19 Commits

Author SHA1 Message Date
Pete Birley
7cfd182929 Security: Make policy fully configurable via helm values
This PS moves the policy.json to be fully driven by gotpl,
allowing full configuration without editing the template.

Nova and Cinder are addressed in the seperate patchsets:
 * https://review.openstack.org/#/c/498215/
 * https://review.openstack.org/#/c/498216/

Change-Id: Ia2be5fb4e460d41034fdadbbefc1e48d0869e023
2017-08-26 17:50:22 -05:00
Pete Birley
27864cec04 Security: Container user for support openstack services
This PS adds user control for the service user for support openstack
services.

Change-Id: I132511bfc09d20a2f155bb9498a7fe8eeee8b6f9
2017-08-26 22:03:15 +00:00
Tin Lam
c35f08c4fa Enable keystonemiddleware cache encryption
This patch set enables keystonemiddleware memcache encryption by providing a
random string key into the service configuration file, and setting the
memcache_security_strategy as ENCRYPT.

Change-Id: Ia030f5414308a29096c644bae70047a323eaffde
2017-08-15 22:47:55 -05:00
Pete Birley
35601e2bd3 Charts: make manifests optional for all OpenStack elements
This PS allows the rendering of manifests to be controlled. It enables
both increased control over deployment when required but also makes
development of a feature easier to target.

Change-Id: I1716e8ee23fe5c53f935bd739ea283bc4a2a9963
2017-08-07 14:59:48 -05:00
Pete Birley
f30cbcf108 Update pod affinity to allow customisation
This PS updates the pod affinity function to allow customisation by
operators at the point of deployment.

Change-Id: I8b7b2f584e990e068051d9a6d5cc7b1e1adb5aa5
2017-07-28 15:02:47 +00:00
Pete Birley
cbae720d1d Values: Move mounts to pod key
This PS moves the mounts key to be under the pod key in the values.
It brings further consolation of related configuration params to be
nested under common keys across all charts.

Change-Id: If9963e4f8b438847e2fcad3bdd8c0d71ca9ecdd8
2017-07-14 10:44:35 -05:00
Pete Birley
4d066332a7 Values: Move replicas to pod key
This PS move s the replicas key to be under the pod key in the values.
It brings further consolation of related configuration params to be
nested under common keys across all charts.

Change-Id: I420b06debd0a62ba5d83497be43ff6c49c49d339
2017-07-13 23:08:08 -05:00
Pete Birley
3fe1fc3354 Apply bootstrap framework to all remaining services
This PS applies the bootstrap framework to all remaining services.

Change-Id: Ib77778d69e743b1594fbadaf9842e95541703bd1
External-Tracking-ID: OSH-36
2017-07-12 08:09:11 -05:00
Pete Birley
20527cb57c Move k8s pod params under common key
This PS moves K8s pod params under a common key.

Change-Id: Ib4e72e82a4f1540fa800c39d0dcc91b286d96c93
2017-07-11 23:28:47 +00:00
Pete Birley
f1512ba7af Mistral: remove unused keystone_authtoken config
The keystone_authtoken values were previously left in the mistral
oslo_config section by mistake - this PS rectifies that.

Change-Id: I5c3f64f15321b0f62bc444bcb68d79f4f037e034
2017-07-09 21:33:31 -05:00
Pete Birley
ac06f49849 Unify and normalise K8s Resources and Upgrade Strategy
This PS unifies and normalises Kubernetes resource allocation and
update strategy across all OpenStack-Helm elements.

Change-Id: Ia41fc453cb5191fa447ca6e1aa0f5b431c939dc8
2017-07-06 17:48:16 +00:00
Pete Birley
c221fa5248 Secret and endpoint standardisation.
This PS moves keystone credentials to the endpoints section within
the values.yaml, and also adds a 'secrets' key, allowing standardiation
of secrets and credential management across OpenStack-Helm.

Change-Id: I86a21e625afd822379ac11351603b2c606a3769f
2017-07-05 12:22:04 -05:00
Pete Birley
c0cf2337a2 Ingress controller for public endpoints
This PS provides the framework for Ingress controller based access to
public APIs.

Services covered:
 * Barbican
 * Cinder
 * Glance
 * Heat
 * Horizon
 * Keystone
 * Magnum
 * Mistral
 * Neutron
 * Nova
 * Senlin

Change-Id: I82d55f6ca41859ebed3312ec7d95b353df09e772
Implements: blueprint api-ingress
External-Tracking-Id: OSH-58, OSH-62
2017-06-28 17:37:10 -05:00
Pete Birley
a7503a7d3f Kubernetes Entrypoint: Lookup service names for dependency checks
The existing entrypoint logic used static names to reolve dependencies.
This prevented the service names, and thus the hostnames of services
being altered. This PS resolves that issue by looking up the service name
from the endpoints specified in the values for a chart.

Partial-Implements: blueprint enhance-entrypoint-dependency-checking
External-Tracking-Id: OSH-21
Change-Id: Ib49490f332f8cd88e98c50d9335dfd314a170936
2017-06-20 08:51:36 -05:00
Darla Ahlert
c394d22112 Add Graceful Termination to all existing charts
This commit adds graceful termination to all existing charts.
It also adds a setting in the values.yaml file for clarity and
the ability to override if wished.

Change-Id: I42025e4be86d248be467c1d2f0980f864c4d440e
2017-06-05 12:38:26 -05:00
Pete Birley
5e193580ed Pod Disruption Budget: Set default to 0
With pod disruption budget set it is not possible to drain nodes
and perform other expected operations. This PS changes the default
value to 0, restoring the typically expected operation of pods.

Change-Id: I43ef35638c98caee2cf567487173399157000ada
2017-05-31 06:11:58 -05:00
Mark Burnett
de20cbb15d Use the standard Dockerhub MariaDB image
Addresses consistency issues that appear with autoincrement fields in
the existing chart, as demonstrated in [1].  It should allow automatic
recovery of 2 out of the 3 (default) cluster members.

It does not address automatic recovery of a complete shutdown of all
cluster nodes.

[1] https://review.openstack.org/#/c/465977/

Change-Id: I84c86e1862f03a6d381bf219b821ea3636049f0b
2017-05-25 08:56:35 -05:00
Larry Rensing
01a015832d Adding pod disruption budget for mistral
This PS adds a default pod disruption budget for mistral-api
to ensure at least one replica is running.

Change-Id: I45d89cacc15a41f9eb3663dfd1f250be1567c3c0
2017-05-18 17:18:37 +00:00
Steve Wilkerson
eb70b1d9c2 Add Mistral Chart
This adds Mistral to the list of services included in OpenStack
Helm.

Change-Id: Ib94c600a170b21f32af0284fbbef96618021ad7f
2017-04-25 15:31:39 -05:00