As the functions of overrides are upgraded,the
files that depend on the functions of overrides
need to be modified synchronously.This patch and
https://review.opendev.org/#/c/707788/ depend on
each other.
Story: 2007291
Task: 38753
Depends-on: https://review.opendev.org/#/c/707788/
Change-Id: I048c8fe73f8f85df465f2c829812b75be1e4f130
Signed-off-by: songgongjun <gongjun.song@intel.com>
Implement container security context for the following Nova resources:
- Neutron metadata_agent
- Neutron ovs_agent
Change-Id: If8246450f8ebd62a0c5999f832ec59796355ee78
This updates the values used for generating the pod and container
security contexts for the components of the neutron chart. This
moves to using a unique application key for each neutron service
instead of a single 'neutron' key that maps to every pod
This also removes the .pod.user.neutron.uid key in favor of using
the user key in the security_context values tree
Change-Id: I1c87a5b4b74e2a2d17b8913dd34f40dc1c38fbe0
Signed-off-by: Steve Wilkerson <sw5822@att.com>
This PS allows the probes in containers/pods to be tuned via values
overrides.
Depends-On: https://review.opendev.org/#/c/631597/
Change-Id: I439dce38a1b7df8c798f10f7fad406f9b0dfe3e6
Signed-off-by: Pete Birley <pete@port.direct>
This PS enables the use of simple logging options if desired.
Change-Id: If6ea420c6ed595b3b6b6eedf99a0bf26a20b6abf
Signed-off-by: Pete Birley <pete@port.direct>
This PS adds emptydirs backing the /tmp directory in pods, which
is required in most cases for full operation when using a read only
filesystem backing the container.
Additionally some yaml indent issues are resolved.
Change-Id: I9df8f70e913b911ff755600fa2f669d9c5dcb928
Signed-off-by: Pete Birley <pete@port.direct>
Health_probe for neutron pods accomplish both liveness and
readiness probe.
Neutron DHCP/L3/OVS agents:
Sends an RPC call with a non-existence method to agent’s queue.
Assumes no other agent subscribed to tunnel-update queue other
than OVS. Probe is success if agent returns with NoSuchMethod
error.
Neutron Metadata agent:
Sends a message to Unix Domain Socket opened by Metadata agent.
Probe is success if agent returns with HTTP status 404.
In both the cases, if agent is not reachable or fails to
respond in time, returns failure to probe.
Readiness probe for Neutron L3/DHCP/Metadata/SRIOV agents
Following are the operations executed on the pod as part of
readiness probe on the neutron agents:
- Check if the agent process is up and running.
- Retrieve the sockets associated with the process from the /proc fs.
- Check the status of tcp sockets related to Rabbitmq communication.
- Check the reachability of the rabbitmq message bus from the agent.
- For SRIOV Agent, check if VFs are configured properly for the
configured NICs in sriov_agent.ini conf file
Change-Id: Ib99ceaabbad1d1e0faf34cc74314da9aa688fa0a
This adds the release-uuid annotation to the pod spec for all
replication controller templates in the openstack-helm charts
Change-Id: I0159f2741c27277fd173208e7169ff657bb33e57
securityContext with non-root user is implemented
at Pod level and leveraged the helm-toolkit snippet
Fix for adding allowPrivilegeEscalation flag in container
securityContext in the neutron charts whereever needed
Depends-On: I95264c933b51e2a8e38f63faa1e239bb3c1ebfda
Change-Id: Id93b56d2e3886b9dd9115e79c28f661930146b00
This PS adds the ability to attach a release uuid to pods and rc
objects as desired. A follow up ps will add the ability to add arbitary
annotations to the same objects.
Depends-On: Iceedba457a03387f6fc44eb763a00fd57f9d84a5
Change-Id: I324680f10263c1aefca2be9056e70d0ff22fcaf0
Signed-off-by: Pete Birley <pete@port.direct>
This PS moves openstack components in OSH to use secrets to store
potentially sensitive config information.
Depends-On: https://review.openstack.org/#/c/593732
Change-Id: I9bab586c03597effea0e48a58c69efff3f980a92
Signed-off-by: Pete Birley <pete@port.direct>
This PS moves the neutron agents to run as child processes of either
the pause container or use the hosts init system (for k8s <1.10)
to prevent defunct process sprawl.
Change-Id: I3392bdc957144c1aa83314583d57183d35279336
Co-Authored-By: Hyunsun Moon <hyunsun.moon@gmail.com>
Signed-off-by: Pete Birley <pete@port.direct>
This introduces a mechanism for generating the logging.conf
file for the openstack services via the values. This allows us to
define loggers, handlers, and formatters for the services and the
modules they're composed of.
This also allows us to take advantage of the oslo fluent handler
and formatter. The fluent handler and formatter give us the
following benefits: sending logs directly to fluentd instead of
routed to stdout/stderr and then through fluentbit to fluentd,
project specific tags on the logged events (enables us to define
more robust filters in fluentd for aggregation if required),
full traceback support, and additional metadata (modules that
created logged event, etc)
Depends-On: https://review.openstack.org/577796
Change-Id: I63340ce6b03191d93a74d9ac6947f0b49b8a1a39
This PS removes an unused variable from the resolution of
dynamic pod dependencies.
Change-Id: I95728a7b91d5143c2a44566179ef8066727020af
Signed-off-by: Pete Birley <pete@port.direct>
This PS moves to use the current ga version for kubernetes daemonsets,
additionally any remaining deployments that were using the
`extensions/v1beta1` have been updated to `apps/v1`.
Story: 2002205
Task: 21735
Depends-On: If9703162dc472af1e6096bf2b9062802fd5ce8ab
Change-Id: Iba4e3d2798c54639e077b80999e669c79b616c6f
Signed-off-by: Pete Birley <pete@port.direct>
When removing helm-toolkit from OSH and swithcing to use the
toolkit from OSH-Infra, the image declaration function was missed.
Depends-On: I2f2012590d81ffcb159d49d8a76eedd4441744cd
Change-Id: I0f1118bb748f3fe1b6bb73acfc00e77c5cca9c7d
Signed-off-by: Pete Birley <pete@port.direct>
This PS adds the local registry image managment to OSH from OSH-Infra.
With this the delta between helm-toolkits in the Repo's is removed,
allowing the toolkit from OSH-Infra to be used and the one from OSH
to be depreciated.
Change-Id: If5e218cf7df17261fe5ef249d281f9d9637e2f6a
Co-Authored-By: Pete Birley <pete@port.direct>
This PS enables sharing of network namespaces with the host,
allowing for hitless upgrades of agents, and much simpler debugging.
It does however require mount propogation to be enabled in kubernetes
which is a alpha gated feature introduced in 1.8, and enabled by default
as a beta feature in 1.10.
Depends-On: I7a37f45ff6061b144c6f04233712cd84fccb3e83
Change-Id: I2a191a343fe637cbfd9e4af5277f9784af736dd1
This PS moves all the config files to be directly values driven,
both simplifying over-ride and allowing configs to be targeted
to pods in future work.
Change-Id: Ifcbc19b17aa1d145f12ed1aed8b15a69ca045bb7
This PS adds the ablity to target different configs to different
hosts for the nutron agents, in the same manner as nova-compute.
Change-Id: Iebd87e30014d6cac2127c7e1a14259b10d74fbf8
This PS allows the neutron and nova charts to dynamicly adapt to
various backends.
Depends-On: I0ec13f45fd4561fec59d08b08eb78390a3866156
Change-Id: I1891af4b0e49237e229ff5e61e907dc3e413cf87
This PS moves static dependencies under a 'static' key to allow
expansion to cover dynamic dependencies.
Change-Id: I38990b93aa79fa1f70af6f2c78e5e5c61c63f32c
- corrected the path of "socket" volume, which is used for sharing
metadata proxy unix socket among the agents
- and give neutron user permission to write to the dir
- set the default nova_metadata_ip to full hostname of metadata
so that it could be accessed properly via ingress
- removed unnecessary configurations from values
Change-Id: I4d20dc670fecebd9799851d659c5f42edb4821ac
Closes-Bug:1745370
This patch set makes the service-specific images for neutron
have explicit names, allowing simple over-riding of images
for an entire site.
Change-Id: Ica7e1f77f43936971d44ac0e6645ac656ca83b96
This PS updates the values file layout for images to allow simple
parsing of the images in use by charts, allowing them to be queried
and modified much more simply. By moving the image tags to a 'tags'
key, we can extend the options used simply to accomodate extra
options simply (eg prefixing the tag for use with an internal
registry) or pre-pulling the images to reduce chart deploy failure.
Change-Id: I9ec1dbb00d997ab6cb021bf0b698f7aae740e95d
This PS updates nova to set metadata's clusterIP dynamically and
neutron to set nova_metadata_ip from metadata hosts
If specify a clusterIP, it is hard-coded as before also.
Change-Id: Ib0d6df8272bd8494bb59ffc8e6b2cfa36a901f60
Closes-Bug: #1715553
Adding daemonset for Linux bridge. Using node selector
"linuxbridge enabled".
network.backend added in neutron/values.yaml to support scenario for
different SDNs using the same networking software, like OVS is used
for reference Neutron L2 agent, ODL, OVN and SONA. The other option for
network.backend can be linuxbridge and calico.
network.backend impacts configuration of DHCP, L3 and metadata agents.
Those agents are dependent on ovsdb_connection flag (officially it is
placed in openvswitch_agent.ini file).
Added daemonset_lb_agent flag in manifests section. Currently
OVS and LinuxBridge L2 agents can be turned on/off to be deployed.
OVS L2 agent and OVS as a network virtualization SW can be deployed
independently.
Removed conf.neutron.default.neutron.interface_driver, since it was not
used anywhere.
Marked places in neutron/values.yaml where changes are needed in order
to use linuxbridge for:
- neutron.conf interface_driver
- ML2 mechanism driver
- dhcp and l3 agents interface_driver
Added example of neutron values overrides in:
tools/overrides/mvp/neutron-linuxbridge.yaml
Change-Id: I7cdcfaa9a73af392a0d45f7df29b7b3ae3cc4c76
Implements: blueprint support-linux-bridge-on-neutron
Before this change, there was no ability to append custom volume for
any of the services. The reason was a missing new line character, so
the templates were formatted like this:
- name: pod-shared
mountPath: /tmp/pod-shared - mountPath: /tmp/test2
name: test2
Apart from that, for some of the services (mostly job-bootstrap) invalid
indentation for custom volumes (and their mounts) was set.
Closes-Bug: 1712745
Change-Id: Ib57c76a34c0e28ad9e67ea47d1fc250b17711a42
Signed-off-by: Mateusz Blaszkowski <mateusz.blaszkowski@intel.com>
This PS removes the licence header from rendered output from tiller,
significantly reducing the configmap size of charts deployed to the
cluster.
Change-Id: I5d1b246f2068f3b83bf59ba79fe8b88bbc9a6161
This PS allows the rendering of manifests to be controlled. It enables
both increased control over deployment when required but also makes
development of a feature easier to target.
Change-Id: I1716e8ee23fe5c53f935bd739ea283bc4a2a9963
This PS moves the mounts key to be under the pod key in the values.
It brings further consolation of related configuration params to be
nested under common keys across all charts.
Change-Id: If9963e4f8b438847e2fcad3bdd8c0d71ca9ecdd8
This patchset enforces stricter file permission on *-etc configmap and
sets readOnly flag to true in a number of charts.
Change-Id: I233689a5d56dd1352e0d81997a94b4cdd6bed5d2
Signed-off-by: Tin Lam <tin@irrational.io>
This PS unifies and normalises Kubernetes resource allocation and
update strategy across all OpenStack-Helm elements.
Change-Id: Ia41fc453cb5191fa447ca6e1aa0f5b431c939dc8
