Merge pull request #1220 from openshift/master

Merge master into prod

9 files changed, 216 insertions, 1 deletions

diff --git a/playbooks/common/openshift-master/restart.yml b/playbooks/common/openshift-master/restart.yml
index d9d857b1a..052892863 100644
--- a/playbooks/common/openshift-master/restart.yml
+++ b/playbooks/common/openshift-master/restart.yml
@@ -68,14 +68,22 @@
 
 - name: Determine which masters are currently active
   hosts: oo_masters_to_config
+  any_errors_fatal: true
   tasks:
   - name: Check master service status
     command: >
       systemctl is-active {{ openshift.common.service_type }}-master
     register: active_check_output
     when: openshift.master.cluster_method | default(None) == 'pacemaker'
-    failed_when: active_check_output.stdout not in ['active', 'inactive', 'unknown']
+    failed_when: false
     changed_when: false
+  # Any master which did not report 'active' or 'inactive' is likely
+  # unhealthy.  Other possible states are 'unknown' or 'failed'.
+  - fail:
+      msg: >
+        Got invalid service state from {{ openshift.common.service_type }}-master
+        on {{ inventory_hostname }}. Please verify pacemaker cluster.
+    when: openshift.master.cluster_method | default(None) == 'pacemaker' and active_check_output.stdout not in ['active', 'inactive']
   - set_fact:
       is_active: "{{ active_check_output.stdout == 'active' }}"
     when: openshift.master.cluster_method | default(None) == 'pacemaker'
diff --git a/roles/chrony/README.md b/roles/chrony/README.md
new file mode 100644
index 000000000..bf15d9669
--- /dev/null
+++ b/roles/chrony/README.md
@@ -0,0 +1,31 @@
+Role Name
+=========
+
+A role to configure chrony as the ntp client
+
+Requirements
+------------
+
+
+Role Variables
+--------------
+
+chrony_ntp_servers: a list of ntp servers to use the chrony.conf file
+
+Dependencies
+------------
+
+roles/lib_timedatectl
+
+Example Playbook
+----------------
+
+License
+-------
+
+Apache 2.0
+
+Author Information
+------------------
+
+Openshift Operations
diff --git a/roles/chrony/defaults/main.yml b/roles/chrony/defaults/main.yml
new file mode 100644
index 000000000..95576e666
--- /dev/null
+++ b/roles/chrony/defaults/main.yml
@@ -0,0 +1,2 @@
+---
+# defaults file for chrony
diff --git a/roles/chrony/handlers/main.yml b/roles/chrony/handlers/main.yml
new file mode 100644
index 000000000..1973c79e2
--- /dev/null
+++ b/roles/chrony/handlers/main.yml
@@ -0,0 +1,5 @@
+---
+- name: Restart chronyd
+  service:
+    name: chronyd
+    state: restarted
diff --git a/roles/chrony/meta/main.yml b/roles/chrony/meta/main.yml
new file mode 100644
index 000000000..85595d7c3
--- /dev/null
+++ b/roles/chrony/meta/main.yml
@@ -0,0 +1,18 @@
+---
+galaxy_info:
+  author: Openshift Operations
+  description: Configure chrony as an ntp server
+  company: Red Hat
+  license: Apache 2.0
+  min_ansible_version: 1.9.2
+  platforms:
+  - name: EL
+    versions:
+    - 7
+  - name: Fedora
+    versions:
+    - all
+  categories:
+  - system
+dependencies:
+- roles/lib_timedatectl
diff --git a/roles/chrony/tasks/main.yml b/roles/chrony/tasks/main.yml
new file mode 100644
index 000000000..fae6d8e4c
--- /dev/null
+++ b/roles/chrony/tasks/main.yml
@@ -0,0 +1,30 @@
+---
+- name: remove ntp package
+  yum:
+    name: ntp
+    state: absent
+
+- name: ensure chrony package is installed
+  yum:
+    name: chrony
+    state: installed
+
+- name: Install /etc/chrony.conf
+  template:
+    src: chrony.conf.j2
+    dest: /etc/chrony.conf
+    owner: root
+    group: root
+    mode: 0644
+  notify:
+    - Restart chronyd
+
+- name: enabled timedatectl set-ntp yes
+  timedatectl:
+    ntp: True
+
+- name:
+  service:
+    name: chronyd
+    state: started
+    enabled: yes
diff --git a/roles/chrony/templates/chrony.conf.j2 b/roles/chrony/templates/chrony.conf.j2
new file mode 100644
index 000000000..de43b6364
--- /dev/null
+++ b/roles/chrony/templates/chrony.conf.j2
@@ -0,0 +1,45 @@
+# Use public servers from the pool.ntp.org project.
+# Please consider joining the pool (http://www.pool.ntp.org/join.html).
+{% for server in chrony_ntp_servers %}
+server {{ server }} iburst
+{% endfor %}
+
+# Ignore stratum in source selection.
+stratumweight 0
+
+# Record the rate at which the system clock gains/losses time.
+driftfile /var/lib/chrony/drift
+
+# Enable kernel RTC synchronization.
+rtcsync
+
+# In first three updates step the system clock instead of slew
+# if the adjustment is larger than 10 seconds.
+makestep 10 3
+
+# Allow NTP client access from local network.
+#allow 192.168/16
+
+# Listen for commands only on localhost.
+bindcmdaddress 127.0.0.1
+bindcmdaddress ::1
+
+# Serve time even if not synchronized to any NTP server.
+#local stratum 10
+
+keyfile /etc/chrony.keys
+
+# Specify the key used as password for chronyc.
+commandkey 1
+
+# Generate command key if missing.
+generatecommandkey
+
+# Disable logging of client accesses.
+noclientlog
+
+# Send a message to syslog if a clock adjustment is larger than 0.5 seconds.
+logchange 0.5
+
+logdir /var/log/chrony
+#log measurements statistics tracking
diff --git a/roles/chrony/vars/main.yml b/roles/chrony/vars/main.yml
new file mode 100644
index 000000000..061a21547
--- /dev/null
+++ b/roles/chrony/vars/main.yml
@@ -0,0 +1,2 @@
+---
+# vars file for chrony
diff --git a/roles/lib_timedatectl/library/timedatectl.py b/roles/lib_timedatectl/library/timedatectl.py
new file mode 100644
index 000000000..b6eab5918
--- /dev/null
+++ b/roles/lib_timedatectl/library/timedatectl.py
@@ -0,0 +1,74 @@
+#!/usr/bin/env python
+'''
+    timedatectl ansible module
+
+    This module supports setting ntp enabled
+'''
+import subprocess
+
+
+
+
+def do_timedatectl(options=None):
+    ''' subprocess timedatectl '''
+
+    cmd = ['/usr/bin/timedatectl']
+    if options:
+        cmd += options.split()
+
+    proc = subprocess.Popen(cmd, stdin=None, stdout=subprocess.PIPE)
+    proc.wait()
+    return proc.stdout.read()
+
+def main():
+    ''' Ansible module for timedatectl
+    '''
+
+    module = AnsibleModule(
+        argument_spec=dict(
+            #state=dict(default='enabled', type='str'),
+            ntp=dict(default=True, type='bool'),
+        ),
+        #supports_check_mode=True
+    )
+
+    # do something
+    ntp_enabled = False
+
+    results = do_timedatectl()
+
+    for line in results.split('\n'):
+        if 'NTP enabled' in line:
+            if 'yes' in line:
+                ntp_enabled = True
+
+    ########
+    # Enable NTP
+    ########
+    if module.params['ntp']:
+        if ntp_enabled:
+            module.exit_json(changed=False, results="enabled", state="enabled")
+
+        # Enable it
+        # Commands to enable ntp
+        else:
+            results = do_timedatectl('set-ntp yes')
+            module.exit_json(changed=True, results="enabled", state="enabled", cmdout=results)
+
+    #########
+    # Disable NTP
+    #########
+    else:
+        if not ntp_enabled:
+            module.exit_json(changed=False, results="disabled", state="disabled")
+
+        results = do_timedatectl('set-ntp no')
+        module.exit_json(changed=True, results="disabled", state="disabled")
+
+    module.exit_json(failed=True, changed=False, results="Something went wrong", state="unknown")
+
+# Pylint is getting in the way of basic Ansible
+# pylint: disable=redefined-builtin,wildcard-import,unused-wildcard-import
+from ansible.module_utils.basic import *
+
+main()