summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
-rw-r--r--.tito/packages/openshift-ansible2
-rw-r--r--openshift-ansible.spec33
-rw-r--r--playbooks/common/openshift-cluster/upgrades/v3_7/validator.yml10
-rw-r--r--roles/nuage_common/defaults/main.yaml3
-rw-r--r--roles/nuage_common/tasks/main.yml27
-rw-r--r--roles/nuage_master/handlers/main.yaml4
-rw-r--r--roles/nuage_master/tasks/main.yaml83
-rwxr-xr-xroles/nuage_master/templates/nuage-master-config-daemonset.j2111
-rwxr-xr-xroles/nuage_master/templates/nuage-node-config-daemonset.j2206
-rw-r--r--roles/nuage_master/templates/nuage-openshift-monitor.j241
-rw-r--r--roles/nuage_master/vars/main.yaml12
-rw-r--r--roles/nuage_node/handlers/main.yaml4
-rw-r--r--roles/nuage_node/tasks/main.yaml48
-rw-r--r--roles/nuage_node/templates/vsp-openshift.j229
-rw-r--r--roles/openshift_examples/files/examples/v1.5/cfme-templates/cfme-template.yaml19
-rw-r--r--roles/openshift_examples/files/examples/v3.6/cfme-templates/cfme-template.yaml19
-rw-r--r--roles/openshift_logging/defaults/main.yml4
-rw-r--r--roles/openshift_node/tasks/main.yml18
-rw-r--r--roles/openshift_node/tasks/tuned.yml41
-rw-r--r--roles/openshift_storage_glusterfs/README.md2
20 files changed, 573 insertions, 143 deletions
diff --git a/.tito/packages/openshift-ansible b/.tito/packages/openshift-ansible
index 2c8f1d56b..6d21accdc 100644
--- a/.tito/packages/openshift-ansible
+++ b/.tito/packages/openshift-ansible
@@ -1 +1 @@
-3.7.0-0.105.0 ./
+3.7.0-0.112.0 ./
diff --git a/openshift-ansible.spec b/openshift-ansible.spec
index 31cb4dc4c..6a84671ef 100644
--- a/openshift-ansible.spec
+++ b/openshift-ansible.spec
@@ -10,7 +10,7 @@
Name: openshift-ansible
Version: 3.7.0
-Release: 0.105.0%{?dist}
+Release: 0.112.0%{?dist}
Summary: Openshift and Atomic Enterprise Ansible
License: ASL 2.0
URL: https://github.com/openshift/openshift-ansible
@@ -280,6 +280,37 @@ Atomic OpenShift Utilities includes
%changelog
+* Fri Aug 25 2017 Jenkins CD Merge Bot <smunilla@redhat.com> 3.7.0-0.112.0
+- fix #5206. Default ES cpu limit (jcantril@redhat.com)
+
+* Fri Aug 25 2017 Jenkins CD Merge Bot <smunilla@redhat.com> 3.7.0-0.111.0
+- Upgrade check for OpenShift authorization objects (rteague@redhat.com)
+
+* Fri Aug 25 2017 Jenkins CD Merge Bot <smunilla@redhat.com> 3.7.0-0.110.0
+- Setup tuned profiles in /etc/tuned (jmencak@redhat.com)
+
+* Thu Aug 24 2017 Jenkins CD Merge Bot <smunilla@redhat.com> 3.7.0-0.109.0
+-
+
+* Thu Aug 24 2017 Jenkins CD Merge Bot <smunilla@redhat.com> 3.7.0-0.108.0
+-
+
+* Thu Aug 24 2017 Jenkins CD Merge Bot <smunilla@redhat.com> 3.7.0-0.107.0
+-
+
+* Thu Aug 24 2017 Jenkins CD Merge Bot <smunilla@redhat.com> 3.7.0-0.106.0
+- Add dotnet 2.0 to v3.6 (sdodson@redhat.com)
+- Add dotnet 2.0 to v3.7 (sdodson@redhat.com)
+- Update v3.6 content (sdodson@redhat.com)
+- Update all image streams and templates (sdodson@redhat.com)
+- Passing memory and cpu limit for ops ES install (ewolinet@redhat.com)
+- If IP4_NAMESERVERS are unset then pull the value from /etc/resolv.conf
+ (sdodson@redhat.com)
+- New tuned profile hierarchy. (jmencak@redhat.com)
+- GlusterFS: add minor README note for #5071 (jarrpa@redhat.com)
+- Update cfme templates to auto-generate postgresql password
+ https://bugzilla.redhat.com/show_bug.cgi?id=1461973 (simaishi@redhat.com)
+
* Wed Aug 23 2017 Jenkins CD Merge Bot <smunilla@redhat.com> 3.7.0-0.105.0
- Fix generated content (sdodson@redhat.com)
- Switch to migrating one host and forming a new cluster (sdodson@redhat.com)
diff --git a/playbooks/common/openshift-cluster/upgrades/v3_7/validator.yml b/playbooks/common/openshift-cluster/upgrades/v3_7/validator.yml
index 90e95422b..136ad5362 100644
--- a/playbooks/common/openshift-cluster/upgrades/v3_7/validator.yml
+++ b/playbooks/common/openshift-cluster/upgrades/v3_7/validator.yml
@@ -7,6 +7,16 @@
hosts: oo_first_master
roles:
- { role: lib_openshift }
+
tasks:
- name: Check for invalid namespaces and SDN errors
oc_objectvalidator:
+
+ - name: Confirm OpenShift authorization objects are in sync
+ command: >
+ {{ openshift.common.client_binary }} adm migrate authorization
+ changed_when: false
+ register: l_oc_result
+ until: l_oc_result.rc == 0
+ retries: 4
+ delay: 15
diff --git a/roles/nuage_common/defaults/main.yaml b/roles/nuage_common/defaults/main.yaml
index a7803c0ee..919e3aa7b 100644
--- a/roles/nuage_common/defaults/main.yaml
+++ b/roles/nuage_common/defaults/main.yaml
@@ -10,5 +10,8 @@ nuage_ca_serial: "{{ nuage_ca_dir }}/nuageMonCA.serial.txt"
nuage_master_mon_dir: /usr/share/nuage-openshift-monitor
nuage_node_plugin_dir: /usr/share/vsp-openshift
+nuage_node_cni_bin_dir: /opt/cni/bin
+nuage_node_cni_netconf_dir: /etc/cni/net.d
+
nuage_mon_rest_server_port: "{{ nuage_openshift_monitor_rest_server_port | default('9443') }}"
nuage_mon_cert_validity_period: "{{ nuage_cert_validity_period | default('3650') }}"
diff --git a/roles/nuage_common/tasks/main.yml b/roles/nuage_common/tasks/main.yml
new file mode 100644
index 000000000..6c8c9f8d2
--- /dev/null
+++ b/roles/nuage_common/tasks/main.yml
@@ -0,0 +1,27 @@
+---
+- name: Set the Nuage plugin openshift directory fact to handle Atomic host install
+ set_fact:
+ nuage_node_plugin_dir: /var/usr/share/vsp-openshift
+ when: openshift.common.is_atomic | bool
+
+- name: Set the Nuage CNI network config directory fact to handle Atomic host install
+ set_fact:
+ nuage_node_cni_netconf_dir: /var/etc/cni/net.d/
+ when: openshift.common.is_atomic | bool
+
+- name: Set the Nuage CNI binary directory fact to handle Atomic host install
+ set_fact:
+ nuage_node_cni_bin_dir: /var/opt/cni/bin/
+ when: openshift.common.is_atomic | bool
+
+- name: Assure CNI plugin config dir exists before daemon set install
+ become: yes
+ file: path="{{ nuage_node_plugin_dir }}" state=directory
+
+- name: Assure CNI netconf directory exists before daemon set install
+ become: yes
+ file: path="{{ nuage_node_cni_netconf_dir }}" state=directory
+
+- name: Assure CNI plugin binary directory exists before daemon set install
+ become: yes
+ file: path="{{ nuage_node_cni_bin_dir }}" state=directory
diff --git a/roles/nuage_master/handlers/main.yaml b/roles/nuage_master/handlers/main.yaml
index ad7bbb111..21da6b953 100644
--- a/roles/nuage_master/handlers/main.yaml
+++ b/roles/nuage_master/handlers/main.yaml
@@ -1,8 +1,4 @@
---
-- name: restart nuage-openshift-monitor
- become: yes
- systemd: name=nuage-openshift-monitor state=restarted
-
- name: restart master api
systemd: name={{ openshift.common.service_type }}-master-api state=restarted
when: >
diff --git a/roles/nuage_master/tasks/main.yaml b/roles/nuage_master/tasks/main.yaml
index d0363c981..f3c487132 100644
--- a/roles/nuage_master/tasks/main.yaml
+++ b/roles/nuage_master/tasks/main.yaml
@@ -3,17 +3,64 @@
include: firewall.yml
static: yes
+- name: Set the Nuage certificate directory fact for Atomic hosts
+ set_fact:
+ cert_output_dir: /var/usr/share/nuage-openshift-monitor
+ when: openshift.common.is_atomic | bool
+
+- name: Set the Nuage kubeconfig file path fact for Atomic hosts
+ set_fact:
+ kube_config: /var/usr/share/nuage-openshift-monitor/nuage.kubeconfig
+ when: openshift.common.is_atomic | bool
+
+- name: Set the Nuage monitor yaml location fact for Atomic hosts
+ set_fact:
+ kubemon_yaml: /var/usr/share/nuage-openshift-monitor/nuage-openshift-monitor.yaml
+ when: openshift.common.is_atomic | bool
+
+- name: Set the Nuage monitor certs location fact for Atomic hosts
+ set_fact:
+ nuage_master_crt_dir: /var/usr/share/nuage-openshift-monitor/
+ when: openshift.common.is_atomic | bool
+
+- name: Set the Nuage master config directory for daemon sets install
+ set_fact:
+ nuage_master_config_dsets_mount_dir: /var/usr/share/
+ when: master_host_type == "is_atomic"
+
+- name: Set the Nuage node config directory for daemon sets install
+ set_fact:
+ nuage_node_config_dsets_mount_dir: /var/usr/share/
+ when: slave_host_type == "is_atomic"
+
+- name: Set the Nuage CNI plugin binary directory for daemon sets install
+ set_fact:
+ nuage_cni_bin_dsets_mount_dir: /var/opt/cni/bin
+ when: openshift.common.is_atomic | bool
+
- name: Create directory /usr/share/nuage-openshift-monitor
become: yes
file: path=/usr/share/nuage-openshift-monitor state=directory
+ when: not openshift.common.is_atomic | bool
-- name: Create the log directory
+- name: Create directory /var/usr/share/nuage-openshift-monitor
become: yes
- file: path={{ nuage_mon_rest_server_logdir }} state=directory
+ file: path=/var/usr/share/nuage-openshift-monitor state=directory
+ when: openshift.common.is_atomic | bool
+
+- name: Create directory /var/usr/bin for monitor binary on atomic
+ become: yes
+ file: path=/var/usr/bin state=directory
+ when: openshift.common.is_atomic | bool
-- name: Install Nuage Openshift Monitor
+- name: Create CNI bin directory /var/opt/cni/bin
become: yes
- yum: name={{ nuage_openshift_rpm }} state=present
+ file: path=/var/opt/cni/bin state=directory
+ when: openshift.common.is_atomic | bool
+
+- name: Create the log directory
+ become: yes
+ file: path={{ nuage_mon_rest_server_logdir }} state=directory
- include: serviceaccount.yml
@@ -45,10 +92,32 @@
become: yes
copy: src="{{ vsd_user_key_file }}" dest="{{ cert_output_dir }}/{{ vsd_user_key_file | basename }}"
-- name: Create nuage-openshift-monitor.yaml
+- name: Create Nuage master daemon set yaml file
+ become: yes
+ template: src=nuage-master-config-daemonset.j2 dest=/etc/nuage-master-config-daemonset.yaml owner=root mode=0644
+
+- name: Create Nuage node daemon set yaml file
become: yes
- template: src=nuage-openshift-monitor.j2 dest=/usr/share/nuage-openshift-monitor/nuage-openshift-monitor.yaml owner=root mode=0644
+ template: src=nuage-node-config-daemonset.j2 dest=/etc/nuage-node-config-daemonset.yaml owner=root mode=0644
+
+- name: Add the service account to the privileged scc to have root permissions
+ shell: oc adm policy add-scc-to-user privileged system:serviceaccount:openshift-infra:daemonset-controller
+ ignore_errors: true
+ when: inventory_hostname == groups.oo_first_master.0
+
+- name: Spawn Nuage Master monitor daemon sets pod
+ shell: oc create -f /etc/nuage-master-config-daemonset.yaml
+ ignore_errors: true
+ when: inventory_hostname == groups.oo_first_master.0
+
+- name: Spawn Nuage CNI daemon sets pod
+ shell: oc create -f /etc/nuage-node-config-daemonset.yaml
+ ignore_errors: true
+ when: inventory_hostname == groups.oo_first_master.0
+
+- name: Restart daemons
+ command: /bin/true
notify:
- restart master api
- restart master controllers
- - restart nuage-openshift-monitor
+ ignore_errors: true
diff --git a/roles/nuage_master/templates/nuage-master-config-daemonset.j2 b/roles/nuage_master/templates/nuage-master-config-daemonset.j2
new file mode 100755
index 000000000..612d689c2
--- /dev/null
+++ b/roles/nuage_master/templates/nuage-master-config-daemonset.j2
@@ -0,0 +1,111 @@
+# This ConfigMap is used to configure Nuage VSP configuration on master nodes
+kind: ConfigMap
+apiVersion: v1
+metadata:
+ name: nuage-master-config
+ namespace: kube-system
+data:
+ # This will generate the required Nuage configuration
+ # on master nodes
+ monitor_yaml_config: |
+
+ # .kubeconfig that includes the nuage service account
+ kubeConfig: {{ nuage_master_crt_dir }}/nuage.kubeconfig
+ # name of the nuage service account, or another account with 'cluster-reader'
+ # permissions
+ # Openshift master config file
+ masterConfig: /etc/origin/master/master-config.yaml
+ # URL of the VSD Architect
+ vsdApiUrl: {{ vsd_api_url }}
+ # API version to query against. Usually "v3_2"
+ vspVersion: {{ vsp_version }}
+ # Name of the enterprise in which pods will reside
+ enterpriseName: {{ enterprise }}
+ # Name of the domain in which pods will reside
+ domainName: {{ domain }}
+ # VSD generated user certificate file location on master node
+ userCertificateFile: {{ nuage_master_crt_dir }}/{{ vsd_user }}.pem
+ # VSD generated user key file location on master node
+ userKeyFile: {{ nuage_master_crt_dir }}/{{ vsd_user }}-Key.pem
+ # Location where logs should be saved
+ log_dir: /var/log/nuage-openshift-monitor
+ # Monitor rest server parameters
+ # Logging level for the nuage openshift monitor
+ # allowed options are: 0 => INFO, 1 => WARNING, 2 => ERROR, 3 => FATAL
+ logLevel: 0
+ # Parameters related to the nuage monitor REST server
+ nuageMonServer:
+ URL: 0.0.0.0:9443
+ certificateDirectory: {{ nuage_master_crt_dir }}
+ # etcd config required for HA
+ etcdClientConfig:
+ ca: {{ nuage_master_crt_dir }}/nuageMonCA.crt
+ certFile: {{ nuage_master_crt_dir }}/nuageMonServer.crt
+ keyFile: {{ nuage_master_crt_dir }}/master.etcd-client.key
+ urls:
+ {% for etcd_url in openshift.master.etcd_urls %}
+ - {{ etcd_url }}
+ {% endfor %}
+
+---
+
+# This manifest installs Nuage master node configuration on
+# each Nuage master node in a cluster.
+kind: DaemonSet
+apiVersion: extensions/v1beta1
+metadata:
+ name: nuage-master-config
+ namespace: kube-system
+ labels:
+ k8s-app: nuage-master-config
+spec:
+ selector:
+ matchLabels:
+ k8s-app: nuage-master-config
+ template:
+ metadata:
+ labels:
+ k8s-app: nuage-master-config
+ spec:
+ hostNetwork: true
+ tolerations:
+ - key: node-role.kubernetes.io/master
+ effect: NoSchedule
+ operator: Exists
+ nodeSelector:
+ install-monitor: "true"
+ containers:
+ # This container configures Nuage Master node
+ - name: install-nuage-master-config
+ image: nuage/master:{{ nuage_monitor_container_image_version }}
+ ports:
+ - containerPort: 9443
+ hostPort: 9443
+ command: ["/configure-master.sh"]
+ args: ["ose", "{{ master_host_type }}"]
+ securityContext:
+ privileged: true
+ env:
+ # nuage-openshift-monitor.yaml config to install on each slave node.
+ - name: NUAGE_MASTER_VSP_CONFIG
+ valueFrom:
+ configMapKeyRef:
+ name: nuage-master-config
+ key: monitor_yaml_config
+ volumeMounts:
+ - mountPath: /var/log
+ name: cni-log-dir
+ - mountPath: {{ nuage_master_config_dsets_mount_dir }}
+ name: usr-share-dir
+ - mountPath: /etc/origin/
+ name: master-config-dir
+ volumes:
+ - name: cni-log-dir
+ hostPath:
+ path: /var/log
+ - name: usr-share-dir
+ hostPath:
+ path: {{ nuage_master_config_dsets_mount_dir }}
+ - name: master-config-dir
+ hostPath:
+ path: /etc/origin/
diff --git a/roles/nuage_master/templates/nuage-node-config-daemonset.j2 b/roles/nuage_master/templates/nuage-node-config-daemonset.j2
new file mode 100755
index 000000000..02e9a1563
--- /dev/null
+++ b/roles/nuage_master/templates/nuage-node-config-daemonset.j2
@@ -0,0 +1,206 @@
+# This ConfigMap is used to configure Nuage VSP configuration
+kind: ConfigMap
+apiVersion: v1
+metadata:
+ name: nuage-config
+ namespace: kube-system
+data:
+ # This will generate the required Nuage vsp-openshift.yaml
+ # config on each slave node
+ plugin_yaml_config: |
+ clientCert: {{ nuage_node_config_dsets_mount_dir }}/vsp-openshift/client.crt
+ # The key to the certificate in clientCert above
+ clientKey: {{ nuage_node_config_dsets_mount_dir }}/vsp-openshift/client.key
+ # The certificate authority's certificate for the local kubelet. Usually the
+ # same as the CA cert used to create the client Cert/Key pair.
+ CACert: {{ nuage_node_config_dsets_mount_dir }}/vsp-openshift/ca.crt
+ # Name of the enterprise in which pods will reside
+ enterpriseName: {{ enterprise }}
+ # Name of the domain in which pods will reside
+ domainName: {{ domain }}
+ # Name of the VSD user in admin group
+ vsdUser: {{ vsd_user }}
+ # IP address and port number of master API server
+ masterApiServer: {{ api_server_url }}
+ # REST server URL
+ nuageMonRestServer: {{ nuage_mon_rest_server_url }}
+ # Bridge name for the docker bridge
+ dockerBridgeName: docker0
+ # Certificate for connecting to the openshift monitor REST api
+ nuageMonClientCert: {{ nuage_node_config_dsets_mount_dir }}/vsp-openshift/nuageMonClient.crt
+ # Key to the certificate in restClientCert
+ nuageMonClientKey: {{ nuage_node_config_dsets_mount_dir }}/vsp-openshift/nuageMonClient.key
+ # CA certificate for verifying the master's rest server
+ nuageMonServerCA: {{ nuage_node_config_dsets_mount_dir }}/vsp-openshift/nuageMonCA.crt
+ # Nuage vport mtu size
+ interfaceMTU: {{ nuage_vport_mtu }}
+ # Logging level for the plugin
+ # allowed options are: "dbg", "info", "warn", "err", "emer", "off"
+ logLevel: 3
+
+ # This will generate the required Nuage CNI yaml configuration
+ cni_yaml_config: |
+ vrsendpoint: "/var/run/openvswitch/db.sock"
+ vrsbridge: "alubr0"
+ monitorinterval: 60
+ cniversion: 0.2.0
+ loglevel: "info"
+ portresolvetimer: 60
+ logfilesize: 1
+ vrsconnectionchecktimer: 180
+ mtu: 1450
+ staleentrytimeout: 600
+
+---
+
+# This manifest installs Nuage CNI plugins and network config on
+# each worker node in Openshift cluster
+kind: DaemonSet
+apiVersion: extensions/v1beta1
+metadata:
+ name: nuage-cni-ds
+ namespace: kube-system
+ labels:
+ k8s-app: nuage-cni-ds
+spec:
+ selector:
+ matchLabels:
+ k8s-app: nuage-cni-ds
+ template:
+ metadata:
+ labels:
+ k8s-app: nuage-cni-ds
+ spec:
+ hostNetwork: true
+ tolerations:
+ - key: node-role.kubernetes.io/master
+ effect: NoSchedule
+ operator: Exists
+ containers:
+ # This container installs Nuage CNI binaries
+ # and CNI network config file on each node.
+ - name: install-nuage-cni
+ image: nuage/cni:{{ nuage_cni_container_image_version }}
+ command: ["/install-cni.sh"]
+ args: ["nuage-cni-openshift", "{{ slave_host_type }}"]
+ securityContext:
+ privileged: true
+ env:
+ # Nuage vsp-openshift.yaml config to install on each slave node.
+ - name: NUAGE_VSP_CONFIG
+ valueFrom:
+ configMapKeyRef:
+ name: nuage-config
+ key: plugin_yaml_config
+ # Nuage nuage-cni.yaml config to install on each slave node.
+ - name: NUAGE_CNI_YAML_CONFIG
+ valueFrom:
+ configMapKeyRef:
+ name: nuage-config
+ key: cni_yaml_config
+ # Nuage cluster network CIDR for iptables configuration
+ - name: NUAGE_CLUSTER_NW_CIDR
+ value: "{{ hostvars[groups.oo_first_master.0].openshift.master.sdn_cluster_network_cidr }}"
+ volumeMounts:
+ - mountPath: /host/opt/cni/bin
+ name: cni-bin-dir
+ - mountPath: /host/etc/cni/net.d
+ name: cni-net-dir
+ - mountPath: /etc/default
+ name: cni-yaml-dir
+ - mountPath: /var/run
+ name: var-run-dir
+ - mountPath: /var/log
+ name: cni-log-dir
+ - mountPath: {{ nuage_node_config_dsets_mount_dir }}
+ name: usr-share-dir
+ volumes:
+ - name: cni-bin-dir
+ hostPath:
+ path: {{ nuage_cni_bin_dsets_mount_dir }}
+ - name: cni-net-dir
+ hostPath:
+ path: {{ nuage_cni_netconf_dsets_mount_dir }}
+ - name: cni-yaml-dir
+ hostPath:
+ path: /etc/default
+ - name: var-run-dir
+ hostPath:
+ path: /var/run
+ - name: cni-log-dir
+ hostPath:
+ path: /var/log
+ - name: usr-share-dir
+ hostPath:
+ path: {{ nuage_node_config_dsets_mount_dir }}
+
+---
+
+# This manifest installs Nuage VRS on
+# each worker node in an Openshift cluster.
+kind: DaemonSet
+apiVersion: extensions/v1beta1
+metadata:
+ name: nuage-vrs-ds
+ namespace: kube-system
+ labels:
+ k8s-app: nuage-vrs-ds
+spec:
+ selector:
+ matchLabels:
+ k8s-app: nuage-vrs-ds
+ updateStrategy:
+ type: RollingUpdate
+ template:
+ metadata:
+ labels:
+ k8s-app: nuage-vrs-ds
+ spec:
+ hostNetwork: true
+ tolerations:
+ - key: node-role.kubernetes.io/master
+ effect: NoSchedule
+ operator: Exists
+ containers:
+ # This container installs Nuage VRS running as a
+ # container on each worker node
+ - name: install-nuage-vrs
+ image: nuage/vrs:{{ nuage_vrs_container_image_version }}
+ securityContext:
+ privileged: true
+ env:
+ # Configure parameters for VRS openvswitch file
+ - name: NUAGE_ACTIVE_CONTROLLER
+ value: "{{ vsc_active_ip }}"
+ - name: NUAGE_STANDBY_CONTROLLER
+ value: "{{ vsc_standby_ip }}"
+ - name: NUAGE_PLATFORM
+ value: '"kvm, k8s"'
+ - name: NUAGE_K8S_SERVICE_IPV4_SUBNET
+ value: '192.168.0.0\/16'
+ - name: NUAGE_NETWORK_UPLINK_INTF
+ value: "eth0"
+ volumeMounts:
+ - mountPath: /var/run
+ name: vrs-run-dir
+ - mountPath: /var/log
+ name: vrs-log-dir
+ - mountPath: /sys/module
+ name: sys-mod-dir
+ readOnly: true
+ - mountPath: /lib/modules
+ name: lib-mod-dir
+ readOnly: true
+ volumes:
+ - name: vrs-run-dir
+ hostPath:
+ path: /var/run
+ - name: vrs-log-dir
+ hostPath:
+ path: /var/log
+ - name: sys-mod-dir
+ hostPath:
+ path: /sys/module
+ - name: lib-mod-dir
+ hostPath:
+ path: /lib/modules
diff --git a/roles/nuage_master/templates/nuage-openshift-monitor.j2 b/roles/nuage_master/templates/nuage-openshift-monitor.j2
deleted file mode 100644
index e077128a4..000000000
--- a/roles/nuage_master/templates/nuage-openshift-monitor.j2
+++ /dev/null
@@ -1,41 +0,0 @@
-# .kubeconfig that includes the nuage service account
-kubeConfig: {{ kube_config }}
-# name of the nuage service account, or another account with 'cluster-reader'
-# permissions
-# Openshift master config file
-masterConfig: {{ master_config_yaml }}
-# URL of the VSD Architect
-vsdApiUrl: {{ vsd_api_url }}
-# API version to query against. Usually "v3_2"
-vspVersion: {{ vsp_version }}
-# File containing a VSP license to install. Only necessary if no license has
-# been installed on the VSD Architect before, only valid for standalone vsd install
-# licenseFile: "/path/to/base_vsp_license.txt"
-# Name of the enterprise in which pods will reside
-enterpriseName: {{ enterprise }}
-# Name of the domain in which pods will reside
-domainName: {{ domain }}
-# VSD generated user certificate file location on master node
-userCertificateFile: {{ cert_output_dir }}/{{ vsd_user_cert_file | basename }}
-# VSD generated user key file location on master node
-userKeyFile: {{ cert_output_dir }}/{{ vsd_user_key_file | basename }}
-# Location where logs should be saved
-log_dir: {{ nuage_mon_rest_server_logdir }}
-# Monitor rest server parameters
-# Logging level for the nuage openshift monitor
-# allowed options are: 0 => INFO, 1 => WARNING, 2 => ERROR, 3 => FATAL
-logLevel: {{ nuage_mon_log_level }}
-# Parameters related to the nuage monitor REST server
-nuageMonServer:
- URL: {{ nuage_mon_rest_server_url }}
- certificateDirectory: {{ cert_output_dir }}
-# etcd config required for HA
-etcdClientConfig:
- ca: {{ openshift_master_config_dir }}/{{ "ca.crt" if (openshift.master.embedded_etcd | bool) else "master.etcd-ca.crt" }}
- certFile: {{ openshift_master_config_dir }}/master.etcd-client.crt
- keyFile: {{ openshift_master_config_dir }}/master.etcd-client.key
- urls:
-{% for etcd_url in openshift.master.etcd_urls %}
- - {{ etcd_url }}
-{% endfor %}
-
diff --git a/roles/nuage_master/vars/main.yaml b/roles/nuage_master/vars/main.yaml
index 57d5d2595..114514d7c 100644
--- a/roles/nuage_master/vars/main.yaml
+++ b/roles/nuage_master/vars/main.yaml
@@ -22,6 +22,18 @@ nuage_mon_rest_server_host: "{{ openshift.master.cluster_hostname | default(open
nuage_master_crt_dir: /usr/share/nuage-openshift-monitor
nuage_service_account: system:serviceaccount:default:nuage
+nuage_master_config_dsets_mount_dir: /usr/share/
+nuage_node_config_dsets_mount_dir: /usr/share/
+nuage_cni_bin_dsets_mount_dir: /opt/cni/bin
+nuage_cni_netconf_dsets_mount_dir: /etc/cni/net.d
+nuage_monitor_container_image_version: "{{ nuage_monitor_image_version | default('v5.1.1') }}"
+nuage_vrs_container_image_version: "{{ nuage_vrs_image_version | default('v5.1.1') }}"
+nuage_cni_container_image_version: "{{ nuage_cni_image_version | default('v5.1.1') }}"
+api_server_url: "{{ hostvars[groups.oo_first_master.0].openshift.master.api_url }}"
+nuage_vport_mtu: "{{ nuage_interface_mtu | default('1460') }}"
+master_host_type: "{{ master_base_host_type | default('is_rhel_server') }}"
+slave_host_type: "{{ slave_base_host_type | default('is_rhel_server') }}"
+
nuage_tasks:
- resource_kind: cluster-role
resource_name: cluster-reader
diff --git a/roles/nuage_node/handlers/main.yaml b/roles/nuage_node/handlers/main.yaml
index 8384856ff..60247c33e 100644
--- a/roles/nuage_node/handlers/main.yaml
+++ b/roles/nuage_node/handlers/main.yaml
@@ -1,8 +1,4 @@
---
-- name: restart vrs
- become: yes
- systemd: name=openvswitch state=restarted
-
- name: restart node
become: yes
systemd: name={{ openshift.common.service_type }}-node state=restarted
diff --git a/roles/nuage_node/tasks/main.yaml b/roles/nuage_node/tasks/main.yaml
index 66d6ef4ca..3764681ff 100644
--- a/roles/nuage_node/tasks/main.yaml
+++ b/roles/nuage_node/tasks/main.yaml
@@ -1,28 +1,18 @@
---
-- name: Install Nuage VRS
- become: yes
- yum: name={{ vrs_rpm }} state=present
-
-- name: Set the uplink interface
- become: yes
- lineinfile: dest={{ vrs_config }} regexp=^NETWORK_UPLINK_INTF line='NETWORK_UPLINK_INTF={{ uplink_interface }}'
-
-- name: Set the Active Controller
- become: yes
- lineinfile: dest={{ vrs_config }} regexp=^ACTIVE_CONTROLLER line='ACTIVE_CONTROLLER={{ vsc_active_ip }}'
-
-- name: Set the K8S/OSE Cluster service CIDR
- become: yes
- lineinfile: dest={{ vrs_config }} regexp=^K8S_SERVICE_IPV4_SUBNET line='K8S_SERVICE_IPV4_SUBNET={{ k8s_cluster_service_cidr }}'
+- name: Set the Nuage plugin openshift directory fact for Atomic hosts
+ set_fact:
+ vsp_openshift_dir: /var/usr/share/vsp-openshift
+ when: openshift.common.is_atomic | bool
-- name: Set the Standby Controller
- become: yes
- lineinfile: dest={{ vrs_config }} regexp=^STANDBY_CONTROLLER line='STANDBY_CONTROLLER={{ vsc_standby_ip }}'
- when: vsc_standby_ip is defined
+- name: Set the Nuage CNI binary directory fact for Atomic hosts
+ set_fact:
+ cni_bin_dir: /var/opt/cni/bin/
+ when: openshift.common.is_atomic | bool
-- name: Install plugin rpm
- become: yes
- yum: name={{ plugin_rpm }} state=present
+- name: Set the Nuage plugin certs directory fact for Atomic hosts
+ set_fact:
+ nuage_plugin_crt_dir: /var/usr/share/vsp-openshift
+ when: openshift.common.is_atomic | bool
- name: Assure CNI conf dir exists
become: yes
@@ -32,13 +22,6 @@
become: yes
file: path="{{ cni_bin_dir }}" state=directory
-- name: Install CNI loopback plugin
- become: yes
- copy:
- src: "{{ k8s_cni_loopback_plugin }}"
- dest: "{{ cni_bin_dir }}/{{ k8s_cni_loopback_plugin | basename }}"
- mode: 0755
-
- name: Copy the certificates and keys
become: yes
copy: src="/tmp/{{ item }}" dest="{{ vsp_openshift_dir }}/{{ item }}"
@@ -50,12 +33,11 @@
- include: certificates.yml
-- name: Set the vsp-openshift.yaml
- become: yes
- template: src=vsp-openshift.j2 dest={{ vsp_openshift_yaml }} owner=root mode=0644
+- name: Restart node services
+ command: /bin/true
notify:
- - restart vrs
- restart node
+ ignore_errors: true
- include: iptables.yml
diff --git a/roles/nuage_node/templates/vsp-openshift.j2 b/roles/nuage_node/templates/vsp-openshift.j2
deleted file mode 100644
index f6bccebc2..000000000
--- a/roles/nuage_node/templates/vsp-openshift.j2
+++ /dev/null
@@ -1,29 +0,0 @@
-clientCert: {{ client_cert }}
-# The key to the certificate in clientCert above
-clientKey: {{ client_key }}
-# The certificate authority's certificate for the local kubelet. Usually the
-# same as the CA cert used to create the client Cert/Key pair.
-CACert: {{ ca_cert }}
-# Name of the enterprise in which pods will reside
-enterpriseName: {{ enterprise }}
-# Name of the domain in which pods will reside
-domainName: {{ domain }}
-# Name of the VSD user in admin group
-vsdUser: {{ vsd_user }}
-# IP address and port number of master API server
-masterApiServer: {{ api_server }}
-# REST server URL
-nuageMonRestServer: {{ nuage_mon_rest_server_url }}
-# Bridge name for the docker bridge
-dockerBridgeName: {{ docker_bridge }}
-# Certificate for connecting to the kubemon REST API
-nuageMonClientCert: {{ rest_client_cert }}
-# Key to the certificate in restClientCert
-nuageMonClientKey: {{ rest_client_key }}
-# CA certificate for verifying the master's rest server
-nuageMonServerCA: {{ rest_server_ca_cert }}
-# Nuage vport mtu size
-interfaceMTU: {{ vport_mtu }}
-# Logging level for the plugin
-# allowed options are: "dbg", "info", "warn", "err", "emer", "off"
-logLevel: {{ plugin_log_level }}
diff --git a/roles/openshift_examples/files/examples/v1.5/cfme-templates/cfme-template.yaml b/roles/openshift_examples/files/examples/v1.5/cfme-templates/cfme-template.yaml
index 3bc6c5813..fd57a864c 100644
--- a/roles/openshift_examples/files/examples/v1.5/cfme-templates/cfme-template.yaml
+++ b/roles/openshift_examples/files/examples/v1.5/cfme-templates/cfme-template.yaml
@@ -10,6 +10,12 @@ metadata:
iconClass: "icon-rails"
objects:
- apiVersion: v1
+ kind: Secret
+ metadata:
+ name: "${NAME}-secrets"
+ stringData:
+ pg-password: "${DATABASE_PASSWORD}"
+- apiVersion: v1
kind: Service
metadata:
annotations:
@@ -148,7 +154,10 @@ objects:
value: "${DATABASE_USER}"
-
name: "POSTGRESQL_PASSWORD"
- value: "${DATABASE_PASSWORD}"
+ valueFrom:
+ secretKeyRef:
+ name: "${NAME}-secrets"
+ key: "pg-password"
-
name: "POSTGRESQL_DATABASE"
value: "${DATABASE_NAME}"
@@ -345,7 +354,10 @@ objects:
value: "${DATABASE_USER}"
-
name: "POSTGRESQL_PASSWORD"
- value: "${DATABASE_PASSWORD}"
+ valueFrom:
+ secretKeyRef:
+ name: "${NAME}-secrets"
+ key: "pg-password"
-
name: "POSTGRESQL_DATABASE"
value: "${DATABASE_NAME}"
@@ -386,7 +398,8 @@ parameters:
displayName: "PostgreSQL Password"
required: true
description: "Password for the PostgreSQL user."
- value: "smartvm"
+ from: "[a-zA-Z0-9]{8}"
+ generate: expression
-
name: "DATABASE_NAME"
required: true
diff --git a/roles/openshift_examples/files/examples/v3.6/cfme-templates/cfme-template.yaml b/roles/openshift_examples/files/examples/v3.6/cfme-templates/cfme-template.yaml
index 3bc6c5813..fd57a864c 100644
--- a/roles/openshift_examples/files/examples/v3.6/cfme-templates/cfme-template.yaml
+++ b/roles/openshift_examples/files/examples/v3.6/cfme-templates/cfme-template.yaml
@@ -10,6 +10,12 @@ metadata:
iconClass: "icon-rails"
objects:
- apiVersion: v1
+ kind: Secret
+ metadata:
+ name: "${NAME}-secrets"
+ stringData:
+ pg-password: "${DATABASE_PASSWORD}"
+- apiVersion: v1
kind: Service
metadata:
annotations:
@@ -148,7 +154,10 @@ objects:
value: "${DATABASE_USER}"
-
name: "POSTGRESQL_PASSWORD"
- value: "${DATABASE_PASSWORD}"
+ valueFrom:
+ secretKeyRef:
+ name: "${NAME}-secrets"
+ key: "pg-password"
-
name: "POSTGRESQL_DATABASE"
value: "${DATABASE_NAME}"
@@ -345,7 +354,10 @@ objects:
value: "${DATABASE_USER}"
-
name: "POSTGRESQL_PASSWORD"
- value: "${DATABASE_PASSWORD}"
+ valueFrom:
+ secretKeyRef:
+ name: "${NAME}-secrets"
+ key: "pg-password"
-
name: "POSTGRESQL_DATABASE"
value: "${DATABASE_NAME}"
@@ -386,7 +398,8 @@ parameters:
displayName: "PostgreSQL Password"
required: true
description: "Password for the PostgreSQL user."
- value: "smartvm"
+ from: "[a-zA-Z0-9]{8}"
+ generate: expression
-
name: "DATABASE_NAME"
required: true
diff --git a/roles/openshift_logging/defaults/main.yml b/roles/openshift_logging/defaults/main.yml
index 8b0f4cb62..f07d7e6da 100644
--- a/roles/openshift_logging/defaults/main.yml
+++ b/roles/openshift_logging/defaults/main.yml
@@ -84,7 +84,7 @@ openshift_logging_es_ca: /etc/fluent/keys/ca
openshift_logging_es_client_cert: /etc/fluent/keys/cert
openshift_logging_es_client_key: /etc/fluent/keys/key
openshift_logging_es_cluster_size: "{{ openshift_hosted_logging_elasticsearch_cluster_size | default(1) }}"
-openshift_logging_es_cpu_limit: null
+openshift_logging_es_cpu_limit: 1000m
# the logging appenders for the root loggers to write ES logs. Valid values: 'file', 'console'
openshift_logging_es_log_appenders: ['file']
openshift_logging_es_memory_limit: "{{ openshift_hosted_logging_elasticsearch_instance_ram | default('8Gi') }}"
@@ -125,7 +125,7 @@ openshift_logging_es_ops_ca: /etc/fluent/keys/ca
openshift_logging_es_ops_client_cert: /etc/fluent/keys/cert
openshift_logging_es_ops_client_key: /etc/fluent/keys/key
openshift_logging_es_ops_cluster_size: "{{ openshift_hosted_logging_elasticsearch_ops_cluster_size | default(1) }}"
-openshift_logging_es_ops_cpu_limit: null
+openshift_logging_es_ops_cpu_limit: 1000m
openshift_logging_es_ops_memory_limit: "{{ openshift_hosted_logging_elasticsearch_ops_instance_ram | default('8Gi') }}"
openshift_logging_es_ops_pv_selector: "{{ openshift_hosted_loggingops_storage_labels | default('') }}"
openshift_logging_es_ops_pvc_dynamic: "{{ openshift_hosted_logging_elasticsearch_ops_pvc_dynamic | default(False) }}"
diff --git a/roles/openshift_node/tasks/main.yml b/roles/openshift_node/tasks/main.yml
index 3353a22e3..81456eac9 100644
--- a/roles/openshift_node/tasks/main.yml
+++ b/roles/openshift_node/tasks/main.yml
@@ -70,25 +70,15 @@
- openshift_disable_swap | default(true) | bool
# End Disable Swap Block
-# We have to add tuned-profiles in the same transaction otherwise we run into depsolving
-# problems because the rpms don't pin the version properly. This was fixed in 3.1 packaging.
- name: Install Node package
package:
- name: "{{ openshift.common.service_type }}-node{{ openshift_pkg_version | default('') | oo_image_tag_to_rpm_version(include_dash=True) }},tuned-profiles-{{ openshift.common.service_type }}-node{{ openshift_pkg_version | default('') | oo_image_tag_to_rpm_version(include_dash=True) }}"
+ name: "{{ openshift.common.service_type }}-node{{ openshift_pkg_version | default('') | oo_image_tag_to_rpm_version(include_dash=True) }}"
state: present
when: not openshift.common.is_containerized | bool
-- name: Check for tuned package
- command: rpm -q tuned
- args:
- warn: no
- register: tuned_installed
- changed_when: false
- failed_when: false
-
-- name: Set atomic-guest tuned profile
- command: "tuned-adm profile atomic-guest"
- when: tuned_installed.rc == 0 and openshift.common.is_atomic | bool
+- name: setup tuned
+ include: tuned.yml
+ static: yes
- name: Install sdn-ovs package
package:
diff --git a/roles/openshift_node/tasks/tuned.yml b/roles/openshift_node/tasks/tuned.yml
new file mode 100644
index 000000000..425bf6a26
--- /dev/null
+++ b/roles/openshift_node/tasks/tuned.yml
@@ -0,0 +1,41 @@
+---
+- name: Check for tuned package
+ command: rpm -q tuned
+ args:
+ warn: no
+ register: tuned_installed
+ changed_when: false
+ failed_when: false
+
+- name: Tuned service setup
+ block:
+ - name: Set tuned OpenShift variables
+ set_fact:
+ openshift_tuned_guest_profile: "{{ 'atomic-guest' if openshift.common.is_atomic else 'virtual-guest' }}"
+ tuned_etc_directory: '/etc/tuned'
+ tuned_templates_source: '../templates/tuned'
+
+ - name: Ensure directory structure exists
+ file:
+ state: directory
+ dest: '{{ tuned_etc_directory }}/{{ item.path }}'
+ with_filetree: '{{ tuned_templates_source }}'
+ when: item.state == 'directory'
+
+ - name: Ensure files are populated from templates
+ template:
+ src: '{{ item.src }}'
+ dest: '{{ tuned_etc_directory }}/{{ item.path }}'
+ with_filetree: '{{ tuned_templates_source }}'
+ when: item.state == 'file'
+
+ - name: Make tuned use the recommended tuned profile on restart
+ file: path=/etc/tuned/active_profile state=absent
+
+ - name: Restart tuned service
+ systemd:
+ state: restarted
+ daemon_reload: yes
+ name: tuned
+
+ when: tuned_installed.rc == 0 | bool
diff --git a/roles/openshift_storage_glusterfs/README.md b/roles/openshift_storage_glusterfs/README.md
index d3de2165a..a059745a6 100644
--- a/roles/openshift_storage_glusterfs/README.md
+++ b/roles/openshift_storage_glusterfs/README.md
@@ -55,7 +55,7 @@ defined:
| Name | Default value | Description |
|-------------------|---------------|-----------------------------------------|
-| glusterfs_devices | None | A list of block devices that will be completely managed as part of a GlusterFS cluster. There must be at least one device listed. Each device must be bare, e.g. no partitions or LVM PVs. **Example:** '[ "/dev/sdb" ]'
+| glusterfs_devices | None | A list of block devices that will be completely managed as part of a GlusterFS cluster. There must be at least one device listed. Each device must be bare, e.g. no partitions or LVM PVs. **Example:** '[ "/dev/sdb" ]' **NOTE:** You MUST set this as a host variable on each node host. For some reason, if you set this as a group variable it gets interpreted as a string rather than an array. See https://github.com/openshift/openshift-ansible/issues/5071
In addition, each host may specify the following variables to further control
their configuration as GlusterFS nodes: