From 39aaeb2336e89c1435ae38ee5b507b51ff5be06a Mon Sep 17 00:00:00 2001 From: graziano obertelli Date: Mon, 11 Jul 2022 02:29:58 +0200 Subject: [PATCH 01/17] Fix creation of firewall zones The creation of the empty firewall zone needs to be done before copying the template. --- roles/ceph-common/tasks/base_firewall.yml | 24 +++++++------ roles/ceph-host/tasks/ceph_firewall.yml | 42 +++++++++++++---------- 2 files changed, 36 insertions(+), 30 deletions(-) diff --git a/roles/ceph-common/tasks/base_firewall.yml b/roles/ceph-common/tasks/base_firewall.yml index a23e264..68576bb 100644 --- a/roles/ceph-common/tasks/base_firewall.yml +++ b/roles/ceph-common/tasks/base_firewall.yml @@ -5,7 +5,7 @@ name: firewalld tags: - firewalld - when: cloud_firewalld_start + when: cloud_firewalld_configure - name: firewalld public interface zone firewalld: @@ -29,6 +29,16 @@ - firewalld when: cloud_firewalld_cluster_interface is not none and cloud_firewalld_cluster_zone is not none +- name: eucalyptus firewalld cluster zone load + command: + cmd: firewall-cmd --permanent --new-zone euca-cluster + tags: + - firewalld + register: firewalld_result + failed_when: "firewalld_result is failed and 'NAME_CONFLICT' not in firewalld_result.stderr" + changed_when: '"NAME_CONFLICT" not in firewalld_result.stderr' + when: cloud_firewalld_cluster_cidr is not none + - name: eucalyptus gre service copy: src: firewalld-service-euca-gre.xml @@ -36,6 +46,7 @@ owner: root group: root mode: 0644 + force: yes tags: - firewalld when: cloud_firewalld_cluster_cidr is not none @@ -47,20 +58,11 @@ owner: root group: root mode: 0644 + force: yes tags: - firewalld when: cloud_firewalld_cluster_cidr is not none -- name: eucalyptus firewalld cluster zone load - command: - cmd: firewall-cmd --permanent --new-zone euca-cluster - tags: - - firewalld - register: firewalld_result - failed_when: "firewalld_result is failed and 'NAME_CONFLICT' not in firewalld_result.stderr" - changed_when: '"NAME_CONFLICT" not in firewalld_result.stderr' - when: cloud_firewalld_cluster_cidr is not none - - name: firewalld default zone command: cmd: firewall-cmd --set-default-zone {{ cloud_firewalld_default_zone }} diff --git a/roles/ceph-host/tasks/ceph_firewall.yml b/roles/ceph-host/tasks/ceph_firewall.yml index d1aa4cc..d4b3651 100644 --- a/roles/ceph-host/tasks/ceph_firewall.yml +++ b/roles/ceph-host/tasks/ceph_firewall.yml @@ -1,15 +1,4 @@ --- -- name: ceph firewalld cluster zone - template: - src: firewalld-zone-ceph-cluster.xml.j2 - dest: /etc/firewalld/zones/ceph-cluster.xml - owner: root - group: root - mode: 0644 - tags: - - firewalld - when: cloud_firewalld_configure and ceph_cluster_network is not none - - name: ceph firewalld cluster zone load command: cmd: firewall-cmd --permanent --new-zone ceph-cluster @@ -18,22 +7,25 @@ register: firewalld_result failed_when: "firewalld_result is failed and 'NAME_CONFLICT' not in firewalld_result.stderr" changed_when: '"NAME_CONFLICT" not in firewalld_result.stderr' - when: cloud_firewalld_configure and ceph_cluster_network is not none + when: + - cloud_firewalld_configure + - ceph_cluster_network is not none + - ceph_cluster_network != cloud_firewalld_cluster_cidr -- name: ceph firewalld public zone +- name: ceph firewalld cluster zone template: - src: firewalld-zone-ceph-public.xml.j2 - dest: /etc/firewalld/zones/ceph-public.xml + src: firewalld-zone-ceph-cluster.xml.j2 + dest: /etc/firewalld/zones/ceph-cluster.xml owner: root group: root + force: yes mode: 0644 tags: - firewalld when: - cloud_firewalld_configure - - ceph_public_network is not none - ceph_cluster_network is not none - - ceph_cluster_network != ceph_public_network + - ceph_cluster_network != cloud_firewalld_cluster_cidr - name: ceph firewalld public zone load command: @@ -46,8 +38,20 @@ when: - cloud_firewalld_configure - ceph_public_network is not none - - ceph_cluster_network is not none - - ceph_cluster_network != ceph_public_network + +- name: ceph firewalld public zone + template: + src: firewalld-zone-ceph-public.xml.j2 + dest: /etc/firewalld/zones/ceph-public.xml + owner: root + group: root + force: yes + mode: 0644 + tags: + - firewalld + when: + - cloud_firewalld_configure + - ceph_public_network is not none - name: firewalld reload systemd: From 447cf096239d674bb651770d05d9b4ec359655db Mon Sep 17 00:00:00 2001 From: graziano obertelli Date: Mon, 11 Jul 2022 23:09:12 +0200 Subject: [PATCH 02/17] Make sure ntpd is installed and running --- roles/ceph-common/tasks/base_config.yml | 6 ++++++ roles/ceph-common/tasks/base_packages.yml | 1 + 2 files changed, 7 insertions(+) diff --git a/roles/ceph-common/tasks/base_config.yml b/roles/ceph-common/tasks/base_config.yml index d338679..d07599b 100644 --- a/roles/ceph-common/tasks/base_config.yml +++ b/roles/ceph-common/tasks/base_config.yml @@ -15,3 +15,9 @@ - firewalld - image when: firewalld_package_result.changed + +- name: ensure ntpd is running + systemd: + enabled: yes + name: ntpd + state: started diff --git a/roles/ceph-common/tasks/base_packages.yml b/roles/ceph-common/tasks/base_packages.yml index 09ae608..277a0f9 100644 --- a/roles/ceph-common/tasks/base_packages.yml +++ b/roles/ceph-common/tasks/base_packages.yml @@ -6,6 +6,7 @@ - rsync - wget - iproute + - ntp state: present tags: - image From 5c1b1e51c3f8130c7b43e55f48387edf75dd5583 Mon Sep 17 00:00:00 2001 From: graziano obertelli Date: Mon, 11 Jul 2022 23:21:43 +0200 Subject: [PATCH 03/17] Restore resolv.conf if we modified --- roles/common/tasks/download_midonet.yml | 3 --- roles/none/tasks/main.yml | 8 ++++++++ 2 files changed, 8 insertions(+), 3 deletions(-) diff --git a/roles/common/tasks/download_midonet.yml b/roles/common/tasks/download_midonet.yml index 6721467..e1fee58 100644 --- a/roles/common/tasks/download_midonet.yml +++ b/roles/common/tasks/download_midonet.yml @@ -21,7 +21,6 @@ - midonet-cluster-5.2.2-1.0.el7.noarch.rpm - midonet-tools-5.2.2-1.0.el7.noarch.rpm - python-midonetclient-5.2.2-1.0.el7.noarch.rpm - run_once: true when: eucalyptus_get_midonet tags: - midonet-packages @@ -35,7 +34,6 @@ loop: - midonet-selinux-1.0-2.el7.centos.noarch.rpm - zkdump-1.05-1.noarch.rpm - run_once: true when: eucalyptus_get_midonet tags: - midonet-packages @@ -58,7 +56,6 @@ - zookeeper-3.4.8-4.x86_64.rpm - zookeeper-debuginfo-3.4.8-4.x86_64.rpm - zookeeper-lib-3.4.5-1.x86_64.rpm - run_once: true when: eucalyptus_get_midonet tags: - midonet-packages diff --git a/roles/none/tasks/main.yml b/roles/none/tasks/main.yml index 9e05cdd..a08600b 100644 --- a/roles/none/tasks/main.yml +++ b/roles/none/tasks/main.yml @@ -378,6 +378,14 @@ - "/etc/firewalld/services/euca-vpcmidogw-4.xml" - "/etc/firewalld/services/euca-vpcmidogw-5.xml" +- name: check if we have changed resolv.conf + local_action: stat path="/etc/dnsmasq-euca.resolv" + register: resolv_conf + +- name: restore resolv.conf + copy: src=/etc/dnsmasq-euca.resolv dest=/etc/resolv.conf + when: resolv_conf.stat.exists + - name: remove added dnsmasq configuration file: path: "{{ item }}" From 97be5903de06b84288ab4af3b75076f35fd031d7 Mon Sep 17 00:00:00 2001 From: graziano obertelli Date: Wed, 12 Oct 2022 15:49:26 -0700 Subject: [PATCH 04/17] Added preflight checklist --- README.md | 43 ++++++++++++++++++++++++++++++++++++++----- 1 file changed, 38 insertions(+), 5 deletions(-) diff --git a/README.md b/README.md index e9ce561..feddc81 100644 --- a/README.md +++ b/README.md @@ -1,5 +1,18 @@ # Ansible playbook for Eucalyptus Cloud deployment +## Preflight checklist + +Before you attempt to install Eucalyptus Cloud, make sure of: +- all machines part of the deployment have been cleanly installed (currently with CentOS or RHEL 7) with as default options as possible (firewalld can be left running, SELinux in permissive mode); +- select the machines roles (CLC, CC, NC, ceph) in case you have more than one machine in the deployment. You should be able to ssh without any password from the machine designated as CLC all other machines; +- make sure the network is setup accordingly to your planning. We suggest at least 2 networks the public facing one and the private facing one: the public will be the one used from clients to connects to the cloud, and the private will be the one mostly used internally for Eucalyptus and Ceph communication; +- all the machine should be able to reach access to Internet for packages, ntp etc... The CLC should have a public IP while all the others can have a masquerade access (or public IP); +- a set of public IPs should reserved for the Eucalyptus Cloud to use with the instances, elastic load balancers, etc ... +- a DNS (sub)domain should be reserved to the cloud, and it should be delegated to the CLC as the authoritative nameserver for it; +- if you use this ansible playbook for ceph deployment, we suggest to have full disks available for OSD: the disks should be empty, and one OSD will be started per disk. + +## Inventory + Create an inventory for your environment: ``` @@ -7,6 +20,14 @@ cp inventory_example.yml inventory.yml vi inventoy.yml ``` +and modify accordingly. If you want a single node deployment (Cloud In A Box option) use instead: + +``` +cp inventory_example_local.yml inventory.yml +vi inventory.yml +``` + + ## Configuration The important options to set up are: @@ -29,29 +50,41 @@ to enable the delegation. ## Installing the different networks mode +To install with VPCMIDO network mode (recommended): + +``` +ansible-playbook -i inventory.yml playbook_vpcmido.yml +``` + +this is the recommended network mode to have access to all VPC options. + To install with EDGE network mode: ``` ansible-playbook -i inventory.yml playbook[_edge].yml ``` -to install with VPCMIDO network mode (recommended): +## Remove a deployment +To remove a eucalyptus installation and main dependencies: ``` -ansible-playbook -i inventory.yml playbook_vpcmido.yml +ansible-playbook -i inventory.yml playbook_clean.yml ``` -to remove a eucalyptus installation and main dependencies: +NOTE: if ceph was installed with this ansible playbook, it will not be touched, thus you will have to clear all the disks yourself if you desire to do a full clean install. For example if you have `/dev/sdb` and `/dev/sdc` dedicated to ceph and you want to clear them on each ceph node do: ``` -ansible-playbook -i inventory.yml playbook_clean.yml +for x in `lvdisplay |awk '/\/dev\/ceph/ { print $3 }'`; do lvremove -f $x; done +for x in `pvdisplay |awk '/ceph/ {print $3}'`; do vgremove $x; done +pvremove /dev/sdb /dev/sdc ``` +## Using tags Tags can be used to control which aspects of the playbook are used: * `image` : `packages` and generic configuration * `packages` : installs yum repositories and rpms -* `midonet-packages : downloads only Midonet packages locally +* `midonet-packages` : downloads only Midonet packages locally Example tag use: From 41ecff6c61e3a503e0b1de0b561ce2ff6a6a56ad Mon Sep 17 00:00:00 2001 From: graziano obertelli Date: Wed, 12 Oct 2022 17:11:44 -0700 Subject: [PATCH 05/17] Don't set ceph network if already set In case there is no ceph public network different from the cluster network already set, avoid to create a firewall rule for the ceph public network. --- roles/ceph-host/tasks/ceph_firewall.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/roles/ceph-host/tasks/ceph_firewall.yml b/roles/ceph-host/tasks/ceph_firewall.yml index d4b3651..ed920f5 100644 --- a/roles/ceph-host/tasks/ceph_firewall.yml +++ b/roles/ceph-host/tasks/ceph_firewall.yml @@ -38,6 +38,7 @@ when: - cloud_firewalld_configure - ceph_public_network is not none + - ceph_public_network != cloud_firewalld_cluster_cidr - name: ceph firewalld public zone template: @@ -52,6 +53,7 @@ when: - cloud_firewalld_configure - ceph_public_network is not none + - ceph_public_network != cloud_firewalld_cluster_cidr - name: firewalld reload systemd: From e73ac610c616ca86a963dfdae6d922cbaa0dbacf Mon Sep 17 00:00:00 2001 From: graziano obertelli Date: Wed, 12 Oct 2022 17:13:55 -0700 Subject: [PATCH 06/17] Retries a shell script to setup tunnel across AZ --- roles/cloud-post/tasks/vpcmido.yml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/roles/cloud-post/tasks/vpcmido.yml b/roles/cloud-post/tasks/vpcmido.yml index b72c393..9198f6e 100644 --- a/roles/cloud-post/tasks/vpcmido.yml +++ b/roles/cloud-post/tasks/vpcmido.yml @@ -5,6 +5,10 @@ environment: PYTHONPATH: /usr/lib/python2.7/site-packages/WebOb-1.4.1-py2.7.egg/ EUCA_TZ_HOST_EXTRAS: "{{ groups.node | map('extract', hostvars, ['eucalyptus_host_cluster_ipv4']) | list | sort | join(' ') }}" + delay: 3 + register: shell_result + until: shell_result.rc == 0 + retries: 5 - name: create eucalyptus account default vpc shell: | From c00d9df08cf37f0552ea01fce90610e656a3dff0 Mon Sep 17 00:00:00 2001 From: graziano obertelli Date: Thu, 13 Oct 2022 15:37:26 -0700 Subject: [PATCH 07/17] Allow for console route53 entry to be modified These changes allow for the console route53 entry to be modified. By default a CNAME default entry to ec2. has been added, assuming that the console has been started on the CLC machine. --- playbook.yml | 8 ++++---- roles/cloud-post/tasks/certbot.yml | 19 ++++++------------- roles/cloud-post/tasks/console.yml | 13 ------------- roles/cloud-post/tasks/main.yml | 13 +++++++++++++ roles/console/defaults/main.yml | 1 + roles/console/tasks/certbot.yml | 6 ++++++ roles/console/tasks/main.yml | 11 ++++++----- 7 files changed, 36 insertions(+), 35 deletions(-) diff --git a/playbook.yml b/playbook.yml index a21dc40..2f0cb8c 100644 --- a/playbook.yml +++ b/playbook.yml @@ -52,6 +52,10 @@ roles: - node +- hosts: cloud + roles: + - cloud-post + - hosts: console module_defaults: yum: @@ -59,10 +63,6 @@ roles: - console -- hosts: cloud - roles: - - cloud-post - - hosts: all roles: - monitoring diff --git a/roles/cloud-post/tasks/certbot.yml b/roles/cloud-post/tasks/certbot.yml index 57cc320..10fb83d 100644 --- a/roles/cloud-post/tasks/certbot.yml +++ b/roles/cloud-post/tasks/certbot.yml @@ -11,6 +11,12 @@ tags: - packages +- name: fix issues with latest CentOS 7 + yum: + name: python-s3transfer.0.1.13-1.el7.0.1 + allow_downgrade: yes + state: present + - name: certbot-renew service.d directory file: path: /etc/systemd/system/certbot-renew.service.d @@ -27,19 +33,6 @@ group: root mode: 0644 -- name: certbot route53 system domain for eucalyptus-cloud authentication - shell: | - set -eu - eval $(clcadmin-assume-system-credentials) - euform-create-stack \ - --template-file /var/lib/eucalyptus/templates/eucalyptus-dns-template.yaml \ - eucalyptus-dns - register: shell_result - changed_when: '"AlreadyExists" not in shell_result.stderr' - failed_when: - - shell_result.rc != 0 - - '"AlreadyExists" not in shell_result.stderr' - - name: certbot firstboot certificate for eucalyptus-cloud shell: | cat <<"EOF" | diff --git a/roles/cloud-post/tasks/console.yml b/roles/cloud-post/tasks/console.yml index 9a8f5d3..194648f 100644 --- a/roles/cloud-post/tasks/console.yml +++ b/roles/cloud-post/tasks/console.yml @@ -30,19 +30,6 @@ CONSOLE_ACCOUNT_NUMBER=$(euare-accountlist | grep "^${CONSOLE_ACCOUNT_ALIAS}[[:space:]]" | cut -f 2) euca-modify-image-attribute -l -a "${CONSOLE_ACCOUNT_NUMBER}" "${CONSOLE_IMAGEID}" -- name: console route53 system domain for eucalyptus-cloud authentication - shell: | - set -eu - eval $(clcadmin-assume-system-credentials) - euform-create-stack \ - --template-file /var/lib/eucalyptus/templates/eucalyptus-dns-template.yaml \ - eucalyptus-dns - register: shell_result - changed_when: '"AlreadyExists" not in shell_result.stderr' - failed_when: - - shell_result.rc != 0 - - '"AlreadyExists" not in shell_result.stderr' - - name: console elastic ip address stack shell: | set -eu diff --git a/roles/cloud-post/tasks/main.yml b/roles/cloud-post/tasks/main.yml index 16662cd..927f36f 100644 --- a/roles/cloud-post/tasks/main.yml +++ b/roles/cloud-post/tasks/main.yml @@ -12,6 +12,19 @@ - import_tasks: vpcmido.yml when: net_mode == "VPCMIDO" +- name: route53 system domain setup + shell: | + set -eu + eval $(clcadmin-assume-system-credentials) + euform-create-stack \ + --template-file /var/lib/eucalyptus/templates/eucalyptus-dns-template.yaml \ + eucalyptus-dns + register: shell_result + changed_when: '"AlreadyExists" not in shell_result.stderr' + failed_when: + - shell_result.rc != 0 + - '"AlreadyExists" not in shell_result.stderr' + - import_tasks: console.yml when: eucalyptus_console_cloud_deploy and net_mode == "VPCMIDO" diff --git a/roles/console/defaults/main.yml b/roles/console/defaults/main.yml index 3690e4a..da51d44 100644 --- a/roles/console/defaults/main.yml +++ b/roles/console/defaults/main.yml @@ -8,6 +8,7 @@ eucaconsole_ats_product_url: https://www.appscale.com/product/ eucaconsole_firewalld_configure: yes eucaconsole_package_version: "" eucaconsole_package_suffix: "{{ ( '-' + eucaconsole_package_version ) if eucaconsole_package_version else eucalyptus_package_suffix }}" +eucalyptus_console_cname: "ec2.{{ cloud_system_dns_dnsdomain | default('localhost') }}" # Certbot eucaconsole_certbot_configure: no diff --git a/roles/console/tasks/certbot.yml b/roles/console/tasks/certbot.yml index 1910926..28dfe03 100644 --- a/roles/console/tasks/certbot.yml +++ b/roles/console/tasks/certbot.yml @@ -8,6 +8,12 @@ tags: - packages +- name: fix issues with latest CentOS 7 + yum: + name: python-s3transfer.0.1.13-1.el7.0.1 + allow_downgrade: yes + state: present + - name: certbot configuration to issue for service endpoints set_fact: eucaconsole_certbot_domain: "{{ eucaconsole_certbot_domain }},{{ eucaconsole_certbot_services | map('regex_replace', '^(.*)$', '\\1.' + cloud_system_dns_dnsdomain) | list | unique | sort | join(',') }}" diff --git a/roles/console/tasks/main.yml b/roles/console/tasks/main.yml index eb65a5d..af6d9a1 100644 --- a/roles/console/tasks/main.yml +++ b/roles/console/tasks/main.yml @@ -67,11 +67,11 @@ - http - https -- name: certbot system domain for eucalyptus-cloud +- name: update console route53 entry for eucalyptus-cloud shell: | set -eu eval $(clcadmin-assume-system-credentials) - euform-create-stack \ + euform-update-stack \ --template-file /var/lib/eucalyptus/templates/eucalyptus-dns-template.yaml \ -p ConsoleCname={{ eucalyptus_console_cname | default | quote }} \ -p ConsoleIpAddress={{ eucalyptus_console_ipv4 | default | quote }} \ @@ -79,16 +79,17 @@ delegate_to: "{{ groups.cloud[0] }}" when: eucalyptus_console_cname is defined or eucalyptus_console_ipv4 is defined register: shell_result - changed_when: '"AlreadyExists" not in shell_result.stderr' + changed_when: '"No updates are to be performed" not in shell_result.stderr' failed_when: - shell_result.rc != 0 - - '"AlreadyExists" not in shell_result.stderr' + - '"No updates are to be performed" not in shell_result.stderr' + - name: wait for certbot system domain for eucalyptus-cloud stack shell: | set -euo pipefail eval $(clcadmin-assume-system-credentials) - euform-describe-stacks eucalyptus-dns | grep CREATE_COMPLETE + euform-describe-stacks eucalyptus-dns | grep UPDATE_COMPLETE delegate_to: "{{ groups.cloud[0] }}" when: (eucalyptus_console_cname is defined or eucalyptus_console_ipv4 is defined) and shell_result.changed register: shell_result From b5de7a20b464d26d95723a240caab9f594edb2fe Mon Sep 17 00:00:00 2001 From: graziano obertelli Date: Thu, 13 Oct 2022 18:04:20 -0700 Subject: [PATCH 08/17] Allow the update of the instances type Allow for the updates of the instances type template to be able to change what is available on the deployment. --- roles/cloud-post/defaults/main.yml | 9 ++++++++ roles/cloud-post/tasks/main.yml | 35 ++++++++++++++++++++++++++++-- 2 files changed, 42 insertions(+), 2 deletions(-) diff --git a/roles/cloud-post/defaults/main.yml b/roles/cloud-post/defaults/main.yml index e1df427..3a0c1b6 100644 --- a/roles/cloud-post/defaults/main.yml +++ b/roles/cloud-post/defaults/main.yml @@ -15,6 +15,15 @@ eucalyptus_console_product: "{{ eucalyptus_product|default('eucalyptus') }}" eucalyptus_monitoring_enable: no eucalyptus_monitoring_account: cloud-monitoring +# Instance types to enable +enable_M1_instances: False +enable_M2_instances: False +enable_M3_instances: False +enable_M4_instances: False +enable_M5D_instances: False +enable_T1_instances: False +enable_T3_instances: False + # Certbot for eucalyptus-cloud eucalyptus_services_certbot_enable: no eucalyptus_services_certbot_email: "" diff --git a/roles/cloud-post/tasks/main.yml b/roles/cloud-post/tasks/main.yml index 927f36f..2dc6347 100644 --- a/roles/cloud-post/tasks/main.yml +++ b/roles/cloud-post/tasks/main.yml @@ -79,16 +79,47 @@ name: dnsdist@eucalyptus when: cloud_dns_authoritative_balancer|default(False) -- name: add T3 instances type +- name: add basics instances type shell: | set -eu eval $(clcadmin-assume-system-credentials) euform-create-stack \ --template-file /usr/share/eucalyptus/doc/ec2-instance-types-general.yaml \ - -p EnableT3=True \ ec2-instance-types-general register: shell_result changed_when: '"AlreadyExists" not in shell_result.stderr' failed_when: - shell_result.rc != 0 - '"Stack already exists" not in shell_result.stderr' + +- name: wait for basic instances type template to complete + shell: | + set -euo pipefail + eval $(clcadmin-assume-system-credentials) + euform-describe-stacks ec2-instance-types-general | grep _COMPLETE + register: shell_result + changed_when: False + until: shell_result is succeeded + retries: 5 + delay: 30 + +- name: add more instances type as configured + shell: | + set -eu + eval $(clcadmin-assume-system-credentials) + euform-update-stack \ + --template-file /usr/share/eucalyptus/doc/ec2-instance-types-general.yaml \ + -p EnableM1={{ enable_M1_instances |default(False) }}\ + -p EnableM2={{ enable_M2_instances |default(False) }}\ + -p EnableM3={{ enable_M3_instances |default(False) }}\ + -p EnableM4={{ enable_M4_instances |default(False) }}\ + -p EnableM5D={{ enable_M5D_instances |default(False) }}\ + -p EnableT1={{ enable_T1_instances |default(False) }}\ + -p EnableT3={{ enable_T3_instances |default(False) }}\ + ec2-instance-types-general + register: shell_result + changed_when: '"No updates are to be performed" not in shell_result.stderr' + failed_when: + - shell_result.rc != 0 + - '"No updates are to be performed" not in shell_result.stderr' + From 271f09926ddcdc85f432775d2ab994272e38b119 Mon Sep 17 00:00:00 2001 From: graziano obertelli Date: Thu, 13 Oct 2022 19:17:09 -0700 Subject: [PATCH 09/17] Enable dnsmasq by default --- README.md | 60 ++++++++++++++++++++++++++++++--- roles/cloud-post/tasks/main.yml | 8 +++++ roles/common/defaults/main.yml | 2 +- 3 files changed, 64 insertions(+), 6 deletions(-) diff --git a/README.md b/README.md index feddc81..023e3bb 100644 --- a/README.md +++ b/README.md @@ -30,23 +30,73 @@ vi inventory.yml ## Configuration -The important options to set up are: +To operate the cloud __will need__ a subdomain, and a set of public IPs to be used for the instances and services. The options to set them up are: ``` -cloud_system_dns_dnsdomain= -vpcmido_public_ip_cidr= +cloud_system_dns_dnsdomain: ``` the DNS subdomain needs to be delegated to the cloud (CLC) machine. For -example to delegate ats.mydomain.foo with dnsmasq you cam add: +example to delegate _ats.mydomain.foo_ with dnsmasq add to dnsmasq configuration (for bind or other DNS server, follow their respective documentation): ``` server=/ats.mydomain.foo/ ``` -to enable the delegation. +to enable the delegation. For the public IPs, you will need to define the network they are in and list them: +``` +vpcmido_public_ip_cidr: +vpcmido_public_ip_range: +``` + +## Configuration Options +There are few variables to use to configure the cloud: + +``` +cloud_firewalld_configure: yes +``` +default is no, but without this one you either disable firewalld or you configure it by hand; + +``` +cloud_use_dnsmasq: no +``` +default is yes and it is recommended to keep it. Without a local dnsmasq running on the CLC configured to delegate the subdomain to the CLC, your deployment will depends on external DNS server to operate some functionalities (for example ELBs and more); + +``` +ceph_osd_data_path: + - /dev/sdg + - /dev/sdh +``` +if you choose to let this script setup ceph for you, this is the list (1 or more) of hard disks to delegate to each ceph machine. The disks needs to be empty, without tags; +``` +cloud_region_name: my_lovely_cloud +``` +you can customize here your deployment region's name (from the unimaginative default of cloud-1); + +``` +cloud_zone_1_name: developers +cloud_zone_2_name: sales +cloud_zone_3_name: production +``` +you can customize here the name if each AZ you have configured. Defaults is to add _a_, _b_ etc... to the deployment name; + +``` +eucalyptus_console_cname: ec2.clouddns_subdomain +``` +this is the CNAME to be used with your deployment Route53 to set an entry for the console. The default assumes you installed the eucaconsole on the CLC machine, and thus we add an entry of _ec2.your_dns_cloud_subdomain_. If you prefer to set a full A record instead add also _eucalyptus_console_ipv4: IP_address_; + +``` +enable_M1_instances: False +enable_M2_instances: False +enable_M3_instances: False +enable_M4_instances: False +enable_M5D_instances: False +enable_T1_instances: False +enable_T3_instances: False +``` +turns each one of the above to True to have more instance types available in your deployment. ## Installing the different networks mode diff --git a/roles/cloud-post/tasks/main.yml b/roles/cloud-post/tasks/main.yml index 927f36f..6eeb348 100644 --- a/roles/cloud-post/tasks/main.yml +++ b/roles/cloud-post/tasks/main.yml @@ -92,3 +92,11 @@ failed_when: - shell_result.rc != 0 - '"Stack already exists" not in shell_result.stderr' + +- name: restart dnsmasq service + systemd: + enabled: true + state: restarted + name: dnsmasq + when: cloud_use_dnsmasq + diff --git a/roles/common/defaults/main.yml b/roles/common/defaults/main.yml index d715844..baa5ffe 100644 --- a/roles/common/defaults/main.yml +++ b/roles/common/defaults/main.yml @@ -92,7 +92,7 @@ net_node_router_ip: "{{ edge_router_ip }}" # DNS Settings cloud_dns_authoritative_balancer: no -cloud_use_dnsmasq: no +cloud_use_dnsmasq: yes # Role settings key_facts: no From da6750cacc184568ff47a543f42a6ed13d05e72e Mon Sep 17 00:00:00 2001 From: graziano obertelli Date: Fri, 14 Oct 2022 04:23:17 +0200 Subject: [PATCH 10/17] Update main.yml --- roles/cloud-post/tasks/main.yml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/roles/cloud-post/tasks/main.yml b/roles/cloud-post/tasks/main.yml index c7226f1..ce5b792 100644 --- a/roles/cloud-post/tasks/main.yml +++ b/roles/cloud-post/tasks/main.yml @@ -128,4 +128,5 @@ enabled: true state: restarted name: dnsmasq - when: cloud_use_dnsmasq \ No newline at end of file + when: cloud_use_dnsmasq + From 83263219529d5937c9ddbbc033a11568d374ebc9 Mon Sep 17 00:00:00 2001 From: graziano obertelli Date: Thu, 13 Oct 2022 20:18:15 -0700 Subject: [PATCH 11/17] Don't use variable not defined We cannot restart here dnsmasq using a variable which is not defined in this role. For now, if some resposne are not right after re-running the playbook (while changing route53) we may need to wait the reload dnsmasq by hand. --- roles/cloud-post/tasks/main.yml | 7 ------- 1 file changed, 7 deletions(-) diff --git a/roles/cloud-post/tasks/main.yml b/roles/cloud-post/tasks/main.yml index ce5b792..2dc6347 100644 --- a/roles/cloud-post/tasks/main.yml +++ b/roles/cloud-post/tasks/main.yml @@ -123,10 +123,3 @@ - shell_result.rc != 0 - '"No updates are to be performed" not in shell_result.stderr' -- name: restart dnsmasq service - systemd: - enabled: true - state: restarted - name: dnsmasq - when: cloud_use_dnsmasq - From 4b8151674a99e09524668d7e5abe87246877903d Mon Sep 17 00:00:00 2001 From: graziano obertelli Date: Mon, 31 Oct 2022 16:51:50 -0700 Subject: [PATCH 12/17] Adjust some ceph options Make sure we have the balancer set up, as well as raise the basic number of pg and added the ceph_osd_pool_pgnum to the README to explicitly encourage to configure it on a per deployment basis. --- README.md | 6 ++++++ inventory_example_local.yml | 1 + roles/ceph-common/defaults/main.yml | 2 +- roles/ceph/files/ceph-euca-setup.sh | 2 ++ 4 files changed, 10 insertions(+), 1 deletion(-) diff --git a/README.md b/README.md index 023e3bb..7e438b5 100644 --- a/README.md +++ b/README.md @@ -162,3 +162,9 @@ and ceph_private_ipv4. Without any specification the Eucalyputs public and cluster networks will be used. + +``` +ceph_osd_pool_pgnum: 256 +``` +This value should be adjusted to the specific ceph deployments (number of +OSDs, nodes, expected use etc...). diff --git a/inventory_example_local.yml b/inventory_example_local.yml index 6e163bd..61c019c 100644 --- a/inventory_example_local.yml +++ b/inventory_example_local.yml @@ -29,6 +29,7 @@ all: midonet_zookeeper_heap: 512m midonet_cluster_heap: 512m midonet_midolman_heap: 512m + ceph_osd_pool_pgnum: 16 # If using EDGE then br0 must be configured and these # ip address ranges should be updated diff --git a/roles/ceph-common/defaults/main.yml b/roles/ceph-common/defaults/main.yml index 68cf60d..4e73042 100644 --- a/roles/ceph-common/defaults/main.yml +++ b/roles/ceph-common/defaults/main.yml @@ -12,7 +12,7 @@ ceph_osd_volume_pool: eucavolumes ceph_osd_snapshot_pool: eucasnapshots -ceph_osd_pool_pgnum: 16 +ceph_osd_pool_pgnum: 256 ceph_rgw_uid: eucas3 diff --git a/roles/ceph/files/ceph-euca-setup.sh b/roles/ceph/files/ceph-euca-setup.sh index b4b8eaf..03063cd 100644 --- a/roles/ceph/files/ceph-euca-setup.sh +++ b/roles/ceph/files/ceph-euca-setup.sh @@ -14,6 +14,8 @@ if ! ceph osd pool ls | grep -q ${EUCA_CEPH_VOLUME_POOL_NAME} ; then echo "Generating volume pool ${EUCA_CEPH_VOLUME_POOL_NAME}" ceph osd pool create ${EUCA_CEPH_VOLUME_POOL_NAME} ${EUCA_POOL_PLACEMENT_GROUPS} ceph osd pool application enable ${EUCA_CEPH_VOLUME_POOL_NAME} rbd 2>/dev/null || true + ceph balancer mode upmap + ceph balancer on fi if [ "${EUCA_CEPH_VOLUME_POOL_NAME}" != "${EUCA_CEPH_SNAPSHOT_POOL_NAME}" ] ; then From 6a392ac8af55a4169bf51fb9192dee5bcb568caa Mon Sep 17 00:00:00 2001 From: graziano obertelli Date: Mon, 7 Nov 2022 16:20:06 -0800 Subject: [PATCH 13/17] Fix release to nautilus Fixing the release allow to set a minum client, thus to allow the balancer to start by default and remove the ceph warning. --- roles/ceph-common/defaults/main.yml | 2 +- roles/ceph/files/ceph-euca-setup.sh | 6 ++++-- roles/console/tasks/certbot.yml | 5 ++++- 3 files changed, 9 insertions(+), 4 deletions(-) diff --git a/roles/ceph-common/defaults/main.yml b/roles/ceph-common/defaults/main.yml index 4e73042..91fce18 100644 --- a/roles/ceph-common/defaults/main.yml +++ b/roles/ceph-common/defaults/main.yml @@ -1,5 +1,5 @@ --- -ceph_release: jewel +ceph_release: nautilus ceph_public_network: 192.168.0.0/16 diff --git a/roles/ceph/files/ceph-euca-setup.sh b/roles/ceph/files/ceph-euca-setup.sh index 03063cd..e0aef7a 100644 --- a/roles/ceph/files/ceph-euca-setup.sh +++ b/roles/ceph/files/ceph-euca-setup.sh @@ -14,8 +14,6 @@ if ! ceph osd pool ls | grep -q ${EUCA_CEPH_VOLUME_POOL_NAME} ; then echo "Generating volume pool ${EUCA_CEPH_VOLUME_POOL_NAME}" ceph osd pool create ${EUCA_CEPH_VOLUME_POOL_NAME} ${EUCA_POOL_PLACEMENT_GROUPS} ceph osd pool application enable ${EUCA_CEPH_VOLUME_POOL_NAME} rbd 2>/dev/null || true - ceph balancer mode upmap - ceph balancer on fi if [ "${EUCA_CEPH_VOLUME_POOL_NAME}" != "${EUCA_CEPH_SNAPSHOT_POOL_NAME}" ] ; then @@ -28,6 +26,10 @@ fi if [ -n "${EUCA_CEPH_MIN_CLIENT}" ] ; then ceph osd set-require-min-compat-client "${EUCA_CEPH_MIN_CLIENT}" + if [[ "${EUCA_CEPH_MIN_CLIENT:0:1}" > "l" ]]; then + ceph balancer mode upmap + ceph balancer on + fi fi if [ ! -e "${EUCA_CEPH_ARTIFACTS_DIR}" ] ; then diff --git a/roles/console/tasks/certbot.yml b/roles/console/tasks/certbot.yml index 28dfe03..073e542 100644 --- a/roles/console/tasks/certbot.yml +++ b/roles/console/tasks/certbot.yml @@ -3,7 +3,10 @@ - name: install certbot package yum: - name: certbot + name: + - certbot + - python2-certbot-dns-route53 + - python2-futures state: present tags: - packages From eaff8160b5729bf1a032f7bef71f1e3368a648d6 Mon Sep 17 00:00:00 2001 From: graziano obertelli Date: Tue, 8 Nov 2022 11:31:21 -0800 Subject: [PATCH 14/17] Enable pg_autoscaler With the switch to nautilus, we can now enable the autoscaler by default. More wise ceph users may take the rein and do tune the ceph cluster, but with autoscaler and balancer enabled the ceph cluster should usable in most cases. --- README.md | 5 ----- roles/ceph-common/defaults/main.yml | 2 +- roles/ceph/files/ceph-euca-setup.sh | 8 ++++++++ 3 files changed, 9 insertions(+), 6 deletions(-) diff --git a/README.md b/README.md index 7e438b5..ac6e308 100644 --- a/README.md +++ b/README.md @@ -163,8 +163,3 @@ and ceph_private_ipv4. Without any specification the Eucalyputs public and cluster networks will be used. -``` -ceph_osd_pool_pgnum: 256 -``` -This value should be adjusted to the specific ceph deployments (number of -OSDs, nodes, expected use etc...). diff --git a/roles/ceph-common/defaults/main.yml b/roles/ceph-common/defaults/main.yml index 91fce18..81fd7b6 100644 --- a/roles/ceph-common/defaults/main.yml +++ b/roles/ceph-common/defaults/main.yml @@ -12,7 +12,7 @@ ceph_osd_volume_pool: eucavolumes ceph_osd_snapshot_pool: eucasnapshots -ceph_osd_pool_pgnum: 256 +ceph_osd_pool_pgnum: 16 ceph_rgw_uid: eucas3 diff --git a/roles/ceph/files/ceph-euca-setup.sh b/roles/ceph/files/ceph-euca-setup.sh index e0aef7a..74484e4 100644 --- a/roles/ceph/files/ceph-euca-setup.sh +++ b/roles/ceph/files/ceph-euca-setup.sh @@ -14,6 +14,10 @@ if ! ceph osd pool ls | grep -q ${EUCA_CEPH_VOLUME_POOL_NAME} ; then echo "Generating volume pool ${EUCA_CEPH_VOLUME_POOL_NAME}" ceph osd pool create ${EUCA_CEPH_VOLUME_POOL_NAME} ${EUCA_POOL_PLACEMENT_GROUPS} ceph osd pool application enable ${EUCA_CEPH_VOLUME_POOL_NAME} rbd 2>/dev/null || true + if [[ "${EUCA_CEPH_MIN_CLIENT:0:1}" > "l" ]]; then + ceph mgr module enable pg_autoscaler + ceph osd pool set ${EUCA_CEPH_VOLUME_POOL_NAME} pg_autoscale_mode on + fi fi if [ "${EUCA_CEPH_VOLUME_POOL_NAME}" != "${EUCA_CEPH_SNAPSHOT_POOL_NAME}" ] ; then @@ -21,6 +25,10 @@ if [ "${EUCA_CEPH_VOLUME_POOL_NAME}" != "${EUCA_CEPH_SNAPSHOT_POOL_NAME}" ] ; th echo "Generating snapshot pool ${EUCA_CEPH_SNAPSHOT_POOL_NAME}" ceph osd pool create ${EUCA_CEPH_SNAPSHOT_POOL_NAME} ${EUCA_POOL_PLACEMENT_GROUPS} ceph osd pool application enable ${EUCA_CEPH_SNAPSHOT_POOL_NAME} rbd 2>/dev/null || true + if [[ "${EUCA_CEPH_MIN_CLIENT:0:1}" > "l" ]]; then + ceph mgr module enable pg_autoscaler + ceph osd pool set ${EUCA_CEPH_SNAPSHOT_POOL_NAME} pg_autoscale_mode on + fi fi fi From 6f6632dd02e1f6805f4db8a2ffba67949dd98fd7 Mon Sep 17 00:00:00 2001 From: graziano obertelli Date: Tue, 8 Nov 2022 11:34:51 -0800 Subject: [PATCH 15/17] Remove fixes for Certbot These 'fixes' seems not to work as expexted colliding with ceph installation and other problems. They also seem to be obsolete, at least in few installation cases. We will have to leave it to the user to fix it if they run into problem. --- roles/cloud-post/tasks/certbot.yml | 6 ------ roles/console/tasks/certbot.yml | 6 ------ 2 files changed, 12 deletions(-) diff --git a/roles/cloud-post/tasks/certbot.yml b/roles/cloud-post/tasks/certbot.yml index 10fb83d..3dd4364 100644 --- a/roles/cloud-post/tasks/certbot.yml +++ b/roles/cloud-post/tasks/certbot.yml @@ -11,12 +11,6 @@ tags: - packages -- name: fix issues with latest CentOS 7 - yum: - name: python-s3transfer.0.1.13-1.el7.0.1 - allow_downgrade: yes - state: present - - name: certbot-renew service.d directory file: path: /etc/systemd/system/certbot-renew.service.d diff --git a/roles/console/tasks/certbot.yml b/roles/console/tasks/certbot.yml index 073e542..00ddfc7 100644 --- a/roles/console/tasks/certbot.yml +++ b/roles/console/tasks/certbot.yml @@ -11,12 +11,6 @@ tags: - packages -- name: fix issues with latest CentOS 7 - yum: - name: python-s3transfer.0.1.13-1.el7.0.1 - allow_downgrade: yes - state: present - - name: certbot configuration to issue for service endpoints set_fact: eucaconsole_certbot_domain: "{{ eucaconsole_certbot_domain }},{{ eucaconsole_certbot_services | map('regex_replace', '^(.*)$', '\\1.' + cloud_system_dns_dnsdomain) | list | unique | sort | join(',') }}" From 39084ec27213ab745772467537546e7ba7e306ab Mon Sep 17 00:00:00 2001 From: graziano obertelli Date: Tue, 8 Nov 2022 14:32:17 -0800 Subject: [PATCH 16/17] Allow console to use cert from system certbot In case we alredy have certbot for the system' servives, we do not need to run yet another certbot to get the console's cert: we can simply reuse what's already available. This patch move the certbot configuration for the cloud from cloud-post to cloud (thus making sure we have the certbot before we start the console), and change the certbot configuation of the console to not run certbot again if we already have the cert. --- roles/cloud-post/defaults/main.yml | 5 ---- roles/cloud-post/tasks/main.yml | 16 ------------ roles/{cloud-post => cloud}/tasks/certbot.yml | 0 roles/cloud/tasks/main.yml | 16 ++++++++++++ roles/common/defaults/main.yml | 6 +++++ roles/console/defaults/main.yml | 2 +- roles/console/tasks/certbot.yml | 25 ++++++++++++++++++- 7 files changed, 47 insertions(+), 23 deletions(-) rename roles/{cloud-post => cloud}/tasks/certbot.yml (100%) diff --git a/roles/cloud-post/defaults/main.yml b/roles/cloud-post/defaults/main.yml index 3a0c1b6..04bf4e4 100644 --- a/roles/cloud-post/defaults/main.yml +++ b/roles/cloud-post/defaults/main.yml @@ -24,8 +24,3 @@ enable_M5D_instances: False enable_T1_instances: False enable_T3_instances: False -# Certbot for eucalyptus-cloud -eucalyptus_services_certbot_enable: no -eucalyptus_services_certbot_email: "" -eucalyptus_services_certbot_certonly_opts: "--no-eff-email" -eucalyptus_services_endpoints: ['*', '*.s3'] diff --git a/roles/cloud-post/tasks/main.yml b/roles/cloud-post/tasks/main.yml index 2dc6347..d6f0db5 100644 --- a/roles/cloud-post/tasks/main.yml +++ b/roles/cloud-post/tasks/main.yml @@ -12,28 +12,12 @@ - import_tasks: vpcmido.yml when: net_mode == "VPCMIDO" -- name: route53 system domain setup - shell: | - set -eu - eval $(clcadmin-assume-system-credentials) - euform-create-stack \ - --template-file /var/lib/eucalyptus/templates/eucalyptus-dns-template.yaml \ - eucalyptus-dns - register: shell_result - changed_when: '"AlreadyExists" not in shell_result.stderr' - failed_when: - - shell_result.rc != 0 - - '"AlreadyExists" not in shell_result.stderr' - - import_tasks: console.yml when: eucalyptus_console_cloud_deploy and net_mode == "VPCMIDO" - import_tasks: monitoring.yml when: eucalyptus_monitoring_enable -- import_tasks: certbot.yml - when: eucalyptus_services_certbot_enable - - name: enable imaging service shell: | set -eu diff --git a/roles/cloud-post/tasks/certbot.yml b/roles/cloud/tasks/certbot.yml similarity index 100% rename from roles/cloud-post/tasks/certbot.yml rename to roles/cloud/tasks/certbot.yml diff --git a/roles/cloud/tasks/main.yml b/roles/cloud/tasks/main.yml index e385e87..47b600a 100644 --- a/roles/cloud/tasks/main.yml +++ b/roles/cloud/tasks/main.yml @@ -414,3 +414,19 @@ register: shell_result changed_when: '"not changed" not in shell_result.stderr' when: (cloud_opts_tech_preview + cloud_opts_custom) is search(cloud_opts_tp_rds | regex_escape()) + +- name: route53 system domain setup + shell: | + set -eu + eval $(clcadmin-assume-system-credentials) + euform-create-stack \ + --template-file /var/lib/eucalyptus/templates/eucalyptus-dns-template.yaml \ + eucalyptus-dns + register: shell_result + changed_when: '"AlreadyExists" not in shell_result.stderr' + failed_when: + - shell_result.rc != 0 + - '"AlreadyExists" not in shell_result.stderr' + +- import_tasks: certbot.yml + when: eucalyptus_services_certbot_enable diff --git a/roles/common/defaults/main.yml b/roles/common/defaults/main.yml index baa5ffe..8623df6 100644 --- a/roles/common/defaults/main.yml +++ b/roles/common/defaults/main.yml @@ -64,6 +64,12 @@ cloud_instances_conf_max_cores: "{{ cloud_instances.conf.max_cores }}" cloud_instances_conf_max_mem: "{{ cloud_instances.conf.max_mem }}" cloud_instances_conf_custom: "{{ cloud_instances.conf.custom }}" +# Certbot for eucalyptus-cloud +eucalyptus_services_certbot_enable: no +eucalyptus_services_certbot_email: "" +eucalyptus_services_certbot_certonly_opts: "--no-eff-email" +eucalyptus_services_endpoints: ['*', '*.s3'] + # EDGE network settings edge_router_enabled: Y edge_router_ip: AUTO diff --git a/roles/console/defaults/main.yml b/roles/console/defaults/main.yml index da51d44..2a6ed44 100644 --- a/roles/console/defaults/main.yml +++ b/roles/console/defaults/main.yml @@ -11,7 +11,7 @@ eucaconsole_package_suffix: "{{ ( '-' + eucaconsole_package_version ) if eucacon eucalyptus_console_cname: "ec2.{{ cloud_system_dns_dnsdomain | default('localhost') }}" # Certbot -eucaconsole_certbot_configure: no +eucaconsole_certbot_configure: "{{ eucalyptus_services_certbot_enable }}" eucaconsole_certbot_domain: "console.{{ cloud_system_dns_dnsdomain | default('localhost') }}" eucaconsole_certbot_email: "" eucaconsole_certbot_certonly_opts: "--no-eff-email" diff --git a/roles/console/tasks/certbot.yml b/roles/console/tasks/certbot.yml index 00ddfc7..8b381c4 100644 --- a/roles/console/tasks/certbot.yml +++ b/roles/console/tasks/certbot.yml @@ -47,12 +47,35 @@ until: shell_result is succeeded retries: 5 delay: 30 + when: not eucalyptus_services_certbot_enable + + +- name: eucaconsole set link to cert + ansible.builtin.file: + src: /etc/letsencrypt/live/eucalyptus-cloud/fullchain.pem + dest: /etc/pki/tls/certs/eucaconsole.crt + owner: root + group: root + force: yes + state: link + when: eucalyptus_services_certbot_enable + +- name: eucaconsole set linlk to cert private key + ansible.builtin.file: + src: /etc/letsencrypt/live/eucalyptus-cloud/privkey.pem + dest: /etc/pki/tls/certs/eucaconsole.key + owner: root + group: root + force: yes + state: link + when: eucalyptus_services_certbot_enable - name: eucaconsole certbot https renewal systemd: enabled: true state: started name: certbot-renew.timer + when: not eucalyptus_services_certbot_enable - name: configure cloud property for services https shell: | @@ -60,4 +83,4 @@ eval $(clcadmin-assume-system-credentials) euctl bootstrap.webservices.ssl.server_alias=eucalyptus-cloud delegate_to: "{{ groups.cloud[0] }}" - when: eucaconsole_certbot_request_service_domains and cloud_system_dns_dnsdomain + when: eucaconsole_certbot_request_service_domains and cloud_system_dns_dnsdomain and not eucalyptus_services_certbot_enable From 9118f25d54fadb9565e8e022dd8a7bd94af6671f Mon Sep 17 00:00:00 2001 From: graziano obertelli Date: Tue, 8 Nov 2022 16:46:54 -0800 Subject: [PATCH 17/17] Move template along certbot task Moved also template and file used by the cerbot task. --- .../files/certbot-renew-eucalyptus-cloud.conf | 0 roles/{cloud-post => cloud}/templates/botocore-endpoints.json.j2 | 0 2 files changed, 0 insertions(+), 0 deletions(-) rename roles/{cloud-post => cloud}/files/certbot-renew-eucalyptus-cloud.conf (100%) rename roles/{cloud-post => cloud}/templates/botocore-endpoints.json.j2 (100%) diff --git a/roles/cloud-post/files/certbot-renew-eucalyptus-cloud.conf b/roles/cloud/files/certbot-renew-eucalyptus-cloud.conf similarity index 100% rename from roles/cloud-post/files/certbot-renew-eucalyptus-cloud.conf rename to roles/cloud/files/certbot-renew-eucalyptus-cloud.conf diff --git a/roles/cloud-post/templates/botocore-endpoints.json.j2 b/roles/cloud/templates/botocore-endpoints.json.j2 similarity index 100% rename from roles/cloud-post/templates/botocore-endpoints.json.j2 rename to roles/cloud/templates/botocore-endpoints.json.j2