d8fe3ea780
Certain services such as Murano and trove require access to a rabbitmq instance from tenant networks. [0] Exposing the internal rabbitmq to end users is a security hole, hence there are two options, 1) use vhosts in the existing rabbitmq, or two a separate rabbitmq instances. Given the importance of rabbitmq to the OpenStack deployment, we have decided to go with a separate instance. Refer to [1] for more detail on the various options. This change makes the rabbitmq role generic so that it can be reused, in this case to start 'outward_rabbitmq'. It needs to be exposed via haproxy both for network isolation and also because this is what Murano configuration requires. Follow on patches will be added to add a vhost in this outward instance for Murano and other services which require access. Based on the original work by bdaca[2] [0] http://murano.readthedocs.io/en/stable-liberty/intro/architecture.html [1] http://lists.openstack.org/pipermail/openstack-dev/2016-December/109091.html [2] https://review.openstack.org/#/c/374525 Change-Id: Ib2bcc7ed4bf4f883a7cd1dfad3db89201e3cfd8d Partial-Bug: #1620374 Depends-On: I020eb6219f89a310451becde41f6f1c7f54baadd Co-Authored-By: Bartłomiej Daca <bartek.daca@gmail.com>
58 lines
1.7 KiB
YAML
58 lines
1.7 KiB
YAML
---
|
|
- name: Ensuring config directories exist
|
|
file:
|
|
path: "{{ node_config_directory }}/{{ project_name }}"
|
|
state: "directory"
|
|
recurse: yes
|
|
when:
|
|
- inventory_hostname in groups[item.value.group]
|
|
- item.value.enabled | bool
|
|
with_dict: "{{ rabbitmq_services }}"
|
|
|
|
- name: Copying over config.json files for services
|
|
template:
|
|
src: "{{ item.key }}.json.j2"
|
|
dest: "{{ node_config_directory }}/{{ project_name }}/config.json"
|
|
register: rabbitmq_config_jsons
|
|
when:
|
|
- inventory_hostname in groups[item.value.group]
|
|
- item.value.enabled | bool
|
|
with_dict: "{{ rabbitmq_services }}"
|
|
notify:
|
|
- Restart rabbitmq container
|
|
|
|
- name: Copying over rabbitmq configs
|
|
vars:
|
|
service: "{{ rabbitmq_services['rabbitmq'] }}"
|
|
template:
|
|
src: "{{ item }}.j2"
|
|
dest: "{{ node_config_directory }}/{{ project_name }}/{{ item }}"
|
|
register: rabbitmq_confs
|
|
when:
|
|
- inventory_hostname in groups[service.group]
|
|
- service.enabled | bool
|
|
with_items:
|
|
- "rabbitmq-env.conf"
|
|
- "rabbitmq.config"
|
|
- "rabbitmq-clusterer.config"
|
|
- "definitions.json"
|
|
notify:
|
|
- Restart rabbitmq container
|
|
|
|
- name: Check rabbitmq containers
|
|
kolla_docker:
|
|
action: "compare_container"
|
|
common_options: "{{ docker_common_options }}"
|
|
name: "{{ item.value.container_name }}"
|
|
image: "{{ item.value.image }}"
|
|
volumes: "{{ item.value.volumes }}"
|
|
environment: "{{ item.value.environment }}"
|
|
register: check_rabbitmq_containers
|
|
when:
|
|
- action != "config"
|
|
- inventory_hostname in groups[item.value.group]
|
|
- item.value.enabled | bool
|
|
with_dict: "{{ rabbitmq_services }}"
|
|
notify:
|
|
- Restart rabbitmq container
|