22 Commits

Author SHA1 Message Date
Michal Nasiadka
3f55b87069 Improve Apache logging
Currently we don't put global Apache error logs into /var/log/kolla,
this change adds statements that redirect those logs there.

Adapted the logfile names to catch into openstack wsgi logging fluentd
input config and existing logrotate cron entries.

Change-Id: I21216e688a1993239e3e81411a4e8b6f13e138c2
2019-12-06 13:11:49 +00:00
Michal Nasiadka
0240763d7d Add proper wsgi loglevel when openstack_logging_debug
Change-Id: I51144d92f34ed51c499a4119c059e6475d02eb46
2019-10-24 09:33:05 +00:00
Radosław Piliszek
bc053c09c1 Implement IPv6 support in the control plane
Introduce kolla_address filter.
Introduce put_address_in_context filter.

Add AF config to vars.

Address contexts:
- raw (default): <ADDR>
- memcache: inet6:[<ADDR>]
- url: [<ADDR>]

Other changes:

globals.yml - mention just IP in comment

prechecks/port_checks (api_intf) - kolla_address handles validation

3x interface conditional (swift configs: replication/storage)

2x interface variable definition with hostname
(haproxy listens; api intf)

1x interface variable definition with hostname with bifrost exclusion
(baremetal pre-install /etc/hosts; api intf)

neutron's ml2 'overlay_ip_version' set to 6 for IPv6 on tunnel network

basic multinode source CI job for IPv6

prechecks for rabbitmq and qdrouterd use proper NSS database now

MariaDB Galera Cluster WSREP SST mariabackup workaround
(socat and IPv6)

Ceph naming workaround in CI
TODO: probably needs documenting

RabbitMQ IPv6-only proto_dist

Ceph ms switch to IPv6 mode

Remove neutron-server ml2_type_vxlan/vxlan_group setting
as it is not used (let's avoid any confusion)
and could break setups without proper multicast routing
if it started working (also IPv4-only)

haproxy upgrade checks for slaves based on ipv6 addresses

TODO:

ovs-dpdk grabs ipv4 network address (w/ prefix len / submask)
not supported, invalid by default because neutron_external has no address
No idea whether ovs-dpdk works at all atm.

ml2 for xenapi
Xen is not supported too well.
This would require working with XenAPI facts.

rp_filter setting
This would require meddling with ip6tables (there is no sysctl param).
By default nothing is dropped.
Unlikely we really need it.

ironic dnsmasq is configured IPv4-only
dnsmasq needs DHCPv6 options and testing in vivo.

KNOWN ISSUES (beyond us):

One cannot use IPv6 address to reference the image for docker like we
currently do, see: https://github.com/moby/moby/issues/39033
(docker_registry; docker API 400 - invalid reference format)
workaround: use hostname/FQDN

RabbitMQ may fail to bind to IPv6 if hostname resolves also to IPv4.
This is due to old RabbitMQ versions available in images.
IPv4 is preferred by default and may fail in the IPv6-only scenario.
This should be no problem in real life as IPv6-only is indeed IPv6-only.
Also, when new RabbitMQ (3.7.16/3.8+) makes it into images, this will
no longer be relevant as we supply all the necessary config.
See: https://github.com/rabbitmq/rabbitmq-server/pull/1982

For reliable runs, at least Ansible 2.8 is required (2.8.5 confirmed
to work well). Older Ansible versions are known to miss IPv6 addresses
in interface facts. This may affect redeploys, reconfigures and
upgrades which run after VIP address is assigned.
See: https://github.com/ansible/ansible/issues/63227

Bifrost Train does not support IPv6 deployments.
See: https://storyboard.openstack.org/#!/story/2006689

Change-Id: Ia34e6916ea4f99e9522cd2ddde03a0a4776f7e2c
Implements: blueprint ipv6-control-plane
Signed-off-by: Radosław Piliszek <radoslaw.piliszek@gmail.com>
2019-10-16 10:24:35 +02:00
chenxing
16d0d4c361 Update python_path for "source" install type
Both ubuntu source and binary install type support python3 now,
python_path should be updated.

Depends-On: https://review.opendev.org/675581
Partially Implements: blueprint python3-support

Change-Id: I4bf721b44220bde2d25d4d985f5ca411699a5a72
2019-09-09 16:06:23 +08:00
Mark Goddard
d62ccca3e0 Fix ubuntu binary deploys
1. The Keystone WSGI scripts don't have a python3- prefix, although they
   are using python 3.

2. The Placement WSGI script doesn't have a python3- prefix, although it
   is using python 3.

Depends-On: https://review.openstack.org/651327
Change-Id: I805df8f85634edea8322495ca73897d44967cfe6
Closes-Bug: #1823989
2019-04-10 08:55:25 +01:00
Mark Goddard
a103ed7c07 Use service-specific _install_type variables in wsgi scripts
Change-Id: I0c31ad353e1fb764bc8e826cda5c3d092623f44b
2019-03-15 15:22:54 +00:00
chenxing
6722e18465 ubuntu: update configuration Stein UCA
Update wsgi configuration after services migrating to python3.

Change-Id: I25d8db36dabd5f148b2ec96a30381c6a86fa710e
Depends-On: https://review.openstack.org/#/c/625298/
Partially Implements: blueprint python3-support
2019-03-13 21:25:51 +08:00
Jim Rollenhagen
bece976b91 Allow keystone services to use independent hostnames
This allows keystone service endpoints to use custom hostnames, and adds the
following variables:

* keystone_internal_fqdn
* keystone_external_fqdn

These default to the old values of kolla_internal_fqdn or
kolla_external_fqdn.

This also adds the following variables:

* keystone_admin_listen_port
* keystone_public_listen_port

These default to keystone_admin_port and keystone_public_port,
respectively, for backward compatibility.

These options allow the user to differentiate between the port the
service listens on, and the port the service is reachable on. This is
useful for external load balancers which live on the same host as the
service itself.

Change-Id: I50c46c674134f9958ee4357f0f4eed5483af2214
Implements: blueprint service-hostnames
2019-02-08 10:26:00 -05:00
Kien Nguyen
043943117d Use <project>_install_type instead of kolla_install_type
Use <project>_install_type instead of kolla_install_type
to set python_path. For example, general kolla_install_type
is 'binary', but user wants to deploy Horizon from 'source'.
Horizon templates still use python_path=/usr/share/openstack-dashboard,
it is wrong.

Change-Id: Ide6a24e17b1f8ab6506aa5e53f70693706830418
2019-01-04 14:33:46 +07:00
Jeffrey Zhang
9d5bafabb2 Use the pbr generated wsgi binary file located in binary folder
Since pbr 1.4.0, wsgi_scripts entrypoing is supported and it will
generated a wsgi compatible binary file. No need to copied it to
/var/www/cgi-bin/keystone folder.

Change-Id: If85558dcdcdf185be6171de20eed3faa8e101661
2018-03-21 00:27:47 +08:00
Jeffrey Zhang
f8cb527f78 Security reinforce for apache server
Disable ServerSignature and Hide apache related infromation.

Change-Id: I9188ddb85988539087c922117bb9f53454b7507c
2018-03-14 18:14:26 +08:00
Jeffrey Zhang
f5dd178fc5 Disable trace for all containers running httpd
Trace method is enabled in default for httpd. There is security risk
with trace enabled. So disable it in default. more info please check[0].

[0] https://security.stackexchange.com/a/7711

Change-Id: I4496a6d058d88e1abfb210085f189e7a610e0362
Closes-Bug: #1705160
2017-07-19 10:52:41 +08:00
Christian Berendt
801f36ad3c Make number of keystone processes configurable
TrivialFix

Change-Id: I2f0945c444016227a09486d62cec53db51ac1ec9
2016-10-10 14:05:34 +02:00
Ken Wronkiewicz
37b3c8c354 Keystone interface address and memcached override
Note: This should not result in any behavior changes in regular Kolla,
just Kolla-Kubernetes and only when you've overridden stuff in globals.yml

Allows override of interface address and memcached pools, so that
Kubernetes can do the right thing.

There are some significant architectural issues involved in
memcached pooling in the Kolla-kubernetes world.  Avoiding them right
now.

Current working Kolla-Kubernetes globals.yml file, assuming that your
memcached servers are available under the DNS alias "memcached":

api_interface_address: "0.0.0.0"

memcached_servers: "memcached"

keystone_database_address: "mariadb"
keystone_admin_url: "{{ admin_protocol }}://keystone-admin:{{ keystone_admin_port }}/v3"
keystone_internal_url: "{{ internal_protocol }}://keystone-public:{{ keystone_public_port }}/v3"
keystone_public_url: "{{ public_protocol }}://keystone-public:{{ keystone_public_port }}/v3"

Co-authored-by: Ryan Hallisey <rhallise@redhat.com>
Change-Id: I5126f81da7b4d48001b87f73d58bbbfad658209c
Partially-implements: blueprint api-interface-bind-address-override
2016-08-11 05:33:56 -04:00
Carlos Cesario
493650aa5e Change keystone log dir
Proposed patch to change keystone and heka log dir
from /var/log/kolla/apache2/ to /var/log/kolla/keystone/

Closes-Bug: #1560620
Change-Id: I70c65ceba5a301cc56880313ca86f01bd35676cb
2016-03-28 08:51:35 -03:00
Dave McCowan
b770339534 Use passed client IP address in various audit logs
HAProxy: change to use option forwardfor to pass origin IP address
to backend via X-Forwarded-For header

Keystone: Apache does the audit logs for keystone.  Change the
LogFormat to display the passed address instead of the connection
address which is that of the load balancer.

Nova, Cinder, Glance: these services can make use of the address
passed in X-Forwarded-For.  With this setting the API logs for
these services include the client IP address.

Change-Id: Ia861ecc11a7c7d463d0366586926d1a842853f69
Closes-Bug: #1548935
2016-02-24 09:51:13 -05:00
Éric Lemoine
684873b89b Make Heka collect Keystone logs
Partially implements: blueprint heka
Change-Id: I940143876981a04464af67aff65c09a06926701d
2016-02-19 21:49:21 +00:00
Michal Rostecki
febcb600f1 Source installation in virtualenv
Use virtualenv for installation of OpenStack projects and
dependencies to avoid conflicts with Python libraries installed
by non-OpenStack binary packages.

Change-Id: I21ecd673b2e93335b1d3dd4e279e940c9d694c3c
Implements: blueprint virtualenv
2015-11-27 10:22:17 +01:00
Michal Jastrzebski
f99a27f0c5 Keystone logging to rsyslog
Configure keystone to use rsyslog container as logging mechanism

Change-Id: Id77574fe841e9c2a9d870b712ffd0c26b5463ded
Implements: bp logging-container
2015-09-24 14:08:25 +02:00
Sam Yaple
17333aed12 Fix keystone for Ubuntu
Due to the differences between Ubuntu and Centos around Apache2 I have
had to copy both start.sh and config-external.sh to be unique files
for Ubuntu so as not to affect Centos either. This can be removed when
we change the way config-external works.

Change-Id: I14dc11e7bb6284b897259a53acc914ae8f254d3c
Partially-Implements: blueprint install-from-ubuntu
2015-08-23 06:07:04 +00:00
Sam Yaple
4c4181d54a Fix permissions on log directory for keystone
Additionally fixed bootstrap issue caused by an ansible bug in some
versions of the docker module.

Closes-Bug: #1472270
Change-Id: Ia5a370db5ab7690854afcd63492ba7dbbea29835
2015-07-08 09:35:33 +00:00
Sam Yaple
11597cc2f4 Updated keystone for wsgi in config-external
This will switch config-external to using wsgi vs evenlet for keystone.

Partially Implements: blueprint ansible-service

Change-Id: I85a88c813ed36d827916796199dad735b2d44b40
2015-07-03 14:17:02 +00:00