38 Commits

Author SHA1 Message Date
karthik s
512c032a0b Add bootparams service for all roles
NIC partitioning requires IOMMU to be enabled on roles using it.
By adding the BootParams service to all the roles, we could
enable IOMMU selectively by supplying the role specific parameter
"KernelArgs". If a role doesn't use NIC Partitioning then
"KernelArgs" shall be not be set and backward compatibility would
be retained.

Change-Id: I2eb078d9860d9a46d6bffd0fe2f799298538bf73
2018-11-19 05:02:07 -05:00
Emilien Macchi
7bebdefda8 Introduce OS::TripleO::Services::Podman
Podman service will be in charge of installing, configuring, upgrading
and updating podman in TripleO.

For now, the service is disabled by default but included in all roles.
In the cycle, we'll make it the default.

Note: when Podman will be able to run in TripleO without Docker,
we'll do like https://review.openstack.org/#/c/586679/ and make it as
a generic service that can be switched to either podman or docker.
But for now, we need podman & docker working side by side.

Depends-On: Ie9f5d3b6380caa6824ca940ca48ed0fcf6308608
Change-Id: If9e311df2fc7b808982ee54224cc0ea27e21c830
2018-10-02 01:47:46 +00:00
Alex Schultz
f7f9053963 Create a Timesync service declaration
In order to support switching between multiple timesync backends, let's
simplify the service configurations for the roles so that there is a
single timesync service.  This timesync service should point to the
expected backend (ntp/ptp/chrony).

Change-Id: I986d39398b6143f6c11be29200a4ce364575e402
Related-Blueprint: tripleo-chrony
2018-09-04 21:00:56 +00:00
Zuul
e7bde70073 Merge "Add NovaResumeGuestsStateOnHostBoot and NovaResumeGuestsShutdownTimeout" 2018-08-08 12:39:02 +00:00
Martin Mágr
b76d7623ac QDR for metrics collection purposes
This patch adds composable new service (QDR) for containerized deployments.
Metrics QDR will run on each overcloud node in 'edge' mode. This basically
means that there is a possibility that there will be two QDRs running
on controllers in case that oslo messaging is deployed. This is a reason why
we need separate composable service for this use case.

Depends-On: If9e3658d304c3071f53ecb1c42796d2603875fcd
Depends-On: I68f39b6bda02ba3920f2ab1cf2df0bd54ad7453f
Depends-On: I73f988d05840eca44949f13f248f86d094a57c46
Change-Id: I1353020f874b348afd98e7ed3832033f85a5267f
2018-07-31 21:55:45 +00:00
Martin Schuppert
9654393f24 Add NovaResumeGuestsStateOnHostBoot and NovaResumeGuestsShutdownTimeout
NovaResumeGuestsStateOnHostBoot (true/false) parameter which
configures whether or not to start again instances which were running at
the time of a compute reboot.
This will set the resume_guests_state_on_host_boot parameter in nova.conf
and configures and enables libvirt-guests with a dependency to the
docker service to shutdown instances before the libvirt container gets
stopped.
NovaResumeGuestsShutdownTimeout specifies the number in seconds for an
instance to allow to shutdown.

Change-Id: I946600ebbc3afd88385ca89015e8f6a6c46f46ef
Closes-Bug: 1778216
Depends-On: I2766cdd66ff17756daaf1a75ad516a7af6eebddc
Depends-On: Id1cc2e75af316b864cebf601395f1111b7fb049a
2018-07-31 12:24:08 +02:00
zshi
d0a92f1c20 Add PTP composable service
Precision Time Protocol (PTP) is a protocol used to
synchronize clocks throughout a network. When used
in conjunction with hardware support, PTP is capable
of sub-microsecond accuracy which is far better than
is normally obtainable with NTP.

Change-Id: I98a1833db28944cfd5a89e4f28c192bb9af8ebbb
Depends-On: Idc78df3a90b73be504480bc9d33a3f0041d2d84f
2018-02-08 15:20:17 +08:00
lhinds
7e68dbdf8c Implements AIDE Intrusion Detection System
Introduces a service to configure AIDE Intrusion Detection.

This service init's the database and copies the new database
to the active naming. It also sets a cron job, using email if
`AideEmail` is populated, otherwise the reports are sent to
`/var/log/aide/`.

AIDE rules can be supplied as a hash, and should the rules ever
be changed, the service will populate the new rules and re-init
a fresh integrity database.

Related-Blueprint: tripleo-aide-database
Depends-On: Iac2ceb7fc6b610f8920ae6f75faa2885f3edf6eb
Change-Id: I23d8ba2c43e907372fe079026df1fca5fa1c9881
2018-01-15 13:10:16 +00:00
Daniel Alvarez
85e006d19d Add support for OVN Metadata Agent
This patch adds support for networking-ovn-metadata-agent.
It will deploy the agent on compute nodes and disable Nova
force_config_drive.

The following two patches have been squashed into this one:
* https://review.openstack.org/#/c/525164/
* https://review.openstack.org/#/c/522813/
The reason behind the squash is that we had interdepenencies
and this patch alone wouldn't be testing the code properly
without the two other ones since scenario007 job in baremetal
has been removed for this cycle.

UpgradeImpact

Depends-On: I678652294cb8f964c34b742a0bc0ea360d736fb9
Depends-On: If3dffde5e0db8f7607a9708d36d54d1600fe5da8
Depends-On: I38f775479d178f5b252619635b67f876bc8c5ed5
Depends-On: Ifdd42437333730a3b3e6f36cbab6df0a2971a5a1
Depends-On: I940cec6d670df39ac6e2a3559a028acbeee99331

Change-Id: Idc2bb4e31a64502ac6fcdac771d823509dc328e7
Signed-off-by: Daniel Alvarez <dalvarez@redhat.com>
2018-01-12 09:40:06 +00:00
Emilien Macchi
6a6872f390 Introduce OS::TripleO::Services::Rhsm
Background:
extraconfig/pre_deploy/rhel-registration interface has been maintained
for some time now but it's missing some features and the code overlaps
with ongoing efforts to convert everything to Ansible.

Plan:
Consume ansible-role-redhat-subscription from TripleO, so all the logics
goes into the Ansible role, and not in TripleO anymore.
The single parameter exposed to TripleO is RhsmVars and any Ansible
parameter can be given to make the role working.
The parameter can be overriden per roles, so we can think at specific
cases were some Director roles would have specific RHSM configs.
Once we have feature parity between what is done and what was here
before, we'll deprecate the old interface.

Testing:
Because RHSM can't be tested on CentOS, this code was manually tested on
RHEL against the public subscription portal. Also, we verified that
generated Ansible playbooks were correct and called the role with the
right parameters.

Documentation:
We'll work on documentation during the following weeks and explain
how to switch from the previous interface to the new one, and also
document new uses requested by our users.

Change-Id: I8610e4f1f8478f2dcbe3afc319981df914ce1780
2017-12-27 11:03:49 -08:00
Juan Antonio Osorio Robles
898ad4f54b Add IPSEC composable service
This service is tied to the external_deploy_tasks (such as the k8s
service); and it deploys IPSEC in the overcloud.

bp ipsec

Change-Id: Ie3b7af92c0ec97241de6d8badec13b9e93ee9305
2017-12-05 13:10:18 +00:00
lhinds
502fde7a64 Implements management of /etc/login.defs
Enables management of shadow password directives in login.defs

By allowing operators to set values in login.defs, they are able
to improve password security for newly created system accounts.

This change will in turn allow operators to adhere with security
hardening frameworks, such as STIG DISA & CIS Security Benchmarks.

bp login-defs

Change-Id: Id4fe88cb9569f18f27f94c35b5c27a85fe7947ae
Depends-On: Iec8c032adb44593da3770d3c6bb5a4655e463637
2017-11-29 09:23:25 +00:00
Zuul
b2bc4f36a3 Merge "logging: merge fluentd-client and fluentd-base" 2017-11-22 10:41:19 +00:00
Zuul
e7e0dd17da Merge "Deprecate hyperconverged-ceph.yaml" 2017-11-21 15:06:45 +00:00
Lars Kellogg-Stedman
f982eb55c4 logging: merge fluentd-client and fluentd-base
The fluentd implementation was originally split across multiple files
in order to support both client and server services. we ultimately
decided to only implement the client as part of tripleo so this
division is no longer necessary.  This commit merges
fluentd-client.yaml and fluentd-base.yaml into fluentd.yaml, and
renames things appropriately.

Partial-bug: #1715187
Depends-On: Iace34b7baae8822d2233d97adabf6ebc8833adab
Change-Id: Idb9886f04d56ffc75a78c4059ff319b58b4acf9f
2017-11-17 11:04:52 +01:00
Juan Antonio Osorio Robles
97f9a01f79 Add rsyslog-sidecar resource and configuration
This introduces a "sidecar" container, which is meant to be used
besides other containers (or as part of the pod). It merely uses
rsyslog to listen on a specific UNIX socket and outputs what it
gets to stdout.

This adds the service to each relevant role and introduces a
composable service which merely configures the container. Subsequently
it'll be used as part of other templates.

Note that it is only enabled if "stdout logging" is enabled.

bp logging-stdout-rsyslog
Depends-On: I4864ddca223becd0a17f902729cf2e566df5e521

Change-Id: I2c54acaaa820961c936f1fbe304f42162f720496
2017-11-17 10:38:57 +02:00
John Fulton
1e1a86e0b7 Deprecate hyperconverged-ceph.yaml
This file was introduced in Newton to allow for HCI deployments
without requiring the user to edit roles_data.yaml. However, a
more general solution exists to use composable roles without
manually editing roles_data.yaml. This change adds a comment
describing how to use the new method instead.

Change-Id: I72a29a1ddb77fbdf10c9cf190d2ad5e02100d138
Closes-Bug: #1731104
2017-11-09 08:37:34 -05:00
Saravanan KR
739b05f528 Added a new role definition for SR-IOV Compute role
In order to support the role generation command, a new role for
hosting SR-IOV workloads has been added. This also removes the
SR_IOV services from the default compute so that compute and compute
sriov can co-exist in the same cluster.
Closes-Bug: #1715829

Change-Id: If48bd6a69209da556cc75ece035b341eb59f41a9
2017-10-25 15:16:28 +05:30
Sylvain Baubeau
d31bc3a573 Add a Skydive composable service
This commits adds one service for the agent, and one
other for the analyzer. When using multiple controller nodes,
the analyzers are deployed in cluster mode, with a single etcd node.
These services are deployed as containers using a Mistral
workflow with Ansible.

Depends-on: I0442d2a75a4931a4bd8399c58ff6b016d5486945
Change-Id: I56c53158f9ed294dac95dbd7087d057e427f16a1
2017-10-04 10:32:07 +02:00
Brent Eagles
94c9c2f954 Add Neutron SR-IOV agent container
This patch adds support for running the neutron SR-IOV agent in a
container.

Depends-On: I4a63845a97c890d7d408731ec5509c320289f18f
Depends-On: Ie5d8cd7863c0d042cc6a4e1fc52602d8a03a1935
Depends-On: I1b5ab0a64ae1f5735f1bd5a68e6ae8bdcf47ddec

Closes-Bug: #1715388

Change-Id: I7ee603b32eddacd02d846dff00dd1b786d4a7ad9
2017-09-06 22:18:24 -02:30
Ricardo Noriega
a18a94e498 Add Bagpipe driver composable service
The BaGPipe driver for the BGPVPN service plugin is designed
  to work jointly with the openvswitch ML2 mechanism driver.

Change-Id: I17ed258231e7efdd1ca8e0697d074b11961ed0ae
Depends-On: I1e0227d8055f456043fe63c6a9cbd722d7bf84a7
Partially-Implements: blueprint bgpvpn-service-integration
Signed-off-by: Ricardo Noriega <rnoriega@redhat.com>
2017-09-01 11:56:47 +02:00
Bogdan Dobrelya
8a03456056 Add logrotate with crond service
Add a docker service template to provide containerized services
logs rotation with a crond job.
Add OS::TripleO::Services::LogrotateCrond to CI multinode-containers
and to all environments among with generic services like Ntp or Kernel.
Set it to OS::Heat::None for non containerized environments and
only enable it to the environments/docker.yaml.

Closes-bug: #1700912

Change-Id: Ic94373f0a0758e9959e1f896481780674437147d
Signed-off-by: Bogdan Dobrelya <bdobreli@redhat.com>
2017-08-21 08:56:29 +02:00
Numan Siddique
5f313f27c9 Add 'ovn-controller' service
Presently the ovn-controller service (puppet/services/neutron-compute-plugin-ovn.yaml)
is started only on compute nodes. But for the cases where the controller nodes
provide the north/south traffic, we need ovn-controller service runninng in controller
nodes as well.

This patch
 - Renames the neutron-compute-plugin-ovn.yaml to ovn-controller.yaml which makes more
   sense and sets the service name as 'ovn-controller'.
 - Adds the service 'ovn-controller' to Controller and Compute roles.
 - Adds the missing 'upgrade_tasks' section in ovn-dbs.yaml and ovn-controller.yaml

Depends-On: Ie3f09dc70a582f3d14de093043e232820f837bc3
Depends-On: Ide11569d81f5f28bafccc168b624be505174fc53
Change-Id: Ib7747406213d18fd65b86820c1f86ee7c39f7cf5
2017-07-27 18:22:03 +00:00
Joe Talerico
c2b2cc555a Adding Tuned Service
Allow the user to set a specific Tuned profile on a given host.

Defaults to throughput-performance

Change-Id: I0c66193d2733b7a82ad44b1cd0d2187dd732065a
2017-07-25 17:08:37 +00:00
Oliver Walsh
4a7f3398f1 Add support for nova live/cold-migration with containers
Updates hieradata for changes in https://review.openstack.org/471950.
Creates a new service - NovaMigrationTarget. On baremetal this just configures
live/cold-migration. On docker is includes a container running a second sshd
services on an alternative port.
Configures /var/lib/nova/.ssh/config and mounts in nova-compute and libvirtd
containers.

Change-Id: Ic4b810ff71085b73ccd08c66a3739f94e6c0c427
Implements: blueprint tripleo-cold-migration
Depends-On: I6c04cebd1cf066c79c5b4335011733d32ac208dc
Depends-On: I063a84a8e6da64ae3b09125cfa42e48df69adc12
2017-07-23 02:26:55 +01:00
Dan Prince
15c93fdbd9 Move iscsid to a container
This configures iscsid so that it runs as a container on
relevant roles (undercloud, controller, compute, and volume).
When the iscsid docker service is provision it will also run
an ansible snippet that disables the iscsid.socket on the host
OS thus disabling the hosts systemd from auto-starting iscsid
as it normally does.

Co-Authored-By: Jon Bernard <jobernar@redhat.com>

Change-Id: I2ea741ad978f166e199d47ed1b52369e9b031f1f
2017-06-12 10:04:58 -04:00
Bartosz Stopa
ee2c065be7 Add support for linuxbridge agent
Currently TripleO does not support LinuxBridge driver, setting
NeutronMechanismDrivers to linuxbridge will not force ml2 plugin
to use linuxbridge.

This commit adds new environment file which replaces default ovs
agent with linuxbridge on Compute and Controller nodes.

Change-Id: I433b60a551c1eeb9d956df4d0ffb6eeffe980071
Closes-Bug: #1652211
Depends-On: Iae87dc7811bc28fe86db0c422c363eaed5e5285b
Depends-On: Ie3ac03052f341c26735b423701e1decf7233d935
2017-05-25 14:39:44 +02:00
Feng Pan
59fedd3d53 Add networking-vpp ML2 mechanism driver support
Implements: blueprint fdio-integration-tripleo

Change-Id: I412f7a887ca4b95bcf1314e8c54cb1e7d03b1e41
Signed-off-by: Feng Pan <fpan@redhat.com>
2017-04-10 11:44:08 -04:00
Jenkins
aabb90e7a1 Merge "Add Docker service to all roles" 2017-04-07 16:51:36 +00:00
Jiri Stransky
e9abec8273 Add Docker service to all roles
This will add the Docker service to all roles. Note that currently by
default the Docker service is mapped to OS::Heat::None by default. It
will only be deployed if environments/docker.yaml file is included in
the deployment.

Change-Id: I9d8348b7b6576b94c872781bc89fecb42075cde0
Related-Bug: #1680395
2017-04-07 14:28:59 +02:00
lhinds
9945538069 Adds service for managing securetty
This adds the ability to manage the securetty file.

By allowing management of securetty, operators can limit root
console access and improve security through hardening.

Change-Id: I0767c9529b40a721ebce1eadc2dea263e0a5d4d7
Partial-Bug: #1665042
Depends-On: Ic4647fb823bd112648c5b8d102913baa8b4dac1c
2017-04-06 13:30:50 +01:00
Juan Antonio Osorio Robles
31bc6eaa88 Add certmonger-user profile
This profile will request the certificates for the services on the node.
So with this, we will remove the requesting of these certs on the
services' profiles themselves.

The reasoning for this is that for a containerized environment, the
containers won't have credentials to the CA while the baremetal node
does. So, with this, we will have this profile that still gets executed
in the baremetal nodes, and we can subsequently pass the requested
certificates by bind-mounting them on the containers. On the other hand,
this approach still works well for the TLS-everywhere case when the
services are running on baremetal.

Change-Id: Ibf58dfd7d783090e927de6629e487f968f7e05b6
Depends-On: I4d2e62b5c1b893551f9478cf5f69173c334ac81f
2017-03-13 17:10:13 +02:00
Giulio Fidente
6ff979aa75 Align hyperconverged-ceph.yaml environment and adds some validation
Until bug #1635409 is fixed we'll have to keep the default list
of services deployed by hyperconverged-ceph.yaml in sync with the
ServicesDefault list provided in roles_data.yaml

This change adds some logic in the templates validation script to
ensure that is preserved with future updates.

Change-Id: Ib767f9a24c3541b16f96bd6b6455cf797113fbd8
2017-02-28 18:55:55 +01:00
Giulio Fidente
1a719a037d Align HCI environment file with list of services from roles_data
Until we get bug #1635409 fixed we'll have to keep the two lists
in sync.

Change-Id: Ifd996bd4c95f901f242696b37e179073be6334d0
Related-Bug: #1635409
2017-02-16 12:47:33 +01:00
Dan Prince
933f1afefd Stop using puppet to configure VIPs in /etc/hosts
This patch drops use of the vip-hosts.yaml service which can
cause issues during deployment because puppet 'hosts' resources
overwrite the data in /etc/hosts. The only reason things seem to work
at all at the moment is because our hosts element in t-i-e runs
on each os-refresh-config iteration and re-adds the dropped hosts
entries.

To work around the issue we add a conditional which selectively
adds the extra hosts entries only if the AddVipsToEtcHosts is set
to true.

Closes-bug: 1645123

Change-Id: Ic6aaeb249a127df83894f32a704219683a6382b2
2016-11-27 13:20:33 -05:00
Giulio Fidente
2a7e044518 Provide full list of services for Compute role in HCI scenario
Until bug #1635409 is fixed, we can provide the full list of
services needed on the Compute role, plus CephOSD, in the
hyperconverged-ceph environment file, preserving the user
experience.

Change-Id: I42409bc098c740759b378969526e13efaf002d3c
Related-Bug: #1635409
2016-11-25 11:32:49 +01:00
Giulio Fidente
7d75b583b7 Activate StorageMgmtPort on computes in HCI environment
Change-Id: If4d3b186d1d943ca6fad46427fb3b35699cdfc90
2016-09-23 13:26:28 +02:00
Giulio Fidente
dff4f6ca0c Add hyperconverged-ceph environment to include CephOSD on computes
This would be useful to test Ceph in CI without a dedicated OSD node.

Change-Id: Ie534d327a9418b6119f5811ee62d448795879fb0
2016-08-29 14:25:05 +00:00