Files
cf66cd365c5c4ab7276b8d9a2c11d149f1884eb3
openstack-ansible-os_nova /tasks /main.yml

304 lines
9.7 KiB
YAML
Raw Normal View History

Convert existing roles into galaxy roles This change implements the blueprint to convert all roles and plays into a more generic setup, following upstream ansible best practices. Items Changed: * All tasks have tags. * All roles use namespaced variables. * All redundant tasks within a given play and role have been removed. * All of the repetitive plays have been removed in-favor of a more simplistic approach. This change duplicates code within the roles but ensures that the roles only ever run within their own scope. * All roles have been built using an ansible galaxy syntax. * The `*requirement.txt` files have been reformatted follow upstream Openstack practices. * Dynamically generated inventory is now more organized, this should assist anyone who may want or need to dive into the JSON blob that is created. In the inventory a properties field is used for items that customize containers within the inventory. * The environment map has been modified to support additional host groups to enable the seperation of infrastructure pieces. While the old infra_hosts group will still work this change allows for groups to be divided up into seperate chunks; eg: deployment of a swift only stack. * The LXC logic now exists within the plays. * etc/openstack_deploy/user_variables.yml has all password/token variables extracted into the separate file etc/openstack_deploy/user_secrets.yml in order to allow seperate security settings on that file. Items Excised: * All of the roles have had the LXC logic removed from within them which should allow roles to be consumed outside of the `os-ansible-deployment` reference architecture. Note: * the directory rpc_deployment still exists and is presently pointed at plays containing a deprecation warning instructing the user to move to the standard playbooks directory. * While all of the rackspace specific components and variables have been removed and or were refactored the repository still relies on an upstream mirror of Openstack built python files and container images. This upstream mirror is hosted at rackspace at "http://rpc-repo.rackspace.com" though this is not locked to and or tied to rackspace specific installations. This repository contains all of the needed code to create and/or clone your own mirror. DocImpact Co-Authored-By: Jesse Pretorius <jesse.pretorius@rackspace.co.uk> Closes-Bug: #1403676 Implements: blueprint galaxy-roles Change-Id: I03df3328b7655f0cc9e43ba83b02623d038d214e
2015年02月14日 10:06:50 -06:00
---
# Copyright 2014, Rackspace US, Inc.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
- name:Gather variables for each operating system
include_vars:"{{ lookup('first_found', params) }}"
vars:
params:
files:
- "{{ ansible_facts['distribution'] | lower }}-{{ ansible_facts['distribution_version'] | lower }}.yml"
- "{{ ansible_facts['distribution'] | lower }}-{{ ansible_facts['distribution_major_version'] | lower }}.yml"
- "{{ ansible_facts['os_family'] | lower }}-{{ ansible_facts['distribution_major_version'] | lower }}.yml"
- "{{ ansible_facts['distribution'] | lower }}.yml"
- "{{ ansible_facts['os_family'] | lower }}-{{ ansible_facts['distribution_version'].split('.')[0] }}.yml"
- "{{ ansible_facts['os_family'] | lower }}.yml"
paths:
- "{{ role_path }}/vars"
tags:
- always
- name:Fail when virt type is unsupported
fail:
msg:"Unsupported Virt Type Provided {{ nova_supported_virt_types }}"
when:
- nova_virt_type is defined
- nova_virt_type not in nova_supported_virt_types
tags:
- always
- name:Fail if service was deployed using a different installation method
fail:
msg:"Switching installation methods for OpenStack services is not supported"
when:
- ansible_local is defined
- ansible_local.openstack_ansible is defined
- ansible_local.openstack_ansible.nova is defined
- ansible_local.openstack_ansible.nova.install_method is defined
- ansible_local.openstack_ansible.nova.install_method != nova_install_method
- name:Gather variables for installation method
include_vars:"{{ nova_install_method }}_install.yml"
tags:
- always
- include_role:
name:openstack.osa.db_setup
apply:
tags:
- common-db
- nova-config
when:
- _nova_is_first_play_host
vars:
_oslodb_setup_host:"{{ nova_db_setup_host }}"
_oslodb_ansible_python_interpreter:"{{ nova_db_setup_python_interpreter }}"
_oslodb_setup_endpoint:"{{ nova_galera_address }}"
_oslodb_setup_port:"{{ nova_galera_port }}"
_oslodb_databases:
- name:"{{ nova_galera_database }}"
users:
- username:"{{ nova_galera_user }}"
password:"{{ nova_container_mysql_password }}"
- name:"{{ nova_api_galera_database }}"
users:
- username:"{{ nova_api_galera_user }}"
password:"{{ nova_api_container_mysql_password }}"
- name:"{{ nova_cell0_database }}"
users:
- username:"{{ nova_api_galera_user }}"
password:"{{ nova_api_container_mysql_password }}"
tags:
- always
- include_role:
name:openstack.osa.mq_setup
apply:
tags:
- common-mq
- nova-config
when:
- _nova_is_first_play_host
vars:
_oslomsg_rpc_setup_host:"{{ nova_oslomsg_rpc_setup_host }}"
_oslomsg_rpc_userid:"{{ nova_oslomsg_rpc_userid }}"
_oslomsg_rpc_password:"{{ nova_oslomsg_rpc_password }}"
_oslomsg_rpc_vhost:"{{ nova_oslomsg_rpc_vhost }}"
_oslomsg_rpc_transport:"{{ nova_oslomsg_rpc_transport }}"
_oslomsg_notify_setup_host:"{{ nova_oslomsg_notify_setup_host }}"
_oslomsg_notify_userid:"{{ nova_oslomsg_notify_userid }}"
_oslomsg_notify_password:"{{ nova_oslomsg_notify_password }}"
_oslomsg_notify_vhost:"{{ nova_oslomsg_notify_vhost }}"
_oslomsg_notify_transport:"{{ nova_oslomsg_notify_transport }}"
tags:
- always
- import_tasks:nova_virt_detect.yml
when:
- nova_virt_type is not defined
tags:
- always
- nova-config
- import_tasks:nova_mdev_detect.yml
tags:
- always
- nova-config
- import_tasks:nova_pre_install.yml
tags:
- nova-install
- import_tasks:nova_install.yml
tags:
- nova-install
Implement data migrations for rolling upgrades In order to cater for artifact-based installed, and rolling upgrades, this patch implements a set of local facts to inform the online migrations task. The 'nova_all_software_updated' variable will be set by the playbook on each run to ensure that the online migrations only happen once all venvs are homogenous. This ensures that the playbook can be executed in a serialised fashion and the data will not be corrupted. The ``upgrade_levels`` setting for ``compute`` is set to ``auto`` to ensure that a mixed RPC version deployment can operate properly when doing a rolling upgrade as suggested by [1]. Additional changes are made to improve the role's ability to be executed using serialised playbooks. Finally, the nova-manage command references to the config file location have been removed as they refer to the default location. [1] https://docs.openstack.org/developer/nova/upgrade.html Change-Id: I08e5a7f0ce526b11aa52c35ee29c458954a5f22d
2017年06月30日 19:35:01 +01:00
- name:refresh local facts
setup:
filter:ansible_local
gather_subset:"!all"
tags:
- nova-config
Enable TLS for live migrations Instead of using SSH to live migrate VM's use TLS as this is more secure and SSH migrations are deprecated. https://docs.openstack.org/nova/xena/admin/secure-live-migration-with-qemu-native-tls.html A pre-existing PKI (Public Key Infrastruture) setup is required. TLS live migrations require that all compute hosts can communcate with each other on port 16514 and port range 49152 to 49261. To enable TLS live migrations, both libvirt and QEMU require server and client certificates, the server certicicates is used to verify servers and the client cert is used by servers to authenticate clients. A single cert is created by the pki role, that can be used by both libvirt and QEMU for both client and server auth. The client, server and CA certifcates need to installed in a number of locations on each compute host: * For Libvirt https://libvirt.org/tlscerts.html * For QEMU https://github.com/libvirt/libvirt/blob/master/src/qemu/qemu.conf Depends-On: https://review.opendev.org/c/openstack/ansible-role-pki/+/815007 Depends-On: https://review.opendev.org/c/openstack/ansible-role-pki/+/815849 Depends-On: https://review.opendev.org/c/openstack/ansible-role-pki/+/816857 Change-Id: Iddbe8764bb6d3cd3eaee122b2d5ddc02fa3f7662
2021年10月25日 08:32:04 +01:00
# Create certs after libvirt groups have been created but before handlers
Enable TLS for VNC from novncproxy to compute hosts To secure communications from the proxy server to the compute nodes using VeNCrypt authentication scheme. In a previous patch a TLS server certificate was deployed to compute nodes, this patch makes use of this same server cert for securing VNC sessions on compute nodes. It is recommended that this certificate be issued by a dedicated certificate authority solely for the VNC service, as libvirt does not currently have a mechanism to restrict what certificates can be presented by the proxy server. This has not been implemented to reduce complexity. In addition the noVNC proxy needs to present a client certificate so only approved VNC proxy servers can connect to the Compute nodes. The PKI role has been used to create a client certificate for the nova console nodes. Related Nova docs: https://docs.openstack.org/nova/latest/admin/remote-console-access.html To help with the transition from from unencrypted VNC to VeNCrypt, initially compute nodes auth scheme allows for both encrypted and unencrypted sessions using the variable `nova_vencrypt_auth_scheme`, this will be removed in future releases. Change-Id: Iafb788f80fd401c6ce6e4576bafd06c92431bd65
2021年11月08日 15:40:27 +00:00
- name:Create and install SSL certificates for compute hosts
Enable TLS for live migrations Instead of using SSH to live migrate VM's use TLS as this is more secure and SSH migrations are deprecated. https://docs.openstack.org/nova/xena/admin/secure-live-migration-with-qemu-native-tls.html A pre-existing PKI (Public Key Infrastruture) setup is required. TLS live migrations require that all compute hosts can communcate with each other on port 16514 and port range 49152 to 49261. To enable TLS live migrations, both libvirt and QEMU require server and client certificates, the server certicicates is used to verify servers and the client cert is used by servers to authenticate clients. A single cert is created by the pki role, that can be used by both libvirt and QEMU for both client and server auth. The client, server and CA certifcates need to installed in a number of locations on each compute host: * For Libvirt https://libvirt.org/tlscerts.html * For QEMU https://github.com/libvirt/libvirt/blob/master/src/qemu/qemu.conf Depends-On: https://review.opendev.org/c/openstack/ansible-role-pki/+/815007 Depends-On: https://review.opendev.org/c/openstack/ansible-role-pki/+/815849 Depends-On: https://review.opendev.org/c/openstack/ansible-role-pki/+/816857 Change-Id: Iddbe8764bb6d3cd3eaee122b2d5ddc02fa3f7662
2021年10月25日 08:32:04 +01:00
include_role:
name:pki
tasks_from:main_certs.yml
vars:
pki_setup_host:"{{ nova_pki_setup_host }}"
pki_dir:"{{ nova_pki_dir }}"
pki_create_certificates:"{{ nova_user_ssl_cert is not defined and nova_user_ssl_key is not defined }}"
pki_regen_cert:"{{ nova_pki_regen_cert }}"
Enable TLS for VNC from novncproxy to compute hosts To secure communications from the proxy server to the compute nodes using VeNCrypt authentication scheme. In a previous patch a TLS server certificate was deployed to compute nodes, this patch makes use of this same server cert for securing VNC sessions on compute nodes. It is recommended that this certificate be issued by a dedicated certificate authority solely for the VNC service, as libvirt does not currently have a mechanism to restrict what certificates can be presented by the proxy server. This has not been implemented to reduce complexity. In addition the noVNC proxy needs to present a client certificate so only approved VNC proxy servers can connect to the Compute nodes. The PKI role has been used to create a client certificate for the nova console nodes. Related Nova docs: https://docs.openstack.org/nova/latest/admin/remote-console-access.html To help with the transition from from unencrypted VNC to VeNCrypt, initially compute nodes auth scheme allows for both encrypted and unencrypted sessions using the variable `nova_vencrypt_auth_scheme`, this will be removed in future releases. Change-Id: Iafb788f80fd401c6ce6e4576bafd06c92431bd65
2021年11月08日 15:40:27 +00:00
pki_certificates:"{{ nova_pki_compute_certificates }}"
pki_install_certificates:"{{ nova_pki_compute_install_certificates }}"
Enable TLS for live migrations Instead of using SSH to live migrate VM's use TLS as this is more secure and SSH migrations are deprecated. https://docs.openstack.org/nova/xena/admin/secure-live-migration-with-qemu-native-tls.html A pre-existing PKI (Public Key Infrastruture) setup is required. TLS live migrations require that all compute hosts can communcate with each other on port 16514 and port range 49152 to 49261. To enable TLS live migrations, both libvirt and QEMU require server and client certificates, the server certicicates is used to verify servers and the client cert is used by servers to authenticate clients. A single cert is created by the pki role, that can be used by both libvirt and QEMU for both client and server auth. The client, server and CA certifcates need to installed in a number of locations on each compute host: * For Libvirt https://libvirt.org/tlscerts.html * For QEMU https://github.com/libvirt/libvirt/blob/master/src/qemu/qemu.conf Depends-On: https://review.opendev.org/c/openstack/ansible-role-pki/+/815007 Depends-On: https://review.opendev.org/c/openstack/ansible-role-pki/+/815849 Depends-On: https://review.opendev.org/c/openstack/ansible-role-pki/+/816857 Change-Id: Iddbe8764bb6d3cd3eaee122b2d5ddc02fa3f7662
2021年10月25日 08:32:04 +01:00
when:
- nova_libvirtd_listen_tls == 1
- "'nova_compute' in group_names"
- nova_virt_type != 'ironic'
Enable TLS for live migrations Instead of using SSH to live migrate VM's use TLS as this is more secure and SSH migrations are deprecated. https://docs.openstack.org/nova/xena/admin/secure-live-migration-with-qemu-native-tls.html A pre-existing PKI (Public Key Infrastruture) setup is required. TLS live migrations require that all compute hosts can communcate with each other on port 16514 and port range 49152 to 49261. To enable TLS live migrations, both libvirt and QEMU require server and client certificates, the server certicicates is used to verify servers and the client cert is used by servers to authenticate clients. A single cert is created by the pki role, that can be used by both libvirt and QEMU for both client and server auth. The client, server and CA certifcates need to installed in a number of locations on each compute host: * For Libvirt https://libvirt.org/tlscerts.html * For QEMU https://github.com/libvirt/libvirt/blob/master/src/qemu/qemu.conf Depends-On: https://review.opendev.org/c/openstack/ansible-role-pki/+/815007 Depends-On: https://review.opendev.org/c/openstack/ansible-role-pki/+/815849 Depends-On: https://review.opendev.org/c/openstack/ansible-role-pki/+/816857 Change-Id: Iddbe8764bb6d3cd3eaee122b2d5ddc02fa3f7662
2021年10月25日 08:32:04 +01:00
Enable TLS for VNC from novncproxy to compute hosts To secure communications from the proxy server to the compute nodes using VeNCrypt authentication scheme. In a previous patch a TLS server certificate was deployed to compute nodes, this patch makes use of this same server cert for securing VNC sessions on compute nodes. It is recommended that this certificate be issued by a dedicated certificate authority solely for the VNC service, as libvirt does not currently have a mechanism to restrict what certificates can be presented by the proxy server. This has not been implemented to reduce complexity. In addition the noVNC proxy needs to present a client certificate so only approved VNC proxy servers can connect to the Compute nodes. The PKI role has been used to create a client certificate for the nova console nodes. Related Nova docs: https://docs.openstack.org/nova/latest/admin/remote-console-access.html To help with the transition from from unencrypted VNC to VeNCrypt, initially compute nodes auth scheme allows for both encrypted and unencrypted sessions using the variable `nova_vencrypt_auth_scheme`, this will be removed in future releases. Change-Id: Iafb788f80fd401c6ce6e4576bafd06c92431bd65
2021年11月08日 15:40:27 +00:00
# Create certs after nova groups have been created but before handlers
- name:Create and install SSL certificates for console hosts
include_role:
name:pki
tasks_from:main_certs.yml
vars:
pki_setup_host:"{{ nova_pki_setup_host }}"
pki_dir:"{{ nova_pki_dir }}"
pki_create_certificates:"{{ nova_user_ssl_cert is not defined and nova_user_ssl_key is not defined }}"
pki_regen_cert:"{{ nova_pki_regen_cert }}"
Enable TLS for VNC from novncproxy to compute hosts To secure communications from the proxy server to the compute nodes using VeNCrypt authentication scheme. In a previous patch a TLS server certificate was deployed to compute nodes, this patch makes use of this same server cert for securing VNC sessions on compute nodes. It is recommended that this certificate be issued by a dedicated certificate authority solely for the VNC service, as libvirt does not currently have a mechanism to restrict what certificates can be presented by the proxy server. This has not been implemented to reduce complexity. In addition the noVNC proxy needs to present a client certificate so only approved VNC proxy servers can connect to the Compute nodes. The PKI role has been used to create a client certificate for the nova console nodes. Related Nova docs: https://docs.openstack.org/nova/latest/admin/remote-console-access.html To help with the transition from from unencrypted VNC to VeNCrypt, initially compute nodes auth scheme allows for both encrypted and unencrypted sessions using the variable `nova_vencrypt_auth_scheme`, this will be removed in future releases. Change-Id: Iafb788f80fd401c6ce6e4576bafd06c92431bd65
2021年11月08日 15:40:27 +00:00
pki_certificates:"{{ nova_pki_console_certificates }}"
pki_install_certificates:"{{ nova_pki_console_install_certificates }}"
when:
- nova_qemu_vnc_tls == 1
- nova_console_type == 'novnc'
- "'nova_console' in group_names"
- import_tasks:nova_post_install.yml
tags:
- nova-config
- include_role:
name:openstack.osa.service_setup
apply:
tags:
- common-service
- nova-config
vars:
_service_adminuri_insecure:"{{ keystone_service_adminuri_insecure }}"
_service_in_ldap:"{{ nova_service_in_ldap }}"
_service_setup_host:"{{ nova_service_setup_host }}"
_service_setup_host_python_interpreter:"{{ nova_service_setup_host_python_interpreter }}"
_service_project_name:"{{ nova_service_project_name }}"
_service_region:"{{ nova_service_region }}"
_service_users:
- name:"{{ nova_service_user_name }}"
password:"{{ nova_service_password }}"
role:"{{ nova_service_role_name }}"
_service_endpoints:
- service:"{{ nova_service_name }}"
interface:"public"
url:"{{ nova_service_publicurl }}"
- service:"{{ nova_service_name }}"
interface:"internal"
url:"{{ nova_service_internalurl }}"
- service:"{{ nova_service_name }}"
interface:"admin"
url:"{{ nova_service_adminurl }}"
_service_catalog:
- name:"{{ nova_service_name }}"
type:"{{ nova_service_type }}"
description:"{{ nova_service_description }}"
when:
- _nova_is_first_play_host
tags:
- always
- import_tasks:nova_db_setup.yml
when:
- _nova_is_first_play_host
tags:
- nova-config
Convert existing roles into galaxy roles This change implements the blueprint to convert all roles and plays into a more generic setup, following upstream ansible best practices. Items Changed: * All tasks have tags. * All roles use namespaced variables. * All redundant tasks within a given play and role have been removed. * All of the repetitive plays have been removed in-favor of a more simplistic approach. This change duplicates code within the roles but ensures that the roles only ever run within their own scope. * All roles have been built using an ansible galaxy syntax. * The `*requirement.txt` files have been reformatted follow upstream Openstack practices. * Dynamically generated inventory is now more organized, this should assist anyone who may want or need to dive into the JSON blob that is created. In the inventory a properties field is used for items that customize containers within the inventory. * The environment map has been modified to support additional host groups to enable the seperation of infrastructure pieces. While the old infra_hosts group will still work this change allows for groups to be divided up into seperate chunks; eg: deployment of a swift only stack. * The LXC logic now exists within the plays. * etc/openstack_deploy/user_variables.yml has all password/token variables extracted into the separate file etc/openstack_deploy/user_secrets.yml in order to allow seperate security settings on that file. Items Excised: * All of the roles have had the LXC logic removed from within them which should allow roles to be consumed outside of the `os-ansible-deployment` reference architecture. Note: * the directory rpc_deployment still exists and is presently pointed at plays containing a deprecation warning instructing the user to move to the standard playbooks directory. * While all of the rackspace specific components and variables have been removed and or were refactored the repository still relies on an upstream mirror of Openstack built python files and container images. This upstream mirror is hosted at rackspace at "http://rpc-repo.rackspace.com" though this is not locked to and or tied to rackspace specific installations. This repository contains all of the needed code to create and/or clone your own mirror. DocImpact Co-Authored-By: Jesse Pretorius <jesse.pretorius@rackspace.co.uk> Closes-Bug: #1403676 Implements: blueprint galaxy-roles Change-Id: I03df3328b7655f0cc9e43ba83b02623d038d214e
2015年02月14日 10:06:50 -06:00
- name:Import uwsgi role
import_role:
name:uwsgi
vars:
uwsgi_services:"{{ uwsgi_nova_services }}"
uwsgi_install_method:"{{ nova_install_method }}"
tags:
- nova-config
- uwsgi
- name:Run the systemd service role
import_role:
name:systemd_service
vars:
systemd_user_name:"{{ nova_system_user_name }}"
systemd_group_name:"{{ nova_system_group_name }}"
systemd_tempd_prefix:openstack
systemd_slice_name:"{{ nova_system_slice_name }}"
systemd_lock_dir:"{{ nova_lock_dir }}"
systemd_CPUAccounting:true
systemd_BlockIOAccounting:true
systemd_MemoryAccounting:true
systemd_TasksAccounting:true
systemd_services:|-
{% set services = [] %}
{% for service in filtered_nova_services %}
{%
set _ = service.update(
{
'enabled':'yes',
'state':'started',
'config_overrides':service.init_config_overrides
}
)
%}
{% set _ = service.pop('init_config_overrides') -%}
{% set _ = services.append(service) -%}
{% endfor %}
{{services }}
tags:
- nova-config
- systemd-service
Convert existing roles into galaxy roles This change implements the blueprint to convert all roles and plays into a more generic setup, following upstream ansible best practices. Items Changed: * All tasks have tags. * All roles use namespaced variables. * All redundant tasks within a given play and role have been removed. * All of the repetitive plays have been removed in-favor of a more simplistic approach. This change duplicates code within the roles but ensures that the roles only ever run within their own scope. * All roles have been built using an ansible galaxy syntax. * The `*requirement.txt` files have been reformatted follow upstream Openstack practices. * Dynamically generated inventory is now more organized, this should assist anyone who may want or need to dive into the JSON blob that is created. In the inventory a properties field is used for items that customize containers within the inventory. * The environment map has been modified to support additional host groups to enable the seperation of infrastructure pieces. While the old infra_hosts group will still work this change allows for groups to be divided up into seperate chunks; eg: deployment of a swift only stack. * The LXC logic now exists within the plays. * etc/openstack_deploy/user_variables.yml has all password/token variables extracted into the separate file etc/openstack_deploy/user_secrets.yml in order to allow seperate security settings on that file. Items Excised: * All of the roles have had the LXC logic removed from within them which should allow roles to be consumed outside of the `os-ansible-deployment` reference architecture. Note: * the directory rpc_deployment still exists and is presently pointed at plays containing a deprecation warning instructing the user to move to the standard playbooks directory. * While all of the rackspace specific components and variables have been removed and or were refactored the repository still relies on an upstream mirror of Openstack built python files and container images. This upstream mirror is hosted at rackspace at "http://rpc-repo.rackspace.com" though this is not locked to and or tied to rackspace specific installations. This repository contains all of the needed code to create and/or clone your own mirror. DocImpact Co-Authored-By: Jesse Pretorius <jesse.pretorius@rackspace.co.uk> Closes-Bug: #1403676 Implements: blueprint galaxy-roles Change-Id: I03df3328b7655f0cc9e43ba83b02623d038d214e
2015年02月14日 10:06:50 -06:00
- import_tasks:nova_compute.yml
when:
- nova_virt_type != 'ironic'
- "nova_services['nova-compute']['group'] in group_names"
Convert existing roles into galaxy roles This change implements the blueprint to convert all roles and plays into a more generic setup, following upstream ansible best practices. Items Changed: * All tasks have tags. * All roles use namespaced variables. * All redundant tasks within a given play and role have been removed. * All of the repetitive plays have been removed in-favor of a more simplistic approach. This change duplicates code within the roles but ensures that the roles only ever run within their own scope. * All roles have been built using an ansible galaxy syntax. * The `*requirement.txt` files have been reformatted follow upstream Openstack practices. * Dynamically generated inventory is now more organized, this should assist anyone who may want or need to dive into the JSON blob that is created. In the inventory a properties field is used for items that customize containers within the inventory. * The environment map has been modified to support additional host groups to enable the seperation of infrastructure pieces. While the old infra_hosts group will still work this change allows for groups to be divided up into seperate chunks; eg: deployment of a swift only stack. * The LXC logic now exists within the plays. * etc/openstack_deploy/user_variables.yml has all password/token variables extracted into the separate file etc/openstack_deploy/user_secrets.yml in order to allow seperate security settings on that file. Items Excised: * All of the roles have had the LXC logic removed from within them which should allow roles to be consumed outside of the `os-ansible-deployment` reference architecture. Note: * the directory rpc_deployment still exists and is presently pointed at plays containing a deprecation warning instructing the user to move to the standard playbooks directory. * While all of the rackspace specific components and variables have been removed and or were refactored the repository still relies on an upstream mirror of Openstack built python files and container images. This upstream mirror is hosted at rackspace at "http://rpc-repo.rackspace.com" though this is not locked to and or tied to rackspace specific installations. This repository contains all of the needed code to create and/or clone your own mirror. DocImpact Co-Authored-By: Jesse Pretorius <jesse.pretorius@rackspace.co.uk> Closes-Bug: #1403676 Implements: blueprint galaxy-roles Change-Id: I03df3328b7655f0cc9e43ba83b02623d038d214e
2015年02月14日 10:06:50 -06:00
tags:
Nova Kilofication Work * API Versions 1.1 and 3 have been deprecated from nova, plays have been modified to completely remove v1.1 and make v3 optional via nova_v3_deprecated_but_enabled boolean. * Addition of v2.1 api configuration. * Elimination of the unused nova_api_ec2 container. * nova_spice_console has been renamed to nova_console and nova_spice_console_container has been renamed to nova_console_container to facilitate different consoles in the future. * Spice has been made the default console. * A standalone task and init scripts for nova_spice. - Fixed some typos - Modified HAProxy role to remove nova_api_ec2 and rename nova_spice_console to nova_console - Updated user_secrets.yml - Unbroke things that I broke Partially Implements Blueprint: master-kilofication Change-Id: Ia87dfb1e8c0316103a30e2121f11996a9ca87c25
2015年04月06日 13:41:11 -05:00
- nova-compute
- name:Include ceph_client role
import_role:
name:ceph_client
vars:
openstack_service_system_user:"{{ nova_system_user_name }}"
openstack_service_venv_bin:"{{ (nova_install_method == 'source') | ternary(nova_bin, '') }}"
when:
- nova_virt_type != 'ironic'
- nova_services['nova-compute']['group'] in group_names
- (nova_rbd_inuse | bool) or (nova_glance_rbd_inuse | bool)
tags:
- ceph
- name:Flush handlers
meta:flush_handlers
Add nova-placement-api service and cell_v2 setup This patch adds Nova requirements for Ocata: * Nova Placement API running as uwsgi with Nginx. * cell_v2 setup for cell0 and cell1 * All required settings for these services with sane defaults It fixes up some ordering for DB operations: * online_db_migrations should only happen after a full upgrade. * Cell setup needs to happen after api_db sync but before db sync. * Discover_hosts for cell_v2 needs to happen after compute is restarted This adds functionality to allow uwsgi apps in the init scripts: * Allowing the "--log" line to be adjusted. * Setting the condition value so that only enabled services are deployed * Fixes a bug for program_override which mean this value was never being used. Depends-On: I082f37bb3ce61a900e06a58f21c7882f83671355 Change-Id: I282d25988377d18257b708859f89a7ae4260ac07
2017年01月09日 17:03:47 +00:00
Execute service setup against a delegated host using Ansible built-in modules In order to reduce the packages required to pip install on to the hosts, we allow the service setup to be delegated to a specific host, defaulting to the deploy host. We also switch as many tasks as possible to using the built-in Ansible modules which make use of the shade library. The 'virtualenv' package is now installed appropriately by the openstack_hosts role, so there's no need to install it any more. The 'httplib2' package is a legacy Ansible requirement for the get_url/get_uri module which is no longer needed. The keystone client library is not required any more now that we're using the upstream modules. As there are no required packages left, the task to install them is also removed. Unfortunately we need to use the openstack client to wait for a compute host to register, so we add it into the nova venv and implement a change in the way we do the wait so that openrc/clouds.yaml is only implemented on a single compute host and the wait task is executed there. Depends-On: https://review.openstack.org/582359 Change-Id: I702480a5188a583a03f66bb39609f7d25a996e4a
2018年07月12日 18:49:56 +01:00
# We delegate this back to the conductor because that is
# where we want to isolate the clouds.yaml configuration,
# rather than have it implemented on all compute nodes.
- import_tasks:nova_compute_wait.yml
delegate_to:"{{ nova_conductor_setup_host }}"
Execute service setup against a delegated host using Ansible built-in modules In order to reduce the packages required to pip install on to the hosts, we allow the service setup to be delegated to a specific host, defaulting to the deploy host. We also switch as many tasks as possible to using the built-in Ansible modules which make use of the shade library. The 'virtualenv' package is now installed appropriately by the openstack_hosts role, so there's no need to install it any more. The 'httplib2' package is a legacy Ansible requirement for the get_url/get_uri module which is no longer needed. The keystone client library is not required any more now that we're using the upstream modules. As there are no required packages left, the task to install them is also removed. Unfortunately we need to use the openstack client to wait for a compute host to register, so we add it into the nova venv and implement a change in the way we do the wait so that openrc/clouds.yaml is only implemented on a single compute host and the wait task is executed there. Depends-On: https://review.openstack.org/582359 Change-Id: I702480a5188a583a03f66bb39609f7d25a996e4a
2018年07月12日 18:49:56 +01:00
when:
- "nova_services['nova-compute']['group'] in group_names"
- "nova_discover_hosts_in_cells_interval | int < 1"
vars:
compute_host_to_wait_for:"{{ ansible_facts['nodename'] }}"
Execute service setup against a delegated host using Ansible built-in modules In order to reduce the packages required to pip install on to the hosts, we allow the service setup to be delegated to a specific host, defaulting to the deploy host. We also switch as many tasks as possible to using the built-in Ansible modules which make use of the shade library. The 'virtualenv' package is now installed appropriately by the openstack_hosts role, so there's no need to install it any more. The 'httplib2' package is a legacy Ansible requirement for the get_url/get_uri module which is no longer needed. The keystone client library is not required any more now that we're using the upstream modules. As there are no required packages left, the task to install them is also removed. Unfortunately we need to use the openstack client to wait for a compute host to register, so we add it into the nova venv and implement a change in the way we do the wait so that openrc/clouds.yaml is only implemented on a single compute host and the wait task is executed there. Depends-On: https://review.openstack.org/582359 Change-Id: I702480a5188a583a03f66bb39609f7d25a996e4a
2018年07月12日 18:49:56 +01:00
tags:
- nova-config
Implement data migrations for rolling upgrades In order to cater for artifact-based installed, and rolling upgrades, this patch implements a set of local facts to inform the online migrations task. The 'nova_all_software_updated' variable will be set by the playbook on each run to ensure that the online migrations only happen once all venvs are homogenous. This ensures that the playbook can be executed in a serialised fashion and the data will not be corrupted. The ``upgrade_levels`` setting for ``compute`` is set to ``auto`` to ensure that a mixed RPC version deployment can operate properly when doing a rolling upgrade as suggested by [1]. Additional changes are made to improve the role's ability to be executed using serialised playbooks. Finally, the nova-manage command references to the config file location have been removed as they refer to the default location. [1] https://docs.openstack.org/developer/nova/upgrade.html Change-Id: I08e5a7f0ce526b11aa52c35ee29c458954a5f22d
2017年06月30日 19:35:01 +01:00
# We have to delegate this back to the conductor
# because the compute hosts do not have access to
# the database connection string and therefore
# cannot run nova-manage.
Rearrange cell mapping tasks Existing instances can be mapped to a newly created cell immediately after the cell is created and by the same conductor host that created the cell. After a new compute host is built, it will need to mapped to a cell through the 'discover_hosts' command of nova-manage. This command will still need to be run against a host that has direct database access, but the command is able to handle mapping of all compute hosts that do not currently belong to the cell so it only needs to be run once per play. There can be a short delay in the time between a compute service starting and becoming available to be discovered and mapped but, for most deployments, compute host discovery will be handled automatically as a periodic task. Change-Id: I4f7328e1aff79eb94f278999b97fbad8f44c6a3e Closes-Bug: 1749037 Related-Bug: 1729661 Related-Bug: 1752540
2018年02月22日 08:55:06 -08:00
- import_tasks:nova_db_post_setup.yml
delegate_to:"{{ nova_conductor_setup_host }}"
Rearrange cell mapping tasks Existing instances can be mapped to a newly created cell immediately after the cell is created and by the same conductor host that created the cell. After a new compute host is built, it will need to mapped to a cell through the 'discover_hosts' command of nova-manage. This command will still need to be run against a host that has direct database access, but the command is able to handle mapping of all compute hosts that do not currently belong to the cell so it only needs to be run once per play. There can be a short delay in the time between a compute service starting and becoming available to be discovered and mapped but, for most deployments, compute host discovery will be handled automatically as a periodic task. Change-Id: I4f7328e1aff79eb94f278999b97fbad8f44c6a3e Closes-Bug: 1749037 Related-Bug: 1729661 Related-Bug: 1752540
2018年02月22日 08:55:06 -08:00
run_once:true
when:
- "nova_services['nova-compute']['group'] in group_names"
Add nova-placement-api service and cell_v2 setup This patch adds Nova requirements for Ocata: * Nova Placement API running as uwsgi with Nginx. * cell_v2 setup for cell0 and cell1 * All required settings for these services with sane defaults It fixes up some ordering for DB operations: * online_db_migrations should only happen after a full upgrade. * Cell setup needs to happen after api_db sync but before db sync. * Discover_hosts for cell_v2 needs to happen after compute is restarted This adds functionality to allow uwsgi apps in the init scripts: * Allowing the "--log" line to be adjusted. * Setting the condition value so that only enabled services are deployed * Fixes a bug for program_override which mean this value was never being used. Depends-On: I082f37bb3ce61a900e06a58f21c7882f83671355 Change-Id: I282d25988377d18257b708859f89a7ae4260ac07
2017年01月09日 17:03:47 +00:00
tags:
- nova-config