Skip to content

Commit 1ab16a9

Browse files
cardoecardoe
authored
Merge pull request #1044 from rackerlabs/add-cinder
feat: add deployment of OpenStack Cinder
2 parents 1bc84ba + e765527 commit 1ab16a9

File tree

9 files changed

+310
-1
lines changed

9 files changed

+310
-1
lines changed

‎.typos.toml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,11 @@ extend-exclude = [
88
"containers/*/patches",
99
"go.mod",
1010
"ansible/roles/statuses/defaults/main.yaml",
11+
"apps/infra/*.yaml",
12+
"apps/operators/*.yaml",
13+
"apps/global/*.yaml",
14+
"apps/site/*.yaml",
15+
"apps/openstack/*.yaml",
1116
]
1217

1318
[default]

‎apps/openstack/cinder.yaml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
---
2+
component: cinder
3+
repoURL: https://tarballs.opendev.org/openstack/openstack-helm
4+
chartVersion: 2025.1.3+abd55b4a7

‎components/cinder/README.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
# OpenStack Cinder

‎components/cinder/cinder-mariadb-db.yaml‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
---
2+
apiVersion: k8s.mariadb.com/v1alpha1
3+
kind: Database
4+
metadata:
5+
name: cinder
6+
namespace: openstack
7+
spec:
8+
# If you want the database to be created with a different name than the resource name
9+
# name: data-custom
10+
mariaDbRef:
11+
name: mariadb # name of the MariaDB kind
12+
waitForIt: true
13+
characterSet: utf8
14+
collate: utf8_general_ci
15+
retryInterval: 5s
16+
---
17+
apiVersion: k8s.mariadb.com/v1alpha1
18+
kind: User
19+
metadata:
20+
name: cinder
21+
namespace: openstack
22+
spec:
23+
# If you want the user to be created with a different name than the resource name
24+
# name: user-custom
25+
mariaDbRef:
26+
name: mariadb # name of the MariaDB kind
27+
waitForIt: true
28+
passwordSecretKeyRef:
29+
name: cinder-db-password
30+
key: password
31+
# This field is immutable and defaults to 10, 0 means unlimited.
32+
maxUserConnections: 0
33+
host: "%"
34+
retryInterval: 5s
35+
---
36+
apiVersion: k8s.mariadb.com/v1alpha1
37+
kind: Grant
38+
metadata:
39+
name: cinder-grant
40+
namespace: openstack
41+
spec:
42+
mariaDbRef:
43+
name: mariadb # name of the MariaDB kind
44+
waitForIt: true
45+
privileges:
46+
- "ALL"
47+
database: "cinder"
48+
table: "*"
49+
username: cinder
50+
grantOption: true
51+
host: "%"
52+
retryInterval: 5s

‎components/cinder/cinder-rabbitmq-queue.yaml‎

Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
---
2+
apiVersion: rabbitmq.com/v1beta1
3+
kind: User
4+
metadata:
5+
name: cinder
6+
namespace: openstack
7+
spec:
8+
tags:
9+
- management # available tags are 'management', 'policymaker', 'monitoring' and 'administrator'
10+
- policymaker
11+
rabbitmqClusterReference:
12+
name: rabbitmq # rabbitmqCluster must exist in the same namespace as this resource
13+
namespace: openstack
14+
importCredentialsSecret:
15+
name: cinder-rabbitmq-password
16+
---
17+
apiVersion: rabbitmq.com/v1beta1
18+
kind: Vhost
19+
metadata:
20+
name: cinder-vhost
21+
namespace: openstack
22+
spec:
23+
name: "cinder" # vhost name; required and cannot be updated
24+
defaultQueueType: quorum # default queue type for this vhost; require RabbitMQ version 3.11.12 or above
25+
rabbitmqClusterReference:
26+
name: rabbitmq # rabbitmqCluster must exist in the same namespace as this resource
27+
namespace: openstack
28+
---
29+
apiVersion: rabbitmq.com/v1beta1
30+
kind: Permission
31+
metadata:
32+
name: cinder-permission
33+
namespace: openstack
34+
spec:
35+
vhost: "cinder" # name of a vhost
36+
userReference:
37+
name: "cinder" # name of a user.rabbitmq.com in the same namespace; must specify either spec.userReference or spec.user
38+
permissions:
39+
write: ".*"
40+
configure: ".*"
41+
read: ".*"
42+
rabbitmqClusterReference:
43+
name: rabbitmq # rabbitmqCluster must exist in the same namespace as this resource
44+
namespace: openstack
45+
---
46+
apiVersion: rabbitmq.com/v1beta1
47+
kind: Policy
48+
metadata:
49+
name: cinder-notifications-ttl
50+
namespace: openstack
51+
spec:
52+
name: cinder-notifications-ttl # name of the policy
53+
vhost: "cinder" # default to '/' if not provided
54+
pattern: "^notifications.*" # regex used to match queues and exchanges
55+
applyTo: "queues" # set to 'queues', 'exchanges', or 'all'
56+
priority: 1 # defaults to 0
57+
definition: # policy definition
58+
message-ttl: 86400000
59+
rabbitmqClusterReference:
60+
name: rabbitmq # rabbitmqCluster must exist in the same namespace as this resource
61+
namespace: openstack

‎components/cinder/kustomization.yaml‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
---
2+
apiVersion: kustomize.config.k8s.io/v1beta1
3+
kind: Kustomization
4+
5+
resources:
6+
- cinder-mariadb-db.yaml
7+
- cinder-rabbitmq-queue.yaml

‎components/cinder/values.yaml‎

Lines changed: 163 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,163 @@
1+
---
2+
release_group: null
3+
4+
conf:
5+
backends:
6+
# disable the hardcoded one in the OpenStack Helm values.yaml
7+
rbd1: null
8+
9+
# typically overridden by environmental
10+
# values, but should include all endpoints
11+
# required by this chart
12+
endpoints:
13+
oslo_messaging:
14+
statefulset:
15+
replicas: 3
16+
name: rabbitmq-server
17+
hosts:
18+
default: rabbitmq-nodes
19+
volumev3:
20+
port:
21+
api:
22+
public: 443
23+
scheme:
24+
public: https
25+
path:
26+
# since the Yoga release it is not necessary to include the tenant_id
27+
# in the URL
28+
default: '/v3'
29+
host_fqdn_override:
30+
public:
31+
tls:
32+
secretName: cinder-tls-public
33+
issuerRef:
34+
name: understack-cluster-issuer
35+
kind: ClusterIssuer
36+
37+
38+
network:
39+
# configure OpenStack Helm to use Undercloud's ingress
40+
# instead of expecting the ingress controller provided
41+
# by OpenStack Helm
42+
use_external_ingress_controller: true
43+
api:
44+
ingress:
45+
annotations:
46+
nginx.ingress.kubernetes.io/rewrite-target: /
47+
# set our default issuer
48+
cert-manager.io/cluster-issuer: understack-cluster-issuer
49+
50+
pod:
51+
mounts:
52+
cinder_volume:
53+
cinder_volume:
54+
# necessary because the netapp driver requires this for scratch space
55+
# and even makes sure its writeable a better approach should go upstream
56+
volumeMounts:
57+
- mountPath: /var/lib/cinder
58+
name: var-lib-cinder
59+
volumes:
60+
- name: var-lib-cinder
61+
emptyDir: {}
62+
lifecycle:
63+
disruption_budget:
64+
deployments:
65+
# this should be set to no more than (pod.replicas.server - 1)
66+
# usually set on per-deployment basis.
67+
min_available: 0
68+
dependencies:
69+
dynamic:
70+
common:
71+
local_image_registry:
72+
jobs: null
73+
static:
74+
api:
75+
jobs:
76+
- cinder-db-sync
77+
- cinder-ks-user
78+
- cinder-ks-endpoints
79+
services:
80+
- endpoint: internal
81+
service: oslo_db
82+
- endpoint: internal
83+
service: identity
84+
db_sync:
85+
jobs:
86+
backup:
87+
jobs:
88+
- cinder-db-sync
89+
- cinder-ks-user
90+
- cinder-ks-endpoints
91+
db_purge:
92+
jobs:
93+
- cinder-db-sync
94+
- cinder-ks-user
95+
- cinder-ks-endpoints
96+
scheduler:
97+
jobs:
98+
- cinder-db-sync
99+
- cinder-ks-user
100+
- cinder-ks-endpoints
101+
volume:
102+
jobs:
103+
- cinder-db-sync
104+
- cinder-ks-user
105+
- cinder-ks-endpoints
106+
volume_usage_audit:
107+
jobs:
108+
- cinder-db-sync
109+
- cinder-ks-user
110+
- cinder-ks-endpoints
111+
112+
manifests:
113+
secret_keystone: true
114+
job_backup_storage_init: false
115+
job_bootstrap: false
116+
job_db_init: false
117+
job_db_drop: false
118+
job_rabbit_init: false
119+
job_storage_init: false
120+
pod_rally_test: false
121+
secret_db: false
122+
secret_ingress_tls: false
123+
secret_rabbitmq: false
124+
secret_registry: false
125+
service_ingress_api: false
126+
deployment_backup: false
127+
128+
# We don't want to enable OpenStack Helm's
129+
# helm.sh/hooks because they set them as
130+
# post-install,post-upgrade which in ArgoCD
131+
# maps to PostSync. However the deployments
132+
# and statefulsets in OpenStack Helm
133+
# depend on the jobs to complete to become
134+
# healthy. Which they cannot because they are in
135+
# the post step and not in the main step.
136+
# Turning this on results in the keys jobs
137+
# editing the annotation which deletes the item
138+
# and wipes our keys.
139+
helm3_hook: false
140+
141+
annotations:
142+
job:
143+
cinder_db_sync:
144+
argocd.argoproj.io/hook: Sync
145+
argocd.argoproj.io/hook-delete-policy: BeforeHookCreation
146+
cinder_ks_service:
147+
argocd.argoproj.io/hook: Sync
148+
argocd.argoproj.io/hook-delete-policy: BeforeHookCreation
149+
cinder_ks_user:
150+
argocd.argoproj.io/hook: Sync
151+
argocd.argoproj.io/hook-delete-policy: BeforeHookCreation
152+
cinder_ks_endpoints:
153+
argocd.argoproj.io/hook: Sync
154+
argocd.argoproj.io/hook-delete-policy: BeforeHookCreation
155+
cinder_image_repo_sync:
156+
argocd.argoproj.io/hook: Sync
157+
argocd.argoproj.io/hook-delete-policy: BeforeHookCreation
158+
cinder_clean:
159+
argocd.argoproj.io/hook: Sync
160+
argocd.argoproj.io/hook-delete-policy: BeforeHookCreation
161+
cinder_create_internal_tenant:
162+
argocd.argoproj.io/hook: Sync
163+
argocd.argoproj.io/hook-delete-policy: BeforeHookCreation

‎components/openstack-secrets.tpl.yaml‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,9 @@ endpoints:
2828
# this user is the service account that placement uses
2929
placement:
3030
password: "${PLACEMENT_KEYSTONE_PASSWORD}"
31+
# this user is the service account that cinder uses
32+
cinder:
33+
password: "${CINDER_KEYSTONE_PASSWORD}"
3134

3235
# set our public facing URL
3336
host_fqdn_override:
@@ -64,6 +67,9 @@ endpoints:
6467
# this is what the horizon dashboard service uses to connect to MariaDB
6568
horizon:
6669
password: "${HORIZON_DB_PASSWORD}"
70+
# this is what the cinder service uses to connect to MariaDB
71+
cinder:
72+
password: "${CINDER_DB_PASSWORD}"
6773

6874
# 'oslo_db_api' is for MariaDB specific for nova
6975
oslo_db_api:
@@ -95,6 +101,9 @@ endpoints:
95101
# this is what the nova service uses to connect to RabbitMQ
96102
nova:
97103
password: "${NOVA_RABBITMQ_PASSWORD}"
104+
# this is what the cinder service uses to connect to RabbitMQ
105+
cinder:
106+
password: "${CINDER_RABBITMQ_PASSWORD}"
98107

99108
# 'baremetal' is the ironic service
100109
baremetal:
@@ -137,4 +146,11 @@ endpoints:
137146
host_fqdn_override:
138147
public:
139148
host: horizon.${DNS_ZONE}
149+
150+
# 'volumev3' is the cinder service
151+
volumev3:
152+
# set our public facing URL
153+
host_fqdn_override:
154+
public:
155+
host: cinder.${DNS_ZONE}
140156
...

‎scripts/gitops-secrets-gen.sh‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -299,7 +299,7 @@ create_os_secret() {
299299
## OpenStack component secret generation
300300
## each openstack component is very similar to collapse this
301301
## into a loop to generate the same thing for each
302-
for component in keystone ironic placement neutron nova glance; do
302+
for component in keystone ironic placement neutron nova glance cinder; do
303303
echo "Checking ${component}"
304304
mkdir -p "${DEST_DIR}/${component}/"
305305
# keystone service account username

0 commit comments

Comments
 (0)