Files
d0877c6fd315e5fb99a3515e527f46186305e86a
openstack-ansible-os_nova /templates /nova.conf.j2

343 lines
13 KiB
Plaintext
Raw Normal View History

Convert existing roles into galaxy roles This change implements the blueprint to convert all roles and plays into a more generic setup, following upstream ansible best practices. Items Changed: * All tasks have tags. * All roles use namespaced variables. * All redundant tasks within a given play and role have been removed. * All of the repetitive plays have been removed in-favor of a more simplistic approach. This change duplicates code within the roles but ensures that the roles only ever run within their own scope. * All roles have been built using an ansible galaxy syntax. * The `*requirement.txt` files have been reformatted follow upstream Openstack practices. * Dynamically generated inventory is now more organized, this should assist anyone who may want or need to dive into the JSON blob that is created. In the inventory a properties field is used for items that customize containers within the inventory. * The environment map has been modified to support additional host groups to enable the seperation of infrastructure pieces. While the old infra_hosts group will still work this change allows for groups to be divided up into seperate chunks; eg: deployment of a swift only stack. * The LXC logic now exists within the plays. * etc/openstack_deploy/user_variables.yml has all password/token variables extracted into the separate file etc/openstack_deploy/user_secrets.yml in order to allow seperate security settings on that file. Items Excised: * All of the roles have had the LXC logic removed from within them which should allow roles to be consumed outside of the `os-ansible-deployment` reference architecture. Note: * the directory rpc_deployment still exists and is presently pointed at plays containing a deprecation warning instructing the user to move to the standard playbooks directory. * While all of the rackspace specific components and variables have been removed and or were refactored the repository still relies on an upstream mirror of Openstack built python files and container images. This upstream mirror is hosted at rackspace at "http://rpc-repo.rackspace.com" though this is not locked to and or tied to rackspace specific installations. This repository contains all of the needed code to create and/or clone your own mirror. DocImpact Co-Authored-By: Jesse Pretorius <jesse.pretorius@rackspace.co.uk> Closes-Bug: #1403676 Implements: blueprint galaxy-roles Change-Id: I03df3328b7655f0cc9e43ba83b02623d038d214e
2015年02月14日 10:06:50 -06:00
# {{ ansible_managed }}
[DEFAULT]
# Logs / State
debug = {{ debug }}
use_journal = True
Convert existing roles into galaxy roles This change implements the blueprint to convert all roles and plays into a more generic setup, following upstream ansible best practices. Items Changed: * All tasks have tags. * All roles use namespaced variables. * All redundant tasks within a given play and role have been removed. * All of the repetitive plays have been removed in-favor of a more simplistic approach. This change duplicates code within the roles but ensures that the roles only ever run within their own scope. * All roles have been built using an ansible galaxy syntax. * The `*requirement.txt` files have been reformatted follow upstream Openstack practices. * Dynamically generated inventory is now more organized, this should assist anyone who may want or need to dive into the JSON blob that is created. In the inventory a properties field is used for items that customize containers within the inventory. * The environment map has been modified to support additional host groups to enable the seperation of infrastructure pieces. While the old infra_hosts group will still work this change allows for groups to be divided up into seperate chunks; eg: deployment of a swift only stack. * The LXC logic now exists within the plays. * etc/openstack_deploy/user_variables.yml has all password/token variables extracted into the separate file etc/openstack_deploy/user_secrets.yml in order to allow seperate security settings on that file. Items Excised: * All of the roles have had the LXC logic removed from within them which should allow roles to be consumed outside of the `os-ansible-deployment` reference architecture. Note: * the directory rpc_deployment still exists and is presently pointed at plays containing a deprecation warning instructing the user to move to the standard playbooks directory. * While all of the rackspace specific components and variables have been removed and or were refactored the repository still relies on an upstream mirror of Openstack built python files and container images. This upstream mirror is hosted at rackspace at "http://rpc-repo.rackspace.com" though this is not locked to and or tied to rackspace specific installations. This repository contains all of the needed code to create and/or clone your own mirror. DocImpact Co-Authored-By: Jesse Pretorius <jesse.pretorius@rackspace.co.uk> Closes-Bug: #1403676 Implements: blueprint galaxy-roles Change-Id: I03df3328b7655f0cc9e43ba83b02623d038d214e
2015年02月14日 10:06:50 -06:00
state_path = {{ nova_system_home_folder }}
service_down_time = 120
# Scheduler
cpu_allocation_ratio = {{ nova_cpu_allocation_ratio }}
disk_allocation_ratio = {{ nova_disk_allocation_ratio }}
ram_allocation_ratio = {{ nova_ram_allocation_ratio }}
reserved_host_disk_mb = {{ nova_reserved_host_disk_mb }}
reserved_host_memory_mb = {{ nova_reserved_host_memory_mb }}
# Compute
compute_driver = {{ nova_compute_driver }}
instances_path = {{ nova_system_home_folder }}/instances
allow_resize_to_same_host = True
{% if nova_console_user_ssl_cert is defined and nova_console_user_ssl_key is defined and ( nova_services['nova-novncproxy']['group'] in group_names or nova_services['nova-spicehtml5proxy']['group'] in group_names or nova_services['nova-serialconsole-proxy']['group'] in group_names ) %}
# Console SSL keys
ssl_only = true
cert = {{ nova_console_ssl_cert }}
key = {{ nova_console_ssl_key }}
{% endif %}
Convert existing roles into galaxy roles This change implements the blueprint to convert all roles and plays into a more generic setup, following upstream ansible best practices. Items Changed: * All tasks have tags. * All roles use namespaced variables. * All redundant tasks within a given play and role have been removed. * All of the repetitive plays have been removed in-favor of a more simplistic approach. This change duplicates code within the roles but ensures that the roles only ever run within their own scope. * All roles have been built using an ansible galaxy syntax. * The `*requirement.txt` files have been reformatted follow upstream Openstack practices. * Dynamically generated inventory is now more organized, this should assist anyone who may want or need to dive into the JSON blob that is created. In the inventory a properties field is used for items that customize containers within the inventory. * The environment map has been modified to support additional host groups to enable the seperation of infrastructure pieces. While the old infra_hosts group will still work this change allows for groups to be divided up into seperate chunks; eg: deployment of a swift only stack. * The LXC logic now exists within the plays. * etc/openstack_deploy/user_variables.yml has all password/token variables extracted into the separate file etc/openstack_deploy/user_secrets.yml in order to allow seperate security settings on that file. Items Excised: * All of the roles have had the LXC logic removed from within them which should allow roles to be consumed outside of the `os-ansible-deployment` reference architecture. Note: * the directory rpc_deployment still exists and is presently pointed at plays containing a deprecation warning instructing the user to move to the standard playbooks directory. * While all of the rackspace specific components and variables have been removed and or were refactored the repository still relies on an upstream mirror of Openstack built python files and container images. This upstream mirror is hosted at rackspace at "http://rpc-repo.rackspace.com" though this is not locked to and or tied to rackspace specific installations. This repository contains all of the needed code to create and/or clone your own mirror. DocImpact Co-Authored-By: Jesse Pretorius <jesse.pretorius@rackspace.co.uk> Closes-Bug: #1403676 Implements: blueprint galaxy-roles Change-Id: I03df3328b7655f0cc9e43ba83b02623d038d214e
2015年02月14日 10:06:50 -06:00
# Api's
Updated repository for minimum viable kilo install * Updated Keystone wsgi and paste files from upstream. * Updated all clients in the openstack_client.yml file. * Kilo services are tracking the head of master. * Removed pinned middleware because they're pinned else where. * Added additional service references for neutron vpnaas, fwaas, and lbaas which have now been moved into their own repos and no longer exist within the core neutron repository. * The neutron vpnaas, fwaas, and lbaas have been removed from the basic plugins being loaded and a comment has been added to describe how one might add them back in. * Updated rootwrap filters for neutron dhcp and l3. * Updated heat policy.json * Added the `python-libguestfs` to the nova-compute installation packages. * Updates all services to point to the latest kilo tag Services updated due to deprecated configs: * Keystone * Glance * Nova * Neutron (is still using the deprecated nova auth plugin) * Heat * Tempest Items for future work post initial release: * roles/os_neutron/files/post-up-checksum-rules:25: TODO(cloudnull) remove this script once the bug is fixed. * roles/rabbitmq_server/tasks/rabbitmq_cluster_join.yml:17: TODO(someone): implement a more robust way of checking Implements: blueprint minimal-kilo Closes-Bug: 1428421 Closes-Bug: 1428431 Closes-Bug: 1428437 Closes-Bug: 1428445 Closes-Bug: 1428451 Closes-Bug: 1428469 Closes-Bug: 1428639 Change-Id: I28a305d9e40a9cf70148ef7d7b00d467a65ca076
2015年03月22日 09:09:53 -05:00
enabled_apis = {{ nova_enabled_apis }}
Convert existing roles into galaxy roles This change implements the blueprint to convert all roles and plays into a more generic setup, following upstream ansible best practices. Items Changed: * All tasks have tags. * All roles use namespaced variables. * All redundant tasks within a given play and role have been removed. * All of the repetitive plays have been removed in-favor of a more simplistic approach. This change duplicates code within the roles but ensures that the roles only ever run within their own scope. * All roles have been built using an ansible galaxy syntax. * The `*requirement.txt` files have been reformatted follow upstream Openstack practices. * Dynamically generated inventory is now more organized, this should assist anyone who may want or need to dive into the JSON blob that is created. In the inventory a properties field is used for items that customize containers within the inventory. * The environment map has been modified to support additional host groups to enable the seperation of infrastructure pieces. While the old infra_hosts group will still work this change allows for groups to be divided up into seperate chunks; eg: deployment of a swift only stack. * The LXC logic now exists within the plays. * etc/openstack_deploy/user_variables.yml has all password/token variables extracted into the separate file etc/openstack_deploy/user_secrets.yml in order to allow seperate security settings on that file. Items Excised: * All of the roles have had the LXC logic removed from within them which should allow roles to be consumed outside of the `os-ansible-deployment` reference architecture. Note: * the directory rpc_deployment still exists and is presently pointed at plays containing a deprecation warning instructing the user to move to the standard playbooks directory. * While all of the rackspace specific components and variables have been removed and or were refactored the repository still relies on an upstream mirror of Openstack built python files and container images. This upstream mirror is hosted at rackspace at "http://rpc-repo.rackspace.com" though this is not locked to and or tied to rackspace specific installations. This repository contains all of the needed code to create and/or clone your own mirror. DocImpact Co-Authored-By: Jesse Pretorius <jesse.pretorius@rackspace.co.uk> Closes-Bug: #1403676 Implements: blueprint galaxy-roles Change-Id: I03df3328b7655f0cc9e43ba83b02623d038d214e
2015年02月14日 10:06:50 -06:00
# Rpc all
transport_url = {{ nova_oslomsg_rpc_transport }}://{% for host in nova_oslomsg_rpc_servers.split(',') %}{{ nova_oslomsg_rpc_userid }}:{{ nova_oslomsg_rpc_password }}@{{ host }}:{{ nova_oslomsg_rpc_port }}{% if not loop.last %},{% else %}/{{ nova_oslomsg_rpc_vhost }}{% if nova_oslomsg_rpc_use_ssl | bool %}?ssl=1&ssl_version={{ nova_oslomsg_rpc_ssl_version }}&ssl_ca_file={{ nova_oslomsg_rpc_ssl_ca_file }}{% else %}?ssl=0{% endif %}{% endif %}{% endfor %}
Convert existing roles into galaxy roles This change implements the blueprint to convert all roles and plays into a more generic setup, following upstream ansible best practices. Items Changed: * All tasks have tags. * All roles use namespaced variables. * All redundant tasks within a given play and role have been removed. * All of the repetitive plays have been removed in-favor of a more simplistic approach. This change duplicates code within the roles but ensures that the roles only ever run within their own scope. * All roles have been built using an ansible galaxy syntax. * The `*requirement.txt` files have been reformatted follow upstream Openstack practices. * Dynamically generated inventory is now more organized, this should assist anyone who may want or need to dive into the JSON blob that is created. In the inventory a properties field is used for items that customize containers within the inventory. * The environment map has been modified to support additional host groups to enable the seperation of infrastructure pieces. While the old infra_hosts group will still work this change allows for groups to be divided up into seperate chunks; eg: deployment of a swift only stack. * The LXC logic now exists within the plays. * etc/openstack_deploy/user_variables.yml has all password/token variables extracted into the separate file etc/openstack_deploy/user_secrets.yml in order to allow seperate security settings on that file. Items Excised: * All of the roles have had the LXC logic removed from within them which should allow roles to be consumed outside of the `os-ansible-deployment` reference architecture. Note: * the directory rpc_deployment still exists and is presently pointed at plays containing a deprecation warning instructing the user to move to the standard playbooks directory. * While all of the rackspace specific components and variables have been removed and or were refactored the repository still relies on an upstream mirror of Openstack built python files and container images. This upstream mirror is hosted at rackspace at "http://rpc-repo.rackspace.com" though this is not locked to and or tied to rackspace specific installations. This repository contains all of the needed code to create and/or clone your own mirror. DocImpact Co-Authored-By: Jesse Pretorius <jesse.pretorius@rackspace.co.uk> Closes-Bug: #1403676 Implements: blueprint galaxy-roles Change-Id: I03df3328b7655f0cc9e43ba83b02623d038d214e
2015年02月14日 10:06:50 -06:00
# Network
my_ip = {% if nova_management_address == 'localhost' %}127.0.0.1{% else %}{{ nova_management_address }}{% endif %}
Convert existing roles into galaxy roles This change implements the blueprint to convert all roles and plays into a more generic setup, following upstream ansible best practices. Items Changed: * All tasks have tags. * All roles use namespaced variables. * All redundant tasks within a given play and role have been removed. * All of the repetitive plays have been removed in-favor of a more simplistic approach. This change duplicates code within the roles but ensures that the roles only ever run within their own scope. * All roles have been built using an ansible galaxy syntax. * The `*requirement.txt` files have been reformatted follow upstream Openstack practices. * Dynamically generated inventory is now more organized, this should assist anyone who may want or need to dive into the JSON blob that is created. In the inventory a properties field is used for items that customize containers within the inventory. * The environment map has been modified to support additional host groups to enable the seperation of infrastructure pieces. While the old infra_hosts group will still work this change allows for groups to be divided up into seperate chunks; eg: deployment of a swift only stack. * The LXC logic now exists within the plays. * etc/openstack_deploy/user_variables.yml has all password/token variables extracted into the separate file etc/openstack_deploy/user_secrets.yml in order to allow seperate security settings on that file. Items Excised: * All of the roles have had the LXC logic removed from within them which should allow roles to be consumed outside of the `os-ansible-deployment` reference architecture. Note: * the directory rpc_deployment still exists and is presently pointed at plays containing a deprecation warning instructing the user to move to the standard playbooks directory. * While all of the rackspace specific components and variables have been removed and or were refactored the repository still relies on an upstream mirror of Openstack built python files and container images. This upstream mirror is hosted at rackspace at "http://rpc-repo.rackspace.com" though this is not locked to and or tied to rackspace specific installations. This repository contains all of the needed code to create and/or clone your own mirror. DocImpact Co-Authored-By: Jesse Pretorius <jesse.pretorius@rackspace.co.uk> Closes-Bug: #1403676 Implements: blueprint galaxy-roles Change-Id: I03df3328b7655f0cc9e43ba83b02623d038d214e
2015年02月14日 10:06:50 -06:00
# Hypervisor
default_ephemeral_format = ext4
# Ceilometer notification configurations
{% if nova_ceilometer_enabled %}
instance_usage_audit = True
instance_usage_audit_period = hour
{% endif %}
# Notifications
[oslo_messaging_notifications]
{% set notification_topics = [] %}
{% if nova_ceilometer_enabled %}
{% set _ = notification_topics.append('notifications') %}
{% endif %}
{% if nova_designate_enabled %}
{% set _ = notification_topics.append(nova_notifications_designate) %}
{% endif %}
topics = {{ notification_topics | join(',') }}
driver = {{ (notification_topics | length > 0) | ternary('messagingv2', 'noop') }}
transport_url = {{ nova_oslomsg_notify_transport }}://{% for host in nova_oslomsg_notify_servers.split(',') %}{{ nova_oslomsg_notify_userid }}:{{ nova_oslomsg_notify_password }}@{{ host }}:{{ nova_oslomsg_notify_port }}{% if not loop.last %},{% else %}/{{ nova_oslomsg_notify_vhost }}{% if nova_oslomsg_notify_use_ssl | bool %}?ssl=1&ssl_version={{ nova_oslomsg_notify_ssl_version }}&ssl_ca_file={{ nova_oslomsg_notify_ssl_ca_file }}{% else %}?ssl=0{% endif %}{% endif %}{% endfor %}
# Messaging
[oslo_messaging_rabbit]
heartbeat_in_pthread = {{ nova_oslomsg_heartbeat_in_pthread }}
# Image cache
[image_cache]
manager_interval = {{ nova_image_cache_manager_interval }}
# Cache
[cache]
enabled = true
backend = {{ nova_cache_backend }}
{% if nova_cache_backend in nova_cache_backend_map['dogpile'] %}
memcache_servers = {{ nova_cache_servers }}
{% endif %}
Convert existing roles into galaxy roles This change implements the blueprint to convert all roles and plays into a more generic setup, following upstream ansible best practices. Items Changed: * All tasks have tags. * All roles use namespaced variables. * All redundant tasks within a given play and role have been removed. * All of the repetitive plays have been removed in-favor of a more simplistic approach. This change duplicates code within the roles but ensures that the roles only ever run within their own scope. * All roles have been built using an ansible galaxy syntax. * The `*requirement.txt` files have been reformatted follow upstream Openstack practices. * Dynamically generated inventory is now more organized, this should assist anyone who may want or need to dive into the JSON blob that is created. In the inventory a properties field is used for items that customize containers within the inventory. * The environment map has been modified to support additional host groups to enable the seperation of infrastructure pieces. While the old infra_hosts group will still work this change allows for groups to be divided up into seperate chunks; eg: deployment of a swift only stack. * The LXC logic now exists within the plays. * etc/openstack_deploy/user_variables.yml has all password/token variables extracted into the separate file etc/openstack_deploy/user_secrets.yml in order to allow seperate security settings on that file. Items Excised: * All of the roles have had the LXC logic removed from within them which should allow roles to be consumed outside of the `os-ansible-deployment` reference architecture. Note: * the directory rpc_deployment still exists and is presently pointed at plays containing a deprecation warning instructing the user to move to the standard playbooks directory. * While all of the rackspace specific components and variables have been removed and or were refactored the repository still relies on an upstream mirror of Openstack built python files and container images. This upstream mirror is hosted at rackspace at "http://rpc-repo.rackspace.com" though this is not locked to and or tied to rackspace specific installations. This repository contains all of the needed code to create and/or clone your own mirror. DocImpact Co-Authored-By: Jesse Pretorius <jesse.pretorius@rackspace.co.uk> Closes-Bug: #1403676 Implements: blueprint galaxy-roles Change-Id: I03df3328b7655f0cc9e43ba83b02623d038d214e
2015年02月14日 10:06:50 -06:00
# Cinder
[cinder]
catalog_info = volumev3:cinderv3:internalURL
os_region_name = {{ nova_service_region }}
auth_section = keystone_authtoken
Convert existing roles into galaxy roles This change implements the blueprint to convert all roles and plays into a more generic setup, following upstream ansible best practices. Items Changed: * All tasks have tags. * All roles use namespaced variables. * All redundant tasks within a given play and role have been removed. * All of the repetitive plays have been removed in-favor of a more simplistic approach. This change duplicates code within the roles but ensures that the roles only ever run within their own scope. * All roles have been built using an ansible galaxy syntax. * The `*requirement.txt` files have been reformatted follow upstream Openstack practices. * Dynamically generated inventory is now more organized, this should assist anyone who may want or need to dive into the JSON blob that is created. In the inventory a properties field is used for items that customize containers within the inventory. * The environment map has been modified to support additional host groups to enable the seperation of infrastructure pieces. While the old infra_hosts group will still work this change allows for groups to be divided up into seperate chunks; eg: deployment of a swift only stack. * The LXC logic now exists within the plays. * etc/openstack_deploy/user_variables.yml has all password/token variables extracted into the separate file etc/openstack_deploy/user_secrets.yml in order to allow seperate security settings on that file. Items Excised: * All of the roles have had the LXC logic removed from within them which should allow roles to be consumed outside of the `os-ansible-deployment` reference architecture. Note: * the directory rpc_deployment still exists and is presently pointed at plays containing a deprecation warning instructing the user to move to the standard playbooks directory. * While all of the rackspace specific components and variables have been removed and or were refactored the repository still relies on an upstream mirror of Openstack built python files and container images. This upstream mirror is hosted at rackspace at "http://rpc-repo.rackspace.com" though this is not locked to and or tied to rackspace specific installations. This repository contains all of the needed code to create and/or clone your own mirror. DocImpact Co-Authored-By: Jesse Pretorius <jesse.pretorius@rackspace.co.uk> Closes-Bug: #1403676 Implements: blueprint galaxy-roles Change-Id: I03df3328b7655f0cc9e43ba83b02623d038d214e
2015年02月14日 10:06:50 -06:00
[spice]
agent_enabled = {{ nova_spice_console_agent_enabled }}
enabled = {{ (nova_console_type == 'spice') | ternary(True, False) }}
{% if 'spice' in nova_console_proxy_types %}
Convert existing roles into galaxy roles This change implements the blueprint to convert all roles and plays into a more generic setup, following upstream ansible best practices. Items Changed: * All tasks have tags. * All roles use namespaced variables. * All redundant tasks within a given play and role have been removed. * All of the repetitive plays have been removed in-favor of a more simplistic approach. This change duplicates code within the roles but ensures that the roles only ever run within their own scope. * All roles have been built using an ansible galaxy syntax. * The `*requirement.txt` files have been reformatted follow upstream Openstack practices. * Dynamically generated inventory is now more organized, this should assist anyone who may want or need to dive into the JSON blob that is created. In the inventory a properties field is used for items that customize containers within the inventory. * The environment map has been modified to support additional host groups to enable the seperation of infrastructure pieces. While the old infra_hosts group will still work this change allows for groups to be divided up into seperate chunks; eg: deployment of a swift only stack. * The LXC logic now exists within the plays. * etc/openstack_deploy/user_variables.yml has all password/token variables extracted into the separate file etc/openstack_deploy/user_secrets.yml in order to allow seperate security settings on that file. Items Excised: * All of the roles have had the LXC logic removed from within them which should allow roles to be consumed outside of the `os-ansible-deployment` reference architecture. Note: * the directory rpc_deployment still exists and is presently pointed at plays containing a deprecation warning instructing the user to move to the standard playbooks directory. * While all of the rackspace specific components and variables have been removed and or were refactored the repository still relies on an upstream mirror of Openstack built python files and container images. This upstream mirror is hosted at rackspace at "http://rpc-repo.rackspace.com" though this is not locked to and or tied to rackspace specific installations. This repository contains all of the needed code to create and/or clone your own mirror. DocImpact Co-Authored-By: Jesse Pretorius <jesse.pretorius@rackspace.co.uk> Closes-Bug: #1403676 Implements: blueprint galaxy-roles Change-Id: I03df3328b7655f0cc9e43ba83b02623d038d214e
2015年02月14日 10:06:50 -06:00
html5proxy_base_url = {{ nova_spice_html5proxy_base_url }}
html5proxy_host = {% if nova_management_address == 'localhost' %}127.0.0.1{% else %}{{ nova_management_address }}{% endif %}
server_listen = {% if nova_management_address == 'localhost' %}127.0.0.1{% else %}{{ nova_management_address }}{% endif %}
server_proxyclient_address = {% if nova_management_address == 'localhost' %}127.0.0.1{% else %}{{ nova_management_address }}{% endif %}
{% endif %}
[vnc]
enabled = {{ (nova_console_type == 'novnc') | ternary(True, False) }}
{% if 'novnc' in nova_console_proxy_types %}
novncproxy_base_url = {{ nova_novncproxy_base_url }}
novncproxy_host = {{ nova_novncproxy_host }}
novncproxy_port = {{ nova_novncproxy_port }}
server_listen = {{ nova_novncproxy_vncserver_listen }}
server_proxyclient_address = {{ nova_novncproxy_vncserver_proxyclient_address }}
Enable TLS for VNC from novncproxy to compute hosts To secure communications from the proxy server to the compute nodes using VeNCrypt authentication scheme. In a previous patch a TLS server certificate was deployed to compute nodes, this patch makes use of this same server cert for securing VNC sessions on compute nodes. It is recommended that this certificate be issued by a dedicated certificate authority solely for the VNC service, as libvirt does not currently have a mechanism to restrict what certificates can be presented by the proxy server. This has not been implemented to reduce complexity. In addition the noVNC proxy needs to present a client certificate so only approved VNC proxy servers can connect to the Compute nodes. The PKI role has been used to create a client certificate for the nova console nodes. Related Nova docs: https://docs.openstack.org/nova/latest/admin/remote-console-access.html To help with the transition from from unencrypted VNC to VeNCrypt, initially compute nodes auth scheme allows for both encrypted and unencrypted sessions using the variable `nova_vencrypt_auth_scheme`, this will be removed in future releases. Change-Id: Iafb788f80fd401c6ce6e4576bafd06c92431bd65
2021年11月08日 15:40:27 +00:00
{% if nova_qemu_vnc_tls == 1 %}
auth_schemes={{ nova_vencrypt_auth_scheme }}
vencrypt_client_key={{ nova_vencrypt_client_key }}
vencrypt_client_cert={{ nova_vencrypt_client_cert }}
vencrypt_ca_certs={{ nova_vencrypt_ca_certs }}
{% endif %}
{% endif %}
Enable TLS for VNC from novncproxy to compute hosts To secure communications from the proxy server to the compute nodes using VeNCrypt authentication scheme. In a previous patch a TLS server certificate was deployed to compute nodes, this patch makes use of this same server cert for securing VNC sessions on compute nodes. It is recommended that this certificate be issued by a dedicated certificate authority solely for the VNC service, as libvirt does not currently have a mechanism to restrict what certificates can be presented by the proxy server. This has not been implemented to reduce complexity. In addition the noVNC proxy needs to present a client certificate so only approved VNC proxy servers can connect to the Compute nodes. The PKI role has been used to create a client certificate for the nova console nodes. Related Nova docs: https://docs.openstack.org/nova/latest/admin/remote-console-access.html To help with the transition from from unencrypted VNC to VeNCrypt, initially compute nodes auth scheme allows for both encrypted and unencrypted sessions using the variable `nova_vencrypt_auth_scheme`, this will be removed in future releases. Change-Id: Iafb788f80fd401c6ce6e4576bafd06c92431bd65
2021年11月08日 15:40:27 +00:00
[serial_console]
enabled = {{ (nova_console_type == 'serialconsole') | ternary(True, False) }}
{% if 'serialconsole' in nova_console_proxy_types %}
base_url= {{ nova_serialconsoleproxy_base_url }}
proxyclient_address = {% if nova_management_address == 'localhost' +%}127.0.0.1{% else +%}{{ nova_management_address }}{% endif +%}
port_range = {{ nova_serialconsoleproxy_port_range }}
serialproxy_host= {{ nova_serialconsoleproxy_serialconsole_proxyserver_proxyclient_address }}
serialproxy_port= {{ nova_serialconsoleproxy_port }}
{% endif %}
Convert existing roles into galaxy roles This change implements the blueprint to convert all roles and plays into a more generic setup, following upstream ansible best practices. Items Changed: * All tasks have tags. * All roles use namespaced variables. * All redundant tasks within a given play and role have been removed. * All of the repetitive plays have been removed in-favor of a more simplistic approach. This change duplicates code within the roles but ensures that the roles only ever run within their own scope. * All roles have been built using an ansible galaxy syntax. * The `*requirement.txt` files have been reformatted follow upstream Openstack practices. * Dynamically generated inventory is now more organized, this should assist anyone who may want or need to dive into the JSON blob that is created. In the inventory a properties field is used for items that customize containers within the inventory. * The environment map has been modified to support additional host groups to enable the seperation of infrastructure pieces. While the old infra_hosts group will still work this change allows for groups to be divided up into seperate chunks; eg: deployment of a swift only stack. * The LXC logic now exists within the plays. * etc/openstack_deploy/user_variables.yml has all password/token variables extracted into the separate file etc/openstack_deploy/user_secrets.yml in order to allow seperate security settings on that file. Items Excised: * All of the roles have had the LXC logic removed from within them which should allow roles to be consumed outside of the `os-ansible-deployment` reference architecture. Note: * the directory rpc_deployment still exists and is presently pointed at plays containing a deprecation warning instructing the user to move to the standard playbooks directory. * While all of the rackspace specific components and variables have been removed and or were refactored the repository still relies on an upstream mirror of Openstack built python files and container images. This upstream mirror is hosted at rackspace at "http://rpc-repo.rackspace.com" though this is not locked to and or tied to rackspace specific installations. This repository contains all of the needed code to create and/or clone your own mirror. DocImpact Co-Authored-By: Jesse Pretorius <jesse.pretorius@rackspace.co.uk> Closes-Bug: #1403676 Implements: blueprint galaxy-roles Change-Id: I03df3328b7655f0cc9e43ba83b02623d038d214e
2015年02月14日 10:06:50 -06:00
# Glance
[glance]
insecure = {{ keystone_service_internaluri_insecure | bool }}
{% if nova_glance_rbd_inuse | bool %}
enable_rbd_download = True
rbd_user = {{ nova_ceph_client }}
rbd_pool = {{ nova_glance_images_rbd_pool }}
rbd_ceph_conf = /etc/ceph/ceph.conf
{% endif %}
Convert existing roles into galaxy roles This change implements the blueprint to convert all roles and plays into a more generic setup, following upstream ansible best practices. Items Changed: * All tasks have tags. * All roles use namespaced variables. * All redundant tasks within a given play and role have been removed. * All of the repetitive plays have been removed in-favor of a more simplistic approach. This change duplicates code within the roles but ensures that the roles only ever run within their own scope. * All roles have been built using an ansible galaxy syntax. * The `*requirement.txt` files have been reformatted follow upstream Openstack practices. * Dynamically generated inventory is now more organized, this should assist anyone who may want or need to dive into the JSON blob that is created. In the inventory a properties field is used for items that customize containers within the inventory. * The environment map has been modified to support additional host groups to enable the seperation of infrastructure pieces. While the old infra_hosts group will still work this change allows for groups to be divided up into seperate chunks; eg: deployment of a swift only stack. * The LXC logic now exists within the plays. * etc/openstack_deploy/user_variables.yml has all password/token variables extracted into the separate file etc/openstack_deploy/user_secrets.yml in order to allow seperate security settings on that file. Items Excised: * All of the roles have had the LXC logic removed from within them which should allow roles to be consumed outside of the `os-ansible-deployment` reference architecture. Note: * the directory rpc_deployment still exists and is presently pointed at plays containing a deprecation warning instructing the user to move to the standard playbooks directory. * While all of the rackspace specific components and variables have been removed and or were refactored the repository still relies on an upstream mirror of Openstack built python files and container images. This upstream mirror is hosted at rackspace at "http://rpc-repo.rackspace.com" though this is not locked to and or tied to rackspace specific installations. This repository contains all of the needed code to create and/or clone your own mirror. DocImpact Co-Authored-By: Jesse Pretorius <jesse.pretorius@rackspace.co.uk> Closes-Bug: #1403676 Implements: blueprint galaxy-roles Change-Id: I03df3328b7655f0cc9e43ba83b02623d038d214e
2015年02月14日 10:06:50 -06:00
# Neutron
[neutron]
region_name = {{ nova_service_region }}
Resolve oslo_config deprecations in nova.conf Each of the following log messages are resolved by these changes: * Option "auth_plugin" from group "keystone_authtoken" is deprecated. Use option "auth_type" from group "keystone_authtoken". * Option "use_local" from group "conductor" is deprecated for removal. * Option "host" from group "glance" is deprecated for removal. * Option "port" from group "glance" is deprecated for removal. Under the [glance] group the use of api_servers in all cases is the current recommendation per related change-id. As a result, the glance_host and glance_service_port variables which were used to define the deprecated configuration values are used to construct an api_servers value that is backwards-compatible. The glance_host variable is already provided by the OpenStack-Ansible playbook to install nova so no new required role vars are introduced. The glance_host var is not renamed to begin with the nova_ namespace prefix at this time. That change should be introduced in a following patch. The following message is not addressed: * Option "username" from group "keystone_authtoken" is deprecated. Use option "user-name" from group "keystone_authtoken". This is a bogus warning, There is no support for use of user-name in the keystone auth library. Related-To: I8c973e9f325f5b732d827a702a98eff8ca56cbd7 Change-Id: I8697775ccc77c11b4ed2735f40eaf3c68975a16c
2016年03月09日 12:28:28 -08:00
auth_type = password
default_floating_pool = public
username = {{ nova_service_user_name }}
password = {{ nova_service_password }}
project_name = {{ nova_service_project_name }}
user_domain_id = {{ nova_service_user_domain_id }}
project_domain_id = {{ nova_service_project_domain_id }}
Upgrade the Keystone library to use v3 In order to enable and deploy federated Keystone, we need to use version 3 of the Keystone API and the v3 Keystone Client. This work begins that transition by having a set of backwards compatible library commands. Specifically, this commit updates the keystone library to use v3 Keystone Client and the usage of ensure_tenant in the os_keystone tasks to use the v3 admin url. In version 3 of Keystone's Endpoints (Catalog) API each endpoint only has one URL and has separate interface types (public, internal, admin). This change updates all uses of ensure_endpoint to structure the endpoint data in a better way for the ensure_endpoint command in the keystone module. As a result, some incidents where internalurl and adminurl were swapped have been fixed. Note: In new deployments the endpoints will be created using the v3 API and will therefore not be available via the v2 API. This will be a breaking change to legacy CLI clients. The openstack CLI should be used instead. DocImpact Related-Bug: #1470635 Partially-implements: blueprint keystone-federation Change-Id: I2cd4f505e850b4b113452abc25ee00d486b1637d
2015年06月29日 23:23:08 -05:00
auth_url = {{ keystone_service_adminurl }}
insecure = {{ keystone_service_adminuri_insecure | bool }}
Convert existing roles into galaxy roles This change implements the blueprint to convert all roles and plays into a more generic setup, following upstream ansible best practices. Items Changed: * All tasks have tags. * All roles use namespaced variables. * All redundant tasks within a given play and role have been removed. * All of the repetitive plays have been removed in-favor of a more simplistic approach. This change duplicates code within the roles but ensures that the roles only ever run within their own scope. * All roles have been built using an ansible galaxy syntax. * The `*requirement.txt` files have been reformatted follow upstream Openstack practices. * Dynamically generated inventory is now more organized, this should assist anyone who may want or need to dive into the JSON blob that is created. In the inventory a properties field is used for items that customize containers within the inventory. * The environment map has been modified to support additional host groups to enable the seperation of infrastructure pieces. While the old infra_hosts group will still work this change allows for groups to be divided up into seperate chunks; eg: deployment of a swift only stack. * The LXC logic now exists within the plays. * etc/openstack_deploy/user_variables.yml has all password/token variables extracted into the separate file etc/openstack_deploy/user_secrets.yml in order to allow seperate security settings on that file. Items Excised: * All of the roles have had the LXC logic removed from within them which should allow roles to be consumed outside of the `os-ansible-deployment` reference architecture. Note: * the directory rpc_deployment still exists and is presently pointed at plays containing a deprecation warning instructing the user to move to the standard playbooks directory. * While all of the rackspace specific components and variables have been removed and or were refactored the repository still relies on an upstream mirror of Openstack built python files and container images. This upstream mirror is hosted at rackspace at "http://rpc-repo.rackspace.com" though this is not locked to and or tied to rackspace specific installations. This repository contains all of the needed code to create and/or clone your own mirror. DocImpact Co-Authored-By: Jesse Pretorius <jesse.pretorius@rackspace.co.uk> Closes-Bug: #1403676 Implements: blueprint galaxy-roles Change-Id: I03df3328b7655f0cc9e43ba83b02623d038d214e
2015年02月14日 10:06:50 -06:00
metadata_proxy_shared_secret = {{ nova_metadata_proxy_secret }}
service_metadata_proxy = {{ nova_metadata_proxy_enabled }}
{% if nova_ceilometer_enabled %}
[notifications]
notify_on_state_change = vm_and_task_state
notification_format = {% if nova_versioned_notification_enabled %}both{% else %}unversioned{% endif %}
{% endif %}
Add nova-placement-api service and cell_v2 setup This patch adds Nova requirements for Ocata: * Nova Placement API running as uwsgi with Nginx. * cell_v2 setup for cell0 and cell1 * All required settings for these services with sane defaults It fixes up some ordering for DB operations: * online_db_migrations should only happen after a full upgrade. * Cell setup needs to happen after api_db sync but before db sync. * Discover_hosts for cell_v2 needs to happen after compute is restarted This adds functionality to allow uwsgi apps in the init scripts: * Allowing the "--log" line to be adjusted. * Setting the condition value so that only enabled services are deployed * Fixes a bug for program_override which mean this value was never being used. Depends-On: I082f37bb3ce61a900e06a58f21c7882f83671355 Change-Id: I282d25988377d18257b708859f89a7ae4260ac07
2017年01月09日 17:03:47 +00:00
[placement]
region_name = {{ nova_service_region }}
auth_type = password
username = {{ nova_service_user_name }}
password = {{ nova_service_password }}
project_name = {{ nova_service_project_name }}
user_domain_id = {{ nova_service_user_domain_id }}
project_domain_id = {{ nova_service_project_domain_id }}
Add nova-placement-api service and cell_v2 setup This patch adds Nova requirements for Ocata: * Nova Placement API running as uwsgi with Nginx. * cell_v2 setup for cell0 and cell1 * All required settings for these services with sane defaults It fixes up some ordering for DB operations: * online_db_migrations should only happen after a full upgrade. * Cell setup needs to happen after api_db sync but before db sync. * Discover_hosts for cell_v2 needs to happen after compute is restarted This adds functionality to allow uwsgi apps in the init scripts: * Allowing the "--log" line to be adjusted. * Setting the condition value so that only enabled services are deployed * Fixes a bug for program_override which mean this value was never being used. Depends-On: I082f37bb3ce61a900e06a58f21c7882f83671355 Change-Id: I282d25988377d18257b708859f89a7ae4260ac07
2017年01月09日 17:03:47 +00:00
auth_url = {{ keystone_service_adminurl }}
insecure = {{ keystone_service_adminuri_insecure | bool }}
Convert existing roles into galaxy roles This change implements the blueprint to convert all roles and plays into a more generic setup, following upstream ansible best practices. Items Changed: * All tasks have tags. * All roles use namespaced variables. * All redundant tasks within a given play and role have been removed. * All of the repetitive plays have been removed in-favor of a more simplistic approach. This change duplicates code within the roles but ensures that the roles only ever run within their own scope. * All roles have been built using an ansible galaxy syntax. * The `*requirement.txt` files have been reformatted follow upstream Openstack practices. * Dynamically generated inventory is now more organized, this should assist anyone who may want or need to dive into the JSON blob that is created. In the inventory a properties field is used for items that customize containers within the inventory. * The environment map has been modified to support additional host groups to enable the seperation of infrastructure pieces. While the old infra_hosts group will still work this change allows for groups to be divided up into seperate chunks; eg: deployment of a swift only stack. * The LXC logic now exists within the plays. * etc/openstack_deploy/user_variables.yml has all password/token variables extracted into the separate file etc/openstack_deploy/user_secrets.yml in order to allow seperate security settings on that file. Items Excised: * All of the roles have had the LXC logic removed from within them which should allow roles to be consumed outside of the `os-ansible-deployment` reference architecture. Note: * the directory rpc_deployment still exists and is presently pointed at plays containing a deprecation warning instructing the user to move to the standard playbooks directory. * While all of the rackspace specific components and variables have been removed and or were refactored the repository still relies on an upstream mirror of Openstack built python files and container images. This upstream mirror is hosted at rackspace at "http://rpc-repo.rackspace.com" though this is not locked to and or tied to rackspace specific installations. This repository contains all of the needed code to create and/or clone your own mirror. DocImpact Co-Authored-By: Jesse Pretorius <jesse.pretorius@rackspace.co.uk> Closes-Bug: #1403676 Implements: blueprint galaxy-roles Change-Id: I03df3328b7655f0cc9e43ba83b02623d038d214e
2015年02月14日 10:06:50 -06:00
[conductor]
workers = {{ nova_conductor_workers | default(nova_api_threads) }}
Convert existing roles into galaxy roles This change implements the blueprint to convert all roles and plays into a more generic setup, following upstream ansible best practices. Items Changed: * All tasks have tags. * All roles use namespaced variables. * All redundant tasks within a given play and role have been removed. * All of the repetitive plays have been removed in-favor of a more simplistic approach. This change duplicates code within the roles but ensures that the roles only ever run within their own scope. * All roles have been built using an ansible galaxy syntax. * The `*requirement.txt` files have been reformatted follow upstream Openstack practices. * Dynamically generated inventory is now more organized, this should assist anyone who may want or need to dive into the JSON blob that is created. In the inventory a properties field is used for items that customize containers within the inventory. * The environment map has been modified to support additional host groups to enable the seperation of infrastructure pieces. While the old infra_hosts group will still work this change allows for groups to be divided up into seperate chunks; eg: deployment of a swift only stack. * The LXC logic now exists within the plays. * etc/openstack_deploy/user_variables.yml has all password/token variables extracted into the separate file etc/openstack_deploy/user_secrets.yml in order to allow seperate security settings on that file. Items Excised: * All of the roles have had the LXC logic removed from within them which should allow roles to be consumed outside of the `os-ansible-deployment` reference architecture. Note: * the directory rpc_deployment still exists and is presently pointed at plays containing a deprecation warning instructing the user to move to the standard playbooks directory. * While all of the rackspace specific components and variables have been removed and or were refactored the repository still relies on an upstream mirror of Openstack built python files and container images. This upstream mirror is hosted at rackspace at "http://rpc-repo.rackspace.com" though this is not locked to and or tied to rackspace specific installations. This repository contains all of the needed code to create and/or clone your own mirror. DocImpact Co-Authored-By: Jesse Pretorius <jesse.pretorius@rackspace.co.uk> Closes-Bug: #1403676 Implements: blueprint galaxy-roles Change-Id: I03df3328b7655f0cc9e43ba83b02623d038d214e
2015年02月14日 10:06:50 -06:00
[service_user]
send_service_user_token = {{ nova_service_token_roles_required | bool }}
region_name = {{ nova_service_region }}
auth_type = password
username = {{ nova_service_user_name }}
password = {{ nova_service_password }}
project_name = {{ nova_service_project_name }}
user_domain_id = {{ nova_service_user_domain_id }}
project_domain_id = {{ nova_service_project_domain_id }}
auth_url = {{ keystone_service_adminurl }}
insecure = {{ keystone_service_adminuri_insecure | bool }}
Convert existing roles into galaxy roles This change implements the blueprint to convert all roles and plays into a more generic setup, following upstream ansible best practices. Items Changed: * All tasks have tags. * All roles use namespaced variables. * All redundant tasks within a given play and role have been removed. * All of the repetitive plays have been removed in-favor of a more simplistic approach. This change duplicates code within the roles but ensures that the roles only ever run within their own scope. * All roles have been built using an ansible galaxy syntax. * The `*requirement.txt` files have been reformatted follow upstream Openstack practices. * Dynamically generated inventory is now more organized, this should assist anyone who may want or need to dive into the JSON blob that is created. In the inventory a properties field is used for items that customize containers within the inventory. * The environment map has been modified to support additional host groups to enable the seperation of infrastructure pieces. While the old infra_hosts group will still work this change allows for groups to be divided up into seperate chunks; eg: deployment of a swift only stack. * The LXC logic now exists within the plays. * etc/openstack_deploy/user_variables.yml has all password/token variables extracted into the separate file etc/openstack_deploy/user_secrets.yml in order to allow seperate security settings on that file. Items Excised: * All of the roles have had the LXC logic removed from within them which should allow roles to be consumed outside of the `os-ansible-deployment` reference architecture. Note: * the directory rpc_deployment still exists and is presently pointed at plays containing a deprecation warning instructing the user to move to the standard playbooks directory. * While all of the rackspace specific components and variables have been removed and or were refactored the repository still relies on an upstream mirror of Openstack built python files and container images. This upstream mirror is hosted at rackspace at "http://rpc-repo.rackspace.com" though this is not locked to and or tied to rackspace specific installations. This repository contains all of the needed code to create and/or clone your own mirror. DocImpact Co-Authored-By: Jesse Pretorius <jesse.pretorius@rackspace.co.uk> Closes-Bug: #1403676 Implements: blueprint galaxy-roles Change-Id: I03df3328b7655f0cc9e43ba83b02623d038d214e
2015年02月14日 10:06:50 -06:00
[keystone_authtoken]
Enable all services to use Keystone 'insecurely' This patch introduces an insecure flag for the Keystone internal and admin endpoints: * keystone_service_adminuri_insecure * keystone_service_internaluri_insecure Both values default to false. If you have setup SSL endpoints for Keystone using an untrusted certificate then you should set the appropriate flag to true in your user_variables. This patch is used to enable testing and development with Keystone SSL endpoints without having to make use of SSL certificates signed by a trusted, public CA. The patch introduces a new optional argument (insecure) to the keystone, glance and neutron Ansible libraries. This is a boolean value which, when true, enables these libraries to access Keystone endpoints 'insecurely'. When these libraries are used in plays, the appropriate value is set automatically as per the above conditions. Implements: blueprint keystone-federation Change-Id: Ia07e7e201f901042dd06a86efe5c6f6725e9ce13
2015年07月07日 21:01:20 +00:00
insecure = {{ keystone_service_internaluri_insecure | bool }}
auth_type = {{ nova_keystone_auth_plugin }}
auth_url = {{ keystone_service_adminuri }}
www_authenticate_uri = {{ keystone_service_internaluri }}
project_domain_id = {{ nova_service_project_domain_id }}
user_domain_id = {{ nova_service_user_domain_id }}
project_name = {{ nova_service_project_name }}
username = {{ nova_service_user_name }}
password = {{ nova_service_password }}
region_name = {{ keystone_service_region }}
Convert existing roles into galaxy roles This change implements the blueprint to convert all roles and plays into a more generic setup, following upstream ansible best practices. Items Changed: * All tasks have tags. * All roles use namespaced variables. * All redundant tasks within a given play and role have been removed. * All of the repetitive plays have been removed in-favor of a more simplistic approach. This change duplicates code within the roles but ensures that the roles only ever run within their own scope. * All roles have been built using an ansible galaxy syntax. * The `*requirement.txt` files have been reformatted follow upstream Openstack practices. * Dynamically generated inventory is now more organized, this should assist anyone who may want or need to dive into the JSON blob that is created. In the inventory a properties field is used for items that customize containers within the inventory. * The environment map has been modified to support additional host groups to enable the seperation of infrastructure pieces. While the old infra_hosts group will still work this change allows for groups to be divided up into seperate chunks; eg: deployment of a swift only stack. * The LXC logic now exists within the plays. * etc/openstack_deploy/user_variables.yml has all password/token variables extracted into the separate file etc/openstack_deploy/user_secrets.yml in order to allow seperate security settings on that file. Items Excised: * All of the roles have had the LXC logic removed from within them which should allow roles to be consumed outside of the `os-ansible-deployment` reference architecture. Note: * the directory rpc_deployment still exists and is presently pointed at plays containing a deprecation warning instructing the user to move to the standard playbooks directory. * While all of the rackspace specific components and variables have been removed and or were refactored the repository still relies on an upstream mirror of Openstack built python files and container images. This upstream mirror is hosted at rackspace at "http://rpc-repo.rackspace.com" though this is not locked to and or tied to rackspace specific installations. This repository contains all of the needed code to create and/or clone your own mirror. DocImpact Co-Authored-By: Jesse Pretorius <jesse.pretorius@rackspace.co.uk> Closes-Bug: #1403676 Implements: blueprint galaxy-roles Change-Id: I03df3328b7655f0cc9e43ba83b02623d038d214e
2015年02月14日 10:06:50 -06:00
service_token_roles_required = {{ nova_service_token_roles_required | bool }}
service_token_roles = {{ nova_service_token_roles | join(',') }}
service_type = {{ nova_service_type }}
{% if nova_cache_backend in nova_cache_backend_map['dogpile'] %}
memcached_servers = {{ nova_cache_servers }}
Convert existing roles into galaxy roles This change implements the blueprint to convert all roles and plays into a more generic setup, following upstream ansible best practices. Items Changed: * All tasks have tags. * All roles use namespaced variables. * All redundant tasks within a given play and role have been removed. * All of the repetitive plays have been removed in-favor of a more simplistic approach. This change duplicates code within the roles but ensures that the roles only ever run within their own scope. * All roles have been built using an ansible galaxy syntax. * The `*requirement.txt` files have been reformatted follow upstream Openstack practices. * Dynamically generated inventory is now more organized, this should assist anyone who may want or need to dive into the JSON blob that is created. In the inventory a properties field is used for items that customize containers within the inventory. * The environment map has been modified to support additional host groups to enable the seperation of infrastructure pieces. While the old infra_hosts group will still work this change allows for groups to be divided up into seperate chunks; eg: deployment of a swift only stack. * The LXC logic now exists within the plays. * etc/openstack_deploy/user_variables.yml has all password/token variables extracted into the separate file etc/openstack_deploy/user_secrets.yml in order to allow seperate security settings on that file. Items Excised: * All of the roles have had the LXC logic removed from within them which should allow roles to be consumed outside of the `os-ansible-deployment` reference architecture. Note: * the directory rpc_deployment still exists and is presently pointed at plays containing a deprecation warning instructing the user to move to the standard playbooks directory. * While all of the rackspace specific components and variables have been removed and or were refactored the repository still relies on an upstream mirror of Openstack built python files and container images. This upstream mirror is hosted at rackspace at "http://rpc-repo.rackspace.com" though this is not locked to and or tied to rackspace specific installations. This repository contains all of the needed code to create and/or clone your own mirror. DocImpact Co-Authored-By: Jesse Pretorius <jesse.pretorius@rackspace.co.uk> Closes-Bug: #1403676 Implements: blueprint galaxy-roles Change-Id: I03df3328b7655f0cc9e43ba83b02623d038d214e
2015年02月14日 10:06:50 -06:00
token_cache_time = 300
# if your memcached server is shared, use these settings to avoid cache poisoning
memcache_security_strategy = ENCRYPT
memcache_secret_key = {{ memcached_encryption_key }}
{% endif %}
Convert existing roles into galaxy roles This change implements the blueprint to convert all roles and plays into a more generic setup, following upstream ansible best practices. Items Changed: * All tasks have tags. * All roles use namespaced variables. * All redundant tasks within a given play and role have been removed. * All of the repetitive plays have been removed in-favor of a more simplistic approach. This change duplicates code within the roles but ensures that the roles only ever run within their own scope. * All roles have been built using an ansible galaxy syntax. * The `*requirement.txt` files have been reformatted follow upstream Openstack practices. * Dynamically generated inventory is now more organized, this should assist anyone who may want or need to dive into the JSON blob that is created. In the inventory a properties field is used for items that customize containers within the inventory. * The environment map has been modified to support additional host groups to enable the seperation of infrastructure pieces. While the old infra_hosts group will still work this change allows for groups to be divided up into seperate chunks; eg: deployment of a swift only stack. * The LXC logic now exists within the plays. * etc/openstack_deploy/user_variables.yml has all password/token variables extracted into the separate file etc/openstack_deploy/user_secrets.yml in order to allow seperate security settings on that file. Items Excised: * All of the roles have had the LXC logic removed from within them which should allow roles to be consumed outside of the `os-ansible-deployment` reference architecture. Note: * the directory rpc_deployment still exists and is presently pointed at plays containing a deprecation warning instructing the user to move to the standard playbooks directory. * While all of the rackspace specific components and variables have been removed and or were refactored the repository still relies on an upstream mirror of Openstack built python files and container images. This upstream mirror is hosted at rackspace at "http://rpc-repo.rackspace.com" though this is not locked to and or tied to rackspace specific installations. This repository contains all of the needed code to create and/or clone your own mirror. DocImpact Co-Authored-By: Jesse Pretorius <jesse.pretorius@rackspace.co.uk> Closes-Bug: #1403676 Implements: blueprint galaxy-roles Change-Id: I03df3328b7655f0cc9e43ba83b02623d038d214e
2015年02月14日 10:06:50 -06:00
{% if group_names | intersect(nova_services.keys() | difference('nova-compute') | map('extract', nova_services, 'group') | list) | count > 0 %}
Convert existing roles into galaxy roles This change implements the blueprint to convert all roles and plays into a more generic setup, following upstream ansible best practices. Items Changed: * All tasks have tags. * All roles use namespaced variables. * All redundant tasks within a given play and role have been removed. * All of the repetitive plays have been removed in-favor of a more simplistic approach. This change duplicates code within the roles but ensures that the roles only ever run within their own scope. * All roles have been built using an ansible galaxy syntax. * The `*requirement.txt` files have been reformatted follow upstream Openstack practices. * Dynamically generated inventory is now more organized, this should assist anyone who may want or need to dive into the JSON blob that is created. In the inventory a properties field is used for items that customize containers within the inventory. * The environment map has been modified to support additional host groups to enable the seperation of infrastructure pieces. While the old infra_hosts group will still work this change allows for groups to be divided up into seperate chunks; eg: deployment of a swift only stack. * The LXC logic now exists within the plays. * etc/openstack_deploy/user_variables.yml has all password/token variables extracted into the separate file etc/openstack_deploy/user_secrets.yml in order to allow seperate security settings on that file. Items Excised: * All of the roles have had the LXC logic removed from within them which should allow roles to be consumed outside of the `os-ansible-deployment` reference architecture. Note: * the directory rpc_deployment still exists and is presently pointed at plays containing a deprecation warning instructing the user to move to the standard playbooks directory. * While all of the rackspace specific components and variables have been removed and or were refactored the repository still relies on an upstream mirror of Openstack built python files and container images. This upstream mirror is hosted at rackspace at "http://rpc-repo.rackspace.com" though this is not locked to and or tied to rackspace specific installations. This repository contains all of the needed code to create and/or clone your own mirror. DocImpact Co-Authored-By: Jesse Pretorius <jesse.pretorius@rackspace.co.uk> Closes-Bug: #1403676 Implements: blueprint galaxy-roles Change-Id: I03df3328b7655f0cc9e43ba83b02623d038d214e
2015年02月14日 10:06:50 -06:00
[database]
connection = mysql+pymysql://{{ nova_galera_user }}:{{ nova_container_mysql_password }}@{{ nova_galera_address }}:{{ nova_galera_port }}/{{ nova_galera_database }}?charset=utf8{% if nova_galera_use_ssl | bool %}&ssl_verify_cert=true{% if nova_galera_ssl_ca_cert | length > 0 %}&ssl_ca={{ nova_galera_ssl_ca_cert }}{% endif %}{% endif %}
max_overflow = {{ nova_db_max_overflow }}
max_pool_size = {{ nova_db_max_pool_size }}
pool_timeout = {{ nova_db_pool_timeout }}
connection_recycle_time = {{ nova_db_connection_recycle_time }}
[api_database]
connection = mysql+pymysql://{{ nova_api_galera_user }}:{{ nova_api_container_mysql_password }}@{{ nova_api_galera_address }}:{{ nova_api_galera_port }}/{{ nova_api_galera_database }}?charset=utf8{% if nova_galera_use_ssl | bool %}&ssl_verify_cert=true{% if nova_galera_ssl_ca_cert | length > 0 %}&ssl_ca={{ nova_galera_ssl_ca_cert }}{% endif %}{% endif %}
max_overflow = {{ nova_api_db_max_overflow }}
max_pool_size = {{ nova_api_db_max_pool_size }}
pool_timeout = {{ nova_api_db_pool_timeout }}
connection_recycle_time = {{ nova_api_db_connection_recycle_time }}
Convert existing roles into galaxy roles This change implements the blueprint to convert all roles and plays into a more generic setup, following upstream ansible best practices. Items Changed: * All tasks have tags. * All roles use namespaced variables. * All redundant tasks within a given play and role have been removed. * All of the repetitive plays have been removed in-favor of a more simplistic approach. This change duplicates code within the roles but ensures that the roles only ever run within their own scope. * All roles have been built using an ansible galaxy syntax. * The `*requirement.txt` files have been reformatted follow upstream Openstack practices. * Dynamically generated inventory is now more organized, this should assist anyone who may want or need to dive into the JSON blob that is created. In the inventory a properties field is used for items that customize containers within the inventory. * The environment map has been modified to support additional host groups to enable the seperation of infrastructure pieces. While the old infra_hosts group will still work this change allows for groups to be divided up into seperate chunks; eg: deployment of a swift only stack. * The LXC logic now exists within the plays. * etc/openstack_deploy/user_variables.yml has all password/token variables extracted into the separate file etc/openstack_deploy/user_secrets.yml in order to allow seperate security settings on that file. Items Excised: * All of the roles have had the LXC logic removed from within them which should allow roles to be consumed outside of the `os-ansible-deployment` reference architecture. Note: * the directory rpc_deployment still exists and is presently pointed at plays containing a deprecation warning instructing the user to move to the standard playbooks directory. * While all of the rackspace specific components and variables have been removed and or were refactored the repository still relies on an upstream mirror of Openstack built python files and container images. This upstream mirror is hosted at rackspace at "http://rpc-repo.rackspace.com" though this is not locked to and or tied to rackspace specific installations. This repository contains all of the needed code to create and/or clone your own mirror. DocImpact Co-Authored-By: Jesse Pretorius <jesse.pretorius@rackspace.co.uk> Closes-Bug: #1403676 Implements: blueprint galaxy-roles Change-Id: I03df3328b7655f0cc9e43ba83b02623d038d214e
2015年02月14日 10:06:50 -06:00
Add nova-placement-api service and cell_v2 setup This patch adds Nova requirements for Ocata: * Nova Placement API running as uwsgi with Nginx. * cell_v2 setup for cell0 and cell1 * All required settings for these services with sane defaults It fixes up some ordering for DB operations: * online_db_migrations should only happen after a full upgrade. * Cell setup needs to happen after api_db sync but before db sync. * Discover_hosts for cell_v2 needs to happen after compute is restarted This adds functionality to allow uwsgi apps in the init scripts: * Allowing the "--log" line to be adjusted. * Setting the condition value so that only enabled services are deployed * Fixes a bug for program_override which mean this value was never being used. Depends-On: I082f37bb3ce61a900e06a58f21c7882f83671355 Change-Id: I282d25988377d18257b708859f89a7ae4260ac07
2017年01月09日 17:03:47 +00:00
{% endif %}
Convert existing roles into galaxy roles This change implements the blueprint to convert all roles and plays into a more generic setup, following upstream ansible best practices. Items Changed: * All tasks have tags. * All roles use namespaced variables. * All redundant tasks within a given play and role have been removed. * All of the repetitive plays have been removed in-favor of a more simplistic approach. This change duplicates code within the roles but ensures that the roles only ever run within their own scope. * All roles have been built using an ansible galaxy syntax. * The `*requirement.txt` files have been reformatted follow upstream Openstack practices. * Dynamically generated inventory is now more organized, this should assist anyone who may want or need to dive into the JSON blob that is created. In the inventory a properties field is used for items that customize containers within the inventory. * The environment map has been modified to support additional host groups to enable the seperation of infrastructure pieces. While the old infra_hosts group will still work this change allows for groups to be divided up into seperate chunks; eg: deployment of a swift only stack. * The LXC logic now exists within the plays. * etc/openstack_deploy/user_variables.yml has all password/token variables extracted into the separate file etc/openstack_deploy/user_secrets.yml in order to allow seperate security settings on that file. Items Excised: * All of the roles have had the LXC logic removed from within them which should allow roles to be consumed outside of the `os-ansible-deployment` reference architecture. Note: * the directory rpc_deployment still exists and is presently pointed at plays containing a deprecation warning instructing the user to move to the standard playbooks directory. * While all of the rackspace specific components and variables have been removed and or were refactored the repository still relies on an upstream mirror of Openstack built python files and container images. This upstream mirror is hosted at rackspace at "http://rpc-repo.rackspace.com" though this is not locked to and or tied to rackspace specific installations. This repository contains all of the needed code to create and/or clone your own mirror. DocImpact Co-Authored-By: Jesse Pretorius <jesse.pretorius@rackspace.co.uk> Closes-Bug: #1403676 Implements: blueprint galaxy-roles Change-Id: I03df3328b7655f0cc9e43ba83b02623d038d214e
2015年02月14日 10:06:50 -06:00
Updated repository for minimum viable kilo install * Updated Keystone wsgi and paste files from upstream. * Updated all clients in the openstack_client.yml file. * Kilo services are tracking the head of master. * Removed pinned middleware because they're pinned else where. * Added additional service references for neutron vpnaas, fwaas, and lbaas which have now been moved into their own repos and no longer exist within the core neutron repository. * The neutron vpnaas, fwaas, and lbaas have been removed from the basic plugins being loaded and a comment has been added to describe how one might add them back in. * Updated rootwrap filters for neutron dhcp and l3. * Updated heat policy.json * Added the `python-libguestfs` to the nova-compute installation packages. * Updates all services to point to the latest kilo tag Services updated due to deprecated configs: * Keystone * Glance * Nova * Neutron (is still using the deprecated nova auth plugin) * Heat * Tempest Items for future work post initial release: * roles/os_neutron/files/post-up-checksum-rules:25: TODO(cloudnull) remove this script once the bug is fixed. * roles/rabbitmq_server/tasks/rabbitmq_cluster_join.yml:17: TODO(someone): implement a more robust way of checking Implements: blueprint minimal-kilo Closes-Bug: 1428421 Closes-Bug: 1428431 Closes-Bug: 1428437 Closes-Bug: 1428445 Closes-Bug: 1428451 Closes-Bug: 1428469 Closes-Bug: 1428639 Change-Id: I28a305d9e40a9cf70148ef7d7b00d467a65ca076
2015年03月22日 09:09:53 -05:00
[oslo_concurrency]
lock_path = {{ nova_lock_dir }}/{{ nova_system_slice_name }}
Updated repository for minimum viable kilo install * Updated Keystone wsgi and paste files from upstream. * Updated all clients in the openstack_client.yml file. * Kilo services are tracking the head of master. * Removed pinned middleware because they're pinned else where. * Added additional service references for neutron vpnaas, fwaas, and lbaas which have now been moved into their own repos and no longer exist within the core neutron repository. * The neutron vpnaas, fwaas, and lbaas have been removed from the basic plugins being loaded and a comment has been added to describe how one might add them back in. * Updated rootwrap filters for neutron dhcp and l3. * Updated heat policy.json * Added the `python-libguestfs` to the nova-compute installation packages. * Updates all services to point to the latest kilo tag Services updated due to deprecated configs: * Keystone * Glance * Nova * Neutron (is still using the deprecated nova auth plugin) * Heat * Tempest Items for future work post initial release: * roles/os_neutron/files/post-up-checksum-rules:25: TODO(cloudnull) remove this script once the bug is fixed. * roles/rabbitmq_server/tasks/rabbitmq_cluster_join.yml:17: TODO(someone): implement a more robust way of checking Implements: blueprint minimal-kilo Closes-Bug: 1428421 Closes-Bug: 1428431 Closes-Bug: 1428437 Closes-Bug: 1428445 Closes-Bug: 1428451 Closes-Bug: 1428469 Closes-Bug: 1428639 Change-Id: I28a305d9e40a9cf70148ef7d7b00d467a65ca076
2015年03月22日 09:09:53 -05:00
Add Nova config for os_ironic role This patch configures Nova for use with Ironic, noting that without moving to cells, an openstack-ansible install can support only one type of hypervisor at a time (i.e. kvm or ironic etc). Setting the nova_virt_type determines whether Nova is configured for Ironic. If it is left unset, the default kvm hypervisor is used. The nova virtualization types have all been moved into a single nova_virt_types data structure which is used to define facts for a specific supported virtualization type. This change is compatible with older versions of overrides as the virt type values are used to set host facts which could also be set using user variables or any other means to predefine a default value. Change-Id: Ic8160fa00457d68ee223452f4dae6d38bffcdca0 Signed-off-by: Michael Davies <michael@the-davies.net> Partially-implements: blueprint role-ironic Signed-off-by: Kevin Carter <kevin.carter@rackspace.com>
2016年03月16日 08:42:26 +00:00
{% if nova_virt_type == 'ironic' %}
[ironic]
auth_type = {{ nova_keystone_auth_plugin }}
username = {{ nova_service_user_name }}
password = {{ nova_service_password }}
project_name = {{ nova_service_project_name }}
user_domain_id = {{ nova_service_user_domain_id }}
project_domain_id = {{ nova_service_project_domain_id }}
auth_url = {{ keystone_service_adminurl }}
insecure = {{ keystone_service_adminuri_insecure | bool }}
Add Nova config for os_ironic role This patch configures Nova for use with Ironic, noting that without moving to cells, an openstack-ansible install can support only one type of hypervisor at a time (i.e. kvm or ironic etc). Setting the nova_virt_type determines whether Nova is configured for Ironic. If it is left unset, the default kvm hypervisor is used. The nova virtualization types have all been moved into a single nova_virt_types data structure which is used to define facts for a specific supported virtualization type. This change is compatible with older versions of overrides as the virt type values are used to set host facts which could also be set using user variables or any other means to predefine a default value. Change-Id: Ic8160fa00457d68ee223452f4dae6d38bffcdca0 Signed-off-by: Michael Davies <michael@the-davies.net> Partially-implements: blueprint role-ironic Signed-off-by: Kevin Carter <kevin.carter@rackspace.com>
2016年03月16日 08:42:26 +00:00
{% endif %}
{% if nova_virt_type in ['kvm', 'qemu', 'xen', 'lxc', 'uml', 'parallels'] %}
{% if (neutron_plugin_type | default('') == "ml2.ovs") %}
[os_vif_ovs]
isolate_vif = True
{% endif %}
Convert existing roles into galaxy roles This change implements the blueprint to convert all roles and plays into a more generic setup, following upstream ansible best practices. Items Changed: * All tasks have tags. * All roles use namespaced variables. * All redundant tasks within a given play and role have been removed. * All of the repetitive plays have been removed in-favor of a more simplistic approach. This change duplicates code within the roles but ensures that the roles only ever run within their own scope. * All roles have been built using an ansible galaxy syntax. * The `*requirement.txt` files have been reformatted follow upstream Openstack practices. * Dynamically generated inventory is now more organized, this should assist anyone who may want or need to dive into the JSON blob that is created. In the inventory a properties field is used for items that customize containers within the inventory. * The environment map has been modified to support additional host groups to enable the seperation of infrastructure pieces. While the old infra_hosts group will still work this change allows for groups to be divided up into seperate chunks; eg: deployment of a swift only stack. * The LXC logic now exists within the plays. * etc/openstack_deploy/user_variables.yml has all password/token variables extracted into the separate file etc/openstack_deploy/user_secrets.yml in order to allow seperate security settings on that file. Items Excised: * All of the roles have had the LXC logic removed from within them which should allow roles to be consumed outside of the `os-ansible-deployment` reference architecture. Note: * the directory rpc_deployment still exists and is presently pointed at plays containing a deprecation warning instructing the user to move to the standard playbooks directory. * While all of the rackspace specific components and variables have been removed and or were refactored the repository still relies on an upstream mirror of Openstack built python files and container images. This upstream mirror is hosted at rackspace at "http://rpc-repo.rackspace.com" though this is not locked to and or tied to rackspace specific installations. This repository contains all of the needed code to create and/or clone your own mirror. DocImpact Co-Authored-By: Jesse Pretorius <jesse.pretorius@rackspace.co.uk> Closes-Bug: #1403676 Implements: blueprint galaxy-roles Change-Id: I03df3328b7655f0cc9e43ba83b02623d038d214e
2015年02月14日 10:06:50 -06:00
[libvirt]
inject_partition = {{ nova_libvirt_inject_partition }}
inject_password = {{ nova_libvirt_inject_password }}
inject_key = {{ nova_libvirt_inject_key }}
Convert existing roles into galaxy roles This change implements the blueprint to convert all roles and plays into a more generic setup, following upstream ansible best practices. Items Changed: * All tasks have tags. * All roles use namespaced variables. * All redundant tasks within a given play and role have been removed. * All of the repetitive plays have been removed in-favor of a more simplistic approach. This change duplicates code within the roles but ensures that the roles only ever run within their own scope. * All roles have been built using an ansible galaxy syntax. * The `*requirement.txt` files have been reformatted follow upstream Openstack practices. * Dynamically generated inventory is now more organized, this should assist anyone who may want or need to dive into the JSON blob that is created. In the inventory a properties field is used for items that customize containers within the inventory. * The environment map has been modified to support additional host groups to enable the seperation of infrastructure pieces. While the old infra_hosts group will still work this change allows for groups to be divided up into seperate chunks; eg: deployment of a swift only stack. * The LXC logic now exists within the plays. * etc/openstack_deploy/user_variables.yml has all password/token variables extracted into the separate file etc/openstack_deploy/user_secrets.yml in order to allow seperate security settings on that file. Items Excised: * All of the roles have had the LXC logic removed from within them which should allow roles to be consumed outside of the `os-ansible-deployment` reference architecture. Note: * the directory rpc_deployment still exists and is presently pointed at plays containing a deprecation warning instructing the user to move to the standard playbooks directory. * While all of the rackspace specific components and variables have been removed and or were refactored the repository still relies on an upstream mirror of Openstack built python files and container images. This upstream mirror is hosted at rackspace at "http://rpc-repo.rackspace.com" though this is not locked to and or tied to rackspace specific installations. This repository contains all of the needed code to create and/or clone your own mirror. DocImpact Co-Authored-By: Jesse Pretorius <jesse.pretorius@rackspace.co.uk> Closes-Bug: #1403676 Implements: blueprint galaxy-roles Change-Id: I03df3328b7655f0cc9e43ba83b02623d038d214e
2015年02月14日 10:06:50 -06:00
virt_type = {{ nova_virt_type }}
{% if nova_cpu_mode is defined %}
cpu_mode = {{ nova_cpu_mode }}
{% endif %}
Add Ceph/RBD support to playbooks Currently the playbooks do not allow Ceph to be configured as a backend for Cinder, Glance or Nova. This commit adds a new role called ceph_client to do the required configuration of the hosts and updates the service roles to include the required configuration file changes. This commit requires that a Ceph cluster already exists and does not make any changes to that cluster. ceph_client role, run on the OpenStack service hosts - configures the Ceph apt repo - installs any required Ceph dependencies - copies the ceph.conf file and appropriate keyring file to /etc/ceph - creates the necessary libvirt secrets os_glance role glance-api.conf will set the following variables for Ceph: - [DEFAULT]/show_image_direct_url - [glance_store]/stores - [glance_store]/rbd_store_pool - [glance_store]/rbd_store_user - [glance_store]/rbd_store_ceph_conf - [glance_store]/rbd_store_chunk_size os_nova role nova.conf will set the following variables for Ceph: - [libvirt]/rbd_user - [libvirt]/rbd_secret_uuid - [libvirt]/images_type - [libvirt]/images_rbd_pool - [libvirt]/images_rbd_ceph_conf - [libvirt]/inject_password - [libvirt]/inject_key - [libvirt]/inject_partition - [libvirt]/live_migration_flag os_cinder is not updated because ceph is defined as a backend and that is generated from a dictionary of the config, for an example backend config, see etc/openstack_deploy/openstack_user_config.yml.example pw-token-gen.py is updated so that variables ending in uuid are assigned a UUID. DocImpact Implements: blueprint ceph-block-devices Closes-Bug: #1455238 Change-Id: Ie484ce0bbb93adc53c30be32f291aa5058b20028
2015年05月07日 16:41:18 +02:00
{% if nova_rbd_inuse %}
Add Ceph/RBD support to playbooks Currently the playbooks do not allow Ceph to be configured as a backend for Cinder, Glance or Nova. This commit adds a new role called ceph_client to do the required configuration of the hosts and updates the service roles to include the required configuration file changes. This commit requires that a Ceph cluster already exists and does not make any changes to that cluster. ceph_client role, run on the OpenStack service hosts - configures the Ceph apt repo - installs any required Ceph dependencies - copies the ceph.conf file and appropriate keyring file to /etc/ceph - creates the necessary libvirt secrets os_glance role glance-api.conf will set the following variables for Ceph: - [DEFAULT]/show_image_direct_url - [glance_store]/stores - [glance_store]/rbd_store_pool - [glance_store]/rbd_store_user - [glance_store]/rbd_store_ceph_conf - [glance_store]/rbd_store_chunk_size os_nova role nova.conf will set the following variables for Ceph: - [libvirt]/rbd_user - [libvirt]/rbd_secret_uuid - [libvirt]/images_type - [libvirt]/images_rbd_pool - [libvirt]/images_rbd_ceph_conf - [libvirt]/inject_password - [libvirt]/inject_key - [libvirt]/inject_partition - [libvirt]/live_migration_flag os_cinder is not updated because ceph is defined as a backend and that is generated from a dictionary of the config, for an example backend config, see etc/openstack_deploy/openstack_user_config.yml.example pw-token-gen.py is updated so that variables ending in uuid are assigned a UUID. DocImpact Implements: blueprint ceph-block-devices Closes-Bug: #1455238 Change-Id: Ie484ce0bbb93adc53c30be32f291aa5058b20028
2015年05月07日 16:41:18 +02:00
# ceph rbd support
rbd_user = {{ nova_ceph_client }}
rbd_secret_uuid = {{ nova_ceph_client_uuid }}
{% endif %}
{% if nova_libvirt_images_rbd_pool | length > 0 %}
Add Ceph/RBD support to playbooks Currently the playbooks do not allow Ceph to be configured as a backend for Cinder, Glance or Nova. This commit adds a new role called ceph_client to do the required configuration of the hosts and updates the service roles to include the required configuration file changes. This commit requires that a Ceph cluster already exists and does not make any changes to that cluster. ceph_client role, run on the OpenStack service hosts - configures the Ceph apt repo - installs any required Ceph dependencies - copies the ceph.conf file and appropriate keyring file to /etc/ceph - creates the necessary libvirt secrets os_glance role glance-api.conf will set the following variables for Ceph: - [DEFAULT]/show_image_direct_url - [glance_store]/stores - [glance_store]/rbd_store_pool - [glance_store]/rbd_store_user - [glance_store]/rbd_store_ceph_conf - [glance_store]/rbd_store_chunk_size os_nova role nova.conf will set the following variables for Ceph: - [libvirt]/rbd_user - [libvirt]/rbd_secret_uuid - [libvirt]/images_type - [libvirt]/images_rbd_pool - [libvirt]/images_rbd_ceph_conf - [libvirt]/inject_password - [libvirt]/inject_key - [libvirt]/inject_partition - [libvirt]/live_migration_flag os_cinder is not updated because ceph is defined as a backend and that is generated from a dictionary of the config, for an example backend config, see etc/openstack_deploy/openstack_user_config.yml.example pw-token-gen.py is updated so that variables ending in uuid are assigned a UUID. DocImpact Implements: blueprint ceph-block-devices Closes-Bug: #1455238 Change-Id: Ie484ce0bbb93adc53c30be32f291aa5058b20028
2015年05月07日 16:41:18 +02:00
images_type = rbd
images_rbd_pool = {{ nova_libvirt_images_rbd_pool }}
images_rbd_ceph_conf = /etc/ceph/ceph.conf
{% endif %}
{% if nova_virt_type in ['kvm', 'qemu'] %}
Enable TLS for live migrations Instead of using SSH to live migrate VM's use TLS as this is more secure and SSH migrations are deprecated. https://docs.openstack.org/nova/xena/admin/secure-live-migration-with-qemu-native-tls.html A pre-existing PKI (Public Key Infrastruture) setup is required. TLS live migrations require that all compute hosts can communcate with each other on port 16514 and port range 49152 to 49261. To enable TLS live migrations, both libvirt and QEMU require server and client certificates, the server certicicates is used to verify servers and the client cert is used by servers to authenticate clients. A single cert is created by the pki role, that can be used by both libvirt and QEMU for both client and server auth. The client, server and CA certifcates need to installed in a number of locations on each compute host: * For Libvirt https://libvirt.org/tlscerts.html * For QEMU https://github.com/libvirt/libvirt/blob/master/src/qemu/qemu.conf Depends-On: https://review.opendev.org/c/openstack/ansible-role-pki/+/815007 Depends-On: https://review.opendev.org/c/openstack/ansible-role-pki/+/815849 Depends-On: https://review.opendev.org/c/openstack/ansible-role-pki/+/816857 Change-Id: Iddbe8764bb6d3cd3eaee122b2d5ddc02fa3f7662
2021年10月25日 08:32:04 +01:00
{% if nova_libvirtd_listen_tls == 1 %}
live_migration_with_native_tls = true
live_migration_scheme = tls
{% else %}
live_migration_uri = "qemu+ssh://nova@%s/system?no_verify=1&keyfile={{ nova_system_home_folder }}/.ssh/id_rsa"
live_migration_tunnelled = True
Enable TLS for live migrations Instead of using SSH to live migrate VM's use TLS as this is more secure and SSH migrations are deprecated. https://docs.openstack.org/nova/xena/admin/secure-live-migration-with-qemu-native-tls.html A pre-existing PKI (Public Key Infrastruture) setup is required. TLS live migrations require that all compute hosts can communcate with each other on port 16514 and port range 49152 to 49261. To enable TLS live migrations, both libvirt and QEMU require server and client certificates, the server certicicates is used to verify servers and the client cert is used by servers to authenticate clients. A single cert is created by the pki role, that can be used by both libvirt and QEMU for both client and server auth. The client, server and CA certifcates need to installed in a number of locations on each compute host: * For Libvirt https://libvirt.org/tlscerts.html * For QEMU https://github.com/libvirt/libvirt/blob/master/src/qemu/qemu.conf Depends-On: https://review.opendev.org/c/openstack/ansible-role-pki/+/815007 Depends-On: https://review.opendev.org/c/openstack/ansible-role-pki/+/815849 Depends-On: https://review.opendev.org/c/openstack/ansible-role-pki/+/816857 Change-Id: Iddbe8764bb6d3cd3eaee122b2d5ddc02fa3f7662
2021年10月25日 08:32:04 +01:00
{% endif %}
Use Nova management IP for live migrations Our installation uses separate networks for deployment and for OpenStack management. By default, live migrations depend upon a hostname, which resolves to an IP on our (lower speed) deployment network. Dependent on the deployment, the hostname may not be a reliable mechanism for determining the correct network for live migrations. Nova exposes a live_migration_inbound_addr which can be used to correct this. This patch defaults the inbound_addr to match the Nova service bind address, but provides the option for it to be overwritten through variables. Whilst the Nova docs suggest that live_migration_inbound_addr is ignored when live_migration_tunnelled is enabled this appears to be inaccurate from our testing. Change-Id: Iff6326f72971364d275ea999418d476007690ef8 Related-Bug: #1576724
2020年07月15日 10:48:37 +01:00
live_migration_inbound_addr = {{ nova_libvirt_live_migration_inbound_addr }}
{% endif %}
hw_disk_discard = {{ nova_libvirt_hw_disk_discard }}
disk_cachemodes = {{ nova_libvirt_disk_cachemodes }}
{% endif %}
{% if nova_barbican_enabled %}
[barbican]
auth_endpoint = {{ keystone_service_internaluri }}/v3
send_service_user_token = {{ nova_service_token_roles_required | bool }}
[key_manager]
backend = barbican
auth_type = "password"
username = {{ nova_service_user_name }}
password = {{ nova_service_password }}
project_name = {{ nova_service_project_name }}
user_domain_id = {{ nova_service_user_domain_id }}
project_domain_id = {{ nova_service_project_domain_id }}
auth_url = {{ keystone_service_adminurl }}
insecure = {{ keystone_service_adminuri_insecure | bool }}
{% endif %}
[wsgi]
api_paste_config = /etc/nova/api-paste.ini
[api]
vendordata_jsonfile_path = /etc/nova/vendor_data.json
dhcp_domain = {{ nova_dhcp_domain }}
[scheduler]
workers = {{ nova_scheduler_workers | default(nova_api_threads) }}
max_attempts = {{ nova_scheduler_max_attempts }}
discover_hosts_in_cells_interval = {{ nova_discover_hosts_in_cells_interval }}
[filter_scheduler]
max_io_ops_per_host = {{ nova_max_io_ops_per_host }}
ram_weight_multiplier = {{ nova_ram_weight_multiplier }}
enabled_filters = {{ _nova_scheduler_filters | join(',') }}
host_subset_size = {{ nova_scheduler_host_subset_size }}
track_instance_changes = {{ nova_scheduler_tracks_instance_changes }}
Implement data migrations for rolling upgrades In order to cater for artifact-based installed, and rolling upgrades, this patch implements a set of local facts to inform the online migrations task. The 'nova_all_software_updated' variable will be set by the playbook on each run to ensure that the online migrations only happen once all venvs are homogenous. This ensures that the playbook can be executed in a serialised fashion and the data will not be corrupted. The ``upgrade_levels`` setting for ``compute`` is set to ``auto`` to ensure that a mixed RPC version deployment can operate properly when doing a rolling upgrade as suggested by [1]. Additional changes are made to improve the role's ability to be executed using serialised playbooks. Finally, the nova-manage command references to the config file location have been removed as they refer to the default location. [1] https://docs.openstack.org/developer/nova/upgrade.html Change-Id: I08e5a7f0ce526b11aa52c35ee29c458954a5f22d
2017年06月30日 19:35:01 +01:00
[upgrade_levels]
compute=auto
{% if nova_enabled_mdev_types | length > 0 or discovered_mdev_types is defined %}
[devices]
enabled_mdev_types = {{ nova_enabled_mdev_types | map(attribute='type') | list | default(discovered_mdev_types, true) | unique | join(',') }}
{% for record in nova_enabled_mdev_types | selectattr('address', 'defined') | list %}
[mdev_{{ record.type }}]
device_addresses = {{ (record.address is string) | ternary(record.address, record.address | join(',')) }}
{% endfor %}
{% endif %}
{% if nova_pci_passthrough_whitelist or nova_pci_alias %}
[pci]
{% if nova_pci_passthrough_whitelist %}
# White list of PCI devices available to VMs.
passthrough_whitelist = {{ nova_pci_passthrough_whitelist }}
{% endif %}
{% if nova_pci_alias %}
# PCI Alias
{% for item in nova_pci_alias %}
alias = {{item}}
{% endfor %}
{% endif %}
{% endif %}