52 Commits

Author SHA1 Message Date
Michal Nasiadka
1009931162 Change local_action to delegate_to: localhost
As part of the effort to implement Ansible code linting in CI
(using ansible-lint) - we need to implement recommendations from
ansible-lint output [1].

One of them is to stop using local_action in favor of delegate_to -
to increase readability and and match the style of typical ansible
tasks.

[1]: https://review.opendev.org/694779/

Partially implements: blueprint ansible-lint

Change-Id: I46c259ddad5a6aaf9c7301e6c44cd8a1d5c457d3
2019-11-22 15:04:44 +00:00
Kris Lindgren
2fe0d98ebb Add a job that *only* deploys updated containers
Sometimes as cloud admins, we want to only update code that is running
in a cloud.  But we dont need to do anything else.  Make an action in
kolla-ansible that allows us to do that.

Change-Id: I904f595c69f7276e71692696471e32fd1f88e6e8
Implements: blueprint deploy-containers-action
2019-09-26 17:51:14 +01:00
Dincer Celik
a4be4c0dcf Fix Octavia to use keystone_admin_project variable
Project name shouldn't be static as user may override it with
keystone_admin_project

Change-Id: If41b9d8de17985d960104c8daf27ea7d706c27c0
2019-09-19 15:57:57 +00:00
Mark Goddard
3522d235bd Refactor service, endpoint and user registration
Use upstream Ansible modules for registration of services, endpoints,
users, projects, roles, and role grants.

Change-Id: I7c9138d422cc91c177fd8992347176bb54156b5a
2019-09-17 10:13:56 -07:00
Scott Solkhon
09e02ef8f1 Support configuration of trusted CA certificate file
This commit adds the functionality for an operator to specify
their own trusted CA certificate file for interacting with the
Keystone API.

Implements: blueprint support-trusted-ca-certificate-file
Change-Id: I84f9897cc8e107658701fb309ec318c0f805883b
2019-08-16 12:47:42 +00:00
Radosław Piliszek
6a737b1968 Fix handling of docker restart policy
Docker has no restart policy named 'never'. It has 'no'.
This has bitten us already (see [1]) and might bite us again whenever
we want to change the restart policy to 'no'.

This patch makes our docker integration honor all valid restart policies
and only valid restart policies.
All relevant docker restart policy usages are patched as well.

I added some FIXMEs around which are relevant to kolla-ansible docker
integration. They are not fixed in here to not alter behavior.

[1] https://review.opendev.org/667363

Change-Id: I1c9764fb9bbda08a71186091aced67433ad4e3d6
Signed-off-by: Radosław Piliszek <radoslaw.piliszek@gmail.com>
2019-07-18 13:39:06 +00:00
Mark Goddard
d5e5e885d1 During deploy, always sync DB
A common class of problems goes like this:

* kolla-ansible deploy
* Hit a problem, often in ansible/roles/*/tasks/bootstrap.yml
* Re-run kolla-ansible deploy
* Service fails to start

This happens because the DB is created during the first run, but for some
reason we fail before performing the DB sync. This means that on the second run
we don't include ansible/roles/*/tasks/bootstrap_service.yml because the DB
already exists, and therefore still don't perform the DB sync. However this
time, the command may complete without apparent error.

We should be less careful about when we perform the DB sync, and do it whenever
it is necessary. There is an argument for not doing the sync during a
'reconfigure' command, although we will not change that here.

This change only always performs the DB sync during 'deploy' and
'reconfigure' commands.

Change-Id: I82d30f3fcf325a3fdff3c59f19a1f88055b566cc
Closes-Bug: #1823766
Closes-Bug: #1797814
2019-07-12 08:56:54 +00:00
Mark Goddard
de00bf491d Simplify handler conditionals
Currently, we have a lot of logic for checking if a handler should run,
depending on whether config files have changed and whether the
container configuration has changed. As rm_work pointed out during
the recent haproxy refactor, these conditionals are typically
unnecessary - we can rely on Ansible's handler notification system
to only trigger handlers when they need to run. This removes a lot
of error prone code.

This patch removes conditional handler logic for all services. It is
important to ensure that we no longer trigger handlers when unnecessary,
because without these checks in place it will trigger a restart of the
containers.

Implements: blueprint simplify-handlers

Change-Id: I4f1aa03e9a9faaf8aecd556dfeafdb834042e4cd
2019-06-27 15:57:19 +00:00
Mark Goddard
b123bf6621 Use become for all docker tasks
Many tasks that use Docker have become specified already, but
not all. This change ensures all tasks that use the following
modules have become:

* kolla_docker
* kolla_ceph_keyring
* kolla_toolbox
* kolla_container_facts

It also adds become for 'command' tasks that use docker CLI.

Change-Id: I4a5ebcedaccb9261dbc958ec67e8077d7980e496
2019-06-06 19:04:58 +01:00
Mark Goddard
a4bb8567da Fix up config file permissions on the host
Several config file permissions are incorrect on the host. In general,
files should be 0660, and directories and executables 0770.

Change-Id: Id276ac1864f280554e98b937f2845bb424d521de
Closes-Bug: #1821579
2019-04-02 17:23:31 +01:00
Jim Rollenhagen
55702739d0 Allow octavia services to use independent hostnames
This allows octavia service endpoints to use custom hostnames, and adds the
following variables:

* octavia_internal_fqdn
* octavia_external_fqdn

These default to the old values of kolla_internal_fqdn or
kolla_external_fqdn.

This also adds a octavia_api_listen_port option, which defaults to
octavia_api_port for backward compatibility.

This option allow the user to differentiate between the port the
service listens on, and the port the service is reachable on. This is
useful for external load balancers which live on the same host as the
service itself.

Change-Id: I1310eb5573a469b1a0e9549e853734455307a8b3
Implements: blueprint service-hostnames
2019-03-06 15:08:28 -05:00
dommgifer
5c771df7d1 Add become for Octavia configuration tasks
This is required to support execution as a non-root user.

Change-Id: Idd2deec2918e5eb7743e60112a91cb31edf5aad3
Close-bug: #1809527
2018-12-22 15:04:13 +08:00
Eduardo Gonzalez
1a682fab28 Support stop specific containers
With this change, an operator may be able to stop a
service container without stopping all services in a host.
This change is the starting point to start
fast-forward upgrades support.
In next changes new flags will be introducced to disable
stop dataplane services during upgrades.

Change-Id: Ifde7a39d7d8596ef0d7405ecf1ac1d49a459d9ef
Implements: blueprint support-stop-containers
2018-11-26 08:07:01 +00:00
Dai Dang Van
22bf7997b9 Support Octavia custom policy
Change-Id: I542b06be75991412f8e2a931ea2e40f0a0c317e4
Closes-Bug: #1758903
2018-10-04 02:34:46 +00:00
Adam Harwell
f1c8136556 Refactor haproxy config (split by service) V2.0
Having all services in one giant haproxy file makes altering
configuration for a service both painful and dangerous. Each service
should be configured with a simple set of variables and rendered with a
single unified template.

Available are two new templates:

* haproxy_single_service_listen.cfg.j2: close to the original style, but
only one service per file
* haproxy_single_service_split.cfg.j2: using the newer haproxy syntax
for separated frontend and backend

For now the default will be the single listen block, for ease of
transition.

Change-Id: I6e237438fbc0aa3c89a3c8bd706a53b74e71904b
2018-09-26 03:30:38 -07:00
Zuul
3e45b2cbec Merge "Use include_tasks instead of include" 2018-07-27 08:16:08 +00:00
Jeffrey Zhang
b51eeed89e Use include_tasks instead of include
include is marked as deprecated since ansible 2.4[0]

[0] https://docs.ansible.com/ansible/2.4/include_module.html#deprecated

Co-Authored-By: confi-surya <singh.surya64mnnit@gmail.com>
Change-Id: Ic9d71e1865d1c728890625aeddf424a5734c0a8a
2018-07-25 23:57:22 +08:00
Lakshmi Prasanna Goutham Pratapa
9f0db30fd1 Apply Resource-Constraints to all services.
This commit is the final commit to apply resource-constraints
to all OpenStack services.

Depends-on: I39004f54281f97d53dfa4b1dbcf248650ad6f186
Change-Id: I072d69be9698be54775cb0ae286ea2b6ed78776c
Implements: blueprint resource-constraints
2018-07-23 19:07:05 +05:30
Ha Manh Dong
30be04ea91 Specify 'become' for all tasks that use kolla_docker module
Add become to all tasks that use the module "kolla_docker"

Change-Id: I4309c4011687b88ec31d739fd8f834fe2326ff10
Partial-Implements: blueprint ansible-specific-task-become
2018-06-08 12:39:24 +00:00
Jeffrey Zhang
c567055176 Fix ansible warning
- rename action and serial to kolla_ansible and kolla_serial
- use become instead of "sudo <command>" in shell
- Remove quota for failed_when and changed_when in rabbitmq tasks

Change-Id: I78cb60168aaa40bb6439198283546b7faf33917c
Implements: blueprint migrate-to-ansible-2-2-0
2018-05-11 02:54:02 +00:00
Jeffrey Zhang
84ade4e149 Remove useless module_extra_vars in registry.yml
- remove uesless module_extra_vars, this is a historical issue. In the
  past, we use 'docker exec kolla_toolbox ansible xxx' to run module on
  target node, so complex data have to pass through extra_vars. Now we
  are using kolla_toolbox module, no need to use extra_vars anymore.
- Remove some useless until.

Change-Id: I72ed28001202917f9a82a1c3ea33cd6319911ec8
2018-04-16 09:14:54 +08:00
Duong Ha-Quang
9965cc46ff Specify 'become' for only neccesary tasks (all other roles)
Add become to only neccesary tasks in roles:

- aodh
- barbican
- bifrost
- ceilometer
- ceph
- chrony
- cinder
- cloudkitty
- collectd
- congress
- designate
- elasticsearch
- etcd
- freezer
- gnocchi
- grafana
- influxdb
- ironic
- iscsi
- karbor
- kibana
- kuryr
- magnum
- manila
- mistral
- mongodb
- multipathd
- murano
- octavia
- panko
- qdrouterd
- rally
- sahara
- searchlight
- senlin
- skydive
- solum
- swift
- swift
- tacker
- telegraf
- tempest
- trove
- vmtp
- watcher
- zun

Change-Id: I6e32d94d4172dd96d09d8609e8a5221ab5586a31
Partial-Implements: blueprint ansible-specific-task-become
2018-03-12 09:37:43 +07:00
Jeffrey Zhang
377ece5774 Adding octavia required roles
Adding following role which is reuqired by octavia services

- load-balancer_observer
- load-balancer_global_observer
- load-balancer_member
- load-balancer_admin
- load-balancer_quota_admin

Change-Id: I6f351c96915b09cb9a6ef716515b45785d62cb90
Closes-Bug: #1745915
2018-01-29 12:49:35 +08:00
Alexandru Bogdan Pica
8e3b79440c Implement external MariaDB and pre-configured Databases support
This change allows the following use cases:

1. Using an already-configured MariaDB / MySQL server / Cluster
2. Using already-created DB users, without requiring root DB access.

Update: added external mariadb precheck

Change-Id: I78b0d178306d7c5293b0bf53e445f19f18b4b824
Implements: blueprint external-mariadb-support.
Closes-Bug: #1603121
2018-01-23 13:07:40 +00:00
Eduardo Gonzalez
56374206be Fix deployment with public TLS enabled
When deploying with tls enabled in public
endpoints, ansible modules fails due SSL certificates
are self-signed.

This change adds a new variable to allow customization
on which endpoints ansible should connect.
Defaults to admin because admin auth parameters defaults
to admin endpoint.

Change-Id: Ic3ed58cf9c9579cae08a11bbfe6fce983b5a9cbc
Closes-Bug: #1720995
2017-10-05 08:36:34 +00:00
Jenkins
39a2b59056 Merge "Copy certifications info octavia housekeeping and health manager container" 2017-09-27 03:47:54 +00:00
Jenkins
9cdbae707b Merge "Simplify Openstack services configuration possibilities" 2017-09-26 15:49:22 +00:00
Jeffrey Zhang
ef85df2335 Copy certifications info octavia housekeeping and health manager container
octavia-housekeeping container need certifications to create spare
amphore instances.

octavia-health-manager container need certifications to create stable
amphore instances.

Change-Id: I90b9c4c39f6542bb1ee5f40a8d0a39ae8d0ab2b0
Closes-Bug: #1719063
2017-09-26 15:42:57 +08:00
Jeffrey Zhang
b7bfe84a51 Use octavia account instead of admin in octavia
Closes-Bug: #1719503
Change-Id: I705de11614f2d086bd123ea5b3841f59b5a24666
2017-09-26 11:29:21 +08:00
Bertrand Lallau
a3dfdfc085 Simplify Openstack services configuration possibilities
Actually Openstack services configuration can be overriden using many
files:
- /etc/kolla/config/<< service name >>/<< config file >>
- /etc/kolla/config/<< service name >>/<<host>>/<< config file >>
- /etc/kolla/config/global.conf
- /etc/kolla/config/database.conf
- /etc/kolla/config/messaging.conf

Only per-service configuration is actually documented here:
https://github.com/openstack/kolla-ansible/blob/master/doc/advanced-configuration.rst#L164

Allowing to globally modify service configuration can be perform too,
but it can be done in 3 different manners, all not documented:
- /etc/kolla/config/global.conf
- /etc/kolla/config/database.conf
- /etc/kolla/config/messaging.conf

database.conf and messaging.conf seems redundant with global.conf.
In order to simplify codebase it seems logical to remove them.

Documentation has been added for overriding configuration globally and
release note has been added too.

Closes-Bug: #1682479
Change-Id: I5d922dfc0d938173bad34ac64e490b78db1b7e31
2017-09-13 17:47:36 +02:00
Jenkins
a71aa61ea7 Merge "Use unified vars in task" 2017-07-12 01:56:12 +00:00
Bertrand Lallau
a9113fc466 Avoid launching "local" actions too many times
In order to speed up deployment time some "local" actions should be run
only once using 'run_once: True'.
This will decrease deployment time in case of multihost configuration.

Change-Id: I6015d772d35c15e96c52f577013b6e41197cb41a
2017-07-05 15:55:39 +02:00
caoyuan
36c530f9ed Fix the database user name for all roles
when create database user, it should use
database_user, not database_name.

Change-Id: I4dfa01d1a5a46c5c58f1fc47b0be71b186462764
Closes-Bug: #1698762
2017-06-20 21:19:31 +08:00
Jeffrey Zhang
03e1b05f99 Use unified vars in task
Ansible task support vars directive, no need implement another one in
merge_config. This patch remove the vars directive in merge_config
action plugin.

Change-Id: I33648a2b6e39b4d49ce76eb66fbf2522721f8c68
2017-06-15 22:37:28 +08:00
Yotaro Konishi
36a3994ac1 Fix service_type of Octavia
Currently service_type value of Octavia is 'application-catalog', which is obviously wrong.
It must be 'load-balancer'.

See https://developer.openstack.org/api-ref/load-balancer/v2/index.html

Change-Id: Ic457e6d06adb9541273dd3bf191d60cb4421e1c9
Closes-Bug: #1697337
2017-06-12 11:40:41 +09:00
Bertrand Lallau
afdd11b9a2 Generalize api_interface_address variable usage
Useful api_interface_address variable has been define here:
https://github.com/openstack/kolla-ansible/blob/master/ansible/group_vars/all.yml#L57
In order to simplify codebase we must use it as much as possible.

Change-Id: I18fec19bf69e05a22a4142a9cd1165eccd022455
2017-05-23 08:35:15 +00:00
Jeffrey Zhang
b1f015616c Add timeout parameter for precheck tasks
wait_for module waits 300 seconds for the port started or stopped.  This
is meaningless and useless in precheck. This patch change timeout to 1
seconds.

Change-Id: I9b251ec4ba17ce446655917e8ef5e152ef947298
Closes-Bug: #1688152
2017-05-04 09:02:25 +08:00
Bertrand Lallau
3170b6c2a7 Fix 'node_config_directory' variable bad usage
Some roles made a bad usage of the 'node_config_directory' variable.

As described here:
https://github.com/openstack/kolla-ansible/blob/master/ansible/group_vars/all.yml#L16

'node_config_directory' is the directory to store the config files on
the destination node.

This variable MUST be changed to 'node_custom_config'.
Futhermore this will unified all roles.

Closes-Bug: #1682445
Change-Id: Id8d8a1268c79befac8938c1e0396267314b40301
2017-04-13 17:15:24 +02:00
Paul Bourke
5418ada148 Enable sanity checks from kolla-ansible
Add a new subcommand 'check' to kolla-ansible, used to run the
smoke/sanity checks.

Add stub files to all services that don't currently have checks.

Change-Id: I9f661c5fc51fd5b9b266f23f6c524884613dee48
Partially-implements: blueprint sanity-check-container
2017-03-09 10:37:06 +00:00
Jenkins
d9740e9c40 Merge "Remove unnecessary until in register.yml file" 2017-02-22 12:28:06 +00:00
liyingjun
68d30d8fd6 Checking certificate files for octavia
There is not precheck for certificate files for octavia, this patch
add it.

Change-Id: I0031a65d5c83c09ce0e16db9094f3dea12024495
Closes-bug: #1663575
2017-02-13 09:51:49 +00:00
Jeffrey Zhang
38ad05a872 Remove unnecessary until in register.yml file
Change-Id: I1577cc3afef4dadd3a188c8ba749c9cdfad313ae
2017-02-04 14:38:54 +08:00
Eduardo Gonzalez
4e0fa6a334 Remove hardcoded usernames in register.yml
Usernames can be configured with variables in
configuration files, but user creation is hardcoded.

Change-Id: I057cfb921d776217db66f59226dcfa79f3eb7368
Closes-Bug: #1661587
2017-02-03 12:17:54 +00:00
caoyuan
517491a93a Optimize reconfiguration for octavia
Co-Authored-By: Mauricio Lima <mauriciolimab@gmail.com>
Change-Id: If6a0d935df9f8b84d7628b2c8753aa12627e2c8a
Partially-implements: blueprint better-reconfigure
2017-01-27 21:02:02 +08:00
Jeffrey Zhang
8155d74d8d Refactor register.yml files
Co-Authored-By: Mauricio Lima <mauriciolimab@gmail.com>
Change-Id: I9a4a6b6523dee4b388513386b7d85d421f2b7b89
2017-01-26 17:10:27 +00:00
Jenkins
88b52b2341 Merge "Fix octavia image names in start.yml" 2017-01-18 15:14:50 +00:00
Jenkins
3f8cb8adda Merge "Refactor bootstrap.yml file" 2017-01-18 10:17:50 +00:00
Mauricio Lima
2bcb134496 Fix octavia image names in start.yml
Change-Id: I2d21bb68d00556d3029ded7df602df271fd6d93e
2017-01-17 14:14:07 -03:00
Mauricio Lima
d53f27caea Move prechecks into its own role
To avoid many merge conflicts and re-works
* Panko
* Octavia
* Ceph
* MariaDB

Co-Authored-By: caoyuan <cao.yuan@99cloud.net>
Partially-implements: blueprint condition-pre-check
Change-Id: I3d2766d0d9f01ad4052731c7219a2d0635527ac5
2017-01-13 12:43:49 -03:00
Jeffrey Zhang
7233b45d29 Refactor bootstrap.yml file
Change-Id: I00d2dcb0895548ba169ab85764cf546c2214cbf5
2017-01-12 23:37:50 +08:00