diff options
Diffstat (limited to 'ansible')
28 files changed, 3030 insertions, 0 deletions
diff --git a/ansible/action_plugins b/ansible/action_plugins new file mode 120000 index 0000000..660c351 --- /dev/null +++ b/ansible/action_plugins @@ -0,0 +1 @@ +./roles/ceph.ceph-common/plugins/actions/
\ No newline at end of file diff --git a/ansible/ansible.cfg b/ansible/ansible.cfg new file mode 100755 index 0000000..4a72589 --- /dev/null +++ b/ansible/ansible.cfg @@ -0,0 +1,46 @@ +# -*- encoding: utf-8 -*- +# ============LICENSE_START======================================================= +# org.onap.vvp/engagementmgr +# =================================================================== +# Copyright © 2017 AT&T Intellectual Property. All rights reserved. +# =================================================================== +# +# Unless otherwise specified, all software contained herein is licensed +# under the Apache License, Version 2.0 (the “License”); +# you may not use this software except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +# +# +# Unless otherwise specified, all documentation contained herein is licensed +# under the Creative Commons License, Attribution 4.0 Intl. (the “License”); +# you may not use this documentation except in compliance with the License. +# You may obtain a copy of the License at +# +# https://creativecommons.org/licenses/by/4.0/ +# +# Unless required by applicable law or agreed to in writing, documentation +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +# ============LICENSE_END============================================ +# +# ECOMP is a trademark and service mark of AT&T Intellectual Property. +[defaults] +roles_path=./roles/ +vault_password_file=.vault_password +action_plugins =./roles/ceph.ceph-common/plugins/actions +inventory =../zones/multi-node/inventory/ + +[ssh_connection] +ssh_args = -o ControlPersist=60s -o ControlMaster=auto -o ServerAliveInterval=10 -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no diff --git a/ansible/application.yml b/ansible/application.yml new file mode 100755 index 0000000..7e305cc --- /dev/null +++ b/ansible/application.yml @@ -0,0 +1,89 @@ +# -*- encoding: utf-8 -*- +# ============LICENSE_START======================================================= +# org.onap.vvp/engagementmgr +# =================================================================== +# Copyright © 2017 AT&T Intellectual Property. All rights reserved. +# =================================================================== +# +# Unless otherwise specified, all software contained herein is licensed +# under the Apache License, Version 2.0 (the “License”); +# you may not use this software except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +# +# +# Unless otherwise specified, all documentation contained herein is licensed +# under the Creative Commons License, Attribution 4.0 Intl. (the “License”); +# you may not use this documentation except in compliance with the License. +# You may obtain a copy of the License at +# +# https://creativecommons.org/licenses/by/4.0/ +# +# Unless required by applicable law or agreed to in writing, documentation +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +# ============LICENSE_END============================================ +# +# ECOMP is a trademark and service mark of AT&T Intellectual Property. +--- +- hosts: localhost + connection: local + tasks: + - name: Set timestamp fact if it hasn't been set + local_action: + set_fact timestamp="{{lookup('pipe', 'date \"+%s\"')}}" + run_once: True + when: timestamp is not defined + tags: + - always + +- hosts: localhost + connection: local + gather_facts: False + pre_tasks: + - shell: cat {{fetch_directory}}/ceph_cluster_uuid.conf + register: ceph_uuid + tags: + - always + + - shell: grep 'key' {{fetch_directory}}/{{ceph_uuid.stdout}}/etc/ceph/ceph.client.admin.keyring | awk '{print $3}' + register: client_key + tags: + - always + + - set_fact: + ceph_key: "{{client_key.stdout}}" + tags: + - always + +- hosts: rbdhost + become: True + pre_tasks: + - set_fact: + timestamp: "{{hostvars['127.0.0.1']['timestamp']}}" + tags: + - always + roles: + - role: ansible-vvp-volumes + +- hosts: localhost + connection: local + gather_facts: False + vars: + rollback_deployment: [] + sleep_in_seconds: + pre_deploy: "{{ pre_deploy_sleep | default(0) }}" + post_deploy: "{{ post_deploy_sleep | default(60) }}" + roles: + - ansible-vvp-templates diff --git a/ansible/infrastructure.yml b/ansible/infrastructure.yml new file mode 100755 index 0000000..0e700ca --- /dev/null +++ b/ansible/infrastructure.yml @@ -0,0 +1,85 @@ +# -*- encoding: utf-8 -*- +# ============LICENSE_START======================================================= +# org.onap.vvp/engagementmgr +# =================================================================== +# Copyright © 2017 AT&T Intellectual Property. All rights reserved. +# =================================================================== +# +# Unless otherwise specified, all software contained herein is licensed +# under the Apache License, Version 2.0 (the “License”); +# you may not use this software except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +# +# +# Unless otherwise specified, all documentation contained herein is licensed +# under the Creative Commons License, Attribution 4.0 Intl. (the “License”); +# you may not use this documentation except in compliance with the License. +# You may obtain a copy of the License at +# +# https://creativecommons.org/licenses/by/4.0/ +# +# Unless required by applicable law or agreed to in writing, documentation +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +# ============LICENSE_END============================================ +# +# ECOMP is a trademark and service mark of AT&T Intellectual Property. +--- +- hosts: localhost,rbdhost + tasks: + - name: Set timestamp fact if it hasn't been set + local_action: + set_fact timestamp="{{lookup('pipe', 'date \"+%s\"')}}" + run_once: True + when: timestamp is not defined + tags: + - always + +- hosts: mons + become: True + roles: + - ceph.ceph-mon + +- hosts: rgws + become: True + roles: + - ceph.ceph-rgw + +- hosts: osds + become: True + roles: + - ceph.ceph-osd + +- hosts: bootstrap + become: yes + roles: + - ansible-vvp-bootstrap + +- hosts: rbdhost + vars: + rollback_volumes: [] + snapshot_volumes: [] + become: True + roles: + - role: ansible-vvp-volumes + +# we can't do this in the earlier rgws block because we need its underlying +# osds and volumes to be set up. +- hosts: rgws + tasks: + - name: configure radosgw static files user + command: radosgw-admin user create --uid="staticfiles" --display-name="static files user" --caps="users=*;buckets=*;metadata=*" --access-key="{{ vault_aws_access_key_id }}" --secret-key="{{ vault_aws_secret_access_key }}" + run_once: true + become: true diff --git a/ansible/library/kubectl_apply_manifest.py b/ansible/library/kubectl_apply_manifest.py new file mode 100755 index 0000000..75c68cb --- /dev/null +++ b/ansible/library/kubectl_apply_manifest.py @@ -0,0 +1,73 @@ +# -*- encoding: utf-8 -*- +# ============LICENSE_START======================================================= +# org.onap.vvp/engagementmgr +# =================================================================== +# Copyright © 2017 AT&T Intellectual Property. All rights reserved. +# =================================================================== +# +# Unless otherwise specified, all software contained herein is licensed +# under the Apache License, Version 2.0 (the “License”); +# you may not use this software except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +# +# +# Unless otherwise specified, all documentation contained herein is licensed +# under the Creative Commons License, Attribution 4.0 Intl. (the “License”); +# you may not use this documentation except in compliance with the License. +# You may obtain a copy of the License at +# +# https://creativecommons.org/licenses/by/4.0/ +# +# Unless required by applicable law or agreed to in writing, documentation +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +# ============LICENSE_END============================================ +# +# ECOMP is a trademark and service mark of AT&T Intellectual Property. +#!/usr/bin/python +import os +from ansible.module_utils.basic import AnsibleModule + + +def kubectl_apply_manifest(module, manifest, kubeconfig): + kubectl_path = module.get_bin_path('kubectl', required=True) + args = [kubectl_path, '--kubeconfig', kubeconfig, 'apply', '-f', manifest] + return module.run_command(args) + + +def main(): + module = AnsibleModule( + argument_spec=dict( + manifest=dict(required=True), + kubeconfig=dict(default=os.environ['KUBECONFIG']) + ), + ) + + manifest = module.params['manifest'] + kubeconfig = module.params['kubeconfig'] + + if kubeconfig is None: + msg = "Could not apply manifest, kubeconfig not specified" + module.fail_json(msg=msg) + + rc, stdout, stderr = kubectl_apply_manifest(module, manifest, kubeconfig) + if rc == 0: + module.exit_json(changed=True, stdout=stdout) + else: + msg = "Could not apply manifest" + module.fail_json(msg=msg + " " + stderr) + +if __name__ == "__main__": + main() diff --git a/ansible/requirements.yml b/ansible/requirements.yml new file mode 100755 index 0000000..ea1e8d0 --- /dev/null +++ b/ansible/requirements.yml @@ -0,0 +1,57 @@ +# -*- encoding: utf-8 -*- +# ============LICENSE_START======================================================= +# org.onap.vvp/engagementmgr +# =================================================================== +# Copyright © 2017 AT&T Intellectual Property. All rights reserved. +# =================================================================== +# +# Unless otherwise specified, all software contained herein is licensed +# under the Apache License, Version 2.0 (the “License”); +# you may not use this software except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +# +# +# Unless otherwise specified, all documentation contained herein is licensed +# under the Creative Commons License, Attribution 4.0 Intl. (the “License”); +# you may not use this documentation except in compliance with the License. +# You may obtain a copy of the License at +# +# https://creativecommons.org/licenses/by/4.0/ +# +# Unless required by applicable law or agreed to in writing, documentation +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +# ============LICENSE_END============================================ +# +# ECOMP is a trademark and service mark of AT&T Intellectual Property. +- src: https://github.com/ceph/ansible-ceph-common.git + version: v2.2.10 + name: ceph.ceph-common + +- src: https://github.com/ceph/ansible-ceph-docker-common.git + version: master + name: ceph.ceph-docker-common + +- src: https://github.com/ceph/ansible-ceph-rgw.git + version: v2.2.10 + name: ceph.ceph-rgw + +- src: https://github.com/ceph/ansible-ceph-mon.git + version: v2.2.10 + name: ceph.ceph-mon + +- src: https://github.com/ceph/ansible-ceph-osd.git + version: v2.2.10 + name: ceph.ceph-osd diff --git a/ansible/roles/ansible-vvp-bootstrap/.gitignore b/ansible/roles/ansible-vvp-bootstrap/.gitignore new file mode 100755 index 0000000..5109f81 --- /dev/null +++ b/ansible/roles/ansible-vvp-bootstrap/.gitignore @@ -0,0 +1,2 @@ +*.swp +.sw* diff --git a/ansible/roles/ansible-vvp-bootstrap/.travis.yml b/ansible/roles/ansible-vvp-bootstrap/.travis.yml new file mode 100755 index 0000000..1b9ad49 --- /dev/null +++ b/ansible/roles/ansible-vvp-bootstrap/.travis.yml @@ -0,0 +1,64 @@ +# -*- encoding: utf-8 -*- +# ============LICENSE_START======================================================= +# org.onap.vvp/engagementmgr +# =================================================================== +# Copyright © 2017 AT&T Intellectual Property. All rights reserved. +# =================================================================== +# +# Unless otherwise specified, all software contained herein is licensed +# under the Apache License, Version 2.0 (the “License”); +# you may not use this software except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +# +# +# Unless otherwise specified, all documentation contained herein is licensed +# under the Creative Commons License, Attribution 4.0 Intl. (the “License”); +# you may not use this documentation except in compliance with the License. +# You may obtain a copy of the License at +# +# https://creativecommons.org/licenses/by/4.0/ +# +# Unless required by applicable law or agreed to in writing, documentation +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +# ============LICENSE_END============================================ +# +# ECOMP is a trademark and service mark of AT&T Intellectual Property. +--- +language: python +python: "2.7" + +# Use the new container infrastructure +sudo: false + +# Install ansible +addons: + apt: + packages: + - python-pip + +install: + # Install ansible + - pip install ansible + + # Check ansible version + - ansible --version + + # Create ansible.cfg with correct roles_path + - printf '[defaults]\nroles_path=../' >ansible.cfg + +script: + # Basic role syntax check + - ansible-playbook tests/test.yml -i tests/inventory --syntax-check diff --git a/ansible/roles/ansible-vvp-bootstrap/defaults/main.yml b/ansible/roles/ansible-vvp-bootstrap/defaults/main.yml new file mode 100755 index 0000000..9d39136 --- /dev/null +++ b/ansible/roles/ansible-vvp-bootstrap/defaults/main.yml @@ -0,0 +1,39 @@ +# -*- encoding: utf-8 -*- +# ============LICENSE_START======================================================= +# org.onap.vvp/engagementmgr +# =================================================================== +# Copyright © 2017 AT&T Intellectual Property. All rights reserved. +# =================================================================== +# +# Unless otherwise specified, all software contained herein is licensed +# under the Apache License, Version 2.0 (the “License”); +# you may not use this software except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +# +# +# Unless otherwise specified, all documentation contained herein is licensed +# under the Creative Commons License, Attribution 4.0 Intl. (the “License”); +# you may not use this documentation except in compliance with the License. +# You may obtain a copy of the License at +# +# https://creativecommons.org/licenses/by/4.0/ +# +# Unless required by applicable law or agreed to in writing, documentation +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +# ============LICENSE_END============================================ +# +# ECOMP is a trademark and service mark of AT&T Intellectual Property. +sysdig_access_key: "{{ vault_sysdig_access_key | default('') }}" diff --git a/ansible/roles/ansible-vvp-bootstrap/files/iceundionly.kpxe b/ansible/roles/ansible-vvp-bootstrap/files/iceundionly.kpxe Binary files differnew file mode 100755 index 0000000..ccda67b --- /dev/null +++ b/ansible/roles/ansible-vvp-bootstrap/files/iceundionly.kpxe diff --git a/ansible/roles/ansible-vvp-bootstrap/meta/.galaxy_install_info b/ansible/roles/ansible-vvp-bootstrap/meta/.galaxy_install_info new file mode 100755 index 0000000..0b7735f --- /dev/null +++ b/ansible/roles/ansible-vvp-bootstrap/meta/.galaxy_install_info @@ -0,0 +1,39 @@ +# -*- encoding: utf-8 -*- +# ============LICENSE_START======================================================= +# org.onap.vvp/engagementmgr +# =================================================================== +# Copyright © 2017 AT&T Intellectual Property. All rights reserved. +# =================================================================== +# +# Unless otherwise specified, all software contained herein is licensed +# under the Apache License, Version 2.0 (the “License”); +# you may not use this software except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +# +# +# Unless otherwise specified, all documentation contained herein is licensed +# under the Creative Commons License, Attribution 4.0 Intl. (the “License”); +# you may not use this documentation except in compliance with the License. +# You may obtain a copy of the License at +# +# https://creativecommons.org/licenses/by/4.0/ +# +# Unless required by applicable law or agreed to in writing, documentation +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +# ============LICENSE_END============================================ +# +# ECOMP is a trademark and service mark of AT&T Intellectual Property. +{install_date: 'Thu Jul 20 18:38:57 2017', version: develop} diff --git a/ansible/roles/ansible-vvp-bootstrap/meta/main.yml b/ansible/roles/ansible-vvp-bootstrap/meta/main.yml new file mode 100755 index 0000000..6b0bfdd --- /dev/null +++ b/ansible/roles/ansible-vvp-bootstrap/meta/main.yml @@ -0,0 +1,38 @@ +# -*- encoding: utf-8 -*- +# ============LICENSE_START======================================================= +# org.onap.vvp/engagementmgr +# =================================================================== +# Copyright © 2017 AT&T Intellectual Property. All rights reserved. +# =================================================================== +# +# Unless otherwise specified, all software contained herein is licensed +# under the Apache License, Version 2.0 (the “License”); +# you may not use this software except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +# +# +# Unless otherwise specified, all documentation contained herein is licensed +# under the Creative Commons License, Attribution 4.0 Intl. (the “License”); +# you may not use this documentation except in compliance with the License. +# You may obtain a copy of the License at +# +# https://creativecommons.org/licenses/by/4.0/ +# +# Unless required by applicable law or agreed to in writing, documentation +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +# ============LICENSE_END============================================ +# +# ECOMP is a trademark and service mark of AT&T Intellectual Property. diff --git a/ansible/roles/ansible-vvp-bootstrap/tasks/dnsmasq.yml b/ansible/roles/ansible-vvp-bootstrap/tasks/dnsmasq.yml new file mode 100755 index 0000000..48dad1c --- /dev/null +++ b/ansible/roles/ansible-vvp-bootstrap/tasks/dnsmasq.yml @@ -0,0 +1,103 @@ +# -*- encoding: utf-8 -*- +# ============LICENSE_START======================================================= +# org.onap.vvp/engagementmgr +# =================================================================== +# Copyright © 2017 AT&T Intellectual Property. All rights reserved. +# =================================================================== +# +# Unless otherwise specified, all software contained herein is licensed +# under the Apache License, Version 2.0 (the “License”); +# you may not use this software except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +# +# +# Unless otherwise specified, all documentation contained herein is licensed +# under the Creative Commons License, Attribution 4.0 Intl. (the “License”); +# you may not use this documentation except in compliance with the License. +# You may obtain a copy of the License at +# +# https://creativecommons.org/licenses/by/4.0/ +# +# Unless required by applicable law or agreed to in writing, documentation +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +# ============LICENSE_END============================================ +# +# ECOMP is a trademark and service mark of AT&T Intellectual Property. +- name: Install nf_conntrack_tftp + modprobe: + name: nf_conntrack_tftp + state: present + +- name: Copy our pxe client + copy: src=iceundionly.kpxe dest="{{files_dir}}/iceundionly.kpxe" + when: pxe_chainload + +- name: Create DNSMASQ leases file + file: path="{{files_dir}}/leases" mode=0644 state=touch + +- name: DROP DNS, tftp requests from public + shell: iptables -I INPUT 1 -p udp --dport {{item}} -i {{ops_public_interface}} -j DROP + with_items: + - 53 + - 69 + +- name: DROP DNS, tftp requests to public + shell: iptables -I OUTPUT 1 -p udp --sport {{item}} -o {{ops_public_interface}} -j DROP + with_items: + - 53 + - 69 + +- name: Allow Inbound UDP DHCP Requests + shell: iptables -A INPUT -p udp --dport {{item}} -j ACCEPT + with_items: + - 53 + - 67:69 + +- name: Allow Outbound UDP DNS, DHCP + shell: iptables -A OUTPUT -p udp --sport {{item}} -j ACCEPT + with_items: + - 53 + - 67:69 + +- name: Allow TFTP file transfers on arbitrary ports. + shell: 'iptables -A OUTPUT -p udp -o {{ ops_management_interface }} --sport 1023: --dport 1024: -m state --state ESTABLISHED,RELATED -j ACCEPT' + +- name: Allow TFTP file transfers on arbitrary ports. + shell: 'iptables -A INPUT -p udp -i {{ops_management_interface}} --dport 1023: -m state --state ESTABLISHED,RELATED -j ACCEPT' + +- name: Render DNSMASQ configuration + template: + src: dnsmasq.conf.j2 + dest: "{{files_dir}}/dnsmasq.conf" + +- name: Is dnsmasq already running? + shell: docker ps | grep dnsmasq | awk '{ print $1 }' + register: dnsmasq_id + +- name: Kill dnsmasq! + shell: docker kill "{{dnsmasq_id.stdout}}" + when: dnsmasq_id.stdout != "" + +- name: Start DNSMASQ + command: "docker run -d + --net=host + --cap-add=NET_ADMIN + -v {{files_dir}}/leases:/var/lib/misc/dnsmasq.leases:Z + -v {{files_dir}}/dnsmasq.conf:/etc/dnsmasq.conf:Z +{% if pxe_chainload %} + -v {{files_dir}}/iceundionly.kpxe:/var/lib/tftpboot/iceundionly.kpxe:Z +{% endif %} + quay.io/coreos/dnsmasq -d -q" diff --git a/ansible/roles/ansible-vvp-bootstrap/tasks/main.yml b/ansible/roles/ansible-vvp-bootstrap/tasks/main.yml new file mode 100755 index 0000000..48b545e --- /dev/null +++ b/ansible/roles/ansible-vvp-bootstrap/tasks/main.yml @@ -0,0 +1,183 @@ +# -*- encoding: utf-8 -*- +# ============LICENSE_START======================================================= +# org.onap.vvp/engagementmgr +# =================================================================== +# Copyright © 2017 AT&T Intellectual Property. All rights reserved. +# =================================================================== +# +# Unless otherwise specified, all software contained herein is licensed +# under the Apache License, Version 2.0 (the “License”); +# you may not use this software except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +# +# +# Unless otherwise specified, all documentation contained herein is licensed +# under the Creative Commons License, Attribution 4.0 Intl. (the “License”); +# you may not use this documentation except in compliance with the License. +# You may obtain a copy of the License at +# +# https://creativecommons.org/licenses/by/4.0/ +# +# Unless required by applicable law or agreed to in writing, documentation +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +# ============LICENSE_END============================================ +# +# ECOMP is a trademark and service mark of AT&T Intellectual Property. +--- +- name: install packages + yum: + name: "{{ item }}" + state: present + with_items: + - docker + tags: + - bootstrap + +- name: Is our management IP set? + shell: "ip addr show {{ops_management_interface}} | grep {{ops_management_ip}}" + register: mgmt_ip + tags: + - bootstrap + ignore_errors: True + +- name: Set interface address + command: ip addr add {{ops_management_ip}}/24 dev {{ops_management_interface}} + when: mgmt_ip.stdout == "" + tags: + - bootstrap + +- name: Temporarily allow all INPUT + shell: iptables -P INPUT ACCEPT + tags: + - always + +- name: Temporarily allow all OUTPUT + shell: iptables -P OUTPUT ACCEPT + tags: + - always + +- name: Flush all IPTables Rules (non nat) + shell: iptables -F + tags: + - always + +- name: Allow SSH for development environments + shell: iptables -A INPUT -p tcp -i eth0 --dport 22 -j ACCEPT + when: ice_environment == "development" + tags: + - always + +- name: Allow SSH out for development environments + shell: iptables -A OUTPUT -p tcp -o eth0 --sport 22 -j ACCEPT + when: ice_environment == "development" + tags: + - always + +- name: Allow SSH out for development environments + shell: iptables -A OUTPUT -p tcp -o {{ops_management_interface}} --sport 22 -j ACCEPT + when: ice_environment != "development" + tags: + - always + +- name: Allow SSH for non-development environments + shell: iptables -A INPUT -p tcp -i {{ops_management_interface}} --dport 22 -j ACCEPT + when: ice_environment != "development" + tags: + - always + +- name: Allow Outbound UDP DNS + shell: iptables -A OUTPUT -p udp --dport 53 -j ACCEPT + +- name: Allow Inbound UDP DNS replies + shell: iptables -A INPUT -p udp --sport 53 -j ACCEPT + +- name: Allow Outbound Web Requests + shell: iptables -A OUTPUT -p tcp --dport {{item}} -j ACCEPT + with_items: + - 443 + - 80 + +- name: Allow Inbound Web Replies + shell: iptables -A INPUT -p tcp --sport {{item}} -m state --state ESTABLISHED,RELATED -j ACCEPT + with_items: + - 443 + - 80 +- name: Drop INPUT + shell: iptables -P INPUT DROP + tags: + - always + +- name: Drop OUTPUT + shell: iptables -P OUTPUT DROP + tags: + - always + +- name: Drop FORWARD + shell: iptables -P FORWARD DROP + tags: + - always + +- name: set additional interfaces ip + command: ip addr add {{item.value}} dev {{item.key}} + when: hostvars[inventory_hostname]["ansible_%s" % item.key] and (hostvars[inventory_hostname]["ansible_%s" % item.key]['ipv4'] is not defined or not item.value.split('/')[0] in hostvars[inventory_hostname]["ansible_%s" % item.key]['ipv4']['address']) + with_dict: "{{ additional_interfaces }}" + +- name: Bring additional interfaces up + command: ifup {{item.key}} + when: hostvars[inventory_hostname]["ansible_%s" % item.key] and (hostvars[inventory_hostname]["ansible_%s" % item.key]['ipv4'] is not defined or not item.value.split('/')[0] in hostvars[inventory_hostname]["ansible_%s" % item.key]['ipv4']['address']) + with_dict: "{{ additional_interfaces }}" + +- name: Add self to resolv.conf + lineinfile: + dest: /etc/resolv.conf + line: "nameserver {{ops_management_ip}}" + insertbefore: BOF + +- name: start docker + command: systemctl restart docker + tags: + - always + +- name: Disable Forwarding + command: "echo 0 > /proc/sys/net/ipv4/ip_forward" + tags: + - bootstrap + +######################### +# FILESYSTEM +# +- name: Create files DIR + file: state=directory path="{{files_dir}}" mode=0755 + tags: + - bootstrap + - tls + +- include: matchbox.yml + tags: + - bootstrap + - matchbox + + +- include: tls.yml + tags: + - bootstrap + - tls + +- include: dnsmasq.yml + tags: + - bootstrap + - dnsmasq + diff --git a/ansible/roles/ansible-vvp-bootstrap/tasks/matchbox.yml b/ansible/roles/ansible-vvp-bootstrap/tasks/matchbox.yml new file mode 100755 index 0000000..7e4ea87 --- /dev/null +++ b/ansible/roles/ansible-vvp-bootstrap/tasks/matchbox.yml @@ -0,0 +1,137 @@ +# -*- encoding: utf-8 -*- +# ============LICENSE_START======================================================= +# org.onap.vvp/engagementmgr +# =================================================================== +# Copyright © 2017 AT&T Intellectual Property. All rights reserved. +# =================================================================== +# +# Unless otherwise specified, all software contained herein is licensed +# under the Apache License, Version 2.0 (the “License”); +# you may not use this software except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +# +# +# Unless otherwise specified, all documentation contained herein is licensed +# under the Creative Commons License, Attribution 4.0 Intl. (the “License”); +# you may not use this documentation except in compliance with the License. +# You may obtain a copy of the License at +# +# https://creativecommons.org/licenses/by/4.0/ +# +# Unless required by applicable law or agreed to in writing, documentation +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +# ============LICENSE_END============================================ +# +# ECOMP is a trademark and service mark of AT&T Intellectual Property. +- name: Create assets directory + file: path="{{coreos_assets_dir}}" state=directory mode="0755" + tags: + - bootstrap + - matchbox + +- name: Download PXE image + get_url: url="http://{{coreos_channel}}.release.core-os.net/amd64-usr/{{coreos_version}}/{{item}}" dest="{{coreos_assets_dir}}/{{item}}" + with_items: + - "coreos_production_pxe.vmlinuz" + - "coreos_production_pxe.vmlinuz.sig" + - "coreos_production_pxe_image.cpio.gz" + - "coreos_production_pxe_image.cpio.gz.sig" + - "coreos_production_image.bin.bz2" + - "coreos_production_image.bin.bz2.sig" + tags: + - bootstrap + - matchbox + +- name: Retrieve the signing key + get_url: url="https://coreos.com/security/image-signing-key/CoreOS_Image_Signing_Key.asc" dest="{{coreos_assets_dir}}/CoreOS_Image_Signing_Key.asc" + tags: + - bootstrap + - matchbox + +- name: Import signing key + command: "gpg --import {{coreos_assets_dir}}/CoreOS_Image_Signing_Key.asc" + tags: + - bootstrap + - matchbox + +- name: Adding trust for CoreOS Signing key + command: 'echo "04126D0BFABEC8871FFB2CCE50E0885593D2DCB4:6:" | gpg --import-ownertrust' + tags: + - bootstrap + - matchbox + +- name: Verifying vmlinuz + command: "gpg --verify {{coreos_assets_dir}}/{{item}}" + with_items: + - "coreos_production_pxe.vmlinuz.sig" + - "coreos_production_pxe_image.cpio.gz.sig" + tags: + - bootstrap + - matchbox + + +- name: Create matchbox directory + file: path="{{matchbox_dir}}" state=directory mode=0754 + tags: + - bootstrap + - matchbox + +- name: Create groups, profiles and ignition directories + file: path="{{matchbox_dir}}/{{item}}" state=directory mode=0754 + with_items: + - groups + - profiles + - ignition + +- name: matchbox k7 groups templates + template: + src: "groups/group.json.j2" + dest: "{{matchbox_dir}}/groups/{{item.name}}.json" + with_items: "{{hosts}}" + when: item.os == "coreos" + +- name: Allow Inbound 8080 web requests + shell: iptables -A INPUT -p udp --dport 8080 -i {{ops_management_interface}} -j ACCEPT + +- name: Allow Outbound 8080 web replies + shell: iptables -A OUTPUT -p udp --sport 8080 -o {{ops_management_interface}} -j ACCEPT + +- name: Create TLS assets directory + file: path="{{assets_dir}}/tls" state=directory mode=643 + +- name: matchbox k8 other templates + template: + src: "{{item}}.j2" + dest: "{{matchbox_dir}}/{{item}}" + with_items: + - groups/install.json + - profiles/controller.json + - profiles/worker.json + - profiles/install-reboot.json + - ignition/controller.yaml + - ignition/coreos-install.yaml + - ignition/worker.yaml + +- name: Is matchbox already running? + shell: docker ps | grep matchbox | awk '{ print $1 }' + register: matchbox_id + +- name: Kill matchbox! + shell: docker kill {{matchbox_id.stdout}} + when: matchbox_id.stdout != "" + +- name: matchbox docker + command: docker run -d -p {{ops_management_ip}}:8080:8080 -v {{assets_dir}}:/assets:Z -v {{matchbox_dir}}:/var/lib/matchbox:Z quay.io/coreos/matchbox:v0.5.0 -address=0.0.0.0:8080 -log-level=debug -assets-path=/assets diff --git a/ansible/roles/ansible-vvp-bootstrap/tasks/tls.yml b/ansible/roles/ansible-vvp-bootstrap/tasks/tls.yml new file mode 100755 index 0000000..e0346cf --- /dev/null +++ b/ansible/roles/ansible-vvp-bootstrap/tasks/tls.yml @@ -0,0 +1,150 @@ +# -*- encoding: utf-8 -*- +# ============LICENSE_START======================================================= +# org.onap.vvp/engagementmgr +# =================================================================== +# Copyright © 2017 AT&T Intellectual Property. All rights reserved. +# =================================================================== +# +# Unless otherwise specified, all software contained herein is licensed +# under the Apache License, Version 2.0 (the “License”); +# you may not use this software except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +# +# +# Unless otherwise specified, all documentation contained herein is licensed +# under the Creative Commons License, Attribution 4.0 Intl. (the “License”); +# you may not use this documentation except in compliance with the License. +# You may obtain a copy of the License at +# +# https://creativecommons.org/licenses/by/4.0/ +# +# Unless required by applicable law or agreed to in writing, documentation +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +# ============LICENSE_END============================================ +# +# ECOMP is a trademark and service mark of AT&T Intellectual Property. +- name: create TLS dir + file: + state: directory + path: "{{files_dir}}/tls" + mode: 0755 + tags: + - bootstrap + - tls + +- name: create TLS dir + file: + state: directory + path: "{{assets_dir}}/tls" + mode: 0755 + tags: + - bootstrap + - tls + +- stat: path="{{files_dir}}/tls/ca-key.pem" + register: ca_key + +- name: create root CA + shell: openssl genrsa -out {{files_dir}}/tls/ca-key.pem 2048 + when: not ca_key.stat.exists + +- stat: path="{{files_dir}}/tls/ca.pem" + register: ca + +- name: create self signed cert + shell: openssl req -x509 -new -nodes -key {{files_dir}}/tls/ca-key.pem -days 10000 -out {{files_dir}}/tls/ca.pem -subj "/CN=kube-ca" + when: not ca.stat.exists + +- name: Generate Config File + template: + src: openssl.config.j2 + dest: "{{files_dir}}/tls/{{item}}-openssl.config" + with_items: + - admin + - apiserver + - worker + +- stat: path={{files_dir}}/tls/{{item}}-key.pem + register: keyfiles + with_items: + - admin + - apiserver + - worker + +- name: create keyfile + shell: openssl genrsa -out {{files_dir}}/tls/{{item.item}}-key.pem 2048 + with_items: "{{keyfiles.results}}" + when: not item.stat.exists + +- stat: path={{files_dir}}/tls/{{item}}.csr + register: csr_files + with_items: + - admin + - apiserver + - worker + +- name: Create csr + shell: openssl req -new -key {{files_dir}}/tls/{{item.item}}-key.pem -out {{files_dir}}/tls/{{item.item}}.csr -subj "/CN=kube-{{item.item}}" -config {{files_dir}}/tls/{{item.item}}-openssl.config + with_items: "{{csr_files.results}}" + when: not item.stat.exists + +- stat: path={{files_dir}}/tls/{{item}}.pem + register: pem_files + with_items: + - admin + - apiserver + - worker + +- name: Create pemfile + shell: openssl x509 -req -in {{files_dir}}/tls/{{item.item}}.csr -CA {{files_dir}}/tls/ca.pem -CAkey {{files_dir}}/tls/ca-key.pem -CAcreateserial -out {{files_dir}}/tls/{{item.item}}.pem -days 365 -extensions v3_req -extfile {{files_dir}}/tls/{{item.item}}-openssl.config + with_items: "{{pem_files.results}}" + when: not item.stat.exists + +- name: Copy tls related files to assets + copy: + src: "{{files_dir}}/{{item}}" + dest: "{{assets_dir}}/{{item}}" + remote_src: yes + backup: yes + with_items: + - tls/apiserver-key.pem + - tls/apiserver.pem + - tls/ca.pem + - tls/worker-key.pem + - tls/worker.pem + +- name: Encode Admin Cert + shell: base64 -w 0 {{files_dir}}/tls/admin.pem + register: ADMIN_CERT_BASE64 + +- name: Encode Admin Key + shell: base64 -w 0 {{files_dir}}/tls/admin-key.pem + register: ADMIN_KEY_BASE64 + +- name: Encode CA Cert + shell: base64 -w 0 {{files_dir}}/tls/ca.pem + register: CA_CERT_BASE64 + +- name: Render kubeconfig + template: + src: kubeconfig.j2 + dest: "{{files_dir}}/kubeconfig" + +- name: Fetch the new kubeconfig + fetch: + src: "{{files_dir}}/kubeconfig" + dest: "{{inventory_dir}}/../k8/" + flat: yes diff --git a/ansible/roles/ansible-vvp-bootstrap/templates/dnsmasq.conf.j2 b/ansible/roles/ansible-vvp-bootstrap/templates/dnsmasq.conf.j2 new file mode 100755 index 0000000..2908165 --- /dev/null +++ b/ansible/roles/ansible-vvp-bootstrap/templates/dnsmasq.conf.j2 @@ -0,0 +1,73 @@ +# -*- encoding: utf-8 -*- +# ============LICENSE_START======================================================= +# org.onap.vvp/engagementmgr +# =================================================================== +# Copyright © 2017 AT&T Intellectual Property. All rights reserved. +# =================================================================== +# +# Unless otherwise specified, all software contained herein is licensed +# under the Apache License, Version 2.0 (the “License”); +# you may not use this software except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +# +# +# Unless otherwise specified, all documentation contained herein is licensed +# under the Creative Commons License, Attribution 4.0 Intl. (the “License”); +# you may not use this documentation except in compliance with the License. +# You may obtain a copy of the License at +# +# https://creativecommons.org/licenses/by/4.0/ +# +# Unless required by applicable law or agreed to in writing, documentation +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +# ============LICENSE_END============================================ +# +# ECOMP is a trademark and service mark of AT&T Intellectual Property. +domain={{domain}} +{% for range in dhcp_ranges %} +dhcp-range={{range}} +{% endfor %} +{% if ice_environment != 'development' %} +dhcp-option={{ops_management_interface}},121,10.252.0.0/16,{{management_gateway}} +dhcp-option=tag:#coreos,{{ops_management_interface}},3,{{management_gateway}} +dhcp-option=tag:coreos,{{ops_management_interface}},3 +{% endif %} +{% for interface in additional_gateways.keys() %} +dhcp-option={{interface}},3{% if additional_gateways[interface] != '' %},{{additional_gateways[interface]}} {% endif %} + +dhcp-option=#{{ops_management_interface}},6 +{% endfor %} +enable-tftp +tftp-root=/var/lib/tftpboot +{% if pxe_boot %} + {% if pxe_chainload %} +dhcp-userclass=set:iceundi,ICEPXE +dhcp-boot=tag:coreos,tag:#iceundi,iceundionly.kpxe + {% else %} +dhcp-userclass=set:iceundi,iPXE +dhcp-boot=tag:coreos,tag:#iceundi,undionly.kpxe + {% endif %} +dhcp-boot=tag:iceundi,http://{{ops_management_ip}}:8080/boot.ipxe +{% endif %} +{% for host in hosts %} + {% for config in host.dnsmasq_config %} +dhcp-host={{config}} + {% endfor %} +{% endfor %} +dhcp-ignore=tag:#known +log-queries +log-dhcp +bogus-priv diff --git a/ansible/roles/ansible-vvp-bootstrap/templates/groups/group.json.j2 b/ansible/roles/ansible-vvp-bootstrap/templates/groups/group.json.j2 new file mode 100755 index 0000000..f7faa70 --- /dev/null +++ b/ansible/roles/ansible-vvp-bootstrap/templates/groups/group.json.j2 @@ -0,0 +1,73 @@ +{# +-*- encoding: utf-8 -*- +============LICENSE_START======================================================= +org.onap.vvp/engagementmgr +=================================================================== +Copyright © 2017 AT&T Intellectual Property. All rights reserved. +=================================================================== + +Unless otherwise specified, all software contained herein is licensed +under the Apache License, Version 2.0 (the “License”); +you may not use this software except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. + + + +Unless otherwise specified, all documentation contained herein is licensed +under the Creative Commons License, Attribution 4.0 Intl. (the “License”); +you may not use this documentation except in compliance with the License. +You may obtain a copy of the License at + + https://creativecommons.org/licenses/by/4.0/ + +Unless required by applicable law or agreed to in writing, documentation +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. + +============LICENSE_END============================================ + + ECOMP is a trademark and service mark of AT&T Intellectual Property. +#} +{ + "id": "{{item.name}}", + "name": "k8s node", + "profile": "{{item.role}}", + "selector": { + "mac": "{{item.mac}}", + "os": "installed" + }, + "metadata": { + "ssh_ip": "{{item.ssh_ip}}", + "k8s_flanneld_iface": "{{flanneld_interface}}", + "container_runtime": "{{container_runtime | default('rkt')}}", + "domain_name": "{{item.name}}.{{domain}}", + "etcd_initial_peers": "http://{{item.name}}.{{domain}}:2380", + "etcd_initial_cluster": "{% for host in hosts %}{% if host.etcd_role == "member" %}{{host.name}}=http://{{host.name}}.{{domain}}:2380,{% endif %}{% endfor %}", + "etcd_name": "{{item.name}}", + "k8s_version": "{{k8s_version}}", + "k8s_cert_endpoint": "http://{{ops_management_ip}}:8080/assets", + "k8s_dns_service_ip": "10.3.0.10", + "k8s_etcd_endpoints": "{% for host in hosts %}{% if host.etcd_role == "member" %}http://{{host.name}}.{{domain}}:2379,{% endif %}{% endfor %}", + "sysdig_access_key": "{{ sysdig_access_key| default('') }}", +{% if item.role == "controller" %} + "k8s_apiserver_advertise_address": "{{k8s_apiserver_advertise_address}}", + "k8s_controller_port": "{{k8s_controller_port}}", + "k8s_pod_network": "10.2.0.0/16", + "k8s_service_ip_range": "10.3.0.0/24", +{% else %} + "k8s_controller_endpoint": "https://{{(hosts|selectattr('role', 'equalto', 'controller')|first).name}}.{{domain}}:{{k8s_controller_port}}", +{% endif %} + "ssh_authorized_keys": [{% for key in ssh_keys %}"{{key}}"{% if not loop.last %},{% endif %}{% endfor %}], + "ignition_endpoint": "http://{{ops_management_ip}}:8080/ignition" + } +} diff --git a/ansible/roles/ansible-vvp-bootstrap/templates/groups/install.json.j2 b/ansible/roles/ansible-vvp-bootstrap/templates/groups/install.json.j2 new file mode 100755 index 0000000..bf9284f --- /dev/null +++ b/ansible/roles/ansible-vvp-bootstrap/templates/groups/install.json.j2 @@ -0,0 +1,51 @@ +{# +-*- encoding: utf-8 -*- +============LICENSE_START======================================================= +org.onap.vvp/engagementmgr +=================================================================== +Copyright © 2017 AT&T Intellectual Property. All rights reserved. +=================================================================== + +Unless otherwise specified, all software contained herein is licensed +under the Apache License, Version 2.0 (the “License”); +you may not use this software except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. + + + +Unless otherwise specified, all documentation contained herein is licensed +under the Creative Commons License, Attribution 4.0 Intl. (the “License”); +you may not use this documentation except in compliance with the License. +You may obtain a copy of the License at + + https://creativecommons.org/licenses/by/4.0/ + +Unless required by applicable law or agreed to in writing, documentation +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. + +============LICENSE_END============================================ + + ECOMP is a trademark and service mark of AT&T Intellectual Property. +#} +{ + "id": "coreos-install", + "name": "CoreOS Install", + "profile": "install-reboot", + "metadata": { + "coreos_channel": "{{coreos_channel}}", + "coreos_version": "{{coreos_version}}", + "ignition_endpoint": "http://{{ops_management_ip}}:8080/ignition", + "ssh_authorized_keys": [{% for key in ssh_keys %}"{{key}}"{% if not loop.last %},{% endif %}{% endfor %}] + } +} diff --git a/ansible/roles/ansible-vvp-bootstrap/templates/ignition/controller.yaml.j2 b/ansible/roles/ansible-vvp-bootstrap/templates/ignition/controller.yaml.j2 new file mode 100755 index 0000000..ff8e0b8 --- /dev/null +++ b/ansible/roles/ansible-vvp-bootstrap/templates/ignition/controller.yaml.j2 @@ -0,0 +1,872 @@ +{# +-*- encoding: utf-8 -*- +============LICENSE_START======================================================= +org.onap.vvp/engagementmgr +=================================================================== +Copyright © 2017 AT&T Intellectual Property. All rights reserved. +=================================================================== + +Unless otherwise specified, all software contained herein is licensed +under the Apache License, Version 2.0 (the “License”); +you may not use this software except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. + + + +Unless otherwise specified, all documentation contained herein is licensed +under the Creative Commons License, Attribution 4.0 Intl. (the “License”); +you may not use this documentation except in compliance with the License. +You may obtain a copy of the License at + + https://creativecommons.org/licenses/by/4.0/ + +Unless required by applicable law or agreed to in writing, documentation +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. + +============LICENSE_END============================================ + + ECOMP is a trademark and service mark of AT&T Intellectual Property. +#} +--- +systemd: + units: +{% for mount in mounts %} + - name: {{mount.name}}.mount + enable: true + contents: | + [Mount] + What={{mount.dev}} + Where={{mount.dest}} + Type={{mount.type}} + [Install] + WantedBy=local-fs.target +{% endfor %} + - name: ice-filesystems.service + enable: true + contents: | + [Unit] + After=systemd-tmpfiles-setup.service + [Service] + Type=oneshot + {% if manually_grow_root %} + ExecStart=/usr/bin/cgpt resize /dev/sda9 + ExecStart=/usr/sbin/xfs_growfs /dev/sda9 + {% endif %} + ExecStart=/usr/bin/cp -r --preserve=all /usr/share/coreos /etc/coreos + ExecStart=/usr/bin/systemctl disable ice-filesystems.service + [Install] + WantedBy=multi-user.target {% raw %} + - name: sshd.socket + enable: true + contents: | + [Unit] + Description=OpenSSH Server Socket + Conflicts=sshd.service + + [Socket] + ListenStream={{.ssh_ip}}:22 + FreeBind=true + Accept=yes + + [Install] + WantedBy=sockets.target + - name: etcd2.service + enable: true + dropins: + - name: 40-etcd-cluster.conf + contents: | + [Service] + Environment="ETCD_NAME={{.etcd_name}}" + Environment="ETCD_ADVERTISE_CLIENT_URLS=http://{{.domain_name}}:2379" + Environment="ETCD_INITIAL_ADVERTISE_PEER_URLS={{.etcd_initial_peers}}" + Environment="ETCD_LISTEN_CLIENT_URLS=http://0.0.0.0:2379" + Environment="ETCD_LISTEN_PEER_URLS=http://0.0.0.0:2380" + Environment="ETCD_INITIAL_CLUSTER={{.etcd_initial_cluster}}" + Environment="ETCD_STRICT_RECONFIG_CHECK=true" + - name: flanneld.service + dropins: + - name: 40-ExecStartPre-symlink.conf + contents: | + [Service] + EnvironmentFile=-/etc/flannel/options.env + ExecStartPre=/opt/init-flannel + - name: docker.service + dropins: + - name: 40-flannel.conf + contents: | + [Unit] + Requires=flanneld.service + After=flanneld.service + [Service] + EnvironmentFile=/etc/kubernetes/cni/docker_opts_cni.env + - name: locksmithd.service + dropins: + - name: 40-etcd-lock.conf + contents: | + [Service] + Environment="REBOOT_STRATEGY=off" + - name: k8s-certs@.service + contents: | + [Unit] + Description=Fetch Kubernetes certificate assets + Requires=network-online.target + After=network-online.target + [Service] + ExecStartPre=/usr/bin/mkdir -p /etc/kubernetes/ssl + ExecStart=/usr/bin/bash -c "[ -f /etc/kubernetes/ssl/%i ] || curl {{.k8s_cert_endpoint}}/tls/%i -o /etc/kubernetes/ssl/%i" + - name: k8s-assets.target + contents: | + [Unit] + Description=Load Kubernetes Assets + Requires=k8s-certs@apiserver.pem.service + After=k8s-certs@apiserver.pem.service + Requires=k8s-certs@apiserver-key.pem.service + After=k8s-certs@apiserver-key.pem.service + Requires=k8s-certs@ca.pem.service + After=k8s-certs@ca.pem.service + - name: kubelet.service + enable: true + contents: | + [Unit] + Description=Kubelet via Hyperkube ACI + Wants=flanneld.service + Requires=k8s-assets.target + After=k8s-assets.target + [Service] + Environment=KUBELET_VERSION={{.k8s_version}} + Environment="RKT_OPTS=--uuid-file-save=/var/run/kubelet-pod.uuid \ + --volume dns,kind=host,source=/etc/resolv.conf \ + --mount volume=dns,target=/etc/resolv.conf \ + {{ if eq .container_runtime "rkt" -}} + --volume rkt,kind=host,source=/opt/bin/host-rkt \ + --mount volume=rkt,target=/usr/bin/rkt \ + --volume var-lib-rkt,kind=host,source=/var/lib/rkt \ + --mount volume=var-lib-rkt,target=/var/lib/rkt \ + --volume stage,kind=host,source=/tmp \ + --mount volume=stage,target=/tmp \ + {{ end -}} + --volume modprobe,kind=host,source=/usr/sbin/modprobe \ + --mount volume=modprobe,target=/usr/sbin/modprobe \ + --volume lib-modules,kind=host,source=/lib/modules \ + --mount volume=lib-modules,target=/lib/modules \ + --volume mkfsxfs,kind=host,source=/usr/sbin/mkfs.xfs \ + --mount volume=mkfsxfs,target=/usr/sbin/mkfs.xfs \ + --volume libxfs,kind=host,source=/lib64/libxfs.so.0 \ + --mount volume=libxfs,target=/lib64/libxfs.so.0 \ + --volume var-log,kind=host,source=/var/log \ + --mount volume=var-log,target=/var/log" + ExecStartPre=/usr/bin/mkdir -p /etc/kubernetes/manifests + ExecStartPre=/usr/bin/mkdir -p /var/log/containers + ExecStartPre=/usr/bin/systemctl is-active flanneld.service + ExecStartPre=-/usr/bin/rkt rm --uuid-file=/var/run/kubelet-pod.uuid + ExecStart=/usr/lib/coreos/kubelet-wrapper \ + --api-servers=http://127.0.0.1:8080 \ + --register-schedulable=true \ + --cni-conf-dir=/etc/kubernetes/cni/net.d \ + --network-plugin=cni \ + --container-runtime={{.container_runtime}} \ + --rkt-path=/usr/bin/rkt \ + --rkt-stage1-image=coreos.com/rkt/stage1-coreos \ + --allow-privileged=true \ + --pod-manifest-path=/etc/kubernetes/manifests \ + --hostname-override={{.domain_name}} \ + --cluster_dns={{.k8s_dns_service_ip}} \ + --cluster_domain=cluster.local + ExecStop=-/usr/bin/rkt stop --uuid-file=/var/run/kubelet-pod.uuid + Restart=always + RestartSec=10 + [Install] + WantedBy=multi-user.target + - name: k8s-addons.service + enable: true + contents: | + [Unit] + Description=Kubernetes Addons + [Service] + Type=oneshot + ExecStart=/opt/k8s-addons + [Install] + WantedBy=multi-user.target + {{ if eq .container_runtime "rkt" }} + - name: rkt-api.service + enable: true + contents: | + [Unit] + Before=kubelet.service + [Service] + ExecStart=/usr/bin/rkt api-service + Restart=always + RestartSec=10 + [Install] + RequiredBy=kubelet.service + - name: load-rkt-stage1.service + enable: true + contents: | + [Unit] + Description=Load rkt stage1 images + Documentation=http://github.com/coreos/rkt + Requires=network-online.target + After=network-online.target + Before=rkt-api.service + [Service] + Type=oneshot + RemainAfterExit=yes + ExecStart=/usr/bin/rkt fetch /usr/lib/rkt/stage1-images/stage1-coreos.aci /usr/lib/rkt/stage1-images/stage1-fly.aci --insecure-options=image + [Install] + RequiredBy=rkt-api.service + {{ end }} + {{if ne .sysdig_access_key "" }} + - name: sysdig.service + enable: true + contents: | + [Unit] + Description=Sysdig Cloud Agent + After=docker.service + Requires=docker.service + [Service] + TimeoutStartSec=0 + ExecStartPre=-/usr/bin/docker kill sysdig-agent + ExecStartPre=-/usr/bin/docker rm sysdig-agent + ExecStartPre=-/usr/bin/docker rmi sysdig-agent + ExecStartPre=/usr/bin/docker pull sysdig/agent +{% endraw %} + ExecStart=/usr/bin/docker run --name sysdig-agent --privileged --net host --pid host -e ADDITIONAL_CONF="app_checks:\n - name: nginx\n enabled: false" -e ACCESS_KEY={{sysdig_access_key}} -e TAGS=deploy_environment:staging -v /var/lib/rkt:/host/var/lib/rkt:ro -v /var/run/docker.sock:/host/var/run/docker.sock -v /dev:/host/dev -v /proc:/host/proc:ro -v /boot:/host/boot:ro sysdig/agent {% raw %} + ExecStop=/usr/bin/docker stop sysdig-agent + [Install] + WantedBy=multi-user.target + RequiredBy=k8-addons.service + {{ end }} +storage: + filesystems: +{% endraw %} +{% for fs in filesystems %} + - name: {{fs.device}} + mount: + device: {{fs.device}} + format: {{fs.format}} + create: + force: {{fs.create.force}} +{% if "options" in fs.create.keys() %} + options: +{% for option in fs.create.options %} + - {{option}} +{% endfor %} +{% endif %} +{% endfor %}{% raw %} + files: + - path: /etc/kubernetes/cni/net.d/10-flannel.conf + filesystem: root + contents: + inline: | + { + "name": "podnet", + "type": "flannel", + "delegate": { + "isDefaultGateway": true + } + } + - path: /etc/kubernetes/cni/docker_opts_cni.env + filesystem: root + contents: + inline: | + DOCKER_OPT_BIP="" + DOCKER_OPT_IPMASQ="" + - path: /etc/sysctl.d/max-user-watches.conf + filesystem: root + contents: + inline: | + fs.inotify.max_user_watches=16184 + - path: /etc/kubernetes/manifests/kube-proxy.yaml + filesystem: root + contents: + inline: | + apiVersion: v1 + kind: Pod + metadata: + name: kube-proxy + namespace: kube-system + annotations: + rkt.alpha.kubernetes.io/stage1-name-override: coreos.com/rkt/stage1-fly + spec: + hostNetwork: true + containers: + - name: kube-proxy + image: quay.io/coreos/hyperkube:{{.k8s_version}} + command: + - /hyperkube + - proxy + - --master=http://127.0.0.1:8080 + - --cluster-cidr={{.k8s_service_ip_range}} + securityContext: + privileged: true + volumeMounts: + - mountPath: /etc/ssl/certs + name: ssl-certs-host + readOnly: true + - mountPath: /var/run/dbus + name: dbus + readOnly: false + volumes: + - hostPath: + path: /usr/share/ca-certificates + name: ssl-certs-host + - hostPath: + path: /var/run/dbus + name: dbus + - path: /etc/kubernetes/manifests/kube-apiserver.yaml + filesystem: root + contents: + inline: | + apiVersion: v1 + kind: Pod + metadata: + name: kube-apiserver + namespace: kube-system + spec: + hostNetwork: true + containers: + - name: kube-apiserver + image: quay.io/coreos/hyperkube:{{.k8s_version}} + command: + - /hyperkube + - apiserver + - --bind-address=0.0.0.0 + - --advertise-address={{.k8s_apiserver_advertise_address}} + - --etcd-servers={{.k8s_etcd_endpoints}} + - --allow-privileged=true + - --service-cluster-ip-range={{.k8s_service_ip_range}} + - --secure-port={{.k8s_controller_port}} + - --admission-control=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,ResourceQuota + - --tls-cert-file=/etc/kubernetes/ssl/apiserver.pem + - --tls-private-key-file=/etc/kubernetes/ssl/apiserver-key.pem + - --client-ca-file=/etc/kubernetes/ssl/ca.pem + - --service-account-key-file=/etc/kubernetes/ssl/apiserver-key.pem + - --runtime-config=extensions/v1beta1/networkpolicies=true + - --anonymous-auth=false + livenessProbe: + httpGet: + host: 127.0.0.1 + port: 8080 + path: /healthz + initialDelaySeconds: 15 + timeoutSeconds: 15 + ports: + - containerPort: {{.k8s_controller_port}} + hostPort: {{.k8s_controller_port}} + name: https + - containerPort: 8080 + hostPort: 8080 + name: local + volumeMounts: + - mountPath: /etc/kubernetes/ssl + name: ssl-certs-kubernetes + readOnly: true + - mountPath: /etc/ssl/certs + name: ssl-certs-host + readOnly: true + volumes: + - hostPath: + path: /etc/kubernetes/ssl + name: ssl-certs-kubernetes + - hostPath: + path: /usr/share/ca-certificates + name: ssl-certs-host + - path: /etc/flannel/options.env + filesystem: root + contents: + inline: | + FLANNELD_ETCD_ENDPOINTS={{.k8s_etcd_endpoints}} + FLANNELD_IFACE={{.k8s_flanneld_iface}} + - path: /etc/kubernetes/manifests/kube-controller-manager.yaml + filesystem: root + contents: + inline: | + apiVersion: v1 + kind: Pod + metadata: + name: kube-controller-manager + namespace: kube-system + spec: + containers: + - name: kube-controller-manager + image: quay.io/coreos/hyperkube:{{.k8s_version}} + command: + - /hyperkube + - controller-manager + - --master=http://127.0.0.1:8080 + - --leader-elect=true + - --service-account-private-key-file=/etc/kubernetes/ssl/apiserver-key.pem + - --root-ca-file=/etc/kubernetes/ssl/ca.pem + resources: + requests: + cpu: 200m + livenessProbe: + httpGet: + host: 127.0.0.1 + path: /healthz + port: 10252 + initialDelaySeconds: 15 + timeoutSeconds: 15 + volumeMounts: + - mountPath: /etc/kubernetes/ssl + name: ssl-certs-kubernetes + readOnly: true + - mountPath: /etc/ssl/certs + name: ssl-certs-host + readOnly: true + hostNetwork: true + volumes: + - hostPath: + path: /etc/kubernetes/ssl + name: ssl-certs-kubernetes + - hostPath: + path: /usr/share/ca-certificates + name: ssl-certs-host + - path: /etc/kubernetes/manifests/kube-scheduler.yaml + filesystem: root + contents: + inline: | + apiVersion: v1 + kind: Pod + metadata: + name: kube-scheduler + namespace: kube-system + spec: + hostNetwork: true + containers: + - name: kube-scheduler + image: quay.io/coreos/hyperkube:{{.k8s_version}} + command: + - /hyperkube + - scheduler + - --master=http://127.0.0.1:8080 + - --leader-elect=true + resources: + requests: + cpu: 100m + livenessProbe: + httpGet: + host: 127.0.0.1 + path: /healthz + port: 10251 + initialDelaySeconds: 15 + timeoutSeconds: 15 + - path: /srv/kubernetes/manifests/kube-dns-deployment.yaml + filesystem: root + contents: + inline: | + apiVersion: extensions/v1beta1 + kind: Deployment + metadata: + name: kube-dns + namespace: kube-system + labels: + k8s-app: kube-dns + kubernetes.io/cluster-service: "true" + spec: + strategy: + rollingUpdate: + maxSurge: 10% + maxUnavailable: 0 + selector: + matchLabels: + k8s-app: kube-dns + template: + metadata: + labels: + k8s-app: kube-dns + annotations: + scheduler.alpha.kubernetes.io/critical-pod: '' + scheduler.alpha.kubernetes.io/tolerations: '[{"key":"CriticalAddonsOnly", "operator":"Exists"}]' + spec: + containers: + - name: kubedns + image: gcr.io/google_containers/kubedns-amd64:1.9 + livenessProbe: + httpGet: + path: /healthz-kubedns + port: 8080 + scheme: HTTP + initialDelaySeconds: 60 + timeoutSeconds: 5 + successThreshold: 1 + failureThreshold: 5 + readinessProbe: + httpGet: + path: /readiness + port: 8081 + scheme: HTTP + initialDelaySeconds: 3 + timeoutSeconds: 5 + args: + - --domain=cluster.local + - --dns-port=10053 + - --config-map=kube-dns + - --v=2 + env: + - name: PROMETHEUS_PORT + value: "10055" + ports: + - containerPort: 10053 + name: dns-local + protocol: UDP + - containerPort: 10053 + name: dns-tcp-local + protocol: TCP + - containerPort: 10055 + name: metrics + protocol: TCP + - name: dnsmasq + image: gcr.io/google_containers/kube-dnsmasq-amd64:1.4 + livenessProbe: + httpGet: + path: /healthz-dnsmasq + port: 8080 + scheme: HTTP + initialDelaySeconds: 60 + timeoutSeconds: 5 + successThreshold: 1 + failureThreshold: 5 + args: + - --cache-size=1000 + - --no-resolv + - --server=127.0.0.1#10053 + - --log-facility=- + ports: + - containerPort: 53 + name: dns + protocol: UDP + - containerPort: 53 + name: dns-tcp + protocol: TCP + - name: dnsmasq-metrics + image: gcr.io/google_containers/dnsmasq-metrics-amd64:1.0 + livenessProbe: + httpGet: + path: /metrics + port: 10054 + scheme: HTTP + initialDelaySeconds: 60 + timeoutSeconds: 5 + successThreshold: 1 + failureThreshold: 5 + args: + - --v=2 + - --logtostderr + ports: + - containerPort: 10054 + name: metrics + protocol: TCP + - name: healthz + image: gcr.io/google_containers/exechealthz-amd64:1.2 + args: + - --cmd=nslookup kubernetes.default.svc.cluster.local 127.0.0.1 >/dev/null + - --url=/healthz-dnsmasq + - --cmd=nslookup kubernetes.default.svc.cluster.local 127.0.0.1:10053 >/dev/null + - --url=/healthz-kubedns + - --port=8080 + - --quiet + ports: + - containerPort: 8080 + protocol: TCP + dnsPolicy: Default + - path: /srv/kubernetes/manifests/kube-dns-svc.yaml + filesystem: root + contents: + inline: | + apiVersion: v1 + kind: Service + metadata: + name: kube-dns + namespace: kube-system + labels: + k8s-app: kube-dns + kubernetes.io/cluster-service: "true" + kubernetes.io/name: "KubeDNS" + spec: + selector: + k8s-app: kube-dns + clusterIP: {{.k8s_dns_service_ip}} + ports: + - name: dns + port: 53 + protocol: UDP + - name: dns-tcp + port: 53 + protocol: TCP + - path: /srv/kubernetes/manifests/heapster-deployment.yaml + filesystem: root + contents: + inline: | + apiVersion: extensions/v1beta1 + kind: Deployment + metadata: + name: heapster-v1.2.0 + namespace: kube-system + labels: + k8s-app: heapster + kubernetes.io/cluster-service: "true" + version: v1.2.0 + spec: + replicas: 1 + selector: + matchLabels: + k8s-app: heapster + version: v1.2.0 + template: + metadata: + labels: + k8s-app: heapster + version: v1.2.0 + annotations: + scheduler.alpha.kubernetes.io/critical-pod: '' + scheduler.alpha.kubernetes.io/tolerations: '[{"key":"CriticalAddonsOnly", "operator":"Exists"}]' + spec: + containers: + - image: gcr.io/google_containers/heapster:v1.2.0 + name: heapster + livenessProbe: + httpGet: + path: /healthz + port: 8082 + scheme: HTTP + initialDelaySeconds: 180 + timeoutSeconds: 5 + command: + - /heapster + - --source=kubernetes.summary_api:'' + - image: gcr.io/google_containers/addon-resizer:1.6 + name: heapster-nanny + resources: + limits: + cpu: 50m + memory: 90Mi + requests: + cpu: 50m + memory: 90Mi + env: + - name: MY_POD_NAME + valueFrom: + fieldRef: + fieldPath: metadata.name + - name: MY_POD_NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + command: + - /pod_nanny + - --cpu=80m + - --extra-cpu=4m + - --memory=200Mi + - --extra-memory=4Mi + - --threshold=5 + - --deployment=heapster-v1.2.0 + - --container=heapster + - --poll-period=300000 + - --estimator=exponential + - path: /srv/kubernetes/manifests/heapster-svc.yaml + filesystem: root + contents: + inline: | + kind: Service + apiVersion: v1 + metadata: + name: heapster + namespace: kube-system + labels: + kubernetes.io/cluster-service: "true" + kubernetes.io/name: "Heapster" + spec: + ports: + - port: 80 + targetPort: 8082 + selector: + k8s-app: heapster + - path: /srv/kubernetes/manifests/kube-dashboard-deployment.yaml + filesystem: root + contents: + inline: | + apiVersion: extensions/v1beta1 + kind: Deployment + metadata: + name: kubernetes-dashboard + namespace: kube-system + labels: + k8s-app: kubernetes-dashboard + kubernetes.io/cluster-service: "true" + spec: + selector: + matchLabels: + k8s-app: kubernetes-dashboard + template: + metadata: + labels: + k8s-app: kubernetes-dashboard + annotations: + scheduler.alpha.kubernetes.io/critical-pod: '' + scheduler.alpha.kubernetes.io/tolerations: '[{"key":"CriticalAddonsOnly", "operator":"Exists"}]' + spec: + containers: + - name: kubernetes-dashboard + image: gcr.io/google_containers/kubernetes-dashboard-amd64:v1.5.0 + resources: + # keep request = limit to keep this container in guaranteed class + limits: + cpu: 100m + memory: 50Mi + requests: + cpu: 100m + memory: 50Mi + ports: + - containerPort: 9090 + livenessProbe: + httpGet: + path: / + port: 9090 + initialDelaySeconds: 30 + timeoutSeconds: 30 + - path: /srv/kubernetes/manifests/kube-dashboard-svc.yaml + filesystem: root + contents: + inline: | + apiVersion: v1 + kind: Service + metadata: + name: kubernetes-dashboard + namespace: kube-system + labels: + k8s-app: kubernetes-dashboard + kubernetes.io/cluster-service: "true" + spec: + selector: + k8s-app: kubernetes-dashboard + ports: + - port: 80 + targetPort: 9090 + - path: /opt/init-flannel + filesystem: root + mode: 0544 + contents: + inline: | + #!/bin/bash -ex + function init_flannel { + echo "Waiting for etcd..." + while true + do + IFS=',' read -ra ES <<< "{{.k8s_etcd_endpoints}}" + for ETCD in "${ES[@]}"; do + echo "Trying: $ETCD" + if [ -n "$(curl --silent "$ETCD/v2/machines")" ]; then + local ACTIVE_ETCD=$ETCD + break + fi + sleep 1 + done + if [ -n "$ACTIVE_ETCD" ]; then + break + fi + done + RES=$(curl --silent -X PUT -d "value={\"Network\":\"{{.k8s_pod_network}}\",\"Backend\":{\"Type\":\"vxlan\"}}" "$ACTIVE_ETCD/v2/keys/coreos.com/network/config?prevExist=false") + if [ -z "$(echo $RES | grep '"action":"create"')" ] && [ -z "$(echo $RES | grep 'Key already exists')" ]; then + echo "Unexpected error configuring flannel pod network: $RES" + fi + } + init_flannel + {{ if eq .container_runtime "rkt" }} + - path: /opt/bin/host-rkt + filesystem: root + mode: 0544 + contents: + inline: | + #!/bin/sh + # This is bind mounted into the kubelet rootfs and all rkt shell-outs go + # through this rkt wrapper. It essentially enters the host mount namespace + # (which it is already in) only for the purpose of breaking out of the chroot + # before calling rkt. It makes things like rkt gc work and avoids bind mounting + # in certain rkt filesystem dependancies into the kubelet rootfs. This can + # eventually be obviated when the write-api stuff gets upstream and rkt gc is + # through the api-server. Related issue: + # https://github.com/coreos/rkt/issues/2878 + exec nsenter -m -u -i -n -p -t 1 -- /usr/bin/rkt "$@" + {{ end }} + - path: /opt/k8s-addons + filesystem: root + mode: 0544 + contents: + inline: | + #!/bin/bash -ex + echo "Waiting for Kubernetes API..." + until curl --silent "http://127.0.0.1:8080/version" + do + sleep 5 + done + echo "K8S: DNS addon" + curl --silent -H "Content-Type: application/yaml" -XPOST -d"$(cat /srv/kubernetes/manifests/kube-dns-deployment.yaml)" "http://127.0.0.1:8080/apis/extensions/v1beta1/namespaces/kube-system/deployments" + curl --silent -H "Content-Type: application/yaml" -XPOST -d"$(cat /srv/kubernetes/manifests/kube-dns-svc.yaml)" "http://127.0.0.1:8080/api/v1/namespaces/kube-system/services" + echo "K8S: Heapster addon" + curl --silent -H "Content-Type: application/yaml" -XPOST -d"$(cat /srv/kubernetes/manifests/heapster-deployment.yaml)" "http://127.0.0.1:8080/apis/extensions/v1beta1/namespaces/kube-system/deployments" + curl --silent -H "Content-Type: application/yaml" -XPOST -d"$(cat /srv/kubernetes/manifests/heapster-svc.yaml)" "http://127.0.0.1:8080/api/v1/namespaces/kube-system/services" + echo "K8S: Dashboard addon" + curl --silent -H "Content-Type: application/yaml" -XPOST -d"$(cat /srv/kubernetes/manifests/kube-dashboard-deployment.yaml)" "http://127.0.0.1:8080/apis/extensions/v1beta1/namespaces/kube-system/deployments" + curl --silent -H "Content-Type: application/yaml" -XPOST -d"$(cat /srv/kubernetes/manifests/kube-dashboard-svc.yaml)" "http://127.0.0.1:8080/api/v1/namespaces/kube-system/services" + - path: "/etc/modules-load.d/rbd.conf" + filesystem: root + contents: + inline: | + rbd + - path: "/opt/bin/ceph-rbdnamer" + filesystem: root + mode: 0755 + contents: + inline: | + #!/bin/sh + DEV=$1 + NUM=`echo $DEV | sed 's#p.*##g' | tr -d 'a-z'` + POOL=`cat /sys/devices/rbd/$NUM/pool` + IMAGE=`cat /sys/devices/rbd/$NUM/name` + SNAP=`cat /sys/devices/rbd/$NUM/current_snap` + if [ "$SNAP" = "-" ]; then + echo -n "$POOL $IMAGE" + else + echo -n "$POOL $IMAGE@$SNAP" + fi + - path: "/etc/udev/rules.d/50-rbd.rules" + filesystem: root + contents: + inline: | + KERNEL=="rbd[0-9]*", ENV{DEVTYPE}=="disk", PROGRAM="/opt/bin/ceph-rbdnamer %k", SYMLINK+="rbd/%c{1}/%c{2}" + KERNEL=="rbd[0-9]*", ENV{DEVTYPE}=="partition", PROGRAM="/opt/bin/ceph-rbdnamer %k", SYMLINK+="rbd/%c{1}/%c{2}-part%n" + - path: /etc/ssh/sshd_config + filesystem: root + mode: 0600 + user: + id: 0 + group: + id: 0 + contents: + inline: | + UsePrivilegeSeparation sandbox + Subsystem sftp internal-sftp + ClientAliveInterval 180 + UseDNS no + ListenAddress {{.ssh_ip}} +{{ if index . "ssh_authorized_keys" }} +passwd: + users: + - name: core + ssh_authorized_keys: + {{ range $element := .ssh_authorized_keys }} + - {{$element}} + {{end}} +{{end}}{% endraw %} diff --git a/ansible/roles/ansible-vvp-bootstrap/templates/ignition/coreos-install.yaml.j2 b/ansible/roles/ansible-vvp-bootstrap/templates/ignition/coreos-install.yaml.j2 new file mode 100755 index 0000000..30cd838 --- /dev/null +++ b/ansible/roles/ansible-vvp-bootstrap/templates/ignition/coreos-install.yaml.j2 @@ -0,0 +1,107 @@ +{# +-*- encoding: utf-8 -*- +============LICENSE_START======================================================= +org.onap.vvp/engagementmgr +=================================================================== +Copyright © 2017 AT&T Intellectual Property. All rights reserved. +=================================================================== + +Unless otherwise specified, all software contained herein is licensed +under the Apache License, Version 2.0 (the “License”); +you may not use this software except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. + + + +Unless otherwise specified, all documentation contained herein is licensed +under the Creative Commons License, Attribution 4.0 Intl. (the “License”); +you may not use this documentation except in compliance with the License. +You may obtain a copy of the License at + + https://creativecommons.org/licenses/by/4.0/ + +Unless required by applicable law or agreed to in writing, documentation +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. + +============LICENSE_END============================================ + + ECOMP is a trademark and service mark of AT&T Intellectual Property. +#} +--- +storage: + disks: +{% for disk in disks %} + - device: {{disk.device}} + wipe_table: {{disk.wipe_table}} +{% for partition in disk.partitions %} + partitions: + - label: {{partition.label}} + number: {{partition.number}} +{% endfor %} +{% endfor %} + filesystems: +{% for fs in filesystems if not "sda" in fs.device %} + - name: {{fs.name}} + mount: + device: "{{fs.device}}" + format: "{{fs.format}}" + create: + force: {{fs.create.force}} +{% if "options" in fs.create.keys() %} + options: +{% for option in fs.create.options %} + - "{{option}}" +{% endfor %} +{% endif %} +{% endfor %} +systemd: + units: +{% for mount in mounts %} + - name: {{mount.name}}.mount + enable: true + contents: | + [Mount] + What={{mount.dev}} + Where={{mount.dest}} + Type={{mount.type}} + [Install] + WantedBy=local-fs.target +{% endfor %} + - name: install.service + enable: true + contents: | + [Unit] + Requires=network-online.target + After=network-online.target + Requires=systemd-networkd.socket + After=systemd-networkd.socket + [Service] + Type=oneshot + ExecStartPre=/usr/lib/systemd/systemd-networkd-wait-online {% raw %} + ExecStart=/usr/bin/curl {{.ignition_endpoint}}?{{.request.raw_query}}&os=installed -o ignition.json + ExecStart=/usr/bin/coreos-install -d /dev/sda -C {{.coreos_channel}} -V {{.coreos_version}} -b http://{% endraw %}{{ops_management_ip}}{% raw %}:8080/assets/coreos -i ignition.json + ExecStart=/usr/bin/udevadm settle + ExecStart=/usr/bin/systemctl reboot + [Install] + WantedBy=multi-user.target +{{ if .ssh_authorized_keys }} +passwd: + users: + - name: core + ssh_authorized_keys: + {{ range $element := .ssh_authorized_keys }} + - {{$element}} + {{end}} +{{end}} +{% endraw %} diff --git a/ansible/roles/ansible-vvp-bootstrap/templates/ignition/worker.yaml.j2 b/ansible/roles/ansible-vvp-bootstrap/templates/ignition/worker.yaml.j2 new file mode 100755 index 0000000..701559b --- /dev/null +++ b/ansible/roles/ansible-vvp-bootstrap/templates/ignition/worker.yaml.j2 @@ -0,0 +1,397 @@ +{# +-*- encoding: utf-8 -*- +============LICENSE_START======================================================= +org.onap.vvp/engagementmgr +=================================================================== +Copyright © 2017 AT&T Intellectual Property. All rights reserved. +=================================================================== + +Unless otherwise specified, all software contained herein is licensed +under the Apache License, Version 2.0 (the “License”); +you may not use this software except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. + + + +Unless otherwise specified, all documentation contained herein is licensed +under the Creative Commons License, Attribution 4.0 Intl. (the “License”); +you may not use this documentation except in compliance with the License. +You may obtain a copy of the License at + + https://creativecommons.org/licenses/by/4.0/ + +Unless required by applicable law or agreed to in writing, documentation +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. + +============LICENSE_END============================================ + + ECOMP is a trademark and service mark of AT&T Intellectual Property. +#} +--- +{% raw %} +systemd: + units: + - name: sshd.socket + enable: true + contents: | + [Unit] + Description=OpenSSH Server Socket + Conflicts=sshd.service + + [Socket] + ListenStream={{.ssh_ip}}:22 + FreeBind=true + Accept=yes + + [Install] + WantedBy=sockets.target + - name: etcd2.service + enable: true + dropins: + - name: 40-etcd-cluster.conf + contents: | + [Service] + Environment="ETCD_NAME={{.etcd_name}}" + Environment="ETCD_ADVERTISE_CLIENT_URLS=http://{{.domain_name}}:2379" + Environment="ETCD_INITIAL_ADVERTISE_PEER_URLS={{.etcd_initial_peers}}" + Environment="ETCD_LISTEN_CLIENT_URLS=http://0.0.0.0:2379" + Environment="ETCD_LISTEN_PEER_URLS=http://0.0.0.0:2380" + Environment="ETCD_INITIAL_CLUSTER={{.etcd_initial_cluster}}" + Environment="ETCD_STRICT_RECONFIG_CHECK=true" + - name: flanneld.service + dropins: + - name: 40-add-options.conf + contents: | + [Service] + EnvironmentFile=-/etc/flannel/options.env + - name: docker.service + dropins: + - name: 40-flannel.conf + contents: | + [Unit] + Requires=flanneld.service + After=flanneld.service + [Service] + EnvironmentFile=/etc/kubernetes/cni/docker_opts_cni.env + - name: locksmithd.service + dropins: + - name: 40-etcd-lock.conf + contents: | + [Service] + Environment="REBOOT_STRATEGY=off" + - name: k8s-certs@.service + contents: | + [Unit] + Description=Fetch Kubernetes certificate assets + Requires=network-online.target + After=network-online.target + [Service] + ExecStartPre=/usr/bin/mkdir -p /etc/kubernetes/ssl + ExecStart=/usr/bin/bash -c "[ -f /etc/kubernetes/ssl/%i ] || curl {{.k8s_cert_endpoint}}/tls/%i -o /etc/kubernetes/ssl/%i" + - name: k8s-assets.target + contents: | + [Unit] + Description=Load Kubernetes Assets + Requires=k8s-certs@worker.pem.service + After=k8s-certs@worker.pem.service + Requires=k8s-certs@worker-key.pem.service + After=k8s-certs@worker-key.pem.service + Requires=k8s-certs@ca.pem.service + After=k8s-certs@ca.pem.service + - name: kubelet.service + enable: true + contents: | + [Unit] + Description=Kubelet via Hyperkube ACI + Requires=k8s-assets.target + After=k8s-assets.target + [Service] + Environment=KUBELET_VERSION={{.k8s_version}} + Environment="RKT_OPTS=--uuid-file-save=/var/run/kubelet-pod.uuid \ + --volume dns,kind=host,source=/etc/resolv.conf \ + --mount volume=dns,target=/etc/resolv.conf \ + {{ if eq .container_runtime "rkt" -}} + --volume rkt,kind=host,source=/opt/bin/host-rkt \ + --mount volume=rkt,target=/usr/bin/rkt \ + --volume var-lib-rkt,kind=host,source=/var/lib/rkt \ + --mount volume=var-lib-rkt,target=/var/lib/rkt \ + --volume stage,kind=host,source=/tmp \ + --mount volume=stage,target=/tmp \ + {{ end -}} + --volume modprobe,kind=host,source=/usr/sbin/modprobe \ + --mount volume=modprobe,target=/usr/sbin/modprobe \ + --volume lib-modules,kind=host,source=/lib/modules \ + --mount volume=lib-modules,target=/lib/modules \ + --volume mkfsxfs,kind=host,source=/usr/sbin/mkfs.xfs \ + --mount volume=mkfsxfs,target=/usr/sbin/mkfs.xfs \ + --volume libxfs,kind=host,source=/lib64/libxfs.so.0 \ + --mount volume=libxfs,target=/lib64/libxfs.so.0 \ + --volume var-log,kind=host,source=/var/log \ + --mount volume=var-log,target=/var/log" + ExecStartPre=/usr/bin/mkdir -p /etc/kubernetes/manifests + ExecStartPre=/usr/bin/mkdir -p /var/log/containers + ExecStartPre=-/usr/bin/rkt rm --uuid-file=/var/run/kubelet-pod.uuid + ExecStart=/usr/lib/coreos/kubelet-wrapper \ + --api-servers={{.k8s_controller_endpoint}} \ + --cni-conf-dir=/etc/kubernetes/cni/net.d \ + --network-plugin=cni \ + --container-runtime={{.container_runtime}} \ + --rkt-path=/usr/bin/rkt \ + --rkt-stage1-image=coreos.com/rkt/stage1-coreos \ + --register-node=true \ + --allow-privileged=true \ + --pod-manifest-path=/etc/kubernetes/manifests \ + --hostname-override={{.domain_name}} \ + --cluster_dns={{.k8s_dns_service_ip}} \ + --cluster_domain=cluster.local \ + --kubeconfig=/etc/kubernetes/worker-kubeconfig.yaml \ + --tls-cert-file=/etc/kubernetes/ssl/worker.pem \ + --tls-private-key-file=/etc/kubernetes/ssl/worker-key.pem + ExecStop=-/usr/bin/rkt stop --uuid-file=/var/run/kubelet-pod.uuid + Restart=always + RestartSec=10 + [Install] + WantedBy=multi-user.target + {{ if eq .container_runtime "rkt" }} + - name: rkt-api.service + enable: true + contents: | + [Unit] + Before=kubelet.service + [Service] + ExecStart=/usr/bin/rkt api-service + Restart=always + RestartSec=10 + [Install] + RequiredBy=kubelet.service + - name: load-rkt-stage1.service + enable: true + contents: | + [Unit] + Description=Load rkt stage1 images + Documentation=http://github.com/coreos/rkt + Requires=network-online.target + After=network-online.target + Before=rkt-api.service + [Service] + Type=oneshot + RemainAfterExit=yes + ExecStart=/usr/bin/rkt fetch /usr/lib/rkt/stage1-images/stage1-coreos.aci /usr/lib/rkt/stage1-images/stage1-fly.aci --insecure-options=image + [Install] + RequiredBy=rkt-api.service + {{ end }} + {{if ne .sysdig_access_key "" }} + - name: sysdig.service + enable: true + contents: | + [Unit] + Description=Sysdig Cloud Agent + After=docker.service + Requires=docker.service + [Service] + TimeoutStartSec=0 + ExecStartPre=-/usr/bin/docker kill sysdig-agent + ExecStartPre=-/usr/bin/docker rm sysdig-agent + ExecStartPre=-/usr/bin/docker rmi sysdig-agent + ExecStartPre=/usr/bin/docker pull sysdig/agent +{% endraw %} + ExecStart=/usr/bin/docker run --name sysdig-agent --privileged --net host --pid host -e ADDITIONAL_CONF="app_checks:\n - name: nginx\n enabled: false" -e ACCESS_KEY={{sysdig_access_key}} -e TAGS=deploy_environment:{{ice_environment}} -v /var/lib/rkt:/host/var/lib/rkt:ro -v /var/run/docker.sock:/host/var/run/docker.sock -v /dev:/host/dev -v /proc:/host/proc:ro -v /boot:/host/boot:ro sysdig/agent {% raw %} + ExecStop=/usr/bin/docker stop sysdig-agent + [Install] + WantedBy=multi-user.target + RequiredBy=k8-addons.service + {{ end }} +storage: + filesystems: +{% endraw %} +{% for fs in filesystems %} + - name: {{fs.device}} + mount: + device: {{fs.device}} + format: {{fs.format}} + create: + force: {{fs.create.force}} +{% if "options" in fs.create.keys() %} + options: +{% for option in fs.create.options %} + - {{option}} +{% endfor %} +{% endif %} +{% endfor %}{% raw %} + files: + - path: /etc/kubernetes/cni/net.d/10-flannel.conf + filesystem: root + contents: + inline: | + { + "name": "podnet", + "type": "flannel", + "delegate": { + "isDefaultGateway": true + } + } + - path: /etc/kubernetes/cni/docker_opts_cni.env + filesystem: root + contents: + inline: | + DOCKER_OPT_BIP="" + DOCKER_OPT_IPMASQ="" + - path: /etc/sysctl.d/max-user-watches.conf + filesystem: root + contents: + inline: | + fs.inotify.max_user_watches=16184 + - path: /etc/kubernetes/worker-kubeconfig.yaml + filesystem: root + contents: + inline: | + apiVersion: v1 + kind: Config + clusters: + - name: local + cluster: + certificate-authority: /etc/kubernetes/ssl/ca.pem + users: + - name: kubelet + user: + client-certificate: /etc/kubernetes/ssl/worker.pem + client-key: /etc/kubernetes/ssl/worker-key.pem + contexts: + - context: + cluster: local + user: kubelet + name: kubelet-context + current-context: kubelet-context + - path: /etc/kubernetes/manifests/kube-proxy.yaml + filesystem: root + contents: + inline: | + apiVersion: v1 + kind: Pod + metadata: + name: kube-proxy + namespace: kube-system + annotations: + rkt.alpha.kubernetes.io/stage1-name-override: coreos.com/rkt/stage1-fly + spec: + hostNetwork: true + containers: + - name: kube-proxy + image: quay.io/coreos/hyperkube:{{.k8s_version}} + command: + - /hyperkube + - proxy + - --master={{.k8s_controller_endpoint}} + - --kubeconfig=/etc/kubernetes/worker-kubeconfig.yaml + securityContext: + privileged: true + volumeMounts: + - mountPath: /etc/ssl/certs + name: "ssl-certs" + - mountPath: /etc/kubernetes/worker-kubeconfig.yaml + name: "kubeconfig" + readOnly: true + - mountPath: /etc/kubernetes/ssl + name: "etc-kube-ssl" + readOnly: true + - mountPath: /var/run/dbus + name: dbus + readOnly: false + volumes: + - name: "ssl-certs" + hostPath: + path: "/usr/share/ca-certificates" + - name: "kubeconfig" + hostPath: + path: "/etc/kubernetes/worker-kubeconfig.yaml" + - name: "etc-kube-ssl" + hostPath: + path: "/etc/kubernetes/ssl" + - hostPath: + path: /var/run/dbus + name: dbus + - path: /etc/flannel/options.env + filesystem: root + contents: + inline: | + FLANNELD_ETCD_ENDPOINTS={{.k8s_etcd_endpoints}} + FLANNELD_IFACE={{.k8s_flanneld_iface}} + {{ if eq .container_runtime "rkt" }} + - path: /opt/bin/host-rkt + filesystem: root + mode: 0544 + contents: + inline: | + #!/bin/sh + # This is bind mounted into the kubelet rootfs and all rkt shell-outs go + # through this rkt wrapper. It essentially enters the host mount namespace + # (which it is already in) only for the purpose of breaking out of the chroot + # before calling rkt. It makes things like rkt gc work and avoids bind mounting + # in certain rkt filesystem dependancies into the kubelet rootfs. This can + # eventually be obviated when the write-api stuff gets upstream and rkt gc is + # through the api-server. Related issue: + # https://github.com/coreos/rkt/issues/2878 + exec nsenter -m -u -i -n -p -t 1 -- /usr/bin/rkt "$@" + {{ end }} + - path: "/etc/modules-load.d/rbd.conf" + filesystem: root + contents: + inline: | + rbd + - path: "/opt/bin/ceph-rbdnamer" + filesystem: root + mode: 0755 + contents: + inline: | + #!/bin/sh + DEV=$1 + NUM=`echo $DEV | sed 's#p.*##g' | tr -d 'a-z'` + POOL=`cat /sys/devices/rbd/$NUM/pool` + IMAGE=`cat /sys/devices/rbd/$NUM/name` + SNAP=`cat /sys/devices/rbd/$NUM/current_snap` + if [ "$SNAP" = "-" ]; then + echo -n "$POOL $IMAGE" + else + echo -n "$POOL $IMAGE@$SNAP" + fi + - path: "/etc/udev/rules.d/50-rbd.rules" + filesystem: root + contents: + inline: | + KERNEL=="rbd[0-9]*", ENV{DEVTYPE}=="disk", PROGRAM="/opt/bin/ceph-rbdnamer %k", SYMLINK+="rbd/%c{1}/%c{2}" + KERNEL=="rbd[0-9]*", ENV{DEVTYPE}=="partition", PROGRAM="/opt/bin/ceph-rbdnamer %k", SYMLINK+="rbd/%c{1}/%c{2}-part%n" + - path: /etc/ssh/sshd_config + filesystem: root + mode: 0600 + user: + id: 0 + group: + id: 0 + contents: + inline: | + # Use most defaults for sshd configuration. + UsePrivilegeSeparation sandbox + Subsystem sftp internal-sftp + ClientAliveInterval 180 + UseDNS no + ListenAddress {{.ssh_ip}} +{{ if index . "ssh_authorized_keys" }} +passwd: + users: + - name: core + ssh_authorized_keys: + {{ range $element := .ssh_authorized_keys }} + - {{$element}} + {{end}} +{{end}}{% endraw %} diff --git a/ansible/roles/ansible-vvp-bootstrap/templates/kubeconfig.j2 b/ansible/roles/ansible-vvp-bootstrap/templates/kubeconfig.j2 new file mode 100755 index 0000000..a8e03bf --- /dev/null +++ b/ansible/roles/ansible-vvp-bootstrap/templates/kubeconfig.j2 @@ -0,0 +1,56 @@ +# -*- encoding: utf-8 -*- +# ============LICENSE_START======================================================= +# org.onap.vvp/engagementmgr +# =================================================================== +# Copyright © 2017 AT&T Intellectual Property. All rights reserved. +# =================================================================== +# +# Unless otherwise specified, all software contained herein is licensed +# under the Apache License, Version 2.0 (the “License”); +# you may not use this software except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +# +# +# Unless otherwise specified, all documentation contained herein is licensed +# under the Creative Commons License, Attribution 4.0 Intl. (the “License”); +# you may not use this documentation except in compliance with the License. +# You may obtain a copy of the License at +# +# https://creativecommons.org/licenses/by/4.0/ +# +# Unless required by applicable law or agreed to in writing, documentation +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +# ============LICENSE_END============================================ +# +# ECOMP is a trademark and service mark of AT&T Intellectual Property. +apiVersion: v1 +kind: Config +users: +- name: bootcfg-user + user: + client-certificate-data: {{ADMIN_CERT_BASE64.stdout}} + client-key-data: {{ADMIN_KEY_BASE64.stdout}} +clusters: +- name: bootcfg-cluster + cluster: + certificate-authority-data: {{CA_CERT_BASE64.stdout}} + server: https://{{(hosts|selectattr('role', 'equalto', 'controller')|first).name}}.{{domain}}:{{k8s_controller_port}} +contexts: +- context: + cluster: bootcfg-cluster + user: bootcfg-user + name: bootcfg-context +current-context: bootcfg-context diff --git a/ansible/roles/ansible-vvp-bootstrap/templates/openssl.config.j2 b/ansible/roles/ansible-vvp-bootstrap/templates/openssl.config.j2 new file mode 100755 index 0000000..3d44c5b --- /dev/null +++ b/ansible/roles/ansible-vvp-bootstrap/templates/openssl.config.j2 @@ -0,0 +1,73 @@ +# -*- encoding: utf-8 -*- +# ============LICENSE_START======================================================= +# org.onap.vvp/engagementmgr +# =================================================================== +# Copyright © 2017 AT&T Intellectual Property. All rights reserved. +# =================================================================== +# +# Unless otherwise specified, all software contained herein is licensed +# under the Apache License, Version 2.0 (the “License”); +# you may not use this software except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +# +# +# Unless otherwise specified, all documentation contained herein is licensed +# under the Creative Commons License, Attribution 4.0 Intl. (the “License”); +# you may not use this documentation except in compliance with the License. +# You may obtain a copy of the License at +# +# https://creativecommons.org/licenses/by/4.0/ +# +# Unless required by applicable law or agreed to in writing, documentation +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +# ============LICENSE_END============================================ +# +# ECOMP is a trademark and service mark of AT&T Intellectual Property. +[req] +req_extensions = v3_req +distinguished_name = req_distinguished_name + +[req_distinguished_name] + +[ v3_req ] +basicConstraints = CA:FALSE +keyUsage = nonRepudiation, digitalSignature, keyEncipherment +subjectAltName = @alt_names + +[alt_names] +DNS.101 = kubernetes +DNS.102 = kubernetes.default +DNS.103 = kubernetes.default.svc +DNS.104 = kubernetes.default.svc.cluster.local +{% if item == "apiserver" %} +IP.200 = 10.3.0.1 + {% for controller in hosts|selectattr('role', 'equalto', 'controller') %} + {%- set count = loop.index %} + {%- for entry in controller.dnsmasq_config %} +IP.{{count}}{{loop.index}} = {{entry.split(',')[1]}} +DNS.{{count}}{{loop.index}} = {{entry.split(',')[2]}}.{{domain}} +{% endfor %} + {%- endfor %} +{%- elif item == "worker" %} + {%- for worker in hosts|selectattr('role', 'equalto', 'worker') %} + {%- set count = loop.index %} + {%- for entry in worker.dnsmasq_config %} +IP.{{count}}{{loop.index }} = {{entry.split(',')[1]}} +DNS.{{count}}{{loop.index }} = {{entry.split(',')[2]}}.{{domain}} +{% endfor %} + {%- endfor %} +# workers +{% endif %} diff --git a/ansible/roles/ansible-vvp-bootstrap/templates/profiles/controller.json.j2 b/ansible/roles/ansible-vvp-bootstrap/templates/profiles/controller.json.j2 new file mode 100755 index 0000000..11b8cd0 --- /dev/null +++ b/ansible/roles/ansible-vvp-bootstrap/templates/profiles/controller.json.j2 @@ -0,0 +1,56 @@ +{# +-*- encoding: utf-8 -*- +============LICENSE_START======================================================= +org.onap.vvp/engagementmgr +=================================================================== +Copyright © 2017 AT&T Intellectual Property. All rights reserved. +=================================================================== + +Unless otherwise specified, all software contained herein is licensed +under the Apache License, Version 2.0 (the “License”); +you may not use this software except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. + + + +Unless otherwise specified, all documentation contained herein is licensed +under the Creative Commons License, Attribution 4.0 Intl. (the “License”); +you may not use this documentation except in compliance with the License. +You may obtain a copy of the License at + + https://creativecommons.org/licenses/by/4.0/ + +Unless required by applicable law or agreed to in writing, documentation +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. + +============LICENSE_END============================================ + + ECOMP is a trademark and service mark of AT&T Intellectual Property. +#} +{ + "id": "controller", + "name": "Kubernetes Controller", + "boot": { + "kernel": "/assets/coreos/{{coreos_version}}/coreos_production_pxe.vmlinuz", + "initrd": ["/assets/coreos/{{coreos_version}}/coreos_production_pxe_image.cpio.gz"], + "cmdline": { + "root": "/dev/sda1", + "coreos.config.url": "http://{{ops_management_ip}}:8080/ignition?uuid=${uuid}&mac=${net0/mac:hexhyp}&os=installed", + "coreos.autologin": "", + "coreos.first_boot": "" + } + }, + "cloud_id": "", + "ignition_id": "controller.yaml" +} diff --git a/ansible/roles/ansible-vvp-bootstrap/templates/profiles/install-reboot.json.j2 b/ansible/roles/ansible-vvp-bootstrap/templates/profiles/install-reboot.json.j2 new file mode 100755 index 0000000..ed4d0df --- /dev/null +++ b/ansible/roles/ansible-vvp-bootstrap/templates/profiles/install-reboot.json.j2 @@ -0,0 +1,55 @@ +{# +-*- encoding: utf-8 -*- +============LICENSE_START======================================================= +org.onap.vvp/engagementmgr +=================================================================== +Copyright © 2017 AT&T Intellectual Property. All rights reserved. +=================================================================== + +Unless otherwise specified, all software contained herein is licensed +under the Apache License, Version 2.0 (the “License”); +you may not use this software except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. + + + +Unless otherwise specified, all documentation contained herein is licensed +under the Creative Commons License, Attribution 4.0 Intl. (the “License”); +you may not use this documentation except in compliance with the License. +You may obtain a copy of the License at + + https://creativecommons.org/licenses/by/4.0/ + +Unless required by applicable law or agreed to in writing, documentation +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. + +============LICENSE_END============================================ + + ECOMP is a trademark and service mark of AT&T Intellectual Property. +#} +{ + "id": "install-reboot", + "name": "Install CoreOS and Reboot", + "boot": { + "kernel": "/assets/coreos/{{coreos_version}}/coreos_production_pxe.vmlinuz", + "initrd": ["/assets/coreos/{{coreos_version}}/coreos_production_pxe_image.cpio.gz"], + "cmdline": { + "coreos.config.url": "http://{{ops_management_ip}}:8080/ignition?uuid=${uuid}&mac=${net0/mac:hexhyp}", + "coreos.autologin": "", + "coreos.first_boot": "" + } + }, + "cloud_id": "", + "ignition_id": "coreos-install.yaml" +} diff --git a/ansible/roles/ansible-vvp-bootstrap/templates/profiles/worker.json.j2 b/ansible/roles/ansible-vvp-bootstrap/templates/profiles/worker.json.j2 new file mode 100755 index 0000000..6eb3f24 --- /dev/null +++ b/ansible/roles/ansible-vvp-bootstrap/templates/profiles/worker.json.j2 @@ -0,0 +1,56 @@ +{# +-*- encoding: utf-8 -*- +============LICENSE_START======================================================= +org.onap.vvp/engagementmgr +=================================================================== +Copyright © 2017 AT&T Intellectual Property. All rights reserved. +=================================================================== + +Unless otherwise specified, all software contained herein is licensed +under the Apache License, Version 2.0 (the “License”); +you may not use this software except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. + + + +Unless otherwise specified, all documentation contained herein is licensed +under the Creative Commons License, Attribution 4.0 Intl. (the “License”); +you may not use this documentation except in compliance with the License. +You may obtain a copy of the License at + + https://creativecommons.org/licenses/by/4.0/ + +Unless required by applicable law or agreed to in writing, documentation +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. + +============LICENSE_END============================================ + + ECOMP is a trademark and service mark of AT&T Intellectual Property. +#} +{ + "id": "worker", + "name": "Kubernetes Worker", + "boot": { + "kernel": "/assets/coreos/{{coreos_version}}/coreos_production_pxe.vmlinuz", + "initrd": ["/assets/coreos/{{coreos_version}}/coreos_production_pxe_image.cpio.gz"], + "cmdline": { + "root": "/dev/sda1", + "coreos.config.url": "http://{{ops_management_ip}}:8080/ignition?uuid=${uuid}&mac=${net0/mac:hexhyp}", + "coreos.autologin": "", + "coreos.first_boot": "" + } + }, + "cloud_id": "", + "ignition_id": "worker.yaml" +} diff --git a/ansible/simple-deploy.yml b/ansible/simple-deploy.yml new file mode 100755 index 0000000..6d43884 --- /dev/null +++ b/ansible/simple-deploy.yml @@ -0,0 +1,55 @@ +# -*- encoding: utf-8 -*- +# ============LICENSE_START======================================================= +# org.onap.vvp/engagementmgr +# =================================================================== +# Copyright © 2017 AT&T Intellectual Property. All rights reserved. +# =================================================================== +# +# Unless otherwise specified, all software contained herein is licensed +# under the Apache License, Version 2.0 (the “License”); +# you may not use this software except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +# +# +# Unless otherwise specified, all documentation contained herein is licensed +# under the Creative Commons License, Attribution 4.0 Intl. (the “License”); +# you may not use this documentation except in compliance with the License. +# You may obtain a copy of the License at +# +# https://creativecommons.org/licenses/by/4.0/ +# +# Unless required by applicable law or agreed to in writing, documentation +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +# ============LICENSE_END============================================ +# +# ECOMP is a trademark and service mark of AT&T Intellectual Property. +- hosts: localhost + connection: local + gather_facts: False + tasks: + - name: Deploy Secrets, configmaps, and Services | Deploy + kubectl_apply_manifest: + manifest: "{{item}}" + with_fileglob: + - "{{k8_config_dir}}/secrets/*" + - "{{k8_config_dir}}/configmaps/*" + - "{{k8_config_dir}}/services/*" + - "{{k8_config_dir}}/jobs/*" + + - name: Create deployment | Create Deployment + kubectl_apply_manifest: + manifest: "{{item}}" + with_fileglob: "{{k8_config_dir}}/deployments/*" |