Commit Graph

288 Commits

Author SHA1 Message Date
Dmitriy Rabotyagov bd011b0eee Fix permissions for base directories
With fixing linters [1] I have accidentally set incorrect mode for base directories
to 0644 while it should be 0755.

[1] https://review.opendev.org/c/openstack/openstack-ansible-lxc_hosts/+/888180

Closes-Bug: #2047593
Change-Id: Ied402f4f22ac333573c7144877da669251eccf8c
2024-01-04 15:31:46 +01:00
Zuul 3d6a3d812d Merge "Stop installing openssh and rsync to containers" 2023-10-13 09:51:09 +00:00
Dmitriy Rabotyagov d4d8114a11 Stop installing openssh and rsync to containers
With fixing keystone role there should be no need in explicitly
installing rsync and openssh everywhere.

Depends-On: https://review.opendev.org/c/openstack/openstack-ansible-os_keystone/+/889934
Change-Id: I25729462fa6be7953e8ef0687ec4580509c21aaf
2023-10-12 08:01:57 +00:00
Jonathan Rosser d57f9a8f47 Remove lxc_cache_map variable
This has not had any practical use for several releases and mostly
carries copies of ansible facts. Remove the variable and use the
facts directly.

Change-Id: I1d2be9d07b38eaf2b737819c451a0d2339f723d0
2023-10-11 15:56:08 +00:00
Jonathan Rosser a22ec2150f Remove old tasks and vars from image download process
These are leftover from when the role downloaded prebuilt LXC
iamges, but are no longer used.

Change-Id: I3689e18cbd62804d7a959beb8f58f91920beecd1
2023-10-10 17:38:52 +01:00
Jonathan Rosser 655818e0a0 Remove old cleaup task
Change-Id: If065bbd51701591c5755278e86423ef46f01f893
2023-10-10 17:25:16 +01:00
Dmitriy Rabotyagov 4686fac862 Add retries to LXC base build command
Sometimes there could be intermittent issues on some of the
mirrors that would be picked while building the base image.

In order to increases chances of image to build, we add a retries
to increase chances to pick properly synced mirror.

Change-Id: I5546ee71cce4f4b40fbd1d38d5d49586606bbbda
2023-07-20 07:27:33 +00:00
Dmitriy Rabotyagov a5589beb5f Fix linters issue and metadata
With update of ansible-lint to version >=6.0.0 a lot of new
linters were added, that enabled by default. In order to comply
with linter rules we're applying changes to the role.

With that we also update metdata to reflect current state.

Change-Id: If6171be3d649f6e7dd26decf1460d45775bd5f9e
2023-07-20 07:27:08 +00:00
Dmitriy Rabotyagov a51291f87d Refactor LXC image expiration
Right now we write output of `date -d @{{ timestamp }} to
the expiry file, and then attempt to comapre with timestamp.
However, output of  `date -d` is datetime and not timestamp,
so these 2 things can not be properly compared. So image cache
was valid forever.

Change-Id: I42f5b43f09d3c530813dd7fd334eafce7a5eaf39
2023-07-20 07:25:46 +00:00
Zuul 6edd7f802b Merge "Allow to create OVS bridge for lxcbr0" 2023-01-13 17:36:25 +00:00
Jonathan Rosser e519c6b302 Remove "warn" paramter from command module
This is removed in ansible 2.14.

Change-Id: I38e2fdbbd6dab744199407504911caecdbfc140f
2023-01-10 08:38:49 +00:00
Dmitriy Rabotyagov db7c1e8a7c Allow to create OVS bridge for lxcbr0
This patch aims to handle creation of OVS bridge if
`lxc_net_bridge_type` is set to `openvswitch`. That will finalize path
when deployer prefers to have OVS as the only bridge provider and do not
use LXB for any bridges.

Change-Id: Idd7a6eecf718df7fd8b4ae008f7dc00e42e8c32c
2023-01-03 08:05:05 +00:00
Dmitriy Rabotyagov 9385ec8011 Add option to disable lxc interface management
This change adds a new role default option which will allow operators
to omit the deployment of specific lxc bridge network config. This
change is being implemented because, as an operator, I have a host
setup specifically built for OpenStack which includes an interface
config covering the lxc deployment. Currently when running a deployment
the role will attempt to deploy a new interface file which at best
conflicts with the host setup and at worst fails to run due to the
interface being in a state unknown to OSA.

The new config option `lxc_net_managed` is default **true** keeping
the existing expectations, but when set to **false** the role will
no longer deploy an interface file or attempt to bring up the interface
using the distro tools.

Signed-off-by: Kevin Carter <kevin@cloudnull.com>
Change-Id: Icdf4a1f5ff98dc1b86c6a87ea4e606b7c74e1aac
2022-11-29 17:27:05 +01:00
Dmitriy Rabotyagov 3d8e3690ba Replace ifupdown with native ip-link
We also leverage systemd-networkd for managing lxc-net and replace
using of custom service template for lxc-dnsmasq service with our
systemd-service role. These changes are quite tighten together, so
it's quite hard to split them in different patchsets.

Depends-On: https://review.opendev.org/c/openstack/ansible-role-systemd_service/+/861350
Change-Id: I5ac99e2b6c6e6ccd9da18ae68e1f8801f95f4f4e
2022-11-11 09:57:56 +01:00
Dmitriy Rabotyagov a09612c1fb Use policy_rc_d attribute instead of copy
Since ansible 2.8 it's possible to provide policy_rc_d attribute to the
apt module in order to avoid service restart on installation/upgrade

Change-Id: I299605bb5735cd510a82490a710ef6fae98bfafa
2022-09-26 13:30:35 +02:00
Erik Berg 028d3e5303 Remove redundant vars line
This line snuck in with Icfa97babeb7034cab623aca883bb83d5a07f7233
probably to bring it in line with other OSA roles, but should already
be covered by the distribution_major_version line above.

Change-Id: Ifa5d05a70988962e2bce8538204ddd3131ad6003
2022-09-15 10:15:43 +02:00
Dmitriy Rabotyagov f8594d335f Prevent lxc.service from being restarted on package update
As of today, each lxc-utils update would lead to restart of all
containers. At the same time this might be unwanted behaviour, as
if it's run without limit, all cluster members inside containers can
go down at the same time.

In order to prevent that, we place policy-rc.d file that will simply
quit with 101 code `action forbidden by policy` on service restart
attempt.

Change-Id: I9140b7ab9f9266fcf4fe800e4610497f2324df4e
2022-07-28 09:40:05 +00:00
Jonathan Rosser fd23eeedfc
Add centos-9 support
Remove installation of aria2 everywhere as we no longer download
lxc images but build them locally.

Change-Id: I5eba0b1f08cfe23998cf1116bb017e8a8ef0bb72
2022-05-19 17:23:09 -04:00
Dmitriy Rabotyagov 337ddf8780 Replace systemd-mount template with role
To reduce role complexity we replace separatelly maintained template
with systemd_mount role that is widely used across OSA.

Depends-On: https://review.opendev.org/c/openstack/openstack-ansible/+/836945
Change-Id: I23632f9c145be334b1d19067352f8b82114a1209
2022-04-07 11:40:09 +00:00
Jonathan Rosser 0c99f74c03 Remove legacy network scripts cleanup task
Change-Id: I9567a0319a4763ad3e37e4a8704751d7dfbf8b29
2022-02-02 03:59:07 -05:00
Jonathan Rosser b9cccb3a8b Refactor use of include_vars
Use a first_found lookup instead of a with_first_found loop so that
the 'paths' parameter can be used.

This ensures that only vars from the role are included, and not vars
from a parent calling role. This can happen when a parent role has
a higher priority vars file available for inclusion than the role
it calls.

Change-Id: Icfa97babeb7034cab623aca883bb83d5a07f7233
2022-01-24 16:43:10 +00:00
Jonathan Rosser 786c4fcf18 Switch all base images to be built locally rather than downloaded
This patch switches the debian/ubuntu OS to build their lxc base
images locally using debootstrap rather than download a pre-built
lxc image. This unifies the approach with Centos-8 which is already
building a local image using dnf.

The LXC cache prestage tasks are removed, and all variables
associated with the download of the lxc image are removed from
defaults/main.yml.

A new variable lxc_apt_mirror is introduced, which is passed to
debootstrap to provide the apt source that the container rootfs
should be built from.

Depends-On: https://review.opendev.org/786396
Change-Id: Ia5a62cee7ab493857df16f7ae906796d22ba616c
2021-04-22 12:55:26 +03:00
Jonathan Rosser 791b9e813e Optionally build container image as a local chroot
This change uses dnf to build the container image for Centos-8
using dnf locally rather than rely on an external image that is
downloaded and unpacked.

The existing image prestage commands are made conditional, and
an operating system specific command can be provided via role
variables to build a chroot in /var/lib/machines.

During the transition from Centos-8 to Centos-8-Stream, the
vars files are separated, with vars/redhat.yml covering Stream,
and vars/centos-8.3.yml covering legcay Centos-8.

In addition, the systemd-logind service is masked from the base
image. This is masked in the previously downloaded container base
image, so we ensure that the same is done for locally built chroots.

Depends-On: I31880ca995735b737d33532eaa4c29be02523117
Depends-On: I74f02669b013b8580d3469a8ffe214d88cd0f525
Change-Id: I1ddfe36259610b25e86b69d64d1d7f32a56c0e4d
2021-04-20 08:56:20 +00:00
Jonathan Rosser df9a63ea98 Remove references to unsupported operating systems
All references to Gentoo, SUSE, Debian stretch and Centos-7  are removed.
Conditional tasks, ternary operators and variables are simplified where possible
OS specific variables files are generalised where possible

Change-Id: I79f68c467d48b9b50143fd3a11e176f91804e805
2021-03-18 17:01:48 +00:00
Jonathan Rosser 6de26d8519 Use ansible_facts[] instead of fact variables
See https://github.com/ansible/ansible/issues/73654

Change-Id: If64c72dc2ffbf87459b4729b9c03928efbf5177c
2021-03-04 14:24:37 +00:00
Zuul 477ee3e086 Merge "Remove duplicate lxc volume tasks" 2021-03-02 01:00:37 +00:00
Zuul 35adaabc81 Merge "Move lxc cache facts setting to where those facts are used." 2021-03-02 00:58:17 +00:00
Zuul aeacf7c6d6 Merge "Remove workarounds for old systemd bugs" 2021-03-01 14:05:09 +00:00
Zuul e448431f13 Merge "Remove single task from lxc_apparmor file" 2021-03-01 00:44:50 +00:00
Zuul aaa8f73807 Merge "Update Centos-8 LXC image to 8.3" 2021-02-24 11:13:09 +00:00
Zuul 8ba7117429 Merge "Remove per-backend container creation tasks files" 2021-02-24 10:35:42 +00:00
Zuul 486c0dfdf2 Merge "Move kernel tuning tasks to lxc_post_install.yml" 2021-02-23 19:44:39 +00:00
Zuul 89a8b38ca9 Merge "Remove lxc_install task file which contains only one task" 2021-02-23 19:29:10 +00:00
Zuul d81a9ff0e8 Merge "Remove support for gentoo" 2021-02-23 10:55:04 +00:00
Zuul 9e76dc945f Merge "Remove support for openSUSE" 2021-02-23 10:50:49 +00:00
Jonathan Rosser 3f8a5b4ca3 Remove workarounds for old systemd bugs
These are now resolved:

Were are now later than systemd v231
https://bugs.launchpad.net/ubuntu/+source/lxc/+bug/1497420
https://github.com/lxc/lxc/issues/713

Change-Id: I3c427bc670815ee5bac677925b56df644f460271
2021-02-18 09:20:12 +00:00
Jonathan Rosser 611e278642 Remove single task from lxc_apparmor file
This can go in the lxc_install_apt tasks file where the previous
lxc_apparmor file was included

Change-Id: I2c23303a355c211c1d9d50238a24ef11c3f38580
2021-02-18 09:20:01 +00:00
Jonathan Rosser 7fc5e9950e Remove per-backend container creation tasks files
The same can be achieved with two ternary operators. Much
less code and duplication.

Default lxc_container_backing_store to 'dir' to match the
lxc_container_create role and further simplify the code.
Change-Id: I59bbbcd8a66970a4fb30339aed457b50fb4dad50
2021-02-18 09:19:47 +00:00
Jonathan Rosser 51ba33d7f5 Move kernel tuning tasks to lxc_post_install.yml
This was a single task in a task file which can be included with the
rest of the post installation tasks

Change-Id: Ic9e0e4fe28aeb3d22e9b06371ee01f923fcd26d9
2021-02-17 19:40:30 +00:00
Jonathan Rosser 478abec936 Remove lxc_install task file which contains only one task
Change-Id: I2dbd74d88ca3d04b55536fdd07f67c26b74f1b6c
2021-02-17 19:40:28 +00:00
Jonathan Rosser 59abc5a288 Remove support for gentoo
Openstack-Ansible does not maintain support for deploying on gentoo
so we can simplify this ansible role

Change-Id: If2a63a2743714745e0f0b0eea2ee3d5b8d4c9a35
2021-02-17 19:14:55 +00:00
Jonathan Rosser 1e8055c5bf Remove support for openSUSE
OpenStack-Ansible no longer supports openSUSE so we can simplify this
ansible role.

Change-Id: I4c53307d0d4f7a72010b878953f34ba0c8784922
2021-02-17 17:31:23 +00:00
Jonathan Rosser 608254f0a1 Remove duplicate lxc volume tasks
These tasks are duplicated in both lxc_cache_preparation_simple.yml
and lxc_volume.yml, so we remove one of the duplicate set of tasks.

Change-Id: I5e5ea241308a11b79864885584944037dfecc6bc
2021-02-17 13:35:08 +00:00
Jonathan Rosser 369c807b90 Move lxc cache facts setting to where those facts are used.
If we build a local chroot then the lxc_cache_prestage.yml tasks
are no longer required, but the cache facts are still used later in
the role. Move the settings of the facts closer to where the facts
are used.

Change-Id: Ie0bcf56f0ac12f5a5472f539824221f2d8f3c769
2021-02-17 13:30:17 +00:00
Jonathan Rosser d808ac2066 Reference the installed gpg key when setting up the EPEL repository
Building a chroot using dnf fails if the yum repo config does not
contain the url of the gpg key. This key url is present in the other
repo config files on a centos-8 stream system.

Change-Id: I97ad5d9f210a17a6a19f31c7e6cadee595dc7dca
2021-02-17 13:02:56 +00:00
Jonathan Rosser 172e3e4bd0 Update Centos-8 LXC image to 8.3
This requires extra ansible tasks to unpack the nested tar file
structure of the 8.3 container image.

Depends-On: I31880ca995735b737d33532eaa4c29be02523117
Change-Id: I443f5b9ecef1c142dcbcac91a0f36cb28035f3f6
2021-02-16 13:30:38 +00:00
Dmitriy Rabotyagov bd40afa00a Fix lxc_hosts_container_image_url condition
lxc_hosts_container_image_url is string, so can't be passed through bool
filter as it will always result as false.

Change-Id: I0f12760840d81c9d73118d63bc0927eab78b9df2
Closes-Bug: #1908544
2021-02-02 20:07:21 +02:00
Dmitriy Rabotyagov 46e10d21f1 Determine latest base image available
Closes-Bug: #1900884
Closes-Bug: #1900975
Change-Id: I362a15397fee891d967ce7150819b02312200d2e
2020-10-22 15:53:01 +00:00
Dmitriy Rabotyagov a6476c3f5b Increase amount of MaxSessions
For running bigger amount of ansible forks, we need to increase
ssh MaxSessions parameter for lxc hosts, since
all connections to lxc containers occur through hosts

Depends-On: https://review.opendev.org/758399
Change-Id: Ib3e850ba79658a42995cd782a11342aca6858342
2020-10-15 13:05:11 +00:00
Jonathan Rosser 01eecae8d3 Fix linter errors
Change-Id: Ifed6a818868943c19bbdb3620582c2f2aca3b937
2020-10-02 10:40:16 +01:00