Skip to content

Commit

Permalink
Identifying rabbit port based on openstack HA or contrail HA
Browse files Browse the repository at this point in the history 
setup.

Change-Id: I0bc98c367ed4a69998626fea12132f9d2a9ce213
Closes-Bug: 1616178
(cherry picked from commit be82730)

Make the /etc/contrail/ssl/ directory before copying the ssl certs to the
other cfgm nodes from the first cfgm.

Change-Id: I39022479804f9323b7b5235ce60844d891444dd0
Closes-Bug: 1645433
(cherry picked from commit a2b89e6)
(cherry picked from commit 08bae9e)

fix ceilometer.conf to point to https auth uri in a ssl enabled keystone setup.
fix keystone haproxy backend syntax to support ssl.

(cherry picked from commit bb6bd44)

(cherry picked from commit 0ddd551)

Closes-Bug: 1647243
Change-Id: I06740c325a3864b122419ebb7fe77b86cefa23b9
(cherry picked from commit e122c30)

Removing heartbeat parmameter, so that the default value 60 sec will be used.
If we need to override this value in rabbitmq.config, we also need to set
'rabbit_health_check_interval' in the contrail-api.conf to twice the value of
heartbeat set in rabbitmq.config.

Change-Id: I22fab8a3cc7a0b076ae3f642d16029ba5dab8e2f
Partial-Bug: 1639014
(cherry picked from commit 0697528)

zookeeper is moved to cfgm and cassandra will be running
in both cfgm and database nodes, So making backup_restore
procedure to accomadate this.

Change-Id: I66121bbc28609e8c3d48ba52586580d28606aae9
Closs-Bug: 1636344
(cherry picked from commit 04817d0)

Ceilometer config file needs to be populated with
keystone certs or insecure flag for it to communicate
with SSL enabled keystone and check for ceilometer support
in respective nodes.

Change-Id: If736de02b73aefeb477cc73a6c9e92cbf2ec8f38
Closes-Bug: 1645570
(cherry picked from commit 08abf91)

We have to provison  both keystone/config-api as https in contrail-cloud deployment.
In contrail-networking deployments we have option of provisioning config-api
with https and using keystone which is pre provisioned  with http.
The deployment of keystone with https and config-api with http is not recommended.

Change-Id: If66b897ba95562150920bcd9843895fb48af743d
Closes-Bug: 639074
(cherry picked from commit 93eccbc)

SSL copy to other nodes in the HA cluster fails during parallel
execution, Fixing it by creating seperate temp files during copy.

Change-Id: I8f25ebaf5970403950e5966fa04ea09810633dfe
Closes-Bug: 1649470
(cherry picked from commit 09a3928)

Do not override the user specified cfgm host.

Change-Id: I68ab3e474cca8053cead501a93e29b80017f317b
Closes-Bug: 1649679
(cherry picked from commit 5e79790)

Haproxy fails to start as the keystone certs are not created before
starting haproxy in a HA setup. Fix is to create keystone ssl
certificates before configuring haproxy and skip recreating
certs during openstack setup.

Change-Id: Ibb53ad16c0222ebd3685a03c09398a1067464664
Closes-Bug: 1649787
(cherry picked from commit b27b0fa)
(cherry picked from commit a592dc6)
  • Loading branch information
@cijohnson
cijohnson committed Dec 15, 2016
1 parent e8a8756 commit 94c45dc
Show file tree
Hide file tree
Showing 8 changed files with 164 additions and 57 deletions.
8 changes: 4 additions & 4 deletions fabfile/tasks/backup_restore.py
View file
Expand Up @@ -163,7 +163,7 @@ def backup_nova_instance_data():
# end backup_nova_instance_data


@roles('database')
@roles('database', 'cfgm')
def backup_cassandra(db_datas, store_db='local', cassandra_backup='full'):
"""Backup cassandra data in all databases """
global backup_path, final_dir
Expand Down Expand Up @@ -337,7 +337,7 @@ def backup_instance_image(db_datas, store_db='local'):
sudo(remote_bk_cmd)
# end backup_instances_images

@roles('database')
@roles('database', 'cfgm')
def backup_zookeeper(db_datas, store_db='local'):
"""Backup zookeeper data to all database nodes """
host = env.host_string
Expand Down Expand Up @@ -692,7 +692,7 @@ def restart_analytics():
time.sleep(5)

@task
@roles('database')
@roles('database', 'cfgm')
def restore_cassandra(backup_data_path='', store_db='local',cassandra_backup='full'):
"""Restore cassandra data to all databases .and usuage is restore_cassadra_db """
global backup_path
Expand Down Expand Up @@ -905,7 +905,7 @@ def restore_instance_image(backup_data_path, store_db='local'):

# end restore_glance_images

@roles('database')
@roles('database', 'cfgm')
def restore_zookeeper(backup_data_path, store_db='local'):
"""Restore zookeeper data to all database nodes """
global backup_path
Expand Down
59 changes: 50 additions & 9 deletions fabfile/tasks/ha.py
View file
Expand Up @@ -4,13 +4,20 @@
from fabfile.templates import openstack_haproxy, collector_haproxy
from fabfile.tasks.helpers import enable_haproxy
from fabfile.tasks.rabbitmq import purge_node_from_rabbitmq_cluster
from fabfile.utils.fabos import detect_ostype, get_as_sudo, is_package_installed
from fabfile.utils.host import get_authserver_ip, get_control_host_string,\
hstr_to_ip, get_from_testbed_dict, get_service_token, get_env_passwords,\
get_openstack_internal_vip, get_openstack_external_vip,\
get_contrail_internal_vip, get_contrail_external_vip, \
get_openstack_internal_virtual_router_id, get_contrail_internal_virtual_router_id, \
get_openstack_external_virtual_router_id, get_contrail_external_virtual_router_id
from fabfile.utils.fabos import (
detect_ostype, get_as_sudo, is_package_installed,
)
from fabfile.utils.host import (
get_authserver_ip, get_control_host_string, hstr_to_ip,
get_from_testbed_dict, get_service_token, get_env_passwords,
get_openstack_internal_vip, get_openstack_external_vip,
get_contrail_internal_vip, get_contrail_external_vip,
get_openstack_internal_virtual_router_id,
get_contrail_internal_virtual_router_id,
get_openstack_external_virtual_router_id,
get_contrail_external_virtual_router_id,
keystone_ssl_enabled,
)
from fabfile.utils.cluster import get_orchestrator
from fabfile.tasks.provision import fixup_restart_haproxy_in_all_cfgm
from fabfile.utils.commandline import frame_vnc_database_cmd, frame_vnc_config_cmd
Expand Down Expand Up @@ -416,6 +423,8 @@ def fixup_restart_haproxy_in_openstack():

@task
def fixup_restart_haproxy_in_openstack_node(*args):
keystone_frontend = 'frontend openstack-keystone *:5000'
keystone_admin_frontend = 'frontend openstack-keystone-admin *:35357'
keystone_server_lines = ''
keystone_admin_server_lines = ''
glance_server_lines = ''
Expand All @@ -431,16 +440,44 @@ def fixup_restart_haproxy_in_openstack_node(*args):
barbican_server_lines = ''
space = ' ' * 3

if keystone_ssl_enabled():
keystone_frontend_lines = [
'frontend openstack-keystone',
'%s bind *:5000 ssl crt /etc/keystone/ssl/certs/keystonecertbundle.pem' % space,
'%s option http-server-close' % space,
'%s option forwardfor' % space,
'%s reqadd X-Forwarded-Proto:\ https' % space,
'%s reqadd X-Forwarded-Port:\ 5000' % space,
]
keystone_frontend = '\n'.join(keystone_frontend_lines)
keystone_admin_frontend_lines = [
'frontend openstack-keystone-admin',
'%s bind *:35357 ssl crt /etc/keystone/ssl/certs/keystonecertbundle.pem' % space,
'%s option http-server-close' % space,
'%s option forwardfor' % space,
'%s reqadd X-Forwarded-Proto:\ https' % space,
'%s reqadd X-Forwarded-Port:\ 35357' % space,
]
keystone_admin_frontend = '\n'.join(keystone_admin_frontend_lines)

for host_string in env.roledefs['openstack']:
server_index = env.roledefs['openstack'].index(host_string) + 1
mgmt_host_ip = hstr_to_ip(host_string)
host_ip = hstr_to_ip(get_control_host_string(host_string))
keystone_server_lines +=\
'%s server %s %s:6000 check inter 2000 rise 2 fall 1\n'\
'%s server %s %s:6000 check inter 2000 rise 2 fall 1'\
% (space, host_ip, host_ip)
if keystone_ssl_enabled():
keystone_server_lines += " ssl verify none\n"
else:
keystone_server_lines += "\n"
keystone_admin_server_lines +=\
'%s server %s %s:35358 check inter 2000 rise 2 fall 1\n'\
'%s server %s %s:35358 check inter 2000 rise 2 fall 1'\
% (space, host_ip, host_ip)
if keystone_ssl_enabled():
keystone_admin_server_lines += " ssl verify none\n"
else:
keystone_admin_server_lines += "\n"
glance_server_lines +=\
'%s server %s %s:9393 check inter 2000 rise 2 fall 1\n'\
% (space, host_ip, host_ip)
Expand Down Expand Up @@ -488,7 +525,9 @@ def fixup_restart_haproxy_in_openstack_node(*args):

for host_string in env.roledefs['openstack']:
haproxy_config = openstack_haproxy.template.safe_substitute({
'__keystone_frontend__' : keystone_frontend,
'__keystone_backend_servers__' : keystone_server_lines,
'__keystone_admin_frontend__' : keystone_admin_frontend,
'__keystone_admin_backend_servers__' : keystone_admin_server_lines,
'__glance_backend_servers__' : glance_server_lines,
'__heat_backend_servers__' : heat_server_lines,
Expand Down Expand Up @@ -1073,6 +1112,8 @@ def setup_ha():
execute('fix_wsrep_cluster_address')
execute('setup_cmon_schema')
execute('fix_restart_xinetd_conf')
if keystone_ssl_enabled():
execute("setup_keystone_ssl_certs")
execute('fixup_restart_haproxy_in_openstack')
execute('setup_glance_images_loc')
execute('fix_memcache_conf')
Expand Down
7 changes: 7 additions & 0 deletions fabfile/tasks/helpers.py
View file
Expand Up @@ -1316,6 +1316,13 @@ def pre_check():
print "\t 2.Same set of nodes or"
print "\t 3.cfgm should be subset of database nodes."
exit(1)
if (env.roledefs['openstack'] and # Openstack defined
[os_node for os_node in env.roledefs['openstack']
if os_node in env.roledefs['all']] and # Openstack in all role(contrail-cloud deployment)
keystone_ssl_enabled() and # ssl enabled for keystone
not apiserver_ssl_enabled()): # ssl disabled for apiserver
print "\nERROR: \n\tIn contrail cloud deployment, recommended to deploy both keystone and apiserver with ssl."
exit(1)


def role_to_ip_dict(role=None):
Expand Down
78 changes: 53 additions & 25 deletions fabfile/tasks/provision.py
View file
Expand Up @@ -676,6 +676,8 @@ def fixup_ceilometer_conf_common():
sudo("openstack-config --set %s database connection %s" % (conf_file, value))
amqp_server_ip = get_openstack_amqp_server()
sudo("openstack-config --set %s DEFAULT rabbit_host %s" % (conf_file, amqp_server_ip))
amqp_server_port = get_openstack_amqp_port()
sudo("openstack-config --set %s DEFAULT rabbit_port %s" % (conf_file, amqp_server_port))
value = "/var/log/ceilometer"
sudo("openstack-config --set %s DEFAULT log_dir %s" % (conf_file, value))
value = "a74ca26452848001921c"
Expand All @@ -688,6 +690,9 @@ def fixup_ceilometer_conf_common():
#end fixup_ceilometer_conf_common

def fixup_ceilometer_conf_keystone(openstack_ip):
auth_protocol = 'http'
if keystone_ssl_enabled():
auth_protocol = 'https'
conf_file = '/etc/ceilometer/ceilometer.conf'
with settings(warn_only=True):
authtoken_config = sudo("grep '^auth_host =' /etc/ceilometer/ceilometer.conf").succeeded
Expand All @@ -696,15 +701,19 @@ def fixup_ceilometer_conf_keystone(openstack_ip):
sudo("%s admin_password CEILOMETER_PASS" % config_cmd)
sudo("%s admin_user ceilometer" % config_cmd)
sudo("%s admin_tenant_name service" % config_cmd)
sudo("%s auth_uri http://%s:5000" % (config_cmd, openstack_ip))
sudo("%s auth_protocol http" % config_cmd)
sudo("%s auth_uri %s://%s:5000" % (config_cmd, auth_protocol, openstack_ip))
sudo("%s auth_protocol %s" % (config_cmd, auth_protocol))
sudo("%s auth_port 35357" % config_cmd)
sudo("%s auth_host %s" % (config_cmd, openstack_ip))
if keystone_ssl_enabled():
sudo("%s insecure True" % config_cmd)
config_cmd = "openstack-config --set %s service_credentials" % conf_file
sudo("%s os_password CEILOMETER_PASS" % config_cmd)
sudo("%s os_tenant_name service" % config_cmd)
sudo("%s os_username ceilometer" % config_cmd)
sudo("%s os_auth_url http://%s:5000/v2.0" % (config_cmd, openstack_ip))
sudo("%s os_auth_url %s://%s:5000/v2.0" % (config_cmd, auth_protocol, openstack_ip))
if keystone_ssl_enabled():
sudo("%s insecure True" % config_cmd)
#end fixup_ceilometer_conf_keystone

def fixup_ceilometer_pipeline_conf(analytics_ip):
Expand Down Expand Up @@ -941,6 +950,8 @@ def setup_ceilometer():
@task
def setup_ceilometer_node(*args):
"""Provisions ceilometer services in one or list of nodes. USAGE: fab setup_ceilometer_node:user@1.1.1.1,user@2.2.2.2"""
if not is_ceilometer_provision_supported():
return
analytics_ip = hstr_to_ip(env.roledefs['collector'][0])
for host_string in args:
self_host = get_control_host_string(host_string)
Expand Down Expand Up @@ -986,7 +997,7 @@ def setup_ceilometer_node(*args):
ceilometer_service_exists = sudo("source /etc/contrail/openstackrc;keystone --insecure service-list | grep ceilometer").succeeded
if not ceilometer_service_exists:
sudo("source /etc/contrail/openstackrc;keystone --insecure service-create --name=ceilometer --type=metering --description=\"Telemetry\"")
sudo("source /etc/contrail/openstackrc;keystone --insecure endpoint-create --service-id=$(keystone service-list | awk '/ metering / {print $2}') --publicurl=http://%s:8777 --internalurl=http://%s:8777 --adminurl=http://%s:8777 --region=RegionOne" %(self_ip, self_ip, self_ip))
sudo("source /etc/contrail/openstackrc;keystone --insecure endpoint-create --service-id=$(keystone --insecure service-list | awk '/ metering / {print $2}') --publicurl=http://%s:8777 --internalurl=http://%s:8777 --adminurl=http://%s:8777 --region=RegionOne" %(self_ip, self_ip, self_ip))
# Fixup ceilometer pipeline cfg
fixup_ceilometer_pipeline_conf(analytics_ip)
for svc in ceilometer_services:
Expand All @@ -1004,6 +1015,8 @@ def setup_network_service():
def setup_network_service_node(*args):
"""Provisions network services in one or list of nodes.
USAGE: fab setup_network_service_node:user@1.1.1.1,user@2.2.2.2"""
if not is_ceilometer_provision_supported():
return
conf_file = '/etc/neutron/neutron.conf'
neutron_config = {'DEFAULT' : {'notification_driver' : 'neutron.openstack.common.notifier.rpc_notifier'}
}
Expand All @@ -1014,21 +1027,25 @@ def setup_network_service_node(*args):
sudo("service neutron-server restart")
#end setup_network_service_node

@task
@roles('openstack')
def setup_identity_service():
"""Provisions identity services in openstack nodes"""
if env.roledefs['openstack']:
execute("setup_identity_service_node", env.host_string)

@task
def setup_identity_service_node(*args):
"""Provisions identity services in one or list of nodes.
USAGE: fab setup_identity_service_node:user@1.1.1.1,user@2.2.2.2"""
if not is_ceilometer_provision_supported():
return
amqp_server_ip = get_openstack_amqp_server()
rabbit_port = "5672"

# If HA is enabled, then use the frontend HAProxy Rabbit port
if get_openstack_internal_vip():
rabbit_port = "5673"

conf_file = '/etc/keystone/keystone.conf'
keystone_configs = {'DEFAULT' : {'notification_driver' : 'messaging',
'rabbit_host' : '%s' % amqp_server_ip,
'rabbit_port' : '%s' % rabbit_port }
'rabbit_port' : '%s' % get_openstack_amqp_port() }
}
for host_string in args:
for section, key_values in keystone_configs.iteritems():
Expand All @@ -1037,16 +1054,26 @@ def setup_identity_service_node(*args):
sudo("service keystone restart")
#end setup_identity_service_node

@task
@roles('openstack')
def setup_image_service():
"""Provisions image services in openstack nodes"""
if env.roledefs['openstack']:
execute("setup_image_service_node", env.host_string)

@task
def setup_image_service_node(*args):
"""Provisions image services in one or list of nodes. USAGE: fab setup_image_service_node:user@1.1.1.1,user@2.2.2.2"""
if not is_ceilometer_provision_supported():
return
amqp_server_ip = get_openstack_amqp_server()
for host_string in args:
openstack_sku = get_openstack_sku()

glance_configs = {'DEFAULT' : {'notification_driver' : 'messaging',
'rpc_backend' : 'rabbit',
'rabbit_host' : '%s' % amqp_server_ip,
'rabbit_port' : '%s' % get_openstack_amqp_port(),
'rabbit_password' : 'guest'}
}
if openstack_sku == 'havana':
Expand All @@ -1073,12 +1100,6 @@ def setup_openstack():
execute("setup_openstack_node", env.host_string)
if is_package_installed('contrail-openstack-dashboard'):
execute('setup_contrail_horizon_node', env.host_string)
if is_ceilometer_provision_supported():
if env.host_string == env.roledefs['openstack'][0]:
execute("setup_ceilometer_node", env.host_string)
execute("setup_network_service") #Provisions in cfgm node
execute("setup_image_service_node", env.host_string)
execute("setup_identity_service_node", env.host_string)

@task
@roles('openstack')
Expand Down Expand Up @@ -1144,7 +1165,8 @@ def setup_openstack_node(*args):
cmd = frame_vnc_openstack_cmd(host_string)
# Execute the provision openstack script
with settings(host_string=host_string):
if keystone_ssl_enabled():
# Certs are already created in setup_ha task
if keystone_ssl_enabled() and not get_openstack_internal_vip():
execute("setup_keystone_ssl_certs_node", host_string)
with cd(INSTALLER_DIR):
sudo(cmd)
Expand Down Expand Up @@ -1621,7 +1643,7 @@ def prov_config_node(*args, **kwargs):
oper = kwargs.get('oper', 'add')
tgt_node = kwargs.get('tgt_node', None)
cfgm_host = env.roledefs['cfgm'][0]
cfgm_ip = hstr_to_ip(get_control_host_string(cfgm_host))
cfgm_ip = get_contrail_internal_vip() or hstr_to_ip(get_control_host_string(cfgm_host))
cfgm_host_password = get_env_passwords(cfgm_host)
for host_string in args:
with settings(host_string=host_string,
Expand Down Expand Up @@ -1656,7 +1678,7 @@ def prov_database_node(*args, **kwargs):
oper = kwargs.get('oper', 'add')
tgt_node = kwargs.get('tgt_node', None)
cfgm_host = env.roledefs['cfgm'][0]
cfgm_ip = hstr_to_ip(get_control_host_string(cfgm_host))
cfgm_ip = get_contrail_internal_vip() or hstr_to_ip(get_control_host_string(cfgm_host))
cfgm_host_password = get_env_passwords(cfgm_host)
for host_string in args:
with settings(host_string=host_string,
Expand Down Expand Up @@ -1692,7 +1714,7 @@ def prov_analytics_node(*args, **kwargs):
oper = kwargs.get('oper', 'add')
tgt_node = kwargs.get('tgt_node', None)
cfgm_host = env.roledefs['cfgm'][0]
cfgm_ip = hstr_to_ip(get_control_host_string(cfgm_host))
cfgm_ip = get_contrail_internal_vip() or hstr_to_ip(get_control_host_string(cfgm_host))
cfgm_host_password = get_env_passwords(cfgm_host)
for host_string in args:
with settings(host_string=host_string,
Expand Down Expand Up @@ -1726,8 +1748,12 @@ def prov_control_bgp():
def prov_control_bgp_node(*args, **kwargs):
oper = kwargs.get('oper', 'add')
tgt_node = kwargs.get('tgt_node', None)
cfgm_host = kwargs.get('cfgm_host', env.roledefs['cfgm'][0])
cfgm_ip = hstr_to_ip(get_control_host_string(cfgm_host))
cfgm_host = kwargs.get('cfgm_host', None)
if cfgm_host:
cfgm_ip = hstr_to_ip(get_control_host_string(cfgm_host))
else:
cfgm_host = env.roledefs['cfgm'][0]
cfgm_ip = get_contrail_internal_vip() or hstr_to_ip(get_control_host_string(cfgm_host))
cfgm_host_password = get_env_passwords(cfgm_host)
for host_string in args:
with settings(host_string=host_string,
Expand Down Expand Up @@ -1771,7 +1797,7 @@ def prov_external_bgp_node(*args):
for host_string in args:
with settings(host_string=host_string,
password=get_env_passwords(host_string)):
cfgm_ip = hstr_to_ip(get_control_host_string(env.roledefs['cfgm'][0]))
cfgm_ip = get_contrail_internal_vip() or hstr_to_ip(get_control_host_string(env.roledefs['cfgm'][0]))
for ext_bgp in testbed.ext_routers:
ext_bgp_name = ext_bgp[0]
ext_bgp_ip = ext_bgp[1]
Expand Down Expand Up @@ -2377,8 +2403,10 @@ def setup_orchestrator():
if orch == 'openstack':
execute('increase_ulimits')
execute('setup_openstack')
if get_openstack_internal_vip():
execute('sync_keystone_ssl_certs')
execute("setup_ceilometer")
execute("setup_network_service") #Provisions in cfgm node
execute("setup_image_service",)
execute("setup_identity_service")
execute('verify_openstack')
#setup_vcenter can be called outside of setup_all and need not be below. So commenting.
#elif orch == 'vcenter':
Expand Down

0 comments on commit 94c45dc

Please sign in to comment.