61be9e722d
This change matches an earlier modification to os_neutron Currently we symlink /etc/<service> to empty directory at pre-stage, and filling it with config only during post_install. This means, that policies and rootwrap filters are not working properly until playbook execution finish. Additionally, we replace sudoers file with new path in it, which makes current operations impossible for the service, since rootwrap can not gain sudo privileges. With this change we move symlinking and rootwrap steps to handlers, which means that we will do replace configs while service is stopped. During post_install we place all of the configs inside the venv, which is versioned at the moment. This way we minimise downtime of the service while performing upgrades Closes-Bug: #2056180 Change-Id: I9c8212408c21e09895ee5805011aecb40b689a13
120 lines
3.1 KiB
YAML
120 lines
3.1 KiB
YAML
---
|
|
# Copyright 2015, Rackspace US, Inc.
|
|
#
|
|
# Licensed under the Apache License, Version 2.0 (the "License");
|
|
# you may not use this file except in compliance with the License.
|
|
# You may obtain a copy of the License at
|
|
#
|
|
# http://www.apache.org/licenses/LICENSE-2.0
|
|
#
|
|
# Unless required by applicable law or agreed to in writing, software
|
|
# distributed under the License is distributed on an "AS IS" BASIS,
|
|
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
# See the License for the specific language governing permissions and
|
|
# limitations under the License.
|
|
|
|
- name: Stop libvirt-bin
|
|
service:
|
|
name: "{{ item }}"
|
|
enabled: yes
|
|
state: "stopped"
|
|
listen:
|
|
- Restart libvirt-bin
|
|
- "cert installed"
|
|
with_items:
|
|
- "{{ libvirt_service_name }}"
|
|
when:
|
|
- "'nova_compute' in group_names"
|
|
- nova_virt_type != 'ironic'
|
|
|
|
- name: Enable sockets when needed
|
|
service:
|
|
name: "{{ item.name | default(item) }}"
|
|
state: "{{ item.condition | default(False) | ternary('started', 'stopped') }}"
|
|
enabled: "{{ item.condition | default(False) }}"
|
|
masked: no
|
|
with_items:
|
|
- name: libvirtd-tls.socket
|
|
condition: "{{ nova_libvirtd_listen_tls | bool }}"
|
|
- name: libvirtd-tcp.socket
|
|
condition: "{{ nova_libvirtd_listen_tcp | bool }}"
|
|
listen:
|
|
- Restart libvirt-bin
|
|
|
|
- name: Start libvirt-bin
|
|
service:
|
|
name: "{{ item }}"
|
|
enabled: yes
|
|
state: "started"
|
|
with_items:
|
|
- "{{ libvirt_service_name }}"
|
|
listen:
|
|
- Restart libvirt-bin
|
|
- "cert installed"
|
|
when:
|
|
- "'nova_compute' in group_names"
|
|
- nova_virt_type != 'ironic'
|
|
|
|
- name: Symlink nova config directory
|
|
file:
|
|
# NOTE(cloudnull): The "src" path is relative. This ensures all files remain
|
|
# within the host/container confines when connecting to
|
|
# them using the connection plugin or the root filesystem.
|
|
src: "{{ nova_conf_version_dir | regex_replace('^/', '../') }}"
|
|
dest: "{{ nova_conf_dir }}"
|
|
state: link
|
|
force: true
|
|
when: nova_install_method == 'source'
|
|
listen:
|
|
- "venv changed"
|
|
|
|
- name: Drop sudoers file
|
|
template:
|
|
src: "sudoers.j2"
|
|
dest: "/etc/sudoers.d/{{ nova_system_user_name }}_sudoers"
|
|
mode: "0440"
|
|
owner: "root"
|
|
group: "root"
|
|
listen:
|
|
- "Restart nova services"
|
|
- "venv changed"
|
|
|
|
- name: Stop services
|
|
service:
|
|
name: "{{ item.service_name }}"
|
|
enabled: yes
|
|
state: "stopped"
|
|
daemon_reload: yes
|
|
with_items: "{{ filtered_nova_services }}"
|
|
register: _stop
|
|
until: _stop is success
|
|
retries: 5
|
|
delay: 2
|
|
listen:
|
|
- "Restart nova services"
|
|
- "venv changed"
|
|
- "cert installed"
|
|
- "systemd service changed"
|
|
|
|
- name: Start services
|
|
service:
|
|
name: "{{ item.service_name }}"
|
|
enabled: yes
|
|
state: "started"
|
|
daemon_reload: yes
|
|
with_items: "{{ filtered_nova_services }}"
|
|
register: _start
|
|
until: _start is success
|
|
retries: 5
|
|
delay: 2
|
|
listen:
|
|
- "Restart nova services"
|
|
- "venv changed"
|
|
- "cert installed"
|
|
- "systemd service changed"
|
|
|
|
- name: Reload apparmor profile
|
|
ansible.builtin.service:
|
|
name: apparmor.service
|
|
state: reloaded
|