider_api.validate_token(token_id)
- token_ref = token_model.KeystoneToken(
- token_id=token_id, token_data=response)
- return token_ref['user']
-
- # @controller.protected()
- # def get_inter_extensions(self, context, **kw):
- # user = self._get_user_from_token(context.get('token_id'))
- # return {
- # 'inter_extensions':
- # self.interextension_api.get_inter_extensions()
- # }
-
- # @controller.protected()
- # def get_inter_extension(self, context, **kw):
- # user = self._get_user_from_token(context.get('token_id'))
- # return {
- # 'inter_extensions':
- # self.interextension_api.get_inter_extension(uuid=kw['inter_extension_id'])
- # }
-
- # @controller.protected()
- # def create_inter_extension(self, context, **kw):
- # user = self._get_user_from_token(context.get('token_id'))
- # return self.interextension_api.create_inter_extension(kw)
-
- # @controller.protected()
- # def delete_inter_extension(self, context, **kw):
- # user = self._get_user_from_token(context.get('token_id'))
- # if 'inter_extension_id' not in kw:
- # raise exception.Error
- # return
- # self.interextension_api.delete_inter_extension(kw['inter_extension_id'])
-
-
-@dependency.requires('moonlog_api', 'authz_api') # noqa: 405
-class Logs(controller.V3Controller):
-
- def __init__(self):
- super(Logs, self).__init__()
-
- def _get_user_id_from_token(self, token_id):
- response = self.token_provider_api.validate_token(token_id)
- token_ref = token_model.KeystoneToken(
- token_id=token_id, token_data=response)
- return token_ref['user']
-
- @controller.protected()
- def get_logs(self, context, **kw):
- user_id = self._get_user_id_from_token(context.get('token_id'))
- options = kw.get('options', '')
- return self.moonlog_api.get_logs(user_id, options)
-
-
-@dependency.requires('identity_api', "token_provider_api", "resource_api") # noqa: 405
-class MoonAuth(controller.V3Controller):
-
- def __init__(self):
- super(MoonAuth, self).__init__()
-
- def _get_project(self, uuid="", name=""):
- projects = self.resource_api.list_projects()
- for project in projects:
- if uuid and uuid == project['id']:
- return project
- elif name and name == project['name']:
- return project
-
- def get_token(self, context, **kw):
- data_auth = {
- "auth": {
- "identity": {
- "methods": [
- "password"
- ],
- "password": {
- "user": {
- "domain": {
- "id": "Default"
- },
- "name": kw['username'],
- "password": kw['password']
- }
- }
- }
- }
- }
-
- message = {}
- if "project" in kw:
- project = self._get_project(name=kw['project'])
- if project:
- data_auth["auth"]["scope"] = dict()
- data_auth["auth"]["scope"]['project'] = dict()
- data_auth["auth"]["scope"]['project']['id'] = project['id']
- else:
- message = {
- "error": {
- "message": "Unable to find project {}".format(kw['project']), # noqa
- "code": 200,
- "title": "UnScopedToken"
- }}
-
-# req = requests.post("http://localhost:5000/v3/auth/tokens",
-# json=data_auth,
-# headers={"Content-Type": "application/json"}
-# )
- req = requests.post("http://172.16.1.222:5000/v3/auth/tokens",
- json=data_auth,
- headers={"Content-Type": "application/json"}
- )
- if req.status_code not in (200, 201):
- LOG.error(req.text)
- else:
- _token = req.headers['X-Subject-Token']
- _data = req.json()
- _result = {
- "token": _token,
- 'message': message
- }
- try:
- _result["roles"] = map(
- lambda x: x['name'], _data["token"]["roles"])
- except KeyError:
- pass
- return _result
- return {"token": None, 'message': req.json()}
+++ /dev/null
-keystone/admin-password: password
-keystone/auth-token: password
-keystone/admin-password-confirm: password
-keystone/admin-email: root@localhost
-keystone/admin-role-name: admin
-keystone/admin-user: admin
-keystone/create-admin-tenant: false
-keystone/region-name: Orange
-keystone/admin-tenant-name: admin
-keystone/register-endpoint: false
-keystone/configure_db: false
+++ /dev/null
-#!/usr/bin/env python3
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
-
-
-import sys
-import subprocess
-
-pkts = []
-
-for arg in sys.argv[1:]:
- proc = subprocess.Popen(["dpkg-deb",
- "--info",
- arg],
- stdin=None,
- stdout=subprocess.PIPE,
- stderr=subprocess.PIPE)
- out = proc.stdout.read()
- err = proc.stderr.read()
- if err:
- print("An error occurred with {} ({})".format(arg, err))
- continue
- for line in out.splitlines():
- line = line.decode('utf-8')
- if " Depends:" in line:
- line = line.replace(" Depends:", "")
- for _dep in line.split(','):
- pkts.append(_dep.split()[0])
-
-print(" ".join(pkts))
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-- name: restart keystone services
- service: name={{ item }} state=restarted enabled=yes
- with_items: services | union(services_noarch)
+++ /dev/null
-#############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-- include: moon.yml
- when: moon == "Enable"
+++ /dev/null
-#############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-- name: update api-paste.ini
- template: src=api-paste.ini dest=/etc/nova/api-paste.ini backup=yes
-
-- name: restart nova task
- service: name={{ item }} state=restarted enabled=yes
- with_items:
- - nova-compute
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-# install all packages
-- name: install unzip packages
- shell: apt-get install -y python-pip unzip
-
-# download master.zip
-- name: get image http server
- shell: awk -F'=' '/compass_server/ {print $2}' /etc/compass.conf
- register: http_server
-
-- name: download keystone-moon packages
- get_url:
- url: "http://{{ http_server.stdout_lines[0] }}/packages/moon/master.zip"
- dest: /tmp/master.zip
- mode: 0444
-
-- name: extract keystone-moon packages
- unarchive: src=/tmp/master.zip dest=/tmp copy=no
-
-# install all dependencies
-- name: copy scripts
- copy: src=get_deb_depends.py dest=/tmp/get_deb_depends.py
-
-- name: install keystone-moon dependencies
- shell: |
- apt-get install \
- $(python /tmp/get_deb_depends.py /tmp/moon-bin-master/*.deb)
- when: ansible_os_family == "Debian"
-
-- name: delete configuration file
- shell: >
- rm -f {{ apache_config_dir }}/sites-enabled/wsgi-keystone.conf;
- rm -f {{ apache_config_dir }}/sites-available/wsgi-keystone.conf;
-
-# install keystone moon
-- name: copy scripts
- copy: src=deb.conf dest=/tmp/deb.conf
-
-- name: install keystone moon
- shell: >
- export DEBIAN_FRONTEND="noninteractive";
- sudo -E dpkg -i /tmp/moon-bin-master/*moon*.deb;
-
-# - name: install keystone moon
-# shell: >
-# export DEBIAN_FRONTEND="noninteractive";
-# sudo -E debconf-set-selections python-keystone < /tmp/deb.conf;
-# sudo -E dpkg -i /tmp/moon-bin-master/*moon*.deb;
-
-- name: stop keystone task
- shell: >
- service keystone stop;
- mv /etc/init.d/keystone /home/;
- mv /etc/init/keystone.conf /home/;
- mv /lib/systemd/system/keystone.service /home/;
-
-# config keystone and apache2
-- name: delete sqlite database
- file:
- path: /var/lib/keystone/keystone.db
- state: absent
-
-# - name: update keystone conf
-# template: src=keystone.conf dest=/etc/keystone/keystone.conf backup=yes
-
-
-# - name: assure listen port exist
-# lineinfile:
-# dest: '{{ apache_config_dir }}/ports.conf'
-# regexp: '{{ item.regexp }}'
-# line: '{{ item.line}}'
-# with_items:
-# - regexp: "^Listen {{ internal_ip }}:5000"
-# line: "Listen {{ internal_ip }}:5000"
-# - regexp: "^Listen {{ internal_ip }}:35357"
-# line: "Listen {{ internal_ip }}:35357"
-
-- name: update apache2 configs
- template:
- src: wsgi-keystone.conf.j2
- dest: '{{ apache_config_dir }}/sites-available/wsgi-keystone.conf'
- when: ansible_os_family == 'Debian'
-
-- name: enable keystone server
- file:
- src: "{{ apache_config_dir }}/sites-available/wsgi-keystone.conf"
- dest: "{{ apache_config_dir }}/sites-enabled/wsgi-keystone.conf"
- state: "link"
- when: ansible_os_family == 'Debian'
-
-# - name: keystone source files
-# template: src={{ item }} dest=/opt/{{ item }}
-# with_items:
-# - admin-openrc.sh
-# - demo-openrc.sh
-
-# keystone paste ini
-- name: backup keystone-paste.ini
- shell: >
- cp /etc/keystone/keystone-paste.ini /etc/keystone/keystone-paste.ini.bak;
-
-- name: config keystone-paste.ini
- shell: >
- sed -i "3i[pipeline:moon_pipeline]\n" /etc/keystone/keystone-paste.ini;
- sed -i "5i[app:moon_service]\nuse = egg:keystone#moon_service\n" \
- /etc/keystone/keystone-paste.ini;
- sed -i "s/use = egg:Paste#urlmap/use = egg:Paste#urlmap\n\/moon = moon_pipeline/" \
- /etc/keystone/keystone-paste.ini;
-
-- name: config keystone-paste.ini
- blockinfile:
- dest: /etc/keystone/keystone-paste.ini
- insertafter: "pipeline:moon_pipeline"
- block: >
- pipeline = sizelimit url_normalize request_id build_auth_context
- token_auth admin_token_auth json_body ec2_extension_v3 s3_extension moon_service
-
-# moon log
-- name: moon log
- shell: >
- sudo mkdir /var/log/moon/;
- sudo chown keystone /var/log/moon/;
- sudo addgroup moonlog;
- sudo chgrp moonlog /var/log/moon/;
- sudo touch /var/log/moon/keystonemiddleware.log;
- sudo touch /var/log/moon/system.log;
- sudo chgrp moonlog /var/log/moon/keystonemiddleware.log;
- sudo chgrp moonlog /var/log/moon/system.log;
- sudo chmod g+rw /var/log/moon;
- sudo chmod g+rw /var/log/moon/keystonemiddleware.log;
- sudo chmod g+rw /var/log/moon/system.log;
- sudo adduser keystone moonlog;
- # sudo adduser swift moonlog;
- sudo adduser nova moonlog;
-
-
-# keystone db sync
-- name: keystone db sync
- shell: >
- sudo /usr/bin/keystone-manage db_sync;
- sudo /usr/bin/keystone-manage db_sync --extension moon;
- when: inventory_hostname == haproxy_hosts.keys()[0]
-
-- name: wait for keystone ready
- wait_for: port=35357 delay=3 timeout=10 host={{ internal_ip }}
-
-# moon workaround
-- name: copy scripts
- copy:
- src: controllers.py
- dest: /usr/lib/python2.7/dist-packages/keystone/contrib/moon/controllers.py
-
-# apache2 restart
-- name: restart apache2
- service: name={{ item }} state=restarted enabled=yes
- with_items: services | union(services_noarch)
-
-# install moonclient
-- name: install moon client
- shell: sudo pip install /tmp/moon-bin-master/python-moonclient-0.1.tar.gz
-
-# - name: add tenants
-# keystone_user:
-# token: "{{ ADMIN_TOKEN }}"
-# endpoint: "http://{{ internal_ip }}:35357/v2.0"
-# tenant: "{{ item.tenant }}"
-# tenant_description: "{{ item.tenant_description }}"
-# with_items: "{{ os_users }}"
-# when: inventory_hostname == groups['controller'][0]
-
-# - name: add users
-# keystone_user:
-# token: "{{ ADMIN_TOKEN }}"
-# endpoint: "http://{{ internal_ip }}:35357/v2.0"
-# user: "{{ item.user }}"
-# tenant: "{{ item.tenant }}"
-# password: "{{ item.password }}"
-# email: "{{ item.email }}"
-# with_items: "{{ os_users }}"
-# when: inventory_hostname == groups['controller'][0]
-
-# - name: grant roles
-# keystone_user:
-# token: "{{ ADMIN_TOKEN }}"
-# endpoint: "http://{{ internal_ip }}:35357/v2.0"
-# user: "{{ item.user }}"
-# role: "{{ item.role }}"
-# tenant: "{{ item.tenant }}"
-# with_items: "{{ os_users }}"
-# when: inventory_hostname == groups['controller'][0]
-
-# - name: add endpoints
-# keystone_service:
-# token: "{{ ADMIN_TOKEN }}"
-# endpoint: "http://{{ internal_ip }}:35357/v2.0"
-# name: "{{ item.name }}"
-# type: "{{ item.type }}"
-# region: "{{ item.region}}"
-# description: "{{ item.description }}"
-# publicurl: "{{ item.publicurl }}"
-# internalurl: "{{ item.internalurl }}"
-# adminurl: "{{ item.adminurl }}"
-# with_items: "{{ os_services }}"
-# when: inventory_hostname == groups['controller'][0]
-
-- name: update api-paste.ini
- template: src=api-paste.ini dest=/etc/nova/api-paste.ini backup=yes
-
-# - name: update proxy-server conf
-# template: src=proxy-server.conf dest=/etc/swift/proxy-server.conf backup=yes
-
-# restart nova
-- name: restart nova
- service: name={{ item }} state=restarted enabled=yes
- with_items:
- - nova-api
- - nova-cert
- - nova-conductor
- - nova-consoleauth
- - nova-scheduler
-
-# restart swift
-# - name: restart swift
-# service: name={{ item }} state=restarted enabled=yes
-# with_items:
-# - swift-proxy
-# - memcached
+++ /dev/null
-#############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-- include_vars: "{{ ansible_os_family }}.yml"
-
-- include: moon-controller.yml
- when: inventory_hostname in groups['controller']
-
-- include: moon-compute.yml
- when: inventory_hostname in groups['compute']
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
-# Verify the Identity Service installation
-export OS_PASSWORD={{ ADMIN_PASS }}
-export OS_TENANT_NAME=admin
-export OS_AUTH_URL=http://{{ internal_vip.ip }}:35357/v2.0
-export OS_USERNAME=admin
-export OS_VOLUME_API_VERSION=2
-
+++ /dev/null
-############
-# Metadata #
-############
-[composite:metadata]
-use = egg:Paste#urlmap
-/: meta
-
-[pipeline:meta]
-pipeline = cors metaapp
-
-[app:metaapp]
-paste.app_factory = nova.api.metadata.handler:MetadataRequestHandler.factory
-
-#############
-# OpenStack #
-#############
-
-[composite:osapi_compute]
-use = call:nova.api.openstack.urlmap:urlmap_factory
-/: oscomputeversions
-# starting in Liberty the v21 implementation replaces the v2
-# implementation and is suggested that you use it as the default. If
-# this causes issues with your clients you can rollback to the
-# *frozen* v2 api by commenting out the above stanza and using the
-# following instead::
-# /v2: openstack_compute_api_legacy_v2
-# if rolling back to v2 fixes your issue please file a critical bug
-# at - https://bugs.launchpad.net/nova/+bugs
-#
-# v21 is an exactly feature match for v2, except it has more stringent
-# input validation on the wsgi surface (prevents fuzzing early on the
-# API). It also provides new features via API microversions which are
-# opt into for clients. Unaware clients will receive the same frozen
-# v2 API feature set, but with some relaxed validation
-/v2: openstack_compute_api_v21_legacy_v2_compatible
-/v2.1: openstack_compute_api_v21
-
-# NOTE: this is deprecated in favor of openstack_compute_api_v21_legacy_v2_compatible
-[composite:openstack_compute_api_legacy_v2]
-use = call:nova.api.auth:pipeline_factory
-noauth2 = cors compute_req_id faultwrap sizelimit noauth2 legacy_ratelimit osapi_compute_app_legacy_v2
-keystone = cors compute_req_id faultwrap sizelimit authtoken keystonecontext moon legacy_ratelimit osapi_compute_app_legacy_v2
-keystone_nolimit = cors compute_req_id faultwrap sizelimit authtoken keystonecontext osapi_compute_app_legacy_v2
-
-[composite:openstack_compute_api_v21]
-use = call:nova.api.auth:pipeline_factory_v21
-noauth2 = cors compute_req_id faultwrap sizelimit noauth2 osapi_compute_app_v21
-keystone = cors compute_req_id faultwrap sizelimit authtoken keystonecontext osapi_compute_app_v21
-
-[composite:openstack_compute_api_v21_legacy_v2_compatible]
-use = call:nova.api.auth:pipeline_factory_v21
-noauth2 = cors compute_req_id faultwrap sizelimit noauth2 legacy_v2_compatible osapi_compute_app_v21
-keystone = cors compute_req_id faultwrap sizelimit authtoken keystonecontext legacy_v2_compatible osapi_compute_app_v21
-
-[filter:request_id]
-paste.filter_factory = oslo_middleware:RequestId.factory
-
-[filter:compute_req_id]
-paste.filter_factory = nova.api.compute_req_id:ComputeReqIdMiddleware.factory
-
-[filter:faultwrap]
-paste.filter_factory = nova.api.openstack:FaultWrapper.factory
-
-[filter:noauth2]
-paste.filter_factory = nova.api.openstack.auth:NoAuthMiddleware.factory
-
-[filter:legacy_ratelimit]
-paste.filter_factory = nova.api.openstack.compute.limits:RateLimitingMiddleware.factory
-
-[filter:sizelimit]
-paste.filter_factory = oslo_middleware:RequestBodySizeLimiter.factory
-
-[filter:legacy_v2_compatible]
-paste.filter_factory = nova.api.openstack:LegacyV2CompatibleWrapper.factory
-
-[app:osapi_compute_app_legacy_v2]
-paste.app_factory = nova.api.openstack.compute:APIRouter.factory
-
-[app:osapi_compute_app_v21]
-paste.app_factory = nova.api.openstack.compute:APIRouterV21.factory
-
-[pipeline:oscomputeversions]
-pipeline = faultwrap oscomputeversionapp
-
-[app:oscomputeversionapp]
-paste.app_factory = nova.api.openstack.compute.versions:Versions.factory
-
-##########
-# Shared #
-##########
-
-[filter:cors]
-paste.filter_factory = oslo_middleware.cors:filter_factory
-oslo_config_project = nova
-
-[filter:keystonecontext]
-paste.filter_factory = nova.api.auth:NovaKeystoneContext.factory
-
-[filter:authtoken]
-paste.filter_factory = keystonemiddleware.auth_token:filter_factory
-
-[filter:moon]
-paste.filter_factory = keystonemiddleware.moon_agent:filter_factory
-authz_login=admin
-authz_password=password
-logfile=/var/log/moon/keystonemiddleware.log
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
-export OS_USERNAME=demo
-export OS_PASSWORD={{ DEMO_PASS }}
-export OS_TENANT_NAME=demo
-export OS_AUTH_URL=http://{{ internal_vip.ip }}:35357/v2.0
-
+++ /dev/null
-# Keystone PasteDeploy configuration file.
-
-[pipeline:moon_pipeline]
-pipeline = sizelimit url_normalize request_id build_auth_context token_auth admin_token_auth json_body ec2_extension_v3 s3_extension moon_service
-
-[app:moon_service]
-use = egg:keystone#moon_service
-
-[filter:debug]
-use = egg:oslo.middleware#debug
-
-[filter:request_id]
-use = egg:oslo.middleware#request_id
-
-[filter:build_auth_context]
-use = egg:keystone#build_auth_context
-
-[filter:token_auth]
-use = egg:keystone#token_auth
-
-[filter:admin_token_auth]
-# This is deprecated in the M release and will be removed in the O release.
-# Use `keystone-manage bootstrap` and remove this from the pipelines below.
-use = egg:keystone#admin_token_auth
-
-[filter:json_body]
-use = egg:keystone#json_body
-
-[filter:cors]
-use = egg:oslo.middleware#cors
-oslo_config_project = keystone
-
-[filter:ec2_extension]
-use = egg:keystone#ec2_extension
-
-[filter:ec2_extension_v3]
-use = egg:keystone#ec2_extension_v3
-
-[filter:s3_extension]
-use = egg:keystone#s3_extension
-
-[filter:url_normalize]
-use = egg:keystone#url_normalize
-
-[filter:sizelimit]
-use = egg:oslo.middleware#sizelimit
-
-[app:public_service]
-use = egg:keystone#public_service
-
-[app:service_v3]
-use = egg:keystone#service_v3
-
-[app:admin_service]
-use = egg:keystone#admin_service
-
-[pipeline:public_api]
-# The last item in this pipeline must be public_service or an equivalent
-# application. It cannot be a filter.
-pipeline = cors sizelimit url_normalize request_id admin_token_auth build_auth_context token_auth json_body ec2_extension public_service
-
-[pipeline:admin_api]
-# The last item in this pipeline must be admin_service or an equivalent
-# application. It cannot be a filter.
-pipeline = cors sizelimit url_normalize request_id admin_token_auth build_auth_context token_auth json_body ec2_extension s3_extension admin_service
-
-[pipeline:api_v3]
-# The last item in this pipeline must be service_v3 or an equivalent
-# application. It cannot be a filter.
-pipeline = cors sizelimit url_normalize request_id admin_token_auth build_auth_context token_auth json_body ec2_extension_v3 s3_extension service_v3
-
-[app:public_version_service]
-use = egg:keystone#public_version_service
-
-[app:admin_version_service]
-use = egg:keystone#admin_version_service
-
-[pipeline:public_version_api]
-pipeline = cors sizelimit url_normalize public_version_service
-
-[pipeline:admin_version_api]
-pipeline = cors sizelimit url_normalize admin_version_service
-
-[composite:main]
-use = egg:Paste#urlmap
-/moon = moon_pipeline
-/v2.0 = public_api
-/v3 = api_v3
-/ = public_version_api
-
-[composite:admin]
-use = egg:Paste#urlmap
-/moon = moon_pipeline
-/v2.0 = admin_api
-/v3 = api_v3
-/ = admin_version_api
+++ /dev/null
-{% set memcached_servers = [] %}
-{% set rabbitmq_servers = [] %}
-{% for host in haproxy_hosts.values() %}
-{% set _ = memcached_servers.append('%s:11211'% host) %}
-{% set _ = rabbitmq_servers.append('%s:5672'% host) %}
-{% endfor %}
-{% set memcached_servers = memcached_servers|join(',') %}
-{% set rabbitmq_servers = rabbitmq_servers|join(',') %}
-[DEFAULT]
-admin_token={{ ADMIN_TOKEN }}
-debug={{ DEBUG }}
-log_dir = /var/log/keystone
-
-[cache]
-backend=keystone.cache.memcache_pool
-memcache_servers={{ memcached_servers}}
-enabled=true
-
-[revoke]
-driver=sql
-expiration_buffer=3600
-caching=true
-
-[database]
-connection = mysql://keystone:{{ KEYSTONE_DBPASS }}@{{ db_host }}/keystone?charset=utf8
-idle_timeout=30
-min_pool_size=5
-max_pool_size=120
-pool_timeout=30
-
-
-[identity]
-default_domain_id=default
-driver=sql
-
-[assignment]
-driver=sql
-
-[resource]
-driver=sql
-caching=true
-cache_time=3600
-
-[token]
-enforce_token_bind=permissive
-expiration=43200
-provider=uuid
-driver=sql
-caching=true
-cache_time=3600
-
-[eventlet_server]
-public_bind_host= {{ identity_host }}
-admin_bind_host= {{ identity_host }}
-
-[oslo_messaging_rabbit]
-rabbit_userid = {{ RABBIT_USER }}
-rabbit_password = {{ RABBIT_PASS }}
-rabbit_hosts = {{ rabbitmq_servers }}
+++ /dev/null
-{% set memcached_servers = [] %}
-{% for host in haproxy_hosts.values() %}
-{% set _ = memcached_servers.append('%s:11211'% host) %}
-{% endfor %}
-{% set memcached_servers = memcached_servers|join(',') %}
-[DEFAULT]
-bind_ip = {{ internal_ip }}
-bind_port = 8080
-# bind_timeout = 30
-# backlog = 4096
-swift_dir = /etc/swift
-user = swift
-
-# Enables exposing configuration settings via HTTP GET /info.
-# expose_info = true
-
-# Key to use for admin calls that are HMAC signed. Default is empty,
-# which will disable admin calls to /info.
-# admin_key = secret_admin_key
-#
-# Allows the ability to withhold sections from showing up in the public calls
-# to /info. You can withhold subsections by separating the dict level with a
-# ".". The following would cause the sections 'container_quotas' and 'tempurl'
-# to not be listed, and the key max_failed_deletes would be removed from
-# bulk_delete. Default value is 'swift.valid_api_versions' which allows all
-# registered features to be listed via HTTP GET /info except
-# swift.valid_api_versions information
-# disallowed_sections = swift.valid_api_versions, container_quotas, tempurl
-
-# Use an integer to override the number of pre-forked processes that will
-# accept connections. Should default to the number of effective cpu
-# cores in the system. It's worth noting that individual workers will
-# use many eventlet co-routines to service multiple concurrent requests.
-# workers = auto
-#
-# Maximum concurrent requests per worker
-# max_clients = 1024
-#
-# Set the following two lines to enable SSL. This is for testing only.
-# cert_file = /etc/swift/proxy.crt
-# key_file = /etc/swift/proxy.key
-#
-# expiring_objects_container_divisor = 86400
-# expiring_objects_account_name = expiring_objects
-#
-# You can specify default log routing here if you want:
-# log_name = swift
-# log_facility = LOG_LOCAL0
-# log_level = INFO
-# log_headers = false
-# log_address = /dev/log
-# The following caps the length of log lines to the value given; no limit if
-# set to 0, the default.
-# log_max_line_length = 0
-#
-# This optional suffix (default is empty) that would be appended to the swift transaction
-# id allows one to easily figure out from which cluster that X-Trans-Id belongs to.
-# This is very useful when one is managing more than one swift cluster.
-# trans_id_suffix =
-#
-# comma separated list of functions to call to setup custom log handlers.
-# functions get passed: conf, name, log_to_console, log_route, fmt, logger,
-# adapted_logger
-# log_custom_handlers =
-#
-# If set, log_udp_host will override log_address
-# log_udp_host =
-# log_udp_port = 514
-#
-# You can enable StatsD logging here:
-# log_statsd_host =
-# log_statsd_port = 8125
-# log_statsd_default_sample_rate = 1.0
-# log_statsd_sample_rate_factor = 1.0
-# log_statsd_metric_prefix =
-#
-# Use a comma separated list of full url (http://foo.bar:1234,https://foo.bar)
-# cors_allow_origin =
-# strict_cors_mode = True
-#
-# client_timeout = 60
-# eventlet_debug = false
-
-[pipeline:main]
-# This sample pipeline uses tempauth and is used for SAIO dev work and
-# testing. See below for a pipeline using keystone.
-#pipeline = catch_errors gatekeeper healthcheck proxy-logging cache container_sync bulk tempurl ratelimit tempauth container-quotas account-quotas slo dlo versioned_writes proxy-logging proxy-server
-pipeline = catch_errors gatekeeper healthcheck proxy-logging cache container_sync bulk ratelimit authtoken keystoneauth container-quotas account-quotas slo dlo versioned_writes proxy-logging moon proxy-server
-
-# The following pipeline shows keystone integration. Comment out the one
-# above and uncomment this one. Additional steps for integrating keystone are
-# covered further below in the filter sections for authtoken and keystoneauth.
-#pipeline = catch_errors gatekeeper healthcheck proxy-logging cache container_sync bulk tempurl ratelimit authtoken keystoneauth container-quotas account-quotas slo dlo versioned_writes proxy-logging proxy-server
-
-[app:proxy-server]
-use = egg:swift#proxy
-account_autocreate = True
-# You can override the default log routing for this app here:
-# set log_name = proxy-server
-# set log_facility = LOG_LOCAL0
-# set log_level = INFO
-# set log_address = /dev/log
-#
-# log_handoffs = true
-# recheck_account_existence = 60
-# recheck_container_existence = 60
-# object_chunk_size = 65536
-# client_chunk_size = 65536
-#
-# How long the proxy server will wait on responses from the a/c/o servers.
-# node_timeout = 10
-#
-# How long the proxy server will wait for an initial response and to read a
-# chunk of data from the object servers while serving GET / HEAD requests.
-# Timeouts from these requests can be recovered from so setting this to
-# something lower than node_timeout would provide quicker error recovery
-# while allowing for a longer timeout for non-recoverable requests (PUTs).
-# Defaults to node_timeout, should be overriden if node_timeout is set to a
-# high number to prevent client timeouts from firing before the proxy server
-# has a chance to retry.
-# recoverable_node_timeout = node_timeout
-#
-# conn_timeout = 0.5
-#
-# How long to wait for requests to finish after a quorum has been established.
-# post_quorum_timeout = 0.5
-#
-# How long without an error before a node's error count is reset. This will
-# also be how long before a node is reenabled after suppression is triggered.
-# error_suppression_interval = 60
-#
-# How many errors can accumulate before a node is temporarily ignored.
-# error_suppression_limit = 10
-#
-# If set to 'true' any authorized user may create and delete accounts; if
-# 'false' no one, even authorized, can.
-# allow_account_management = false
-#
-# Set object_post_as_copy = false to turn on fast posts where only the metadata
-# changes are stored anew and the original data file is kept in place. This
-# makes for quicker posts.
-# object_post_as_copy = true
-#
-# If set to 'true' authorized accounts that do not yet exist within the Swift
-# cluster will be automatically created.
-# account_autocreate = false
-#
-# If set to a positive value, trying to create a container when the account
-# already has at least this maximum containers will result in a 403 Forbidden.
-# Note: This is a soft limit, meaning a user might exceed the cap for
-# recheck_account_existence before the 403s kick in.
-# max_containers_per_account = 0
-#
-# This is a comma separated list of account hashes that ignore the
-# max_containers_per_account cap.
-# max_containers_whitelist =
-#
-# Comma separated list of Host headers to which the proxy will deny requests.
-# deny_host_headers =
-#
-# Prefix used when automatically creating accounts.
-# auto_create_account_prefix = .
-#
-# Depth of the proxy put queue.
-# put_queue_depth = 10
-#
-# Storage nodes can be chosen at random (shuffle), by using timing
-# measurements (timing), or by using an explicit match (affinity).
-# Using timing measurements may allow for lower overall latency, while
-# using affinity allows for finer control. In both the timing and
-# affinity cases, equally-sorting nodes are still randomly chosen to
-# spread load.
-# The valid values for sorting_method are "affinity", "shuffle", or "timing".
-# sorting_method = shuffle
-#
-# If the "timing" sorting_method is used, the timings will only be valid for
-# the number of seconds configured by timing_expiry.
-# timing_expiry = 300
-#
-# By default on a GET/HEAD swift will connect to a storage node one at a time
-# in a single thread. There is smarts in the order they are hit however. If you
-# turn on concurrent_gets below, then replica count threads will be used.
-# With addition of the concurrency_timeout option this will allow swift to send
-# out GET/HEAD requests to the storage nodes concurrently and answer with the
-# first to respond. With an EC policy the parameter only affects HEAD requests.
-# concurrent_gets = off
-#
-# This parameter controls how long to wait before firing off the next
-# concurrent_get thread. A value of 0 would be fully concurrent, any other
-# number will stagger the firing of the threads. This number should be
-# between 0 and node_timeout. The default is what ever you set for the
-# conn_timeout parameter.
-# concurrency_timeout = 0.5
-#
-# Set to the number of nodes to contact for a normal request. You can use
-# '* replicas' at the end to have it use the number given times the number of
-# replicas for the ring being used for the request.
-# request_node_count = 2 * replicas
-#
-# Which backend servers to prefer on reads. Format is r<N> for region
-# N or r<N>z<M> for region N, zone M. The value after the equals is
-# the priority; lower numbers are higher priority.
-#
-# Example: first read from region 1 zone 1, then region 1 zone 2, then
-# anything in region 2, then everything else:
-# read_affinity = r1z1=100, r1z2=200, r2=300
-# Default is empty, meaning no preference.
-# read_affinity =
-#
-# Which backend servers to prefer on writes. Format is r<N> for region
-# N or r<N>z<M> for region N, zone M. If this is set, then when
-# handling an object PUT request, some number (see setting
-# write_affinity_node_count) of local backend servers will be tried
-# before any nonlocal ones.
-#
-# Example: try to write to regions 1 and 2 before writing to any other
-# nodes:
-# write_affinity = r1, r2
-# Default is empty, meaning no preference.
-# write_affinity =
-#
-# The number of local (as governed by the write_affinity setting)
-# nodes to attempt to contact first, before any non-local ones. You
-# can use '* replicas' at the end to have it use the number given
-# times the number of replicas for the ring being used for the
-# request.
-# write_affinity_node_count = 2 * replicas
-#
-# These are the headers whose values will only be shown to swift_owners. The
-# exact definition of a swift_owner is up to the auth system in use, but
-# usually indicates administrative responsibilities.
-# swift_owner_headers = x-container-read, x-container-write, x-container-sync-key, x-container-sync-to, x-account-meta-temp-url-key, x-account-meta-temp-url-key-2, x-container-meta-temp-url-key, x-container-meta-temp-url-key-2, x-account-access-control
-
-[filter:tempauth]
-use = egg:swift#tempauth
-# You can override the default log routing for this filter here:
-# set log_name = tempauth
-# set log_facility = LOG_LOCAL0
-# set log_level = INFO
-# set log_headers = false
-# set log_address = /dev/log
-#
-# The reseller prefix will verify a token begins with this prefix before even
-# attempting to validate it. Also, with authorization, only Swift storage
-# accounts with this prefix will be authorized by this middleware. Useful if
-# multiple auth systems are in use for one Swift cluster.
-# The reseller_prefix may contain a comma separated list of items. The first
-# item is used for the token as mentioned above. If second and subsequent
-# items exist, the middleware will handle authorization for an account with
-# that prefix. For example, for prefixes "AUTH, SERVICE", a path of
-# /v1/SERVICE_account is handled the same as /v1/AUTH_account. If an empty
-# (blank) reseller prefix is required, it must be first in the list. Two
-# single quote characters indicates an empty (blank) reseller prefix.
-# reseller_prefix = AUTH
-
-#
-# The require_group parameter names a group that must be presented by
-# either X-Auth-Token or X-Service-Token. Usually this parameter is
-# used only with multiple reseller prefixes (e.g., SERVICE_require_group=blah).
-# By default, no group is needed. Do not use .admin.
-# require_group =
-
-# The auth prefix will cause requests beginning with this prefix to be routed
-# to the auth subsystem, for granting tokens, etc.
-# auth_prefix = /auth/
-# token_life = 86400
-#
-# This allows middleware higher in the WSGI pipeline to override auth
-# processing, useful for middleware such as tempurl and formpost. If you know
-# you're not going to use such middleware and you want a bit of extra security,
-# you can set this to false.
-# allow_overrides = true
-#
-# This specifies what scheme to return with storage urls:
-# http, https, or default (chooses based on what the server is running as)
-# This can be useful with an SSL load balancer in front of a non-SSL server.
-# storage_url_scheme = default
-#
-# Lastly, you need to list all the accounts/users you want here. The format is:
-# user_<account>_<user> = <key> [group] [group] [...] [storage_url]
-# or if you want underscores in <account> or <user>, you can base64 encode them
-# (with no equal signs) and use this format:
-# user64_<account_b64>_<user_b64> = <key> [group] [group] [...] [storage_url]
-# There are special groups of:
-# .reseller_admin = can do anything to any account for this auth
-# .admin = can do anything within the account
-# If neither of these groups are specified, the user can only access containers
-# that have been explicitly allowed for them by a .admin or .reseller_admin.
-# The trailing optional storage_url allows you to specify an alternate url to
-# hand back to the user upon authentication. If not specified, this defaults to
-# $HOST/v1/<reseller_prefix>_<account> where $HOST will do its best to resolve
-# to what the requester would need to use to reach this host.
-# Here are example entries, required for running the tests:
-user_admin_admin = admin .admin .reseller_admin
-user_test_tester = testing .admin
-user_test2_tester2 = testing2 .admin
-user_test_tester3 = testing3
-user_test5_tester5 = testing5 service
-
-# To enable Keystone authentication you need to have the auth token
-# middleware first to be configured. Here is an example below, please
-# refer to the keystone's documentation for details about the
-# different settings.
-#
-# You'll also need to have the keystoneauth middleware enabled and have it in
-# your main pipeline, as show in the sample pipeline at the top of this file.
-#
-# Following parameters are known to work with keystonemiddleware v2.3.0
-# (above v2.0.0), but checking the latest information in the wiki page[1]
-# is recommended.
-# 1. http://docs.openstack.org/developer/keystonemiddleware/middlewarearchitecture.html#configuration
-#
-[filter:authtoken]
-paste.filter_factory = keystonemiddleware.auth_token:filter_factory
-auth_uri = http://{{ internal_vip.ip }}:5000
-auth_url = http://{{ internal_vip.ip }}:35357
-identity_uri = http://{{ internal_vip.ip }}:35357
-memcached_servers = {{ memcached_servers }}
-#auth_plugin = password
-auth_type = password
-project_domain_id = default
-user_domain_id = default
-project_name = service
-username = swift
-password = {{ CINDER_PASS }}
-delay_auth_decision = True
-admin_user=admin
-admin_password={{ ADMIN_PASS }}
-admin_token={{ ADMIN_TOKEN }}
-#
-# delay_auth_decision defaults to False, but leaving it as false will
-# prevent other auth systems, staticweb, tempurl, formpost, and ACLs from
-# working. This value must be explicitly set to True.
-# delay_auth_decision = False
-#
-# cache = swift.cache
-# include_service_catalog = False
-#
-[filter:keystoneauth]
-use = egg:swift#keystoneauth
-operator_roles = admin,user
-# The reseller_prefix option lists account namespaces that this middleware is
-# responsible for. The prefix is placed before the Keystone project id.
-# For example, for project 12345678, and prefix AUTH, the account is
-# named AUTH_12345678 (i.e., path is /v1/AUTH_12345678/...).
-# Several prefixes are allowed by specifying a comma-separated list
-# as in: "reseller_prefix = AUTH, SERVICE". The empty string indicates a
-# single blank/empty prefix. If an empty prefix is required in a list of
-# prefixes, a value of '' (two single quote characters) indicates a
-# blank/empty prefix. Except for the blank/empty prefix, an underscore ('_')
-# character is appended to the value unless already present.
-# reseller_prefix = AUTH
-#
-# The user must have at least one role named by operator_roles on a
-# project in order to create, delete and modify containers and objects
-# and to set and read privileged headers such as ACLs.
-# If there are several reseller prefix items, you can prefix the
-# parameter so it applies only to those accounts (for example
-# the parameter SERVICE_operator_roles applies to the /v1/SERVICE_<project>
-# path). If you omit the prefix, the option applies to all reseller
-# prefix items. For the blank/empty prefix, prefix with '' (do not put
-# underscore after the two single quote characters).
-# operator_roles = admin, swiftoperator
-#
-# The reseller admin role has the ability to create and delete accounts
-# reseller_admin_role = ResellerAdmin
-#
-# This allows middleware higher in the WSGI pipeline to override auth
-# processing, useful for middleware such as tempurl and formpost. If you know
-# you're not going to use such middleware and you want a bit of extra security,
-# you can set this to false.
-# allow_overrides = true
-#
-# If the service_roles parameter is present, an X-Service-Token must be
-# present in the request that when validated, grants at least one role listed
-# in the parameter. The X-Service-Token may be scoped to any project.
-# If there are several reseller prefix items, you can prefix the
-# parameter so it applies only to those accounts (for example
-# the parameter SERVICE_service_roles applies to the /v1/SERVICE_<project>
-# path). If you omit the prefix, the option applies to all reseller
-# prefix items. For the blank/empty prefix, prefix with '' (do not put
-# underscore after the two single quote characters).
-# By default, no service_roles are required.
-# service_roles =
-#
-# For backwards compatibility, keystoneauth will match names in cross-tenant
-# access control lists (ACLs) when both the requesting user and the tenant
-# are in the default domain i.e the domain to which existing tenants are
-# migrated. The default_domain_id value configured here should be the same as
-# the value used during migration of tenants to keystone domains.
-# default_domain_id = default
-#
-# For a new installation, or an installation in which keystone projects may
-# move between domains, you should disable backwards compatible name matching
-# in ACLs by setting allow_names_in_acls to false:
-# allow_names_in_acls = true
-
-[filter:healthcheck]
-use = egg:swift#healthcheck
-# An optional filesystem path, which if present, will cause the healthcheck
-# URL to return "503 Service Unavailable" with a body of "DISABLED BY FILE".
-# This facility may be used to temporarily remove a Swift node from a load
-# balancer pool during maintenance or upgrade (remove the file to allow the
-# node back into the load balancer pool).
-# disable_path =
-
-[filter:cache]
-use = egg:swift#memcache
-memcache_servers = {{ memcached_servers }}
-# You can override the default log routing for this filter here:
-# set log_name = cache
-# set log_facility = LOG_LOCAL0
-# set log_level = INFO
-# set log_headers = false
-# set log_address = /dev/log
-#
-# If not set here, the value for memcache_servers will be read from
-# memcache.conf (see memcache.conf-sample) or lacking that file, it will
-# default to the value below. You can specify multiple servers separated with
-# commas, as in: 10.1.2.3:11211,10.1.2.4:11211 (IPv6 addresses must
-# follow rfc3986 section-3.2.2, i.e. [::1]:11211)
-# memcache_servers = 127.0.0.1:11211
-#
-# Sets how memcache values are serialized and deserialized:
-# 0 = older, insecure pickle serialization
-# 1 = json serialization but pickles can still be read (still insecure)
-# 2 = json serialization only (secure and the default)
-# If not set here, the value for memcache_serialization_support will be read
-# from /etc/swift/memcache.conf (see memcache.conf-sample).
-# To avoid an instant full cache flush, existing installations should
-# upgrade with 0, then set to 1 and reload, then after some time (24 hours)
-# set to 2 and reload.
-# In the future, the ability to use pickle serialization will be removed.
-# memcache_serialization_support = 2
-#
-# Sets the maximum number of connections to each memcached server per worker
-# memcache_max_connections = 2
-#
-# More options documented in memcache.conf-sample
-
-[filter:ratelimit]
-use = egg:swift#ratelimit
-# You can override the default log routing for this filter here:
-# set log_name = ratelimit
-# set log_facility = LOG_LOCAL0
-# set log_level = INFO
-# set log_headers = false
-# set log_address = /dev/log
-#
-# clock_accuracy should represent how accurate the proxy servers' system clocks
-# are with each other. 1000 means that all the proxies' clock are accurate to
-# each other within 1 millisecond. No ratelimit should be higher than the
-# clock accuracy.
-# clock_accuracy = 1000
-#
-# max_sleep_time_seconds = 60
-#
-# log_sleep_time_seconds of 0 means disabled
-# log_sleep_time_seconds = 0
-#
-# allows for slow rates (e.g. running up to 5 sec's behind) to catch up.
-# rate_buffer_seconds = 5
-#
-# account_ratelimit of 0 means disabled
-# account_ratelimit = 0
-
-# DEPRECATED- these will continue to work but will be replaced
-# by the X-Account-Sysmeta-Global-Write-Ratelimit flag.
-# Please see ratelimiting docs for details.
-# these are comma separated lists of account names
-# account_whitelist = a,b
-# account_blacklist = c,d
-
-# with container_limit_x = r
-# for containers of size x limit write requests per second to r. The container
-# rate will be linearly interpolated from the values given. With the values
-# below, a container of size 5 will get a rate of 75.
-# container_ratelimit_0 = 100
-# container_ratelimit_10 = 50
-# container_ratelimit_50 = 20
-
-# Similarly to the above container-level write limits, the following will limit
-# container GET (listing) requests.
-# container_listing_ratelimit_0 = 100
-# container_listing_ratelimit_10 = 50
-# container_listing_ratelimit_50 = 20
-
-[filter:domain_remap]
-use = egg:swift#domain_remap
-# You can override the default log routing for this filter here:
-# set log_name = domain_remap
-# set log_facility = LOG_LOCAL0
-# set log_level = INFO
-# set log_headers = false
-# set log_address = /dev/log
-#
-# storage_domain = example.com
-# path_root = v1
-
-# Browsers can convert a host header to lowercase, so check that reseller
-# prefix on the account is the correct case. This is done by comparing the
-# items in the reseller_prefixes config option to the found prefix. If they
-# match except for case, the item from reseller_prefixes will be used
-# instead of the found reseller prefix. When none match, the default reseller
-# prefix is used. When no default reseller prefix is configured, any request
-# with an account prefix not in that list will be ignored by this middleware.
-# reseller_prefixes = AUTH
-# default_reseller_prefix =
-
-[filter:catch_errors]
-use = egg:swift#catch_errors
-# You can override the default log routing for this filter here:
-# set log_name = catch_errors
-# set log_facility = LOG_LOCAL0
-# set log_level = INFO
-# set log_headers = false
-# set log_address = /dev/log
-
-[filter:cname_lookup]
-# Note: this middleware requires python-dnspython
-use = egg:swift#cname_lookup
-# You can override the default log routing for this filter here:
-# set log_name = cname_lookup
-# set log_facility = LOG_LOCAL0
-# set log_level = INFO
-# set log_headers = false
-# set log_address = /dev/log
-#
-# Specify the storage_domain that match your cloud, multiple domains
-# can be specified separated by a comma
-# storage_domain = example.com
-#
-# lookup_depth = 1
-
-# Note: Put staticweb just after your auth filter(s) in the pipeline
-[filter:staticweb]
-use = egg:swift#staticweb
-# You can override the default log routing for this filter here:
-# set log_name = staticweb
-# set log_facility = LOG_LOCAL0
-# set log_level = INFO
-# set log_headers = false
-# set log_address = /dev/log
-
-# Note: Put tempurl before dlo, slo and your auth filter(s) in the pipeline
-[filter:tempurl]
-use = egg:swift#tempurl
-# The methods allowed with Temp URLs.
-# methods = GET HEAD PUT POST DELETE
-#
-# The headers to remove from incoming requests. Simply a whitespace delimited
-# list of header names and names can optionally end with '*' to indicate a
-# prefix match. incoming_allow_headers is a list of exceptions to these
-# removals.
-# incoming_remove_headers = x-timestamp
-#
-# The headers allowed as exceptions to incoming_remove_headers. Simply a
-# whitespace delimited list of header names and names can optionally end with
-# '*' to indicate a prefix match.
-# incoming_allow_headers =
-#
-# The headers to remove from outgoing responses. Simply a whitespace delimited
-# list of header names and names can optionally end with '*' to indicate a
-# prefix match. outgoing_allow_headers is a list of exceptions to these
-# removals.
-# outgoing_remove_headers = x-object-meta-*
-#
-# The headers allowed as exceptions to outgoing_remove_headers. Simply a
-# whitespace delimited list of header names and names can optionally end with
-# '*' to indicate a prefix match.
-# outgoing_allow_headers = x-object-meta-public-*
-
-# Note: Put formpost just before your auth filter(s) in the pipeline
-[filter:formpost]
-use = egg:swift#formpost
-
-# Note: Just needs to be placed before the proxy-server in the pipeline.
-[filter:name_check]
-use = egg:swift#name_check
-# forbidden_chars = '"`<>
-# maximum_length = 255
-# forbidden_regexp = /\./|/\.\./|/\.$|/\.\.$
-
-[filter:list-endpoints]
-use = egg:swift#list_endpoints
-# list_endpoints_path = /endpoints/
-
-[filter:proxy-logging]
-use = egg:swift#proxy_logging
-# If not set, logging directives from [DEFAULT] without "access_" will be used
-# access_log_name = swift
-# access_log_facility = LOG_LOCAL0
-# access_log_level = INFO
-# access_log_address = /dev/log
-#
-# If set, access_log_udp_host will override access_log_address
-# access_log_udp_host =
-# access_log_udp_port = 514
-#
-# You can use log_statsd_* from [DEFAULT] or override them here:
-# access_log_statsd_host =
-# access_log_statsd_port = 8125
-# access_log_statsd_default_sample_rate = 1.0
-# access_log_statsd_sample_rate_factor = 1.0
-# access_log_statsd_metric_prefix =
-# access_log_headers = false
-#
-# If access_log_headers is True and access_log_headers_only is set only
-# these headers are logged. Multiple headers can be defined as comma separated
-# list like this: access_log_headers_only = Host, X-Object-Meta-Mtime
-# access_log_headers_only =
-#
-# By default, the X-Auth-Token is logged. To obscure the value,
-# set reveal_sensitive_prefix to the number of characters to log.
-# For example, if set to 12, only the first 12 characters of the
-# token appear in the log. An unauthorized access of the log file
-# won't allow unauthorized usage of the token. However, the first
-# 12 or so characters is unique enough that you can trace/debug
-# token usage. Set to 0 to suppress the token completely (replaced
-# by '...' in the log).
-# Note: reveal_sensitive_prefix will not affect the value
-# logged with access_log_headers=True.
-# reveal_sensitive_prefix = 16
-#
-# What HTTP methods are allowed for StatsD logging (comma-sep); request methods
-# not in this list will have "BAD_METHOD" for the <verb> portion of the metric.
-# log_statsd_valid_http_methods = GET,HEAD,POST,PUT,DELETE,COPY,OPTIONS
-#
-# Note: The double proxy-logging in the pipeline is not a mistake. The
-# left-most proxy-logging is there to log requests that were handled in
-# middleware and never made it through to the right-most middleware (and
-# proxy server). Double logging is prevented for normal requests. See
-# proxy-logging docs.
-
-# Note: Put before both ratelimit and auth in the pipeline.
-[filter:bulk]
-use = egg:swift#bulk
-# max_containers_per_extraction = 10000
-# max_failed_extractions = 1000
-# max_deletes_per_request = 10000
-# max_failed_deletes = 1000
-
-# In order to keep a connection active during a potentially long bulk request,
-# Swift may return whitespace prepended to the actual response body. This
-# whitespace will be yielded no more than every yield_frequency seconds.
-# yield_frequency = 10
-
-# Note: The following parameter is used during a bulk delete of objects and
-# their container. This would frequently fail because it is very likely
-# that all replicated objects have not been deleted by the time the middleware got a
-# successful response. It can be configured the number of retries. And the
-# number of seconds to wait between each retry will be 1.5**retry
-
-# delete_container_retry_count = 0
-
-# Note: Put after auth and staticweb in the pipeline.
-[filter:slo]
-use = egg:swift#slo
-# max_manifest_segments = 1000
-# max_manifest_size = 2097152
-#
-# Rate limiting applies only to segments smaller than this size (bytes).
-# rate_limit_under_size = 1048576
-#
-# Start rate-limiting SLO segment serving after the Nth small segment of a
-# segmented object.
-# rate_limit_after_segment = 10
-#
-# Once segment rate-limiting kicks in for an object, limit segments served
-# to N per second. 0 means no rate-limiting.
-# rate_limit_segments_per_sec = 1
-#
-# Time limit on GET requests (seconds)
-# max_get_time = 86400
-
-# Note: Put after auth and staticweb in the pipeline.
-# If you don't put it in the pipeline, it will be inserted for you.
-[filter:dlo]
-use = egg:swift#dlo
-# Start rate-limiting DLO segment serving after the Nth segment of a
-# segmented object.
-# rate_limit_after_segment = 10
-#
-# Once segment rate-limiting kicks in for an object, limit segments served
-# to N per second. 0 means no rate-limiting.
-# rate_limit_segments_per_sec = 1
-#
-# Time limit on GET requests (seconds)
-# max_get_time = 86400
-
-# Note: Put after auth in the pipeline.
-[filter:container-quotas]
-use = egg:swift#container_quotas
-
-# Note: Put after auth in the pipeline.
-[filter:account-quotas]
-use = egg:swift#account_quotas
-
-[filter:gatekeeper]
-use = egg:swift#gatekeeper
-# Set this to false if you want to allow clients to set arbitrary X-Timestamps
-# on uploaded objects. This may be used to preserve timestamps when migrating
-# from a previous storage system, but risks allowing users to upload
-# difficult-to-delete data.
-# shunt_inbound_x_timestamp = true
-#
-# You can override the default log routing for this filter here:
-# set log_name = gatekeeper
-# set log_facility = LOG_LOCAL0
-# set log_level = INFO
-# set log_headers = false
-# set log_address = /dev/log
-
-[filter:container_sync]
-use = egg:swift#container_sync
-# Set this to false if you want to disallow any full url values to be set for
-# any new X-Container-Sync-To headers. This will keep any new full urls from
-# coming in, but won't change any existing values already in the cluster.
-# Updating those will have to be done manually, as knowing what the true realm
-# endpoint should be cannot always be guessed.
-# allow_full_urls = true
-# Set this to specify this clusters //realm/cluster as "current" in /info
-# current = //REALM/CLUSTER
-
-# Note: Put it at the beginning of the pipeline to profile all middleware. But
-# it is safer to put this after catch_errors, gatekeeper and healthcheck.
-[filter:xprofile]
-use = egg:swift#xprofile
-# This option enable you to switch profilers which should inherit from python
-# standard profiler. Currently the supported value can be 'cProfile',
-# 'eventlet.green.profile' etc.
-# profile_module = eventlet.green.profile
-#
-# This prefix will be used to combine process ID and timestamp to name the
-# profile data file. Make sure the executing user has permission to write
-# into this path (missing path segments will be created, if necessary).
-# If you enable profiling in more than one type of daemon, you must override
-# it with an unique value like: /var/log/swift/profile/proxy.profile
-# log_filename_prefix = /tmp/log/swift/profile/default.profile
-#
-# the profile data will be dumped to local disk based on above naming rule
-# in this interval.
-# dump_interval = 5.0
-#
-# Be careful, this option will enable profiler to dump data into the file with
-# time stamp which means there will be lots of files piled up in the directory.
-# dump_timestamp = false
-#
-# This is the path of the URL to access the mini web UI.
-# path = /__profile__
-#
-# Clear the data when the wsgi server shutdown.
-# flush_at_shutdown = false
-#
-# unwind the iterator of applications
-# unwind = false
-
-# Note: Put after slo, dlo in the pipeline.
-# If you don't put it in the pipeline, it will be inserted automatically.
-[filter:versioned_writes]
-use = egg:swift#versioned_writes
-# Enables using versioned writes middleware and exposing configuration
-# settings via HTTP GET /info.
-# WARNING: Setting this option bypasses the "allow_versions" option
-# in the container configuration file, which will be eventually
-# deprecated. See documentation for more details.
-# allow_versioned_writes = false
-
-
-[filter:moon]
-paste.filter_factory = keystonemiddleware.moon_agent:filter_factory
-authz_login=admin
-authz_password={{ ADMIN_PASS }}
-auth_host = {{ internal_vip.ip }}
-logfile=/var/log/moon/keystonemiddleware.log
+++ /dev/null
- {% set work_threads = (ansible_processor_vcpus + 1) // 2 %}
-<VirtualHost {{ internal_ip }}:5000>
- WSGIDaemonProcess keystone-public processes={{ work_threads }} threads={{ work_threads }} user=keystone group=keystone display-name=%{GROUP}
- WSGIProcessGroup keystone-public
- WSGIScriptAlias / /usr/bin/keystone-wsgi-public
- WSGIApplicationGroup %{GLOBAL}
- WSGIPassAuthorization On
- <IfVersion >= 2.4>
- ErrorLogFormat "%{cu}t %M"
- </IfVersion>
- ErrorLog /var/log/{{ http_service_name }}/keystone.log
- CustomLog /var/log/{{ http_service_name }}/keystone_access.log combined
-
- <Directory /usr/bin>
- <IfVersion >= 2.4>
- Require all granted
- </IfVersion>
- <IfVersion < 2.4>
- Order allow,deny
- Allow from all
- </IfVersion>
- </Directory>
-</VirtualHost>
-
-<VirtualHost {{ internal_ip }}:35357>
- WSGIDaemonProcess keystone-admin processes={{ work_threads }} threads={{ work_threads }} user=keystone group=keystone display-name=%{GROUP}
- WSGIProcessGroup keystone-admin
- WSGIScriptAlias / /usr/bin/keystone-wsgi-admin
- WSGIApplicationGroup %{GLOBAL}
- WSGIPassAuthorization On
- <IfVersion >= 2.4>
- ErrorLogFormat "%{cu}t %M"
- </IfVersion>
- ErrorLog /var/log/{{ http_service_name }}/keystone.log
- CustomLog /var/log/{{ http_service_name }}/keystone_access.log combined
-
- <Directory /usr/bin>
- <IfVersion >= 2.4>
- Require all granted
- </IfVersion>
- <IfVersion < 2.4>
- Order allow,deny
- Allow from all
- </IfVersion>
- </Directory>
-</VirtualHost>
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-
-packages:
- - adduser
- - dbconfig-common
- - init-system-helpers
- - python-keystone
- - q-text-as-data
- - sqlite3
- - ssl-cert
- - debconf
- - lsb-base
- - python:any
- - libjs-sphinxdoc
- - python-pip
- - unzip
- - apache2
- - libapache2-mod-wsgi
-
-dependency_packages:
- - python-cryptography
- - python-dateutil
- - python-dogpile.cache
- - python-eventlet
- - python-greenlet
- - python-jsonschema
- - python-keystoneclient
- - python-keystonemiddleware
- - python-ldap
- - python-ldappool
- - python-lxml
- - python-memcache
- - python-migrate
- - python-msgpack
- - python-mysqldb
- - python-oauthlib
- - python-openstackclient
- - python-oslo.cache
- - python-oslo.concurrency
- - python-oslo.config
- - python-oslo.context
- - python-oslo.db
- - python-oslo.i18n
- - python-oslo.log
- - python-oslo.messaging
- - python-oslo.middleware
- - python-oslo.policy
- - python-oslo.serialization
- - python-oslo.service
- - python-oslo.utils
- - python-pam
- - python-passlib
- - python-paste
- - python-pastedeploy
- - python-pbr
- - python-pycadf
- - python-pymysql
- - python-pysaml2
- - python-pysqlite2
- - python-routes
- - python-six
- - python-sqlalchemy
- - python-stevedore
- - python-webob
- - unzip
- - python3-keystoneauth1
- - python3-keystoneclient
- - python3-oslo.config
- - python3-oslo.context
- - python3-oslo.i18n
- - python3-oslo.serialization
- - python-oslo.service
- - python-oslo.utils
- - python-pam
- - python-passlib
- - python-paste
- - python-pastedeploy
- - python-pbr
- - python-pycadf
- - python-pymysql
- - python-pysaml2
- - python-pysqlite2
- - python-routes
- - python-six
- - python-sqlalchemy
- - python-stevedore
- - python-webob
- - unzip
- - python3-keystoneauth1
- - python3-keystoneclient
- - python3-oslo.config
- - python3-oslo.context
- - python3-oslo.i18n
- - python3-oslo.serialization
- - python3-oslo.utils
- - apache2
- - libapache2-mod-wsgi
- - python3-cryptography
- - python3-dateutil
- - python3-dogpile.cache
- - python3-eventlet
- - python3-greenlet
- - python3-jsonschema
- - python3-keystoneclient
- - python3-keystonemiddleware
- - python3-lxml
- - python3-memcache
- - python3-migrate
- - python3-msgpack
- - python3-mysqldb
- - python3-oauthlib
- - python3-openstackclient
- - python3-oslo.cache
- - python3-oslo.concurrency
- - python3-oslo.config
- - python3-oslo.context
- - python3-oslo.db
- - python3-oslo.i18n
- - python3-oslo.log
- - python3-oslo.messaging
- - python3-oslo.middleware
- - python3-oslo.policy
- - python3-oslo.serialization
- - python3-oslo.service
- - python3-oslo.utils
- - python3-pam
- - python3-passlib
- - python3-paste
- - python3-pastedeploy
- - python3-pbr
- - python3-pycadf
- - python3-pymysql
- - python3-pysaml2
- - python3-routes
- - python3-six
- - python3-sqlalchemy
- - python3-stevedore
- - python3-webob
- - python3-oslo.service
- - python3-oslo.utils
- - python3-pam
- - python3-passlib
- - python3-paste
- - python3-pastedeploy
- - python3-pbr
- - python3-pycadf
- - python3-pymysql
- - python3-pysaml2
- - python3-routes
- - python3-six
- - python3-sqlalchemy
- - python3-stevedore
- - python3-webob
-
-services:
- - apache2
-
-
-apache_config_dir: /etc/apache2
-http_service_name: apache2
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-packages_noarch: []
-
-services_noarch: []
-
-os_services:
- - name: keystone
- type: identity
- region: RegionOne
- description: "OpenStack Identity"
- publicurl: "http://{{ public_vip.ip }}:5000/v2.0"
- internalurl: "http://{{ internal_vip.ip }}:5000/v2.0"
- adminurl: "http://{{ internal_vip.ip }}:35357/v2.0"
-
- - name: glance
- type: image
- region: RegionOne
- description: "OpenStack Image Service"
- publicurl: "http://{{ public_vip.ip }}:9292"
- internalurl: "http://{{ internal_vip.ip }}:9292"
- adminurl: "http://{{ internal_vip.ip }}:9292"
-
- - name: nova
- type: compute
- region: RegionOne
- description: "OpenStack Compute"
- publicurl: "http://{{ public_vip.ip }}:8774/v2/%(tenant_id)s"
- internalurl: "http://{{ internal_vip.ip }}:8774/v2/%(tenant_id)s"
- adminurl: "http://{{ internal_vip.ip }}:8774/v2/%(tenant_id)s"
-
- - name: neutron
- type: network
- region: RegionOne
- description: "OpenStack Networking"
- publicurl: "http://{{ public_vip.ip }}:9696"
- internalurl: "http://{{ internal_vip.ip }}:9696"
- adminurl: "http://{{ internal_vip.ip }}:9696"
-
- - name: ceilometer
- type: metering
- region: RegionOne
- description: "OpenStack Telemetry"
- publicurl: "http://{{ public_vip.ip }}:8777"
- internalurl: "http://{{ internal_vip.ip }}:8777"
- adminurl: "http://{{ internal_vip.ip }}:8777"
-
- - name: aodh
- type: alarming
- region: RegionOne
- description: "OpenStack Telemetry"
- publicurl: "http://{{ public_vip.ip }}:8042"
- internalurl: "http://{{ internal_vip.ip }}:8042"
- adminurl: "http://{{ internal_vip.ip }}:8042"
-
- - name: heat
- type: orchestration
- region: RegionOne
- description: "OpenStack Orchestration"
- publicurl: "http://{{ public_vip.ip }}:8004/v1/%(tenant_id)s"
- internalurl: "http://{{ internal_vip.ip }}:8004/v1/%(tenant_id)s"
- adminurl: "http://{{ internal_vip.ip }}:8004/v1/%(tenant_id)s"
-
- - name: heat-cfn
- type: cloudformation
- region: RegionOne
- description: "OpenStack CloudFormation Orchestration"
- publicurl: "http://{{ public_vip.ip }}:8000/v1"
- internalurl: "http://{{ internal_vip.ip }}:8000/v1"
- adminurl: "http://{{ internal_vip.ip }}:8000/v1"
-
-# - name: cinder
-# type: volume
-# region: RegionOne
-# description: "OpenStack Block Storage"
-# publicurl: "http://{{ public_vip.ip }}:8776/v1/%(tenant_id)s"
-# internalurl: "http://{{ internal_vip.ip }}:8776/v1/%(tenant_id)s"
-# adminurl: "http://{{ internal_vip.ip }}:8776/v1/%(tenant_id)s"
-
-# - name: cinderv2
-# type: volumev2
-# region: RegionOne
-# description: "OpenStack Block Storage v2"
-# publicurl: "http://{{ public_vip.ip }}:8776/v2/%(tenant_id)s"
-# internalurl: "http://{{ internal_vip.ip }}:8776/v2/%(tenant_id)s"
-# adminurl: "http://{{ internal_vip.ip }}:8776/v2/%(tenant_id)s"
-
-# - name: swift
-# type: object-store
-# region: RegionOne
-# description: "OpenStack Object Storage"
-# publicurl: "http://{{ public_vip.ip }}:8080/v1/AUTH_%(tenant_id)s"
-# internalurl: "http://{{ internal_vip.ip }}:8080/v1/AUTH_%(tenant_id)s"
-# adminurl: "http://{{ internal_vip.ip }}:8080/v1/AUTH_%(tenant_id)s"
-
-os_users:
- - user: admin
- password: "{{ ADMIN_PASS }}"
- email: admin@admin.com
- role: admin
- tenant: admin
- tenant_description: "Admin Tenant"
-
- - user: glance
- password: "{{ GLANCE_PASS }}"
- email: glance@admin.com
- role: admin
- tenant: service
- tenant_description: "Service Tenant"
-
- - user: nova
- password: "{{ NOVA_PASS }}"
- email: nova@admin.com
- role: admin
- tenant: service
- tenant_description: "Service Tenant"
-
- - user: keystone
- password: "{{ KEYSTONE_PASS }}"
- email: keystone@admin.com
- role: admin
- tenant: service
- tenant_description: "Service Tenant"
-
- - user: neutron
- password: "{{ NEUTRON_PASS }}"
- email: neutron@admin.com
- role: admin
- tenant: service
- tenant_description: "Service Tenant"
-
- - user: ceilometer
- password: "{{ CEILOMETER_PASS }}"
- email: ceilometer@admin.com
- role: admin
- tenant: service
- tenant_description: "Service Tenant"
-
- - user: cinder
- password: "{{ CINDER_PASS }}"
- email: cinder@admin.com
- role: admin
- tenant: service
- tenant_description: "Service Tenant"
-
- - user: heat
- password: "{{ HEAT_PASS }}"
- email: heat@admin.com
- role: admin
- tenant: service
- tenant_description: "Service Tenant"
-
- - user: demo
- password: ""
- email: heat@demo.com
- role: heat_stack_user
- tenant: demo
- tenant_description: "Demo Tenant"
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-- include_vars: "{{ ansible_os_family }}.yml"
-
-- include: rabbitmq_install.yml
-
-- include: rabbitmq_config.yml
- when: inventory_hostname == haproxy_hosts.keys()[0]
-
-- meta: flush_handlers
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-- name: check if i in the node list
- shell: |
- rabbitmqctl -q cluster_status | grep '\[{nodes,' \
- | grep {{ inventory_hostname }}
- changed_when: is_member.rc != 0
- failed_when: false
- register: is_member
- delegate_to: '{{ haproxy_hosts.keys()[0] }}'
-
-- name: stop rabbitmq app
- shell: |
- rabbitmqctl stop_app; sleep 5
- failed_when: false
- when: is_member.rc != 0
-
-- name: join cluster
- shell: rabbitmqctl join_cluster rabbit@{{ haproxy_hosts.keys()[0] }}
- register: join_result
- when: is_member.rc != 0
- until: join_result|success
- failed_when: join_result|failed and not 'already_member' in join_result.stderr
- changed_when: join_result|success
- retries: 20
- delay: 3
-
-- name: start rabbitmq app
- shell: rabbitmqctl start_app
- when: is_member.rc != 0
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-- name: remove default guest user is removed
- rabbitmq_user:
- user: guest
- state: absent
-
-- name: add rabbitmq user
- rabbitmq_user:
- user='{{ RABBIT_USER }}'
- password='{{ RABBIT_PASS }}'
- vhost=/
- configure_priv=.*
- write_priv=.*
- read_priv=.*
- state=present
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-- name: create rabbitmq directory
- file: path=/etc/rabbitmq state=directory mode=0755
-
-- name: disable auto start
- copy:
- content: "#!/bin/sh\nexit 101"
- dest: "/usr/sbin/policy-rc.d"
- mode: 0755
- when: ansible_os_family == "Debian"
-
-- name: install rabbitmq-server
- action: "{{ ansible_pkg_mgr }} name=rabbitmq-server state=present"
- with_items: "{{ packages | union(packages_noarch) }}"
-
-- name: enable auto start
- file:
- path=/usr/sbin/policy-rc.d
- state=absent
- when: ansible_os_family == "Debian"
-
-- name: make sure rabbitmq-server stopped
- service:
- name: rabbitmq-server
- state: stopped
- enabled: "yes"
-
-- name: replace cookie
- copy:
- content: "{{ ERLANG_TOKEN }}"
- dest: /var/lib/rabbitmq/.erlang.cookie
- mode: 0400
- owner: rabbitmq
- group: rabbitmq
-
-- name: replace config
- copy:
- content: "RABBITMQ_NODE_IP_ADDRESS={{ internal_ip }}"
- dest: /etc/rabbitmq/rabbitmq-env.conf
- mode: 0400
- owner: rabbitmq
- group: rabbitmq
-
-- name: set open file limit for rabbitmq
- copy:
- content: "ulimit -n 65536"
- dest: /etc/default/rabbitmq-server
- mode: 0400
- owner: rabbitmq
- group: rabbitmq
-
-- name: restart rabbitmq-server
- service:
- name: rabbitmq-server
- state: restarted
-
-- name: enable queue mirroring
- rabbitmq_policy:
- name: "ha-all"
- pattern: '^(?!amq\.).*'
- tags: "ha-mode=all"
-
-- name: get cluster name
- shell: |
- rabbitmqctl cluster_status | grep -w '<<"compass">>'
- register: cluster_status
- failed_when: false
- changed_when: cluster_status.rc != 0
- when: |
- inventory_hostname == haproxy_hosts.keys()[0]
-
-- name: set cluster name
- shell: rabbitmqctl set_cluster_name compass
- when: |
- inventory_hostname == haproxy_hosts.keys()[0]
- and cluster_status.rc != 0
-
-- include: rabbitmq_cluster.yml
- when: inventory_hostname != haproxy_hosts.keys()[0]
-
-- name: generate mq service list
- shell: echo {{ item }} >> /opt/service
- with_items: "{{ services_noarch }}"
+++ /dev/null
-{{ ERLANG_TOKEN }}
+++ /dev/null
-RABBITMQ_NODE_IP_ADDRESS={{ internal_vip.ip }}
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-services: []
-packages: []
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-services: []
-packages: []
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-packages_noarch:
- - rabbitmq-server
-
-services_noarch:
- - rabbitmq-server
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-- name: restart neutron-plugin-openvswitch-agent
- service: name={{ neutron_plugin_openvswitch_agent_services }}
- state=restarted enabled=yes
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-- name: restart neutron compute service
- service: name={{ item }} state=restarted enabled=yes
- with_items: "{{ services | union(services_noarch) }}"
-
-- name: restart nova-compute services
- service: name={{ nova_compute_service }} state=restarted enabled=yes
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-- include_vars: "{{ ansible_os_family }}.yml"
-
-- name: activate ipv4 forwarding
- sysctl: name=net.ipv4.ip_forward value=1
- state=present reload=yes
-
-- name: deactivate ipv4 rp filter
- sysctl: name=net.ipv4.conf.all.rp_filter value=0
- state=present reload=yes
-
-- name: deactivate ipv4 default rp filter
- sysctl: name=net.ipv4.conf.default.rp_filter
- value=0 state=present reload=yes
-
-- name: disable auto start
- copy:
- content: "#!/bin/sh\nexit 101"
- dest: "/usr/sbin/policy-rc.d"
- mode: 0755
- when: ansible_os_family == "Debian"
-
-- name: install compute-related neutron packages
- action: "{{ ansible_pkg_mgr }} name={{ item }} state=present"
- with_items: "{{ packages | union(packages_noarch) }}"
-
-- name: enable auto start
- file:
- path=/usr/sbin/policy-rc.d
- state=absent
- when: ansible_os_family == "Debian"
-
-- name: fix openstack neutron plugin config file
- shell: |
- sed -i 's,plugins/ml2/openvswitch_agent.ini,plugin.ini,g' \
- /usr/lib/systemd/system/neutron-openvswitch-agent.service
- systemctl daemon-reload
- when: ansible_os_family == 'RedHat'
-
-- name: fix openstack neutron plugin config file ubuntu
- shell: |
- sed -i 's,plugins/ml2/openvswitch_agent.ini,plugin.ini,g' \
- /etc/init/neutron-openvswitch-agent.conf
- sed -i 's,plugins/ml2/openvswitch_agent.ini,plugin.ini,g' \
- /etc/init.d/neutron-openvswitch-agent
- when: ansible_os_family == "Debian"
-
-- name: generate neutron compute service list
- lineinfile: dest=/opt/service create=yes line='{{ item }}'
- with_items: "{{ services | union(services_noarch) }}"
-
-- name: config ml2 plugin
- template: src=templates/ml2_conf.ini
- dest=/etc/neutron/plugins/ml2/ml2_conf.ini
- backup=yes
-
-- name: ln plugin.ini
- file:
- src: /etc/neutron/plugins/ml2/ml2_conf.ini
- dest: /etc/neutron/plugin.ini
- state: link
-
-- name: config neutron
- template:
- src: neutron.conf
- dest: /etc/neutron/neutron.conf
- backup: "yes"
- notify:
- - restart neutron compute service
- - restart nova-compute services
-
-- meta: flush_handlers
-
-- include: ../../neutron-network/tasks/odl.yml
- when: "'opendaylight' in {{ NEUTRON_MECHANISM_DRIVERS | to_json }}"
+++ /dev/null
-[DEFAULT]
-# Show debugging output in log (sets DEBUG log level output)
-# debug = False
-verbose = True
-
-# The DHCP agent will resync its state with Neutron to recover from any
-# transient notification or rpc errors. The interval is number of
-# seconds between attempts.
-resync_interval = 5
-
-# The DHCP agent requires an interface driver be set. Choose the one that best
-# matches your plugin.
-# interface_driver =
-
-# Example of interface_driver option for OVS based plugins(OVS, Ryu, NEC, NVP,
-# BigSwitch/Floodlight)
-interface_driver = neutron.agent.linux.interface.OVSInterfaceDriver
-
-# Name of Open vSwitch bridge to use
-# ovs_integration_bridge = br-int
-
-# Use veth for an OVS interface or not.
-# Support kernels with limited namespace support
-# (e.g. RHEL 6.5) so long as ovs_use_veth is set to True.
-ovs_use_veth = False
-
-# Example of interface_driver option for LinuxBridge
-# interface_driver = neutron.agent.linux.interface.BridgeInterfaceDriver
-
-# The agent can use other DHCP drivers. Dnsmasq is the simplest and requires
-# no additional setup of the DHCP server.
-dhcp_driver = neutron.agent.linux.dhcp.Dnsmasq
-
-# Allow overlapping IP (Must have kernel build with CONFIG_NET_NS=y and
-# iproute2 package that supports namespaces).
-use_namespaces = True
-
-# The DHCP server can assist with providing metadata support on isolated
-# networks. Setting this value to True will cause the DHCP server to append
-# specific host routes to the DHCP request. The metadata service will only
-# be activated when the subnet does not contain any router port. The guest
-# instance must be configured to request host routes via DHCP (Option 121).
-enable_isolated_metadata = True
-
-# Allows for serving metadata requests coming from a dedicated metadata
-# access network whose cidr is 169.254.169.254/16 (or larger prefix), and
-# is connected to a Neutron router from which the VMs send metadata
-# request. In this case DHCP Option 121 will not be injected in VMs, as
-# they will be able to reach 169.254.169.254 through a router.
-# This option requires enable_isolated_metadata = True
-enable_metadata_network = False
-
-# Number of threads to use during sync process. Should not exceed connection
-# pool size configured on server.
-# num_sync_threads = 4
-
-# Location to store DHCP server config files
-# dhcp_confs = $state_path/dhcp
-
-# Domain to use for building the hostnames
-dhcp_domain = openstacklocal
-
-# Override the default dnsmasq settings with this file
-# dnsmasq_config_file =
-dnsmasq_config_file = /etc/neutron/dnsmasq-neutron.conf
-
-# Comma-separated list of DNS servers which will be used by dnsmasq
-# as forwarders.
-# dnsmasq_dns_servers =
-
-# Limit number of leases to prevent a denial-of-service.
-dnsmasq_lease_max = 16777216
-
-# Location to DHCP lease relay UNIX domain socket
-# dhcp_lease_relay_socket = $state_path/dhcp/lease_relay
-
-# Location of Metadata Proxy UNIX domain socket
-# metadata_proxy_socket = $state_path/metadata_proxy
-
-# dhcp_delete_namespaces, which is false by default, can be set to True if
-# namespaces can be deleted cleanly on the host running the dhcp agent.
-# Do not enable this until you understand the problem with the Linux iproute
-# utility mentioned in https://bugs.launchpad.net/neutron/+bug/1052535 and
-# you are sure that your version of iproute does not suffer from the problem.
-# If True, namespaces will be deleted when a dhcp server is disabled.
-# dhcp_delete_namespaces = False
-
-# Timeout for ovs-vsctl commands.
-# If the timeout expires, ovs commands will fail with ALARMCLOCK error.
-# ovs_vsctl_timeout = 10
+++ /dev/null
-interfaces {
- restore-original-config-on-shutdown: false
- interface {{ hostvars[inventory_hostname][neutron_vxlan_interface|default(internal_interface)]['device'] }} {
- description: "Internal pNodes interface"
- disable: false
- default-system-config
- }
-}
-
-protocols {
- igmp {
- disable: false
- interface {{ hostvars[inventory_hostname][neutron_vxlan_interface|default(internal_interface)]['device'] }} {
- vif {{ hostvars[inventory_hostname][neutron_vxlan_interface|default(internal_interface)]['device'] }} {
- disable: false
- version: 3
- }
- }
- traceoptions {
- flag all {
- disable: false
- }
- }
- }
-}
+++ /dev/null
-[DEFAULT]
-# Show debugging output in log (sets DEBUG log level output)
-# debug = False
-verbose = True
-
-# L3 requires that an interface driver be set. Choose the one that best
-# matches your plugin.
-# interface_driver =
-
-# Example of interface_driver option for OVS based plugins (OVS, Ryu, NEC)
-# that supports L3 agent
-# interface_driver = neutron.agent.linux.interface.OVSInterfaceDriver
-interface_driver = neutron.agent.linux.interface.OVSInterfaceDriver
-
-# Use veth for an OVS interface or not.
-# Support kernels with limited namespace support
-# (e.g. RHEL 6.5) so long as ovs_use_veth is set to True.
-# ovs_use_veth = False
-
-# Example of interface_driver option for LinuxBridge
-# interface_driver = neutron.agent.linux.interface.BridgeInterfaceDriver
-
-# Allow overlapping IP (Must have kernel build with CONFIG_NET_NS=y and
-# iproute2 package that supports namespaces).
-use_namespaces = True
-
-# If use_namespaces is set as False then the agent can only configure one router.
-
-# This is done by setting the specific router_id.
-# router_id =
-
-# When external_network_bridge is set, each L3 agent can be associated
-# with no more than one external network. This value should be set to the UUID
-# of that external network. To allow L3 agent support multiple external
-# networks, both the external_network_bridge and gateway_external_network_id
-# must be left empty.
-# gateway_external_network_id =
-
-# Indicates that this L3 agent should also handle routers that do not have
-# an external network gateway configured. This option should be True only
-# for a single agent in a Neutron deployment, and may be False for all agents
-# if all routers must have an external network gateway
-handle_internal_only_routers = True
-
-# Name of bridge used for external network traffic. This should be set to
-# empty value for the linux bridge. when this parameter is set, each L3 agent
-# can be associated with no more than one external network.
-external_network_bridge =
-
-# TCP Port used by Neutron metadata server
-metadata_port = 9697
-
-# Send this many gratuitous ARPs for HA setup. Set it below or equal to 0
-# to disable this feature.
-send_arp_for_ha = 3
-
-# seconds between re-sync routers' data if needed
-periodic_interval = 40
-
-# seconds to start to sync routers' data after
-# starting agent
-periodic_fuzzy_delay = 5
-
-# enable_metadata_proxy, which is true by default, can be set to False
-# if the Nova metadata server is not available
-# enable_metadata_proxy = True
-
-# Location of Metadata Proxy UNIX domain socket
-# metadata_proxy_socket = $state_path/metadata_proxy
-
-# router_delete_namespaces, which is false by default, can be set to True if
-# namespaces can be deleted cleanly on the host running the L3 agent.
-# Do not enable this until you understand the problem with the Linux iproute
-# utility mentioned in https://bugs.launchpad.net/neutron/+bug/1052535 and
-# you are sure that your version of iproute does not suffer from the problem.
-# If True, namespaces will be deleted when a router is destroyed.
-# router_delete_namespaces = False
-
-# Timeout for ovs-vsctl commands.
-# If the timeout expires, ovs commands will fail with ALARMCLOCK error.
-# ovs_vsctl_timeout = 10
+++ /dev/null
-[DEFAULT]
-# Show debugging output in log (sets DEBUG log level output)
-debug = True
-
-# The Neutron user information for accessing the Neutron API.
-auth_url = http://{{ internal_vip.ip }}:5000/v3
-auth_region = RegionOne
-# Turn off verification of the certificate for ssl
-# auth_insecure = False
-# Certificate Authority public key (CA cert) file for ssl
-# auth_ca_cert =
-admin_tenant_name = service
-admin_user = neutron
-admin_password = {{ NEUTRON_PASS }}
-
-# Network service endpoint type to pull from the keystone catalog
-# endpoint_type = adminURL
-
-# IP address used by Nova metadata server
-nova_metadata_ip = {{ internal_vip.ip }}
-
-# TCP Port used by Nova metadata server
-nova_metadata_port = 8775
-
-# When proxying metadata requests, Neutron signs the Instance-ID header with a
-# shared secret to prevent spoofing. You may select any string for a secret,
-# but it must match here and in the configuration used by the Nova Metadata
-# Server. NOTE: Nova uses a different key: neutron_metadata_proxy_shared_secret
-metadata_proxy_shared_secret = {{ METADATA_SECRET }}
-
-# Location of Metadata Proxy UNIX domain socket
-# metadata_proxy_socket = $state_path/metadata_proxy
-
-# Number of separate worker processes for metadata server
-# metadata_workers = 0
-
-# Number of backlog requests to configure the metadata server socket with
-# metadata_backlog = 128
-
-# URL to connect to the cache backend.
-# Example of URL using memory caching backend
-# with ttl set to 5 seconds: cache_url = memory://?default_ttl=5
-# default_ttl=0 parameter will cause cache entries to never expire.
-# Otherwise default_ttl specifies time in seconds a cache entry is valid for.
-# No cache is used in case no value is passed.
-# cache_url =
+++ /dev/null
-[DEFAULT]
-verbose = {{ VERBOSE }}
-debug = {{ VERBOSE }}
-state_path = /var/lib/neutron
-notify_nova_on_port_status_changes = True
-notify_nova_on_port_data_changes = True
-log_dir = /var/log/neutron
-bind_host = {{ network_server_host }}
-bind_port = 9696
-core_plugin = ml2
-service_plugins = router
-api_paste_config = api-paste.ini
-auth_strategy = keystone
-dhcp_lease_duration = 86400
-allow_overlapping_ips = True
-rpc_backend = rabbit
-rpc_thread_pool_size = 240
-rpc_conn_pool_size = 100
-rpc_response_timeout = 300
-rpc_cast_timeout = 300
-notification_driver = neutron.openstack.common.notifier.rpc_notifier
-default_notification_level = INFO
-notification_topics = notifications
-agent_down_time = 75
-network_scheduler_driver = neutron.scheduler.dhcp_agent_scheduler.ChanceScheduler
-router_scheduler_driver = neutron.scheduler.l3_agent_scheduler.ChanceScheduler
-api_workers = 8
-rpc_workers = 8
-notify_nova_on_port_status_changes = True
-notify_nova_on_port_data_changes = True
-nova_url = http://{{ internal_vip.ip }}:8774/v3
-nova_region_name = RegionOne
-nova_admin_username = nova
-nova_admin_password = {{ NOVA_PASS }}
-nova_admin_auth_url = http://{{ internal_vip.ip }}:35357/v3
-send_events_interval = 2
-
-[quotas]
-quota_driver = neutron.db.quota_db.DbQuotaDriver
-quota_items = network,subnet,port
-default_quota = -1
-quota_network = 100
-quota_subnet = 100
-quota_port = 8000
-quota_security_group = 1000
-quota_security_group_rule = 1000
-
-[agent]
-root_helper = "sudo /usr/bin/neutron-rootwrap /etc/neutron/rootwrap.conf"
-report_interval = 30
-
-[keystone_authtoken]
-auth_uri = http://{{ internal_vip.ip }}:5000
-auth_url = http://{{ internal_vip.ip }}:35357
-auth_type = password
-project_domain_name = default
-user_domain_name = default
-project_name = service
-username = neutron
-password = {{ NEUTRON_PASS }}
-
-identity_uri = http://{{ internal_vip.ip }}:35357
-admin_tenant_name = service
-admin_user = neutron
-admin_password = {{ NEUTRON_PASS }}
-signing_dir = $state_path/keystone-signing
-
-[database]
-connection = mysql://neutron:{{ NEUTRON_DBPASS }}@{{ db_host }}/neutron
-slave_connection =
-max_retries = 10
-retry_interval = 10
-min_pool_size = 1
-max_pool_size = 100
-idle_timeout = 30
-use_db_reconnect = True
-max_overflow = 100
-connection_debug = 0
-connection_trace = False
-pool_timeout = 10
-
-[service_providers]
-service_provider=FIREWALL:Iptables:neutron.agent.linux.iptables_firewall.OVSHybridIptablesFirewllDriver:default
-
-{% if enable_fwaas %}
-[fwaas]
-driver = neutron_fwaas.services.firewall.drivers.linux.iptables_fwaas.IptablesFwaasDriver
-enabled = True
-{% endif %}
-
-[nova]
-auth_url = http://{{ internal_vip.ip }}:35357
-auth_type = password
-project_domain_name = default
-user_domain_name = default
-project_name = service
-username = nova
-password = {{ NOVA_PASS }}
-
-[oslo_messaging_rabbit]
-rabbit_host = {{ rabbit_host }}
-rabbit_password = {{ RABBIT_PASS }}
-rabbit_port = 5672
-rabbit_userid = {{ RABBIT_USER }}
-
-[oslo_concurrency]
-lock_path = $state_path/lock
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-
-packages:
- - neutron-common
- - neutron-plugin-ml2
- - openvswitch-switch-dpdk
- - openvswitch-switch
- - neutron-plugin-openvswitch-agent
-
-services:
- - neutron-openvswitch-agent
-
-nova_compute_service:
- - nova-compute
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-packages:
- - openstack-neutron
- - openstack-neutron-ml2
- - openstack-neutron-openvswitch
-
-services:
- - openvswitch
- - neutron-openvswitch-agent
- - libvirtd
-
-nova_compute_service:
- - openstack-nova-compute
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-packages_noarch: []
-
-services_noarch: []
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-- name: restart neutron control services
- service: name={{ item }} state=restarted enabled=yes
- with_items: "{{ services | union(services_noarch) }}"
- when: item != "neutron-server"
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-- include: neutron_install.yml
- tags:
- - install
- - neutron_install
- - neutron
-
-- include: neutron_config.yml
- when: inventory_hostname == groups['controller'][0]
- tags:
- - config
- - neutron_config
- - neutron
-
-- name: restart first neutron-server
- service: name=neutron-server state=restarted enabled=yes
- when: inventory_hostname == groups['controller'][0]
-
-- name: restart other neutron-server
- service: name=neutron-server state=restarted enabled=yes
- when: inventory_hostname != groups['controller'][0]
-
-- meta: flush_handlers
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-
-- name: neutron-db-manage upgrade
- shell: |
- neutron-db-manage --config-file=/etc/neutron/neutron.conf \
- --config-file=/etc/neutron/plugins/ml2/ml2_conf.ini upgrade head
- register: result
- run_once: "True"
- until: result.rc == 0
- retries: 10
- delay: 5
- notify:
- - restart neutron control services
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-- include_vars: "{{ ansible_os_family }}.yml"
-
-- name: disable auto start
- copy:
- content: "#!/bin/sh\nexit 101"
- dest: "/usr/sbin/policy-rc.d"
- mode: 0755
- when: ansible_os_family == "Debian"
-
-- name: install controller-related neutron packages
- action: "{{ ansible_pkg_mgr }} name={{ item }} state=present"
- with_items: "{{ packages | union(packages_noarch) }}"
-
-- name: enable auto start
- file:
- path=/usr/sbin/policy-rc.d
- state=absent
- when: ansible_os_family == "Debian"
-
-- name: generate neutron control service list
- lineinfile: dest=/opt/service create=yes line='{{ item }}'
- with_items: "{{ services | union(services_noarch) }}"
-
-- name: get tenant id to fill neutron.conf
- shell:
- . /opt/admin-openrc.sh;
- openstack project show service | grep id | sed -n "2,1p" | awk '{print $4}'
- register: NOVA_ADMIN_TENANT_ID
-
-- name: update neutron conf
- template: src=templates/neutron.conf dest=/etc/neutron/neutron.conf backup=yes
-
-- name: update ml2 plugin conf
- template:
- src: templates/ml2_conf.ini
- dest: /etc/neutron/plugins/ml2/ml2_conf.ini
- backup: "yes"
-
-- name: ln plugin.ini
- file:
- src: /etc/neutron/plugins/ml2/ml2_conf.ini
- dest: /etc/neutron/plugin.ini
- state: link
+++ /dev/null
-[DEFAULT]
-# Show debugging output in log (sets DEBUG log level output)
-# debug = False
-verbose = True
-
-# The DHCP agent will resync its state with Neutron to recover from any
-# transient notification or rpc errors. The interval is number of
-# seconds between attempts.
-resync_interval = 5
-
-# The DHCP agent requires an interface driver be set. Choose the one that best
-# matches your plugin.
-# interface_driver =
-
-# Example of interface_driver option for OVS based plugins(OVS, Ryu, NEC, NVP,
-# BigSwitch/Floodlight)
-interface_driver = neutron.agent.linux.interface.OVSInterfaceDriver
-
-# Name of Open vSwitch bridge to use
-# ovs_integration_bridge = br-int
-
-# Use veth for an OVS interface or not.
-# Support kernels with limited namespace support
-# (e.g. RHEL 6.5) so long as ovs_use_veth is set to True.
-ovs_use_veth = False
-
-# Example of interface_driver option for LinuxBridge
-# interface_driver = neutron.agent.linux.interface.BridgeInterfaceDriver
-
-# The agent can use other DHCP drivers. Dnsmasq is the simplest and requires
-# no additional setup of the DHCP server.
-dhcp_driver = neutron.agent.linux.dhcp.Dnsmasq
-
-# Allow overlapping IP (Must have kernel build with CONFIG_NET_NS=y and
-# iproute2 package that supports namespaces).
-use_namespaces = True
-
-# The DHCP server can assist with providing metadata support on isolated
-# networks. Setting this value to True will cause the DHCP server to append
-# specific host routes to the DHCP request. The metadata service will only
-# be activated when the subnet does not contain any router port. The guest
-# instance must be configured to request host routes via DHCP (Option 121).
-enable_isolated_metadata = True
-
-# Allows for serving metadata requests coming from a dedicated metadata
-# access network whose cidr is 169.254.169.254/16 (or larger prefix), and
-# is connected to a Neutron router from which the VMs send metadata
-# request. In this case DHCP Option 121 will not be injected in VMs, as
-# they will be able to reach 169.254.169.254 through a router.
-# This option requires enable_isolated_metadata = True
-enable_metadata_network = False
-
-# Number of threads to use during sync process. Should not exceed connection
-# pool size configured on server.
-# num_sync_threads = 4
-
-# Location to store DHCP server config files
-# dhcp_confs = $state_path/dhcp
-
-# Domain to use for building the hostnames
-dhcp_domain = openstacklocal
-
-# Override the default dnsmasq settings with this file
-# dnsmasq_config_file =
-dnsmasq_config_file = /etc/neutron/dnsmasq-neutron.conf
-
-# Comma-separated list of DNS servers which will be used by dnsmasq
-# as forwarders.
-# dnsmasq_dns_servers =
-
-# Limit number of leases to prevent a denial-of-service.
-dnsmasq_lease_max = 16777216
-
-# Location to DHCP lease relay UNIX domain socket
-# dhcp_lease_relay_socket = $state_path/dhcp/lease_relay
-
-# Location of Metadata Proxy UNIX domain socket
-# metadata_proxy_socket = $state_path/metadata_proxy
-
-# dhcp_delete_namespaces, which is false by default, can be set to True if
-# namespaces can be deleted cleanly on the host running the dhcp agent.
-# Do not enable this until you understand the problem with the Linux iproute
-# utility mentioned in https://bugs.launchpad.net/neutron/+bug/1052535 and
-# you are sure that your version of iproute does not suffer from the problem.
-# If True, namespaces will be deleted when a dhcp server is disabled.
-# dhcp_delete_namespaces = False
-
-# Timeout for ovs-vsctl commands.
-# If the timeout expires, ovs commands will fail with ALARMCLOCK error.
-# ovs_vsctl_timeout = 10
+++ /dev/null
-interfaces {
- restore-original-config-on-shutdown: false
- interface {{ hostvars[inventory_hostname][neutron_vxlan_interface|default(internal_interface)]['device'] }} {
- description: "Internal pNodes interface"
- disable: false
- default-system-config
- }
-}
-
-protocols {
- igmp {
- disable: false
- interface {{ hostvars[inventory_hostname][neutron_vxlan_interface|default(internal_interface)]['device'] }} {
- vif {{ hostvars[inventory_hostname][neutron_vxlan_interface|default(internal_interface)]['device'] }} {
- disable: false
- version: 3
- }
- }
- traceoptions {
- flag all {
- disable: false
- }
- }
- }
-}
+++ /dev/null
-[DEFAULT]
-# Show debugging output in log (sets DEBUG log level output)
-# debug = False
-verbose = True
-
-# L3 requires that an interface driver be set. Choose the one that best
-# matches your plugin.
-# interface_driver =
-
-# Example of interface_driver option for OVS based plugins (OVS, Ryu, NEC)
-# that supports L3 agent
-# interface_driver = neutron.agent.linux.interface.OVSInterfaceDriver
-interface_driver = neutron.agent.linux.interface.OVSInterfaceDriver
-
-# Use veth for an OVS interface or not.
-# Support kernels with limited namespace support
-# (e.g. RHEL 6.5) so long as ovs_use_veth is set to True.
-# ovs_use_veth = False
-
-# Example of interface_driver option for LinuxBridge
-# interface_driver = neutron.agent.linux.interface.BridgeInterfaceDriver
-
-# Allow overlapping IP (Must have kernel build with CONFIG_NET_NS=y and
-# iproute2 package that supports namespaces).
-use_namespaces = True
-
-# If use_namespaces is set as False then the agent can only configure one router.
-
-# This is done by setting the specific router_id.
-# router_id =
-
-# When external_network_bridge is set, each L3 agent can be associated
-# with no more than one external network. This value should be set to the UUID
-# of that external network. To allow L3 agent support multiple external
-# networks, both the external_network_bridge and gateway_external_network_id
-# must be left empty.
-# gateway_external_network_id =
-
-# Indicates that this L3 agent should also handle routers that do not have
-# an external network gateway configured. This option should be True only
-# for a single agent in a Neutron deployment, and may be False for all agents
-# if all routers must have an external network gateway
-handle_internal_only_routers = True
-
-# Name of bridge used for external network traffic. This should be set to
-# empty value for the linux bridge. when this parameter is set, each L3 agent
-# can be associated with no more than one external network.
-external_network_bridge =
-
-# TCP Port used by Neutron metadata server
-metadata_port = 9697
-
-# Send this many gratuitous ARPs for HA setup. Set it below or equal to 0
-# to disable this feature.
-send_arp_for_ha = 3
-
-# seconds between re-sync routers' data if needed
-periodic_interval = 40
-
-# seconds to start to sync routers' data after
-# starting agent
-periodic_fuzzy_delay = 5
-
-# enable_metadata_proxy, which is true by default, can be set to False
-# if the Nova metadata server is not available
-# enable_metadata_proxy = True
-
-# Location of Metadata Proxy UNIX domain socket
-# metadata_proxy_socket = $state_path/metadata_proxy
-
-# router_delete_namespaces, which is false by default, can be set to True if
-# namespaces can be deleted cleanly on the host running the L3 agent.
-# Do not enable this until you understand the problem with the Linux iproute
-# utility mentioned in https://bugs.launchpad.net/neutron/+bug/1052535 and
-# you are sure that your version of iproute does not suffer from the problem.
-# If True, namespaces will be deleted when a router is destroyed.
-# router_delete_namespaces = False
-
-# Timeout for ovs-vsctl commands.
-# If the timeout expires, ovs commands will fail with ALARMCLOCK error.
-# ovs_vsctl_timeout = 10
+++ /dev/null
-[DEFAULT]
-# Show debugging output in log (sets DEBUG log level output)
-debug = True
-
-# The Neutron user information for accessing the Neutron API.
-auth_url = http://{{ internal_vip.ip }}:5000/v3
-auth_region = RegionOne
-# Turn off verification of the certificate for ssl
-# auth_insecure = False
-# Certificate Authority public key (CA cert) file for ssl
-# auth_ca_cert =
-admin_tenant_name = service
-admin_user = neutron
-admin_password = {{ NEUTRON_PASS }}
-
-# Network service endpoint type to pull from the keystone catalog
-# endpoint_type = adminURL
-
-# IP address used by Nova metadata server
-nova_metadata_ip = {{ internal_vip.ip }}
-
-# TCP Port used by Nova metadata server
-nova_metadata_port = 8775
-
-# When proxying metadata requests, Neutron signs the Instance-ID header with a
-# shared secret to prevent spoofing. You may select any string for a secret,
-# but it must match here and in the configuration used by the Nova Metadata
-# Server. NOTE: Nova uses a different key: neutron_metadata_proxy_shared_secret
-metadata_proxy_shared_secret = {{ METADATA_SECRET }}
-
-# Location of Metadata Proxy UNIX domain socket
-# metadata_proxy_socket = $state_path/metadata_proxy
-
-# Number of separate worker processes for metadata server
-# metadata_workers = 0
-
-# Number of backlog requests to configure the metadata server socket with
-# metadata_backlog = 128
-
-# URL to connect to the cache backend.
-# Example of URL using memory caching backend
-# with ttl set to 5 seconds: cache_url = memory://?default_ttl=5
-# default_ttl=0 parameter will cause cache entries to never expire.
-# Otherwise default_ttl specifies time in seconds a cache entry is valid for.
-# No cache is used in case no value is passed.
-# cache_url =
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-packages:
- - neutron-server
- - neutron-plugin-ml2
-
-services: []
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-packages:
- - openstack-neutron
- - openstack-neutron-ml2
-
-services: []
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-packages_noarch: []
-
-services_noarch:
- - neutron-server
+++ /dev/null
-[Filters]
-ip: IpFilter, ip, root
-ip_exec: IpNetnsExecFilter, ip, root
-ipsec: CommandFilter, ipsec, root
-strongswan: CommandFilter, strongswan, root
-neutron_netns_wrapper: CommandFilter, neutron-vpn-netns-wrapper, root
-neutron_netns_wrapper_local: CommandFilter, /usr/local/bin/neutron-vpn-netns-wrapper, root
+++ /dev/null
-# Defaults for xorp initscript
-# sourced by /etc/init.d/xorp
-# installed at /etc/default/xorp by the maintainer scripts
-
-#
-# This is a POSIX shell fragment
-#
-
-# Master system-wide xorp switch. The initscript
-# will not run if it is not set to yes.
-
-RUN="yes"
-
-
-# Additional options that are passed to the rtrmgr Daemon.
-# e.g. :
-# -a <allowed host> Host allowed by the finder
-# -n <allowed net> Subnet allowed by the finder
-# -v Print verbose information
-# -b <file> Specify boot file
-# -d Run as a daemon, detach from tty
-
-DAEMON_OPTS="-b /etc/xorp/config.boot "
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-- name: restart neutron network relation service
- service: name={{ item }} state=restarted enabled=yes
- with_flattened:
- - "{{ services_noarch }}"
- - "{{ services }}"
-
-- name: restart openvswitch agent service
- service: name=neutron-openvswitch-agent state=restarted enabled=yes
-
-- name: restart vpn agent service
- service: name={{ item }} state=restarted enabled=yes
- with_items:
- - neutron-vpn-agent
- - strongswan
-
-- name: kill dnsmasq
- command: killall dnsmasq
- ignore_errors: "True"
-
-- name: restart xorp
- service: name=xorp state=restarted enabled=yes sleep=10
- ignore_errors: "True"
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-- include_vars: "{{ ansible_os_family }}.yml"
-
-- name: disable auto start
- copy:
- content: "#!/bin/sh\nexit 101"
- dest: "/usr/sbin/policy-rc.d"
- mode: 0755
- when: ansible_os_family == "Debian"
-
-- name: install firewall packages
- action: "{{ ansible_pkg_mgr }} name={{ item }} state=present"
- with_items: "{{ firewall_packages }}"
-
-- name: enable auto start
- file:
- path=/usr/sbin/policy-rc.d
- state=absent
- when: ansible_os_family == "Debian"
-
-- name: update firewall related conf
- shell: |
- crudini --set --list /etc/neutron/neutron.conf DEFAULT service_plugins firewall
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-- name: Install XORP to provide IGMP router functionality
- action: "{{ ansible_pkg_mgr }} name={{ item }} state=present"
- with_items: "{{ xorp_packages }}"
-
-- name: create xorp directory
- file: path=/etc/xorp state=directory
-
-- name: configure xorp
- template: src=etc/xorp/config.boot dest=/etc/xorp/config.boot
- notify:
- - restart xorp
-
-- name: set xorp defaults
- copy: src=xorp dest=/etc/default/xorp
- notify:
- - restart xorp
-
-- meta: flush_handlers
-
-- name: start and enable xorp service
- service: name=xorp state=started enabled=yes
- retries: 2
- delay: 10
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-- include_vars: "{{ ansible_os_family }}.yml"
-
-- name: activate ipv4 forwarding
- sysctl: name=net.ipv4.ip_forward value=1
- state=present reload=yes
-
-- name: deactivate ipv4 rp filter
- sysctl: name=net.ipv4.conf.all.rp_filter value=0
- state=present reload=yes
-
-- name: deactivate ipv4 default rp filter
- sysctl: name=net.ipv4.conf.default.rp_filter
- value=0 state=present reload=yes
-
-- name: assert kernel support for vxlan
- command: modinfo -F version vxlan
- when: "'vxlan' in {{ NEUTRON_TUNNEL_TYPES | to_json }}"
-
-- name: assert iproute2 suppport for vxlan
- command: ip link add type vxlan help
- register: iproute_out
- failed_when: iproute_out.rc == 255
- when: "'vxlan' in {{ NEUTRON_TUNNEL_TYPES | to_json }}"
-
-- name: disable auto start
- copy:
- content: "#!/bin/sh\nexit 101"
- dest: "/usr/sbin/policy-rc.d"
- mode: 0755
- when: ansible_os_family == "Debian"
-
-- name: install neutron network related packages
- action: "{{ ansible_pkg_mgr }} name={{ item }} state=present"
- with_items: "{{ packages | union(packages_noarch) }}"
-
-- name: enable auto start
- file:
- path=/usr/sbin/policy-rc.d
- state=absent
- when: ansible_os_family == "Debian"
-
-- name: generate neutron network service list
- lineinfile: dest=/opt/service create=yes line='{{ item }}'
- with_items: "{{ services | union(services_noarch) }}"
-
-- name: fix openstack neutron plugin config file
- shell: |
- sed -i 's,plugins/ml2/openvswitch_agent.ini,plugin.ini,g' \
- /usr/lib/systemd/system/neutron-openvswitch-agent.service;
- systemctl daemon-reload
- when: ansible_os_family == 'RedHat'
-
-- name: fix openstack neutron plugin config file ubuntu
- shell: |
- sed -i 's,plugins/ml2/openvswitch_agent.ini,plugin.ini,g' \
- /etc/init/neutron-openvswitch-agent.con;
- sed -i 's,plugins/ml2/openvswitch_agent.ini,plugin.ini,g' \
- /etc/init.d/neutron-openvswitch-agent;
- when: ansible_os_family == "Debian"
-
-- name: config l3 agent
- template: src=l3_agent.ini dest=/etc/neutron/l3_agent.ini
- backup=yes
-
-- name: config dhcp agent
- template: src=dhcp_agent.ini dest=/etc/neutron/dhcp_agent.ini
- backup=yes
-
-- name: update dnsmasq-neutron.conf
- template: src=templates/dnsmasq-neutron.conf
- dest=/etc/neutron/dnsmasq-neutron.conf
-
-- name: config metadata agent
- template: src=metadata_agent.ini
- dest=/etc/neutron/metadata_agent.ini backup=yes
-
-- name: config ml2 plugin
- template: src=templates/ml2_conf.ini
- dest=/etc/neutron/plugins/ml2/ml2_conf.ini
- backup=yes
-
-- name: ln plugin.ini
- file:
- src: /etc/neutron/plugins/ml2/ml2_conf.ini
- dest: /etc/neutron/plugin.ini
- state: link
-
-- name: config neutron
- template: src=templates/neutron.conf
- dest=/etc/neutron/neutron.conf backup=yes
-
-- name: force mtu to 1450 for vxlan
- lineinfile:
- dest: /etc/neutron/dnsmasq-neutron.conf
- regexp: '^dhcp-option-force'
- line: 'dhcp-option-force=26,1450'
- when: "'vxlan' in {{ NEUTRON_TUNNEL_TYPES | to_json }}"
-
-- include: firewall.yml
- when: enable_fwaas == True
-
-- include: vpn.yml
- when: enable_vpnaas == True
-
-- include: odl.yml
- when: "'opendaylight' in {{ NEUTRON_MECHANISM_DRIVERS | to_json }}"
-
-- name: restart neutron network relation service
- service: name={{ item }} state=restarted enabled=yes
- with_flattened:
- - "{{ services_noarch }}"
- - "{{ services }}"
-
-- meta: flush_handlers
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-- name: ovs set manager
- command: ovs-vsctl set-manager tcp:{{ controller }}:6640
-
-- name: get ovs uuid
- shell: ovs-vsctl get Open_vSwitch . _uuid
- register: ovs_uuid
-
-- name: set bridge_mappings
- command: |
- ovs-vsctl set Open_vSwitch {{ ovs_uuid.stdout }} \
- other_config:bridge_mappings=physnet1:{{ INTERFACE_NAME }}
-
-- name: set local ip
- command: |
- ovs-vsctl set Open_vSwitch {{ ovs_uuid.stdout }} \
- other_config:local_ip={{ internal_ip }}
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-- include_vars: "{{ ansible_os_family }}.yml"
-
-- name: disable auto start
- copy:
- content: "#!/bin/sh\nexit 101"
- dest: "/usr/sbin/policy-rc.d"
- mode: 0755
- when: ansible_os_family == "Debian"
-
-- name: install vpn packages
- action: "{{ ansible_pkg_mgr }} name={{ item }} state=present"
- with_items: "{{ vpn_packages }}"
-
-- name: enable auto start
- file:
- path=/usr/sbin/policy-rc.d
- state=absent
- when: ansible_os_family == "Debian"
-
-- name: update vpn related conf
- shell: |
- crudini --set /etc/neutron/l3_agent.ini vpnagent vpn_device_driver \
- neutron_vpnaas.services.vpn.device_drivers.strongswan_ipsec.StrongSwanDriver;
- crudini --set --list /etc/neutron/neutron.conf DEFAULT service_plugins vpnaas;
- crudini --set /etc/neutron/neutron_vpnaas.conf service_providers service_provider \
- 'VPN:strongswan:neutron_vpnaas.services.vpn.service_drivers.ipsec.IPsecVPNDriver:default'
-
-- name: make sure rootwrap.d dir exist
- file: path=/etc/neutron/rootwrap.d state=directory mode=0755
-
-- name: update rootwrap
- copy: src=vpnaas.filters dest=/etc/neutron/rootwrap.d/vpnaas.filters
-
-- name: enable vpn service
- service: name={{ item }} state=started enabled=yes
- with_items:
- - neutron-vpn-agent
- - strongswan
- notify:
- - restart vpn agent service
+++ /dev/null
-[DEFAULT]
-# Show debugging output in log (sets DEBUG log level output)
-# debug = False
-verbose = True
-
-# The DHCP agent will resync its state with Neutron to recover from any
-# transient notification or rpc errors. The interval is number of
-# seconds between attempts.
-resync_interval = 5
-
-# The DHCP agent requires an interface driver be set. Choose the one that best
-# matches your plugin.
-# interface_driver =
-
-# Example of interface_driver option for OVS based plugins(OVS, Ryu, NEC, NVP,
-# BigSwitch/Floodlight)
-interface_driver = neutron.agent.linux.interface.OVSInterfaceDriver
-
-# Name of Open vSwitch bridge to use
-# ovs_integration_bridge = br-int
-
-# Use veth for an OVS interface or not.
-# Support kernels with limited namespace support
-# (e.g. RHEL 6.5) so long as ovs_use_veth is set to True.
-ovs_use_veth = False
-
-# Example of interface_driver option for LinuxBridge
-# interface_driver = neutron.agent.linux.interface.BridgeInterfaceDriver
-
-# The agent can use other DHCP drivers. Dnsmasq is the simplest and requires
-# no additional setup of the DHCP server.
-dhcp_driver = neutron.agent.linux.dhcp.Dnsmasq
-
-# Allow overlapping IP (Must have kernel build with CONFIG_NET_NS=y and
-# iproute2 package that supports namespaces).
-use_namespaces = True
-
-# The DHCP server can assist with providing metadata support on isolated
-# networks. Setting this value to True will cause the DHCP server to append
-# specific host routes to the DHCP request. The metadata service will only
-# be activated when the subnet does not contain any router port. The guest
-# instance must be configured to request host routes via DHCP (Option 121).
-enable_isolated_metadata = True
-
-# Allows for serving metadata requests coming from a dedicated metadata
-# access network whose cidr is 169.254.169.254/16 (or larger prefix), and
-# is connected to a Neutron router from which the VMs send metadata
-# request. In this case DHCP Option 121 will not be injected in VMs, as
-# they will be able to reach 169.254.169.254 through a router.
-# This option requires enable_isolated_metadata = True
-enable_metadata_network = False
-
-# Number of threads to use during sync process. Should not exceed connection
-# pool size configured on server.
-# num_sync_threads = 4
-
-# Location to store DHCP server config files
-# dhcp_confs = $state_path/dhcp
-
-# Domain to use for building the hostnames
-dhcp_domain = openstacklocal
-
-# Override the default dnsmasq settings with this file
-# dnsmasq_config_file =
-dnsmasq_config_file = /etc/neutron/dnsmasq-neutron.conf
-
-# Comma-separated list of DNS servers which will be used by dnsmasq
-# as forwarders.
-# dnsmasq_dns_servers =
-
-# Limit number of leases to prevent a denial-of-service.
-dnsmasq_lease_max = 16777216
-
-# Location to DHCP lease relay UNIX domain socket
-# dhcp_lease_relay_socket = $state_path/dhcp/lease_relay
-
-# Location of Metadata Proxy UNIX domain socket
-# metadata_proxy_socket = $state_path/metadata_proxy
-
-# dhcp_delete_namespaces, which is false by default, can be set to True if
-# namespaces can be deleted cleanly on the host running the dhcp agent.
-# Do not enable this until you understand the problem with the Linux iproute
-# utility mentioned in https://bugs.launchpad.net/neutron/+bug/1052535 and
-# you are sure that your version of iproute does not suffer from the problem.
-# If True, namespaces will be deleted when a dhcp server is disabled.
-# dhcp_delete_namespaces = False
-
-# Timeout for ovs-vsctl commands.
-# If the timeout expires, ovs commands will fail with ALARMCLOCK error.
-# ovs_vsctl_timeout = 10
+++ /dev/null
-interfaces {
- restore-original-config-on-shutdown: false
- interface {{ internal_nic }} {
- description: "Internal pNodes interface"
- disable: false
- default-system-config
- }
-}
-
-protocols {
- igmp {
- disable: false
- interface {{ internal_nic }} {
- vif {{ internal_nic }} {
- disable: false
- version: 3
- }
- }
- traceoptions {
- flag all {
- disable: false
- }
- }
- }
-}
+++ /dev/null
-[DEFAULT]
-# Show debugging output in log (sets DEBUG log level output)
-# debug = False
-verbose = True
-
-# L3 requires that an interface driver be set. Choose the one that best
-# matches your plugin.
-# interface_driver =
-
-# Example of interface_driver option for OVS based plugins (OVS, Ryu, NEC)
-# that supports L3 agent
-# interface_driver = neutron.agent.linux.interface.OVSInterfaceDriver
-interface_driver = neutron.agent.linux.interface.OVSInterfaceDriver
-
-# Use veth for an OVS interface or not.
-# Support kernels with limited namespace support
-# (e.g. RHEL 6.5) so long as ovs_use_veth is set to True.
-# ovs_use_veth = False
-
-# Example of interface_driver option for LinuxBridge
-# interface_driver = neutron.agent.linux.interface.BridgeInterfaceDriver
-
-# Allow overlapping IP (Must have kernel build with CONFIG_NET_NS=y and
-# iproute2 package that supports namespaces).
-use_namespaces = True
-
-# If use_namespaces is set as False then the agent can only configure one router.
-
-# This is done by setting the specific router_id.
-# router_id =
-
-# When external_network_bridge is set, each L3 agent can be associated
-# with no more than one external network. This value should be set to the UUID
-# of that external network. To allow L3 agent support multiple external
-# networks, both the external_network_bridge and gateway_external_network_id
-# must be left empty.
-# gateway_external_network_id =
-
-# Indicates that this L3 agent should also handle routers that do not have
-# an external network gateway configured. This option should be True only
-# for a single agent in a Neutron deployment, and may be False for all agents
-# if all routers must have an external network gateway
-handle_internal_only_routers = True
-
-# Name of bridge used for external network traffic. This should be set to
-# empty value for the linux bridge. when this parameter is set, each L3 agent
-# can be associated with no more than one external network.
-external_network_bridge =
-
-# TCP Port used by Neutron metadata server
-metadata_port = 9697
-
-# Send this many gratuitous ARPs for HA setup. Set it below or equal to 0
-# to disable this feature.
-send_arp_for_ha = 3
-
-# seconds between re-sync routers' data if needed
-periodic_interval = 40
-
-# seconds to start to sync routers' data after
-# starting agent
-periodic_fuzzy_delay = 5
-
-# enable_metadata_proxy, which is true by default, can be set to False
-# if the Nova metadata server is not available
-# enable_metadata_proxy = True
-
-# Location of Metadata Proxy UNIX domain socket
-# metadata_proxy_socket = $state_path/metadata_proxy
-
-# router_delete_namespaces, which is false by default, can be set to True if
-# namespaces can be deleted cleanly on the host running the L3 agent.
-# Do not enable this until you understand the problem with the Linux iproute
-# utility mentioned in https://bugs.launchpad.net/neutron/+bug/1052535 and
-# you are sure that your version of iproute does not suffer from the problem.
-# If True, namespaces will be deleted when a router is destroyed.
-# router_delete_namespaces = False
-
-# Timeout for ovs-vsctl commands.
-# If the timeout expires, ovs commands will fail with ALARMCLOCK error.
-# ovs_vsctl_timeout = 10
+++ /dev/null
-[DEFAULT]
-# Show debugging output in log (sets DEBUG log level output)
-debug = True
-
-# The Neutron user information for accessing the Neutron API.
-auth_url = http://{{ internal_vip.ip }}:5000/v3
-auth_region = RegionOne
-# Turn off verification of the certificate for ssl
-# auth_insecure = False
-# Certificate Authority public key (CA cert) file for ssl
-# auth_ca_cert =
-admin_tenant_name = service
-admin_user = neutron
-admin_password = {{ NEUTRON_PASS }}
-
-# Network service endpoint type to pull from the keystone catalog
-# endpoint_type = adminURL
-
-# IP address used by Nova metadata server
-nova_metadata_ip = {{ internal_vip.ip }}
-
-# TCP Port used by Nova metadata server
-nova_metadata_port = 8775
-
-# When proxying metadata requests, Neutron signs the Instance-ID header with a
-# shared secret to prevent spoofing. You may select any string for a secret,
-# but it must match here and in the configuration used by the Nova Metadata
-# Server. NOTE: Nova uses a different key: neutron_metadata_proxy_shared_secret
-metadata_proxy_shared_secret = {{ METADATA_SECRET }}
-
-# Location of Metadata Proxy UNIX domain socket
-# metadata_proxy_socket = $state_path/metadata_proxy
-
-# Number of separate worker processes for metadata server
-# metadata_workers = 0
-
-# Number of backlog requests to configure the metadata server socket with
-# metadata_backlog = 128
-
-# URL to connect to the cache backend.
-# Example of URL using memory caching backend
-# with ttl set to 5 seconds: cache_url = memory://?default_ttl=5
-# default_ttl=0 parameter will cause cache entries to never expire.
-# Otherwise default_ttl specifies time in seconds a cache entry is valid for.
-# No cache is used in case no value is passed.
-# cache_url =
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-packages:
- - neutron-plugin-ml2
- - openvswitch-switch-dpdk
- - openvswitch-switch
- - neutron-l3-agent
- - neutron-dhcp-agent
- - neutron-plugin-openvswitch-agent
-
-services:
- - openvswitch-switch
- - neutron-openvswitch-agent
-
-openvswitch_agent: neutron-plugin-openvswitch-agent
-
-firewall_packages:
-
-vpn_packages:
-
-xorp_packages:
- - xorp
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-packages:
- - openstack-neutron-ml2
- - openstack-neutron-openvswitch
-
-vpn_packages:
- - openstack-neutron-vpn-agent
- - strongswan
-
-firewall_packages:
- - openstack-neutron-fwaas
-
-services:
- - openvswitch
- - neutron-openvswitch-agent
-
-openvswitch_agent: neutron-openvswitch-agent
-
-xorp_packages:
- - openssl098e
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-packages_noarch: []
-
-services_noarch:
- - neutron-l3-agent
- - neutron-dhcp-agent
- - neutron-metadata-agent
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-- name: restart nova-compute services
- service: name={{ item }} state=restarted enabled=yes
- with_items: "{{ services | union(services_noarch) }}"
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-- include_vars: "{{ ansible_os_family }}.yml"
-
-- name: disable auto start
- copy:
- content: "#!/bin/sh\nexit 101"
- dest: "/usr/sbin/policy-rc.d"
- mode: 0755
- when: ansible_os_family == "Debian"
-
-- name: install nova-compute related packages
- action: "{{ ansible_pkg_mgr }} name={{ item }} state=present"
- with_items: "{{ packages | union(packages_noarch) }}"
-
-- name: restart virtlogd
- service: name=virtlogd state=started enabled=yes
- when: ansible_os_family == "Debian"
-
-- name: enable auto start
- file:
- path=/usr/sbin/policy-rc.d
- state=absent
- when: ansible_os_family == "Debian"
-
-- name: get number of cpu support virtualization
- shell: egrep -c '(vmx|svm)' /proc/cpuinfo || echo 0
- register: kvm_cpu_num
-
-- name: update libvirt-bin conf
- lineinfile:
- dest: /etc/default/libvirt-bin
- regexp: '^libvirtd_opts=.*'
- insertafter: '^#libvirtd_opts=.*'
- line: 'libvirtd_opts="-d -l"'
- when: ansible_os_family == "Debian"
- notify:
- - restart nova-compute services
-
-- name: update libvirt-bin.conf
- lineinfile:
- dest: /etc/init/libvirt-bin.conf
- regexp: '^env libvirtd_opts=.*'
- line: 'env libvirtd_opts="-d -l"'
- when: ansible_os_family == "Debian"
- notify:
- - restart nova-compute services
-
-- name: update libvirtd.conf
- lineinfile:
- dest: /etc/libvirt/libvirtd.conf
- regexp: '{{ item.regexp }}'
- insertafter: '{{ item.insertafter }}'
- line: '{{ item.line }}'
- with_items:
- - regexp: '^listen_tls.*'
- insertafter: '^#listen_tls.*'
- line: 'listen_tls = 0'
- - regexp: '^listen_tcp.*'
- insertafter: '^#listen_tcp.*'
- line: 'listen_tcp = 1'
- - regexp: '^auth_tcp.*'
- insertafter: '^#auth_tcp.*'
- line: 'auth_tcp = "none"'
- notify:
- - restart nova-compute services
-
-- name: update sysconfig libvirtd
- lineinfile:
- dest: /etc/sysconfig/libvirtd
- regexp: '^LIBVIRTD_ARGS.*'
- insertafter: '^#LIBVIRTD_ARGS.*'
- line: 'LIBVIRTD_ARGS="--listen"'
- when: ansible_os_family == "RedHat"
- notify:
- - restart nova-compute services
-
-- name: update nova-compute conf
- template: src={{ item }} dest=/etc/nova/{{ item }}
- with_items:
- - nova.conf
- - nova-compute.conf
- notify:
- - restart nova-compute services
-
-- name: generate neutron control service list
- lineinfile: dest=/opt/service create=yes line='{{ item }}'
- with_items: "{{ services | union(services_noarch) }}"
-
-- name: remove nova sqlite db
- shell: rm /var/lib/nova/nova.sqlite || touch nova.sqlite.removed
-
-- meta: flush_handlers
+++ /dev/null
-[DEFAULT]
-compute_driver = libvirt.LibvirtDriver
-force_raw_images = true
-[libvirt]
-cpu_mode = none
-{% if kvm_cpu_num.stdout_lines[0]|int == 0 %}
-virt_type = qemu
-{% else %}
-virt_type = kvm
-{% endif %}
-images_type = raw
-mem_stats_period_seconds = 0
+++ /dev/null
-[DEFAULT]
-transport_url = rabbit://{{ RABBIT_USER }}:{{ RABBIT_PASS }}@{{ rabbit_host }}
-auth_strategy = keystone
-my_ip = {{ internal_ip }}
-use_neutron = True
-firewall_driver = nova.virt.firewall.NoopFirewallDriver
-
-dhcpbridge_flagfile=/etc/nova/nova.conf
-dhcpbridge=/usr/bin/nova-dhcpbridge
-log-dir=/var/log/nova
-state_path=/var/lib/nova
-force_dhcp_release=True
-verbose={{ VERBOSE }}
-ec2_private_dns_show_ip=True
-enabled_apis=osapi_compute,metadata
-default_floating_pool={{ public_net_info.network }}
-metadata_listen={{ internal_ip }}
-linuxnet_interface_driver = nova.network.linux_net.LinuxOVSInterfaceDriver
-iscsi_helper=tgtadm
-connection_type=libvirt
-root_helper=sudo nova-rootwrap /etc/nova/rootwrap.conf
-debug={{ DEBUG }}
-volumes_path=/var/lib/nova/volumes
-rpc_backend = rabbit
-osapi_compute_listen={{ internal_ip }}
-network_api_class = nova.network.neutronv2.api.API
-security_group_api = neutron
-instance_usage_audit = True
-instance_usage_audit_period = hour
-notify_on_state_change = vm_and_task_state
-notification_driver = nova.openstack.common.notifier.rpc_notifier
-notification_driver = ceilometer.compute.nova_notifier
-
-[api_database]
-connection = mysql://nova:{{ NOVA_DBPASS }}@{{ db_host }}/nova_api
-idle_timeout = 30
-pool_timeout = 10
-use_db_reconnect = True
-
-[database]
-connection = mysql://nova:{{ NOVA_DBPASS }}@{{ db_host }}/nova
-idle_timeout = 30
-pool_timeout = 10
-use_db_reconnect = True
-
-[glance]
-api_servers = http://{{ internal_vip.ip }}:9292
-host = {{ internal_vip.ip }}
-
-[keystone_authtoken]
-auth_uri = http://{{ internal_vip.ip }}:5000
-auth_url = http://{{ internal_vip.ip }}:35357
-auth_type = password
-project_domain_name = default
-user_domain_name = default
-project_name = service
-username = nova
-password = {{ NOVA_PASS }}
-
-identity_uri = http://{{ internal_vip.ip }}:35357
-admin_tenant_name = service
-admin_user = nova
-admin_password = {{ NOVA_PASS }}
-
-[libvirt]
-use_virtio_for_bridges=True
-
-[neutron]
-url = http://{{ internal_vip.ip }}:9696
-auth_url = http://{{ internal_vip.ip }}:35357
-auth_type = password
-project_domain_name = default
-user_domain_name = default
-region_name = RegionOne
-project_name = service
-username = neutron
-password = {{ NEUTRON_PASS }}
-service_metadata_proxy = True
-metadata_proxy_shared_secret = {{ METADATA_SECRET }}
-
-auth_strategy = keystone
-admin_tenant_name = service
-admin_username = neutron
-admin_password = {{ NEUTRON_PASS }}
-admin_auth_url = http://{{ internal_vip.ip }}:35357/v3
-
-[oslo_concurrency]
-lock_path=/var/lib/nova/tmp
-
-[oslo_messaging_rabbit]
-rabbit_host = {{ rabbit_host }}
-rabbit_userid = {{ RABBIT_USER }}
-rabbit_password = {{ RABBIT_PASS }}
-
-[vnc]
-enabled = True
-vncserver_listen = {{ internal_ip }}
-vncserver_proxyclient_address = {{ internal_ip }}
-novncproxy_base_url = http://{{ public_vip.ip }}:6080/vnc_auto.html
-novncproxy_host = {{ internal_ip }}
-novncproxy_port = 6080
-
-[wsgi]
-api_paste_config=/etc/nova/api-paste.ini
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-
-packages:
- - nova-compute-kvm
-
-services:
- - nova-compute
- - libvirt-bin
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-packages:
- - openstack-nova-compute
- - sysfsutils
-
-services:
- - libvirtd
- - openstack-nova-compute
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-packages_noarch: []
-
-services_noarch: []
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-- name: restart nova service
- service: name={{ item}} state=restarted enabled=yes
- with_items: "{{ services | union(services_noarch) }}"
-
-- name: remove nova-sqlite-db
- shell: rm /var/lib/nova/nova.sqlite || touch nova.sqlite.db.removed
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-- include: nova_install.yml
- tags:
- - install
- - nova_install
- - nova
-
-- include: nova_config.yml
- when: inventory_hostname == groups['controller'][0]
- tags:
- - config
- - nova_config
- - nova
-
-- meta: flush_handlers
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-- name: nova api db sync
- shell: su -s /bin/sh -c "nova-manage api_db sync" nova
- ignore_errors: "True"
- notify:
- - restart nova service
-
-- name: nova db sync
- shell: su -s /bin/sh -c "nova-manage db sync" nova
- notify:
- - restart nova service
-
-- meta: flush_handlers
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-- include_vars: "{{ ansible_os_family }}.yml"
-
-- name: disable auto start
- copy:
- content: "#!/bin/sh\nexit 101"
- dest: "/usr/sbin/policy-rc.d"
- mode: 0755
- when: ansible_os_family == "Debian"
-
-- name: install nova related packages
- action: "{{ ansible_pkg_mgr }} name={{ item }} state=present"
- with_items: "{{ packages | union(packages_noarch) }}"
-
-- name: enable auto start
- file:
- path=/usr/sbin/policy-rc.d
- state=absent
- when: ansible_os_family == "Debian"
-
-- name: generate nova control service list
- lineinfile: dest=/opt/service create=yes line='{{ item }}'
- with_items: "{{ services | union(services_noarch) }}"
-
-- name: update nova conf
- template: src=templates/nova.conf
- dest=/etc/nova/nova.conf
- backup=yes
- notify:
- - restart nova service
- - remove nova-sqlite-db
+++ /dev/null
-[DEFAULT]
-# Show debugging output in log (sets DEBUG log level output)
-# debug = False
-verbose = True
-
-# The DHCP agent will resync its state with Neutron to recover from any
-# transient notification or rpc errors. The interval is number of
-# seconds between attempts.
-resync_interval = 5
-
-# The DHCP agent requires an interface driver be set. Choose the one that best
-# matches your plugin.
-# interface_driver =
-
-# Example of interface_driver option for OVS based plugins(OVS, Ryu, NEC, NVP,
-# BigSwitch/Floodlight)
-interface_driver = neutron.agent.linux.interface.OVSInterfaceDriver
-
-# Name of Open vSwitch bridge to use
-# ovs_integration_bridge = br-int
-
-# Use veth for an OVS interface or not.
-# Support kernels with limited namespace support
-# (e.g. RHEL 6.5) so long as ovs_use_veth is set to True.
-ovs_use_veth = False
-
-# Example of interface_driver option for LinuxBridge
-# interface_driver = neutron.agent.linux.interface.BridgeInterfaceDriver
-
-# The agent can use other DHCP drivers. Dnsmasq is the simplest and requires
-# no additional setup of the DHCP server.
-dhcp_driver = neutron.agent.linux.dhcp.Dnsmasq
-
-# Allow overlapping IP (Must have kernel build with CONFIG_NET_NS=y and
-# iproute2 package that supports namespaces).
-use_namespaces = True
-
-# The DHCP server can assist with providing metadata support on isolated
-# networks. Setting this value to True will cause the DHCP server to append
-# specific host routes to the DHCP request. The metadata service will only
-# be activated when the subnet does not contain any router port. The guest
-# instance must be configured to request host routes via DHCP (Option 121).
-enable_isolated_metadata = True
-
-# Allows for serving metadata requests coming from a dedicated metadata
-# access network whose cidr is 169.254.169.254/16 (or larger prefix), and
-# is connected to a Neutron router from which the VMs send metadata
-# request. In this case DHCP Option 121 will not be injected in VMs, as
-# they will be able to reach 169.254.169.254 through a router.
-# This option requires enable_isolated_metadata = True
-enable_metadata_network = False
-
-# Number of threads to use during sync process. Should not exceed connection
-# pool size configured on server.
-# num_sync_threads = 4
-
-# Location to store DHCP server config files
-# dhcp_confs = $state_path/dhcp
-
-# Domain to use for building the hostnames
-dhcp_domain = openstacklocal
-
-# Override the default dnsmasq settings with this file
-# dnsmasq_config_file =
-dnsmasq_config_file = /etc/neutron/dnsmasq-neutron.conf
-
-# Comma-separated list of DNS servers which will be used by dnsmasq
-# as forwarders.
-# dnsmasq_dns_servers =
-
-# Limit number of leases to prevent a denial-of-service.
-dnsmasq_lease_max = 16777216
-
-# Location to DHCP lease relay UNIX domain socket
-# dhcp_lease_relay_socket = $state_path/dhcp/lease_relay
-
-# Location of Metadata Proxy UNIX domain socket
-# metadata_proxy_socket = $state_path/metadata_proxy
-
-# dhcp_delete_namespaces, which is false by default, can be set to True if
-# namespaces can be deleted cleanly on the host running the dhcp agent.
-# Do not enable this until you understand the problem with the Linux iproute
-# utility mentioned in https://bugs.launchpad.net/neutron/+bug/1052535 and
-# you are sure that your version of iproute does not suffer from the problem.
-# If True, namespaces will be deleted when a dhcp server is disabled.
-# dhcp_delete_namespaces = False
-
-# Timeout for ovs-vsctl commands.
-# If the timeout expires, ovs commands will fail with ALARMCLOCK error.
-# ovs_vsctl_timeout = 10
+++ /dev/null
-interfaces {
- restore-original-config-on-shutdown: false
- interface {{ hostvars[inventory_hostname][neutron_vxlan_interface|default(internal_interface)]['device'] }} {
- description: "Internal pNodes interface"
- disable: false
- default-system-config
- }
-}
-
-protocols {
- igmp {
- disable: false
- interface {{ hostvars[inventory_hostname][neutron_vxlan_interface|default(internal_interface)]['device'] }} {
- vif {{ hostvars[inventory_hostname][neutron_vxlan_interface|default(internal_interface)]['device'] }} {
- disable: false
- version: 3
- }
- }
- traceoptions {
- flag all {
- disable: false
- }
- }
- }
-}
+++ /dev/null
-[DEFAULT]
-# Show debugging output in log (sets DEBUG log level output)
-# debug = False
-verbose = True
-
-# L3 requires that an interface driver be set. Choose the one that best
-# matches your plugin.
-# interface_driver =
-
-# Example of interface_driver option for OVS based plugins (OVS, Ryu, NEC)
-# that supports L3 agent
-# interface_driver = neutron.agent.linux.interface.OVSInterfaceDriver
-interface_driver = neutron.agent.linux.interface.OVSInterfaceDriver
-
-# Use veth for an OVS interface or not.
-# Support kernels with limited namespace support
-# (e.g. RHEL 6.5) so long as ovs_use_veth is set to True.
-# ovs_use_veth = False
-
-# Example of interface_driver option for LinuxBridge
-# interface_driver = neutron.agent.linux.interface.BridgeInterfaceDriver
-
-# Allow overlapping IP (Must have kernel build with CONFIG_NET_NS=y and
-# iproute2 package that supports namespaces).
-use_namespaces = True
-
-# If use_namespaces is set as False then the agent can only configure one router.
-
-# This is done by setting the specific router_id.
-# router_id =
-
-# When external_network_bridge is set, each L3 agent can be associated
-# with no more than one external network. This value should be set to the UUID
-# of that external network. To allow L3 agent support multiple external
-# networks, both the external_network_bridge and gateway_external_network_id
-# must be left empty.
-# gateway_external_network_id =
-
-# Indicates that this L3 agent should also handle routers that do not have
-# an external network gateway configured. This option should be True only
-# for a single agent in a Neutron deployment, and may be False for all agents
-# if all routers must have an external network gateway
-handle_internal_only_routers = True
-
-# Name of bridge used for external network traffic. This should be set to
-# empty value for the linux bridge. when this parameter is set, each L3 agent
-# can be associated with no more than one external network.
-external_network_bridge =
-
-# TCP Port used by Neutron metadata server
-metadata_port = 9697
-
-# Send this many gratuitous ARPs for HA setup. Set it below or equal to 0
-# to disable this feature.
-send_arp_for_ha = 3
-
-# seconds between re-sync routers' data if needed
-periodic_interval = 40
-
-# seconds to start to sync routers' data after
-# starting agent
-periodic_fuzzy_delay = 5
-
-# enable_metadata_proxy, which is true by default, can be set to False
-# if the Nova metadata server is not available
-# enable_metadata_proxy = True
-
-# Location of Metadata Proxy UNIX domain socket
-# metadata_proxy_socket = $state_path/metadata_proxy
-
-# router_delete_namespaces, which is false by default, can be set to True if
-# namespaces can be deleted cleanly on the host running the L3 agent.
-# Do not enable this until you understand the problem with the Linux iproute
-# utility mentioned in https://bugs.launchpad.net/neutron/+bug/1052535 and
-# you are sure that your version of iproute does not suffer from the problem.
-# If True, namespaces will be deleted when a router is destroyed.
-# router_delete_namespaces = False
-
-# Timeout for ovs-vsctl commands.
-# If the timeout expires, ovs commands will fail with ALARMCLOCK error.
-# ovs_vsctl_timeout = 10
+++ /dev/null
-[DEFAULT]
-# Show debugging output in log (sets DEBUG log level output)
-debug = True
-
-# The Neutron user information for accessing the Neutron API.
-auth_url = http://{{ internal_vip.ip }}:5000/v2.0
-auth_region = RegionOne
-# Turn off verification of the certificate for ssl
-# auth_insecure = False
-# Certificate Authority public key (CA cert) file for ssl
-# auth_ca_cert =
-admin_tenant_name = service
-admin_user = neutron
-admin_password = {{ NEUTRON_PASS }}
-
-# Network service endpoint type to pull from the keystone catalog
-# endpoint_type = adminURL
-
-# IP address used by Nova metadata server
-nova_metadata_ip = {{ internal_vip.ip }}
-
-# TCP Port used by Nova metadata server
-nova_metadata_port = 8775
-
-# When proxying metadata requests, Neutron signs the Instance-ID header with a
-# shared secret to prevent spoofing. You may select any string for a secret,
-# but it must match here and in the configuration used by the Nova Metadata
-# Server. NOTE: Nova uses a different key: neutron_metadata_proxy_shared_secret
-metadata_proxy_shared_secret = {{ METADATA_SECRET }}
-
-# Location of Metadata Proxy UNIX domain socket
-# metadata_proxy_socket = $state_path/metadata_proxy
-
-# Number of separate worker processes for metadata server
-# metadata_workers = 0
-
-# Number of backlog requests to configure the metadata server socket with
-# metadata_backlog = 128
-
-# URL to connect to the cache backend.
-# Example of URL using memory caching backend
-# with ttl set to 5 seconds: cache_url = memory://?default_ttl=5
-# default_ttl=0 parameter will cause cache entries to never expire.
-# Otherwise default_ttl specifies time in seconds a cache entry is valid for.
-# No cache is used in case no value is passed.
-# cache_url =
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
-# neutron --os-username=admin --os-password={{ ADMIN_PASS }} --os-tenant-name=admin --os-auth-url=http://{{ identity_host }}:35357/v2.0 net-create ext-net --shared --router:external=True
-
-# neutron --os-username=admin --os-password={{ ADMIN_PASS }} --os-tenant-name=admin --os-auth-url=http://{{ identity_host }}:35357/v2.0 subnet-create ext-net --name ext-subnet --allocation-pool start={{ FLOATING_IP_START }},end={{ FLOATING_IP_END}} --disable-dhcp --gateway {{EXTERNAL_NETWORK_GATEWAY}} {{EXTERNAL_NETWORK_CIDR}}
-
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-packages:
- - nova-api
- - nova-cert
- - nova-conductor
- - nova-consoleauth
- - nova-novncproxy
- - nova-scheduler
- - python-oslo.rootwrap
-
-services:
- - nova-api
- - nova-cert
- - nova-conductor
- - nova-consoleauth
- - nova-novncproxy
- - nova-scheduler
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-packages:
- - openstack-nova-api
- - openstack-nova-cert
- - openstack-nova-conductor
- - openstack-nova-console
- - openstack-nova-novncproxy
- - openstack-nova-scheduler
-
-services:
- - openstack-nova-api
- - openstack-nova-cert
- - openstack-nova-conductor
- - openstack-nova-consoleauth
- - openstack-nova-novncproxy
- - openstack-nova-scheduler
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-packages_noarch: []
-
-services_noarch: []
+++ /dev/null
-[Unit]
-Description=OpenDaylight
-After=
-
-
-[Service]
-User=root
-Group=root
-Type=simple
-WorkingDirectory=/opt/opendaylight
-PermissionsStartOnly=true
-ExecStartPre=
-ExecStart=/usr/lib/jvm/java-8-oracle/bin/java -Djava.security.properties=/opt/opendaylight/etc/odl.java.security -server -Xms128M -Xmx2048m -XX:+UnlockDiagnosticVMOptions -XX:+UnsyncloadClass -XX:+HeapDumpOnOutOfMemoryError -Dcom.sun.management.jmxremote -Djava.security.egd=file:/dev/./urandom -Djava.endorsed.dirs=/usr/lib/jvm/java-8-oracle/jre/lib/endorsed:/usr/lib/jvm/java-8-oracle/lib/endorsed:/opt/opendaylight/lib/endorsed -Djava.ext.dirs=/usr/lib/jvm/java-8-oracle/jre/lib/ext:/usr/lib/jvm/java-8-oracle/lib/ext:/opt/opendaylight/lib/ext -Dkaraf.instances=/opt/opendaylight/instances -Dkaraf.home=/opt/opendaylight -Dkaraf.base=/opt/opendaylight -Dkaraf.data=/opt/opendaylight/data -Dkaraf.etc=/opt/opendaylight/etc -Djava.io.tmpdir=/opt/opendaylight/data/tmp -Djava.util.logging.config.file=/opt/opendaylight/etc/java.util.logging.properties -Dkaraf.startLocalConsole=false -Dkaraf.startRemoteShell=true -classpath /opt/opendaylight/lib/karaf.branding-1.7.2-Boron-SR2.jar:/opt/opendaylight/lib/karaf-jaas-boot.jar:/opt/opendaylight/lib/karaf.jar:/opt/opendaylight/lib/karaf-org.osgi.core.jar org.apache.karaf.main.Main
-Restart=on-failure
-LimitNOFILE=65535
-TimeoutStopSec=15
-
-[Install]
-WantedBy=multi-user.target
-
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
-
-import yaml
-import netaddr
-import os
-import log as logging
-
-LOG = logging.getLogger("net-recover")
-config_path = os.path.join(os.path.dirname(__file__), "network.cfg")
-
-
-def setup_bondings(bond_mappings):
- print bond_mappings
-
-
-def add_ovs_port(ovs_br, ifname, uplink, vlan_id=None):
- LOG.info("add_ovs_port enter")
- cmd = "ovs-vsctl --may-exist add-port %s %s" % (ovs_br, ifname)
- if vlan_id:
- cmd += " tag=%s" % vlan_id
- cmd += " -- set Interface %s type=internal;" % ifname
- cmd += "ip link set dev %s address `ip link show %s |awk '/link\/ether/{print $2}'`;" % (ifname, uplink) # noqa
- cmd += "ip link set %s up;" % ifname
- LOG.info("add_ovs_port: cmd=%s" % cmd)
- os.system(cmd)
-
-
-def setup_ips(ip_settings, sys_intf_mappings):
- LOG.info("setup_ips enter")
- for intf_info in ip_settings.values():
- network = netaddr.IPNetwork(intf_info["cidr"])
- if sys_intf_mappings[intf_info["name"]]["type"] == "ovs":
- intf_name = intf_info["name"]
- else:
- intf_name = intf_info["alias"]
- if "gw" in intf_info:
- cmd = "ip addr add %s/%s brd %s dev %s;" \
- % (intf_info["ip"], intf_info["netmask"], str(network.broadcast), intf_name) # noqa
- cmd += "route del default;"
- cmd += "ip route add default via %s dev %s" % (
- intf_info["gw"], intf_name)
- LOG.info("setup_ips: cmd=%s" % cmd)
- os.system(cmd)
-
-
-def setup_intfs(sys_intf_mappings, uplink_map):
- LOG.info("setup_intfs enter")
- for intf_name, intf_info in sys_intf_mappings.items():
- if intf_info["type"] == "ovs":
- add_ovs_port(
- intf_info["interface"],
- intf_name,
- uplink_map[intf_info["interface"]],
- vlan_id=intf_info.get("vlan_tag"))
- else:
- pass
-
-
-def main(config):
- uplink_map = {}
- setup_bondings(config["bond_mappings"])
- for provider_net in config["provider_net_mappings"]:
- uplink_map[provider_net['name']] = provider_net['interface']
-
- setup_intfs(config["sys_intf_mappings"], uplink_map)
- setup_ips(config["ip_settings"], config["sys_intf_mappings"])
-
-
-if __name__ == "__main__":
- os.system("service openvswitch-switch status|| service openvswitch-switch start") # noqa
- config = yaml.load(open(config_path))
- main(config)
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
-
-import yaml
-import netaddr
-import os
-import log as logging
-
-LOG = logging.getLogger("net-recover-odl-l3")
-config_path = os.path.join(os.path.dirname(__file__), "network.cfg")
-
-
-def setup_bondings(bond_mappings):
- print bond_mappings
-
-
-def setup_ips_new(config):
- LOG.info("setup_ips_new enter")
- network = netaddr.IPNetwork(config["ip_settings"]["br-prv"]["cidr"])
-# intf_name = config["provider_net_mappings"][0]["interface"]
- cmd = "ip link set br-ex up;"
- cmd += "ip addr add %s/%s brd %s dev %s;" \
- % (config["ip_settings"]["br-prv"]["ip"], config["ip_settings"]["br-prv"]["netmask"], str(network.broadcast), 'br-ex') # noqa
- cmd += "route del default;"
- cmd += "ip route add default via %s dev %s" % (
- config["ip_settings"]["br-prv"]["gw"], 'br-ex')
- LOG.info("setup_ips_new: cmd=%s" % cmd)
- os.system(cmd)
-
-
-def main(config):
- setup_ips_new(config)
-
-if __name__ == "__main__":
- os.system("service openvswitch-switch status|| service openvswitch-switch start") # noqa
- config = yaml.load(open(config_path))
- main(config)
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
-
-import yaml
-import netaddr
-import os
-import log as logging
-
-LOG = logging.getLogger("net-init-l3")
-config_path = os.path.join(os.path.dirname(__file__), "network.cfg")
-
-
-def setup_bondings(bond_mappings):
- print bond_mappings
-
-
-def add_vlan_link(interface, ifname, vlan_id):
- LOG.info("add_vlan_link enter")
- cmd = "ip link add link %s name %s type vlan id %s; " % (
- ifname, interface, vlan_id)
- cmd += "ip link set %s up; ip link set %s up" % (interface, ifname)
- LOG.info("add_vlan_link: cmd=%s" % cmd)
- os.system(cmd)
-
-# def add_ovs_port(ovs_br, ifname, uplink, vlan_id=None):
-# LOG.info("add_ovs_port enter")
-# cmd = "ovs-vsctl --may-exist add-port %s %s" % (ovs_br, ifname)
-# if vlan_id:
-# cmd += " tag=%s" % vlan_id
-# cmd += " -- set Interface %s type=internal;" % ifname
-# cmd += "ip link set dev %s address `ip link show %s |awk '/link\/ether/{print $2}'`;" \ # noqa
-# % (ifname, uplink)
-# cmd += "ip link set %s up;" % ifname
-# LOG.info("add_ovs_port: cmd=%s" % cmd)
-# os.system(cmd)
-
-
-def setup_intfs(sys_intf_mappings, uplink_map):
- LOG.info("setup_intfs enter")
- for intf_name, intf_info in sys_intf_mappings.items():
- if intf_info["type"] == "vlan":
- add_vlan_link(
- intf_name,
- intf_info["interface"],
- intf_info["vlan_tag"])
-# elif intf_info["type"] == "ovs":
-# add_ovs_port(
-# intf_info["interface"],
-# intf_name,
-# uplink_map[intf_info["interface"]],
-# vlan_id=intf_info.get("vlan_tag"))
- else:
- pass
-
-
-def setup_ips(ip_settings, sys_intf_mappings):
- LOG.info("setup_ips enter")
- for intf_info in ip_settings.values():
- network = netaddr.IPNetwork(intf_info["cidr"])
- if sys_intf_mappings[intf_info["name"]]["type"] == "ovs":
- intf_name = intf_info["name"]
- else:
- intf_name = intf_info["alias"]
- if "gw" in intf_info:
- continue
- cmd = "ip addr add %s/%s brd %s dev %s;" \
- % (intf_info["ip"], intf_info["netmask"], str(network.broadcast), intf_name) # noqa
-# if "gw" in intf_info:
-# cmd += "route del default;"
-# cmd += "ip route add default via %s dev %s" % (intf_info["gw"], intf_name) # noqa
- LOG.info("setup_ips: cmd=%s" % cmd)
- os.system(cmd)
-
-
-def setup_ips_new(config):
- LOG.info("setup_ips_new enter")
- network = netaddr.IPNetwork(config["ip_settings"]["br-prv"]["cidr"])
-# intf_name = config["provider_net_mappings"][0]["interface"]
-# cmd = "ip addr add %s/%s brd %s dev %s;" \
-# % (config["ip_settings"]["br-prv"]["ip"], config["ip_settings"]["br-prv"]["netmask"], str(network.broadcast), intf_name) # noqa
- cmd = "ip link set br-ex up;"
- cmd += "ip addr add %s/%s brd %s dev %s;" \
- % (config["ip_settings"]["br-prv"]["ip"], config["ip_settings"]["br-prv"]["netmask"], str(network.broadcast), 'br-ex') # noqa
- cmd += "route del default;"
-# cmd += "ip route add default via %s dev %s" % (config["ip_settings"]["br-prv"]["gw"], intf_name) # noqa
- cmd += "ip route add default via %s dev %s" % (
- config["ip_settings"]["br-prv"]["gw"], 'br-ex')
- LOG.info("setup_ips_new: cmd=%s" % cmd)
- os.system(cmd)
-
-
-def main(config):
- uplink_map = {}
- setup_bondings(config["bond_mappings"])
- for provider_net in config["provider_net_mappings"]:
- uplink_map[provider_net['name']] = provider_net['interface']
-
- setup_intfs(config["sys_intf_mappings"], uplink_map)
- setup_ips(config["ip_settings"], config["sys_intf_mappings"])
- setup_ips_new(config)
-
-if __name__ == "__main__":
- os.system("service openvswitch-switch status|| service openvswitch-switch start") # noqa
- config = yaml.load(open(config_path))
- main(config)
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-- name: restart odl service
- service: name=opendaylight state=restarted
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-
-- name: install controller packages
- action: "{{ ansible_pkg_mgr }} name={{ item }} state=present"
- with_items: "{{ common_packages | union(common_packages_noarch) }}"
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-
-- name: get image http server
- shell: awk -F'=' '/compass_server/ {print $2}' /etc/compass.conf
- register: http_server
-
-- name: download oracle-jdk8 package file
- get_url:
- url: "http://{{ http_server.stdout_lines[0] }}/packages/java/{{ jdk8_pkg_name }}"
- dest: /opt/{{ jdk8_pkg_name }}
-
-- name: download oracle-jdk8 script file
- get_url:
- url: "http://{{ http_server.stdout_lines[0] }}/packages/java/{{ jdk8_script_name }}"
- dest: /opt/
-
-- name: download odl package
- get_url:
- url: "http://{{ http_server.stdout_lines[0] }}/packages/odl/{{ odl_pkg_url }}"
- dest: /opt/{{ odl_pkg_name }}
-
-- name: download odl pip package
- get_url:
- url: "http://{{ http_server.stdout_lines[0] }}/pip-openstack/{{ networking_odl_pkg_name }}"
- dest: /opt/{{ networking_odl_pkg_name }}
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-
-- name: create odl group
- group: name=odl system=yes state=present
-
-- name: create odl user
- user:
- name: odl
- group: odl
- home: "{{ odl_home }}"
- createhome: "yes"
- system: "yes"
- shell: "/bin/false"
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-
-- name: clear jdk8 package
- command: su -s /bin/sh -c "rm -rf /opt/install_jdk8"
-
-- name: unarchive onos driver package
- command: su -s /bin/sh -c "tar xvf /opt/install_jdk8.tar -C /opt/"
-
-- name: install install_jdk8 package
- command: su -s /bin/sh -c "/opt/install_jdk8/install_jdk8.sh"
-
-- name: clear odl package
- command: su -s /bin/sh -c "rm -rf {{ odl_home }}/*"
-
-- name: extract odl package
- command: |
- su -s /bin/sh -c "tar xzf /opt/{{ odl_pkg_name }} -C {{ odl_home }} \
- --strip-components 1" odl
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-- name: opendaylight system file
- copy:
- src: "{{ service_file.src }}"
- dest: "{{ service_file.dst }}"
- mode: 0755
-
-- name: set l3 fwd enable in custom.properties
- template:
- src: custom.properties
- dest: "{{ odl_home }}/etc/custom.properties"
- owner: odl
- group: odl
- mode: 0775
- when: odl_l3_agent == "Enable"
-
-- name: create karaf config
- template:
- src: org.apache.karaf.features.cfg.Debian
- dest: "{{ odl_home }}/etc/org.apache.karaf.features.cfg"
- owner: odl
- group: odl
- mode: 0775
- when: ansible_os_family == "Debian"
-
-- name: create karaf config
- template:
- src: org.apache.karaf.features.cfg.Redhat
- dest: "{{ odl_home }}/etc/org.apache.karaf.features.cfg"
- owner: odl
- group: odl
- mode: 0775
- when: ansible_os_family == "RedHat"
-
-- name: copy acl configuration script
- template:
- src: acl_conf.sh
- dest: "/opt/acl_conf.sh"
- mode: 0777
-
-- name: execute acl configuration script
- command: su -s /bin/sh -c "/opt/acl_conf.sh;"
-
-- name: create tomcat config
- shell: >
- sed -i 's/port="8282"/port="{{ odl_api_port }}"/'
- {{ odl_home }}configuration/tomcat-server.xml
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-
-- name: patch odl pip package
- shell: |
- cd /opt
- tar xf /opt/{{ networking_odl_pkg_name }}
- rm -rf /opt/{{ networking_odl_pkg_name }}
- sed -i 's/^neutron-lib.*/neutron-lib/' {{ odl_pip }}/requirements.txt
- tar zcf /opt/{{ networking_odl_pkg_name }} {{ odl_pip }}
- cd -
-
-- name: odl pip package install
- shell: |
- cd /opt
- pip install {{ networking_odl_pkg_name }}
- rm -rf {{ networking_odl_pkg_name }}
- cd -
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-
-- name: remove karaf data directory
- shell: rm -rf {{ odl_home }}/data/*;
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-
-- name: turn off neutron server and agent Daemon on control node
- shell: >
- sed -i '/{{ service_ovs_agent_name }}/d' /opt/service ;
- sed -i '/neutron-server/d' /opt/service;
- sed -i '/keepalived/d' /opt/service;
-
-- name: turn off neutron-server on control node
- service: name=neutron-server state=stopped
-
-- name: turn off keepalived on control node
- service: name=keepalived state=stopped
- when: ansible_os_family == "Debian"
-
-- name: stop neutron l3 agent
- service: name=neutron-l3-agent state=stopped enabled=no
- when: odl_l3_agent == "Enable" and inventory_hostname in groups['odl']
-
-- name: remove neutron l3 agent
- shell: >
- sed -i '/neutron-l3-agent/d' /opt/service;
- rm -rf /lib/systemd/system/neutron-l3-agent.service;
- rm -rf /etc/init/neutron-l3-agent.conf;
- rm -rf /etc/init.d/neutron-l3-agent;
- when: odl_l3_agent == "Enable" and inventory_hostname in groups['odl']
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-
-- name: chown opendaylight directory and files
- shell: >
- chown -R odl:odl "{{ odl_home }}";
- chown odl:odl "{{ service_file.dst }}";
-
-- name: start opendaylight
- service: name=opendaylight state=started
- when: ansible_os_family == "Debian"
-
-- name: set opendaylight autostart
- shell: chkconfig opendaylight on
- when: ansible_os_family == "RedHat"
-
-- name: start opendaylight
- shell: service opendaylight start
- when: ansible_os_family == "RedHat"
-
-- name: check if opendaylight running
- shell: |
- netstat -lpen --tcp | grep java | grep 6653;
- while [ $? -ne 0 ]; do sleep 10; netstat -lpen --tcp | grep java | grep 6653; done
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-
-- name: configure l2 configuration
- shell: |
- crudini --set /etc/neutron/l3_agent.ini DEFAULT external_network_bridge \
- br-prv;
- when: odl_l3_agent == "Disable"
-
-- name: configure l3 configuration
- shell: |
- crudini --set /etc/neutron/l3_agent.ini DEFAULT external_network_bridge \
- br-ex;
- when: odl_l3_agent == "Enable"
-
-- name: configure odl l3 driver
- shell: |
- crudini --set /etc/neutron/neutron.conf DEFAULT service_plugins \
- networking_odl.l3.l3_odl.OpenDaylightL3RouterPlugin;
- when: odl_l3_agent == "Enable"
-
-- name: configure metadata for l3 configuration
- shell: |
- crudini --set /etc/neutron/dhcp_agent.ini DEFAULT \
- enable_isolated_metadata "True";
- when: odl_l3_agent == "Enable"
-
-- name: force metadata for l3 configuration
- shell: |
- crudini --set /etc/neutron/dhcp_agent.ini DEFAULT \
- force_metadata "True";
- when: odl_l3_agent == "Enable"
-
-
-- name: drop and recreate neutron database
- shell: |
- mysql -e "drop database if exists neutron;";
- mysql -e "create database neutron character set utf8;";
- mysql -e "grant all on neutron.* to 'neutron'@'%' identified by \
- '{{ NEUTRON_DBPASS }}';";
- su -s /bin/sh -c "neutron-db-manage \
- --config-file /etc/neutron/neutron.conf \
- --config-file /etc/neutron/plugins/ml2/ml2_conf.ini \
- upgrade head" neutron;
- when: inventory_hostname == haproxy_hosts.keys()[0]
- tags:
- - test_odl
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-
-- name: download packages
- include: 01_00_download_packages.yml
-
-- name: create odl user and group
- include: 01_01_create_odl_user_and_group.yml
-
-- name: unarchive odl and jdk
- include: 01_02_unarchive_odl_and_jdk.yml
-
-- name: copy odl configuration files
- include: 01_03_copy_odl_configuration_files.yml
-
-- name: install pip packages
- include: 01_04_install_pip_packages.yml
-
-- name: clean up karaf data
- include: 01_05_clean_up_karaf_data.yml
-
-- name: stop openstack services
- include: 01_06_stop_openstack_services.yml
-
-# - name: set opendaylight cluster
-# include: 05_set_opendaylight_cluster.yml
-# when: groups['odl']|length > 1
-
-- name: start and check odl
- include: 01_07_start_check_odl.yml
-
-- name: run openswitch
- include: 03_openvswitch.yml
-
-- name: configure neutron
- include: 01_08_configure_neutron.yml
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-
-- name: Provision ODL on Compute nodes
- include: 03_openvswitch.yml
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-- name: remove neutron-openvswitch-agent service daemon
- shell: sed -i '/{{ service_ovs_agent_name }}/d' /opt/service ;
-
-- name: shut down and disable Neutron's openvswitch agent services
- service: name={{ service_ovs_agent_name }} state=stopped enabled=no
-
-- name: remove Neutron's openvswitch agent services
- shell: >
- update-rc.d -f {{ service_ovs_agent_name }} remove;
- mv /etc/init.d/{{ service_ovs_agent_name }} \
- /home/{{ service_ovs_agent_name }};
- mv /etc/init/{{ service_ovs_agent_name }}.conf \
- /home/{{ service_ovs_agent_name }}.conf;
- when: ansible_os_family == "Debian"
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-
-- name: Stop the Open vSwitch service and clear existing OVSDB
- shell: >
- service {{ service_ovs_name }} stop ;
- rm -rf /var/log/openvswitch/* ;
- rm -rf /etc/openvswitch/conf.db ;
- service {{ service_ovs_name }} start ;
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-
-- name: add ovsdb_connection to neutron.conf
- shell: crudini --set /etc/neutron/neutron.conf OVS ovsdb_connection tcp:127.0.0.1:6639
-
-- name: restart keepalived to recover external IP before check br-int
- shell: service keepalived restart
- when: inventory_hostname in groups['odl']
- ignore_errors: "True"
-
-- name: restart opendaylight
- shell: service opendaylight restart; sleep 60
- when: inventory_hostname in groups['odl']
- ignore_errors: "True"
-
-- name: set opendaylight as the manager
- command: |
- su -s /bin/sh -c "ovs-vsctl set-manager ptcp:6639:127.0.0.1 tcp:{{ internal_vip.ip }}:6640;"
-
-- name: check br-int
- shell: |
- ovs-vsctl list-br | grep br-int; while [ $? -ne 0 ]; do sleep 10; \
- ovs-vsctl list-br | grep br-int; done
-
-- name: set local ip in openvswitch
- shell: |
- ovs-vsctl set Open_vSwitch $(ovs-vsctl show | head -n 1) \
- other_config={'local_ip'=' {{ internal_ip }} '};
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-- name: check br-ex
- shell: |
- ovs-vsctl list-br | grep br-ex;
- while [ $? -ne 0 ]; do sleep 10; ovs-vsctl list-br | grep br-ex; done
-
-- name: add ovs uplink
- openvswitch_port: bridge=br-ex port={{ item["interface"] }} state=present
- with_items: "{{ network_cfg['provider_net_mappings'] }}"
- when: item["type"] == "ovs"
-
-- name: wait 10 seconds
- shell: sleep 10
-
-- name: set external nic in openvswitch
- shell: |
- ovs-vsctl set Open_vSwitch $(ovs-vsctl show | head -n 1) \
- other_config:provider_mappings=br-ex:{{ item["interface"] }}
- with_items: "{{ network_cfg['provider_net_mappings'] }}"
- when: item["type"] == "ovs"
-
-- name: copy recovery script
- copy: src={{ item }} dest=/opt/setup_networks
- with_items:
- - recover_network_odl_l3.py
- - setup_networks_odl_l3.py
-
-- name: recover external script
- shell: python /opt/setup_networks/recover_network_odl_l3.py
-
-- name: update keepalived info
- template: src=keepalived.conf dest=/etc/keepalived/keepalived.conf
- when: inventory_hostname in groups['odl']
-
-- name: modify net-init
- shell: sed -i 's/setup_networks.py/setup_networks_odl_l3.py/g' \
- /etc/init.d/net_init
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-- name: add ovs bridge
- openvswitch_bridge: bridge={{ item["name"] }} state=present
- with_items: "{{ network_cfg['provider_net_mappings'] }}"
- when: item["type"] == "ovs"
-
-- name: add ovs uplink
- openvswitch_port: bridge={{ item["name"] }} port={{ item["interface"] }}
- state=present
- with_items: "{{ network_cfg['provider_net_mappings'] }}"
- when: item["type"] == "ovs"
-
-- name: copy recovery script
- copy: src={{ item }} dest=/opt/setup_networks
- with_items:
- - recover_network.py
-
-- name: recover external script
- shell: python /opt/setup_networks/recover_network.py
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-
-- name: recover external network for L3
- include: 03_03_00_recover_external_network_l3.yml
- when: odl_l3_agent == "Enable"
-
-- name: recover external network for L2
- include: 03_03_01_recover_external_network_l2.yml
- when: odl_l3_agent == "Disable"
-
-- name: restart keepalived to recover external IP
- shell: service keepalived restart
- when: inventory_hostname in groups['odl']
- ignore_errors: "True"
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-
-- name: configure opendaylight -> ml2
- shell: >
- crudini --set /etc/neutron/plugins/ml2/ml2_conf.ini ml2 mechanism_drivers opendaylight;
- crudini --set /etc/neutron/plugins/ml2/ml2_conf.ini ml2 tenant_network_types vxlan;
- crudini --set /etc/neutron/plugins/ml2/ml2_conf.ini ovs enable_tunneling "True";
- crudini --set /etc/neutron/plugins/ml2/ml2_conf.ini ml2 extension_drivers port_security;
-
-- name: copy ml2 configuration script
- template:
- src: ml2_conf.sh
- dest: "/opt/ml2_conf.sh"
- mode: 0777
-
-- name: execute ml2 configuration script
- command: su -s /bin/sh -c "/opt/ml2_conf.sh;"
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-
-- name: switch off neutron-openvswitch-agent
- include: 03_00_switch_off_neutron_openvswitch_agent.yml
-
-- name: clean up and restart openvswitch
- include: 03_01_clean_up_and_restart_openvswitch.yml
-
-- name: openvswitch connect with opendaylight and check br-int
- include: 03_02_openvswitch_connect_opendaylight.yml
-
-- name: recover external network
- include: 03_03_recover_external_network.yml
-
-- name: set up ml2
- include: 03_04_setup_ml2.yml
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-
-- name: set file inject in nova.conf
- shell: crudini --set /etc/nova/nova.conf DEFAULT force_config_drive true
-
-- name: restart all nova service
- shell: for i in `cat /opt/service | grep nova` ; do service $i restart; done
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-
-- name: combine odl controller
- shell: rm -f /opt/cluster; touch /opt/cluster;
-
-- name: combine odl controller
- shell: |
- echo "{{ ip_settings[item.1]['mgmt']['ip'] }} \c" >> /opt/cluster; \
- >> /opt/cluster;
- with_indexed_items: groups['odl']
-
-- name: combine odl controller
- shell: cat /opt/cluster
- register: cluster
-
-- name: combine odl controller
- shell: uname -n | cut -b 5,5
- register: number
-
-- debug: msg="{{ odl_home }}/bin/configure_cluster.sh
- {{ number.stdout_lines[0] }} {{ cluster.stdout_lines[0] }}"
-
-- name: configure odl controller in cluster
- shell: |
- "{{ odl_home }}/bin/configure_cluster.sh {{ number.stdout_lines[0] }} \
- {{ cluster.stdout_lines[0] }}"
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-- include_vars: "{{ ansible_os_family }}.yml"
- tags:
- - test_odl
-
-- name: Provision Common on all nodes
- include: 00_odl_common.yml
- when: groups['odl']|length !=0
-
-- name: Provision ODL on Controller nodes
- include: 01_odl_controller.yml
- when: inventory_hostname in groups['odl']
-
-- name: Provision ODL on Compute nodes
- include: 02_odl_compute.yml
- when: groups['odl']|length !=0 and inventory_hostname not in groups['odl']
+++ /dev/null
-##############################################################################
-# Copyright (c) 2017 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
-mkdir -p {{ odl_home }}etc/opendaylight/datastore/initial/config/
-CONFFILE=$(find {{ odl_home }} -name "*aclservice*config.xml")
-cp $CONFFILE {{ odl_home }}etc/opendaylight/datastore/initial/config/netvirt-aclservice-config.xml
-sed -i s/stateful/transparent/ {{ odl_home }}etc/opendaylight/datastore/initial/config/netvirt-aclservice-config.xml
+++ /dev/null
-# Extra packages to import from the boot class loader
-org.osgi.framework.system.packages.extra=org.apache.karaf.branding,sun.reflect,sun.reflect.misc,sun.misc,sun.nio.ch
-
-# https://bugs.eclipse.org/bugs/show_bug.cgi?id=325578
-# Extend the framework to avoid the resources to be presented with
-# a URL of type bundleresource: but to be presented as file:
-osgi.hook.configurators.include=org.eclipse.virgo.kernel.equinox.extensions.hooks.ExtensionsHookConfigurator
-
-# Embedded Tomcat configuration File
-org.eclipse.gemini.web.tomcat.config.path=configuration/tomcat-server.xml
-org.apache.tomcat.util.buf.UDecoder.ALLOW_ENCODED_SLASH=true
-
-# Use Equinox as default OSGi Framework Implementation
-karaf.framework=equinox
-
-# Netconf startup configuration
-netconf.tcp.address=127.0.0.1
-netconf.tcp.port=8383
-
-netconf.tcp.client.address=127.0.0.1
-netconf.tcp.client.port=8383
-
-netconf.ssh.address=0.0.0.0
-netconf.ssh.port=1830
-# Use Linux style path
-netconf.ssh.pk.path = ./configuration/RSA.pk
-# Set security provider to BouncyCastle
-org.apache.karaf.security.providers = org.bouncycastle.jce.provider.BouncyCastleProvider
-
-
-netconf.config.persister.active=1
-
-netconf.config.persister.1.storageAdapterClass=org.opendaylight.controller.config.persist.storage.file.xml.XmlFileStorageAdapter
-netconf.config.persister.1.properties.fileStorage=etc/opendaylight/current/controller.currentconfig.xml
-netconf.config.persister.1.properties.numberOfBackups=1
-
-# logback configuration
-logback.configurationFile=configuration/logback.xml
-
-# Container configuration
-container.profile = Container
-
-# Connection manager configuration
-connection.scheme = ANY_CONTROLLER_ONE_MASTER
-
-# Open Flow related system parameters
-# TCP port on which the controller is listening (default 6633)
-# of.listenPort=6633
-# IP address of the controller (default: wild card)
-# of.address = 127.0.0.1
-# The time (in milliseconds) the controller will wait for a response after sending a Barrier Request or a Statistic Request message (default 2000 msec)
-# of.messageResponseTimer=2000
-# The switch liveness timeout value (default 60500 msec)
-# of.switchLivenessTimeout=60500
-# The size of the queue holding pending statistics requests (default 64). For large networks of n switches, it is recommended to set the queue size to n
-# of.statsQueueSize = 64
-# The flow statistics polling interval in second (default 10 sec)
-# of.flowStatsPollInterval=10
-# The port statistics polling interval in second (default 5 sec)
-# of.portStatsPollInterval=5
-# The description statistics polling interval in second (default 60 sec)
-# of.descStatsPollInterval=60
-# The table statistics polling interval in second (default 10 sec)
-# of.tableStatsPollInterval=10
-# The maximum number of asynchronous messages can be sent before sending a Barrier Request (default 100)
-# of.barrierMessagePriorCount=100
-# The interval which determines how often the discovery packets should be sent (default 300 sec)
-# of.discoveryInterval=300
-# The timeout multiple of discovery interval
-# of.discoveryTimeoutMultiple=2
-# For newly added ports, allow one more retry if the elapsed time exceeds this threshold (default 30 sec)
-# of.discoveryThreshold=30
-# The maximum number of ports handled in one discovery batch (default 512)
-# of.discoveryBatchMaxPorts=512
-
-# OVSDB configuration
-# ovsdb plugin supports both active and passive connections. It listens on port 6640 by default for Active connections.
-ovsdb.listenPort=6640
-
-# ovsdb creates Openflow nodes/bridges. This configuration configures the bridge's Openflow version.
-# default Openflow version = 1.0, we also support 1.3.
-# ovsdb.of.version=1.3
-
-# ovsdb can be configured with ml2 to perform l3 forwarding. The config below enables that functionality, which is
-# disabled by default.
-ovsdb.l3.fwd.enabled=yes
-
-# ovsdb can be configured with ml2 to perform arp responder, enabled by default.
-ovsdb.l3.arp.responder.disabled=no
-
-# ovsdb can be configured with ml2 to perform l3 forwarding. When used in that scenario, the mac address of the default
-# gateway --on the external subnet-- is expected to be resolved from its inet address. The config below overrides that
-# specific arp/neighDiscovery lookup.
-# ovsdb.l3gateway.mac=00:00:5E:00:02:01
-
-# TLS configuration
-# To enable TLS, set secureChannelEnabled=true and specify the location of controller Java KeyStore and TrustStore files.
-# The Java KeyStore contains controller's private key and certificate. The Java TrustStore contains the trusted certificate
-# entries, including switches' Certification Authority (CA) certificates. For example,
-# secureChannelEnabled=true
-# controllerKeyStore=./configuration/ctlKeyStore
-# controllerKeyStorePassword=xxxxxxxx (this password should match the password used for KeyStore generation and at least 6 characters)
-# controllerTrustStore=./configuration/ctlTrustStore
-# controllerTrustStorePassword=xxxxxxxx (this password should match the password used for TrustStore generation and at least 6 characters)
-
-secureChannelEnabled=false
-controllerKeyStore=
-controllerKeyStorePassword=
-controllerTrustStore=
-controllerTrustStorePassword=
-
-# User Manager configurations
-enableStrongPasswordCheck = false
-
-#Jolokia configurations
-#org.jolokia.listenForHttpService=false
-
-# Logging configuration for Tomcat-JUL logging
-java.util.logging.config.file=configuration/tomcat-logging.properties
-
-#Hosttracker hostsdb key scheme setting
-hosttracker.keyscheme=IP
-
-# LISP Flow Mapping configuration
-# Map-Register messages overwrite existing RLOC sets in EID-to-RLOC mappings (default: true)
-lisp.mappingOverwrite = true
-# Enable the Solicit-Map-Request (SMR) mechanism (default: true)
-lisp.smr = true
-# Choose policy for Explicit Locator Path (ELP) handling
-# There are three options:
-# default: don't add or remove locator records, return mapping as-is
-# both: keep the ELP, but add the next hop as a standalone non-LCAF locator with a lower priority
-# replace: remove the ELP, add the next hop as a standalone non-LCAF locator
-lisp.elpPolicy = default
-
+++ /dev/null
-listen odl-rest-api-1
- bind {{ internal_vip.ip }}:8080
- bind {{ public_vip.ip }}:8080
- mode http
- balance source
- option httplog
- option nolinger
- timeout client 3m
- timeout server 3m
-{% for host,ip in haproxy_hosts.items() %}
- server {{ host }} {{ ip }}:8080 weight 1 check inter 2000 rise 2 fall 3
-{% endfor %}
-
-listen odl-rest-api-2
- bind {{ internal_vip.ip }}:8181
- bind {{ public_vip.ip }}:8181
- mode http
- balance source
- option httplog
- timeout client 3m
- timeout server 3m
-{% for host,ip in haproxy_hosts.items() %}
- server {{ host }} {{ ip }}:8181 weight 1 check inter 2000 rise 2 fall 3
-{% endfor %}
+++ /dev/null
-global_defs {
- router_id {{ inventory_hostname }}
-}
-
-vrrp_sync_group VG1 {
- group {
- internal_vip
- public_vip
- }
-}
-
-vrrp_instance internal_vip {
- interface {{ internal_vip.interface }}
- virtual_router_id {{ vrouter_id_internal }}
- state BACKUP
- nopreempt
- advert_int 1
- priority {{ 50 + (host_index[inventory_hostname] * 50) }}
-
- authentication {
- auth_type PASS
- auth_pass 1234
- }
-
- virtual_ipaddress {
- {{ internal_vip.ip }}/{{ internal_vip.netmask }} dev {{ internal_vip.interface }}
- }
-}
-
-vrrp_instance public_vip {
- interface br-ex
- virtual_router_id {{ vrouter_id_public }}
- state BACKUP
- nopreempt
- advert_int 1
- priority {{ 50 + (host_index[inventory_hostname] * 50) }}
-
- authentication {
- auth_type PASS
- auth_pass 4321
- }
-
- virtual_ipaddress {
- {{ network_cfg.public_vip.ip }}/{{ network_cfg.public_vip.netmask }} dev br-ex
- }
-
-}
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
-cat <<EOT>> /etc/neutron/plugins/ml2/ml2_conf.ini
-[ml2_odl]
-password = admin
-username = admin
-url = http://{{ internal_vip.ip }}:8080/controller/nb/v2/neutron
-EOT
+++ /dev/null
-# This file describes which shards live on which members
-# The format for a module-shards is as follows,
-# {
-# name = "<friendly_name_of_the_module>"
-# shards = [
-# {
-# name="<any_name_that_is_unique_for_the_module>"
-# replicas = [
-# "<name_of_member_on_which_to_run>"
-# ]
-# ]
-# }
-#
-# For Helium we support only one shard per module. Beyond Helium
-# we will support more than 1
-# The replicas section is a collection of member names. This information
-# will be used to decide on which members replicas of a particular shard will be
-# located. Once replication is integrated with the distributed data store then
-# this section can have multiple entries.
-#
-#
-
-
-module-shards = [
- {
- name = "default"
- shards = [
- {
- name="default"
- replicas = [
-{% set key = 0 %}
-{% for host in groups['odl'] %}
- {% set key = key + 1 %}
- {% if loop.last %}
- "member-{{ key }}"
- {% else %}
- "member-{{ key }}",
- {% endif %}
-{% endfor %}
- ]
- }
- ]
- },
- {
- name = "topology"
- shards = [
- {
- name="topology"
- replicas = [
-{% set key = 0 %}
-{% for host in groups['odl'] %}
- {% set key = key + 1 %}
- {% if loop.last %}
- "member-{{ key }}"
- {% else %}
- "member-{{ key }}",
- {% endif %}
-{% endfor %}
- ]
- }
- ]
- },
- {
- name = "inventory"
- shards = [
- {
- name="inventory"
- replicas = [
-{% set key = 0 %}
-{% for host in groups['odl'] %}
- {% set key = key + 1 %}
- {% if loop.last %}
- "member-{{ key }}"
- {% else %}
- "member-{{ key }}",
- {% endif %}
-{% endfor %}
- ]
- }
- ]
- },
- {
- name = "toaster"
- shards = [
- {
- name="toaster"
- replicas = [
-{% set key = 0 %}
-{% for host in groups['odl'] %}
- {% set key = key + 1 %}
- {% if loop.last %}
- "member-{{ key }}"
- {% else %}
- "member-{{ key }}",
- {% endif %}
-{% endfor %}
- ]
- }
- ]
- }
-]
+++ /dev/null
-MOON_SERVER_ADDR={{ internal_vip.ip }}
-MOON_SERVER_PORT=5000
-no_proxy="localhost,127.0.0.1"
+++ /dev/null
-################################################################################
-#
-# Licensed to the Apache Software Foundation (ASF) under one or more
-# contributor license agreements. See the NOTICE file distributed with
-# this work for additional information regarding copyright ownership.
-# The ASF licenses this file to You under the Apache License, Version 2.0
-# (the "License"); you may not use this file except in compliance with
-# the License. You may obtain a copy of the License at
-#
-# http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-#
-################################################################################
-
-#
-# Defines if the startlvl should be respected during feature startup. The default value is true. The default
-# behavior for 2.x is false (!) for this property
-#
-# Be aware that this property is deprecated and will be removed in Karaf 4.0. So, if you need to
-# set this to false, please use this only as a temporary solution!
-#
-#respectStartLvlDuringFeatureStartup=true
-
-
-#
-# Defines if the startlvl should be respected during feature uninstall. The default value is true.
-# If true, means stop bundles respecting the descend order of start level in a certain feature.
-#
-#respectStartLvlDuringFeatureUninstall=true
-
-#
-# Comma separated list of features repositories to register by default
-#
-featuresRepositories = mvn:org.apache.karaf.features/standard/3.0.7/xml/features,mvn:org.apache.karaf.features/enterprise/3.0.7/xml/features,mvn:org.ops4j.pax.web/pax-web-features/3.2.9/xml/features,mvn:org.apache.karaf.features/spring/3.0.7/xml/features,mvn:org.opendaylight.integration/features-integration-index/0.5.2-Boron-SR2/xml/features
-
-#
-# Comma separated list of features to install at startup
-#
-featuresBoot=config,standard,region,package,kar,ssh,management,odl-restconf-all,odl-aaa-authn,odl-dlux-all,odl-ovsdb-openstack,odl-mdsal-apidocs,odl-dlux-core,odl-openflowplugin-nxm-extensions
-
-#
-# Defines if the boot features are started in asynchronous mode (in a dedicated thread)
-#
-featuresBootAsynchronous=false
-
-#
-# Store cfg file for config element in feature
-#
-#configCfgStore=true
+++ /dev/null
-################################################################################
-#
-# Licensed to the Apache Software Foundation (ASF) under one or more
-# contributor license agreements. See the NOTICE file distributed with
-# this work for additional information regarding copyright ownership.
-# The ASF licenses this file to You under the Apache License, Version 2.0
-# (the "License"); you may not use this file except in compliance with
-# the License. You may obtain a copy of the License at
-#
-# http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-#
-################################################################################
-
-#
-# Defines if the startlvl should be respected during feature startup. The default value is true. The default
-# behavior for 2.x is false (!) for this property
-#
-# Be aware that this property is deprecated and will be removed in Karaf 4.0. So, if you need to
-# set this to false, please use this only as a temporary solution!
-#
-#respectStartLvlDuringFeatureStartup=true
-
-
-#
-# Defines if the startlvl should be respected during feature uninstall. The default value is true.
-# If true, means stop bundles respecting the descend order of start level in a certain feature.
-#
-#respectStartLvlDuringFeatureUninstall=true
-
-#
-# Comma separated list of features repositories to register by default
-#
-featuresRepositories = mvn:org.apache.karaf.features/standard/3.0.7/xml/features,mvn:org.apache.karaf.features/enterprise/3.0.7/xml/features,mvn:org.ops4j.pax.web/pax-web-features/3.2.9/xml/features,mvn:org.apache.karaf.features/spring/3.0.7/xml/features,mvn:org.opendaylight.integration/features-integration-index/0.5.2-Boron-SR2/xml/features
-
-#
-# Comma separated list of features to install at startup
-#
-featuresBoot=config,standard,region,package,kar,ssh,management,odl-restconf-all,odl-aaa-authn,odl-dlux-all,odl-ovsdb-openstack,odl-mdsal-apidocs,odl-dlux-core,odl-openflowplugin-nxm-extensions
-
-#
-# Defines if the boot features are started in asynchronous mode (in a dedicated thread)
-#
-featuresBootAsynchronous=false
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-
-common_packages:
- - crudini
-
-service_ovs_name: openvswitch-switch
-service_ovs_agent_name: neutron-openvswitch-agent
-
-service_file:
- src: opendaylight.service
- dst: /lib/systemd/system/opendaylight.service
-
-# networking_odl_pkg_name: networking-odl-3.2.0.tar.gz
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-
-common_packages:
- - crudini
-
-service_ovs_name: openvswitch
-service_ovs_agent_name: neutron-openvswitch-agent
-
-service_file:
- src: opendaylight.service
- dst: /lib/systemd/system/opendaylight.service
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-odl_username: admin
-odl_password: admin
-odl_api_port: 8181
-
-# odl_pkg_url: https://nexus.opendaylight.org/content/groups/public/org/
-# opendaylight/integration/distribution-karaf/0.3.0-Lithium/
-# distribution-karaf-0.3.0-Lithium.tar.gz
-odl_pkg_url: distribution-karaf-0.5.2-Boron-SR2.tar.gz
-odl_pkg_name: distribution-karaf-0.5.2-Boron-SR2.tar.gz
-odl_home: "/opt/opendaylight/"
-odl_base_features:
- - config
- - standard
- - region
- - package
- - kar
- - ssh
- - management
- - odl-restconf
- - odl-l2switch-switch
- - odl-openflowplugin-all
- - odl-mdsal-apidocs
- - odl-dlux-all
- - odl-adsal-northbound
- - odl-nsf-all
- - odl-ovsdb-openstack
- - odl-ovsdb-northbound
- - odl-dlux-core
-
-odl_extra_features:
- - odl-restconf-all
- - odl-mdsal-clustering
- - odl-openflowplugin-flow-services
- - http
- - jolokia-osgi
-
-odl_features: "{{ odl_base_features + odl_extra_features }}"
-
-
-jdk8_pkg_name: jdk-8u51-linux-x64.tar.gz
-jdk8_script_name: install_jdk8.tar
-
-common_packages_noarch: []
-
-odl_pip: networking-odl-3.2.0
-
-networking_odl_pkg_name: networking-odl-3.2.0.tar.gz
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
-
----
-- name: restart neutron-server
- service: name=neutron-server state=restarted enabled=yes
- when: inventory_hostname in groups['odl']
-
-- name: add service daemon
- shell: >
- echo keepalived >> /opt/service ;
- echo neutron-server >> /opt/service ;
- when: inventory_hostname in groups['odl']
-
-- name: restart neutron-l3-agent server
- service: name=neutron-l3-agent state=restarted
- when: inventory_hostname in groups['odl'] and odl_l3_agent == "Disable"
-
-- name: restart neutron-dhcp-agent server
- service: name=neutron-dhcp-agent state=restarted
- when: inventory_hostname in groups['odl']
-
-- name: restart neutron-metadata-agent server
- service: name=neutron-metadata-agent state=restarted
- when: inventory_hostname in groups['odl']
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
-
----
-- name: restart opendaylight
- shell: sleep 60; service opendaylight restart; sleep 300;
- when: inventory_hostname in groups['odl']
-
-- name: add service daemon
- shell: echo opendaylight >> /opt/service ;
- when: inventory_hostname in groups['odl']
+++ /dev/null
-[Unit]
-Description=ONOS
-After=
-
-
-[Service]
-User=root
-Group=root
-Type=simple
-WorkingDirectory=/opt/onos/apache-karaf-3.0.5
-PermissionsStartOnly=true
-ExecStartPre=
-ExecStart=/usr/lib/jvm/java-8-oracle/bin/java -server -Xms128M -Xmx512M -XX:+UnlockDiagnosticVMOptions -XX:+UnsyncloadClass -Dcom.sun.management.jmxremote -Djava.endorsed.dirs=/usr/lib/jvm/java-8-oracle/jre/lib/endorsed:/usr/lib/jvm/java-8-oracle/lib/endorsed:/opt/onos/apache-karaf-3.0.5/lib/endorsed -Djava.ext.dirs=/usr/lib/jvm/java-8-oracle/jre/lib/ext:/usr/lib/jvm/java-8-oracle/lib/ext:/opt/onos/apache-karaf-3.0.5/lib/ext -Dkaraf.instances=/opt/onos/apache-karaf-3.0.5/instances -Dkaraf.home=/opt/onos/apache-karaf-3.0.5 -Dkaraf.base=/opt/onos/apache-karaf-3.0.5 -Dkaraf.data=/opt/onos/apache-karaf-3.0.5/data -Dkaraf.etc=/opt/onos/apache-karaf-3.0.5/etc -Djava.io.tmpdir=/opt/onos/apache-karaf-3.0.5/data/tmp -Djava.util.logging.config.file=/opt/onos/apache-karaf-3.0.5/etc/java.util.logging.properties -Dkaraf.startLocalConsole=true -Dkaraf.startRemoteShell=true -classpath /opt/onos/apache-karaf-3.0.5/lib/karaf-jaas-boot.jar:/opt/onos/apache-karaf-3.0.5/lib/karaf-org.osgi.core.jar:/opt/onos/apache-karaf-3.0.5/lib/karaf.jar org.apache.karaf.main.Main
-Restart=on-failure
-LimitNOFILE=65535
-TimeoutStopSec=15
-
-[Install]
-WantedBy=multi-user.target
-
+++ /dev/null
-import logging
-import os
-loggers = {}
-log_dir = "/var/log/setup_network"
-try:
- os.makedirs(log_dir)
-except:
- pass
-
-
-def getLogger(name):
- if name in loggers:
- return loggers[name]
-
- logger = logging.getLogger(name)
- logger.setLevel(logging.DEBUG)
-
- # create file handler which logs even debug messages
- log_file = "%s/%s.log" % (log_dir, name)
- try:
- os.remove(log_file)
- except:
- pass
-
- fh = logging.FileHandler(log_file)
- fh.setLevel(logging.DEBUG)
-
- # create console handler with a higher log level
- ch = logging.StreamHandler()
- ch.setLevel(logging.ERROR)
-
- # create formatter and add it to the handlers
- formatter = logging.Formatter(
- "%(asctime)s - %(name)s - %(levelname)s - %(message)s")
- ch.setFormatter(formatter)
- fh.setFormatter(formatter)
-
- # add the handlers to logger
- logger.addHandler(ch)
- logger.addHandler(fh)
-
- loggers[name] = logger
- return logger
+++ /dev/null
-#!/bin/bash
-## BEGIN INIT INFO
-# Provides: anamon.init
-# Default-Start: 3 5
-# Default-Stop: 0 1 2 4 6
-# Required-Start: $network
-# Short-Description: Starts the cobbler anamon boot notification program
-# Description: anamon runs the first time a machine is booted after
-# installation.
-## END INIT INFO
-
-#
-# anamon.init: Starts the cobbler post-install boot notification program
-#
-# chkconfig: 35 0 6
-#
-# description: anamon runs the first time a machine is booted after
-# installation.
-#
-python /opt/setup_networks/setup_networks.py
+++ /dev/null
-import yaml
-import netaddr
-import os
-import log as logging
-
-LOG = logging.getLogger("net-init")
-config_path = os.path.join(os.path.dirname(__file__), "network.cfg")
-
-
-def setup_bondings(bond_mappings):
- print bond_mappings
-
-
-def add_vlan_link(interface, ifname, vlan_id):
- LOG.info("add_vlan_link enter")
- cmd = "ip link add link %s name %s type vlan id %s; " % (
- ifname, interface, vlan_id)
- cmd += "ip link set %s up; ip link set %s up" % (interface, ifname)
- LOG.info("add_vlan_link: cmd=%s" % cmd)
- os.system(cmd)
-
-
-def add_ovs_port(ovs_br, ifname, uplink, vlan_id=None):
- LOG.info("add_ovs_port enter")
- cmd = "ovs-vsctl --may-exist add-port %s %s" % (ovs_br, ifname)
- if vlan_id:
- cmd += " tag=%s" % vlan_id
- cmd += " -- set Interface %s type=internal;" % ifname
- cmd += "ip link set dev %s address `ip link show %s |awk \
- '/link\/ether/{print $2}'`;" \
- % (ifname, uplink)
- cmd += "ip link set %s up;" % ifname
- LOG.info("add_ovs_port: cmd=%s" % cmd)
- os.system(cmd)
-
-
-def setup_intfs(sys_intf_mappings, uplink_map):
- LOG.info("setup_intfs enter")
- for intf_name, intf_info in sys_intf_mappings.items():
- if intf_info["type"] == "vlan":
- add_vlan_link(
- intf_name,
- intf_info["interface"],
- intf_info["vlan_tag"])
- elif intf_info["type"] == "ovs":
- add_ovs_port(
- intf_info["interface"],
- intf_name,
- uplink_map[intf_info["interface"]],
- vlan_id=intf_info.get("vlan_tag"))
- else:
- pass
-
-
-def setup_ips(ip_settings, sys_intf_mappings):
- LOG.info("setup_ips enter")
- for intf_info in ip_settings.values():
- network = netaddr.IPNetwork(intf_info["cidr"])
- if sys_intf_mappings[intf_info["name"]]["type"] == "ovs":
- intf_name = intf_info["name"]
- else:
- intf_name = intf_info["alias"]
- cmd = "ip addr add %s/%s brd %s dev %s;" \
- % (intf_info["ip"], intf_info["netmask"], str(network.broadcast), intf_name) # noqa: E501
- if "gw" in intf_info:
- cmd += "route del default;"
- cmd += "ip route add default via %s dev %s" % (
- intf_info["gw"], intf_name)
- LOG.info("setup_ips: cmd=%s" % cmd)
- os.system(cmd)
-
-
-def main(config):
- uplink_map = {}
- setup_bondings(config["bond_mappings"])
- for provider_net in config["provider_net_mappings"]:
- uplink_map[provider_net['name']] = provider_net['interface']
-
- setup_intfs(config["sys_intf_mappings"], uplink_map)
- setup_ips(config["ip_settings"], config["sys_intf_mappings"])
-
-if __name__ == "__main__":
- os.system(
- "service openvswitch-switch status|| service openvswitch-switch start")
- config = yaml.load(open(config_path))
- main(config)
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-- name: restart onos service
- service: name=onos state=restarted enabled=yes
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-- include_vars: "{{ ansible_os_family }}.yml"
-
-- name: install onos related packages
- action: "{{ ansible_pkg_mgr }} name={{ item }} state=present"
- with_items: "{{ packages | union(packages_noarch) }}"
- when: groups['onos']|length !=0
-
-- name: remove neutron-openvswitch-agent auto start
- shell: >
- update-rc.d neutron-openvswitch-agent remove;
- sed -i /neutron-openvswitch-agent/d /opt/service
- when: groups['onos']|length !=0
- ignore_errors: "True"
-
-- name: shut down and disable Neutron's agent services
- service: name=neutron-openvswitch-agent state=stopped
- when: groups['onos']|length !=0
- ignore_errors: "True"
-
-- name: remove neutron-l3-agent auto start
- shell: >
- update-rc.d neutron-l3-agent remove;
- sed -i /neutron-l3-agent/d /opt/service
- when: inventory_hostname in groups['onos']
- ignore_errors: "True"
-
-- name: shut down and disable Neutron's l3 agent services
- service: name=neutron-l3-agent state=stopped
- when: inventory_hostname in groups['onos']
- ignore_errors: "True"
-
-- name: Stop the Open vSwitch service and clear existing OVSDB
- shell: >
- service openvswitch-switch stop ;
- rm -rf /var/log/openvswitch/* ;
- rm -rf /etc/openvswitch/conf.db ;
- service openvswitch-switch start ;
- when: groups['onos']|length !=0
- ignore_errors: "True"
-
-##################################################################
-########### Recover External network #################
-##################################################################
-
-- name: add ovs bridge
- openvswitch_bridge: bridge={{ item["name"] }} state=present
- with_items: "{{ network_cfg['provider_net_mappings'] }}"
- when: item["type"] == "ovs" and groups['onos']|length !=0
-
-- name: add ovs uplink
- openvswitch_port: bridge={{ item["name"] }} port={{ item["interface"] }} state=present
- with_items: "{{ network_cfg['provider_net_mappings'] }}"
- when: item["type"] == "ovs" and groups['onos']|length !=0
-
-- name: add ovs uplink
- shell: ip link set {{ item["interface"] }} up
- with_items: "{{ network_cfg['provider_net_mappings'] }}"
- when: item["type"] == "ovs" and groups['onos']|length !=0
-
-- name: ensure script dir exist
- shell: mkdir -p /opt/setup_networks
- when: groups['onos']|length !=0
-
-- name: copy scripts
- copy: src={{ item }} dest=/opt/setup_networks
- with_items:
- - setup_networks/log.py
- - setup_networks/setup_networks.py
- when: groups['onos']|length !=0
-
-- name: copy boot scripts
- copy: src={{ item }} dest=/etc/init.d/ mode=0755
- with_items:
- - setup_networks/net_init
- when: groups['onos']|length !=0
-
-- name: copy config files
- template: src=network.cfg dest=/opt/setup_networks
- when: groups['onos']|length !=0
-
-- name: make sure python lib exist
- action: "{{ ansible_pkg_mgr }} name={{ item }} state=present"
- with_items:
- - python-yaml
- - python-netaddr
- when: groups['onos']|length !=0
-
-- name: run scripts
- shell: python /opt/setup_networks/setup_networks.py
- when: groups['onos']|length !=0
-
-- name: add to boot scripts
- service: name=net_init enabled=yes
- when: groups['onos']|length !=0
-##################################################################
-
-- name: restart keepalived to recover external IP
- shell: service keepalived restart
- when: inventory_hostname in groups['onos']
- ignore_errors: "True"
-
-- name: upgrade pbr
- shell: |
- pip install pbr --upgrade
-
-- name: Install ONOS Cluster on Controller
- include: onos_controller.yml
- when: inventory_hostname in groups['onos'] and onos_sfc == "Disable"
-
-- name: Install ONOS Cluster on Controller
- include: onos_sfc_controller.yml
- when: inventory_hostname in groups['onos'] and onos_sfc == "Enable"
-
-- name: Config ONOS Cluster
- include: openvswitch.yml
- when: groups['onos']|length !=0
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-
-- name: get image http server
- shell: awk -F'=' '/compass_server/ {print $2}' /etc/compass.conf
- register: http_server
-
-- name: download onos driver packages
- get_url:
- url: "http://{{ http_server.stdout_lines[0] }}/packages/onos/{{ onos_driver }}"
- dest: /opt/
-
-- name: unarchive onos driver package
- command: su -s /bin/sh -c "tar xvf /opt/networking-onos.tar -C /opt/"
-
-- name: install onos driver
- command: su -s /bin/sh -c "/opt/networking-onos/install_driver.sh"
-
-- name: download oracle-jdk8 package file
- get_url:
- url: "http://{{ http_server.stdout_lines[0] }}/packages/java/{{ jdk8_pkg_name }}"
- dest: /opt/{{ jdk8_pkg_name }}
-
-- name: install onos required packages
- action: "{{ ansible_pkg_mgr }} name={{ item }} state=present"
- with_items: "{{ packages }}"
-
-- name: download oracle-jdk8 script file
- get_url:
- url: "http://{{ http_server.stdout_lines[0] }}/packages/java/{{ jdk8_script_name }}"
- dest: /opt/
-
-- name: unarchive onos driver package
- command: su -s /bin/sh -c "tar xvf /opt/install_jdk8.tar -C /opt/"
-
-- name: install install_jdk8 package
- command: su -s /bin/sh -c "/opt/install_jdk8/install_jdk8.sh"
-
-- name: create JAVA_HOME environment variable
- shell: >
- export J2SDKDIR=/usr/lib/jvm/java-8-oracle;
- export J2REDIR=/usr/lib/jvm/java-8-oracle/jre;
- export PATH=$PATH:/usr/lib/jvm/java-8-oracle/bin;
- export PATH=$PATH:/usr/lib/jvm/java-8-oracle/db/bin;
- export PATH=$PATH:/usr/lib/jvm/java-8-oracle/jre/bin;
- export JAVA_HOME=/usr/lib/jvm/java-8-oracle;
- export DERBY_HOME=/usr/lib/jvm/java-8-oracle/db;
-
-- name: create onos group
- group: name=onos system=yes state=present
-
-- name: create onos user
- user:
- name: onos
- group: onos
- home: "{{ onos_home }}"
- createhome: "yes"
- system: "yes"
- shell: "/bin/false"
-
-- name: download onos package
- get_url:
- url: "http://{{ http_server.stdout_lines[0] }}/packages/onos/{{ onos_pkg_name }}"
- dest: /opt/{{ onos_pkg_name }}
-
-- name: create new jar repository
- command: su -s /bin/sh -c "mkdir ~/.m2"
- ignore_errors: "True"
-
-- name: download jar repository
- get_url:
- url: "http://{{ http_server.stdout_lines[0] }}/packages/onos/{{ repository }}"
- dest: ~/.m2/
-
-- name: extract jar repository
- command: su -s /bin/sh -c "tar xvf ~/.m2/repository.tar -C ~/.m2/"
-
-- name: extract onos package
- command: |
- su -s /bin/sh -c "tar xzf /opt/{{ onos_pkg_name }} -C {{ onos_home }} \
- --strip-components 1 --no-overwrite-dir -k --skip-old-files" onos
-
-- name: copy onos.service
- copy:
- src: "{{ onos_service_file.src }}"
- dest: "{{ onos_service_file.dst }}"
- mode: 0755
-
-- name: configure onos service
- shell: >
- echo 'export ONOS_OPTS=debug' > {{ onos_home }}/options;
- echo 'export ONOS_USER=root' >> {{ onos_home }}/options;
- mkdir {{ onos_home }}/var;
- mkdir {{ onos_home }}/config;
-
-- name: create karaf config
- template:
- src: org.apache.karaf.features.cfg
- dest: "{{ onos_home }}/{{ karaf_dist }}/etc/org.apache.karaf.features.cfg"
- owner: onos
- group: onos
- mode: 0775
-
-- name: wait for config time
- shell: "sleep 10"
-
-- name: chown onos directory and files
- shell: >
- chown -R onos:onos "{{ onos_home }}";
- chown onos:onos "{{ onos_service_file.dst }}";
-
-- name: start onos service
- service: name=onos state=started enabled=yes
-
-- name: wait for onos start time
- shell: "sleep 200"
-
-- name: add onos auto start
- shell: >
- echo "onos">>/opt/service
-
-- name: Configure Neutron1
- shell: >
- crudini --set /etc/neutron/neutron.conf DEFAULT service_plugins onos_router;
- crudini --set /etc/neutron/plugins/ml2/ml2_conf.ini ml2 \
- mechanism_drivers onos_ml2;
- crudini --set /etc/neutron/plugins/ml2/ml2_conf.ini ml2 \
- tenant_network_types vxlan;
- crudini --set /etc/neutron/plugins/ml2/ml2_conf.ini ml2 type_drivers vxlan
-
-- name: configure metadata
- shell: |
- crudini --set /etc/neutron/dhcp_agent.ini DEFAULT \
- enable_isolated_metadata "True";
-
-- name: force metadata
- shell: |
- crudini --set /etc/neutron/dhcp_agent.ini DEFAULT \
- force_metadata "True";
-
-- name: configure vsctl for dhcp agent
- shell: |
- crudini --set /etc/neutron/dhcp_agent.ini OVS \
- ovsdb_interface vsctl;
-
-- name: Create ML2 Configuration File
- template:
- src: ml2_conf.sh
- dest: "/opt/ml2_conf.sh"
- mode: 0777
-
-- name: Configure Neutron2
- command: su -s /bin/sh -c "/opt/ml2_conf.sh;"
-
-- name: Configure Neutron3
- shell: >
- mysql -e "drop database if exists neutron_ml2;";
- mysql -e "create database neutron_ml2 character set utf8;";
- mysql -e "grant all on neutron_ml2.* to 'neutron'@'%';";
- su -s /bin/sh -c "neutron-db-manage --config-file /etc/neutron/neutron.conf \
- --config-file /etc/neutron/plugins/ml2/ml2_conf.ini upgrade head" \
- neutron;
-
-- name: Restart neutron-dhcp-agent
- service: name=neutron-dhcp-agent state=restarted
-
-- name: Restart neutron-server
- service: name=neutron-server state=restarted
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-
-- name: get image http server
- shell: awk -F'=' '/compass_server/ {print $2}' /etc/compass.conf
- register: http_server
-
-- name: download onos driver packages
- get_url:
- url: "http://{{ http_server.stdout_lines[0] }}/packages/onos/{{ onos_driver }}"
- dest: /opt/
-
-- name: download onos sfc driver package
- get_url:
- url: "http://{{ http_server.stdout_lines[0] }}/packages/onos/{{ onos_sfc_driver }}"
- dest: /opt/
-
-- name: unarchive onos driver package
- command: su -s /bin/sh -c "tar xvf /opt/networking-onos.tar -C /opt/"
-
-- name: unarchive onos sfc driver package
- command: su -s /bin/sh -c "tar xvf /opt/networking-sfc.tar -C /opt/"
-
-- name: install onos driver
- command: su -s /bin/sh -c "/opt/networking-onos/install_driver.sh"
-
-- name: install onos sfc driver
- command: su -s /bin/sh -c "/opt/networking-sfc/install_driver.sh"
-
-- name: install onos required packages
- action: "{{ ansible_pkg_mgr }} name={{ item }} state=present"
- with_items: packages
-
-- name: download oracle-jdk8 package file
- get_url:
- url: "http://{{ http_server.stdout_lines[0] }}/packages/java/{{ jdk8_pkg_name }}"
- dest: /opt/{{ jdk8_pkg_name }}
-
-- name: download oracle-jdk8 script file
- get_url:
- url: "http://{{ http_server.stdout_lines[0] }}/packages/java/{{ jdk8_script_name }}"
- dest: /opt/
-
-- name: unarchive onos driver package
- command: su -s /bin/sh -c "tar xvf /opt/install_jdk8.tar -C /opt/"
-
-- name: install install_jdk8 package
- command: su -s /bin/sh -c "/opt/install_jdk8/install_jdk8.sh"
-
-- name: create JAVA_HOME environment variable
- shell: >
- export J2SDKDIR=/usr/lib/jvm/java-8-oracle;
- export J2REDIR=/usr/lib/jvm/java-8-oracle/jre;
- export PATH=$PATH:/usr/lib/jvm/java-8-oracle/bin;
- export PATH=$PATH:/usr/lib/jvm/java-8-oracle/db/bin;
- export PATH=$PATH:/usr/lib/jvm/java-8-oracle/jre/bin;
- export JAVA_HOME=/usr/lib/jvm/java-8-oracle;
- export DERBY_HOME=/usr/lib/jvm/java-8-oracle/db;
-
-- name: create onos group
- group: name=onos system=yes state=present
-
-- name: create onos user
- user:
- name: onos
- group: onos
- home: "{{ onos_home }}"
- createhome: "yes"
- system: "yes"
- shell: "/bin/false"
-
-- name: download onos package
- get_url:
- url: "http://{{ http_server.stdout_lines[0] }}/packages/onos/{{ onos_pkg_name }}"
- dest: /opt/{{ onos_pkg_name }}
-
-- name: create new jar repository
- command: su -s /bin/sh -c "mkdir ~/.m2"
- ignore_errors: "True"
-
-- name: download jar repository
- get_url:
- url: "http://{{ http_server.stdout_lines[0] }}/packages/onos/{{ repository }}"
- dest: ~/.m2/
-
-- name: extract jar repository
- command: su -s /bin/sh -c "tar xvf ~/.m2/repository.tar -C ~/.m2/"
-
-- name: extract onos package
- command: |
- su -s /bin/sh -c "tar xzf /opt/{{ onos_pkg_name }} -C {{ onos_home }} \
- --strip-components 1 --no-overwrite-dir -k --skip-old-files" onos
-
-- name: configure onos service
- shell: >
- echo 'export ONOS_OPTS=debug' > {{ onos_home }}/options;
- echo 'export ONOS_USER=root' >> {{ onos_home }}/options;
- mkdir {{ onos_home }}/var;
- mkdir {{ onos_home }}/config;
- sed -i '/pre-stop/i\env JAVA_HOME=/usr/lib/jvm/java-8-oracle' {{ onos_home }}/init/onos.conf;
- cp -rf {{ onos_home }}/init/onos.conf /etc/init/;
- cp -rf {{ onos_home }}/init/onos.conf /etc/init.d/;
-
-- name: configure onos boot feature
- shell: >
- sed -i '/^featuresBoot=/c\featuresBoot={{ onos_boot_features }}' \
- {{ onos_home }}/{{ karaf_dist }}/etc/org.apache.karaf.features.cfg;
-
-- name: wait for config time
- shell: "sleep 10"
-
-- name: start onos service
- service: name=onos state=started enabled=yes
-
-- name: wait for onos start time
- shell: "sleep 200"
-
-- name: add onos auto start
- shell: >
- echo "onos">>/opt/service
-
-#########################################################################################
-################################ ONOS connect with OpenStack #######################
-#########################################################################################
-- name: Configure Neutron1
- shell: >
- crudini --set /etc/neutron/neutron.conf DEFAULT service_plugins \
- networking_sfc.services.sfc.plugin.SfcPlugin, \
- networking_sfc.services.flowclassifier.plugin.FlowClassifierPlugin,onos_router;
- crudini --set /etc/neutron/plugins/ml2/ml2_conf.ini ml2 mechanism_drivers onos_ml2;
- crudini --set /etc/neutron/plugins/ml2/ml2_conf.ini ml2 tenant_network_types vxlan;
- crudini --set /etc/neutron/plugins/ml2/ml2_conf.ini ml2 type_drivers vxlan
-
-- name: Create ML2 Configuration File
- template:
- src: ml2_conf.sh
- dest: "/opt/ml2_conf.sh"
- mode: 0777
-
-- name: Configure Neutron2
- command: su -s /bin/sh -c "/opt/ml2_conf.sh;"
-
-- name: Configure Neutron3
- shell: >
- mysql -e "drop database if exists neutron_ml2;";
- mysql -e "create database neutron_ml2 character set utf8;";
- mysql -e "grant all on neutron_ml2.* to 'neutron'@'%';";
- su -s /bin/sh -c "neutron-db-manage --config-file /etc/neutron/neutron.conf \
- --config-file /etc/neutron/plugins/ml2/ml2_conf.ini upgrade head" neutron;
- su -s /bin/sh -c "neutron-db-manage --subproject networking-sfc upgrade head" neutron;
-
-- name: Restart neutron-server
- service: name=neutron-server state=restarted
+++ /dev/null
-###############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-###############################################################################
----
-
-- name: set veth port
- shell: >
- ip link add onos_port1 type veth peer name onos_port2;
- ifconfig onos_port1 up;
- ifconfig onos_port2 up;
- ignore_errors: "True"
-
-- name: set veth to ovs
- shell: >
- export externamMac=`ifconfig eth1 | grep -Eo '\<[0-9a-fA-F]{2}(:[0-9a-fA-F]{2}){5}'`;
- ifconfig onos_port2 hw ether $externamMac;
- ovs-vsctl add-port br-prv onos_port1;
- ignore_errors: "True"
-
-- name: add onos optical model feature
- command: |
- su -s /bin/sh -c "/opt/onos/bin/onos 'feature:install onos-optical-model'";
- when: inventory_hostname in groups['onos']
-
-- name: add openflow-base feature
- command: |
- su -s /bin/sh -c "/opt/onos/bin/onos 'feature:install onos-providers-openflow-base'";
- when: inventory_hostname in groups['onos']
-
-- name: add openflow feature
- command: |
- su -s /bin/sh -c "/opt/onos/bin/onos 'feature:install onos-providers-openflow-message'";
- when: inventory_hostname in groups['onos']
-
-- name: add ovsdb-base feature
- command: |
- su -s /bin/sh -c "/opt/onos/bin/onos 'feature:install onos-providers-ovsdb-base'";
- when: inventory_hostname in groups['onos']
-
-- name: add onos driver ovsdb feature
- command: |
- su -s /bin/sh -c "/opt/onos/bin/onos 'feature:install onos-drivers-ovsdb'";
- when: inventory_hostname in groups['onos']
-
-- name: add ovsdb provider host feature
- command: |
- su -s /bin/sh -c \
- "/opt/onos/bin/onos 'feature:install onos-providers-ovsdb-host'";
- when: inventory_hostname in groups['onos']
-
-- name: add vtn feature
- command: |
- su -s /bin/sh -c \
- "/opt/onos/bin/onos 'feature:install onos-apps-vtn'";
- when: inventory_hostname in groups['onos']
-
-- name: set public eth card start
- command: |
- su -s /bin/sh -c "/opt/onos/bin/onos 'externalportname-set -n onos_port2'"
- when: inventory_hostname in groups['onos']
-
-- name: set ONOS as the manager
- command: |
- su -s /bin/sh -c \
- "ovs-vsctl set-manager \
- tcp:{{ ip_settings[groups['onos'][0]]['mgmt']['ip'] }}:6640;"
-
-- name: delete default gateway
- shell: >
- route delete default;
- when: inventory_hostname not in groups['onos']
- ignore_errors: "True"
+++ /dev/null
-{ "ipPrefix": "{{ ip_settings[groups['onos'][0]]['mgmt']['cidr'] }}",
- "nodes":[
-{% for host in groups['onos'] %}
- {% if loop.last %}
- { "id": "{{ ip_settings[host]['mgmt']['ip'] }}", "ip": "{{ ip_settings[host]['mgmt']['ip'] }}", "tcpPort": 9876 }
- {% else %}
- { "id": "{{ ip_settings[host]['mgmt']['ip'] }}", "ip": "{{ ip_settings[host]['mgmt']['ip'] }}", "tcpPort": 9876 },
- {% endif %}
-{% endfor %}
-]}
+++ /dev/null
-global_defs {
- router_id {{ inventory_hostname }}
-}
-
-vrrp_sync_group VG1 {
- group {
- internal_vip
- public_vip
- }
-}
-
-vrrp_instance internal_vip {
- interface {{ internal_vip.interface }}
- virtual_router_id {{ vrouter_id_internal }}
- state BACKUP
- nopreempt
- advert_int 1
- priority {{ 50 + (host_index[inventory_hostname] * 50) }}
-
- authentication {
- auth_type PASS
- auth_pass 1234
- }
-
- virtual_ipaddress {
- {{ internal_vip.ip }}/{{ internal_vip.netmask }} dev {{ internal_vip.interface }}
- }
-}
-
-vrrp_instance public_vip {
- interface br-ex
- virtual_router_id {{ vrouter_id_public }}
- state BACKUP
- nopreempt
- advert_int 1
- priority {{ 50 + (host_index[inventory_hostname] * 50) }}
-
- authentication {
- auth_type PASS
- auth_pass 4321
- }
-
- virtual_ipaddress {
- {{ network_cfg.public_vip.ip }}/{{ network_cfg.public_vip.netmask }} dev br-ex
- }
-
-}
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
-cat <<EOT>> /etc/neutron/plugins/ml2/ml2_conf.ini
-[onos]
-password = admin
-username = admin
-url_path = http://{{ ip_settings[groups['onos'][0]]['mgmt']['ip'] }}:8181/onos/vtn
-EOT
-
+++ /dev/null
-{%- for alias, intf in host_ip_settings.items() %}
-
-auto {{ alias }}
-iface {{ alias }} inet static
- address {{ intf["ip"] }}
- netmask {{ intf["netmask"] }}
-{% if "gw" in intf %}
- gateway {{ intf["gw"] }}
-{% endif %}
-{% if intf["name"] == alias %}
- pre-up ip link set {{ sys_intf_mappings[alias]["interface"] }} up
- pre-up ip link add link {{ sys_intf_mappings[alias]["interface"] }} name {{ alias }} type vlan id {{ sys_intf_mappings[alias]["vlan_tag"] }}
-{% endif %}
-{% endfor %}
+++ /dev/null
-bond_mappings: {{ network_cfg["bond_mappings"] | to_json }}
-ip_settings: {{ ip_settings[inventory_hostname] | to_json }}
-sys_intf_mappings: {{ sys_intf_mappings | to_json }}
-provider_net_mappings: {{ network_cfg["provider_net_mappings"] | to_json }}
-
+++ /dev/null
-################################################################################
-#
-# Licensed to the Apache Software Foundation (ASF) under one or more
-# contributor license agreements. See the NOTICE file distributed with
-# this work for additional information regarding copyright ownership.
-# The ASF licenses this file to You under the Apache License, Version 2.0
-# (the "License"); you may not use this file except in compliance with
-# the License. You may obtain a copy of the License at
-#
-# http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-#
-################################################################################
-
-#
-# Defines if the startlvl should be respected during feature startup. The default value is true. The default
-# behavior for 2.x is false (!) for this property
-#
-# Be aware that this property is deprecated and will be removed in Karaf 4.0. So, if you need to
-# set this to false, please use this only as a temporary solution!
-#
-#respectStartLvlDuringFeatureStartup=true
-
-
-#
-# Defines if the startlvl should be respected during feature uninstall. The default value is true.
-# If true, means stop bundles respecting the descend order of start level in a certain feature.
-#
-#respectStartLvlDuringFeatureUninstall=true
-
-#
-# Comma separated list of features repositories to register by default
-#
-featuresRepositories=mvn:org.apache.karaf.features/standard/3.0.5/xml/features,mvn:org.onosproject/onos-features/1.8.4/xml/features
-
-#
-# Comma separated list of features to install at startup
-#
-featuresBoot=config,standard,region,package,kar,ssh,management,webconsole,onos-api,onos-core,onos-incubator,onos-cli,onos-rest,onos-gui
-
-#
-# Defines if the boot features are started in asynchronous mode (in a dedicated thread)
-#
-featuresBootAsynchronous=false
+++ /dev/null
-{
- "nodes": [
-{% for host in groups['onos'] %}
- {% if loop.last %}
- {
- "ip": "{{ ip_settings[host]['mgmt']['ip'] }}",
- "id": "{{ ip_settings[host]['mgmt']['ip'] }}",
- "tcpPort": 9876
- }
- {% else %}
- {
- "ip": "{{ ip_settings[host]['mgmt']['ip'] }}",
- "id": "{{ ip_settings[host]['mgmt']['ip'] }}",
- "tcpPort": 9876
- },
- {% endif %}
-{% endfor %}
- ],
- "partitions": {
- {% set key = 1 %}
- {% for host in groups['onos'] %}
- {% if loop.last %}
- "p{{ key }}":[
- {% for host in groups['onos'] %}
- {% if loop.last %}
- {
- "ip": "{{ ip_settings[host]['mgmt']['ip'] }}",
- "id": "{{ ip_settings[host]['mgmt']['ip'] }}",
- "tcpPort": 9876
- }
- {% else %}
- {
- "ip": "{{ ip_settings[host]['mgmt']['ip'] }}",
- "id": "{{ ip_settings[host]['mgmt']['ip'] }}",
- "tcpPort": 9876
- },
- {% endif %}
- {% endfor %}
- ]
- {% set key = key + 1 %}
- {% else %}
- "p{{ key }}":[
- {% for host in groups['onos'] %}
- {% if loop.last %}
- {
- "ip": "{{ ip_settings[host]['mgmt']['ip'] }}",
- "id": "{{ ip_settings[host]['mgmt']['ip'] }}",
- "tcpPort": 9876
- }
- {% else %}
- {
- "ip": "{{ ip_settings[host]['mgmt']['ip'] }}",
- "id": "{{ ip_settings[host]['mgmt']['ip'] }}",
- "tcpPort": 9876
- },
- {% endif %}
- {% endfor %}
- ],
- {% set key = key + 1 %}
- {% endif %}
- {% endfor %}
-}
-}
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-packages:
- - software-properties-common
- - crudini
-
-services: []
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-packages:
- - software-properties-common
- - crudini
-
-services: []
+++ /dev/null
----
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
-packages_noarch: []
-onos_pkg_name: onos-1.8.4.tar.gz
-onos_home: /opt/onos/
-karaf_dist: apache-karaf-3.0.5
-jdk8_pkg_name: jdk-8u51-linux-x64.tar.gz
-jdk8_script_name: install_jdk8.tar
-onos_driver: networking-onos.tar
-onos_sfc_driver: networking-sfc.tar
-repository: repository.tar
-onos_service_file:
- src: onos.service
- dst: /lib/systemd/system/onos.service
-onos_boot_features:
- - config
- - standard
- - region
- - package
- - kar
- - ssh
- - management
- - webconsole
- - onos-api
- - onos-core
- - onos-incubator
- - onos-cli
- - onos-rest
- - onos-gui
- - onos-openflow-base
- - onos-openflow
- - onos-ovsdatabase
- - onos-ovsdb-base
- - onos-drivers-ovsdb
- - onos-ovsdb-provider-host
- - onos-app-vtn-onosfw
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-- name: restart controller relation service
- service: name={{ item }} state=restarted enabled=yes
- ignore_errors: "True"
- with_items: "{{ controller_services }}"
-
-- name: restart compute relation service
- service: name={{ item }} state=restarted enabled=yes
- ignore_errors: "True"
- with_items: "{{ compute_services }}"
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-- include_vars: "{{ ansible_os_family }}.yml"
- tags: secgroup
-
-- debug: msg={{ enable_secgroup }}
- tags: secgroup
-
-- include: secgroup.yml
- when: '{{ enable_secgroup }} == False'
- tags: secgroup
-
-- meta: flush_handlers
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-- name: make sure template dir exits
- file: path=/opt/os_templates state=directory mode=0755
- tags: secgroup
-
-- name: copy configs
- template: src={{ item }} dest=/opt/os_templates
- with_items:
- - nova.j2
- - neutron.j2
- tags: secgroup
-
-- name: update controller configs
- shell: |
- "[ -f '{{ item.1 }}' ] && crudini --merge '{{ item.1 }}' \
- < /opt/os_templates/{{ item.0.src }} || /bin/true"
- tags: secgroup
- with_subelements:
- - "{{ configs_templates }}"
- - dest
- notify: restart controller relation service
- when: inventory_hostname in "{{ groups['controller'] }}"
-
-- name: update compute configs
- shell: |
- "[ -f '{{ item.1 }}' ] && crudini --merge '{{ item.1 }}' \
- < /opt/os_templates/{{ item.0.src }} || /bin/true"
- tags: secgroup
- with_subelements:
- - "{{ configs_templates }}"
- - dest
- notify: restart compute relation service
- when: inventory_hostname in "{{ groups['compute'] }}"
+++ /dev/null
-[securitygroup]
-firewall_driver = neutron.agent.firewall.NoopFirewallDriver
-enable_security_group = True
-
-[agent]
-prevent_arp_spoofing = False
-
+++ /dev/null
-[DEFAULT]
-firewall_driver = nova.virt.firewall.NoopFirewallDriver
-security_group_api = neutron
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-configs_templates:
- - src: nova.j2
- dest:
- - /etc/nova/nova.conf
- - src: neutron.j2
- dest:
- - /etc/neutron/plugins/ml2/ml2_conf.ini
- - /etc/neutron/plugins/openvswitch/ovs_neutron_plugin.ini
- - /etc/neutron/plugins/ml2/restproxy.ini
-
-controller_services:
- - nova-api
- - nova-cert
- - nova-conductor
- - nova-consoleauth
- - nova-novncproxy
- - nova-scheduler
- - neutron-server
- - neutron-openvswitch-agent
- - neutron-l3-agent
- - neutron-dhcp-agent
- - neutron-metadata-agent
-
-compute_services:
- - nova-compute
- - neutron-openvswitch-agent
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-configs_templates:
- - src: nova.j2
- dest:
- - /etc/nova/nova.conf
- - src: neutron.j2
- dest:
- - /etc/neutron/plugins/ml2/ml2_conf.ini
- - /etc/neutron/plugins/openvswitch/ovs_neutron_plugin.ini
- - /etc/neutron/plugins/ml2/restproxy.ini
-
-controller_services:
- - openstack-nova-api
- - openstack-nova-cert
- - openstack-nova-conductor
- - openstack-nova-consoleauth
- - openstack-nova-novncproxy
- - openstack-nova-scheduler
- - neutron-openvswitch-agent
- - neutron-l3-agent
- - neutron-dhcp-agent
- - neutron-metadata-agent
- - neutron-server
-
-compute_services:
- - openstack-nova-compute
- - neutron-openvswitch-agent
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-packages_noarch: []
-metering_secret: 1c5df72079b31fb47747
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
-
-import yaml
-import sys
-import subprocess
-
-import log as logging
-
-LOG = logging.getLogger("net-check")
-
-
-def is_ip_reachable(ip):
- cmd = "ping -c 2 %s" % ip
- process = subprocess.Popen(
- cmd,
- stdout=subprocess.PIPE,
- stderr=None,
- shell=True)
-
- output = process.communicate()[0]
- if " 0% packet loss" in output:
- LOG.info("%s is reachable", ip)
- elif "100% packet loss" in output:
- LOG.error("%s is unreachable" % (ip))
- return False
- else:
- LOG.warn("%r", output)
-
- return True
-
-
-def is_host_ips_reachable(settings):
- external = settings["br-prv"]["ip"]
- external_gw = settings["br-prv"]["gw"]
- storage = settings["storage"]["ip"]
- mgmt = settings["mgmt"]["ip"]
-
- return is_ip_reachable(external) \
- and is_ip_reachable(external_gw) \
- and is_ip_reachable(storage) \
- and is_ip_reachable(mgmt)
-
-
-def main(hostname, config):
- LOG.info("host is %s", hostname)
-
- result = True
-
- for host, settings in config.iteritems():
- LOG.info("check %s network connectivity start", host)
- result = result and is_host_ips_reachable(settings)
-
- if result:
- LOG.info("All hosts ips are reachable")
- else:
- LOG.error("Some hosts ips are unreachable !!!")
- sys.exit(-1)
-
-if __name__ == "__main__":
- hostname = yaml.load(sys.argv[1])
- config = yaml.load(sys.argv[2])
- config.pop(hostname, None)
-
- main(hostname, config)
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
-
-import logging
-import os
-loggers = {}
-log_dir = "/var/log/setup_network"
-try:
- os.makedirs(log_dir)
-except:
- pass
-
-
-def getLogger(name):
- if name in loggers:
- return loggers[name]
-
- logger = logging.getLogger(name)
- logger.setLevel(logging.DEBUG)
-
- # create file handler which logs even debug messages
- log_file = "%s/%s.log" % (log_dir, name)
- try:
- os.remove(log_file)
- except:
- pass
-
- fh = logging.FileHandler(log_file)
- fh.setLevel(logging.DEBUG)
-
- # create console handler with a higher log level
- ch = logging.StreamHandler()
- ch.setLevel(logging.ERROR)
-
- # create formatter and add it to the handlers
- formatter = logging.Formatter(
- "%(asctime)s - %(name)s - %(levelname)s - %(message)s")
- ch.setFormatter(formatter)
- fh.setFormatter(formatter)
-
- # add the handlers to logger
- logger.addHandler(ch)
- logger.addHandler(fh)
-
- loggers[name] = logger
- return logger
+++ /dev/null
-#! /bin/sh
-### BEGIN INIT INFO
-# Provides: anamon.init
-# Required-Start: $network
-# Required-Stop:
-# Should-Start:
-# Should-Stop:
-# Default-Start: 2 3 4 5
-# Default-Stop: 0 1 6
-# Short-Description: Starts the cobbler anamon boot notification program
-# Description: anamon runs the first time a machine is booted after installation.
-### END INIT INFO
-
-
-
-#
-# anamon.init: Starts the cobbler post-install boot notification program
-#
-# chkconfig: 35 0 6
-#
-# description: anamon runs the first time a machine is booted after
-# installation.
-#
-python /opt/setup_networks/setup_networks.py
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
-
-import yaml
-import netaddr
-import os
-import platform
-import re
-import log as logging
-
-LOG = logging.getLogger("net-init")
-config_path = os.path.join(os.path.dirname(__file__), "network.cfg")
-
-
-def setup_bondings(bond_mappings):
- print bond_mappings
-
-
-def add_vlan_link(interface, ifname, vlan_id):
- LOG.info("add_vlan_link enter")
- cmd = "ip link add link %s name %s type vlan id %s; " % (
- ifname, interface, vlan_id)
- cmd += "ip link set %s up; ip link set %s up" % (interface, ifname)
- LOG.info("add_vlan_link: cmd=%s" % cmd)
- os.system(cmd)
-
-
-def add_ovs_port(ovs_br, ifname, uplink, vlan_id=None):
- LOG.info("add_ovs_port enter")
- cmd = "ovs-vsctl --may-exist add-port %s %s" % (ovs_br, ifname)
- if vlan_id:
- cmd += " tag=%s" % vlan_id
- cmd += " -- set Interface %s type=internal;" % ifname
- cmd += "ip link set dev %s address \
- `ip link show %s |awk '/link\/ether/{print $2}'`;" % (ifname, uplink)
- cmd += "ip link set %s up;" % ifname
- LOG.info("add_ovs_port: cmd=%s" % cmd)
- os.system(cmd)
-
-
-def setup_intfs(sys_intf_mappings, uplink_map):
- LOG.info("setup_intfs enter")
- for intf_name, intf_info in sys_intf_mappings.items():
- if intf_info["type"] == "vlan":
- add_vlan_link(
- intf_name,
- intf_info["interface"],
- intf_info["vlan_tag"])
- elif intf_info["type"] == "ovs":
- add_ovs_port(
- intf_info["interface"],
- intf_name,
- uplink_map[intf_info["interface"]],
- vlan_id=intf_info.get("vlan_tag"))
- else:
- pass
-
-
-def setup_ips(ip_settings, sys_intf_mappings):
- LOG.info("setup_ips enter")
- for intf_info in ip_settings.values():
- network = netaddr.IPNetwork(intf_info["cidr"])
- if sys_intf_mappings[intf_info["name"]]["type"] == "ovs":
- intf_name = intf_info["name"]
- else:
- intf_name = intf_info["alias"]
- cmd = "ip addr add %s/%s brd %s dev %s;" \
- % (intf_info["ip"], intf_info["netmask"], str(network.broadcast), intf_name) # noqa
- if "gw" in intf_info:
- cmd += "route del default;"
- cmd += "ip route add default via %s dev %s" % (
- intf_info["gw"], intf_name)
- LOG.info("setup_ips: cmd=%s" % cmd)
- os.system(cmd)
-
-
-def main(config):
- uplink_map = {}
- setup_bondings(config["bond_mappings"])
- for provider_net in config["provider_net_mappings"]:
- uplink_map[provider_net['name']] = provider_net['interface']
-
- setup_intfs(config["sys_intf_mappings"], uplink_map)
- setup_ips(config["ip_settings"], config["sys_intf_mappings"])
-
-if __name__ == "__main__":
- if re.search('Ubuntu', platform.platform()):
- os.system("service openvswitch-switch start")
- elif re.search('redhat|centos', platform.platform()):
- os.system("service openvswitch start")
- else:
- os.system("echo 'ERROR: no service named openvswitch'")
- config = yaml.load(open(config_path))
- main(config)
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-- name: disable NetworkManager
- service: name=NetworkManager state=stopped enabled=no
- when: ansible_os_family == 'RedHat'
-
-- name: enable network service
- service: name=network state=started enabled=yes
- when: ansible_os_family == 'RedHat'
-
-- name: add ovs bridge
- openvswitch_bridge: bridge={{ item["name"] }} state=present
- with_items: "{{ network_cfg['provider_net_mappings'] }}"
- when: 'item["type"] == "ovs"'
-
-- name: add ovs uplink
- openvswitch_port: bridge={{ item["name"] }} port={{ item["interface"] }}
- state=present
- with_items: "{{ network_cfg['provider_net_mappings'] }}"
- when: 'item["type"] == "ovs"'
-
-- name: add ovs uplink
- shell: ip link set {{ item["interface"] }} up
- with_items: "{{ network_cfg['provider_net_mappings'] }}"
- when: 'item["type"] == "ovs"'
-
-- name: ensure script dir exist
- shell: mkdir -p /opt/setup_networks
-
-- name: copy scripts
- copy: src={{ item }} dest=/opt/setup_networks
- with_items:
- - setup_networks/log.py
- - setup_networks/setup_networks.py
- - setup_networks/check_network.py
- tags:
- - network_check
-
-- name: copy boot scripts
- copy: src={{ item }} dest=/etc/init.d/ mode=0755
- with_items:
- - setup_networks/net_init
-
-- name: copy config files
- template: src=network.cfg dest=/opt/setup_networks
-
-- name: make sure python lib exist
- action: "{{ ansible_pkg_mgr }} name={{ item }} state=present"
- with_items:
- - python-yaml
- - python-netaddr
-
-- name: run scripts
- shell: python /opt/setup_networks/setup_networks.py
- tags:
- - recovery
-
-- name: check basic network connectivity
- shell: >
- python /opt/setup_networks/check_network.py \
- "{{ inventory_hostname }}" \
- "{{ ip_settings | to_json }}"
- register: result
- until: result.stderr.find('unreachable')==-1
- retries: 3
- delay: 2
- tags:
- - network_check
-
-- name: add to boot scripts
- shell: update-rc.d net_init defaults
- when: ansible_os_family == "Debian"
-
-- name: add to boot scripts
- shell: |
- chkconfig --add net_init;
- chkconfig --level 2345 net_init on;
- when: ansible_os_family == 'RedHat'
-
-- meta: flush_handlers
+++ /dev/null
-{%- for alias, intf in host_ip_settings.items() %}
-
-auto {{ alias }}
-iface {{ alias }} inet static
- address {{ intf["ip"] }}
- netmask {{ intf["netmask"] }}
-{% if "gw" in intf %}
- gateway {{ intf["gw"] }}
-{% endif %}
-{% if intf["name"] == alias %}
- pre-up ip link set {{ sys_intf_mappings[alias]["interface"] }} up
- pre-up ip link add link {{ sys_intf_mappings[alias]["interface"] }} name {{ alias }} type vlan id {{ sys_intf_mappings[alias]["vlan_tag"] }}
-{% endif %}
-{% endfor %}
+++ /dev/null
-bond_mappings: {{ network_cfg["bond_mappings"] | to_json }}
-ip_settings: {{ ip_settings[inventory_hostname] | to_json }}
-sys_intf_mappings: {{ sys_intf_mappings | to_json }}
-provider_net_mappings: {{ network_cfg["provider_net_mappings"] | to_json }}
-
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
-seek_num=`echo $1 | sed -e 's/.* //g'`
-if [ ! -f /var/storage.img ]; then
- dd if=/dev/zero of=/var/storage.img bs=1 count=0 seek=$seek_num
-fi
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
-size=`df /var | awk '$3 ~ /[0-9]+/ { print $4 }'`;
-if [ $size -gt 2000000000 ]; then
- echo -n 2000000000000;
-else
- echo -n $((size * 1000 / 512 * 512));
-fi
+++ /dev/null
----
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
-physical_device: /dev/loop0
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
-loop_dev=`losetup -a |grep "/var/storage.img"|awk -F':' '{print $1}'`
-if [ -z $loop_dev ]; then
- losetup -f --show /var/storage.img
-else
- echo $loop_dev
-fi
-
+++ /dev/null
-#! /bin/bash
-### BEGIN INIT INFO
-# Provides: Storage
-# Required-Start: $remote_fs $network
-# Required-Stop: $remote_fs $network
-# Default-Start: 2 3 4 5
-# Default-Stop: 0 1 6
-# Description: Storage
-### END INIT INFO
-loop_dev=`sh /opt/setup_storage/losetup.sh`
+++ /dev/null
-[Unit]
-Description=Storage Service
-Before=runlevel2.target runlevel3.target runlevel4.target runlevel5.target shutdown.target
-After=remote-fs.target nss-lookup.target network-online.target time-sync.target network-online.target net_init.service
-Before=ceph.service
-Wants=network-online.target
-Conflicts=shutdown.target
-
-[Service]
-Type=oneshot
-ExecStart=/bin/sh -c "/etc/init.d/storage"
-
-[Install]
-WantedBy=multi-user.target
-
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-
-- name: get available /var partition size
- script: get_var_size.sh
- register: part_size
-
-- name: create image file if not exitst
- script: create_img.sh "{{ part_size.stdout }}"
-
-- name: do a losetup on storage volumes
- script: losetup.sh
- register: loop_device
-
-- name: debug loop device
- debug: msg={{ loop_device.stdout }}
-
-- name: get device
- shell: echo '{{ loop_device.stdout }}' | sed ':a;N;$!ba;s/.*\n\(\/dev\)/\1/g'
- register: loop_device_filterd
-
-- name: create physical and group volumes
- lvg: vg=storage-volumes pvs={{ loop_device_filterd.stdout }}
- vg_options=--force
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-- name: check if physical device exists
- stat: path={{ physical_device }}
- register: status
- tags:
- - storage
-
-- name: load loop.yml
- include: loop.yml
- when: status.stat.exists == False or status.stat.isblk == False
- tags:
- - storage
-
-- name: load real.yml
- include: real.yml
- when: status.stat.exists == True and status.stat.isblk == True
- tags:
- - storage
-
-- name: make setup_storage directory
- file: path=/opt/setup_storage state=directory mode=0755
- tags:
- - storage
-
-- name: copy setup storage scripts
- copy: src={{ item }} dest=/opt/setup_storage mode=0755
- with_items:
- - losetup.sh
- tags:
- - storage
-
-- name: set autostart file
- copy: src=storage dest=/etc/init.d/storage mode=0755
- tags:
- - storage
-
-- name: set autostart file for centos
- copy:
- src: storage.service
- dest: /usr/lib/systemd/system/storage.service
- mode: 0755
- when: ansible_os_family == "RedHat"
- tags:
- - storage
-
-- name: add to boot scripts
- shell: update-rc.d storage defaults
- when: ansible_os_family == "Debian"
- tags:
- - storage
-
-- name: add to boot scripts
- shell: |
- chkconfig --add storage;
- chkconfig --level 2345 storage on;
- when: ansible_os_family == 'RedHat'
- tags:
- - storage
-
-- meta: flush_handlers
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-- name: destroy GPT lable
- shell: dd if=/dev/urandom of={{ physical_device }} bs=4M count=1
- ignore_errors: "True"
-
-- name: create physical and group volumes
- lvg: vg=storage-volumes pvs={{ physical_device }}
- vg_options=--force
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-- include: swift.yml
- when: moon == "Enable"
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-- name: disable auto start
- copy:
- content: "#!/bin/sh\nexit 101"
- dest: "/usr/sbin/policy-rc.d"
- mode: 0755
- when: ansible_os_family == "Debian"
-
-- name: install swift-compute packages
- action: "{{ ansible_pkg_mgr }} name={{ item }} state=present"
- with_items: compute_packages | union(compute_packages_noarch)
-
-- name: enable auto start
- file:
- path=/usr/sbin/policy-rc.d
- state=absent
- when: ansible_os_family == "Debian"
-
-- name: format devices
- shell: >
- dd if=/dev/zero of=/var/swift1 bs=1G count=10;
- dd if=/dev/zero of=/var/swift2 bs=1G count=10;
- mkfs.xfs /var/swift1;
- mkfs.xfs /var/swift2;
-
-- name: create mount point dirertory
- shell: >
- mkdir -p /srv/node/swift1;
- mkdir -p /srv/node/swift2;
-
-- name: edit /etc/fstab
- shell: >
- echo "/var/swift1 /srv/node/swift1/ xfs noatime,nodiratime,nobarrier,logbufs=8 0 2" \
- >> /etc/fstab;
- echo "/var/swift2 /srv/node/swift2/ xfs noatime,nodiratime,nobarrier,logbufs=8 0 2" \
- >> /etc/fstab;
- mount /srv/node/swift1;
- mount /srv/node/swift2;
-
-- name: edit /etc/default/rsync
- shell: sed -i 's/RSYNC_ENABLE=false/RSYNC_ENABLE=true/g' /etc/default/rsync
-
-- name: restart rsync service
- service: name=rsync state=restarted enabled=yes
-
-- name: copy scripts
- template: src={{ item }} dest=/etc/swift/ backup=yes
- with_items:
- - account-server.conf
- - container-server.conf
- - object-server.conf
-
-- name: change directory
- shell: >
- chown -R swift:swift /srv/node;
- mkdir -p /var/cache/swift;
- chown -R root:swift /var/cache/swift;
- chmod -R 775 /var/cache/swift;
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-
-- name: disable auto start
- copy:
- content: "#!/bin/sh\nexit 101"
- dest: "/usr/sbin/policy-rc.d"
- mode: 0755
- when: ansible_os_family == "Debian"
-
-- name: install swift-controllor packages
- action: "{{ ansible_pkg_mgr }} name={{ item }} state=present"
- with_items: controller_packages | union(controller_packages_noarch)
-
-- name: enable auto start
- file:
- path=/usr/sbin/policy-rc.d
- state=absent
- when: ansible_os_family == "Debian"
-
-- name: make swift directory
- file: path=/etc/swift state=directory mode=0755
-
-- name: update proxy-server conf
- template: src=proxy-server.conf dest=/etc/swift/proxy-server.conf backup=yes
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-- name: create account.builder file
- shell: >
- cd /etc/swift;
- swift-ring-builder account.builder create 10 3 1;
-
-- name: add each storage node to the ring
- shell: >
- cd /etc/swift;
- swift-ring-builder account.builder add --region 1 --zone 1 \
- --ip {{ ip_settings[item.1]['mgmt']['ip'] }} --port 6002 \
- --device swift1 --weight 100 ;
- swift-ring-builder account.builder add --region 1 --zone 1 \
- --ip {{ ip_settings[item.1]['mgmt']['ip'] }} --port 6002 \
- --device swift2 --weight 100 ;
- with_indexed_items: groups['compute']
-
-- name: verify the ring contents 1
- shell: >
- cd /etc/swift;
- swift-ring-builder account.builder;
-
-- name: rebalance the ring
- shell: >
- cd /etc/swift;
- swift-ring-builder account.builder rebalance;
-
-- name: create contrainer builder file
- shell: >
- cd /etc/swift;
- swift-ring-builder container.builder create 10 3 1;
-
-- name: add each storage node to the ring
- shell: >
- cd /etc/swift;
- swift-ring-builder container.builder add --region 1 --zone 1 \
- --ip {{ ip_settings[item.1]['mgmt']['ip'] }} --port 6001 \
- --device swift1 --weight 100;
- swift-ring-builder container.builder add --region 1 --zone 1 \
- --ip {{ ip_settings[item.1]['mgmt']['ip'] }} --port 6001 \
- --device swift2 --weight 100;
- with_indexed_items: groups['compute']
-
-- name: verify the ring contents 2
- shell: >
- cd /etc/swift;
- swift-ring-builder container.builder;
-
-- name: rebalance the ring
- shell: >
- cd /etc/swift;
- swift-ring-builder container.builder rebalance;
-
-- name: create object builder file
- shell: >
- cd /etc/swift;
- swift-ring-builder object.builder create 10 3 1;
-
-- name: add each storage node to the ring
- shell: >
- cd /etc/swift;
- swift-ring-builder object.builder add --region 1 --zone 1 \
- --ip {{ ip_settings[item.1]['mgmt']['ip'] }} --port 6000 \
- --device swift1 --weight 100;
- swift-ring-builder object.builder add --region 1 --zone 1 \
- --ip {{ ip_settings[item.1]['mgmt']['ip'] }} --port 6000 \
- --device swift2 --weight 100;
- with_indexed_items: groups['compute']
-
-- name: verify the ring contents
- shell: >
- cd /etc/swift;
- swift-ring-builder object.builder;
-
-- name: rebalance the ring
- shell: >
- cd /etc/swift;
- swift-ring-builder object.builder rebalance;
-
-- name: distribute ring configuration files to the other controller
- shell: >
- cd /etc/swift;
- scp account.ring.gz container.ring.gz object.ring.gz \
- root@{{ ip_settings[item.1]['mgmt']['ip'] }}:/etc/swift/;
- with_indexed_items: groups['controller']
-
-- name: distribute ring configuration files to the all compute
- shell: >
- cd /etc/swift;
- scp account.ring.gz container.ring.gz object.ring.gz \
- root@{{ ip_settings[item.1]['mgmt']['ip'] }}:/etc/swift/;
- with_indexed_items: groups['compute']
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-- include_vars: "{{ ansible_os_family }}.yml"
-
-- include: swift-controller1.yml
- when: inventory_hostname in groups['controller']
-
-- include: swift-compute1.yml
- when: inventory_hostname in groups['compute']
-
-- include: swift-controller2.yml
- when: inventory_hostname == haproxy_hosts.keys()[0]
-
-- name: copy swift.conf
- template: src=swift.conf dest=/etc/swift/swift.conf backup=yes
-
-- name: chown /etc/swift
- shell: chown -R root:swift /etc/swift
-
-- name: restart tasks on controller
- service: name={{ item }} state=restarted enabled=yes
- with_items:
- - memcached
- - swift-proxy
- when: inventory_hostname in groups['controller']
-
-- name: restart tasks on compute
- shell: swift-init all start
- when: inventory_hostname in groups['compute']
- ignore_errors: "True"
-
-- name: restart tasks on controller
- service: name={{ item }} state=restarted enabled=yes
- with_items:
- - rsync
- when: inventory_hostname in groups['compute']
-
-- name: upload swift lib
- unarchive: src=swift-lib.tar.gz dest=/tmp/
-
-- name: copy swift lib
- command: su -s /bin/sh -c "cp /tmp/swift-lib/* /usr/lib/"
-
-- name: wait 30 seconds
- shell: sleep 30
-
-- name: create swift task script
- shell: echo {{ item }} >> /opt/swift-service
- with_items:
- - swift-account
- - swift-account-replicator
- - swift-container-replicator
- - swift-object
- - swift-object-updater
- - swift-account-auditor
- - swift-container
- - swift-container-sync
- - swift-object-auditor
- - swift-account-reaper
- - swift-container-auditor
- - swift-container-updater
- - swift-object-replicator
- when: inventory_hostname in groups['compute']
- ignore_errors: "True"
-
-- name: restart swift task
- shell: >
- for i in `cat /opt/swift-service`; do service $i start; done;
- sleep 10;
- for i in `cat /opt/swift-service`; do service $i restart; done;
- when: inventory_hostname in groups['compute']
- ignore_errors: "True"
+++ /dev/null
-[DEFAULT]
-bind_ip = {{ internal_ip }}
-bind_port = 6002
-# bind_timeout = 30
-# backlog = 4096
-user = swift
-swift_dir = /etc/swift
-devices = /srv/node
-mount_check = true
-# disable_fallocate = false
-#
-# Use an integer to override the number of pre-forked processes that will
-# accept connections.
-# workers = auto
-#
-# Maximum concurrent requests per worker
-# max_clients = 1024
-#
-# You can specify default log routing here if you want:
-# log_name = swift
-# log_facility = LOG_LOCAL0
-# log_level = INFO
-# log_address = /dev/log
-# The following caps the length of log lines to the value given; no limit if
-# set to 0, the default.
-# log_max_line_length = 0
-#
-# comma separated list of functions to call to setup custom log handlers.
-# functions get passed: conf, name, log_to_console, log_route, fmt, logger,
-# adapted_logger
-# log_custom_handlers =
-#
-# If set, log_udp_host will override log_address
-# log_udp_host =
-# log_udp_port = 514
-#
-# You can enable StatsD logging here:
-# log_statsd_host =
-# log_statsd_port = 8125
-# log_statsd_default_sample_rate = 1.0
-# log_statsd_sample_rate_factor = 1.0
-# log_statsd_metric_prefix =
-#
-# If you don't mind the extra disk space usage in overhead, you can turn this
-# on to preallocate disk space with SQLite databases to decrease fragmentation.
-# db_preallocation = off
-#
-# eventlet_debug = false
-#
-# You can set fallocate_reserve to the number of bytes you'd like fallocate to
-# reserve, whether there is space for the given file size or not.
-# fallocate_reserve = 0
-
-[pipeline:main]
-pipeline = healthcheck recon account-server
-
-[app:account-server]
-use = egg:swift#account
-# You can override the default log routing for this app here:
-# set log_name = account-server
-# set log_facility = LOG_LOCAL0
-# set log_level = INFO
-# set log_requests = true
-# set log_address = /dev/log
-#
-# auto_create_account_prefix = .
-#
-# Configure parameter for creating specific server
-# To handle all verbs, including replication verbs, do not specify
-# "replication_server" (this is the default). To only handle replication,
-# set to a True value (e.g. "True" or "1"). To handle only non-replication
-# verbs, set to "False". Unless you have a separate replication network, you
-# should not specify any value for "replication_server". Default is empty.
-# replication_server = false
-
-[filter:healthcheck]
-use = egg:swift#healthcheck
-# An optional filesystem path, which if present, will cause the healthcheck
-# URL to return "503 Service Unavailable" with a body of "DISABLED BY FILE"
-# disable_path =
-
-[filter:recon]
-use = egg:swift#recon
-recon_cache_path = /var/cache/swift
-
-[account-replicator]
-# You can override the default log routing for this app here (don't use set!):
-# log_name = account-replicator
-# log_facility = LOG_LOCAL0
-# log_level = INFO
-# log_address = /dev/log
-#
-# Maximum number of database rows that will be sync'd in a single HTTP
-# replication request. Databases with less than or equal to this number of
-# differing rows will always be sync'd using an HTTP replication request rather
-# than using rsync.
-# per_diff = 1000
-#
-# Maximum number of HTTP replication requests attempted on each replication
-# pass for any one container. This caps how long the replicator will spend
-# trying to sync a given database per pass so the other databases don't get
-# starved.
-# max_diffs = 100
-#
-# Number of replication workers to spawn.
-# concurrency = 8
-#
-# Time in seconds to wait between replication passes
-# interval = 30
-# run_pause is deprecated, use interval instead
-# run_pause = 30
-#
-# node_timeout = 10
-# conn_timeout = 0.5
-#
-# The replicator also performs reclamation
-# reclaim_age = 604800
-#
-# Allow rsync to compress data which is transmitted to destination node
-# during sync. However, this is applicable only when destination node is in
-# a different region than the local one.
-# rsync_compress = no
-#
-# Format of the rysnc module where the replicator will send data. See
-# etc/rsyncd.conf-sample for some usage examples.
-# rsync_module = {replication_ip}::account
-#
-# recon_cache_path = /var/cache/swift
-
-[account-auditor]
-# You can override the default log routing for this app here (don't use set!):
-# log_name = account-auditor
-# log_facility = LOG_LOCAL0
-# log_level = INFO
-# log_address = /dev/log
-#
-# Will audit each account at most once per interval
-# interval = 1800
-#
-# accounts_per_second = 200
-# recon_cache_path = /var/cache/swift
-
-[account-reaper]
-# You can override the default log routing for this app here (don't use set!):
-# log_name = account-reaper
-# log_facility = LOG_LOCAL0
-# log_level = INFO
-# log_address = /dev/log
-#
-# concurrency = 25
-# interval = 3600
-# node_timeout = 10
-# conn_timeout = 0.5
-#
-# Normally, the reaper begins deleting account information for deleted accounts
-# immediately; you can set this to delay its work however. The value is in
-# seconds; 2592000 = 30 days for example.
-# delay_reaping = 0
-#
-# If the account fails to be be reaped due to a persistent error, the
-# account reaper will log a message such as:
-# Account <name> has not been reaped since <date>
-# You can search logs for this message if space is not being reclaimed
-# after you delete account(s).
-# Default is 2592000 seconds (30 days). This is in addition to any time
-# requested by delay_reaping.
-# reap_warn_after = 2592000
-
-# Note: Put it at the beginning of the pipeline to profile all middleware. But
-# it is safer to put this after healthcheck.
-[filter:xprofile]
-use = egg:swift#xprofile
-# This option enable you to switch profilers which should inherit from python
-# standard profiler. Currently the supported value can be 'cProfile',
-# 'eventlet.green.profile' etc.
-# profile_module = eventlet.green.profile
-#
-# This prefix will be used to combine process ID and timestamp to name the
-# profile data file. Make sure the executing user has permission to write
-# into this path (missing path segments will be created, if necessary).
-# If you enable profiling in more than one type of daemon, you must override
-# it with an unique value like: /var/log/swift/profile/account.profile
-# log_filename_prefix = /tmp/log/swift/profile/default.profile
-#
-# the profile data will be dumped to local disk based on above naming rule
-# in this interval.
-# dump_interval = 5.0
-#
-# Be careful, this option will enable profiler to dump data into the file with
-# time stamp which means there will be lots of files piled up in the directory.
-# dump_timestamp = false
-#
-# This is the path of the URL to access the mini web UI.
-# path = /__profile__
-#
-# Clear the data when the wsgi server shutdown.
-# flush_at_shutdown = false
-#
-# unwind the iterator of applications
-# unwind = false
+++ /dev/null
-[DEFAULT]
-bind_ip = {{ internal_ip }}
-bind_port = 6001
-# bind_timeout = 30
-# backlog = 4096
-user = swift
-swift_dir = /etc/swift
-devices = /srv/node
-mount_check = true
-# disable_fallocate = false
-#
-# Use an integer to override the number of pre-forked processes that will
-# accept connections.
-# workers = auto
-#
-# Maximum concurrent requests per worker
-# max_clients = 1024
-#
-# This is a comma separated list of hosts allowed in the X-Container-Sync-To
-# field for containers. This is the old-style of using container sync. It is
-# strongly recommended to use the new style of a separate
-# container-sync-realms.conf -- see container-sync-realms.conf-sample
-# allowed_sync_hosts = 127.0.0.1
-#
-# You can specify default log routing here if you want:
-# log_name = swift
-# log_facility = LOG_LOCAL0
-# log_level = INFO
-# log_address = /dev/log
-# The following caps the length of log lines to the value given; no limit if
-# set to 0, the default.
-# log_max_line_length = 0
-#
-# comma separated list of functions to call to setup custom log handlers.
-# functions get passed: conf, name, log_to_console, log_route, fmt, logger,
-# adapted_logger
-# log_custom_handlers =
-#
-# If set, log_udp_host will override log_address
-# log_udp_host =
-# log_udp_port = 514
-#
-# You can enable StatsD logging here:
-# log_statsd_host =
-# log_statsd_port = 8125
-# log_statsd_default_sample_rate = 1.0
-# log_statsd_sample_rate_factor = 1.0
-# log_statsd_metric_prefix =
-#
-# If you don't mind the extra disk space usage in overhead, you can turn this
-# on to preallocate disk space with SQLite databases to decrease fragmentation.
-# db_preallocation = off
-#
-# eventlet_debug = false
-#
-# You can set fallocate_reserve to the number of bytes you'd like fallocate to
-# reserve, whether there is space for the given file size or not.
-# fallocate_reserve = 0
-
-[pipeline:main]
-pipeline = healthcheck recon container-server
-
-[app:container-server]
-use = egg:swift#container
-# You can override the default log routing for this app here:
-# set log_name = container-server
-# set log_facility = LOG_LOCAL0
-# set log_level = INFO
-# set log_requests = true
-# set log_address = /dev/log
-#
-# node_timeout = 3
-# conn_timeout = 0.5
-# allow_versions = false
-# auto_create_account_prefix = .
-#
-# Configure parameter for creating specific server
-# To handle all verbs, including replication verbs, do not specify
-# "replication_server" (this is the default). To only handle replication,
-# set to a True value (e.g. "True" or "1"). To handle only non-replication
-# verbs, set to "False". Unless you have a separate replication network, you
-# should not specify any value for "replication_server".
-# replication_server = false
-
-[filter:healthcheck]
-use = egg:swift#healthcheck
-# An optional filesystem path, which if present, will cause the healthcheck
-# URL to return "503 Service Unavailable" with a body of "DISABLED BY FILE"
-# disable_path =
-
-[filter:recon]
-use = egg:swift#recon
-recon_cache_path = /var/cache/swift
-
-[container-replicator]
-# You can override the default log routing for this app here (don't use set!):
-# log_name = container-replicator
-# log_facility = LOG_LOCAL0
-# log_level = INFO
-# log_address = /dev/log
-#
-# Maximum number of database rows that will be sync'd in a single HTTP
-# replication request. Databases with less than or equal to this number of
-# differing rows will always be sync'd using an HTTP replication request rather
-# than using rsync.
-# per_diff = 1000
-#
-# Maximum number of HTTP replication requests attempted on each replication
-# pass for any one container. This caps how long the replicator will spend
-# trying to sync a given database per pass so the other databases don't get
-# starved.
-# max_diffs = 100
-#
-# Number of replication workers to spawn.
-# concurrency = 8
-#
-# Time in seconds to wait between replication passes
-# interval = 30
-# run_pause is deprecated, use interval instead
-# run_pause = 30
-#
-# node_timeout = 10
-# conn_timeout = 0.5
-#
-# The replicator also performs reclamation
-# reclaim_age = 604800
-#
-# Allow rsync to compress data which is transmitted to destination node
-# during sync. However, this is applicable only when destination node is in
-# a different region than the local one.
-# rsync_compress = no
-#
-# Format of the rysnc module where the replicator will send data. See
-# etc/rsyncd.conf-sample for some usage examples.
-# rsync_module = {replication_ip}::container
-#
-# recon_cache_path = /var/cache/swift
-
-[container-updater]
-# You can override the default log routing for this app here (don't use set!):
-# log_name = container-updater
-# log_facility = LOG_LOCAL0
-# log_level = INFO
-# log_address = /dev/log
-#
-# interval = 300
-# concurrency = 4
-# node_timeout = 3
-# conn_timeout = 0.5
-#
-# slowdown will sleep that amount between containers
-# slowdown = 0.01
-#
-# Seconds to suppress updating an account that has generated an error
-# account_suppression_time = 60
-#
-# recon_cache_path = /var/cache/swift
-
-[container-auditor]
-# You can override the default log routing for this app here (don't use set!):
-# log_name = container-auditor
-# log_facility = LOG_LOCAL0
-# log_level = INFO
-# log_address = /dev/log
-#
-# Will audit each container at most once per interval
-# interval = 1800
-#
-# containers_per_second = 200
-# recon_cache_path = /var/cache/swift
-
-[container-sync]
-# You can override the default log routing for this app here (don't use set!):
-# log_name = container-sync
-# log_facility = LOG_LOCAL0
-# log_level = INFO
-# log_address = /dev/log
-#
-# If you need to use an HTTP Proxy, set it here; defaults to no proxy.
-# You can also set this to a comma separated list of HTTP Proxies and they will
-# be randomly used (simple load balancing).
-# sync_proxy = http://10.1.1.1:8888,http://10.1.1.2:8888
-#
-# Will sync each container at most once per interval
-# interval = 300
-#
-# Maximum amount of time to spend syncing each container per pass
-# container_time = 60
-#
-# Maximum amount of time in seconds for the connection attempt
-# conn_timeout = 5
-# Server errors from requests will be retried by default
-# request_tries = 3
-#
-# Internal client config file path
-# internal_client_conf_path = /etc/swift/internal-client.conf
-
-# Note: Put it at the beginning of the pipeline to profile all middleware. But
-# it is safer to put this after healthcheck.
-[filter:xprofile]
-use = egg:swift#xprofile
-# This option enable you to switch profilers which should inherit from python
-# standard profiler. Currently the supported value can be 'cProfile',
-# 'eventlet.green.profile' etc.
-# profile_module = eventlet.green.profile
-#
-# This prefix will be used to combine process ID and timestamp to name the
-# profile data file. Make sure the executing user has permission to write
-# into this path (missing path segments will be created, if necessary).
-# If you enable profiling in more than one type of daemon, you must override
-# it with an unique value like: /var/log/swift/profile/container.profile
-# log_filename_prefix = /tmp/log/swift/profile/default.profile
-#
-# the profile data will be dumped to local disk based on above naming rule
-# in this interval.
-# dump_interval = 5.0
-#
-# Be careful, this option will enable profiler to dump data into the file with
-# time stamp which means there will be lots of files piled up in the directory.
-# dump_timestamp = false
-#
-# This is the path of the URL to access the mini web UI.
-# path = /__profile__
-#
-# Clear the data when the wsgi server shutdown.
-# flush_at_shutdown = false
-#
-# unwind the iterator of applications
-# unwind = false
+++ /dev/null
-[DEFAULT]
-bind_ip = {{ internal_ip }}
-bind_port = 6000
-# bind_timeout = 30
-# backlog = 4096
-user = swift
-swift_dir = /etc/swift
-devices = /srv/node
-mount_check = true
-# disable_fallocate = false
-# expiring_objects_container_divisor = 86400
-# expiring_objects_account_name = expiring_objects
-#
-# Use an integer to override the number of pre-forked processes that will
-# accept connections. NOTE: if servers_per_port is set, this setting is
-# ignored.
-# workers = auto
-#
-# Make object-server run this many worker processes per unique port of
-# "local" ring devices across all storage policies. This can help provide
-# the isolation of threads_per_disk without the severe overhead. The default
-# value of 0 disables this feature.
-# servers_per_port = 0
-#
-# Maximum concurrent requests per worker
-# max_clients = 1024
-#
-# You can specify default log routing here if you want:
-# log_name = swift
-# log_facility = LOG_LOCAL0
-# log_level = INFO
-# log_address = /dev/log
-# The following caps the length of log lines to the value given; no limit if
-# set to 0, the default.
-# log_max_line_length = 0
-#
-# comma separated list of functions to call to setup custom log handlers.
-# functions get passed: conf, name, log_to_console, log_route, fmt, logger,
-# adapted_logger
-# log_custom_handlers =
-#
-# If set, log_udp_host will override log_address
-# log_udp_host =
-# log_udp_port = 514
-#
-# You can enable StatsD logging here:
-# log_statsd_host =
-# log_statsd_port = 8125
-# log_statsd_default_sample_rate = 1.0
-# log_statsd_sample_rate_factor = 1.0
-# log_statsd_metric_prefix =
-#
-# eventlet_debug = false
-#
-# You can set fallocate_reserve to the number of bytes you'd like fallocate to
-# reserve, whether there is space for the given file size or not.
-# fallocate_reserve = 0
-#
-# Time to wait while attempting to connect to another backend node.
-# conn_timeout = 0.5
-# Time to wait while sending each chunk of data to another backend node.
-# node_timeout = 3
-# Time to wait while sending a container update on object update.
-# container_update_timeout = 1.0
-# Time to wait while receiving each chunk of data from a client or another
-# backend node.
-# client_timeout = 60
-#
-# network_chunk_size = 65536
-# disk_chunk_size = 65536
-
-[pipeline:main]
-pipeline = healthcheck recon object-server
-
-[app:object-server]
-use = egg:swift#object
-# You can override the default log routing for this app here:
-# set log_name = object-server
-# set log_facility = LOG_LOCAL0
-# set log_level = INFO
-# set log_requests = true
-# set log_address = /dev/log
-#
-# max_upload_time = 86400
-#
-# slow is the total amount of seconds an object PUT/DELETE request takes at
-# least. If it is faster, the object server will sleep this amount of time minus
-# the already passed transaction time. This is only useful for simulating slow
-# devices on storage nodes during testing and development.
-# slow = 0
-#
-# Objects smaller than this are not evicted from the buffercache once read
-# keep_cache_size = 5242880
-#
-# If true, objects for authenticated GET requests may be kept in buffer cache
-# if small enough
-# keep_cache_private = false
-#
-# on PUTs, sync data every n MB
-# mb_per_sync = 512
-#
-# Comma separated list of headers that can be set in metadata on an object.
-# This list is in addition to X-Object-Meta-* headers and cannot include
-# Content-Type, etag, Content-Length, or deleted
-# allowed_headers = Content-Disposition, Content-Encoding, X-Delete-At, X-Object-Manifest, X-Static-Large-Object
-#
-# auto_create_account_prefix = .
-#
-# A value of 0 means "don't use thread pools". A reasonable starting point is
-# 4.
-# threads_per_disk = 0
-#
-# Configure parameter for creating specific server
-# To handle all verbs, including replication verbs, do not specify
-# "replication_server" (this is the default). To only handle replication,
-# set to a True value (e.g. "True" or "1"). To handle only non-replication
-# verbs, set to "False". Unless you have a separate replication network, you
-# should not specify any value for "replication_server".
-# replication_server = false
-#
-# Set to restrict the number of concurrent incoming SSYNC requests
-# Set to 0 for unlimited
-# Note that SSYNC requests are only used by the object reconstructor or the
-# object replicator when configured to use ssync.
-# replication_concurrency = 4
-#
-# Restricts incoming SSYNC requests to one per device,
-# replication_currency above allowing. This can help control I/O to each
-# device, but you may wish to set this to False to allow multiple SSYNC
-# requests (up to the above replication_concurrency setting) per device.
-# replication_one_per_device = True
-#
-# Number of seconds to wait for an existing replication device lock before
-# giving up.
-# replication_lock_timeout = 15
-#
-# These next two settings control when the SSYNC subrequest handler will
-# abort an incoming SSYNC attempt. An abort will occur if there are at
-# least threshold number of failures and the value of failures / successes
-# exceeds the ratio. The defaults of 100 and 1.0 means that at least 100
-# failures have to occur and there have to be more failures than successes for
-# an abort to occur.
-# replication_failure_threshold = 100
-# replication_failure_ratio = 1.0
-#
-# Use splice() for zero-copy object GETs. This requires Linux kernel
-# version 3.0 or greater. If you set "splice = yes" but the kernel
-# does not support it, error messages will appear in the object server
-# logs at startup, but your object servers should continue to function.
-#
-# splice = no
-
-[filter:healthcheck]
-use = egg:swift#healthcheck
-# An optional filesystem path, which if present, will cause the healthcheck
-# URL to return "503 Service Unavailable" with a body of "DISABLED BY FILE"
-# disable_path =
-
-[filter:recon]
-use = egg:swift#recon
-recon_cache_path = /var/cache/swift
-recon_lock_path = /var/lock
-
-[object-replicator]
-# You can override the default log routing for this app here (don't use set!):
-# log_name = object-replicator
-# log_facility = LOG_LOCAL0
-# log_level = INFO
-# log_address = /dev/log
-#
-# daemonize = on
-#
-# Time in seconds to wait between replication passes
-# interval = 30
-# run_pause is deprecated, use interval instead
-# run_pause = 30
-#
-# concurrency = 1
-# stats_interval = 300
-#
-# default is rsync, alternative is ssync
-# sync_method = rsync
-#
-# max duration of a partition rsync
-# rsync_timeout = 900
-#
-# bandwidth limit for rsync in kB/s. 0 means unlimited
-# rsync_bwlimit = 0
-#
-# passed to rsync for io op timeout
-# rsync_io_timeout = 30
-#
-# Allow rsync to compress data which is transmitted to destination node
-# during sync. However, this is applicable only when destination node is in
-# a different region than the local one.
-# NOTE: Objects that are already compressed (for example: .tar.gz, .mp3) might
-# slow down the syncing process.
-# rsync_compress = no
-#
-# Format of the rysnc module where the replicator will send data. See
-# etc/rsyncd.conf-sample for some usage examples.
-# rsync_module = {replication_ip}::object
-#
-# node_timeout = <whatever's in the DEFAULT section or 10>
-# max duration of an http request; this is for REPLICATE finalization calls and
-# so should be longer than node_timeout
-# http_timeout = 60
-#
-# attempts to kill all workers if nothing replicates for lockup_timeout seconds
-# lockup_timeout = 1800
-#
-# The replicator also performs reclamation
-# reclaim_age = 604800
-#
-# ring_check_interval = 15
-# recon_cache_path = /var/cache/swift
-#
-# limits how long rsync error log lines are
-# 0 means to log the entire line
-# rsync_error_log_line_length = 0
-#
-# handoffs_first and handoff_delete are options for a special case
-# such as disk full in the cluster. These two options SHOULD NOT BE
-# CHANGED, except for such an extreme situations. (e.g. disks filled up
-# or are about to fill up. Anyway, DO NOT let your drives fill up)
-# handoffs_first is the flag to replicate handoffs prior to canonical
-# partitions. It allows to force syncing and deleting handoffs quickly.
-# If set to a True value(e.g. "True" or "1"), partitions
-# that are not supposed to be on the node will be replicated first.
-# handoffs_first = False
-#
-# handoff_delete is the number of replicas which are ensured in swift.
-# If the number less than the number of replicas is set, object-replicator
-# could delete local handoffs even if all replicas are not ensured in the
-# cluster. Object-replicator would remove local handoff partition directories
-# after syncing partition when the number of successful responses is greater
-# than or equal to this number. By default(auto), handoff partitions will be
-# removed when it has successfully replicated to all the canonical nodes.
-# handoff_delete = auto
-
-[object-reconstructor]
-# You can override the default log routing for this app here (don't use set!):
-# Unless otherwise noted, each setting below has the same meaning as described
-# in the [object-replicator] section, however these settings apply to the EC
-# reconstructor
-#
-# log_name = object-reconstructor
-# log_facility = LOG_LOCAL0
-# log_level = INFO
-# log_address = /dev/log
-#
-# daemonize = on
-#
-# Time in seconds to wait between reconstruction passes
-# interval = 30
-# run_pause is deprecated, use interval instead
-# run_pause = 30
-#
-# concurrency = 1
-# stats_interval = 300
-# node_timeout = 10
-# http_timeout = 60
-# lockup_timeout = 1800
-# reclaim_age = 604800
-# ring_check_interval = 15
-# recon_cache_path = /var/cache/swift
-# handoffs_first = False
-
-[object-updater]
-# You can override the default log routing for this app here (don't use set!):
-# log_name = object-updater
-# log_facility = LOG_LOCAL0
-# log_level = INFO
-# log_address = /dev/log
-#
-# interval = 300
-# concurrency = 1
-# node_timeout = <whatever's in the DEFAULT section or 10>
-# slowdown will sleep that amount between objects
-# slowdown = 0.01
-#
-# recon_cache_path = /var/cache/swift
-
-[object-auditor]
-# You can override the default log routing for this app here (don't use set!):
-# log_name = object-auditor
-# log_facility = LOG_LOCAL0
-# log_level = INFO
-# log_address = /dev/log
-#
-# Time in seconds to wait between auditor passes
-# interval = 30
-#
-# You can set the disk chunk size that the auditor uses making it larger if
-# you like for more efficient local auditing of larger objects
-# disk_chunk_size = 65536
-# files_per_second = 20
-# concurrency = 1
-# bytes_per_second = 10000000
-# log_time = 3600
-# zero_byte_files_per_second = 50
-# recon_cache_path = /var/cache/swift
-
-# Takes a comma separated list of ints. If set, the object auditor will
-# increment a counter for every object whose size is <= to the given break
-# points and report the result after a full scan.
-# object_size_stats =
-
-# The auditor will cleanup old rsync tempfiles after they are "old
-# enough" to delete. You can configure the time elapsed in seconds
-# before rsync tempfiles will be unlinked, or the default value of
-# "auto" try to use object-replicator's rsync_timeout + 900 and fallback
-# to 86400 (1 day).
-# rsync_tempfile_timeout = auto
-
-# Note: Put it at the beginning of the pipleline to profile all middleware. But
-# it is safer to put this after healthcheck.
-[filter:xprofile]
-use = egg:swift#xprofile
-# This option enable you to switch profilers which should inherit from python
-# standard profiler. Currently the supported value can be 'cProfile',
-# 'eventlet.green.profile' etc.
-# profile_module = eventlet.green.profile
-#
-# This prefix will be used to combine process ID and timestamp to name the
-# profile data file. Make sure the executing user has permission to write
-# into this path (missing path segments will be created, if necessary).
-# If you enable profiling in more than one type of daemon, you must override
-# it with an unique value like: /var/log/swift/profile/object.profile
-# log_filename_prefix = /tmp/log/swift/profile/default.profile
-#
-# the profile data will be dumped to local disk based on above naming rule
-# in this interval.
-# dump_interval = 5.0
-#
-# Be careful, this option will enable profiler to dump data into the file with
-# time stamp which means there will be lots of files piled up in the directory.
-# dump_timestamp = false
-#
-# This is the path of the URL to access the mini web UI.
-# path = /__profile__
-#
-# Clear the data when the wsgi server shutdown.
-# flush_at_shutdown = false
-#
-# unwind the iterator of applications
-# unwind = false
+++ /dev/null
-{% set memcached_servers = [] %}
-{% for host in haproxy_hosts.values() %}
-{% set _ = memcached_servers.append('%s:11211'% host) %}
-{% endfor %}
-{% set memcached_servers = memcached_servers|join(',') %}
-[DEFAULT]
-bind_ip = {{ internal_ip }}
-bind_port = 8080
-# bind_timeout = 30
-# backlog = 4096
-swift_dir = /etc/swift
-user = swift
-
-# Enables exposing configuration settings via HTTP GET /info.
-# expose_info = true
-
-# Key to use for admin calls that are HMAC signed. Default is empty,
-# which will disable admin calls to /info.
-# admin_key = secret_admin_key
-#
-# Allows the ability to withhold sections from showing up in the public calls
-# to /info. You can withhold subsections by separating the dict level with a
-# ".". The following would cause the sections 'container_quotas' and 'tempurl'
-# to not be listed, and the key max_failed_deletes would be removed from
-# bulk_delete. Default value is 'swift.valid_api_versions' which allows all
-# registered features to be listed via HTTP GET /info except
-# swift.valid_api_versions information
-# disallowed_sections = swift.valid_api_versions, container_quotas, tempurl
-
-# Use an integer to override the number of pre-forked processes that will
-# accept connections. Should default to the number of effective cpu
-# cores in the system. It's worth noting that individual workers will
-# use many eventlet co-routines to service multiple concurrent requests.
-# workers = auto
-#
-# Maximum concurrent requests per worker
-# max_clients = 1024
-#
-# Set the following two lines to enable SSL. This is for testing only.
-# cert_file = /etc/swift/proxy.crt
-# key_file = /etc/swift/proxy.key
-#
-# expiring_objects_container_divisor = 86400
-# expiring_objects_account_name = expiring_objects
-#
-# You can specify default log routing here if you want:
-# log_name = swift
-# log_facility = LOG_LOCAL0
-# log_level = INFO
-# log_headers = false
-# log_address = /dev/log
-# The following caps the length of log lines to the value given; no limit if
-# set to 0, the default.
-# log_max_line_length = 0
-#
-# This optional suffix (default is empty) that would be appended to the swift transaction
-# id allows one to easily figure out from which cluster that X-Trans-Id belongs to.
-# This is very useful when one is managing more than one swift cluster.
-# trans_id_suffix =
-#
-# comma separated list of functions to call to setup custom log handlers.
-# functions get passed: conf, name, log_to_console, log_route, fmt, logger,
-# adapted_logger
-# log_custom_handlers =
-#
-# If set, log_udp_host will override log_address
-# log_udp_host =
-# log_udp_port = 514
-#
-# You can enable StatsD logging here:
-# log_statsd_host =
-# log_statsd_port = 8125
-# log_statsd_default_sample_rate = 1.0
-# log_statsd_sample_rate_factor = 1.0
-# log_statsd_metric_prefix =
-#
-# Use a comma separated list of full url (http://foo.bar:1234,https://foo.bar)
-# cors_allow_origin =
-# strict_cors_mode = True
-#
-# client_timeout = 60
-# eventlet_debug = false
-
-[pipeline:main]
-# This sample pipeline uses tempauth and is used for SAIO dev work and
-# testing. See below for a pipeline using keystone.
-#pipeline = catch_errors gatekeeper healthcheck proxy-logging cache container_sync bulk tempurl ratelimit tempauth container-quotas account-quotas slo dlo versioned_writes proxy-logging proxy-server
-pipeline = catch_errors gatekeeper healthcheck proxy-logging cache container_sync bulk ratelimit authtoken keystoneauth container-quotas account-quotas slo dlo versioned_writes proxy-logging proxy-server
-
-# The following pipeline shows keystone integration. Comment out the one
-# above and uncomment this one. Additional steps for integrating keystone are
-# covered further below in the filter sections for authtoken and keystoneauth.
-#pipeline = catch_errors gatekeeper healthcheck proxy-logging cache container_sync bulk tempurl ratelimit authtoken keystoneauth container-quotas account-quotas slo dlo versioned_writes proxy-logging proxy-server
-
-[app:proxy-server]
-use = egg:swift#proxy
-account_autocreate = True
-# You can override the default log routing for this app here:
-# set log_name = proxy-server
-# set log_facility = LOG_LOCAL0
-# set log_level = INFO
-# set log_address = /dev/log
-#
-# log_handoffs = true
-# recheck_account_existence = 60
-# recheck_container_existence = 60
-# object_chunk_size = 65536
-# client_chunk_size = 65536
-#
-# How long the proxy server will wait on responses from the a/c/o servers.
-# node_timeout = 10
-#
-# How long the proxy server will wait for an initial response and to read a
-# chunk of data from the object servers while serving GET / HEAD requests.
-# Timeouts from these requests can be recovered from so setting this to
-# something lower than node_timeout would provide quicker error recovery
-# while allowing for a longer timeout for non-recoverable requests (PUTs).
-# Defaults to node_timeout, should be overriden if node_timeout is set to a
-# high number to prevent client timeouts from firing before the proxy server
-# has a chance to retry.
-# recoverable_node_timeout = node_timeout
-#
-# conn_timeout = 0.5
-#
-# How long to wait for requests to finish after a quorum has been established.
-# post_quorum_timeout = 0.5
-#
-# How long without an error before a node's error count is reset. This will
-# also be how long before a node is reenabled after suppression is triggered.
-# error_suppression_interval = 60
-#
-# How many errors can accumulate before a node is temporarily ignored.
-# error_suppression_limit = 10
-#
-# If set to 'true' any authorized user may create and delete accounts; if
-# 'false' no one, even authorized, can.
-# allow_account_management = false
-#
-# Set object_post_as_copy = false to turn on fast posts where only the metadata
-# changes are stored anew and the original data file is kept in place. This
-# makes for quicker posts.
-# object_post_as_copy = true
-#
-# If set to 'true' authorized accounts that do not yet exist within the Swift
-# cluster will be automatically created.
-# account_autocreate = false
-#
-# If set to a positive value, trying to create a container when the account
-# already has at least this maximum containers will result in a 403 Forbidden.
-# Note: This is a soft limit, meaning a user might exceed the cap for
-# recheck_account_existence before the 403s kick in.
-# max_containers_per_account = 0
-#
-# This is a comma separated list of account hashes that ignore the
-# max_containers_per_account cap.
-# max_containers_whitelist =
-#
-# Comma separated list of Host headers to which the proxy will deny requests.
-# deny_host_headers =
-#
-# Prefix used when automatically creating accounts.
-# auto_create_account_prefix = .
-#
-# Depth of the proxy put queue.
-# put_queue_depth = 10
-#
-# Storage nodes can be chosen at random (shuffle), by using timing
-# measurements (timing), or by using an explicit match (affinity).
-# Using timing measurements may allow for lower overall latency, while
-# using affinity allows for finer control. In both the timing and
-# affinity cases, equally-sorting nodes are still randomly chosen to
-# spread load.
-# The valid values for sorting_method are "affinity", "shuffle", or "timing".
-# sorting_method = shuffle
-#
-# If the "timing" sorting_method is used, the timings will only be valid for
-# the number of seconds configured by timing_expiry.
-# timing_expiry = 300
-#
-# By default on a GET/HEAD swift will connect to a storage node one at a time
-# in a single thread. There is smarts in the order they are hit however. If you
-# turn on concurrent_gets below, then replica count threads will be used.
-# With addition of the concurrency_timeout option this will allow swift to send
-# out GET/HEAD requests to the storage nodes concurrently and answer with the
-# first to respond. With an EC policy the parameter only affects HEAD requests.
-# concurrent_gets = off
-#
-# This parameter controls how long to wait before firing off the next
-# concurrent_get thread. A value of 0 would be fully concurrent, any other
-# number will stagger the firing of the threads. This number should be
-# between 0 and node_timeout. The default is what ever you set for the
-# conn_timeout parameter.
-# concurrency_timeout = 0.5
-#
-# Set to the number of nodes to contact for a normal request. You can use
-# '* replicas' at the end to have it use the number given times the number of
-# replicas for the ring being used for the request.
-# request_node_count = 2 * replicas
-#
-# Which backend servers to prefer on reads. Format is r<N> for region
-# N or r<N>z<M> for region N, zone M. The value after the equals is
-# the priority; lower numbers are higher priority.
-#
-# Example: first read from region 1 zone 1, then region 1 zone 2, then
-# anything in region 2, then everything else:
-# read_affinity = r1z1=100, r1z2=200, r2=300
-# Default is empty, meaning no preference.
-# read_affinity =
-#
-# Which backend servers to prefer on writes. Format is r<N> for region
-# N or r<N>z<M> for region N, zone M. If this is set, then when
-# handling an object PUT request, some number (see setting
-# write_affinity_node_count) of local backend servers will be tried
-# before any nonlocal ones.
-#
-# Example: try to write to regions 1 and 2 before writing to any other
-# nodes:
-# write_affinity = r1, r2
-# Default is empty, meaning no preference.
-# write_affinity =
-#
-# The number of local (as governed by the write_affinity setting)
-# nodes to attempt to contact first, before any non-local ones. You
-# can use '* replicas' at the end to have it use the number given
-# times the number of replicas for the ring being used for the
-# request.
-# write_affinity_node_count = 2 * replicas
-#
-# These are the headers whose values will only be shown to swift_owners. The
-# exact definition of a swift_owner is up to the auth system in use, but
-# usually indicates administrative responsibilities.
-# swift_owner_headers = x-container-read, x-container-write, x-container-sync-key, x-container-sync-to, x-account-meta-temp-url-key, x-account-meta-temp-url-key-2, x-container-meta-temp-url-key, x-container-meta-temp-url-key-2, x-account-access-control
-
-[filter:tempauth]
-use = egg:swift#tempauth
-# You can override the default log routing for this filter here:
-# set log_name = tempauth
-# set log_facility = LOG_LOCAL0
-# set log_level = INFO
-# set log_headers = false
-# set log_address = /dev/log
-#
-# The reseller prefix will verify a token begins with this prefix before even
-# attempting to validate it. Also, with authorization, only Swift storage
-# accounts with this prefix will be authorized by this middleware. Useful if
-# multiple auth systems are in use for one Swift cluster.
-# The reseller_prefix may contain a comma separated list of items. The first
-# item is used for the token as mentioned above. If second and subsequent
-# items exist, the middleware will handle authorization for an account with
-# that prefix. For example, for prefixes "AUTH, SERVICE", a path of
-# /v1/SERVICE_account is handled the same as /v1/AUTH_account. If an empty
-# (blank) reseller prefix is required, it must be first in the list. Two
-# single quote characters indicates an empty (blank) reseller prefix.
-# reseller_prefix = AUTH
-
-#
-# The require_group parameter names a group that must be presented by
-# either X-Auth-Token or X-Service-Token. Usually this parameter is
-# used only with multiple reseller prefixes (e.g., SERVICE_require_group=blah).
-# By default, no group is needed. Do not use .admin.
-# require_group =
-
-# The auth prefix will cause requests beginning with this prefix to be routed
-# to the auth subsystem, for granting tokens, etc.
-# auth_prefix = /auth/
-# token_life = 86400
-#
-# This allows middleware higher in the WSGI pipeline to override auth
-# processing, useful for middleware such as tempurl and formpost. If you know
-# you're not going to use such middleware and you want a bit of extra security,
-# you can set this to false.
-# allow_overrides = true
-#
-# This specifies what scheme to return with storage urls:
-# http, https, or default (chooses based on what the server is running as)
-# This can be useful with an SSL load balancer in front of a non-SSL server.
-# storage_url_scheme = default
-#
-# Lastly, you need to list all the accounts/users you want here. The format is:
-# user_<account>_<user> = <key> [group] [group] [...] [storage_url]
-# or if you want underscores in <account> or <user>, you can base64 encode them
-# (with no equal signs) and use this format:
-# user64_<account_b64>_<user_b64> = <key> [group] [group] [...] [storage_url]
-# There are special groups of:
-# .reseller_admin = can do anything to any account for this auth
-# .admin = can do anything within the account
-# If neither of these groups are specified, the user can only access containers
-# that have been explicitly allowed for them by a .admin or .reseller_admin.
-# The trailing optional storage_url allows you to specify an alternate url to
-# hand back to the user upon authentication. If not specified, this defaults to
-# $HOST/v1/<reseller_prefix>_<account> where $HOST will do its best to resolve
-# to what the requester would need to use to reach this host.
-# Here are example entries, required for running the tests:
-user_admin_admin = admin .admin .reseller_admin
-user_test_tester = testing .admin
-user_test2_tester2 = testing2 .admin
-user_test_tester3 = testing3
-user_test5_tester5 = testing5 service
-
-# To enable Keystone authentication you need to have the auth token
-# middleware first to be configured. Here is an example below, please
-# refer to the keystone's documentation for details about the
-# different settings.
-#
-# You'll also need to have the keystoneauth middleware enabled and have it in
-# your main pipeline, as show in the sample pipeline at the top of this file.
-#
-# Following parameters are known to work with keystonemiddleware v2.3.0
-# (above v2.0.0), but checking the latest information in the wiki page[1]
-# is recommended.
-# 1. http://docs.openstack.org/developer/keystonemiddleware/middlewarearchitecture.html#configuration
-#
-[filter:authtoken]
-paste.filter_factory = keystonemiddleware.auth_token:filter_factory
-auth_uri = http://{{ internal_vip.ip }}:5000
-auth_url = http://{{ internal_vip.ip }}:35357
-identity_uri = http://{{ internal_vip.ip }}:35357
-memcached_servers = {{ memcached_servers }}
-#auth_plugin = password
-auth_type = password
-project_domain_id = default
-user_domain_id = default
-project_name = service
-username = swift
-password = {{ CINDER_PASS }}
-delay_auth_decision = True
-#
-# delay_auth_decision defaults to False, but leaving it as false will
-# prevent other auth systems, staticweb, tempurl, formpost, and ACLs from
-# working. This value must be explicitly set to True.
-# delay_auth_decision = False
-#
-# cache = swift.cache
-# include_service_catalog = False
-#
-[filter:keystoneauth]
-use = egg:swift#keystoneauth
-operator_roles = admin,user
-# The reseller_prefix option lists account namespaces that this middleware is
-# responsible for. The prefix is placed before the Keystone project id.
-# For example, for project 12345678, and prefix AUTH, the account is
-# named AUTH_12345678 (i.e., path is /v1/AUTH_12345678/...).
-# Several prefixes are allowed by specifying a comma-separated list
-# as in: "reseller_prefix = AUTH, SERVICE". The empty string indicates a
-# single blank/empty prefix. If an empty prefix is required in a list of
-# prefixes, a value of '' (two single quote characters) indicates a
-# blank/empty prefix. Except for the blank/empty prefix, an underscore ('_')
-# character is appended to the value unless already present.
-# reseller_prefix = AUTH
-#
-# The user must have at least one role named by operator_roles on a
-# project in order to create, delete and modify containers and objects
-# and to set and read privileged headers such as ACLs.
-# If there are several reseller prefix items, you can prefix the
-# parameter so it applies only to those accounts (for example
-# the parameter SERVICE_operator_roles applies to the /v1/SERVICE_<project>
-# path). If you omit the prefix, the option applies to all reseller
-# prefix items. For the blank/empty prefix, prefix with '' (do not put
-# underscore after the two single quote characters).
-# operator_roles = admin, swiftoperator
-#
-# The reseller admin role has the ability to create and delete accounts
-# reseller_admin_role = ResellerAdmin
-#
-# This allows middleware higher in the WSGI pipeline to override auth
-# processing, useful for middleware such as tempurl and formpost. If you know
-# you're not going to use such middleware and you want a bit of extra security,
-# you can set this to false.
-# allow_overrides = true
-#
-# If the service_roles parameter is present, an X-Service-Token must be
-# present in the request that when validated, grants at least one role listed
-# in the parameter. The X-Service-Token may be scoped to any project.
-# If there are several reseller prefix items, you can prefix the
-# parameter so it applies only to those accounts (for example
-# the parameter SERVICE_service_roles applies to the /v1/SERVICE_<project>
-# path). If you omit the prefix, the option applies to all reseller
-# prefix items. For the blank/empty prefix, prefix with '' (do not put
-# underscore after the two single quote characters).
-# By default, no service_roles are required.
-# service_roles =
-#
-# For backwards compatibility, keystoneauth will match names in cross-tenant
-# access control lists (ACLs) when both the requesting user and the tenant
-# are in the default domain i.e the domain to which existing tenants are
-# migrated. The default_domain_id value configured here should be the same as
-# the value used during migration of tenants to keystone domains.
-# default_domain_id = default
-#
-# For a new installation, or an installation in which keystone projects may
-# move between domains, you should disable backwards compatible name matching
-# in ACLs by setting allow_names_in_acls to false:
-# allow_names_in_acls = true
-
-[filter:healthcheck]
-use = egg:swift#healthcheck
-# An optional filesystem path, which if present, will cause the healthcheck
-# URL to return "503 Service Unavailable" with a body of "DISABLED BY FILE".
-# This facility may be used to temporarily remove a Swift node from a load
-# balancer pool during maintenance or upgrade (remove the file to allow the
-# node back into the load balancer pool).
-# disable_path =
-
-[filter:cache]
-use = egg:swift#memcache
-memcache_servers = {{ memcached_servers }}
-# You can override the default log routing for this filter here:
-# set log_name = cache
-# set log_facility = LOG_LOCAL0
-# set log_level = INFO
-# set log_headers = false
-# set log_address = /dev/log
-#
-# If not set here, the value for memcache_servers will be read from
-# memcache.conf (see memcache.conf-sample) or lacking that file, it will
-# default to the value below. You can specify multiple servers separated with
-# commas, as in: 10.1.2.3:11211,10.1.2.4:11211 (IPv6 addresses must
-# follow rfc3986 section-3.2.2, i.e. [::1]:11211)
-# memcache_servers = 127.0.0.1:11211
-#
-# Sets how memcache values are serialized and deserialized:
-# 0 = older, insecure pickle serialization
-# 1 = json serialization but pickles can still be read (still insecure)
-# 2 = json serialization only (secure and the default)
-# If not set here, the value for memcache_serialization_support will be read
-# from /etc/swift/memcache.conf (see memcache.conf-sample).
-# To avoid an instant full cache flush, existing installations should
-# upgrade with 0, then set to 1 and reload, then after some time (24 hours)
-# set to 2 and reload.
-# In the future, the ability to use pickle serialization will be removed.
-# memcache_serialization_support = 2
-#
-# Sets the maximum number of connections to each memcached server per worker
-# memcache_max_connections = 2
-#
-# More options documented in memcache.conf-sample
-
-[filter:ratelimit]
-use = egg:swift#ratelimit
-# You can override the default log routing for this filter here:
-# set log_name = ratelimit
-# set log_facility = LOG_LOCAL0
-# set log_level = INFO
-# set log_headers = false
-# set log_address = /dev/log
-#
-# clock_accuracy should represent how accurate the proxy servers' system clocks
-# are with each other. 1000 means that all the proxies' clock are accurate to
-# each other within 1 millisecond. No ratelimit should be higher than the
-# clock accuracy.
-# clock_accuracy = 1000
-#
-# max_sleep_time_seconds = 60
-#
-# log_sleep_time_seconds of 0 means disabled
-# log_sleep_time_seconds = 0
-#
-# allows for slow rates (e.g. running up to 5 sec's behind) to catch up.
-# rate_buffer_seconds = 5
-#
-# account_ratelimit of 0 means disabled
-# account_ratelimit = 0
-
-# DEPRECATED- these will continue to work but will be replaced
-# by the X-Account-Sysmeta-Global-Write-Ratelimit flag.
-# Please see ratelimiting docs for details.
-# these are comma separated lists of account names
-# account_whitelist = a,b
-# account_blacklist = c,d
-
-# with container_limit_x = r
-# for containers of size x limit write requests per second to r. The container
-# rate will be linearly interpolated from the values given. With the values
-# below, a container of size 5 will get a rate of 75.
-# container_ratelimit_0 = 100
-# container_ratelimit_10 = 50
-# container_ratelimit_50 = 20
-
-# Similarly to the above container-level write limits, the following will limit
-# container GET (listing) requests.
-# container_listing_ratelimit_0 = 100
-# container_listing_ratelimit_10 = 50
-# container_listing_ratelimit_50 = 20
-
-[filter:domain_remap]
-use = egg:swift#domain_remap
-# You can override the default log routing for this filter here:
-# set log_name = domain_remap
-# set log_facility = LOG_LOCAL0
-# set log_level = INFO
-# set log_headers = false
-# set log_address = /dev/log
-#
-# storage_domain = example.com
-# path_root = v1
-
-# Browsers can convert a host header to lowercase, so check that reseller
-# prefix on the account is the correct case. This is done by comparing the
-# items in the reseller_prefixes config option to the found prefix. If they
-# match except for case, the item from reseller_prefixes will be used
-# instead of the found reseller prefix. When none match, the default reseller
-# prefix is used. When no default reseller prefix is configured, any request
-# with an account prefix not in that list will be ignored by this middleware.
-# reseller_prefixes = AUTH
-# default_reseller_prefix =
-
-[filter:catch_errors]
-use = egg:swift#catch_errors
-# You can override the default log routing for this filter here:
-# set log_name = catch_errors
-# set log_facility = LOG_LOCAL0
-# set log_level = INFO
-# set log_headers = false
-# set log_address = /dev/log
-
-[filter:cname_lookup]
-# Note: this middleware requires python-dnspython
-use = egg:swift#cname_lookup
-# You can override the default log routing for this filter here:
-# set log_name = cname_lookup
-# set log_facility = LOG_LOCAL0
-# set log_level = INFO
-# set log_headers = false
-# set log_address = /dev/log
-#
-# Specify the storage_domain that match your cloud, multiple domains
-# can be specified separated by a comma
-# storage_domain = example.com
-#
-# lookup_depth = 1
-
-# Note: Put staticweb just after your auth filter(s) in the pipeline
-[filter:staticweb]
-use = egg:swift#staticweb
-# You can override the default log routing for this filter here:
-# set log_name = staticweb
-# set log_facility = LOG_LOCAL0
-# set log_level = INFO
-# set log_headers = false
-# set log_address = /dev/log
-
-# Note: Put tempurl before dlo, slo and your auth filter(s) in the pipeline
-[filter:tempurl]
-use = egg:swift#tempurl
-# The methods allowed with Temp URLs.
-# methods = GET HEAD PUT POST DELETE
-#
-# The headers to remove from incoming requests. Simply a whitespace delimited
-# list of header names and names can optionally end with '*' to indicate a
-# prefix match. incoming_allow_headers is a list of exceptions to these
-# removals.
-# incoming_remove_headers = x-timestamp
-#
-# The headers allowed as exceptions to incoming_remove_headers. Simply a
-# whitespace delimited list of header names and names can optionally end with
-# '*' to indicate a prefix match.
-# incoming_allow_headers =
-#
-# The headers to remove from outgoing responses. Simply a whitespace delimited
-# list of header names and names can optionally end with '*' to indicate a
-# prefix match. outgoing_allow_headers is a list of exceptions to these
-# removals.
-# outgoing_remove_headers = x-object-meta-*
-#
-# The headers allowed as exceptions to outgoing_remove_headers. Simply a
-# whitespace delimited list of header names and names can optionally end with
-# '*' to indicate a prefix match.
-# outgoing_allow_headers = x-object-meta-public-*
-
-# Note: Put formpost just before your auth filter(s) in the pipeline
-[filter:formpost]
-use = egg:swift#formpost
-
-# Note: Just needs to be placed before the proxy-server in the pipeline.
-[filter:name_check]
-use = egg:swift#name_check
-# forbidden_chars = '"`<>
-# maximum_length = 255
-# forbidden_regexp = /\./|/\.\./|/\.$|/\.\.$
-
-[filter:list-endpoints]
-use = egg:swift#list_endpoints
-# list_endpoints_path = /endpoints/
-
-[filter:proxy-logging]
-use = egg:swift#proxy_logging
-# If not set, logging directives from [DEFAULT] without "access_" will be used
-# access_log_name = swift
-# access_log_facility = LOG_LOCAL0
-# access_log_level = INFO
-# access_log_address = /dev/log
-#
-# If set, access_log_udp_host will override access_log_address
-# access_log_udp_host =
-# access_log_udp_port = 514
-#
-# You can use log_statsd_* from [DEFAULT] or override them here:
-# access_log_statsd_host =
-# access_log_statsd_port = 8125
-# access_log_statsd_default_sample_rate = 1.0
-# access_log_statsd_sample_rate_factor = 1.0
-# access_log_statsd_metric_prefix =
-# access_log_headers = false
-#
-# If access_log_headers is True and access_log_headers_only is set only
-# these headers are logged. Multiple headers can be defined as comma separated
-# list like this: access_log_headers_only = Host, X-Object-Meta-Mtime
-# access_log_headers_only =
-#
-# By default, the X-Auth-Token is logged. To obscure the value,
-# set reveal_sensitive_prefix to the number of characters to log.
-# For example, if set to 12, only the first 12 characters of the
-# token appear in the log. An unauthorized access of the log file
-# won't allow unauthorized usage of the token. However, the first
-# 12 or so characters is unique enough that you can trace/debug
-# token usage. Set to 0 to suppress the token completely (replaced
-# by '...' in the log).
-# Note: reveal_sensitive_prefix will not affect the value
-# logged with access_log_headers=True.
-# reveal_sensitive_prefix = 16
-#
-# What HTTP methods are allowed for StatsD logging (comma-sep); request methods
-# not in this list will have "BAD_METHOD" for the <verb> portion of the metric.
-# log_statsd_valid_http_methods = GET,HEAD,POST,PUT,DELETE,COPY,OPTIONS
-#
-# Note: The double proxy-logging in the pipeline is not a mistake. The
-# left-most proxy-logging is there to log requests that were handled in
-# middleware and never made it through to the right-most middleware (and
-# proxy server). Double logging is prevented for normal requests. See
-# proxy-logging docs.
-
-# Note: Put before both ratelimit and auth in the pipeline.
-[filter:bulk]
-use = egg:swift#bulk
-# max_containers_per_extraction = 10000
-# max_failed_extractions = 1000
-# max_deletes_per_request = 10000
-# max_failed_deletes = 1000
-
-# In order to keep a connection active during a potentially long bulk request,
-# Swift may return whitespace prepended to the actual response body. This
-# whitespace will be yielded no more than every yield_frequency seconds.
-# yield_frequency = 10
-
-# Note: The following parameter is used during a bulk delete of objects and
-# their container. This would frequently fail because it is very likely
-# that all replicated objects have not been deleted by the time the middleware got a
-# successful response. It can be configured the number of retries. And the
-# number of seconds to wait between each retry will be 1.5**retry
-
-# delete_container_retry_count = 0
-
-# Note: Put after auth and staticweb in the pipeline.
-[filter:slo]
-use = egg:swift#slo
-# max_manifest_segments = 1000
-# max_manifest_size = 2097152
-#
-# Rate limiting applies only to segments smaller than this size (bytes).
-# rate_limit_under_size = 1048576
-#
-# Start rate-limiting SLO segment serving after the Nth small segment of a
-# segmented object.
-# rate_limit_after_segment = 10
-#
-# Once segment rate-limiting kicks in for an object, limit segments served
-# to N per second. 0 means no rate-limiting.
-# rate_limit_segments_per_sec = 1
-#
-# Time limit on GET requests (seconds)
-# max_get_time = 86400
-
-# Note: Put after auth and staticweb in the pipeline.
-# If you don't put it in the pipeline, it will be inserted for you.
-[filter:dlo]
-use = egg:swift#dlo
-# Start rate-limiting DLO segment serving after the Nth segment of a
-# segmented object.
-# rate_limit_after_segment = 10
-#
-# Once segment rate-limiting kicks in for an object, limit segments served
-# to N per second. 0 means no rate-limiting.
-# rate_limit_segments_per_sec = 1
-#
-# Time limit on GET requests (seconds)
-# max_get_time = 86400
-
-# Note: Put after auth in the pipeline.
-[filter:container-quotas]
-use = egg:swift#container_quotas
-
-# Note: Put after auth in the pipeline.
-[filter:account-quotas]
-use = egg:swift#account_quotas
-
-[filter:gatekeeper]
-use = egg:swift#gatekeeper
-# Set this to false if you want to allow clients to set arbitrary X-Timestamps
-# on uploaded objects. This may be used to preserve timestamps when migrating
-# from a previous storage system, but risks allowing users to upload
-# difficult-to-delete data.
-# shunt_inbound_x_timestamp = true
-#
-# You can override the default log routing for this filter here:
-# set log_name = gatekeeper
-# set log_facility = LOG_LOCAL0
-# set log_level = INFO
-# set log_headers = false
-# set log_address = /dev/log
-
-[filter:container_sync]
-use = egg:swift#container_sync
-# Set this to false if you want to disallow any full url values to be set for
-# any new X-Container-Sync-To headers. This will keep any new full urls from
-# coming in, but won't change any existing values already in the cluster.
-# Updating those will have to be done manually, as knowing what the true realm
-# endpoint should be cannot always be guessed.
-# allow_full_urls = true
-# Set this to specify this clusters //realm/cluster as "current" in /info
-# current = //REALM/CLUSTER
-
-# Note: Put it at the beginning of the pipeline to profile all middleware. But
-# it is safer to put this after catch_errors, gatekeeper and healthcheck.
-[filter:xprofile]
-use = egg:swift#xprofile
-# This option enable you to switch profilers which should inherit from python
-# standard profiler. Currently the supported value can be 'cProfile',
-# 'eventlet.green.profile' etc.
-# profile_module = eventlet.green.profile
-#
-# This prefix will be used to combine process ID and timestamp to name the
-# profile data file. Make sure the executing user has permission to write
-# into this path (missing path segments will be created, if necessary).
-# If you enable profiling in more than one type of daemon, you must override
-# it with an unique value like: /var/log/swift/profile/proxy.profile
-# log_filename_prefix = /tmp/log/swift/profile/default.profile
-#
-# the profile data will be dumped to local disk based on above naming rule
-# in this interval.
-# dump_interval = 5.0
-#
-# Be careful, this option will enable profiler to dump data into the file with
-# time stamp which means there will be lots of files piled up in the directory.
-# dump_timestamp = false
-#
-# This is the path of the URL to access the mini web UI.
-# path = /__profile__
-#
-# Clear the data when the wsgi server shutdown.
-# flush_at_shutdown = false
-#
-# unwind the iterator of applications
-# unwind = false
-
-# Note: Put after slo, dlo in the pipeline.
-# If you don't put it in the pipeline, it will be inserted automatically.
-[filter:versioned_writes]
-use = egg:swift#versioned_writes
-# Enables using versioned writes middleware and exposing configuration
-# settings via HTTP GET /info.
-# WARNING: Setting this option bypasses the "allow_versions" option
-# in the container configuration file, which will be eventually
-# deprecated. See documentation for more details.
-# allow_versioned_writes = false
+++ /dev/null
-uid = swift
-gid = swift
-log file = /var/log/rsyncd.log
-pid file = /var/run/rsyncd.pid
-address = {{ internal_ip }}
-
-[account]
-max connections = 2
-path = /srv/node/
-read only = False
-lock file = /var/lock/account.lock
-
-[container]
-max connections = 2
-path = /srv/node/
-read only = False
-lock file = /var/lock/container.lock
-
-[object]
-max connections = 2
-path = /srv/node/
-read only = False
-lock file = /var/lock/object.lock
+++ /dev/null
-[swift-hash]
-
-# swift_hash_path_suffix and swift_hash_path_prefix are used as part of the
-# the hashing algorithm when determining data placement in the cluster.
-# These values should remain secret and MUST NOT change
-# once a cluster has been deployed.
-# Use only printable chars (python -c "import string; print(string.printable)")
-
-swift_hash_path_suffix = 7c6a7cd34d07aed5
-swift_hash_path_prefix = 0c4629166f4de441
-
-# storage policies are defined here and determine various characteristics
-# about how objects are stored and treated. Policies are specified by name on
-# a per container basis. Names are case-insensitive. The policy index is
-# specified in the section header and is used internally. The policy with
-# index 0 is always used for legacy containers and can be given a name for use
-# in metadata however the ring file name will always be 'object.ring.gz' for
-# backwards compatibility. If no policies are defined a policy with index 0
-# will be automatically created for backwards compatibility and given the name
-# Policy-0. A default policy is used when creating new containers when no
-# policy is specified in the request. If no other policies are defined the
-# policy with index 0 will be declared the default. If multiple policies are
-# defined you must define a policy with index 0 and you must specify a
-# default. It is recommended you always define a section for
-# storage-policy:0. Aliases are not required when defining a storage policy.
-#
-# A 'policy_type' argument is also supported but is not mandatory. Default
-# policy type 'replication' is used when 'policy_type' is unspecified.
-[storage-policy:0]
-name = Policy-0
-default = yes
-#policy_type = replication
-aliases = yellow, orange
-
-# the following section would declare a policy called 'silver', the number of
-# replicas will be determined by how the ring is built. In this example the
-# 'silver' policy could have a lower or higher # of replicas than the
-# 'Policy-0' policy above. The ring filename will be 'object-1.ring.gz'. You
-# may only specify one storage policy section as the default. If you changed
-# this section to specify 'silver' as the default, when a client created a new
-# container w/o a policy specified, it will get the 'silver' policy because
-# this config has specified it as the default. However if a legacy container
-# (one created with a pre-policy version of swift) is accessed, it is known
-# implicitly to be assigned to the policy with index 0 as opposed to the
-# current default. Note that even without specifying any aliases, a policy
-# always has at least the default name stored in aliases because this field is
-# used to contain all human readable names for a storage policy.
-#
-#[storage-policy:1]
-#name = silver
-#policy_type = replication
-
-# The following declares a storage policy of type 'erasure_coding' which uses
-# Erasure Coding for data reliability. Please refer to Swift documentation for
-# details on how the 'erasure_coding' storage policy is implemented.
-#
-# Swift uses PyECLib, a Python Erasure coding API library, for encode/decode
-# operations. Please refer to Swift documentation for details on how to
-# install PyECLib.
-#
-# When defining an EC policy, 'policy_type' needs to be 'erasure_coding' and
-# EC configuration parameters 'ec_type', 'ec_num_data_fragments' and
-# 'ec_num_parity_fragments' must be specified. 'ec_type' is chosen from the
-# list of EC backends supported by PyECLib. The ring configured for the
-# storage policy must have it's "replica" count configured to
-# 'ec_num_data_fragments' + 'ec_num_parity_fragments' - this requirement is
-# validated when services start. 'ec_object_segment_size' is the amount of
-# data that will be buffered up before feeding a segment into the
-# encoder/decoder. More information about these configuration options and
-# supported `ec_type` schemes is available in the Swift documentation. Please
-# refer to Swift documentation for details on how to configure EC policies.
-#
-# The example 'deepfreeze10-4' policy defined below is a _sample_
-# configuration with an alias of 'df10-4' as well as 10 'data' and 4 'parity'
-# fragments. 'ec_type' defines the Erasure Coding scheme.
-# 'liberasurecode_rs_vand' (Reed-Solomon Vandermonde) is used as an example
-# below.
-#
-#[storage-policy:2]
-#name = deepfreeze10-4
-#aliases = df10-4
-#policy_type = erasure_coding
-#ec_type = liberasurecode_rs_vand
-#ec_num_data_fragments = 10
-#ec_num_parity_fragments = 4
-#ec_object_segment_size = 1048576
-
-
-# The swift-constraints section sets the basic constraints on data
-# saved in the swift cluster. These constraints are automatically
-# published by the proxy server in responses to /info requests.
-
-[swift-constraints]
-
-# max_file_size is the largest "normal" object that can be saved in
-# the cluster. This is also the limit on the size of each segment of
-# a "large" object when using the large object manifest support.
-# This value is set in bytes. Setting it to lower than 1MiB will cause
-# some tests to fail. It is STRONGLY recommended to leave this value at
-# the default (5 * 2**30 + 2).
-
-#max_file_size = 5368709122
-
-
-# max_meta_name_length is the max number of bytes in the utf8 encoding
-# of the name portion of a metadata header.
-
-#max_meta_name_length = 128
-
-
-# max_meta_value_length is the max number of bytes in the utf8 encoding
-# of a metadata value
-
-#max_meta_value_length = 256
-
-
-# max_meta_count is the max number of metadata keys that can be stored
-# on a single account, container, or object
-
-#max_meta_count = 90
-
-
-# max_meta_overall_size is the max number of bytes in the utf8 encoding
-# of the metadata (keys + values)
-
-#max_meta_overall_size = 4096
-
-# max_header_size is the max number of bytes in the utf8 encoding of each
-# header. Using 8192 as default because eventlet use 8192 as max size of
-# header line. This value may need to be increased when using identity
-# v3 API tokens including more than 7 catalog entries.
-# See also include_service_catalog in proxy-server.conf-sample
-# (documented in overview_auth.rst)
-
-#max_header_size = 8192
-
-
-# By default the maximum number of allowed headers depends on the number of max
-# allowed metadata settings plus a default value of 32 for regular http
-# headers. If for some reason this is not enough (custom middleware for
-# example) it can be increased with the extra_header_count constraint.
-
-#extra_header_count = 0
-
-
-# max_object_name_length is the max number of bytes in the utf8 encoding
-# of an object name
-
-#max_object_name_length = 1024
-
-
-# container_listing_limit is the default (and max) number of items
-# returned for a container listing request
-
-#container_listing_limit = 10000
-
-
-# account_listing_limit is the default (and max) number of items returned
-# for an account listing request
-#account_listing_limit = 10000
-
-
-# max_account_name_length is the max number of bytes in the utf8 encoding
-# of an account name
-
-#max_account_name_length = 256
-
-
-# max_container_name_length is the max number of bytes in the utf8 encoding
-# of a container name
-
-#max_container_name_length = 256
-
-
-# By default all REST API calls should use "v1" or "v1.0" as the version string,
-# for example "/v1/account". This can be manually overridden to make this
-# backward-compatible, in case a different version string has been used before.
-# Use a comma-separated list in case of multiple allowed versions, for example
-# valid_api_versions = v0,v1,v2
-# This is only enforced for account, container and object requests. The allowed
-# api versions are by default excluded from /info.
-
-# valid_api_versions = v1,v1.0
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-
-controller_packages:
- - swift
- - swift-proxy
- - python-swiftclient
- - python-keystoneclient
- - memcached
-
-compute_packages:
- - xfsprogs
- - rsync
- - swift
- - swift-account
- - swift-container
- - swift-object
-
-
-services: []
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-packages_noarch: []
-
-services_noarch: []
-
-controller_packages_noarch: []
-compute_packages_noarch: []
+++ /dev/null
-description "OpenStack Tacker Server"
-author "Yifei Xue <xueyifei@huawei.com>"
-
-start on runlevel [2345]
-stop on runlevel [!2345]
-
-chdir /var/run
-
-respawn
-respawn limit 20 5
-limit nofile 65535 65535
-
-pre-start script
- for i in lock run log lib ; do
- mkdir -p /var/$i/tacker
- chown root /var/$i/tacker
- done
-end script
-
-script
- [ -x "/usr/local/bin/tacker-server" ] || exit 0
- DAEMON_ARGS=""
- CONFIG_FILE="/usr/local/etc/tacker/tacker.conf"
- USE_SYSLOG=""
- USE_LOGFILE=""
- NO_OPENSTACK_CONFIG_FILE_DAEMON_ARG=""
- [ -r /etc/default/openstack ] && . /etc/default/openstack
- [ -r /etc/default/$UPSTART_JOB ] && . /etc/default/$UPSTART_JOB
- [ "x$USE_SYSLOG" = "xyes" ] && DAEMON_ARGS="$DAEMON_ARGS --use-syslog"
- [ "x$USE_LOGFILE" != "xno" ] && DAEMON_ARGS="$DAEMON_ARGS --log-file=/var/log/tacker/tacker.log"
- [ -z "$NO_OPENSTACK_CONFIG_FILE_DAEMON_ARG" ] && DAEMON_ARGS="$DAEMON_ARGS --config-file=$CONFIG_FILE"
-
- exec start-stop-daemon --start --chdir /var/lib/tacker \
- --chuid root:root --make-pidfile --pidfile /var/run/tacker/tacker.pid \
- --exec /usr/local/bin/tacker-server -- ${DAEMON_ARGS}
-end script
+++ /dev/null
-[Unit]
-Description=OpenStack Tacker Server
-After=
-
-[Service]
-User=root
-Group=root
-Type=simple
-WorkingDirectory=/var/lib/tacker
-PermissionsStartOnly=true
-ExecStartPre=/bin/mkdir -p /var/lock/tacker /var/log/tacker /var/lib/tacker
-ExecStartPre=/usr/bin/touch /var/log/tacker/tacker.log
-ExecStart=/usr/local/bin/tacker-server --config-file /usr/local/etc/tacker/tacker.conf
-Restart=on-failure
-LimitNOFILE=65535
-TimeoutStopSec=15
-
-[Install]
-WantedBy=multi-user.target
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-- include_vars: "{{ ansible_os_family }}.yml"
-
-- name: Install Tacker on Controller
- include: tacker_controller.yml
- when: inventory_hostname in groups['controller']
- and ansible_os_family == "Debian"
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-- name: edit ml2_conf.ini
- shell: |
- crudini --set /etc/neutron/plugins/ml2/ml2_conf.ini ml2 extension_drivers port_security;
-
-- name: Restart neutron-server
- service: name=neutron-server state=restarted
-
-- name: "create haproxy configuration for tacker"
- template:
- src: "haproxy-tacker-cfg.j2"
- dest: "/tmp/haproxy-tacker.cfg"
-
-- name: get the current haproxy configuration
- shell: cat /etc/haproxy/haproxy.cfg
- register: ha_cfg
-
-- name: "combination of the haproxy configuration"
- shell: "cat /tmp/haproxy-tacker.cfg >> /etc/haproxy/haproxy.cfg"
- when: ha_cfg.stdout.find('9890') == -1
-
-- name: "delete temporary configuration file"
- file:
- dest: "/tmp/haproxy-tacker.cfg"
- state: "absent"
-
-- name: "restart haproxy"
- service:
- name: "haproxy"
- state: "restarted"
-
-- name: drop and recreate tacker database
- shell: |
- mysql -e "drop database if exists tacker;";
- mysql -e "create database tacker character set utf8;";
- mysql -e "grant all on tacker.* to 'tacker'@'%' identified by 'TACKER_DBPASS';";
- when: inventory_hostname == haproxy_hosts.keys()[0]
-
-- name: get the openstack user info
- shell: . /opt/admin-openrc.sh; openstack user list
- register: user_info
-
-- name: get the openstack service info
- shell: . /opt/admin-openrc.sh; openstack service list
- register: service_info
-
-- name: get the openstack endpoint info
- shell: . /opt/admin-openrc.sh; openstack endpoint list
- register: endpoint_info
-
-- name: delete the existed tacker endpoint
- shell: |
- . /opt/admin-openrc.sh;
- openstack endpoint delete \
- $(openstack endpoint list | grep tacker | awk '{print $2}')
- when: endpoint_info.stdout.find('tacker') != -1
- and inventory_hostname == haproxy_hosts.keys()[0]
-
-- name: delete the existed tacker service
- shell: |
- . /opt/admin-openrc.sh;
- openstack service delete tacker;
- when: service_info.stdout.find('tacker') != -1
- and inventory_hostname == haproxy_hosts.keys()[0]
-
-- name: delete the existed tacker user
- shell: |
- . /opt/admin-openrc.sh;
- openstack user delete tacker;
- when: user_info.stdout.find('tacker') != -1
- and inventory_hostname == haproxy_hosts.keys()[0]
-
-- name: create tacker user with admin privileges
- shell: |
- . /opt/admin-openrc.sh;
- openstack user create --password console tacker;
- openstack role add --project service --user tacker admin;
- when: inventory_hostname == haproxy_hosts.keys()[0]
-
-- name: creat tacker service
- shell: |
- . /opt/admin-openrc.sh;
- openstack service create --name tacker \
- --description "Tacker Project" nfv-orchestration
- when: inventory_hostname == haproxy_hosts.keys()[0]
-
-- name: provide an endpoint to tacker service
- shell: |
- . /opt/admin-openrc.sh; \
- openstack endpoint create --region RegionOne \
- nfv-orchestration public 'http://{{ public_vip.ip }}:9890/';
- openstack endpoint create --region RegionOne \
- nfv-orchestration admin 'http://{{ internal_vip.ip }}:9890/';
- openstack endpoint create --region RegionOne \
- nfv-orchestration internal 'http://{{ internal_vip.ip }}:9890/';
- when: inventory_hostname == haproxy_hosts.keys()[0]
-
-- name: install tacker and tacker client
- shell: |
- pip install tacker python-tackerclient
-
-- name: create 'tacker' directory in '/var/cache'
- shell: |
- mkdir -p /var/cache/tacker
-
-- name: create 'tacker' directory in '/var/log'
- shell: mkdir -p /var/log/tacker
-
-- name: get the policy file of heat
- shell: cat /etc/heat/policy.json | grep Flavor
- register: heat_info
-
-- name: update the policy file of heat
- lineinfile:
- dest: /etc/heat/policy.json
- regexp: ' "resource_types:OS::Nova::Flavor'
- line: ' "resource_types:OS::Nova::Flavor": "role:admin",'
- when: heat_info.stdout.find('role') == -1
-
-- name: restart heat services
- service: name={{ item }} state=restarted enabled=yes
- with_items: "{{ heat_services }}"
-
-- name: copy tacker configs
- template: src={{ item.src }} dest=/opt/os_templates
- with_items: "{{ tacker_configs_templates }}"
-
-- name: edit tacker configuration file
- shell: |
- crudini --merge /usr/local/etc/tacker/tacker.conf \
- < /opt/os_templates/tacker.j2
-
-- name: populate tacker database
- shell: |
- . /opt/admin-openrc.sh; \
- /usr/local/bin/tacker-db-manage \
- --config-file /usr/local/etc/tacker/tacker.conf upgrade head
- when: inventory_hostname == haproxy_hosts.keys()[0]
-
-- name: create tacker service
- copy: src=tacker.service dest=/lib/systemd/system/
-
-- name: create tacker service work dir
- file: path=/var/lib/tacker state=directory
-
-- name: link the tacker service
- file:
- src: /lib/systemd/system/tacker.service
- dest: /etc/systemd/system/multi-user.target.wants/tacker.service
- state: link
-
-- name: start tacker service
- shell: service tacker start
-
-- name: create tackerc file
- template: src=tackerc.sh dest=/opt/tackerc.sh mode=777
-
-- name: create nfvrc file
- template: src=nfvrc.sh dest=/opt/nfvrc.sh mode=777
-
-- name: get the nfv_user info
- shell: . /opt/tackerc.sh; openstack user list
- register: nfvuser_info
-
-- name: delete the existed nfv user
- shell: . /opt/tackerc.sh; openstack user delete nfv_user
- when: nfvuser_info.stdout.find('nfv') != -1 and inventory_hostname == haproxy_hosts.keys()[0]
-
-- name: get the openstack project info
- shell: . /opt/tackerc.sh; openstack project list
- register: nfvproject_info
-
-- name: delete the existed nfv project
- shell: |
- . /opt/tackerc.sh;
- openstack project delete $(openstack project list | grep nfv | awk '{print $2}')
- when: nfvproject_info.stdout.find('nfv') != -1 and inventory_hostname == haproxy_hosts.keys()[0]
-
-- name: create an nfv project
- shell: . /opt/tackerc.sh; openstack project create --description "NFV Project" nfv
- when: inventory_hostname == haproxy_hosts.keys()[0]
-
-- name: create nfv user with admin privileges
- shell: |
- . /opt/tackerc.sh;
- openstack user create --password console nfv_user;
- openstack role add --project nfv --user nfv_user admin;
- when: inventory_hostname == haproxy_hosts.keys()[0]
-
-- name: create config.yml
- template: src=config.yaml dest=/opt/config.yaml
-
-- name: check if tacker running
- shell: . /opt/tackerc.sh; while (!(tacker ext-list)); do sleep 30; done
-
-- name: register VIM to tacker
- shell: |
- . /opt/tackerc.sh;
- tacker vim-register --config-file /opt/config.yaml --description "Default VIM" VIM0
- when: inventory_hostname == haproxy_hosts.keys()[0]
-
-- name: restart tacker service
- shell: service tacker stop; service tacker start
+++ /dev/null
----
-
-auth_url: http://{{ public_vip.ip }}:5000/v3
-username: nfv_user
-password: console
-project_name: nfv
-project_domain_name: default
-user_domain_name: default
+++ /dev/null
-listen proxy-tacker_api_cluster
- bind {{ internal_vip.ip }}:9890
- bind {{ public_vip.ip }}:9890
- mode tcp
- option tcp-check
- option tcplog
- balance source
-{% for host,ip in haproxy_hosts.items() %}
- server {{ host }} {{ ip }}:9890 weight 1 check inter 2000 rise 2 fall 5
-{% endfor %}
+++ /dev/null
-[ml2]
-extension_drivers = port_security
+++ /dev/null
-#!/bin/sh
-export LC_ALL=C
-export OS_NO_CACHE=true
-export OS_TENANT_NAME=nfv
-export OS_PROJECT_NAME=nfv
-export OS_USERNAME=nfv_user
-export OS_PASSWORD=console
-export OS_AUTH_URL=http://{{ internal_vip.ip }}:35357/v3
-export OS_PROJECT_DOMAIN_NAME=default
-export OS_USER_DOMAIN_NAME=default
-export OS_AUTH_STRATEGY=keystone
-export OS_REGION_NAME=RegionOne
-export OS_IDENTITY_API_VERSION=3
-export OS_IMAGE_API_VERSION=2
+++ /dev/null
-{% set memcached_servers = [] %}
-{% set rabbitmq_servers = [] %}
-{% for host in haproxy_hosts.values() %}
-{% set _ = memcached_servers.append('%s:11211'% host) %}
-{% set _ = rabbitmq_servers.append('%s:5672'% host) %}
-{% endfor %}
-{% set memcached_servers = memcached_servers|join(',') %}
-{% set rabbitmq_servers = rabbitmq_servers|join(',') %}
-
-[DEFAULT]
-# Print more verbose output (set logging level to INFO instead of default WARNING level).
-verbose = True
-
-# Print debugging output (set logging level to DEBUG instead of default WARNING level).
-debug = True
-
-# Where to store Tacker state files. This directory must be writable by the
-# user executing the agent.
-state_path = /var/lib/tacker
-
-# Where to store lock files
-lock_path = $state_path/lock
-
-auth_strategy = keystone
-policy_file = /usr/local/etc/tacker/policy.json
-
-# log_format = %(asctime)s %(levelname)8s [%(name)s] %(message)s
-# log_date_format = %Y-%m-%d %H:%M:%S
-
-# use_syslog -> syslog
-# log_file and log_dir -> log_dir/log_file
-# (not log_file) and log_dir -> log_dir/{binary_name}.log
-# use_stderr -> stderr
-# (not user_stderr) and (not log_file) -> stdout
-# publish_errors -> notification system
-
-use_syslog = False
-# syslog_log_facility = LOG_USER
-
-# use_stderr = True
-# log_file =
-# log_dir =
-
-# publish_errors = False
-
-# Address to bind the API server to
-bind_host = {{ internal_ip }}
-
-# Port the bind the API server to
-bind_port = 9890
-
-# Path to the extensions. Note that this can be a colon-separated list of
-# paths. For example:
-# api_extensions_path = extensions:/path/to/more/extensions:/even/more/extensions
-# The __path__ of tacker.extensions is appended to this, so if your
-# extensions are in there you don't need to specify them here
-# api_extensions_path =
-
-# (StrOpt) Tacker core plugin entrypoint to be loaded from the
-# tacker.core_plugins namespace. See setup.cfg for the entrypoint names of the
-# plugins included in the tacker source distribution. For compatibility with
-# previous versions, the class name of a plugin can be specified instead of its
-# entrypoint name.
-#
-# core_plugin =
-# Example: core_plugin = ml2
-
-# (ListOpt) List of service plugin entrypoints to be loaded from the
-# tacker.service_plugins namespace. See setup.cfg for the entrypoint names of
-# the plugins included in the tacker source distribution. For compatibility
-# with previous versions, the class name of a plugin can be specified instead
-# of its entrypoint name.
-#
-# service_plugins =
-# Example: service_plugins = router,firewall,lbaas,vpnaas,metering
-
-service_plugins = vnfm,nfvo
-
-# Paste configuration file
-# api_paste_config = api-paste.ini
-
-# The strategy to be used for auth.
-# Supported values are 'keystone'(default), 'noauth'.
-# auth_strategy = keystone
-
-# Allow sending resource operation notification to DHCP agent
-# dhcp_agent_notification = True
-
-# Enable or disable bulk create/update/delete operations
-# allow_bulk = True
-# Enable or disable pagination
-# allow_pagination = False
-# Enable or disable sorting
-# allow_sorting = False
-# Enable or disable overlapping IPs for subnets
-# Attention: the following parameter MUST be set to False if Tacker is
-# being used in conjunction with nova security groups
-# allow_overlapping_ips = False
-# Ensure that configured gateway is on subnet
-# force_gateway_on_subnet = False
-
-
-# RPC configuration options. Defined in rpc __init__
-# The messaging module to use, defaults to kombu.
-# rpc_backend = tacker.openstack.common.rpc.impl_kombu
-# Size of RPC thread pool
-# rpc_thread_pool_size = 64
-# Size of RPC connection pool
-# rpc_conn_pool_size = 30
-# Seconds to wait for a response from call or multicall
-# rpc_response_timeout = 60
-# Seconds to wait before a cast expires (TTL). Only supported by impl_zmq.
-# rpc_cast_timeout = 30
-# Modules of exceptions that are permitted to be recreated
-# upon receiving exception data from an rpc call.
-# allowed_rpc_exception_modules = tacker.openstack.common.exception, nova.exception
-# AMQP exchange to connect to if using RabbitMQ or QPID
-# control_exchange = tacker
-
-# If passed, use a fake RabbitMQ provider
-# fake_rabbit = False
-
-# Configuration options if sending notifications via kombu rpc (these are
-# the defaults)
-# SSL version to use (valid only if SSL enabled)
-# kombu_ssl_version =
-# SSL key file (valid only if SSL enabled)
-# kombu_ssl_keyfile =
-# SSL cert file (valid only if SSL enabled)
-# kombu_ssl_certfile =
-# SSL certification authority file (valid only if SSL enabled)
-# kombu_ssl_ca_certs =
-# IP address of the RabbitMQ installation
-# rabbit_host = localhost
-# Password of the RabbitMQ server
-# rabbit_password = guest
-# Port where RabbitMQ server is running/listening
-# rabbit_port = 5672
-# RabbitMQ single or HA cluster (host:port pairs i.e: host1:5672, host2:5672)
-# rabbit_hosts is defaulted to '$rabbit_host:$rabbit_port'
-# rabbit_hosts = localhost:5672
-# User ID used for RabbitMQ connections
-# rabbit_userid = guest
-# Location of a virtual RabbitMQ installation.
-# rabbit_virtual_host = /
-# Maximum retries with trying to connect to RabbitMQ
-# (the default of 0 implies an infinite retry count)
-# rabbit_max_retries = 0
-# RabbitMQ connection retry interval
-# rabbit_retry_interval = 1
-# Use HA queues in RabbitMQ (x-ha-policy: all). You need to
-# wipe RabbitMQ database when changing this option. (boolean value)
-# rabbit_ha_queues = false
-
-# QPID
-# rpc_backend=tacker.openstack.common.rpc.impl_qpid
-# Qpid broker hostname
-# qpid_hostname = localhost
-# Qpid broker port
-# qpid_port = 5672
-# Qpid single or HA cluster (host:port pairs i.e: host1:5672, host2:5672)
-# qpid_hosts is defaulted to '$qpid_hostname:$qpid_port'
-# qpid_hosts = localhost:5672
-# Username for qpid connection
-# qpid_username = ''
-# Password for qpid connection
-# qpid_password = ''
-# Space separated list of SASL mechanisms to use for auth
-# qpid_sasl_mechanisms = ''
-# Seconds between connection keepalive heartbeats
-# qpid_heartbeat = 60
-# Transport to use, either 'tcp' or 'ssl'
-# qpid_protocol = tcp
-# Disable Nagle algorithm
-# qpid_tcp_nodelay = True
-
-# ZMQ
-# rpc_backend=tacker.openstack.common.rpc.impl_zmq
-# ZeroMQ bind address. Should be a wildcard (*), an ethernet interface, or IP.
-# The "host" option should point or resolve to this address.
-# rpc_zmq_bind_address = *
-
-# ============ Notification System Options =====================
-
-# Notifications can be sent when network/subnet/port are created, updated or deleted.
-# There are three methods of sending notifications: logging (via the
-# log_file directive), rpc (via a message queue) and
-# noop (no notifications sent, the default)
-
-# Notification_driver can be defined multiple times
-# Do nothing driver
-# notification_driver = tacker.openstack.common.notifier.no_op_notifier
-# Logging driver
-# notification_driver = tacker.openstack.common.notifier.log_notifier
-# RPC driver.
-notification_driver = tacker.openstack.common.notifier.rpc_notifier
-
-# default_notification_level is used to form actual topic name(s) or to set logging level
-# default_notification_level = INFO
-
-# default_publisher_id is a part of the notification payload
-# host = myhost.com
-# default_publisher_id = $host
-
-# Defined in rpc_notifier, can be comma separated values.
-# The actual topic names will be %s.%(default_notification_level)s
-# notification_topics = notifications
-
-# Default maximum number of items returned in a single response,
-# value == infinite and value < 0 means no max limit, and value must
-# be greater than 0. If the number of items requested is greater than
-# pagination_max_limit, server will just return pagination_max_limit
-# of number of items.
-# pagination_max_limit = -1
-
-# Maximum number of DNS nameservers per subnet
-# max_dns_nameservers = 5
-
-# Maximum number of host routes per subnet
-# max_subnet_host_routes = 20
-
-# Maximum number of fixed ips per port
-# max_fixed_ips_per_port = 5
-
-# =========== items for agent management extension =============
-# Seconds to regard the agent as down; should be at least twice
-# report_interval, to be sure the agent is down for good
-# agent_down_time = 75
-# =========== end of items for agent management extension =====
-
-# Allow auto scheduling networks to DHCP agent. It will schedule non-hosted
-# networks to first DHCP agent which sends get_active_networks message to
-# tacker server
-# network_auto_schedule = True
-
-# Allow auto scheduling routers to L3 agent. It will schedule non-hosted
-# routers to first L3 agent which sends sync_routers message to tacker server
-# router_auto_schedule = True
-
-# Number of DHCP agents scheduled to host a network. This enables redundant
-# DHCP agents for configured networks.
-# dhcp_agents_per_network = 1
-
-# =========== end of items for agent scheduler extension =====
-
-# =========== WSGI parameters related to the API server ==============
-# Number of separate worker processes to spawn. The default, 0, runs the
-# worker thread in the current process. Greater than 0 launches that number of
-# child processes as workers. The parent process manages them.
-# api_workers = 0
-
-# Number of separate RPC worker processes to spawn. The default, 0, runs the
-# worker thread in the current process. Greater than 0 launches that number of
-# child processes as RPC workers. The parent process manages them.
-# This feature is experimental until issues are addressed and testing has been
-# enabled for various plugins for compatibility.
-# rpc_workers = 0
-
-# Sets the value of TCP_KEEPIDLE in seconds to use for each server socket when
-# starting API server. Not supported on OS X.
-# tcp_keepidle = 600
-
-# Number of seconds to keep retrying to listen
-# retry_until_window = 30
-
-# Number of backlog requests to configure the socket with.
-# backlog = 4096
-
-# Max header line to accommodate large tokens
-# max_header_line = 16384
-
-# Enable SSL on the API server
-# use_ssl = False
-
-# Certificate file to use when starting API server securely
-# ssl_cert_file = /path/to/certfile
-
-# Private key file to use when starting API server securely
-# ssl_key_file = /path/to/keyfile
-
-# CA certificate file to use when starting API server securely to
-# verify connecting clients. This is an optional parameter only required if
-# API clients need to authenticate to the API server using SSL certificates
-# signed by a trusted CA
-# ssl_ca_file = /path/to/cafile
-# ======== end of WSGI parameters related to the API server ==========
-
-
-# ======== tacker nova interactions ==========
-# Send notification to nova when port status is active.
-# notify_nova_on_port_status_changes = True
-
-# Send notifications to nova when port data (fixed_ips/floatingips) change
-# so nova can update it's cache.
-# notify_nova_on_port_data_changes = True
-
-# URL for connection to nova (Only supports one nova region currently).
-# nova_url = http://127.0.0.1:8774/v3
-
-# Name of nova region to use. Useful if keystone manages more than one region
-# nova_region_name =
-
-# Username for connection to nova in admin context
-# nova_admin_username =
-
-# The uuid of the admin nova tenant
-# nova_admin_tenant_id =
-
-# Password for connection to nova in admin context.
-# nova_admin_password =
-
-# Authorization URL for connection to nova in admin context.
-# nova_admin_auth_url =
-
-# CA file for novaclient to verify server certificates
-# nova_ca_certificates_file =
-
-# Boolean to control ignoring SSL errors on the nova url
-# nova_api_insecure = False
-
-# Number of seconds between sending events to nova if there are any events to send
-# send_events_interval = 2
-
-# ======== end of tacker nova interactions ==========
-
-[agent]
-# Use "sudo tacker-rootwrap /etc/tacker/rootwrap.conf" to use the real
-# root filter facility.
-# Change to "sudo" to skip the filtering and just run the comand directly
-root_helper = sudo /usr/local/bin/tacker-rootwrap /usr/local/etc/tacker/rootwrap.conf
-
-# =========== items for agent management extension =============
-# seconds between nodes reporting state to server; should be less than
-# agent_down_time, best if it is half or less than agent_down_time
-# report_interval = 30
-
-# =========== end of items for agent management extension =====
-
-[keystone_authtoken]
-signing_dir = /var/cache/tacker
-#cafile = /opt/stack/data/ca-bundle.pem
-#project_domain_id = default
-project_name = service
-#user_domain_id = default
-project_domain_name = default
-user_domain_name = default
-region_name = RegionOne
-memcached_servers = {{ memcached_servers }}
-password = console
-username = tacker
-auth_url = http://{{ internal_vip.ip }}:35357
-auth_plugin = password
-identity_uri = http://{{ internal_vip.ip }}:5000
-auth_uri = http://{{ internal_vip.ip }}:5000
-
-
-[database]
-# This line MUST be changed to actually run the plugin.
-# Example:
-# connection = mysql://root:pass@127.0.0.1:3306/tacker
-connection = mysql://tacker:TACKER_DBPASS@{{ internal_vip.ip }}:3306/tacker?charset=utf8
-# Replace 127.0.0.1 above with the IP address of the database used by the
-# main tacker server. (Leave it as is if the database runs on this host.)
-# connection = sqlite://
-# NOTE: In deployment the [database] section and its connection attribute may
-# be set in the corresponding core plugin '.ini' file. However, it is suggested
-# to put the [database] section and its connection attribute in this
-# configuration file.
-
-# Database engine for which script will be generated when using offline
-# migration
-# engine =
-
-# The SQLAlchemy connection string used to connect to the slave database
-# slave_connection =
-
-# Database reconnection retry times - in event connectivity is lost
-# set to -1 implies an infinite retry count
-# max_retries = 10
-
-# Database reconnection interval in seconds - if the initial connection to the
-# database fails
-# retry_interval = 10
-
-# Minimum number of SQL connections to keep open in a pool
-# min_pool_size = 1
-
-# Maximum number of SQL connections to keep open in a pool
-# max_pool_size = 10
-
-# Timeout in seconds before idle sql connections are reaped
-# idle_timeout = 3600
-
-# If set, use this value for max_overflow with sqlalchemy
-# max_overflow = 20
-
-# Verbosity of SQL debugging information. 0=None, 100=Everything
-# connection_debug = 0
-
-# Add python stack traces to SQL as comment strings
-# connection_trace = False
-
-# If set, use this value for pool_timeout with sqlalchemy
-# pool_timeout = 10
-
-[tacker]
-# Specify drivers for hosting device
-# infra_driver = heat,nova,noop
-
-# Specify drivers for mgmt
-# mgmt_driver = noop,openwrt
-
-# Specify drivers for monitoring
-monitor_driver = ping, http_ping
-
-[nfvo]
-vim_drivers = openstack
-
-[vim_keys]
-#openstack = /etc/tacker/vim/fernet_keys
-[tacker_nova]
-# parameters for novaclient to talk to nova
-region_name = RegionOne
-#project_domain_id = default
-project_name = service
-#user_domain_id = default
-password = console
-username = nova
-auth_url = http://{{ internal_vip.ip }}:35357
-auth_plugin = password
-
-[tacker_heat]
-heat_uri = http://{{ internal_vip.ip }}:8004/v1
-stack_retries = 60
-stack_retry_wait = 5
+++ /dev/null
-#!/bin/sh
-export LC_ALL=C
-export OS_NO_CACHE=true
-export OS_TENANT_NAME=service
-export OS_PROJECT_NAME=service
-export OS_USERNAME=tacker
-export OS_PASSWORD=console
-export OS_AUTH_URL=http://{{ internal_vip.ip }}:35357/v3
-export OS_PROJECT_DOMAIN_NAME=default
-export OS_USER_DOMAIN_NAME=default
-export OS_AUTH_STRATEGY=keystone
-export OS_REGION_NAME=RegionOne
-export OS_IDENTITY_API_VERSION=3
-export OS_IMAGE_API_VERSION=2
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-packages:
- - software-properties-common
- - crudini
-
-services: []
-
-heat_services:
- - heat-api
- - heat-api-cfn
- - heat-engine
+++ /dev/null
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
----
-packages:
- - software-properties-common
- - crudini
-
-services: []
+++ /dev/null
----
-##############################################################################
-# Copyright (c) 2016 HUAWEI TECHNOLOGIES CO.,LTD and others.
-#
-# All rights reserved. This program and the accompanying materials
-# are made available under the terms of the Apache License, Version 2.0
-# which accompanies this distribution, and is available at
-# http://www.apache.org/licenses/LICENSE-2.0
-##############################################################################
-
-tacker_configs_templates:
- - src: tacker.j2
- dest:
- - /usr/local/etc/tacker/tacker.conf
Code Review / compass4nfv.git / commitdiff