From e2c7b1305ca8495065dcf40fd2092d7c698dd6ea Mon Sep 17 00:00:00 2001
From: "Suren A. Chilingaryan" <csa@suren.me>
Date: Tue, 20 Mar 2018 15:47:51 +0100
Subject: Local volumes and StatefulSet to provision Master/Slave MySQL and
 Galera cluster

---
 roles/ands_network/tasks/add_names.yml             | 28 +++++++++++++++++++
 roles/ands_network/tasks/common.yml                |  1 -
 roles/ands_network/tasks/firewall.yml              | 32 ++++++++++++++++++++++
 roles/ands_network/tasks/firewall_service.yml      | 13 +++++++++
 roles/ands_network/tasks/nm_configure.yml          | 15 +++++++++-
 .../ands_network/tasks/nm_configure_connection.yml | 31 ++++++++++++++++-----
 6 files changed, 111 insertions(+), 9 deletions(-)
 create mode 100644 roles/ands_network/tasks/add_names.yml
 create mode 100644 roles/ands_network/tasks/firewall.yml
 create mode 100644 roles/ands_network/tasks/firewall_service.yml

(limited to 'roles/ands_network/tasks')

diff --git a/roles/ands_network/tasks/add_names.yml b/roles/ands_network/tasks/add_names.yml
new file mode 100644
index 0000000..3edde38
--- /dev/null
+++ b/roles/ands_network/tasks/add_names.yml
@@ -0,0 +1,28 @@
+# Currently EXCLUDED
+# Kind of post-install. We can include this in maitain later.
+
+# We should not do it before Gluster peers are probed, otherwise everything will fail.
+# Some peers will have names and others IPs.
+- name: Configure all storage hostnames in /etc/hosts
+  lineinfile: dest="/etc/hosts" line="{{ ip }} {{ fqdn }} {{ hostname }}" regexp="{{ fqdn }}" state="present"
+  when: 
+    - hostvars[item]['ands_facts_configured'] is defined
+  vars:
+    ip: "{{ hostvars[item]['ands_storage_ip'] }}"
+    hostname: "{{ hostvars[item]['ands_hostname_storage'] }}"
+    fqdn: "{{  hostvars[item]['ands_hostname_storage'] ~ ands_inner_dot_domain }}"
+  with_inventory_hostnames:
+    - nodes
+    - new_nodes
+
+- name: Configure all public hostnames in /etc/hosts
+  lineinfile: dest="/etc/hosts" line="{{ ip }} {{ fqdn }} {{ hostname }}" regexp="{{ fqdn }}" state="present"
+  when: 
+    - hostvars[item]['ands_facts_configured'] is defined
+  vars:
+    ip: "{{ hostvars[item]['ands_openshift_public_ip'] }}"
+    hostname: "{{ hostvars[item]['ands_hostname_public'] }}"
+    fqdn: "{{  hostvars[item]['ands_hostname_public'] ~ ands_inner_dot_domain }}"
+  with_inventory_hostnames:
+    - nodes
+    - new_nodes
diff --git a/roles/ands_network/tasks/common.yml b/roles/ands_network/tasks/common.yml
index f2fda00..940cde7 100644
--- a/roles/ands_network/tasks/common.yml
+++ b/roles/ands_network/tasks/common.yml
@@ -7,7 +7,6 @@
 #    - nodes
 #    - new_nodes
 
-
 # This will not work properly unless 'ands_facts' are executed on all nodes.... This is checked by evaluating if 'ands_openshift_fqdn' is defined
 - name: Configure all cluster hostnames in /etc/hosts
   lineinfile: dest="/etc/hosts" line="{{ ip }} {{ fqdn }} {{ hostname }}" regexp="{{ fqdn }}" state="present"
diff --git a/roles/ands_network/tasks/firewall.yml b/roles/ands_network/tasks/firewall.yml
new file mode 100644
index 0000000..d5ba5f3
--- /dev/null
+++ b/roles/ands_network/tasks/firewall.yml
@@ -0,0 +1,32 @@
+- name: Ensure firewall template directory exists
+  file: path="{{ firewall_template_path }}" state="directory" mode=0644 owner=root group=root
+
+#Just in case we already added but not reloaded yet
+#- name: Reload firewalld rules
+#  shell: firewall-cmd --reload
+
+- name: Get list of existing firewalld services
+  shell: "firewall-cmd --get-services | tr ' ' '\n'"
+  changed_when: false
+  register: services
+
+- name: Configure missing firewalld services
+  include_tasks: firewall_service.yml
+  with_items: "{{ firewall_services }}"
+  vars:
+    servicelist: "{{ services.stdout_lines }}"
+  loop_control:
+    loop_var: service
+
+- name: Reload firewalld rules
+  shell: firewall-cmd --reload
+
+- name: Enable MySQL and Galera services if ands_hostnet_db is enabled
+  firewalld: service="{{ item }}" state="enabled" permanent="true" immediate="true"
+  when: ands_hostnet_db | default(false)
+  with_items:
+    - mysql
+    - galera
+
+- name: Reload firewalld rules
+  shell: firewall-cmd --reload
diff --git a/roles/ands_network/tasks/firewall_service.yml b/roles/ands_network/tasks/firewall_service.yml
new file mode 100644
index 0000000..98bc866
--- /dev/null
+++ b/roles/ands_network/tasks/firewall_service.yml
@@ -0,0 +1,13 @@
+- name: "Copy firewalld service '{{ service }}'"
+  copy: src="{{ service }}.xml" dest="{{ firewall_template_path }}/{{ service }}.xml" owner=root group=root mode="0644"
+  register: result
+
+- name: "Delete old version of firewalld service '{{ service }}'"
+  command: "firewall-offline-cmd  --remove-service={{ service }}"
+  when: 
+    - service in servicelist
+    - result | changed
+  
+- name: "Create firewalld service '{{ service }}'"
+  command: "firewall-offline-cmd --new-service-from-file='{{ firewall_template_path }}/{{ service }}.xml' --name={{ service }}"
+  when: (service not in servicelist) or (result | changed)
diff --git a/roles/ands_network/tasks/nm_configure.yml b/roles/ands_network/tasks/nm_configure.yml
index 4482705..57e40ca 100644
--- a/roles/ands_network/tasks/nm_configure.yml
+++ b/roles/ands_network/tasks/nm_configure.yml
@@ -1,4 +1,3 @@
-
 - name: install needed network manager libs
   yum: name='{{ item }}' state=installed
   with_items:
@@ -21,6 +20,16 @@
     cidr: "{{ ands_storage_cidr }}"
     force: true
 
+- name: configure bridged openshift nework
+  include_tasks: nm_configure_connection.yml
+  vars:
+    bridge: "{{ ands_bridge }}"
+    name: "openshift"
+    iface: "{{ ands_inner_interface }}"
+    cidr: "{{ ands_openshift_cidr }}"
+    force: true
+  when: ands_enable_cnr | default(false)
+
 - name: configure openshift nework
   include_tasks: nm_configure_connection.yml
   vars:
@@ -28,6 +37,8 @@
     iface: "{{ ands_inner_interface }}"
     cidr: "{{ ands_openshift_cidr }}"
     force: true
+  when: not (ands_enable_cnr | default(false))
+    
 
 - name: configure public nework
   include_tasks: nm_configure_connection.yml
@@ -37,3 +48,5 @@
     cidr: "{{ ands_openshift_public_cidr }}"
     alias: true
 
+- name: Configure firewall
+  include_tasks: firewall.yml
diff --git a/roles/ands_network/tasks/nm_configure_connection.yml b/roles/ands_network/tasks/nm_configure_connection.yml
index 18fc91e..9354fbf 100644
--- a/roles/ands_network/tasks/nm_configure_connection.yml
+++ b/roles/ands_network/tasks/nm_configure_connection.yml
@@ -1,15 +1,16 @@
-- name: "detect nm connection corresponding to interface '{{ iface }}'"
+- name: "detect nm connection corresponding to interface '{{ bridge | default(iface) }}'"
   shell: "nmcli d show {{ iface | quote }} | grep CONNECTION | cut -d ':' -f 2- | sed -E -e 's/^[[:space:]]+//' | grep '^[[:alpha:]]'"
   register: conres
   failed_when: false
   changed_when: false
 
 
-- name: "check if the requested ip '{{ cidr }}' is present on the interface '{{ iface }}'"
+- name: "check if the requested ip '{{ cidr }}' is present on the interface '{{ biface }}'"
   set_fact:
     ip_present: "{{ cidr | ipaddr('address') in ips }}"
   vars:
-    eth:     "{{ hostvars[inventory_hostname]['ansible_' + iface] | default({}) }}"
+    biface:  "{{ bridge | default(iface) }}"
+    eth:     "{{ hostvars[inventory_hostname]['ansible_' + biface] | default({}) }}"
     ipv4:    "{{ eth['ipv4'] | default({}) }}"
     q:       "{{ eth | json_query('ipv4_secondaries[*].address') }}"
     sec:     "{{ ((q == ands_none) or (q == '')) | ternary([], q) }}"
@@ -27,9 +28,24 @@
     - not (alias | default(false))
     - not ip_present
     
-- name: "configure storage network interface '{{ iface }}' to '{{ cidr }}'"
+- name: "create bridge '{{ bridge }}' with cidr '{{ cidr }}'"
+  command: "nmcli connection add type bridge ifname {{ bridge | quote }} con-name {{ name }} ip4 {{ cidr }}"
+  when: 
+    - bridge is defined
+    - (conres.rc != 0) or (not (delres | skipped))
+    - (conres.rc != 0) or (not (alias | default(false)))
+  
+- name: "connect bridge '{{ bridge }}' to interface '{{ iface }}'"
+  command: "nmcli connection add type bridge-slave ifname {{ iface | quote }} master {{ bridge | quote }}"
+  when: 
+    - bridge is defined
+    - (conres.rc != 0) or (not (delres | skipped))
+    - (conres.rc != 0) or (not (alias | default(false)))
+    
+- name: "configure network interface '{{ iface }}' to '{{ cidr }}'"
   command: "nmcli connection add type infiniband ifname {{ iface | quote }} con-name {{ name }} ip4 {{ cidr }}"
   when: 
+    - bridge is not defined
     - (conres.rc != 0) or (not (delres | skipped))
     - (conres.rc != 0) or (not (alias | default(false)))
 
@@ -41,10 +57,11 @@
     - conres.rc == 0
     - not ip_present
     
-
-- name: "add ip alias '{{ cidr }}' to network interface '{{ iface }}'"
-  command: "nmcli connection up {{ conres.stdout | quote }}"
+- name: "start connection {{ cname  }}"
+  command: "nmcli connection up {{ cname | quote }}"
   register: alres
+  vars:
+    cname: "{{ (conres.stdout == '') | ternary(name, conres.stdout) }}"
   when: 
     - not(alres | skipped)
     - alres | succeeded
-- 
cgit v1.2.3