container_create.yml

---
# Copyright 2014, Rackspace US, Inc.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

- name: Check for lxc volume group
  shell: "(which vgs > /dev/null && vgs | grep -o '{{ lxc_container_vg_name }}') || false"
  register: vg_result
  failed_when: false
  changed_when: vg_result.rc != 0
  delegate_to: "{{ physical_host }}"
  tags:
    - lxc-container-vg-detect

- name: Set container backend "dir" if "lvm" not found
  set_fact:
     lxc_container_backing_store: dir
  when: vg_result.rc != 0
  tags:
    - lxc-container-vg-detect

- name: Container service directories
  file:
    path: "{{ item }}"
    state: "directory"
  with_items:
    - "/openstack/{{ inventory_hostname }}"
    - "/openstack/backup/{{ inventory_hostname }}"
    - "/openstack/log/{{ inventory_hostname }}"
    - "{{ lxc_container_directory }}/{{ inventory_hostname }}"
  delegate_to: "{{ physical_host }}"
  tags:
    - lxc-container-directories

- name: LXC autodev setup
  template:
    src: "autodev.j2"
    dest: "/var/lib/lxc/{{ inventory_hostname }}/autodev"
    owner: "root"
    group: "root"
    mode: "0755"
  delegate_to: "{{ physical_host }}"
  tags:
    - lxc-container-autodev

- name: Create container
  lxc_container:
    name: "{{ inventory_hostname }}"
    container_log: "true"
    config: "{{ properties.container_config|default(lxc_container_config) }}"
    template: "{{ properties.container_template|default(lxc_container_template) }}"
    state: started
    backing_store: "{{ properties.container_backing_store|default(lxc_container_backing_store) }}"
    directory: "{{ lxc_container_rootfs_directory }}"
    fs_size: "{{ properties.container_fs_size|default(lxc_container_fs_size) }}"
    fs_type: "{{ properties.container_fs_type|default(lxc_container_fs_type) }}"
    vg_name: "{{ properties.container_vg_name|default(lxc_container_vg_name) }}"
    template_options: "{{ lxc_container_template_options }}"
    container_command: |
      if [ -f  "/usr/lib/systemd/system/poweroff.target" ];then
        ln -sf /usr/lib/systemd/system/poweroff.target /etc/systemd/system/sigpwr.target || true
      fi
      ln -s /dev/null /etc/systemd/system/systemd-udevd.service || true
      ln -s /dev/null /etc/systemd/system/systemd-udevd-control.socket || true
      ln -s /dev/null /etc/systemd/system/systemd-udevd-kernel.socket || true
      ln -s /dev/null /etc/systemd/system/proc-sys-fs-binfmt_misc.automount || true
      echo -e '{{ lxc_container_default_interfaces }}' | tee /etc/network/interfaces
  delegate_to: "{{ physical_host }}"
  tags:
    - lxc-container-create

- name: Write container config
  lineinfile:
    dest: "/var/lib/lxc/{{ inventory_hostname }}/config"
    line: "{{ item }}"
    backup: "true"
  with_items:
    - "lxc.autodev = 1"
    - "lxc.pts = 1024"
    - "lxc.kmsg = 0"
    - "lxc.hook.autodev = /var/lib/lxc/{{ inventory_hostname }}/autodev"
  notify:
    - Lxc container restart
  delegate_to: "{{ physical_host }}"
  tags:
    - lxc-container-config

# NOTE(mhayden): The bind mount for Galera logs was broken through release
# 13.3.1. This task removes the incorrect bind mount from the LXC config file
# and allows the deployer to restart at a more convenient time. See
# https://bugs.launchpad.net/openstack-ansible/+bug/1609862 for details.
- name: Remove incorrect bind mount from galera container configuration (bug 1609862)
  lineinfile:
    dest: "/var/lib/lxc/{{ inventory_hostname }}/config"
    regexp: "^lxc.mount.entry\\s*=\\s*\\/openstack\\/log\\/[\\w_-]*\\svar\\/log\\/galera"
    state: absent
    backup: True
  register: bug_1609862_fix
  when:
    - "'_galera_' in inventory_hostname"
  delegate_to: "{{ physical_host }}"
  tags:
    - lxc-container-service-config

# NOTE(mhayden): This task adds in the correct bind mount for Galera logs, but
# it avoids a container restart. Note that the spaces between the param and
# value are *critical* here. Even though the next task has no spaces between
# the param and value, the lxc_container module will add spaces between them
# when it writes the actual LXC container configuration file. If the spaces are
# missing in this task, the following task will add a new line and restart
# the Galera containers, which can cause downtime.
- name: Add correct bind mount to galera container configuration (bug 1609862)
  lineinfile:
    dest: "/var/lib/lxc/{{ inventory_hostname }}/config"
    line: "lxc.mount.entry = /openstack/log/{{ inventory_hostname }} var/log/{{ properties.log_directory | default(properties.service_name) }} none defaults,bind,rw 0 0"
    state: present
    backup: True
  when:
    - bug_1609862_fix | changed
  delegate_to: "{{ physical_host }}"
  tags:
    - lxc-container-service-config

- name: Load container service mounts and profile
  lxc_container:
    name: "{{ inventory_hostname }}"
    container_command: |
      mkdir -p /var/backup
      mkdir -p /var/log/{{ properties.log_directory | default(properties.service_name) }}
    container_config:
      - "lxc.mount.entry=/openstack/backup/{{ inventory_hostname }} var/backup none defaults,bind,rw 0 0"
      - "lxc.mount.entry=/openstack/log/{{ inventory_hostname }} var/log/{{ properties.log_directory | default(properties.service_name) }} none defaults,bind,rw 0 0"
  when: properties.service_name is defined
  delegate_to: "{{ physical_host }}"
  tags:
    - lxc-container-service-config

- name: Container network interfaces
  lxc_container:
    name: "{{ inventory_hostname }}"
    container_command: |
      if [ ! -d "/etc/network/interfaces.d" ];then
        mkdir -p /etc/network/interfaces.d
      fi
      configmd5sum=$(md5sum /etc/network/interfaces.d/{{ item.value.interface }}.cfg 2>/dev/null)
      echo -e '{{ lxc_container_interface }}' | tee /etc/network/interfaces.d/{{ item.value.interface }}.cfg
      if ! md5sum -c --status <<< "$configmd5sum" 2>/dev/null; then
        ifdown {{ item.value.interface }}
        ifup {{ item.value.interface }}
      fi
  with_dict: container_networks|default({})
  delegate_to: "{{ physical_host }}"
  tags:
    - lxc-container-networks

- name: LXC host config for container networks
  template:
    src: "container-interface.ini.j2"
    dest: "/var/lib/lxc/{{ inventory_hostname }}/{{ item.value.interface }}.ini"
    owner: "root"
    group: "root"
    mode: "0644"
  with_dict: container_networks|default({})
  notify:
    - Lxc container restart
  delegate_to: "{{ physical_host }}"
  tags:
    - lxc-container-networks

# NOTE(major): the lxc.network.veth.pair line must appear *immediately* after
# the lxc.network.name congfiguration line or it will be ignored.  That's why
# you'll find a "insertafter" in this YAML block.
- name: Add veth pair name to match container name
  lineinfile:
    dest: "/var/lib/lxc/{{ inventory_hostname }}/config"
    line: "lxc.network.veth.pair = {{ inventory_hostname[-8:].replace('-', '').replace('_', '') }}_eth0"
    insertafter: "^lxc.network.name"
    backup: "true"
  delegate_to: "{{ physical_host }}"
  tags:
    - lxc-container-networks

- name: Container network includes
  lineinfile:
    dest: "/var/lib/lxc/{{ inventory_hostname }}/config"
    line: "lxc.include = /var/lib/lxc/{{ inventory_hostname }}/{{ item.value.interface }}.ini"
    backup: "true"
  with_dict: container_networks|default({})
  when: >
    item.value.interface is defined
  notify:
    - Lxc container restart
  delegate_to: "{{ physical_host }}"
  tags:
    - lxc-container-networks

# Adds post-down and pre-start hooks
- name: Drop veth cleanup script
  template:
    src: "veth-cleanup.sh.j2"
    dest: "/var/lib/lxc/{{ inventory_hostname }}/veth-cleanup.sh"
    owner: "root"
    group: "root"
    mode: "0755"
  delegate_to: "{{ physical_host }}"
  tags:
    - lxc-container-networks

# This is being defined due to an issue with dangling veth pairs.
#  TODO(someone) This should be removed once an upstream patch has
#  been submitted to either the kernel or LXC to fix the veth issues.
#  Container restart is not happening here because it's not needed.
- name: Defines a pre and post hook script
  lineinfile:
    dest: "/var/lib/lxc/{{ inventory_hostname }}/config"
    line: "{{ item }}"
    backup: "true"
  with_items:
    - "lxc.hook.pre-start = /var/lib/lxc/{{ inventory_hostname }}/veth-cleanup.sh"
    - "lxc.hook.post-stop = /var/lib/lxc/{{ inventory_hostname }}/veth-cleanup.sh"
  delegate_to: "{{ physical_host }}"
  tags:
    - lxc-container-networks

# Flush the handlers to ensure the container and networking is online.
- meta: flush_handlers

- name: Wait for ssh to be available
  local_action:
    module: wait_for
    port: "{{ ansible_ssh_port | default('22') }}"
    host: "{{ ansible_ssh_host | default(inventory_hostname) }}"
    search_regex: OpenSSH
    delay: "{{ lxc_container_ssh_delay }}"
  register: ssh_wait_check
  until: ssh_wait_check | success
  retries: 3
  tags:
    - lxc-container-networks

# Resets the container user's password using lxc_container because Python2.7
#  may not be installed at this point.
- name: Force container user password set
  lxc_container:
    name: "{{ inventory_hostname }}"
    container_command: |
      getent passwd "{{ lxc_container_user_name }}" &&
      echo "{{ lxc_container_user_name }}:{{ lxc_container_user_password }}" | chpasswd
  delegate_to: "{{ physical_host }}"
  no_log: True
  tags:
    - lxc-container-user-password-regen

- name: Install container proxy settings
  template:
    dest: "/etc/environment"
    src: "environment.j2"
    mode: "0644"
  remote_user: root
  when:
    - global_environment_variables is defined
  tags:
    - lxc-container-proxy