Commit Graph

1102 Commits

Author SHA1 Message Date
Pete Birley
27864cec04 Security: Container user for support openstack services
This PS adds user control for the service user for support openstack
services.

Change-Id: I132511bfc09d20a2f155bb9498a7fe8eeee8b6f9
2017-08-26 22:03:15 +00:00
Pete Birley
7463058b73 Reduce load in single node gate tests
This PS seeks to reduce the load exerted on the node in the single
node gate test - as a the single node gate is currently broken
due to resource starvation on the nodes.

Change-Id: I34db5108b4abb48bb452eed73067644cc03270c0
2017-08-26 17:01:19 -05:00
Jaesang Lee
59d9c463bd Fix incorrect description
change mis-spelled description in tools/overrides/mvp/cinder.yaml

Change-Id: Ifb4ae667b40418f12ab29654c6a7ff55fad931e1
2017-08-26 17:23:02 +09:00
Pete Birley
0251c099ba Nova: Support Cinder Volume Attachement using Ceph Backend
This PS enables cinder volume attachment for nova when used with ceph.

Change-Id: I9772f38fb3a1a9af26bd92ee18a651d3372de64c
2017-08-25 14:07:34 -05:00
Jenkins
85b6716c49 Merge "Fix for appending custom volumes" 2017-08-25 15:00:10 +00:00
Jenkins
d76fe73b40 Merge "Ceph: update namespace client key script to hard fail sucessfully" 2017-08-25 13:26:47 +00:00
Jenkins
420e37cb7e Merge "Ingress: fix ingress error page backend service" 2017-08-25 13:21:29 +00:00
Jenkins
d04e69c438 Merge "Enable keystonemiddleware cache encryption" 2017-08-25 01:56:10 +00:00
Pete Birley
8b58159e2d Ingress: fix ingress error page backend service
This Ps fixes the ingress error page service, which was not
attaching to the error page pod.

Change-Id: Ia4ce523d0e17a80a0860cf7bdbdc46875b344617
2017-08-25 01:47:22 +00:00
Mateusz Blaszkowski
fc9677f718 Fix for appending custom volumes
Before this change, there was no ability to append custom volume for
any of the services. The reason was a missing new line character, so
the templates were formatted like this:
- name: pod-shared
  mountPath: /tmp/pod-shared - mountPath: /tmp/test2
  name: test2

Apart from that, for some of the services (mostly job-bootstrap) invalid
indentation for custom volumes (and their mounts) was set.

Closes-Bug: 1712745
Change-Id: Ib57c76a34c0e28ad9e67ea47d1fc250b17711a42
Signed-off-by: Mateusz Blaszkowski <mateusz.blaszkowski@intel.com>
2017-08-24 06:24:47 -04:00
Pete Birley
4740486f63 Security: Container user and rootwrap for neutron
This PS adds user control for the service user and rootwrap for
the Neutron chart.

Change-Id: Ibefa3e76c9e64427e97cdcbb93a11d2b2125e171
2017-08-24 05:26:30 +00:00
Jenkins
87723a700c Merge "Helm-Toolkit: Configmap templater" 2017-08-23 15:14:59 +00:00
Jenkins
98dd7fe1f5 Merge "Neutron: move OvS interaction to native interface" 2017-08-23 14:09:53 +00:00
Pete Birley
1fd7f66783 Helm-Toolkit: Configmap templater
This PS adds a configmap teplater helper to helm-toolkit. It makes it
simpler to write consistent charts that supports over-riding of all
values.

Change-Id: I9a587999859ea02802485eb25a3f0ebec8c712a8
2017-08-23 08:06:38 -05:00
Jenkins
ddc3ca4b23 Merge "Nova: Fix libvirtd PID check and error reporting" 2017-08-23 01:44:31 +00:00
Pete Birley
25683d8cf4 Neutron: move OvS interaction to native interface
This PS changes the MVP deployment of Neutron to use the native
interface rather than shelling uout to the clients. The values
were inserted during the original development of the MVP deployment
and subsequently left.

Change-Id: Ie098dc71a0fc82f000b7c40048e9f35913f05a79
2017-08-22 20:08:01 -05:00
Jenkins
89a0c1f8f7 Merge "Nova: Break out NoVNC assets from the proxy process" 2017-08-22 22:38:42 +00:00
Craig Anderson
1080c9e5be Nova: Fix libvirtd PID check and error reporting
Prevent false positive container exit from recycled libvirtd PID.

Clarify error log message and fix exit code typo.

Closes-Bug: #1711480
Change-Id: I47a7fdcb40b5c8153cf428e6863b618301abfd7c
2017-08-22 20:12:58 +00:00
Pete Birley
39509c1eb5 Ceph: update namespace client key script to hard fail sucessfully
This PS updates the ceph namespace client key script to hard fail
if it cannot get the admin storage key from the namespace ceph is
deployed into.

Change-Id: Ieefe6d800a678d721294561b25bbebc874cfa74d
2017-08-22 11:12:04 -05:00
Jenkins
6c90f49858 Merge "Fix issues with [trustee] section of heat.conf" 2017-08-22 15:55:47 +00:00
Jenkins
dd132eaf9d Merge "Add Tempest script in helm test framework" 2017-08-22 14:59:38 +00:00
Jaesang Lee
a0cfd9a14c Support Nginx custom configuration in Ingress
This PS support to render nginx configuration to be controlled. It
enables to config nginx paramter in values.yaml

Change-Id: Ie36efddceeb2feb1aedb88f5852fb706c161aa05
Closes-Bug: 1712263
2017-08-22 06:46:55 +00:00
Jenkins
a09cebd2a5 Merge "Gate: Heat functional test" 2017-08-21 21:46:40 +00:00
Michał Dulko
da137ac70d Fix issues with [trustee] section of heat.conf
There are serveral issues with default settings of [trustee] section in
heat.conf:

1. Keystone trust isn't added for admin user (heat-trust should be
   admin's user trustee to make it possible for admin to create stacks).
2. Keystone is adding role "admin" in domain "heat". This blocks
   creation of correct trust in Keystone as role names are duplicated.
   Please note that adding this role is not necessary for Heat to work
   correctly.

This commit solves the issues by:

1. Creating a job that will add a Keystone trust between admin and
   heat-trust users. This allows admin to create Heat stacks.
2. Removes adding a new role in a domain in _ks-domain-user.sh.tpl
   script.

Additionally, as _ks-domain-user.sh.tpl is only really used by Heat
chart, this commit also removes it from configmap-bin in Barbican,
Magnum, Mistral and Senlin charts. Those charts must have been
copy-pasted from Heat chart and don't need to include this file.

Also I fix a bug introduced by I86a21e625afd822379ac11351603b2c606a3769f
that renamded heat-domain user to heat-trust and created two users with
the same name.

Change-Id: I303d9bc2aa1796f21bedc6ecdc85a4b3f6c68504
Closes-Bug: 1696462
2017-08-21 20:10:11 +00:00
Pete Birley
ff6e6d19f9 Gate: Heat functional test
This PS adds a functional test of heat in the OSH gates, it also moves
most params to a seperate file - making config of the gate in non-zuul
environments simpler.

Change-Id: I37a1bc0dcc8000c5da8067a8d376c78f7cd6f7ab
2017-08-21 13:55:53 -05:00
Jawon Choo
9f7e6eda90 pod resources mismatched in ingress chart
in ingress chart,
ingress/error resource configuration is mismatched.

Change-Id: Idd9ea2692981b2ba971a259844f703ec9e7307b1
Closes-Bug: #1711980
2017-08-21 11:41:31 +09:00
Pete Birley
2114e907bf Nova: Break out NoVNC assets from the proxy process
This PS seperates the NoVNC assets from the container serving the
NoVNC Proxy process - meaning images other than kolla or those
built from disto packages can be used without modification.

Change-Id: I8b363db9d4166ae2d5e85d135e488402ffb14f41
2017-08-21 00:13:44 +00:00
Pete Birley
0c715b8b3c Gate: Add heat to single node checks and to Armada checks
This PS adds heat to the single node and Armada based deployment
checks in the gate scripts. Additionally it moves the client calls
in the check scripts to use the heat engine pod.

Change-Id: Iccc996fb2b2140ed19c6708d6033b4a9dd1bfc46
2017-08-20 13:20:48 -05:00
Jenkins
d5436cc978 Merge "Add management port to RabbitMQ service" 2017-08-18 05:23:46 +00:00
Dae Seong Kim
aacd11e361 Add Tempest script in helm test framework
Now, openstack-helm support "helm test" function, and It execute rally
container.
Rally also can test Tempest itself, so this fix will be add tempest
test in rally container.

Change-Id: I2c2f684f6583f2a3d9c7279a3d85cb242934e90e
Implements: blueprint add-tempest-in-helm-test
2017-08-16 16:56:10 +09:00
Tin Lam
c35f08c4fa Enable keystonemiddleware cache encryption
This patch set enables keystonemiddleware memcache encryption by providing a
random string key into the service configuration file, and setting the
memcache_security_strategy as ENCRYPT.

Change-Id: Ia030f5414308a29096c644bae70047a323eaffde
2017-08-15 22:47:55 -05:00
Jenkins
b06fab9c07 Merge "KubeADM-AIO: allow customisation of CNI" 2017-08-15 17:49:28 +00:00
Jenkins
b0f53eec2c Merge "Nova: remove hardcoded debug for API service" 2017-08-15 15:56:21 +00:00
Jenkins
658269f888 Merge "Add barbican helm test" 2017-08-15 15:02:19 +00:00
Pete Birley
52c549a2d3 KubeADM-AIO: allow customisation of CNI
This PS adds the ability to customise the CNI used by
the AIO KubeADM container.

Change-Id: If531a896e38baeda32c008d9645c34174603c690
2017-08-15 08:12:21 -05:00
Tin Lam
8e76f32407 Add barbican helm test
This patch set adds basic barbican test using the OpenStack Client.  This
patch set also addressed an issue where the href contains a duplicate
version in the path, e.g. http://URL:xxxx/v1/v1/secrets in secret path.

Change-Id: Ie66d00d5a0b02721ba41e6bf4b5e784fb49adce8
2017-08-15 05:08:20 -05:00
lukepatrick
2b683908c2 Bug: Fixes in nodeport indentation and missing brackets
This PS fixes indentation and some missing {{ }} brackets in barbican, glance, and nova

Change-Id: I3f0c9afed8693662a7bc9e8df3b8f384b76243bb
2017-08-14 10:22:48 -06:00
Pete Birley
794d11ce69 Nova: remove hardcoded debug for API service
This PS removes the hardcoded debug flag on the api service.

Change-Id: I8413cb832be57e32af29d02b2aae322a250ecb34
2017-08-14 08:30:56 -05:00
Jenkins
a95845062f Merge "Add a default mode to all charts missing it" 2017-08-11 20:05:52 +00:00
Darla Ahlert
afeb03879b Add a default mode to all charts missing it
This ps adds missing defaultMode to any chart missing it
on the configmap for volumes

Change-Id: If996d137fe1f4f5547dcbf43d9883924f192db57
2017-08-11 13:18:55 -05:00
Jenkins
8a8c813727 Merge "Update DNS policy for pods in host network namespace" 2017-08-11 15:16:17 +00:00
Pete Birley
53966ecbe1 Bug: Fixs nodeport indentation in keystone and barbican
This PS fixes the nodeport indentation in keystone and barbican.

Change-Id: I3903fcf3b1a3309b6b5e6324053682e7418cb0bc
2017-08-11 09:19:49 -05:00
Pete Birley
0c75f1ab9c Update DNS policy for pods in host network namespace
This PS updates the DNS policy for pods that run in the hosts network
namespace.

Change-Id: I5ff11985459c967e5248d1ce9f62ebfc578e3afb
2017-08-10 16:43:20 -05:00
Pete Birley
920cb9aae5 Gate: Set tests to run only if a deployment of OSH is performed
This PS updates the gate script to only run tests of OSH if it is
actually deployed.

Change-Id: Iaf89bbfffb01ca3c7ba7bfc5b5867794c6bfd5e8
2017-08-10 09:47:49 -05:00
Jenkins
c4050ba375 Merge "Armada OpenStack deployment yaml" 2017-08-09 20:29:16 +00:00
Huamin Chen
da9539bb87 Use RBD external provisioner
Currently RBD storageclass uses in-tree provisioner
kubernetes.io/rbd. Since containerized kubernetes controller image
doesn't include rbd binary, in-tree provisioner errors out.

This fix uses external provisioner ceph.com/rbd.

Closes-Bug: #1707937

Change-Id: Iad443a54c0229c0356beb6d872365298248c40c9
2017-08-09 11:24:59 -05:00
Tim Heyer
47bb6d2a85 Armada OpenStack deployment yaml
Armada is a tool for managing multiple helm charts with dependencies by
centralizing all configurations in a single Armada yaml. This yaml is
used for a full OpenStack deployment.

Co-Authored-By: Alexis Rivera <gardlt@tetrasol.org>
Co-Authored-By: Pete Birley <pete@port.direct>

Change-Id: I70b41f038c2819aeaa4b2c7bb617b7b2c38441d1
2017-08-09 09:40:46 -05:00
Huamin Chen
e30c1cf414 set DNS policy for osd daemonset
Use ClusterFirstWithHostNet DNS policy so osd pods can resolve mon address
through host network

Change-Id: I7aaeee1fc26cc1812c210bfe2c0f5b131c4cbd81
Closes-Bug: #1709439
2017-08-08 15:25:28 -04:00
Jenkins
9b58bee639 Merge "Licence: Remove licence header from rendered files" 2017-08-08 14:25:59 +00:00
Grzegorz Grasza
a3dcbe91b5 Add management port to RabbitMQ service
Management port exposes a HTTP REST API which can be used to
add virtual hosts and users, gather statistics and other data
about the running cluster. This also turns on the web interface
available on the management port.

Change-Id: I5e4c902d780d99e96fdd160c58227676d4676e87
Partial-Implements: blueprint service-rabbitmq-registration
2017-08-08 12:52:35 +00:00