d8fe3ea780
Certain services such as Murano and trove require access to a rabbitmq instance from tenant networks. [0] Exposing the internal rabbitmq to end users is a security hole, hence there are two options, 1) use vhosts in the existing rabbitmq, or two a separate rabbitmq instances. Given the importance of rabbitmq to the OpenStack deployment, we have decided to go with a separate instance. Refer to [1] for more detail on the various options. This change makes the rabbitmq role generic so that it can be reused, in this case to start 'outward_rabbitmq'. It needs to be exposed via haproxy both for network isolation and also because this is what Murano configuration requires. Follow on patches will be added to add a vhost in this outward instance for Murano and other services which require access. Based on the original work by bdaca[2] [0] http://murano.readthedocs.io/en/stable-liberty/intro/architecture.html [1] http://lists.openstack.org/pipermail/openstack-dev/2016-December/109091.html [2] https://review.openstack.org/#/c/374525 Change-Id: Ib2bcc7ed4bf4f883a7cd1dfad3db89201e3cfd8d Partial-Bug: #1620374 Depends-On: I020eb6219f89a310451becde41f6f1c7f54baadd Co-Authored-By: Bartłomiej Daca <bartek.daca@gmail.com>
116 lines
3.5 KiB
YAML
116 lines
3.5 KiB
YAML
---
|
|
- name: Get container facts
|
|
kolla_container_facts:
|
|
name:
|
|
- rabbitmq
|
|
register: container_facts
|
|
|
|
- name: Checking free port for RabbitMQ
|
|
wait_for:
|
|
host: "{{ api_interface_address }}"
|
|
port: "{{ rabbitmq_port }}"
|
|
connect_timeout: 1
|
|
timeout: 1
|
|
state: stopped
|
|
when:
|
|
- container_facts['rabbitmq'] is not defined
|
|
- inventory_hostname in groups['rabbitmq']
|
|
|
|
- name: Checking free port for RabbitMQ Management
|
|
wait_for:
|
|
host: "{{ api_interface_address }}"
|
|
port: "{{ rabbitmq_management_port }}"
|
|
connect_timeout: 1
|
|
timeout: 1
|
|
state: stopped
|
|
when:
|
|
- container_facts['rabbitmq'] is not defined
|
|
- inventory_hostname in groups['rabbitmq']
|
|
|
|
- name: Checking free port for RabbitMQ Cluster
|
|
wait_for:
|
|
host: "{{ api_interface_address }}"
|
|
port: "{{ rabbitmq_cluster_port }}"
|
|
connect_timeout: 1
|
|
timeout: 1
|
|
state: stopped
|
|
when:
|
|
- container_facts['rabbitmq'] is not defined
|
|
- inventory_hostname in groups['rabbitmq']
|
|
|
|
- name: Checking free port for RabbitMQ EPMD
|
|
wait_for:
|
|
host: "{{ api_interface_address }}"
|
|
port: "{{ rabbitmq_epmd_port }}"
|
|
connect_timeout: 1
|
|
timeout: 1
|
|
state: stopped
|
|
when:
|
|
- container_facts['rabbitmq'] is not defined
|
|
- inventory_hostname in groups['rabbitmq']
|
|
|
|
- name: Check if all rabbit hostnames are resolvable
|
|
command: "getent ahostsv4 {{ hostvars[item]['ansible_hostname'] }}"
|
|
changed_when: false
|
|
register: rabbitmq_hostnames
|
|
with_items: "{{ groups['rabbitmq'] }}"
|
|
|
|
- fail: msg="Hostname has to resolve to IP address of api_interface"
|
|
with_items: "{{ rabbitmq_hostnames.results }}"
|
|
when:
|
|
- "item.stdout.find(hostvars[item['item']]['ansible_' ~ hostvars[item['item']]['api_interface']]['ipv4']['address']) == -1"
|
|
|
|
- name: Checking free port for outward RabbitMQ
|
|
wait_for:
|
|
host: "{{ api_interface_address }}"
|
|
port: "{{ outward_rabbitmq_port }}"
|
|
connect_timeout: 1
|
|
state: stopped
|
|
when:
|
|
- enable_outward_rabbitmq | bool
|
|
- inventory_hostname in groups['outward-rabbitmq']
|
|
|
|
- name: Checking free port for outward RabbitMQ Management
|
|
wait_for:
|
|
host: "{{ api_interface_address }}"
|
|
port: "{{ outward_rabbitmq_management_port }}"
|
|
connect_timeout: 1
|
|
state: stopped
|
|
when:
|
|
- enable_outward_rabbitmq | bool
|
|
- inventory_hostname in groups['outward-rabbitmq']
|
|
|
|
- name: Checking free port for outward RabbitMQ Cluster
|
|
wait_for:
|
|
host: "{{ api_interface_address }}"
|
|
port: "{{ outward_rabbitmq_cluster_port }}"
|
|
connect_timeout: 1
|
|
state: stopped
|
|
when:
|
|
- enable_outward_rabbitmq | bool
|
|
- inventory_hostname in groups['outward-rabbitmq']
|
|
|
|
- name: Checking free port for outward RabbitMQ EPMD
|
|
wait_for:
|
|
host: "{{ api_interface_address }}"
|
|
port: "{{ outward_rabbitmq_epmd_port }}"
|
|
connect_timeout: 1
|
|
state: stopped
|
|
when:
|
|
- enable_outward_rabbitmq | bool
|
|
- inventory_hostname in groups['outward-rabbitmq']
|
|
|
|
- name: Check if all outward rabbit hostnames are resolvable
|
|
command: "getent ahostsv4 {{ hostvars[item]['ansible_hostname'] }}"
|
|
changed_when: false
|
|
register: outward_rabbitmq_hostnames
|
|
with_items: "{{ groups['outward-rabbitmq'] }}"
|
|
when:
|
|
- enable_outward_rabbitmq | bool
|
|
|
|
- fail: msg="Hostname has to resolve to IP address of api_interface"
|
|
with_items: "{{ outward_rabbitmq_hostnames.results }}"
|
|
when:
|
|
- enable_outward_rabbitmq | bool
|
|
- "item.stdout.find(hostvars[item['item']]['ansible_' ~ hostvars[item['item']]['api_interface']]['ipv4']['address']) == -1"
|