openstack-ansible-os_octavia/tests/test-octavia.yml
German Eichberger fbda283da8 Adds the issuer to the CAs
Octavia is using certificate authorities to manage
the amp communication but the built-in ansible
certificate commands can't generate proper CA
certificates (they omit the necessary X509 extensions)
nor properly sign CSRs and reference the CA.

The changes here replace the parts where ansible's
certificate commands fall short with running the
openssl command directly. To do so it sets up
the necessary files, directories, and templates
an openssl config file.

Once ansible's certificate capabilities improve we
can retire those commands.

Also improve tests so we gate when this fails.

Change-Id: Iaae462844d783bd6086ce6a2816ea01cafc14e6d
2018-06-22 08:46:14 -07:00

177 lines
6.0 KiB
YAML

---
# Copyright 2016, Rackspace US, Inc.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
- name: Test Octavia
hosts: localhost
user: root
gather_facts: false
vars:
env:
OS_ENDPOINT_TYPE: internalURL
OS_INTERFACE: internalURL
OS_USERNAME: admin
OS_PASSWORD: "{{ keystone_auth_admin_password }}"
OS_PROJECT_NAME: admin
OS_TENANT_NAME: admin
OS_AUTH_URL: "http://{{ test_keystone_host }}:5000/v3"
OS_NO_CACHE: 1
OS_USER_DOMAIN_NAME: Default
OS_PROJECT_DOMAIN_NAME: Default
OS_REGION_NAME: RegionOne
OS_IDENTITY_API_VERSION: 3
OS_AUTH_VERSION: 3
tasks:
- name: Install pip requirements
pip:
name: "{{ item }}"
state: "{{ octavia_pip_package_state }}"
extra_args: >-
{{ octavia_developer_mode | ternary(pip_install_developer_constraints | default('--constraint /opt/developer-pip-constraints.txt'), '') }}
{{ (pip_install_upper_constraints is defined) | ternary('--constraint ' + pip_install_upper_constraints | default(''),'') }}
{{ pip_install_options | default('') }}
register: install_packages
until: install_packages|success
retries: 5
delay: 2
with_items:
- "python-neutronclient"
- "python-glanceclient"
- "shade"
- "python-octaviaclient"
- "python-openstackclient"
- "cmd2<0.9.0" # >=0.9.0 is python3 only
- name: Ensure public network exists
os_network:
auth:
auth_url: "{{ keystone_service_adminurl }}"
username: "{{ octavia_service_user_name }}"
password: "{{ octavia_service_password }}"
project_name: "{{ octavia_service_project_name }}"
user_domain_name: "{{ octavia_service_user_domain_id }}"
project_domain_name: "{{ octavia_service_project_domain_id }}"
endpoint_type: "{{ octavia_ansible_endpoint_type }}"
state: present
name: "public"
provider_network_type: "flat"
provider_physical_network: "flat"
external: True
- name: Ensure public subnet exists
os_subnet:
auth:
auth_url: "{{ keystone_service_adminurl }}"
username: "{{ octavia_service_user_name }}"
password: "{{ octavia_service_password }}"
project_name: "{{ octavia_service_project_name }}"
user_domain_name: "{{ octavia_service_user_domain_id }}"
project_domain_name: "{{ octavia_service_project_domain_id }}"
endpoint_type: "{{ octavia_ansible_endpoint_type }}"
state: present
network_name: "public"
name: "public-subnet"
cidr: "10.1.3.0/24"
- name: Create ssh-key
shell: >
cat /dev/zero | ssh-keygen -q -N ""
args:
creates: /root/.ssh/id_rsa.pub
tags:
- skip_ansible_lint
- name: Upload key to nova
os_keypair:
auth:
auth_url: "{{ keystone_service_adminurl }}"
username: "{{ octavia_service_user_name }}"
password: "{{ octavia_service_password }}"
project_name: "{{ octavia_service_project_name }}"
user_domain_name: "{{ octavia_service_user_domain_id }}"
project_domain_name: "{{ octavia_service_project_domain_id }}"
endpoint_type: "{{ octavia_ansible_endpoint_type }}"
state: present
name: "octavia_key"
public_key_file: "/root/.ssh/id_rsa.pub"
run_once: true
- name: Create a loadbalancer
shell: >
openstack --debug loadbalancer create --name test-lb --vip-subnet-id public-subnet
environment: "{{ env }}"
tags:
- skip_ansible_lint
- name: Wait until LB is active
shell: >
openstack loadbalancer show test-lb -c provisioning_status -f value
environment: "{{ env }}"
register: lb_active
until: lb_active.stdout == "ACTIVE"
failed_when: lb_active.stdout == "ERROR"
retries: 50
delay: 10
tags:
- skip_ansible_lint
- name: Create a listener
shell: >
openstack loadbalancer listener create --protocol HTTP --protocol-port 80 --name listener test-lb
environment: "{{ env }}"
tags:
- skip_ansible_lint
- name: Wait until Listener is active
shell: >
openstack loadbalancer show test-lb -c provisioning_status -f value
environment: "{{ env }}"
register: lb_active
until: lb_active.stdout == "ACTIVE"
failed_when: lb_active.stdout == "ERROR"
retries: 10
delay: 10
tags:
- skip_ansible_lint
- name: Run Show (for debugging)
shell: >
openstack loadbalancer show test-lb
environment: "{{ env }}"
when:
- debug|bool == true
tags:
- skip_ansible_lint
- name: Register VIP IP # this is likley changing with a newer version of octaviaclient
shell: >
openstack loadbalancer show test-lb -c vip_address -f value
environment: "{{ env }}"
register: vip_output
tags:
- skip_ansible_lint
- name: Set VIP fact
set_fact:
vip: "{{ vip_output.stdout }}"
- name: Test the Listener
uri:
url: "http://{{ vip }}"
status_code: 503
when: test_octavia_amphora|bool == true
- name: Delete LoadBalancer
shell: >
openstack loadbalancer delete --cascade test-lb
environment: "{{ env }}"
register: lb_deleted
until: lb_deleted|success
retries: 10
delay: 15
tags:
- skip_ansible_lint
vars_files:
- common/test-vars.yml