summaryrefslogtreecommitdiffstats
path: root/roles/etcd_common
diff options
context:
space:
mode:
Diffstat (limited to 'roles/etcd_common')
-rw-r--r--roles/etcd_common/README.md53
-rw-r--r--roles/etcd_common/defaults/main.yml78
-rwxr-xr-xroles/etcd_common/library/delegated_serial_command.py274
-rw-r--r--roles/etcd_common/meta/main.yml15
-rw-r--r--roles/etcd_common/tasks/backup.yml101
-rw-r--r--roles/etcd_common/tasks/drop_etcdctl.yml12
-rw-r--r--roles/etcd_common/tasks/main.yml9
-rw-r--r--roles/etcd_common/tasks/noop.yml4
-rw-r--r--roles/etcd_common/templates/etcdctl.sh.j212
-rw-r--r--roles/etcd_common/vars/main.yml4
10 files changed, 0 insertions, 562 deletions
diff --git a/roles/etcd_common/README.md b/roles/etcd_common/README.md
deleted file mode 100644
index d1c3a6602..000000000
--- a/roles/etcd_common/README.md
+++ /dev/null
@@ -1,53 +0,0 @@
-etcd_common
-========================
-
-Common resources for dependent etcd roles. E.g. default variables for:
-* config directories
-* certificates
-* ports
-* other settings
-
-Or `delegated_serial_command` ansible module for executing a command on a remote node. E.g.
-
-```yaml
-- delegated_serial_command:
- command: /usr/bin/make_database.sh arg1 arg2
- creates: /path/to/database
-```
-
-Or etcdctl.yml playbook for installation of `etcdctl` aliases on a node (see example).
-
-Dependencies
-------------
-
-openshift-repos
-
-Example Playbook
-----------------
-
-**Drop etcdctl aliases**
-
-```yaml
-- include_role:
- name: etcd_common
- tasks_from: etcdctl
-```
-
-**Get access to common variables**
-
-```yaml
-# meta.yml of etcd
-...
-dependencies:
-- { role: etcd_common }
-```
-
-License
--------
-
-Apache License Version 2.0
-
-Author Information
-------------------
-
-Jason DeTiberus (jdetiber@redhat.com)
diff --git a/roles/etcd_common/defaults/main.yml b/roles/etcd_common/defaults/main.yml
deleted file mode 100644
index 6705e1ac5..000000000
--- a/roles/etcd_common/defaults/main.yml
+++ /dev/null
@@ -1,78 +0,0 @@
----
-# Default action when calling this role
-r_etcd_common_action: noop
-r_etcd_common_backup_tag: ''
-r_etcd_common_backup_sufix_name: ''
-
-# runc, docker, host
-r_etcd_common_etcd_runtime: "docker"
-r_etcd_common_embedded_etcd: false
-
-# etcd run on a host => use etcdctl command directly
-# etcd run as a docker container => use docker exec
-# etcd run as a runc container => use runc exec
-r_etcd_common_etcdctl_command: "{{ 'etcdctl' if r_etcd_common_etcd_runtime == 'host' or r_etcd_common_embedded_etcd | bool else 'docker exec etcd_container etcdctl' if r_etcd_common_etcd_runtime == 'docker' else 'runc exec etcd etcdctl' }}"
-
-# etcd server vars
-etcd_conf_dir: '/etc/etcd'
-r_etcd_common_system_container_host_dir: /var/lib/etcd/etcd.etcd
-etcd_system_container_conf_dir: /var/lib/etcd/etc
-etcd_conf_file: "{{ etcd_conf_dir }}/etcd.conf"
-etcd_ca_file: "{{ etcd_conf_dir }}/ca.crt"
-etcd_cert_file: "{{ etcd_conf_dir }}/server.crt"
-etcd_key_file: "{{ etcd_conf_dir }}/server.key"
-etcd_peer_ca_file: "{{ etcd_conf_dir }}/ca.crt"
-etcd_peer_cert_file: "{{ etcd_conf_dir }}/peer.crt"
-etcd_peer_key_file: "{{ etcd_conf_dir }}/peer.key"
-
-# etcd ca vars
-etcd_ca_dir: "{{ etcd_conf_dir}}/ca"
-etcd_generated_certs_dir: "{{ etcd_conf_dir }}/generated_certs"
-etcd_ca_cert: "{{ etcd_ca_dir }}/ca.crt"
-etcd_ca_key: "{{ etcd_ca_dir }}/ca.key"
-etcd_openssl_conf: "{{ etcd_ca_dir }}/openssl.cnf"
-etcd_ca_name: etcd_ca
-etcd_req_ext: etcd_v3_req
-etcd_ca_exts_peer: etcd_v3_ca_peer
-etcd_ca_exts_server: etcd_v3_ca_server
-etcd_ca_exts_self: etcd_v3_ca_self
-etcd_ca_exts_client: etcd_v3_ca_client
-etcd_ca_crl_dir: "{{ etcd_ca_dir }}/crl"
-etcd_ca_new_certs_dir: "{{ etcd_ca_dir }}/certs"
-etcd_ca_db: "{{ etcd_ca_dir }}/index.txt"
-etcd_ca_serial: "{{ etcd_ca_dir }}/serial"
-etcd_ca_crl_number: "{{ etcd_ca_dir }}/crlnumber"
-etcd_ca_default_days: 1825
-
-r_etcd_common_master_peer_cert_file: /etc/origin/master/master.etcd-client.crt
-r_etcd_common_master_peer_key_file: /etc/origin/master/master.etcd-client.key
-r_etcd_common_master_peer_ca_file: /etc/origin/master/master.etcd-ca.crt
-
-# etcd server & certificate vars
-etcd_hostname: "{{ inventory_hostname }}"
-etcd_ip: "{{ ansible_default_ipv4.address }}"
-etcd_is_atomic: False
-etcd_is_containerized: False
-etcd_is_thirdparty: False
-
-# etcd dir vars
-etcd_data_dir: "{{ '/var/lib/origin/openshift.local.etcd' if r_etcd_common_embedded_etcd | bool else '/var/lib/etcd/' if r_etcd_common_etcd_runtime != 'runc' else '/var/lib/etcd/etcd.etcd/' }}"
-
-# etcd ports and protocols
-etcd_client_port: 2379
-etcd_peer_port: 2380
-etcd_url_scheme: http
-etcd_peer_url_scheme: http
-
-etcd_initial_cluster_state: new
-etcd_initial_cluster_token: etcd-cluster-1
-
-etcd_initial_advertise_peer_urls: "{{ etcd_peer_url_scheme }}://{{ etcd_ip }}:{{ etcd_peer_port }}"
-etcd_listen_peer_urls: "{{ etcd_peer_url_scheme }}://{{ etcd_ip }}:{{ etcd_peer_port }}"
-etcd_advertise_client_urls: "{{ etcd_url_scheme }}://{{ etcd_ip }}:{{ etcd_client_port }}"
-etcd_listen_client_urls: "{{ etcd_url_scheme }}://{{ etcd_ip }}:{{ etcd_client_port }}"
-
-etcd_systemd_dir: "/etc/systemd/system/{{ etcd_service }}.service.d"
-
-# etcd_peer needs to be set by a role caller
-etcdctlv2: "etcdctl --cert-file {{ etcd_peer_cert_file }} --key-file {{ etcd_peer_key_file }} --ca-file {{ etcd_peer_ca_file }} -C https://{{ etcd_peer }}:{{ etcd_client_port }}"
diff --git a/roles/etcd_common/library/delegated_serial_command.py b/roles/etcd_common/library/delegated_serial_command.py
deleted file mode 100755
index 0cab1ca88..000000000
--- a/roles/etcd_common/library/delegated_serial_command.py
+++ /dev/null
@@ -1,274 +0,0 @@
-#!/usr/bin/python
-# -*- coding: utf-8 -*-
-
-# (c) 2012, Michael DeHaan <michael.dehaan@gmail.com>, and others
-# (c) 2016, Andrew Butcher <abutcher@redhat.com>
-#
-# This module is derrived from the Ansible command module.
-#
-# Ansible is free software: you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation, either version 3 of the License, or
-# (at your option) any later version.
-#
-# Ansible is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License
-# along with Ansible. If not, see <http://www.gnu.org/licenses/>.
-
-
-# pylint: disable=unused-wildcard-import,wildcard-import,unused-import,redefined-builtin
-
-''' delegated_serial_command '''
-
-import datetime
-import errno
-import glob
-import shlex
-import os
-import fcntl
-import time
-
-DOCUMENTATION = '''
----
-module: delegated_serial_command
-short_description: Executes a command on a remote node
-version_added: historical
-description:
- - The M(command) module takes the command name followed by a list
- of space-delimited arguments.
- - The given command will be executed on all selected nodes. It
- will not be processed through the shell, so variables like
- C($HOME) and operations like C("<"), C(">"), C("|"), and C("&")
- will not work (use the M(shell) module if you need these
- features).
- - Creates and maintains a lockfile such that this module will
- wait for other invocations to proceed.
-options:
- command:
- description:
- - the command to run
- required: true
- default: null
- creates:
- description:
- - a filename or (since 2.0) glob pattern, when it already
- exists, this step will B(not) be run.
- required: no
- default: null
- removes:
- description:
- - a filename or (since 2.0) glob pattern, when it does not
- exist, this step will B(not) be run.
- version_added: "0.8"
- required: no
- default: null
- chdir:
- description:
- - cd into this directory before running the command
- version_added: "0.6"
- required: false
- default: null
- executable:
- description:
- - change the shell used to execute the command. Should be an
- absolute path to the executable.
- required: false
- default: null
- version_added: "0.9"
- warn:
- version_added: "1.8"
- default: yes
- description:
- - if command warnings are on in ansible.cfg, do not warn about
- this particular line if set to no/false.
- required: false
- lockfile:
- default: yes
- description:
- - the lockfile that will be created
- timeout:
- default: yes
- description:
- - time in milliseconds to wait to obtain the lock
-notes:
- - If you want to run a command through the shell (say you are using C(<),
- C(>), C(|), etc), you actually want the M(shell) module instead. The
- M(command) module is much more secure as it's not affected by the user's
- environment.
- - " C(creates), C(removes), and C(chdir) can be specified after
- the command. For instance, if you only want to run a command if
- a certain file does not exist, use this."
-author:
- - Ansible Core Team
- - Michael DeHaan
- - Andrew Butcher
-'''
-
-EXAMPLES = '''
-# Example from Ansible Playbooks.
-- delegated_serial_command:
- command: /sbin/shutdown -t now
-
-# Run the command if the specified file does not exist.
-- delegated_serial_command:
- command: /usr/bin/make_database.sh arg1 arg2
- creates: /path/to/database
-'''
-
-# Dict of options and their defaults
-OPTIONS = {'chdir': None,
- 'creates': None,
- 'command': None,
- 'executable': None,
- 'NO_LOG': None,
- 'removes': None,
- 'warn': True,
- 'lockfile': None,
- 'timeout': None}
-
-
-def check_command(commandline):
- ''' Check provided command '''
- arguments = {'chown': 'owner', 'chmod': 'mode', 'chgrp': 'group',
- 'ln': 'state=link', 'mkdir': 'state=directory',
- 'rmdir': 'state=absent', 'rm': 'state=absent', 'touch': 'state=touch'}
- commands = {'git': 'git', 'hg': 'hg', 'curl': 'get_url or uri', 'wget': 'get_url or uri',
- 'svn': 'subversion', 'service': 'service',
- 'mount': 'mount', 'rpm': 'yum, dnf or zypper', 'yum': 'yum', 'apt-get': 'apt',
- 'tar': 'unarchive', 'unzip': 'unarchive', 'sed': 'template or lineinfile',
- 'rsync': 'synchronize', 'dnf': 'dnf', 'zypper': 'zypper'}
- become = ['sudo', 'su', 'pbrun', 'pfexec', 'runas']
- warnings = list()
- command = os.path.basename(commandline.split()[0])
- # pylint: disable=line-too-long
- if command in arguments:
- warnings.append("Consider using file module with {0} rather than running {1}".format(arguments[command], command))
- if command in commands:
- warnings.append("Consider using {0} module rather than running {1}".format(commands[command], command))
- if command in become:
- warnings.append(
- "Consider using 'become', 'become_method', and 'become_user' rather than running {0}".format(command,))
- return warnings
-
-
-# pylint: disable=too-many-statements,too-many-branches,too-many-locals
-def main():
- ''' Main module function '''
- module = AnsibleModule( # noqa: F405
- argument_spec=dict(
- _uses_shell=dict(type='bool', default=False),
- command=dict(required=True),
- chdir=dict(),
- executable=dict(),
- creates=dict(),
- removes=dict(),
- warn=dict(type='bool', default=True),
- lockfile=dict(default='/tmp/delegated_serial_command.lock'),
- timeout=dict(type='int', default=30)
- )
- )
-
- shell = module.params['_uses_shell']
- chdir = module.params['chdir']
- executable = module.params['executable']
- command = module.params['command']
- creates = module.params['creates']
- removes = module.params['removes']
- warn = module.params['warn']
- lockfile = module.params['lockfile']
- timeout = module.params['timeout']
-
- if command.strip() == '':
- module.fail_json(rc=256, msg="no command given")
-
- iterated = 0
- lockfd = open(lockfile, 'w+')
- while iterated < timeout:
- try:
- fcntl.flock(lockfd, fcntl.LOCK_EX | fcntl.LOCK_NB)
- break
- # pylint: disable=invalid-name
- except IOError as e:
- if e.errno != errno.EAGAIN:
- module.fail_json(msg="I/O Error {0}: {1}".format(e.errno, e.strerror))
- else:
- iterated += 1
- time.sleep(0.1)
-
- if chdir:
- chdir = os.path.abspath(os.path.expanduser(chdir))
- os.chdir(chdir)
-
- if creates:
- # do not run the command if the line contains creates=filename
- # and the filename already exists. This allows idempotence
- # of command executions.
- path = os.path.expanduser(creates)
- if glob.glob(path):
- module.exit_json(
- cmd=command,
- stdout="skipped, since %s exists" % path,
- changed=False,
- stderr=False,
- rc=0
- )
-
- if removes:
- # do not run the command if the line contains removes=filename
- # and the filename does not exist. This allows idempotence
- # of command executions.
- path = os.path.expanduser(removes)
- if not glob.glob(path):
- module.exit_json(
- cmd=command,
- stdout="skipped, since %s does not exist" % path,
- changed=False,
- stderr=False,
- rc=0
- )
-
- warnings = list()
- if warn:
- warnings = check_command(command)
-
- if not shell:
- command = shlex.split(command)
- startd = datetime.datetime.now()
-
- # pylint: disable=invalid-name
- rc, out, err = module.run_command(command, executable=executable, use_unsafe_shell=shell)
-
- fcntl.flock(lockfd, fcntl.LOCK_UN)
- lockfd.close()
-
- endd = datetime.datetime.now()
- delta = endd - startd
-
- if out is None:
- out = ''
- if err is None:
- err = ''
-
- module.exit_json(
- cmd=command,
- stdout=out.rstrip("\r\n"),
- stderr=err.rstrip("\r\n"),
- rc=rc,
- start=str(startd),
- end=str(endd),
- delta=str(delta),
- changed=True,
- warnings=warnings,
- iterated=iterated
- )
-
-
-# import module snippets
-# pylint: disable=wrong-import-position
-from ansible.module_utils.basic import * # noqa: F402,F403
-
-main()
diff --git a/roles/etcd_common/meta/main.yml b/roles/etcd_common/meta/main.yml
deleted file mode 100644
index dfb1c7a2c..000000000
--- a/roles/etcd_common/meta/main.yml
+++ /dev/null
@@ -1,15 +0,0 @@
----
-galaxy_info:
- author: Jason DeTiberus
- description:
- company: Red Hat, Inc.
- license: Apache License, Version 2.0
- min_ansible_version: 1.9
- platforms:
- - name: EL
- versions:
- - 7
- categories:
- - cloud
- - system
-dependencies: []
diff --git a/roles/etcd_common/tasks/backup.yml b/roles/etcd_common/tasks/backup.yml
deleted file mode 100644
index 42d27c081..000000000
--- a/roles/etcd_common/tasks/backup.yml
+++ /dev/null
@@ -1,101 +0,0 @@
----
-# set the etcd backup directory name here in case the tag or sufix consists of dynamic value that changes over time
-# e.g. openshift-backup-{{ lookup('pipe', 'date +%Y%m%d%H%M%S') }} value will change every second so if the date changes
-# right after setting l_etcd_incontainer_backup_dir and before l_etcd_backup_dir facts, the backup directory name is different
-- set_fact:
- l_backup_dir_name: "openshift-backup-{{ r_etcd_common_backup_tag }}{{ r_etcd_common_backup_sufix_name }}"
-
-- set_fact:
- l_etcd_data_dir: "{{ etcd_data_dir }}{{ '/etcd.etcd' if r_etcd_common_etcd_runtime == 'runc' else '' }}"
-
-- set_fact:
- l_etcd_incontainer_data_dir: "{{ etcd_data_dir }}"
-
-- set_fact:
- l_etcd_incontainer_backup_dir: "{{ l_etcd_incontainer_data_dir }}/{{ l_backup_dir_name }}"
-
-- set_fact:
- l_etcd_backup_dir: "{{ l_etcd_data_dir }}/{{ l_backup_dir_name }}"
-
-# TODO: replace shell module with command and update later checks
-- name: Check available disk space for etcd backup
- shell: df --output=avail -k {{ l_etcd_data_dir }} | tail -n 1
- register: l_avail_disk
- # AUDIT:changed_when: `false` because we are only inspecting
- # state, not manipulating anything
- changed_when: false
-
-# TODO: replace shell module with command and update later checks
-- name: Check current etcd disk usage
- shell: du --exclude='*openshift-backup*' -k {{ l_etcd_data_dir }} | tail -n 1 | cut -f1
- register: l_etcd_disk_usage
- # AUDIT:changed_when: `false` because we are only inspecting
- # state, not manipulating anything
- changed_when: false
-
-- name: Abort if insufficient disk space for etcd backup
- fail:
- msg: >
- {{ l_etcd_disk_usage.stdout|int*2 }} Kb disk space required for etcd backup,
- {{ l_avail_disk.stdout }} Kb available.
- when: l_etcd_disk_usage.stdout|int*2 > l_avail_disk.stdout|int
-
-# For non containerized and non embedded we should have the correct version of
-# etcd installed already. So don't do anything.
-#
-# For containerized installs we now exec into etcd_container
-#
-# For embedded non containerized we need to ensure we have the latest version
-# etcd on the host.
-- name: Detecting Atomic Host Operating System
- stat:
- path: /run/ostree-booted
- register: l_ostree_booted
-
-- name: Install latest etcd for embedded
- package:
- name: etcd
- state: latest
- when:
- - r_etcd_common_embedded_etcd | bool
- - not l_ostree_booted.stat.exists | bool
-
-- name: Check selinux label of '{{ l_etcd_data_dir }}'
- command: >
- stat -c '%C' {{ l_etcd_data_dir }}
- register: l_etcd_selinux_labels
-
-- debug:
- msg: "{{ l_etcd_selinux_labels }}"
-
-- name: Make sure the '{{ l_etcd_data_dir }}' has the proper label
- command: >
- chcon -t svirt_sandbox_file_t "{{ l_etcd_data_dir }}"
- when:
- - l_etcd_selinux_labels.rc == 0
- - "'svirt_sandbox_file_t' not in l_etcd_selinux_labels.stdout"
-
-- name: Generate etcd backup
- command: >
- {{ r_etcd_common_etcdctl_command }} backup --data-dir={{ l_etcd_incontainer_data_dir }}
- --backup-dir={{ l_etcd_incontainer_backup_dir }}
-
-# According to the docs change you can simply copy snap/db
-# https://github.com/openshift/openshift-docs/commit/b38042de02d9780842dce95cfa0ef45d53b58bc6
-- name: Check for v3 data store
- stat:
- path: "{{ l_etcd_data_dir }}/member/snap/db"
- register: l_v3_db
-
-- name: Copy etcd v3 data store
- command: >
- cp -a {{ l_etcd_data_dir }}/member/snap/db
- {{ l_etcd_backup_dir }}/member/snap/
- when: l_v3_db.stat.exists
-
-- set_fact:
- r_etcd_common_backup_complete: True
-
-- name: Display location of etcd backup
- debug:
- msg: "Etcd backup created in {{ l_etcd_backup_dir }}"
diff --git a/roles/etcd_common/tasks/drop_etcdctl.yml b/roles/etcd_common/tasks/drop_etcdctl.yml
deleted file mode 100644
index 6cb456677..000000000
--- a/roles/etcd_common/tasks/drop_etcdctl.yml
+++ /dev/null
@@ -1,12 +0,0 @@
----
-- name: Install etcd for etcdctl
- package: name=etcd{{ '-' + etcd_version if etcd_version is defined else '' }} state=present
- when: not openshift.common.is_atomic | bool
-
-- name: Configure etcd profile.d alises
- template:
- dest: "/etc/profile.d/etcdctl.sh"
- src: etcdctl.sh.j2
- mode: 0755
- owner: root
- group: root
diff --git a/roles/etcd_common/tasks/main.yml b/roles/etcd_common/tasks/main.yml
deleted file mode 100644
index 6ed87e6c7..000000000
--- a/roles/etcd_common/tasks/main.yml
+++ /dev/null
@@ -1,9 +0,0 @@
----
-- name: Fail if invalid r_etcd_common_action provided
- fail:
- msg: "etcd_common role can only be called with 'noop' or 'backup' or 'drop_etcdctl'"
- when: r_etcd_common_action not in ['noop', 'backup', 'drop_etcdctl']
-
-- name: Include main action task file
- include: "{{ r_etcd_common_action }}.yml"
- when: r_etcd_common_action != "noop"
diff --git a/roles/etcd_common/tasks/noop.yml b/roles/etcd_common/tasks/noop.yml
deleted file mode 100644
index a88d78235..000000000
--- a/roles/etcd_common/tasks/noop.yml
+++ /dev/null
@@ -1,4 +0,0 @@
----
-# This is file is here because the usage of tags, specifically `pre_upgrade`
-# breaks the functionality of this role.
-# See https://bugzilla.redhat.com/show_bug.cgi?id=1464025
diff --git a/roles/etcd_common/templates/etcdctl.sh.j2 b/roles/etcd_common/templates/etcdctl.sh.j2
deleted file mode 100644
index ac7d9c72f..000000000
--- a/roles/etcd_common/templates/etcdctl.sh.j2
+++ /dev/null
@@ -1,12 +0,0 @@
-#!/bin/bash
-# Sets up handy aliases for etcd, need etcdctl2 and etcdctl3 because
-# command flags are different between the two. Should work on stand
-# alone etcd hosts and master + etcd hosts too because we use the peer keys.
-etcdctl2() {
- /usr/bin/etcdctl --cert-file {{ etcd_peer_cert_file }} --key-file {{ etcd_peer_key_file }} --ca-file {{ etcd_peer_ca_file }} -C https://`hostname`:2379 ${@}
-
-}
-
-etcdctl3() {
- ETCDCTL_API=3 /usr/bin/etcdctl --cert {{ etcd_peer_cert_file }} --key {{ etcd_peer_key_file }} --cacert {{ etcd_peer_ca_file }} --endpoints https://`hostname`:2379 ${@}
-}
diff --git a/roles/etcd_common/vars/main.yml b/roles/etcd_common/vars/main.yml
deleted file mode 100644
index 00d697776..000000000
--- a/roles/etcd_common/vars/main.yml
+++ /dev/null
@@ -1,4 +0,0 @@
----
-etcd_service: "{{ 'etcd_container' if r_etcd_common_etcd_runtime == 'docker' else 'etcd' }}"
-# Location of the service file is fixed and not meant to be changed
-etcd_service_file: "/etc/systemd/system/{{ etcd_service }}.service"