/
main.yml
273 lines (239 loc) · 12.6 KB
/
main.yml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
---
# Copyright 2016 Internet Solutions (Pty) Ltd
# Copyright 2017 IBM Corp
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
#
# (c) 2016 Donovan Francesco <donovan.francesco@is.co.za>
# (c) 2016 Paul Stevens <paul.stevens@is.co.za>
# Set the host which will execute the shade modules
# for the service setup. The host must already have
# clouds.yaml properly configured.
trove_service_setup_host: "{{ openstack_service_setup_host | default('localhost') }}"
trove_service_setup_host_python_interpreter: "{{ openstack_service_setup_host_python_interpreter | default((trove_service_setup_host == 'localhost') | ternary(ansible_playbook_python, ansible_python['executable'])) }}"
trove_package_state: "latest"
trove_pip_package_state: "latest"
debug: false
trove_system_group_name: trove
trove_system_user_name: trove
trove_system_user_comment: Trove System User
trove_system_user_shell: /bin/false
trove_system_user_home: "/var/lib/{{ trove_system_user_name }}"
trove_log_directory: /var/log/trove
trove_etc_directory: /etc/trove
trove_admin_user_name: admin_trove_user
trove_service_name: trove
trove_service_user_name: "{{ trove_admin_user_name }}"
trove_service_tenant_name: trove_for_trove_usage
trove_service_type: database
trove_service_description: "OpenStack DBaaS (Trove)"
trove_service_project_name: "{{ trove_service_tenant_name }}"
trove_service_admin_role_names:
- admin
trove_service_region: RegionOne
trove_service_host: "0.0.0.0"
trove_service_port: 8779
trove_service_proto: http
trove_service_publicuri_proto: "{{ openstack_service_publicuri_proto | default(trove_service_proto) }}"
trove_service_internaluri_proto: "{{ openstack_service_internaluri_proto | default(trove_service_proto) }}"
trove_service_adminuri_proto: "{{ openstack_service_adminuri_proto | default(trove_service_proto) }}"
trove_service_publicurl: "{{ trove_service_publicuri_proto }}://{{ external_lb_vip_address }}:{{ trove_service_port }}/v1.0/%(tenant_id)s"
trove_service_internalurl: "{{ trove_service_internaluri_proto }}://{{ internal_lb_vip_address }}:{{ trove_service_port }}/v1.0/%(tenant_id)s"
trove_service_adminurl: "{{ trove_service_adminuri_proto }}://{{ internal_lb_vip_address }}:{{ trove_service_port }}/v1.0/%(tenant_id)s"
trove_auth_url: "{{ keystone_service_internalurl }}"
# By default assume the trove service network is an internal one
# It would be good to use the catalog service to lookup these URLs based on the endpoint type
# but currently the Trove code doesn't work properly when endpoint types are specified
trove_nova_compute_url: "{{ trove_service_internaluri_proto }}://{{ internal_lb_vip_address }}:{{ nova_service_port }}/v2.1"
trove_cinder_url: "{{ trove_service_internaluri_proto }}://{{ internal_lb_vip_address }}:{{ cinder_service_port }}/v1"
trove_swift_url: "{{ trove_service_internaluri_proto }}://{{ internal_lb_vip_address }}:{{ swift_proxy_port }}/v1/AUTH_"
trove_neutron_url: "{{ trove_service_internaluri_proto }}://{{ internal_lb_vip_address }}:{{ neutron_service_port }}/"
trove_profiler_enabled: false
## Cap the maximum number of threads / workers when a user value is unspecified.
trove_api_workers_max: 16
trove_api_workers: "{{ [[ansible_processor_vcpus|default(2) // 2, 1] | max, trove_api_workers_max] | min }}"
## Cap the maximum number of threads / workers when a user value is unspecified.
trove_conductor_workers_max: 16
trove_conductor_workers: "{{ [[ansible_processor_vcpus|default(2) // 2, 1] | max, trove_conductor_workers_max] | min }}"
# Enable/Disable Ceilometer
trove_ceilometer_enabled: False
trove_pip_install_args: "{{ pip_install_options | default('') }}"
# Name of the virtual env to deploy into
trove_venv_tag: "{{ venv_tag | default('untagged') }}"
trove_bin: "/openstack/venvs/trove-{{ trove_venv_tag }}/bin"
trove_git_repo: "https://git.openstack.org/openstack/trove"
trove_git_install_branch: master
trove_upper_constraints_url: "{{ requirements_git_url | default('https://git.openstack.org/cgit/openstack/requirements/plain/upper-constraints.txt?h=' ~ requirements_git_install_branch | default('master')) }}"
trove_git_constraints:
- "git+{{ trove_git_repo }}@{{ trove_git_install_branch }}#egg=trove"
- "--constraint {{ trove_upper_constraints_url }}"
#: Set this to false to disable API service through Apache + mod_wsgi
trove_use_mod_wsgi: false
## Apache setup
trove_apache_log_level: info
trove_apache_servertokens: "Prod"
trove_apache_serversignature: "Off"
trove_wsgi_threads: 1
## Cap the maximum number of processes when a user value is unspecified.
trove_wsgi_processes_max: 32
trove_wsgi_processes: "{{ [[ansible_processor_vcpus|default(1), 1] | max * 2, trove_wsgi_processes_max] | min }}"
# set trove_ssl to true to enable SSL configuration on the trove containers
trove_ssl: false
trove_ssl_cert: /etc/ssl/certs/trove.pem
trove_ssl_key: /etc/ssl/private/trove.key
trove_ssl_ca_cert: /etc/ssl/certs/trove-ca.pem
trove_ssl_protocol: "{{ ssl_protocol | default('ALL -SSLv2 -SSLv3 -TLSv1.0 -TLSv1.1') }}"
trove_ssl_cipher_suite: "{{ ssl_cipher_suite | default('ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:RSA+AESGCM:RSA+AES:!aNULL:!MD5:!DSS') }}"
# if using a self-signed certificate, set this to true to regenerate it
trove_ssl_self_signed_regen: false
trove_ssl_self_signed_subject: "/C=US/ST=Texas/L=San Antonio/O=IT/CN={{ internal_lb_vip_address }}/subjectAltName=IP.1={{ external_lb_vip_address }}"
# Database vars
trove_db_setup_host: "{{ ('galera_all' in groups) | ternary(groups['galera_all'][0], 'localhost') }}"
trove_galera_address: "{{ galera_address | default('127.0.0.1') }}"
trove_galera_database_name: trove
trove_galera_user: trove
trove_db_sync_options:
trove_galera_use_ssl: "{{ galera_use_ssl | default(False) }}"
trove_galera_ssl_ca_cert: "{{ galera_ssl_ca_cert | default('/etc/ssl/certs/galera-ca.pem') }}"
trove_galera_connection_string: "mysql+pymysql://{{ trove_galera_user}}:{{ trove_galera_password }}@{{ trove_galera_address }}/{{ trove_galera_database_name }}?charset=utf8{% if trove_galera_use_ssl | bool %}&ssl_ca={{ trove_galera_ssl_ca_cert }}{% endif %}"
## Oslo Messaging vars
# RPC
trove_oslomsg_rpc_host_group: "{{ oslomsg_rpc_host_group | default('rabbitmq_all') }}"
trove_oslomsg_rpc_setup_host: "{{ (trove_oslomsg_rpc_host_group in groups) | ternary(groups[trove_oslomsg_rpc_host_group][0], 'localhost') }}"
trove_oslomsg_rpc_transport: "{{ oslomsg_rpc_transport | default('rabbit') }}"
trove_oslomsg_rpc_servers: "{{ oslomsg_rpc_servers | default('127.0.0.1') }}"
trove_oslomsg_rpc_port: "{{ oslomsg_rpc_port | default('5672') }}"
trove_oslomsg_rpc_use_ssl: "{{ oslomsg_rpc_use_ssl | default(False) }}"
trove_oslomsg_rpc_userid: trove
trove_oslomsg_rpc_vhost: /trove
# Notify
trove_oslomsg_notify_host_group: "{{ oslomsg_notify_host_group | default('rabbitmq_all') }}"
trove_oslomsg_notify_setup_host: "{{ (trove_oslomsg_notify_host_group in groups) | ternary(groups[trove_oslomsg_notify_host_group][0], 'localhost') }}"
trove_oslomsg_notify_transport: "{{ oslomsg_notify_transport | default('rabbit') }}"
trove_oslomsg_notify_servers: "{{ oslomsg_notify_servers | default('127.0.0.1') }}"
trove_oslomsg_notify_port: "{{ oslomsg_notify_port | default('5672') }}"
trove_oslomsg_notify_use_ssl: "{{ oslomsg_notify_use_ssl | default(False) }}"
trove_oslomsg_notify_userid: "{{ trove_oslomsg_rpc_userid }}"
trove_oslomsg_notify_password: "{{ trove_oslomsg_rpc_password }}"
trove_oslomsg_notify_vhost: "{{ trove_oslomsg_rpc_vhost }}"
## Qdrouterd integration
# TODO(ansmith): Change structure when more backends will be supported
trove_oslomsg_amqp1_enabled: "{{ trove_oslomsg_rpc_transport == 'amqp' }}"
# Specific pip packages provided by the user
trove_user_pip_packages: []
# Rabbit vars
trove_control_exchange: trove
trove_rabbit_notification_topic: notification
# The trove guest agent in the deployed DB VMs need access to OpenStack services (keystone, swift, etc)
# and also to rabbitmq. The way it gets access (networking) these services may differ.
# By default assume:
# OpenStack services are accesses through public interfaces
# Infrastructure services (rabbitmq) are accessed through the defined provider network.
#
# The value of 'net_name' field of the provider network network to use for infrastructure services
trove_provider_net_name: dbaas-mgmt
trove_provider_network: "{{ provider_networks|map(attribute='network')|selectattr('net_name','defined')|selectattr('net_name', 'equalto', trove_provider_net_name)|list|first }}"
# The value of 'ip_from_q' field
trove_provider_ip_from_q: "{{ trove_provider_network['ip_from_q'] }}"
# The name of the network address pool
trove_container_net_name: "{{ trove_provider_ip_from_q }}_address"
trove_guest_oslomsg_rpc_servers: "{{ oslomsg_rpc_servers | default('127.0.0.1') }}"
trove_guest_oslomsg_rpc_use_ssl: "{{ oslomsg_rpc_use_ssl | default(False) }}"
trove_guest_oslomsg_notify_servers: "{{ oslomsg_notify_servers | default('127.0.0.1') }}"
trove_guest_oslomsg_notify_use_ssl: "{{ oslomsg_notify_use_ssl | default(False) }}"
# For OpenStack services that have public, admin, and internal access, use the public ones for the guest VMs.
trove_guest_auth_url: "{{ keystone_service_publicurl }}"
trove_guest_swift_url: "{{ trove_service_publicuri_proto }}://{{ external_lb_vip_address }}:{{ swift_proxy_port }}/v1/AUTH_"
# Trove service network settings.
# These values are used when creating an OpenStack network to be used by Trove. By default the network will
# not be created.
trove_service_net_setup: False
trove_service_net_validate_certs: "False"
trove_service_net_phys_net: dbaas-mgmt
trove_service_net_type: flat
trove_service_net_name: dbaas_service_net
# Network segmentation ID if vlan, gre...
# trove_service_net_segmentation_id:
trove_service_subnet_name: dbaas_service_subnet
trove_service_net_subnet_cidr: "192.168.20.0/24"
trove_service_net_dhcp: "True"
trove_service_net_allocation_pool_start: "192.168.20.100"
trove_service_net_allocation_pool_end: "192.168.20.120"
trove_service_net_endpoint_type: internal
# RPC encryption keys
# See the Trove documentation as to the significance of the rpc encryption keys
# Trove supplies default values but we enforce they not be left to their default values
trove_enable_secure_rpc_messaging: "True"
trove_required_secrets:
- trove_galera_password
- trove_oslomsg_rpc_password
- trove_oslomsg_notify_password
- trove_service_password
- trove_admin_user_password
- trove_taskmanager_rpc_encr_key
- trove_inst_rpc_key_encr_key
# Keystone AuthToken/Middleware
trove_keystone_auth_plugin: "{{ trove_keystone_auth_type }}"
trove_keystone_auth_type: password
trove_service_project_domain_name: Default
trove_service_user_domain_name: default
trove_service_project_domain_id: default
trove_service_user_domain_id: default
#Glance images
trove_glance_images: []
trove_pip_packages:
- cryptography
- os-client-config
- osprofiler
- pexpect
- PyMySQL
- python-troveclient
- python-memcached
- trove
trove_optional_oslomsg_amqp1_pip_packages:
- oslo.messaging[amqp1]
# This variable is used by the repo_build process to determine
# which host group to check for members of before building the
# pip packages required by this role. The value is picked up
# by the py_pkgs lookup.
trove_role_project_group: trove_all
## Tunable overrides
trove_config_overrides: {}
trove_api_paste_ini_overrides: {}
trove_conductor_config_overrides: {}
trove_taskmanager_config_overrides: {}
trove_guestagent_config_overrides: {}
trove_policy_overrides: {}
trove_api_init_config_overrides: {}
trove_conductor_init_config_overrides: {}
trove_taskmanager_init_config_overrides: {}
## Service Name-Group Mapping
trove_services:
trove-api:
group: trove_api
service_name: trove-api
execstarts: "{{ trove_bin }}/trove-api"
init_config_overrides: "{{ trove_api_init_config_overrides }}"
start_order: 1
trove-conductor:
group: trove_conductor
service_name: trove-conductor
execstarts: "{{ trove_bin }}/trove-conductor"
init_config_overrides: "{{ trove_conductor_init_config_overrides }}"
start_order: 2
trove-taskmanager:
group: trove_taskmanager
service_name: trove-taskmanager
execstarts: "{{ trove_bin }}/trove-taskmanager"
init_config_overrides: "{{ trove_taskmanager_init_config_overrides }}"
start_order: 3