2891 Commits

Author SHA1 Message Date
Matthias Runge
d6df3c61c2 Clarify horizon allowed hosts setting
Horizon allowed hosts should name the IP addresses/
DNS names (short/long) the Horizon node is listening to.
Allowed hosts is used for header checks and is a security
mechanism.

Change-Id: I81c96357f969a1a436eecd35eb178579159bc719
2016-10-21 16:23:18 +00:00
Jenkins
ec02ba6319 Merge "Add special case handling for OVS upgrade in updates and upgrades" 2016-10-21 16:23:16 +00:00
Jenkins
60750a2e02 Merge "Use ::os_workers fact instead of ::processorcount" 2016-10-21 16:13:55 +00:00
Jenkins
23a1617da9 Merge "Add parameters to run cinder over httpd" 2016-10-21 15:45:37 +00:00
Jenkins
85f6017ba2 Merge "Add missing Ceph endpoints from tls-everywhere environment" 2016-10-21 14:42:17 +00:00
Jiri Stransky
b6a4bdc3e4 Re-add NFS backend for Glance
We lost ability to store Glance images in NFS mounts as we moved to NG
HA architecture. This patch re-adds that ability, but the parameter
interface changes because the semantics change as well. (Pacemaker
allowed for different mounts than just NFS so the parameters were more
generic, although we only ever tested and documented NFS usage.)

Change-Id: Ic5197e09846bbf75d780dcc74da1717dcf8301d0
Related-Bug: #1635606
2016-10-21 16:22:40 +02:00
Jenkins
6d29fdb365 Merge "Include ceilometer in swift proxy pipeline" 2016-10-21 13:16:34 +00:00
Jenkins
cc79c92b73 Merge "Removes EnableODL heat parameter and fixes missing local_ip param" 2016-10-21 12:58:45 +00:00
Juan Antonio Osorio Robles
da3b0cb68f Use ::os_workers fact instead of ::processorcount
Change-Id: Ib25849565c617f32357ef545957f58454b2a53f8
2016-10-21 15:37:35 +03:00
Brad P. Crochet
9dfc243202 Composable Mistral services
Adds new puppet specific services for Mistral
API and Mistral Engine.

This submission enables the mistral service by default in the
overcloud, a following submission will disable it and make it
optional by enabling it on demand based in an environment file.

Depends-On: Iae42ffa37c4c9b1e070b7c3753e04c45bb97703f
Depends-On: I942d419be951651e305d01460f394870c30a9878
Depends-On: I6cb2cbf4a2abf494668d24b8c36b0d525643f0af
Implements: blueprint composable-services-within-roles
Co-Authored-By: Carlos Camacho <ccamacho@redhat.com>

Change-Id: Id5ff9cb498b5a47af38413d211ff0ed6ccd0015b
2016-10-21 08:07:08 -04:00
Jenkins
ded5fe48f7 Merge "Generate internal TLS hieradata for apache services" 2016-10-21 12:05:37 +00:00
Juan Antonio Osorio Robles
7cc594c53a Add missing Ceph endpoints from tls-everywhere environment
Change-Id: Ib945e570556e8e10e5bb07faa57270958c9eda99
2016-10-21 14:36:56 +03:00
Jenkins
f20cac2e94 Merge "Bind mount files to run DiD in latest atomic host" 2016-10-21 09:20:01 +00:00
Jenkins
13839aef60 Merge "Have docker start script honor configuration" 2016-10-21 09:19:54 +00:00
Michele Baldessari
c6ddaafe54 Remove double tcp_listen_options entries for rabbit
After a brand new deployment we have the following in rabbitmq.config:
...
  {rabbit, [
    {tcp_listen_options,
         [binary,
         {packet,        raw},
         {reuseaddr,     true},
         {backlog,       128},
         {nodelay,       true},
         {exit_on_close, false}]
    },
    {tcp_listen_options, [binary, {packet, raw}, {reuseaddr, true},
{backlog, 128}, {nodelay, true}, {exit_on_close, false}, {keepalive,
true}]},
...

Let's remove these duplicate entries and make sure that we use the
parameters for the puppet module to set the following values
explicitely (it's the only parameter where we do not use the default
setting from the puppet module):
keepalive = true -> rabbitmq::tcp_keepalive: true

All the other options that we set are the default in the puppet module:
{packet, raw}
{reuseaddr, true}
{backlog, 128}{nodelay, true}
{exit_on_close, false}

Depends-On: I608477d5714a5081b3b4ab3b9fc2932bdd598301
Change-Id: I35921652bd84d1d6be0727051294983d4a0dde10
2016-10-21 07:46:12 +02:00
James Slagle
1c4ade1d66 Open port 16509 for libvirt for live migration
Port 16509 should be opened for tcp traffic to enable live migration.

See Also:
http://docs.openstack.org/admin-guide/compute-configuring-migrations.html

Previously, we were not enabling any iptables rules on the Compute
Roles, so this is a regression.

Change-Id: Ie4abf53dc2a8171af48d02e34a1a3ad43f27cfb3
Closes-Bug: #1635427
2016-10-20 17:25:21 -04:00
Pradeep Kilambi
f1b509c8c8 Include ceilometer in swift proxy pipeline
new ceilometermiddleware is available and integrated into
puppet-swift. Lets leverage it and include it in the
swift proxy pipeline. The correcponding puppet triple
change for this is Ie49f4a750368ff174b23b8d6baa743d0956d727e

Closes-Bug: #1631108

Change-Id: I82da0240d60d1eed54f1c0927e6157bb63025a19
2016-10-20 19:57:33 +00:00
Jenkins
980668899a Merge "Disables Neutron ML2 config on Compute for OpenDaylight" 2016-10-20 18:35:45 +00:00
Michele Baldessari
7ce217909a Fix the stonith property during upgrades
We currently set the stonith property from all controller nodes during
upgrade. This is racy and can actually end up disabling stonith after
the upgrade even if when it was enabled.

Let's set the property only from the bootstrap node.

Change-Id: Id4afb867b485ac853be874a0179a7ed7cc914068
Closes-Bug: #1635294
2016-10-20 20:16:28 +02:00
marios
7e09b70bc3 Add special case handling for OVS upgrade in updates and upgrades
This adds a special case handling for the opensvswitch package
as discussed at the related bug below.
This is added/handled here for both the minor update and the
major mitaka...newton upgrade.

Change-Id: I9b1f0eaa0d36a28e20b507bec6a4e9b3af1781ae
Closes-Bug: 1635205
2016-10-20 13:42:37 +03:00
Juan Antonio Osorio Robles
bf97a0fb63 Enable internal TLS for gnocchi
This adds the necessary hieradata for enabling TLS in the internal
network for gnocchi.

bp tls-via-certmonger

Depends-On: Ie983933e062ac6a7f0af4d88b32634e6ce17838b
Change-Id: Iad8d4949ada8b8fd52e0d0bd345b6fb1ca65827b
2016-10-20 12:22:51 +03:00
Juan Antonio Osorio Robles
eb114773ac Enable internal TLS for aodh
This adds the necessary hieradata for enabling TLS in the internal
network for aodh.

bp tls-via-certmonger

Change-Id: I2ea160e3ac0775404d6ed302f475268d3a3031ef
Depends-On: I50ef0c8fbecb19d6597a28290daa61a91f3b13fc
2016-10-20 12:22:51 +03:00
Juan Antonio Osorio Robles
660dbd5afb Enable internal TLS for ceilometer
This adds the necessary hieradata for enabling TLS in the internal
network for ceilometer.

bp tls-via-certmonger

Depends-On: Ib5609f77a31b17ed12baea419ecfab5d5f676496
Change-Id: I3eb34efbc8489b23269f97f762d4a3d0fa69f666
2016-10-20 12:22:51 +03:00
Juan Antonio Osorio Robles
debbfbbf8f Generate internal TLS hieradata for apache services
This adds an environment file that can be used to enable TLS in
the internal endpoints via certmonger if used. This will include
a nested stack that will create the hash that will be used to
create the certmonger certificates.

When setting up a service over apache via puppet, we used to disable
explicitly ssl (which sets modd_ssl-related fields for that vhost).
We now make this depend on the EnableInternalTLS flag. This has only
been done for keystone, but more services will be added as the
puppet code lands

bp tls-via-certmonger

Depends-On: I303f6cf47859284785c0cdc65284a7eb89a4e039
Change-Id: I12e794f2d4076be9505dabfe456c1ca6cfbd359c
2016-10-20 12:22:42 +03:00
Juan Antonio Osorio Robles
9bd8d53cda Remove duplicate bind_host from nova-api profile
Change-Id: I3c5c7753237ebaf16fb40806df0d195cb2b9aaa0
2016-10-20 09:16:47 +03:00
Martin André
e7cb607872 Bind mount files to run DiD in latest atomic host
The /usr/bin/docker is a shell script in latest atomic host, pointing
to either docker-latest or docker-current binary. Bind mount the
required files from atomic host to be able to run docker in docker
inside heat-agents container.

Co-Authored-By: Flavio Percoco <flavio@redhat.com>
Change-Id: I97e29f65beb3a3f89c1b42c339e2e89f0fc1d519
2016-10-19 14:31:17 +02:00
Martin André
6d41f69033 Have docker start script honor configuration
The test was always evaluate as true which resulted in
insecure_registry line being set even when DockerNamespaceIsRegistry
was set to false.

Change-Id: Iacb73a4908a6a27082b94fe919734e644ed47b19
2016-10-19 14:31:17 +02:00
Ade Lee
5f2f5422d7 Add Barbican to the overcloud
Co-Authored-By: Juan Antonio Osorio Robles <jaosorior@redhat.com>
Depends-On: If2804b469eb3ee08f3f194c7dd3290d23a245a7a
Depends-On: I091ecfbcb2e38fe77203244ac7a597aedcb558fb
Change-Id: Iacc504fc4fa2d06893917024ce2340d3fb80b626
2016-10-19 06:40:08 +00:00
Jenkins
81aa47d314 Merge "Set nova service_name via t-h-t" 2016-10-18 19:55:16 +00:00
Jenkins
c471c144b8 Merge "Fix api_extensions_path in neutron-opencontrail environment" 2016-10-18 19:53:20 +00:00
Jenkins
9d3abe0923 Merge "Enable proxy headers parsing for Neutron" 2016-10-18 13:47:37 +00:00
Jenkins
2775cc735c Merge "Add apache workers to nova-api conditional" 2016-10-18 12:50:14 +00:00
Juan Antonio Osorio Robles
0b62c9524c Add parameters to run cinder over httpd
This adds the necessary hieradata to run cinder over httpd instead
of eventlet.

Change-Id: Ic1967a6f4f60a273965811516f33121115d518b4
2016-10-18 13:36:14 +03:00
Jenkins
01452606a4 Merge "Ensure all HostsDeployments finish before puppet" 2016-10-18 10:17:22 +00:00
Cyril Lopez
2cd90e8f36 Fix api_extensions_path in neutron-opencontrail environment
There is a missing repositiry for LBaaS in api_extensions_path in neutron-opencontrail.
This patch is working in my lab : tripleo liberty and opencontrail 3.0.2

Closes-Bug: #1634120

Change-Id: Ie06612faf226d0e5e75f3f8a9b560118cba5ff4c
Signed-off-by: Cyril Lopez <cylopez@redhat.com>
2016-10-18 00:45:01 +02:00
Steven Hardy
4c500c680a Add apache workers to nova-api conditional
Without this httpd fails to start on deployments where the
worker count isn't explicitly overridden via a parameter.

Change-Id: Ie7b31bc6e022a0166af126c866994bdd019718df
Closes-Bug: #1634213
2016-10-17 19:02:41 +01:00
Tim Rozet
59f19b5e37 Removes EnableODL heat parameter and fixes missing local_ip param
EnableOpenDaylightOnController was not very composable.  Removing this
parameter to make the service truly composable.  Also fixes missing
local_ip setting for OVS, required for VXLAN or GRE tenant networks.

Closes-Bug: 1633625

Depends-On: Ia55c05e12d5d434111a13e1ed795da530e3ff4a5

Change-Id: I0e07e1631793311334d1436ee8fdf9af2802ba70
Signed-off-by: Tim Rozet <trozet@redhat.com>
2016-10-17 11:32:06 -04:00
Juan Antonio Osorio Robles
d7610f70d0 Set nova service_name via t-h-t
with the move to use httpd instead of eventlet, We now add this
parameter in t-h-t to be able to clean it up from the puppet-tripleo
manifest.

Change-Id: Ic229182cc5c887b57f6182c3db1bac8bed330f7c
Depends-On: I4603b81d30a704b07eef461b3cdbfe164614b04f
2016-10-17 12:22:51 +03:00
Juan Antonio Osorio Robles
bb875ec21c Enable proxy headers parsing for Neutron
http_proxy_to_wsgi middleware was recently added to Neutron [1] and
in order to take it into use, we need to enable it via hiera.

[1] Ice9ee8f4e04050271d59858f92034c230325718b
Depends-On: I99bc9486fdd85857ce73c413e17400320bd6ec5b
Related-Bug: #1590608

Change-Id: I10c065e726f2708e09acfc04dac3cae34a534d23
2016-10-17 11:49:25 +03:00
Attila Fazekas
0ff21f83f3 glance_multiple_locations when NovaEnableRbdBackend=true
glance_multiple_locations does not needed when the
NovaEnableRbdBackend=false, but it is neede when both the
image and the instance storage is rbd and
the show_image_direct_url is enabled.

The condition introduced in Ia7e0558e4f318640981abb44d188e3479b5eae69

Change-Id: Ia8a8cd9aeda69e9a7db6f95dcf418f56e29cae00
Closes-Bug: 1632285
2016-10-17 08:43:11 +02:00
Tim Rozet
6b9fe61995 Disables Neutron ML2 config on Compute for OpenDaylight
This is not needed with ODL and actually triggers deployments to fail
due to missing ODL username/password info on compute nodes.

Depends-On: Ifd906db4e6062ac271c2147fe1149b1009d06ae2

Closes-Bug: 1633630

Change-Id: Ib88e8ef91c393d30c44b86a932103f5a294bc547
Signed-off-by: Tim Rozet <trozet@redhat.com>
2016-10-15 21:47:31 +00:00
Jenkins
9fa2b4e97b Merge "Modify the constraint to allow single quote for DPDK core list param" 2016-10-14 23:21:40 +00:00
Jenkins
b8d23becd1 Merge "Move trunk service plugin to the proper list" 2016-10-14 23:21:33 +00:00
Jenkins
30ebec7461 Merge "Pass heat domain admin password to keystone" 2016-10-14 22:50:30 +00:00
Jenkins
86f958491e Merge "Fixes missing provider mappings for OpenDaylight" 2016-10-14 18:41:37 +00:00
Dan Prince
ccc3a56983 Ensure all HostsDeployments finish before puppet
This makes sure that the Host settings for all deployments are finished
before starting the AllNodesDeployments which execute puppet.

Change-Id: Ibe604472255ce905ca2c1dca2a9b07a6f8f40e47
Related-bug: #1633565
2016-10-14 13:39:01 -04:00
Luca Lorenzetto
74317f2b96 heat-api-cfn endpoint is created to RegionOne instead of regionOne
When deploying, heat-api-cfn is assigned to RegionOne. This leads to a
bad user experience when logging into horizon, because if RegionOne is
selected by default, the users finds all menus empty (no computing, or
anything else).

Thanks to trown for finding out the issue.

Closes-Bug: 1633524

Change-Id: Ic108280f6b0875ffec10be6f696669962fb82e6b
2016-10-14 15:54:57 +00:00
Jenkins
23dc0914e4 Merge "Add contrail services to the resource registry" 2016-10-14 14:31:18 +00:00
Tim Rozet
32d7c52bf8 Fixes missing provider mappings for OpenDaylight
Provider mappings were not parameterized, and this is traditionally
required for VLAN provider networks.  In ODL Boron with new netvirt,
this value is required to be set in order to use external networks.

Closes-Bug: #1627898

Change-Id: I8001a4077fc7c4af458033043ea438c32c9772b0
Signed-off-by: Tim Rozet <trozet@redhat.com>
2016-10-14 09:45:25 -04:00
Steven Hardy
4e98b29572 Pass heat domain admin password to keystone
This is needed to create the user/domain/project in the
keystone profile on whatever role is running the keystone service.

Change-Id: I115ead005974080e0a35e3675d9b37828c8934b1
Closes-Bug: #1631130
Depends-On: Ib088a572b384b479f51d56555734d78ab840a1f3
2016-10-14 13:29:15 +00:00