Vadim Kuznetsov 833b58da2c Octavia certificate distribution
Current copy certificates task works only if octavia_cert_setup_host is
localhost, because it copies from local path. See bug 1842117

To fix this issue certs are slurped and registered after they are
created.
If octavia_cert_setup_host is 'localhost' cert variables are
registered to task_vars scope.
If octavia_cert_setup_host is one of the octavia containers or utility
containers, i.e. setup host exists in inventory cert variables are
registered to hostvars[octavia_cert_setup_host] i.e hostvars scope.
Certs facts are set according to octavia_cert_setup_host value.
Certs distribution play copies certs from certs facts to each octavia
conatainer.

Change-Id: I0906c7cf80c3345fb993a71fe190fa2f6baa55e4
Closes-Bug: 1842117
2019-09-20 16:55:48 +03:00

208 lines
6.6 KiB
YAML

---
# Copyright 2017, Rackspace US, Inc.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
- name: Fail if service was deployed using a different installation method
fail:
msg: "Switching installation methods for OpenStack services is not supported"
when:
- ansible_local is defined
- ansible_local.openstack_ansible is defined
- ansible_local.openstack_ansible.octavia is defined
- ansible_local.openstack_ansible.octavia.install_method is defined
- ansible_local.openstack_ansible.octavia.install_method != octavia_install_method
- name: Gather variables for each operating system
include_vars: "{{ item }}"
with_first_found:
- "{{ ansible_distribution | lower }}-{{ ansible_distribution_version | lower }}.yml"
- "{{ ansible_distribution | lower }}-{{ ansible_distribution_major_version | lower }}.yml"
- "{{ ansible_os_family | lower }}-{{ ansible_distribution_major_version | lower }}.yml"
- "{{ ansible_distribution | lower }}.yml"
- "{{ ansible_os_family | lower }}.yml"
tags:
- always
- name: Fail if our required secrets are not present
fail:
msg: "Please set the {{ item }} variable prior to applying this role."
when: (item is undefined) or (item is none)
with_items: "{{ octavia_required_secrets }}"
tags:
- always
- import_tasks: db_setup.yml
when:
- inventory_hostname == groups['octavia_all'][0]
vars:
_oslodb_setup_host: "{{ octavia_db_setup_host }}"
_oslodb_databases:
- name: "{{ octavia_galera_database }}"
users:
- username: "{{ octavia_galera_user }}"
password: "{{ octavia_container_mysql_password }}"
tags:
- common-db
- octavia-config
- import_tasks: mq_setup.yml
when:
- inventory_hostname == groups['octavia_all'][0]
vars:
_oslomsg_rpc_setup_host: "{{ octavia_oslomsg_rpc_setup_host }}"
_oslomsg_rpc_userid: "{{ octavia_oslomsg_rpc_userid }}"
_oslomsg_rpc_password: "{{ octavia_oslomsg_rpc_password }}"
_oslomsg_rpc_vhost: "{{ octavia_oslomsg_rpc_vhost }}"
_oslomsg_rpc_transport: "{{ octavia_oslomsg_rpc_transport }}"
_oslomsg_notify_setup_host: "{{ octavia_oslomsg_notify_setup_host }}"
_oslomsg_notify_userid: "{{ octavia_oslomsg_notify_userid }}"
_oslomsg_notify_password: "{{ octavia_oslomsg_notify_password }}"
_oslomsg_notify_vhost: "{{ octavia_oslomsg_notify_vhost }}"
_oslomsg_notify_transport: "{{ octavia_oslomsg_notify_transport }}"
tags:
- common-mq
- octavia-config
- import_tasks: octavia_certs.yml
run_once: true
when: octavia_generate_certs | bool
tags:
- octavia-config
- name: Gather variables for installation method
include_vars: "{{ octavia_install_method }}_install.yml"
tags:
- always
- import_tasks: octavia_pre_install.yml
tags:
- octavia-install
- import_tasks: octavia_install.yml
tags:
- octavia-install
- include_tasks: octavia_certs_distribute.yml
when: octavia_generate_certs | bool
tags:
- octavia-config
- name: Import uwsgi role
import_role:
name: uwsgi
vars:
uwsgi_services: "{{ uwsgi_octavia_services }}"
uwsgi_install_method: "{{ octavia_install_method }}"
tags:
- octavia-config
- uwsgi
- name: Run the systemd service role
import_role:
name: systemd_service
vars:
systemd_after_targets: "{{ service_var.after_targets | default(['syslog.target', 'network.target']) }}"
systemd_user_name: "{{ octavia_system_user_name }}"
systemd_group_name: "{{ octavia_system_group_name }}"
systemd_tempd_prefix: openstack
systemd_slice_name: nova
systemd_lock_path: /var/lock/octavia
systemd_CPUAccounting: true
systemd_BlockIOAccounting: true
systemd_MemoryAccounting: true
systemd_TasksAccounting: true
systemd_services: "{{ filtered_octavia_services }}"
tags:
- nova-config
- systemd-service
- import_tasks: service_setup.yml
vars:
_service_adminuri_insecure: "{{ keystone_service_adminuri_insecure }}"
_service_in_ldap: "{{ octavia_service_in_ldap }}"
_service_setup_host: "{{ octavia_service_setup_host }}"
_service_setup_host_python_interpreter: "{{ octavia_service_setup_host_python_interpreter }}"
_service_project_name: "{{ octavia_service_project_name }}"
_service_region: "{{ octavia_service_region }}"
_service_users:
- name: "{{ octavia_service_user_name }}"
password: "{{ octavia_service_password }}"
role: "{{ octavia_service_role_name }}"
- role: load-balancer_observer
- role: load-balancer_global_observer
- role: load-balancer_member
- role: load-balancer_admin
- role: load-balancer_quota_admin
_service_endpoints:
- service: "{{ octavia_service_name }}"
interface: "public"
url: "{{ octavia_service_publicuri }}"
- service: "{{ octavia_service_name }}"
interface: "internal"
url: "{{ octavia_service_internaluri }}"
- service: "{{ octavia_service_name }}"
interface: "admin"
url: "{{ octavia_service_adminuri }}"
_service_catalog:
- name: "{{ octavia_service_name }}"
type: "{{ octavia_service_type }}"
description: "{{ octavia_service_description }}"
when: inventory_hostname == groups['octavia_all'][0]
tags:
- octavia-install
- import_tasks: octavia_mgmt_network.yml
when:
- octavia_neutron_management_network_uuid is not defined
- octavia_neutron_management_network_name is defined
tags:
- octavia-install
- octavia-config
- import_tasks: octavia_security_group.yml
run_once: true
tags:
- octavia-install
- import_tasks: octavia_flavor_create.yml
when:
- octavia_nova_flavor_uuid is not defined
tags:
- octavia-install
- octavia-config
- import_tasks: octavia_post_install.yml
tags:
- octavia-install
- octavia-config
- import_tasks: octavia_db_sync.yml
when:
- inventory_hostname == groups['octavia_all'][0]
tags:
- octavia-install
- import_tasks: octavia_policy.yml
tags:
- octavia-install
- octavia-config
- import_tasks: octavia_amp_image.yml
run_once: true
tags:
- octavia-config
- name: Flush handlers
meta: flush_handlers