1
=== removed directory 'contrib/puppet'
2
=== removed directory 'contrib/puppet/files'
3
=== removed directory 'contrib/puppet/files/etc'
4
=== removed directory 'contrib/puppet/files/etc/default'
5
=== removed file 'contrib/puppet/files/etc/default/nova-compute'
6
--- contrib/puppet/files/etc/default/nova-compute	2010-11-12 19:07:46 +0000
7
+++ contrib/puppet/files/etc/default/nova-compute	1970-01-01 00:00:00 +0000
8
@@ -1,1 +0,0 @@
9
1
ENABLED=true
10
2
0
11
=== removed file 'contrib/puppet/files/etc/default/nova-volume'
12
--- contrib/puppet/files/etc/default/nova-volume	2010-11-12 19:07:46 +0000
13
+++ contrib/puppet/files/etc/default/nova-volume	1970-01-01 00:00:00 +0000
14
@@ -1,1 +0,0 @@
15
1
ENABLED=true
16
2
0
17
=== removed file 'contrib/puppet/files/etc/issue'
18
--- contrib/puppet/files/etc/issue	2010-11-12 19:07:46 +0000
19
+++ contrib/puppet/files/etc/issue	1970-01-01 00:00:00 +0000
20
@@ -1,5 +0,0 @@
21
1
-----------------------------------------------
22
2
23
3
    Welcome to your OpenStack installation!    
24
4
25
5
-----------------------------------------------
26
6
0
27
=== removed directory 'contrib/puppet/files/etc/libvirt'
28
=== removed file 'contrib/puppet/files/etc/libvirt/qemu.conf'
29
--- contrib/puppet/files/etc/libvirt/qemu.conf	2010-11-12 19:07:46 +0000
30
+++ contrib/puppet/files/etc/libvirt/qemu.conf	1970-01-01 00:00:00 +0000
31
@@ -1,170 +0,0 @@
32
1
# Master configuration file for the QEMU driver.
33
2
# All settings described here are optional - if omitted, sensible
34
3
# defaults are used.
35
4
36
5
# VNC is configured to listen on 127.0.0.1 by default.
37
6
# To make it listen on all public interfaces, uncomment
38
7
# this next option.
39
8
#
40
9
# NB, strong recommendation to enable TLS + x509 certificate
41
10
# verification when allowing public access
42
11
#
43
12
# vnc_listen = "0.0.0.0"
44
13
45
14
46
15
# Enable use of TLS encryption on the VNC server. This requires
47
16
# a VNC client which supports the VeNCrypt protocol extension.
48
17
# Examples include vinagre, virt-viewer, virt-manager and vencrypt
49
18
# itself. UltraVNC, RealVNC, TightVNC do not support this
50
19
#
51
20
# It is necessary to setup CA and issue a server certificate
52
21
# before enabling this.
53
22
#
54
23
# vnc_tls = 1
55
24
56
25
57
26
# Use of TLS requires that x509 certificates be issued. The
58
27
# default it to keep them in /etc/pki/libvirt-vnc. This directory
59
28
# must contain
60
29
#
61
30
#  ca-cert.pem - the CA master certificate
62
31
#  server-cert.pem - the server certificate signed with ca-cert.pem
63
32
#  server-key.pem  - the server private key
64
33
#
65
34
# This option allows the certificate directory to be changed
66
35
#
67
36
# vnc_tls_x509_cert_dir = "/etc/pki/libvirt-vnc"
68
37
69
38
70
39
# The default TLS configuration only uses certificates for the server
71
40
# allowing the client to verify the server's identity and establish
72
41
# and encrypted channel.
73
42
#
74
43
# It is possible to use x509 certificates for authentication too, by
75
44
# issuing a x509 certificate to every client who needs to connect.
76
45
#
77
46
# Enabling this option will reject any client who does not have a
78
47
# certificate signed by the CA in /etc/pki/libvirt-vnc/ca-cert.pem
79
48
#
80
49
# vnc_tls_x509_verify = 1
81
50
82
51
83
52
# The default VNC password. Only 8 letters are significant for
84
53
# VNC passwords. This parameter is only used if the per-domain
85
54
# XML config does not already provide a password. To allow
86
55
# access without passwords, leave this commented out. An empty
87
56
# string will still enable passwords, but be rejected by QEMU
88
57
# effectively preventing any use of VNC. Obviously change this
89
58
# example here before you set this
90
59
#
91
60
# vnc_password = "XYZ12345"
92
61
93
62
94
63
# Enable use of SASL encryption on the VNC server. This requires
95
64
# a VNC client which supports the SASL protocol extension.
96
65
# Examples include vinagre, virt-viewer and virt-manager
97
66
# itself. UltraVNC, RealVNC, TightVNC do not support this
98
67
#
99
68
# It is necessary to configure /etc/sasl2/qemu.conf to choose
100
69
# the desired SASL plugin (eg, GSSPI for Kerberos)
101
70
#
102
71
# vnc_sasl = 1
103
72
104
73
105
74
# The default SASL configuration file is located in /etc/sasl2/
106
75
# When running libvirtd unprivileged, it may be desirable to
107
76
# override the configs in this location. Set this parameter to
108
77
# point to the directory, and create a qemu.conf in that location
109
78
#
110
79
# vnc_sasl_dir = "/some/directory/sasl2"
111
80
112
81
113
82
114
83
115
84
# The default security driver is SELinux. If SELinux is disabled
116
85
# on the host, then the security driver will automatically disable
117
86
# itself. If you wish to disable QEMU SELinux security driver while
118
87
# leaving SELinux enabled for the host in general, then set this
119
88
# to 'none' instead
120
89
#
121
90
# security_driver = "selinux"
122
91
123
92
124
93
# The user ID for QEMU processes run by the system instance
125
94
user = "root"
126
95
127
96
# The group ID for QEMU processes run by the system instance
128
97
group = "root"
129
98
130
99
# Whether libvirt should dynamically change file ownership
131
100
# to match the configured user/group above. Defaults to 1.
132
101
# Set to 0 to disable file ownership changes.
133
102
#dynamic_ownership = 1
134
103
135
104
136
105
# What cgroup controllers to make use of with QEMU guests
137
106
#
138
107
#  - 'cpu' - use for schedular tunables
139
108
#  - 'devices' - use for device whitelisting
140
109
#
141
110
# NB, even if configured here, they won't be used unless
142
111
# the adminsitrator has mounted cgroups. eg
143
112
#
144
113
#  mkdir /dev/cgroup
145
114
#  mount -t cgroup -o devices,cpu none /dev/cgroup
146
115
#
147
116
# They can be mounted anywhere, and different controlers
148
117
# can be mounted in different locations. libvirt will detect
149
118
# where they are located.
150
119
#
151
120
# cgroup_controllers = [ "cpu", "devices" ]
152
121
153
122
# This is the basic set of devices allowed / required by
154
123
# all virtual machines.
155
124
#
156
125
# As well as this, any configured block backed disks,
157
126
# all sound device, and all PTY devices are allowed.
158
127
#
159
128
# This will only need setting if newer QEMU suddenly
160
129
# wants some device we don't already know a bout.
161
130
#
162
131
#cgroup_device_acl = [
163
132
#    "/dev/null", "/dev/full", "/dev/zero",
164
133
#    "/dev/random", "/dev/urandom",
165
134
#    "/dev/ptmx", "/dev/kvm", "/dev/kqemu",
166
135
#    "/dev/rtc", "/dev/hpet", "/dev/net/tun",
167
136
#]
168
137
169
138
# The default format for Qemu/KVM guest save images is raw; that is, the
170
139
# memory from the domain is dumped out directly to a file.  If you have
171
140
# guests with a large amount of memory, however, this can take up quite
172
141
# a bit of space.  If you would like to compress the images while they
173
142
# are being saved to disk, you can also set "lzop", "gzip", "bzip2", or "xz"
174
143
# for save_image_format.  Note that this means you slow down the process of
175
144
# saving a domain in order to save disk space; the list above is in descending
176
145
# order by performance and ascending order by compression ratio.
177
146
#
178
147
# save_image_format = "raw"
179
148
180
149
# If provided by the host and a hugetlbfs mount point is configured,
181
150
# a guest may request huge page backing.  When this mount point is
182
151
# unspecified here, determination of a host mount point in /proc/mounts
183
152
# will be attempted.  Specifying an explicit mount overrides detection
184
153
# of the same in /proc/mounts.  Setting the mount point to "" will
185
154
# disable guest hugepage backing.
186
155
#
187
156
# NB, within this mount point, guests will create memory backing files
188
157
# in a location of  $MOUNTPOINT/libvirt/qemu
189
158
190
159
# hugetlbfs_mount = "/dev/hugepages"
191
160
192
161
# mac_filter enables MAC addressed based filtering on bridge ports.
193
162
# This currently requires ebtables to be installed.
194
163
#
195
164
# mac_filter = 1
196
165
197
166
# By default, PCI devices below non-ACS switch are not allowed to be assigned
198
167
# to guests. By setting relaxed_acs_check to 1 such devices will be allowed to
199
168
# be assigned to guests.
200
169
#
201
170
# relaxed_acs_check = 1
202
171
0
203
=== removed directory 'contrib/puppet/files/etc/lvm'
204
=== removed file 'contrib/puppet/files/etc/lvm/lvm.conf'
205
--- contrib/puppet/files/etc/lvm/lvm.conf	2010-11-12 19:07:46 +0000
206
+++ contrib/puppet/files/etc/lvm/lvm.conf	1970-01-01 00:00:00 +0000
207
@@ -1,463 +0,0 @@
208
1
# This is an example configuration file for the LVM2 system.
209
2
# It contains the default settings that would be used if there was no
210
3
# /etc/lvm/lvm.conf file.
211
4
#
212
5
# Refer to 'man lvm.conf' for further information including the file layout.
213
6
#
214
7
# To put this file in a different directory and override /etc/lvm set
215
8
# the environment variable LVM_SYSTEM_DIR before running the tools.
216
9
217
10
218
11
# This section allows you to configure which block devices should
219
12
# be used by the LVM system.
220
13
devices {
221
14
222
15
    # Where do you want your volume groups to appear ?
223
16
    dir = "/dev"
224
17
225
18
    # An array of directories that contain the device nodes you wish
226
19
    # to use with LVM2.
227
20
    scan = [ "/dev" ]
228
21
229
22
    # If several entries in the scanned directories correspond to the
230
23
    # same block device and the tools need to display a name for device,
231
24
    # all the pathnames are matched against each item in the following
232
25
    # list of regular expressions in turn and the first match is used.
233
26
    preferred_names = [ ]
234
27
235
28
    # Try to avoid using undescriptive /dev/dm-N names, if present.
236
29
    # preferred_names = [ "^/dev/mpath/", "^/dev/mapper/mpath", "^/dev/[hs]d" ]
237
30
238
31
    # A filter that tells LVM2 to only use a restricted set of devices.
239
32
    # The filter consists of an array of regular expressions.  These
240
33
    # expressions can be delimited by a character of your choice, and
241
34
    # prefixed with either an 'a' (for accept) or 'r' (for reject).
242
35
    # The first expression found to match a device name determines if
243
36
    # the device will be accepted or rejected (ignored).  Devices that
244
37
    # don't match any patterns are accepted.
245
38
246
39
    # Be careful if there there are symbolic links or multiple filesystem 
247
40
    # entries for the same device as each name is checked separately against
248
41
    # the list of patterns.  The effect is that if any name matches any 'a'
249
42
    # pattern, the device is accepted; otherwise if any name matches any 'r'
250
43
    # pattern it is rejected; otherwise it is accepted.
251
44
252
45
    # Don't have more than one filter line active at once: only one gets used.
253
46
254
47
    # Run vgscan after you change this parameter to ensure that
255
48
    # the cache file gets regenerated (see below).
256
49
    # If it doesn't do what you expect, check the output of 'vgscan -vvvv'.
257
50
258
51
259
52
    # By default we accept every block device:
260
53
    filter = [ "r|/dev/etherd/.*|", "r|/dev/block/.*|", "a/.*/" ]
261
54
262
55
    # Exclude the cdrom drive
263
56
    # filter = [ "r|/dev/cdrom|" ]
264
57
265
58
    # When testing I like to work with just loopback devices:
266
59
    # filter = [ "a/loop/", "r/.*/" ]
267
60
268
61
    # Or maybe all loops and ide drives except hdc:
269
62
    # filter =[ "a|loop|", "r|/dev/hdc|", "a|/dev/ide|", "r|.*|" ]
270
63
271
64
    # Use anchors if you want to be really specific
272
65
    # filter = [ "a|^/dev/hda8$|", "r/.*/" ]
273
66
274
67
    # The results of the filtering are cached on disk to avoid
275
68
    # rescanning dud devices (which can take a very long time).
276
69
    # By default this cache is stored in the /etc/lvm/cache directory
277
70
    # in a file called '.cache'.
278
71
    # It is safe to delete the contents: the tools regenerate it.
279
72
    # (The old setting 'cache' is still respected if neither of
280
73
    # these new ones is present.)
281
74
    cache_dir = "/etc/lvm/cache"
282
75
    cache_file_prefix = ""
283
76
284
77
    # You can turn off writing this cache file by setting this to 0.
285
78
    write_cache_state = 1
286
79
287
80
    # Advanced settings.
288
81
289
82
    # List of pairs of additional acceptable block device types found 
290
83
    # in /proc/devices with maximum (non-zero) number of partitions.
291
84
    # types = [ "fd", 16 ]
292
85
293
86
    # If sysfs is mounted (2.6 kernels) restrict device scanning to 
294
87
    # the block devices it believes are valid.
295
88
    # 1 enables; 0 disables.
296
89
    sysfs_scan = 1
297
90
298
91
    # By default, LVM2 will ignore devices used as components of
299
92
    # software RAID (md) devices by looking for md superblocks.
300
93
    # 1 enables; 0 disables.
301
94
    md_component_detection = 1
302
95
303
96
    # By default, if a PV is placed directly upon an md device, LVM2
304
97
    # will align its data blocks with the md device's stripe-width.
305
98
    # 1 enables; 0 disables.
306
99
    md_chunk_alignment = 1
307
100
308
101
    # By default, the start of a PV's data area will be a multiple of
309
102
    # the 'minimum_io_size' or 'optimal_io_size' exposed in sysfs.
310
103
    # - minimum_io_size - the smallest request the device can perform
311
104
    #   w/o incurring a read-modify-write penalty (e.g. MD's chunk size)
312
105
    # - optimal_io_size - the device's preferred unit of receiving I/O
313
106
    #   (e.g. MD's stripe width)
314
107
    # minimum_io_size is used if optimal_io_size is undefined (0).
315
108
    # If md_chunk_alignment is enabled, that detects the optimal_io_size.
316
109
    # This setting takes precedence over md_chunk_alignment.
317
110
    # 1 enables; 0 disables.
318
111
    data_alignment_detection = 1
319
112
320
113
    # Alignment (in KB) of start of data area when creating a new PV.
321
114
    # If a PV is placed directly upon an md device and md_chunk_alignment or
322
115
    # data_alignment_detection is enabled this parameter is ignored.
323
116
    # Set to 0 for the default alignment of 64KB or page size, if larger.
324
117
    data_alignment = 0
325
118
326
119
    # By default, the start of the PV's aligned data area will be shifted by
327
120
    # the 'alignment_offset' exposed in sysfs.  This offset is often 0 but
328
121
    # may be non-zero; e.g.: certain 4KB sector drives that compensate for
329
122
    # windows partitioning will have an alignment_offset of 3584 bytes
330
123
    # (sector 7 is the lowest aligned logical block, the 4KB sectors start
331
124
    # at LBA -1, and consequently sector 63 is aligned on a 4KB boundary).
332
125
    # 1 enables; 0 disables.
333
126
    data_alignment_offset_detection = 1
334
127
335
128
    # If, while scanning the system for PVs, LVM2 encounters a device-mapper
336
129
    # device that has its I/O suspended, it waits for it to become accessible.
337
130
    # Set this to 1 to skip such devices.  This should only be needed
338
131
    # in recovery situations.
339
132
    ignore_suspended_devices = 0
340
133
}
341
134
342
135
# This section that allows you to configure the nature of the
343
136
# information that LVM2 reports.
344
137
log {
345
138
346
139
    # Controls the messages sent to stdout or stderr.
347
140
    # There are three levels of verbosity, 3 being the most verbose.
348
141
    verbose = 0
349
142
350
143
    # Should we send log messages through syslog?
351
144
    # 1 is yes; 0 is no.
352
145
    syslog = 1
353
146
354
147
    # Should we log error and debug messages to a file?
355
148
    # By default there is no log file.
356
149
    #file = "/var/log/lvm2.log"
357
150
358
151
    # Should we overwrite the log file each time the program is run?
359
152
    # By default we append.
360
153
    overwrite = 0
361
154
362
155
    # What level of log messages should we send to the log file and/or syslog?
363
156
    # There are 6 syslog-like log levels currently in use - 2 to 7 inclusive.
364
157
    # 7 is the most verbose (LOG_DEBUG).
365
158
    level = 0
366
159
367
160
    # Format of output messages
368
161
    # Whether or not (1 or 0) to indent messages according to their severity
369
162
    indent = 1
370
163
371
164
    # Whether or not (1 or 0) to display the command name on each line output
372
165
    command_names = 0
373
166
374
167
    # A prefix to use before the message text (but after the command name,
375
168
    # if selected).  Default is two spaces, so you can see/grep the severity
376
169
    # of each message.
377
170
    prefix = "  "
378
171
379
172
    # To make the messages look similar to the original LVM tools use:
380
173
    #   indent = 0
381
174
    #   command_names = 1
382
175
    #   prefix = " -- "
383
176
384
177
    # Set this if you want log messages during activation.
385
178
    # Don't use this in low memory situations (can deadlock).
386
179
    # activation = 0
387
180
}
388
181
389
182
# Configuration of metadata backups and archiving.  In LVM2 when we
390
183
# talk about a 'backup' we mean making a copy of the metadata for the
391
184
# *current* system.  The 'archive' contains old metadata configurations.
392
185
# Backups are stored in a human readeable text format.
393
186
backup {
394
187
395
188
    # Should we maintain a backup of the current metadata configuration ?
396
189
    # Use 1 for Yes; 0 for No.
397
190
    # Think very hard before turning this off!
398
191
    backup = 1
399
192
400
193
    # Where shall we keep it ?
401
194
    # Remember to back up this directory regularly!
402
195
    backup_dir = "/etc/lvm/backup"
403
196
404
197
    # Should we maintain an archive of old metadata configurations.
405
198
    # Use 1 for Yes; 0 for No.
406
199
    # On by default.  Think very hard before turning this off.
407
200
    archive = 1
408
201
409
202
    # Where should archived files go ?
410
203
    # Remember to back up this directory regularly!
411
204
    archive_dir = "/etc/lvm/archive"
412
205
413
206
    # What is the minimum number of archive files you wish to keep ?
414
207
    retain_min = 10
415
208
416
209
    # What is the minimum time you wish to keep an archive file for ?
417
210
    retain_days = 30
418
211
}
419
212
420
213
# Settings for the running LVM2 in shell (readline) mode.
421
214
shell {
422
215
423
216
    # Number of lines of history to store in ~/.lvm_history
424
217
    history_size = 100
425
218
}
426
219
427
220
428
221
# Miscellaneous global LVM2 settings
429
222
global {
430
223
431
224
    # The file creation mask for any files and directories created.
432
225
    # Interpreted as octal if the first digit is zero.
433
226
    umask = 077
434
227
435
228
    # Allow other users to read the files
436
229
    #umask = 022
437
230
438
231
    # Enabling test mode means that no changes to the on disk metadata
439
232
    # will be made.  Equivalent to having the -t option on every
440
233
    # command.  Defaults to off.
441
234
    test = 0
442
235
443
236
    # Default value for --units argument
444
237
    units = "h"
445
238
446
239
    # Since version 2.02.54, the tools distinguish between powers of
447
240
    # 1024 bytes (e.g. KiB, MiB, GiB) and powers of 1000 bytes (e.g.
448
241
    # KB, MB, GB).
449
242
    # If you have scripts that depend on the old behaviour, set this to 0
450
243
    # temporarily until you update them.
451
244
    si_unit_consistency = 1
452
245
453
246
    # Whether or not to communicate with the kernel device-mapper.
454
247
    # Set to 0 if you want to use the tools to manipulate LVM metadata 
455
248
    # without activating any logical volumes.
456
249
    # If the device-mapper kernel driver is not present in your kernel
457
250
    # setting this to 0 should suppress the error messages.
458
251
    activation = 1
459
252
460
253
    # If we can't communicate with device-mapper, should we try running 
461
254
    # the LVM1 tools?
462
255
    # This option only applies to 2.4 kernels and is provided to help you
463
256
    # switch between device-mapper kernels and LVM1 kernels.
464
257
    # The LVM1 tools need to be installed with .lvm1 suffices
465
258
    # e.g. vgscan.lvm1 and they will stop working after you start using
466
259
    # the new lvm2 on-disk metadata format.
467
260
    # The default value is set when the tools are built.
468
261
    # fallback_to_lvm1 = 0
469
262
470
263
    # The default metadata format that commands should use - "lvm1" or "lvm2".
471
264
    # The command line override is -M1 or -M2.
472
265
    # Defaults to "lvm2".
473
266
    # format = "lvm2"
474
267
475
268
    # Location of proc filesystem
476
269
    proc = "/proc"
477
270
478
271
    # Type of locking to use. Defaults to local file-based locking (1).
479
272
    # Turn locking off by setting to 0 (dangerous: risks metadata corruption
480
273
    # if LVM2 commands get run concurrently).
481
274
    # Type 2 uses the external shared library locking_library.
482
275
    # Type 3 uses built-in clustered locking.
483
276
    # Type 4 uses read-only locking which forbids any operations that might 
484
277
    # change metadata.
485
278
    locking_type = 1
486
279
487
280
    # Set to 0 to fail when a lock request cannot be satisfied immediately.
488
281
    wait_for_locks = 1
489
282
490
283
    # If using external locking (type 2) and initialisation fails,
491
284
    # with this set to 1 an attempt will be made to use the built-in
492
285
    # clustered locking.
493
286
    # If you are using a customised locking_library you should set this to 0.
494
287
    fallback_to_clustered_locking = 1
495
288
496
289
    # If an attempt to initialise type 2 or type 3 locking failed, perhaps
497
290
    # because cluster components such as clvmd are not running, with this set
498
291
    # to 1 an attempt will be made to use local file-based locking (type 1).
499
292
    # If this succeeds, only commands against local volume groups will proceed.
500
293
    # Volume Groups marked as clustered will be ignored.
501
294
    fallback_to_local_locking = 1
502
295
503
296
    # Local non-LV directory that holds file-based locks while commands are
504
297
    # in progress.  A directory like /tmp that may get wiped on reboot is OK.
505
298
    locking_dir = "/var/lock/lvm"
506
299
507
300
    # Whenever there are competing read-only and read-write access requests for
508
301
    # a volume group's metadata, instead of always granting the read-only
509
302
    # requests immediately, delay them to allow the read-write requests to be
510
303
    # serviced.  Without this setting, write access may be stalled by a high
511
304
    # volume of read-only requests.
512
305
    # NB. This option only affects locking_type = 1 viz. local file-based
513
306
    # locking.
514
307
    prioritise_write_locks = 1
515
308
516
309
    # Other entries can go here to allow you to load shared libraries
517
310
    # e.g. if support for LVM1 metadata was compiled as a shared library use
518
311
    #   format_libraries = "liblvm2format1.so" 
519
312
    # Full pathnames can be given.
520
313
521
314
    # Search this directory first for shared libraries.
522
315
    #   library_dir = "/lib/lvm2"
523
316
524
317
    # The external locking library to load if locking_type is set to 2.
525
318
    #   locking_library = "liblvm2clusterlock.so"
526
319
}
527
320
528
321
activation {
529
322
    # Set to 0 to disable udev syncronisation (if compiled into the binaries).
530
323
    # Processes will not wait for notification from udev.
531
324
    # They will continue irrespective of any possible udev processing
532
325
    # in the background.  You should only use this if udev is not running
533
326
    # or has rules that ignore the devices LVM2 creates.
534
327
    # The command line argument --nodevsync takes precedence over this setting.
535
328
    # If set to 1 when udev is not running, and there are LVM2 processes
536
329
    # waiting for udev, run 'dmsetup udevcomplete_all' manually to wake them up.
537
330
    udev_sync = 1
538
331
539
332
    # How to fill in missing stripes if activating an incomplete volume.
540
333
    # Using "error" will make inaccessible parts of the device return
541
334
    # I/O errors on access.  You can instead use a device path, in which 
542
335
    # case, that device will be used to in place of missing stripes.
543
336
    # But note that using anything other than "error" with mirrored 
544
337
    # or snapshotted volumes is likely to result in data corruption.
545
338
    missing_stripe_filler = "error"
546
339
547
340
    # How much stack (in KB) to reserve for use while devices suspended
548
341
    reserved_stack = 256
549
342
550
343
    # How much memory (in KB) to reserve for use while devices suspended
551
344
    reserved_memory = 8192
552
345
553
346
    # Nice value used while devices suspended
554
347
    process_priority = -18
555
348
556
349
    # If volume_list is defined, each LV is only activated if there is a
557
350
    # match against the list.
558
351
    #   "vgname" and "vgname/lvname" are matched exactly.
559
352
    #   "@tag" matches any tag set in the LV or VG.
560
353
    #   "@*" matches if any tag defined on the host is also set in the LV or VG
561
354
    #
562
355
    # volume_list = [ "vg1", "vg2/lvol1", "@tag1", "@*" ]
563
356
564
357
    # Size (in KB) of each copy operation when mirroring
565
358
    mirror_region_size = 512
566
359
567
360
    # Setting to use when there is no readahead value stored in the metadata.
568
361
    #
569
362
    # "none" - Disable readahead.
570
363
    # "auto" - Use default value chosen by kernel.
571
364
    readahead = "auto"
572
365
573
366
    # 'mirror_image_fault_policy' and 'mirror_log_fault_policy' define
574
367
    # how a device failure affecting a mirror is handled.
575
368
    # A mirror is composed of mirror images (copies) and a log.
576
369
    # A disk log ensures that a mirror does not need to be re-synced
577
370
    # (all copies made the same) every time a machine reboots or crashes.
578
371
    #
579
372
    # In the event of a failure, the specified policy will be used to determine
580
373
    # what happens. This applies to automatic repairs (when the mirror is being
581
374
    # monitored by dmeventd) and to manual lvconvert --repair when
582
375
    # --use-policies is given.
583
376
    #
584
377
    # "remove" - Simply remove the faulty device and run without it.  If
585
378
    #            the log device fails, the mirror would convert to using
586
379
    #            an in-memory log.  This means the mirror will not
587
380
    #            remember its sync status across crashes/reboots and
588
381
    #            the entire mirror will be re-synced.  If a
589
382
    #            mirror image fails, the mirror will convert to a
590
383
    #            non-mirrored device if there is only one remaining good
591
384
    #            copy.
592
385
    #
593
386
    # "allocate" - Remove the faulty device and try to allocate space on
594
387
    #            a new device to be a replacement for the failed device.
595
388
    #            Using this policy for the log is fast and maintains the
596
389
    #            ability to remember sync state through crashes/reboots.
597
390
    #            Using this policy for a mirror device is slow, as it
598
391
    #            requires the mirror to resynchronize the devices, but it
599
392
    #            will preserve the mirror characteristic of the device.
600
393
    #            This policy acts like "remove" if no suitable device and
601
394
    #            space can be allocated for the replacement.
602
395
    #
603
396
    # "allocate_anywhere" - Not yet implemented. Useful to place the log device
604
397
    #            temporarily on same physical volume as one of the mirror
605
398
    #            images. This policy is not recommended for mirror devices
606
399
    #            since it would break the redundant nature of the mirror. This
607
400
    #            policy acts like "remove" if no suitable device and space can
608
401
    #            be allocated for the replacement.
609
402
610
403
    mirror_log_fault_policy = "allocate"
611
404
    mirror_device_fault_policy = "remove"
612
405
}
613
406
614
407
615
408
####################
616
409
# Advanced section #
617
410
####################
618
411
619
412
# Metadata settings
620
413
#
621
414
# metadata {
622
415
    # Default number of copies of metadata to hold on each PV.  0, 1 or 2.
623
416
    # You might want to override it from the command line with 0 
624
417
    # when running pvcreate on new PVs which are to be added to large VGs.
625
418
626
419
    # pvmetadatacopies = 1
627
420
628
421
    # Approximate default size of on-disk metadata areas in sectors.
629
422
    # You should increase this if you have large volume groups or
630
423
    # you want to retain a large on-disk history of your metadata changes.
631
424
632
425
    # pvmetadatasize = 255
633
426
634
427
    # List of directories holding live copies of text format metadata.
635
428
    # These directories must not be on logical volumes!
636
429
    # It's possible to use LVM2 with a couple of directories here,
637
430
    # preferably on different (non-LV) filesystems, and with no other 
638
431
    # on-disk metadata (pvmetadatacopies = 0). Or this can be in
639
432
    # addition to on-disk metadata areas.
640
433
    # The feature was originally added to simplify testing and is not
641
434
    # supported under low memory situations - the machine could lock up.
642
435
    #
643
436
    # Never edit any files in these directories by hand unless you
644
437
    # you are absolutely sure you know what you are doing! Use
645
438
    # the supplied toolset to make changes (e.g. vgcfgrestore).
646
439
647
440
    # dirs = [ "/etc/lvm/metadata", "/mnt/disk2/lvm/metadata2" ]
648
441
#}
649
442
650
443
# Event daemon
651
444
#
652
445
dmeventd {
653
446
    # mirror_library is the library used when monitoring a mirror device.
654
447
    #
655
448
    # "libdevmapper-event-lvm2mirror.so" attempts to recover from
656
449
    # failures.  It removes failed devices from a volume group and
657
450
    # reconfigures a mirror as necessary. If no mirror library is
658
451
    # provided, mirrors are not monitored through dmeventd.
659
452
660
453
    mirror_library = "libdevmapper-event-lvm2mirror.so"
661
454
662
455
    # snapshot_library is the library used when monitoring a snapshot device.
663
456
    #
664
457
    # "libdevmapper-event-lvm2snapshot.so" monitors the filling of
665
458
    # snapshots and emits a warning through syslog, when the use of
666
459
    # snapshot exceedes 80%. The warning is repeated when 85%, 90% and
667
460
    # 95% of the snapshot are filled.
668
461
669
462
    snapshot_library = "libdevmapper-event-lvm2snapshot.so"
670
463
}
671
464
0
672
=== removed file 'contrib/puppet/files/etc/nova.conf'
673
--- contrib/puppet/files/etc/nova.conf	2010-11-12 19:07:46 +0000
674
+++ contrib/puppet/files/etc/nova.conf	1970-01-01 00:00:00 +0000
675
@@ -1,28 +0,0 @@
676
1
--ec2_url=http://192.168.255.1:8773/services/Cloud
677
2
--rabbit_host=192.168.255.1
678
3
--redis_host=192.168.255.1
679
4
--s3_host=192.168.255.1
680
5
--vpn_ip=192.168.255.1
681
6
--datastore_path=/var/lib/nova/keeper
682
7
--networks_path=/var/lib/nova/networks
683
8
--instances_path=/var/lib/nova/instances
684
9
--buckets_path=/var/lib/nova/objectstore/buckets
685
10
--images_path=/var/lib/nova/objectstore/images
686
11
--ca_path=/var/lib/nova/CA
687
12
--keys_path=/var/lib/nova/keys
688
13
--vlan_start=2000
689
14
--vlan_end=3000
690
15
--private_range=192.168.0.0/16
691
16
--public_range=10.0.0.0/24
692
17
--volume_group=vgdata
693
18
--storage_dev=/dev/sdc
694
19
--bridge_dev=eth2
695
20
--aoe_eth_dev=eth2
696
21
--public_interface=vlan0
697
22
--default_kernel=aki-DEFAULT
698
23
--default_ramdisk=ari-DEFAULT
699
24
--vpn_image_id=ami-cloudpipe
700
25
--daemonize
701
26
--verbose
702
27
--syslog
703
28
--prefix=nova
704
29
0
705
=== removed directory 'contrib/puppet/files/production'
706
=== removed file 'contrib/puppet/files/production/boto.cfg'
707
--- contrib/puppet/files/production/boto.cfg	2010-11-12 19:07:46 +0000
708
+++ contrib/puppet/files/production/boto.cfg	1970-01-01 00:00:00 +0000
709
@@ -1,3 +0,0 @@
710
1
[Boto]
711
2
debug = 0
712
3
num_retries = 1
713
4
0
714
=== removed file 'contrib/puppet/files/production/genvpn.sh'
715
--- contrib/puppet/files/production/genvpn.sh	2010-11-12 19:07:46 +0000
716
+++ contrib/puppet/files/production/genvpn.sh	1970-01-01 00:00:00 +0000
717
@@ -1,35 +0,0 @@
718
1
#!/bin/bash
719
2
# vim: tabstop=4 shiftwidth=4 softtabstop=4
720
3
721
4
# Copyright 2010 United States Government as represented by the
722
5
# Administrator of the National Aeronautics and Space Administration.
723
6
# All Rights Reserved.
724
7
#
725
8
#    Licensed under the Apache License, Version 2.0 (the "License"); you may
726
9
#    not use this file except in compliance with the License. You may obtain
727
10
#    a copy of the License at
728
11
#
729
12
#         http://www.apache.org/licenses/LICENSE-2.0
730
13
#
731
14
#    Unless required by applicable law or agreed to in writing, software
732
15
#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
733
16
#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
734
17
#    License for the specific language governing permissions and limitations
735
18
#    under the License.
736
19
737
20
# This gets zipped and run on the cloudpipe-managed OpenVPN server
738
21
NAME=$1
739
22
SUBJ=$2
740
23
741
24
mkdir -p projects/$NAME
742
25
cd projects/$NAME
743
26
744
27
# generate a server priv key
745
28
openssl genrsa -out server.key 2048
746
29
747
30
# generate a server CSR
748
31
openssl req -new -key server.key -out server.csr -batch -subj "$SUBJ"
749
32
750
33
if [ "`id -u`" != "`grep nova /etc/passwd | cut -d':' -f3`" ]; then
751
34
    sudo chown -R nova:nogroup .
752
35
fi
753
36
0
754
=== removed file 'contrib/puppet/files/production/libvirt.qemu.xml.template'
755
--- contrib/puppet/files/production/libvirt.qemu.xml.template	2010-11-12 19:07:46 +0000
756
+++ contrib/puppet/files/production/libvirt.qemu.xml.template	1970-01-01 00:00:00 +0000
757
@@ -1,35 +0,0 @@
758
1
<domain type='%(type)s'>
759
2
    <name>%(name)s</name>
760
3
    <os>
761
4
        <type>hvm</type>
762
5
        <kernel>%(basepath)s/kernel</kernel>
763
6
        <initrd>%(basepath)s/ramdisk</initrd>
764
7
        <cmdline>root=/dev/vda1 console=ttyS0</cmdline>
765
8
    </os>
766
9
    <features>
767
10
        <acpi/>
768
11
    </features>
769
12
    <memory>%(memory_kb)s</memory>
770
13
    <vcpu>%(vcpus)s</vcpu>
771
14
    <devices>
772
15
        <disk type='file'>
773
16
            <source file='%(basepath)s/disk'/>
774
17
            <target dev='vda' bus='virtio'/>
775
18
        </disk>
776
19
        <interface type='bridge'>
777
20
            <source bridge='%(bridge_name)s'/>
778
21
            <mac address='%(mac_address)s'/>
779
22
            <!--   <model type='virtio'/>  CANT RUN virtio network right now -->
780
23
            <!--
781
24
            <filterref filter="nova-instance-%(name)s">
782
25
                <parameter name="IP" value="%(ip_address)s" />
783
26
                <parameter name="DHCPSERVER" value="%(dhcp_server)s" />
784
27
            </filterref>
785
28
            -->
786
29
        </interface>
787
30
        <serial type="file">
788
31
            <source path='%(basepath)s/console.log'/>
789
32
            <target port='1'/>
790
33
        </serial>
791
34
    </devices>
792
35
</domain>
793
36
0
794
=== removed file 'contrib/puppet/files/production/my.cnf'
795
--- contrib/puppet/files/production/my.cnf	2010-11-12 19:07:46 +0000
796
+++ contrib/puppet/files/production/my.cnf	1970-01-01 00:00:00 +0000
797
@@ -1,137 +0,0 @@
798
1
#
799
2
# The MySQL database server configuration file.
800
3
#
801
4
# You can copy this to one of:
802
5
# - "/etc/mysql/my.cnf" to set global options,
803
6
# - "~/.my.cnf" to set user-specific options.
804
7
# 
805
8
# One can use all long options that the program supports.
806
9
# Run program with --help to get a list of available options and with
807
10
# --print-defaults to see which it would actually understand and use.
808
11
#
809
12
# For explanations see
810
13
# http://dev.mysql.com/doc/mysql/en/server-system-variables.html
811
14
812
15
# This will be passed to all mysql clients
813
16
# It has been reported that passwords should be enclosed with ticks/quotes
814
17
# escpecially if they contain "#" chars...
815
18
# Remember to edit /etc/mysql/debian.cnf when changing the socket location.
816
19
[client]
817
20
port		= 3306
818
21
socket		= /var/run/mysqld/mysqld.sock
819
22
820
23
# Here is entries for some specific programs
821
24
# The following values assume you have at least 32M ram
822
25
823
26
# This was formally known as [safe_mysqld]. Both versions are currently parsed.
824
27
[mysqld_safe]
825
28
socket		= /var/run/mysqld/mysqld.sock
826
29
nice		= 0
827
30
828
31
[mysqld]
829
32
#
830
33
# * Basic Settings
831
34
#
832
35
833
36
#
834
37
# * IMPORTANT
835
38
#   If you make changes to these settings and your system uses apparmor, you may
836
39
#   also need to also adjust /etc/apparmor.d/usr.sbin.mysqld.
837
40
#
838
41
839
42
user		= mysql
840
43
socket		= /var/run/mysqld/mysqld.sock
841
44
port		= 3306
842
45
basedir		= /usr
843
46
datadir		= /var/lib/mysql
844
47
tmpdir		= /tmp
845
48
skip-external-locking
846
49
#
847
50
# Instead of skip-networking the default is now to listen only on
848
51
# localhost which is more compatible and is not less secure.
849
52
# bind-address		= 127.0.0.1
850
53
#
851
54
# * Fine Tuning
852
55
#
853
56
innodb_buffer_pool_size = 12G
854
57
#innodb_log_file_size = 256M
855
58
innodb_log_buffer_size=4M
856
59
innodb_flush_log_at_trx_commit=2
857
60
innodb_thread_concurrency=8
858
61
innodb_flush_method=O_DIRECT
859
62
key_buffer		= 128M
860
63
max_allowed_packet	= 256M
861
64
thread_stack		= 8196K
862
65
thread_cache_size       = 32
863
66
# This replaces the startup script and checks MyISAM tables if needed
864
67
# the first time they are touched
865
68
myisam-recover         = BACKUP
866
69
max_connections        = 1000
867
70
table_cache            = 1024
868
71
#thread_concurrency     = 10
869
72
#
870
73
# * Query Cache Configuration
871
74
#
872
75
query_cache_limit	= 32M
873
76
query_cache_size        = 256M
874
77
#
875
78
# * Logging and Replication
876
79
#
877
80
# Both location gets rotated by the cronjob.
878
81
# Be aware that this log type is a performance killer.
879
82
# As of 5.1 you can enable the log at runtime!
880
83
#general_log_file        = /var/log/mysql/mysql.log
881
84
#general_log             = 1
882
85
883
86
log_error                = /var/log/mysql/error.log
884
87
885
88
# Here you can see queries with especially long duration
886
89
log_slow_queries	= /var/log/mysql/mysql-slow.log
887
90
long_query_time = 2
888
91
#log-queries-not-using-indexes
889
92
#
890
93
# The following can be used as easy to replay backup logs or for replication.
891
94
# note: if you are setting up a replication slave, see README.Debian about
892
95
#       other settings you may need to change.
893
96
server-id		 = 1
894
97
log_bin			 = /var/log/mysql/mysql-bin.log
895
98
expire_logs_days = 10
896
99
max_binlog_size  = 50M
897
100
#binlog_do_db		= include_database_name
898
101
#binlog_ignore_db	= include_database_name
899
102
#
900
103
# * InnoDB
901
104
#
902
105
sync_binlog=1
903
106
# InnoDB is enabled by default with a 10MB datafile in /var/lib/mysql/.
904
107
# Read the manual for more InnoDB related options. There are many!
905
108
#
906
109
# * Security Features
907
110
#
908
111
# Read the manual, too, if you want chroot!
909
112
# chroot = /var/lib/mysql/
910
113
#
911
114
# For generating SSL certificates I recommend the OpenSSL GUI "tinyca".
912
115
#
913
116
# ssl-ca=/etc/mysql/cacert.pem
914
117
# ssl-cert=/etc/mysql/server-cert.pem
915
118
# ssl-key=/etc/mysql/server-key.pem
916
119
917
120
918
121
919
122
[mysqldump]
920
123
quick
921
124
quote-names
922
125
max_allowed_packet	= 256M
923
126
924
127
[mysql]
925
128
#no-auto-rehash	# faster start of mysql but no tab completition
926
129
927
130
[isamchk]
928
131
key_buffer		= 128M
929
132
930
133
#
931
134
# * IMPORTANT: Additional settings that can override those from this file!
932
135
#   The files must end with '.cnf', otherwise they'll be ignored.
933
136
#
934
137
!includedir /etc/mysql/conf.d/
935
138
0
936
=== removed file 'contrib/puppet/files/production/nova-iptables'
937
--- contrib/puppet/files/production/nova-iptables	2010-12-16 11:35:46 +0000
938
+++ contrib/puppet/files/production/nova-iptables	1970-01-01 00:00:00 +0000
939
@@ -1,187 +0,0 @@
940
1
#! /bin/sh
941
2
942
3
# vim: tabstop=4 shiftwidth=4 softtabstop=4
943
4
944
5
# Copyright 2010 United States Government as represented by the
945
6
# Administrator of the National Aeronautics and Space Administration.
946
7
# All Rights Reserved.
947
8
#
948
9
#    Licensed under the Apache License, Version 2.0 (the "License"); you may
949
10
#    not use this file except in compliance with the License. You may obtain
950
11
#    a copy of the License at
951
12
#
952
13
#         http://www.apache.org/licenses/LICENSE-2.0
953
14
#
954
15
#    Unless required by applicable law or agreed to in writing, software
955
16
#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
956
17
#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
957
18
#    License for the specific language governing permissions and limitations
958
19
#    under the License.
959
20
960
21
# NOTE(vish): This script sets up some reasonable defaults for iptables and
961
22
#             creates nova-specific chains.  If you use this script you should
962
23
#             run nova-network and nova-compute with --use_nova_chains=True
963
24
964
25
965
26
# NOTE(vish): If you run public nova-api on a different port, make sure to
966
27
#             change the port here
967
28
968
29
if [ -f /etc/default/nova-iptables ] ; then
969
30
    . /etc/default/nova-iptables
970
31
fi
971
32
972
33
export LC_ALL=C
973
34
974
35
API_PORT=${API_PORT:-"8773"}
975
36
976
37
if [ ! -n "$IP" ]; then
977
38
    # NOTE(vish): IP address is what address the services ALLOW on.
978
39
    #             This will just get the first ip in the list, so if you
979
40
    #             have more than one eth device set up, this will fail, and
980
41
    #             you should explicitly pass in the ip of the instance
981
42
    IP=`ifconfig  | grep -m 1 'inet addr:'| cut -d: -f2 | awk '{print $1}'`
982
43
fi
983
44
984
45
if [ ! -n "$PRIVATE_RANGE" ]; then
985
46
    #NOTE(vish): PRIVATE_RANGE: range is ALLOW to access DHCP
986
47
    PRIVATE_RANGE="192.168.0.0/12"
987
48
fi
988
49
989
50
if [ ! -n "$MGMT_IP" ]; then
990
51
    # NOTE(vish): Management IP is the ip over which to allow ssh traffic.  It
991
52
    #             will also allow traffic to nova-api
992
53
    MGMT_IP="$IP"
993
54
fi
994
55
995
56
if [ ! -n "$DMZ_IP" ]; then
996
57
    # NOTE(vish): DMZ IP is the ip over which to allow api & objectstore access
997
58
    DMZ_IP="$IP"
998
59
fi
999
60
1000
61
clear_nova_iptables() {
1001
62
    iptables -P INPUT ACCEPT
1002
63
    iptables -P FORWARD ACCEPT
1003
64
    iptables -P OUTPUT ACCEPT
1004
65
    iptables -F
1005
66
    iptables -t nat -F
1006
67
    iptables -F services
1007
68
    iptables -X services
1008
69
    # HACK: re-adding fail2ban rules :(
1009
70
    iptables -N fail2ban-ssh
1010
71
    iptables -A INPUT -p tcp -m multiport --dports 22 -j fail2ban-ssh 
1011
72
    iptables -A fail2ban-ssh -j RETURN 
1012
73
}
1013
74
1014
75
load_nova_iptables() {
1015
76
    
1016
77
    iptables -P INPUT DROP
1017
78
    iptables -A INPUT -m state --state INVALID -j DROP
1018
79
    iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
1019
80
    # NOTE(ja): allow localhost for everything
1020
81
    iptables -A INPUT -d 127.0.0.1/32 -j ACCEPT
1021
82
    # NOTE(ja): 22 only allowed MGMT_IP before, but we widened it to any
1022
83
    #           address, since ssh should be listening only on internal
1023
84
    #           before we re-add this rule we will need to add
1024
85
    #           flexibility for RSYNC between omega/stingray
1025
86
    iptables -A INPUT -m tcp -p tcp --dport 22 -j ACCEPT
1026
87
    iptables -A INPUT -m udp -p udp --dport 123 -j ACCEPT
1027
88
    iptables -A INPUT -p icmp -j ACCEPT
1028
89
    iptables -N services
1029
90
    iptables -A INPUT -j services
1030
91
    iptables -A INPUT -p tcp -j REJECT --reject-with tcp-reset
1031
92
    iptables -A INPUT -j REJECT --reject-with icmp-port-unreachable
1032
93
1033
94
    iptables -P FORWARD DROP
1034
95
    iptables -A FORWARD -m state --state INVALID -j DROP
1035
96
    iptables -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
1036
97
    iptables -A FORWARD -p tcp -m tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
1037
98
1038
99
    # NOTE(vish): DROP on output is too restrictive for now.  We need to add
1039
100
    #             in a bunch of more specific output rules to use it.
1040
101
    # iptables -P OUTPUT DROP
1041
102
    iptables -A OUTPUT -m state --state INVALID -j DROP
1042
103
    iptables -A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
1043
104
1044
105
    if [ -n "$GANGLIA" ] || [ -n "$ALL" ]; then
1045
106
        iptables -A services -m tcp -p tcp -d $IP --dport 8649 -j ACCEPT
1046
107
        iptables -A services -m udp -p udp -d $IP --dport 8649 -j ACCEPT
1047
108
    fi
1048
109
    
1049
110
    # if [ -n "$WEB" ] || [ -n "$ALL" ]; then
1050
111
    #     # NOTE(vish): This opens up ports for web access, allowing web-based
1051
112
    #     #             dashboards to work.
1052
113
    #     iptables -A services -m tcp -p tcp -d $IP --dport 80 -j ACCEPT
1053
114
    #     iptables -A services -m tcp -p tcp -d $IP --dport 443 -j ACCEPT
1054
115
    # fi
1055
116
1056
117
    if [ -n "$OBJECTSTORE" ] || [ -n "$ALL" ]; then
1057
118
        # infrastructure
1058
119
        iptables -A services -m tcp -p tcp -d $IP --dport 3333 -j ACCEPT
1059
120
        # clients
1060
121
        iptables -A services -m tcp -p tcp -d $DMZ_IP --dport 3333 -j ACCEPT
1061
122
    fi
1062
123
1063
124
    if [ -n "$API" ] || [ -n "$ALL" ]; then
1064
125
        iptables -A services -m tcp -p tcp -d $IP --dport $API_PORT -j ACCEPT
1065
126
        if [ "$IP" != "$DMZ_IP" ]; then
1066
127
            iptables -A services -m tcp -p tcp -d $DMZ_IP --dport $API_PORT -j ACCEPT
1067
128
        fi
1068
129
        if [ "$IP" != "$MGMT_IP" ] && [ "$DMZ_IP" != "$MGMT_IP" ]; then
1069
130
            iptables -A services -m tcp -p tcp -d $MGMT_IP --dport $API_PORT -j ACCEPT
1070
131
        fi
1071
132
    fi
1072
133
1073
134
    if [ -n "$REDIS" ] || [ -n "$ALL" ]; then
1074
135
        iptables -A services -m tcp -p tcp -d $IP --dport 6379 -j ACCEPT
1075
136
    fi
1076
137
1077
138
    if [ -n "$MYSQL" ] || [ -n "$ALL" ]; then
1078
139
        iptables -A services -m tcp -p tcp -d $IP --dport 3306 -j ACCEPT
1079
140
    fi
1080
141
1081
142
    if [ -n "$RABBITMQ" ] || [ -n "$ALL" ]; then
1082
143
        iptables -A services -m tcp -p tcp -d $IP --dport 4369 -j ACCEPT
1083
144
        iptables -A services -m tcp -p tcp -d $IP --dport 5672 -j ACCEPT
1084
145
        iptables -A services -m tcp -p tcp -d $IP --dport 53284 -j ACCEPT
1085
146
    fi
1086
147
1087
148
    if [ -n "$DNSMASQ" ] || [ -n "$ALL" ]; then
1088
149
        # NOTE(vish): this could theoretically be setup per network
1089
150
        #             for each host, but it seems like overkill
1090
151
        iptables -A services -m tcp -p tcp -s $PRIVATE_RANGE --dport 53 -j ACCEPT
1091
152
        iptables -A services -m udp -p udp -s $PRIVATE_RANGE --dport 53 -j ACCEPT
1092
153
        iptables -A services -m udp -p udp --dport 67 -j ACCEPT
1093
154
    fi
1094
155
1095
156
    if [ -n "$LDAP" ] || [ -n "$ALL" ]; then
1096
157
        iptables -A services -m tcp -p tcp -d $IP --dport 389 -j ACCEPT
1097
158
    fi
1098
159
1099
160
    if [ -n "$ISCSI" ] || [ -n "$ALL" ]; then
1100
161
        iptables -A services -m tcp -p tcp -d $IP --dport 3260 -j ACCEPT
1101
162
        iptables -A services -m tcp -p tcp -d 127.0.0.0/16 --dport 3260 -j ACCEPT
1102
163
    fi
1103
164
}
1104
165
1105
166
1106
167
case "$1" in
1107
168
  start)
1108
169
    echo "Starting nova-iptables: "
1109
170
    load_nova_iptables
1110
171
    ;;
1111
172
  stop)
1112
173
    echo "Clearing nova-iptables: "
1113
174
    clear_nova_iptables
1114
175
    ;;
1115
176
  restart)
1116
177
    echo "Restarting nova-iptables: "
1117
178
    clear_nova_iptables
1118
179
    load_nova_iptables
1119
180
    ;;
1120
181
  *)
1121
182
    echo "Usage: $NAME {start|stop|restart}" >&2
1122
183
    exit 1
1123
184
    ;;
1124
185
esac
1125
186
1126
187
exit 0
1127
188
0
1128
=== removed file 'contrib/puppet/files/production/nova-iscsi-dev.sh'
1129
--- contrib/puppet/files/production/nova-iscsi-dev.sh	2010-11-12 19:07:46 +0000
1130
+++ contrib/puppet/files/production/nova-iscsi-dev.sh	1970-01-01 00:00:00 +0000
1131
@@ -1,19 +0,0 @@
1132
1
#!/bin/sh
1133
2
1134
3
# FILE: /etc/udev/scripts/iscsidev.sh
1135
4
1136
5
BUS=${1}
1137
6
HOST=${BUS%%:*}
1138
7
1139
8
[ -e /sys/class/iscsi_host ] || exit 1
1140
9
1141
10
file="/sys/class/iscsi_host/host${HOST}/device/session*/iscsi_session*/session*/targetname"
1142
11
1143
12
target_name=$(cat ${file})
1144
13
1145
14
# This is not an open-scsi drive
1146
15
if [ -z "${target_name}" ]; then
1147
16
   exit 1
1148
17
fi
1149
18
1150
19
echo "${target_name##*:}"
1151
20
0
1152
=== removed file 'contrib/puppet/files/production/setup_data.sh'
1153
--- contrib/puppet/files/production/setup_data.sh	2010-11-12 19:07:46 +0000
1154
+++ contrib/puppet/files/production/setup_data.sh	1970-01-01 00:00:00 +0000
1155
@@ -1,6 +0,0 @@
1156
1
#!/bin/bash
1157
2
/root/slap.sh
1158
3
mysql -e "DROP DATABASE nova"
1159
4
mysql -e "CREATE DATABASE nova"
1160
5
mysql -e "GRANT ALL on nova.* to nova@'%' identified by 'TODO:CHANGEME:CMON'"
1161
6
touch /root/installed
1162
7
0
1163
=== removed file 'contrib/puppet/files/production/slap.sh'
1164
--- contrib/puppet/files/production/slap.sh	2010-11-12 19:07:46 +0000
1165
+++ contrib/puppet/files/production/slap.sh	1970-01-01 00:00:00 +0000
1166
@@ -1,261 +0,0 @@
1167
1
#!/usr/bin/env bash
1168
2
# vim: tabstop=4 shiftwidth=4 softtabstop=4
1169
3
1170
4
# Copyright 2010 United States Government as represented by the
1171
5
# Administrator of the National Aeronautics and Space Administration.
1172
6
# All Rights Reserved.
1173
7
#
1174
8
#    Licensed under the Apache License, Version 2.0 (the "License"); you may
1175
9
#    not use this file except in compliance with the License. You may obtain
1176
10
#    a copy of the License at
1177
11
#
1178
12
#         http://www.apache.org/licenses/LICENSE-2.0
1179
13
#
1180
14
#    Unless required by applicable law or agreed to in writing, software
1181
15
#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
1182
16
#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
1183
17
#    License for the specific language governing permissions and limitations
1184
18
#    under the License.
1185
19
# LDAP INSTALL SCRIPT - SHOULD BE IDEMPOTENT, but it SCRUBS all USERS
1186
20
1187
21
apt-get install -y slapd ldap-utils python-ldap
1188
22
1189
23
cat >/etc/ldap/schema/openssh-lpk_openldap.schema <<LPK_SCHEMA_EOF
1190
24
#
1191
25
# LDAP Public Key Patch schema for use with openssh-ldappubkey
1192
26
# Author: Eric AUGE <eau@phear.org>
1193
27
#
1194
28
# Based on the proposal of : Mark Ruijter
1195
29
#
1196
30
1197
31
1198
32
# octetString SYNTAX
1199
33
attributetype ( 1.3.6.1.4.1.24552.500.1.1.1.13 NAME 'sshPublicKey'
1200
34
	DESC 'MANDATORY: OpenSSH Public key'
1201
35
	EQUALITY octetStringMatch
1202
36
	SYNTAX 1.3.6.1.4.1.1466.115.121.1.40 )
1203
37
1204
38
# printableString SYNTAX yes|no
1205
39
objectclass ( 1.3.6.1.4.1.24552.500.1.1.2.0 NAME 'ldapPublicKey' SUP top AUXILIARY
1206
40
	DESC 'MANDATORY: OpenSSH LPK objectclass'
1207
41
	MAY ( sshPublicKey $ uid )
1208
42
	)
1209
43
LPK_SCHEMA_EOF
1210
44
1211
45
cat >/etc/ldap/schema/nova.schema <<NOVA_SCHEMA_EOF
1212
46
#
1213
47
# Person object for Nova
1214
48
# inetorgperson with extra attributes
1215
49
# Author: Vishvananda Ishaya <vishvananda@yahoo.com>
1216
50
#
1217
51
#
1218
52
1219
53
# using internet experimental oid arc as per BP64 3.1
1220
54
objectidentifier novaSchema 1.3.6.1.3.1.666.666
1221
55
objectidentifier novaAttrs novaSchema:3
1222
56
objectidentifier novaOCs novaSchema:4
1223
57
1224
58
attributetype (
1225
59
    novaAttrs:1
1226
60
    NAME 'accessKey'
1227
61
    DESC 'Key for accessing data'
1228
62
    EQUALITY caseIgnoreMatch
1229
63
    SUBSTR caseIgnoreSubstringsMatch
1230
64
    SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
1231
65
    SINGLE-VALUE
1232
66
    )
1233
67
1234
68
attributetype (
1235
69
    novaAttrs:2
1236
70
    NAME 'secretKey'
1237
71
    DESC 'Secret key'
1238
72
    EQUALITY caseIgnoreMatch
1239
73
    SUBSTR caseIgnoreSubstringsMatch
1240
74
    SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
1241
75
    SINGLE-VALUE
1242
76
    )
1243
77
1244
78
attributetype (
1245
79
    novaAttrs:3
1246
80
    NAME 'keyFingerprint'
1247
81
    DESC 'Fingerprint of private key'
1248
82
    EQUALITY caseIgnoreMatch
1249
83
    SUBSTR caseIgnoreSubstringsMatch
1250
84
    SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
1251
85
    SINGLE-VALUE
1252
86
    )
1253
87
1254
88
attributetype (
1255
89
    novaAttrs:4
1256
90
    NAME 'isAdmin'
1257
91
    DESC 'Is user an administrator?'
1258
92
    EQUALITY booleanMatch
1259
93
    SYNTAX 1.3.6.1.4.1.1466.115.121.1.7
1260
94
    SINGLE-VALUE
1261
95
    )
1262
96
1263
97
attributetype (
1264
98
    novaAttrs:5
1265
99
    NAME 'projectManager'
1266
100
    DESC 'Project Managers of a project'
1267
101
    SYNTAX 1.3.6.1.4.1.1466.115.121.1.12
1268
102
    )
1269
103
1270
104
objectClass (
1271
105
    novaOCs:1
1272
106
    NAME 'novaUser'
1273
107
    DESC 'access and secret keys'
1274
108
    AUXILIARY
1275
109
    MUST ( uid )
1276
110
    MAY  ( accessKey $ secretKey $ isAdmin )
1277
111
    )
1278
112
1279
113
objectClass (
1280
114
    novaOCs:2
1281
115
    NAME 'novaKeyPair'
1282
116
    DESC 'Key pair for User'
1283
117
    SUP top
1284
118
    STRUCTURAL
1285
119
    MUST ( cn $ sshPublicKey $ keyFingerprint )
1286
120
    )
1287
121
1288
122
objectClass (
1289
123
    novaOCs:3
1290
124
    NAME 'novaProject'
1291
125
    DESC 'Container for project'
1292
126
    SUP groupOfNames
1293
127
    STRUCTURAL
1294
128
    MUST ( cn $ projectManager )
1295
129
    )
1296
130
1297
131
NOVA_SCHEMA_EOF
1298
132
1299
133
mv /etc/ldap/slapd.conf /etc/ldap/slapd.conf.orig
1300
134
cat >/etc/ldap/slapd.conf <<SLAPD_CONF_EOF
1301
135
# slapd.conf - Configuration file for LDAP SLAPD
1302
136
##########
1303
137
# Basics #
1304
138
##########
1305
139
include /etc/ldap/schema/core.schema
1306
140
include /etc/ldap/schema/cosine.schema
1307
141
include /etc/ldap/schema/inetorgperson.schema
1308
142
include /etc/ldap/schema/openssh-lpk_openldap.schema
1309
143
include /etc/ldap/schema/nova.schema
1310
144
pidfile /var/run/slapd/slapd.pid
1311
145
argsfile /var/run/slapd/slapd.args
1312
146
loglevel none
1313
147
modulepath /usr/lib/ldap
1314
148
# modulepath /usr/local/libexec/openldap
1315
149
moduleload back_hdb
1316
150
##########################
1317
151
# Database Configuration #
1318
152
##########################
1319
153
database hdb
1320
154
suffix "dc=example,dc=com"
1321
155
rootdn "cn=Manager,dc=example,dc=com"
1322
156
rootpw changeme
1323
157
directory /var/lib/ldap
1324
158
# directory /usr/local/var/openldap-data
1325
159
index objectClass,cn eq
1326
160
########
1327
161
# ACLs #
1328
162
########
1329
163
access to attrs=userPassword
1330
164
       by anonymous auth
1331
165
       by self write
1332
166
       by * none
1333
167
access to *
1334
168
       by self write
1335
169
       by * none
1336
170
SLAPD_CONF_EOF
1337
171
1338
172
mv /etc/ldap/ldap.conf /etc/ldap/ldap.conf.orig
1339
173
1340
174
cat >/etc/ldap/ldap.conf <<LDAP_CONF_EOF
1341
175
# LDAP Client Settings
1342
176
URI ldap://localhost
1343
177
BASE dc=example,dc=com
1344
178
BINDDN cn=Manager,dc=example,dc=com
1345
179
SIZELIMIT  0
1346
180
TIMELIMIT  0
1347
181
LDAP_CONF_EOF
1348
182
1349
183
cat >/etc/ldap/base.ldif <<BASE_LDIF_EOF
1350
184
# This is the root of the directory tree
1351
185
dn: dc=example,dc=com
1352
186
description: Example.Com, your trusted non-existent corporation.
1353
187
dc: example
1354
188
o: Example.Com
1355
189
objectClass: top
1356
190
objectClass: dcObject
1357
191
objectClass: organization
1358
192
1359
193
# Subtree for users
1360
194
dn: ou=Users,dc=example,dc=com
1361
195
ou: Users
1362
196
description: Users
1363
197
objectClass: organizationalUnit
1364
198
1365
199
# Subtree for groups
1366
200
dn: ou=Groups,dc=example,dc=com
1367
201
ou: Groups
1368
202
description: Groups
1369
203
objectClass: organizationalUnit
1370
204
1371
205
# Subtree for system accounts
1372
206
dn: ou=System,dc=example,dc=com
1373
207
ou: System
1374
208
description: Special accounts used by software applications.
1375
209
objectClass: organizationalUnit
1376
210
1377
211
# Special Account for Authentication:
1378
212
dn: uid=authenticate,ou=System,dc=example,dc=com
1379
213
uid: authenticate
1380
214
ou: System
1381
215
description: Special account for authenticating users
1382
216
userPassword: {MD5}TODO-000000000000000000000000000==
1383
217
objectClass: account
1384
218
objectClass: simpleSecurityObject
1385
219
1386
220
# create the sysadmin entry
1387
221
1388
222
dn: cn=developers,ou=Groups,dc=example,dc=com
1389
223
objectclass: groupOfNames
1390
224
cn: developers
1391
225
description: IT admin group
1392
226
member: uid=admin,ou=Users,dc=example,dc=com
1393
227
1394
228
dn: cn=sysadmins,ou=Groups,dc=example,dc=com
1395
229
objectclass: groupOfNames
1396
230
cn: sysadmins
1397
231
description: IT admin group
1398
232
member: uid=admin,ou=Users,dc=example,dc=com
1399
233
1400
234
dn: cn=netadmins,ou=Groups,dc=example,dc=com
1401
235
objectclass: groupOfNames
1402
236
cn: netadmins
1403
237
description: Network admin group
1404
238
member: uid=admin,ou=Users,dc=example,dc=com
1405
239
1406
240
dn: cn=cloudadmins,ou=Groups,dc=example,dc=com
1407
241
objectclass: groupOfNames
1408
242
cn: cloudadmins
1409
243
description: Cloud admin group
1410
244
member: uid=admin,ou=Users,dc=example,dc=com
1411
245
1412
246
dn: cn=itsec,ou=Groups,dc=example,dc=com
1413
247
objectclass: groupOfNames
1414
248
cn: itsec
1415
249
description: IT security users group
1416
250
member: uid=admin,ou=Users,dc=example,dc=com
1417
251
BASE_LDIF_EOF
1418
252
1419
253
/etc/init.d/slapd stop
1420
254
rm -rf /var/lib/ldap/*
1421
255
rm -rf /etc/ldap/slapd.d/*
1422
256
slaptest -f /etc/ldap/slapd.conf -F /etc/ldap/slapd.d
1423
257
cp /usr/share/slapd/DB_CONFIG /var/lib/ldap/DB_CONFIG
1424
258
slapadd -v -l /etc/ldap/base.ldif
1425
259
chown -R openldap:openldap /etc/ldap/slapd.d
1426
260
chown -R openldap:openldap /var/lib/ldap
1427
261
/etc/init.d/slapd start
1428
262
0
1429
=== removed file 'contrib/puppet/fileserver.conf'
1430
--- contrib/puppet/fileserver.conf	2010-11-12 19:07:46 +0000
1431
+++ contrib/puppet/fileserver.conf	1970-01-01 00:00:00 +0000
1432
@@ -1,8 +0,0 @@
1433
1
# fileserver.conf
1434
2
 
1435
3
[files]
1436
4
path /srv/cloud/puppet/files
1437
5
allow 10.0.0.0/24
1438
6
1439
7
[plugins]
1440
8
1441
9
0
1442
=== removed directory 'contrib/puppet/manifests'
1443
=== removed directory 'contrib/puppet/manifests/classes'
1444
=== removed file 'contrib/puppet/manifests/classes/apt.pp'
1445
--- contrib/puppet/manifests/classes/apt.pp	2010-11-12 19:07:46 +0000
1446
+++ contrib/puppet/manifests/classes/apt.pp	1970-01-01 00:00:00 +0000
1447
@@ -1,1 +0,0 @@
1448
1
exec { "update-apt": command => "/usr/bin/apt-get update" }
1449
2
0
1450
=== removed file 'contrib/puppet/manifests/classes/issue.pp'
1451
--- contrib/puppet/manifests/classes/issue.pp	2010-11-12 19:07:46 +0000
1452
+++ contrib/puppet/manifests/classes/issue.pp	1970-01-01 00:00:00 +0000
1453
@@ -1,14 +0,0 @@
1454
1
class issue {
1455
2
  file { "/etc/issue":
1456
3
    owner => "root",
1457
4
    group => "root",
1458
5
    mode => 444,
1459
6
    source => "puppet://${puppet_server}/files/etc/issue",
1460
7
  }
1461
8
  file { "/etc/issue.net":
1462
9
    owner => "root",
1463
10
    group => "root",
1464
11
    mode => 444,
1465
12
    source => "puppet://${puppet_server}/files/etc/issue",
1466
13
  }
1467
14
}
1468
15
0
1469
=== removed file 'contrib/puppet/manifests/classes/kern_module.pp'
1470
--- contrib/puppet/manifests/classes/kern_module.pp	2010-11-12 19:07:46 +0000
1471
+++ contrib/puppet/manifests/classes/kern_module.pp	1970-01-01 00:00:00 +0000
1472
@@ -1,34 +0,0 @@
1473
1
# via http://projects.puppetlabs.com/projects/puppet/wiki/Kernel_Modules_Patterns 
1474
2
1475
3
define kern_module ($ensure) {
1476
4
    $modulesfile = $operatingsystem ? { ubuntu => "/etc/modules", redhat => "/etc/rc.modules" }
1477
5
    case $operatingsystem {
1478
6
        redhat: { file { "/etc/rc.modules": ensure => file, mode => 755 } }
1479
7
    }
1480
8
    case $ensure {
1481
9
        present: {
1482
10
            exec { "insert_module_${name}":
1483
11
                command => $operatingsystem ? {
1484
12
                    ubuntu => "/bin/echo '${name}' >> '${modulesfile}'",
1485
13
                    redhat => "/bin/echo '/sbin/modprobe ${name}' >> '${modulesfile}' "
1486
14
                },
1487
15
                unless => "/bin/grep -qFx '${name}' '${modulesfile}'"
1488
16
            }
1489
17
            exec { "/sbin/modprobe ${name}": unless => "/bin/grep -q '^${name} ' '/proc/modules'" }
1490
18
        }
1491
19
        absent: {
1492
20
            exec { "/sbin/modprobe -r ${name}": onlyif => "/bin/grep -q '^${name} ' '/proc/modules'" }
1493
21
            exec { "remove_module_${name}":
1494
22
                command => $operatingsystem ? {
1495
23
                    ubuntu => "/usr/bin/perl -ni -e 'print unless /^\\Q${name}\\E\$/' '${modulesfile}'",
1496
24
                    redhat => "/usr/bin/perl -ni -e 'print unless /^\\Q/sbin/modprobe ${name}\\E\$/' '${modulesfile}'"
1497
25
                },
1498
26
                onlyif => $operatingsystem ? {
1499
27
                    ubuntu => "/bin/grep -qFx '${name}' '${modulesfile}'",
1500
28
                    redhat => "/bin/grep -q '^/sbin/modprobe ${name}' '${modulesfile}'"
1501
29
                }
1502
30
            }
1503
31
        }
1504
32
        default: { err ( "unknown ensure value ${ensure}" ) }
1505
33
    }
1506
34
}
1507
35
0
1508
=== removed file 'contrib/puppet/manifests/classes/loopback.pp'
1509
--- contrib/puppet/manifests/classes/loopback.pp	2010-11-12 19:07:46 +0000
1510
+++ contrib/puppet/manifests/classes/loopback.pp	1970-01-01 00:00:00 +0000
1511
@@ -1,6 +0,0 @@
1512
1
define loopback($num) {
1513
2
  exec { "mknod -m 0660 /dev/loop${num} b 7 ${num}; chown root:disk /dev/loop${num}":
1514
3
    creates => "/dev/loop${num}",
1515
4
    path => ["/usr/bin", "/usr/sbin", "/bin"]
1516
5
  }
1517
6
}
1518
7
0
1519
=== removed file 'contrib/puppet/manifests/classes/lvm.pp'
1520
--- contrib/puppet/manifests/classes/lvm.pp	2010-11-12 19:07:46 +0000
1521
+++ contrib/puppet/manifests/classes/lvm.pp	1970-01-01 00:00:00 +0000
1522
@@ -1,8 +0,0 @@
1523
1
class lvm {
1524
2
  file { "/etc/lvm/lvm.conf":
1525
3
    owner => "root",
1526
4
    group => "root",
1527
5
    mode => 444,
1528
6
    source => "puppet://${puppet_server}/files/etc/lvm.conf",
1529
7
  }
1530
8
}
1531
9
0
1532
=== removed file 'contrib/puppet/manifests/classes/lvmconf.pp'
1533
--- contrib/puppet/manifests/classes/lvmconf.pp	2010-11-12 19:07:46 +0000
1534
+++ contrib/puppet/manifests/classes/lvmconf.pp	1970-01-01 00:00:00 +0000
1535
@@ -1,8 +0,0 @@
1536
1
class lvmconf {
1537
2
  file { "/etc/lvm/lvm.conf":
1538
3
    owner => "root", group => "root", mode  => 644,
1539
4
    source => "puppet://${puppet_server}/files/etc/lvm/lvm.conf",
1540
5
    ensure => present
1541
6
  }
1542
7
}
1543
8
1544
9
0
1545
=== removed file 'contrib/puppet/manifests/classes/nova.pp'
1546
--- contrib/puppet/manifests/classes/nova.pp	2010-11-12 19:07:46 +0000
1547
+++ contrib/puppet/manifests/classes/nova.pp	1970-01-01 00:00:00 +0000
1548
@@ -1,464 +0,0 @@
1549
1
import "kern_module"
1550
2
import "apt"
1551
3
import "loopback"
1552
4
1553
5
#$head_node_ip = "undef"
1554
6
#$rabbit_ip = "undef"
1555
7
#$vpn_ip = "undef"
1556
8
#$public_interface = "undef"
1557
9
#$vlan_start = "5000"
1558
10
#$vlan_end = "6000"
1559
11
#$private_range = "10.0.0.0/16"
1560
12
#$public_range = "192.168.177.0/24"
1561
13
1562
14
define nova_iptables($services, $ip="", $private_range="", $mgmt_ip="", $dmz_ip="") {
1563
15
  file { "/etc/init.d/nova-iptables":
1564
16
    owner => "root", mode => 755,
1565
17
    source => "puppet://${puppet_server}/files/production/nova-iptables",
1566
18
  }
1567
19
1568
20
  file { "/etc/default/nova-iptables":
1569
21
    owner => "root", mode => 644,
1570
22
    content => template("nova-iptables.erb")
1571
23
  }
1572
24
}
1573
25
1574
26
define nova_conf_pointer($name) {
1575
27
  file { "/etc/nova/nova-${name}.conf":
1576
28
    owner => "nova", mode => 400,
1577
29
    content => "--flagfile=/etc/nova/nova.conf"
1578
30
  }
1579
31
}
1580
32
1581
33
class novaconf {
1582
34
  file { "/etc/nova/nova.conf":
1583
35
    owner => "nova", mode => 400,
1584
36
    content => template("production/nova-common.conf.erb", "production/nova-${cluster_name}.conf.erb")
1585
37
  }
1586
38
  nova_conf_pointer{'manage': name => 'manage'}
1587
39
}
1588
40
1589
41
class novadata {
1590
42
  package { "rabbitmq-server": ensure => present }
1591
43
1592
44
  file { "/etc/rabbitmq/rabbitmq.conf":
1593
45
    owner => "root", mode => 644,
1594
46
    content => "NODENAME=rabbit@localhost",
1595
47
  }
1596
48
1597
49
  service { "rabbitmq-server":
1598
50
    ensure => running,
1599
51
    enable => true,
1600
52
    hasstatus => true,
1601
53
    require => [
1602
54
      File["/etc/rabbitmq/rabbitmq.conf"],
1603
55
      Package["rabbitmq-server"]
1604
56
    ]
1605
57
  }
1606
58
1607
59
  package { "mysql-server": ensure => present }
1608
60
1609
61
  file { "/etc/mysql/my.cnf":
1610
62
    owner => "root", mode => 644,
1611
63
    source => "puppet://${puppet_server}/files/production/my.cnf",
1612
64
  }
1613
65
1614
66
  service { "mysql":
1615
67
    ensure => running,
1616
68
    enable => true,
1617
69
    hasstatus => true,
1618
70
    require => [
1619
71
      File["/etc/mysql/my.cnf"],
1620
72
      Package["mysql-server"]
1621
73
    ]
1622
74
  }
1623
75
1624
76
  file { "/root/slap.sh":
1625
77
    owner => "root", mode => 755,
1626
78
    source => "puppet://${puppet_server}/files/production/slap.sh",
1627
79
  }
1628
80
1629
81
  file { "/root/setup_data.sh":
1630
82
    owner => "root", mode => 755,
1631
83
    source => "puppet://${puppet_server}/files/production/setup_data.sh",
1632
84
  }
1633
85
1634
86
  # setup compute data
1635
87
  exec { "setup_data":
1636
88
    command => "/root/setup_data.sh",
1637
89
    path => "/usr/bin:/bin",
1638
90
    unless => "test -f /root/installed",
1639
91
    require => [
1640
92
      Service["mysql"],
1641
93
      File["/root/slap.sh"],
1642
94
      File["/root/setup_data.sh"]
1643
95
    ]
1644
96
  }
1645
97
}
1646
98
1647
99
define nscheduler($version) {
1648
100
  package { "nova-scheduler": ensure => $version, require => Exec["update-apt"] }
1649
101
  nova_conf_pointer{'scheduler': name => 'scheduler'}
1650
102
  exec { "update-rc.d -f nova-scheduler remove; update-rc.d nova-scheduler defaults 50":
1651
103
    path => "/usr/bin:/usr/sbin:/bin",
1652
104
    onlyif => "test -f /etc/init.d/nova-scheduler",
1653
105
    unless => "test -f /etc/rc2.d/S50nova-scheduler"
1654
106
  }
1655
107
  service { "nova-scheduler":
1656
108
    ensure => running,
1657
109
    hasstatus => true,
1658
110
    subscribe => [
1659
111
      Package["nova-scheduler"],
1660
112
      File["/etc/nova/nova.conf"],
1661
113
      File["/etc/nova/nova-scheduler.conf"]
1662
114
    ]
1663
115
  }
1664
116
1665
117
}
1666
118
1667
119
define napi($version, $api_servers, $api_base_port) {
1668
120
  file { "/etc/boto.cfg":
1669
121
    owner => "root", mode => 644,
1670
122
    source => "puppet://${puppet_server}/files/production/boto.cfg",
1671
123
  }
1672
124
1673
125
  file { "/var/lib/nova/CA/genvpn.sh":
1674
126
    owner => "nova", mode => 755,
1675
127
    source => "puppet://${puppet_server}/files/production/genvpn.sh",
1676
128
  }
1677
129
1678
130
  package { "python-greenlet": ensure => present }
1679
131
  package { "nova-api": ensure => $version, require => [Exec["update-apt"], Package["python-greenlet"]] }
1680
132
  nova_conf_pointer{'api': name => 'api'}
1681
133
1682
134
  exec { "update-rc.d -f nova-api remove; update-rc.d nova-api defaults 50":
1683
135
    path => "/usr/bin:/usr/sbin:/bin",
1684
136
    onlyif => "test -f /etc/init.d/nova-api",
1685
137
    unless => "test -f /etc/rc2.d/S50nova-api"
1686
138
  }
1687
139
1688
140
  service { "nova-netsync":
1689
141
    start => "/usr/bin/nova-netsync --pidfile=/var/run/nova/nova-netsync.pid --lockfile=/var/run/nova/nova-netsync.pid.lock start",
1690
142
    stop => "/usr/bin/nova-netsync --pidfile=/var/run/nova/nova-netsync.pid --lockfile=/var/run/nova/nova-netsync.pid.lock stop",
1691
143
    ensure => running,
1692
144
    hasstatus => false,
1693
145
    pattern => "nova-netsync",
1694
146
    require => Service["nova-api"],
1695
147
    subscribe => File["/etc/nova/nova.conf"]
1696
148
  }
1697
149
  service { "nova-api":
1698
150
    start => "monit start all -g nova_api",
1699
151
    stop => "monit stop all -g nova_api",
1700
152
    restart => "monit restart all -g nova_api",
1701
153
    # ensure => running,
1702
154
    # hasstatus => true,
1703
155
    require => Service["monit"],
1704
156
    subscribe => [
1705
157
      Package["nova-objectstore"],
1706
158
      File["/etc/boto.cfg"],
1707
159
      File["/etc/nova/nova.conf"],
1708
160
      File["/etc/nova/nova-objectstore.conf"]
1709
161
    ]
1710
162
  }
1711
163
1712
164
  # the haproxy & monit's template use $api_servers and $api_base_port
1713
165
1714
166
  package { "haproxy": ensure => present }
1715
167
  file { "/etc/default/haproxy":
1716
168
    owner => "root", mode => 644,
1717
169
    content => "ENABLED=1",
1718
170
    require => Package['haproxy']
1719
171
  }
1720
172
  file { "/etc/haproxy/haproxy.cfg":
1721
173
    owner => "root", mode => 644,
1722
174
    content => template("/srv/cloud/puppet/templates/haproxy.cfg.erb"),
1723
175
    require => Package['haproxy']
1724
176
  }
1725
177
  service { "haproxy":
1726
178
    ensure => true,
1727
179
    enable => true,
1728
180
    hasstatus => true,
1729
181
    subscribe => [
1730
182
      Package["haproxy"],
1731
183
      File["/etc/default/haproxy"],
1732
184
      File["/etc/haproxy/haproxy.cfg"],
1733
185
    ]
1734
186
  }
1735
187
1736
188
  package { "socat": ensure => present }
1737
189
1738
190
  file { "/usr/local/bin/gmetric_haproxy.sh":
1739
191
    owner => "root", mode => 755,
1740
192
    source => "puppet://${puppet_server}/files/production/ganglia/gmetric_scripts/gmetric_haproxy.sh",
1741
193
  }
1742
194
1743
195
  cron { "gmetric_haproxy":
1744
196
    command => "/usr/local/bin/gmetric_haproxy.sh",
1745
197
    user    => root,
1746
198
    minute  => "*/3",
1747
199
  }
1748
200
1749
201
  package { "monit": ensure => present }
1750
202
1751
203
  file { "/etc/default/monit":
1752
204
    owner => "root", mode => 644,
1753
205
    content => "startup=1",
1754
206
    require => Package['monit']
1755
207
  }
1756
208
  file { "/etc/monit/monitrc":
1757
209
    owner => "root", mode => 600,
1758
210
    content => template("/srv/cloud/puppet/templates/monitrc-nova-api.erb"),
1759
211
    require => Package['monit']
1760
212
  }
1761
213
  service { "monit":
1762
214
    ensure => true,
1763
215
    pattern => "sbin/monit",
1764
216
    subscribe => [
1765
217
      Package["monit"],
1766
218
      File["/etc/default/monit"],
1767
219
      File["/etc/monit/monitrc"],
1768
220
    ]
1769
221
  }
1770
222
1771
223
}
1772
224
1773
225
1774
226
define nnetwork($version) {
1775
227
  # kill the default network added by the package
1776
228
  exec { "kill-libvirt-default-net":
1777
229
    command => "virsh net-destroy default; rm /etc/libvirt/qemu/networks/autostart/default.xml",
1778
230
    path => "/usr/bin:/bin",
1779
231
    onlyif => "test -f /etc/libvirt/qemu/networks/autostart/default.xml"
1780
232
  }
1781
233
1782
234
  # EVIL HACK: custom binary because dnsmasq 2.52 segfaulted accessing dereferenced object
1783
235
  file { "/usr/sbin/dnsmasq":
1784
236
    owner => "root", group => "root",
1785
237
    source => "puppet://${puppet_server}/files/production/dnsmasq",
1786
238
  }
1787
239
1788
240
  package { "nova-network": ensure => $version, require => Exec["update-apt"] }
1789
241
  nova_conf_pointer{'dhcpbridge': name => 'dhcpbridge'}
1790
242
  nova_conf_pointer{'network': name => "network" }
1791
243
1792
244
  exec { "update-rc.d -f nova-network remove; update-rc.d nova-network defaults 50":
1793
245
    path => "/usr/bin:/usr/sbin:/bin",
1794
246
    onlyif => "test -f /etc/init.d/nova-network",
1795
247
    unless => "test -f /etc/rc2.d/S50nova-network"
1796
248
  }
1797
249
  service { "nova-network":
1798
250
    ensure => running,
1799
251
    hasstatus => true,
1800
252
    subscribe => [
1801
253
      Package["nova-network"],
1802
254
      File["/etc/nova/nova.conf"],
1803
255
      File["/etc/nova/nova-network.conf"]
1804
256
    ]
1805
257
  }
1806
258
}
1807
259
1808
260
define nobjectstore($version) {
1809
261
  package { "nova-objectstore": ensure => $version, require => Exec["update-apt"] }
1810
262
  nova_conf_pointer{'objectstore': name => 'objectstore'}
1811
263
  exec { "update-rc.d -f nova-objectstore remove; update-rc.d nova-objectstore defaults 50":
1812
264
    path => "/usr/bin:/usr/sbin:/bin",
1813
265
    onlyif => "test -f /etc/init.d/nova-objectstore",
1814
266
    unless => "test -f /etc/rc2.d/S50nova-objectstore"
1815
267
  }
1816
268
  service { "nova-objectstore":
1817
269
    ensure => running,
1818
270
    hasstatus => true,
1819
271
    subscribe => [
1820
272
      Package["nova-objectstore"],
1821
273
      File["/etc/nova/nova.conf"],
1822
274
      File["/etc/nova/nova-objectstore.conf"]
1823
275
    ]
1824
276
  }
1825
277
}
1826
278
1827
279
define ncompute($version) {
1828
280
  include ganglia-python
1829
281
  include ganglia-compute
1830
282
1831
283
  # kill the default network added by the package
1832
284
  exec { "kill-libvirt-default-net":
1833
285
    command => "virsh net-destroy default; rm /etc/libvirt/qemu/networks/autostart/default.xml",
1834
286
    path => "/usr/bin:/bin",
1835
287
    onlyif => "test -f /etc/libvirt/qemu/networks/autostart/default.xml"
1836
288
  }
1837
289
1838
290
1839
291
  # LIBVIRT has to be restarted when ebtables / gawk is installed
1840
292
  service { "libvirt-bin":
1841
293
    ensure => running,
1842
294
    pattern => "sbin/libvirtd",
1843
295
    subscribe => [
1844
296
      Package["ebtables"],
1845
297
      Kern_module["kvm_intel"]
1846
298
    ],
1847
299
    require => [
1848
300
      Package["libvirt-bin"],
1849
301
      Package["ebtables"],
1850
302
      Package["gawk"],
1851
303
      Kern_module["kvm_intel"],
1852
304
      File["/dev/kvm"]
1853
305
    ]
1854
306
  }
1855
307
1856
308
  package { "libvirt-bin": ensure => "0.8.3-1ubuntu14~ppalucid2" }
1857
309
  package { "ebtables": ensure => present }
1858
310
  package { "gawk": ensure => present }
1859
311
1860
312
  # ensure proper permissions on /dev/kvm
1861
313
  file { "/dev/kvm":
1862
314
    owner => "root",
1863
315
    group => "kvm",
1864
316
    mode => 660
1865
317
  }
1866
318
1867
319
  # require hardware virt
1868
320
  kern_module { "kvm_intel":
1869
321
    ensure => present,
1870
322
  }
1871
323
1872
324
  # increase loopback devices
1873
325
  file { "/etc/modprobe.d/loop.conf":
1874
326
    owner => "root", mode => 644,
1875
327
    content => "options loop max_loop=40"
1876
328
  }
1877
329
1878
330
  nova_conf_pointer{'compute': name => 'compute'}
1879
331
1880
332
  loopback{loop0: num => 0}
1881
333
  loopback{loop1: num => 1}
1882
334
  loopback{loop2: num => 2}
1883
335
  loopback{loop3: num => 3}
1884
336
  loopback{loop4: num => 4}
1885
337
  loopback{loop5: num => 5}
1886
338
  loopback{loop6: num => 6}
1887
339
  loopback{loop7: num => 7}
1888
340
  loopback{loop8: num => 8}
1889
341
  loopback{loop9: num => 9}
1890
342
  loopback{loop10: num => 10}
1891
343
  loopback{loop11: num => 11}
1892
344
  loopback{loop12: num => 12}
1893
345
  loopback{loop13: num => 13}
1894
346
  loopback{loop14: num => 14}
1895
347
  loopback{loop15: num => 15}
1896
348
  loopback{loop16: num => 16}
1897
349
  loopback{loop17: num => 17}
1898
350
  loopback{loop18: num => 18}
1899
351
  loopback{loop19: num => 19}
1900
352
  loopback{loop20: num => 20}
1901
353
  loopback{loop21: num => 21}
1902
354
  loopback{loop22: num => 22}
1903
355
  loopback{loop23: num => 23}
1904
356
  loopback{loop24: num => 24}
1905
357
  loopback{loop25: num => 25}
1906
358
  loopback{loop26: num => 26}
1907
359
  loopback{loop27: num => 27}
1908
360
  loopback{loop28: num => 28}
1909
361
  loopback{loop29: num => 29}
1910
362
  loopback{loop30: num => 30}
1911
363
  loopback{loop31: num => 31}
1912
364
  loopback{loop32: num => 32}
1913
365
  loopback{loop33: num => 33}
1914
366
  loopback{loop34: num => 34}
1915
367
  loopback{loop35: num => 35}
1916
368
  loopback{loop36: num => 36}
1917
369
  loopback{loop37: num => 37}
1918
370
  loopback{loop38: num => 38}
1919
371
  loopback{loop39: num => 39}
1920
372
1921
373
  package { "python-libvirt": ensure => "0.8.3-1ubuntu14~ppalucid2" }
1922
374
1923
375
  package { "nova-compute":
1924
376
      ensure => "$version",
1925
377
      require => Package["python-libvirt"]
1926
378
  }
1927
379
1928
380
  #file { "/usr/share/nova/libvirt.qemu.xml.template":
1929
381
  #  owner => "nova", mode => 400,
1930
382
  #  source => "puppet://${puppet_server}/files/production/libvirt.qemu.xml.template",
1931
383
  #}
1932
384
1933
385
  # fix runlevels: using enable => true adds it as 20, which is too early
1934
386
  exec { "update-rc.d -f nova-compute remove":
1935
387
    path => "/usr/bin:/usr/sbin:/bin",
1936
388
    onlyif => "test -f /etc/rc2.d/S??nova-compute"
1937
389
  }
1938
390
  service { "nova-compute":
1939
391
    ensure => running,
1940
392
    hasstatus => true,
1941
393
    subscribe => [
1942
394
      Package["nova-compute"],
1943
395
      File["/etc/nova/nova.conf"],
1944
396
      File["/etc/nova/nova-compute.conf"],
1945
397
      #File["/usr/share/nova/libvirt.qemu.xml.template"],
1946
398
      Service["libvirt-bin"],
1947
399
      Kern_module["kvm_intel"]
1948
400
    ]
1949
401
  }
1950
402
}
1951
403
1952
404
define nvolume($version) {
1953
405
1954
406
  package { "nova-volume": ensure => $version, require => Exec["update-apt"] }
1955
407
1956
408
  nova_conf_pointer{'volume': name => 'volume'}
1957
409
1958
410
  # fix runlevels: using enable => true adds it as 20, which is too early
1959
411
  exec { "update-rc.d -f nova-volume remove":
1960
412
    path => "/usr/bin:/usr/sbin:/bin",
1961
413
    onlyif => "test -f /etc/rc2.d/S??nova-volume"
1962
414
  }
1963
415
1964
416
  file { "/etc/default/iscsitarget":
1965
417
    owner => "root", mode => 644,
1966
418
    content => "ISCSITARGET_ENABLE=true"
1967
419
  }
1968
420
1969
421
  package { "iscsitarget": ensure => present }
1970
422
1971
423
  file { "/dev/iscsi": ensure => directory } # FIXME(vish): owner / mode?
1972
424
  file { "/usr/sbin/nova-iscsi-dev.sh":
1973
425
    owner => "root", mode => 755,
1974
426
    source => "puppet://${puppet_server}/files/production/nova-iscsi-dev.sh"
1975
427
  }
1976
428
  file { "/etc/udev/rules.d/55-openiscsi.rules":
1977
429
    owner => "root", mode => 644,
1978
430
    content => 'KERNEL=="sd*", BUS=="scsi", PROGRAM="/usr/sbin/nova-iscsi-dev.sh %b",SYMLINK+="iscsi/%c%n"'
1979
431
  }
1980
432
1981
433
  service { "iscsitarget":
1982
434
    ensure => running,
1983
435
    enable => true,
1984
436
    hasstatus => true,
1985
437
    require => [
1986
438
      File["/etc/default/iscsitarget"],
1987
439
      Package["iscsitarget"]
1988
440
    ]
1989
441
  }
1990
442
1991
443
  service { "nova-volume":
1992
444
    ensure => running,
1993
445
    hasstatus => true,
1994
446
    subscribe => [
1995
447
      Package["nova-volume"],
1996
448
      File["/etc/nova/nova.conf"],
1997
449
      File["/etc/nova/nova-volume.conf"]
1998
450
    ]
1999
451
  }
2000
452
}
2001
453
2002
454
class novaspool {
2003
455
    # This isn't in release yet
2004
456
  #cron { logspool:
2005
457
  #  command => "/usr/bin/nova-logspool /var/log/nova.log /var/lib/nova/spool",
2006
458
  #  user => "nova"
2007
459
  #}
2008
460
  #cron { spoolsentry:
2009
461
  #  command => "/usr/bin/nova-spoolsentry ${sentry_url} ${sentry_key} /var/lib/nova/spool",
2010
462
  #  user => "nova"
2011
463
  #}
2012
464
}
2013
465
0
2014
=== removed file 'contrib/puppet/manifests/classes/swift.pp'
2015
--- contrib/puppet/manifests/classes/swift.pp	2010-11-12 19:07:46 +0000
2016
+++ contrib/puppet/manifests/classes/swift.pp	1970-01-01 00:00:00 +0000
2017
@@ -1,7 +0,0 @@
2018
1
class swift {
2019
2
  package { "memcached": ensure => present }
2020
3
  service { "memcached": require => Package['memcached'] }
2021
4
2022
5
  package { "swift-proxy": ensure => present }
2023
6
}
2024
7
2025
8
0
2026
=== removed file 'contrib/puppet/manifests/site.pp'
2027
--- contrib/puppet/manifests/site.pp	2010-11-12 19:07:46 +0000
2028
+++ contrib/puppet/manifests/site.pp	1970-01-01 00:00:00 +0000
2029
@@ -1,120 +0,0 @@
2030
1
# site.pp
2031
2
2032
3
import "templates"
2033
4
import "classes/*"
2034
5
2035
6
node novabase inherits default {
2036
7
#  $puppet_server = "192.168.0.10"
2037
8
  $cluster_name = "openstack001"
2038
9
  $ganglia_udp_send_channel = "openstack001.example.com"
2039
10
  $syslog = "192.168.0.10"
2040
11
2041
12
  # THIS STUFF ISN'T IN RELEASE YET
2042
13
  #$sentry_url = "http://192.168.0.19/sentry/store/"
2043
14
  #$sentry_key = "TODO:SENTRYPASS"
2044
15
2045
16
  $local_network = "192.168.0.0/16"
2046
17
  $vpn_ip = "192.168.0.2"
2047
18
  $public_interface = "eth0"
2048
19
  include novanode
2049
20
#  include nova-common
2050
21
  include opsmetrics
2051
22
2052
23
# non-nova stuff such as nova-dash inherit from novanode
2053
24
# novaspool needs a better home
2054
25
#  include novaspool
2055
26
}
2056
27
2057
28
# Builder
2058
29
node "nova000.example.com" inherits novabase {
2059
30
  $syslog = "server"
2060
31
  include ntp
2061
32
  include syslog-server
2062
33
}
2063
34
2064
35
# Non-Nova nodes
2065
36
2066
37
node
2067
38
     "blog.example.com",
2068
39
     "wiki.example.com"
2069
40
inherits novabase {
2070
41
  include ganglia-python
2071
42
  include ganglia-apache
2072
43
  include ganglia-mysql
2073
44
}
2074
45
2075
46
2076
47
node "nova001.example.com"
2077
48
inherits novabase {
2078
49
  include novabase
2079
50
2080
51
  nova_iptables { nova:
2081
52
      services => [
2082
53
        "ganglia",
2083
54
        "mysql",
2084
55
        "rabbitmq",
2085
56
        "ldap",
2086
57
        "api",
2087
58
        "objectstore",
2088
59
        "nrpe",
2089
60
      ],
2090
61
      ip => "192.168.0.10",
2091
62
   }
2092
63
2093
64
  nobjectstore { nova: version => "0.9.0" }
2094
65
  nscheduler   { nova: version => "0.9.0" }
2095
66
  napi { nova:
2096
67
    version => "0.9.0",
2097
68
    api_servers => 10,
2098
69
    api_base_port => 8000
2099
70
  }
2100
71
}
2101
72
2102
73
node "nova002.example.com"
2103
74
inherits novabase {
2104
75
  include novaconf
2105
76
2106
77
  nova_iptables { nova:
2107
78
      services => [
2108
79
        "ganglia",
2109
80
        "dnsmasq",
2110
81
        "nrpe"
2111
82
      ],
2112
83
      ip => "192.168.4.2",
2113
84
      private_range => "192.168.0.0/16",
2114
85
   }
2115
86
2116
87
  nnetwork { nova: version => "0.9.0" }
2117
88
}
2118
89
2119
90
node
2120
91
     "nova003.example.com",
2121
92
     "nova004.example.com",
2122
93
     "nova005.example.com",
2123
94
     "nova006.example.com",
2124
95
     "nova007.example.com",
2125
96
     "nova008.example.com",
2126
97
     "nova009.example.com",
2127
98
     "nova010.example.com",
2128
99
     "nova011.example.com",
2129
100
     "nova012.example.com",
2130
101
     "nova013.example.com",
2131
102
     "nova014.example.com",
2132
103
     "nova015.example.com",
2133
104
     "nova016.example.com",
2134
105
     "nova017.example.com",
2135
106
     "nova018.example.com",
2136
107
     "nova019.example.com",
2137
108
inherits novabase {
2138
109
  include novaconf
2139
110
  ncompute { nova: version => "0.9.0" }
2140
111
  nvolume  { nova: version => "0.9.0" }
2141
112
}
2142
113
2143
114
#node
2144
115
#     "nova020.example.com"
2145
116
#     "nova021.example.com"
2146
117
#inherits novanode {
2147
118
#  include novaconf
2148
119
  #ncompute { nova: version => "0.9.0" }
2149
120
#}
2150
121
0
2151
=== removed file 'contrib/puppet/manifests/templates.pp'
2152
--- contrib/puppet/manifests/templates.pp	2010-11-12 19:07:46 +0000
2153
+++ contrib/puppet/manifests/templates.pp	1970-01-01 00:00:00 +0000
2154
@@ -1,21 +0,0 @@
2155
1
# templates.pp
2156
2
2157
3
import "classes/*"
2158
4
2159
5
class baseclass {
2160
6
#  include dns-client  # FIXME: missing resolv.conf.erb??
2161
7
  include issue
2162
8
}
2163
9
2164
10
node default {
2165
11
  $nova_site = "undef"
2166
12
  $nova_ns1 = "undef"
2167
13
  $nova_ns2 = "undef"
2168
14
#  include baseclass
2169
15
}
2170
16
2171
17
# novanode handles the system-level requirements for Nova/Swift nodes
2172
18
class novanode {
2173
19
  include baseclass
2174
20
  include lvmconf
2175
21
}
2176
22
0
2177
=== removed file 'contrib/puppet/puppet.conf'
2178
--- contrib/puppet/puppet.conf	2010-11-12 19:07:46 +0000
2179
+++ contrib/puppet/puppet.conf	1970-01-01 00:00:00 +0000
2180
@@ -1,11 +0,0 @@
2181
1
[main]
2182
2
logdir=/var/log/puppet
2183
3
vardir=/var/lib/puppet
2184
4
ssldir=/var/lib/puppet/ssl
2185
5
rundir=/var/run/puppet
2186
6
factpath=$vardir/lib/facter
2187
7
pluginsync=false
2188
8
2189
9
[puppetmasterd]
2190
10
templatedir=/var/lib/nova/contrib/puppet/templates
2191
11
autosign=true
2192
12
0
2193
=== removed directory 'contrib/puppet/templates'
2194
=== removed file 'contrib/puppet/templates/haproxy.cfg.erb'
2195
--- contrib/puppet/templates/haproxy.cfg.erb	2010-11-12 19:07:46 +0000
2196
+++ contrib/puppet/templates/haproxy.cfg.erb	1970-01-01 00:00:00 +0000
2197
@@ -1,39 +0,0 @@
2198
1
# this config needs haproxy-1.1.28 or haproxy-1.2.1
2199
2
2200
3
global
2201
4
    log 127.0.0.1    local0
2202
5
    log 127.0.0.1    local1 notice
2203
6
    #log loghost    local0 info
2204
7
    maxconn 4096
2205
8
    #chroot /usr/share/haproxy
2206
9
    stats socket /var/run/haproxy.sock
2207
10
    user haproxy
2208
11
    group haproxy
2209
12
    daemon
2210
13
    #debug
2211
14
    #quiet
2212
15
2213
16
defaults
2214
17
    log    global
2215
18
    mode    http
2216
19
    option    httplog
2217
20
    option    dontlognull
2218
21
    retries    3
2219
22
    option redispatch
2220
23
    stats enable
2221
24
    stats uri /haproxy
2222
25
    maxconn    2000
2223
26
    contimeout    5000
2224
27
    clitimeout    50000
2225
28
    srvtimeout    50000
2226
29
2227
30
2228
31
listen    nova-api 0.0.0.0:8773
2229
32
    option httpchk GET / HTTP/1.0\r\nHost:\ example.com
2230
33
    option forwardfor
2231
34
    reqidel ^X-Forwarded-For:.*
2232
35
    balance    roundrobin
2233
36
<% api_servers.to_i.times do |offset| %><% port = api_base_port.to_i + offset -%>
2234
37
    server    api_<%= port %> 127.0.0.1:<%= port %> maxconn 1 check 
2235
38
<% end -%>
2236
39
    option    httpclose        # disable keep-alive
2237
40
0
2238
=== removed file 'contrib/puppet/templates/monitrc-nova-api.erb'
2239
--- contrib/puppet/templates/monitrc-nova-api.erb	2010-11-12 19:07:46 +0000
2240
+++ contrib/puppet/templates/monitrc-nova-api.erb	1970-01-01 00:00:00 +0000
2241
@@ -1,138 +0,0 @@
2242
1
###############################################################################
2243
2
## Monit control file
2244
3
###############################################################################
2245
4
##
2246
5
## Comments begin with a '#' and extend through the end of the line. Keywords
2247
6
## are case insensitive. All path's MUST BE FULLY QUALIFIED, starting with '/'.
2248
7
##
2249
8
## Below you will find examples of some frequently used statements. For 
2250
9
## information about the control file, a complete list of statements and 
2251
10
## options please have a look in the monit manual.
2252
11
##
2253
12
##
2254
13
###############################################################################
2255
14
## Global section
2256
15
###############################################################################
2257
16
##
2258
17
## Start monit in the background (run as a daemon):
2259
18
#
2260
19
set daemon 60           # check services at 1-minute intervals
2261
20
    with start delay 30 # optional: delay the first check by half a minute
2262
21
                        # (by default check immediately after monit start)
2263
22
2264
23
2265
24
## Set syslog logging with the 'daemon' facility. If the FACILITY option is
2266
25
## omitted, monit will use 'user' facility by default. If you want to log to 
2267
26
## a stand alone log file instead, specify the path to a log file
2268
27
#
2269
28
set logfile syslog facility log_daemon                       
2270
29
#
2271
30
#
2272
31
### Set the location of monit id file which saves the unique id specific for
2273
32
### given monit. The id is generated and stored on first monit start.
2274
33
### By default the file is placed in $HOME/.monit.id.
2275
34
#
2276
35
# set idfile /var/.monit.id
2277
36
#
2278
37
### Set the location of monit state file which saves the monitoring state
2279
38
### on each cycle. By default the file is placed in $HOME/.monit.state. If
2280
39
### state file is stored on persistent filesystem, monit will recover the
2281
40
### monitoring state across reboots. If it is on temporary filesystem, the
2282
41
### state will be lost on reboot.
2283
42
#
2284
43
# set statefile /var/.monit.state
2285
44
#
2286
45
## Set the list of mail servers for alert delivery. Multiple servers may be 
2287
46
## specified using comma separator. By default monit uses port 25 - this
2288
47
## is possible to override with the PORT option.
2289
48
#
2290
49
# set mailserver mail.bar.baz,               # primary mailserver
2291
50
#                backup.bar.baz port 10025,  # backup mailserver on port 10025
2292
51
#                localhost                   # fallback relay
2293
52
#
2294
53
#
2295
54
## By default monit will drop alert events if no mail servers are available. 
2296
55
## If you want to keep the alerts for a later delivery retry, you can use the 
2297
56
## EVENTQUEUE statement. The base directory where undelivered alerts will be 
2298
57
## stored is specified by the BASEDIR option. You can limit the maximal queue
2299
58
## size using the SLOTS option (if omitted, the queue is limited by space 
2300
59
## available in the back end filesystem).
2301
60
#
2302
61
# set eventqueue
2303
62
#     basedir /var/monit  # set the base directory where events will be stored
2304
63
#     slots 100           # optionaly limit the queue size
2305
64
#
2306
65
#
2307
66
## Send status and events to M/Monit (Monit central management: for more
2308
67
## informations about M/Monit see http://www.tildeslash.com/mmonit).
2309
68
#
2310
69
# set mmonit http://monit:monit@192.168.1.10:8080/collector
2311
70
#
2312
71
#
2313
72
## Monit by default uses the following alert mail format:
2314
73
##
2315
74
## --8<--
2316
75
## From: monit@$HOST                         # sender
2317
76
## Subject: monit alert --  $EVENT $SERVICE  # subject
2318
77
##
2319
78
## $EVENT Service $SERVICE                   #
2320
79
##                                           #
2321
80
## 	Date:        $DATE                   #
2322
81
## 	Action:      $ACTION                 #
2323
82
## 	Host:        $HOST                   # body
2324
83
## 	Description: $DESCRIPTION            #
2325
84
##                                           #
2326
85
## Your faithful employee,                   #
2327
86
## monit                                     #
2328
87
## --8<--
2329
88
##
2330
89
## You can override this message format or parts of it, such as subject
2331
90
## or sender using the MAIL-FORMAT statement. Macros such as $DATE, etc.
2332
91
## are expanded at runtime. For example, to override the sender:
2333
92
#
2334
93
# set mail-format { from: monit@foo.bar }
2335
94
#
2336
95
#
2337
96
## You can set alert recipients here whom will receive alerts if/when a 
2338
97
## service defined in this file has errors. Alerts may be restricted on 
2339
98
## events by using a filter as in the second example below. 
2340
99
#
2341
100
# set alert sysadm@foo.bar                       # receive all alerts
2342
101
# set alert manager@foo.bar only on { timeout }  # receive just service-
2343
102
#                                                # timeout alert
2344
103
#
2345
104
#
2346
105
## Monit has an embedded web server which can be used to view status of 
2347
106
## services monitored, the current configuration, actual services parameters
2348
107
## and manage services from a web interface.
2349
108
#
2350
109
 set httpd port 2812 and
2351
110
     use address localhost  # only accept connection from localhost
2352
111
     allow localhost        # allow localhost to connect to the server and
2353
112
#     allow admin:monit      # require user 'admin' with password 'monit'
2354
113
#     allow @monit           # allow users of group 'monit' to connect (rw)
2355
114
#     allow @users readonly  # allow users of group 'users' to connect readonly
2356
115
#
2357
116
#
2358
117
###############################################################################
2359
118
## Services
2360
119
###############################################################################
2361
120
2362
121
<% api_servers.to_i.times do |offset| %><% port = api_base_port.to_i + offset %>
2363
122
2364
123
check process nova_api_<%= port %> with pidfile /var/run/nova/nova-api-<%= port %>.pid
2365
124
   group nova_api
2366
125
   start program = "/usr/bin/nova-api --flagfile=/etc/nova/nova.conf --pidfile=/var/run/nova/nova-api-<%= port %>.pid --api_listen_port=<%= port %> --lockfile=/var/run/nova/nova-api-<%= port %>.pid.lock start"
2367
126
       as uid nova
2368
127
   stop program = "/usr/bin/nova-api --flagfile=/etc/nova/nova.conf --pidfile=/var/run/nova/nova-api-<%= port %>.pid --api_listen_port=<%= port %> --lockfile=/var/run/nova/nova-api-<%= port %>.pid.lock stop"
2369
128
       as uid nova
2370
129
   if failed port <%= port %> protocol http
2371
130
     with timeout 15 seconds
2372
131
     for 4 cycles
2373
132
     then restart
2374
133
   if totalmem > 300 Mb then restart
2375
134
   if cpu is greater than 60% for 2 cycles then alert
2376
135
   if cpu > 80% for 3 cycles then restart
2377
136
   if 3 restarts within 5 cycles then timeout
2378
137
2379
138
<% end %>
2380
139
0
2381
=== removed file 'contrib/puppet/templates/nova-iptables.erb'
2382
--- contrib/puppet/templates/nova-iptables.erb	2010-11-12 19:07:46 +0000
2383
+++ contrib/puppet/templates/nova-iptables.erb	1970-01-01 00:00:00 +0000
2384
@@ -1,10 +0,0 @@
2385
1
<% services.each do |service| -%>
2386
2
<%= service.upcase %>=1
2387
3
<% end -%>
2388
4
<% if ip && ip != "" %>IP="<%=ip%>"<% end %>
2389
5
<% if private_range && private_range != "" %>PRIVATE_RANGE="<%=private_range%>"<% end %>
2390
6
<% if mgmt_ip && mgmt_ip != "" %>MGMT_IP="<%=mgmt_ip%>"<% end %>
2391
7
<% if dmz_ip && dmz_ip != "" %>DMZ_IP="<%=dmz_ip%>"<% end %>
2392
8
2393
9
# warning: this file is auto-generated by puppet
2394
10
2395
11
0
2396
=== removed directory 'contrib/puppet/templates/production'
2397
=== removed file 'contrib/puppet/templates/production/nova-common.conf.erb'
2398
--- contrib/puppet/templates/production/nova-common.conf.erb	2010-11-23 18:46:07 +0000
2399
+++ contrib/puppet/templates/production/nova-common.conf.erb	1970-01-01 00:00:00 +0000
2400
@@ -1,55 +0,0 @@
2401
1
# global
2402
2
--dmz_net=192.168.0.0
2403
3
--dmz_mask=255.255.0.0
2404
4
--dmz_cidr=192.168.0.0/16
2405
5
--ldap_user_dn=cn=Administrators,dc=example,dc=com
2406
6
--ldap_user_unit=Users
2407
7
--ldap_user_subtree=ou=Users,dc=example,dc=com
2408
8
--ldap_project_subtree=ou=Groups,dc=example,dc=com
2409
9
--role_project_subtree=ou=Groups,dc=example,dc=com
2410
10
--ldap_cloudadmin=cn=NovaAdmins,ou=Groups,dc=example,dc=com
2411
11
--ldap_itsec=cn=NovaSecurity,ou=Groups,dc=example,dc=com
2412
12
--ldap_sysadmin=cn=Administrators,ou=Groups,dc=example,dc=com
2413
13
--ldap_netadmin=cn=Administrators,ou=Groups,dc=example,dc=com
2414
14
--ldap_developer=cn=developers,ou=Groups,dc=example,dc=com
2415
15
--verbose
2416
16
--daemonize
2417
17
--syslog
2418
18
--networks_path=/var/lib/nova/networks
2419
19
--instances_path=/var/lib/nova/instances
2420
20
--buckets_path=/var/lib/nova/objectstore/buckets
2421
21
--images_path=/var/lib/nova/objectstore/images
2422
22
--scheduler_driver=nova.scheduler.simple.SimpleScheduler
2423
23
--libvirt_xml_template=/usr/share/nova/libvirt.qemu.xml.template
2424
24
--credentials_template=/usr/share/nova/novarc.template
2425
25
--boot_script_template=/usr/share/nova/bootscript.template
2426
26
--vpn_client_template=/usr/share/nova/client.ovpn.template
2427
27
--max_cores=40
2428
28
--max_gigabytes=2000
2429
29
--ca_path=/var/lib/nova/CA
2430
30
--keys_path=/var/lib/nova/keys
2431
31
--vpn_start=11000
2432
32
--volume_group=vgdata
2433
33
--volume_manager=nova.volume.manager.ISCSIManager
2434
34
--volume_driver=nova.volume.driver.ISCSIDriver
2435
35
--default_kernel=aki-DEFAULT
2436
36
--default_ramdisk=ari-DEFAULT
2437
37
--dhcpbridge=/usr/bin/nova-dhcpbridge
2438
38
--vpn_image_id=ami-cloudpipe
2439
39
--dhcpbridge_flagfile=/etc/nova/nova.conf
2440
40
--credential_cert_subject=/C=US/ST=Texas/L=Bexar/O=NovaDev/OU=NOVA/CN=%s-%s
2441
41
--auth_driver=nova.auth.ldapdriver.LdapDriver
2442
42
--quota_cores=17
2443
43
--quota_floating_ips=5
2444
44
--quota_instances=6
2445
45
--quota_volumes=10
2446
46
--quota_gigabytes=100
2447
47
--use_nova_chains=True
2448
48
--input_chain=services
2449
49
--use_project_ca=True
2450
50
--fixed_ip_disassociate_timeout=300
2451
51
--api_max_requests=1
2452
52
--api_listen_ip=127.0.0.1
2453
53
--user_cert_subject=/C=US/ST=Texas/L=Bexar/O=NovaDev/OU=Nova/CN=%s-%s-%s
2454
54
--project_cert_subject=/C=US/ST=Texas/L=Bexar/O=NovaDev/OU=Nova/CN=project-ca-%s-%s
2455
55
--vpn_cert_subject=/C=US/ST=Texas/L=Bexar/O=NovaDev/OU=Nova/CN=project-vpn-%s-%s
2456
56
0
2457
=== removed file 'contrib/puppet/templates/production/nova-nova.conf.erb'
2458
--- contrib/puppet/templates/production/nova-nova.conf.erb	2010-11-12 19:07:46 +0000
2459
+++ contrib/puppet/templates/production/nova-nova.conf.erb	1970-01-01 00:00:00 +0000
2460
@@ -1,21 +0,0 @@
2461
1
--fixed_range=192.168.0.0/16
2462
2
--iscsi_ip_prefix=192.168.4
2463
3
--floating_range=10.0.0.0/24
2464
4
--rabbit_host=192.168.0.10
2465
5
--s3_host=192.168.0.10
2466
6
--cc_host=192.168.0.10
2467
7
--cc_dmz=192.168.24.10
2468
8
--s3_dmz=192.168.24.10
2469
9
--ec2_url=http://192.168.0.1:8773/services/Cloud
2470
10
--vpn_ip=192.168.0.2
2471
11
--ldap_url=ldap://192.168.0.10
2472
12
--sql_connection=mysql://nova:TODO-MYPASS@192.168.0.10/nova
2473
13
--other_sql_connection=mysql://nova:TODO-MYPASS@192.168.0.10/nova
2474
14
--routing_source_ip=192.168.0.2
2475
15
--bridge_dev=eth1
2476
16
--public_interface=eth0
2477
17
--vlan_start=3100
2478
18
--num_networks=700
2479
19
--rabbit_userid=TODO:RABBIT
2480
20
--rabbit_password=TODO:CHANGEME
2481
21
--ldap_password=TODO:CHANGEME
2482
22
0
2483
=== modified file 'nova/service.py'
2484
--- nova/service.py	2011-01-27 19:52:10 +0000
2485
+++ nova/service.py	2011-02-20 19:58:33 +0000
2486
@@ -50,10 +50,6 @@
2487
50
                     'seconds between running periodic tasks',
50
                     'seconds between running periodic tasks',
2488
51
                     lower_bound=1)
51
                     lower_bound=1)
2489
52
52
2490
53
flags.DEFINE_string('pidfile', None,
2491
54
                    'pidfile to use for this service')
2492
55
2493
56
2494
57
flags.DEFINE_flag(flags.HelpFlag())
53
flags.DEFINE_flag(flags.HelpFlag())
2495
58
flags.DEFINE_flag(flags.HelpshortFlag())
54
flags.DEFINE_flag(flags.HelpshortFlag())
2496
59
flags.DEFINE_flag(flags.HelpXMLFlag())
55
flags.DEFINE_flag(flags.HelpXMLFlag())
Reviewer	Date Requested	Status
Todd Willey (community)		Approve on 2011-02-22
Devin Carlen (community)	2011-02-15	Approve on 2011-02-22
Thierry Carrez (community)		Approve on 2011-02-21
Review via email: mp+49871@code.launchpad.net