From e2c7b1305ca8495065dcf40fd2092d7c698dd6ea Mon Sep 17 00:00:00 2001 From: "Suren A. Chilingaryan" Date: Tue, 20 Mar 2018 15:47:51 +0100 Subject: Local volumes and StatefulSet to provision Master/Slave MySQL and Galera cluster --- roles/ands_network/defaults/main.yml | 2 ++ roles/ands_network/files/galera.xml | 10 +++++++ roles/ands_network/files/netpipe.xml | 6 ++++ roles/ands_network/tasks/add_names.yml | 28 +++++++++++++++++++ roles/ands_network/tasks/common.yml | 1 - roles/ands_network/tasks/firewall.yml | 32 ++++++++++++++++++++++ roles/ands_network/tasks/firewall_service.yml | 13 +++++++++ roles/ands_network/tasks/nm_configure.yml | 15 +++++++++- .../ands_network/tasks/nm_configure_connection.yml | 31 ++++++++++++++++----- 9 files changed, 129 insertions(+), 9 deletions(-) create mode 100644 roles/ands_network/files/galera.xml create mode 100644 roles/ands_network/files/netpipe.xml create mode 100644 roles/ands_network/tasks/add_names.yml create mode 100644 roles/ands_network/tasks/firewall.yml create mode 100644 roles/ands_network/tasks/firewall_service.yml (limited to 'roles/ands_network') diff --git a/roles/ands_network/defaults/main.yml b/roles/ands_network/defaults/main.yml index 139e8b3..0170370 100644 --- a/roles/ands_network/defaults/main.yml +++ b/roles/ands_network/defaults/main.yml @@ -1 +1,3 @@ configure_network: "{{ ands_configure_network | default(false) }}" +firewall_template_path: "{{ ands_paths.provision }}/firewall/{{ ansible_hostname }}" +firewall_services: [ 'galera', 'netpipe' ] \ No newline at end of file diff --git a/roles/ands_network/files/galera.xml b/roles/ands_network/files/galera.xml new file mode 100644 index 0000000..15f908b --- /dev/null +++ b/roles/ands_network/files/galera.xml @@ -0,0 +1,10 @@ + + + MySQL/Galera + MySQL/Galera Database Server + + + + + + diff --git a/roles/ands_network/files/netpipe.xml b/roles/ands_network/files/netpipe.xml new file mode 100644 index 0000000..0e7f355 --- /dev/null +++ b/roles/ands_network/files/netpipe.xml @@ -0,0 +1,6 @@ + + + NetPIPE + NetPIPE network benchmark + + diff --git a/roles/ands_network/tasks/add_names.yml b/roles/ands_network/tasks/add_names.yml new file mode 100644 index 0000000..3edde38 --- /dev/null +++ b/roles/ands_network/tasks/add_names.yml @@ -0,0 +1,28 @@ +# Currently EXCLUDED +# Kind of post-install. We can include this in maitain later. + +# We should not do it before Gluster peers are probed, otherwise everything will fail. +# Some peers will have names and others IPs. +- name: Configure all storage hostnames in /etc/hosts + lineinfile: dest="/etc/hosts" line="{{ ip }} {{ fqdn }} {{ hostname }}" regexp="{{ fqdn }}" state="present" + when: + - hostvars[item]['ands_facts_configured'] is defined + vars: + ip: "{{ hostvars[item]['ands_storage_ip'] }}" + hostname: "{{ hostvars[item]['ands_hostname_storage'] }}" + fqdn: "{{ hostvars[item]['ands_hostname_storage'] ~ ands_inner_dot_domain }}" + with_inventory_hostnames: + - nodes + - new_nodes + +- name: Configure all public hostnames in /etc/hosts + lineinfile: dest="/etc/hosts" line="{{ ip }} {{ fqdn }} {{ hostname }}" regexp="{{ fqdn }}" state="present" + when: + - hostvars[item]['ands_facts_configured'] is defined + vars: + ip: "{{ hostvars[item]['ands_openshift_public_ip'] }}" + hostname: "{{ hostvars[item]['ands_hostname_public'] }}" + fqdn: "{{ hostvars[item]['ands_hostname_public'] ~ ands_inner_dot_domain }}" + with_inventory_hostnames: + - nodes + - new_nodes diff --git a/roles/ands_network/tasks/common.yml b/roles/ands_network/tasks/common.yml index f2fda00..940cde7 100644 --- a/roles/ands_network/tasks/common.yml +++ b/roles/ands_network/tasks/common.yml @@ -7,7 +7,6 @@ # - nodes # - new_nodes - # This will not work properly unless 'ands_facts' are executed on all nodes.... This is checked by evaluating if 'ands_openshift_fqdn' is defined - name: Configure all cluster hostnames in /etc/hosts lineinfile: dest="/etc/hosts" line="{{ ip }} {{ fqdn }} {{ hostname }}" regexp="{{ fqdn }}" state="present" diff --git a/roles/ands_network/tasks/firewall.yml b/roles/ands_network/tasks/firewall.yml new file mode 100644 index 0000000..d5ba5f3 --- /dev/null +++ b/roles/ands_network/tasks/firewall.yml @@ -0,0 +1,32 @@ +- name: Ensure firewall template directory exists + file: path="{{ firewall_template_path }}" state="directory" mode=0644 owner=root group=root + +#Just in case we already added but not reloaded yet +#- name: Reload firewalld rules +# shell: firewall-cmd --reload + +- name: Get list of existing firewalld services + shell: "firewall-cmd --get-services | tr ' ' '\n'" + changed_when: false + register: services + +- name: Configure missing firewalld services + include_tasks: firewall_service.yml + with_items: "{{ firewall_services }}" + vars: + servicelist: "{{ services.stdout_lines }}" + loop_control: + loop_var: service + +- name: Reload firewalld rules + shell: firewall-cmd --reload + +- name: Enable MySQL and Galera services if ands_hostnet_db is enabled + firewalld: service="{{ item }}" state="enabled" permanent="true" immediate="true" + when: ands_hostnet_db | default(false) + with_items: + - mysql + - galera + +- name: Reload firewalld rules + shell: firewall-cmd --reload diff --git a/roles/ands_network/tasks/firewall_service.yml b/roles/ands_network/tasks/firewall_service.yml new file mode 100644 index 0000000..98bc866 --- /dev/null +++ b/roles/ands_network/tasks/firewall_service.yml @@ -0,0 +1,13 @@ +- name: "Copy firewalld service '{{ service }}'" + copy: src="{{ service }}.xml" dest="{{ firewall_template_path }}/{{ service }}.xml" owner=root group=root mode="0644" + register: result + +- name: "Delete old version of firewalld service '{{ service }}'" + command: "firewall-offline-cmd --remove-service={{ service }}" + when: + - service in servicelist + - result | changed + +- name: "Create firewalld service '{{ service }}'" + command: "firewall-offline-cmd --new-service-from-file='{{ firewall_template_path }}/{{ service }}.xml' --name={{ service }}" + when: (service not in servicelist) or (result | changed) diff --git a/roles/ands_network/tasks/nm_configure.yml b/roles/ands_network/tasks/nm_configure.yml index 4482705..57e40ca 100644 --- a/roles/ands_network/tasks/nm_configure.yml +++ b/roles/ands_network/tasks/nm_configure.yml @@ -1,4 +1,3 @@ - - name: install needed network manager libs yum: name='{{ item }}' state=installed with_items: @@ -21,6 +20,16 @@ cidr: "{{ ands_storage_cidr }}" force: true +- name: configure bridged openshift nework + include_tasks: nm_configure_connection.yml + vars: + bridge: "{{ ands_bridge }}" + name: "openshift" + iface: "{{ ands_inner_interface }}" + cidr: "{{ ands_openshift_cidr }}" + force: true + when: ands_enable_cnr | default(false) + - name: configure openshift nework include_tasks: nm_configure_connection.yml vars: @@ -28,6 +37,8 @@ iface: "{{ ands_inner_interface }}" cidr: "{{ ands_openshift_cidr }}" force: true + when: not (ands_enable_cnr | default(false)) + - name: configure public nework include_tasks: nm_configure_connection.yml @@ -37,3 +48,5 @@ cidr: "{{ ands_openshift_public_cidr }}" alias: true +- name: Configure firewall + include_tasks: firewall.yml diff --git a/roles/ands_network/tasks/nm_configure_connection.yml b/roles/ands_network/tasks/nm_configure_connection.yml index 18fc91e..9354fbf 100644 --- a/roles/ands_network/tasks/nm_configure_connection.yml +++ b/roles/ands_network/tasks/nm_configure_connection.yml @@ -1,15 +1,16 @@ -- name: "detect nm connection corresponding to interface '{{ iface }}'" +- name: "detect nm connection corresponding to interface '{{ bridge | default(iface) }}'" shell: "nmcli d show {{ iface | quote }} | grep CONNECTION | cut -d ':' -f 2- | sed -E -e 's/^[[:space:]]+//' | grep '^[[:alpha:]]'" register: conres failed_when: false changed_when: false -- name: "check if the requested ip '{{ cidr }}' is present on the interface '{{ iface }}'" +- name: "check if the requested ip '{{ cidr }}' is present on the interface '{{ biface }}'" set_fact: ip_present: "{{ cidr | ipaddr('address') in ips }}" vars: - eth: "{{ hostvars[inventory_hostname]['ansible_' + iface] | default({}) }}" + biface: "{{ bridge | default(iface) }}" + eth: "{{ hostvars[inventory_hostname]['ansible_' + biface] | default({}) }}" ipv4: "{{ eth['ipv4'] | default({}) }}" q: "{{ eth | json_query('ipv4_secondaries[*].address') }}" sec: "{{ ((q == ands_none) or (q == '')) | ternary([], q) }}" @@ -27,9 +28,24 @@ - not (alias | default(false)) - not ip_present -- name: "configure storage network interface '{{ iface }}' to '{{ cidr }}'" +- name: "create bridge '{{ bridge }}' with cidr '{{ cidr }}'" + command: "nmcli connection add type bridge ifname {{ bridge | quote }} con-name {{ name }} ip4 {{ cidr }}" + when: + - bridge is defined + - (conres.rc != 0) or (not (delres | skipped)) + - (conres.rc != 0) or (not (alias | default(false))) + +- name: "connect bridge '{{ bridge }}' to interface '{{ iface }}'" + command: "nmcli connection add type bridge-slave ifname {{ iface | quote }} master {{ bridge | quote }}" + when: + - bridge is defined + - (conres.rc != 0) or (not (delres | skipped)) + - (conres.rc != 0) or (not (alias | default(false))) + +- name: "configure network interface '{{ iface }}' to '{{ cidr }}'" command: "nmcli connection add type infiniband ifname {{ iface | quote }} con-name {{ name }} ip4 {{ cidr }}" when: + - bridge is not defined - (conres.rc != 0) or (not (delres | skipped)) - (conres.rc != 0) or (not (alias | default(false))) @@ -41,10 +57,11 @@ - conres.rc == 0 - not ip_present - -- name: "add ip alias '{{ cidr }}' to network interface '{{ iface }}'" - command: "nmcli connection up {{ conres.stdout | quote }}" +- name: "start connection {{ cname }}" + command: "nmcli connection up {{ cname | quote }}" register: alres + vars: + cname: "{{ (conres.stdout == '') | ternary(name, conres.stdout) }}" when: - not(alres | skipped) - alres | succeeded -- cgit v1.2.3