Merge pull request #182 from stackhpc/stable/wallaby

sync stackhpc/wallaby with upstream

Author: bbezak

ansible/group_vars/all.yml

@@ -381,6 +381,9 @@ mariadb_clustercheck_port: "4569"
 mariadb_monitor_user: "haproxy"
 mariadb_default_database_shard_id: 0
 mariadb_default_database_shard_hosts: "{% set default_shard = [] %}{% for host in groups['mariadb'] %}{% if hostvars[host]['mariadb_shard_id'] is not defined or hostvars[host]['mariadb_shard_id'] == mariadb_default_database_shard_id %}{{ default_shard.append(host) }}{% endif %}{% endfor %}{{ default_shard }}"
+mariadb_shard_id: "{{ mariadb_default_database_shard_id }}"
+mariadb_shard_name: "shard_{{ mariadb_shard_id }}"
+mariadb_shard_group: "mariadb_{{ mariadb_shard_name }}"
 mariadb_loadbalancer: "haproxy"
 
 masakari_api_port: "15868"

ansible/roles/common/tasks/config.yml

@@ -14,7 +14,6 @@
     - - service_name: "cron"
         paths:
           - "cron"
-          - "cron/logrotate"
       - service_name: "fluentd"
         paths:
           - "fluentd"

ansible/roles/cyborg/templates/cyborg.conf.j2

@@ -18,7 +18,7 @@ max_pool_size = {{ database_max_pool_size }}
 memcache_security_strategy = ENCRYPT
 memcache_secret_key = {{ memcache_secret_key }}
 memcache_servers = {% for host in groups['memcached'] %}{{ 'api' | kolla_address(host) | put_address_in_context('memcache') }}:{{ memcached_port }}{% if not loop.last %},{% endif %}{% endfor %}
-auth_uri = {{ keystone_internal_url }}
+www_authenticate_uri = {{ keystone_internal_url }}
 project_domain_name = {{ default_project_domain_name }}
 project_name = service
 user_domain_name = {{ default_user_domain_name }}

ansible/roles/haproxy/templates/haproxy_main.cfg.j2

@@ -17,8 +17,6 @@ global
     ssl-default-bind-ciphers DEFAULT:!MEDIUM:!3DES
     ssl-default-bind-options no-sslv3 no-tlsv10 no-tlsv11
     tune.ssl.default-dh-param 4096
-    {% endif %}
-    {% if kolla_enable_tls_internal | bool or kolla_enable_tls_external | bool %}
     ca-base {{ haproxy_backend_cacert_dir }}
     {% endif %}
 

ansible/roles/keystone/defaults/main.yml

@@ -59,6 +59,7 @@ keystone_services:
       - "kolla_logs:/var/log/kolla/"
       - "keystone_fernet_tokens:/etc/keystone/fernet-keys"
     dimensions: "{{ keystone_fernet_dimensions }}"
+    healthcheck: "{{ keystone_fernet_healthcheck }}"
 
 ####################
 # Database
@@ -123,6 +124,19 @@ keystone_ssh_healthcheck:
   test: "{% if keystone_ssh_enable_healthchecks | bool %}{{ keystone_ssh_healthcheck_test }}{% else %}NONE{% endif %}"
   timeout: "{{ keystone_ssh_healthcheck_timeout }}"
 
+keystone_fernet_enable_healthchecks: "{{ enable_container_healthchecks }}"
+keystone_fernet_healthcheck_interval: "{{ default_container_healthcheck_interval }}"
+keystone_fernet_healthcheck_retries: "{{ default_container_healthcheck_retries }}"
+keystone_fernet_healthcheck_start_period: "{{ default_container_healthcheck_start_period }}"
+keystone_fernet_healthcheck_test: ["CMD-SHELL", "/usr/bin/fernet-healthcheck.sh"]
+keystone_fernet_healthcheck_timeout: "{{ default_container_healthcheck_timeout }}"
+keystone_fernet_healthcheck:
+  interval: "{{ keystone_fernet_healthcheck_interval }}"
+  retries: "{{ keystone_fernet_healthcheck_retries }}"
+  start_period: "{{ keystone_fernet_healthcheck_start_period }}"
+  test: "{% if keystone_fernet_enable_healthchecks | bool %}{{ keystone_fernet_healthcheck_test }}{% else %}NONE{% endif %}"
+  timeout: "{{ keystone_fernet_healthcheck_timeout }}"
+
 keystone_default_volumes:
   - "{{ node_config_directory }}/keystone/:{{ container_config_directory }}/:ro"
   - "/etc/localtime:/etc/localtime:ro"

ansible/roles/keystone/tasks/config.yml

@@ -223,6 +223,7 @@
     - { src: "fernet-rotate.sh.j2", dest: "fernet-rotate.sh" }
     - { src: "fernet-node-sync.sh.j2", dest: "fernet-node-sync.sh" }
     - { src: "fernet-push.sh.j2", dest: "fernet-push.sh" }
+    - { src: "fernet-healthcheck.sh.j2", dest: "fernet-healthcheck.sh" }
     - { src: "id_rsa", dest: "id_rsa" }
     - { src: "ssh_config.j2", dest: "ssh_config" }
   when:

ansible/roles/keystone/templates/fernet-healthcheck.sh.j2

@@ -0,0 +1,6 @@
+#!/bin/bash
+
+set -o errexit
+set -o pipefail
+
+(/usr/bin/fernet-node-sync.sh --check && /usr/bin/fernet-push.sh --check) || exit 1

ansible/roles/keystone/templates/fernet-node-sync.sh.j2

@@ -3,17 +3,27 @@
 set -o errexit
 set -o pipefail
 
-# Ensure tokens are populated, check for 0 key which should always exist
-n=0
-while [ ! -f /etc/keystone/fernet-keys/0 ]; do
-    if [ $n -lt 10 ]; then
-        n=$(( n + 1 ))
-        echo "ERROR: Fernet tokens have not been populated, rechecking in 1 minute"
-        echo "DEBUG: /etc/keystone/fernet-keys contents:"
-        ls -l /etc/keystone/fernet-keys/
-        sleep 60
+if [ ! -z "$1" ] && [ "$1" == "--check" ]; then
+    if [ -f /etc/keystone/fernet-keys/0 ]; then
+        if [[ $(stat -c %U:%G /etc/keystone/fernet-keys/0) != "keystone:keystone" ]]; then
+            exit 1
+        fi
     else
-        echo "CRITICAL: Waited for 10 minutes - failing"
         exit 1
     fi
-done
+else
+    # Ensure tokens are populated, check for 0 key which should always exist
+    n=0
+    while [ ! -f /etc/keystone/fernet-keys/0 ]; do
+        if [ $n -lt 10 ]; then
+            n=$(( n + 1 ))
+            echo "ERROR: Fernet tokens have not been populated, rechecking in 1 minute"
+            echo "DEBUG: /etc/keystone/fernet-keys contents:"
+            ls -l /etc/keystone/fernet-keys/
+            sleep 60
+        else
+            echo "CRITICAL: Waited for 10 minutes - failing"
+            exit 1
+        fi
+    done
+fi

ansible/roles/keystone/templates/fernet-push.sh.j2

@@ -3,8 +3,24 @@
 set -o errexit
 set -o pipefail
 
+if [ ! -z "$1" ] && [ "$1" == "--check" ]; then
+{% if groups['keystone'] | length > 1 %}
+{% for host in groups['keystone'] %}
+{% if inventory_hostname != host %}
+/usr/bin/rsync --dry-run -az -e 'ssh -i /var/lib/keystone/.ssh/id_rsa -p {{ hostvars[host]['keystone_ssh_port'] }} -F /var/lib/keystone/.ssh/config' --delete /etc/keystone/fernet-keys/ keystone@{{ 'api' | kolla_address(host) | put_address_in_context('url') }}:/etc/keystone/fernet-keys
+{% endif %}
+{% endfor %}
+{% else %}
+echo "No additional keystone-server where fernet keys could be rsynced."
+{% endif %}
+else
+{% if groups['keystone'] | length > 1 %}
 {% for host in groups['keystone'] %}
 {% if inventory_hostname != host %}
 /usr/bin/rsync -az -e 'ssh -i /var/lib/keystone/.ssh/id_rsa -p {{ hostvars[host]['keystone_ssh_port'] }} -F /var/lib/keystone/.ssh/config' --delete /etc/keystone/fernet-keys/ keystone@{{ 'api' | kolla_address(host) | put_address_in_context('url') }}:/etc/keystone/fernet-keys
 {% endif %}
 {% endfor %}
+{% else %}
+echo "No additional keystone-server where fernet keys could be rsynced."
+{% endif %}
+fi

ansible/roles/keystone/templates/keystone-fernet.json.j2

@@ -49,6 +49,12 @@
             "dest": "/etc/keystone/{{ keystone_policy_file }}",
             "owner": "keystone",
             "perm": "0600"
+        }{% endif %}{% if keystone_fernet_enable_healthchecks | bool %},
+        {
+            "source": "{{ container_config_directory }}/fernet-healthcheck.sh",
+            "dest": "/usr/bin/fernet-healthcheck.sh",
+            "owner": "root",
+            "perm": "0755"
         }{% endif %}
     ],
     "permissions": [