summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorSimon Pasquier <spasquier@mirantis.com>2016-07-25 17:39:40 +0200
committerSimon Pasquier <spasquier@mirantis.com>2016-07-27 11:14:13 +0200
commit2d74feb3d517485e3d9128fb286239fb1cec1284 (patch)
tree0dff204ef8df7bbc686096b3056677b96badbc20
parent521cf50a22c792fe86d94afd23cbb9abdbde3d8b (diff)
Configure Kibana to use its own VIP
This change modifies the deployment manifests to use the Kibana VIP address instead of the one allocated for Elasticsearch. It allows then the deployer to expose the Kibana dashboard on the public network using network templates if needed. Change-Id: I8debb43e3e382a7319a70643116572a7e50cb246 DocImpact: document the Kibana VIP address Implements-blueprint: kibana-grafana-public-ip-access Depends-On: Icdf9315239a8fde8b0528f555a89adf0374c408f
Notes
Notes (review): Code-Review+2: Swann Croiset <scroiset@mirantis.com> Code-Review+2: Simon Pasquier <spasquier@mirantis.com> Workflow+1: Simon Pasquier <spasquier@mirantis.com> Verified+2: Jenkins Submitted-by: Jenkins Submitted-at: Fri, 29 Jul 2016 08:52:21 +0000 Reviewed-on: https://review.openstack.org/346902 Project: openstack/fuel-plugin-elasticsearch-kibana Branch: refs/heads/master
-rw-r--r--deployment_scripts/puppet/manifests/haproxy.pp27
-rw-r--r--deployment_scripts/puppet/manifests/hiera_override.pp25
-rw-r--r--deployment_scripts/puppet/manifests/provision_services.pp19
3 files changed, 52 insertions, 19 deletions
diff --git a/deployment_scripts/puppet/manifests/haproxy.pp b/deployment_scripts/puppet/manifests/haproxy.pp
index ebc1e57..b18c64d 100644
--- a/deployment_scripts/puppet/manifests/haproxy.pp
+++ b/deployment_scripts/puppet/manifests/haproxy.pp
@@ -19,24 +19,27 @@ $kibana_backend_port = hiera('lma::elasticsearch::apache_port')
19$kibana_backend_viewer_port = hiera('lma::elasticsearch::apache_viewer_port') 19$kibana_backend_viewer_port = hiera('lma::elasticsearch::apache_viewer_port')
20$kibana_frontend_port = hiera('lma::elasticsearch::kibana_frontend_port') 20$kibana_frontend_port = hiera('lma::elasticsearch::kibana_frontend_port')
21$kibana_frontend_viewer_port = hiera('lma::elasticsearch::kibana_frontend_viewer_port') 21$kibana_frontend_viewer_port = hiera('lma::elasticsearch::kibana_frontend_viewer_port')
22$vip = hiera('lma::elasticsearch::vip') 22$es_vip = hiera('lma::elasticsearch::vip')
23$kibana_vip = hiera('lma::kibana::vip')
23 24
24$nodes_ips = hiera('lma::elasticsearch::nodes') 25$es_nodes_ips = hiera('lma::elasticsearch::nodes')
25$nodes_names = prefix(range(1, size($nodes_ips)), 'server_') 26$es_nodes_names = prefix(range(1, size($es_nodes_ips)), 'server_')
27$kibana_nodes_ips = hiera('lma::kibana::nodes')
28$kibana_nodes_names = prefix(range(1, size($kibana_nodes_ips)), 'server_')
26 29
27Openstack::Ha::Haproxy_service { 30Openstack::Ha::Haproxy_service {
28 server_names => $nodes_names,
29 ipaddresses => $nodes_ips,
30 public => false, 31 public => false,
31 public_ssl => false, 32 public_ssl => false,
32 internal => true, 33 internal => true,
33 internal_virtual_ip => $vip,
34} 34}
35 35
36$es_haproxy_service = hiera('lma::elasticsearch::es_haproxy_service') 36$es_haproxy_service = hiera('lma::elasticsearch::es_haproxy_service')
37openstack::ha::haproxy_service { $es_haproxy_service: 37openstack::ha::haproxy_service { $es_haproxy_service:
38 order => '920', 38 order => '920',
39 internal_virtual_ip => $es_vip,
39 listen_port => $es_port, 40 listen_port => $es_port,
41 server_names => $es_nodes_names,
42 ipaddresses => $es_nodes_ips,
40 balancermember_port => $es_port, 43 balancermember_port => $es_port,
41 balancermember_options => 'check inter 10s fastinter 2s downinter 3s rise 3 fall 3', 44 balancermember_options => 'check inter 10s fastinter 2s downinter 3s rise 3 fall 3',
42 haproxy_config_options => { 45 haproxy_config_options => {
@@ -53,7 +56,10 @@ if $kibana_tls['enabled'] {
53 order => '921', 56 order => '921',
54 internal_ssl => true, 57 internal_ssl => true,
55 internal_ssl_path => $kibana_tls['cert_file_path'], 58 internal_ssl_path => $kibana_tls['cert_file_path'],
59 internal_virtual_ip => $kibana_vip,
56 listen_port => $kibana_frontend_port, 60 listen_port => $kibana_frontend_port,
61 server_names => $kibana_nodes_names,
62 ipaddresses => $kibana_nodes_ips,
57 balancermember_port => $kibana_backend_port, 63 balancermember_port => $kibana_backend_port,
58 balancermember_options => 'check inter 10s fastinter 2s downinter 3s rise 3 fall 3', 64 balancermember_options => 'check inter 10s fastinter 2s downinter 3s rise 3 fall 3',
59 haproxy_config_options => { 65 haproxy_config_options => {
@@ -67,7 +73,10 @@ if $kibana_tls['enabled'] {
67 order => '922', 73 order => '922',
68 internal_ssl => true, 74 internal_ssl => true,
69 internal_ssl_path => $kibana_tls['cert_file_path'], 75 internal_ssl_path => $kibana_tls['cert_file_path'],
76 internal_virtual_ip => $kibana_vip,
70 listen_port => $kibana_frontend_viewer_port, 77 listen_port => $kibana_frontend_viewer_port,
78 server_names => $kibana_nodes_names,
79 ipaddresses => $kibana_nodes_ips,
71 balancermember_port => $kibana_backend_viewer_port, 80 balancermember_port => $kibana_backend_viewer_port,
72 balancermember_options => 'check inter 10s fastinter 2s downinter 3s rise 3 fall 3', 81 balancermember_options => 'check inter 10s fastinter 2s downinter 3s rise 3 fall 3',
73 haproxy_config_options => { 82 haproxy_config_options => {
@@ -81,7 +90,10 @@ if $kibana_tls['enabled'] {
81} else { 90} else {
82 openstack::ha::haproxy_service { 'kibana': 91 openstack::ha::haproxy_service { 'kibana':
83 order => '921', 92 order => '921',
93 internal_virtual_ip => $kibana_vip,
84 listen_port => $kibana_frontend_port, 94 listen_port => $kibana_frontend_port,
95 server_names => $kibana_nodes_names,
96 ipaddresses => $kibana_nodes_ips,
85 balancermember_port => $kibana_backend_port, 97 balancermember_port => $kibana_backend_port,
86 balancermember_options => 'check inter 10s fastinter 2s downinter 3s rise 3 fall 3', 98 balancermember_options => 'check inter 10s fastinter 2s downinter 3s rise 3 fall 3',
87 haproxy_config_options => { 99 haproxy_config_options => {
@@ -93,7 +105,10 @@ if $kibana_tls['enabled'] {
93 if $authnz['ldap_enabled'] and $authnz['ldap_authorization_enabled'] { 105 if $authnz['ldap_enabled'] and $authnz['ldap_authorization_enabled'] {
94 openstack::ha::haproxy_service { 'kibana-viewer': 106 openstack::ha::haproxy_service { 'kibana-viewer':
95 order => '922', 107 order => '922',
108 internal_virtual_ip => $kibana_vip,
96 listen_port => $kibana_frontend_viewer_port, 109 listen_port => $kibana_frontend_viewer_port,
110 server_names => $kibana_nodes_names,
111 ipaddresses => $kibana_nodes_ips,
97 balancermember_port => $kibana_backend_viewer_port, 112 balancermember_port => $kibana_backend_viewer_port,
98 balancermember_options => 'check inter 10s fastinter 2s downinter 3s rise 3 fall 3', 113 balancermember_options => 'check inter 10s fastinter 2s downinter 3s rise 3 fall 3',
99 haproxy_config_options => { 114 haproxy_config_options => {
diff --git a/deployment_scripts/puppet/manifests/hiera_override.pp b/deployment_scripts/puppet/manifests/hiera_override.pp
index ed97308..4b02642 100644
--- a/deployment_scripts/puppet/manifests/hiera_override.pp
+++ b/deployment_scripts/puppet/manifests/hiera_override.pp
@@ -21,7 +21,7 @@ prepare_network_config($network_scheme)
21 21
22$elasticsearch_kibana = hiera_hash('elasticsearch_kibana') 22$elasticsearch_kibana = hiera_hash('elasticsearch_kibana')
23$hiera_file = '/etc/hiera/plugins/elasticsearch_kibana.yaml' 23$hiera_file = '/etc/hiera/plugins/elasticsearch_kibana.yaml'
24$listen_address = get_network_role_property('elasticsearch', 'ipaddr') 24$es_listen_address = get_network_role_property('elasticsearch', 'ipaddr')
25$es_nodes = get_nodes_hash_by_roles($network_metadata, ['elasticsearch_kibana', 'primary-elasticsearch_kibana']) 25$es_nodes = get_nodes_hash_by_roles($network_metadata, ['elasticsearch_kibana', 'primary-elasticsearch_kibana'])
26$es_addresses_map = get_node_to_ipaddr_map_by_network_role($es_nodes, 'elasticsearch') 26$es_addresses_map = get_node_to_ipaddr_map_by_network_role($es_nodes, 'elasticsearch')
27$es_ip_addresses = sort(values($es_addresses_map)) 27$es_ip_addresses = sort(values($es_addresses_map))
@@ -29,7 +29,18 @@ $es_nodes_count = count($es_nodes)
29if ! $network_metadata['vips']['es_vip_mgmt'] { 29if ! $network_metadata['vips']['es_vip_mgmt'] {
30 fail('Elasticsearch VIP is not defined') 30 fail('Elasticsearch VIP is not defined')
31} 31}
32$vip = $network_metadata['vips']['es_vip_mgmt']['ipaddr'] 32$elasticsearch_vip = $network_metadata['vips']['es_vip_mgmt']['ipaddr']
33
34# For security reasons (eg not exposing Kibana directly on the public network),
35# only the Kibana VIP should listen on the 'kibana' network and the Kibana
36# services themselves should listen on the 'elasticsearch' network which is an
37# equivalent of the management network for OpenStack.
38$kibana_listen_address = $es_listen_address
39$kibana_ip_addresses = $es_ip_addresses
40if ! $network_metadata['vips']['kibana'] {
41 fail('Kibana VIP is not defined')
42}
43$kibana_vip = $network_metadata['vips']['kibana']['ipaddr']
33 44
34if is_integer($elasticsearch_kibana['number_of_replicas']) and $elasticsearch_kibana['number_of_replicas'] < $es_nodes_count { 45if is_integer($elasticsearch_kibana['number_of_replicas']) and $elasticsearch_kibana['number_of_replicas'] < $es_nodes_count {
35 $number_of_replicas = 0 + $elasticsearch_kibana['number_of_replicas'] 46 $number_of_replicas = 0 + $elasticsearch_kibana['number_of_replicas']
@@ -127,9 +138,9 @@ $calculated_content = inline_template('
127lma::corosync_roles: 138lma::corosync_roles:
128 - primary-elasticsearch_kibana 139 - primary-elasticsearch_kibana
129 - elasticsearch_kibana 140 - elasticsearch_kibana
130lma::elasticsearch::vip: <%= @vip %> 141lma::elasticsearch::vip: <%= @elasticsearch_vip %>
131lma::elasticsearch::es_haproxy_service: elasticsearch-rest 142lma::elasticsearch::es_haproxy_service: elasticsearch-rest
132lma::elasticsearch::listen_address: <%= @listen_address%> 143lma::elasticsearch::listen_address: <%= @es_listen_address%>
133<% if @tls_enabled -%> 144<% if @tls_enabled -%>
134lma::elasticsearch::kibana_frontend_port: 443 145lma::elasticsearch::kibana_frontend_port: 443
135lma::elasticsearch::kibana_frontend_viewer_port: 8443 146lma::elasticsearch::kibana_frontend_viewer_port: 8443
@@ -158,6 +169,12 @@ lma::elasticsearch::jvm_size: <%= @elasticsearch_kibana["jvm_heap_size"] %>
158lma::elasticsearch::instance_name: <%= @instance_name %> 169lma::elasticsearch::instance_name: <%= @instance_name %>
159lma::elasticsearch::node_name: "<%= @fqdn %>_es-01" 170lma::elasticsearch::node_name: "<%= @fqdn %>_es-01"
160lma::elasticsearch::cluster_name: lma 171lma::elasticsearch::cluster_name: lma
172lma::kibana::vip: <%= @kibana_vip %>
173lma::kibana::listen_address: <%= @kibana_listen_address%>
174lma::kibana::nodes:
175<% @kibana_ip_addresses.each do |x| -%>
176 - "<%= x %>"
177<% end -%>
161lma::kibana::tls: 178lma::kibana::tls:
162 enabled: <%= @tls_enabled %> 179 enabled: <%= @tls_enabled %>
163<% if @tls_enabled -%> 180<% if @tls_enabled -%>
diff --git a/deployment_scripts/puppet/manifests/provision_services.pp b/deployment_scripts/puppet/manifests/provision_services.pp
index 9a08019..c18933f 100644
--- a/deployment_scripts/puppet/manifests/provision_services.pp
+++ b/deployment_scripts/puppet/manifests/provision_services.pp
@@ -16,7 +16,8 @@ notice('fuel-plugin-elasticsearch-kibana: provision_services.pp')
16 16
17$deployment_id = hiera('deployment_id') 17$deployment_id = hiera('deployment_id')
18$master_ip = hiera('master_ip') 18$master_ip = hiera('master_ip')
19$vip = hiera('lma::elasticsearch::vip') 19$es_vip = hiera('lma::elasticsearch::vip')
20$kibana_vip = hiera('lma::kibana::vip')
20$kibana_viewer_port = hiera('lma::elasticsearch::kibana_frontend_viewer_port') 21$kibana_viewer_port = hiera('lma::elasticsearch::kibana_frontend_viewer_port')
21$es_port = hiera('lma::elasticsearch::rest_port') 22$es_port = hiera('lma::elasticsearch::rest_port')
22$number_of_replicas = hiera('lma::elasticsearch::number_of_replicas') 23$number_of_replicas = hiera('lma::elasticsearch::number_of_replicas')
@@ -33,14 +34,14 @@ if $kibana_tls['enabled'] {
33 $kibana_hostname = $kibana_tls['hostname'] 34 $kibana_hostname = $kibana_tls['hostname']
34 if $two_links { 35 if $two_links {
35 $kibana_link_data = "{\"title\":\"Kibana (Admin role)\",\ 36 $kibana_link_data = "{\"title\":\"Kibana (Admin role)\",\
36 \"description\":\"Dashboard for visualizing logs and notifications (${kibana_hostname}: ${protocol}://${vip})\",\ 37 \"description\":\"Dashboard for visualizing logs and notifications (${kibana_hostname}: ${protocol}://${kibana_vip})\",\
37 \"url\":\"${protocol}://${kibana_hostname}\"}" 38 \"url\":\"${protocol}://${kibana_hostname}\"}"
38 $kibana_link_viewer_data = "{\"title\":\"Kibana (Viewer role)\",\ 39 $kibana_link_viewer_data = "{\"title\":\"Kibana (Viewer role)\",\
39 \"description\":\"Dashboard for visualizing logs and notifications (${kibana_hostname}: ${protocol}://${vip}:${kibana_viewer_port})\",\ 40 \"description\":\"Dashboard for visualizing logs and notifications (${kibana_hostname}: ${protocol}://${kibana_vip}:${kibana_viewer_port})\",\
40 \"url\":\"${protocol}://${kibana_hostname}:${kibana_viewer_port}/\"}" 41 \"url\":\"${protocol}://${kibana_hostname}:${kibana_viewer_port}/\"}"
41 } else { 42 } else {
42 $kibana_link_data = "{\"title\":\"Kibana\",\ 43 $kibana_link_data = "{\"title\":\"Kibana\",\
43 \"description\":\"Dashboard for visualizing logs and notifications (${kibana_hostname}: ${protocol}://${vip})\",\ 44 \"description\":\"Dashboard for visualizing logs and notifications (${kibana_hostname}: ${protocol}://${kibana_vip})\",\
44 \"url\":\"${protocol}://${kibana_hostname}\"}" 45 \"url\":\"${protocol}://${kibana_hostname}\"}"
45 } 46 }
46} else { 47} else {
@@ -48,24 +49,24 @@ if $kibana_tls['enabled'] {
48 if $two_links { 49 if $two_links {
49 $kibana_link_data = "{\"title\":\"Kibana (Admin role)\",\ 50 $kibana_link_data = "{\"title\":\"Kibana (Admin role)\",\
50 \"description\":\"Dashboard for visualizing logs and notifications\",\ 51 \"description\":\"Dashboard for visualizing logs and notifications\",\
51 \"url\":\"${protocol}://${vip}\"}" 52 \"url\":\"${protocol}://${kibana_vip}\"}"
52 $kibana_link_viewer_data = "{\"title\":\"Kibana (Viewer role)\",\ 53 $kibana_link_viewer_data = "{\"title\":\"Kibana (Viewer role)\",\
53 \"description\":\"Dashboard for visualizing logs and notifications\",\ 54 \"description\":\"Dashboard for visualizing logs and notifications\",\
54 \"url\":\"${protocol}://${vip}:${kibana_viewer_port}/\"}" 55 \"url\":\"${protocol}://${kibana_vip}:${kibana_viewer_port}/\"}"
55 } else { 56 } else {
56 $kibana_link_data = "{\"title\":\"Kibana\",\ 57 $kibana_link_data = "{\"title\":\"Kibana\",\
57 \"description\":\"Dashboard for visualizing logs and notifications\",\ 58 \"description\":\"Dashboard for visualizing logs and notifications\",\
58 \"url\":\"${protocol}://${vip}\"}" 59 \"url\":\"${protocol}://${kibana_vip}\"}"
59 } 60 }
60} 61}
61 62
62lma_logging_analytics::es_template { ['log', 'notification']: 63lma_logging_analytics::es_template { ['log', 'notification']:
63 number_of_replicas => $number_of_replicas, 64 number_of_replicas => $number_of_replicas,
64 host => $vip, 65 host => $es_vip,
65 port => $es_port, 66 port => $es_port,
66} -> 67} ->
67class { 'lma_logging_analytics::curator': 68class { 'lma_logging_analytics::curator':
68 host => $vip, 69 host => $es_vip,
69 port => $es_port, 70 port => $es_port,
70 retention_period => hiera('lma::elasticsearch::retention_period'), 71 retention_period => hiera('lma::elasticsearch::retention_period'),
71 prefixes => ['log', 'notification'], 72 prefixes => ['log', 'notification'],