Merge "Golden configuration - fix image for mdb nodes"
diff --git a/defaults/haproxy/elasticsearch.yml b/defaults/haproxy/elasticsearch.yml
new file mode 100644
index 0000000..07db053
--- /dev/null
+++ b/defaults/haproxy/elasticsearch.yml
@@ -0,0 +1,6 @@
+parameters:
+ _param:
+ haproxy_elasticsearch_http_bind_port: 9200
+ haproxy_elasticsearch_http_exposed_port: 9200
+ haproxy_elasticsearch_binary_bind_port: 9300
+ haproxy_elasticsearch_binary_exposed_port: 9300
diff --git a/defaults/haproxy/init.yml b/defaults/haproxy/init.yml
new file mode 100644
index 0000000..499e085
--- /dev/null
+++ b/defaults/haproxy/init.yml
@@ -0,0 +1,2 @@
+classes:
+- system.defaults.haproxy.elasticsearch
diff --git a/defaults/init.yml b/defaults/init.yml
index 2683f28..f12a8ec 100644
--- a/defaults/init.yml
+++ b/defaults/init.yml
@@ -26,6 +26,7 @@
- system.defaults.stacklight
- system.defaults.xtrabackup
- system.defaults.backup
+- system.defaults.haproxy
# k8s
- system.defaults.etcd
parameters:
diff --git a/elasticsearch/client/ssl.yml b/elasticsearch/client/ssl.yml
new file mode 100644
index 0000000..9f0f9c2
--- /dev/null
+++ b/elasticsearch/client/ssl.yml
@@ -0,0 +1,5 @@
+parameters:
+ elasticsearch:
+ client:
+ server:
+ scheme: https
diff --git a/fluentd/label/default_metric/prometheus_ssl.yml b/fluentd/label/default_metric/prometheus_ssl.yml
new file mode 100644
index 0000000..292c481
--- /dev/null
+++ b/fluentd/label/default_metric/prometheus_ssl.yml
@@ -0,0 +1,9 @@
+parameters:
+ fluentd:
+ agent:
+ config:
+ input:
+ prometheus:
+ metric:
+ ssl:
+ enabled: True
diff --git a/fluentd/label/default_output/elasticsearch_ssl.yml b/fluentd/label/default_output/elasticsearch_ssl.yml
new file mode 100644
index 0000000..da3a5a7
--- /dev/null
+++ b/fluentd/label/default_output/elasticsearch_ssl.yml
@@ -0,0 +1,9 @@
+parameters:
+ fluentd:
+ agent:
+ config:
+ label:
+ default_output:
+ match:
+ elasticsearch_output:
+ scheme: https
diff --git a/haproxy/proxy/listen/stacklight/elasticsearch.yml b/haproxy/proxy/listen/stacklight/elasticsearch.yml
index 582de6a..d684861 100644
--- a/haproxy/proxy/listen/stacklight/elasticsearch.yml
+++ b/haproxy/proxy/listen/stacklight/elasticsearch.yml
@@ -1,10 +1,6 @@
parameters:
_param:
haproxy_elasticsearch_bind_host: ${_param:cluster_vip_address}
- haproxy_elasticsearch_http_bind_port: 9200
- haproxy_elasticsearch_http_exposed_port: 9200
- haproxy_elasticsearch_binary_bind_port: 9300
- haproxy_elasticsearch_binary_exposed_port: 9300
haproxy:
proxy:
listen:
@@ -17,7 +13,7 @@
- dontlog-normal
balance: roundrobin
binds:
- - address: ${_param:haproxy_elasticsearch_bind_host}
+ - address: ${_param:cluster_vip_address}
port: ${_param:haproxy_elasticsearch_http_bind_port}
servers:
- name: ${_param:cluster_node01_hostname}
diff --git a/haproxy/proxy/listen/stacklight/elasticsearch_ssl.yml b/haproxy/proxy/listen/stacklight/elasticsearch_ssl.yml
new file mode 100644
index 0000000..a50280e
--- /dev/null
+++ b/haproxy/proxy/listen/stacklight/elasticsearch_ssl.yml
@@ -0,0 +1,55 @@
+parameters:
+ _param:
+ haproxy_elasticsearch_bind_host: ${_param:cluster_vip_address}
+ haproxy:
+ proxy:
+ listen:
+ elasticsearch:
+ mode: http
+ options:
+ - httplog
+ - http-keep-alive
+ - prefer-last-server
+ - dontlog-normal
+ balance: roundrobin
+ binds:
+ - address: ${_param:cluster_vip_address}
+ port: ${_param:haproxy_elasticsearch_http_bind_port}
+ ssl:
+ enabled: true
+ pem_file: /etc/elasticsearch/elasticsearch.pem
+ servers:
+ - name: ${_param:cluster_node01_hostname}
+ host: ${_param:cluster_node01_address}
+ port: ${_param:haproxy_elasticsearch_http_exposed_port}
+ params: 'check inter 10s fastinter 2s downinter 3s rise 3 fall 3'
+ - name: ${_param:cluster_node02_hostname}
+ host: ${_param:cluster_node02_address}
+ port: ${_param:haproxy_elasticsearch_http_exposed_port}
+ params: 'check inter 10s fastinter 2s downinter 3s rise 3 fall 3'
+ - name: ${_param:cluster_node03_hostname}
+ host: ${_param:cluster_node03_address}
+ port: ${_param:haproxy_elasticsearch_http_exposed_port}
+ params: 'check inter 10s fastinter 2s downinter 3s rise 3 fall 3'
+ elasticsearch_binary:
+ mode: tcp
+ options:
+ - tcpka
+ - tcplog
+ balance: source
+ binds:
+ - address: ${_param:cluster_vip_address}
+ port: ${_param:haproxy_elasticsearch_binary_bind_port}
+ servers:
+ - name: ${_param:cluster_node01_hostname}
+ host: ${_param:cluster_node01_address}
+ port: ${_param:haproxy_elasticsearch_binary_exposed_port}
+ params: 'check'
+ - name: ${_param:cluster_node02_hostname}
+ host: ${_param:cluster_node02_address}
+ port: ${_param:haproxy_elasticsearch_binary_exposed_port}
+ params: 'check'
+ - name: ${_param:cluster_node03_hostname}
+ host: ${_param:cluster_node03_address}
+ port: ${_param:haproxy_elasticsearch_binary_exposed_port}
+ params: 'check'
diff --git a/jenkins/client/job/deploy/update/init.yml b/jenkins/client/job/deploy/update/init.yml
index 8e58753..c3ea450 100644
--- a/jenkins/client/job/deploy/update/init.yml
+++ b/jenkins/client/job/deploy/update/init.yml
@@ -5,7 +5,6 @@
- system.jenkins.client.job.deploy.update.update_mirror_image
- system.jenkins.client.job.deploy.update.update_ceph
- system.jenkins.client.job.deploy.update.upgrade
- - system.jenkins.client.job.deploy.update.upgrade_rabbitmq
- system.jenkins.client.job.deploy.update.upgrade_compute
- system.jenkins.client.job.deploy.update.upgrade_mcp_release
- system.jenkins.client.job.deploy.update.upgrade_ovs_gateway
@@ -22,3 +21,7 @@
- system.jenkins.client.job.deploy.galera_database_backup
- system.jenkins.client.job.deploy.backupninja_backup
- system.jenkins.client.job.deploy.backupninja_restore
+ - system.jenkins.client.job.deploy.update.update_glusterfs
+ - system.jenkins.client.job.deploy.update.update_glusterfs_servers
+ - system.jenkins.client.job.deploy.update.update_glusterfs_clients
+ - system.jenkins.client.job.deploy.update.update_glusterfs_cluster_op_version
diff --git a/jenkins/client/job/deploy/update/update_glusterfs.yml b/jenkins/client/job/deploy/update/update_glusterfs.yml
new file mode 100644
index 0000000..dfdfc9e
--- /dev/null
+++ b/jenkins/client/job/deploy/update/update_glusterfs.yml
@@ -0,0 +1,31 @@
+#
+# Jobs to run given states on given Salt master environment's
+#
+parameters:
+ jenkins:
+ client:
+ job:
+ update-glusterfs:
+ type: workflow-scm
+ description: This is a general job which runs "Update glusterfs servers", "Update glusterfs clients" and "Update glusterfs cluster.op-version" jobs with default parameters. If you need/want better control of update process use those jobs.
+ concurrent: true
+ discard:
+ build:
+ keep_num: 10
+ artifact:
+ keep_num: 10
+ display_name: "Update GlusterFS"
+ scm:
+ type: git
+ url: "${_param:jenkins_gerrit_url}/mk/mk-pipelines"
+ branch: "${_param:jenkins_pipelines_branch}"
+ credentials: "gerrit"
+ script: update-glusterfs.groovy
+ param:
+ DRIVE_TRAIN_PARAMS:
+ type: text
+ description: "Yaml based DriveTrain releated params"
+ default: |
+ ---
+ SALT_MASTER_URL: "${_param:jenkins_salt_api_url}"
+ SALT_MASTER_CREDENTIALS: "salt"
diff --git a/jenkins/client/job/deploy/update/update_glusterfs_clients.yml b/jenkins/client/job/deploy/update/update_glusterfs_clients.yml
new file mode 100644
index 0000000..48a393c
--- /dev/null
+++ b/jenkins/client/job/deploy/update/update_glusterfs_clients.yml
@@ -0,0 +1,37 @@
+#
+# Jobs to run given states on given Salt master environment's
+#
+parameters:
+ jenkins:
+ client:
+ job:
+ update-glusterfs-clients:
+ type: workflow-scm
+ description: Update glusterfs-client package on corresponding hosts
+ concurrent: true
+ discard:
+ build:
+ keep_num: 10
+ artifact:
+ keep_num: 10
+ display_name: "Update glusterfs clients"
+ scm:
+ type: git
+ url: "${_param:jenkins_gerrit_url}/mk/mk-pipelines"
+ branch: "${_param:jenkins_pipelines_branch}"
+ credentials: "gerrit"
+ script: update-glusterfs-clients.groovy
+ param:
+ DRIVE_TRAIN_PARAMS:
+ type: text
+ description: "Yaml based DriveTrain releated params"
+ default: |
+ ---
+ SALT_MASTER_URL: "${_param:jenkins_salt_api_url}"
+ SALT_MASTER_CREDENTIALS: "salt"
+ # Salt compound target to match nodes to be updated [*, G@osfamily:debian].
+ TARGET_SERVERS: "I@glusterfs:client"
+ # Does not validate server availability/status before update
+ IGNORE_SERVER_STATUS: false
+ # Does not validate that all servers have been updated
+ IGNORE_SERVER_VERSION: false
diff --git a/jenkins/client/job/deploy/update/update_glusterfs_cluster_op_version.yml b/jenkins/client/job/deploy/update/update_glusterfs_cluster_op_version.yml
new file mode 100644
index 0000000..e35e4fa
--- /dev/null
+++ b/jenkins/client/job/deploy/update/update_glusterfs_cluster_op_version.yml
@@ -0,0 +1,39 @@
+#
+# Jobs to run given states on given Salt master environment's
+#
+parameters:
+ jenkins:
+ client:
+ job:
+ update-glusterfs-cluster-op-version:
+ type: workflow-scm
+ description: Update cluster.op-version global option
+ concurrent: true
+ discard:
+ build:
+ keep_num: 10
+ artifact:
+ keep_num: 10
+ display_name: "Update glusterfs cluster.op-version"
+ scm:
+ type: git
+ url: "${_param:jenkins_gerrit_url}/mk/mk-pipelines"
+ branch: "${_param:jenkins_pipelines_branch}"
+ credentials: "gerrit"
+ script: update-glusterfs-cluster-op-version.groovy
+ param:
+ DRIVE_TRAIN_PARAMS:
+ type: text
+ description: "Yaml based DriveTrain releated params"
+ default: |
+ ---
+ SALT_MASTER_URL: "${_param:jenkins_salt_api_url}"
+ SALT_MASTER_CREDENTIALS: "salt"
+ # Salt compound target to match nodes to be updated [*, G@osfamily:debian].
+ TARGET_SERVERS: "I@glusterfs:server:role:primary"
+ # GlusterFS cluster.op-verion option to set. Leave it empty to get proper version from cluster.max-op-version if available.
+ CLUSTER_OP_VERSION: ''
+ # Does not validate that all clients have been updated
+ IGNORE_CLIENT_VERSION: false
+ # Does not validate that all servers have been updated
+ IGNORE_SERVER_VERSION: false
diff --git a/jenkins/client/job/deploy/update/update_glusterfs_servers.yml b/jenkins/client/job/deploy/update/update_glusterfs_servers.yml
new file mode 100644
index 0000000..97f4e77
--- /dev/null
+++ b/jenkins/client/job/deploy/update/update_glusterfs_servers.yml
@@ -0,0 +1,37 @@
+#
+# Jobs to run given states on given Salt master environment's
+#
+parameters:
+ jenkins:
+ client:
+ job:
+ update-glusterfs-servers:
+ type: workflow-scm
+ description: Update glusterfs-server package on corresponding hosts
+ concurrent: true
+ discard:
+ build:
+ keep_num: 10
+ artifact:
+ keep_num: 10
+ display_name: "Update glusterfs servers"
+ scm:
+ type: git
+ url: "${_param:jenkins_gerrit_url}/mk/mk-pipelines"
+ branch: "${_param:jenkins_pipelines_branch}"
+ credentials: "gerrit"
+ script: update-glusterfs-servers.groovy
+ param:
+ DRIVE_TRAIN_PARAMS:
+ type: text
+ description: "Yaml based DriveTrain releated params"
+ default: |
+ ---
+ SALT_MASTER_URL: "${_param:jenkins_salt_api_url}"
+ SALT_MASTER_CREDENTIALS: "salt"
+ # Salt compound target to match nodes to be updated [*, G@osfamily:debian].
+ TARGET_SERVERS: "I@glusterfs:server"
+ # Does not validate server availability/status before update
+ IGNORE_SERVER_STATUS: false
+ # Update GlusterFS even there is a non-replicated volume
+ IGNORE_NON_REPLICATED_VOLUMES: false
diff --git a/kibana/client/ssl.yml b/kibana/client/ssl.yml
new file mode 100644
index 0000000..76160c6
--- /dev/null
+++ b/kibana/client/ssl.yml
@@ -0,0 +1,5 @@
+parameters:
+ kibana:
+ client:
+ server:
+ scheme: https
diff --git a/kibana/server/single.yml b/kibana/server/single.yml
index 965f274..5c59588 100644
--- a/kibana/server/single.yml
+++ b/kibana/server/single.yml
@@ -13,4 +13,5 @@
engine: elasticsearch
host: ${_param:kibana_elasticsearch_host}
port: 9200
+ scheme: http
diff --git a/kibana/server/ssl.yml b/kibana/server/ssl.yml
new file mode 100644
index 0000000..5b049f8
--- /dev/null
+++ b/kibana/server/ssl.yml
@@ -0,0 +1,5 @@
+parameters:
+ kibana:
+ server:
+ database:
+ scheme: https
diff --git a/salt/minion/cert/elasticsearch.yml b/salt/minion/cert/elasticsearch.yml
new file mode 100644
index 0000000..0ac232d
--- /dev/null
+++ b/salt/minion/cert/elasticsearch.yml
@@ -0,0 +1,16 @@
+parameters:
+ salt:
+ minion:
+ cert:
+ elasticsearch:
+ host: ${_param:salt_minion_ca_host}
+ authority: ${_param:salt_minion_ca_authority}
+ common_name: elasticsearch
+ signing_policy: cert_server
+ alternative_names: IP:127.0.0.1,IP:${_param:single_address},IP:${_param:stacklight_log_address},DNS:${linux:system:name},DNS:${linux:network:fqdn}
+ key_file: /etc/elasticsearch/elasticsearch.key
+ cert_file: /etc/elasticsearch/elasticsearch.crt
+ ca_file: /etc/ssl/certs/ca-${_param:salt_minion_ca_authority}.pem
+ all_file: /etc/elasticsearch/elasticsearch.pem
+ mode: '0444'
+ enabled: true
diff --git a/salt/minion/cert/fluentd_prometheus.yml b/salt/minion/cert/fluentd_prometheus.yml
new file mode 100644
index 0000000..d7f4469
--- /dev/null
+++ b/salt/minion/cert/fluentd_prometheus.yml
@@ -0,0 +1,14 @@
+parameters:
+ salt:
+ minion:
+ cert:
+ fluentd_prometheus:
+ host: ${_param:salt_minion_ca_host}
+ authority: ${_param:salt_minion_ca_authority}
+ common_name: fluentd_prometheus
+ signing_policy: cert_server
+ alternative_names: IP:127.0.0.1,IP:${_param:single_address},DNS:${linux:system:name},DNS:${linux:network:fqdn}
+ key_file: ${fluentd:agent:dir:config}/fluentd-prometheus.key
+ cert_file: ${fluentd:agent:dir:config}/fluentd-prometheus.crt
+ mode: '0444'
+ enabled: true