diff options
Diffstat (limited to 'roles')
26 files changed, 477 insertions, 120 deletions
diff --git a/roles/ands_facts/tasks/main.yml b/roles/ands_facts/tasks/main.yml index ce5dd23..54c800a 100644 --- a/roles/ands_facts/tasks/main.yml +++ b/roles/ands_facts/tasks/main.yml @@ -13,7 +13,15 @@ - name: "Configuring storage facts" include_tasks: "storage.yml" +- name: "Configuring ands nodes" + include_tasks: "nodes.yml" + +- name: "Configuring ands volumes" + include_tasks: "volumes.yml" + - name: "Confirm that ands facts are configured" set_fact: ands_none: "{{ ands_none }}" ands_facts_configured: true + +#- debug: msg="{{ ands_volume_hostraid_servers }}" diff --git a/roles/ands_facts/tasks/node.yml b/roles/ands_facts/tasks/node.yml new file mode 100644 index 0000000..e30442c --- /dev/null +++ b/roles/ands_facts/tasks/node.yml @@ -0,0 +1,5 @@ +- name: "Associating public host names with ids" + set_fact: "ands_host_{{ host_id }}_public_hostname={{ host.value['ands_openshift_public_hostname'] }}" + +- name: "Associating openshift fqdn with ids" + set_fact: "ands_host_{{ host_id }}_openshift_fqdn={{ host.value['ands_openshift_fqdn'] }}" diff --git a/roles/ands_facts/tasks/nodes.yml b/roles/ands_facts/tasks/nodes.yml new file mode 100644 index 0000000..ebe8091 --- /dev/null +++ b/roles/ands_facts/tasks/nodes.yml @@ -0,0 +1,10 @@ +- name: Process all nodes + include_tasks: "node.yml" + run_once: true + delegate_to: "{{ groups['masters'][0] }}" + with_dict: "{{ hostvars }}" + vars: + host_id: "{{ host.value['ands_host_id'] }}" + host_name: "{{ host.value['ansible_hostname'] }}" + loop_control: + loop_var: host diff --git a/roles/ands_facts/tasks/volume.yml b/roles/ands_facts/tasks/volume.yml new file mode 100644 index 0000000..5ac4af3 --- /dev/null +++ b/roles/ands_facts/tasks/volume.yml @@ -0,0 +1,8 @@ +- name: "Associating volumes with domains" + set_fact: "ands_volume_{{ name }}_domain={{ domain }}" + +- name: "Associating volumes with servers" + set_fact: "ands_volume_{{ name }}_servers={{ domain_servers }}" + +- name: "Associating volumes with servers" + set_fact: "ands_volume_{{ name }}_server_ids={{ domain_server_ids }}" diff --git a/roles/ands_facts/tasks/volumes.yml b/roles/ands_facts/tasks/volumes.yml new file mode 100644 index 0000000..616202c --- /dev/null +++ b/roles/ands_facts/tasks/volumes.yml @@ -0,0 +1,7 @@ +- name: Process all storage domains + include_tasks: "volumes_iterate.yml" + run_once: true + delegate_to: "{{ groups[domain.servers][0] }}" + with_items: "{{ ands_local_storage_domains | default([]) | union(ands_storage_domains) }}" + loop_control: + loop_var: domain diff --git a/roles/ands_facts/tasks/volumes_iterate.yml b/roles/ands_facts/tasks/volumes_iterate.yml new file mode 100644 index 0000000..979e12f --- /dev/null +++ b/roles/ands_facts/tasks/volumes_iterate.yml @@ -0,0 +1,13 @@ +--- +- name: Iterate volumes + include_tasks: "volume.yml" + with_dict: "{{ domain.volumes }}" + vars: + name: "{{ volume.key }}" + path: "{{ volume.value.mount }}" + server_group: "{{ domain.servers }}" + domain_servers: "{{ groups[domain.servers] | map('extract', hostvars, 'ands_storage_hostname') | list }}" + domain_server_ids: "{{ groups[domain.servers] | map('extract', hostvars, 'ands_host_id') | list }}" + when: volume.value.mount is defined + loop_control: + loop_var: volume diff --git a/roles/ands_kaas/00-local-volumes.yml.j2 b/roles/ands_kaas/00-local-volumes.yml.j2 new file mode 100644 index 0000000..8d1a1c8 --- /dev/null +++ b/roles/ands_kaas/00-local-volumes.yml.j2 @@ -0,0 +1,67 @@ +--- +apiVersion: v1 +kind: Template +metadata: + name: {{ kaas_project }}-local-volumes + annotations: + descriptions: "{{ kaas_project }} local volumes" +objects: +{% for name, vol in kaas_project_local_volumes.iteritems() %} +{% set voltypes = kaas_storage_domains | json_query("[*].volumes." + vol.volume + ".type") %} +{% set voltype = voltypes[0] | default('host') %} +{% set mntpaths = kaas_storage_domains | json_query("[*].volumes." + vol.volume + ".mount") %} +{% set mntpath = mntpaths[0] | default('') %} +{% set oc_name = vol.name | default(name) | regex_replace('_','-') %} +{% set cfgpath = vol.path | default("") %} +{% set path = cfgpath if cfgpath[:1] == "/" else "/" + kaas_project + "/" + cfgpath %} +{% if oc_name | regex_search("^" + kaas_project) %} +{% set pvprefix = oc_name %} +{% else %} +{% set pvprefix = (kaas_project + "-" + oc_name) | regex_replace('_','-') %} +{% endif %} +{% set i = 0 %} +{% for id in vol.nodes | default(hostvars[inventory_hostname]['ands_volume_' + vol.volume + '_server_ids']) %} +{% set srvid = (id | string) %} +{% set server_name = hostvars[inventory_hostname]['ands_host_' + srvid + '_public_hostname'] %} +{% set openshift_name = hostvars[inventory_hostname]['ands_host_' + srvid + '_openshift_fqdn'] %} +{% set pvname = pvprefix + '-' + server_name %} +{% set pvcname = oc_name + '-' + (i|string) %} + - apiVersion: v1 + kind: PersistentVolume + metadata: + name: {{ pvname }} + annotations: + "volume.alpha.kubernetes.io/node-affinity": '{ + "requiredDuringSchedulingIgnoredDuringExecution": { + "nodeSelectorTerms": [ + { "matchExpressions": [ { "key": "kubernetes.io/hostname", "operator": "In", "values": ["{{ openshift_name }}"] } ]} + ] + } + }' + spec: + storageClassName: kaas-local-storage + persistentVolumeReclaimPolicy: Retain + local: + path: "{{ mntpath }}{{ path }}" + readOnly: {{ not (vol.write | default(false)) }} + accessModes: + - ReadWriteOnce + capacity: + storage: {{ vol.capacity | default(kaas_default_volume_capacity) }} + claimRef: + name: {{ pvcname }} + namespace: {{ kaas_project }} + - apiVersion: v1 + kind: PersistentVolumeClaim + metadata: + name: {{ pvcname }} + spec: + volumeName: {{ pvname }} + accessModes: + - ReadWriteOnce + resources: + requests: + storage: {{ vol.capacity | default(kaas_default_volume_capacity) }} +{% set i = i + 1 %} +{% endfor %} +{% endfor %} diff --git a/roles/ands_kaas/tasks/do_apps.yml b/roles/ands_kaas/tasks/do_apps.yml index 6738b7f..39283b4 100644 --- a/roles/ands_kaas/tasks/do_apps.yml +++ b/roles/ands_kaas/tasks/do_apps.yml @@ -1,16 +1,20 @@ - name: "Process KaaS apps" include_tasks: "template.yml" run_once: true - with_items: "{{ kaas_project_apps }}" + with_dict: "{{ kaas_project_apps }}" loop_control: - loop_var: appname + loop_var: appitem when: - - app.provision | default(true) - - (ands_configure_app == ands_none) or (app.name == ands_configure_app) + - appitem.value.provision | default(true) + - (ands_configure_app == ands_none) or (appname == ands_configure_app) + - appname | match(kaas_app_regexp | default(.*)) vars: - app: "{{ kaas_project_config[appname] }}" - name: "{{ app.name | default((app.pods.keys() | list)[0]) }}" - instantiate: "{{ app.instantiate | default(false) }}" + app: "{{ kaas_project_config[appitem.key] }}" + appname: "{{ app.name | default(appitem.key) | regex_replace('_','-') }}" +# appname: "{{ app.name | default((app.pods.keys() | list)[0]) }}" + options: "{{ app.options | default({}) }}" + delete: "{{ options.delete | default(true) }}" + instantiate: "{{ appitem.value.instantiate | default(false) }}" load: "{{ app.load | default(false) }}" pods: "{{ app.pods }}" tmpl_name: "50-kaas-pods.yml.j2" diff --git a/roles/ands_kaas/tasks/do_keys.yml b/roles/ands_kaas/tasks/do_keys.yml new file mode 100644 index 0000000..391392e --- /dev/null +++ b/roles/ands_kaas/tasks/do_keys.yml @@ -0,0 +1,6 @@ +- name: Load OpenSSL keys + include_tasks: keys.yml + run_once: true + with_dict: "{{ kaas_project_pods }}" + loop_control: + loop_var: pod diff --git a/roles/ands_kaas/tasks/do_project.yml b/roles/ands_kaas/tasks/do_project.yml index f5b3276..71a54ad 100644 --- a/roles/ands_kaas/tasks/do_project.yml +++ b/roles/ands_kaas/tasks/do_project.yml @@ -2,77 +2,24 @@ - name: Ensure OpenShift template directory exists file: path="{{ kaas_template_path }}" state="directory" mode=0755 owner=root group=root -- name: Configure KaaS volumes - include_tasks: volume.yml - run_once: true -# delegate_to: "{{ groups.masters[0] }}" - with_dict: "{{ kaas_project_volumes }}" - loop_control: - loop_var: osv - vars: - vt_query: "[*].volumes.{{osv.value.volume}}.type" - voltype: "{{ (kaas_storage_domains | json_query(vt_query)) }}" - mp_query: "[*].volumes.{{osv.value.volume}}.mount" - mntpath: "{{ (kaas_storage_domains | json_query(mp_query)) }}" - rp_query: "[*].volumes.{{osv.value.volume}}.path" - realpath: "{{ (kaas_storage_domains | json_query(rp_query)) }}" - osvpath: "{{ osv.value.path | default('') }}" - prefix: "{{ ( osvpath[:1] == '/' ) | ternary('', '/' ~ kaas_project ~ '/') }}" - path: "{{ mntpath[0] ~ prefix ~ osvpath }}" - hostpath: "{{ realpath[0] is defined | ternary((realpath[0] | default('')) ~ prefix ~ osvpath, '') }}" - name: "{{osv.key}}" - volume: "{{osv.value}}" - when: ( mntpath | length ) > 0 - -- name: Check if static configuration exists - local_action: stat path="{{ kaas_project_path }}/files/" - register: result - -- name: Search static configuration - include_tasks: search.yml - when: result.stat.exists - -- name: Configure KaaS files - include_tasks: file.yml - run_once: true -# delegate_to: "{{ groups.masters[0] }}" - with_items: "{{ kaas_project_config.files | default(kaas_openshift_files) | default([]) }}" - loop_control: - loop_var: file - vars: - osv: "{{ kaas_project_volumes[file.osv] }}" - vt_query: "[*].volumes.{{osv.volume}}.type" - voltype: "{{ (kaas_storage_domains | json_query(vt_query)) }}" - mp_query: "[*].volumes.{{osv.volume}}.mount" - mntpath: "{{ (kaas_storage_domains | json_query(mp_query)) }}" - rp_query: "[*].volumes.{{osv.volume}}.path" - realpath: "{{ (kaas_storage_domains | json_query(rp_query)) }}" - pvar: "kaas_{{ file.osv }}_path" - path: "{{ hostvars[inventory_hostname][pvar] }}/{{ file.path }}" - hvar: "kaas_{{ file.osv }}_hostpath" - hostpath: "{{ hostvars[inventory_hostname][hvar] }}/{{ file.path }}" - when: file.osv in kaas_project_volumes - -- name: Load OpenSSL keys - include_tasks: keys.yml -# delegate_to: "{{ groups.masters[0] }}" - run_once: true - with_dict: "{{ kaas_project_pods }}" - loop_control: - loop_var: pod - - name: "Run OC script" include_tasks: ocscript.yml -# delegate_to: "{{ groups.masters[0] }}" run_once: true when: kaas_project_config.oc is defined -- name: "Configure all templates" - include_tasks: templates.yml -# delegate_to: "{{ groups.masters[0] }}" +- block: + - name: Configure storage + include_tasks: do_storage.yml + + - name: Configure SSL keys + include_tasks: do_keys.yml + + - name: Configure all templates + include_tasks: templates.yml + + - name: Install Applications + include_tasks: do_apps.yml run_once: true when: - kaas_project_config.oc is undefined -- name: Install Applications - include_tasks: do_apps.yml diff --git a/roles/ands_kaas/tasks/do_storage.yml b/roles/ands_kaas/tasks/do_storage.yml index ee118fd..e79db56 100644 --- a/roles/ands_kaas/tasks/do_storage.yml +++ b/roles/ands_kaas/tasks/do_storage.yml @@ -18,8 +18,18 @@ volume: "{{osv.value}}" when: - ( mntpath | length ) > 0 - - (osv.type | default("host")) in [ "host" ] + - (kaas_storage_types is not defined) or ((osv.type | default("host")) in kaas_storage_types) +- name: Check if static configuration exists + local_action: stat path="{{ kaas_project_path }}/files/" + register: result + +# Executed only if complete project is provisioned (not if we just care to provision per-node storage) +- name: Search static configuration + include_tasks: search.yml + when: + - result.stat.exists + - kaas_storage_types is not defined - name: Configure KaaS files include_tasks: file.yml @@ -40,4 +50,4 @@ hostpath: "{{ hostvars[inventory_hostname][hvar] }}/{{ file.path }}" when: - file.osv in kaas_project_volumes - - (osv.type | default("host")) in [ "host" ] + - (kaas_storage_types is not defined) or ((osv.type | default("host")) in kaas_storage_types) diff --git a/roles/ands_kaas/tasks/ocitem.yml b/roles/ands_kaas/tasks/ocitem.yml index addb249..758cdaf 100644 --- a/roles/ands_kaas/tasks/ocitem.yml +++ b/roles/ands_kaas/tasks/ocitem.yml @@ -1,13 +1,35 @@ --- +- name: Storage + include_tasks: do_storage.yml + run_once: true + vars: + kaas_storage_regexp: "{{ ocitem.storage }}" + when: ocitem.storage is defined + +- name: Keys + include_tasks: do_keys.yml + run_once: true + vars: + kaas_keys_regexp: "{{ ocitem.keys }}" + when: ocitem.keys is defined + - name: OpenShift templates include_tasks: templates.yml run_once: true vars: - kaas_template_glob: "{{ ocitem.template }}" - when: ocitem.template is defined + kaas_template_glob: "{{ ocitem.templates }}" + when: ocitem.templates is defined + +- name: OpenShift apps + include_tasks: do_apps.yml + run_once: true + vars: + kaas_app_regexp: "{{ ocitem.apps }}" + when: ocitem.apps is defined - name: OpenShift commands include_tasks: oc.yml -# delegate_to: "{{ groups.masters[0] }}" run_once: true when: ocitem.oc is defined + + diff --git a/roles/ands_kaas/tasks/project.yml b/roles/ands_kaas/tasks/project.yml index ecb2035..26bd0cc 100644 --- a/roles/ands_kaas/tasks/project.yml +++ b/roles/ands_kaas/tasks/project.yml @@ -26,7 +26,7 @@ with_dict: "{{ kaas_block_volumes }}" when: item.value.project == kaas_project -- name: Get information about block volumes +- name: Get more information about block volumes delegate_to: "{{ groups.masters[0] }}" shell: gluster-block info {{ item.value.volume }}/{{ item.key }} | grep -oP '^EXPORTED NODE.*:\s*\K.*' | tr ' ' '\n' register: portal_info @@ -55,11 +55,12 @@ - include_tasks: "do_{{ do_subrole | default('project') }}.yml" vars: var_name: "var_{{kaas_project}}_config" - kaas_project_config: "{{ hostvars[inventory_hostname][var_name] }}" - kaas_project_volumes: "{{ kaas_project_config.volumes | default(kaas_project_config.extra_volumes | default({}) | combine(kaas_openshift_volumes)) }}" - kaas_project_pods: "{{ kaas_project_config.pods | default({}) }}" - kaas_project_apps: "{{ kaas_project_config.apps | default([]) }}" - kaas_project_gids: "{{ kaas_project_config.gids | default(kaas_openshift_gids) }}" - kaas_project_uids: "{{ kaas_project_config.uids | default(kaas_openshift_uids) }}" - kaas_blockvol_info: "{{ block_info }}" + kaas_project_config: "{{ hostvars[inventory_hostname][var_name] }}" + kaas_project_volumes: "{{ kaas_project_config.volumes | default(kaas_project_config.extra_volumes | default({}) | combine(kaas_openshift_volumes)) }}" + kaas_project_local_volumes: "{{ kaas_project_config.local_volumes | default({}) }}" + kaas_project_pods: "{{ kaas_project_config.pods | default({}) }}" + kaas_project_apps: "{{ kaas_project_config.apps | default([]) }}" + kaas_project_gids: "{{ kaas_project_config.gids | default(kaas_openshift_gids) }}" + kaas_project_uids: "{{ kaas_project_config.uids | default(kaas_openshift_uids) }}" + kaas_blockvol_info: "{{ block_info }}"
\ No newline at end of file diff --git a/roles/ands_kaas/tasks/template.yml b/roles/ands_kaas/tasks/template.yml index 418331a..87e45a6 100644 --- a/roles/ands_kaas/tasks/template.yml +++ b/roles/ands_kaas/tasks/template.yml @@ -1,9 +1,9 @@ -- name: "Populate template {{ tmpl_name }}" +- name: "Populate template '{{ tmpl_name }}' in project '{{ kaas_project }}' for application '{{ appname | default('kaas') }}'" template: src="{{ item }}" dest="{{ kaas_template_path }}/{{ dest_name }}" owner=root group=root mode="0644" register: result vars: default_name: "{{ item | basename | regex_replace('\\.j2','') }}" - dest_name: "{{ (name is defined) | ternary ( (name | default('')) + '.yml', default_name ) }}" + dest_name: "{{ (appname is defined) | ternary ( '90-' + (appname | default('')) + '.yml', default_name ) }}" with_first_found: - paths: - "{{ role_path }}/templates/" @@ -15,10 +15,13 @@ include_role: name="openshift_resource" when: instantiate == true vars: - template: "{{ tmpl_name | basename | regex_replace('\\.j2','') }}" + default_name: "{{ tmpl_name | basename | regex_replace('\\.j2','') }}" + dest_name: "{{ (appname is defined) | ternary ( '90-' + (appname | default('')) + '.yml', default_name ) }}" + template: "{{ dest_name }}" template_path: "{{ kaas_template_path }}" project: "{{ kaas_project }}" - recreate: "{{ result | changed | ternary (true, false) }}" + recreate: "{{ result | changed | ternary (delete | ternary(true, false), false) }}" + replace: "{{ result | changed | ternary (delete | ternary(false, true), false) }}" # alternatively load template # TODO diff --git a/roles/ands_kaas/templates/00-local-volumes.yml.j2 b/roles/ands_kaas/templates/00-local-volumes.yml.j2 new file mode 100644 index 0000000..a97ffae --- /dev/null +++ b/roles/ands_kaas/templates/00-local-volumes.yml.j2 @@ -0,0 +1,50 @@ +--- +apiVersion: v1 +kind: Template +metadata: + name: {{ kaas_project }}-local-volumes + annotations: + descriptions: "{{ kaas_project }} local volumes" +objects: +{% for name, vol in kaas_project_local_volumes.iteritems() %} +{% set voltypes = kaas_storage_domains | json_query("[*].volumes." + vol.volume + ".type") %} +{% set voltype = voltypes[0] | default('host') %} +{% set mntpaths = kaas_storage_domains | json_query("[*].volumes." + vol.volume + ".mount") %} +{% set mntpath = mntpaths[0] | default('') %} +{% set oc_name = vol.name | default(name) | regex_replace('_','-') %} +{% set cfgpath = vol.path | default("") %} +{% set path = cfgpath if cfgpath[:1] == "/" else "/" + kaas_project + "/" + cfgpath %} +{% if oc_name | regex_search("^" + kaas_project) %} +{% set pvprefix = oc_name %} +{% else %} +{% set pvprefix = (kaas_project + "-" + oc_name) | regex_replace('_','-') %} +{% endif %} +{% for id in vol.nodes | default(hostvars[inventory_hostname]['ands_volume_' + vol.volume + '_server_ids']) %} +{% set srvid = (id | string) %} +{% set server_name = hostvars[inventory_hostname]['ands_host_' + srvid + '_public_hostname'] %} +{% set openshift_name = hostvars[inventory_hostname]['ands_host_' + srvid + '_openshift_fqdn'] %} +{% set pvname = pvprefix + '-' + server_name %} + - apiVersion: v1 + kind: PersistentVolume + metadata: + name: {{ pvname }} + annotations: + "volume.alpha.kubernetes.io/node-affinity": '{ + "requiredDuringSchedulingIgnoredDuringExecution": { + "nodeSelectorTerms": [ + { "matchExpressions": [ { "key": "kubernetes.io/hostname", "operator": "In", "values": ["{{ openshift_name }}"] } ]} + ] + } + }' + spec: + storageClassName: {{ vol.sc | default('kaas-lst-' + pvprefix) }} + persistentVolumeReclaimPolicy: Retain + local: + path: "{{ mntpath }}{{ path }}" + readOnly: {{ not (vol.write | default(false)) }} + accessModes: + - ReadWriteOnce + capacity: + storage: {{ vol.capacity | default(kaas_default_volume_capacity) }} +{% endfor %} +{% endfor %} diff --git a/roles/ands_kaas/templates/50-kaas-pods.yml.j2 b/roles/ands_kaas/templates/50-kaas-pods.yml.j2 index 761004d..8c7fe85 100644 --- a/roles/ands_kaas/templates/50-kaas-pods.yml.j2 +++ b/roles/ands_kaas/templates/50-kaas-pods.yml.j2 @@ -1,14 +1,20 @@ #jinja2: trim_blocks: "true", lstrip_blocks: "false" --- +{% set app = app | default('{}') %} apiVersion: v1 kind: Template metadata: - name: {{ name | default(kaas_project) }}-pods + name: {{ appname | default(kaas_project) }}-pods annotations: - descriptions: {{ kaas_project_config.description | default(name | default(kaas_project) ~ " auto-generated pod template") }} + descriptions: {{ kaas_project_config.description | default(appname | default(kaas_project) ~ " auto-generated pod template") }} +{% set applabels = ( app.labels | default({}) | combine( { 'app': appname }) ) if appname is defined else (app.labels | default({})) %} +{% if applabels | length > 0 %} + labels: {{ applabels | to_json }} +{% endif %} objects: {% for name, pod in pods.iteritems() %} {% set kind = pod.kind | default('DeploymentConfig') %} + {% set podname = pod.name | default(name) | regex_replace('_','-') %} {% if pod.enabled | default(true) %} {% set pubkey = "kaas_" ~ name ~ "_pubkey" %} {% set privkey = "kaas_" ~ name ~ "_privkey" %} @@ -17,19 +23,27 @@ objects: {% set pod = pod[pod.variant] %} {% endif %} {% set sched = pod.sched | default({}) %} + {% set service = pod.service | default({}) %} + {% set headless = (service.headles | default(false)) if kind == 'StatefulSet' else false %} + {% set network = pod.network | default({}) %} + {% set hostnet = network.host | default(false) %} {% set node_selector = (sched.selector is defined) | ternary(sched.selector, ands_default_node_selector | combine(sched.restrict | default({}))) %} + {% set labels = pod.general_labels | default({}) | combine(applabels) %} {% if pod.service is defined %} - {% if kind == 'StatefulSet' and pod.service.ports is defined %} + {% if headless and pod.service.ports is defined %} - apiVersion: v1 kind: Service metadata: - name: {{ pod.name | default(name) }}-ss + name: {{ podname }}-ss annotations: {{ pod.service.annotations | default({}) | combine({"service.alpha.kubernetes.io/tolerate-unready-endpoints": "true" }) | to_json }} + {% if labels | length > 0 %} + labels: {{ labels | to_json }} + {% endif %} spec: clusterIP: None publishNotReadyAddresses: True selector: - name: {{ pod.name | default(name) }} + name: {{ podname }} ports: {% for port in pod.service.ports %} {% set portmap = (port | string).split('/') %} @@ -41,13 +55,16 @@ objects: - apiVersion: v1 kind: Service metadata: - name: {{ pod.name | default(name) }} + name: {{ podname }} {% if pod.service.annotations is defined %} annotations: {{ pod.service.annotations | to_json }} {% endif %} + {% if labels | length > 0 %} + labels: {{ labels | to_json }} + {% endif %} spec: selector: - name: {{ pod.name | default(name) }} + name: {{ podname }} {% if pod.service.ip is defined %} clusterIP: {{ pod.service.ip }} {% endif %} @@ -65,12 +82,15 @@ objects: - apiVersion: v1 kind: Route metadata: - name: {{ pod.name | default(name) }} + name: {{ podname }} + {% if labels | length > 0 %} + labels: {{ labels | to_json }} + {% endif %} spec: host: {{ pod.service.host }} to: kind: Service - name: {{ pod.name | default(name) }} + name: {{ podname }} port: targetPort: {{ (first_port[1] is defined) | ternary(first_port[1], first_port[0]) }} {% if (first_port[0] == "80") %} @@ -95,7 +115,10 @@ objects: - apiVersion: {{ kaas_openshift_api_versions[kind] | default('v1') }} kind: {{ kind }} metadata: - name: {{ pod.name | default(name) }} + name: {{ podname }} + {% if labels | length > 0 %} + labels: {{ labels | to_json }} + {% endif %} spec: replicas: {{ ( sched | default({})).replicas | default(1) }} revisionHistoryLimit: 2 @@ -111,25 +134,59 @@ objects: triggers: - type: ConfigChange {% if kind == 'StatefulSet' %} - serviceName: {{ pod.name | default(name) }}-ss + {% if headless %} + serviceName: {{ podname }}-ss + {% else %} + serviceName: {{ podname }} + {% endif %} selector: matchLabels: - name: {{ pod.name | default(name) }} + name: {{ podname }} {% else %} selector: - name: {{ pod.name | default(name) }} + name: {{ podname }} {% endif %} + {% if pod.pvc is defined %} + volumeClaimTemplates: + {% for name, pvc in pod.pvc.iteritems() %} + {% set pvcname = name | regex_replace('_','-') %} + {% set pv = kaas_project_local_volumes[pvcname] | default({}) %} + {% set oc_name = pv.name | default(pvcname) | regex_replace('_','-') %} + {% if oc_name | regex_search("^" + kaas_project) %} + {% set pvname = oc_name %} + {% else %} + {% set pvname = (kaas_project + "-" + oc_name) | regex_replace('_','-') %} + {% endif %} + - metadata: + name: {{ pvcname }} + spec: + storageClassName: {{ pvc.sc | default(pv.sc | default('kaas-lst-' + pvname)) }} + accessModes: + - ReadWriteOnce + resources: + requests: + storage: {{ pvc.capacity | default(pv.capacity | default(kaas_default_volume_capacity)) }} + {% endfor %} + {% endif %} template: metadata: - name: {{ pod.name | default(name) }} - {% if kind == 'StatefulSet' %} + name: {{ podname }} + {% if headless %} annotations: {{ pod.annotations | default({}) | combine({"pod.alpha.kubernetes.io/initialized": "true"}) | to_json }} {% elif pod.annotations is defined %} annotations: {{ pod.annotations | to_json }} {% endif %} - labels: - name: {{ pod.name | default(name) }} + labels: {{ pod.labels | default({}) | combine(labels) | combine({'name': podname, 'app': (appname | default('kaas'))}) | to_json }} spec: + {% if pod.sa is defined %} + serviceAccountName: {{ pod.sa }} + {% endif %} + hostNetwork: {{ hostnet }} + {% if (headless) and (hostnet) %} + dnsPolicy: {{ network.dns_policy | default('ClusterFirstWithHostNet') }} + {% elif network.dns_policy is defined %} + dnsPolicy: {{ network.dns_policy }} + {% endif %} {% if node_selector | length > 0 %} nodeSelector: {{ node_selector | to_json }} {% endif %} @@ -140,10 +197,12 @@ objects: {% for img in pod.images %} {% set imgidx = loop.index %} {% for vol in (img.mappings | default([])) %} - {% set oc_name = vol.name | default(name) | regex_replace('_','-') %} + {% if (vol.name | default(name)) in kaas_project_volumes.keys() %} + {% set oc_name = vol.name | default(name) | regex_replace('_','-') %} - name: vol-{{imgidx}}-{{loop.index}} persistentVolumeClaim: claimName: {{ oc_name }} + {% endif %} {% endfor %} {% for vol in (img.hostpath | default([])) %} - name: host-{{imgidx}}-{{loop.index}} @@ -170,7 +229,7 @@ objects: containers: {% for img in pod.images %} {% set imgidx = loop.index %} - - name: {{ img.name | default(pod.name) | default(name) }} + - name: {{ img.name | default(podname) }} image: {{ img.image }} imagePullPolicy: {{ img.pull | default('Always') }} {% if (img.command is defined) %} @@ -179,13 +238,22 @@ objects: {% if img.ports is defined %} ports: {% for port in img.ports %} + {% if hostnet %} + {% set portmap = (port | string).split('/') %} + - containerPort: {{ (portmap[1] is defined) | ternary(portmap[1], portmap[0]) }} + hostPort: {{ portmap[0] }} + {% else %} - containerPort: {{ port }} + {% endif %} {% endfor %} {% elif pod.service.ports is defined %} ports: {% for port in pod.service.ports %} {% set portmap = (port | string).split('/') %} - containerPort: {{ (portmap[1] is defined) | ternary(portmap[1], portmap[0]) }} + {% if hostnet %} + hostPort: {{ portmap[0] }} + {% endif %} {% endfor %} {% endif %} {% if kind == 'StatefulSet' %} @@ -226,7 +294,12 @@ objects: {% if img.mappings is defined or img.hostpath is defined %} volumeMounts: {% for vol in (img.mappings | default([])) %} + {% if vol.name in kaas_project_volumes.keys() %} - name: vol-{{imgidx}}-{{loop.index}} + {% elif vol.name in kaas_project_local_volumes.keys() %} + {% set pvcname = vol.name | regex_replace('_','-') %} + - name: {{ pvcname }} + {% endif %} subPath: {{ vol.path | default("") }} mountPath: {{ vol.mount }} {% endfor %} diff --git a/roles/ands_network/defaults/main.yml b/roles/ands_network/defaults/main.yml index 139e8b3..0170370 100644 --- a/roles/ands_network/defaults/main.yml +++ b/roles/ands_network/defaults/main.yml @@ -1 +1,3 @@ configure_network: "{{ ands_configure_network | default(false) }}" +firewall_template_path: "{{ ands_paths.provision }}/firewall/{{ ansible_hostname }}" +firewall_services: [ 'galera', 'netpipe' ]
\ No newline at end of file diff --git a/roles/ands_network/files/galera.xml b/roles/ands_network/files/galera.xml new file mode 100644 index 0000000..15f908b --- /dev/null +++ b/roles/ands_network/files/galera.xml @@ -0,0 +1,10 @@ +<?xml version="1.0" encoding="utf-8"?> +<service> + <short>MySQL/Galera</short> + <description>MySQL/Galera Database Server</description> + <port protocol="tcp" port="3306"/> + <port protocol="tcp" port="4567"/> + <port protocol="udp" port="4567"/> + <port protocol="tcp" port="4568"/> + <port protocol="tcp" port="4444"/> +</service> diff --git a/roles/ands_network/files/netpipe.xml b/roles/ands_network/files/netpipe.xml new file mode 100644 index 0000000..0e7f355 --- /dev/null +++ b/roles/ands_network/files/netpipe.xml @@ -0,0 +1,6 @@ +<?xml version="1.0" encoding="utf-8"?> +<service> + <short>NetPIPE</short> + <description>NetPIPE network benchmark</description> + <port protocol="tcp" port="5002"/> +</service> diff --git a/roles/ands_network/tasks/add_names.yml b/roles/ands_network/tasks/add_names.yml new file mode 100644 index 0000000..3edde38 --- /dev/null +++ b/roles/ands_network/tasks/add_names.yml @@ -0,0 +1,28 @@ +# Currently EXCLUDED +# Kind of post-install. We can include this in maitain later. + +# We should not do it before Gluster peers are probed, otherwise everything will fail. +# Some peers will have names and others IPs. +- name: Configure all storage hostnames in /etc/hosts + lineinfile: dest="/etc/hosts" line="{{ ip }} {{ fqdn }} {{ hostname }}" regexp="{{ fqdn }}" state="present" + when: + - hostvars[item]['ands_facts_configured'] is defined + vars: + ip: "{{ hostvars[item]['ands_storage_ip'] }}" + hostname: "{{ hostvars[item]['ands_hostname_storage'] }}" + fqdn: "{{ hostvars[item]['ands_hostname_storage'] ~ ands_inner_dot_domain }}" + with_inventory_hostnames: + - nodes + - new_nodes + +- name: Configure all public hostnames in /etc/hosts + lineinfile: dest="/etc/hosts" line="{{ ip }} {{ fqdn }} {{ hostname }}" regexp="{{ fqdn }}" state="present" + when: + - hostvars[item]['ands_facts_configured'] is defined + vars: + ip: "{{ hostvars[item]['ands_openshift_public_ip'] }}" + hostname: "{{ hostvars[item]['ands_hostname_public'] }}" + fqdn: "{{ hostvars[item]['ands_hostname_public'] ~ ands_inner_dot_domain }}" + with_inventory_hostnames: + - nodes + - new_nodes diff --git a/roles/ands_network/tasks/common.yml b/roles/ands_network/tasks/common.yml index f2fda00..940cde7 100644 --- a/roles/ands_network/tasks/common.yml +++ b/roles/ands_network/tasks/common.yml @@ -7,7 +7,6 @@ # - nodes # - new_nodes - # This will not work properly unless 'ands_facts' are executed on all nodes.... This is checked by evaluating if 'ands_openshift_fqdn' is defined - name: Configure all cluster hostnames in /etc/hosts lineinfile: dest="/etc/hosts" line="{{ ip }} {{ fqdn }} {{ hostname }}" regexp="{{ fqdn }}" state="present" diff --git a/roles/ands_network/tasks/firewall.yml b/roles/ands_network/tasks/firewall.yml new file mode 100644 index 0000000..d5ba5f3 --- /dev/null +++ b/roles/ands_network/tasks/firewall.yml @@ -0,0 +1,32 @@ +- name: Ensure firewall template directory exists + file: path="{{ firewall_template_path }}" state="directory" mode=0644 owner=root group=root + +#Just in case we already added but not reloaded yet +#- name: Reload firewalld rules +# shell: firewall-cmd --reload + +- name: Get list of existing firewalld services + shell: "firewall-cmd --get-services | tr ' ' '\n'" + changed_when: false + register: services + +- name: Configure missing firewalld services + include_tasks: firewall_service.yml + with_items: "{{ firewall_services }}" + vars: + servicelist: "{{ services.stdout_lines }}" + loop_control: + loop_var: service + +- name: Reload firewalld rules + shell: firewall-cmd --reload + +- name: Enable MySQL and Galera services if ands_hostnet_db is enabled + firewalld: service="{{ item }}" state="enabled" permanent="true" immediate="true" + when: ands_hostnet_db | default(false) + with_items: + - mysql + - galera + +- name: Reload firewalld rules + shell: firewall-cmd --reload diff --git a/roles/ands_network/tasks/firewall_service.yml b/roles/ands_network/tasks/firewall_service.yml new file mode 100644 index 0000000..98bc866 --- /dev/null +++ b/roles/ands_network/tasks/firewall_service.yml @@ -0,0 +1,13 @@ +- name: "Copy firewalld service '{{ service }}'" + copy: src="{{ service }}.xml" dest="{{ firewall_template_path }}/{{ service }}.xml" owner=root group=root mode="0644" + register: result + +- name: "Delete old version of firewalld service '{{ service }}'" + command: "firewall-offline-cmd --remove-service={{ service }}" + when: + - service in servicelist + - result | changed + +- name: "Create firewalld service '{{ service }}'" + command: "firewall-offline-cmd --new-service-from-file='{{ firewall_template_path }}/{{ service }}.xml' --name={{ service }}" + when: (service not in servicelist) or (result | changed) diff --git a/roles/ands_network/tasks/nm_configure.yml b/roles/ands_network/tasks/nm_configure.yml index 4482705..57e40ca 100644 --- a/roles/ands_network/tasks/nm_configure.yml +++ b/roles/ands_network/tasks/nm_configure.yml @@ -1,4 +1,3 @@ - - name: install needed network manager libs yum: name='{{ item }}' state=installed with_items: @@ -21,6 +20,16 @@ cidr: "{{ ands_storage_cidr }}" force: true +- name: configure bridged openshift nework + include_tasks: nm_configure_connection.yml + vars: + bridge: "{{ ands_bridge }}" + name: "openshift" + iface: "{{ ands_inner_interface }}" + cidr: "{{ ands_openshift_cidr }}" + force: true + when: ands_enable_cnr | default(false) + - name: configure openshift nework include_tasks: nm_configure_connection.yml vars: @@ -28,6 +37,8 @@ iface: "{{ ands_inner_interface }}" cidr: "{{ ands_openshift_cidr }}" force: true + when: not (ands_enable_cnr | default(false)) + - name: configure public nework include_tasks: nm_configure_connection.yml @@ -37,3 +48,5 @@ cidr: "{{ ands_openshift_public_cidr }}" alias: true +- name: Configure firewall + include_tasks: firewall.yml diff --git a/roles/ands_network/tasks/nm_configure_connection.yml b/roles/ands_network/tasks/nm_configure_connection.yml index 18fc91e..9354fbf 100644 --- a/roles/ands_network/tasks/nm_configure_connection.yml +++ b/roles/ands_network/tasks/nm_configure_connection.yml @@ -1,15 +1,16 @@ -- name: "detect nm connection corresponding to interface '{{ iface }}'" +- name: "detect nm connection corresponding to interface '{{ bridge | default(iface) }}'" shell: "nmcli d show {{ iface | quote }} | grep CONNECTION | cut -d ':' -f 2- | sed -E -e 's/^[[:space:]]+//' | grep '^[[:alpha:]]'" register: conres failed_when: false changed_when: false -- name: "check if the requested ip '{{ cidr }}' is present on the interface '{{ iface }}'" +- name: "check if the requested ip '{{ cidr }}' is present on the interface '{{ biface }}'" set_fact: ip_present: "{{ cidr | ipaddr('address') in ips }}" vars: - eth: "{{ hostvars[inventory_hostname]['ansible_' + iface] | default({}) }}" + biface: "{{ bridge | default(iface) }}" + eth: "{{ hostvars[inventory_hostname]['ansible_' + biface] | default({}) }}" ipv4: "{{ eth['ipv4'] | default({}) }}" q: "{{ eth | json_query('ipv4_secondaries[*].address') }}" sec: "{{ ((q == ands_none) or (q == '')) | ternary([], q) }}" @@ -27,9 +28,24 @@ - not (alias | default(false)) - not ip_present -- name: "configure storage network interface '{{ iface }}' to '{{ cidr }}'" +- name: "create bridge '{{ bridge }}' with cidr '{{ cidr }}'" + command: "nmcli connection add type bridge ifname {{ bridge | quote }} con-name {{ name }} ip4 {{ cidr }}" + when: + - bridge is defined + - (conres.rc != 0) or (not (delres | skipped)) + - (conres.rc != 0) or (not (alias | default(false))) + +- name: "connect bridge '{{ bridge }}' to interface '{{ iface }}'" + command: "nmcli connection add type bridge-slave ifname {{ iface | quote }} master {{ bridge | quote }}" + when: + - bridge is defined + - (conres.rc != 0) or (not (delres | skipped)) + - (conres.rc != 0) or (not (alias | default(false))) + +- name: "configure network interface '{{ iface }}' to '{{ cidr }}'" command: "nmcli connection add type infiniband ifname {{ iface | quote }} con-name {{ name }} ip4 {{ cidr }}" when: + - bridge is not defined - (conres.rc != 0) or (not (delres | skipped)) - (conres.rc != 0) or (not (alias | default(false))) @@ -41,10 +57,11 @@ - conres.rc == 0 - not ip_present - -- name: "add ip alias '{{ cidr }}' to network interface '{{ iface }}'" - command: "nmcli connection up {{ conres.stdout | quote }}" +- name: "start connection {{ cname }}" + command: "nmcli connection up {{ cname | quote }}" register: alres + vars: + cname: "{{ (conres.stdout == '') | ternary(name, conres.stdout) }}" when: - not(alres | skipped) - alres | succeeded diff --git a/roles/openshift_resource/tasks/template.yml b/roles/openshift_resource/tasks/template.yml index 188599f..3469464 100644 --- a/roles/openshift_resource/tasks/template.yml +++ b/roles/openshift_resource/tasks/template.yml @@ -21,10 +21,13 @@ with_sequence: start=0 count="{{resources | default([]) | length}}" when: ((recreate|default(false)) or (results | changed)) and (results.results[item|int].rc == 0) - - name: "{{ template }}: Populate resources to {{project}}" - shell: "oc process -n {{project}} -f '{{ template_path }}/{{template}}' {{ template_args | default('') }} | oc create -n {{project}} -f - {{ create_args | default('') }}" +# Replace often complains on various immutable variables it can't change. We ignore. + - name: "{{ template }}: Populate resources to {{project}} ({{ replace | ternary('replace', 'create') }})" + shell: "oc process -n {{project}} -f '{{ template_path }}/{{template}}' {{ template_args | default('') }} | oc {{ replace | ternary('replace', 'create') }} -n {{project}} -f - {{ create_args | default('') }}" + register: status + failed_when: (status.rc != 0) and not (replace | default(false)) when: - - (recreate|default(false)) or (results | changed) + - (recreate | default(false)) or (replace | default(false)) or (results | changed) - resources | length > 0 run_once: true |