Commit Graph

113 Commits

Author SHA1 Message Date
okozachenko 48a59b1324 set startupProbe in nova compute
In environments where there is a large number of ports (100+) on a
hypervisor, the start up can take a long time, and eventually the
liveness test will fail because the process is stuck plugging ports
in.
No need initial delay for live/readiness probe and Startup probe
is enough

Change-Id: I54544a45a716fa4ff840019c0526343063ed1ac5
2024-01-04 08:12:59 -06:00
josebb 8b2ba7b029 Support TLS endpoints in nova
This allows nova to consume TLS openstack endpoints.
Jobs consume openstack endpoints, typically identity endpoints.
And nova itself interact with other openstack services via
endpoints.

Change-Id: Iff4422360ca51e94fd1b00854693e266cc202390
2022-04-01 19:05:59 +03:00
Thiago Brito 45ea26175b Enable taint toleration for nova
This changes use the helm-toolkit template for toleration
in openstack services

Signed-off-by: Lucas Cavalcante <lucasmedeiros.cavalcante@windriver.com>
Story: 2009276
Task: 43531
Depends-On: I168837f962465d1c89acc511b7bf4064ac4b546c
Change-Id: I72a4f6073eaf19c662ccd0b3e35ca62c5b88ad65
2022-03-28 10:44:19 -03:00
Hugo Brito 3ff41ce11c Remove ssh-config
All ssh configurations for the nova-compute pods
are now done by _ssh-init.sh.tpl . This patch removes
the ssh-config that is not needed anymore.

Signed-off-by: Hugo Brito <hugo.brito@windriver.com>
Change-Id: Ib1b24466678a0df28a3ce7ba4d3fe94bfb169702
2022-02-04 10:05:14 -03:00
Thiago Brito c63b1920d5 Fix nova-compute-ssh init to execute as runAsUser
On _ssh-init.sh.tpl, despite one change the runAsUser for the
nova-compute container on the securityContext, the ssh keys are always
being copied into the 'nova' user's folder. This change fixes it by
getting the correct user defined on the securityContext and copying the
keys to its correct folder.

Signed-off-by: Thiago Brito <thiago.brito@windriver.com>
Change-Id: Ia7883dc4626a295892eb4637ef717b0b1725ac89
2022-01-12 17:32:12 -03:00
Chris Wedgwood 3a5c7afba1 [nova] add missing 'runlock' hostMount when enable_scsi
Change-Id: Ia6c9b50ae81bec238c4cabc422fe7140347a50a6
2021-08-06 12:51:42 -05:00
Haider, Nafiz (nh532m) c900712f30 feat(tls): Make openstack services compatible with rabbitmq TLS
Depends-on: https://review.opendev.org/c/openstack/openstack-helm-infra/+/770678

Co-authored-by: Sangeet Gupta <sg774j@att.com>

Change-Id: I11e9ad3f4079b0e12e498f9ed57e5b87ae9dc66a
2021-05-21 01:27:18 +00:00
Karl Kloppenborg d2e2d58a5f Add ISCSI Multipath support when enable_iscsi true
When using iscsi in both cinder and nova multipath tooling access is not
currently available. This commit provides the host system access to
configure and control multipath.
This commit has been tested in our own production systems however this
is my first commit into Openstack-Helm so please review carefully and
provide me guidance on what I might be able to do better.

Change-Id: I4f017f67a5d80b9c931e2ee1653062aa503a7fd9
2021-04-12 08:28:56 +00:00
okozachenko 04d600c5b0 Mount /dev/pts in nova-compute container
Nova will check if pty device exist or not under /dev/pts
when get console log.
If it does not exist, cannot get console log.
ref: https://review.opendev.org/c/starlingx/config/+/660268

Change-Id: I2793d1f51c18e81a4271b8b0c50bfe1a2dab8a09
2021-03-01 17:43:42 +02:00
Chris Wedgwood 61c167d359 [nova,cinder] Use HostToContainer mount propagation
Bidirectional mount propagation doesn't work as expected,
HostToContainer does and is the safer option for now.

Change-Id: Ia0b0ab1a74991745cd74d3629d23f86bd8ff5296
2021-02-02 12:19:57 +00:00
Sphicas, Phil (ps3910) c7c19e85c0 Use HostToContainer mountPropagation
For any host mounts that include /var/lib/kubelet, use HostToContainer
mountPropagation, which avoids creating extra references to mounts in
other containers.

Affects the following resources:
* neutron-lb-agent daemonset
* neutron-ovs-agent daemonset
* neutron-sriov-agent daemonset (unused mount removed)
* nova-compute daemeonset

Change-Id: I92f1700e56517a74b1fbcc8e3a68567045a593ee
2021-01-07 20:27:08 +00:00
Chris Wedgwood 097632ebbf [nova-compute] Enable hostIPC
IPC is used by the multipath processes, hostIPC should be set so
semaphore operations work between the nova-compute pod and the host.

Without this things like `multipath -f ...` stall until timeout.

Change-Id: Iaeb6dff2ae934eabf5faddf930ba2029c0698f90
2020-12-22 17:23:08 -06:00
okozachenko 74b119db35 Add nova-compute-ssh
Change-Id: Ia555bb69182441d5f17040504efc7d1d524e59ec
2020-09-25 17:39:05 +03:00
Andrii Ostapenko 44d263b2bf Enable templates linting
- braces
- brackets
- colons
- commas
- comments
- hyphens
- indentation
- key-duplicates

with corresponding code changes.

Also disable enforcement for document-(start|end) rules and
disables warnings to increase readability.

* Unrestrict octal values rule since benefits of file modes readability
  exceed possible issues with yaml 1.2 adoption in future k8s versions.
  These issues will be addressed when/if they occur.

Change-Id: Ic5e327cf40c4b09c90738baff56419a6cef132da
Signed-off-by: Andrii Ostapenko <andrii.ostapenko@att.com>
2020-07-11 00:52:51 +00:00
Andrii Ostapenko 0807ecb354 Add security context from snippet for tungstenfabric container
Change-Id: I4db982e8f600288ec954d4c019f096bd8dcd7e52
Signed-off-by: Andrii Ostapenko <andrii.ostapenko@att.com>
2020-07-11 00:52:46 +00:00
Tin Lam 918a307427 feat(tls): add tls support to openstack services
This patch set enables TLS for the following OpenStack services: keystone,
horizon, glance, cinder, heat, nova, placement and neutron for s- (stein)
and t- (train) release. This serves as a consolidation and clean up patch
for the following patches:

[0] https://review.opendev.org/#/c/733291
[1] https://review.opendev.org/#/c/735202
[2] https://review.opendev.org/#/c/733962
[3] https://review.opendev.org/#/c/733404
[4] https://review.opendev.org/#/c/734896

This also addresses comments mentioned in previous patches.

Co-authored-by: Gage Hugo <gagehugo@gmail.com>
Co-authored-by: sgupta <sg774j@att.com>

Depends-on: https://review.opendev.org/#/c/737194/

Change-Id: Id34ace54298660b4b151522916e929a29f5731be
Signed-off-by: Tin Lam <tin@irrational.io>
2020-07-10 09:36:31 -05:00
OlegBravo 4f2eb8cac6 Add TungstenFabric compatibility to charts
The charts changes are required for deployment
of various clouds based on Tungsten Fabric SDN.
Right now it's tested for Airship-in-a-bottle.

The code cannot be tested currently in
OpenStack Helm project because of absence of
tests and platform for that.

This patchset doesn't have Heat-related changes,
they'll be added later.

Change-Id: I73f2ced2b09dbb93146334b59fe4571fa13dbfb0
Depends-On: https://review.opendev.org/#/c/734635/
2020-06-26 10:39:20 +03:00
Zuul 8c073c5767 Merge "[nova] Unhardcode readiness/liveness probe timings" 2020-06-03 07:36:07 +00:00
Gage Hugo db79e79788 Remove OSH Authors copyright
The current copyright refers to a non-existent group
"openstack helm authors" with often out-of-date references that
are confusing when adding a new file to the repo.

This change removes all references to this copyright by the
non-existent group and any blank lines underneath.

Change-Id: Ia035037e000f1bf95202fc07b8cd1ad0fc019094
2020-04-03 20:53:32 +00:00
Oleksii Grudev af4e2aaadd [nova] Unhardcode readiness/liveness probe timings
This patch adds ability to unhardcode readiness/
liveness probes timings. Moreover it introduces
RPC_PROBE_TIMEOUT and RPC_PROBE_RETRIES variables
which are passed to health probe script and
allow to unhardcode RPCtest  timeout and number of
retries

Change-Id: I2498a14e97557feafbd45c8df3c683f8500026e6
2020-04-01 14:54:57 +03:00
Huang, Sophie (sh879n) 8a7b7ba086 Enable Cinder backends to use iSCSI for data traffic
In this patchset, the iSCSI protocol support is added
to enable Cinder to use iSCSI based storage backends.

Bootable volumes are not supported, only VM attached
volumes are supported for this initial patchset.

Change-Id: I1b35290b62d2cebae4bd8be62126a53f230ac6c0
2020-03-16 14:23:23 +00:00
Zuul 3c093d2dea Merge "Revert "Modify files related to overrides."" 2020-03-13 22:41:15 +00:00
Pete Birley 728b3739cf Revert "Modify files related to overrides."
This reverts commit 0389b54578.

Change-Id: I91f2c87f51978fe0a35143757c19fe789f7e0669
see: https://review.opendev.org/#/c/712959/1
2020-03-13 14:08:31 +00:00
dt241s@att.com ef1f5ec153 Enable Apparmor to Nova components
Change-Id: Icefa9c91899110d7560dae7e73f9dd932e88e3fa
2020-03-10 02:24:58 +00:00
songgongjun 0389b54578 Modify files related to overrides.
As the functions of overrides are upgraded,the
files that depend on the functions of overrides
need to be modified synchronously.This patch and
https://review.opendev.org/#/c/707788/ depend on
each other.

Story: 2007291
Task: 38753
Depends-on: https://review.opendev.org/#/c/707788/
Change-Id: I048c8fe73f8f85df465f2c829812b75be1e4f130
Signed-off-by: songgongjun <gongjun.song@intel.com>
2020-03-03 20:06:45 +08:00
Sangeet Gupta 414b10fab0 Fix health-probe concurrency and timings
Changed Nova and Neutron health-probe script to exit if previous
probe process is still running.
The health-probe has RPC call timeout of 60 seconds and has 2
retries. In worst case scenario the probe process can run a little
over 180 seconds. Changing the periodSeconds so that probe starts
after previous one is complete. Also changing timeoutSeconds value
a little to give little more extra time for the probe to finish.
Increasing the liveness probe periods as they are not do critical
which will reduce the resource usage for the probes.

Co-authored-by: Randeep Jalli <rj2083@att.com>

Change-Id: Ife1c381d663c1e271a5099bdc6d0dfefb00d8d73
2020-02-18 17:24:23 +00:00
Gage Hugo a1fc694ae9 Move apparmor to use feature gates
This change refactors the apparmor job to utilize the feature
gates system instead of relying on separate scripts.

Also disabled barbican running in the apparmor job temporarily
until the correct profile gets used and it can deploy
succesfully.

Change-Id: Iadacd214de3fdb06e4acde4433c5fa86973371d5
2020-01-31 22:24:55 +00:00
Tin Lam bf434ffd67 Add capability for using FQDN in nova compute
This patch set adds in a capability for the user to defaultly use a
FQDN for the nova compute hostname and the hypervisor hostname when
the host is not explicitly specified in the .Values.conf override.

Change-Id: I3243068dfe91ebb97b3885002296a0f454822ec5
Co-authored-by: Drew Walters <andrew.walters@att.com>
Signed-off-by: Tin Lam <tin@irrational.io>
2020-01-01 20:01:25 +00:00
zhipengl 20deb70c75 [Nova] Fix a bug introduced in implementing security context for nova
In daemonset-compute.yaml, it uses a wrong application name
Bug introduced in commit-id:9b42e8a1c0e68404bf13487dbfb699b1bd0e4c01

Change-Id: I614dc9d52d6dd7b346aa0b3f5e0012686de93ced
Signed-off-by: zhipengl <zhipengs.liu@intel.com>
2019-10-12 01:11:36 +00:00
Pete Birley fd37d61b12 Nova: Provide method for removing sections from nova compute conf
This PS provides a method to redact sectionf from the nova compute
configuration file. By default this is configured to redact the
db connection strings, and sections.

Change-Id: Ifb50b932155c166634bb8a88363f6c02fbde8389
Signed-off-by: Pete Birley <pete@port.direct>
2019-06-28 16:55:29 -05:00
Pete Birley 31bd9c832d Logs: Make it optional to use log_config_append option
This PS enables the use of simple logging options if desired.

Change-Id: If6ea420c6ed595b3b6b6eedf99a0bf26a20b6abf
Signed-off-by: Pete Birley <pete@port.direct>
2019-06-17 13:51:21 -05:00
pd2839 9b42e8a1c0 Implement Security Context for Nova
Implement container security context for the following Nova resources:
 - Nova server deployment

Change-Id: I02743cff46d9a043ccb029547c819fafd9da3611
2019-06-03 12:31:18 -05:00
Zuul 778f13f568 Merge "Start nova sshd container only if enabled" 2019-05-01 15:09:37 +00:00
Pete Birley 623c131292 OSH: Add emptydirs for tmp
This PS adds emptydirs backing the /tmp directory in pods, which
is required in most cases for full operation when using a read only
filesystem backing the container.

Additionally some yaml indent issues are resolved.

Change-Id: I9df8f70e913b911ff755600fa2f669d9c5dcb928
Signed-off-by: Pete Birley <pete@port.direct>
2019-04-20 08:55:44 -05:00
Gerry Kopec 52f8415deb Start nova sshd container only if enabled
Only start the sshd container of nova-compute pod if the capability is
enabled.  Defaults to off to allow cases where nova docker image does
not have ssh packages to run cleanly.

Story: 2003463
Task: 30441
Change-Id: I3acf5b654ecda23a93f6c28e865e1bbee14370aa
Signed-off-by: Gerry Kopec <Gerry.Kopec@windriver.com>
2019-04-10 00:36:07 -04:00
Gerry Kopec 5a7c6581ad Fix ssh config in nova to support cold migrations
- Fix .ssh/config file mapping
- Move private key from nova-compute-ssh container to nova-compute
  container.
- Map private and public keys to configmap-ssh which will default to
  the appropriate file permissions.
- Add additional config to /etc/ssh/sshd_config to allow passwordless
  root logins over appropriate subnet passed in from overrides.
- Remove chmods from sshd bash script as they are failing.

Depends on helm-toolkit supporting multiple containers per daemonset
pod.

Story: 2003463
Task: 24723
Change-Id: Idd2e802c293f1e14991ee787ade9a4936fb373ff
Signed-off-by: Gerry Kopec <Gerry.Kopec@windriver.com>
2019-04-09 22:24:46 +00:00
Zuul b1ecd6ab6b Merge "Add default-docker (enforce) AppArmor profile to nova" 2019-03-15 17:12:32 +00:00
Hyunsun Moon 4fa1f8e800 [nova] Mount ceph-keyring volume when needed
Change-Id: I7370db4c9177976f90176c027f4d65a3fe5b5649
2019-03-13 07:55:31 +00:00
Hemachandra Reddy 49b58b7e7d Health probe for Nova components
Health probe for Nova pods is used for both liveness
and readiness probe.

nova-compute, nova-conductor, nova-consoleauth and nova-scheduler:
Check if the rpc socket status on the nova pods to rabbitmq and
database are in established state.
sends an RPC call with a non-existence method to component's queue.
Probe is success if agent returns with NoSuchMethod error.
If agent is not reachable or fails to respond in time,
returns failure to probe.

novnc/spice proxy: uses Kubernetes tcp probe on corresponding ports
they expose.
Added code to catch nova config file not present exception.

Change-Id: Ib8e4b93486588320fd2d562c3bc90b65844e52e5
2019-03-06 19:34:49 +00:00
Jagan Kavva a32b05bfab Add default-docker (enforce) AppArmor profile to nova
Change-Id: I5a60efd133c156ce2ecac31d22e94b25e4e837bf
2019-02-28 14:35:33 -06:00
Steve Wilkerson f4c01d2461 Add release-uuid annotation to pod spec
This adds the release-uuid annotation to the pod spec for all
replication controller templates in the openstack-helm charts

Change-Id: I0159f2741c27277fd173208e7169ff657bb33e57
2019-02-12 12:31:59 -06:00
Pete Birley 65df9acaf8 Nova: Move ceph config to remain on host
Change-Id: I786f9fec553eb8b65faa5b8b022d6c971f7dfba1
Signed-off-by: Pete Birley <pete@port.direct>
2019-02-08 16:02:13 -06:00
Rahul Khiyani 1e85edddfc Fix for adding allowPrivilegeEscalation flag in container
securityContext in the charts whereever needed

Change-Id: I97f17ce0631051be33038449a21efee26c572613
2019-01-09 02:39:54 +00:00
Tin Lam a60cdbf310 Enable runAsUser in pod level
This patchset enables and moves the securityContext: runAsUser to the pod
level, and uses a non-root user (UID != 0) wherever applicable.

Depends-On: I95264c933b51e2a8e38f63faa1e239bb3c1ebfda
Change-Id: I81f6e11fe31ab7333a3805399b2e5326ec1e06a7
Signed-off-by: Tin Lam <tin@irrational.io>
2018-12-25 05:33:54 +00:00
Pete Birley bb7b973258 Nova: Mount cgroups read only
This PS updates the mount options for the nova-compute pod to mount
cgroups as read only within the pod.

Change-Id: I82e958c2865029cd4a093f62614a1e878075098a
Signed-off-by: Pete Birley <pete@port.direct>
2018-12-05 09:33:52 +00:00
Pete Birley 3ae745a10e Add release uuid to pods and rc objects
This PS adds the ability to attach a release uuid to pods and rc
objects as desired. A follow up ps will add the ability to add arbitary
annotations to the same objects.

Depends-On: Iceedba457a03387f6fc44eb763a00fd57f9d84a5
Change-Id: I324680f10263c1aefca2be9056e70d0ff22fcaf0
Signed-off-by: Pete Birley <pete@port.direct>
2018-09-13 06:29:14 -05:00
Chinasubbareddy M b2714cb111 Ceph-storage-init : make configmap and secret names to be driven via chart values
This is make ceph configmap and admin keyring secret names using
in storage init scripts to be read  from chart values as we may
have two ceph clusters  gets activated in one namespace and
each ceph clsuter will have its own configmap and admin secret names.

Change-Id: I84d94f3ac21e602c50619e456ff327ae1da53622
2018-09-05 14:56:00 +00:00
Jean-Philippe Evrard 05d0e2b4b8 Revert "Update OSH Author copyrights to OSF"
This reverts commit b1755c3993.

Change-Id: I215a172f2ff4220340292b95f5323847944baeb7
2018-08-28 17:25:13 +00:00
Matt McEuen b1755c3993 Update OSH Author copyrights to OSF
This PS updates the "Openstack-Helm Authors" copyright attribution
to be the "OpenStack Foundation", as decided in the 2018-03-20
team meeting:
http://eavesdrop.openstack.org/meetings/openstack_helm/2018/openstack_helm.2018-03-20-15.00.log.html

No other copyright attributions were changed.

Change-Id: I167ceedab8fadee28c19514fad6f125d0a521caf
2018-08-26 17:17:41 -05:00
Pete Birley 83b91e6e1b Openstack: Use k8s secret to store config
This PS moves openstack components in OSH to use secrets to store
potentially sensitive config information.

Depends-On: https://review.openstack.org/#/c/593732

Change-Id: I9bab586c03597effea0e48a58c69efff3f980a92
Signed-off-by: Pete Birley <pete@port.direct>
2018-08-22 20:39:52 -05:00