diff --git a/README.md b/README.md index e9ce561..ac6e308 100644 --- a/README.md +++ b/README.md @@ -1,5 +1,18 @@ # Ansible playbook for Eucalyptus Cloud deployment +## Preflight checklist + +Before you attempt to install Eucalyptus Cloud, make sure of: +- all machines part of the deployment have been cleanly installed (currently with CentOS or RHEL 7) with as default options as possible (firewalld can be left running, SELinux in permissive mode); +- select the machines roles (CLC, CC, NC, ceph) in case you have more than one machine in the deployment. You should be able to ssh without any password from the machine designated as CLC all other machines; +- make sure the network is setup accordingly to your planning. We suggest at least 2 networks the public facing one and the private facing one: the public will be the one used from clients to connects to the cloud, and the private will be the one mostly used internally for Eucalyptus and Ceph communication; +- all the machine should be able to reach access to Internet for packages, ntp etc... The CLC should have a public IP while all the others can have a masquerade access (or public IP); +- a set of public IPs should reserved for the Eucalyptus Cloud to use with the instances, elastic load balancers, etc ... +- a DNS (sub)domain should be reserved to the cloud, and it should be delegated to the CLC as the authoritative nameserver for it; +- if you use this ansible playbook for ceph deployment, we suggest to have full disks available for OSD: the disks should be empty, and one OSD will be started per disk. + +## Inventory + Create an inventory for your environment: ``` @@ -7,51 +20,121 @@ cp inventory_example.yml inventory.yml vi inventoy.yml ``` +and modify accordingly. If you want a single node deployment (Cloud In A Box option) use instead: + +``` +cp inventory_example_local.yml inventory.yml +vi inventory.yml +``` + + ## Configuration -The important options to set up are: +To operate the cloud __will need__ a subdomain, and a set of public IPs to be used for the instances and services. The options to set them up are: ``` -cloud_system_dns_dnsdomain= -vpcmido_public_ip_cidr= +cloud_system_dns_dnsdomain: ``` the DNS subdomain needs to be delegated to the cloud (CLC) machine. For -example to delegate ats.mydomain.foo with dnsmasq you cam add: +example to delegate _ats.mydomain.foo_ with dnsmasq add to dnsmasq configuration (for bind or other DNS server, follow their respective documentation): ``` server=/ats.mydomain.foo/ ``` -to enable the delegation. +to enable the delegation. For the public IPs, you will need to define the network they are in and list them: +``` +vpcmido_public_ip_cidr: +vpcmido_public_ip_range: +``` +## Configuration Options +There are few variables to use to configure the cloud: + +``` +cloud_firewalld_configure: yes +``` +default is no, but without this one you either disable firewalld or you configure it by hand; + +``` +cloud_use_dnsmasq: no +``` +default is yes and it is recommended to keep it. Without a local dnsmasq running on the CLC configured to delegate the subdomain to the CLC, your deployment will depends on external DNS server to operate some functionalities (for example ELBs and more); + +``` +ceph_osd_data_path: + - /dev/sdg + - /dev/sdh +``` +if you choose to let this script setup ceph for you, this is the list (1 or more) of hard disks to delegate to each ceph machine. The disks needs to be empty, without tags; + +``` +cloud_region_name: my_lovely_cloud +``` +you can customize here your deployment region's name (from the unimaginative default of cloud-1); + +``` +cloud_zone_1_name: developers +cloud_zone_2_name: sales +cloud_zone_3_name: production +``` +you can customize here the name if each AZ you have configured. Defaults is to add _a_, _b_ etc... to the deployment name; + +``` +eucalyptus_console_cname: ec2.clouddns_subdomain +``` +this is the CNAME to be used with your deployment Route53 to set an entry for the console. The default assumes you installed the eucaconsole on the CLC machine, and thus we add an entry of _ec2.your_dns_cloud_subdomain_. If you prefer to set a full A record instead add also _eucalyptus_console_ipv4: IP_address_; + +``` +enable_M1_instances: False +enable_M2_instances: False +enable_M3_instances: False +enable_M4_instances: False +enable_M5D_instances: False +enable_T1_instances: False +enable_T3_instances: False +``` +turns each one of the above to True to have more instance types available in your deployment. ## Installing the different networks mode +To install with VPCMIDO network mode (recommended): + +``` +ansible-playbook -i inventory.yml playbook_vpcmido.yml +``` + +this is the recommended network mode to have access to all VPC options. + To install with EDGE network mode: ``` ansible-playbook -i inventory.yml playbook[_edge].yml ``` -to install with VPCMIDO network mode (recommended): +## Remove a deployment +To remove a eucalyptus installation and main dependencies: ``` -ansible-playbook -i inventory.yml playbook_vpcmido.yml +ansible-playbook -i inventory.yml playbook_clean.yml ``` -to remove a eucalyptus installation and main dependencies: +NOTE: if ceph was installed with this ansible playbook, it will not be touched, thus you will have to clear all the disks yourself if you desire to do a full clean install. For example if you have `/dev/sdb` and `/dev/sdc` dedicated to ceph and you want to clear them on each ceph node do: ``` -ansible-playbook -i inventory.yml playbook_clean.yml +for x in `lvdisplay |awk '/\/dev\/ceph/ { print $3 }'`; do lvremove -f $x; done +for x in `pvdisplay |awk '/ceph/ {print $3}'`; do vgremove $x; done +pvremove /dev/sdb /dev/sdc ``` +## Using tags Tags can be used to control which aspects of the playbook are used: * `image` : `packages` and generic configuration * `packages` : installs yum repositories and rpms -* `midonet-packages : downloads only Midonet packages locally +* `midonet-packages` : downloads only Midonet packages locally Example tag use: @@ -79,3 +162,4 @@ and ceph_private_ipv4. Without any specification the Eucalyputs public and cluster networks will be used. + diff --git a/inventory_example_local.yml b/inventory_example_local.yml index 6e163bd..61c019c 100644 --- a/inventory_example_local.yml +++ b/inventory_example_local.yml @@ -29,6 +29,7 @@ all: midonet_zookeeper_heap: 512m midonet_cluster_heap: 512m midonet_midolman_heap: 512m + ceph_osd_pool_pgnum: 16 # If using EDGE then br0 must be configured and these # ip address ranges should be updated diff --git a/playbook.yml b/playbook.yml index a21dc40..2f0cb8c 100644 --- a/playbook.yml +++ b/playbook.yml @@ -52,6 +52,10 @@ roles: - node +- hosts: cloud + roles: + - cloud-post + - hosts: console module_defaults: yum: @@ -59,10 +63,6 @@ roles: - console -- hosts: cloud - roles: - - cloud-post - - hosts: all roles: - monitoring diff --git a/roles/ceph-common/defaults/main.yml b/roles/ceph-common/defaults/main.yml index 68cf60d..81fd7b6 100644 --- a/roles/ceph-common/defaults/main.yml +++ b/roles/ceph-common/defaults/main.yml @@ -1,5 +1,5 @@ --- -ceph_release: jewel +ceph_release: nautilus ceph_public_network: 192.168.0.0/16 diff --git a/roles/ceph-common/tasks/base_config.yml b/roles/ceph-common/tasks/base_config.yml index d338679..d07599b 100644 --- a/roles/ceph-common/tasks/base_config.yml +++ b/roles/ceph-common/tasks/base_config.yml @@ -15,3 +15,9 @@ - firewalld - image when: firewalld_package_result.changed + +- name: ensure ntpd is running + systemd: + enabled: yes + name: ntpd + state: started diff --git a/roles/ceph-common/tasks/base_firewall.yml b/roles/ceph-common/tasks/base_firewall.yml index a23e264..68576bb 100644 --- a/roles/ceph-common/tasks/base_firewall.yml +++ b/roles/ceph-common/tasks/base_firewall.yml @@ -5,7 +5,7 @@ name: firewalld tags: - firewalld - when: cloud_firewalld_start + when: cloud_firewalld_configure - name: firewalld public interface zone firewalld: @@ -29,6 +29,16 @@ - firewalld when: cloud_firewalld_cluster_interface is not none and cloud_firewalld_cluster_zone is not none +- name: eucalyptus firewalld cluster zone load + command: + cmd: firewall-cmd --permanent --new-zone euca-cluster + tags: + - firewalld + register: firewalld_result + failed_when: "firewalld_result is failed and 'NAME_CONFLICT' not in firewalld_result.stderr" + changed_when: '"NAME_CONFLICT" not in firewalld_result.stderr' + when: cloud_firewalld_cluster_cidr is not none + - name: eucalyptus gre service copy: src: firewalld-service-euca-gre.xml @@ -36,6 +46,7 @@ owner: root group: root mode: 0644 + force: yes tags: - firewalld when: cloud_firewalld_cluster_cidr is not none @@ -47,20 +58,11 @@ owner: root group: root mode: 0644 + force: yes tags: - firewalld when: cloud_firewalld_cluster_cidr is not none -- name: eucalyptus firewalld cluster zone load - command: - cmd: firewall-cmd --permanent --new-zone euca-cluster - tags: - - firewalld - register: firewalld_result - failed_when: "firewalld_result is failed and 'NAME_CONFLICT' not in firewalld_result.stderr" - changed_when: '"NAME_CONFLICT" not in firewalld_result.stderr' - when: cloud_firewalld_cluster_cidr is not none - - name: firewalld default zone command: cmd: firewall-cmd --set-default-zone {{ cloud_firewalld_default_zone }} diff --git a/roles/ceph-common/tasks/base_packages.yml b/roles/ceph-common/tasks/base_packages.yml index 09ae608..277a0f9 100644 --- a/roles/ceph-common/tasks/base_packages.yml +++ b/roles/ceph-common/tasks/base_packages.yml @@ -6,6 +6,7 @@ - rsync - wget - iproute + - ntp state: present tags: - image diff --git a/roles/ceph-host/tasks/ceph_firewall.yml b/roles/ceph-host/tasks/ceph_firewall.yml index d1aa4cc..ed920f5 100644 --- a/roles/ceph-host/tasks/ceph_firewall.yml +++ b/roles/ceph-host/tasks/ceph_firewall.yml @@ -1,15 +1,4 @@ --- -- name: ceph firewalld cluster zone - template: - src: firewalld-zone-ceph-cluster.xml.j2 - dest: /etc/firewalld/zones/ceph-cluster.xml - owner: root - group: root - mode: 0644 - tags: - - firewalld - when: cloud_firewalld_configure and ceph_cluster_network is not none - - name: ceph firewalld cluster zone load command: cmd: firewall-cmd --permanent --new-zone ceph-cluster @@ -18,22 +7,25 @@ register: firewalld_result failed_when: "firewalld_result is failed and 'NAME_CONFLICT' not in firewalld_result.stderr" changed_when: '"NAME_CONFLICT" not in firewalld_result.stderr' - when: cloud_firewalld_configure and ceph_cluster_network is not none + when: + - cloud_firewalld_configure + - ceph_cluster_network is not none + - ceph_cluster_network != cloud_firewalld_cluster_cidr -- name: ceph firewalld public zone +- name: ceph firewalld cluster zone template: - src: firewalld-zone-ceph-public.xml.j2 - dest: /etc/firewalld/zones/ceph-public.xml + src: firewalld-zone-ceph-cluster.xml.j2 + dest: /etc/firewalld/zones/ceph-cluster.xml owner: root group: root + force: yes mode: 0644 tags: - firewalld when: - cloud_firewalld_configure - - ceph_public_network is not none - ceph_cluster_network is not none - - ceph_cluster_network != ceph_public_network + - ceph_cluster_network != cloud_firewalld_cluster_cidr - name: ceph firewalld public zone load command: @@ -46,8 +38,22 @@ when: - cloud_firewalld_configure - ceph_public_network is not none - - ceph_cluster_network is not none - - ceph_cluster_network != ceph_public_network + - ceph_public_network != cloud_firewalld_cluster_cidr + +- name: ceph firewalld public zone + template: + src: firewalld-zone-ceph-public.xml.j2 + dest: /etc/firewalld/zones/ceph-public.xml + owner: root + group: root + force: yes + mode: 0644 + tags: + - firewalld + when: + - cloud_firewalld_configure + - ceph_public_network is not none + - ceph_public_network != cloud_firewalld_cluster_cidr - name: firewalld reload systemd: diff --git a/roles/ceph/files/ceph-euca-setup.sh b/roles/ceph/files/ceph-euca-setup.sh index b4b8eaf..74484e4 100644 --- a/roles/ceph/files/ceph-euca-setup.sh +++ b/roles/ceph/files/ceph-euca-setup.sh @@ -14,6 +14,10 @@ if ! ceph osd pool ls | grep -q ${EUCA_CEPH_VOLUME_POOL_NAME} ; then echo "Generating volume pool ${EUCA_CEPH_VOLUME_POOL_NAME}" ceph osd pool create ${EUCA_CEPH_VOLUME_POOL_NAME} ${EUCA_POOL_PLACEMENT_GROUPS} ceph osd pool application enable ${EUCA_CEPH_VOLUME_POOL_NAME} rbd 2>/dev/null || true + if [[ "${EUCA_CEPH_MIN_CLIENT:0:1}" > "l" ]]; then + ceph mgr module enable pg_autoscaler + ceph osd pool set ${EUCA_CEPH_VOLUME_POOL_NAME} pg_autoscale_mode on + fi fi if [ "${EUCA_CEPH_VOLUME_POOL_NAME}" != "${EUCA_CEPH_SNAPSHOT_POOL_NAME}" ] ; then @@ -21,11 +25,19 @@ if [ "${EUCA_CEPH_VOLUME_POOL_NAME}" != "${EUCA_CEPH_SNAPSHOT_POOL_NAME}" ] ; th echo "Generating snapshot pool ${EUCA_CEPH_SNAPSHOT_POOL_NAME}" ceph osd pool create ${EUCA_CEPH_SNAPSHOT_POOL_NAME} ${EUCA_POOL_PLACEMENT_GROUPS} ceph osd pool application enable ${EUCA_CEPH_SNAPSHOT_POOL_NAME} rbd 2>/dev/null || true + if [[ "${EUCA_CEPH_MIN_CLIENT:0:1}" > "l" ]]; then + ceph mgr module enable pg_autoscaler + ceph osd pool set ${EUCA_CEPH_SNAPSHOT_POOL_NAME} pg_autoscale_mode on + fi fi fi if [ -n "${EUCA_CEPH_MIN_CLIENT}" ] ; then ceph osd set-require-min-compat-client "${EUCA_CEPH_MIN_CLIENT}" + if [[ "${EUCA_CEPH_MIN_CLIENT:0:1}" > "l" ]]; then + ceph balancer mode upmap + ceph balancer on + fi fi if [ ! -e "${EUCA_CEPH_ARTIFACTS_DIR}" ] ; then diff --git a/roles/cloud-post/defaults/main.yml b/roles/cloud-post/defaults/main.yml index e1df427..04bf4e4 100644 --- a/roles/cloud-post/defaults/main.yml +++ b/roles/cloud-post/defaults/main.yml @@ -15,8 +15,12 @@ eucalyptus_console_product: "{{ eucalyptus_product|default('eucalyptus') }}" eucalyptus_monitoring_enable: no eucalyptus_monitoring_account: cloud-monitoring -# Certbot for eucalyptus-cloud -eucalyptus_services_certbot_enable: no -eucalyptus_services_certbot_email: "" -eucalyptus_services_certbot_certonly_opts: "--no-eff-email" -eucalyptus_services_endpoints: ['*', '*.s3'] +# Instance types to enable +enable_M1_instances: False +enable_M2_instances: False +enable_M3_instances: False +enable_M4_instances: False +enable_M5D_instances: False +enable_T1_instances: False +enable_T3_instances: False + diff --git a/roles/cloud-post/tasks/console.yml b/roles/cloud-post/tasks/console.yml index 9a8f5d3..194648f 100644 --- a/roles/cloud-post/tasks/console.yml +++ b/roles/cloud-post/tasks/console.yml @@ -30,19 +30,6 @@ CONSOLE_ACCOUNT_NUMBER=$(euare-accountlist | grep "^${CONSOLE_ACCOUNT_ALIAS}[[:space:]]" | cut -f 2) euca-modify-image-attribute -l -a "${CONSOLE_ACCOUNT_NUMBER}" "${CONSOLE_IMAGEID}" -- name: console route53 system domain for eucalyptus-cloud authentication - shell: | - set -eu - eval $(clcadmin-assume-system-credentials) - euform-create-stack \ - --template-file /var/lib/eucalyptus/templates/eucalyptus-dns-template.yaml \ - eucalyptus-dns - register: shell_result - changed_when: '"AlreadyExists" not in shell_result.stderr' - failed_when: - - shell_result.rc != 0 - - '"AlreadyExists" not in shell_result.stderr' - - name: console elastic ip address stack shell: | set -eu diff --git a/roles/cloud-post/tasks/main.yml b/roles/cloud-post/tasks/main.yml index 16662cd..d6f0db5 100644 --- a/roles/cloud-post/tasks/main.yml +++ b/roles/cloud-post/tasks/main.yml @@ -18,9 +18,6 @@ - import_tasks: monitoring.yml when: eucalyptus_monitoring_enable -- import_tasks: certbot.yml - when: eucalyptus_services_certbot_enable - - name: enable imaging service shell: | set -eu @@ -66,16 +63,47 @@ name: dnsdist@eucalyptus when: cloud_dns_authoritative_balancer|default(False) -- name: add T3 instances type +- name: add basics instances type shell: | set -eu eval $(clcadmin-assume-system-credentials) euform-create-stack \ --template-file /usr/share/eucalyptus/doc/ec2-instance-types-general.yaml \ - -p EnableT3=True \ ec2-instance-types-general register: shell_result changed_when: '"AlreadyExists" not in shell_result.stderr' failed_when: - shell_result.rc != 0 - '"Stack already exists" not in shell_result.stderr' + +- name: wait for basic instances type template to complete + shell: | + set -euo pipefail + eval $(clcadmin-assume-system-credentials) + euform-describe-stacks ec2-instance-types-general | grep _COMPLETE + register: shell_result + changed_when: False + until: shell_result is succeeded + retries: 5 + delay: 30 + +- name: add more instances type as configured + shell: | + set -eu + eval $(clcadmin-assume-system-credentials) + euform-update-stack \ + --template-file /usr/share/eucalyptus/doc/ec2-instance-types-general.yaml \ + -p EnableM1={{ enable_M1_instances |default(False) }}\ + -p EnableM2={{ enable_M2_instances |default(False) }}\ + -p EnableM3={{ enable_M3_instances |default(False) }}\ + -p EnableM4={{ enable_M4_instances |default(False) }}\ + -p EnableM5D={{ enable_M5D_instances |default(False) }}\ + -p EnableT1={{ enable_T1_instances |default(False) }}\ + -p EnableT3={{ enable_T3_instances |default(False) }}\ + ec2-instance-types-general + register: shell_result + changed_when: '"No updates are to be performed" not in shell_result.stderr' + failed_when: + - shell_result.rc != 0 + - '"No updates are to be performed" not in shell_result.stderr' + diff --git a/roles/cloud-post/tasks/vpcmido.yml b/roles/cloud-post/tasks/vpcmido.yml index b72c393..9198f6e 100644 --- a/roles/cloud-post/tasks/vpcmido.yml +++ b/roles/cloud-post/tasks/vpcmido.yml @@ -5,6 +5,10 @@ environment: PYTHONPATH: /usr/lib/python2.7/site-packages/WebOb-1.4.1-py2.7.egg/ EUCA_TZ_HOST_EXTRAS: "{{ groups.node | map('extract', hostvars, ['eucalyptus_host_cluster_ipv4']) | list | sort | join(' ') }}" + delay: 3 + register: shell_result + until: shell_result.rc == 0 + retries: 5 - name: create eucalyptus account default vpc shell: | diff --git a/roles/cloud-post/files/certbot-renew-eucalyptus-cloud.conf b/roles/cloud/files/certbot-renew-eucalyptus-cloud.conf similarity index 100% rename from roles/cloud-post/files/certbot-renew-eucalyptus-cloud.conf rename to roles/cloud/files/certbot-renew-eucalyptus-cloud.conf diff --git a/roles/cloud-post/tasks/certbot.yml b/roles/cloud/tasks/certbot.yml similarity index 89% rename from roles/cloud-post/tasks/certbot.yml rename to roles/cloud/tasks/certbot.yml index 57cc320..3dd4364 100644 --- a/roles/cloud-post/tasks/certbot.yml +++ b/roles/cloud/tasks/certbot.yml @@ -27,19 +27,6 @@ group: root mode: 0644 -- name: certbot route53 system domain for eucalyptus-cloud authentication - shell: | - set -eu - eval $(clcadmin-assume-system-credentials) - euform-create-stack \ - --template-file /var/lib/eucalyptus/templates/eucalyptus-dns-template.yaml \ - eucalyptus-dns - register: shell_result - changed_when: '"AlreadyExists" not in shell_result.stderr' - failed_when: - - shell_result.rc != 0 - - '"AlreadyExists" not in shell_result.stderr' - - name: certbot firstboot certificate for eucalyptus-cloud shell: | cat <<"EOF" | diff --git a/roles/cloud/tasks/main.yml b/roles/cloud/tasks/main.yml index e385e87..47b600a 100644 --- a/roles/cloud/tasks/main.yml +++ b/roles/cloud/tasks/main.yml @@ -414,3 +414,19 @@ register: shell_result changed_when: '"not changed" not in shell_result.stderr' when: (cloud_opts_tech_preview + cloud_opts_custom) is search(cloud_opts_tp_rds | regex_escape()) + +- name: route53 system domain setup + shell: | + set -eu + eval $(clcadmin-assume-system-credentials) + euform-create-stack \ + --template-file /var/lib/eucalyptus/templates/eucalyptus-dns-template.yaml \ + eucalyptus-dns + register: shell_result + changed_when: '"AlreadyExists" not in shell_result.stderr' + failed_when: + - shell_result.rc != 0 + - '"AlreadyExists" not in shell_result.stderr' + +- import_tasks: certbot.yml + when: eucalyptus_services_certbot_enable diff --git a/roles/cloud-post/templates/botocore-endpoints.json.j2 b/roles/cloud/templates/botocore-endpoints.json.j2 similarity index 100% rename from roles/cloud-post/templates/botocore-endpoints.json.j2 rename to roles/cloud/templates/botocore-endpoints.json.j2 diff --git a/roles/common/defaults/main.yml b/roles/common/defaults/main.yml index d715844..8623df6 100644 --- a/roles/common/defaults/main.yml +++ b/roles/common/defaults/main.yml @@ -64,6 +64,12 @@ cloud_instances_conf_max_cores: "{{ cloud_instances.conf.max_cores }}" cloud_instances_conf_max_mem: "{{ cloud_instances.conf.max_mem }}" cloud_instances_conf_custom: "{{ cloud_instances.conf.custom }}" +# Certbot for eucalyptus-cloud +eucalyptus_services_certbot_enable: no +eucalyptus_services_certbot_email: "" +eucalyptus_services_certbot_certonly_opts: "--no-eff-email" +eucalyptus_services_endpoints: ['*', '*.s3'] + # EDGE network settings edge_router_enabled: Y edge_router_ip: AUTO @@ -92,7 +98,7 @@ net_node_router_ip: "{{ edge_router_ip }}" # DNS Settings cloud_dns_authoritative_balancer: no -cloud_use_dnsmasq: no +cloud_use_dnsmasq: yes # Role settings key_facts: no diff --git a/roles/common/tasks/download_midonet.yml b/roles/common/tasks/download_midonet.yml index 6721467..e1fee58 100644 --- a/roles/common/tasks/download_midonet.yml +++ b/roles/common/tasks/download_midonet.yml @@ -21,7 +21,6 @@ - midonet-cluster-5.2.2-1.0.el7.noarch.rpm - midonet-tools-5.2.2-1.0.el7.noarch.rpm - python-midonetclient-5.2.2-1.0.el7.noarch.rpm - run_once: true when: eucalyptus_get_midonet tags: - midonet-packages @@ -35,7 +34,6 @@ loop: - midonet-selinux-1.0-2.el7.centos.noarch.rpm - zkdump-1.05-1.noarch.rpm - run_once: true when: eucalyptus_get_midonet tags: - midonet-packages @@ -58,7 +56,6 @@ - zookeeper-3.4.8-4.x86_64.rpm - zookeeper-debuginfo-3.4.8-4.x86_64.rpm - zookeeper-lib-3.4.5-1.x86_64.rpm - run_once: true when: eucalyptus_get_midonet tags: - midonet-packages diff --git a/roles/console/defaults/main.yml b/roles/console/defaults/main.yml index 3690e4a..2a6ed44 100644 --- a/roles/console/defaults/main.yml +++ b/roles/console/defaults/main.yml @@ -8,9 +8,10 @@ eucaconsole_ats_product_url: https://www.appscale.com/product/ eucaconsole_firewalld_configure: yes eucaconsole_package_version: "" eucaconsole_package_suffix: "{{ ( '-' + eucaconsole_package_version ) if eucaconsole_package_version else eucalyptus_package_suffix }}" +eucalyptus_console_cname: "ec2.{{ cloud_system_dns_dnsdomain | default('localhost') }}" # Certbot -eucaconsole_certbot_configure: no +eucaconsole_certbot_configure: "{{ eucalyptus_services_certbot_enable }}" eucaconsole_certbot_domain: "console.{{ cloud_system_dns_dnsdomain | default('localhost') }}" eucaconsole_certbot_email: "" eucaconsole_certbot_certonly_opts: "--no-eff-email" diff --git a/roles/console/tasks/certbot.yml b/roles/console/tasks/certbot.yml index 1910926..8b381c4 100644 --- a/roles/console/tasks/certbot.yml +++ b/roles/console/tasks/certbot.yml @@ -3,7 +3,10 @@ - name: install certbot package yum: - name: certbot + name: + - certbot + - python2-certbot-dns-route53 + - python2-futures state: present tags: - packages @@ -44,12 +47,35 @@ until: shell_result is succeeded retries: 5 delay: 30 + when: not eucalyptus_services_certbot_enable + + +- name: eucaconsole set link to cert + ansible.builtin.file: + src: /etc/letsencrypt/live/eucalyptus-cloud/fullchain.pem + dest: /etc/pki/tls/certs/eucaconsole.crt + owner: root + group: root + force: yes + state: link + when: eucalyptus_services_certbot_enable + +- name: eucaconsole set linlk to cert private key + ansible.builtin.file: + src: /etc/letsencrypt/live/eucalyptus-cloud/privkey.pem + dest: /etc/pki/tls/certs/eucaconsole.key + owner: root + group: root + force: yes + state: link + when: eucalyptus_services_certbot_enable - name: eucaconsole certbot https renewal systemd: enabled: true state: started name: certbot-renew.timer + when: not eucalyptus_services_certbot_enable - name: configure cloud property for services https shell: | @@ -57,4 +83,4 @@ eval $(clcadmin-assume-system-credentials) euctl bootstrap.webservices.ssl.server_alias=eucalyptus-cloud delegate_to: "{{ groups.cloud[0] }}" - when: eucaconsole_certbot_request_service_domains and cloud_system_dns_dnsdomain + when: eucaconsole_certbot_request_service_domains and cloud_system_dns_dnsdomain and not eucalyptus_services_certbot_enable diff --git a/roles/console/tasks/main.yml b/roles/console/tasks/main.yml index eb65a5d..af6d9a1 100644 --- a/roles/console/tasks/main.yml +++ b/roles/console/tasks/main.yml @@ -67,11 +67,11 @@ - http - https -- name: certbot system domain for eucalyptus-cloud +- name: update console route53 entry for eucalyptus-cloud shell: | set -eu eval $(clcadmin-assume-system-credentials) - euform-create-stack \ + euform-update-stack \ --template-file /var/lib/eucalyptus/templates/eucalyptus-dns-template.yaml \ -p ConsoleCname={{ eucalyptus_console_cname | default | quote }} \ -p ConsoleIpAddress={{ eucalyptus_console_ipv4 | default | quote }} \ @@ -79,16 +79,17 @@ delegate_to: "{{ groups.cloud[0] }}" when: eucalyptus_console_cname is defined or eucalyptus_console_ipv4 is defined register: shell_result - changed_when: '"AlreadyExists" not in shell_result.stderr' + changed_when: '"No updates are to be performed" not in shell_result.stderr' failed_when: - shell_result.rc != 0 - - '"AlreadyExists" not in shell_result.stderr' + - '"No updates are to be performed" not in shell_result.stderr' + - name: wait for certbot system domain for eucalyptus-cloud stack shell: | set -euo pipefail eval $(clcadmin-assume-system-credentials) - euform-describe-stacks eucalyptus-dns | grep CREATE_COMPLETE + euform-describe-stacks eucalyptus-dns | grep UPDATE_COMPLETE delegate_to: "{{ groups.cloud[0] }}" when: (eucalyptus_console_cname is defined or eucalyptus_console_ipv4 is defined) and shell_result.changed register: shell_result diff --git a/roles/none/tasks/main.yml b/roles/none/tasks/main.yml index 9e05cdd..a08600b 100644 --- a/roles/none/tasks/main.yml +++ b/roles/none/tasks/main.yml @@ -378,6 +378,14 @@ - "/etc/firewalld/services/euca-vpcmidogw-4.xml" - "/etc/firewalld/services/euca-vpcmidogw-5.xml" +- name: check if we have changed resolv.conf + local_action: stat path="/etc/dnsmasq-euca.resolv" + register: resolv_conf + +- name: restore resolv.conf + copy: src=/etc/dnsmasq-euca.resolv dest=/etc/resolv.conf + when: resolv_conf.stat.exists + - name: remove added dnsmasq configuration file: path: "{{ item }}"