Merge lp:~ivoks/charms/precise/nova-cloud-controller/tls-ha into lp:~charmers/charms/precise/nova-cloud-controller/trunk

[Ante Karamatić]

As part of changing OpenStack charm to provide better SSL experience, we need to put HAproxy in front of the Apache. Apache then does SSL termination on destination host, and HAproxy balances TCP traffic instead of HTTP. This allows us to keep all outside server traffic - crypted.

In addition, we stop and start services, instead of restarting. This avoids TCP port conflicts.

Depends on charm-helpers from: lp:~ivoks/charm-helpers/new-ssl

[lp:~ivoks/charms/precise/nova-cloud-controller/tls-ha]

67. By Ante Karamatić on 2014-02-17

Support for neutron_url in nova.conf

68. By Ante Karamatić on 2014-02-17

Update charm-helpers

[Edward Hope-Morley (hopem)]

The status of this MP has been set to Merged but this has not been merged. Also it contains a bug, is out-of-sync with the corresponding cham-helpers patch and is target at the wrong branch.

review: Needs Fixing

[Edward Hope-Morley (hopem)]

This is now supersceded by https://code.launchpad.net/~hopem/charms/precise/nova-cloud-controller/lp1273469

=== modified file 'hooks/charmhelpers/contrib/hahelpers/cluster.py'
--- hooks/charmhelpers/contrib/hahelpers/cluster.py	2013-08-14 16:14:10 +0000
+++ hooks/charmhelpers/contrib/hahelpers/cluster.py	2014-02-17 12:10:56 +0000
@@ -126,17 +126,17 @@
     return public_port - (i * 10)
 
 
-def determine_haproxy_port(public_port):
+def determine_apache_port(public_port):
     '''
-    Description: Determine correct proxy listening port based on public IP +
-    existence of HTTPS reverse proxy.
+    Description: Determine correct apache listening port based on public IP +
+    state of the cluster.
 
     public_port: int: standard public port for given service
 
     returns: int: the correct listening port for the HAProxy service
     '''
     i = 0
-    if https():
+    if len(peer_units()) > 0 or is_clustered():
         i += 1
     return public_port - (i * 10)
 

=== modified file 'hooks/charmhelpers/contrib/openstack/context.py'
--- hooks/charmhelpers/contrib/openstack/context.py	2013-12-18 14:57:37 +0000
+++ hooks/charmhelpers/contrib/openstack/context.py	2014-02-17 12:10:56 +0000
@@ -27,8 +27,8 @@
 )
 
 from charmhelpers.contrib.hahelpers.cluster import (
+    determine_apache_port,
     determine_api_port,
-    determine_haproxy_port,
     https,
     is_clustered,
     peer_units,
@@ -341,11 +341,9 @@
             'private_address': unit_get('private-address'),
             'endpoints': []
         }
-        for ext_port in self.external_ports:
-            if peer_units() or is_clustered():
-                int_port = determine_haproxy_port(ext_port)
-            else:
-                int_port = determine_api_port(ext_port)
+        for api_port in self.external_ports:
+            ext_port = determine_apache_port(api_port)
+            int_port = determine_api_port(api_port)
             portmap = (int(ext_port), int(int_port))
             ctxt['endpoints'].append(portmap)
         return ctxt
@@ -412,6 +410,22 @@
 
         return nvp_ctxt
 
+    def neutron_ctxt(self):
+        if https():
+            proto = 'https'
+        else:
+            proto = 'http'
+        if is_clustered():
+            host = config()['vip']
+        else:
+            host = unit_get('private-address')
+        url = proto + '://' + host + ':9696'
+        ctxt = {
+            'network_manager': self.network_manager,
+            'neutron_url': url,
+        }
+        return ctxt
+
     def __call__(self):
         self._ensure_packages()
 
@@ -421,7 +435,7 @@
         if not self.plugin:
             return {}
 
-        ctxt = {'network_manager': self.network_manager}
+        ctxt = self.neutron_ctxt()
 
         if self.plugin == 'ovs':
             ctxt.update(self.ovs_ctxt())

=== modified file 'hooks/charmhelpers/contrib/openstack/templates/haproxy.cfg'
--- hooks/charmhelpers/contrib/openstack/templates/haproxy.cfg	2013-08-02 03:42:16 +0000
+++ hooks/charmhelpers/contrib/openstack/templates/haproxy.cfg	2014-02-17 12:10:56 +0000
@@ -8,8 +8,8 @@
 
 defaults
     log global
-    mode http
-    option httplog
+    mode tcp
+    option tcplog
     option dontlognull
     retries 3
     timeout queue 1000
@@ -29,7 +29,6 @@
 {% for service, ports in service_ports.iteritems() -%}
 listen {{ service }} 0.0.0.0:{{ ports[0] }}
     balance roundrobin
-    option tcplog
     {% for unit, address in units.iteritems() -%}
     server {{ unit }} {{ address }}:{{ ports[1] }} check
     {% endfor %}

=== modified file 'hooks/charmhelpers/core/host.py'
--- hooks/charmhelpers/core/host.py	2013-10-22 23:01:40 +0000
+++ hooks/charmhelpers/core/host.py	2014-02-17 12:10:56 +0000
@@ -194,7 +194,7 @@
         return None
 
 
-def restart_on_change(restart_map):
+def restart_on_change(restart_map, stopstart=False):
     """Restart services based on configuration files changing
 
     This function is used a decorator, for example
@@ -219,8 +219,14 @@
             for path in restart_map:
                 if checksums[path] != file_hash(path):
                     restarts += restart_map[path]
-            for service_name in list(OrderedDict.fromkeys(restarts)):
-                service('restart', service_name)
+            services_list = list(OrderedDict.fromkeys(restarts))
+            if not stopstart:
+                for service_name in services_list:
+                    service('restart', service_name)
+            else:
+                for action in ['stop', 'start']:
+                    for service_name in services_list:
+                        service(action, service_name)
         return wrapped_f
     return wrap
 

=== modified file 'hooks/nova_cc_context.py'
--- hooks/nova_cc_context.py	2013-10-16 10:47:19 +0000
+++ hooks/nova_cc_context.py	2014-02-17 12:10:56 +0000
@@ -6,7 +6,7 @@
 from charmhelpers.contrib.openstack import context, neutron, utils
 
 from charmhelpers.contrib.hahelpers.cluster import (
-    determine_api_port, determine_haproxy_port)
+    determine_apache_port, determine_api_port)
 
 
 class ApacheSSLContext(context.ApacheSSLContext):
@@ -67,6 +67,13 @@
         nvol_api = determine_api_port(api_port('nova-api-os-volume'))
         neutron_api = determine_api_port(api_port('neutron-server'))
 
+        # Apache ports
+        a_compute_api = determine_apache_port(api_port('nova-api-os-compute'))
+        a_ec2_api = determine_apache_port(api_port('nova-api-ec2'))
+        a_s3_api = determine_apache_port(api_port('nova-objectstore'))
+        a_nvol_api = determine_apache_port(api_port('nova-api-os-volume'))
+        a_neutron_api = determine_apache_port(api_port('neutron-server'))
+
         # to be set in nova.conf accordingly.
         listen_ports = {
             'osapi_compute_listen_port': compute_api,
@@ -76,32 +83,24 @@
 
         port_mapping = {
             'nova-api-os-compute': [
-                determine_haproxy_port(api_port('nova-api-os-compute')),
-                compute_api,
-            ],
+                api_port('nova-api-os-compute'), a_compute_api],
             'nova-api-ec2': [
-                determine_haproxy_port(api_port('nova-api-ec2')),
-                ec2_api,
-            ],
+                api_port('nova-api-ec2'), a_ec2_api],
             'nova-objectstore': [
-                determine_haproxy_port(api_port('nova-objectstore')),
-                s3_api,
-            ],
+                api_port('nova-objectstore'), a_s3_api],
         }
 
         if relation_ids('nova-volume-service'):
             port_mapping.update({
                 'nova-api-ec2': [
-                    determine_haproxy_port(api_port('nova-api-ec2')),
-                    nvol_api],
+                    api_port('nova-api-ec2'), a_nvol_api],
             })
             listen_ports['osapi_volume_listen_port'] = nvol_api
 
         if neutron.network_manager() in ['neutron', 'quantum']:
             port_mapping.update({
                 'neutron-server': [
-                    determine_haproxy_port(api_port('neutron-server')),
-                    neutron_api]
+                    api_port('neutron-server'), a_neutron_api]
             })
             # quantum/neutron.conf listening port, set separte from nova's.
             ctxt['neutron_bind_port'] = neutron_api

=== modified file 'hooks/nova_cc_hooks.py'
--- hooks/nova_cc_hooks.py	2013-12-16 10:09:36 +0000
+++ hooks/nova_cc_hooks.py	2014-02-17 12:10:56 +0000
@@ -94,7 +94,7 @@
 
 
 @hooks.hook('config-changed')
-@restart_on_change(restart_map())
+@restart_on_change(restart_map(), stopstart=True)
 def config_changed():
     if openstack_upgrade_available('nova-common'):
         do_openstack_upgrade(configs=CONFIGS)
@@ -333,7 +333,7 @@
 
 @hooks.hook('cluster-relation-changed',
             'cluster-relation-departed')
-@restart_on_change(restart_map())
+@restart_on_change(restart_map(), stopstart=True)
 def cluster_changed():
     CONFIGS.write_all()
 

=== modified file 'revision'
--- revision	2013-12-02 18:01:11 +0000
+++ revision	2014-02-17 12:10:56 +0000
@@ -1,1 +1,1 @@
-312
+313

=== modified file 'templates/folsom/nova.conf'
--- templates/folsom/nova.conf	2014-02-03 13:32:52 +0000
+++ templates/folsom/nova.conf	2014-02-17 12:10:56 +0000
@@ -73,6 +73,7 @@
 
 {% if network_manager and network_manager == 'quantum' -%}
 network_api_class = nova.network.quantumv2.api.API
+quantum_url = {{ neutron_url }}
 {% if auth_host -%}
 quantum_auth_strategy = keystone
 quantum_admin_tenant_name = {{ admin_tenant_name }}
@@ -82,6 +83,7 @@
 {% endif -%}
 {% elif network_manager and network_manager == 'neutron' -%}
 network_api_class = nova.network.neutronv2.api.API
+neutron_url = {{ neutron_url }}
 {% if auth_host -%}
 neutron_auth_strategy = keystone
 neutron_admin_tenant_name = {{ admin_tenant_name }}