Commit Graph

144 Commits

Author SHA1 Message Date
Dmitriy Rabotyagov 218724412b Allow to extend default ironic_driver_types
This patch implements extra variable that allows to define extra types
for ironic without need to fully override the existing ones.

Depends-On: https://review.opendev.org/c/openstack/openstack-ansible-os_tempest/+/907180
Change-Id: Ic35dbeae949ba4425a0e352e51de64122b7c13d5
2024-01-30 08:47:29 +00:00
Zuul 8a3b336ca3 Merge "Stop generating ssh keypair for ironic user" 2023-12-13 05:28:44 +00:00
Dmitriy Rabotyagov fcde81e4a7 Add quorum queues support for service
This change implements and enables by default quorum support
for rabbitmq as well as providing default variables to globally tune
it's behaviour.

In order to ensure upgrade path and ability to switch back to HA queues
we change vhost names with removing leading `/`, as enabling quorum
requires to remove exchange which is tricky thing to do with running
services.

Depends-On: https://review.opendev.org/c/openstack/openstack-ansible-plugins/+/896017
Change-Id: I0f6ae74be36c0cb7a2270cfa1085c44e6dd4dc77
2023-10-20 12:19:49 +00:00
Dmitriy Rabotyagov fb50e99438 Stop generating ssh keypair for ironic user
There is no obvious need to have an SSH keypairs for ironic user
I was not able to find any proof in the project installation guide that
such keypairs were ever needed. Thus, such functionality is removed.

Depends-On: https://review.opendev.org/c/openstack/openstack-ansible-plugins/+/896017
Change-Id: I493d5f5aa0a915e7bc9fb7dbcd2673749c0b95d3
2023-10-14 08:50:18 +00:00
Dmitriy Rabotyagov f5180b7ba1 Stop reffering _member_ role
Keystone has stopped providing or reffering `_member_` role for a while,
thus role should not be refferenced anymore.

Moreover, with 2023.1 service policies have dropped `_member_`
which resulted in the role to be insufficient for basic operations.

Change-Id: I3ee97d4b7a3070211dbba3824f9d605da3b8bd01
Related-Bug: #2029486
2023-08-15 13:02:56 +02:00
Dmitriy Rabotyagov 7226653ad9 Fix linters and metadata
With update of ansible-lint to version >=6.0.0 a lot of new
linters were added, that enabled by default. In order to comply
with linter rules we're applying changes to the role.

With that we also update metdata to reflect current state.

Depends-On: https://review.opendev.org/c/openstack/ansible-role-systemd_service/+/888223
Change-Id: I1ab9664505068c20924370790322caa67cc6e022
2023-07-14 18:07:30 +02:00
Damian Dabrowski 61fd6b6e14 Add TLS support to ironic backends
By overriding the variable `ironic_backend_ssl: True` HTTPS will
be enabled, disabling HTTP support on the ironic backend api.

The ansible-role-pki is used to generate the required TLS
certificates if this functionality is enabled.

Depends-On: https://review.opendev.org/c/openstack/openstack-ansible/+/879085
Change-Id: If97a857c36e9e3e7ad8a18926bb9cbf04189c7cb
2023-04-29 18:37:37 +02:00
Zuul e7099c1e47 Merge "Add a no_driver ironic driver type" 2023-04-04 19:29:17 +00:00
Zuul ee60da284a Merge "Install socat and configure ipmtool-socat console interface" 2023-04-04 19:29:13 +00:00
Jonathan Rosser 6eb9142fc6 Update IPA version for 2023.1 release of Ironic
Depends-On: https://review.opendev.org/c/openstack/openstack-ansible-os_swift/+/877534
Change-Id: Ia3964416f0ccba49d2986aa2d8fc91c16a7a53da
2023-03-21 19:01:13 +00:00
Jonathan Rosser 0a5de94bf3 Add a no_driver ironic driver type
Enabling this driver type ensures that the no-console, no-raid
and no-inspect interfaces are enabled so that they can be later
configured on a per-node basis if required.

These interfaces are useful to have enabled at the same time as
driver specific interfaces such as idrac or ilo in order so that
managment of specific functions can be disabled if required.

Change-Id: I2904ba005e3fa18faf8ccf04661e206501fa4aa3
2023-03-21 19:00:45 +00:00
Jonathan Rosser 11b162cfa3 Install socat and configure ipmtool-socat console interface
This patch adds the `console` field to the ironic_driver_types
variable and then enables a set of console drivers in the ironic
config through the `enabled_console_interfaces` option.

If `ipmitool-socat` is one of the enabled drivers, then the socat
distro package is installed to support that.

Defaults are added for socat bind address and port range to
use.

[1] https://opendev.org/openstack/ironic/src/branch/master/doc/source/admin/upgrade-to-hardware-types.rst

Change-Id: I36dd1a0ec69e5702143a1a26bd5901fc88706e84
2023-03-21 19:00:31 +00:00
Jonathan Rosser a2d0b5a192 Update IPA image for the Zed release
Change-Id: I0d32eb17594800d3df2b7197b002e9aac617185f
2023-01-09 14:48:41 +00:00
Jonathan Rosser c305af301b Allow user defined extra files to be added to ironic tftp directory
Some of these files are already statically defined in the role vars,
but cannot be extended. The new variable ironic_tftp_extra_content
allows either local files (path:) or files from a web server (url:)
to be copied into the tftp server root.

A feature like this is needed to copy EFI firmware to the tftp root
for ironic node CPU architectures that are different to the
ironic control plane nodes. The EFI firmware is sometimes not
available from the system package manager for architechtures
different to the host CPU.

Change-Id: Ie30c009d0704b87c2298088935a7f2ec0d55c6fb
2022-12-12 12:36:40 +00:00
Zuul 591399a999 Merge "Tidy definition of http dir for inspector" 2022-12-09 12:44:51 +00:00
Zuul ff48276ae5 Merge "Update variables for switchport introspection during inspection" 2022-12-08 21:45:15 +00:00
Zuul 1d20ba1a84 Merge "Add variable for user defined list of deploy images" 2022-12-08 21:41:52 +00:00
Zuul 9fb6b3df3c Merge "Allow extra plugin installation ironic/inspector venvs" 2022-12-08 21:41:51 +00:00
Jonathan Rosser 71d201fcba Allow extra plugin installation ironic/inspector venvs
Ironic and inspector are extensible via the stevedore framework.
In order to add extra plugins to the ironic and inspector venvs
extra variables are needed to supply user defined lists of python
packages to install.

Change-Id: I656abb90827486bbb69bf0ccd7e990fd680f2c51
2022-12-08 18:00:08 +00:00
Jonathan Rosser ba1d9e9d4b Tidy definition of http dir for inspector
The directory for the tftp server defined consistently between ironic
and inspector, but not for the http directory.

This patch makes the definition of the http directory work the same
way as the tftp one.

Change-Id: I8d893faa31e5858c4923cb12ef453ec9397db5df
2022-12-07 14:04:19 +00:00
Jonathan Rosser db106d8b88 Add variable for user defined list of deploy images
It might be needed to supply a list of extra deploy images as
well as the defaults, possibly to cover architectures in
addition to x86.

Change-Id: I2ecf21c44bac75b0e2cbf3bd786821ff0b7bf31a
2022-12-07 14:04:11 +00:00
Jonathan Rosser 5d29fb4e17 Update variables for switchport introspection during inspection
1) The variable to allow processing hooks to be configured is used
in the ironic-inspector template but not documented in the role defaults.
Add the default and an example of usage.

2) When using LLDP to discover switchport connections during
inspection it is necessary to pass an additional kernel parameter
to the deploy image but there is no variable to allow this to
happen. This patch adds a variable that the deployer can use
to pass arbitrary kernel parameters to the deploy image.

Change-Id: I2f67dfcf4164e009bf53e9324bd430aec4c97dcb
2022-12-07 14:04:02 +00:00
Jonathan Rosser b974a6c0e0 Refactor ironic deploy image handling.
The deploy image is required in two places in an ironic deployment,
first as images uploaded to glance for the ironic service, and second
as files on a web server for the ironic-inspector service.

Previously this role only placed the deploy images on the ironic
inspector web server, but this patch provides the functionality to
also upload the images to glance.

The variables for ironic deploy image source locations are
consolidated so that only one set are required to run the tasks
for both ironic and ironic-inspector, and several overrides are
available allowing the source to be overidden to a local mirror
easily.

Finally - the name of the files placed on the inspector web server
and into glance represent the upstream name of the image files rather
than generic names which lose versioning and release information.

Change-Id: I1aed9d97a4ddbfb70d2375f5204c55374d1067c9
2022-12-07 15:03:32 +01:00
Jonathan Rosser c9674b656e Allow ironic bmaas network gateway and dns servers to be undefined
For a simple unrouted network these do not exist, but the role
currently forces bogus values to be given for the dhcpd template.

Allow the values to be unset to reduce confusion.

Change-Id: I609a05c50d1de5668f2b092e3a3ef1015e944fe6
2022-11-25 14:38:54 +00:00
Jonathan Rosser 6c8437c326 Allow ironic inspector callback URL to be overridden
Define the callback URL in the role defaults so it can be specifically
overridden rather than needing to use config_template to override
the entire kernel parameters line in the inspector ipxe config.

Change-Id: Ib8d53b394937405c821687b1c46b2b19112267dd
2022-10-06 21:48:25 +00:00
James Denton 90d0204a43 Replace pxe_append_params with kernel_pxe_params in ironic.conf
Ironic has replaced deprecated pxe_append_params config option
with kernel_pxe_params. The ironic.conf template has been changed
accordingly, but support remains for config override
ironic_pxe_append_params.

Change-Id: Icedd2b8f0e81607caba93afd34557bd4c3a88b4d
2022-09-14 02:15:40 +00:00
Jonathan Rosser b4161545b3 Bind http and tftp services to the bmaas network
Currently the ironic role uses ansible_host as the IP to bind these
services to, which means that in an LXC deployment it is not
possible to provision ironic hosts on the bmaas network as
the services are instead bound to the mgmt network.

The code worked previously as it is most likley developed on metal
and the CI job does not actually enrol/provision a node so the
test coverage is very small.

Depends-On: https://review.opendev.org/c/openstack/openstack-ansible/+/852174
Depends-On: https://review.opendev.org/c/openstack/openstack-ansible/+/854231
Change-Id: Id544d395f42f4c36a17e9c20a35aeb56a5e3bf03
2022-09-13 07:35:09 +00:00
Dmitriy Rabotyagov 20a533dd53 Support service tokens
Implement support for service_tokens. For that we convert
role_name to be a list along with renaming corresponding variable.

Additionally service_type is defined now for keystone_authtoken which
enables to validate tokens with restricted access rules

Depends-On: https://review.opendev.org/c/openstack/openstack-ansible-plugins/+/845690
Change-Id: I1d70c2c46fef6ffc0fcebe4b56a0ecdedc1d3298
2022-06-17 06:26:07 +00:00
Zuul 28795b1050 Merge "Update Ironic Inspector for Metal Deployments" 2022-01-20 19:12:18 +00:00
James Denton f7e6cc04cf Update Ironic Inspector for Metal Deployments
This patchset aims to correct some design limitations with the current
ironic-inspector deploy process.

- a new ironic-inspector-dnsmasq service has been created to split
inspector-specific dnsmasq configuration out of the base dnsmasq
config files
- PXE/iPXE and UEFI support for ironic-inspector boot
- (todo) documentation improvements and diagrams

Depends-On: https://review.opendev.org/c/openstack/openstack-ansible/+/823426
Change-Id: Ib5cbb28f97dd7421bfecb815def89305f3b1da33
2022-01-11 19:56:38 +00:00
James Denton 4c6578538a Remove glance_api_servers from ironic.conf
The [glance]glance_api_servers configuration option has been deprecated
since Pike and removed in 2019 per Ironic commit
dcfb4f10f31c11afa350ef6418a0e12e6be6e5b2. Removing from ironic.conf
template.

Change-Id: I3b09514635ee0c8665c425bd1fe42fb594361a0e
2021-12-23 16:24:43 -06:00
Damian Dabrowski 9355e1dd2d Database connection pooling improvements
- Implemented new variable ``connection_recycle_time`` responsible for SQLAlchemy's connection recycling
- Set new default values for db pooling variables which are inherited from the global ones.

Depends-On: https://review.opendev.org/c/openstack/openstack-ansible/+/819424
Change-Id: I1c90ce68ce218d538cd89b111dc1ee4142f14eef
2021-12-02 19:18:25 +01:00
Dmitriy Rabotyagov 301900f373 Refactor definition of lock path
Depends-On: https://review.opendev.org/c/openstack/openstack-ansible/+/819300
Depends-On: https://review.opendev.org/c/openstack/ansible-role-systemd_service/+/819298
Change-Id: I4d2fe4659fed362ab0bb1c179339a623d7ce3e08
2021-11-30 12:14:13 +02:00
Dmitriy Rabotyagov 590541adc1 Refactor galera_use_ssl behaviour
With PKI role in place in most cases you don't need to explicitly
provide path to the CA file because PKI role ensures that CA is trusted
by the system overall. In the meanwhile in PyMySQL [1] you must either
provide CA file or cert/key or enable verify.

Since current behaviour is to provide path to the custom CA we expect
certificate being trusted overall. Thus we enable cert verification when
galera_use_ssl is True.

[1] 78f0cf99e5/pymysql/connections.py (L267)

Change-Id: I79e43119830da22f09d7666b25054c6c14c28ffb
2021-10-06 11:59:30 +00:00
Zuul fb96a661ff Merge "Add variables for rabbitmq ssl configuration" 2021-05-31 14:33:43 +00:00
Jonathan Rosser 029292a02d Add variables for rabbitmq ssl configuration
Change-Id: Icfe4696b0924abcf04d7f501186bf14d31c6fbdd
2021-05-17 10:49:26 +00:00
Dmitriy Rabotyagov 43f3f35afd Use global service variables
Instead of overriding each service separatelly it might make
sense for deployers to define some higher level variable that
will be used first or fallback to default variable.

Change-Id: Ib2928efaa35bd82f6e6f65fecf32cf8da2eb9f5d
2021-04-19 19:18:51 +00:00
Jonathan Rosser e5920f628e Use ansible_facts[] instead of fact variables
See https://github.com/ansible/ansible/issues/73654

Change-Id: If731b98c03bae2b38eb494c060699abea3cda9e0
2021-03-16 08:04:54 +00:00
Jonathan Rosser 9adda06789 Switch default virtualenv to python3
Change-Id: Id28e42c69d2e0a7f9688080d9bc8943c71744e26
2021-03-10 08:54:14 +00:00
Jonathan Rosser b4df743cfe Move ironic pip packages from constraints to requirements
This is necessary to use the new pip resolver

Depends-On: I6003a1004b6042a804ea142684b42b17f16d6da8
Change-Id: I06958da8881c93abde25c114d06943d777ea2b0a
2021-01-28 16:36:20 +00:00
Zuul 5ba9a1c6e8 Merge "Update Inspector listener address and network" 2020-11-10 13:57:30 +00:00
James Denton 7900aeb223 Update Inspector listener address and network
This patch allows ironic-inspector to listen on host IP
rather than 0.0.0.0, as well as allows an existing Neutron-managed
inspection network to be used for inspection traffic.

Change-Id: I645857ad62954f08b160e5889f93dc1f6423def2
2020-11-09 11:35:08 -06:00
Dmitriy Rabotyagov d509a5798f Reduce number of processes on small systems
Even the most modest 4C/8T system would run with the maximum 16 processes
due to the calculation being VCPU*2.

We devide amount of CPUs to number of threads for hyperthreaded CPUs

Change-Id: I67c151181cc358b1adb2ee4dc7aab8fbff2c25ba
2020-10-30 18:30:11 +02:00
James Denton 8f3a9e207c Add iPXE support to Ironic Conductor
This patchset adds support for iPXE, which can speed up baremetal
provisioning considerably due to the use of HTTP versus TFTP.

Change-Id: I8b49ae37a0380cd7a2191f050a52c85cc373026b
2020-10-22 15:24:19 +00:00
Zuul de902a0ba8 Merge "Use the utility host for db setup tasks" 2020-08-21 15:56:05 +00:00
Dmitriy Rabotyagov 9a5cbb3dfc Use the utility host for db setup tasks
Move it to the service setup host (defaults to utility[0]) instead
of the galera[0] host, and use galera_address (defaults to internal VIP)
as the endpoint instead of a local connection on the db host.

Change-Id: I87d61c619920a945c7a0b0887e3902f39f2b1b3c
2020-08-20 18:20:08 +03:00
Dmitriy Rabotyagov bea6f664bd Add ironic-inspector to constraints
We missed adding ironic-inspector to constraints which resulted
in installing always the latest avaialbe version in the pypi.

Depends-On: https://review.opendev.org/746931
Change-Id: I9a6e7273f752b6bdc1639be299e00933889b6cc9
2020-08-19 17:12:05 +03:00
Dmitriy Rabotyagov 75725919ab Cleanup after repo_build and pip_install retirement
Change-Id: I5af4ea54dcd2d416570f17bad676b79a08b78903
2020-05-12 22:06:44 +03:00
Guilherme Steinmüller 02750db47b Refactor memcached_servers
This patch aims to add a prefix for memcached_server
on each role to give the ability for deployers to
override the location of memcached cluster. I.e users
wants to create a single memcached cluster with k8s
for each service.

We also add pymemcache based on [1]

[1] https://review.opendev.org/711429

Change-Id: I7e3b2835f1cee2525b02960e2b7e4ee238373bcc
2020-03-16 13:57:29 +00:00
Cameron Loader 1f434661b1 Ironic fixes from inspector addition
1. There was an issue with pip packages not being installed when
inspector_hosts is not defined.

2. The db_setup task failed when inspector_hosts not defined because of
the condition.

Change-Id: I0ccd782ffd54322896559e5a6218ff532f3cae03
2020-02-19 11:31:55 -06:00