Merge lp:~freyes/charms/trusty/nova-cloud-controller/single-nova-consoleauth into lp:~openstack-charmers-archive/charms/trusty/nova-cloud-controller/next

[Felipe Reyes]

Dear OpenStack Charmers,

This patch configures a new pacemaker resource that will allow to run a single instance of nova-consoleauth service when console-access-protocol is defined.

Specifically, nova-consoleauth is configured to run where the vip is allocated, with this patch this will be default behaviour. This is needed for environments where the memcached cannot (or doesn't want to) be related to nova-cloud-controller to share the authorization tokens across all the running instances.

Example output of 'sudo crm_mon -1' with this patch applied:

Last updated: Wed Feb 18 19:43:32 2015
Last change: Wed Feb 18 19:42:05 2015 via crmd on juju-xxx-machine-95
Stack: corosync
Current DC: juju-xxx-machine-97 (168102885) - partition with quorum
Version: 1.1.10-42f2063
3 Nodes configured
5 Resources configured

Online: [ juju-xxx-machine-95 juju-xxx-machine-96 juju-xxx-machine-97 ]

 Resource Group: grp_nova_vips
     res_nova_eth0_vip (ocf::heartbeat:IPaddr2): Started juju-xxx-machine-97
 Clone Set: cl_nova_haproxy [res_nova_haproxy]
     Started: [ juju-xxx-machine-95 juju-xxx-machine-96 juju-xxx-machine-97 ]
 res_nova_consoleauth (upstart:nova-consoleauth): Started juju-xxx-machine-97

This patch adds unit tests, but if an amulet test is needed I could add it.

Thanks,

[uosci-testing-bot (uosci-testing-bot)]

charm_lint_check #2119 nova-cloud-controller-next for freyes mp250339
    LINT OK: passed

Build: http://10.245.162.77:8080/job/charm_lint_check/2119/

[uosci-testing-bot (uosci-testing-bot)]

charm_unit_test #1909 nova-cloud-controller-next for freyes mp250339
    UNIT OK: passed

Build: http://10.245.162.77:8080/job/charm_unit_test/1909/

[uosci-testing-bot (uosci-testing-bot)]

charm_amulet_test #2028 nova-cloud-controller-next for freyes mp250339
    AMULET OK: passed

Build: http://10.245.162.77:8080/job/charm_amulet_test/2028/

[Billy Olsen (billy-olsen)]

Felipe,

Thanks for the submission. I haven't deployed this yet to try it out, but my concerns are around the upstart resources. Since we'll have a difference between systemd and upstart between vivid and previous releases I think we should be using an ocf file instead. There's already one that exists in https://github.com/madkiss/openstack-resource-agents/tree/master/ocf. Looks like its been awhile since its been touched so its either stable or not supported anymore. I think the openstack-resource-agents package also includes this, but I'm not sure as to its status (I believe its in universe).

An amulet test is always nice :-) We don't have anything in the way of the hacluster relation in our amulet tests at this point so I don't think its strictly a requirement (e.g. I wouldn't hold up the mp for it), but improvements are always welcomed.

review: Needs Fixing

[lp:~freyes/charms/trusty/nova-cloud-controller/single-nova-consoleauth]

148. By Felipe Reyes on 2015-02-27

pacemakr: use openstack resource agent instead of upstart

149. By Felipe Reyes on 2015-03-02

Fix unit test

150. By Felipe Reyes on 2015-03-06

Commit after merge

151. By Felipe Reyes on 2015-03-06

Fix lint errors

152. By Felipe Reyes on 2015-03-09

pcmkr: Delete resources when single-nova-consoleauth turned off

153. By Felipe Reyes on 2015-03-18

Remove pcmkr rules when single-nova-consoleauth is set to True

154. By Felipe Reyes on 2015-05-18

Commit after merge

155. By Felipe Reyes on 2015-05-22

Move code into its own function and it's called from config-changed, ha-relation-changed and upgrade-charm

156. By Felipe Reyes on 2015-05-22

fix lint warning

157. By Felipe Reyes on 2015-05-22

Commit after merge

158. By Felipe Reyes on 2015-05-22

nova-consoleauth set to manual only if there is a ha relation

Unmerged revisions

=== modified file 'config.yaml'
--- config.yaml	2015-02-19 04:30:13 +0000
+++ config.yaml	2015-03-02 14:34:20 +0000
@@ -320,9 +320,23 @@
           juju-myservice-0
       If you're running multiple environments with the same services in them
       this allows you to differentiate between them.
+<<<<<<< TREE
   nagios_servicegroups:
     default: ""
     type: string
     description: |
       A comma-separated list of nagios servicegroups.
       If left empty, the nagios_context will be used as the servicegroup
+=======
+  single-nova-consoleauth:
+    type: boolean
+    default: true
+    description: |
+      When this configuration is set to True, a single instance of
+      nova-consoleauth service will be running, this allows users to always
+      authenticate against the same instance and avoid authentications issues
+      when the token used was stored in a different instance.
+      
+      If memcached is being used to store the tokens, then it's recommended to
+      change this configuration to False.
+>>>>>>> MERGE-SOURCE
 
=== modified file 'hooks/nova_cc_hooks.py'
--- hooks/nova_cc_hooks.py	2015-02-19 04:29:22 +0000
+++ hooks/nova_cc_hooks.py	2015-03-02 14:34:20 +0000
@@ -171,6 +171,27 @@
     [cluster_joined(rid) for rid in relation_ids('cluster')]
     update_nrpe_config()
 
+    if config('single-nova-consoleauth') and console_attributes('protocol'):
+        colocations = {
+            'vip_consoleauth': 'inf: res_nova_consoleauth grp_nova_vips'
+        }
+        init_services = {
+            'res_nova_consoleauth': 'nova-consoleauth'
+        }
+        resources = {
+            'res_nova_consoleauth': 'ocf:openstack:nova-consoleauth'
+        }
+        resource_params = {
+            'res_nova_consoleauth': 'op monitor interval="5s"'
+        }
+
+        for rid in relation_ids('ha'):
+            relation_set(rid,
+                         init_services=init_services,
+                         resources=resources,
+                         resource_params=resource_params,
+                         colocations=colocations)
+
 
 @hooks.hook('amqp-relation-joined')
 def amqp_joined(relation_id=None):
@@ -636,7 +657,7 @@
         'res_nova_haproxy': 'lsb:haproxy',
     }
     resource_params = {
-        'res_nova_haproxy': 'op monitor interval="5s"'
+        'res_nova_haproxy': 'op monitor interval="5s"',
     }
 
     vip_group = []
@@ -674,12 +695,22 @@
     clones = {
         'cl_nova_haproxy': 'res_nova_haproxy'
     }
+    colocations = {}
+
+    if config('single-nova-consoleauth') and console_attributes('protocol'):
+        colocations['vip_consoleauth'] = ('inf: res_nova_consoleauth '
+                                          'grp_nova_vips')
+        init_services['res_nova_consoleauth'] = 'nova-consoleauth'
+        resources['res_nova_consoleauth'] = 'ocf:openstack:nova-consoleauth'
+        resource_params['res_nova_consoleauth'] = 'op monitor interval="5s"'
+
     relation_set(init_services=init_services,
                  corosync_bindiface=cluster_config['ha-bindiface'],
                  corosync_mcastport=cluster_config['ha-mcastport'],
                  resources=resources,
                  resource_params=resource_params,
-                 clones=clones)
+                 clones=clones,
+                 colocations=colocations)
 
 
 @hooks.hook('ha-relation-changed')
 
=== modified file 'unit_tests/test_nova_cc_hooks.py'
--- unit_tests/test_nova_cc_hooks.py	2015-01-13 14:44:54 +0000
+++ unit_tests/test_nova_cc_hooks.py	2015-03-02 14:34:20 +0000
@@ -611,30 +611,127 @@
             'by the neutron-server process.'
         )
 
-    def test_ha_relation_joined_no_bound_ip(self):
-        self.get_hacluster_config.return_value = {
-            'ha-bindiface': 'em0',
-            'ha-mcastport': '8080',
-            'vip': '10.10.10.10',
-        }
-        self.test_config.set('vip_iface', 'eth120')
-        self.test_config.set('vip_cidr', '21')
-        self.get_iface_for_address.return_value = None
-        self.get_netmask_for_address.return_value = None
-        hooks.ha_joined()
-        args = {
-            'corosync_bindiface': 'em0',
-            'corosync_mcastport': '8080',
-            'init_services': {'res_nova_haproxy': 'haproxy'},
-            'resources': {'res_nova_eth120_vip': 'ocf:heartbeat:IPaddr2',
-                          'res_nova_haproxy': 'lsb:haproxy'},
-            'resource_params': {
-                'res_nova_eth120_vip': 'params ip="10.10.10.10"'
-                ' cidr_netmask="21" nic="eth120"',
-                'res_nova_haproxy': 'op monitor interval="5s"'},
-            'clones': {'cl_nova_haproxy': 'res_nova_haproxy'}
-        }
-        self.relation_set.assert_has_calls([
-            call(groups={'grp_nova_vips': 'res_nova_eth120_vip'}),
-            call(**args),
+    @patch('nova_cc_utils.config')
+    def test_ha_relation_joined_no_bound_ip(self, config):
+        self.get_hacluster_config.return_value = {
+            'ha-bindiface': 'em0',
+            'ha-mcastport': '8080',
+            'vip': '10.10.10.10',
+        }
+        self.test_config.set('vip_iface', 'eth120')
+        self.test_config.set('vip_cidr', '21')
+        config.return_value = None
+        self.get_iface_for_address.return_value = None
+        self.get_netmask_for_address.return_value = None
+        hooks.ha_joined()
+        args = {
+            'corosync_bindiface': 'em0',
+            'corosync_mcastport': '8080',
+            'init_services': {'res_nova_haproxy': 'haproxy'},
+            'resources': {'res_nova_eth120_vip': 'ocf:heartbeat:IPaddr2',
+                          'res_nova_haproxy': 'lsb:haproxy'},
+            'resource_params': {
+                'res_nova_eth120_vip': 'params ip="10.10.10.10"'
+                ' cidr_netmask="21" nic="eth120"',
+                'res_nova_haproxy': 'op monitor interval="5s"'},
+            'colocations': {},
+            'clones': {'cl_nova_haproxy': 'res_nova_haproxy'}
+        }
+        self.relation_set.assert_has_calls([
+            call(groups={'grp_nova_vips': 'res_nova_eth120_vip'}),
+            call(**args),
+        ])
+
+    @patch('nova_cc_utils.config')
+    def test_ha_relation_multi_consoleauth(self, config):
+        self.get_hacluster_config.return_value = {
+            'ha-bindiface': 'em0',
+            'ha-mcastport': '8080',
+            'vip': '10.10.10.10',
+        }
+        self.test_config.set('vip_iface', 'eth120')
+        self.test_config.set('vip_cidr', '21')
+        self.test_config.set('single-nova-consoleauth', False)
+        config.return_value = 'novnc'
+        self.get_iface_for_address.return_value = None
+        self.get_netmask_for_address.return_value = None
+        hooks.ha_joined()
+        args = {
+            'corosync_bindiface': 'em0',
+            'corosync_mcastport': '8080',
+            'init_services': {'res_nova_haproxy': 'haproxy'},
+            'resources': {'res_nova_eth120_vip': 'ocf:heartbeat:IPaddr2',
+                          'res_nova_haproxy': 'lsb:haproxy'},
+            'resource_params': {
+                'res_nova_eth120_vip': 'params ip="10.10.10.10"'
+                ' cidr_netmask="21" nic="eth120"',
+                'res_nova_haproxy': 'op monitor interval="5s"'},
+            'colocations': {},
+            'clones': {'cl_nova_haproxy': 'res_nova_haproxy'}
+        }
+        self.relation_set.assert_has_calls([
+            call(groups={'grp_nova_vips': 'res_nova_eth120_vip'}),
+            call(**args),
+        ])
+
+    @patch('nova_cc_utils.config')
+    def test_ha_relation_single_consoleauth(self, config):
+        self.get_hacluster_config.return_value = {
+            'ha-bindiface': 'em0',
+            'ha-mcastport': '8080',
+            'vip': '10.10.10.10',
+        }
+        self.test_config.set('vip_iface', 'eth120')
+        self.test_config.set('vip_cidr', '21')
+        config.return_value = 'novnc'
+        self.get_iface_for_address.return_value = None
+        self.get_netmask_for_address.return_value = None
+        hooks.ha_joined()
+        args = {
+            'corosync_bindiface': 'em0',
+            'corosync_mcastport': '8080',
+            'init_services': {'res_nova_haproxy': 'haproxy',
+                              'res_nova_consoleauth': 'nova-consoleauth'},
+            'resources': {'res_nova_eth120_vip': 'ocf:heartbeat:IPaddr2',
+                          'res_nova_haproxy': 'lsb:haproxy',
+                          'res_nova_consoleauth': \
+                          'ocf:openstack:nova-consoleauth'},
+            'resource_params': {
+                'res_nova_eth120_vip': 'params ip="10.10.10.10"'
+                ' cidr_netmask="21" nic="eth120"',
+                'res_nova_haproxy': 'op monitor interval="5s"',
+                'res_nova_consoleauth': 'op monitor interval="5s"'},
+            'colocations': {
+                'vip_consoleauth': 'inf: res_nova_consoleauth grp_nova_vips'
+            },
+            'clones': {'cl_nova_haproxy': 'res_nova_haproxy'}
+        }
+        self.relation_set.assert_has_calls([
+            call(groups={'grp_nova_vips': 'res_nova_eth120_vip'}),
+            call(**args),
+        ])
+
+    @patch('nova_cc_hooks.configure_https')
+    @patch('nova_cc_utils.config')
+    def test_config_changed_single_consoleauth(self, config, *args):
+        config.return_value = 'novnc'
+        rids = {'ha': ['ha:1']}
+
+        def f(r):
+            return rids.get(r, [])
+
+        self.relation_ids.side_effect = f
+        hooks.config_changed()
+        args = {
+            'init_services': {'res_nova_consoleauth': 'nova-consoleauth'},
+            'resources': {'res_nova_consoleauth': \
+                          'ocf:openstack:nova-consoleauth'},
+            'resource_params': {
+                'res_nova_consoleauth': 'op monitor interval="5s"'},
+            'colocations': {
+                'vip_consoleauth': 'inf: res_nova_consoleauth grp_nova_vips'
+            }
+        }
+        self.relation_set.assert_has_calls([
+            call(v, **args) for v in rids['ha']
         ])