Files
5a533aae238638a7af50c75d334f67215fe2142f
openstack-ansible-os_nova /tasks /main.yml

342 lines
10 KiB
YAML
Raw Normal View History

Convert existing roles into galaxy roles This change implements the blueprint to convert all roles and plays into a more generic setup, following upstream ansible best practices. Items Changed: * All tasks have tags. * All roles use namespaced variables. * All redundant tasks within a given play and role have been removed. * All of the repetitive plays have been removed in-favor of a more simplistic approach. This change duplicates code within the roles but ensures that the roles only ever run within their own scope. * All roles have been built using an ansible galaxy syntax. * The `*requirement.txt` files have been reformatted follow upstream Openstack practices. * Dynamically generated inventory is now more organized, this should assist anyone who may want or need to dive into the JSON blob that is created. In the inventory a properties field is used for items that customize containers within the inventory. * The environment map has been modified to support additional host groups to enable the seperation of infrastructure pieces. While the old infra_hosts group will still work this change allows for groups to be divided up into seperate chunks; eg: deployment of a swift only stack. * The LXC logic now exists within the plays. * etc/openstack_deploy/user_variables.yml has all password/token variables extracted into the separate file etc/openstack_deploy/user_secrets.yml in order to allow seperate security settings on that file. Items Excised: * All of the roles have had the LXC logic removed from within them which should allow roles to be consumed outside of the `os-ansible-deployment` reference architecture. Note: * the directory rpc_deployment still exists and is presently pointed at plays containing a deprecation warning instructing the user to move to the standard playbooks directory. * While all of the rackspace specific components and variables have been removed and or were refactored the repository still relies on an upstream mirror of Openstack built python files and container images. This upstream mirror is hosted at rackspace at "http://rpc-repo.rackspace.com" though this is not locked to and or tied to rackspace specific installations. This repository contains all of the needed code to create and/or clone your own mirror. DocImpact Co-Authored-By: Jesse Pretorius <jesse.pretorius@rackspace.co.uk> Closes-Bug: #1403676 Implements: blueprint galaxy-roles Change-Id: I03df3328b7655f0cc9e43ba83b02623d038d214e
2015年02月14日 10:06:50 -06:00
---
# Copyright 2014, Rackspace US, Inc.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
- name:Gather variables for each operating system
include_vars:"{{ lookup('first_found', params) }}"
vars:
params:
files:
- "{{ ansible_facts['distribution'] | lower }}-{{ ansible_facts['distribution_version'] | lower }}.yml"
- "{{ ansible_facts['distribution'] | lower }}-{{ ansible_facts['distribution_major_version'] | lower }}.yml"
- "{{ ansible_facts['os_family'] | lower }}-{{ ansible_facts['distribution_major_version'] | lower }}.yml"
- "{{ ansible_facts['distribution'] | lower }}.yml"
- "{{ ansible_facts['os_family'] | lower }}.yml"
paths:
- "{{ role_path }}/vars"
tags:
- always
- name:Fail when virt type is unsupported
fail:
msg:"Unsupported Virt Type Provided {{ nova_supported_virt_types }}"
when:
- nova_virt_type is defined
- nova_virt_type not in nova_supported_virt_types
tags:
- always
- name:Fail if service was deployed using a different installation method
fail:
msg:"Switching installation methods for OpenStack services is not supported"
when:
- ansible_local is defined
- ansible_local.openstack_ansible is defined
- ansible_local.openstack_ansible.nova is defined
- ansible_local.openstack_ansible.nova.install_method is defined
- ansible_local.openstack_ansible.nova.install_method != nova_install_method
- name:Gather variables for installation method
include_vars:"{{ nova_install_method }}_install.yml"
tags:
- always
- name:Including osa.db_setup role
include_role:
name:openstack.osa.db_setup
apply:
tags:
- common-db
- nova-config
when:
- _nova_is_first_play_host
vars:
_oslodb_setup_host:"{{ nova_db_setup_host }}"
_oslodb_ansible_python_interpreter:"{{ nova_db_setup_python_interpreter }}"
_oslodb_setup_endpoint:"{{ nova_galera_address }}"
_oslodb_setup_port:"{{ nova_galera_port }}"
_oslodb_databases:
- name:"{{ nova_galera_database }}"
users:
- username:"{{ nova_galera_user }}"
password:"{{ nova_container_mysql_password }}"
- name:"{{ nova_api_galera_database }}"
users:
- username:"{{ nova_api_galera_user }}"
password:"{{ nova_api_container_mysql_password }}"
- name:"{{ nova_cell0_database }}"
users:
- username:"{{ nova_api_galera_user }}"
password:"{{ nova_api_container_mysql_password }}"
tags:
- always
- name:Including osa.mq_setup role
include_role:
name:openstack.osa.mq_setup
apply:
tags:
- common-mq
- nova-config
when:
- _nova_is_first_play_host
vars:
_oslomsg_rpc_setup_host:"{{ nova_oslomsg_rpc_setup_host }}"
_oslomsg_rpc_userid:"{{ nova_oslomsg_rpc_userid }}"
_oslomsg_rpc_password:"{{ nova_oslomsg_rpc_password }}"
_oslomsg_rpc_vhost:"{{ nova_oslomsg_rpc_vhost }}"
_oslomsg_rpc_transport:"{{ nova_oslomsg_rpc_transport }}"
_oslomsg_notify_setup_host:"{{ nova_oslomsg_notify_setup_host }}"
_oslomsg_notify_userid:"{{ nova_oslomsg_notify_userid }}"
_oslomsg_notify_password:"{{ nova_oslomsg_notify_password }}"
_oslomsg_notify_vhost:"{{ nova_oslomsg_notify_vhost }}"
_oslomsg_notify_transport:"{{ nova_oslomsg_notify_transport }}"
tags:
- always
- name:Including nova_virt_detect tasks
include_tasks:nova_virt_detect.yml
args:
apply:
tags:
- always
when:
- nova_virt_type is not defined
tags:
- always
- name:Importing nova_mdev_detect tasks
import_tasks:nova_mdev_detect.yml
tags:
- always
- name:Importing nova_pre_install tasks
import_tasks:nova_pre_install.yml
tags:
- nova-install
- name:Importing nova_install tasks
import_tasks:nova_install.yml
tags:
- nova-install
- name:Refresh local facts
Implement data migrations for rolling upgrades In order to cater for artifact-based installed, and rolling upgrades, this patch implements a set of local facts to inform the online migrations task. The 'nova_all_software_updated' variable will be set by the playbook on each run to ensure that the online migrations only happen once all venvs are homogenous. This ensures that the playbook can be executed in a serialised fashion and the data will not be corrupted. The ``upgrade_levels`` setting for ``compute`` is set to ``auto`` to ensure that a mixed RPC version deployment can operate properly when doing a rolling upgrade as suggested by [1]. Additional changes are made to improve the role's ability to be executed using serialised playbooks. Finally, the nova-manage command references to the config file location have been removed as they refer to the default location. [1] https://docs.openstack.org/developer/nova/upgrade.html Change-Id: I08e5a7f0ce526b11aa52c35ee29c458954a5f22d
2017年06月30日 19:35:01 +01:00
setup:
filter:ansible_local
gather_subset:"!all"
tags:
- nova-config
Add TLS support to nova API backends By overriding the variable `nova_backend_ssl: True` HTTPS will be enabled, disabling HTTP support on the nova backend api. The ansible-role-pki is used to generate the required TLS certificates if this functionality is enabled. `nova_pki_console_certificates` are used to encrypt: - traffic between console proxy and compute hosts `nova_pki_certificates` are used to encrypt: - traffic between haproxy and its backends(including console proxy) It would be complex to use nova_pki_console_certificates to encrypt traffic between haproxy and console proxy because they don't have valid key_usage for that and changing key_usage would require to manually set `pki_regen_cert` for existing environments. Certs securing traffic between haproxy and console proxy are provided in execstarts because otherwise they would have to be defined in nova.conf that may be shared with nova-api(which stands behind uwsgi and should not use TLS). Depends-On: https://review.opendev.org/c/openstack/openstack-ansible/+/879085 Change-Id: Ibff3bf0b5eedc87c221bbb1b5976b12972fda608
2023年02月22日 22:16:33 +01:00
# Create certs after nova groups have been created but before handlers
- name:Create and install SSL certificates for API
include_role:
name:pki
tasks_from:main_certs.yml
apply:
tags:
- nova-config
- pki
vars:
pki_setup_host:"{{ nova_pki_setup_host }}"
pki_dir:"{{ nova_pki_dir }}"
pki_create_certificates:"{{ nova_user_ssl_cert is not defined and nova_user_ssl_key is not defined }}"
pki_regen_cert:"{{ nova_pki_regen_cert }}"
pki_certificates:"{{ nova_pki_certificates }}"
pki_install_certificates:"{{ nova_pki_install_certificates }}"
when:
- "'nova_api_metadata' in group_names or 'nova_api_os_compute' in group_names"
tags:
- always
Enable TLS for VNC from novncproxy to compute hosts To secure communications from the proxy server to the compute nodes using VeNCrypt authentication scheme. In a previous patch a TLS server certificate was deployed to compute nodes, this patch makes use of this same server cert for securing VNC sessions on compute nodes. It is recommended that this certificate be issued by a dedicated certificate authority solely for the VNC service, as libvirt does not currently have a mechanism to restrict what certificates can be presented by the proxy server. This has not been implemented to reduce complexity. In addition the noVNC proxy needs to present a client certificate so only approved VNC proxy servers can connect to the Compute nodes. The PKI role has been used to create a client certificate for the nova console nodes. Related Nova docs: https://docs.openstack.org/nova/latest/admin/remote-console-access.html To help with the transition from from unencrypted VNC to VeNCrypt, initially compute nodes auth scheme allows for both encrypted and unencrypted sessions using the variable `nova_vencrypt_auth_scheme`, this will be removed in future releases. Change-Id: Iafb788f80fd401c6ce6e4576bafd06c92431bd65
2021年11月08日 15:40:27 +00:00
- name:Create and install SSL certificates for compute hosts
Enable TLS for live migrations Instead of using SSH to live migrate VM's use TLS as this is more secure and SSH migrations are deprecated. https://docs.openstack.org/nova/xena/admin/secure-live-migration-with-qemu-native-tls.html A pre-existing PKI (Public Key Infrastruture) setup is required. TLS live migrations require that all compute hosts can communcate with each other on port 16514 and port range 49152 to 49261. To enable TLS live migrations, both libvirt and QEMU require server and client certificates, the server certicicates is used to verify servers and the client cert is used by servers to authenticate clients. A single cert is created by the pki role, that can be used by both libvirt and QEMU for both client and server auth. The client, server and CA certifcates need to installed in a number of locations on each compute host: * For Libvirt https://libvirt.org/tlscerts.html * For QEMU https://github.com/libvirt/libvirt/blob/master/src/qemu/qemu.conf Depends-On: https://review.opendev.org/c/openstack/ansible-role-pki/+/815007 Depends-On: https://review.opendev.org/c/openstack/ansible-role-pki/+/815849 Depends-On: https://review.opendev.org/c/openstack/ansible-role-pki/+/816857 Change-Id: Iddbe8764bb6d3cd3eaee122b2d5ddc02fa3f7662
2021年10月25日 08:32:04 +01:00
include_role:
name:pki
tasks_from:main_certs.yml
Add TLS support to nova API backends By overriding the variable `nova_backend_ssl: True` HTTPS will be enabled, disabling HTTP support on the nova backend api. The ansible-role-pki is used to generate the required TLS certificates if this functionality is enabled. `nova_pki_console_certificates` are used to encrypt: - traffic between console proxy and compute hosts `nova_pki_certificates` are used to encrypt: - traffic between haproxy and its backends(including console proxy) It would be complex to use nova_pki_console_certificates to encrypt traffic between haproxy and console proxy because they don't have valid key_usage for that and changing key_usage would require to manually set `pki_regen_cert` for existing environments. Certs securing traffic between haproxy and console proxy are provided in execstarts because otherwise they would have to be defined in nova.conf that may be shared with nova-api(which stands behind uwsgi and should not use TLS). Depends-On: https://review.opendev.org/c/openstack/openstack-ansible/+/879085 Change-Id: Ibff3bf0b5eedc87c221bbb1b5976b12972fda608
2023年02月22日 22:16:33 +01:00
apply:
tags:
- nova-config
- pki
Enable TLS for live migrations Instead of using SSH to live migrate VM's use TLS as this is more secure and SSH migrations are deprecated. https://docs.openstack.org/nova/xena/admin/secure-live-migration-with-qemu-native-tls.html A pre-existing PKI (Public Key Infrastruture) setup is required. TLS live migrations require that all compute hosts can communcate with each other on port 16514 and port range 49152 to 49261. To enable TLS live migrations, both libvirt and QEMU require server and client certificates, the server certicicates is used to verify servers and the client cert is used by servers to authenticate clients. A single cert is created by the pki role, that can be used by both libvirt and QEMU for both client and server auth. The client, server and CA certifcates need to installed in a number of locations on each compute host: * For Libvirt https://libvirt.org/tlscerts.html * For QEMU https://github.com/libvirt/libvirt/blob/master/src/qemu/qemu.conf Depends-On: https://review.opendev.org/c/openstack/ansible-role-pki/+/815007 Depends-On: https://review.opendev.org/c/openstack/ansible-role-pki/+/815849 Depends-On: https://review.opendev.org/c/openstack/ansible-role-pki/+/816857 Change-Id: Iddbe8764bb6d3cd3eaee122b2d5ddc02fa3f7662
2021年10月25日 08:32:04 +01:00
vars:
pki_setup_host:"{{ nova_pki_setup_host }}"
pki_dir:"{{ nova_pki_dir }}"
pki_create_certificates:"{{ nova_user_ssl_cert is not defined and nova_user_ssl_key is not defined }}"
pki_regen_cert:"{{ nova_pki_regen_cert }}"
Enable TLS for VNC from novncproxy to compute hosts To secure communications from the proxy server to the compute nodes using VeNCrypt authentication scheme. In a previous patch a TLS server certificate was deployed to compute nodes, this patch makes use of this same server cert for securing VNC sessions on compute nodes. It is recommended that this certificate be issued by a dedicated certificate authority solely for the VNC service, as libvirt does not currently have a mechanism to restrict what certificates can be presented by the proxy server. This has not been implemented to reduce complexity. In addition the noVNC proxy needs to present a client certificate so only approved VNC proxy servers can connect to the Compute nodes. The PKI role has been used to create a client certificate for the nova console nodes. Related Nova docs: https://docs.openstack.org/nova/latest/admin/remote-console-access.html To help with the transition from from unencrypted VNC to VeNCrypt, initially compute nodes auth scheme allows for both encrypted and unencrypted sessions using the variable `nova_vencrypt_auth_scheme`, this will be removed in future releases. Change-Id: Iafb788f80fd401c6ce6e4576bafd06c92431bd65
2021年11月08日 15:40:27 +00:00
pki_certificates:"{{ nova_pki_compute_certificates }}"
pki_install_certificates:"{{ nova_pki_compute_install_certificates }}"
Enable TLS for live migrations Instead of using SSH to live migrate VM's use TLS as this is more secure and SSH migrations are deprecated. https://docs.openstack.org/nova/xena/admin/secure-live-migration-with-qemu-native-tls.html A pre-existing PKI (Public Key Infrastruture) setup is required. TLS live migrations require that all compute hosts can communcate with each other on port 16514 and port range 49152 to 49261. To enable TLS live migrations, both libvirt and QEMU require server and client certificates, the server certicicates is used to verify servers and the client cert is used by servers to authenticate clients. A single cert is created by the pki role, that can be used by both libvirt and QEMU for both client and server auth. The client, server and CA certifcates need to installed in a number of locations on each compute host: * For Libvirt https://libvirt.org/tlscerts.html * For QEMU https://github.com/libvirt/libvirt/blob/master/src/qemu/qemu.conf Depends-On: https://review.opendev.org/c/openstack/ansible-role-pki/+/815007 Depends-On: https://review.opendev.org/c/openstack/ansible-role-pki/+/815849 Depends-On: https://review.opendev.org/c/openstack/ansible-role-pki/+/816857 Change-Id: Iddbe8764bb6d3cd3eaee122b2d5ddc02fa3f7662
2021年10月25日 08:32:04 +01:00
when:
- nova_libvirtd_listen_tls == 1
- "'nova_compute' in group_names"
- nova_virt_type != 'ironic'
Add TLS support to nova API backends By overriding the variable `nova_backend_ssl: True` HTTPS will be enabled, disabling HTTP support on the nova backend api. The ansible-role-pki is used to generate the required TLS certificates if this functionality is enabled. `nova_pki_console_certificates` are used to encrypt: - traffic between console proxy and compute hosts `nova_pki_certificates` are used to encrypt: - traffic between haproxy and its backends(including console proxy) It would be complex to use nova_pki_console_certificates to encrypt traffic between haproxy and console proxy because they don't have valid key_usage for that and changing key_usage would require to manually set `pki_regen_cert` for existing environments. Certs securing traffic between haproxy and console proxy are provided in execstarts because otherwise they would have to be defined in nova.conf that may be shared with nova-api(which stands behind uwsgi and should not use TLS). Depends-On: https://review.opendev.org/c/openstack/openstack-ansible/+/879085 Change-Id: Ibff3bf0b5eedc87c221bbb1b5976b12972fda608
2023年02月22日 22:16:33 +01:00
tags:
- always
Enable TLS for live migrations Instead of using SSH to live migrate VM's use TLS as this is more secure and SSH migrations are deprecated. https://docs.openstack.org/nova/xena/admin/secure-live-migration-with-qemu-native-tls.html A pre-existing PKI (Public Key Infrastruture) setup is required. TLS live migrations require that all compute hosts can communcate with each other on port 16514 and port range 49152 to 49261. To enable TLS live migrations, both libvirt and QEMU require server and client certificates, the server certicicates is used to verify servers and the client cert is used by servers to authenticate clients. A single cert is created by the pki role, that can be used by both libvirt and QEMU for both client and server auth. The client, server and CA certifcates need to installed in a number of locations on each compute host: * For Libvirt https://libvirt.org/tlscerts.html * For QEMU https://github.com/libvirt/libvirt/blob/master/src/qemu/qemu.conf Depends-On: https://review.opendev.org/c/openstack/ansible-role-pki/+/815007 Depends-On: https://review.opendev.org/c/openstack/ansible-role-pki/+/815849 Depends-On: https://review.opendev.org/c/openstack/ansible-role-pki/+/816857 Change-Id: Iddbe8764bb6d3cd3eaee122b2d5ddc02fa3f7662
2021年10月25日 08:32:04 +01:00
Enable TLS for VNC from novncproxy to compute hosts To secure communications from the proxy server to the compute nodes using VeNCrypt authentication scheme. In a previous patch a TLS server certificate was deployed to compute nodes, this patch makes use of this same server cert for securing VNC sessions on compute nodes. It is recommended that this certificate be issued by a dedicated certificate authority solely for the VNC service, as libvirt does not currently have a mechanism to restrict what certificates can be presented by the proxy server. This has not been implemented to reduce complexity. In addition the noVNC proxy needs to present a client certificate so only approved VNC proxy servers can connect to the Compute nodes. The PKI role has been used to create a client certificate for the nova console nodes. Related Nova docs: https://docs.openstack.org/nova/latest/admin/remote-console-access.html To help with the transition from from unencrypted VNC to VeNCrypt, initially compute nodes auth scheme allows for both encrypted and unencrypted sessions using the variable `nova_vencrypt_auth_scheme`, this will be removed in future releases. Change-Id: Iafb788f80fd401c6ce6e4576bafd06c92431bd65
2021年11月08日 15:40:27 +00:00
- name:Create and install SSL certificates for console hosts
include_role:
name:pki
tasks_from:main_certs.yml
Add TLS support to nova API backends By overriding the variable `nova_backend_ssl: True` HTTPS will be enabled, disabling HTTP support on the nova backend api. The ansible-role-pki is used to generate the required TLS certificates if this functionality is enabled. `nova_pki_console_certificates` are used to encrypt: - traffic between console proxy and compute hosts `nova_pki_certificates` are used to encrypt: - traffic between haproxy and its backends(including console proxy) It would be complex to use nova_pki_console_certificates to encrypt traffic between haproxy and console proxy because they don't have valid key_usage for that and changing key_usage would require to manually set `pki_regen_cert` for existing environments. Certs securing traffic between haproxy and console proxy are provided in execstarts because otherwise they would have to be defined in nova.conf that may be shared with nova-api(which stands behind uwsgi and should not use TLS). Depends-On: https://review.opendev.org/c/openstack/openstack-ansible/+/879085 Change-Id: Ibff3bf0b5eedc87c221bbb1b5976b12972fda608
2023年02月22日 22:16:33 +01:00
apply:
tags:
- nova-config
- pki
Enable TLS for VNC from novncproxy to compute hosts To secure communications from the proxy server to the compute nodes using VeNCrypt authentication scheme. In a previous patch a TLS server certificate was deployed to compute nodes, this patch makes use of this same server cert for securing VNC sessions on compute nodes. It is recommended that this certificate be issued by a dedicated certificate authority solely for the VNC service, as libvirt does not currently have a mechanism to restrict what certificates can be presented by the proxy server. This has not been implemented to reduce complexity. In addition the noVNC proxy needs to present a client certificate so only approved VNC proxy servers can connect to the Compute nodes. The PKI role has been used to create a client certificate for the nova console nodes. Related Nova docs: https://docs.openstack.org/nova/latest/admin/remote-console-access.html To help with the transition from from unencrypted VNC to VeNCrypt, initially compute nodes auth scheme allows for both encrypted and unencrypted sessions using the variable `nova_vencrypt_auth_scheme`, this will be removed in future releases. Change-Id: Iafb788f80fd401c6ce6e4576bafd06c92431bd65
2021年11月08日 15:40:27 +00:00
vars:
pki_setup_host:"{{ nova_pki_setup_host }}"
pki_dir:"{{ nova_pki_dir }}"
pki_create_certificates:"{{ nova_user_ssl_cert is not defined and nova_user_ssl_key is not defined }}"
pki_regen_cert:"{{ nova_pki_regen_cert }}"
Add TLS support to nova API backends By overriding the variable `nova_backend_ssl: True` HTTPS will be enabled, disabling HTTP support on the nova backend api. The ansible-role-pki is used to generate the required TLS certificates if this functionality is enabled. `nova_pki_console_certificates` are used to encrypt: - traffic between console proxy and compute hosts `nova_pki_certificates` are used to encrypt: - traffic between haproxy and its backends(including console proxy) It would be complex to use nova_pki_console_certificates to encrypt traffic between haproxy and console proxy because they don't have valid key_usage for that and changing key_usage would require to manually set `pki_regen_cert` for existing environments. Certs securing traffic between haproxy and console proxy are provided in execstarts because otherwise they would have to be defined in nova.conf that may be shared with nova-api(which stands behind uwsgi and should not use TLS). Depends-On: https://review.opendev.org/c/openstack/openstack-ansible/+/879085 Change-Id: Ibff3bf0b5eedc87c221bbb1b5976b12972fda608
2023年02月22日 22:16:33 +01:00
pki_certificates:"{{ nova_pki_certificates + nova_pki_console_certificates }}"
pki_install_certificates:"{{ nova_pki_install_certificates + nova_pki_console_install_certificates }}"
Enable TLS for VNC from novncproxy to compute hosts To secure communications from the proxy server to the compute nodes using VeNCrypt authentication scheme. In a previous patch a TLS server certificate was deployed to compute nodes, this patch makes use of this same server cert for securing VNC sessions on compute nodes. It is recommended that this certificate be issued by a dedicated certificate authority solely for the VNC service, as libvirt does not currently have a mechanism to restrict what certificates can be presented by the proxy server. This has not been implemented to reduce complexity. In addition the noVNC proxy needs to present a client certificate so only approved VNC proxy servers can connect to the Compute nodes. The PKI role has been used to create a client certificate for the nova console nodes. Related Nova docs: https://docs.openstack.org/nova/latest/admin/remote-console-access.html To help with the transition from from unencrypted VNC to VeNCrypt, initially compute nodes auth scheme allows for both encrypted and unencrypted sessions using the variable `nova_vencrypt_auth_scheme`, this will be removed in future releases. Change-Id: Iafb788f80fd401c6ce6e4576bafd06c92431bd65
2021年11月08日 15:40:27 +00:00
when:
- "'nova_console' in group_names"
Add TLS support to nova API backends By overriding the variable `nova_backend_ssl: True` HTTPS will be enabled, disabling HTTP support on the nova backend api. The ansible-role-pki is used to generate the required TLS certificates if this functionality is enabled. `nova_pki_console_certificates` are used to encrypt: - traffic between console proxy and compute hosts `nova_pki_certificates` are used to encrypt: - traffic between haproxy and its backends(including console proxy) It would be complex to use nova_pki_console_certificates to encrypt traffic between haproxy and console proxy because they don't have valid key_usage for that and changing key_usage would require to manually set `pki_regen_cert` for existing environments. Certs securing traffic between haproxy and console proxy are provided in execstarts because otherwise they would have to be defined in nova.conf that may be shared with nova-api(which stands behind uwsgi and should not use TLS). Depends-On: https://review.opendev.org/c/openstack/openstack-ansible/+/879085 Change-Id: Ibff3bf0b5eedc87c221bbb1b5976b12972fda608
2023年02月22日 22:16:33 +01:00
tags:
- always
Enable TLS for VNC from novncproxy to compute hosts To secure communications from the proxy server to the compute nodes using VeNCrypt authentication scheme. In a previous patch a TLS server certificate was deployed to compute nodes, this patch makes use of this same server cert for securing VNC sessions on compute nodes. It is recommended that this certificate be issued by a dedicated certificate authority solely for the VNC service, as libvirt does not currently have a mechanism to restrict what certificates can be presented by the proxy server. This has not been implemented to reduce complexity. In addition the noVNC proxy needs to present a client certificate so only approved VNC proxy servers can connect to the Compute nodes. The PKI role has been used to create a client certificate for the nova console nodes. Related Nova docs: https://docs.openstack.org/nova/latest/admin/remote-console-access.html To help with the transition from from unencrypted VNC to VeNCrypt, initially compute nodes auth scheme allows for both encrypted and unencrypted sessions using the variable `nova_vencrypt_auth_scheme`, this will be removed in future releases. Change-Id: Iafb788f80fd401c6ce6e4576bafd06c92431bd65
2021年11月08日 15:40:27 +00:00
- name:Including nova_post_install tasks
import_tasks:nova_post_install.yml
tags:
- nova-config
- name:Including osa.service_setup tasks
include_role:
name:openstack.osa.service_setup
apply:
tags:
- common-service
- nova-config
vars:
_service_adminuri_insecure:"{{ keystone_service_adminuri_insecure }}"
_service_in_ldap:"{{ nova_service_in_ldap }}"
_service_setup_host:"{{ nova_service_setup_host }}"
_service_setup_host_python_interpreter:"{{ nova_service_setup_host_python_interpreter }}"
_service_project_name:"{{ nova_service_project_name }}"
_service_region:"{{ nova_service_region }}"
_service_users:
- name:"{{ nova_service_user_name }}"
password:"{{ nova_service_password }}"
role:"{{ nova_service_role_names }}"
_service_endpoints:
- service:"{{ nova_service_name }}"
interface:"public"
url:"{{ nova_service_publicurl }}"
- service:"{{ nova_service_name }}"
interface:"internal"
url:"{{ nova_service_internalurl }}"
- service:"{{ nova_service_name }}"
interface:"admin"
url:"{{ nova_service_adminurl }}"
_service_catalog:
- name:"{{ nova_service_name }}"
type:"{{ nova_service_type }}"
description:"{{ nova_service_description }}"
when:
- _nova_is_first_play_host
tags:
- always
- name:Including nova_db_setup tasks
include_tasks:nova_db_setup.yml
args:
apply:
tags:
- nova-config
when:
- _nova_is_first_play_host
tags:
- always
Convert existing roles into galaxy roles This change implements the blueprint to convert all roles and plays into a more generic setup, following upstream ansible best practices. Items Changed: * All tasks have tags. * All roles use namespaced variables. * All redundant tasks within a given play and role have been removed. * All of the repetitive plays have been removed in-favor of a more simplistic approach. This change duplicates code within the roles but ensures that the roles only ever run within their own scope. * All roles have been built using an ansible galaxy syntax. * The `*requirement.txt` files have been reformatted follow upstream Openstack practices. * Dynamically generated inventory is now more organized, this should assist anyone who may want or need to dive into the JSON blob that is created. In the inventory a properties field is used for items that customize containers within the inventory. * The environment map has been modified to support additional host groups to enable the seperation of infrastructure pieces. While the old infra_hosts group will still work this change allows for groups to be divided up into seperate chunks; eg: deployment of a swift only stack. * The LXC logic now exists within the plays. * etc/openstack_deploy/user_variables.yml has all password/token variables extracted into the separate file etc/openstack_deploy/user_secrets.yml in order to allow seperate security settings on that file. Items Excised: * All of the roles have had the LXC logic removed from within them which should allow roles to be consumed outside of the `os-ansible-deployment` reference architecture. Note: * the directory rpc_deployment still exists and is presently pointed at plays containing a deprecation warning instructing the user to move to the standard playbooks directory. * While all of the rackspace specific components and variables have been removed and or were refactored the repository still relies on an upstream mirror of Openstack built python files and container images. This upstream mirror is hosted at rackspace at "http://rpc-repo.rackspace.com" though this is not locked to and or tied to rackspace specific installations. This repository contains all of the needed code to create and/or clone your own mirror. DocImpact Co-Authored-By: Jesse Pretorius <jesse.pretorius@rackspace.co.uk> Closes-Bug: #1403676 Implements: blueprint galaxy-roles Change-Id: I03df3328b7655f0cc9e43ba83b02623d038d214e
2015年02月14日 10:06:50 -06:00
- name:Import uwsgi role
import_role:
name:uwsgi
vars:
uwsgi_services:"{{ uwsgi_nova_services }}"
uwsgi_install_method:"{{ nova_install_method }}"
when:
- uwsgi_nova_services | length > 0
tags:
- nova-config
- uwsgi
- name:Run the systemd service role
import_role:
name:systemd_service
vars:
systemd_user_name:"{{ nova_system_user_name }}"
systemd_group_name:"{{ nova_system_group_name }}"
systemd_tempd_prefix:openstack
systemd_slice_name:"{{ nova_system_slice_name }}"
systemd_lock_dir:"{{ nova_lock_dir }}"
systemd_service_cpu_accounting:true
systemd_service_block_io_accounting:true
systemd_service_memory_accounting:true
systemd_service_tasks_accounting:true
systemd_services:|-
{% set services = [] %}
{% for service in filtered_nova_services %}
{%
set _ = service.update(
{
'enabled':'yes',
'state':'started',
'config_overrides':service.init_config_overrides
}
)
%}
{% set _ = service.pop('init_config_overrides') -%}
{% set _ = services.append(service) -%}
{% endfor %}
{{services }}
tags:
- nova-config
- systemd-service
Convert existing roles into galaxy roles This change implements the blueprint to convert all roles and plays into a more generic setup, following upstream ansible best practices. Items Changed: * All tasks have tags. * All roles use namespaced variables. * All redundant tasks within a given play and role have been removed. * All of the repetitive plays have been removed in-favor of a more simplistic approach. This change duplicates code within the roles but ensures that the roles only ever run within their own scope. * All roles have been built using an ansible galaxy syntax. * The `*requirement.txt` files have been reformatted follow upstream Openstack practices. * Dynamically generated inventory is now more organized, this should assist anyone who may want or need to dive into the JSON blob that is created. In the inventory a properties field is used for items that customize containers within the inventory. * The environment map has been modified to support additional host groups to enable the seperation of infrastructure pieces. While the old infra_hosts group will still work this change allows for groups to be divided up into seperate chunks; eg: deployment of a swift only stack. * The LXC logic now exists within the plays. * etc/openstack_deploy/user_variables.yml has all password/token variables extracted into the separate file etc/openstack_deploy/user_secrets.yml in order to allow seperate security settings on that file. Items Excised: * All of the roles have had the LXC logic removed from within them which should allow roles to be consumed outside of the `os-ansible-deployment` reference architecture. Note: * the directory rpc_deployment still exists and is presently pointed at plays containing a deprecation warning instructing the user to move to the standard playbooks directory. * While all of the rackspace specific components and variables have been removed and or were refactored the repository still relies on an upstream mirror of Openstack built python files and container images. This upstream mirror is hosted at rackspace at "http://rpc-repo.rackspace.com" though this is not locked to and or tied to rackspace specific installations. This repository contains all of the needed code to create and/or clone your own mirror. DocImpact Co-Authored-By: Jesse Pretorius <jesse.pretorius@rackspace.co.uk> Closes-Bug: #1403676 Implements: blueprint galaxy-roles Change-Id: I03df3328b7655f0cc9e43ba83b02623d038d214e
2015年02月14日 10:06:50 -06:00
- name:Including nova_compute tasks
include_tasks:nova_compute.yml
args:
apply:
tags:
- nova-compute
when:
- nova_virt_type != 'ironic'
- "nova_services['nova-compute']['group'] in group_names"
Convert existing roles into galaxy roles This change implements the blueprint to convert all roles and plays into a more generic setup, following upstream ansible best practices. Items Changed: * All tasks have tags. * All roles use namespaced variables. * All redundant tasks within a given play and role have been removed. * All of the repetitive plays have been removed in-favor of a more simplistic approach. This change duplicates code within the roles but ensures that the roles only ever run within their own scope. * All roles have been built using an ansible galaxy syntax. * The `*requirement.txt` files have been reformatted follow upstream Openstack practices. * Dynamically generated inventory is now more organized, this should assist anyone who may want or need to dive into the JSON blob that is created. In the inventory a properties field is used for items that customize containers within the inventory. * The environment map has been modified to support additional host groups to enable the seperation of infrastructure pieces. While the old infra_hosts group will still work this change allows for groups to be divided up into seperate chunks; eg: deployment of a swift only stack. * The LXC logic now exists within the plays. * etc/openstack_deploy/user_variables.yml has all password/token variables extracted into the separate file etc/openstack_deploy/user_secrets.yml in order to allow seperate security settings on that file. Items Excised: * All of the roles have had the LXC logic removed from within them which should allow roles to be consumed outside of the `os-ansible-deployment` reference architecture. Note: * the directory rpc_deployment still exists and is presently pointed at plays containing a deprecation warning instructing the user to move to the standard playbooks directory. * While all of the rackspace specific components and variables have been removed and or were refactored the repository still relies on an upstream mirror of Openstack built python files and container images. This upstream mirror is hosted at rackspace at "http://rpc-repo.rackspace.com" though this is not locked to and or tied to rackspace specific installations. This repository contains all of the needed code to create and/or clone your own mirror. DocImpact Co-Authored-By: Jesse Pretorius <jesse.pretorius@rackspace.co.uk> Closes-Bug: #1403676 Implements: blueprint galaxy-roles Change-Id: I03df3328b7655f0cc9e43ba83b02623d038d214e
2015年02月14日 10:06:50 -06:00
tags:
- always
Nova Kilofication Work * API Versions 1.1 and 3 have been deprecated from nova, plays have been modified to completely remove v1.1 and make v3 optional via nova_v3_deprecated_but_enabled boolean. * Addition of v2.1 api configuration. * Elimination of the unused nova_api_ec2 container. * nova_spice_console has been renamed to nova_console and nova_spice_console_container has been renamed to nova_console_container to facilitate different consoles in the future. * Spice has been made the default console. * A standalone task and init scripts for nova_spice. - Fixed some typos - Modified HAProxy role to remove nova_api_ec2 and rename nova_spice_console to nova_console - Updated user_secrets.yml - Unbroke things that I broke Partially Implements Blueprint: master-kilofication Change-Id: Ia87dfb1e8c0316103a30e2121f11996a9ca87c25
2015年04月06日 13:41:11 -05:00
- name:Include ceph_client role
include_role:
name:ceph_client
apply:
tags:
- ceph
vars:
openstack_service_system_user:"{{ nova_system_user_name }}"
openstack_service_venv_bin:"{{ (nova_install_method == 'source') | ternary(nova_bin, '') }}"
when:
- nova_virt_type != 'ironic'
- nova_services['nova-compute']['group'] in group_names
- (nova_rbd_inuse | bool) or (nova_glance_rbd_inuse | bool)
tags:
- always
- name:Flush handlers
meta:flush_handlers
Add nova-placement-api service and cell_v2 setup This patch adds Nova requirements for Ocata: * Nova Placement API running as uwsgi with Nginx. * cell_v2 setup for cell0 and cell1 * All required settings for these services with sane defaults It fixes up some ordering for DB operations: * online_db_migrations should only happen after a full upgrade. * Cell setup needs to happen after api_db sync but before db sync. * Discover_hosts for cell_v2 needs to happen after compute is restarted This adds functionality to allow uwsgi apps in the init scripts: * Allowing the "--log" line to be adjusted. * Setting the condition value so that only enabled services are deployed * Fixes a bug for program_override which mean this value was never being used. Depends-On: I082f37bb3ce61a900e06a58f21c7882f83671355 Change-Id: I282d25988377d18257b708859f89a7ae4260ac07
2017年01月09日 17:03:47 +00:00
- name:Importing nova_compute_wait tasks
import_tasks:nova_compute_wait.yml
Execute service setup against a delegated host using Ansible built-in modules In order to reduce the packages required to pip install on to the hosts, we allow the service setup to be delegated to a specific host, defaulting to the deploy host. We also switch as many tasks as possible to using the built-in Ansible modules which make use of the shade library. The 'virtualenv' package is now installed appropriately by the openstack_hosts role, so there's no need to install it any more. The 'httplib2' package is a legacy Ansible requirement for the get_url/get_uri module which is no longer needed. The keystone client library is not required any more now that we're using the upstream modules. As there are no required packages left, the task to install them is also removed. Unfortunately we need to use the openstack client to wait for a compute host to register, so we add it into the nova venv and implement a change in the way we do the wait so that openrc/clouds.yaml is only implemented on a single compute host and the wait task is executed there. Depends-On: https://review.openstack.org/582359 Change-Id: I702480a5188a583a03f66bb39609f7d25a996e4a
2018年07月12日 18:49:56 +01:00
when:
- "nova_services['nova-compute']['group'] in group_names"
- "nova_discover_hosts_in_cells_interval | int < 1"
vars:
compute_host_to_wait_for:"{{ ansible_facts['nodename'] }}"
Execute service setup against a delegated host using Ansible built-in modules In order to reduce the packages required to pip install on to the hosts, we allow the service setup to be delegated to a specific host, defaulting to the deploy host. We also switch as many tasks as possible to using the built-in Ansible modules which make use of the shade library. The 'virtualenv' package is now installed appropriately by the openstack_hosts role, so there's no need to install it any more. The 'httplib2' package is a legacy Ansible requirement for the get_url/get_uri module which is no longer needed. The keystone client library is not required any more now that we're using the upstream modules. As there are no required packages left, the task to install them is also removed. Unfortunately we need to use the openstack client to wait for a compute host to register, so we add it into the nova venv and implement a change in the way we do the wait so that openrc/clouds.yaml is only implemented on a single compute host and the wait task is executed there. Depends-On: https://review.openstack.org/582359 Change-Id: I702480a5188a583a03f66bb39609f7d25a996e4a
2018年07月12日 18:49:56 +01:00
tags:
- nova-config