summaryrefslogtreecommitdiffstats
path: root/roles/openstack-stack
Commit message (Collapse)AuthorAgeFilesLines
* Avoid server recreation in case of user_data modification. (#651)ioggstream2017-08-162-0/+2
|
* Set custom hostnames for servers (#643)Tlacenka2017-08-161-10/+8
| | | | | | | | | | * README, all.yml, stack_params.yml, heat_stack.yaml.j2: hostname customisation added * hostnames customisation: default set in stack_params * heat_stack: bug fix * fixed commented defaults in group_vars/all.yml
* Access UI via a bastion node (#596)Bogdan Dobrelya2017-08-162-5/+16
| | | | | | | | When using a bastion and a single master, use the lb-secgrp to access UI port allowed from the ingress bastion node cidr. For HA (masters>1), UI still should be accessed via the LB node's ingress cidr, omitting the bastion. Signed-off-by: Bogdan Dobrelya <bdobreli@redhat.com>
* Specify different image names for roles (#637)Tlacenka2017-08-151-6/+6
| | | | | | | | | | | | * all.yml: set up new variables for specifying images for roles * stack_params.yaml: add image name variables for different roles * more roles added * heat_stack.yaml.j2: openstack_image changed to updated image names * README: updated documentation for specifying image names
* Allow using ephemeral volumes for docker storage (#615)Tomas Sedovic2017-08-042-0/+4
| | | | | | | | For testing cases it's sometimes useful to not create Cinder volumes for the VMs. It can also sometimes be a little faster and more robust (but unfit for production). This adds an option called `ephemeral_volumes` that will use the VM's storage instead of creating volumes when set to true.
* Options for bastion, SSH config, static inventory autogenerationBogdan Dobrelya2017-07-254-2/+183
| | | | | | | | | | | | | | | * At the provisioning stage, allow users to auto-generate SSH config, when using a static inventory. * Run playbooks to provsion and post-provision as a separate, when using a bastion. This re-applies the SSH config, which ansible can't do on the fly. * Support a pre-installed bastion node, colocated with the 1st infra node. * With a bastion enabled, reduce floating IP footprint to infra and dns nodes only, effectively isolating a cluster in a private network. Signed-off-by: Bogdan Dobrelya <bdobreli@redhat.com>
* Generate static inventory with shade inventory (#538)Bogdan Dobrelya2017-07-202-2/+9
| | | | | | | | | | | | | | * Autogenerate inventory/hosts when 'inventory: static' (Default), with the shade-inventory tool. * Drop unused anymore: openstack.py and associated GPL notes, an example static inventory, omit manual updates for the inventory DNS names in the deployment guide. * Switch openstack.py formatted inventory hostvars to the shade-inventory format (omit openstack.* from hostvars). * Populate node labels from inventory vars instead of the heat templates combined with inventory vars. * Add app (k8s minions) nodes group for primary node labels. Signed-off-by: Bogdan Dobrelya <bdobreli@redhat.com>
* Replace greaterthan and equalto in openstack-stackTomas Sedovic2017-07-131-4/+4
| | | | | | These two Jinja filters were added in 2.8 which is notably not packaged in CentOS and RHEL. This removes them in favour of the `==` and `>` operators which are available in Jinja 2.7.
* Add defaults values for some openstack vars (#539)Tomas Sedovic2017-07-121-6/+5
| | | | | | | | | | | | | | * Add defaults values for some openstack vars Ansible shows errors when the `rhsm_register` and `openstack_flat_secgrp` values are not present in the inventory even though they have sensible default values. This makes them both default to false when they're not specified. * Comment out the flat security group option in inv It's no longer required to be there so let's comment it out.
* Persist DNS configuration for nodes for openstack providerBogdan Dobrelya2017-06-303-14/+22
| | | | | | | | | | | | | | | | | * Firstly, provision a Heat stack with given public resolvers. * After the DNS node configured as an authoritative server, switch the Heat stack's Neutron subnet to that resolver (private_dns_server) the way it to become the first entry pushed into the hosts /etc/resolv.conf. It will be serving the cluster domain requests for OpenShift nodes and workloads. * Drop post-provision /etc/reslov.conf nameserver hacks as not needed anymore. * Fix dns floating IPs output and add the priv IPs output as well. * Update docs, clarify localhost vs servers requirements, add required Network Manager setup step. * Use post-provision task names instead of comments. Signed-off-by: Bogdan Dobrelya <bdobreli@redhat.com>
* Merge pull request #502 from bogdando/sec_groupsTomas Sedovic2017-06-281-13/+4
|\ | | | | Modify sec groups for provisioned openstack servers
| * Modify sec groups for provisioned openstack serversBogdan Dobrelya2017-06-261-13/+4
| | | | | | | | | | | | | | | | | | | | Drop ingress DNS rules from the common secgrp. Add an ingress ICMP rule, restricted by the ssh ingress cidr, to the common secgrp. This allows to ping servers from the control node (ansible admin node). Add dns servers into the common secgrp as well. Signed-off-by: Bogdan Dobrelya <bdobreli@redhat.com>
* | Merge pull request #512 from bogdando/undo_infra_secgrpTomas Sedovic2017-06-281-0/+6
|\ \ | | | | | | Put back node/flat secgrp for infra nodes on openstack
| * | Put back node/flat secgrp for infra nodes on openstackBogdan Dobrelya2017-06-281-0/+6
| |/ | | | | | | | | | | | | Partially undo 2028883e936c8a1a0be031a19d531d0804a32b68 to unblock end-to-end deployments Signed-off-by: Bogdan Dobrelya <bdobreli@redhat.com>
* | Merge pull request #491 from tzumainn/openstack-heat-stack-updateTomas Sedovic2017-06-262-0/+3
|\ \ | |/ |/| Add node_removal_policies variable to openstack provisioning to allow for scaling down
| * rename node_removal_policies, add some comments and defaultsTzu-Mainn Chen2017-06-232-2/+2
| |
| * Add node_removal_policies variable to allow for scaling downTzu-Mainn Chen2017-06-212-0/+3
| |
* | Merge pull request #488 from bogdando/fix_flat_sgBogdan Dobrelya2017-06-231-59/+33
|\ \ | | | | | | Fix flat sec group and infra/dns sec rules
| * | Fix flat sec group and infra/dns sec rulesBogdan Dobrelya2017-06-231-59/+33
| |/ | | | | | | | | | | | | | | | | | | Make flat sec group to only merge node/master/etcd sec rules. Add basic dns/ssh sec group and assign it to all but dns node groups. Assign only dns sec group for dns nodes. Assign only infra (and basic) sec groups for ingra nodes. Add security notes for openstack provider. Signed-off-by: Bogdan Dobrelya <bdobreli@redhat.com>
* / Use cached facts, do not become for localhost (#484)Bogdan Dobrelya2017-06-211-0/+2
|/ | | | | | Prohibit sudoing for localhost played tasks, like DNS setup. Re-use cached facts to speed up deployment. Signed-off-by: Bogdan Dobrelya <bdobreli@redhat.com>
* Fix yamllint errorsTomas Sedovic2017-06-161-1/+0
|
* Add a flat sec group for openstack providerBogdan Dobrelya2017-06-151-10/+128
| | | | | | | | | | Add a openstack_flat_secgroup, defaults to False. When set, merges sec rules for master, node, etcd, infra nodes into a single group. Less secure, but might help to mitigate quota limitations. Update docs. Use timeout 30s to mitigate the error: Timeout (12s) waiting for privilege escalation prompt. Signed-off-by: Bogdan Dobrelya <bdobreli@redhat.com>
* Always let the openshift nodes access the DNSTomas Sedovic2017-06-151-0/+15
| | | | | | | | | When `node_ingress_cidr` to limit the IP range for the DNS server, this can prevent the actual openshift nodes from accessing it as well. This commit makes the access from the `openstack_subnet_prefix` always pass through and uses `node_ingress_cidr` for additional access control.
* Update CASL to use nsupdate for DNS records (#48)Øystein Bedin2017-06-132-8/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * Updated to use nsupdate for DNS records * Updated formatting of dict * Updating descriptive text * Support for external DNS config * Upgrading jinja2 to work correctly with latest templates * Latest update for nsupdate * Updated to use nsupdate for DNS records * Updated formatting of dict * Updating descriptive text * Support for external DNS config * Latest update for nsupdate * Updated to support external public/private DNS server(s) * Updated DNS server handling * Updated DNS server handling * Updated DNS server handling * Eliminated the from the sample inventories * Updated sample inventory to point to 2 separate DNS servers for private/public * Playbook clean-up * Adding 'python-dns' * splitting subscription manager calls to allow for a clean pre-install playbook
* First attempt at a simple multi-master support (#39)Eric Sauer2017-04-272-0/+71
| | | | | | | | * First attempt at a simple multi-master support * Removing unneeded inventory * adding default number of masters and lower number of nodes
* Stack refactor (#38)Eric Sauer2017-04-255-286/+184
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * Refactored openstack-stack role to: - Convert static heat template files to ansible templates - Include native ansible groups via openstack metadata. This removes the need for a playbook to map host groups - Some code cleanup * Deleting commentd out code and irrelevant plays * Refactored openstack-stack role to: - Convert static heat template files to ansible templates - Include native ansible groups via openstack metadata. This removes the need for a playbook to map host groups - Some code cleanup * Deleting commentd out code and irrelevant plays * Replacing stack parameters with jinja expressions * Updating sample inventory to work with latest dynamic inventory changes * updating inventory with host group mapping. making sync keys optional * Missing cluster_hosts group * Updating to add infra_hosts * Updating inventory per comments from oybed and sabre1041
* Fixing two significant bugs in the HEAT deployment (#13)Eric Sauer2017-02-061-0/+3
|
* Openstack heat (#2)Eric Sauer2016-12-217-0/+911
* Adding a role to invoke openstack heat * Adding readme * Pulling parameters out to inventory file * start of end-to-end playbook * More enhancements and refactoring to make dynamic inventory the driver for an openshift install * Switching to variable substituted path to config.yaml playbook * Changes to allow defining of number of nodes/infranodes. * Added labels to inventory * Start of end-to-end functionality * Enhancements to support openstack heat provisioning * Updating inventory sample to remove some deprecation warnings * Working towards making the secure-registry role 'become' aware * Fixing node labels and removing secure-registry as it's no longer needed * No longer need insecure registry line, as installer will secure our registry * Adjusted dynamic inventory to filter by clusterid * Minor updates to dynamic inventory bug * Adding a refactored sample inventory directory * Refactoring playbooks for better directory structure, and to narrow down host groups * Adding volume mounts to heat template * Moving dns playbooks back to original location * Fixing incorrect file path * Cleaning up inventory samples * One more hostname to clean up * Changing var name * changed openshift-provision to openshift-prep * Adjusting current provision script to avoid breakage by new openstack-heat code
generated by cgit v1.2.3 (git 2.25.1) at 2024-12-25 13:09:55 +0000