Skip to content

Commit b981366

Browse files
committed
Merge branch 'main' into feat/templatetf
2 parents 9543c14 + 44608ac commit b981366

File tree

101 files changed

+2430
-121
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

101 files changed

+2430
-121
lines changed

.github/workflows/fatimage.yml

+3-1
Original file line numberDiff line numberDiff line change
@@ -47,7 +47,9 @@ jobs:
4747
. environments/.stackhpc/activate
4848
cd packer/
4949
packer init .
50-
PACKER_LOG=1 packer build -only openstack.openhpc -on-error=ask -var-file=$PKR_VAR_environment_root/${{ vars.CI_CLOUD }}.pkrvars.hcl openstack.pkr.hcl
50+
PACKER_LOG=1 packer build -only openstack.openhpc -on-error=${{ vars.PACKER_ON_ERROR }} -var-file=$PKR_VAR_environment_root/${{ vars.CI_CLOUD }}.pkrvars.hcl openstack.pkr.hcl
51+
env:
52+
TESTUSER_PASSWORD: ${{ secrets.TEST_USER_PASSWORD }}
5153

5254
- name: Get created image name from manifest
5355
id: manifest

ansible.cfg

+19
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
# Only used for Azimuth running the caas environment
2+
[defaults]
3+
any_errors_fatal = True
4+
gathering = smart
5+
forks = 30
6+
host_key_checking = False
7+
remote_tmp = /tmp
8+
collections_path = ansible/collections
9+
roles_path = ansible/roles
10+
filter_plugins = ansible/filter_plugins
11+
callbacks_enabled = ansible.posix.profile_tasks
12+
13+
[ssh_connection]
14+
ssh_args = -o ControlMaster=auto -o ControlPersist=240s -o PreferredAuthentications=publickey -o UserKnownHostsFile=/dev/null
15+
pipelining = True
16+
# This is important because we are using one of the hosts in the play as a jump host
17+
# This ensures that if the proxy connection is interrupted, rendering the other hosts
18+
# unreachable, the connection is retried instead of failing the entire play
19+
retries = 10

ansible/.gitignore

+15-4
Original file line numberDiff line numberDiff line change
@@ -28,8 +28,6 @@ roles/*
2828
!roles/firewalld/**
2929
!roles/etc_hosts/
3030
!roles/etc_hosts/**
31-
!roles/cloud_init/
32-
!roles/cloud_init/**
3331
!roles/mysql/
3432
!roles/mysql/**
3533
!roles/systemd/
@@ -42,5 +40,18 @@ roles/*
4240
!roles/proxy/**
4341
!roles/resolv_conf/
4442
!roles/resolv_conf/**
45-
!roles/terraform/
46-
!roles/terraform/**
43+
!roles/cve-2023-41914
44+
!roles/cve-2023-41914/**
45+
!roles/cluster_infra/
46+
!roles/cluster_infra/**
47+
!roles/image_build_infra/
48+
!roles/image_build_infra/**
49+
!roles/persist_openhpc_secrets/
50+
!roles/persist_openhpc_secrets/**
51+
!roles/zenith_proxy/
52+
!roles/zenith_proxy/**
53+
!roles/image_build/
54+
!roles/image_build/**
55+
!roles/persist_hostkeys/
56+
!roles/persist_hostkeys/**
57+
!roles/requirements.yml

ansible/adhoc/backup-keytabs.yml

+11
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
# Use ONE of the following tags on this playbook:
2+
# - retrieve: copies keytabs out of the state volume to the environment
3+
# - deploy: copies keytabs from the environment to the state volume
4+
5+
- hosts: freeipa_client
6+
become: yes
7+
gather_facts: no
8+
tasks:
9+
- import_role:
10+
name: freeipa
11+
tasks_from: backup-keytabs.yml

ansible/adhoc/cve-2023-41914.yml

+6
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
- hosts: openhpc
2+
gather_facts: no
3+
become: yes
4+
tasks:
5+
- import_role:
6+
name: cve-2023-41914

ansible/adhoc/template-cloud-init.yml

-9
This file was deleted.

ansible/bootstrap.yml

+16-10
Original file line numberDiff line numberDiff line change
@@ -82,6 +82,21 @@
8282
policy: "{{ selinux_policy }}"
8383
register: sestatus
8484

85+
- hosts: freeipa_server
86+
# Done here as it might be providing DNS
87+
tags:
88+
- freeipa
89+
- freeipa_server
90+
gather_facts: yes
91+
become: yes
92+
tasks:
93+
- name: Install FreeIPA server
94+
import_role:
95+
name: freeipa
96+
tasks_from: server.yml
97+
98+
# --- tasks after here require access to package repos ---
99+
85100
- hosts: firewalld
86101
gather_facts: false
87102
become: yes
@@ -99,6 +114,7 @@
99114
name: fail2ban
100115

101116
- name: Setup podman
117+
gather_facts: false
102118
hosts: podman
103119
tags: podman
104120
tasks:
@@ -112,16 +128,6 @@
112128
tasks_from: config.yml
113129
tags: config
114130

115-
- name: Setup EESSI
116-
hosts: eessi
117-
tags: eessi
118-
become: true
119-
gather_facts: false
120-
tasks:
121-
- name: Install and configure EESSI
122-
import_role:
123-
name: eessi
124-
125131
- hosts: update
126132
gather_facts: false
127133
become: yes

ansible/ci/retrieve_inventory.yml

+2-1
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,8 @@
77
gather_facts: no
88
vars:
99
cluster_prefix: "{{ undef(hint='cluster_prefix must be defined') }}" # e.g. ci4005969475
10-
cluster_network: WCDC-iLab-60
10+
ci_vars_file: "{{ appliances_environment_root + '/terraform/' + lookup('env', 'CI_CLOUD') }}.tfvars"
11+
cluster_network: "{{ lookup('ansible.builtin.ini', 'cluster_net', file=ci_vars_file, type='properties') | trim('\"') }}"
1112
tasks:
1213
- name: Get control host IP
1314
set_fact:

ansible/extras.yml

+22-1
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,25 @@
1-
- hosts: cuda
1+
- hosts: basic_users:!builder
2+
become: yes
3+
tags:
4+
- basic_users
5+
- users
6+
gather_facts: yes
7+
tasks:
8+
- import_role:
9+
name: basic_users
10+
11+
- name: Setup EESSI
12+
hosts: eessi
13+
tags: eessi
14+
become: true
15+
gather_facts: false
16+
tasks:
17+
- name: Install and configure EESSI
18+
import_role:
19+
name: eessi
20+
21+
- name: Setup CUDA
22+
hosts: cuda
223
become: yes
324
gather_facts: no
425
tags: cuda

ansible/fatimage.yml

+14-2
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,12 @@
11
# Builder version of site.yml just installing binaries
22

3+
- hosts: builder
4+
become: no
5+
gather_facts: no
6+
tasks:
7+
- name: Report hostname (= final image name)
8+
command: hostname
9+
310
- name: Run pre.yml hook
411
vars:
512
appliances_environment_root: "{{ lookup('env', 'APPLIANCES_ENVIRONMENT_ROOT') }}"
@@ -27,6 +34,13 @@
2734
state: stopped
2835
enabled: false
2936

37+
# - import_playbook: iam.yml
38+
- name: Install FreeIPA client
39+
import_role:
40+
name: freeipa
41+
tasks_from: client-install.yml
42+
when: "'freeipa_client' in group_names"
43+
3044
# - import_playbook: filesystems.yml
3145
- name: nfs
3246
dnf:
@@ -142,8 +156,6 @@
142156
name: cloudalchemy.grafana
143157
tasks_from: install.yml
144158

145-
# - import_playbook: iam.yml - nothing to do
146-
147159
- name: Run post.yml hook
148160
vars:
149161
appliances_environment_root: "{{ lookup('env', 'APPLIANCES_ENVIRONMENT_ROOT') }}"

ansible/iam.yml

+38-4
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,42 @@
1-
- hosts: basic_users
1+
- hosts: freeipa_client
2+
tags:
3+
- freeipa
4+
- freeipa_server # as this is only relevant if using freeipa_server
5+
- freeipa_host
6+
gather_facts: no
27
become: yes
8+
tasks:
9+
- name: Ensure FreeIPA client hosts are added to the FreeIPA server
10+
import_role:
11+
name: freeipa
12+
tasks_from: addhost.yml
13+
when: groups['freeipa_server'] | length > 0
14+
15+
- hosts: freeipa_client
316
tags:
4-
- basic_users
17+
- freeipa
18+
- freeipa_client
519
gather_facts: yes
20+
become: yes
21+
tasks:
22+
- name: Install FreeIPA client
23+
import_role:
24+
name: freeipa
25+
tasks_from: client-install.yml
26+
- name: Enrol FreeIPA client
27+
import_role:
28+
name: freeipa
29+
tasks_from: enrol.yml
30+
31+
- hosts: freeipa_server
32+
tags:
33+
- freeipa
34+
- freeipa_server
35+
- users
36+
gather_facts: yes
37+
become: yes
638
tasks:
7-
- import_role:
8-
name: basic_users
39+
- name: Add FreeIPA users
40+
import_role:
41+
name: freeipa
42+
tasks_from: users.yml

ansible/noop.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -6,4 +6,4 @@
66

77
- hosts: localhost
88
gather_facts: false
9-
tasks: []
9+
tasks: []
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
cluster_deploy_ssh_keys_extra: []
2+
3+
# List of hw_scsi_models that result in block devices presenting as /dev/sdX
4+
# rather than /dev/vdX
5+
scsi_models:
6+
# Ceph [https://docs.ceph.com/en/quincy/rbd/rbd-openstack/#image-properties]
7+
- virtio-scsi
+104
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,104 @@
1+
- debug:
2+
msg: |
3+
terraform_backend_type: {{ terraform_backend_type }}
4+
terraform_state: {{ terraform_state }}
5+
cluster_upgrade_system_packages: {{ cluster_upgrade_system_packages | default('undefined') }}
6+
7+
# We need to convert the floating IP id to an address for Terraform
8+
# if we we have cluster_floating_ip, otherwise assume that we're
9+
# assigning the FIP in Terraform and that it will be available in
10+
# outputs.cluster_gateway_ip.
11+
- block:
12+
- name: Look up floating IP
13+
include_role:
14+
name: stackhpc.terraform.infra
15+
tasks_from: lookup_floating_ip
16+
vars:
17+
os_floating_ip_id: "{{ cluster_floating_ip }}"
18+
19+
- name: Set floating IP address fact
20+
set_fact:
21+
cluster_floating_ip_address: "{{ os_floating_ip_info.floating_ip_address }}"
22+
when: cluster_floating_ip is defined
23+
24+
- name: Install Terraform binary
25+
include_role:
26+
name: stackhpc.terraform.install
27+
28+
- name: Make Terraform project directory
29+
file:
30+
path: "{{ terraform_project_path }}"
31+
state: directory
32+
33+
- name: Write backend configuration
34+
copy:
35+
content: |
36+
terraform {
37+
backend "{{ terraform_backend_type }}" { }
38+
}
39+
dest: "{{ terraform_project_path }}/backend.tf"
40+
41+
# Patching in this appliance is implemented as a switch to a new base image
42+
# So unless explicitly patching, we want to use the same image as last time
43+
# To do this, we query the previous Terraform state before updating
44+
- block:
45+
- name: Get previous Terraform state
46+
stackhpc.terraform.terraform_output:
47+
binary_path: "{{ terraform_binary_path }}"
48+
project_path: "{{ terraform_project_path }}"
49+
backend_config: "{{ terraform_backend_config }}"
50+
register: cluster_infra_terraform_output
51+
52+
- name: Extract image from Terraform state
53+
set_fact:
54+
cluster_previous_image: "{{ cluster_infra_terraform_output.outputs.cluster_image.value }}"
55+
when: '"cluster_image" in cluster_infra_terraform_output.outputs'
56+
when:
57+
- terraform_state == "present"
58+
- cluster_upgrade_system_packages is not defined or not cluster_upgrade_system_packages
59+
60+
- name: Detect volume device prefix from image metadata
61+
block:
62+
- name: Get image metadata from OpenStack API
63+
openstack.cloud.image_info:
64+
image: "{{ cluster_previous_image | default(cluster_image) }}"
65+
register: cluster_image_info
66+
- name: Check only single image found
67+
assert:
68+
that: cluster_image_info.images | length == 1
69+
fail_msg: "Multiple images found for 'cluster_image' {{ cluster_image }}"
70+
- name: Set volume_device_prefix fact
71+
set_fact:
72+
block_device_prefix: >-
73+
{{
74+
'sd' if (cluster_image_info.images | first).hw_scsi_model is defined and
75+
(cluster_image_info.images | first).hw_scsi_model in scsi_models
76+
else 'vd'
77+
}}
78+
# Only run when block_device_prefix isn't set as an extravar
79+
when:
80+
- block_device_prefix is not defined
81+
- cluster_image is defined
82+
83+
- name: Template Terraform files into project directory
84+
template:
85+
src: >-
86+
{{
87+
"{}{}.j2".format(
88+
(
89+
cluster_terraform_template_dir ~ "/"
90+
if cluster_terraform_template_dir is defined
91+
else ""
92+
),
93+
item
94+
)
95+
}}
96+
dest: "{{ terraform_project_path }}/{{ item }}"
97+
loop:
98+
- outputs.tf
99+
- providers.tf
100+
- resources.tf
101+
102+
- name: Provision infrastructure
103+
include_role:
104+
name: stackhpc.terraform.infra

0 commit comments

Comments
 (0)