From 269278b56ed03eca8d5e220275ccdb5b7fa1c07d Mon Sep 17 00:00:00 2001 From: Tomas Sedovic Date: Fri, 2 Jun 2017 14:21:46 +0200 Subject: Add readme --- playbooks/provisioning/openstack/README.md | 113 +++++++++++++++++++++++++++++ 1 file changed, 113 insertions(+) create mode 100644 playbooks/provisioning/openstack/README.md (limited to 'playbooks/provisioning/openstack/README.md') diff --git a/playbooks/provisioning/openstack/README.md b/playbooks/provisioning/openstack/README.md new file mode 100644 index 000000000..68550d3a3 --- /dev/null +++ b/playbooks/provisioning/openstack/README.md @@ -0,0 +1,113 @@ +# OpenStack Provisioning + +This repository contains playbooks and Heat templates to provision +OpenStack resources (servers, networking, volumes, security groups, +etc.). The result is an environment ready for openshift-ansible. + + +## Dependencies + +* [Ansible 2.3](https://pypi.python.org/pypi/ansible) +* [shade](https://pypi.python.org/pypi/shade) + + +## What does it do + +* Create Nova servers with floating IP addresses attached +* Assigns Cinder volumes to the servers +* Set up an `openshift` user with sudo privileges +* Optionally attach Red Hat subscriptions +* Set up a bind-based DNS server +* When deploying more than one master, set up a HAproxy server + + +## Set up + +### Copy the sample inventory + + cp openshift-ansible-contrib/playbooks/provisioning/openstack/sample-inventory inventory + +### Copy clouds.yaml + + cp openshift-ansible-contrib/playbooks/provisioning/openstack/sample-inventory/clouds.yaml clouds.yaml + +### Update `inventory/group_vars/all.yml` + +Pay special attention to the values in the first paragraph -- these +will depend on your OpenStack environment. + +The `env_id` and `openstack_dns_domain` will form the DNS domain all +your servers will be under. With the default values, this will be +`openshift.example.com`. + +`openstack_nameservers` is a list of DNS servers accessible from all +the created Nova servers. These will be serve as your DNS forwarders. + +`openstack_ssh_key` is a Nova keypair -- you can see your keypairs with +`openstack keypair list`. + +`openstack_default_image_name` is the name of the Glance image the +servers will use. You can +see your images with `openstack image list`. + +`openstack_default_flavor` is the Nova flavor the servers will use. +You can see your flavors with `openstack flavor list`. + +`openstack_external_network_name` is the name of the Neutron network +providing external connectivity. It is often called `public`, +`external` or `ext-net`. You can see your networks with `openstack +network list`. + +The `openstack_num_masters`, `openstack_num_infra` and +`openstack_num_nodes` values specify the number of Master, Infra and +App nodes to create. + +### Update the DNS names in `inventory/hosts` + +The different server groups are currently grouped by the domain name, +so if you end up using a different domain than +`openshift.example.com`, you will need to update the `inventory/hosts` +file. + +For example, if your final domain is `my.cloud.com`, you can run this +command to fix update the `hosts` file: + + sed -i 's/openshift.example.com/my.cloud.com/' inventory/hosts + +### Configure the OpenShift parameters + +Finally, you need to update the DNS entry in +`inventory/group_vars/OSEv3.yml` (look at +`openshift_master_default_subdomain`). + +In addition, this is the place where you can customise your OpenShift +installation for example by specifying the authentication. + +The full list of options is available in this sample inventory: + +https://github.com/openshift/openshift-ansible/blob/master/inventory/byo/hosts.ose.example + + +## Deployment + +### Run the playbook + +Assuming your OpenStack (Keystone) credentials are in the `keystonerc` +file, this is how you stat the provisioning process: + + . keystonerc + ansible-playbook -i inventory --private-key ~/.ssh/openshift openshift-ansible-contrib/playbooks/provisioning/openstack/provision.yaml + +### Install OpenShift + +Once it succeeds, you can install openshift by running: + + ansible-playbook --become --user openshift --private-key ~/.ssh/openshift -i inventory/ openshift-ansible/playbooks/byo/config.yml + + +## License + +As the rest of the openshift-ansible-contrib repository, the code here is +licensed under Apache 2. However, the openstack.py file under +`sample-inventory` is GPLv3+. See the INVENTORY-LICENSE.txt file for the full +text of the license. -- cgit v1.2.3 From 4bb2f005bc6cdeb8e656c2b42ac54db8fbd67fb9 Mon Sep 17 00:00:00 2001 From: Bogdan Dobrelya Date: Mon, 5 Jun 2017 16:41:09 +0200 Subject: Add a flat sec group for openstack provider Add a openstack_flat_secgroup, defaults to False. When set, merges sec rules for master, node, etcd, infra nodes into a single group. Less secure, but might help to mitigate quota limitations. Update docs. Use timeout 30s to mitigate the error: Timeout (12s) waiting for privilege escalation prompt. Signed-off-by: Bogdan Dobrelya --- playbooks/provisioning/openstack/README.md | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) (limited to 'playbooks/provisioning/openstack/README.md') diff --git a/playbooks/provisioning/openstack/README.md b/playbooks/provisioning/openstack/README.md index 68550d3a3..35f37db0d 100644 --- a/playbooks/provisioning/openstack/README.md +++ b/playbooks/provisioning/openstack/README.md @@ -25,7 +25,7 @@ etc.). The result is an environment ready for openshift-ansible. ### Copy the sample inventory - cp openshift-ansible-contrib/playbooks/provisioning/openstack/sample-inventory inventory + cp -r openshift-ansible-contrib/playbooks/provisioning/openstack/sample-inventory inventory ### Copy clouds.yaml @@ -62,6 +62,11 @@ The `openstack_num_masters`, `openstack_num_infra` and `openstack_num_nodes` values specify the number of Master, Infra and App nodes to create. +The `openstack_flat_secgroup`, controls Neutron security groups creation for Heat +stacks. Set it to true, if you experience issues with sec group rules +quotas. It trades security for number of rules, by sharing the same set +of firewall rules for master, node, etcd and infra nodes. + ### Update the DNS names in `inventory/hosts` The different server groups are currently grouped by the domain name, @@ -96,13 +101,13 @@ Assuming your OpenStack (Keystone) credentials are in the `keystonerc` file, this is how you stat the provisioning process: . keystonerc - ansible-playbook -i inventory --private-key ~/.ssh/openshift openshift-ansible-contrib/playbooks/provisioning/openstack/provision.yaml + ansible-playbook -i inventory --timeout 30 --private-key ~/.ssh/openshift openshift-ansible-contrib/playbooks/provisioning/openstack/provision.yaml ### Install OpenShift Once it succeeds, you can install openshift by running: - ansible-playbook --become --user openshift --private-key ~/.ssh/openshift -i inventory/ openshift-ansible/playbooks/byo/config.yml + ansible-playbook --timeout 30 --become --user openshift --private-key ~/.ssh/openshift -i inventory/ openshift-ansible/playbooks/byo/config.yml ## License -- cgit v1.2.3 From a8719af95559926bcf4841197273dfe838a563a4 Mon Sep 17 00:00:00 2001 From: Bogdan Dobrelya Date: Mon, 5 Jun 2017 22:06:48 +0200 Subject: Add ansible.cfg for openstack provider Signed-off-by: Bogdan Dobrelya --- playbooks/provisioning/openstack/README.md | 4 ++++ 1 file changed, 4 insertions(+) (limited to 'playbooks/provisioning/openstack/README.md') diff --git a/playbooks/provisioning/openstack/README.md b/playbooks/provisioning/openstack/README.md index 35f37db0d..fb2053c25 100644 --- a/playbooks/provisioning/openstack/README.md +++ b/playbooks/provisioning/openstack/README.md @@ -31,6 +31,10 @@ etc.). The result is an environment ready for openshift-ansible. cp openshift-ansible-contrib/playbooks/provisioning/openstack/sample-inventory/clouds.yaml clouds.yaml +### Copy ansible config + + cp openshift-ansible-contrib/playbooks/provisioning/openstack/sample-inventory/ansible.cfg ansible.cfg + ### Update `inventory/group_vars/all.yml` Pay special attention to the values in the first paragraph -- these -- cgit v1.2.3 From b884e6a9c77ae2d86b2de3c4ae6e8de558444610 Mon Sep 17 00:00:00 2001 From: Bogdan Dobrelya Date: Mon, 12 Jun 2017 12:02:41 +0200 Subject: Drop atomic-openshift-utils, update docs for origin TODO use with when: ansible_distribution == 'CentOS' Also update docs for origin Signed-off-by: Bogdan Dobrelya --- playbooks/provisioning/openstack/README.md | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) (limited to 'playbooks/provisioning/openstack/README.md') diff --git a/playbooks/provisioning/openstack/README.md b/playbooks/provisioning/openstack/README.md index fb2053c25..c319791c9 100644 --- a/playbooks/provisioning/openstack/README.md +++ b/playbooks/provisioning/openstack/README.md @@ -96,6 +96,12 @@ The full list of options is available in this sample inventory: https://github.com/openshift/openshift-ansible/blob/master/inventory/byo/hosts.ose.example +Note, that in order to deploy OpenShift origin, you should update the following +variables for the `inventory/group_vars/OSEv3.yml`, `all.yml`: + + deployment_type: origin + origin_release: 1.5.1 + openshift_deployment_type: "{{ deployment_type }}" ## Deployment @@ -111,8 +117,11 @@ file, this is how you stat the provisioning process: Once it succeeds, you can install openshift by running: - ansible-playbook --timeout 30 --become --user openshift --private-key ~/.ssh/openshift -i inventory/ openshift-ansible/playbooks/byo/config.yml + ansible-playbook --become --user openshift --private-key ~/.ssh/openshift -i inventory/ openshift-ansible/playbooks/byo/openshift-node/network_manager.yml + ansible-playbook --become --user openshift --private-key ~/.ssh/openshift -i inventory/ openshift-ansible/playbooks/byo/config.yml +Note, the `network_manager.yml` is only required if you're deploying OpenShift +origin. ## License -- cgit v1.2.3 From ca93151d4dee1f907cf578e3ab2b565f288c37c8 Mon Sep 17 00:00:00 2001 From: Tomas Sedovic Date: Fri, 16 Jun 2017 17:16:06 +0200 Subject: Update sample inventory with the latest changes --- playbooks/provisioning/openstack/README.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) (limited to 'playbooks/provisioning/openstack/README.md') diff --git a/playbooks/provisioning/openstack/README.md b/playbooks/provisioning/openstack/README.md index c319791c9..423d57113 100644 --- a/playbooks/provisioning/openstack/README.md +++ b/playbooks/provisioning/openstack/README.md @@ -9,6 +9,7 @@ etc.). The result is an environment ready for openshift-ansible. * [Ansible 2.3](https://pypi.python.org/pypi/ansible) * [shade](https://pypi.python.org/pypi/shade) +* python-dns ## What does it do @@ -66,7 +67,7 @@ The `openstack_num_masters`, `openstack_num_infra` and `openstack_num_nodes` values specify the number of Master, Infra and App nodes to create. -The `openstack_flat_secgroup`, controls Neutron security groups creation for Heat +The `openstack_flat_secgrp`, controls Neutron security groups creation for Heat stacks. Set it to true, if you experience issues with sec group rules quotas. It trades security for number of rules, by sharing the same set of firewall rules for master, node, etcd and infra nodes. -- cgit v1.2.3 From 8219f17503e16620b4881faefc78023c696ed2e5 Mon Sep 17 00:00:00 2001 From: Tzu-Mainn Chen Date: Wed, 21 Jun 2017 18:01:48 -0400 Subject: Add node_removal_policies variable to allow for scaling down --- playbooks/provisioning/openstack/README.md | 3 +++ 1 file changed, 3 insertions(+) (limited to 'playbooks/provisioning/openstack/README.md') diff --git a/playbooks/provisioning/openstack/README.md b/playbooks/provisioning/openstack/README.md index 423d57113..4686dfc08 100644 --- a/playbooks/provisioning/openstack/README.md +++ b/playbooks/provisioning/openstack/README.md @@ -67,6 +67,9 @@ The `openstack_num_masters`, `openstack_num_infra` and `openstack_num_nodes` values specify the number of Master, Infra and App nodes to create. +The `openstack_node_removal_policies` allows you to specify which App nodes to +remove. + The `openstack_flat_secgrp`, controls Neutron security groups creation for Heat stacks. Set it to true, if you experience issues with sec group rules quotas. It trades security for number of rules, by sharing the same set -- cgit v1.2.3 From 3f10c266aab0881ab294513d4ef93a1528d33c6b Mon Sep 17 00:00:00 2001 From: Bogdan Dobrelya Date: Wed, 21 Jun 2017 13:32:48 +0200 Subject: Fix flat sec group and infra/dns sec rules Make flat sec group to only merge node/master/etcd sec rules. Add basic dns/ssh sec group and assign it to all but dns node groups. Assign only dns sec group for dns nodes. Assign only infra (and basic) sec groups for ingra nodes. Add security notes for openstack provider. Signed-off-by: Bogdan Dobrelya --- playbooks/provisioning/openstack/README.md | 11 +++++++++++ 1 file changed, 11 insertions(+) (limited to 'playbooks/provisioning/openstack/README.md') diff --git a/playbooks/provisioning/openstack/README.md b/playbooks/provisioning/openstack/README.md index 423d57113..df00e5507 100644 --- a/playbooks/provisioning/openstack/README.md +++ b/playbooks/provisioning/openstack/README.md @@ -72,6 +72,17 @@ stacks. Set it to true, if you experience issues with sec group rules quotas. It trades security for number of rules, by sharing the same set of firewall rules for master, node, etcd and infra nodes. +#### Security notes + +Configure required `*_ingress_cidr` variables to restrict public access +to provisioned servers from your laptop (a /32 notation should be used) +or your trusted network. The most important is the `node_ingress_cidr` +that restricts public access to the deployed DNS server and cluster +nodes' ephemeral ports range. + +Note, the command ``curl https://api.ipify.org`` helps fiding an external +IP address of your box (the ansible admin node). + ### Update the DNS names in `inventory/hosts` The different server groups are currently grouped by the domain name, -- cgit v1.2.3 From 2fa7c112561eca54e0980902bda6920506c96f92 Mon Sep 17 00:00:00 2001 From: Tzu-Mainn Chen Date: Fri, 23 Jun 2017 15:47:17 -0400 Subject: rename node_removal_policies, add some comments and defaults --- playbooks/provisioning/openstack/README.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'playbooks/provisioning/openstack/README.md') diff --git a/playbooks/provisioning/openstack/README.md b/playbooks/provisioning/openstack/README.md index 4686dfc08..37868b2ea 100644 --- a/playbooks/provisioning/openstack/README.md +++ b/playbooks/provisioning/openstack/README.md @@ -67,8 +67,8 @@ The `openstack_num_masters`, `openstack_num_infra` and `openstack_num_nodes` values specify the number of Master, Infra and App nodes to create. -The `openstack_node_removal_policies` allows you to specify which App nodes to -remove. +The `openstack_nodes_to_remove` allows you to specify the numerical indexes +of App nodes that should be removed; for example, ['0', '2'], The `openstack_flat_secgrp`, controls Neutron security groups creation for Heat stacks. Set it to true, if you experience issues with sec group rules -- cgit v1.2.3 From d25db744f9f1fba8c08289a15632a0f7efe8111a Mon Sep 17 00:00:00 2001 From: Katerina Pilatova Date: Tue, 27 Jun 2017 16:00:49 +0200 Subject: README.md: list jinja2 as a dependency --- playbooks/provisioning/openstack/README.md | 1 + 1 file changed, 1 insertion(+) (limited to 'playbooks/provisioning/openstack/README.md') diff --git a/playbooks/provisioning/openstack/README.md b/playbooks/provisioning/openstack/README.md index a542e1493..84997b9cd 100644 --- a/playbooks/provisioning/openstack/README.md +++ b/playbooks/provisioning/openstack/README.md @@ -8,6 +8,7 @@ etc.). The result is an environment ready for openshift-ansible. ## Dependencies * [Ansible 2.3](https://pypi.python.org/pypi/ansible) +* [jinja](http://jinja.pocoo.org/docs/2.9/) * [shade](https://pypi.python.org/pypi/shade) * python-dns -- cgit v1.2.3 From 2e56553856c51344069546a189b22d34dacb8bfa Mon Sep 17 00:00:00 2001 From: Katerina Pilatova Date: Tue, 27 Jun 2017 16:02:34 +0200 Subject: README.md: fixing typo --- playbooks/provisioning/openstack/README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'playbooks/provisioning/openstack/README.md') diff --git a/playbooks/provisioning/openstack/README.md b/playbooks/provisioning/openstack/README.md index 84997b9cd..57b72c7f3 100644 --- a/playbooks/provisioning/openstack/README.md +++ b/playbooks/provisioning/openstack/README.md @@ -8,7 +8,7 @@ etc.). The result is an environment ready for openshift-ansible. ## Dependencies * [Ansible 2.3](https://pypi.python.org/pypi/ansible) -* [jinja](http://jinja.pocoo.org/docs/2.9/) +* [jinja2](http://jinja.pocoo.org/docs/2.9/) * [shade](https://pypi.python.org/pypi/shade) * python-dns -- cgit v1.2.3 From b28d6d787fbdc6f242aff77830a85693c148faa7 Mon Sep 17 00:00:00 2001 From: Bogdan Dobrelya Date: Thu, 29 Jun 2017 17:59:22 +0200 Subject: Manage packages to install/update for openstack provider Allow required packages and yum update all steps to be optionally disabled. Signed-off-by: Bogdan Dobrelya --- playbooks/provisioning/openstack/README.md | 10 ++++++++++ 1 file changed, 10 insertions(+) (limited to 'playbooks/provisioning/openstack/README.md') diff --git a/playbooks/provisioning/openstack/README.md b/playbooks/provisioning/openstack/README.md index 57b72c7f3..43e5e4878 100644 --- a/playbooks/provisioning/openstack/README.md +++ b/playbooks/provisioning/openstack/README.md @@ -76,6 +76,10 @@ stacks. Set it to true, if you experience issues with sec group rules quotas. It trades security for number of rules, by sharing the same set of firewall rules for master, node, etcd and infra nodes. +The `required_packages` variable also provides a list of the additional +prerequisite packages to be installed before to deploy an OpenShift cluster. +Those are ignored though, if the `manage_packages: False`. + #### Security notes Configure required `*_ingress_cidr` variables to restrict public access @@ -87,6 +91,12 @@ nodes' ephemeral ports range. Note, the command ``curl https://api.ipify.org`` helps fiding an external IP address of your box (the ansible admin node). +There is also the `manage_packages` variable (defaults to True) you +may want to turn off in order to speed up the provisioning tasks. This may +be the case for development environments. When turned off, the servers will +be provisioned omitting the ``yum update`` command. This brings security +implications though, and is not recommended for production deployments. + ### Update the DNS names in `inventory/hosts` The different server groups are currently grouped by the domain name, -- cgit v1.2.3 From 1409e0a52d45b7781b3a23f3f7eaa8fe09d26cd6 Mon Sep 17 00:00:00 2001 From: Bogdan Dobrelya Date: Mon, 19 Jun 2017 12:24:23 +0200 Subject: Persist DNS configuration for nodes for openstack provider * Firstly, provision a Heat stack with given public resolvers. * After the DNS node configured as an authoritative server, switch the Heat stack's Neutron subnet to that resolver (private_dns_server) the way it to become the first entry pushed into the hosts /etc/resolv.conf. It will be serving the cluster domain requests for OpenShift nodes and workloads. * Drop post-provision /etc/reslov.conf nameserver hacks as not needed anymore. * Fix dns floating IPs output and add the priv IPs output as well. * Update docs, clarify localhost vs servers requirements, add required Network Manager setup step. * Use post-provision task names instead of comments. Signed-off-by: Bogdan Dobrelya --- playbooks/provisioning/openstack/README.md | 39 +++++++++++++++++++++++------- 1 file changed, 30 insertions(+), 9 deletions(-) (limited to 'playbooks/provisioning/openstack/README.md') diff --git a/playbooks/provisioning/openstack/README.md b/playbooks/provisioning/openstack/README.md index 57b72c7f3..972ef705d 100644 --- a/playbooks/provisioning/openstack/README.md +++ b/playbooks/provisioning/openstack/README.md @@ -5,13 +5,19 @@ OpenStack resources (servers, networking, volumes, security groups, etc.). The result is an environment ready for openshift-ansible. -## Dependencies +## Dependencies for localhost (ansible control/admin node) * [Ansible 2.3](https://pypi.python.org/pypi/ansible) * [jinja2](http://jinja.pocoo.org/docs/2.9/) * [shade](https://pypi.python.org/pypi/shade) -* python-dns +* python-dns / [dnspython](https://pypi.python.org/pypi/dnspython) +* Become (sudo) is not required. +## Dependencies for OpenStack hosted cluster nodes (servers) + +There are no additional dependencies for the cluster nodes. Required +configuration steps are done by Heat given a specific user data config +that normally should not be changed. ## What does it do @@ -42,12 +48,27 @@ etc.). The result is an environment ready for openshift-ansible. Pay special attention to the values in the first paragraph -- these will depend on your OpenStack environment. -The `env_id` and `openstack_dns_domain` will form the DNS domain all +The `env_id` and `public_dns_domain` will form the cluster's DNS domain all your servers will be under. With the default values, this will be -`openshift.example.com`. - -`openstack_nameservers` is a list of DNS servers accessible from all -the created Nova servers. These will be serve as your DNS forwarders. +`openshift.example.com`. For workloads, the default subdomain is 'apps'. +That sudomain can be set as well by the `openshift_app_domain` variable in +the inventory. + +The `public_dns_nameservers` is a list of DNS servers accessible from all +the created Nova servers. These will be serving as your DNS forwarders for +external FQDNs that do not belong to the cluster's DNS domain and its subdomains. + +The `openshift_use_dnsmasq` controls either dnsmasq is deployed or not. +By default, dnsmasq is deployed and comes as the hosts' /etc/resolv.conf file +first nameserver entry that points to the local host instance of the dnsmasq +daemon that in turn proxies DNS requests to the authoritative DNS server. +When Network Manager is enabled for provisioned cluster nodes, which is +normally the case, you should not change the defaults and always deploy dnsmasq. + +Note that the authoritative DNS server is configured on post provsision +steps, and the Neutron subnet for the Heat stack is updated to point to that +server in the end. So the provisioned servers will start using it natively +as a default nameserver that comes from the NetworkManager and cloud-init. `openstack_ssh_key` is a Nova keypair -- you can see your keypairs with `openstack keypair list`. @@ -136,8 +157,8 @@ Once it succeeds, you can install openshift by running: ansible-playbook --become --user openshift --private-key ~/.ssh/openshift -i inventory/ openshift-ansible/playbooks/byo/openshift-node/network_manager.yml ansible-playbook --become --user openshift --private-key ~/.ssh/openshift -i inventory/ openshift-ansible/playbooks/byo/config.yml -Note, the `network_manager.yml` is only required if you're deploying OpenShift -origin. +Note, the `network_manager.yml` step is mandatory and is required for persisting +the hosts' DNS configs. ## License -- cgit v1.2.3 From 25a2d4f772d735bc31e7a891e16e3d7d7002cd68 Mon Sep 17 00:00:00 2001 From: Bogdan Dobrelya Date: Wed, 12 Jul 2017 11:52:11 +0200 Subject: Install DNS roles from casl-infra with galaxy (#529) Signed-off-by: Bogdan Dobrelya --- playbooks/provisioning/openstack/README.md | 19 ++++++++++++++++++- 1 file changed, 18 insertions(+), 1 deletion(-) (limited to 'playbooks/provisioning/openstack/README.md') diff --git a/playbooks/provisioning/openstack/README.md b/playbooks/provisioning/openstack/README.md index 34b548b9b..05e7e791a 100644 --- a/playbooks/provisioning/openstack/README.md +++ b/playbooks/provisioning/openstack/README.md @@ -4,10 +4,10 @@ This repository contains playbooks and Heat templates to provision OpenStack resources (servers, networking, volumes, security groups, etc.). The result is an environment ready for openshift-ansible. - ## Dependencies for localhost (ansible control/admin node) * [Ansible 2.3](https://pypi.python.org/pypi/ansible) +* [Ansible-galaxy](https://pypi.python.org/pypi/ansible-galaxy-local-deps) * [jinja2](http://jinja.pocoo.org/docs/2.9/) * [shade](https://pypi.python.org/pypi/shade) * python-dns / [dnspython](https://pypi.python.org/pypi/dnspython) @@ -19,6 +19,23 @@ There are no additional dependencies for the cluster nodes. Required configuration steps are done by Heat given a specific user data config that normally should not be changed. +## Required galaxy modules + +In order to pull in external dependencies for DNS configuration steps, +the following commads need to be executed: + + ansible-galaxy install \ + -r openshift-ansible-contrib/playbooks/provisioning/openstack/galaxy-requirements.yaml \ + -p openshift-ansible-contrib/roles + +Alternatively you can install directly from github: + + ansible-galaxy install git+https://github.com/redhat-cop/infra-ansible,master \ + -p openshift-ansible-contrib/roles + +Note, this assumes we're in the directory that contains the clonned +openshift-ansible-contrib repo in its root path. + ## What does it do * Create Nova servers with floating IP addresses attached -- cgit v1.2.3 From fb3d95ff05257906d846562b752fb9258794dc38 Mon Sep 17 00:00:00 2001 From: Tomas Sedovic Date: Fri, 14 Jul 2017 12:22:51 +0200 Subject: Set up NetworkManager automatically (#542) * Set up NetworkManager automatically This removes the extra step of running the `openshift-ansible/playbooks/byo/openshift-node/network_manager.yml` before installing openshift. In addition, the playbook relies on a host group that the provisioning doesn't provide (oo_all_hosts). Instead, we set up NetworkManager on CentOS nodes automatically. And we restart it on RHEL (which is necessary for the nodes to pick up the new DNS we configured the subnet with). This makes the provisioning easier and more resilient. * Apply the node-network-manager role to every node It makes the code simpler and more consistent across distros. --- playbooks/provisioning/openstack/README.md | 3 --- 1 file changed, 3 deletions(-) (limited to 'playbooks/provisioning/openstack/README.md') diff --git a/playbooks/provisioning/openstack/README.md b/playbooks/provisioning/openstack/README.md index 05e7e791a..5c2f61202 100644 --- a/playbooks/provisioning/openstack/README.md +++ b/playbooks/provisioning/openstack/README.md @@ -181,11 +181,8 @@ file, this is how you stat the provisioning process: Once it succeeds, you can install openshift by running: - ansible-playbook --become --user openshift --private-key ~/.ssh/openshift -i inventory/ openshift-ansible/playbooks/byo/openshift-node/network_manager.yml ansible-playbook --become --user openshift --private-key ~/.ssh/openshift -i inventory/ openshift-ansible/playbooks/byo/config.yml -Note, the `network_manager.yml` step is mandatory and is required for persisting -the hosts' DNS configs. ## License -- cgit v1.2.3 From 86b132e4bb1e5c58c1b194403f7d61fa34b20171 Mon Sep 17 00:00:00 2001 From: Katerina Pilatova Date: Tue, 18 Jul 2017 14:00:17 +0200 Subject: README: added prerequisity for a repository needed for python-openstackclient installation --- playbooks/provisioning/openstack/README.md | 1 + 1 file changed, 1 insertion(+) (limited to 'playbooks/provisioning/openstack/README.md') diff --git a/playbooks/provisioning/openstack/README.md b/playbooks/provisioning/openstack/README.md index 5c2f61202..0d8433367 100644 --- a/playbooks/provisioning/openstack/README.md +++ b/playbooks/provisioning/openstack/README.md @@ -12,6 +12,7 @@ etc.). The result is an environment ready for openshift-ansible. * [shade](https://pypi.python.org/pypi/shade) * python-dns / [dnspython](https://pypi.python.org/pypi/dnspython) * Become (sudo) is not required. +* `rhel-7-server-openstack-10-rpms` repository (in order to be able to install `python-openstackclient`) ## Dependencies for OpenStack hosted cluster nodes (servers) -- cgit v1.2.3 From 7040d1c9562d275bd1cef3059646db696a5f954e Mon Sep 17 00:00:00 2001 From: Katerina Pilatova Date: Tue, 18 Jul 2017 16:38:31 +0200 Subject: dependencies: python-heatclient and python-openstackclient added to optional dependencies --- playbooks/provisioning/openstack/README.md | 6 ++++++ 1 file changed, 6 insertions(+) (limited to 'playbooks/provisioning/openstack/README.md') diff --git a/playbooks/provisioning/openstack/README.md b/playbooks/provisioning/openstack/README.md index 0d8433367..e5ec68458 100644 --- a/playbooks/provisioning/openstack/README.md +++ b/playbooks/provisioning/openstack/README.md @@ -14,6 +14,12 @@ etc.). The result is an environment ready for openshift-ansible. * Become (sudo) is not required. * `rhel-7-server-openstack-10-rpms` repository (in order to be able to install `python-openstackclient`) +### Optional Dependencies forlocalhost +**Note**: When using rhel images, `rhel-7-server-openstack-10-rpms` repository is required in order to install these packages. + +* `python-openstackclient` +* `python-heatclient` + ## Dependencies for OpenStack hosted cluster nodes (servers) There are no additional dependencies for the cluster nodes. Required -- cgit v1.2.3 From 5a94e47f12a85daf1f93e1ea695689808c9a481d Mon Sep 17 00:00:00 2001 From: Katerina Pilatova Date: Tue, 18 Jul 2017 16:40:33 +0200 Subject: README: typo --- playbooks/provisioning/openstack/README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'playbooks/provisioning/openstack/README.md') diff --git a/playbooks/provisioning/openstack/README.md b/playbooks/provisioning/openstack/README.md index e5ec68458..fe68abb19 100644 --- a/playbooks/provisioning/openstack/README.md +++ b/playbooks/provisioning/openstack/README.md @@ -14,7 +14,7 @@ etc.). The result is an environment ready for openshift-ansible. * Become (sudo) is not required. * `rhel-7-server-openstack-10-rpms` repository (in order to be able to install `python-openstackclient`) -### Optional Dependencies forlocalhost +### Optional Dependencies for localhost **Note**: When using rhel images, `rhel-7-server-openstack-10-rpms` repository is required in order to install these packages. * `python-openstackclient` -- cgit v1.2.3 From 7081dd61c6d591ebff565795c460066f7de3809c Mon Sep 17 00:00:00 2001 From: Katerina Pilatova Date: Wed, 19 Jul 2017 11:49:56 +0200 Subject: README: fix --- playbooks/provisioning/openstack/README.md | 1 - 1 file changed, 1 deletion(-) (limited to 'playbooks/provisioning/openstack/README.md') diff --git a/playbooks/provisioning/openstack/README.md b/playbooks/provisioning/openstack/README.md index fe68abb19..6dd60cd88 100644 --- a/playbooks/provisioning/openstack/README.md +++ b/playbooks/provisioning/openstack/README.md @@ -12,7 +12,6 @@ etc.). The result is an environment ready for openshift-ansible. * [shade](https://pypi.python.org/pypi/shade) * python-dns / [dnspython](https://pypi.python.org/pypi/dnspython) * Become (sudo) is not required. -* `rhel-7-server-openstack-10-rpms` repository (in order to be able to install `python-openstackclient`) ### Optional Dependencies for localhost **Note**: When using rhel images, `rhel-7-server-openstack-10-rpms` repository is required in order to install these packages. -- cgit v1.2.3 From 63e623561f8fbc54e87248edf789b6c5d395cf26 Mon Sep 17 00:00:00 2001 From: Tomas Sedovic Date: Wed, 19 Jul 2017 15:45:04 +0200 Subject: Set ansible_become for the OSEv3 group Because openshift-ansible requires root on the cluster nodes, but it doesn't explicitly set it in the playbooks (like we do), let's set it in our inventory instead of requiring to pass `--become` to `ansible-playbook`. That will simplify the installation steps as well as let us include the provisioning and openshift-ansible playbooks in a single playbook. --- playbooks/provisioning/openstack/README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'playbooks/provisioning/openstack/README.md') diff --git a/playbooks/provisioning/openstack/README.md b/playbooks/provisioning/openstack/README.md index 5c2f61202..ac648a559 100644 --- a/playbooks/provisioning/openstack/README.md +++ b/playbooks/provisioning/openstack/README.md @@ -181,7 +181,7 @@ file, this is how you stat the provisioning process: Once it succeeds, you can install openshift by running: - ansible-playbook --become --user openshift --private-key ~/.ssh/openshift -i inventory/ openshift-ansible/playbooks/byo/config.yml + ansible-playbook --user openshift --private-key ~/.ssh/openshift -i inventory/ openshift-ansible/playbooks/byo/config.yml ## License -- cgit v1.2.3 From 1975fb57b4ddee77eec6f849f2c7677e2ee3d6df Mon Sep 17 00:00:00 2001 From: Bogdan Dobrelya Date: Thu, 20 Jul 2017 14:53:01 +0200 Subject: Generate static inventory with shade inventory (#538) * Autogenerate inventory/hosts when 'inventory: static' (Default), with the shade-inventory tool. * Drop unused anymore: openstack.py and associated GPL notes, an example static inventory, omit manual updates for the inventory DNS names in the deployment guide. * Switch openstack.py formatted inventory hostvars to the shade-inventory format (omit openstack.* from hostvars). * Populate node labels from inventory vars instead of the heat templates combined with inventory vars. * Add app (k8s minions) nodes group for primary node labels. Signed-off-by: Bogdan Dobrelya --- playbooks/provisioning/openstack/README.md | 19 ++++--------------- 1 file changed, 4 insertions(+), 15 deletions(-) (limited to 'playbooks/provisioning/openstack/README.md') diff --git a/playbooks/provisioning/openstack/README.md b/playbooks/provisioning/openstack/README.md index a92bc8837..d5b7c53ee 100644 --- a/playbooks/provisioning/openstack/README.md +++ b/playbooks/provisioning/openstack/README.md @@ -112,6 +112,9 @@ The `openstack_num_masters`, `openstack_num_infra` and `openstack_num_nodes` values specify the number of Master, Infra and App nodes to create. +The `openshift_cluster_node_labels` defines custom labels for your openshift +cluster node groups, like app or infra nodes. For example: `{'region': 'infra'}`. + The `openstack_nodes_to_remove` allows you to specify the numerical indexes of App nodes that should be removed; for example, ['0', '2'], @@ -141,18 +144,6 @@ be the case for development environments. When turned off, the servers will be provisioned omitting the ``yum update`` command. This brings security implications though, and is not recommended for production deployments. -### Update the DNS names in `inventory/hosts` - -The different server groups are currently grouped by the domain name, -so if you end up using a different domain than -`openshift.example.com`, you will need to update the `inventory/hosts` -file. - -For example, if your final domain is `my.cloud.com`, you can run this -command to fix update the `hosts` file: - - sed -i 's/openshift.example.com/my.cloud.com/' inventory/hosts - ### Configure the OpenShift parameters Finally, you need to update the DNS entry in @@ -193,6 +184,4 @@ Once it succeeds, you can install openshift by running: ## License As the rest of the openshift-ansible-contrib repository, the code here is -licensed under Apache 2. However, the openstack.py file under -`sample-inventory` is GPLv3+. See the INVENTORY-LICENSE.txt file for the full -text of the license. +licensed under Apache 2. -- cgit v1.2.3 From e7a7d1642c1ffbfe23cd5ad2d920e842f0cae4b2 Mon Sep 17 00:00:00 2001 From: Bogdan Dobrelya Date: Thu, 20 Jul 2017 16:53:05 +0200 Subject: Static inventory autogeneration (#550) * At the provisioning stage, allow users to auto-generate a static inventory w/o manual steps needed. The alternative to go fully dynamic TBD. * Move openshift pre-install playbook to the post provision playbook, where the second part of the pre install tasks is already placed. Signed-off-by: Bogdan Dobrelya --- playbooks/provisioning/openstack/README.md | 46 ++++++++++++++++++++++++++---- 1 file changed, 41 insertions(+), 5 deletions(-) (limited to 'playbooks/provisioning/openstack/README.md') diff --git a/playbooks/provisioning/openstack/README.md b/playbooks/provisioning/openstack/README.md index d5b7c53ee..0b0382834 100644 --- a/playbooks/provisioning/openstack/README.md +++ b/playbooks/provisioning/openstack/README.md @@ -93,8 +93,9 @@ steps, and the Neutron subnet for the Heat stack is updated to point to that server in the end. So the provisioned servers will start using it natively as a default nameserver that comes from the NetworkManager and cloud-init. -`openstack_ssh_key` is a Nova keypair -- you can see your keypairs with -`openstack keypair list`. +`openstack_ssh_key` is a Nova keypair - you can see your keypairs with +`openstack keypair list`. This guide assumes that its corresponding private +key is `~/.ssh/openshift`, stored on the ansible admin (control) node. `openstack_default_image_name` is the name of the Glance image the servers will use. You can @@ -127,6 +128,14 @@ The `required_packages` variable also provides a list of the additional prerequisite packages to be installed before to deploy an OpenShift cluster. Those are ignored though, if the `manage_packages: False`. +The `openstack_inventory` controls either a static inventory will be created after the +cluster nodes provisioned on OpenStack cloud. Note, the fully dynamic inventory +is yet to be supported, so the static inventory will be created anyway. + +The `openstack_inventory_path` points the directory to host the generated static inventory. +It should point to the copied example inventory directory, otherwise ti creates +a new one for you. + #### Security notes Configure required `*_ingress_cidr` variables to restrict public access @@ -164,21 +173,48 @@ variables for the `inventory/group_vars/OSEv3.yml`, `all.yml`: origin_release: 1.5.1 openshift_deployment_type: "{{ deployment_type }}" +### Configure static inventory + +Example inventory variables: + + openstack_private_ssh_key: ~/.ssh/openshift + openstack_inventory: static + openstack_inventory_path: ../../../../inventory + + +In this guide, the latter points to the current directory, where you run ansible commands +from. + +To verify nodes connectivity, use the command: + + ansible -v -i inventory/hosts -m ping all + +If something is broken, double-check the inventory variables, paths and the +generated `/hosts` file. + +The `inventory: dynamic` can be used instead to access cluster nodes directly via +floating IPs. In this mode you can not use a bastion node and should specify +the dynamic inventory file in your ansible commands , like `-i openstack.py`. + ## Deployment ### Run the playbook Assuming your OpenStack (Keystone) credentials are in the `keystonerc` -file, this is how you stat the provisioning process: +this is how you stat the provisioning process from your ansible control node: . keystonerc - ansible-playbook -i inventory --timeout 30 --private-key ~/.ssh/openshift openshift-ansible-contrib/playbooks/provisioning/openstack/provision.yaml + ansible-playbook openshift-ansible-contrib/playbooks/provisioning/openstack/provision.yaml + +Note, here you start with an empty inventory. The static inventory will be populated +with data so you can omit providing additional arguments for future ansible commands. + ### Install OpenShift Once it succeeds, you can install openshift by running: - ansible-playbook --user openshift --private-key ~/.ssh/openshift -i inventory/ openshift-ansible/playbooks/byo/config.yml + ansible-playbook openshift-ansible/playbooks/byo/config.yml ## License -- cgit v1.2.3 From 76b277f9649d7932ae84a544633e7dd5c5cd12c4 Mon Sep 17 00:00:00 2001 From: Tlacenka Date: Mon, 24 Jul 2017 10:39:22 +0200 Subject: README: Added note about infra-ansible installation (#574) * README in provisioning: note about infra-ansible not updating versions if one exists * README in provisioning: minor change * README: improved readability --- playbooks/provisioning/openstack/README.md | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) (limited to 'playbooks/provisioning/openstack/README.md') diff --git a/playbooks/provisioning/openstack/README.md b/playbooks/provisioning/openstack/README.md index 0b0382834..1ff586b49 100644 --- a/playbooks/provisioning/openstack/README.md +++ b/playbooks/provisioning/openstack/README.md @@ -39,8 +39,12 @@ Alternatively you can install directly from github: ansible-galaxy install git+https://github.com/redhat-cop/infra-ansible,master \ -p openshift-ansible-contrib/roles -Note, this assumes we're in the directory that contains the clonned +Notes: +* This assumes we're in the directory that contains the clonned openshift-ansible-contrib repo in its root path. +* When trying to install a different version, the previous one must be removed first +(`infra-ansible` directory from [roles](https://github.com/openshift/openshift-ansible-contrib/tree/master/roles)). +Otherwise, even if there are differences between the two versions, installation of the newer version is skipped. ## What does it do -- cgit v1.2.3 From df8f5f0e251a014ab30dabd62c17e151b7fe36e8 Mon Sep 17 00:00:00 2001 From: Bogdan Dobrelya Date: Wed, 12 Jul 2017 13:09:45 +0200 Subject: Options for bastion, SSH config, static inventory autogeneration * At the provisioning stage, allow users to auto-generate SSH config, when using a static inventory. * Run playbooks to provsion and post-provision as a separate, when using a bastion. This re-applies the SSH config, which ansible can't do on the fly. * Support a pre-installed bastion node, colocated with the 1st infra node. * With a bastion enabled, reduce floating IP footprint to infra and dns nodes only, effectively isolating a cluster in a private network. Signed-off-by: Bogdan Dobrelya --- playbooks/provisioning/openstack/README.md | 31 ++++++++++++++++++++++++++---- 1 file changed, 27 insertions(+), 4 deletions(-) (limited to 'playbooks/provisioning/openstack/README.md') diff --git a/playbooks/provisioning/openstack/README.md b/playbooks/provisioning/openstack/README.md index 1ff586b49..6b9e5a3a9 100644 --- a/playbooks/provisioning/openstack/README.md +++ b/playbooks/provisioning/openstack/README.md @@ -40,7 +40,7 @@ Alternatively you can install directly from github: -p openshift-ansible-contrib/roles Notes: -* This assumes we're in the directory that contains the clonned +* This assumes we're in the directory that contains the clonned openshift-ansible-contrib repo in its root path. * When trying to install a different version, the previous one must be removed first (`infra-ansible` directory from [roles](https://github.com/openshift/openshift-ansible-contrib/tree/master/roles)). @@ -177,16 +177,30 @@ variables for the `inventory/group_vars/OSEv3.yml`, `all.yml`: origin_release: 1.5.1 openshift_deployment_type: "{{ deployment_type }}" -### Configure static inventory +### Configure static inventory and access via a bastion node Example inventory variables: + openstack_use_bastion: true + bastion_ingress_cidr: "{{openstack_subnet_prefix}}.0/24" openstack_private_ssh_key: ~/.ssh/openshift openstack_inventory: static openstack_inventory_path: ../../../../inventory + openstack_ssh_config_path: /tmp/ssh.config.openshift.ansible.openshift.example.com +The `openstack_subnet_prefix` is the openstack private network for your cluster. +And the `bastion_ingress_cidr` defines accepted range for SSH connections to nodes +additionally to the `ssh_ingress_cidr`` (see the security notes above). -In this guide, the latter points to the current directory, where you run ansible commands +The SSH config will be stored on the ansible control node by the +gitven path. Ansible uses it automatically. To access the cluster nodes with +that ssh config, use the `-F` prefix, f.e.: + + ssh -F /tmp/ssh.config.openshift.ansible.openshift.example.com master-0.openshift.example.com echo OK + +Note, relative paths will not work for the `openstack_ssh_config_path`, but it +works for the `openstack_private_ssh_key` and `openstack_inventory_path`. In this +guide, the latter points to the current directory, where you run ansible commands from. To verify nodes connectivity, use the command: @@ -194,7 +208,7 @@ To verify nodes connectivity, use the command: ansible -v -i inventory/hosts -m ping all If something is broken, double-check the inventory variables, paths and the -generated `/hosts` file. +generated `/hosts` and `openstack_ssh_config_path` files. The `inventory: dynamic` can be used instead to access cluster nodes directly via floating IPs. In this mode you can not use a bastion node and should specify @@ -213,6 +227,15 @@ this is how you stat the provisioning process from your ansible control node: Note, here you start with an empty inventory. The static inventory will be populated with data so you can omit providing additional arguments for future ansible commands. +If bastion enabled, the generates SSH config must be applied for ansible. +Otherwise, it is auto included by the previous step. In order to execute it +as a separate playbook, use the following command: + + ansible-playbook openshift-ansible-contrib/playbooks/provisioning/openstack/post-provision-openstack.yml + +The first infra node then becomes a bastion node as well and proxies access +for future ansible commands. The post-provision step also configures Satellite, +if requested, and DNS server, and ensures other OpenShift requirements to be met. ### Install OpenShift -- cgit v1.2.3 From 56bd0c0417b4a5d79a106a0aed771a4ca477d572 Mon Sep 17 00:00:00 2001 From: Bogdan Dobrelya Date: Fri, 28 Jul 2017 16:44:36 +0200 Subject: Note about jmespath requirement for control node (#599) Signed-off-by: Bogdan Dobrelya --- playbooks/provisioning/openstack/README.md | 1 + 1 file changed, 1 insertion(+) (limited to 'playbooks/provisioning/openstack/README.md') diff --git a/playbooks/provisioning/openstack/README.md b/playbooks/provisioning/openstack/README.md index 6b9e5a3a9..8e99dd14b 100644 --- a/playbooks/provisioning/openstack/README.md +++ b/playbooks/provisioning/openstack/README.md @@ -10,6 +10,7 @@ etc.). The result is an environment ready for openshift-ansible. * [Ansible-galaxy](https://pypi.python.org/pypi/ansible-galaxy-local-deps) * [jinja2](http://jinja.pocoo.org/docs/2.9/) * [shade](https://pypi.python.org/pypi/shade) +* python-jmespath / [jmespath](https://pypi.python.org/pypi/jmespath) * python-dns / [dnspython](https://pypi.python.org/pypi/dnspython) * Become (sudo) is not required. -- cgit v1.2.3 From bc73ea59b62f6b24426171c9dc370ad6509e99a7 Mon Sep 17 00:00:00 2001 From: Tomas Sedovic Date: Fri, 4 Aug 2017 14:12:05 +0200 Subject: Remove clouds.yaml from sample-inventory With the move to the static inventory, we don't need it anymore so it's now just an unnecessary step in the deployment. Note that the users may still want to use clouds.yaml for openstack credentials instead of sourcing the `OS_*` environment variables, but they can do that at their discression. The reason we had the clouds.yaml here was because the `openstack.py` dynamic inventory used the servers' UUID's as ansible hosts by default and the options we put in caused it to use the hostnames (as desired). --- playbooks/provisioning/openstack/README.md | 4 ---- 1 file changed, 4 deletions(-) (limited to 'playbooks/provisioning/openstack/README.md') diff --git a/playbooks/provisioning/openstack/README.md b/playbooks/provisioning/openstack/README.md index 8e99dd14b..c7b2ea975 100644 --- a/playbooks/provisioning/openstack/README.md +++ b/playbooks/provisioning/openstack/README.md @@ -63,10 +63,6 @@ Otherwise, even if there are differences between the two versions, installation cp -r openshift-ansible-contrib/playbooks/provisioning/openstack/sample-inventory inventory -### Copy clouds.yaml - - cp openshift-ansible-contrib/playbooks/provisioning/openstack/sample-inventory/clouds.yaml clouds.yaml - ### Copy ansible config cp openshift-ansible-contrib/playbooks/provisioning/openstack/sample-inventory/ansible.cfg ansible.cfg -- cgit v1.2.3 From 784443b0d88597b988c3d5c58bc6358f5c73675e Mon Sep 17 00:00:00 2001 From: Bogdan Dobrelya Date: Tue, 15 Aug 2017 17:48:58 +0200 Subject: Support multiple private networks for static inventory (#604) Add openstack_private_network_name to filter by a wanted private network. Signed-off-by: Bogdan Dobrelya --- playbooks/provisioning/openstack/README.md | 4 ++++ 1 file changed, 4 insertions(+) (limited to 'playbooks/provisioning/openstack/README.md') diff --git a/playbooks/provisioning/openstack/README.md b/playbooks/provisioning/openstack/README.md index c7b2ea975..98c847d88 100644 --- a/playbooks/provisioning/openstack/README.md +++ b/playbooks/provisioning/openstack/README.md @@ -110,6 +110,10 @@ providing external connectivity. It is often called `public`, `external` or `ext-net`. You can see your networks with `openstack network list`. +`openstack_private_network_name` is the name of the private Neutron network +providing admin/control access for ansible. It can be merged with other +cluster networks, there are no special requirements for networking. + The `openstack_num_masters`, `openstack_num_infra` and `openstack_num_nodes` values specify the number of Master, Infra and App nodes to create. -- cgit v1.2.3 From 3d9676911df8eb0fc4ce03c5ccfab049b430f87b Mon Sep 17 00:00:00 2001 From: Tlacenka Date: Tue, 15 Aug 2017 19:17:59 +0200 Subject: Specify different image names for roles (#637) * all.yml: set up new variables for specifying images for roles * stack_params.yaml: add image name variables for different roles * more roles added * heat_stack.yaml.j2: openstack_image changed to updated image names * README: updated documentation for specifying image names --- playbooks/provisioning/openstack/README.md | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) (limited to 'playbooks/provisioning/openstack/README.md') diff --git a/playbooks/provisioning/openstack/README.md b/playbooks/provisioning/openstack/README.md index 98c847d88..216205947 100644 --- a/playbooks/provisioning/openstack/README.md +++ b/playbooks/provisioning/openstack/README.md @@ -98,9 +98,12 @@ as a default nameserver that comes from the NetworkManager and cloud-init. `openstack keypair list`. This guide assumes that its corresponding private key is `~/.ssh/openshift`, stored on the ansible admin (control) node. -`openstack_default_image_name` is the name of the Glance image the -servers will use. You can -see your images with `openstack image list`. +`openstack_default_image_name` is the default name of the Glance image the +servers will use. You can see your images with `openstack image list`. +In order to set a different image for a role, uncomment the line with the +corresponding variable (e.g. `openstack_lb_image_name` for load balancer) and +set its value to another available image name. `openstack_default_image_name` +must stay defined as it is used as a default value for the rest of the roles. `openstack_default_flavor` is the Nova flavor the servers will use. You can see your flavors with `openstack flavor list`. -- cgit v1.2.3 From 4ddb3fb369008395f8e2dc225cb6e08ca59a115b Mon Sep 17 00:00:00 2001 From: Tlacenka Date: Tue, 15 Aug 2017 20:37:18 +0200 Subject: group_vars/all.yml, stack_params.yaml, README: specifying flavors enabled and documented (#638) --- playbooks/provisioning/openstack/README.md | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) (limited to 'playbooks/provisioning/openstack/README.md') diff --git a/playbooks/provisioning/openstack/README.md b/playbooks/provisioning/openstack/README.md index 216205947..79e153fe1 100644 --- a/playbooks/provisioning/openstack/README.md +++ b/playbooks/provisioning/openstack/README.md @@ -105,8 +105,12 @@ corresponding variable (e.g. `openstack_lb_image_name` for load balancer) and set its value to another available image name. `openstack_default_image_name` must stay defined as it is used as a default value for the rest of the roles. -`openstack_default_flavor` is the Nova flavor the servers will use. +`openstack_default_flavor` is the default Nova flavor the servers will use. You can see your flavors with `openstack flavor list`. +In order to set a different flavor for a role, uncomment the line with the +corresponding variable (e.g. `openstack_lb_flavor` for load balancer) and +set its value to another available flavor. `openstack_default_flavor` must +stay defined as it is used as a default value for the rest of the roles. `openstack_external_network_name` is the name of the Neutron network providing external connectivity. It is often called `public`, -- cgit v1.2.3 From 6ebad037254b0c254638f6e6dfbd48e451a1ceeb Mon Sep 17 00:00:00 2001 From: Bogdan Dobrelya Date: Wed, 16 Aug 2017 09:14:06 +0200 Subject: Access UI via a bastion node (#596) When using a bastion and a single master, use the lb-secgrp to access UI port allowed from the ingress bastion node cidr. For HA (masters>1), UI still should be accessed via the LB node's ingress cidr, omitting the bastion. Signed-off-by: Bogdan Dobrelya --- playbooks/provisioning/openstack/README.md | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) (limited to 'playbooks/provisioning/openstack/README.md') diff --git a/playbooks/provisioning/openstack/README.md b/playbooks/provisioning/openstack/README.md index 79e153fe1..d7fa76b0f 100644 --- a/playbooks/provisioning/openstack/README.md +++ b/playbooks/provisioning/openstack/README.md @@ -251,6 +251,24 @@ Once it succeeds, you can install openshift by running: ansible-playbook openshift-ansible/playbooks/byo/config.yml +### Access UI + +OpenShift UI may be accessed via the 1st master node FQDN, port 8443. + +When using a bastion, you may want to make an SSH tunnel from your control node +to access UI on the `https://localhost:8443`, with this inventory variable: + + openshift_ui_ssh_tunnel: True + +Note, this requires sudo rights on the ansible control node and an absolute path +for the `openstack_private_ssh_key`. You should also update the control node's +`/etc/hosts`: + + 127.0.0.1 master-0.openshift.example.com + +In order to access UI, the ssh-tunnel service will be created and started on the +control node. Make sure to remove these changes and the service manually, when not +needed anymore. ## License -- cgit v1.2.3 From d41308f238b1c8dac35682e64f661c2e4b01c317 Mon Sep 17 00:00:00 2001 From: Tlacenka Date: Wed, 16 Aug 2017 11:09:02 +0200 Subject: Set custom hostnames for servers (#643) * README, all.yml, stack_params.yml, heat_stack.yaml.j2: hostname customisation added * hostnames customisation: default set in stack_params * heat_stack: bug fix * fixed commented defaults in group_vars/all.yml --- playbooks/provisioning/openstack/README.md | 4 ++++ 1 file changed, 4 insertions(+) (limited to 'playbooks/provisioning/openstack/README.md') diff --git a/playbooks/provisioning/openstack/README.md b/playbooks/provisioning/openstack/README.md index d7fa76b0f..afaeb430b 100644 --- a/playbooks/provisioning/openstack/README.md +++ b/playbooks/provisioning/openstack/README.md @@ -78,6 +78,10 @@ your servers will be under. With the default values, this will be That sudomain can be set as well by the `openshift_app_domain` variable in the inventory. +The `openstack__hostname` is a set of variables used for customising +hostnames of servers with a given role. When such a variable stays commented, +default hostname (usually the role name) is used. + The `public_dns_nameservers` is a list of DNS servers accessible from all the created Nova servers. These will be serving as your DNS forwarders for external FQDNs that do not belong to the cluster's DNS domain and its subdomains. -- cgit v1.2.3 From 6a528d5803619f93c734c23be44a2021f1d35ee9 Mon Sep 17 00:00:00 2001 From: Tlacenka Date: Thu, 17 Aug 2017 13:48:20 +0200 Subject: Configure different Docker volume sizes for different roles (#644) * README, all.yml, stack_params.yaml, openstack-stack: added docker volume size customisation - app_volume_size changed to node_volume_size (it is node everywhere else) * all.yml, stack_params.yaml,openstack-stack: added customisation for lb, etcd, dns * README: updated * README: updated info about ephemeral volumes --- playbooks/provisioning/openstack/README.md | 10 ++++++++++ 1 file changed, 10 insertions(+) (limited to 'playbooks/provisioning/openstack/README.md') diff --git a/playbooks/provisioning/openstack/README.md b/playbooks/provisioning/openstack/README.md index afaeb430b..ae572f9b6 100644 --- a/playbooks/provisioning/openstack/README.md +++ b/playbooks/provisioning/openstack/README.md @@ -135,6 +135,16 @@ cluster node groups, like app or infra nodes. For example: `{'region': 'infra'}` The `openstack_nodes_to_remove` allows you to specify the numerical indexes of App nodes that should be removed; for example, ['0', '2'], +The `docker_volume_size` is the default Docker volume size the servers will use. +In order to set a different volume size for a role, +uncomment the line with the corresponding variable (e. g. `docker_master_volume_size` +for master) and change its value. `docker_volume_size` must stay defined as it is +used as a default value for some of the servers (master, infra, app node). +The rest of the roles (etcd, load balancer, dns) have their defaults hard-coded. + +**Note**: If the `ephemeral_volumes` is set to `true`, the `*_volume_size` variables +will be ignored and the deployment will not create any cinder volumes. + The `openstack_flat_secgrp`, controls Neutron security groups creation for Heat stacks. Set it to true, if you experience issues with sec group rules quotas. It trades security for number of rules, by sharing the same set -- cgit v1.2.3 From ec07a43c6ac64d220458b688ded7ce3634eeb0d7 Mon Sep 17 00:00:00 2001 From: Tomas Sedovic Date: Mon, 21 Aug 2017 12:22:54 +0200 Subject: Update openshift_release in the sample inventory (#647) * Update openshift_release in the sample inventory This removes setting the version for Openshift Origin, because the only the latest release is actually available. So if a new Origin release comes up, the installation will fail. --- playbooks/provisioning/openstack/README.md | 1 - 1 file changed, 1 deletion(-) (limited to 'playbooks/provisioning/openstack/README.md') diff --git a/playbooks/provisioning/openstack/README.md b/playbooks/provisioning/openstack/README.md index ae572f9b6..099b017bb 100644 --- a/playbooks/provisioning/openstack/README.md +++ b/playbooks/provisioning/openstack/README.md @@ -196,7 +196,6 @@ Note, that in order to deploy OpenShift origin, you should update the following variables for the `inventory/group_vars/OSEv3.yml`, `all.yml`: deployment_type: origin - origin_release: 1.5.1 openshift_deployment_type: "{{ deployment_type }}" ### Configure static inventory and access via a bastion node -- cgit v1.2.3 From f4b584fcef4fad12be931631e0c95ac677799ee7 Mon Sep 17 00:00:00 2001 From: Bogdan Dobrelya Date: Wed, 16 Aug 2017 11:04:27 +0200 Subject: Add docs and defaults for multi-master setup Additionally, add the lb group to contain lb nodes to the static inventory template. Include the lb group into the OSEv3 group, in order to apply the cluster group vars to it. Signed-off-by: Bogdan Dobrelya --- playbooks/provisioning/openstack/README.md | 13 +++++++++++++ 1 file changed, 13 insertions(+) (limited to 'playbooks/provisioning/openstack/README.md') diff --git a/playbooks/provisioning/openstack/README.md b/playbooks/provisioning/openstack/README.md index 099b017bb..358ed182b 100644 --- a/playbooks/provisioning/openstack/README.md +++ b/playbooks/provisioning/openstack/README.md @@ -162,6 +162,19 @@ The `openstack_inventory_path` points the directory to host the generated static It should point to the copied example inventory directory, otherwise ti creates a new one for you. +#### Multi-master configuration + +Please refer to the official documentation for the +[multi-master setup](https://docs.openshift.com/container-platform/3.6/install_config/install/advanced_install.html#multiple-masters) +and define the corresponding [inventory +variables](https://docs.openshift.com/container-platform/3.6/install_config/install/advanced_install.html#configuring-cluster-variables) +in `inventory/group_vars/OSEv3.yml`. For example, given a load balancer node +under the ansible group named `ext_lb`: + + openshift_master_cluster_method: native + openshift_master_cluster_hostname: "{{ groups.ext_lb.0 }}" + openshift_master_cluster_public_hostname: "{{ groups.ext_lb.0 }}" + #### Security notes Configure required `*_ingress_cidr` variables to restrict public access -- cgit v1.2.3 From ce9b66f71b60857f644cc5a3559a5c21af5d9b24 Mon Sep 17 00:00:00 2001 From: tzumainn Date: Wed, 23 Aug 2017 09:58:07 -0400 Subject: Add documentation regarding running custom post-provision tasks (#678) * Add documentation regarding running custom post-provision tasks * moved post-provision doc to openstack README * added reference to OSEv3, clarified some text --- playbooks/provisioning/openstack/README.md | 38 ++++++++++++++++++++++++++++++ 1 file changed, 38 insertions(+) (limited to 'playbooks/provisioning/openstack/README.md') diff --git a/playbooks/provisioning/openstack/README.md b/playbooks/provisioning/openstack/README.md index 358ed182b..002c2f6aa 100644 --- a/playbooks/provisioning/openstack/README.md +++ b/playbooks/provisioning/openstack/README.md @@ -271,6 +271,44 @@ The first infra node then becomes a bastion node as well and proxies access for future ansible commands. The post-provision step also configures Satellite, if requested, and DNS server, and ensures other OpenShift requirements to be met. +### Running Custom Post-Provision Actions + +If you'd like to run post-provision actions, you can do so by creating a custom playbook. Here's one example that adds additional YUM repositories: + +``` +--- +- hosts: app + tasks: + + # enable EPL + - name: Add repository + yum_repository: + name: epel + description: EPEL YUM repo + baseurl: https://download.fedoraproject.org/pub/epel/$releasever/$basearch/ +``` + +This example runs against app nodes. The list of options include: + + - cluster_hosts (all hosts: app, infra, masters, dns, lb) + - OSEv3 (app, infra, masters) + - app + - dns + - masters + - infra_hosts + +After writing your custom playbook, run it like this: + +``` +ansible-playbook --private-key ~/.ssh/openshift -i myinventory/ custom-playbook.yaml +``` + +If you'd like to limit the run to one particular host, you can do so as follows: + +``` +ansible-playbook --private-key ~/.ssh/openshift -i myinventory/ custom-playbook.yaml -l app-node-0.openshift.example.com +``` + ### Install OpenShift Once it succeeds, you can install openshift by running: -- cgit v1.2.3 From 2a0afda0940b63d71f05c0d11834e3b4582f4e90 Mon Sep 17 00:00:00 2001 From: Tlacenka Date: Wed, 23 Aug 2017 16:39:17 +0200 Subject: Fix node label customisation (#679) * node labels: add checks for custom labels - README: add more info about customising labels - pre_tasks: add checks for label values, set to empty dict if undefined - group_vars: move labels customisation from OSEv3 to all * pre_tasks: tried a new approach to updating variables * pre_tasks: variable update fixed * pre_tasks: rollback upscaling changes (to be added in upscaling PR) * pre_tasks: blank line removed * pre_tasks: add check for undefined variable (should not happen though) * pre_tasks: be sure to have regions defined --- playbooks/provisioning/openstack/README.md | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) (limited to 'playbooks/provisioning/openstack/README.md') diff --git a/playbooks/provisioning/openstack/README.md b/playbooks/provisioning/openstack/README.md index 002c2f6aa..c9f651032 100644 --- a/playbooks/provisioning/openstack/README.md +++ b/playbooks/provisioning/openstack/README.md @@ -130,7 +130,15 @@ The `openstack_num_masters`, `openstack_num_infra` and App nodes to create. The `openshift_cluster_node_labels` defines custom labels for your openshift -cluster node groups, like app or infra nodes. For example: `{'region': 'infra'}`. +cluster node groups. It currently supports app and infra node groups. +The default value of this variable sets `region: primary` to app nodes and +`region: infra` to infra nodes. +An example of setting a customised label: +``` +openshift_cluster_node_labels: + app: + mylabel: myvalue +``` The `openstack_nodes_to_remove` allows you to specify the numerical indexes of App nodes that should be removed; for example, ['0', '2'], -- cgit v1.2.3 From 2ea1ccfb37461a70d329655f7eeaaab090f1ca0d Mon Sep 17 00:00:00 2001 From: Bogdan Dobrelya Date: Fri, 25 Aug 2017 16:15:40 +0200 Subject: Support external/pre-provisioned authoritative cluster DNS (#690) * Document how to use fully external DNS servers w/o provisioning dns servers group with Heat. * Document how to use a mixed servers setup for dynamic records updates mathing public or private views. * Allow custom nsupdate key names for OSP10 dns service compatibility. The osp-dns configures the named service with the fixed key_name 'update-key'. Add optional key_name for the external_nsupdate_keys public section to allow custom key names. --- playbooks/provisioning/openstack/README.md | 56 ++++++++++++++++++++++++++---- 1 file changed, 50 insertions(+), 6 deletions(-) (limited to 'playbooks/provisioning/openstack/README.md') diff --git a/playbooks/provisioning/openstack/README.md b/playbooks/provisioning/openstack/README.md index c9f651032..2eb9aa9cd 100644 --- a/playbooks/provisioning/openstack/README.md +++ b/playbooks/provisioning/openstack/README.md @@ -53,8 +53,9 @@ Otherwise, even if there are differences between the two versions, installation * Assigns Cinder volumes to the servers * Set up an `openshift` user with sudo privileges * Optionally attach Red Hat subscriptions -* Set up a bind-based DNS server -* When deploying more than one master, set up a HAproxy server +* Sets up a bind-based DNS server or configures the cluster servers to use an external DNS server. +* Supports mixed in-stack/external DNS servers for dynamic updates. +* When deploying more than one master, sets up a HAproxy server ## Set up @@ -69,9 +70,17 @@ Otherwise, even if there are differences between the two versions, installation ### Update `inventory/group_vars/all.yml` +#### DNS configuration variables + Pay special attention to the values in the first paragraph -- these will depend on your OpenStack environment. +Note that the provsisioning playbooks update the original Neutron subnet +created with the Heat stack to point to the configured DNS servers. +So the provisioned cluster nodes will start using those natively as +default nameservers. Technically, this allows to deploy OpenShift clusters +without dnsmasq proxies. + The `env_id` and `public_dns_domain` will form the cluster's DNS domain all your servers will be under. With the default values, this will be `openshift.example.com`. For workloads, the default subdomain is 'apps'. @@ -93,10 +102,45 @@ daemon that in turn proxies DNS requests to the authoritative DNS server. When Network Manager is enabled for provisioned cluster nodes, which is normally the case, you should not change the defaults and always deploy dnsmasq. -Note that the authoritative DNS server is configured on post provsision -steps, and the Neutron subnet for the Heat stack is updated to point to that -server in the end. So the provisioned servers will start using it natively -as a default nameserver that comes from the NetworkManager and cloud-init. +`external_nsupdate_keys` describes an external authoritative DNS server(s) +processing dynamic records updates in the public and private cluster views: + + external_nsupdate_keys: + public: + key_secret: + key_algorithm: 'hmac-md5' + key_name: 'update-key' + server: + private: + key_secret: + key_algorithm: 'hmac-sha256' + server: + +Here, for the public view section, we specified another key algorithm and +optional `key_name`, which normally defaults to the cluster's DNS domain. +This just illustrates a compatibility mode with a DNS service deployed +by OpenShift on OSP10 reference architecture, and used in a mixed mode with +another external DNS server. + +Another example defines an external DNS server for the public view +additionally to the in-stack DNS server used for the private view only: + + external_nsupdate_keys: + public: + key_secret: + key_algorithm: 'hmac-sha256' + server: + +Here, updates matching the public view will be hitting the given public +server IP. While updates matching the private view will be sent to the +auto evaluated in-stack DNS server's **public** IP. + +Note, for the in-stack DNS server, private view updates may be sent only +via the public IP of the server. You can not send updates via the private +IP yet. This forces the in-stack private server to have a floating IP. +See also the [security notes](#security-notes) + +#### Other configuration variables `openstack_ssh_key` is a Nova keypair - you can see your keypairs with `openstack keypair list`. This guide assumes that its corresponding private -- cgit v1.2.3 From 8008fd49227a750a6a5cf5cae8700f0fe0970bce Mon Sep 17 00:00:00 2001 From: tzumainn Date: Thu, 31 Aug 2017 04:38:38 -0400 Subject: Add custom post-provision playbook for adding yum repos (#697) * Add custom post-provision playbook for adding yum repos * fixed formatting issues * requested corrections and formatting changes --- playbooks/provisioning/openstack/README.md | 26 +++++++++++++++++--------- 1 file changed, 17 insertions(+), 9 deletions(-) (limited to 'playbooks/provisioning/openstack/README.md') diff --git a/playbooks/provisioning/openstack/README.md b/playbooks/provisioning/openstack/README.md index 2eb9aa9cd..57d5839c8 100644 --- a/playbooks/provisioning/openstack/README.md +++ b/playbooks/provisioning/openstack/README.md @@ -325,7 +325,19 @@ if requested, and DNS server, and ensures other OpenShift requirements to be met ### Running Custom Post-Provision Actions -If you'd like to run post-provision actions, you can do so by creating a custom playbook. Here's one example that adds additional YUM repositories: +A custom playbook can be run like this: + +``` +ansible-playbook --private-key ~/.ssh/openshift -i inventory/ openshift-ansible-contrib/playbooks/provisioning/openstack/custom-actions/custom-playbook.yml +``` + +If you'd like to limit the run to one particular host, you can do so as follows: + +``` +ansible-playbook --private-key ~/.ssh/openshift -i inventory/ openshift-ansible-contrib/playbooks/provisioning/openstack/custom-actions/custom-playbook.yml -l app-node-0.openshift.example.com +``` + +You can also create your own custom playbook. Here's one example that adds additional YUM repositories: ``` --- @@ -349,17 +361,13 @@ This example runs against app nodes. The list of options include: - masters - infra_hosts -After writing your custom playbook, run it like this: +Please consider contributing your custom playbook back to openshift-ansible-contrib! -``` -ansible-playbook --private-key ~/.ssh/openshift -i myinventory/ custom-playbook.yaml -``` +A library of custom post-provision actions exists in `openshift-ansible-contrib/playbooks/provisioning/openstack/custom-actions`. Playbooks include: -If you'd like to limit the run to one particular host, you can do so as follows: +##### add-yum-repos.yml -``` -ansible-playbook --private-key ~/.ssh/openshift -i myinventory/ custom-playbook.yaml -l app-node-0.openshift.example.com -``` +[add-yum-repos.yml](https://github.com/openshift/openshift-ansible-contrib/blob/master/playbooks/provisioning/openstack/custom-actions/add-yum-repos.yml) adds a list of custom yum repositories to every node in the cluster. ### Install OpenShift -- cgit v1.2.3 From 06abd17792fafc3adec3916f56c69800690b1431 Mon Sep 17 00:00:00 2001 From: Bogdan Dobrelya Date: Tue, 5 Sep 2017 15:56:43 +0200 Subject: Document global DNS security options (#694) * Document global DNS security options Related changes: * Do not create a view if externally managed. * Allow to specify the recursion settings for public/private views defined by the dns-view role. Signed-off-by: Bogdan Dobrelya * Document public_dns_nameservers better Also use it as the private view forwarder Signed-off-by: Bogdan Dobrelya --- playbooks/provisioning/openstack/README.md | 14 ++++++++++++++ 1 file changed, 14 insertions(+) (limited to 'playbooks/provisioning/openstack/README.md') diff --git a/playbooks/provisioning/openstack/README.md b/playbooks/provisioning/openstack/README.md index 57d5839c8..b898351e6 100644 --- a/playbooks/provisioning/openstack/README.md +++ b/playbooks/provisioning/openstack/README.md @@ -94,6 +94,8 @@ default hostname (usually the role name) is used. The `public_dns_nameservers` is a list of DNS servers accessible from all the created Nova servers. These will be serving as your DNS forwarders for external FQDNs that do not belong to the cluster's DNS domain and its subdomains. +If you're unsure what to put in here, you can try the google or opendns servers, +but note that some organizations may be blocking them. The `openshift_use_dnsmasq` controls either dnsmasq is deployed or not. By default, dnsmasq is deployed and comes as the hosts' /etc/resolv.conf file @@ -244,6 +246,18 @@ be the case for development environments. When turned off, the servers will be provisioned omitting the ``yum update`` command. This brings security implications though, and is not recommended for production deployments. +##### DNS servers security options + +Aside from `node_ingress_cidr` restricting public access to in-stack DNS +servers, there are following (bind/named specific) DNS security +options available: + + named_public_recursion: 'no' + named_private_recursion: 'yes' + +External DNS servers, which is not included in the 'dns' hosts group, +are not managed. It is up to you to configure such ones. + ### Configure the OpenShift parameters Finally, you need to update the DNS entry in -- cgit v1.2.3 From daa0b91119d2c16860a19b4ead2d0d128f8bc5ce Mon Sep 17 00:00:00 2001 From: Tomas Sedovic Date: Wed, 6 Sep 2017 10:24:16 +0200 Subject: Allow using a provider network (#701) * Allow using a provider network This adds a new option `openstack_provider_network_name` which will take a name of an existing network and put the servers there. It will also prevent creating floating IP addresses as the provider network's IPs should already be accessible without any additional routing required. Fixes #622 * Requested changes Don't fail on external/private networks and use role defaults for the provider network. * Add missing endif --- playbooks/provisioning/openstack/README.md | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) (limited to 'playbooks/provisioning/openstack/README.md') diff --git a/playbooks/provisioning/openstack/README.md b/playbooks/provisioning/openstack/README.md index b898351e6..4e74627dc 100644 --- a/playbooks/provisioning/openstack/README.md +++ b/playbooks/provisioning/openstack/README.md @@ -229,6 +229,24 @@ under the ansible group named `ext_lb`: openshift_master_cluster_hostname: "{{ groups.ext_lb.0 }}" openshift_master_cluster_public_hostname: "{{ groups.ext_lb.0 }}" +#### Provider Network + +Normally, the playbooks create a new Neutron network and subnet and attach +floating IP addresses to each node. If you have a provider network set up, this +is all unnecessary as you can just access servers that are placed in the +provider network directly. + +To use a provider network, set its name in `openstack_provider_network_name` in +`inventory/group_vars/all.yml`. + +If you set the provider network name, the `openstack_external_network_name` and +`openstack_private_network_name` fields will be ignored. + +**NOTE**: this will not update the nodes' DNS, so running openshift-ansible +right after provisioning will fail (unless you're using an external DNS server +your provider network knows about). You must make sure your nodes are able to +resolve each other by name. + #### Security notes Configure required `*_ingress_cidr` variables to restrict public access -- cgit v1.2.3 From 97c99ad8582370803e2841b07985260886614eb2 Mon Sep 17 00:00:00 2001 From: tzumainn Date: Wed, 6 Sep 2017 09:36:09 -0400 Subject: Point openshift_master_cluster_public_hostname at master or lb if defined (#706) * Point openshift_master_cluster_public_hostname at master or load balancer if specified * cleanup * remove extraneous brackets * corrections * added doc section * add private records --- playbooks/provisioning/openstack/README.md | 9 +++++++++ 1 file changed, 9 insertions(+) (limited to 'playbooks/provisioning/openstack/README.md') diff --git a/playbooks/provisioning/openstack/README.md b/playbooks/provisioning/openstack/README.md index 4e74627dc..8b9a37537 100644 --- a/playbooks/provisioning/openstack/README.md +++ b/playbooks/provisioning/openstack/README.md @@ -295,6 +295,15 @@ variables for the `inventory/group_vars/OSEv3.yml`, `all.yml`: deployment_type: origin openshift_deployment_type: "{{ deployment_type }}" +#### Setting a custom entrypoint + +In order to set a custom entrypoint, update `openshift_master_cluster_public_hostname` + + openshift_master_cluster_public_hostname: api.openshift.example.com + +Note than an empty hostname does not work, so if your domain is `openshift.example.com`, +you cannot set this value to simply `openshift.example.com`. + ### Configure static inventory and access via a bastion node Example inventory variables: -- cgit v1.2.3 From afd6a03b071eced6bd0940bb96a2a39233739523 Mon Sep 17 00:00:00 2001 From: Tomas Sedovic Date: Tue, 12 Sep 2017 17:05:56 +0200 Subject: Support Cinder-backed Openshift registry (#707) * Attach and detach a volume, wait for it to be accessible This is mostly just handling the attach/detach code, making sure the necessary vars are accessible where they need to be as well as finding out the correct device name the volume is attached as. * Create temp directory for mounts, remove some debug info * add the fs actions * Remove debug * Prepare the volume automatically if possible * Add docs and sample inventory * Read OS_* creds from shell in sample inventory * Fix yamlint complaint * Update readme This mentions the potential pitfalls when using devstack. * Better check for the router deployment in CI * Set the openshift_hoster*_wait vars to True * Fix typo --- playbooks/provisioning/openstack/README.md | 78 ++++++++++++++++++++++++++++++ 1 file changed, 78 insertions(+) (limited to 'playbooks/provisioning/openstack/README.md') diff --git a/playbooks/provisioning/openstack/README.md b/playbooks/provisioning/openstack/README.md index 8b9a37537..267176eec 100644 --- a/playbooks/provisioning/openstack/README.md +++ b/playbooks/provisioning/openstack/README.md @@ -295,6 +295,7 @@ variables for the `inventory/group_vars/OSEv3.yml`, `all.yml`: deployment_type: origin openshift_deployment_type: "{{ deployment_type }}" + #### Setting a custom entrypoint In order to set a custom entrypoint, update `openshift_master_cluster_public_hostname` @@ -304,6 +305,83 @@ In order to set a custom entrypoint, update `openshift_master_cluster_public_hos Note than an empty hostname does not work, so if your domain is `openshift.example.com`, you cannot set this value to simply `openshift.example.com`. +### Use an existing Cinder volume for the OpenShift registry + +You can optionally use an existing Cinder volume for the storage of +your OpenShift registry. + +To do that, you need to have a Cinder volume (you can create one by +running: + + openstack volume create --size + +The volume needs to have a file system created before you put it to +use. We can do prepare it for you if you put this in inventory/group_vars/all.yml: + + prepare_and_format_registry_volume: true + +**NOTE:** doing so **will destroy any data that's currently on the volume**! + +You can also run the registry setup playbook directly: + + ansible-playbook -i inventory playbooks/provisioning/openstack/prepare-and-format-cinder-volume.yaml + +(the provisioning phase must be completed, first) + + +To instruct OpenShift to actually use the volume, you must first configure it +with the OpenStack credentials by putting the following to `OSEv3.yml`: + + ## Openstack credentials + #openshift_cloudprovider_kind=openstack + #openshift_cloudprovider_openstack_auth_url=http://openstack.example.com:35357/v2.0/ + #openshift_cloudprovider_openstack_username=username + #openshift_cloudprovider_openstack_password=password + #openshift_cloudprovider_openstack_domain_id=domain_id + #openshift_cloudprovider_openstack_domain_name=domain_name + #openshift_cloudprovider_openstack_tenant_id=tenant_id + #openshift_cloudprovider_openstack_tenant_name=tenant_name + #openshift_cloudprovider_openstack_region=region + +Note that these credentials may be different from the ones you used for +provisioning (say for quota or access control reasons). To use the same +OpenStack credentials for both, take a look at the `sample-inventory`. It shows +how to read the values from your shell environment. + +Make sure to only set the values you need from (e.g. your keystonerc or +clouds.yaml). Some of the options ar keystone V2 or V3 specific. + +**NOTE**: If you're testing this on (DevStack)[devstack], you must +explicitly set your Keystone API version to v2 (e.g. +`OS_AUTH_URL=http://10.20.30.40/identity/v2.0`) instead of the default +value provided by `openrc`. You may also encounter the following issue +with Cinder: + +https://github.com/kubernetes/kubernetes/issues/50461 + + +[devstack]: https://docs.openstack.org/devstack/latest/ + + +You can read the (OpenShift documentation on configuring +OpenStack)[openstack] for more information. + +[openstack]: https://docs.openshift.org/latest/install_config/configuring_openstack.html + + +Next we need to instruct openshift-ansible to use the Cinder volume +for it's registry. Again in `OSEv3.yml`: + + ## Use Cinder volume for Openshift registry: + #openshift_hosted_registry_storage_kind: openstack + #openshift_hosted_registry_storage_access_modes: ['ReadWriteOnce'] + #openshift_hosted_registry_storage_openstack_filesystem: xfs + #openshift_hosted_registry_storage_openstack_volumeID: e0ba2d73-d2f9-4514-a3b2-a0ced507fa05 + #openshift_hosted_registry_storage_volume_size: 10Gi + +The **Cinder volume ID**, **filesystem** and **volume size** variables must +correspond to the values in your volume. + ### Configure static inventory and access via a bastion node Example inventory variables: -- cgit v1.2.3 From b6dd8f112cd5506923b4b3ce51a1774b0bfc037c Mon Sep 17 00:00:00 2001 From: Tomas Sedovic Date: Mon, 11 Sep 2017 14:57:09 +0200 Subject: Pre-create a Cinder registry volume --- playbooks/provisioning/openstack/README.md | 117 +++++++++++++++++------------ 1 file changed, 70 insertions(+), 47 deletions(-) (limited to 'playbooks/provisioning/openstack/README.md') diff --git a/playbooks/provisioning/openstack/README.md b/playbooks/provisioning/openstack/README.md index 267176eec..ab1513a73 100644 --- a/playbooks/provisioning/openstack/README.md +++ b/playbooks/provisioning/openstack/README.md @@ -305,82 +305,105 @@ In order to set a custom entrypoint, update `openshift_master_cluster_public_hos Note than an empty hostname does not work, so if your domain is `openshift.example.com`, you cannot set this value to simply `openshift.example.com`. -### Use an existing Cinder volume for the OpenShift registry +### Creating and using a Cinder volume for the OpenShift registry -You can optionally use an existing Cinder volume for the storage of -your OpenShift registry. +You can optionally have the playbooks create a Cinder volume and set +it up as the OpenShift hosted registry. -To do that, you need to have a Cinder volume (you can create one by -running: +To do that you need specify the desired Cinder volume name and size in +Gigabytes in `inventory/group_vars/all.yml`: - openstack volume create --size + cinder_hosted_registry_name: cinder-registry + cinder_hosted_registry_size_gb: 10 -The volume needs to have a file system created before you put it to -use. We can do prepare it for you if you put this in inventory/group_vars/all.yml: +With this, the playbooks will create the volume and set up its +filesystem. If there is an existing volume of the same name, we will +use it but keep the existing data on it. - prepare_and_format_registry_volume: true - -**NOTE:** doing so **will destroy any data that's currently on the volume**! - -You can also run the registry setup playbook directly: - - ansible-playbook -i inventory playbooks/provisioning/openstack/prepare-and-format-cinder-volume.yaml - -(the provisioning phase must be completed, first) +To use the volume for the registry, you must first configure it with +the OpenStack credentials by putting the following to `OSEv3.yml`: + openshift_cloudprovider_openstack_username: "{{ lookup('env','OS_USERNAME') }}" + openshift_cloudprovider_openstack_password: "{{ lookup('env','OS_PASSWORD') }}" + openshift_cloudprovider_openstack_auth_url: "{{ lookup('env','OS_AUTH_URL') }}" + openshift_cloudprovider_openstack_tenant_name: "{{ lookup('env','OS_TENANT_NAME') }}" -To instruct OpenShift to actually use the volume, you must first configure it -with the OpenStack credentials by putting the following to `OSEv3.yml`: - - ## Openstack credentials - #openshift_cloudprovider_kind=openstack - #openshift_cloudprovider_openstack_auth_url=http://openstack.example.com:35357/v2.0/ - #openshift_cloudprovider_openstack_username=username - #openshift_cloudprovider_openstack_password=password - #openshift_cloudprovider_openstack_domain_id=domain_id - #openshift_cloudprovider_openstack_domain_name=domain_name - #openshift_cloudprovider_openstack_tenant_id=tenant_id - #openshift_cloudprovider_openstack_tenant_name=tenant_name - #openshift_cloudprovider_openstack_region=region - -Note that these credentials may be different from the ones you used for -provisioning (say for quota or access control reasons). To use the same -OpenStack credentials for both, take a look at the `sample-inventory`. It shows -how to read the values from your shell environment. - -Make sure to only set the values you need from (e.g. your keystonerc or -clouds.yaml). Some of the options ar keystone V2 or V3 specific. +This will use the credentials from your shell environment. If you want +to enter them explicitly, you can. You can also use credentials +different from the provisioning ones (say for quota or access control +reasons). **NOTE**: If you're testing this on (DevStack)[devstack], you must explicitly set your Keystone API version to v2 (e.g. -`OS_AUTH_URL=http://10.20.30.40/identity/v2.0`) instead of the default +`OS_AUTH_URL=http://10.34.37.47/identity/v2.0`) instead of the default value provided by `openrc`. You may also encounter the following issue with Cinder: https://github.com/kubernetes/kubernetes/issues/50461 +You can read the (OpenShift documentation on configuring +OpenStack)[openstack] for more information. [devstack]: https://docs.openstack.org/devstack/latest/ +[openstack]: https://docs.openshift.org/latest/install_config/configuring_openstack.html -You can read the (OpenShift documentation on configuring -OpenStack)[openstack] for more information. +Next, we need to instruct OpenShift to use the Cinder volume for it's +registry. Again in `OSEv3.yml`: -[openstack]: https://docs.openshift.org/latest/install_config/configuring_openstack.html + #openshift_hosted_registry_storage_kind: openstack + #openshift_hosted_registry_storage_access_modes: ['ReadWriteOnce'] + #openshift_hosted_registry_storage_openstack_filesystem: xfs +The filesystem value here will be used in the initial formatting of +the volume. -Next we need to instruct openshift-ansible to use the Cinder volume -for it's registry. Again in `OSEv3.yml`: - ## Use Cinder volume for Openshift registry: +### Use an existing Cinder volume for the OpenShift registry + +You can also use a pre-existing Cinder volume for the storage of your +OpenShift registry. + +To do that, you need to have a Cinder volume. You can create one by +running: + + openstack volume create --size + +The volume needs to have a file system created before you put it to +use. + +As with the automatically-created volume, you have to set up the +OpenStack credentials in `inventory/group_vars/OSEv3.yml` as well as +registry values: + #openshift_hosted_registry_storage_kind: openstack #openshift_hosted_registry_storage_access_modes: ['ReadWriteOnce'] #openshift_hosted_registry_storage_openstack_filesystem: xfs #openshift_hosted_registry_storage_openstack_volumeID: e0ba2d73-d2f9-4514-a3b2-a0ced507fa05 #openshift_hosted_registry_storage_volume_size: 10Gi -The **Cinder volume ID**, **filesystem** and **volume size** variables must -correspond to the values in your volume. +Note the `openshift_hosted_registry_storage_openstack_volumeID` and +`openshift_hosted_registry_storage_volume_size` values: these need to +be added in addition to the previous variables. + +The **Cinder volume ID**, **filesystem** and **volume size** variables +must correspond to the values in your volume. The volume ID must be +the **UUID** of the Cinder volume, *not its name*. + +We can do formate the volume for you if you ask for it in +`inventory/group_vars/all.yml`: + + prepare_and_format_registry_volume: true + +**NOTE:** doing so **will destroy any data that's currently on the volume**! + +You can also run the registry setup playbook directly: + + ansible-playbook -i inventory playbooks/provisioning/openstack/prepare-and-format-cinder-volume.yaml + +(the provisioning phase must be completed, first) + + ### Configure static inventory and access via a bastion node -- cgit v1.2.3 From 957a3130d586f7da8cd2643dce3de059649bcdbf Mon Sep 17 00:00:00 2001 From: Tomas Sedovic Date: Tue, 19 Sep 2017 17:35:45 +0200 Subject: Docker ansible host (#742) * Document using a Docker image for Ansible host * Fix the markdown url syntax * Mention keystonerc as well --- playbooks/provisioning/openstack/README.md | 32 ++++++++++++++++++++++++++++++ 1 file changed, 32 insertions(+) (limited to 'playbooks/provisioning/openstack/README.md') diff --git a/playbooks/provisioning/openstack/README.md b/playbooks/provisioning/openstack/README.md index ab1513a73..c6633df06 100644 --- a/playbooks/provisioning/openstack/README.md +++ b/playbooks/provisioning/openstack/README.md @@ -14,6 +14,9 @@ etc.). The result is an environment ready for openshift-ansible. * python-dns / [dnspython](https://pypi.python.org/pypi/dnspython) * Become (sudo) is not required. +**NOTE**: You can use a Docker image with all dependencies set up. +Find more in the [Deployment section](#deployment). + ### Optional Dependencies for localhost **Note**: When using rhel images, `rhel-7-server-openstack-10-rpms` repository is required in order to install these packages. @@ -444,6 +447,35 @@ the dynamic inventory file in your ansible commands , like `-i openstack.py`. ## Deployment +### Using Docker on the Ansible host + +If you don't want to worry about the dependencies, you can use the +[OpenStack Control Host image][control-host-image]. + +[control-host-image]: https://hub.docker.com/r/redhatcop/control-host-openstack/ + +It has all the dependencies installed, but you'll need to map your +code and credentials to it. Assuming your SSH keys live in `~/.ssh` +and everything else is in your current directory (i.e. `ansible.cfg`, +`keystonerc`, `inventory`, `openshift-ansible`, +`openshift-ansible-contrib`), this is how you run the deployment: + + sudo docker run -it -v ~/.ssh:/mnt/.ssh:Z \ + -v $PWD:/root/openshift:Z \ + -v $PWD/keystonerc:/root/.config/openstack/keystonerc.sh:Z \ + redhatcop/control-host-openstack bash + +(feel free to replace `$PWD` with an actual path to your inventory and +checkouts, but note that relative paths don't work) + +The first run may take a few minutes while the image is being +downloaded. After that, you'll be inside the container and you can run +the playbooks: + + cd openshift + ansible-playbook openshift-ansible-contrib/playbooks/provisioning/openstack/provision.yaml + + ### Run the playbook Assuming your OpenStack (Keystone) credentials are in the `keystonerc` -- cgit v1.2.3 From d361dc4b307781ec2bb5978f30516f266a34188c Mon Sep 17 00:00:00 2001 From: Tlacenka Date: Tue, 26 Sep 2017 13:39:55 +0200 Subject: Upscaling OpenShift application nodes (#571) * scale-up: playbook for upscaling app nodes * scale-up: removed debug * scale-up: made suggested changes * scale-up: indentation fix * upscaling: process split into two playbooks that are executed by a bash script - upscaling_run.sh: bash script, usage displayed using -h parameter - upscaling_pre-tasks: check that new value is higher, change inventory variable - upscaling_scale-up: rerun provisioning and installation, verify change * upscaling_run: fixed openshift-ansible-contrib directory name * upscaling_run: inventory can be entered as relative path * upscaling_scale-up: fixed formatting * upscaling: minor changes * upscaling: moved to .../provisioning/openstack directory, README updated, minor changes made * README: minor changes * README: formatting * uspcaling: minor fix * upscaling: fix * upscaling: added customisations, fixes - openshift-ansible-contrib and openshift-ansible paths are customisable - fixed implicit incrementation by 1 * upscaling: fixes * upscaling: fixes * upscaling: another fix * upscaling: another fix * upscaling: fix * upscaling: back to a single playbook, README updated * minor fix * pre_tasks: added labels for autoscaling * scale-up: fixes * scale-up: fixed host variables, post-verification is only based on labels * scale-up: added openshift-ansible path customisation - path has to be absolute, cannot contain '/' at the end * scale-up: fix * scale-up: debug removed * README: added docs on openshift_ansible_dir, note about bastion * static_inventory: newly added nodes are added to new_nodes group - note: re-running provisioning fails when trying to install docker * removing new line * scale-up: running byo/config.yml or scaleup.yml based on the situation - (whether there is an existing deployment or not) * openstack.yml: indentation fix * added refresh inventory * upscaling: new_nodes only contains new does, it is not used during the first deployment * static_inventory: make sure that new nodes end up only in their new_nodes group * bug fixes * another fix * fixed condition * scale-up, static_inventory role: all app node data gathered before provisioning * upscaling: bug fixes * upscaling: another fixes * fixes * upscaling: fix * upscaling: fix * upscaling: another logic fix * bug fix for non-scaling deployments --- playbooks/provisioning/openstack/README.md | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+) (limited to 'playbooks/provisioning/openstack/README.md') diff --git a/playbooks/provisioning/openstack/README.md b/playbooks/provisioning/openstack/README.md index c6633df06..5e45add51 100644 --- a/playbooks/provisioning/openstack/README.md +++ b/playbooks/provisioning/openstack/README.md @@ -568,6 +568,27 @@ In order to access UI, the ssh-tunnel service will be created and started on the control node. Make sure to remove these changes and the service manually, when not needed anymore. +## Scale Deployment up/down + +### Scaling up + +One can scale up the number of application nodes by executing the ansible playbook +`openshift-ansible-contrib/playbooks/provisioning/openstack/scale-up.yaml`. +This process can be done even if there is currently no deployment available. +The `increment_by` variable is used to specify by how much the deployment should +be scaled up (if none exists, it serves as a target number of application nodes). +The path to `openshift-ansible` directory can be customised by the `openshift_ansible_dir` +variable. Its value must be an absolute path to `openshift-ansible` and it cannot +contain the '/' symbol at the end. + +Usage: + +``` +ansible-playbook -i openshift-ansible-contrib/playbooks/provisioning/openstack/scale-up.yaml` [-e increment_by=] [-e openshift_ansible_dir=] +``` + +Note: This playbook works only without a bastion node (`openstack_use_bastion: False`). + ## License As the rest of the openshift-ansible-contrib repository, the code here is -- cgit v1.2.3 From 51e017647815e10f61afcb0ac60985b4eeff24ca Mon Sep 17 00:00:00 2001 From: Tomas Sedovic Date: Mon, 2 Oct 2017 09:49:32 +0200 Subject: Add dynamic inventory This adds an `inventory.py` script to the `sample-inventory` that lists all the necessary servers and groups dynamically, skipping the `static_inventory` role as well as the `hosts` creation. It also adds an `os_cinder` lookup function which is necessary for a seamless Cinder OpenShift registry integration without a static inventory. --- playbooks/provisioning/openstack/README.md | 13 +++++++++++++ 1 file changed, 13 insertions(+) (limited to 'playbooks/provisioning/openstack/README.md') diff --git a/playbooks/provisioning/openstack/README.md b/playbooks/provisioning/openstack/README.md index 5e45add51..b96c9c9db 100644 --- a/playbooks/provisioning/openstack/README.md +++ b/playbooks/provisioning/openstack/README.md @@ -361,6 +361,19 @@ registry. Again in `OSEv3.yml`: The filesystem value here will be used in the initial formatting of the volume. +If you're using the dynamic inventory, you must uncomment these two values as +well: + + #openshift_hosted_registry_storage_openstack_volumeID: "{{ lookup('os_cinder', cinder_hosted_registry_name).id }}" + #openshift_hosted_registry_storage_volume_size: "{{ cinder_hosted_registry_size_gb }}Gi" + +But note that they use the `os_cinder` lookup plugin we provide, so you must +tell Ansible where to find it either in `ansible.cfg` (the one we provide is +configured properly) or by exporting the +`ANSIBLE_LOOKUP_PLUGINS=openshift-ansible-contrib/lookup_plugins` environment +variable. + + ### Use an existing Cinder volume for the OpenShift registry -- cgit v1.2.3 From 4fff75f713f963e8ab1ec9b2302c3395d9c53ba2 Mon Sep 17 00:00:00 2001 From: Tomas Sedovic Date: Thu, 12 Oct 2017 12:32:22 +0200 Subject: Streamline the OpenStack provider README This moves all the extra configuration options and deployment notes to a new `advanced-configuration.md` file and keeps the README much shorter. The README now presents the simplest workflow with minimal configuration and manual steps on part of the deployer. The advanced configuration is in need of a little more cleanup, but we can do that in another pull request. --- playbooks/provisioning/openstack/README.md | 712 ++++++++--------------------- 1 file changed, 182 insertions(+), 530 deletions(-) (limited to 'playbooks/provisioning/openstack/README.md') diff --git a/playbooks/provisioning/openstack/README.md b/playbooks/provisioning/openstack/README.md index b96c9c9db..a2f3d4d5d 100644 --- a/playbooks/provisioning/openstack/README.md +++ b/playbooks/provisioning/openstack/README.md @@ -1,608 +1,260 @@ # OpenStack Provisioning -This repository contains playbooks and Heat templates to provision +This directory contains [Ansible][ansible] playbooks and roles to create OpenStack resources (servers, networking, volumes, security groups, -etc.). The result is an environment ready for openshift-ansible. +etc.). The result is an environment ready for OpenShift installation +via [openshift-ansible]. -## Dependencies for localhost (ansible control/admin node) +We provide everything necessary to be able to install OpenShift on +OpenStack (including the DNS and load balancer servers when +necessary). In addition, we work on providing integration with the +OpenStack-native services (storage, lbaas, baremetal as a service, +dns, etc.). -* [Ansible 2.3](https://pypi.python.org/pypi/ansible) -* [Ansible-galaxy](https://pypi.python.org/pypi/ansible-galaxy-local-deps) -* [jinja2](http://jinja.pocoo.org/docs/2.9/) -* [shade](https://pypi.python.org/pypi/shade) -* python-jmespath / [jmespath](https://pypi.python.org/pypi/jmespath) -* python-dns / [dnspython](https://pypi.python.org/pypi/dnspython) -* Become (sudo) is not required. -**NOTE**: You can use a Docker image with all dependencies set up. -Find more in the [Deployment section](#deployment). +## OpenStack Requirements -### Optional Dependencies for localhost -**Note**: When using rhel images, `rhel-7-server-openstack-10-rpms` repository is required in order to install these packages. +Before you start the installation, you need to have an OpenStack +environment to connect to. You can use a public cloud or an OpenStack +within your organisation. It is also possible to +use [Devstack][devstack] or [TripleO][tripleo]. In the case of +TripleO, we will be running on top of the **overcloud**. -* `python-openstackclient` -* `python-heatclient` +The OpenStack release must be Newton (for Red Hat OpenStack this is +version 10) or newer. It must also satisfy these requirements: -## Dependencies for OpenStack hosted cluster nodes (servers) +* Heat (Orchestration) must be available +* The deployment image (CentOS 7 or RHEL 7) must be loaded +* The deployment flavor must be available to your user + - `m1.medium` / 4GB RAM + 40GB disk should be enough for testing + - look at + the [Minimum Hardware Requirements page][hardware-requirements] + for production +* The keypair for SSH must be available in openstack +* `keystonerc` file that lets you talk to the openstack services + * NOTE: only Keystone V2 is currently supported -There are no additional dependencies for the cluster nodes. Required -configuration steps are done by Heat given a specific user data config -that normally should not be changed. +Optional: +* External Neutron network with a floating IP address pool -## Required galaxy modules -In order to pull in external dependencies for DNS configuration steps, -the following commads need to be executed: +## Installation - ansible-galaxy install \ - -r openshift-ansible-contrib/playbooks/provisioning/openstack/galaxy-requirements.yaml \ - -p openshift-ansible-contrib/roles +There are four main parts to the installation: -Alternatively you can install directly from github: +1. [Preparing Ansible and dependencies](#1-preparing-ansible-and-dependencies) +2. [Configuring the desired OpenStack environment and OpenShift cluster](#2-configuring-the-openstack-environment-and-openshift-cluster) +3. [Creating the OpenStack resources (VMs, networking, etc.)](#3-creating-the-openstack-resources-vms-networking-etc) +4. [Installing OpenShift](#4-installing-openshift) - ansible-galaxy install git+https://github.com/redhat-cop/infra-ansible,master \ - -p openshift-ansible-contrib/roles +This guide is going to install [OpenShift Origin][origin] +with [CentOS 7][centos7] images with minimal customisation. -Notes: -* This assumes we're in the directory that contains the clonned -openshift-ansible-contrib repo in its root path. -* When trying to install a different version, the previous one must be removed first -(`infra-ansible` directory from [roles](https://github.com/openshift/openshift-ansible-contrib/tree/master/roles)). -Otherwise, even if there are differences between the two versions, installation of the newer version is skipped. +We will create the VMs for running OpenShift, in a new Neutron +network, assign Floating IP addresses and configure DNS. -## What does it do +The OpenShift cluster will have a single Master node that will run +`etcd`, a single Infra node and two App nodes. -* Create Nova servers with floating IP addresses attached -* Assigns Cinder volumes to the servers -* Set up an `openshift` user with sudo privileges -* Optionally attach Red Hat subscriptions -* Sets up a bind-based DNS server or configures the cluster servers to use an external DNS server. -* Supports mixed in-stack/external DNS servers for dynamic updates. -* When deploying more than one master, sets up a HAproxy server +You can look at +the [Advanced Configuration page][advanced-configuration] for +additional options. -## Set up -### Copy the sample inventory +### 1. Preparing Ansible and dependencies - cp -r openshift-ansible-contrib/playbooks/provisioning/openstack/sample-inventory inventory +First, you need to select where to run [Ansible][ansible] from (the +*Ansible host*). This can be the computer you read this guide on or an +OpenStack VM you'll create specifically for this purpose. -### Copy ansible config +We will use +a +[Docker image that has all the dependencies installed][control-host-image] to +make things easier. If you don't want to use Docker, take a look at +the [Ansible host dependencies][ansible-dependencies] and make sure +they're installed. - cp openshift-ansible-contrib/playbooks/provisioning/openstack/sample-inventory/ansible.cfg ansible.cfg +Your *Ansible host* needs to have the following: -### Update `inventory/group_vars/all.yml` +1. Docker +2. `keystonerc` file with your OpenStack credentials +3. SSH private key for logging in to your OpenShift nodes -#### DNS configuration variables +Assuming your private key is `~/.ssh/id_rsa` and `keystonerc` in your +current directory: -Pay special attention to the values in the first paragraph -- these -will depend on your OpenStack environment. - -Note that the provsisioning playbooks update the original Neutron subnet -created with the Heat stack to point to the configured DNS servers. -So the provisioned cluster nodes will start using those natively as -default nameservers. Technically, this allows to deploy OpenShift clusters -without dnsmasq proxies. - -The `env_id` and `public_dns_domain` will form the cluster's DNS domain all -your servers will be under. With the default values, this will be -`openshift.example.com`. For workloads, the default subdomain is 'apps'. -That sudomain can be set as well by the `openshift_app_domain` variable in -the inventory. - -The `openstack__hostname` is a set of variables used for customising -hostnames of servers with a given role. When such a variable stays commented, -default hostname (usually the role name) is used. - -The `public_dns_nameservers` is a list of DNS servers accessible from all -the created Nova servers. These will be serving as your DNS forwarders for -external FQDNs that do not belong to the cluster's DNS domain and its subdomains. -If you're unsure what to put in here, you can try the google or opendns servers, -but note that some organizations may be blocking them. - -The `openshift_use_dnsmasq` controls either dnsmasq is deployed or not. -By default, dnsmasq is deployed and comes as the hosts' /etc/resolv.conf file -first nameserver entry that points to the local host instance of the dnsmasq -daemon that in turn proxies DNS requests to the authoritative DNS server. -When Network Manager is enabled for provisioned cluster nodes, which is -normally the case, you should not change the defaults and always deploy dnsmasq. - -`external_nsupdate_keys` describes an external authoritative DNS server(s) -processing dynamic records updates in the public and private cluster views: - - external_nsupdate_keys: - public: - key_secret: - key_algorithm: 'hmac-md5' - key_name: 'update-key' - server: - private: - key_secret: - key_algorithm: 'hmac-sha256' - server: - -Here, for the public view section, we specified another key algorithm and -optional `key_name`, which normally defaults to the cluster's DNS domain. -This just illustrates a compatibility mode with a DNS service deployed -by OpenShift on OSP10 reference architecture, and used in a mixed mode with -another external DNS server. - -Another example defines an external DNS server for the public view -additionally to the in-stack DNS server used for the private view only: - - external_nsupdate_keys: - public: - key_secret: - key_algorithm: 'hmac-sha256' - server: - -Here, updates matching the public view will be hitting the given public -server IP. While updates matching the private view will be sent to the -auto evaluated in-stack DNS server's **public** IP. - -Note, for the in-stack DNS server, private view updates may be sent only -via the public IP of the server. You can not send updates via the private -IP yet. This forces the in-stack private server to have a floating IP. -See also the [security notes](#security-notes) - -#### Other configuration variables - -`openstack_ssh_key` is a Nova keypair - you can see your keypairs with -`openstack keypair list`. This guide assumes that its corresponding private -key is `~/.ssh/openshift`, stored on the ansible admin (control) node. - -`openstack_default_image_name` is the default name of the Glance image the -servers will use. You can see your images with `openstack image list`. -In order to set a different image for a role, uncomment the line with the -corresponding variable (e.g. `openstack_lb_image_name` for load balancer) and -set its value to another available image name. `openstack_default_image_name` -must stay defined as it is used as a default value for the rest of the roles. - -`openstack_default_flavor` is the default Nova flavor the servers will use. -You can see your flavors with `openstack flavor list`. -In order to set a different flavor for a role, uncomment the line with the -corresponding variable (e.g. `openstack_lb_flavor` for load balancer) and -set its value to another available flavor. `openstack_default_flavor` must -stay defined as it is used as a default value for the rest of the roles. - -`openstack_external_network_name` is the name of the Neutron network -providing external connectivity. It is often called `public`, -`external` or `ext-net`. You can see your networks with `openstack -network list`. - -`openstack_private_network_name` is the name of the private Neutron network -providing admin/control access for ansible. It can be merged with other -cluster networks, there are no special requirements for networking. - -The `openstack_num_masters`, `openstack_num_infra` and -`openstack_num_nodes` values specify the number of Master, Infra and -App nodes to create. - -The `openshift_cluster_node_labels` defines custom labels for your openshift -cluster node groups. It currently supports app and infra node groups. -The default value of this variable sets `region: primary` to app nodes and -`region: infra` to infra nodes. -An example of setting a customised label: -``` -openshift_cluster_node_labels: - app: - mylabel: myvalue +```bash +$ sudo docker run -it -v ~/.ssh:/mnt/.ssh:Z \ + -v $PWD/keystonerc:/root/.config/openstack/keystonerc.sh:Z \ + redhatcop/control-host-openstack bash ``` -The `openstack_nodes_to_remove` allows you to specify the numerical indexes -of App nodes that should be removed; for example, ['0', '2'], - -The `docker_volume_size` is the default Docker volume size the servers will use. -In order to set a different volume size for a role, -uncomment the line with the corresponding variable (e. g. `docker_master_volume_size` -for master) and change its value. `docker_volume_size` must stay defined as it is -used as a default value for some of the servers (master, infra, app node). -The rest of the roles (etcd, load balancer, dns) have their defaults hard-coded. - -**Note**: If the `ephemeral_volumes` is set to `true`, the `*_volume_size` variables -will be ignored and the deployment will not create any cinder volumes. - -The `openstack_flat_secgrp`, controls Neutron security groups creation for Heat -stacks. Set it to true, if you experience issues with sec group rules -quotas. It trades security for number of rules, by sharing the same set -of firewall rules for master, node, etcd and infra nodes. - -The `required_packages` variable also provides a list of the additional -prerequisite packages to be installed before to deploy an OpenShift cluster. -Those are ignored though, if the `manage_packages: False`. - -The `openstack_inventory` controls either a static inventory will be created after the -cluster nodes provisioned on OpenStack cloud. Note, the fully dynamic inventory -is yet to be supported, so the static inventory will be created anyway. - -The `openstack_inventory_path` points the directory to host the generated static inventory. -It should point to the copied example inventory directory, otherwise ti creates -a new one for you. - -#### Multi-master configuration - -Please refer to the official documentation for the -[multi-master setup](https://docs.openshift.com/container-platform/3.6/install_config/install/advanced_install.html#multiple-masters) -and define the corresponding [inventory -variables](https://docs.openshift.com/container-platform/3.6/install_config/install/advanced_install.html#configuring-cluster-variables) -in `inventory/group_vars/OSEv3.yml`. For example, given a load balancer node -under the ansible group named `ext_lb`: - - openshift_master_cluster_method: native - openshift_master_cluster_hostname: "{{ groups.ext_lb.0 }}" - openshift_master_cluster_public_hostname: "{{ groups.ext_lb.0 }}" - -#### Provider Network - -Normally, the playbooks create a new Neutron network and subnet and attach -floating IP addresses to each node. If you have a provider network set up, this -is all unnecessary as you can just access servers that are placed in the -provider network directly. - -To use a provider network, set its name in `openstack_provider_network_name` in -`inventory/group_vars/all.yml`. - -If you set the provider network name, the `openstack_external_network_name` and -`openstack_private_network_name` fields will be ignored. - -**NOTE**: this will not update the nodes' DNS, so running openshift-ansible -right after provisioning will fail (unless you're using an external DNS server -your provider network knows about). You must make sure your nodes are able to -resolve each other by name. - -#### Security notes - -Configure required `*_ingress_cidr` variables to restrict public access -to provisioned servers from your laptop (a /32 notation should be used) -or your trusted network. The most important is the `node_ingress_cidr` -that restricts public access to the deployed DNS server and cluster -nodes' ephemeral ports range. - -Note, the command ``curl https://api.ipify.org`` helps fiding an external -IP address of your box (the ansible admin node). - -There is also the `manage_packages` variable (defaults to True) you -may want to turn off in order to speed up the provisioning tasks. This may -be the case for development environments. When turned off, the servers will -be provisioned omitting the ``yum update`` command. This brings security -implications though, and is not recommended for production deployments. - -##### DNS servers security options - -Aside from `node_ingress_cidr` restricting public access to in-stack DNS -servers, there are following (bind/named specific) DNS security -options available: - - named_public_recursion: 'no' - named_private_recursion: 'yes' - -External DNS servers, which is not included in the 'dns' hosts group, -are not managed. It is up to you to configure such ones. - -### Configure the OpenShift parameters - -Finally, you need to update the DNS entry in -`inventory/group_vars/OSEv3.yml` (look at -`openshift_master_default_subdomain`). - -In addition, this is the place where you can customise your OpenShift -installation for example by specifying the authentication. - -The full list of options is available in this sample inventory: - -https://github.com/openshift/openshift-ansible/blob/master/inventory/byo/hosts.ose.example - -Note, that in order to deploy OpenShift origin, you should update the following -variables for the `inventory/group_vars/OSEv3.yml`, `all.yml`: - - deployment_type: origin - openshift_deployment_type: "{{ deployment_type }}" - - -#### Setting a custom entrypoint - -In order to set a custom entrypoint, update `openshift_master_cluster_public_hostname` - - openshift_master_cluster_public_hostname: api.openshift.example.com - -Note than an empty hostname does not work, so if your domain is `openshift.example.com`, -you cannot set this value to simply `openshift.example.com`. - -### Creating and using a Cinder volume for the OpenShift registry - -You can optionally have the playbooks create a Cinder volume and set -it up as the OpenShift hosted registry. - -To do that you need specify the desired Cinder volume name and size in -Gigabytes in `inventory/group_vars/all.yml`: - - cinder_hosted_registry_name: cinder-registry - cinder_hosted_registry_size_gb: 10 - -With this, the playbooks will create the volume and set up its -filesystem. If there is an existing volume of the same name, we will -use it but keep the existing data on it. - -To use the volume for the registry, you must first configure it with -the OpenStack credentials by putting the following to `OSEv3.yml`: - - openshift_cloudprovider_openstack_username: "{{ lookup('env','OS_USERNAME') }}" - openshift_cloudprovider_openstack_password: "{{ lookup('env','OS_PASSWORD') }}" - openshift_cloudprovider_openstack_auth_url: "{{ lookup('env','OS_AUTH_URL') }}" - openshift_cloudprovider_openstack_tenant_name: "{{ lookup('env','OS_TENANT_NAME') }}" - -This will use the credentials from your shell environment. If you want -to enter them explicitly, you can. You can also use credentials -different from the provisioning ones (say for quota or access control -reasons). - -**NOTE**: If you're testing this on (DevStack)[devstack], you must -explicitly set your Keystone API version to v2 (e.g. -`OS_AUTH_URL=http://10.34.37.47/identity/v2.0`) instead of the default -value provided by `openrc`. You may also encounter the following issue -with Cinder: - -https://github.com/kubernetes/kubernetes/issues/50461 - -You can read the (OpenShift documentation on configuring -OpenStack)[openstack] for more information. - -[devstack]: https://docs.openstack.org/devstack/latest/ -[openstack]: https://docs.openshift.org/latest/install_config/configuring_openstack.html - - -Next, we need to instruct OpenShift to use the Cinder volume for it's -registry. Again in `OSEv3.yml`: - - #openshift_hosted_registry_storage_kind: openstack - #openshift_hosted_registry_storage_access_modes: ['ReadWriteOnce'] - #openshift_hosted_registry_storage_openstack_filesystem: xfs -The filesystem value here will be used in the initial formatting of -the volume. +This will create the container, add your SSH key and source your +`keystonerc`. It should be set up for the installation. -If you're using the dynamic inventory, you must uncomment these two values as -well: +You can verify that everything is in order: - #openshift_hosted_registry_storage_openstack_volumeID: "{{ lookup('os_cinder', cinder_hosted_registry_name).id }}" - #openshift_hosted_registry_storage_volume_size: "{{ cinder_hosted_registry_size_gb }}Gi" -But note that they use the `os_cinder` lookup plugin we provide, so you must -tell Ansible where to find it either in `ansible.cfg` (the one we provide is -configured properly) or by exporting the -`ANSIBLE_LOOKUP_PLUGINS=openshift-ansible-contrib/lookup_plugins` environment -variable. - - - -### Use an existing Cinder volume for the OpenShift registry - -You can also use a pre-existing Cinder volume for the storage of your -OpenShift registry. - -To do that, you need to have a Cinder volume. You can create one by -running: - - openstack volume create --size - -The volume needs to have a file system created before you put it to -use. - -As with the automatically-created volume, you have to set up the -OpenStack credentials in `inventory/group_vars/OSEv3.yml` as well as -registry values: - - #openshift_hosted_registry_storage_kind: openstack - #openshift_hosted_registry_storage_access_modes: ['ReadWriteOnce'] - #openshift_hosted_registry_storage_openstack_filesystem: xfs - #openshift_hosted_registry_storage_openstack_volumeID: e0ba2d73-d2f9-4514-a3b2-a0ced507fa05 - #openshift_hosted_registry_storage_volume_size: 10Gi - -Note the `openshift_hosted_registry_storage_openstack_volumeID` and -`openshift_hosted_registry_storage_volume_size` values: these need to -be added in addition to the previous variables. - -The **Cinder volume ID**, **filesystem** and **volume size** variables -must correspond to the values in your volume. The volume ID must be -the **UUID** of the Cinder volume, *not its name*. - -We can do formate the volume for you if you ask for it in -`inventory/group_vars/all.yml`: - - prepare_and_format_registry_volume: true - -**NOTE:** doing so **will destroy any data that's currently on the volume**! - -You can also run the registry setup playbook directly: - - ansible-playbook -i inventory playbooks/provisioning/openstack/prepare-and-format-cinder-volume.yaml - -(the provisioning phase must be completed, first) - - - -### Configure static inventory and access via a bastion node - -Example inventory variables: - - openstack_use_bastion: true - bastion_ingress_cidr: "{{openstack_subnet_prefix}}.0/24" - openstack_private_ssh_key: ~/.ssh/openshift - openstack_inventory: static - openstack_inventory_path: ../../../../inventory - openstack_ssh_config_path: /tmp/ssh.config.openshift.ansible.openshift.example.com - -The `openstack_subnet_prefix` is the openstack private network for your cluster. -And the `bastion_ingress_cidr` defines accepted range for SSH connections to nodes -additionally to the `ssh_ingress_cidr`` (see the security notes above). - -The SSH config will be stored on the ansible control node by the -gitven path. Ansible uses it automatically. To access the cluster nodes with -that ssh config, use the `-F` prefix, f.e.: - - ssh -F /tmp/ssh.config.openshift.ansible.openshift.example.com master-0.openshift.example.com echo OK - -Note, relative paths will not work for the `openstack_ssh_config_path`, but it -works for the `openstack_private_ssh_key` and `openstack_inventory_path`. In this -guide, the latter points to the current directory, where you run ansible commands -from. +```bash +$ less .ssh/id_rsa +$ ansible --version +$ openstack image list +``` -To verify nodes connectivity, use the command: - ansible -v -i inventory/hosts -m ping all +### 2. Configuring the OpenStack Environment and OpenShift Cluster -If something is broken, double-check the inventory variables, paths and the -generated `/hosts` and `openstack_ssh_config_path` files. +The configuration is all done in an Ansible inventory directory. We +will clone the [openshift-ansible-contrib][contrib] repository and set +things up for a minimal installation. -The `inventory: dynamic` can be used instead to access cluster nodes directly via -floating IPs. In this mode you can not use a bastion node and should specify -the dynamic inventory file in your ansible commands , like `-i openstack.py`. -## Deployment +``` +$ git clone https://github.com/openshift/openshift-ansible-contrib +$ cp -r openshift-ansible-contrib/playbooks/provisioning/openstack/sample-inventory/ inventory +``` -### Using Docker on the Ansible host +If you're testing multiple configurations, you can have multiple +inventories and switch between them. -If you don't want to worry about the dependencies, you can use the -[OpenStack Control Host image][control-host-image]. +#### OpenStack Configuration -[control-host-image]: https://hub.docker.com/r/redhatcop/control-host-openstack/ +The OpenStack configuration is in `inventory/group_vars/all.yml`. -It has all the dependencies installed, but you'll need to map your -code and credentials to it. Assuming your SSH keys live in `~/.ssh` -and everything else is in your current directory (i.e. `ansible.cfg`, -`keystonerc`, `inventory`, `openshift-ansible`, -`openshift-ansible-contrib`), this is how you run the deployment: +Open the file and plug in the image, flavor and network configuration +corresponding to your OpenStack installation. - sudo docker run -it -v ~/.ssh:/mnt/.ssh:Z \ - -v $PWD:/root/openshift:Z \ - -v $PWD/keystonerc:/root/.config/openstack/keystonerc.sh:Z \ - redhatcop/control-host-openstack bash - -(feel free to replace `$PWD` with an actual path to your inventory and -checkouts, but note that relative paths don't work) +```bash +$ vi inventory/group_vars/all.yml +``` -The first run may take a few minutes while the image is being -downloaded. After that, you'll be inside the container and you can run -the playbooks: +1. Set the `openstack_ssh_public_key` to your OpenStack keypair name. + - See `openstack keypair list` to find the keypairs registered with + OpenShift. + - This must correspond to your private SSH key in `~/.ssh/id_rsa` +2. Set the `openstack_external_network_name` to the floating IP + network of your openstack. + - See `openstack network list` for the list of networks. + - It's often called `public`, `external` or `ext-net`. +3. Set the `openstack_default_image_name` to the image you want your + OpenShift VMs to run. + - See `openstack image list` for the list of available images. +4. Set the `openstack_default_flavor` to the flavor you want your + OpenShift VMs to use. + - See `openstack flavor list` for the list of available flavors. + +**NOTE**: In most OpenStack environments, you will also need to +configure the forwarders for the DNS server we create. This depends on +your environment. + +Launch a VM in your OpenStack and look at its `/etc/resolv.conf` and +put the IP addresses into `public_dns_nameservers` in +`inventory/group_vars/all.yml`. - cd openshift - ansible-playbook openshift-ansible-contrib/playbooks/provisioning/openstack/provision.yaml +#### OpenShift configuration -### Run the playbook +The OpenShift configuration is in `inventory/group_vars/OSEv3.yml`. -Assuming your OpenStack (Keystone) credentials are in the `keystonerc` -this is how you stat the provisioning process from your ansible control node: +The default options will mostly work, but unless you used the large +flavors for a production-ready environment, openshift-ansible's +hardware check will fail. - . keystonerc - ansible-playbook openshift-ansible-contrib/playbooks/provisioning/openstack/provision.yaml +Let's disable those checks by putting this in +`inventory/group_vars/OSEv3.yml`: -Note, here you start with an empty inventory. The static inventory will be populated -with data so you can omit providing additional arguments for future ansible commands. +```yaml +openshift_disable_check: disk_availability,memory_availability +``` -If bastion enabled, the generates SSH config must be applied for ansible. -Otherwise, it is auto included by the previous step. In order to execute it -as a separate playbook, use the following command: +**NOTE**: The default authentication method will allow **any username +and password** in! If you're running this in a public place, you need +to set up access control. - ansible-playbook openshift-ansible-contrib/playbooks/provisioning/openstack/post-provision-openstack.yml +Feel free to look at +the [Sample OpenShift Inventory][sample-openshift-inventory] and +the [advanced configuration][advanced-configuration]. -The first infra node then becomes a bastion node as well and proxies access -for future ansible commands. The post-provision step also configures Satellite, -if requested, and DNS server, and ensures other OpenShift requirements to be met. -### Running Custom Post-Provision Actions +### 3. Creating the OpenStack resources (VMs, networking, etc.) -A custom playbook can be run like this: +We will install the DNS server roles using ansible galaxy and then run +the openstack provisioning playbook. The `ansible.cfg` file we provide +has useful defaults -- copy it to the directory you're going to run +Ansible from. +```bash +$ ansible-galaxy install -r openshift-ansible-contrib/playbooks/provisioning/openstack/galaxy-requirements.yaml -p openshift-ansible-contrib/roles +$ cp openshift-ansible-contrib/playbooks/provisioning/openstack/ansible.cfg ansible.cfg ``` -ansible-playbook --private-key ~/.ssh/openshift -i inventory/ openshift-ansible-contrib/playbooks/provisioning/openstack/custom-actions/custom-playbook.yml -``` +(you will only need to do this once) -If you'd like to limit the run to one particular host, you can do so as follows: +Then run the provisioning playbook -- this will create the OpenStack +resources: -``` -ansible-playbook --private-key ~/.ssh/openshift -i inventory/ openshift-ansible-contrib/playbooks/provisioning/openstack/custom-actions/custom-playbook.yml -l app-node-0.openshift.example.com +```bash +$ ansible-playbook -i inventory openshift-ansible-contrib/playbooks/provisioning/openstack/provision.yaml ``` -You can also create your own custom playbook. Here's one example that adds additional YUM repositories: - -``` ---- -- hosts: app - tasks: - - # enable EPL - - name: Add repository - yum_repository: - name: epel - description: EPEL YUM repo - baseurl: https://download.fedoraproject.org/pub/epel/$releasever/$basearch/ -``` +If you're using multiple inventories, make sure you pass the path to +the right one to `-i`. -This example runs against app nodes. The list of options include: - - cluster_hosts (all hosts: app, infra, masters, dns, lb) - - OSEv3 (app, infra, masters) - - app - - dns - - masters - - infra_hosts -Please consider contributing your custom playbook back to openshift-ansible-contrib! +### 4. Installing OpenShift -A library of custom post-provision actions exists in `openshift-ansible-contrib/playbooks/provisioning/openstack/custom-actions`. Playbooks include: +We will use the `openshift-ansible` project to install openshift on +top of the OpenStack nodes we have prepared: -##### add-yum-repos.yml - -[add-yum-repos.yml](https://github.com/openshift/openshift-ansible-contrib/blob/master/playbooks/provisioning/openstack/custom-actions/add-yum-repos.yml) adds a list of custom yum repositories to every node in the cluster. - -### Install OpenShift - -Once it succeeds, you can install openshift by running: - - ansible-playbook openshift-ansible/playbooks/byo/config.yml - -### Access UI - -OpenShift UI may be accessed via the 1st master node FQDN, port 8443. - -When using a bastion, you may want to make an SSH tunnel from your control node -to access UI on the `https://localhost:8443`, with this inventory variable: - - openshift_ui_ssh_tunnel: True +```bash +$ git clone https://github.com/openshift/openshift-ansible +$ ansible-playbook -i inventory openshift-ansible/playbooks/byo/config.yml +``` -Note, this requires sudo rights on the ansible control node and an absolute path -for the `openstack_private_ssh_key`. You should also update the control node's -`/etc/hosts`: - 127.0.0.1 master-0.openshift.example.com +### Next Steps -In order to access UI, the ssh-tunnel service will be created and started on the -control node. Make sure to remove these changes and the service manually, when not -needed anymore. +And that's it! You should have a small but functional OpenShift +cluster now. -## Scale Deployment up/down +Take a look at [how to access the cluster][accessing-openshift] +and [how to remove it][uninstall-openshift] as well as the more +advanced configuration: -### Scaling up +* [Accessing the OpenShift cluster][accessing-openshift] +* [Removing the OpenShift cluster][uninstall-openshift] +* Set Up Authentication (TODO) +* [Multiple Masters with a load balancer][loadbalancer] +* [External Dns][external-dns] +* Multiple Clusters (TODO) +* [Cinder Registry][cinder-registry] +* [Bastion Node][bastion] -One can scale up the number of application nodes by executing the ansible playbook -`openshift-ansible-contrib/playbooks/provisioning/openstack/scale-up.yaml`. -This process can be done even if there is currently no deployment available. -The `increment_by` variable is used to specify by how much the deployment should -be scaled up (if none exists, it serves as a target number of application nodes). -The path to `openshift-ansible` directory can be customised by the `openshift_ansible_dir` -variable. Its value must be an absolute path to `openshift-ansible` and it cannot -contain the '/' symbol at the end. -Usage: +[ansible]: https://www.ansible.com/ +[openshift-ansible]: https://github.com/openshift/openshift-ansible +[devstack]: https://docs.openstack.org/devstack/ +[tripleo]: http://tripleo.org/ +[ansible-dependencies]: ./advanced-configuration.md#dependencies-for-localhost-ansible-controladmin-node +[contrib]: https://github.com/openshift/openshift-ansible-contrib +[control-host-image]: https://hub.docker.com/r/redhatcop/control-host-openstack/ +[hardware-requirements]: https://docs.openshift.org/latest/install_config/install/prerequisites.html#hardware +[origin]: https://www.openshift.org/ +[centos7]: https://www.centos.org/ +[sample-openshift-inventory]: https://github.com/openshift/openshift-ansible/blob/master/inventory/byo/hosts.example +[advanced-configuration]: ./advanced-configuration.md +[accessing-openshift]: ./advanced-configuration.md#accessing-the-openshift-cluster +[uninstall-openshift]: ./advanced-configuration.md#removing-the-openshift-cluster +[loadbalancer]: ./advanced-configuration.md#multi-master-configuration +[external-dns]: ./advanced-configuration.md#dns-configuration-variables +[cinder-registry]: ./advanced-configuration.md#creating-and-using-a-cinder-volume-for-the-openshift-registry +[bastion]: ./advanced-configuration.md#configure-static-inventory-and-access-via-a-bastion-node -``` -ansible-playbook -i openshift-ansible-contrib/playbooks/provisioning/openstack/scale-up.yaml` [-e increment_by=] [-e openshift_ansible_dir=] -``` -Note: This playbook works only without a bastion node (`openstack_use_bastion: False`). ## License -As the rest of the openshift-ansible-contrib repository, the code here is -licensed under Apache 2. +Like the rest of the openshift-ansible-contrib repository, the code +here is licensed under Apache 2. -- cgit v1.2.3 From 79b5ef66d15b19a232dbf92e246713cf18f3cc8c Mon Sep 17 00:00:00 2001 From: Tlacenka Date: Thu, 12 Oct 2017 18:09:39 +0200 Subject: Attach additional RHN Pools (post-provision custom action) (#753) * README, add-rhn-pools.yml: Add new custom post-provision playbook that attaches additional RHN pools - also mention this example in the contrib README * added become true * README update --- playbooks/provisioning/openstack/README.md | 28 ++++++++++++++++++++++++---- 1 file changed, 24 insertions(+), 4 deletions(-) (limited to 'playbooks/provisioning/openstack/README.md') diff --git a/playbooks/provisioning/openstack/README.md b/playbooks/provisioning/openstack/README.md index b96c9c9db..fe87f68f4 100644 --- a/playbooks/provisioning/openstack/README.md +++ b/playbooks/provisioning/openstack/README.md @@ -524,7 +524,9 @@ If you'd like to limit the run to one particular host, you can do so as follows: ansible-playbook --private-key ~/.ssh/openshift -i inventory/ openshift-ansible-contrib/playbooks/provisioning/openstack/custom-actions/custom-playbook.yml -l app-node-0.openshift.example.com ``` -You can also create your own custom playbook. Here's one example that adds additional YUM repositories: +You can also create your own custom playbook. Here are a few examples: + +#### Adding additional YUM repositories ``` --- @@ -548,13 +550,31 @@ This example runs against app nodes. The list of options include: - masters - infra_hosts +#### Attaching additional RHN pools + +``` +--- +- hosts: cluster_hosts + tasks: + - name: Attach additional RHN pool + become: true + command: "/usr/bin/subscription-manager attach --pool=" + register: attach_rhn_pool_result + until: attach_rhn_pool_result.rc == 0 + retries: 10 + delay: 1 +``` + +This playbook runs against all cluster nodes. In order to help prevent slow connectivity +problems, the task is retried 10 times in case of initial failure. +Note that in order for this example to work in your deployment, your servers must use the RHEL image. + Please consider contributing your custom playbook back to openshift-ansible-contrib! A library of custom post-provision actions exists in `openshift-ansible-contrib/playbooks/provisioning/openstack/custom-actions`. Playbooks include: -##### add-yum-repos.yml - -[add-yum-repos.yml](https://github.com/openshift/openshift-ansible-contrib/blob/master/playbooks/provisioning/openstack/custom-actions/add-yum-repos.yml) adds a list of custom yum repositories to every node in the cluster. +* [add-yum-repos.yml](https://github.com/openshift/openshift-ansible-contrib/blob/master/playbooks/provisioning/openstack/custom-actions/add-yum-repos.yml): adds a list of custom yum repositories to every node in the cluster +* [add-rhn-pools.yml](https://github.com/openshift/openshift-ansible-contrib/blob/master/playbooks/provisioning/openstack/custom-actions/add-rhn-pools.yml): attaches a list of additional RHN pools to every node in the cluster ### Install OpenShift -- cgit v1.2.3 From b450ff75888f7801094ca88957a237f33f5e85f1 Mon Sep 17 00:00:00 2001 From: tzumainn Date: Fri, 13 Oct 2017 05:21:26 -0400 Subject: Allow the specification of server group policies when provisioning openstack (#747) * Allow for the specifying of server policies during OpenStack provisioning * documentation for openstack server group policies * add doc link detailing allowed policies * changed default to anti-affinity --- playbooks/provisioning/openstack/README.md | 15 +++++++++++++++ 1 file changed, 15 insertions(+) (limited to 'playbooks/provisioning/openstack/README.md') diff --git a/playbooks/provisioning/openstack/README.md b/playbooks/provisioning/openstack/README.md index fe87f68f4..370f582b2 100644 --- a/playbooks/provisioning/openstack/README.md +++ b/playbooks/provisioning/openstack/README.md @@ -308,6 +308,21 @@ In order to set a custom entrypoint, update `openshift_master_cluster_public_hos Note than an empty hostname does not work, so if your domain is `openshift.example.com`, you cannot set this value to simply `openshift.example.com`. + +### Specifying server group policies + +You can specify server group policies for infra and master nodes using the following +parameters in `inventory/group_vars/all.yml`: + + ## Specify server group policies for master and infra nodes. Nova must be configured to + ## enable these policies. 'anti-affinity' will ensure that each VM is launched on a + ## different physical host. + #openstack_master_server_group_policies: [anti-affinity] + #openstack_infra_server_group_policies: [anti-affinity] + +The [Heat template documentation](https://docs.openstack.org/heat/pike/template_guide/openstack.html#OS::Nova::ServerGroup) +lists allowed policy values. + ### Creating and using a Cinder volume for the OpenShift registry You can optionally have the playbooks create a Cinder volume and set -- cgit v1.2.3