diff options
Diffstat (limited to 'playbooks')
5 files changed, 133 insertions, 84 deletions
diff --git a/playbooks/provisioning/openstack/README.md b/playbooks/provisioning/openstack/README.md index df00e5507..34b548b9b 100644 --- a/playbooks/provisioning/openstack/README.md +++ b/playbooks/provisioning/openstack/README.md @@ -5,12 +5,19 @@ OpenStack resources (servers, networking, volumes, security groups, etc.). The result is an environment ready for openshift-ansible. -## Dependencies +## Dependencies for localhost (ansible control/admin node) * [Ansible 2.3](https://pypi.python.org/pypi/ansible) +* [jinja2](http://jinja.pocoo.org/docs/2.9/) * [shade](https://pypi.python.org/pypi/shade) -* python-dns +* python-dns / [dnspython](https://pypi.python.org/pypi/dnspython) +* Become (sudo) is not required. +## Dependencies for OpenStack hosted cluster nodes (servers) + +There are no additional dependencies for the cluster nodes. Required +configuration steps are done by Heat given a specific user data config +that normally should not be changed. ## What does it do @@ -41,12 +48,27 @@ etc.). The result is an environment ready for openshift-ansible. Pay special attention to the values in the first paragraph -- these will depend on your OpenStack environment. -The `env_id` and `openstack_dns_domain` will form the DNS domain all +The `env_id` and `public_dns_domain` will form the cluster's DNS domain all your servers will be under. With the default values, this will be -`openshift.example.com`. - -`openstack_nameservers` is a list of DNS servers accessible from all -the created Nova servers. These will be serve as your DNS forwarders. +`openshift.example.com`. For workloads, the default subdomain is 'apps'. +That sudomain can be set as well by the `openshift_app_domain` variable in +the inventory. + +The `public_dns_nameservers` is a list of DNS servers accessible from all +the created Nova servers. These will be serving as your DNS forwarders for +external FQDNs that do not belong to the cluster's DNS domain and its subdomains. + +The `openshift_use_dnsmasq` controls either dnsmasq is deployed or not. +By default, dnsmasq is deployed and comes as the hosts' /etc/resolv.conf file +first nameserver entry that points to the local host instance of the dnsmasq +daemon that in turn proxies DNS requests to the authoritative DNS server. +When Network Manager is enabled for provisioned cluster nodes, which is +normally the case, you should not change the defaults and always deploy dnsmasq. + +Note that the authoritative DNS server is configured on post provsision +steps, and the Neutron subnet for the Heat stack is updated to point to that +server in the end. So the provisioned servers will start using it natively +as a default nameserver that comes from the NetworkManager and cloud-init. `openstack_ssh_key` is a Nova keypair -- you can see your keypairs with `openstack keypair list`. @@ -67,11 +89,18 @@ The `openstack_num_masters`, `openstack_num_infra` and `openstack_num_nodes` values specify the number of Master, Infra and App nodes to create. +The `openstack_nodes_to_remove` allows you to specify the numerical indexes +of App nodes that should be removed; for example, ['0', '2'], + The `openstack_flat_secgrp`, controls Neutron security groups creation for Heat stacks. Set it to true, if you experience issues with sec group rules quotas. It trades security for number of rules, by sharing the same set of firewall rules for master, node, etcd and infra nodes. +The `required_packages` variable also provides a list of the additional +prerequisite packages to be installed before to deploy an OpenShift cluster. +Those are ignored though, if the `manage_packages: False`. + #### Security notes Configure required `*_ingress_cidr` variables to restrict public access @@ -83,6 +112,12 @@ nodes' ephemeral ports range. Note, the command ``curl https://api.ipify.org`` helps fiding an external IP address of your box (the ansible admin node). +There is also the `manage_packages` variable (defaults to True) you +may want to turn off in order to speed up the provisioning tasks. This may +be the case for development environments. When turned off, the servers will +be provisioned omitting the ``yum update`` command. This brings security +implications though, and is not recommended for production deployments. + ### Update the DNS names in `inventory/hosts` The different server groups are currently grouped by the domain name, @@ -132,8 +167,8 @@ Once it succeeds, you can install openshift by running: ansible-playbook --become --user openshift --private-key ~/.ssh/openshift -i inventory/ openshift-ansible/playbooks/byo/openshift-node/network_manager.yml ansible-playbook --become --user openshift --private-key ~/.ssh/openshift -i inventory/ openshift-ansible/playbooks/byo/config.yml -Note, the `network_manager.yml` is only required if you're deploying OpenShift -origin. +Note, the `network_manager.yml` step is mandatory and is required for persisting +the hosts' DNS configs. ## License diff --git a/playbooks/provisioning/openstack/post-provision-openstack.yml b/playbooks/provisioning/openstack/post-provision-openstack.yml index 918f9e065..412ccd221 100644 --- a/playbooks/provisioning/openstack/post-provision-openstack.yml +++ b/playbooks/provisioning/openstack/post-provision-openstack.yml @@ -1,6 +1,6 @@ --- -# Assign hostnames -- hosts: cluster_hosts +- name: Assign hostnames + hosts: cluster_hosts gather_facts: False become: true pre_tasks: @@ -8,8 +8,8 @@ roles: - role: hostnames -# Subscribe DNS Host to allow for configuration below -- hosts: dns +- name: Subscribe DNS Host to allow for configuration below + hosts: dns gather_facts: False become: true roles: @@ -17,15 +17,15 @@ when: hostvars.localhost.rhsm_register tags: 'subscription-manager' -# Determine which DNS server(s) to use for our generated records -- hosts: localhost +- name: Determine which DNS server(s) to use for our generated records + hosts: localhost gather_facts: False become: False roles: - dns-server-detect -# Build the DNS Server Views and Configure DNS Server(s) -- hosts: dns +- name: Build the DNS Server Views and Configure DNS Server(s) + hosts: dns gather_facts: False become: true pre_tasks: @@ -35,8 +35,8 @@ roles: - role: dns-server -# Build and process DNS Records -- hosts: localhost +- name: Build and process DNS Records + hosts: localhost gather_facts: False become: False pre_tasks: @@ -46,18 +46,22 @@ roles: - role: dns -# OpenShift Pre-Requisites -- hosts: OSEv3 +- name: Switch the stack subnet to the configured private DNS server + hosts: localhost + gather_facts: False + become: False + vars_files: + - stack_params.yaml + tasks: + - include_role: + name: openstack-stack + tasks_from: subnet_update_dns_servers + +- name: OpenShift Pre-Requisites + hosts: OSEv3 gather_facts: False become: true tasks: - - name: "Edit /etc/resolv.conf on masters/nodes" - lineinfile: - state: present - dest: /etc/resolv.conf - regexp: "nameserver {{ hostvars['localhost'].private_dns_server }}" - line: "nameserver {{ hostvars['localhost'].private_dns_server }}" - insertafter: search* - name: "Include DNS configuration to ensure proper name resolution" lineinfile: state: present diff --git a/playbooks/provisioning/openstack/provision-openstack.yml b/playbooks/provisioning/openstack/provision-openstack.yml index a2cf7b110..0c673af2f 100644 --- a/playbooks/provisioning/openstack/provision-openstack.yml +++ b/playbooks/provisioning/openstack/provision-openstack.yml @@ -2,32 +2,12 @@ - hosts: localhost gather_facts: True become: False + vars_files: + - stack_params.yaml pre_tasks: - - include: pre_tasks.yml + - include: pre_tasks.yml roles: - - role: openstack-stack - stack_name: "{{ env_id }}.{{ public_dns_domain }}" - dns_domain: "{{ public_dns_domain }}" - dns_nameservers: "{{ public_dns_nameservers }}" - subnet_prefix: "{{ openstack_subnet_prefix }}" - ssh_public_key: "{{ openstack_ssh_public_key }}" - openstack_image: "{{ openstack_default_image_name }}" - lb_flavor: "{{ openstack_default_flavor | default('m1.small') }}" - etcd_flavor: "{{ openstack_default_flavor | default('m1.small') }}" - master_flavor: "{{ openstack_default_flavor | default('m1.medium') }}" - node_flavor: "{{ openstack_default_flavor | default('m1.medium') }}" - infra_flavor: "{{ openstack_default_flavor | default('m1.medium') }}" - dns_flavor: "{{ openstack_default_flavor | default('m1.small') }}" - external_network: "{{ openstack_external_network_name }}" - num_etcd: "{{ openstack_num_etcd | default(0) }}" - num_masters: "{{ openstack_num_masters }}" - num_nodes: "{{ openstack_num_nodes }}" - num_infra: "{{ openstack_num_infra }}" - num_dns: "{{ openstack_num_dns | default(1) }}" - master_volume_size: "{{ docker_volume_size }}" - app_volume_size: "{{ docker_volume_size }}" - infra_volume_size: "{{ docker_volume_size }}" - + - role: openstack-stack - name: Refresh Server inventory hosts: localhost @@ -35,17 +15,21 @@ become: False gather_facts: False tasks: - - meta: refresh_inventory + - meta: refresh_inventory + +- hosts: cluster_hosts + name: Wait for the the nodes to come up + become: False + gather_facts: False + tasks: + - wait_for_connection: - hosts: cluster_hosts gather_facts: True tasks: - - name: Debug hostvar - debug: - msg: "{{ hostvars[inventory_hostname] }}" - verbosity: 2 - - name: waiting for server to come back - local_action: wait_for host={{ hostvars[inventory_hostname]['ansible_ssh_host'] }} port=22 delay=30 timeout=300 - become: false + - name: Debug hostvar + debug: + msg: "{{ hostvars[inventory_hostname] }}" + verbosity: 2 - include: post-provision-openstack.yml diff --git a/playbooks/provisioning/openstack/sample-inventory/group_vars/all.yml b/playbooks/provisioning/openstack/sample-inventory/group_vars/all.yml index 047923253..7c9033828 100644 --- a/playbooks/provisioning/openstack/sample-inventory/group_vars/all.yml +++ b/playbooks/provisioning/openstack/sample-inventory/group_vars/all.yml @@ -12,46 +12,49 @@ openstack_num_masters: 1 openstack_num_infra: 1 openstack_num_nodes: 2 +# # Numerical index of nodes to remove +# openstack_nodes_to_remove: [] + docker_volume_size: "15" openstack_subnet_prefix: "192.168.99" # # Red Hat subscription # # Using Red Hat Satellite: -# rhsm_register: True -# rhsm_satellite: 'sat-6.example.com' -# rhsm_org: 'OPENSHIFT_ORG' -# rhsm_activationkey: '<activation-key>' +#rhsm_register: True +#rhsm_satellite: 'sat-6.example.com' +#rhsm_org: 'OPENSHIFT_ORG' +#rhsm_activationkey: '<activation-key>' # # Or using RHN username, password and optionally pool: -# rhsm_register: True -# rhsm_username: '<username>' -# rhsm_password: '<password>' -# rhsm_pool: '<pool id>' +#rhsm_register: True +#rhsm_username: '<username>' +#rhsm_password: '<password>' +#rhsm_pool: '<pool id>' -# rhsm_repos: -# - "rhel-7-server-rpms" -# - "rhel-7-server-ose-3.5-rpms" -# - "rhel-7-server-extras-rpms" -# - "rhel-7-fast-datapath-rpms" +#rhsm_repos: +# - "rhel-7-server-rpms" +# - "rhel-7-server-ose-3.5-rpms" +# - "rhel-7-server-extras-rpms" +# - "rhel-7-fast-datapath-rpms" # # Roll-your-own DNS -# openstack_num_dns: 0 -# external_nsupdate_keys: -# public: -# key_secret: 'SKqKNdpfk7llKxZ57bbxUnUDobaaJp9t8CjXLJPl+fRI5mPcSBuxTAyvJPa6Y9R7vUg9DwCy/6WTpgLNqnV4Hg==' -# key_algorithm: 'hmac-md5' -# server: '192.168.1.1' -# private: -# key_secret: 'kVE2bVTgZjrdJipxPhID8BEZmbHD8cExlVPR+zbFpW6la8kL5wpXiwOh8q5AAosXQI5t95UXwq3Inx8QT58duw==' -# key_algorithm: 'hmac-md5' -# server: '192.168.1.2' +#openstack_num_dns: 0 +#external_nsupdate_keys: +# public: +# key_secret: 'SKqKNdpfk7llKxZ57bbxUnUDobaaJp9t8CjXLJPl+fRI5mPcSBuxTAyvJPa6Y9R7vUg9DwCy/6WTpgLNqnV4Hg==' +# key_algorithm: 'hmac-md5' +# server: '192.168.1.1' +# private: +# key_secret: 'kVE2bVTgZjrdJipxPhID8BEZmbHD8cExlVPR+zbFpW6la8kL5wpXiwOh8q5AAosXQI5t95UXwq3Inx8QT58duw==' +# key_algorithm: 'hmac-md5' +# server: '192.168.1.2' # NOTE(shadower): Do not change this value. The Ansible user is currently # hardcoded to `openshift`. ansible_user: openshift -# Use a single security group for a cluster +# # Use a single security group for a cluster openstack_flat_secgrp: false diff --git a/playbooks/provisioning/openstack/stack_params.yaml b/playbooks/provisioning/openstack/stack_params.yaml new file mode 100644 index 000000000..9c0b09b45 --- /dev/null +++ b/playbooks/provisioning/openstack/stack_params.yaml @@ -0,0 +1,23 @@ +--- +stack_name: "{{ env_id }}.{{ public_dns_domain }}" +dns_domain: "{{ public_dns_domain }}" +dns_nameservers: "{{ public_dns_nameservers }}" +subnet_prefix: "{{ openstack_subnet_prefix }}" +ssh_public_key: "{{ openstack_ssh_public_key }}" +openstack_image: "{{ openstack_default_image_name }}" +lb_flavor: "{{ openstack_default_flavor | default('m1.small') }}" +etcd_flavor: "{{ openstack_default_flavor | default('m1.small') }}" +master_flavor: "{{ openstack_default_flavor | default('m1.medium') }}" +node_flavor: "{{ openstack_default_flavor | default('m1.medium') }}" +infra_flavor: "{{ openstack_default_flavor | default('m1.medium') }}" +dns_flavor: "{{ openstack_default_flavor | default('m1.small') }}" +external_network: "{{ openstack_external_network_name }}" +num_etcd: "{{ openstack_num_etcd | default(0) }}" +num_masters: "{{ openstack_num_masters }}" +num_nodes: "{{ openstack_num_nodes }}" +num_infra: "{{ openstack_num_infra }}" +num_dns: "{{ openstack_num_dns | default(1) }}" +master_volume_size: "{{ docker_volume_size }}" +app_volume_size: "{{ docker_volume_size }}" +infra_volume_size: "{{ docker_volume_size }}" +nodes_to_remove: "{{ openstack_nodes_to_remove | default([]) | to_yaml }}" |