Dan Sneddon [Wed, 12 Oct 2016 19:38:21 +0000 (12:38 -0700)]
Disable IPv6 RAs & Autoconf For All (Not Just Default)
The current kernel sysctl settings modify the
net.ipv6.conf.default.accept_ra and net.ipv6.conf.default.autoconf
to both be '0'. However, this is overridden by the settings in
net.ipv6.conf.all, so no matter what setting is in the ifcfg file
for the IPv6 interface, autoconfiguration and accept_ra will be
enabled. This causes a security vulnerability where rogue RAs
could be used to intercept traffic from the controllers.
This change sets both default and all settings to '0' for IPv6
accept_ra and autoconf.
Closes-Bug:
1632830
Change-Id: I95b86c5c6feed30dfa5103ffbddb9e85ac567bbb
Jenkins [Wed, 12 Oct 2016 19:32:19 +0000 (19:32 +0000)]
Merge "Allow Glance API and Registry to be split"
Dan Prince [Tue, 11 Oct 2016 16:09:43 +0000 (12:09 -0400)]
Only set NovaWorkers in the non-default case
This patch updates the t-h-t templates for
nova services so that we only set the value of workers in
the non-default case. TripleO has always defaulted the
workers count to 0 and there was recently a regression in
nova where they treat the default of 0 as invalid (a bug
that may get fixed in nova but we don't want to wait on it)
This patch avoids the issue by allowing the default value
to be unset if the TripleO default of 0 is configured.
Change-Id: I175977b88129d87caeb32332d47eb14816a6d5d4
Closes-bug: #
1631133
Dan Prince [Tue, 11 Oct 2016 15:38:38 +0000 (11:38 -0400)]
Remove duplicate metadata keys from nova-api.yaml
These keys are already specified in nova-metadata.yaml
where they get set correctly per the network management
local IP (based on 'service_name' list).
Depends-On: I94f985e719a3bf7408655fbbb5ab1aeaf15e994e
Change-Id: I5d57561b732783118efd2a637aa137f5f7bcddbc
Partial-bug: #
1631133
Jenkins [Wed, 12 Oct 2016 16:42:24 +0000 (16:42 +0000)]
Merge "Add parameters to run nova over httpd"
Carlos Camacho [Fri, 9 Sep 2016 19:36:40 +0000 (21:36 +0200)]
Add contrail services to the resource registry
Added contrail resource registry entries.
Implements: blueprint contrail-services
Change-Id: I03894bff63d54637ba1b10a279e2d75f97a06b3c
Steven Hardy [Wed, 12 Oct 2016 10:50:23 +0000 (11:50 +0100)]
Special case non-matching ObjectStorage role port names
Unfortunately we use "SwiftStorage" in the ObjectStorage role
template, so we have to special-case this for backwards compatibility
or deployments enabling the ObjectStorage role will fail.
Ideally we'd align the port names in the objectstorage-role.yaml, but we
can't becauuse all the ports would be replaced in existing deployments
on update.
Change-Id: Ia07e193d2b9a4d33c6272c2b4448133584b81350
Closes-Bug: #
1632663
Dan Prince [Wed, 28 Sep 2016 15:36:27 +0000 (11:36 -0400)]
Allow Glance API and Registry to be split
The glance-api and glance-registry services are currently coupled
in that some of the hiera settings in the API are required for
the registry to run correctly (the backend settings).
This patch moves some of the common settings into glance-base and
then updates the glance-api and glance-registry services to
supply that service.
Change-Id: Ie3d7e24c7fd475e3f6ad542c1654eb7dbd9d9b35
Closes-bug: #
1628582
Jenkins [Wed, 12 Oct 2016 06:58:27 +0000 (06:58 +0000)]
Merge "Set the notification driver for glance"
Jenkins [Tue, 11 Oct 2016 11:38:21 +0000 (11:38 +0000)]
Merge "Actually start the systemd services in step3 of the major-upgrade step"
Christian Schwede [Mon, 10 Oct 2016 16:02:07 +0000 (18:02 +0200)]
Enable object versioning in Swift proxy
Tempest expects object versioning to be enabled by default in Swift;
if not it has to be disabled explicitly in the Tempest config.
This is a commonly used middleware, therefore it should be enabled
in the overcloud proxy nodes as well.
Closes-Bug:
1632215
Depends-On: I07a206473ff7939749e3eba1dfe3ea8c4526eb5c
Change-Id: I4eae08ff3f9a3a2f829c3497c1c2aaee8e7f8554
Jenkins [Mon, 10 Oct 2016 19:35:57 +0000 (19:35 +0000)]
Merge "Remove unneeded *_enable_backend hiera from Manila backends"
Michele Baldessari [Mon, 10 Oct 2016 19:18:26 +0000 (21:18 +0200)]
Actually start the systemd services in step3 of the major-upgrade step
We have the following function in the upgrade process after we updated
the packages and called the db-sync commands:
services=$(services_to_migrate)
...
for service in $(services); do
manage_systemd_service start "${service%%-clone}"
check_resource_systemd "${service%%-clone}" started 600
done
The above is broken because $services contains a list of services to
start, so $(services) will return gibberish and the for loop will never
execute anything.
One of the symptoms for this is the openstack-nova-compute service not
restarting on the compute nodes during the yum -y upgrade. The reason
for this is that during the service restart, nova-compute waits for
nova-conductor to show up in the rabbitmq queues, which cannot happen
since the service was actually never started.
Change-Id: I811ff19d7b44a935b2ec5c5e66e5b5191b259eb3
Closes-Bug: #
1630580
Christian Schwede [Mon, 10 Oct 2016 11:42:22 +0000 (13:42 +0200)]
Fix default Swift ring partition power
Looks like swift::ringbuilder::part_power is not used at all; actually
the partition power on the overcloud is 18, which is the default in
puppet-swift if nothing else is defined.
Closes-Bug:
1631926
Depends-On: I78049105adf52226d47cc6764b1ba6c2c06e91e5
Change-Id: I65335c8d31ed1130e71f1e193eb519b9f7f2438e
Pradeep Kilambi [Mon, 10 Oct 2016 12:45:08 +0000 (08:45 -0400)]
Set the notification driver for glance
Need to set the right default notification driver for glance so
telemetry receives them accordingly. Without this tempest tests
fail.
Closes-bug: #
1631939
Change-Id: I1cee5467d077eea6142076925646f7d0cdae96c7
Jenkins [Mon, 10 Oct 2016 09:30:29 +0000 (09:30 +0000)]
Merge "Add new environment for debug"
Jenkins [Mon, 10 Oct 2016 09:06:44 +0000 (09:06 +0000)]
Merge "Make step an integer on the pacemaker controller"
Jenkins [Fri, 7 Oct 2016 19:49:46 +0000 (19:49 +0000)]
Merge "Add cloud names to hosts output"
Dan Prince [Fri, 7 Oct 2016 19:12:58 +0000 (15:12 -0400)]
Make step an integer on the pacemaker controller
This resolves the issue causing the 'step' hiera setting
to get written as a string (thus causing puppet failures)
on a pacemaker controller.
Change-Id: I70037889e499846460357928f8637a35ac97bc7a
Closes-bug: #
1631488
Wes Hayutin [Fri, 7 Oct 2016 14:06:04 +0000 (10:06 -0400)]
Add new environment for debug
Introduce a new environment template that enables the Debug parameter.
By default the value is set to "true".
Change-Id: Ieac59de42ffef6afa5d8f10ef1925c32c7dc8551
Jenkins [Fri, 7 Oct 2016 17:04:12 +0000 (17:04 +0000)]
Merge "Renames OpenDaylight to OpenDaylightApi and splits out OVS configuration"
Giulio Fidente [Fri, 7 Oct 2016 10:33:50 +0000 (12:33 +0200)]
Remove unneeded *_enable_backend hiera from Manila backends
Depends-On: I04e28a95e8d69a24cd3df109bf1802bfcbd941db
Change-Id: I4ada033155e5fde0add08ec9aa8f6af7c31d53f3
Jenkins [Fri, 7 Oct 2016 11:15:38 +0000 (11:15 +0000)]
Merge "Ceilometer Wsgi Mitaka->Newton upgrades"
Juan Antonio Osorio Robles [Thu, 6 Oct 2016 08:17:38 +0000 (11:17 +0300)]
Add cloud names to hosts output
Closes-Bug: #
1631277
Change-Id: I126b3ed2afdf03ffabb7e57f8792b9f7ecc06a09
Jenkins [Fri, 7 Oct 2016 10:38:04 +0000 (10:38 +0000)]
Merge "Serialize AllNodesDeployment and UpdateWorkflow"
Pradeep Kilambi [Wed, 24 Aug 2016 15:45:06 +0000 (11:45 -0400)]
Ceilometer Wsgi Mitaka->Newton upgrades
In Newton, ceilometer api is changed to run under apache wsgi
instead of eventlet. This will require upgrades for mitaka
deployments to switch to wsgi.
Closes-Bug:
1631297
Change-Id: If9d6987cd0a8fc5d3f9de518ba422d97d5149732
Steven Hardy [Thu, 6 Oct 2016 18:15:29 +0000 (19:15 +0100)]
Serialize AllNodesDeployment and UpdateWorkflow
Otherwise there may be a race between updating the hiera
and running the UpdateWorkflow
Change-Id: I22cd893e0db3df6d39504fbd61d7d9024cebb1c5
Related-Bug:
1631297
Jenkins [Fri, 7 Oct 2016 00:26:06 +0000 (00:26 +0000)]
Merge "Specify the Ceph packages to be installed"
Jenkins [Thu, 6 Oct 2016 23:24:42 +0000 (23:24 +0000)]
Merge "Add Select per-network hostnames for service_node_names to role.role.j2.yaml"
John Fulton [Wed, 5 Oct 2016 03:29:25 +0000 (23:29 -0400)]
Specify the Ceph packages to be installed
The puppet-ceph module defaults to 'ceph' but that is a metapacakge
which isn't provided in all repos.
Depends-On: I13462219522386f8740b0d70916a44f3474115e4
Change-Id: Ie55d22301dd22102d471e6002dfcaad4bfadd5f6
Related-Bug:
1629933
Emilien Macchi [Thu, 6 Oct 2016 15:18:14 +0000 (11:18 -0400)]
Enable firewalling by default on compute nodes
- Move VXLAN and VRRP rules from Neutron Server to the right services.
- Enable Firewall by default on Compute nodes.
Change-Id: I99d172dcedaf6be297aad184cc51fe9f292a57e1
Dan Prince [Tue, 4 Oct 2016 13:59:56 +0000 (09:59 -0400)]
Re-enable ManageFirewall by default.
This default setting got lots in the composable roles/services patches.
Re-enable the ManageFirewall setting by default per what we did in
git commit
73c76b867ddc8a23a30b9a3cac4031189d4178c6.
We also fix a typo in neutron-api.yaml so that the firewall rules
matches to service_name. (otherwise it won't get loaded).
Also, drops the environments/manage-firewall.yaml which is
no longer needed if we enable firewall management by default.
Change-Id: Ie198e4efd190131d0722085b10ef77da9005bc1b
Closes-bug:
1629934
Carlos Camacho [Wed, 5 Oct 2016 09:29:59 +0000 (11:29 +0200)]
Add Select per-network hostnames for service_node_names to role.role.j2.yaml
This will wire up the per-network hostnames in the generic role.
Needs to land after https://review.openstack.org/#/c/378764
Partial-Bug: #
1626976
Change-Id: I595f35cce03d9f416a1768aa5c349a1bb20b0e19
Jenkins [Thu, 6 Oct 2016 12:34:31 +0000 (12:34 +0000)]
Merge "restore missing fluentd client functionality"
Jenkins [Thu, 6 Oct 2016 12:34:24 +0000 (12:34 +0000)]
Merge "Add generic template for custom roles."
Jenkins [Thu, 6 Oct 2016 12:31:49 +0000 (12:31 +0000)]
Merge "Set proper ceph config path for manila"
Jenkins [Thu, 6 Oct 2016 11:56:02 +0000 (11:56 +0000)]
Merge "Select per-network hostnames for service_node_names"
Jenkins [Thu, 6 Oct 2016 09:26:29 +0000 (09:26 +0000)]
Merge "Fix OpendaylightApiNetwork key naming"
Martin André [Tue, 6 Sep 2016 12:58:00 +0000 (14:58 +0200)]
Be more inclusive in insecure registry regex
The regex failed to match the INSECURE_REGISTRY string used in latest
atomic host image due to it expecting a whitespace after
--insecure-registry.
Change-Id: Ib8f288d844b4d94b0f6309bfd04bb05930d8c4c5
Carlos Camacho [Tue, 4 Oct 2016 09:50:33 +0000 (11:50 +0200)]
Add generic template for custom roles.
This submission creates a generic template
file to deploy custom roles.
Also adds a file to specify an exclusion role
list in order to avoid not to generate the
template for those roles.
Partial-Bug: #
1626976
Depends-On: I6d7247bbb8702eb0ab9bdf133b5ab1c6e8349d98
Change-Id: I3e11c089023b793a5063d9e1714527a3fe2b7458
Tom Barron [Wed, 5 Oct 2016 21:55:09 +0000 (17:55 -0400)]
Set proper ceph config path for manila
When deploying manila with cephfs backend,
/etc/manila/manila.conf should define
cephfs_conf_path = /etc/ceph/ceph.conf
in the cephfs native backend since this is
the conventional path that ceph operators expect
and since we document that path upstream.
Change-Id: I4abf5c33b675b1102413a84d64f4ce23b07b4485
Closes-Bug:
1630777
Jenkins [Wed, 5 Oct 2016 21:47:47 +0000 (21:47 +0000)]
Merge "Open tripleo-heat-templates for Ocata"
Jenkins [Wed, 5 Oct 2016 18:01:20 +0000 (18:01 +0000)]
Merge "Adds Environment File for Removing Sahara during M/N upgrade"
Lars Kellogg-Stedman [Wed, 5 Oct 2016 13:28:59 +0000 (09:28 -0400)]
restore missing fluentd client functionality
in the great rebase following the JINJA ALL THE THINGS changes we lost
critical functionality in the fluentd client service. This review
restores the missing features.
Change-Id: I7c23f16f81e75f3da6a24587b2eb8385b3e920a4
Closes-bug:
1630692
Tim Rozet [Mon, 3 Oct 2016 14:25:15 +0000 (10:25 -0400)]
Renames OpenDaylight to OpenDaylightApi and splits out OVS configuration
This patch modifies the service name to be more appropriately called
"OpenDaylightApi" along side the "OpenDaylightOvs" service used to
configure OpenVSwitch. It also splits out the OVS configuration for
controller nodes into the composable OpenDaylightOvs service.
Related-Bug: #
1629408
Change-Id: I15221401acdfb2a9ef81107b54a8005348f8372f
Signed-off-by: Tim Rozet <trozet@redhat.com>
Steven Hardy [Wed, 5 Oct 2016 14:53:16 +0000 (15:53 +0100)]
Fix OpendaylightApiNetwork key naming
This captialization won't work with the CamelCase to snake_case
conversion we do, as the required name is opendaylight_api_network
Adds some clarification to the ServiceNetMap description to hopefully
avoid future confusion.
Change-Id: Ife04ee2185e81009ebef55ad521aef799251e002
Closes-Bug: #
1629408
Jenkins [Wed, 5 Oct 2016 14:30:53 +0000 (14:30 +0000)]
Merge "Fixing resources path in OpenDaylight"
John Trowbridge [Wed, 5 Oct 2016 14:05:58 +0000 (10:05 -0400)]
Open tripleo-heat-templates for Ocata
To avoid pushing an artificial alpha tag, following PBR semver keyword
bumps major version. See http://docs.openstack.org/developer/pbr/#version
Change-Id: Ic47869c96217269806daac9c3c888603e4e5d00a
Sem-Ver: api-break
marios [Fri, 23 Sep 2016 14:19:07 +0000 (17:19 +0300)]
Adds Environment File for Removing Sahara during M/N upgrade
The default path if the operator does nothing is to keep the
sahara services on mitaka to newton upgrades.
If the operator wishes to remove sahara services then they
need to specify the provided major-upgrade-remove-sahara.yaml
environment file in the stack upgrade commands.
The existing migration to ha arch already removes the constraints
and pcs resource for sahara api/engine so we just need to stop
it from starting again if we want to remove it.
This adds a KeepSaharaServiceOnUpgrade parameter to determine if
Sahara is disabled from starting up after the controllers are
upgraded (defaults true).
Finally it is worth noting that we default the sahara services
as 'on' during converge here in the resource_registry of the
converge environment file; any subsequent stack updates where
the deployment contains sahara services will need to
include the -e /environments/services/sahara.yaml environment
file.
Related-Bug:
1630247
Change-Id: I59536cae3260e3df52589289b4f63e9ea0129407
Steven Hardy [Wed, 28 Sep 2016 15:19:56 +0000 (16:19 +0100)]
Select per-network hostnames for service_node_names
Co-Authored-By: Juan Antonio Osorio Robles <jaosorior@redhat.com>
Depends-On: Ic6fec1057439ed9122d44ef294be890d3ff8a8ee
Change-Id: I754c4a41d8a294a4c7c18bd282ae014efd4b9b16
Closes-Bug: #
1628521
Steven Hardy [Tue, 4 Oct 2016 14:52:19 +0000 (15:52 +0100)]
j2 template per-role ServiceNetMapDefaults
The *HostnameResolveNetwork should default to a sane value
for all roles, including those specified by the user.
We choose internal_api by default (maintaining the existing
special-case for the CephStorage role which uses the storage
network), but users can of course override the default with
a network of their choice.
Change-Id: Ib240f56c1db5842b953fa510316e75fd53f24735
Closes-Bug: #
1629827
Jenkins [Wed, 5 Oct 2016 03:06:17 +0000 (03:06 +0000)]
Merge "Move the main template files for defalut services to new syntax generation"
Jenkins [Tue, 4 Oct 2016 21:40:13 +0000 (21:40 +0000)]
Merge "j2 template role config templates"
Carlos Camacho [Tue, 4 Oct 2016 16:28:39 +0000 (18:28 +0200)]
Move the main template files for defalut services to new syntax generation
When generating these templates, we should
create them with the "-role" appended as they will
be generated from a role.role.j2.yaml file.
i.e. role.role.j2.yaml will generate <service>-role.yaml
config.role.j2.yaml will generate <service>-config.yaml
Partial-Bug: #
1626976
Change-Id: I614dc462fd7fc088b67634d489d8e7b68e7d4ab1
Dan Prince [Tue, 4 Oct 2016 14:04:44 +0000 (10:04 -0400)]
Include redis/mongo hiera when using pacemaker
This patch updates the pacemaker composable service templates for
mongo and redis to extend the proper base (redis.yaml and mongo.yaml)
templates instead of the -base.yaml versions. This was causing
some missing hiera settings for these services which caused symptoms
like missing firewall rules for these services.
Change-Id: I3f94acbf4d1baadbb151b1c4d34b4a0ab28ad5e5
Partial-bug: #
1629934
Jenkins [Tue, 4 Oct 2016 11:00:47 +0000 (11:00 +0000)]
Merge "Use netapp_host_type instead of netapp_eseries_host_type"
Jenkins [Tue, 4 Oct 2016 05:18:43 +0000 (05:18 +0000)]
Merge "Make keystone api network hiera composable"
Jenkins [Tue, 4 Oct 2016 03:01:11 +0000 (03:01 +0000)]
Merge "Set ceph osd max object name and namespace len on upgrade when on ext4"
Jenkins [Mon, 3 Oct 2016 22:19:31 +0000 (22:19 +0000)]
Merge "reload HAProxy config in HA setups when certificate is updated"
Jenkins [Mon, 3 Oct 2016 18:17:47 +0000 (18:17 +0000)]
Merge "Update $service to $resource this variable does not exist in the context"
Jenkins [Mon, 3 Oct 2016 16:40:41 +0000 (16:40 +0000)]
Merge "Cinder volume service is not managed by Pacemaker on BlockStorage"
Jenkins [Mon, 3 Oct 2016 16:40:06 +0000 (16:40 +0000)]
Merge "Change the rabbitmq ha policies during an M/N Upgrade"
Mathieu Bultel [Mon, 3 Oct 2016 14:02:34 +0000 (16:02 +0200)]
Update $service to $resource this variable does not exist in the context
heat failed due to a:
service: unbound variable
In the context $service is never set.
Change-Id: If82ee4562612f2617b676732956396278ee40a88
Closes-Bug: #
1629903
Juan Antonio Osorio Robles [Mon, 3 Oct 2016 13:56:21 +0000 (16:56 +0300)]
reload HAProxy config in HA setups when certificate is updated
When updating a certificate for HAProxy, we only do a reload of the
configuration on non-HA setups. This means that if we try the same in
an HA setup, the cloud will still serve the old certificate and that
leads to several issues, such as serving a revoked or even a
compromised certificate for some time, or just SSL issues that the
certificate doesn't match. This enables a reload for HA cases too.
Change-Id: Ib8ca2fe91be345ef4324fc8265c45df8108add7a
Closes-Bug: #
1629886
Jenkins [Mon, 3 Oct 2016 09:50:29 +0000 (09:50 +0000)]
Merge "Fixed NoneType issue when monitoring-environment.yaml"
Jenkins [Mon, 3 Oct 2016 09:50:23 +0000 (09:50 +0000)]
Merge "Balance Rabbitmq Queue Master Location on queue declaration with min-masters strategy"
Jenkins [Mon, 3 Oct 2016 09:50:16 +0000 (09:50 +0000)]
Merge "Change rabbitmq queues HA mode from ha-all to ha-exactly"
Michele Baldessari [Sat, 1 Oct 2016 15:42:54 +0000 (17:42 +0200)]
Change the rabbitmq ha policies during an M/N Upgrade
This takes care of the M->N upgrade path when changing
the ha rabbitmq policy.
Partial-Bug: #
1628998
Change-Id: I2468a096b5d7042bc801a742a7a85fb1521c1c02
Jenkins [Mon, 3 Oct 2016 06:35:06 +0000 (06:35 +0000)]
Merge "Fixed NoneType issue when logging-environment.yaml is used"
Michele Baldessari [Thu, 29 Sep 2016 16:30:23 +0000 (18:30 +0200)]
Change rabbitmq queues HA mode from ha-all to ha-exactly
It turns out that reducing number of rabbitmq queues in cluster
significantly improves performance of cluster especially in the case of
failover recovery time. Right now the cluster uses ha-all mode for rabbitmq
queues.
It is best to change this to "ha-exactly" mode and reduce the number
of queue copies to ceil(N/2) where N is number of controllers in the
cluster - so in typical scenario of 3 controller It would be 2 by
default.
It does not make much sense to keep the copies of queues over whole
cluster since if the quorum of nodes is lost then the rest of cluster
nodes will be stopped anyway. We let the user override this with a
parameter.
I.e. for a 3 node controlplane cluster we will go from this:
pcs resource show rabbitmq
Resource: rabbitmq (class=ocf provider=heartbeat type=rabbitmq-cluster)
Attributes: set_policy="ha-all ^(?!amq\.).* {"ha-mode":"all"}"
To this:
pcs resource show rabbitmq
Resource: rabbitmq (class=ocf provider=heartbeat type=rabbitmq-cluster)
Attributes: set_policy="ha-all ^(?!amq\.).* {"ha-mode":"exactly","ha-params":2}"
According to Marin Krcmarik's testing recovery time from failure was
reduced significantly.
Partial-Bug: #
1628998
Change-Id: Iace6daf27a76cb8ef1050ada0de7ff1f530916c6
Jenkins [Fri, 30 Sep 2016 18:54:57 +0000 (18:54 +0000)]
Merge "telemetry: remove coordination_url hiera settings"
Jenkins [Fri, 30 Sep 2016 18:52:04 +0000 (18:52 +0000)]
Merge "Telemetry: add redis_password hiera parameter"
Jenkins [Fri, 30 Sep 2016 17:44:22 +0000 (17:44 +0000)]
Merge "Replace per role manifests with a common role manifest"
Steven Hardy [Fri, 30 Sep 2016 14:23:26 +0000 (15:23 +0100)]
Make keystone api network hiera composable
These hard-coded references to the Controller role mean that
things won't work if the keystone service is moved to any other
role, so we need to generate the lists dynamically based on the
enabled services for each role.
Change-Id: I5f1250a8a1a38cb3909feeb7d4c1000fd0fabd14
Closes-Bug: #
1629096
Steven Hardy [Wed, 28 Sep 2016 16:03:42 +0000 (17:03 +0100)]
j2 template role config templates
This means the user won't have to manually specify e.g the
OS::TripleO::ACustomRoleConfig resource manually.
Partial-Bug:
1626976
Change-Id: I063571d4c5cbc2f295a7a044d81c27d703bd0e10
Depends-On: I9f920e191344040a564214f3f9a1147b265e9ff3
Steven Hardy [Fri, 23 Sep 2016 14:39:33 +0000 (15:39 +0100)]
Replace per role manifests with a common role manifest
This removes the (nearly empty) per role manifests, and
replaces them with a generic manifest, where we use str_replace
to substitute the role name at runtime (or in some cases a
subset of the name for backwards compatibility)
Change-Id: I79da0f523189959b783bbcbb3b0f37be778e02fe
Partial-Bug: #
1626976
Emilien Macchi [Fri, 30 Sep 2016 13:48:56 +0000 (09:48 -0400)]
telemetry: remove coordination_url hiera settings
They are now normalized and set in puppet-tripleo.
Change-Id: I197481c577b85894178e7899a55869da47847755
Closes-Bug: #
1629279
Depends-On: Ic6de09acf0d36ca90cc2041c0add1bc2b4a369a5
Emilien Macchi [Fri, 30 Sep 2016 13:28:06 +0000 (09:28 -0400)]
Telemetry: add redis_password hiera parameter
Add redis_password parameter in Hiera so we can re-use it from
puppet-tripleo later for Aodh, Ceilometer and Gnocchi.
Change-Id: I038e2bac22e3bfa5047d2e76e23cff664546464d
Partial-Bug: #
1629279
Juan Badia Payno [Fri, 30 Sep 2016 08:25:44 +0000 (10:25 +0200)]
Fixed NoneType issue when monitoring-environment.yaml
When you tried to use the environemnt/monitoring-environment.yaml
as a part of the deployment on the overcloud you hit the
following error and it stops the deploy of the overcloud.
***
Deploying templates in the directory /home/stack/tripleo-heat-templates
'NoneType' object does not support item assignment
***
Closes-Bug: #
1629323
Change-Id: I8cf2e7d8f3a4e79cc71a1566ec17d0a977c38d60
Signed-off-by: Juan Badia Payno <jbadiapa@redhat.com>
Juan Badia Payno [Fri, 30 Sep 2016 08:13:29 +0000 (10:13 +0200)]
Fixed NoneType issue when logging-environment.yaml is used
When you tried to use the environemnt/logging-environemnt.yaml
as a part of the deployment on the overcloud you hit the
following error and it stops the deploy of the overcloud.
***
Deploying templates in the directory /home/stack/tripleo-heat-templates
'NoneType' object does not support item assignment
***
Closes-Bug: #
1629315
Change-Id: I55e5c7f20ddf30f3e48247b734f6fa47f5de3750
Signed-off-by: Juan Badia Payno <jbadiapa@redhat.com>
Jenkins [Fri, 30 Sep 2016 12:48:04 +0000 (12:48 +0000)]
Merge "Add option to specify Certmonger CA"
Jenkins [Fri, 30 Sep 2016 07:48:29 +0000 (07:48 +0000)]
Merge "Move the rest of static roles resource registry entries to j2"
Juan Antonio Osorio Robles [Mon, 12 Sep 2016 08:46:15 +0000 (11:46 +0300)]
Add flag for internal TLS
This sets up a flag that tells the profiles to use TLS (this will happen
in the internal network).
bp tls-via-certmonger
Change-Id: If47febb5b38b1c65f60f9de87a34cb31936a7c0d
Jenkins [Thu, 29 Sep 2016 23:58:01 +0000 (23:58 +0000)]
Merge "Use -L with chown and set crush map tunables when upgrading Ceph"
Jenkins [Thu, 29 Sep 2016 23:57:43 +0000 (23:57 +0000)]
Merge "Fix typo in fixing gnocchi upgrade."
Jenkins [Thu, 29 Sep 2016 23:52:33 +0000 (23:52 +0000)]
Merge "Add gateway_ip in OS::Neutron::Subnet"
Juan Antonio Osorio Robles [Wed, 17 Aug 2016 12:24:23 +0000 (12:24 +0000)]
Add HAProxy TLS handled by certmonger as composable service
This adds some basic pieces to get certmonger to manage the
certificates for HAProxy. The aim is to be flexible enough that we
will be able to manage both public and internal certificates.
This also adds a relevant environment to get the endpoints to have
TLS everywhere.
bp tls-via-certmonger
Depends-On: I89001ae32f46c9682aecc118753ef6cd647baa62
Change-Id: Ife5f8c2f07233295bc15b4c605acf3d9bd62f162
Juan Antonio Osorio Robles [Mon, 12 Sep 2016 08:42:02 +0000 (11:42 +0300)]
Add option to specify Certmonger CA
This will be used for internal (or even public) TLS, for when
certmonger is generating the certificates. This same setting is used
for the undercloud with the generate_service_certificate option.
Change-Id: Ic54fe512b9ed5c71417a66491b7954e653f660b6
Michele Baldessari [Thu, 29 Sep 2016 16:50:39 +0000 (18:50 +0200)]
Balance Rabbitmq Queue Master Location on queue declaration with min-masters strategy
It may happen that one of the controllers may become unavailable and
Queue Masters will be located on available controllers during queue
declarations. Once a lost controller will be become available masters of
newly declared queues are not placed with priority to such controller
with obviously lower number of queue masters and thus the distribution
may be unbalanced and one of the controllers may become under
significantly higher load in some circumstances of multiple fail-overs.
With rabbit 3.6.0 rabbitmq introduced a new HA feature of Queue masters
distribution - one of the strategies is min-masters, which picks the
node hosting the minimum number of masters.
One of the ways how to turn such min-masters strategy on is by adding
following into configuration file - rabbitmq.config
{rabbit,[ ..
{queue_master_locator, <<"min-masters">>},
.. ]},
Change-Id: I61bcab0e93027282b62f2a97bec87cbb0a6e6551
Closes-Bug: #
1629010
Giulio Fidente [Thu, 29 Sep 2016 11:52:32 +0000 (13:52 +0200)]
Set ceph osd max object name and namespace len on upgrade when on ext4
As per [1] we need to lower osd max object name and namespace len when
upgrading from Hammer and the OSD is backed by ext4.
These could also be given via ExtraConfig but on upgrade we only run
puppet apply after this script is executed, so the values won't be
effective unless the daemon is restarted. Yet we do not want puppet
to restart the daemon because we can't bring all OSDs down
unconditionally or guests will die.
1. http://tracker.ceph.com/issues/16187
Co-Authored-By: Michele Baldessari <michele@acksyn.org>
Co-Authored-By: Dimitri Savineau <dsavinea@redhat.com>
Change-Id: I7fec4e2426bdacd5f364adbebd42ab23dcfa523a
Closes-Bug:
1628874
Juan Antonio Osorio Robles [Mon, 26 Sep 2016 07:52:02 +0000 (10:52 +0300)]
Add parameters to run nova over httpd
This adds the necessary hieradata to run nova over httpd instead
of eventlet.
Change-Id: I57fb20cf0d58b3376243ba4aeb04e995e7152ce3
Giulio Fidente [Thu, 29 Sep 2016 12:05:46 +0000 (14:05 +0200)]
Cinder volume service is not managed by Pacemaker on BlockStorage
We do not want cinder-volume to be managed by Pacemaker on
BlockStorage nodes, where Pacemaker is not running at all.
This change adds a new BlockStorageCinderVolume service name
which can (and is, by default) mapped to the non Pacemaker
implementation of the service.
The error was:
Could not find dependency Exec[wait-for-settle] for
Pacemaker::Resource::Systemd[openstack-cinder-volume]
Also moves cinder::host setting into the Pacemaker specific service
definition because we only want to set a shared host= string when
the service is managed by Pacemaker.
Closes-Bug: #
1628912
Change-Id: I2f7e82db4fdfd5f161e44d65d17893c3e19a89c9
Carlos Camacho [Thu, 29 Sep 2016 12:57:36 +0000 (14:57 +0200)]
Move the rest of static roles resource registry entries to j2
Moving the rest of the static based resource registry
entries to j2, this allows to extend the content of the
template to the roles_list.
Also moved the templates to correspond with the role name.
Partial-Bug: #
1626976
Change-Id: I1cbe101eb4ce5a89cba5f2cc45cace43d3380f22
Jenkins [Thu, 29 Sep 2016 14:56:56 +0000 (14:56 +0000)]
Merge "j2 template per-role things in default registry"
Jenkins [Thu, 29 Sep 2016 14:56:49 +0000 (14:56 +0000)]
Merge "Relax pre-upgrade check for failed actions"
Jenkins [Thu, 29 Sep 2016 14:56:41 +0000 (14:56 +0000)]
Merge "Fix races in major-upgrade-pacemaker Step2"
Sofer Athlan-Guyot [Thu, 29 Sep 2016 13:22:16 +0000 (15:22 +0200)]
Fix typo in fixing gnocchi upgrade.
Change-Id: I44451a280dd928cd694dd6845d5d83040ad1f482
Related-Bug: #
1626592
Jenkins [Thu, 29 Sep 2016 13:08:35 +0000 (13:08 +0000)]
Merge "Full HA->HA NG migration might fail setting maintenance-mode"
Jenkins [Thu, 29 Sep 2016 13:03:21 +0000 (13:03 +0000)]
Merge "Update gnocchi database during M/N upgrade."
Giulio Fidente [Wed, 28 Sep 2016 13:05:14 +0000 (15:05 +0200)]
Use -L with chown and set crush map tunables when upgrading Ceph
Previously the chown command wasn't traversing symlinks, causing
the new ownership to not be set for some needed files.
This change also ensures the crush map tunables are set to the 'default'
profile after the upgrade.
Finally redirects the output of a pidof to /dev/null to avoid spurious
logging.
Change-Id: Id4865ffff207edfc727d729f9cc04e6e81ad19d8