Enable the use of a package manager cache

This change instructs package managers to use a proxy connecting
through the repo server instead of going directly to the online
repository. This should speedup deployments by caching packages
closer to the environment.

Change-Id: I91d7320bb33996eb61516927cb35eff3b0ecaa79
Depends-On: I78b2fba6a1f294751bd7098513060015cb41300c
Signed-off-by: Kevin Carter <kevin.carter@rackspace.com>

playbooks/inventory/group_vars/all.yml

@@ -35,6 +35,7 @@ pip_links:
 ## OpenStack source options
 # URL for the frozen internal openstack repo.
 repo_server_port: 8181
+repo_pkg_cache_enabled: true
 openstack_repo_url: "http://{{ internal_lb_vip_address }}:{{ repo_server_port }}"
 openstack_repo_git_url: "git://{{ internal_lb_vip_address }}"
 

playbooks/repo-server.yml

@@ -44,3 +44,22 @@
         - "rsyslog-client"
   vars:
     is_metal: "{{ properties.is_metal|default(false) }}"
+
+- name: Setup package manager proxy
+  hosts: all:!repo_all
+  tasks:
+    - name: Drop apt package manager proxy
+      copy:
+        content: 'Acquire::http { Proxy "http://{{ internal_lb_vip_address }}:3142"; };'
+        dest: "/etc/apt/apt.conf.d/00apt-cacher-proxy"
+      when:
+        - ansible_os_family == 'Debian'
+        - repo_pkg_cache_enabled | bool
+    - name: Drop apt package manager proxy
+      lineinfile:
+        line: 'proxy=http://{{ internal_lb_vip_address }}:3142'
+        dest: "/etc/yum.conf"
+      when:
+        - ansible_os_family == 'RedHat'
+        - repo_pkg_cache_enabled | bool
+

playbooks/vars/configs/haproxy_config.yml

@@ -47,6 +47,19 @@ haproxy_default_services:
       haproxy_balance_type: http
       haproxy_backend_options:
         - "httpchk HEAD /"
+  - service:
+      haproxy_service_name: repo_cache
+      haproxy_backend_nodes: "{{ [groups['repo_all'][0]] | default([]) }}"  # list expected
+      haproxy_backup_nodes: "{{ groups['repo_all'][1:] | default([]) }}"
+      haproxy_ssl: "{{ haproxy_ssl }}"
+      haproxy_port: 3142
+      haproxy_balance_type: http
+      haproxy_backend_options:
+        - "httpchk HEAD /acng-report.html"
+      haproxy_whitelist_networks:
+        - 192.168.0.0/16
+        - 172.16.0.0/12
+        - 10.0.0.0/8
   - service:
       haproxy_service_name: glance_api
       haproxy_backend_nodes: "{{ groups['glance_api'] | default([]) }}"

releasenotes/notes/haproxy-package-cache-backend-da096228387bc1f4.yaml

@@ -0,0 +1,13 @@
+---
+features:
+  - The repo server will now be used as a package manager
+    cache.
+upgrade:
+  - Haproxy has a new backend to support using the repo
+    server nodes as a package manager cache. The new backend
+    is called "repo_cache" and uses port "3142" and a single
+    active node. All other nodes within the pool are backups
+    and will be promoted if the active node goes down.
+    Default ACLs have been created to lock down the port's
+    availability to only internal networks originating from
+    an RFC1918 address.