apex-tripleo-heat-templates.git
7 years agoTag the ha containers with 'pcmklatest' at deploy time
Michele Baldessari [Tue, 8 Aug 2017 07:46:26 +0000 (09:46 +0200)]
Tag the ha containers with 'pcmklatest' at deploy time

We need to tag the HA containers with a special tag so
that the RA definition never changes. We do this step in THT
as opposed to puppet because we need to guarantee
that all images are tagged on all nodes *before* step 2 where the bundle
gets created.

NB: Getting the image name without the tag will require some more
yaql work to get all the cases right. Right now this works only
if we enforce that the image has a ':tag' at the end of the name.
So far this is always the case. If things change we will need to
amend this code.

Co-Authored-By: Damien Ciabrini <dciabrin@redhat.com>
Co-Authored-By: Sofer Athlan-Guyot <sathlang@redhat.com>
Change-Id: I362e6cf26fba77d3f949b7d2fc4b35a3eab9087e

7 years agoMerge "Refactor setup_docker_host.sh as host_prep_tasks"
Jenkins [Fri, 18 Aug 2017 09:17:15 +0000 (09:17 +0000)]
Merge "Refactor setup_docker_host.sh as host_prep_tasks"

7 years agoMerge "Provide sample environment for composable roles"
Jenkins [Fri, 18 Aug 2017 07:43:47 +0000 (07:43 +0000)]
Merge "Provide sample environment for composable roles"

7 years agoMerge "Containerize Manila Share for HA"
Jenkins [Fri, 18 Aug 2017 07:39:02 +0000 (07:39 +0000)]
Merge "Containerize Manila Share for HA"

7 years agoMerge "Add support for installing Ceph MDS via ceph-ansible"
Jenkins [Fri, 18 Aug 2017 02:50:50 +0000 (02:50 +0000)]
Merge "Add support for installing Ceph MDS via ceph-ansible"

7 years agoMerge "Make cinder-manage db sync run on only one controller during upgrade"
Jenkins [Fri, 18 Aug 2017 02:23:17 +0000 (02:23 +0000)]
Merge "Make cinder-manage db sync run on only one controller during upgrade"

7 years agoMerge "Remove iscsid from TLS everywhere docker environment"
Jenkins [Fri, 18 Aug 2017 01:28:19 +0000 (01:28 +0000)]
Merge "Remove iscsid from TLS everywhere docker environment"

7 years agoMerge "Mount NFS volume to docker container."
Jenkins [Thu, 17 Aug 2017 19:10:04 +0000 (19:10 +0000)]
Merge "Mount NFS volume to docker container."

7 years agoMerge "Enable TLS configuration for containerized RabbitMQ"
Jenkins [Thu, 17 Aug 2017 18:46:42 +0000 (18:46 +0000)]
Merge "Enable TLS configuration for containerized RabbitMQ"

7 years agoMerge "Enable TLS for containerized MySQL"
Jenkins [Thu, 17 Aug 2017 16:08:31 +0000 (16:08 +0000)]
Merge "Enable TLS for containerized MySQL"

7 years agoMerge "Enable TLS for containerized haproxy"
Jenkins [Thu, 17 Aug 2017 16:08:20 +0000 (16:08 +0000)]
Merge "Enable TLS for containerized haproxy"

7 years agoMerge "Render IP map and host maps according to network_data.yaml"
Jenkins [Thu, 17 Aug 2017 15:51:00 +0000 (15:51 +0000)]
Merge "Render IP map and host maps according to network_data.yaml"

7 years agoMerge "Enable TLS configuration for containerized HAProxy"
Jenkins [Thu, 17 Aug 2017 15:48:44 +0000 (15:48 +0000)]
Merge "Enable TLS configuration for containerized HAProxy"

7 years agoRefactor setup_docker_host.sh as host_prep_tasks
Jiri Stransky [Tue, 30 May 2017 15:29:51 +0000 (17:29 +0200)]
Refactor setup_docker_host.sh as host_prep_tasks

Previously what we've been doing with setup_docker_host.sh can now be
achieved with host_prep_tasks, and we can free up the NodeUserData
interface for other use cases.

Closes-Bug: #1711387
Change-Id: Iaac90efd03e37ceb02c312f9c15c1da7d4982510

7 years agoProvide sample environment for composable roles
Alex Schultz [Tue, 25 Jul 2017 21:38:46 +0000 (15:38 -0600)]
Provide sample environment for composable roles

Creating a sample environment generator configuration to generate basic
environment files for the following architectures:

 * Monolithic HA (3 Controller, 3 Compute, 1 Ceph)
 * Monolithic Non-HA (1 Controller, 1 Compute, 1 Ceph)
 * Standalone (3 Controller, 3 Database, 3 Messaging, 2 Networker,
   1 Compute, 1 Ceph)

Change-Id: Id0b967d3b2356f38a51e1028b2dccc122d59888c
Related-Blueprint: example-custom-role-environments

7 years agoMerge "README: Fix CI coverage layout"
Jenkins [Thu, 17 Aug 2017 13:43:32 +0000 (13:43 +0000)]
Merge "README: Fix CI coverage layout"

7 years agoRemove iscsid from TLS everywhere docker environment
Juan Antonio Osorio Robles [Thu, 17 Aug 2017 08:04:10 +0000 (08:04 +0000)]
Remove iscsid from TLS everywhere docker environment

Since nova-compute is not containerized with TLS yet, using containerized
iscsid causes errors when trying to spawn a VM with a volume. Since
the path is different in this case.

I will re-add iscsid to this environment once nova-compute is
containerized with TLS.

bp tls-via-certmonger-containers

Change-Id: Ida87b187e56ae852c5a4ef6f78cc04a0870fe3f4

7 years agoMerge "Remove duplicate Iscsid service in resource registry"
Jenkins [Thu, 17 Aug 2017 07:21:15 +0000 (07:21 +0000)]
Merge "Remove duplicate Iscsid service in resource registry"

7 years agoMerge "Set default OSD pool size to 1 in scenario 001/004 containers"
Jenkins [Thu, 17 Aug 2017 04:37:16 +0000 (04:37 +0000)]
Merge "Set default OSD pool size to 1 in scenario 001/004 containers"

7 years agoMerge "Containerize virtlogd"
Jenkins [Thu, 17 Aug 2017 01:02:22 +0000 (01:02 +0000)]
Merge "Containerize virtlogd"

7 years agoMerge "Delete docker-centos-tripleoupstream.yaml"
Jenkins [Thu, 17 Aug 2017 01:00:06 +0000 (01:00 +0000)]
Merge "Delete docker-centos-tripleoupstream.yaml"

7 years agoMerge "Add ServiceData to hidden params"
Jenkins [Wed, 16 Aug 2017 21:11:48 +0000 (21:11 +0000)]
Merge "Add ServiceData to hidden params"

7 years agoMerge "Add NeutronOverlayIPVersion parameter to neutron-plugins-ml2 service"
Jenkins [Wed, 16 Aug 2017 19:46:32 +0000 (19:46 +0000)]
Merge "Add NeutronOverlayIPVersion parameter to neutron-plugins-ml2 service"

7 years agoContainerize Manila Share for HA
Victoria Martinez de la Cruz [Tue, 11 Jul 2017 19:42:15 +0000 (16:42 -0300)]
Containerize Manila Share for HA

This service allows configuring and deploying manila-share
containers in a HA overcloud managed by pacemaker.

The containers are managed and run by pacemaker. Pacemaker runs the
standard Kolla image but overrides the initial command so that
it explicitely calls manila-share. This way, we shield ourselves
from any unexpected future change in Kolla.
This container needs to use the 'docker_config' section to invoke
puppet (as opposed to 'docker_puppet_tasks'), because due to the HA
composability each resource creation needs to happen on the bootstrap
node of that service and 'docker_puppet_tasks' will only run on the
controller/primary role.

Based on work done in fdb233e64e3d78014dd7e351abfed5aec5035866

Partial-Bug: #1668922

Change-Id: Ifa94c506db5eb667690a19d594115a93d2a790b2
Depends-On: I797eea2f7788f65411964ccb852b5707e916416f

7 years agoREADME: Fix CI coverage layout
Emilien Macchi [Wed, 16 Aug 2017 17:28:29 +0000 (10:28 -0700)]
README: Fix CI coverage layout

Change-Id: Ib892f54781e568fb267a34390fec1a7e0323de2c

7 years agoMerge "Render VIPs dynamically based on network_data.yaml"
Jenkins [Wed, 16 Aug 2017 15:30:29 +0000 (15:30 +0000)]
Merge "Render VIPs dynamically based on network_data.yaml"

7 years agoAdd support for installing Ceph MDS via ceph-ansible
John Fulton [Fri, 30 Jun 2017 22:07:46 +0000 (22:07 +0000)]
Add support for installing Ceph MDS via ceph-ansible

Based on puppet/services/ceph-mds.yaml. Nodes in the CephMds role
will already be in the Ansible inventory but this change provides
a way pass their parameters to ceph-ansible.

Co-Authored-By: Giulio Fidente <gfidente@redhat.com>
Change-Id: Ia3ef9e9a2b159dacea01e38762145ff2bcc7ba27

7 years agoRender IP map and host maps according to network_data.yaml
Dan Sneddon [Tue, 15 Aug 2017 18:39:53 +0000 (11:39 -0700)]
Render IP map and host maps according to network_data.yaml

This change renders the network IP maps and hostname maps for
all networks defined in network_data.yaml. This should make it
possible to create custom networks that will be rendered for
all applicable roles.

Note that at this time all networks will be rendered whether
they are enabled or not. All networks will be present in all
roles, but ports will be associated with noop.yaml in roles
that do not use the network. This is in accordance with
previous behavior, although we may wish to change this in
the future to limit the size of the role definitions and
reduce the number of placeholder resources in deployments
with many networks.

Note that this patch is a replacement for original patch
https://review.openstack.org/#/c/486280, which I was having
trouble rebasing to current.

Change-Id: I445b008fc1240af57c2b76a5dbb6c751a05b7a2a
Depends-on: I662e8d0b3737c7807d18c8917bfce1e25baa3d8a
Partially-implements: blueprint composable-networks

7 years agoSet default OSD pool size to 1 in scenario 001/004 containers
Giulio Fidente [Wed, 16 Aug 2017 11:41:28 +0000 (13:41 +0200)]
Set default OSD pool size to 1 in scenario 001/004 containers

When the OSD pool size is unset it defaults to 3, while we only
have a single OSD in CI so the pools are created but not writable.

We did set the default pool size to 1 in the non-containerized
scenarios but apparently missed it in the containerized version.

Change-Id: I1ac1fe5c2effd72a2385ab43d27abafba5c45d4d
Closes-Bug: #1710773

7 years agoMerge "Don't unregister on system/resource delete"
Jenkins [Wed, 16 Aug 2017 06:43:02 +0000 (06:43 +0000)]
Merge "Don't unregister on system/resource delete"

7 years agoMerge "Bind mount tripleo.cnf in transient bootstrap containers"
Jenkins [Wed, 16 Aug 2017 01:38:32 +0000 (01:38 +0000)]
Merge "Bind mount tripleo.cnf in transient bootstrap containers"

7 years agoMerge "Convert network templates to be rendered via j2"
Jenkins [Wed, 16 Aug 2017 01:38:25 +0000 (01:38 +0000)]
Merge "Convert network templates to be rendered via j2"

7 years agoMerge "Consolidate deployment in major-upgrade-composable-steps"
Jenkins [Wed, 16 Aug 2017 00:39:01 +0000 (00:39 +0000)]
Merge "Consolidate deployment in major-upgrade-composable-steps"

7 years agoMerge "Do not run clustercheck on the host after O->P upgrade"
Jenkins [Tue, 15 Aug 2017 23:53:57 +0000 (23:53 +0000)]
Merge "Do not run clustercheck on the host after O->P upgrade"

7 years agoMerge "Internal TLS support for mongodb container"
Jenkins [Tue, 15 Aug 2017 23:53:29 +0000 (23:53 +0000)]
Merge "Internal TLS support for mongodb container"

7 years agoMerge "Set file mode permission of Ceph keyrings"
Jenkins [Tue, 15 Aug 2017 23:53:22 +0000 (23:53 +0000)]
Merge "Set file mode permission of Ceph keyrings"

7 years agoMerge "Make network-isolation-v6 environment rendered for all roles"
Jenkins [Tue, 15 Aug 2017 23:08:42 +0000 (23:08 +0000)]
Merge "Make network-isolation-v6 environment rendered for all roles"

7 years agoMerge "Fix parsing of DockerCephDaemonImage parameter"
Jenkins [Tue, 15 Aug 2017 16:12:19 +0000 (16:12 +0000)]
Merge "Fix parsing of DockerCephDaemonImage parameter"

7 years agoAdd NeutronOverlayIPVersion parameter to neutron-plugins-ml2 service
Feng Pan [Tue, 16 May 2017 19:22:47 +0000 (15:22 -0400)]
Add NeutronOverlayIPVersion parameter to neutron-plugins-ml2 service

This patch adds NeutronOverlayIPVersion parameter to congfigure
neutron ML2 overlay_ip_version option from T-H-T. puppet-neutron
already has support for configuration of this option, we are just
exposing it from T-H-T. This parameter needs to be set to '6' when
IPv6 vxlan tunnel endpoints are desired.

Closes-Bug: #1691213

Change-Id: I056afa25f67a3b6857bdfef14e6d582b0a9e5e93
Signed-off-by: Feng Pan <fpan@redhat.com>
7 years agoMerge "Fix Heat condition for RHEL registration yum update"
Jenkins [Tue, 15 Aug 2017 14:34:38 +0000 (14:34 +0000)]
Merge "Fix Heat condition for RHEL registration yum update"

7 years agoConvert network templates to be rendered via j2
Steven Hardy [Wed, 9 Aug 2017 18:17:49 +0000 (19:17 +0100)]
Convert network templates to be rendered via j2

Use the network.network.j2.yaml to render these files, instead
of relying on the hard-coded versions.

Note this doesn't currently consider the _v6 templates as we may want
to deprecate these and instead rely on an ipv6 specific network_data file,
or perhaps make the network/network.network.j2.yaml generic and able to
detect the version from the cidr?

Change-Id: I662e8d0b3737c7807d18c8917bfce1e25baa3d8a
Partially-Implements: blueprint composable-networks

7 years agoMerge "Enable TLS configuration for containerized Galera"
Jenkins [Mon, 14 Aug 2017 23:03:35 +0000 (23:03 +0000)]
Merge "Enable TLS configuration for containerized Galera"

7 years agoMerge "Make HA container bundle work on remote nodes"
Jenkins [Mon, 14 Aug 2017 23:03:27 +0000 (23:03 +0000)]
Merge "Make HA container bundle work on remote nodes"

7 years agoMerge "Convert cephstorage-role.yaml to role.role.j2.yaml"
Jenkins [Mon, 14 Aug 2017 23:03:17 +0000 (23:03 +0000)]
Merge "Convert cephstorage-role.yaml to role.role.j2.yaml"

7 years agoMerge "Fix metadata_settings in containerized mongodb"
Jenkins [Mon, 14 Aug 2017 22:52:21 +0000 (22:52 +0000)]
Merge "Fix metadata_settings in containerized mongodb"

7 years agoDelete docker-centos-tripleoupstream.yaml
Steve Baker [Wed, 26 Jul 2017 22:23:39 +0000 (10:23 +1200)]
Delete docker-centos-tripleoupstream.yaml

This file is generated and needs to be manually maintained. It
would be better for users who want to deploy latest directly from
docker hub to generate it locally by running:

    openstack overcloud container image prepare \
      --namespace tripleoupstream \
      --tag latest \
      --env-file docker-centos-tripleoupstream.yaml

The documentation and CI are being updated to use prepare.

Change-Id: I86503f1076459ae9d84a34e649a6097cba10fa3c
Closes-Bug: #1696598

7 years agoMerge "Enable TLS for nova api and placement containers"
Jenkins [Mon, 14 Aug 2017 22:02:25 +0000 (22:02 +0000)]
Merge "Enable TLS for nova api and placement containers"

7 years agoMerge "Make containerized nova-api run with httpd"
Jenkins [Mon, 14 Aug 2017 22:01:04 +0000 (22:01 +0000)]
Merge "Make containerized nova-api run with httpd"

7 years agoSet file mode permission of Ceph keyrings
John Fulton [Wed, 9 Aug 2017 21:07:40 +0000 (17:07 -0400)]
Set file mode permission of Ceph keyrings

Pass mode parameter to ceph-ansible in place of ACLs parameter
because ACLs are not for same UID in container as container host
and because ACLs are not passed by kolla_config.

Change-Id: I7e3433eab8e2a62963b623531f223d5abd301d16
Closes-Bug: #1709683

7 years agoEnable TLS for containerized MySQL
Juan Antonio Osorio Robles [Mon, 14 Aug 2017 14:23:21 +0000 (14:23 +0000)]
Enable TLS for containerized MySQL

Bind mounts and adds the appropriate permissions for the cert and
key that's used for TLS.

bp tls-via-certmonger-containers

Change-Id: I7fae4083604c7dc89ca04141080a228ebfc44ac9

7 years agoEnable TLS for containerized haproxy
Juan Antonio Osorio Robles [Wed, 2 Aug 2017 07:34:02 +0000 (10:34 +0300)]
Enable TLS for containerized haproxy

This bind mounts the certificates if TLS is enabled in the internal
network. It also disables the CRL usage since we can't restart haproxy
at the rate that the CRL is updated. This will be addressed later and
is a known limitation of using containerized haproxy (there's the same
issue in the HA scenario). To address the different UID that the certs
and keys will have, I added an extra step that changes the ownership
of these files; though this only gets included if TLS in the internal
network is enabled.

bp tls-via-certmonger-containers

Depends-On: I2078da7757ff3af1d05d36315fcebd54bb4ca3ec
Change-Id: Ic6ca88ee7b6b256ae6182e60e07498a8a793d66a

7 years agoDon't unregister on system/resource delete
James Slagle [Fri, 11 Aug 2017 12:05:10 +0000 (08:05 -0400)]
Don't unregister on system/resource delete

Don't unregister systems from the portal/satellite
when deleting from Heat. There are several reasons why
it's compelling to fix this behavior. See
https://bugs.launchpad.net/tripleo/+bug/1710144
for full information. The previous behavior can be triggered
by setting the DeleteOnRHELUnregistration parameter to "true".

Closes-Bug: #1710144
Change-Id: I909a6f7a049dc23fc27f2231a4893d428f06a1f1

7 years agoFix Heat condition for RHEL registration yum update
James Slagle [Thu, 10 Aug 2017 17:42:31 +0000 (13:42 -0400)]
Fix Heat condition for RHEL registration yum update

There were 2 problems with this condition making the
rhel-registration.yal template broken:

"conditions" should be "condition"

The condition should refer to just a condition name defined in the
"conditions:" section of the template.

Change-Id: I14d5c72cf86423808e81f1d8406098d5fd635e66
Closes-Bug: #1709916

7 years agoFix metadata_settings in containerized mongodb
Damien Ciabrini [Wed, 9 Aug 2017 07:25:42 +0000 (07:25 +0000)]
Fix metadata_settings in containerized mongodb

The containerized version of the mongodb service omits the
metadata_settings definition [1], which confuses certmonger when
internal TLS is enabled and make the generation of certificates fail.

Use the right setting from the non-containerized profile.

[1] https://review.openstack.org/#/c/461780/

Change-Id: I50a9a3a822ba5ef5d2657a12c359b51b7a3a42f2
Closes-Bug: #1709553

7 years agoBind mount tripleo.cnf in transient bootstrap containers
Damien Ciabrini [Fri, 11 Aug 2017 11:24:12 +0000 (11:24 +0000)]
Bind mount tripleo.cnf in transient bootstrap containers

Various containerized services (e.g. nova, neutron, heat) run initial set up
steps with some ephemeral containers that don't use kolla_start. The
tripleo.cnf file is not copied in /etc/my.cnf.d and this can break some
deployments (e.g. when using internal TLS, service lack SSL settings).

Fix the configuration of transient containers by bind mounting of the
tripleo.cnf file when kolla_start is not used.

Change-Id: I5246f9d52fcf8c8af81de7a0dd8281169c971577
Closes-Bug: #1710127
Co-Authored-By: Juan Antonio Osorio Robles <jaosorior@redhat.com>
7 years agoContainerize virtlogd
Jiri Stransky [Tue, 30 May 2017 13:49:51 +0000 (15:49 +0200)]
Containerize virtlogd

So far we've been using virtlogd running on the host, we should now be
using virtlogd from a container.

Co-Authored-By: Martin André <m.andre@redhat.com>
Co-Authored-By: Jiri Stransky <jistr@redhat.com>
Change-Id: I998c69ea1f7480ebb90afb44d6006953a84a1c04

7 years agoConsolidate deployment in major-upgrade-composable-steps
Jose Luis Franco Arza [Mon, 14 Aug 2017 09:49:00 +0000 (11:49 +0200)]
Consolidate deployment in major-upgrade-composable-steps

After 483293 commit is merged, major-upgrade-composable-steps.yaml file
is pointing to the wrong location deployment, which is now under
common/ folder.

Change-Id: Ic6784533d1c21b5b8fcb422bccd820af72e499d9

7 years agoMerge "Pass monitor_address_block to ceph-ansible for mon_host"
Jenkins [Sun, 13 Aug 2017 22:26:57 +0000 (22:26 +0000)]
Merge "Pass monitor_address_block to ceph-ansible for mon_host"

7 years agoMerge "Add environment to disable deploy steps"
Jenkins [Sun, 13 Aug 2017 06:56:00 +0000 (06:56 +0000)]
Merge "Add environment to disable deploy steps"

7 years agoMerge "Add support for update_tasks"
Jenkins [Sun, 13 Aug 2017 06:51:54 +0000 (06:51 +0000)]
Merge "Add support for update_tasks"

7 years agoMerge "Add RoleConfig output"
Jenkins [Sun, 13 Aug 2017 06:51:35 +0000 (06:51 +0000)]
Merge "Add RoleConfig output"

7 years agoMerge "Default docker_puppet_debug to false"
Jenkins [Sun, 13 Aug 2017 06:50:34 +0000 (06:50 +0000)]
Merge "Default docker_puppet_debug to false"

7 years agoMerge "Move deploy-steps-playbook to deploy-steps-tasks"
Jenkins [Sun, 13 Aug 2017 06:45:37 +0000 (06:45 +0000)]
Merge "Move deploy-steps-playbook to deploy-steps-tasks"

7 years agoMerge "Convert blockstorage-role.yaml to role.role.j2.yaml"
Jenkins [Sat, 12 Aug 2017 13:48:35 +0000 (13:48 +0000)]
Merge "Convert blockstorage-role.yaml to role.role.j2.yaml"

7 years agoMerge "Convert objectstorage-role.yaml to role.role.j2.yaml"
Jenkins [Sat, 12 Aug 2017 13:22:39 +0000 (13:22 +0000)]
Merge "Convert objectstorage-role.yaml to role.role.j2.yaml"

7 years agoFix parsing of DockerCephDaemonImage parameter
Giulio Fidente [Tue, 8 Aug 2017 11:25:27 +0000 (13:25 +0200)]
Fix parsing of DockerCephDaemonImage parameter

Splitting by colon using native str_split function did not work well
because we needed a right split.

This change replaces the str_split calls with yaql rightSplit().

Change-Id: Iab2f69a5fadc6b02e2eacf3c9d1a9024b0212ac6

7 years agoPass monitor_address_block to ceph-ansible for mon_host
Giulio Fidente [Tue, 8 Aug 2017 21:18:23 +0000 (23:18 +0200)]
Pass monitor_address_block to ceph-ansible for mon_host

The ip address which clients and other nodes use to connect to the
monitors is derived from the monitor_interface parameter unless
a monitor_address or monitor_address_block is given (to set mon_host
into ceph.conf); this change adds setting for monitor_address_block to
match the public_network so that clients attempt to connect to the mons
on the appropriate network.

Change-Id: I7187e739e9f777eab724fbc09e8b2c8ddedc552d
Closes-Bug: #1709485

7 years agoAdd environment to disable deploy steps
Steven Hardy [Fri, 21 Jul 2017 16:45:09 +0000 (17:45 +0100)]
Add environment to disable deploy steps

This enables either deploying without configuring any services, or
temporarily disabling the deploy steps such as will be required
for minor updates where we want to re-run the rolling update outside
of heat.

To deploy directly via ansible-playbook you can do e.g:

openstack overcloud config download --config-dir tmpconfig
cd tmpconfig/tripleo-6b02U7-config
ansible-playbook -vvv -b -i /usr/bin/tripleo-ansible-inventory deploy_steps_playbook.yaml

Which will run the same ansible steps as we normally run via heat.

Change-Id: I59947b67523dfcc43d454d4ac7d82b06804cf71d

7 years agoAdd support for update_tasks
Steven Hardy [Fri, 21 Jul 2017 10:43:25 +0000 (11:43 +0100)]
Add support for update_tasks

These work the same way as upgrade_tasks *but* they use a step variable
instead of tags, so we can iterate over a count/sequence which isn't
possibly via a wrapper playbook with tags (we may want to align upgrade
tasks with the same approach if this works out well).

Note the tasks can be run via ansible-playbook on the undercloud, like:

openstack overcloud config download --config-dir tmpconfig
cd tmpconfig/tripleo-HCrDA6-config
ansible-playbook -b -i /usr/bin/tripleo-ansible-inventory update_steps_playbook.yaml --limit controller

The above will do a rolling update for the Controller role (note the inconsistent
capitalization, we probably need to fix the group naming in tripleo-ansible-inventory)
because we specify serial: 1 in the playbook.

You can also trigger an update explicitly on one node like this, which is useful for debugging:

ansible-playbook -vvv -b -i /usr/bin/tripleo-ansible-inventory update_steps_playbook.yaml --limit overcloud-controller-0

Change-Id: I20bb3e26ab9d9cadf1a31fd304de8a014a901aa9

7 years agoAdd RoleConfig output
Steven Hardy [Thu, 20 Jul 2017 16:11:44 +0000 (17:11 +0100)]
Add RoleConfig output

This exposes the deploy workflow for all roles from deploy-steps
via overcloud.j2.yaml - which means we can write it via the new
openstack overcloud config download command and/or run the workflow
outside of heat via mistral

With https://review.openstack.org/#/c/485732/ applied to
tripleoclient it becomes possible to do:

openstack overcloud config download --config-dir tmpconfig
cd tmpconfig/tripleo-EvEZk0-config
ansible-playbook -b -i /usr/bin/tripleo-ansible-inventory deploy_steps_playbook.yaml

This runs the deploy steps, exactly the same as normally run via heat
via ansible-playbook for all overcloud nodes (--limit can be used to restrict
to specific nodes/roles).

Change-Id: I96ec09bc788836584c4b39dcce5bf9b80e914c71

7 years agoDefault docker_puppet_debug to false
Steven Hardy [Fri, 21 Jul 2017 10:21:09 +0000 (11:21 +0100)]
Default docker_puppet_debug to false

This isn't set unless the playbook is run via heat, so default it to false
to enable easier use via ansible-playbook combined with tripleo-ansible-inventory

Change-Id: I9705e4533831a019dd0051e5522d4b7958682506

7 years agoMove deploy-steps-playbook to deploy-steps-tasks
Steven Hardy [Thu, 20 Jul 2017 14:04:10 +0000 (15:04 +0100)]
Move deploy-steps-playbook to deploy-steps-tasks

So that we can more easily iterate over an include in an output

Change-Id: Idd5bb47589e5c37123caafcded1afbff8881aa33

7 years agoMerge "Consolidate puppet/docker deployments with one deploy steps workflow"
Jenkins [Sat, 12 Aug 2017 07:18:07 +0000 (07:18 +0000)]
Merge "Consolidate puppet/docker deployments with one deploy steps workflow"

7 years agoMerge "Correct gnocchi-upgrade command quotes"
Jenkins [Sat, 12 Aug 2017 04:44:00 +0000 (04:44 +0000)]
Merge "Correct gnocchi-upgrade command quotes"

7 years agoMerge "Convert compute-role.yaml to role.role.j2.yaml"
Jenkins [Sat, 12 Aug 2017 03:19:08 +0000 (03:19 +0000)]
Merge "Convert compute-role.yaml to role.role.j2.yaml"

7 years agoMerge "Convert controller-role.yaml to role.role.j2.yaml"
Jenkins [Sat, 12 Aug 2017 03:17:49 +0000 (03:17 +0000)]
Merge "Convert controller-role.yaml to role.role.j2.yaml"

7 years agoAdd ServiceData to hidden params
Ben Nemec [Fri, 11 Aug 2017 21:16:24 +0000 (16:16 -0500)]
Add ServiceData to hidden params

It looks like this was added recently and it doesn't appear to be a
parameter we want in the sample environments.

Change-Id: I0ac433553e7ad9b0a54c011b66c54b4692b44be0

7 years agoMerge "TLS everywhere: Configure CA for mongodb"
Jenkins [Fri, 11 Aug 2017 21:20:59 +0000 (21:20 +0000)]
Merge "TLS everywhere: Configure CA for mongodb"

7 years agoMerge "Add script to create tripleo-admin on deployed servers"
Jenkins [Fri, 11 Aug 2017 19:07:26 +0000 (19:07 +0000)]
Merge "Add script to create tripleo-admin on deployed servers"

7 years agoCorrect gnocchi-upgrade command quotes
Jose Luis Franco Arza [Tue, 8 Aug 2017 14:19:20 +0000 (16:19 +0200)]
Correct gnocchi-upgrade command quotes

After merging commit 488796, single quotation marks
were missed. This causes the upgrade to fail as the
flag --sacks-number is considered a su command flag.

Also mounts Ceph config data into the container which
seems needed for the gnocchi-upgrade command when
configured to use Ceph.

Also move the gnocchi db sync to step 4, so ceph is
ready. Add a retry loop to ceilometer-upgrade cmd so
it doesnt fail while apache is restarted.

Closes-Bug: #1709322
Change-Id: I62f3a5fa2d43a2cd579f72286661d503e9f08b90

7 years agoMerge "openstack-heat-templates: fix deprecation path"
Jenkins [Fri, 11 Aug 2017 17:55:43 +0000 (17:55 +0000)]
Merge "openstack-heat-templates: fix deprecation path"

7 years agoConsolidate puppet/docker deployments with one deploy steps workflow
Steven Hardy [Thu, 13 Jul 2017 12:40:48 +0000 (13:40 +0100)]
Consolidate puppet/docker deployments with one deploy steps workflow

If we consolidate these we can focus on one implementation (the new ansible
based one used for docker-steps)

Change-Id: Iec0ad2278d62040bf03613fc9556b199c6a80546
Depends-On: Ifa2afa915e0fee368fb2506c02de75bf5efe82d5

7 years agoConvert cephstorage-role.yaml to role.role.j2.yaml
Steven Hardy [Tue, 11 Jul 2017 16:28:38 +0000 (17:28 +0100)]
Convert cephstorage-role.yaml to role.role.j2.yaml

Add some special-casing for backwards compatibility, such that the
CephStorage role can be rendered via j2 for support of composable networks.

Change-Id: Iee92bb6ee94963717d3a8ef400e7970f62576a0d
Partially-Implements: blueprint composable-networks

7 years agoConvert blockstorage-role.yaml to role.role.j2.yaml
Steven Hardy [Tue, 11 Jul 2017 16:22:28 +0000 (17:22 +0100)]
Convert blockstorage-role.yaml to role.role.j2.yaml

Add some special-casing for backwards compatibility, such that the
BlockStorage role can be rendered via j2 for support of composable networks.

Change-Id: Ia5fb5ff6dbe218710e95a69583ac289cf7b4af9e
Partially-Implements: blueprint composable-networks

7 years agoConvert objectstorage-role.yaml to role.role.j2.yaml
Steven Hardy [Tue, 11 Jul 2017 16:09:04 +0000 (17:09 +0100)]
Convert objectstorage-role.yaml to role.role.j2.yaml

Add some special-casing for backwards compatibility, such that the
ObjectStorage role can be rendered via j2 for support of composable networks.

Change-Id: I52abbefe2f5035059ccbed925990faab020c6c89
Partially-Implements: blueprint composable-networks

7 years agoConvert compute-role.yaml to role.role.j2.yaml
Steven Hardy [Tue, 11 Jul 2017 14:45:52 +0000 (15:45 +0100)]
Convert compute-role.yaml to role.role.j2.yaml

Add some special-casing for backwards compatibility, such that the
Compute role can be rendered via j2 for support of composable networks.

Change-Id: Ieee446583f77bb9423609d444c576788cf930121
Partially-Implements: blueprint composable-networks

7 years agoConvert controller-role.yaml to role.role.j2.yaml
Steven Hardy [Tue, 4 Jul 2017 17:20:10 +0000 (18:20 +0100)]
Convert controller-role.yaml to role.role.j2.yaml

Add deprecated role-specific parameters to role definition, in
order to special-case some parameters for backwards compatibility,
such that the Controller role can be rendered via j2 for support
of composable networks.

Co-Authored By: Dan Sneddon <dsneddon@redhat.com>
Change-Id: I5983f03ae1b7f0b6add793914540b8ca405f9b2b
Partially-Implements: blueprint composable-networks

7 years agoInternal TLS support for mongodb container
Juan Antonio Osorio Robles [Fri, 11 Aug 2017 08:46:49 +0000 (11:46 +0300)]
Internal TLS support for mongodb container

This bind mounts the necessary files for the mongodb container to serve
TLS in the internal network.

bp tls-via-certmonger-containers

Change-Id: Ieef2a456a397f7d5df368ddd5003273cb0bb7259
Co-Authored-By: Damien Ciabrini <dciabrin@redhat.com>
7 years agoTLS everywhere: Configure CA for mongodb
Juan Antonio Osorio Robles [Fri, 11 Aug 2017 13:07:13 +0000 (16:07 +0300)]
TLS everywhere: Configure CA for mongodb

It wasn't being configured, thus making mongodb fail.

Change-Id: If0d7513aacfa74493a9747440fb97f915a77db84
Closes-Bug: #1710162

7 years agoMerge "Move HAProxy's public TLS logic from controller to service template"
Jenkins [Fri, 11 Aug 2017 12:02:30 +0000 (12:02 +0000)]
Merge "Move HAProxy's public TLS logic from controller to service template"

7 years agoMerge "Set virsh secret with an init step when using Ceph"
Jenkins [Fri, 11 Aug 2017 11:28:41 +0000 (11:28 +0000)]
Merge "Set virsh secret with an init step when using Ceph"

7 years agoMerge "Keep dynamic network creation backward compatible."
Jenkins [Fri, 11 Aug 2017 11:26:41 +0000 (11:26 +0000)]
Merge "Keep dynamic network creation backward compatible."

7 years agoEnable TLS for nova api and placement containers
Juan Antonio Osorio Robles [Wed, 2 Aug 2017 06:58:46 +0000 (09:58 +0300)]
Enable TLS for nova api and placement containers

With these two services running over httpd in the containers, we can now
enable TLS for them.

bp tls-via-certmonger-containers

Change-Id: Ib8fc37a391e3b32feef0ac6492492c0088866d21

7 years agoMake containerized nova-api run with httpd
Juan Antonio Osorio Robles [Mon, 19 Jun 2017 12:21:15 +0000 (15:21 +0300)]
Make containerized nova-api run with httpd

The non-containerized version will run over httpd [1], and for the
containerized TLS work, it is needed in the container version as well.

[1] Iac35b7ddcd8a800901548c75ca8d5083ad17e4d3

bp tls-via-certmonger-containers

Depends-On: I1c5f13039414f17312f91a5e0fd02019aa08e00e
Change-Id: I2c39a2957fd95dd261b5b8c4df5e66e00a68d2f7

7 years agoEnable TLS configuration for containerized Galera
Damien Ciabrini [Wed, 2 Aug 2017 10:13:48 +0000 (06:13 -0400)]
Enable TLS configuration for containerized Galera

In non-containerized deployments, Galera can be configured to use TLS
for gcomm group communication when enable_internal_tls is set to true.

Fix the metadata service definition and update the Kolla configuration
to make gcomm use TLS in containers, if configured.

bp tls-via-certmonger-containers

Change-Id: Ibead27be81910f946d64b8e5421bcc41210d7430
Co-Authored-By: Juan Antonio Osorio Robles <jaosorior@redhat.com>
Closes-Bug: #1708135
Depends-On: If845baa7b0a437c28148c817b7f94d540ca15814

7 years agoMove HAProxy's public TLS logic from controller to service template
Juan Antonio Osorio Robles [Mon, 7 Aug 2017 11:25:38 +0000 (14:25 +0300)]
Move HAProxy's public TLS logic from controller to service template

This de-couples public TLS from controllers to now run wherever HAProxy
is deployed.

Partially-Implements: blueprint composable-networks
Change-Id: I9e84a25a363899acf103015527787bdd8248949f

7 years agoMerge "Noop controller pre and post config resources."
Jenkins [Thu, 10 Aug 2017 21:49:55 +0000 (21:49 +0000)]
Merge "Noop controller pre and post config resources."

7 years agoMerge "Fix cidr get_attr in custom networks"
Jenkins [Thu, 10 Aug 2017 19:41:17 +0000 (19:41 +0000)]
Merge "Fix cidr get_attr in custom networks"

7 years agoMerge "Create parameters for haproxy TLS certs and keys"
Jenkins [Thu, 10 Aug 2017 19:37:55 +0000 (19:37 +0000)]
Merge "Create parameters for haproxy TLS certs and keys"

7 years agoRemove duplicate Iscsid service in resource registry
Oliver Walsh [Thu, 10 Aug 2017 11:24:16 +0000 (12:24 +0100)]
Remove duplicate Iscsid service in resource registry

I forgot to remove the existing entry in
I11232fc412adcc18087928c281ba82546388376e.

Change-Id: I40b12e857dc40881f5fe9cf73963ac90caacb17d