diff --git a/nova/templates/network_policy.yaml b/nova/templates/network_policy.yaml index 6b44ace0b8..7cc8b7c0b7 100644 --- a/nova/templates/network_policy.yaml +++ b/nova/templates/network_policy.yaml @@ -17,6 +17,8 @@ limitations under the License. {{- if .Values.manifests.network_policy -}} {{- $netpol_opts := dict "envAll" . "name" "application" "label" "nova" }} {{ $netpol_opts | include "helm-toolkit.manifests.kubernetes_network_policy" }} +{{- if .Values.manifests.deployment_placement -}} {{- $netpol_opts := dict "envAll" . "name" "application" "label" "placement" }} {{ $netpol_opts | include "helm-toolkit.manifests.kubernetes_network_policy" }} {{- end -}} +{{- end -}} diff --git a/nova/templates/secret-ingress-tls.yaml b/nova/templates/secret-ingress-tls.yaml index 3b9062e3c7..bd1a797c1d 100644 --- a/nova/templates/secret-ingress-tls.yaml +++ b/nova/templates/secret-ingress-tls.yaml @@ -17,5 +17,7 @@ limitations under the License. {{- if .Values.manifests.secret_ingress_tls }} {{ include "helm-toolkit.manifests.secret_ingress_tls" ( dict "envAll" . "backendService" "osapi" "backendServiceType" "compute" ) }} {{ include "helm-toolkit.manifests.secret_ingress_tls" ( dict "envAll" . "backendService" "novncproxy" "backendServiceType" "compute_novnc_proxy" ) }} +{{- if .Values.manifests.ingress_placement }} {{ include "helm-toolkit.manifests.secret_ingress_tls" ( dict "envAll" . "backendService" "placement" "backendServiceType" "placement" ) }} {{- end }} +{{- end }} diff --git a/nova/values_overrides/stein-disable-nova-placement.yaml b/nova/values_overrides/stein-disable-nova-placement.yaml new file mode 100644 index 0000000000..351650df7b --- /dev/null +++ b/nova/values_overrides/stein-disable-nova-placement.yaml @@ -0,0 +1,15 @@ +--- +manifests: + cron_job_cell_setup: false + cron_job_service_cleaner: false + statefulset_compute_ironic: false + deployment_placement: false + ingress_placement: false + job_db_init_placement: false + job_ks_placement_endpoints: false + job_ks_placement_service: false + job_ks_placement_user: false + pdb_placement: false + secret_keystone_placement: false + service_ingress_placement: false + service_placement: false diff --git a/placement/Chart.yaml b/placement/Chart.yaml new file mode 100644 index 0000000000..1ea11071bc --- /dev/null +++ b/placement/Chart.yaml @@ -0,0 +1,25 @@ +# Copyright 2019 Intel Corporation. +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: v1 +description: OpenStack-Helm Placement +name: placement +version: 0.1.0 +home: https://docs.openstack.org/placement/latest/ +icon: https://www.openstack.org/themes/openstack/images/project-mascots/Placement/OpenStack_Project_Placement_vertical.png +sources: + - https://opendev.org/openstack/placement + - https://opendev.org/openstack/openstack-helm +maintainers: + - name: OpenStack-Helm Authors \ No newline at end of file diff --git a/placement/requirements.yaml b/placement/requirements.yaml new file mode 100644 index 0000000000..551fd91c8b --- /dev/null +++ b/placement/requirements.yaml @@ -0,0 +1,18 @@ +# Copyright 2019 Intel Corporation. +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +dependencies: + - name: helm-toolkit + repository: http://localhost:8879/charts + version: 0.1.0 diff --git a/placement/templates/bin/_db-sync.sh.tpl b/placement/templates/bin/_db-sync.sh.tpl new file mode 100644 index 0000000000..48857b8d3f --- /dev/null +++ b/placement/templates/bin/_db-sync.sh.tpl @@ -0,0 +1,21 @@ +#!/bin/bash + +{{/* +Copyright 2019 Intel Corporation. + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/}} + +set -ex + +placement-manage db sync diff --git a/placement/templates/bin/_placement-api.sh.tpl b/placement/templates/bin/_placement-api.sh.tpl new file mode 100644 index 0000000000..5cd89188d5 --- /dev/null +++ b/placement/templates/bin/_placement-api.sh.tpl @@ -0,0 +1,42 @@ +#!/bin/bash + +{{/* +Copyright 2019 Intel Corporation. + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/}} + +set -ex +COMMAND="${@:-start}" + +function start () { + + cp -a $(type -p placement-api) /var/www/cgi-bin/placement/ + + if [ -f /etc/apache2/envvars ]; then + # Loading Apache2 ENV variables + source /etc/apache2/envvars + fi + + # Get rid of stale pid file if present. + rm -f /var/run/apache2/*.pid + + # Start Apache2 + exec apache2ctl -DFOREGROUND +} + +function stop () { + apache2ctl -k graceful-stop +} + +$COMMAND diff --git a/placement/templates/configmap-bin.yaml b/placement/templates/configmap-bin.yaml new file mode 100644 index 0000000000..0bc5546cb3 --- /dev/null +++ b/placement/templates/configmap-bin.yaml @@ -0,0 +1,39 @@ +{{/* +Copyright 2019 Intel Corporation. + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/}} + +{{- if .Values.manifests.configmap_bin }} +{{- $envAll := . }} +--- +apiVersion: v1 +kind: ConfigMap +metadata: + name: placement-bin +data: + placement-api.sh: | +{{ tuple "bin/_placement-api.sh.tpl" . | include "helm-toolkit.utils.template" | indent 4 }} + db-sync.sh: | +{{ tuple "bin/_db-sync.sh.tpl" . | include "helm-toolkit.utils.template" | indent 4 }} + db-init.py: | +{{- include "helm-toolkit.scripts.db_init" . | indent 4 }} + db-drop.py: | +{{- include "helm-toolkit.scripts.db_drop" . | indent 4 }} + ks-service.sh: | +{{- include "helm-toolkit.scripts.keystone_service" . | indent 4 }} + ks-endpoints.sh: | +{{- include "helm-toolkit.scripts.keystone_endpoints" . | indent 4 }} + ks-user.sh: | +{{- include "helm-toolkit.scripts.keystone_user" . | indent 4 }} +{{- end }} diff --git a/placement/templates/configmap-etc.yaml b/placement/templates/configmap-etc.yaml new file mode 100644 index 0000000000..e0c88fa2e1 --- /dev/null +++ b/placement/templates/configmap-etc.yaml @@ -0,0 +1,66 @@ +{{/* +Copyright 2019 Intel Corporation. + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/}} + +{{- if .Values.manifests.configmap_etc }} +{{- $envAll := . }} + +{{- if empty .Values.conf.placement.placement_database.connection -}} +{{- $_ := tuple "oslo_db" "internal" "placement" "mysql" . | include "helm-toolkit.endpoints.authenticated_endpoint_uri_lookup" | set .Values.conf.placement.placement_database "connection" -}} +{{- end -}} + +{{- if empty .Values.conf.placement.keystone_authtoken.auth_uri -}} +{{- $_ := tuple "identity" "internal" "api" . | include "helm-toolkit.endpoints.keystone_endpoint_uri_lookup" | set .Values.conf.placement.keystone_authtoken "auth_uri" -}} +{{- end -}} +{{- if empty .Values.conf.placement.keystone_authtoken.auth_url -}} +{{- $_ := tuple "identity" "internal" "api" . | include "helm-toolkit.endpoints.keystone_endpoint_uri_lookup" | set .Values.conf.placement.keystone_authtoken "auth_url" -}} +{{- end -}} + +{{- if empty .Values.conf.placement.keystone_authtoken.os_region_name -}} +{{- $_ := set .Values.conf.placement.keystone_authtoken "os_region_name" .Values.endpoints.identity.auth.placement.region_name -}} +{{- end -}} +{{- if empty .Values.conf.placement.keystone_authtoken.project_name -}} +{{- $_ := set .Values.conf.placement.keystone_authtoken "project_name" .Values.endpoints.identity.auth.placement.project_name -}} +{{- end -}} +{{- if empty .Values.conf.placement.keystone_authtoken.project_domain_name -}} +{{- $_ := set .Values.conf.placement.keystone_authtoken "project_domain_name" .Values.endpoints.identity.auth.placement.project_domain_name -}} +{{- end -}} +{{- if empty .Values.conf.placement.keystone_authtoken.user_domain_name -}} +{{- $_ := set .Values.conf.placement.keystone_authtoken "user_domain_name" .Values.endpoints.identity.auth.placement.user_domain_name -}} +{{- end -}} +{{- if empty .Values.conf.placement.keystone_authtoken.username -}} +{{- $_ := set .Values.conf.placement.keystone_authtoken "username" .Values.endpoints.identity.auth.placement.username -}} +{{- end -}} +{{- if empty .Values.conf.placement.keystone_authtoken.password -}} +{{- $_ := set .Values.conf.placement.keystone_authtoken "password" .Values.endpoints.identity.auth.placement.password -}} +{{- end -}} +{{- if empty .Values.conf.placement.keystone_authtoken.memcached_servers -}} +{{- $_ := tuple "oslo_cache" "internal" "memcache" . | include "helm-toolkit.endpoints.host_and_port_endpoint_uri_lookup" | set .Values.conf.placement.keystone_authtoken "memcached_servers" -}} +{{- end -}} +{{- if empty .Values.conf.placement.keystone_authtoken.memcache_secret_key -}} +{{- $_ := set .Values.conf.placement.keystone_authtoken "memcache_secret_key" ( default ( randAlphaNum 64 ) .Values.endpoints.oslo_cache.auth.memcache_secret_key ) -}} +{{- end -}} +--- +apiVersion: v1 +kind: Secret +metadata: + name: placement-etc +type: Opaque +data: + policy.yaml: {{ toYaml .Values.conf.policy | b64enc }} + placement.conf: {{ include "helm-toolkit.utils.to_oslo_conf" .Values.conf.placement | b64enc }} + logging.conf: {{ include "helm-toolkit.utils.to_oslo_conf" .Values.conf.logging | b64enc }} +{{- include "helm-toolkit.snippets.values_template_renderer" (dict "envAll" $envAll "template" .Values.conf.wsgi_placement "key" "wsgi-placement.conf" "format" "Secret" ) | indent 2 }} +{{- end }} diff --git a/placement/templates/deployment.yaml b/placement/templates/deployment.yaml new file mode 100644 index 0000000000..65bbf6d089 --- /dev/null +++ b/placement/templates/deployment.yaml @@ -0,0 +1,124 @@ +{{/* +Copyright 2019 Intel Corporation. + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/}} + +{{- if .Values.manifests.deployment }} +{{- $envAll := . }} + +{{- $mounts_placement := .Values.pod.mounts.placement.placement }} +{{- $mounts_placement_init := .Values.pod.mounts.placement.init_container }} + +{{- $serviceAccountName := "placement-api" }} +{{ tuple $envAll "api" $serviceAccountName | include "helm-toolkit.snippets.kubernetes_pod_rbac_serviceaccount" }} +--- +apiVersion: apps/v1 +kind: Deployment +metadata: + name: placement-api + annotations: + {{ tuple $envAll | include "helm-toolkit.snippets.release_uuid" }} + labels: +{{ tuple $envAll "placement" "api" | include "helm-toolkit.snippets.kubernetes_metadata_labels" | indent 4 }} +spec: + replicas: {{ .Values.pod.replicas.api }} + selector: + matchLabels: +{{ tuple $envAll "placement" "api" | include "helm-toolkit.snippets.kubernetes_metadata_labels" | indent 6 }} +{{ tuple $envAll | include "helm-toolkit.snippets.kubernetes_upgrades_deployment" | indent 2 }} + template: + metadata: + labels: +{{ tuple $envAll "placement" "api" | include "helm-toolkit.snippets.kubernetes_metadata_labels" | indent 8 }} + annotations: +{{ tuple $envAll | include "helm-toolkit.snippets.release_uuid" | indent 8 }} + configmap-bin-hash: {{ tuple "configmap-bin.yaml" . | include "helm-toolkit.utils.hash" }} + configmap-etc-hash: {{ tuple "configmap-etc.yaml" . | include "helm-toolkit.utils.hash" }} + spec: + serviceAccountName: {{ $serviceAccountName }} + affinity: +{{ tuple $envAll "placement" "api" | include "helm-toolkit.snippets.kubernetes_pod_anti_affinity" | indent 8 }} + nodeSelector: + {{ .Values.labels.api.node_selector_key }}: {{ .Values.labels.api.node_selector_value }} + terminationGracePeriodSeconds: {{ .Values.pod.lifecycle.termination_grace_period.api.timeout | default "30" }} + initContainers: +{{ tuple $envAll "api" $mounts_placement_init | include "helm-toolkit.snippets.kubernetes_entrypoint_init_container" | indent 8 }} + containers: + - name: placement-api +{{ tuple $envAll "placement" | include "helm-toolkit.snippets.image" | indent 10 }} +{{ tuple $envAll $envAll.Values.pod.resources.api | include "helm-toolkit.snippets.kubernetes_resources" | indent 10 }} + command: + - /tmp/placement-api.sh + - start + lifecycle: + preStop: + exec: + command: + - /tmp/placement-api.sh + - stop + ports: + - name: p-api + containerPort: {{ tuple "placement" "internal" "api" . | include "helm-toolkit.endpoints.endpoint_port_lookup" }} + readinessProbe: + #NOTE(portdirect): use tcpSocket check as HTTP will return 401 + tcpSocket: + port: {{ tuple "placement" "internal" "api" . | include "helm-toolkit.endpoints.endpoint_port_lookup" }} + initialDelaySeconds: 15 + periodSeconds: 10 + livenessProbe: + tcpSocket: + port: {{ tuple "placement" "internal" "api" . | include "helm-toolkit.endpoints.endpoint_port_lookup" }} + initialDelaySeconds: 50 + periodSeconds: 10 + volumeMounts: + - name: pod-tmp + mountPath: /tmp + - name: wsgi-placement + mountPath: /var/www/cgi-bin/placement + - name: placement-bin + mountPath: /tmp/placement-api.sh + subPath: placement-api.sh + readOnly: true + - name: placement-etc + mountPath: /etc/placement/placement.conf + subPath: placement.conf + readOnly: true + - name: placement-etc + mountPath: {{ .Values.conf.placement.DEFAULT.log_config_append }} + subPath: {{ base .Values.conf.placement.DEFAULT.log_config_append }} + readOnly: true + - name: placement-etc + mountPath: /etc/placement/policy.yaml + subPath: policy.yaml + readOnly: true + - name: placement-etc + mountPath: /etc/apache2/conf-enabled/wsgi-placement.conf + subPath: wsgi-placement.conf + readOnly: true +{{ if $mounts_placement.volumeMounts }}{{ toYaml $mounts_placement.volumeMounts | indent 12 }}{{ end }} + volumes: + - name: pod-tmp + emptyDir: {} + - name: wsgi-placement + emptyDir: {} + - name: placement-bin + configMap: + name: placement-bin + defaultMode: 0555 + - name: placement-etc + secret: + secretName: placement-etc + defaultMode: 0444 +{{ if $mounts_placement.volumes }}{{ toYaml $mounts_placement.volumes | indent 8 }}{{ end }} +{{- end }} diff --git a/placement/templates/ingress.yaml b/placement/templates/ingress.yaml new file mode 100644 index 0000000000..38f17d9b7e --- /dev/null +++ b/placement/templates/ingress.yaml @@ -0,0 +1,20 @@ +{{/* +Copyright 2019 Intel Corporation. + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/}} + +{{- if and .Values.manifests.ingress .Values.network.api.ingress.public }} +{{- $ingressOpts := dict "envAll" . "backendServiceType" "placement" "backendPort" "p-api" -}} +{{ $ingressOpts | include "helm-toolkit.manifests.ingress" }} +{{- end }} diff --git a/placement/templates/job-db-drop.yaml b/placement/templates/job-db-drop.yaml new file mode 100644 index 0000000000..efa916918e --- /dev/null +++ b/placement/templates/job-db-drop.yaml @@ -0,0 +1,21 @@ +{{/* +Copyright 2019 Intel Corporation. + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/}} + +{{- if .Values.manifests.job_db_drop }} +{{- $serviceName := "placement" -}} +{{- $dbDropJob := dict "envAll" . "serviceName" $serviceName -}} +{{ $dbDropJob | include "helm-toolkit.manifests.job_db_drop_mysql" }} +{{- end }} diff --git a/placement/templates/job-db-init.yaml b/placement/templates/job-db-init.yaml new file mode 100644 index 0000000000..82cd3c5e70 --- /dev/null +++ b/placement/templates/job-db-init.yaml @@ -0,0 +1,23 @@ +{{/* +Copyright 2019 Intel Corporation. + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/}} + +{{- if .Values.manifests.job_db_init }} +{{- $serviceName := "placement" -}} +{{- $dbApi := dict "adminSecret" .Values.secrets.oslo_db.admin "configFile" (printf "/etc/%s/%s.conf" $serviceName $serviceName ) "logConfigFile" (printf "/etc/%s/logging.conf" $serviceName ) "configDbSection" "placement_database" "configDbKey" "connection" -}} +{{- $dbsToInit := list $dbApi }} +{{- $dbInitJob := dict "envAll" . "serviceName" $serviceName "dbsToInit" $dbsToInit -}} +{{ $dbInitJob | include "helm-toolkit.manifests.job_db_init_mysql" }} +{{- end }} diff --git a/placement/templates/job-db-sync.yaml b/placement/templates/job-db-sync.yaml new file mode 100644 index 0000000000..953c776151 --- /dev/null +++ b/placement/templates/job-db-sync.yaml @@ -0,0 +1,20 @@ +{{/* +Copyright 2019 Intel Corporation. + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/}} + +{{- if .Values.manifests.job_db_sync }} +{{- $dbSyncJob := dict "envAll" . "serviceName" "placement" -}} +{{ $dbSyncJob | include "helm-toolkit.manifests.job_db_sync" }} +{{- end }} diff --git a/placement/templates/job-image-repo-sync.yaml b/placement/templates/job-image-repo-sync.yaml new file mode 100644 index 0000000000..dc135df931 --- /dev/null +++ b/placement/templates/job-image-repo-sync.yaml @@ -0,0 +1,20 @@ +{{/* +Copyright 2019 Intel Corporation. + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/}} + +{{- if and .Values.manifests.job_image_repo_sync .Values.images.local_registry.active }} +{{- $imageRepoSyncJob := dict "envAll" . "serviceName" "placement" -}} +{{ $imageRepoSyncJob | include "helm-toolkit.manifests.job_image_repo_sync" }} +{{- end }} diff --git a/placement/templates/job-ks-endpoints.yaml b/placement/templates/job-ks-endpoints.yaml new file mode 100644 index 0000000000..19269f95c8 --- /dev/null +++ b/placement/templates/job-ks-endpoints.yaml @@ -0,0 +1,20 @@ +{{/* +Copyright 2019 Intel Corporation. + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/}} + +{{- if .Values.manifests.job_ks_endpoints }} +{{- $ksServiceJob := dict "envAll" . "serviceName" "placement" "serviceTypes" ( tuple "placement" ) -}} +{{ $ksServiceJob | include "helm-toolkit.manifests.job_ks_endpoints" }} +{{- end }} diff --git a/placement/templates/job-ks-service.yaml b/placement/templates/job-ks-service.yaml new file mode 100644 index 0000000000..87151af01f --- /dev/null +++ b/placement/templates/job-ks-service.yaml @@ -0,0 +1,20 @@ +{{/* +Copyright 2019 Intel Corporation. + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/}} + +{{- if .Values.manifests.job_ks_service }} +{{- $ksServiceJob := dict "envAll" . "serviceName" "placement" "serviceTypes" ( tuple "placement" ) -}} +{{ $ksServiceJob | include "helm-toolkit.manifests.job_ks_service" }} +{{- end }} diff --git a/placement/templates/job-ks-user.yaml b/placement/templates/job-ks-user.yaml new file mode 100644 index 0000000000..1dd4d11db8 --- /dev/null +++ b/placement/templates/job-ks-user.yaml @@ -0,0 +1,20 @@ +{{/* +Copyright 2019 Intel Corporation. + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/}} + +{{- if .Values.manifests.job_ks_user }} +{{- $ksUserJob := dict "envAll" . "serviceName" "placement" -}} +{{ $ksUserJob | include "helm-toolkit.manifests.job_ks_user" }} +{{- end }} diff --git a/placement/templates/network_policy.yaml b/placement/templates/network_policy.yaml new file mode 100644 index 0000000000..d4d209e187 --- /dev/null +++ b/placement/templates/network_policy.yaml @@ -0,0 +1,20 @@ +{{/* +Copyright 2019 Intel Corporation. + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/}} + +{{- if .Values.manifests.network_policy -}} +{{- $netpol_opts := dict "envAll" . "name" "application" "label" "placement" }} +{{ $netpol_opts | include "helm-toolkit.manifests.kubernetes_network_policy" }} +{{- end -}} diff --git a/placement/templates/pdb.yaml b/placement/templates/pdb.yaml new file mode 100644 index 0000000000..65c4c9a5d3 --- /dev/null +++ b/placement/templates/pdb.yaml @@ -0,0 +1,29 @@ +{{/* +Copyright 2019 Intel Corporation. + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/}} + +{{- if .Values.manifests.pdb }} +{{- $envAll := . }} +--- +apiVersion: policy/v1beta1 +kind: PodDisruptionBudget +metadata: + name: placement-api +spec: + minAvailable: {{ .Values.pod.lifecycle.disruption_budget.api.min_available }} + selector: + matchLabels: +{{ tuple $envAll "placement" "api" | include "helm-toolkit.snippets.kubernetes_metadata_labels" | indent 6 }} +{{- end }} diff --git a/placement/templates/secret-db.yaml b/placement/templates/secret-db.yaml new file mode 100644 index 0000000000..dc18506e76 --- /dev/null +++ b/placement/templates/secret-db.yaml @@ -0,0 +1,30 @@ +{{/* +Copyright 2019 Intel Corporation. + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/}} + +{{- if .Values.manifests.secret_db }} +{{- $envAll := . }} +{{- range $key1, $userClass := tuple "admin" "placement" }} +{{- $secretName := index $envAll.Values.secrets.oslo_db $userClass }} +--- +apiVersion: v1 +kind: Secret +metadata: + name: {{ $secretName }} +type: Opaque +data: + DB_CONNECTION: {{ tuple "oslo_db" "internal" $userClass "mysql" $envAll | include "helm-toolkit.endpoints.authenticated_endpoint_uri_lookup" | b64enc -}} +{{- end }} +{{- end }} diff --git a/placement/templates/secret-ingress-tls.yaml b/placement/templates/secret-ingress-tls.yaml new file mode 100644 index 0000000000..49931c5215 --- /dev/null +++ b/placement/templates/secret-ingress-tls.yaml @@ -0,0 +1,19 @@ +{{/* +Copyright 2019 Intel Corporation. + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/}} + +{{- if .Values.manifests.secret_ingress_tls }} +{{ include "helm-toolkit.manifests.secret_ingress_tls" ( dict "envAll" . "backendServiceType" "placement" ) }} +{{- end }} diff --git a/placement/templates/secret-keystone.yaml b/placement/templates/secret-keystone.yaml new file mode 100644 index 0000000000..ce24aa2da1 --- /dev/null +++ b/placement/templates/secret-keystone.yaml @@ -0,0 +1,30 @@ +{{/* +Copyright 2019 Intel Corporation. + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/}} + +{{- if .Values.manifests.secret_keystone }} +{{- $envAll := . }} +{{- range $key1, $userClass := tuple "admin" "placement" }} +{{- $secretName := index $envAll.Values.secrets.identity $userClass }} +--- +apiVersion: v1 +kind: Secret +metadata: + name: {{ $secretName }} +type: Opaque +data: +{{- tuple $userClass "internal" $envAll | include "helm-toolkit.snippets.keystone_secret_openrc" | indent 2 -}} +{{- end }} +{{- end }} diff --git a/placement/templates/service-ingress.yaml b/placement/templates/service-ingress.yaml new file mode 100644 index 0000000000..1eb19c210c --- /dev/null +++ b/placement/templates/service-ingress.yaml @@ -0,0 +1,20 @@ +{{/* +Copyright 2019 Intel Corporation. + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/}} + +{{- if and .Values.manifests.service_ingress .Values.network.api.ingress.public }} +{{- $serviceIngressOpts := dict "envAll" . "backendServiceType" "placement" -}} +{{ $serviceIngressOpts | include "helm-toolkit.manifests.service_ingress" }} +{{- end }} diff --git a/placement/templates/service.yaml b/placement/templates/service.yaml new file mode 100644 index 0000000000..3d9bd0190c --- /dev/null +++ b/placement/templates/service.yaml @@ -0,0 +1,36 @@ +{{/* +Copyright 2019 Intel Corporation. + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/}} + +{{- if .Values.manifests.service }} +{{- $envAll := . }} +--- +apiVersion: v1 +kind: Service +metadata: + name: {{ tuple "placement" "internal" . | include "helm-toolkit.endpoints.hostname_short_endpoint_lookup" }} +spec: + ports: + - name: p-api + port: {{ tuple "placement" "internal" "api" . | include "helm-toolkit.endpoints.endpoint_port_lookup" }} + {{ if .Values.network.api.node_port.enabled }} + nodePort: {{ .Values.network.api.node_port.port }} + {{ end }} + selector: +{{ tuple $envAll "placement" "api" | include "helm-toolkit.snippets.kubernetes_metadata_labels" | indent 4 }} + {{ if .Values.network.api.node_port.enabled }} + type: NodePort + {{ end }} +{{- end }} diff --git a/placement/values.yaml b/placement/values.yaml new file mode 100644 index 0000000000..9cff0dcd96 --- /dev/null +++ b/placement/values.yaml @@ -0,0 +1,423 @@ +# Copyright 2019 Intel Corporation. +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +# Default values for openstack-placement. +# This is a YAML-formatted file. +# Declare variables to be passed into your templates. + +release_group: null + +labels: + api: + node_selector_key: openstack-control-plane + node_selector_value: enabled + job: + node_selector_key: openstack-control-plane + node_selector_value: enabled + +images: + pull_policy: IfNotPresent + tags: + placement: docker.io/openstackhelm/placement:master-ubuntu_bionic + ks_user: docker.io/openstackhelm/heat:ocata-ubuntu_xenial + ks_service: docker.io/openstackhelm/heat:ocata-ubuntu_xenial + ks_endpoints: docker.io/openstackhelm/heat:ocata-ubuntu_xenial + db_init: docker.io/openstackhelm/heat:ocata-ubuntu_xenial + db_drop: docker.io/openstackhelm/heat:ocata-ubuntu_xenial + placement_db_sync: docker.io/openstackhelm/placement:master-ubuntu_bionic + dep_check: quay.io/stackanetes/kubernetes-entrypoint:v0.3.1 + image_repo_sync: docker.io/docker:17.07.0 + local_registry: + active: false + exclude: + - dep_check + - image_repo_sync + +network: + api: + port: 8778 + ingress: + public: true + classes: + namespace: "nginx" + cluster: "nginx-cluster" + annotations: + nginx.ingress.kubernetes.io/rewrite-target: / + external_policy_local: false + node_port: + enabled: false + port: 30778 + +conf: + policy: + context_is_admin: 'role:admin' + segregation: 'rule:context_is_admin' + admin_or_owner: 'rule:context_is_admin or project_id:%(project_id)s' + default: 'rule:admin_or_owner' + placement: + DEFAULT: + debug: false + use_syslog: false + log_config_append: /etc/placement/logging.conf + placement_database: + connection: null + keystone_authtoken: + auth_version: v3 + auth_type: password + memcache_security_strategy: ENCRYPT + logging: + loggers: + keys: + - root + - placement + handlers: + keys: + - stdout + - stderr + - "null" + formatters: + keys: + - context + - default + logger_root: + level: WARNING + handlers: stdout + logger_placement: + level: INFO + handlers: + - stdout + qualname: placement + logger_amqp: + level: WARNING + handlers: stderr + qualname: amqp + logger_amqplib: + level: WARNING + handlers: stderr + qualname: amqplib + logger_eventletwsgi: + level: WARNING + handlers: stderr + qualname: eventlet.wsgi.server + logger_sqlalchemy: + level: WARNING + handlers: stderr + qualname: sqlalchemy + logger_boto: + level: WARNING + handlers: stderr + qualname: boto + handler_null: + class: logging.NullHandler + formatter: default + args: () + handler_stdout: + class: StreamHandler + args: (sys.stdout,) + formatter: context + handler_stderr: + class: StreamHandler + args: (sys.stderr,) + formatter: context + formatter_context: + class: oslo_log.formatters.ContextFormatter + datefmt: "%Y-%m-%d %H:%M:%S" + formatter_default: + format: "%(message)s" + datefmt: "%Y-%m-%d %H:%M:%S" + wsgi_placement: | + Listen 0.0.0.0:{{ tuple "placement" "internal" "api" . | include "helm-toolkit.endpoints.endpoint_port_lookup" }} + LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined + LogFormat "%{X-Forwarded-For}i %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" proxy + SetEnvIf X-Forwarded-For "^.*\..*\..*\..*" forwarded + CustomLog /dev/stdout combined env=!forwarded + CustomLog /dev/stdout proxy env=forwarded + + WSGIDaemonProcess placement-api processes=4 threads=1 user=placement group=placement display-name=%{GROUP} + WSGIProcessGroup placement-api + WSGIScriptAlias / /var/www/cgi-bin/placement/placement-api + WSGIApplicationGroup %{GLOBAL} + WSGIPassAuthorization On + = 2.4> + ErrorLogFormat "%{cu}t %M" + + ErrorLog /dev/stdout + SetEnvIf X-Forwarded-For "^.*\..*\..*\..*" forwarded + CustomLog /dev/stdout combined env=!forwarded + CustomLog /dev/stdout proxy env=forwarded + + Alias /placement /var/www/cgi-bin/placement/placement-api + + SetHandler wsgi-script + Options +ExecCGI + WSGIProcessGroup placement-api + WSGIApplicationGroup %{GLOBAL} + WSGIPassAuthorization On + + +endpoints: + cluster_domain_suffix: cluster.local + local_image_registry: + name: docker-registry + namespace: docker-registry + hosts: + default: localhost + internal: docker-registry + node: localhost + host_fqdn_override: + default: null + port: + registry: + node: 5000 + oslo_db: + auth: + admin: + username: root + password: password + placement: + username: placement + password: password + hosts: + default: mariadb + host_fqdn_override: + default: null + path: /placement + scheme: mysql+pymysql + port: + mysql: + default: 3306 + oslo_cache: + auth: + # NOTE(portdirect): this is used to define the value for keystone + # authtoken cache encryption key, if not set it will be populated + # automatically with a random value, but to take advantage of + # this feature all services should be set to use the same key, + # and memcache service. + memcache_secret_key: null + hosts: + default: memcached + host_fqdn_override: + default: null + port: + memcache: + default: 11211 + identity: + name: keystone + auth: + admin: + region_name: RegionOne + username: admin + password: password + project_name: admin + user_domain_name: default + project_domain_name: default + placement: + role: admin + region_name: RegionOne + username: placement + password: password + project_name: service + user_domain_name: service + project_domain_name: service + hosts: + default: keystone + internal: keystone-api + host_fqdn_override: + default: null + path: + default: /v3 + scheme: + default: http + port: + api: + default: 80 + internal: 5000 + placement: + name: placement + hosts: + default: placement-api + public: placement + host_fqdn_override: + default: null + path: + default: / + scheme: + default: 'http' + port: + api: + default: 8778 + public: 80 + +pod: + user: + placement: + uid: 42424 + affinity: + anti: + type: + default: preferredDuringSchedulingIgnoredDuringExecution + topologyKey: + default: kubernetes.io/hostname + mounts: + placement: + init_container: null + placement: + volumeMounts: + volumes: + replicas: + api: 1 + lifecycle: + upgrades: + deployments: + revision_history: 3 + pod_replacement_strategy: RollingUpdate + rolling_update: + max_unavailable: 1 + max_surge: 3 + disruption_budget: + api: + min_available: 0 + termination_grace_period: + api: + timeout: 30 + resources: + enabled: false + api: + requests: + memory: "128Mi" + cpu: "100m" + limits: + memory: "1024Mi" + cpu: "2000m" + jobs: + db_init: + requests: + memory: "128Mi" + cpu: "100m" + limits: + memory: "1024Mi" + cpu: "2000m" + db_sync: + requests: + memory: "128Mi" + cpu: "100m" + limits: + memory: "1024Mi" + cpu: "2000m" + db_drop: + requests: + memory: "128Mi" + cpu: "100m" + limits: + memory: "1024Mi" + cpu: "2000m" + ks_endpoints: + requests: + memory: "128Mi" + cpu: "100m" + limits: + memory: "1024Mi" + cpu: "2000m" + ks_service: + requests: + memory: "128Mi" + cpu: "100m" + limits: + memory: "1024Mi" + cpu: "2000m" + ks_user: + requests: + memory: "128Mi" + cpu: "100m" + limits: + memory: "1024Mi" + cpu: "2000m" + +secrets: + identity: + admin: placement-keystone-admin + placement: placement-keystone-user + oslo_db: + admin: placement-db-admin + placement: placement-db-user + tls: + placement: + api: + public: placement-tls-public + +dependencies: + dynamic: + common: + local_image_registry: + jobs: + - image-repo-sync + services: + - endpoint: node + service: local_image_registry + static: + api: + jobs: + - placement-db-sync + - placement-ks-service + - placement-ks-user + - placement-ks-endpoints + ks_endpoints: + jobs: + - placement-ks-user + - placement-ks-service + services: + - endpoint: internal + service: identity + ks_service: + services: + - endpoint: internal + service: identity + ks_user: + services: + - endpoint: internal + service: identity + db_drop: + services: + - endpoint: internal + service: oslo_db + db_init: + services: + - endpoint: internal + service: oslo_db + db_sync: + jobs: + - placement-db-init + services: + - endpoint: internal + service: oslo_db + +manifests: + configmap_bin: true + configmap_etc: true + deployment: true + job_image_repo_sync: true + job_db_init: true + job_db_sync: true + job_db_drop: false + job_ks_endpoints: true + job_ks_service: true + job_ks_user: true + network_policy: false + secret_db: true + secret_ingress_tls: true + pdb: true + ingress: true + secret_keystone: true + service_ingress: true + service: true diff --git a/tools/deployment/component/compute-kit/compute-kit.sh b/tools/deployment/component/compute-kit/compute-kit.sh index 0e0ea746ff..d78b96a334 100755 --- a/tools/deployment/component/compute-kit/compute-kit.sh +++ b/tools/deployment/component/compute-kit/compute-kit.sh @@ -15,9 +15,52 @@ # under the License. set -xe +#NOTE: Get the overrides to use for placement, should placement be deployed. +case "${OPENSTACK_RELEASE}" in + "newton") + DEPLOY_SEPARATE_PLACEMENT="no" + ;; + "ocata") + DEPLOY_SEPARATE_PLACEMENT="no" + ;; + "pike") + DEPLOY_SEPARATE_PLACEMENT="no" + ;; + "queens") + DEPLOY_SEPARATE_PLACEMENT="no" + ;; + "rocky") + DEPLOY_SEPARATE_PLACEMENT="no" + ;; + *) + DEPLOY_SEPARATE_PLACEMENT="yes" + ;; +esac + +if [[ "${DEPLOY_SEPARATE_PLACEMENT}" == "yes" ]]; then + # Get overrides + : ${OSH_EXTRA_HELM_ARGS_PLACEMENT:="$(./tools/deployment/common/get-values-overrides.sh placement)"} + + # Lint and package + make placement + + # Deploy + helm upgrade --install placement ./placement --namespace=openstack \ + ${OSH_EXTRA_HELM_ARGS:=} ${OSH_EXTRA_HELM_ARGS_PLACEMENT} +fi + #NOTE: Get the over-rides to use : ${OSH_EXTRA_HELM_ARGS_NOVA:="$(./tools/deployment/common/get-values-overrides.sh nova)"} +# TODO: Revert this reasoning when gates are pointing to more up to +# date openstack release. When doing so, we should revert the default +# values of the nova chart to NOT use placement by default, and +# have a ocata/pike/queens/rocky override to enable placement in the nova chart deploy + +if [[ "${DEPLOY_SEPARATE_PLACEMENT}" == "yes" ]]; then + OSH_EXTRA_HELM_ARGS_NOVA="${OSH_EXTRA_HELM_ARGS_NOVA} --values=./nova/values_overrides/stein-disable-nova-placement.yaml" +fi + #NOTE: Lint and package chart make nova