openstack/ironic
Code Issues Proposed changes
Files
72c208f7653a1edfe44dec8518a87f3af505bc35
ironic/devstack/lib/ironic
Julia Kreger 72c208f765 ci: Expand the multinode job -- remove tinyipa usage 
This change moves multinode jobs to be leveraged across multiple
"compute" nodes with an increased amount of memory, which increases
the overall test resources available and limits controller node
hot spotting for deployment operations.

This effectively chagnes multinode jobs from being a single
compute node with a single controller node, to two compute
nodes and a single controller node. The controller node's
hosted virtual machines is also dialed back.

This was done to eliminate usage of tinyipa in favor of a more
realistic Centos based IPA ramdisk, and also removes fallback
logic to use tinyipa on more limited resource nodes.

Change-Id: Ib52f7039072901ce72ac96e660d35a10cca59737
Signed-off-by: Julia Kreger <juliaashleykreger@gmail.com>
2025-06-02 12:16:53 -07:00

4424 lines
184 KiB
Bash
Raw Blame History

#!/bin/bash
#
# lib/ironic
# Functions to control the configuration and operation of the **Ironic** service
# Dependencies:
#
# - ``functions`` file
# - ``DEST``, ``DATA_DIR``, ``STACK_USER`` must be defined
# - ``SERVICE_{TENANT_NAME|PASSWORD}`` must be defined
# - ``SERVICE_HOST``
# - ``KEYSTONE_TOKEN_FORMAT`` must be defined
# ``stack.sh`` calls the entry points in this order:
#
# - install_ironic
# - install_ironicclient
# - init_ironic
# - start_ironic
# - stop_ironic
# - cleanup_ironic
# ensure we don't re-source this in the same environment
[[ -z "$_IRONIC_DEVSTACK_LIB" ]] || return 0
declare -r -g _IRONIC_DEVSTACK_LIB=1
# Save xtrace and pipefail settings
_XTRACE_IRONIC=$(set +o | grep xtrace)
_PIPEFAIL_IRONIC=$(set +o | grep pipefail)
set -o xtrace
set +o pipefail
# Defaults
# --------
# Set up default directories
GITDIR["python-ironicclient"]=$DEST/python-ironicclient
GITREPO["pyghmi"]=${PYGHMI_REPO:-${GIT_BASE}/x/pyghmi}
GITBRANCH["pyghmi"]=${PYGHMI_BRANCH:-master}
GITDIR["pyghmi"]=$DEST/pyghmi
GITREPO["virtualbmc"]=${VIRTUALBMC_REPO:-${GIT_BASE}/openstack/virtualbmc.git}
GITBRANCH["virtualbmc"]=${VIRTUALBMC_BRANCH:-master}
GITDIR["virtualbmc"]=$DEST/virtualbmc
GITREPO["virtualpdu"]=${VIRTUALPDU_REPO:-${GIT_BASE}/openstack/virtualpdu.git}
GITBRANCH["virtualpdu"]=${VIRTUALPDU_BRANCH:-master}
GITDIR["virtualpdu"]=$DEST/virtualpdu
GITREPO["sushy"]=${SUSHY_REPO:-${GIT_BASE}/openstack/sushy.git}
GITBRANCH["sushy"]=${SUSHY_BRANCH:-master}
GITDIR["sushy"]=$DEST/sushy
GITREPO["sushy-tools"]=${SUSHY_TOOLS_REPO:-${GIT_BASE}/openstack/sushy-tools.git}
GITBRANCH["sushy-tools"]=${SUSHY_TOOLS_BRANCH:-master}
GITDIR["sushy-tools"]=$DEST/sushy-tools
IRONIC_DIR=$DEST/ironic
IRONIC_DEVSTACK_DIR=$IRONIC_DIR/devstack
IRONIC_DEVSTACK_FILES_DIR=$IRONIC_DEVSTACK_DIR/files
# TODO(dtantsur): delete these three when we migrate image building to
# ironic-python-agent-builder completely
IRONIC_PYTHON_AGENT_REPO=${IRONIC_PYTHON_AGENT_REPO:-${GIT_BASE}/openstack/ironic-python-agent.git}
IRONIC_PYTHON_AGENT_BRANCH=${IRONIC_PYTHON_AGENT_BRANCH:-$TARGET_BRANCH}
IRONIC_PYTHON_AGENT_DIR=$DEST/ironic-python-agent
IRONIC_PYTHON_AGENT_BUILDER_REPO=${IRONIC_PYTHON_AGENT_BUILDER_REPO:-${GIT_BASE}/openstack/ironic-python-agent-builder.git}
IRONIC_PYTHON_AGENT_BUILDER_BRANCH=${IRONIC_PYTHON_AGENT_BUILDER_BRANCH:-$BRANCHLESS_TARGET_BRANCH}
IRONIC_PYTHON_AGENT_BUILDER_DIR=$DEST/ironic-python-agent-builder
IRONIC_DIB_BINDEP_FILE=https://opendev.org/openstack/diskimage-builder/raw/branch/master/bindep.txt
IRONIC_DATA_DIR=$DATA_DIR/ironic
IRONIC_STATE_PATH=/var/lib/ironic
IRONIC_AUTH_CACHE_DIR=${IRONIC_AUTH_CACHE_DIR:-/var/cache/ironic}
IRONIC_CONF_DIR=${IRONIC_CONF_DIR:-/etc/ironic}
IRONIC_CONF_FILE=$IRONIC_CONF_DIR/ironic.conf
IRONIC_MACHINE_TYPE=${IRONIC_MACHINE_TYPE:-q35}
# Whether DevStack will be setup for bare metal or VMs
IRONIC_IS_HARDWARE=$(trueorfalse False IRONIC_IS_HARDWARE)
# Deploy callback timeout can be changed from its default (1800), if required.
IRONIC_CALLBACK_TIMEOUT=${IRONIC_CALLBACK_TIMEOUT:-}
# Timeout before retrying PXE boot. Set low to help the CI.
if [[ "$IRONIC_IS_HARDWARE" == False ]]; then
IRONIC_PXE_BOOT_RETRY_TIMEOUT=${IRONIC_PXE_BOOT_RETRY_TIMEOUT:-900}
else
IRONIC_PXE_BOOT_RETRY_TIMEOUT=${IRONIC_PXE_BOOT_RETRY_TIMEOUT:-}
fi
# Ping timeout after the node becomes active
IRONIC_PING_TIMEOUT=${IRONIC_PING_TIMEOUT:-}
# Deploy to hardware platform
IRONIC_HW_NODE_CPU=${IRONIC_HW_NODE_CPU:-1}
IRONIC_HW_NODE_RAM=${IRONIC_HW_NODE_RAM:-512}
IRONIC_HW_NODE_DISK=${IRONIC_HW_NODE_DISK:-10}
IRONIC_HW_EPHEMERAL_DISK=${IRONIC_HW_EPHEMERAL_DISK:-0}
# Ironic hardware architecture type, supported types are:
IRONIC_SUPPORTED_HW_ARCH_TYPES_RE="^(x86_64|aarch64)$"
IRONIC_HW_ARCH=${IRONIC_HW_ARCH:-x86_64}
if [[ ! "$IRONIC_HW_ARCH" =~ $IRONIC_SUPPORTED_HW_ARCH_TYPES_RE ]]; then
die $LINENO "Unsupported IRONIC_HW_ARCH: $IRONIC_HW_ARCH. Expected either of 'x86_64' or 'aarch64'."
fi
if is_ubuntu; then
IRONIC_VM_EMULATOR="/usr/bin/qemu-system-${IRONIC_HW_ARCH}"
else
# Fedora/Centos
IRONIC_VM_EMULATOR="/usr/libexec/qemu-kvm"
fi
GRUB_ARCH=x64
if [[ $IRONIC_HW_ARCH == "aarch64" ]]; then
GRUB_ARCH=aa64
# NOTE(cid): Original change was tested on virt-6.2
# 'virt' is an alias for whatever is the latest version
IRONIC_MACHINE_TYPE=virt
fi
# Deploy Ironic Nodes & configure n-cpu for sharding
# Currently only supports 0 (old behavior) or 1 (adds all nodes
# to the same shard). You can still use this with multinode to
# get multiple shards in one Ironic install.
# IRONIC_SHARD_1_NAME + IRONIC_SHARDS will also configure n-cpu
IRONIC_SHARDS=${IRONIC_SHARDS:-0}
IRONIC_SHARD_1_NAME=${IRONIC_SHARD_1_NAME:-ds_shard_1}
IRONIC_NODE_SHARD_NAME=${IRONIC_NODE_SHARD_NAME:-ds_shard_1}
# The file is composed of multiple lines, each line includes fields
# separated by white space, in the format:
#
# <BMC address> <MAC address> <BMC username> <BMC password> [<driver specific fields>]
#
# For example:
#
# 192.168.110.107 00:1e:67:57:50:4c root otc123
#
# Supported IRONIC_DEPLOY_DRIVERs:
# ipmi:
# <BMC address> <MAC address> <BMC username> <BMC password>
#
# idrac:
# <BMC address> <MAC address> <BMC username> <BMC password>
#
# irmc:
# <BMC address> <MAC address> <BMC username> <BMC password>
#
IRONIC_HWINFO_FILE=${IRONIC_HWINFO_FILE:-$IRONIC_DATA_DIR/hardware_info}
# Set up defaults for functional / integration testing
IRONIC_NODE_UUID=${IRONIC_NODE_UUID:-`uuidgen`}
IRONIC_SCRIPTS_DIR=${IRONIC_SCRIPTS_DIR:-$IRONIC_DEVSTACK_DIR/tools/ironic/scripts}
IRONIC_TEMPLATES_DIR=${IRONIC_TEMPLATES_DIR:-$IRONIC_DEVSTACK_DIR/tools/ironic/templates}
IRONIC_BAREMETAL_BASIC_OPS=$(trueorfalse False IRONIC_BAREMETAL_BASIC_OPS)
IRONIC_TFTPBOOT_DIR=${IRONIC_TFTPBOOT_DIR:-$IRONIC_DATA_DIR/tftpboot}
IRONIC_TFTPSERVER_IP=${IRONIC_TFTPSERVER_IP:-$HOST_IP}
IRONIC_TFTP_BLOCKSIZE=${IRONIC_TFTP_BLOCKSIZE:-$((PUBLIC_BRIDGE_MTU-50))}
IRONIC_VM_COUNT=${IRONIC_VM_COUNT:-1}
IRONIC_VM_SPECS_CPU=${IRONIC_VM_SPECS_CPU:-1}
IRONIC_VM_SPECS_RAM=${IRONIC_VM_SPECS_RAM:-3072}
IRONIC_VM_SPECS_DISK=${IRONIC_VM_SPECS_DISK:-10}
IRONIC_VM_SPECS_DISK_FORMAT=${IRONIC_VM_SPECS_DISK_FORMAT:-qcow2}
IRONIC_VM_EPHEMERAL_DISK=${IRONIC_VM_EPHEMERAL_DISK:-0}
IRONIC_VM_ENGINE=${IRONIC_VM_ENGINE:-qemu}
IRONIC_VM_NETWORK_BRIDGE=${IRONIC_VM_NETWORK_BRIDGE:-brbm}
IRONIC_VM_INTERFACE_COUNT=${IRONIC_VM_INTERFACE_COUNT:-2}
IRONIC_VM_VOLUME_COUNT=${IRONIC_VM_VOLUME_COUNT:-1}
IRONIC_VM_BLOCK_SIZE=${IRONIC_VM_BLOCK_SIZE:-512}
IRONIC_VM_MACS_CSV_FILE=${IRONIC_VM_MACS_CSV_FILE:-$IRONIC_DATA_DIR/ironic_macs.csv}
IRONIC_CLEAN_NET_NAME=${IRONIC_CLEAN_NET_NAME:-${IRONIC_PROVISION_NETWORK_NAME:-${PRIVATE_NETWORK_NAME}}}
IRONIC_RESCUE_NET_NAME=${IRONIC_RESCUE_NET_NAME:-${IRONIC_CLEAN_NET_NAME}}
IRONIC_INSPECTION_NET_NAME=${IRONIC_INSPECTION_NET_NAME:-${IRONIC_CLEAN_NET_NAME}}
IRONIC_EXTRA_PXE_PARAMS=${IRONIC_EXTRA_PXE_PARAMS:-}
IRONIC_TTY_DEV=${IRONIC_TTY_DEV:-ttyS0,115200}
IRONIC_USE_PORT_GROUP=$(trueorfalse False IRONIC_USE_PORT_GROUP)
IRONIC_PORT_GROUP_MODE=${IRONIC_PORT_GROUP_MODE:-"balance-rr"}
IRONIC_TEMPEST_BUILD_TIMEOUT=${IRONIC_TEMPEST_BUILD_TIMEOUT:-${BUILD_TIMEOUT:-}}
if [[ -n "$BUILD_TIMEOUT" ]]; then
echo "WARNING: BUILD_TIMEOUT variable is renamed to IRONIC_TEMPEST_BUILD_TIMEOUT and will be deprecated in Pike."
fi
if [[ "$IRONIC_USE_PORT_GROUP" == "True" && ${IRONIC_VM_INTERFACE_COUNT} -ne 2 ]]; then
die $LINENO "To use portgroups IRONIC_USE_PORT_GROUP=True 2 interfaces for VM is required IRONIC_VM_INTERFACE_COUNT"
fi
hostdomain=$(hostname)
if [[ "$hostdomain" =~ "rax" ]] || [[ "$hostdomain" =~ "iweb" ]]; then
echo "WARNING: Auto-increasing the requested build timeout by 1.5 as the detected hostname suggests a cloud host where VMs are software emulated."
# NOTE(TheJulia): Rax hosts are entirely qemu emulated, not CPU enabled
# virtualization. As such, the ramdisk decompression is known to take an
# eceptional amount of time and we need to afford a little more time to
# these hosts for jobs to complete without issues.
# NOTE(TheJulia): This is also the case for iweb hosts. And arm64 in general.
new_timeout=$(echo "$IRONIC_TEMPEST_BUILD_TIMEOUT * 1.5 / 1" | bc)
IRONIC_TEMPEST_BUILD_TIMEOUT=$new_timeout
if [ -n "$IRONIC_PXE_BOOT_RETRY_TIMEOUT" ]; then
new_timeout=$(echo "$IRONIC_PXE_BOOT_RETRY_TIMEOUT * 1.5 / 1" | bc)
IRONIC_PXE_BOOT_RETRY_TIMEOUT=$new_timeout
fi
# TODO(TheJulia): If we have to do magically extend timeouts again,
# we should make a helper method...
fi
# Oslo Policy enforcement for Scope and new policy enforcement.
IRONIC_ENFORCE_SCOPE=$(trueorfalse True IRONIC_ENFORCE_SCOPE)
if [[ "$IRONIC_ENFORCE_SCOPE" == "True" ]]; then
IRONIC_OS_CLOUD=devstack-system-admin
else
IRONIC_OS_CLOUD=devstack-admin
fi
# NOTE(TheJulia): Project scoped admin as of Yoga cycle
# the core devstack code doesn't assert any environment variables
# upfront except for OS_CLOUD, which is defaulted to devstack-admin
# in the last keystone step which executes after ironic's base setup
# occurs. We navigate this just fine for yoga with fixes, however
# we need this variable for Xena and possibly Wallaby grenade.
OS_CLOUD=${OS_CLOUD:-devstack-admin}
# If the node owner needs to be set on nodes, for example, jobs
# such as metalsmith have hardcoded OS_CLOUD variables which mean
# an ironic in a full system scope enforced mode can't find nodes
# for an allocation as suddenly the owner is applied.
IRONIC_SET_NODE_OWNER=${IRONIC_SET_NODE_OWNER:-}
# Versions and command line for API client
IRONIC_DEFAULT_API_VERSION=${IRONIC_DEFAULT_API_VERSION:-}
IRONIC_CMD="openstack --os-cloud $IRONIC_OS_CLOUD baremetal"
if [[ -n "$IRONIC_DEFAULT_API_VERSION" ]]; then
IRONIC_CMD="$IRONIC_CMD --os-baremetal-api-version $IRONIC_DEFAULT_API_VERSION"
fi
# Settings!
IRONIC_ENABLED_HARDWARE_TYPES=${IRONIC_ENABLED_HARDWARE_TYPES:-"ipmi,fake-hardware"}
# list of all available driver interfaces types
IRONIC_DRIVER_INTERFACE_TYPES="bios boot power management deploy console inspect raid rescue storage network vendor"
IRONIC_ENABLED_BIOS_INTERFACES=${IRONIC_ENABLED_BIOS_INTERFACES:-"fake,no-bios"}
IRONIC_ENABLED_BOOT_INTERFACES=${IRONIC_ENABLED_BOOT_INTERFACES:-"fake,ipxe"}
IRONIC_ENABLED_CONSOLE_INTERFACES=${IRONIC_ENABLED_CONSOLE_INTERFACES:-"fake,no-console"}
IRONIC_ENABLED_DEPLOY_INTERFACES=${IRONIC_ENABLED_DEPLOY_INTERFACES:-"fake,direct,ramdisk"}
IRONIC_ENABLED_INSPECT_INTERFACES=${IRONIC_ENABLED_INSPECT_INTERFACES:-"fake,agent,no-inspect"}
IRONIC_ENABLED_MANAGEMENT_INTERFACES=${IRONIC_ENABLED_MANAGEMENT_INTERFACES:-""}
IRONIC_ENABLED_NETWORK_INTERFACES=${IRONIC_ENABLED_NETWORK_INTERFACES:-"flat,noop"}
IRONIC_ENABLED_POWER_INTERFACES=${IRONIC_ENABLED_POWER_INTERFACES:-""}
IRONIC_ENABLED_RAID_INTERFACES=${IRONIC_ENABLED_RAID_INTERFACES:-"fake,agent,no-raid"}
IRONIC_ENABLED_RESCUE_INTERFACES=${IRONIC_ENABLED_RESCUE_INTERFACES:-"fake,no-rescue"}
IRONIC_ENABLED_STORAGE_INTERFACES=${IRONIC_ENABLED_STORAGE_INTERFACES:-"fake,cinder,noop"}
IRONIC_ENABLED_VENDOR_INTERFACES=${IRONIC_ENABLED_VENDOR_INTERFACES:-"fake,ipmitool,no-vendor"}
# for usage with hardware types
IRONIC_DEFAULT_BIOS_INTERFACE=${IRONIC_DEFAULT_BIOS_INTERFACE:-}
IRONIC_DEFAULT_BOOT_INTERFACE=${IRONIC_DEFAULT_BOOT_INTERFACE:-}
IRONIC_DEFAULT_CONSOLE_INTERFACE=${IRONIC_DEFAULT_CONSOLE_INTERFACE:-}
IRONIC_DEFAULT_DEPLOY_INTERFACE=${IRONIC_DEFAULT_DEPLOY_INTERFACE:-}
IRONIC_DEFAULT_INSPECT_INTERFACE=${IRONIC_DEFAULT_INSPECT_INTERFACE:-}
IRONIC_DEFAULT_MANAGEMENT_INTERFACE=${IRONIC_DEFAULT_MANAGEMENT_INTERFACE:-}
IRONIC_DEFAULT_NETWORK_INTERFACE=${IRONIC_DEFAULT_NETWORK_INTERFACE:-}
IRONIC_DEFAULT_POWER_INTERFACE=${IRONIC_DEFAULT_POWER_INTERFACE:-}
IRONIC_DEFAULT_RAID_INTERFACE=${IRONIC_DEFAULT_RAID_INTERFACE:-}
IRONIC_DEFAULT_RESCUE_INTERFACE=${IRONIC_DEFAULT_RESCUE_INTERFACE:-}
IRONIC_DEFAULT_STORAGE_INTERFACE=${IRONIC_DEFAULT_STORAGE_INTERFACE:-}
IRONIC_DEFAULT_VENDOR_INTERFACE=${IRONIC_DEFAULT_VENDOR_INTERFACE:-}
IRONIC_UNMANAGED_INSPECTION=$(trueorfalse False IRONIC_UNMANAGED_INSPECTION)
# If IRONIC_VM_ENGINE is explicitly set to "auto" or "kvm",
# devstack will attempt to use hardware virtualization
# (aka nested kvm). We do not enable it in the infra gates
# because it is not consistently supported/working across
# all gate infrastructure providers.
if [[ "$IRONIC_VM_ENGINE" == "auto" ]]; then
sudo modprobe kvm || true
if [ ! -e /dev/kvm ]; then
echo "WARNING: Switching to QEMU"
IRONIC_VM_ENGINE=qemu
else
IRONIC_VM_ENGINE=kvm
fi
fi
if [[ "$IRONIC_VM_ENGINE" == "kvm" ]]; then
# Set this to empty, so configure-vm.py can autodetect location
# of KVM binary
IRONIC_VM_EMULATOR=""
fi
# By default, baremetal VMs will console output to file.
IRONIC_VM_LOG_CONSOLE=$(trueorfalse True IRONIC_VM_LOG_CONSOLE)
IRONIC_VM_LOG_DIR=${IRONIC_VM_LOG_DIR:-$IRONIC_DATA_DIR/logs/}
IRONIC_VM_LOG_ROTATE=$(trueorfalse True IRONIC_VM_LOG_ROTATE)
# Set resource_classes for nodes to use Nova's placement engine
IRONIC_DEFAULT_RESOURCE_CLASS=${IRONIC_DEFAULT_RESOURCE_CLASS:-baremetal}
# Set traits for nodes. Traits should be separated by whitespace.
IRONIC_DEFAULT_TRAITS=${IRONIC_DEFAULT_TRAITS:-CUSTOM_GOLD}
# Whether to build the ramdisk or download a prebuilt one.
IRONIC_BUILD_DEPLOY_RAMDISK=$(trueorfalse True IRONIC_BUILD_DEPLOY_RAMDISK)
# Ironic IPA ramdisk type, supported types are:
IRONIC_SUPPORTED_RAMDISK_TYPES_RE="^(tinyipa|dib)$"
IRONIC_RAMDISK_TYPE=${IRONIC_RAMDISK_TYPE:-dib}
# Confirm we have a supported ramdisk type or fail early.
if [[ ! "$IRONIC_RAMDISK_TYPE" =~ $IRONIC_SUPPORTED_RAMDISK_TYPES_RE ]]; then
die $LINENO "Unrecognized IRONIC_RAMDISK_TYPE: $IRONIC_RAMDISK_TYPE. Expected 'tinyipa' or 'dib'"
fi
# Which deploy driver to use - valid choices right now
# are ``ipmi``, ``snmp`` and ``redfish``.
#
# Additional valid choices if IRONIC_IS_HARDWARE == true are:
# ``idrac`` and ``irmc``.
IRONIC_DEPLOY_DRIVER=${IRONIC_DEPLOY_DRIVER:-ipmi}
# If present, these files are used as deploy ramdisk/kernel.
# (The value must be an absolute path)
IRONIC_DEPLOY_RAMDISK=${IRONIC_DEPLOY_RAMDISK:-$TOP_DIR/files/ir-deploy-$IRONIC_DEPLOY_DRIVER.initramfs}
IRONIC_DEPLOY_KERNEL=${IRONIC_DEPLOY_KERNEL:-$TOP_DIR/files/ir-deploy-$IRONIC_DEPLOY_DRIVER.kernel}
IRONIC_DEPLOY_ISO=${IRONIC_DEPLOY_ISO:-$TOP_DIR/files/ir-deploy-$IRONIC_DEPLOY_DRIVER.iso}
# If present, this file is used to deploy/boot nodes over virtual media
# (The value must be an absolute path)
IRONIC_EFIBOOT=${IRONIC_EFIBOOT:-$TOP_DIR/files/ir-deploy-$IRONIC_DEPLOY_DRIVER.efiboot}
# NOTE(jroll) this needs to be updated when stable branches are cut
IPA_DOWNLOAD_BRANCH=${IPA_DOWNLOAD_BRANCH:-${TARGET_BRANCH:-master}}
IPA_DOWNLOAD_BRANCH=$(echo $IPA_DOWNLOAD_BRANCH | tr / -)
IPA_DOWNLOAD_SOURCE=ironic-python-agent
if [[ $IRONIC_HW_ARCH == "aarch64" ]]; then
IPA_DOWNLOAD_SOURCE=ironic-python-agent-builder
fi
# OS for using with DIB images
IRONIC_DIB_RAMDISK_OS=${IRONIC_DIB_RAMDISK_OS:-centos9}
IRONIC_DIB_RAMDISK_RELEASE=${IRONIC_DIB_RAMDISK_RELEASE:-}
# Configure URLs required to download ramdisk if we're not building it, and
# IRONIC_DEPLOY_RAMDISK/KERNEL or the RAMDISK/KERNEL_URLs have not been
# preconfigured.
if [[ "$IRONIC_BUILD_DEPLOY_RAMDISK" == "False" && \
! (-e "$IRONIC_DEPLOY_RAMDISK" && -e "$IRONIC_DEPLOY_KERNEL") && \
(-z "$IRONIC_AGENT_KERNEL_URL" || -z "$IRONIC_AGENT_RAMDISK_URL") ]]; then
case $IRONIC_RAMDISK_TYPE in
tinyipa)
IRONIC_AGENT_KERNEL_FILE=tinyipa-${IPA_DOWNLOAD_BRANCH}.vmlinuz
IRONIC_AGENT_RAMDISK_FILE=tinyipa-${IPA_DOWNLOAD_BRANCH}.gz
;;
dib)
IRONIC_AGENT_KERNEL_FILE=ipa-${IRONIC_DIB_RAMDISK_OS}-${IPA_DOWNLOAD_BRANCH}.kernel
IRONIC_AGENT_RAMDISK_FILE=ipa-${IRONIC_DIB_RAMDISK_OS}-${IPA_DOWNLOAD_BRANCH}.initramfs
;;
esac
IRONIC_AGENT_KERNEL_URL=https://tarballs.openstack.org/${IPA_DOWNLOAD_SOURCE}/${IRONIC_RAMDISK_TYPE}/files/${IRONIC_AGENT_KERNEL_FILE}
IRONIC_AGENT_RAMDISK_URL=https://tarballs.openstack.org/${IPA_DOWNLOAD_SOURCE}/${IRONIC_RAMDISK_TYPE}/files/${IRONIC_AGENT_RAMDISK_FILE}
fi
# This refers the options for disk-image-create and the platform on which
# to build the dib based ironic-python-agent ramdisk.
IRONIC_DIB_RAMDISK_OPTIONS=${IRONIC_DIB_RAMDISK_OPTIONS:-}
if [[ -z "$IRONIC_DIB_RAMDISK_OPTIONS" ]]; then
# Adapt for DIB naming change
if [[ "$IRONIC_DIB_RAMDISK_OS" == "centos8" ]]; then
IRONIC_DIB_RAMDISK_OS=centos
IRONIC_DIB_RAMDISK_RELEASE=8-stream
fi
if [[ "$IRONIC_DIB_RAMDISK_OS" == "centos9" ]]; then
IRONIC_DIB_RAMDISK_OS=centos
IRONIC_DIB_RAMDISK_RELEASE=9-stream
fi
IRONIC_DIB_RAMDISK_OPTIONS="$IRONIC_DIB_RAMDISK_OS"
fi
# DHCP timeout for the dhcp-all-interfaces element.
IRONIC_DIB_DHCP_TIMEOUT=${IRONIC_DIB_DHCP_TIMEOUT:-60}
# Options for building a DIB image
IRONIC_BUILD_DIB_IMAGE=${IRONIC_BUILD_DIB_IMAGE:-False}
IRONIC_DIB_IMAGE_OPTIONS=${IRONIC_DIB_IMAGE_OPTIONS:-}
IRONIC_DIB_IMAGE_OS=${IRONIC_DIB_IMAGE_OS:-centos}
IRONIC_DIB_IMAGE_RELEASE=${IRONIC_DIB_IMAGE_RELEASE:-9-stream}
if [[ -z "$IRONIC_DIB_IMAGE_OPTIONS" ]]; then
IRONIC_DIB_IMAGE_OPTIONS="$IRONIC_DIB_IMAGE_OS bootloader block-device-efi-lvm growvols dracut-regenerate"
fi
# Some drivers in Ironic require deploy ramdisk in bootable ISO format.
# Set this variable to "true" to build an ISO for deploy ramdisk and
# upload to Glance.
IRONIC_DEPLOY_ISO_REQUIRED=$(trueorfalse False IRONIC_DEPLOY_ISO_REQUIRED)
if [[ "$IRONIC_DEPLOY_ISO_REQUIRED" = "True" \
&& "$IRONIC_BUILD_DEPLOY_RAMDISK" = "False" \
&& ! -e "$IRONIC_DEPLOY_ISO" ]]; then
die "Prebuilt ISOs are not available, provide an ISO via IRONIC_DEPLOY_ISO \
or set IRONIC_BUILD_DEPLOY_RAMDISK=True to use ISOs"
fi
# If the requested driver is not yet enable, enable it, if it is not it will fail anyway
if [[ -z "$(echo ${IRONIC_ENABLED_HARDWARE_TYPES} | grep -w ${IRONIC_DEPLOY_DRIVER})" ]]; then
die "The deploy driver $IRONIC_DEPLOY_DRIVER is not in the list of enabled \
hardware types $IRONIC_ENABLED_HARDWARE_TYPES"
fi
# Support entry points installation of console scripts
IRONIC_BIN_DIR=$(get_python_exec_prefix)
IRONIC_UWSGI_CONF=$IRONIC_CONF_DIR/ironic-uwsgi.ini
IRONIC_UWSGI=${IRONIC_UWSGI:-ironic.wsgi:application}
# Lets support IPv6 testing!
IRONIC_IP_VERSION=${IRONIC_IP_VERSION:-${IP_VERSION:-4}}
IRONIC_IPV6_ADDRESS_MODE=${IRONIC_IPV6_ADDRESS_MODE:-dhcpv6-stateless}
# Ironic connection info. Note the port must be specified.
if is_service_enabled tls-proxy; then
IRONIC_SERVICE_PROTOCOL=https
fi
IRONIC_SERVICE_PROTOCOL=${IRONIC_SERVICE_PROTOCOL:-$SERVICE_PROTOCOL}
IRONIC_SERVICE_PORT=${IRONIC_SERVICE_PORT:-6385}
IRONIC_SERVICE_PORT_INT=${IRONIC_SERVICE_PORT_INT:-16385}
IRONIC_NOVNCPROXY_PORT=${IRONIC_NOVNCPROXY_PORT:-6090}
IRONIC_HOSTPORT=${IRONIC_HOSTPORT:-$SERVICE_HOST/baremetal}
# Enable iPXE
IRONIC_IPXE_ENABLED=$(trueorfalse True IRONIC_IPXE_ENABLED)
# Options below are only applied when IRONIC_IPXE_ENABLED is True
IRONIC_IPXE_USE_SWIFT=$(trueorfalse False IRONIC_IPXE_USE_SWIFT)
IRONIC_HTTP_DIR=${IRONIC_HTTP_DIR:-$IRONIC_DATA_DIR/httpboot}
IRONIC_HTTP_PORT=${IRONIC_HTTP_PORT:-3928}
# Allow using JSON RPC instead of oslo.messaging
IRONIC_RPC_TRANSPORT=${IRONIC_RPC_TRANSPORT:-oslo}
IRONIC_JSON_RPC_PORT=${IRONIC_JSON_RPC_PORT:-8089}
# The authentication strategy used by json-rpc. Valid values are:
# keystone, http_basic, noauth, or no value to inherit from ironic-api
# auth strategy.
IRONIC_JSON_RPC_AUTH_STRATEGY=${IRONIC_JSON_RPC_AUTH_STRATEGY:-}
# The first port in the range to bind the Virtual BMCs. The number of
# ports that will be used depends on $IRONIC_VM_COUNT variable, e.g if
# $IRONIC_VM_COUNT=3 the ports 6230, 6231 and 6232 will be used for the
# Virtual BMCs, one for each VM.
IRONIC_VBMC_PORT_RANGE_START=${IRONIC_VBMC_PORT_RANGE_START:-6230}
IRONIC_VBMC_CONFIG_FILE=${IRONIC_VBMC_CONFIG_FILE:-$IRONIC_CONF_DIR/virtualbmc/virtualbmc.conf}
IRONIC_VBMC_LOGFILE=${IRONIC_VBMC_LOGFILE:-$IRONIC_VM_LOG_DIR/virtualbmc.log}
IRONIC_VBMC_SYSTEMD_SERVICE=devstack@virtualbmc.service
# Virtual PDU configs
IRONIC_VPDU_CONFIG_FILE=${IRONIC_VPDU_CONFIG_FILE:-$IRONIC_CONF_DIR/virtualpdu/virtualpdu.conf}
IRONIC_VPDU_PORT_RANGE_START=${IRONIC_VPDU_PORT_RANGE_START:-1}
IRONIC_VPDU_LISTEN_PORT=${IRONIC_VPDU_LISTEN_PORT:-1161}
IRONIC_VPDU_COMMUNITY=${IRONIC_VPDU_COMMUNITY:-private}
IRONIC_VPDU_SNMPDRIVER=${IRONIC_VPDU_SNMPDRIVER:-apc_rackpdu}
IRONIC_VPDU_SYSTEMD_SERVICE=devstack@virtualpdu.service
# Redfish configs
IRONIC_REDFISH_EMULATOR_PORT=${IRONIC_REDFISH_EMULATOR_PORT:-9132}
IRONIC_REDFISH_EMULATOR_SYSTEMD_SERVICE="devstack@redfish-emulator.service"
IRONIC_REDFISH_EMULATOR_CONFIG=${IRONIC_REDFISH_EMULATOR_CONFIG:-$IRONIC_CONF_DIR/redfish/emulator.conf}
IRONIC_REDFISH_EMULATOR_FEATURE_SET=${IRONIC_REDFISH_EMULATOR_FEATURE_SET:-full}
# To explicitly enable configuration of Glance with Swift
# (which is required by some vendor drivers), set this
# variable to true.
IRONIC_CONFIGURE_GLANCE_WITH_SWIFT=$(trueorfalse False IRONIC_CONFIGURE_GLANCE_WITH_SWIFT)
# The path to the libvirt hooks directory, used if IRONIC_VM_LOG_ROTATE is True
IRONIC_LIBVIRT_HOOKS_PATH=${IRONIC_LIBVIRT_HOOKS_PATH:-/etc/libvirt/hooks/}
LIBVIRT_STORAGE_POOL=${LIBVIRT_STORAGE_POOL:-"default"}
LIBVIRT_STORAGE_POOL_PATH=${LIBVIRT_STORAGE_POOL_PATH:-/var/lib/libvirt/images}
# The authentication strategy used by ironic-api. Valid values are:
# keystone, http_basic, noauth.
IRONIC_AUTH_STRATEGY=${IRONIC_AUTH_STRATEGY:-keystone}
# By default, terminal SSL certificate is disabled.
IRONIC_TERMINAL_SSL=$(trueorfalse False IRONIC_TERMINAL_SSL)
IRONIC_TERMINAL_CERT_DIR=${IRONIC_TERMINAL_CERT_DIR:-$IRONIC_DATA_DIR/terminal_cert/}
# This flag is used to allow adding Link-Local-Connection info
# to ironic port-create command. LLC info is obtained from
# IRONIC_{VM,HW}_NODES_FILE
IRONIC_USE_LINK_LOCAL=$(trueorfalse False IRONIC_USE_LINK_LOCAL)
# Allow selecting dhcp provider
IRONIC_DHCP_PROVIDER=${IRONIC_DHCP_PROVIDER:-neutron}
# This is the network interface to use for a node
IRONIC_NETWORK_INTERFACE=${IRONIC_NETWORK_INTERFACE:-}
# Ironic provision network name, if this value is set it means we are using
# multi-tenant networking. If not set, then we are not using multi-tenant
# networking and are therefore using a 'flat' network.
IRONIC_PROVISION_NETWORK_NAME=${IRONIC_PROVISION_NETWORK_NAME:-}
# Provision network provider type. Can be flat or vlan.
# This is only used if IRONIC_PROVISION_NETWORK_NAME has been set.
IRONIC_PROVISION_PROVIDER_NETWORK_TYPE=${IRONIC_PROVISION_PROVIDER_NETWORK_TYPE:-'vlan'}
# If IRONIC_PROVISION_PROVIDER_NETWORK_TYPE is vlan. VLAN_ID may be specified. If it is not set,
# vlan will be allocated dynamically.
# This is only used if IRONIC_PROVISION_NETWORK_NAME has been set.
IRONIC_PROVISION_SEGMENTATION_ID=${IRONIC_PROVISION_SEGMENTATION_ID:-}
# NOTE(TheJulia): Some silly logic to help make multinode work because conductors
# refer to themselves and in this case we're running multiple conductors.
SUBNODE_FINAL="2"
# For nodes, there is a relative order, so when we have a subnode, we use
# this value to try and track which would be appropriate.
SUBNODE_ID=""
if [ -f /etc/devstack-host ]; then
# NOTE(TheJulia): this needs to match the Zuul Nodeset configuration
# of hostnames, and should then be mapped out with as many nodes
# required.
if $(grep -qi compute0 /etc/devstack-host); then
SUBNODE_FINAL="2"
SUBNODE_ID="1"
elif $(grep -qi compute1 /etc/devstack-host); then
SUBNODE_FINAL="3"
SUBNODE_ID="2"
fi
fi
if [[ "$IRONIC_IP_VERSION" != '6' ]]; then
# NOTE(TheJulia): Lets not try and support mixed mode since the conductor
# can't support mixed mode operation. We are either IPv4 OR IPv6.
IRONIC_IP_VERSION='4'
# Allocation network pool for provision network
# Example: IRONIC_PROVISION_ALLOCATION_POOL=start=10.0.5.10,end=10.0.5.100
# This is only used if IRONIC_PROVISION_NETWORK_NAME has been set.
IRONIC_PROVISION_ALLOCATION_POOL=${IRONIC_PROVISION_ALLOCATION_POOL:-'start=10.0.5.10,end=10.0.5.100'}
# With multinode case all ironic-conductors should have IP from provisioning network.
# IRONIC_PROVISION_SUBNET_GATEWAY - is configured on primary node.
# Ironic provision subnet gateway.
IRONIC_PROVISION_SUBNET_GATEWAY=${IRONIC_PROVISION_SUBNET_GATEWAY:-'10.0.5.1'}
IRONIC_PROVISION_SUBNET_SUBNODE_IP=${IRONIC_PROVISION_SUBNET_SUBNODE_IP:-'10.0.5.'$SUBNODE_FINAL}
# Ironic provision subnet prefix
# Example: IRONIC_PROVISION_SUBNET_PREFIX=10.0.5.0/24
IRONIC_PROVISION_SUBNET_PREFIX=${IRONIC_PROVISION_SUBNET_PREFIX:-'10.0.5.0/24'}
else
IRONIC_IP_VERSION='6'
# We setup an address elsewhere because the service address of
# HOST_IPV6 cannot be used for v6 testing.
IRONIC_HOST_IPV6='fc00::1'
IRONIC_PROVISION_SUBNET_GATEWAY=${IRONIC_PROVISION_SUBNET_GATEWAY:-'fc01::1'}
IRONIC_PROVISION_SUBNET_SUBNODE_IP=${IRONIC_PROVISION_SUBNET_SUBNODE_IP:-'fc01::'$SUBNODE_FINAL}
IRONIC_PROVISION_SUBNET_PREFIX=${IRONIC_PROVISION_SUBNET_PREFIX:-'fc01::/64'}
IRONIC_TFTPSERVER_IP=$IRONIC_HOST_IPV6
fi
IRONIC_ROUTER_NAME=${Q_ROUTER_NAME:-router1}
# Ironic provision subnet name.
# This is only used if IRONIC_PROVISION_NETWORK_NAME has been set.
IRONIC_PROVISION_PROVIDER_SUBNET_NAME=${IRONIC_PROVISION_PROVIDER_SUBNET_NAME:-${IRONIC_PROVISION_NETWORK_NAME}-subnet}
# When enabled this will set the physical_network attribute for ironic ports
# and subnet-to-segment association on provisioning network will be configured.
# NOTE: The neutron segments service_plugin must be loaded for this.
IRONIC_USE_NEUTRON_SEGMENTS=$(trueorfalse False IRONIC_USE_NEUTRON_SEGMENTS)
# This is the storage interface to use for a node
# Only 'cinder' can be set for testing boot from volume
IRONIC_STORAGE_INTERFACE=${IRONIC_STORAGE_INTERFACE:-}
# With multinode case all ironic-conductors should have IP from provisioning network.
# IRONIC_PROVISION_SUBNET_GATEWAY - is configured on primary node.
# Ironic provision subnet gateway.
IRONIC_PROVISION_SUBNET_GATEWAY=${IRONIC_PROVISION_SUBNET_GATEWAY:-'10.0.5.1'}
IRONIC_PROVISION_SUBNET_SUBNODE_IP=${IRONIC_PROVISION_SUBNET_SUBNODE_IP:-'10.0.5.2'}
# Ironic provision subnet prefix
# Example: IRONIC_PROVISION_SUBNET_PREFIX=10.0.5.0/24
IRONIC_PROVISION_SUBNET_PREFIX=${IRONIC_PROVISION_SUBNET_PREFIX:-'10.0.5.0/24'}
if [[ "$HOST_TOPOLOGY_ROLE" == "primary" ]]; then
# Some CI jobs get triggered without a HOST_TOPOLOGY_ROLE
# If so, none of this logic is, or needs to be executed.
IRONIC_TFTPSERVER_IP=$IRONIC_PROVISION_SUBNET_GATEWAY
IRONIC_HTTP_SERVER=$IRONIC_PROVISION_SUBNET_GATEWAY
fi
if [[ "$HOST_TOPOLOGY_ROLE" == "subnode" ]]; then
IRONIC_TFTPSERVER_IP=$IRONIC_PROVISION_SUBNET_SUBNODE_IP
IRONIC_HTTP_SERVER=$IRONIC_PROVISION_SUBNET_SUBNODE_IP
fi
# NOTE(TheJulia): Last catch for this being set or not.
# should only work for v4.
IRONIC_HTTP_SERVER=${IRONIC_HTTP_SERVER:-$IRONIC_TFTPSERVER_IP}
# Port that must be permitted for iSCSI connections to be
# established from the tenant network.
ISCSI_SERVICE_PORT=${ISCSI_SERVICE_PORT:-3260}
# Retrieving logs from the deploy ramdisk
#
# IRONIC_DEPLOY_LOGS_COLLECT possible values are:
# * always: Collect the ramdisk logs from the deployment on success or
# failure (Default in DevStack for debugging purpose).
# * on_failure: Collect the ramdisk logs upon a deployment failure
# (Default in Ironic).
# * never: Never collect the ramdisk logs.
IRONIC_DEPLOY_LOGS_COLLECT=${IRONIC_DEPLOY_LOGS_COLLECT:-always}
# IRONIC_DEPLOY_LOGS_STORAGE_BACKEND possible values are:
# * local: To store the logs in the local filesystem (Default in Ironic and DevStack).
# * swift: To store the logs in Swift.
IRONIC_DEPLOY_LOGS_STORAGE_BACKEND=${IRONIC_DEPLOY_LOGS_STORAGE_BACKEND:-local}
# The path to the directory where Ironic should put the logs when IRONIC_DEPLOY_LOGS_STORAGE_BACKEND is set to "local"
IRONIC_DEPLOY_LOGS_LOCAL_PATH=${IRONIC_DEPLOY_LOGS_LOCAL_PATH:-$IRONIC_VM_LOG_DIR/deploy_logs}
# Fast track option
IRONIC_DEPLOY_FAST_TRACK=${IRONIC_DEPLOY_FAST_TRACK:-False}
# Define baremetal min_microversion in tempest config. Default value None is picked from tempest.
TEMPEST_BAREMETAL_MIN_MICROVERSION=${TEMPEST_BAREMETAL_MIN_MICROVERSION:-}
# Define baremetal max_microversion in tempest config. No default value means that it is picked from tempest.
TEMPEST_BAREMETAL_MAX_MICROVERSION=${TEMPEST_BAREMETAL_MAX_MICROVERSION:-}
# TODO(TheJulia): This PHYSICAL_NETWORK needs to be refactored in
# our devstack plugin. It is used by the neutron integration,
# however they want to name the new variable for the current neutron
# plugin NEUTRON_PHYSICAL_NETWORK. For now we'll do some magic and
# change it later once we migrate our jobs.
PHYSICAL_NETWORK=${NEUTRON_PHYSICAL_NETWORK:-${PHYSICAL_NETWORK:-}}
# Ramdisk ISO image for Ramdisk Virtual Media/iPXE testing
# Originally http://tinycorelinux.net/13.x/x86/archive/13.0/Core-13.0.iso
# However sometimes this is unreachable.
# NOTE(TheJulia): As of May 19th, 2023, mirrors.dotsrc.org was
# accessible via ipv4 and ipv6, it appears to be the only v6
# accessible tinycore mirror..
# NOTE(TheJulia): The TinyCore Image *is* only compatible with
# BIOS booting. iPXE loaders with UEFI mode will ERROR pointing
# to https://ipxe.org/err/7f22208e.
IRONIC_RAMDISK_IMAGE=${IRONIC_RAMDISK_IMAGE:-http://mirrors.dotsrc.org/tinycorelinux/14.x/x86/release/Core-current.iso}
IRONIC_LOADER_PATHS=${IRONIC_LOADER_PATHS:-}
# update_loader_copy_paths() - Appends to the loader paths for automatic
# file copy in by Ironic upon startup.
function update_loader_copy_paths {
if [[ -n $IRONIC_LOADER_PATHS ]]; then
IRONIC_LOADER_PATHS="$IRONIC_LOADER_PATHS,$1"
else
IRONIC_LOADER_PATHS=$1
fi
}
# get_pxe_boot_file() - Get the PXE boot file path
function get_pxe_boot_file {
local pxe_boot_file
# Standard PXE
if is_ubuntu; then
# Ubuntu Xenial (16.04) places the file under /usr/lib/PXELINUX
pxe_paths="/usr/lib/syslinux/pxelinux.0 /usr/lib/PXELINUX/pxelinux.0"
for p in $pxe_paths; do
if [[ -f $p ]]; then
pxe_boot_file=$p
fi
done
elif is_fedora || is_suse; then
pxe_boot_file=/usr/share/syslinux/pxelinux.0
fi
echo $pxe_boot_file
}
# PXE boot image - Deprecated
IRONIC_PXE_BOOT_IMAGE=${IRONIC_PXE_BOOT_IMAGE:-$(get_pxe_boot_file)}
IRONIC_AUTOMATED_CLEAN_ENABLED=$(trueorfalse True IRONIC_AUTOMATED_CLEAN_ENABLED)
IRONIC_SECURE_BOOT=${IRONIC_SECURE_BOOT:-False}
IRONIC_UEFI_BOOT_LOADER=${IRONIC_UEFI_BOOT_LOADER:-grub2}
IRONIC_GRUB2_SHIM_FILE=${IRONIC_GRUB2_SHIM_FILE:-}
IRONIC_GRUB2_FILE=${IRONIC_GRUB2_FILE:-}
IRONIC_GRUB2_NETWORK_FILE=${IRONIC_GRUB2_NETWORK_FILE:-}
IRONIC_UEFI_FILES_DIR=${IRONIC_UEFI_FILES_DIR:-/var/lib/libvirt/images}
UEFI_LOADER_PATH=$IRONIC_UEFI_FILES_DIR/OVMF_CODE_4M.fd
UEFI_NVRAM_PATH=$IRONIC_UEFI_FILES_DIR/OVMF_VARS_4M.fd
if [[ $IRONIC_HW_ARCH == "aarch64" ]]; then
UEFI_LOADER_PATH=$IRONIC_UEFI_FILES_DIR/AAVMF_CODE.fd
UEFI_NVRAM_PATH=$IRONIC_UEFI_FILES_DIR/AAVMF_VARS.fd
fi
# Handle architecture specific package installs
install_package shim shim-signed
if [[ $IRONIC_HW_ARCH == "x86_64" ]]; then
if is_ubuntu; then
install_package grub-efi-amd64-signed
elif is_fedora; then
install_package grub2 grub2-efi
fi
elif [[ $IRONIC_HW_ARCH == "aarch64" ]]; then
if is_ubuntu; then
install_package qemu-system-arm qemu-efi-aarch64
elif is_fedora; then
install_package grub2-arm64-efi
fi
fi
# Sanity checks
if [[ "$IRONIC_BOOT_MODE" == "uefi" ]]; then
if [[ "$IRONIC_IPXE_ENABLED" == "False" ]] && [[ "$IRONIC_UEFI_BOOT_LOADER" != "grub2" ]]; then
die $LINENO "Boot mode UEFI is only supported with iPXE and grub2 bootloaders."
fi
if ! is_fedora && ! is_ubuntu; then
die $LINENO "Boot mode UEFI only works in Ubuntu or Fedora for now."
fi
if is_ubuntu; then
if [[ $IRONIC_HW_ARCH == "x86_64" ]]; then
if [[ -z $IRONIC_GRUB2_FILE ]]; then
IRONIC_GRUB2_SHIM_FILE=/usr/lib/shim/shimx64.efi.signed
IRONIC_GRUB2_FILE=/usr/lib/grub/x86_64-efi-signed/grubx64.efi.signed
IRONIC_GRUB2_NETWORK_FILE=/usr/lib/grub/x86_64-efi-signed/grubnetx64.efi.signed
fi
elif [[ $IRONIC_HW_ARCH == "aarch64" ]]; then
if [[ -z $IRONIC_GRUB2_FILE ]]; then
IRONIC_GRUB2_SHIM_FILE=/usr/lib/shim/shimaa64.efi.signed
IRONIC_GRUB2_FILE=/usr/lib/grub/arm64-efi-signed/grubaa64.efi.signed
IRONIC_GRUB2_NETWORK_FILE=/usr/lib/grub/arm64-efi-signed/grubnetaa64.efi.signed
fi
fi
elif is_fedora && grep -qs "CentOS" /etc/redhat-release; then
if [[ $IRONIC_HW_ARCH == "x86_64" ]]; then
if [[ -z $IRONIC_GRUB2_FILE ]]; then
IRONIC_GRUB2_SHIM_FILE=/boot/efi/EFI/centos/shimx64.efi
IRONIC_GRUB2_FILE=/boot/efi/EFI/centos/grubx64.efi
IRONIC_GRUB2_NETWORK_FILE=/boot/efi/EFI/centos/grubx64.efi
fi
elif [[ $IRONIC_HW_ARCH == "aarch64" ]]; then
if [[ -z $IRONIC_GRUB2_FILE ]]; then
IRONIC_GRUB2_SHIM_FILE=/boot/efi/EFI/centos/shimaa64.efi
IRONIC_GRUB2_FILE=/boot/efi/EFI/centos/grubaa64.efi
IRONIC_GRUB2_NETWORK_FILE=/boot/efi/EFI/centos/grubaa64.efi
fi
fi
elif is_fedora; then
if [[ $IRONIC_HW_ARCH == "x86_64" ]]; then
if [[ -z $IRONIC_GRUB2_FILE ]]; then
IRONIC_GRUB2_SHIM_FILE=/boot/efi/EFI/fedora/shimx64.efi
IRONIC_GRUB2_FILE=/boot/efi/EFI/fedora/grubx64.efi
IRONIC_GRUB2_NETWORK_FILE=/boot/efi/EFI/fedora/grubx64.efi
fi
elif [[ $IRONIC_HW_ARCH == "aarch64" ]]; then
if [[ -z $IRONIC_GRUB2_FILE ]]; then
IRONIC_GRUB2_SHIM_FILE=/boot/efi/EFI/fedora/shimaa64.efi
IRONIC_GRUB2_FILE=/boot/efi/EFI/fedora/grubaa64.efi
IRONIC_GRUB2_NETWORK_FILE=/boot/efi/EFI/fedora/grubaa64.efi
fi
fi
fi
if [[ "$IRONIC_IPXE_ENABLED" == "False" ]]; then
# NOTE(TheJulia): While we no longer directly copy the
# IRONIC_GRUB2_FILE, we still check the existence as
# without the bootloader package we would be unable to build
# the netboot core image.
if [[ -z $IRONIC_GRUB2_SHIM_FILE ]] || [[ -z $IRONIC_GRUB2_FILE ]] || [[ ! -f $IRONIC_GRUB2_SHIM_FILE ]] || [[ ! -f $IRONIC_GRUB2_FILE ]]; then
die $LINENO "Grub2 Bootloader and Shim file missing."
fi
fi
# NOTE(tkajinam) Use local mirror in CI
if [ -f /etc/ci/mirror_info.sh ]; then
source /etc/ci/mirror_info.sh
CENTOS_MIRROR_HOST="http://${NODEPOOL_MIRROR_HOST}/centos-stream"
IRONIC_GRUB2_SHIM_FILE=$(echo $IRONIC_GRUB2_SHIM_FILE | sed "s|https://mirror.stream.centos.org|${CENTOS_MIRROR_HOST}|g")
IRONIC_GRUB2_FILE=$(echo $IRONIC_GRUB2_FILE | sed "s|https://mirror.stream.centos.org|${CENTOS_MIRROR_HOST}|g")
fi
fi
if [[ "$IRONIC_SHARDS" != "0" ]] && [[ "$IRONIC_SHARDS" != "1" ]]; then
die $LINENO "Only support 0 or 1 shards at this time."
fi
# TODO(pas-ha) find a way to (cross-)sign the custom CA bundle used by tls-proxy
# with default iPXE cert - for reference see http://ipxe.org/crypto
if is_service_enabled tls-proxy && [[ "$IRONIC_IPXE_USE_SWIFT" == "True" ]]; then
die $LINENO "Ironic in DevStack does not yet support booting iPXE from HTTPS URLs"
fi
IRONIC_NETWORK_DOWNLOAD_RETRY_MAX=${IRONIC_NETWORK_DOWNLOAD_RETRY_MAX:-5}
IRONIC_NETWORK_DOWNLOAD_RETRY_DELAY=${IRONIC_NETWORK_DOWNLOAD_RETRY_DELAY:-10}
function download_with_retry() {
local source_url=$1
local destination_path=$2
local attempts=1
echo "Downloading $source_url to $destination_path"
while [ $attempts -le $IRONIC_NETWORK_DOWNLOAD_RETRY_MAX ]; do
if wget --timeout=30 --tries=3 -q "$source_url" -O "$destination_path"; then
echo "Successfully downloaded $source_url on attempt $attempts"
return 0
fi
echo "Download attempt $attempts failed for $source_url, retrying in \
$IRONIC_NETWORK_DOWNLOAD_RETRY_DELAY seconds..."
sleep $IRONIC_NETWORK_DOWNLOAD_RETRY_DELAY
attempts=$((attempts + 1))
done
echo "Failed to download $source_url after $IRONIC_NETWORK_DOWNLOAD_RETRY_MAX attempts"
return 1
}
# Timeout for "manage" action. 2 minutes is more than enough.
IRONIC_MANAGE_TIMEOUT=${IRONIC_MANAGE_TIMEOUT:-120}
# Timeout for "provide" action. This involves cleaning.
if [[ -n "$IRONIC_PXE_BOOT_RETRY_TIMEOUT" ]]; then
IRONIC_DEFAULT_CLEANING_TIMEOUT=$(( $IRONIC_PXE_BOOT_RETRY_TIMEOUT * 2 ))
else
IRONIC_DEFAULT_CLEANING_TIMEOUT=1800
fi
IRONIC_CLEANING_TIMEOUT=${IRONIC_CLEANING_TIMEOUT:-$IRONIC_DEFAULT_CLEANING_TIMEOUT}
IRONIC_CLEANING_DELAY=10
IRONIC_CLEANING_ATTEMPTS=$(( $IRONIC_CLEANING_TIMEOUT / $IRONIC_CLEANING_DELAY ))
# Timeout for ironic-neutron-agent to report state before providing nodes.
# The agent reports every 60 seconds, 2 minutes should do.
IRONIC_NEUTRON_AGENT_REPORT_STATE_DELAY=10
IRONIC_NEUTRON_AGENT_REPORT_STATE_TIMEOUT=${IRONIC_NEUTRON_AGENT_REPORT_STATE_TIMEOUT:-120}
IRONIC_NEUTRON_AGENT_REPORT_STATE_ATTEMPTS=$(( $IRONIC_NEUTRON_AGENT_REPORT_STATE_TIMEOUT / IRONIC_NEUTRON_AGENT_REPORT_STATE_DELAY ))
# Username to use by Ansible to access ramdisk,
# to be set as '[ansible]/default_username' option.
# If not set here (default), will be set to 'tc' for TinyIPA ramdisk,
# for other ramdisks it must be either provided here,
# or set manually per-node via ironic API
IRONIC_ANSIBLE_SSH_USER=${IRONIC_ANSIBLE_SSH_USER:-}
# Path to the private SSH key to use by ansible deploy interface
# that will be set as '[ansible]/default_key_file' option in config.
# The public key path is assumed to be ${IRONIC_ANSIBLE_SSH_KEY}.pub
# and will be used when rebuilding the image to include this public key
# in ~/.ssh/authorized_keys of a $IRONIC_ANSIBLE_SSH_USER in the ramdisk.
# Only the TinyIPA ramdisks are currently supported for such rebuild.
# For TinyIPA ramdisks, if the specified file doesn't exist, it will
# be created and will contain a new RSA passwordless key. We assume
# that the directories in the path to this file exist and are
# writable.
# For other ramdisk types, make sure the corresponding public key is baked into
# the ramdisk to be used by DevStack and provide the path to the private key here,
# or set it manually per node via ironic API.
# FIXME(pas-ha) auto-generated keys currently won't work for multi-node
# DevStack deployment, as we do not distribute this generated key to subnodes yet.
IRONIC_ANSIBLE_SSH_KEY=${IRONIC_ANSIBLE_SSH_KEY:-$IRONIC_DATA_DIR/ansible_ssh_key}
if is_service_enabled swift && [[ "$SWIFT_ENABLE_TEMPURLS" == "True" ]]; then
IRONIC_DEFAULT_DOWNLOAD_SOURCE=swift
else
IRONIC_DEFAULT_DOWNLOAD_SOURCE=
fi
IRONIC_AGENT_IMAGE_DOWNLOAD_SOURCE=${IRONIC_AGENT_IMAGE_DOWNLOAD_SOURCE:-$IRONIC_DEFAULT_DOWNLOAD_SOURCE}
# Functions
# ---------
# UEFI related functions
function get_uefi_loader {
if [[ $IRONIC_HW_ARCH == "aarch64" ]]; then
if is_ubuntu; then
echo /usr/share/AAVMF/AAVMF_CODE.fd
elif is_fedora; then
echo /usr/share/edk2/aarch64/QEMU_EFI.fd
fi
else
if is_ubuntu; then
echo /usr/share/OVMF/OVMF_CODE_4M.fd
elif is_fedora; then
echo /usr/share/edk2/ovmf/OVMF_CODE.fd
fi
fi
}
function get_uefi_nvram {
if [[ $IRONIC_HW_ARCH == "aarch64" ]]; then
if is_ubuntu; then
echo /usr/share/AAVMF/AAVMF_VARS.fd
elif is_fedora; then
echo /usr/share/edk2/aarch64/QEMU_VARS.fd
fi
else
if is_ubuntu; then
echo /usr/share/OVMF/OVMF_VARS_4M.fd
elif is_fedora; then
echo /usr/share/edk2/ovmf/OVMF_VARS.fd
fi
fi
}
# Misc
function restart_libvirt {
local libvirt_service_name="libvirtd"
if is_ubuntu && ! type libvirtd; then
libvirt_service_name="libvirt-bin"
fi
restart_service $libvirt_service_name
}
# Test if any Ironic services are enabled
# is_ironic_enabled
function is_ironic_enabled {
[[ ,${ENABLED_SERVICES} =~ ,"ir-" ]] && return 0
return 1
}
function is_deployed_by_agent {
[[ "$IRONIC_DEFAULT_DEPLOY_INTERFACE" == "direct"
|| "$IRONIC_DEFAULT_DEPLOY_INTERFACE" == "" ]] && return 0
return 1
}
function is_deployed_by_ipmi {
[[ "$IRONIC_DEPLOY_DRIVER" == ipmi ]] && return 0
return 1
}
function is_deployed_by_ilo {
[[ "${IRONIC_DEPLOY_DRIVER}" == ilo ]] && return 0
return 1
}
function is_deployed_by_drac {
[[ "${IRONIC_DEPLOY_DRIVER}" == idrac ]] && return 0
return 1
}
function is_deployed_by_snmp {
[[ "${IRONIC_DEPLOY_DRIVER}" == snmp ]] && return 0
return 1
}
function is_deployed_by_redfish {
[[ "$IRONIC_DEPLOY_DRIVER" == redfish ]] && return 0
return 1
}
function is_deployed_by_irmc {
[[ "$IRONIC_DEPLOY_DRIVER" == irmc ]] && return 0
return 1
}
function is_drac_enabled {
[[ -z "${IRONIC_ENABLED_HARDWARE_TYPES%%*idrac*}" ]] && return 0
return 1
}
function is_ansible_deploy_enabled {
[[ -z "${IRONIC_ENABLED_DEPLOY_INTERFACES%%*ansible*}" ]] && return 0
return 1
}
function is_redfish_enabled {
[[ -z "${IRONIC_ENABLED_HARDWARE_TYPES%%*redfish*}" ]] && return 0
return 1
}
function is_ansible_with_tinyipa {
# NOTE(pas-ha) we support rebuilding the ramdisk to include (generated) SSH keys
# as needed for ansible deploy interface only for TinyIPA ramdisks for now
is_ansible_deploy_enabled && [[ "$IRONIC_RAMDISK_TYPE" == "tinyipa" ]] && return 0
return 1
}
function is_http_server_required {
[[ "$IRONIC_IPXE_ENABLED" == "True" ]] && return 0
is_deployed_by_agent && [[ "$IRONIC_AGENT_IMAGE_DOWNLOAD_SOURCE" != "swift" ]] && return 0
return 1
}
function is_glance_configuration_required {
# Always configure if we're asked to
[[ "$IRONIC_CONFIGURE_GLANCE_WITH_SWIFT" == "True" ]] && return 0
# Do not require swift configuration if using image_download_source!=swift
[[ "$IRONIC_AGENT_IMAGE_DOWNLOAD_SOURCE" == "swift" ]] || return 1
# Otherwise require for direct and ansible deploy
is_deployed_by_agent || is_ansible_deploy_enabled && return 0
return 1
}
function is_deploy_iso_required {
[[ "$IRONIC_IS_HARDWARE" == "True" && "$IRONIC_DEPLOY_ISO_REQUIRED" == "True" ]] && return 0
return 1
}
# Assert that the redfish hardware type is enabled in case we are using
# the redfish driver
if is_deployed_by_redfish && [[ "$IRONIC_ENABLED_HARDWARE_TYPES" != *"redfish"* ]]; then
die $LINENO "Please make sure that the redfish hardware" \
"type is enabled. Take a look at the " \
"IRONIC_ENABLED_HARDWARE_TYPES configuration option" \
"for DevStack"
fi
# Syslinux >= 5.00 pxelinux.0 binary is not "stand-alone" anymore,
# it depends on some c32 modules to work correctly.
# More info: http://www.syslinux.org/wiki/index.php/Library_modules
function setup_syslinux_modules {
# Ignore it for iPXE, it doesn't repend on syslinux modules
[[ "$IRONIC_IPXE_ENABLED" == "True" ]] && return 0
# Ubuntu Xenial keeps doesn't ship pxelinux.0 as part of syslinux anymore
if is_ubuntu && [[ -d /usr/lib/PXELINUX/ ]]; then
# NOTE(TheJulia): Few distributions package and ship syslinux.efi,
# so this is basically only for bios booting.
cp -aR /usr/lib/syslinux/modules/bios/*.c32 $IRONIC_TFTPBOOT_DIR
else
cp -aR $(dirname $IRONIC_PXE_BOOT_IMAGE)/*.c32 $IRONIC_TFTPBOOT_DIR
fi
}
function start_virtualbmc {
start_service $IRONIC_VBMC_SYSTEMD_SERVICE
}
function stop_virtualbmc {
stop_service $IRONIC_VBMC_SYSTEMD_SERVICE
}
function cleanup_virtualbmc {
stop_virtualbmc
disable_service $IRONIC_VBMC_SYSTEMD_SERVICE
local unitfile="$SYSTEMD_DIR/$IRONIC_VBMC_SYSTEMD_SERVICE"
sudo rm -f $unitfile
local vbmc_dir="${HOME}/.vbmc"
if [[ -d "$vbmc_dir" ]]; then
sudo rm -rf "$vbmc_dir"
fi
$SYSTEMCTL daemon-reload
}
function install_virtualbmc {
# Install pyghmi from source, if requested, otherwise it will be
# downloaded as part of the virtualbmc installation
if use_library_from_git "pyghmi"; then
git_clone_by_name "pyghmi"
setup_dev_lib "pyghmi"
fi
if use_library_from_git "virtualbmc"; then
git_clone_by_name "virtualbmc"
setup_dev_lib "virtualbmc"
else
pip_install_gr "virtualbmc"
fi
local cmd
BIN_DIR=$(get_python_exec_prefix)
cmd=$BIN_DIR/vbmcd
cmd+=" --foreground"
write_user_unit_file $IRONIC_VBMC_SYSTEMD_SERVICE "$cmd" "" "$STACK_USER"
local unitfile="$SYSTEMD_DIR/$IRONIC_VBMC_SYSTEMD_SERVICE"
iniset -sudo $unitfile "Service" "Environment" "VIRTUALBMC_CONFIG=$IRONIC_VBMC_CONFIG_FILE"
enable_service $IRONIC_VBMC_SYSTEMD_SERVICE
}
function configure_virtualbmc {
if [[ ! -d $(dirname $IRONIC_VBMC_CONFIG_FILE) ]]; then
mkdir -p $(dirname $IRONIC_VBMC_CONFIG_FILE)
fi
iniset -sudo $IRONIC_VBMC_CONFIG_FILE log debug True
}
function start_virtualpdu {
start_service $IRONIC_VPDU_SYSTEMD_SERVICE
}
function stop_virtualpdu {
stop_service $IRONIC_VPDU_SYSTEMD_SERVICE
}
function cleanup_virtualpdu {
stop_virtualpdu
disable_service $IRONIC_VPDU_SYSTEMD_SERVICE
local unitfile="$SYSTEMD_DIR/$IRONIC_VPDU_SYSTEMD_SERVICE"
sudo rm -f $unitfile
$SYSTEMCTL daemon-reload
}
function install_virtualpdu {
if use_library_from_git "virtualpdu"; then
git_clone_by_name "virtualpdu"
setup_dev_lib "virtualpdu"
else
pip_install "virtualpdu"
fi
local cmd
cmd=$(which virtualpdu)
cmd+=" $IRONIC_VPDU_CONFIG_FILE"
write_user_unit_file $IRONIC_VPDU_SYSTEMD_SERVICE "$cmd" "" "$STACK_USER"
enable_service $IRONIC_VPDU_SYSTEMD_SERVICE
}
function configure_virtualpdu {
mkdir -p $(dirname $IRONIC_VPDU_CONFIG_FILE)
iniset -sudo $IRONIC_VPDU_CONFIG_FILE global debug True
iniset -sudo $IRONIC_VPDU_CONFIG_FILE global libvirt_uri "qemu:///system"
iniset -sudo $IRONIC_VPDU_CONFIG_FILE PDU listen_address ${HOST_IP}
iniset -sudo $IRONIC_VPDU_CONFIG_FILE PDU listen_port ${IRONIC_VPDU_LISTEN_PORT}
iniset -sudo $IRONIC_VPDU_CONFIG_FILE PDU community ${IRONIC_VPDU_COMMUNITY}
iniset -sudo $IRONIC_VPDU_CONFIG_FILE PDU ports $(_generate_pdu_ports)
iniset -sudo $IRONIC_VPDU_CONFIG_FILE PDU outlet_default_state "OFF"
}
# _generate_pdu_ports() - Generates list of port:node_name.
function _generate_pdu_ports {
pdu_port_number=${IRONIC_VPDU_PORT_RANGE_START}
port_config=()
for vm_name in $(_ironic_bm_vm_names); do
port_config+=("${pdu_port_number}:${vm_name}")
pdu_port_number=$(( pdu_port_number + 1 ))
done
echo ${port_config[*]} | tr ' ' ','
}
function start_redfish {
start_service $IRONIC_REDFISH_EMULATOR_SYSTEMD_SERVICE
}
function stop_redfish {
stop_service $IRONIC_REDFISH_EMULATOR_SYSTEMD_SERVICE
}
function cleanup_redfish {
stop_redfish
rm -f $IRONIC_REDFISH_EMULATOR_CONFIG
disable_service $IRONIC_REDFISH_EMULATOR_SYSTEMD_SERVICE
local unitfile="$SYSTEMD_DIR/$IRONIC_REDFISH_EMULATOR_SYSTEMD_SERVICE"
sudo rm -f $unitfile
$SYSTEMCTL daemon-reload
}
function install_redfish {
# TODO(lucasagomes): Use Apache WSGI instead of gunicorn
. /opt/stack/data/venv/bin/activate
if is_fedora; then
install_package python3-gunicorn
else
pip_install_gr "gunicorn"
fi
if use_library_from_git "sushy-tools"; then
git_clone_by_name "sushy-tools"
setup_dev_lib "sushy-tools"
else
# 1.1.0 adds support for feature sets
pip_install "sushy-tools>=1.1.0"
fi
local cmd
cmd=$(which gunicorn)
cmd+=" sushy_tools.emulator.main:app"
cmd+=" --bind ${HOST_IP}:${IRONIC_REDFISH_EMULATOR_PORT}"
cmd+=" --env FLASK_DEBUG=1"
cmd+=" --env SUSHY_EMULATOR_CONFIG=${IRONIC_REDFISH_EMULATOR_CONFIG}"
# NOTE(dtantsur): handling virtual media ISO can take time, so increase
# both concurrency and the worker timeout.
cmd+=" --workers 2 --threads 2 --timeout 90"
# NOTE(dtantsur): log all accesses to stdout
cmd+=" --access-logfile=- --error-logfile=-"
# Exit virtualenv once installation is complete
deactivate
write_user_unit_file $IRONIC_REDFISH_EMULATOR_SYSTEMD_SERVICE "$cmd" "" "$STACK_USER"
# update unit file reference
local unitfile="$SYSTEMD_DIR/$IRONIC_REDFISH_EMULATOR_SYSTEMD_SERVICE"
iniset -sudo $unitfile "Service" "Environment" "PATH=/opt/stack/data/venv/bin:$PATH"
enable_service $IRONIC_REDFISH_EMULATOR_SYSTEMD_SERVICE
}
function configure_redfish {
if [[ ! -d $(dirname $IRONIC_REDFISH_EMULATOR_CONFIG) ]]; then
mkdir -p $(dirname $IRONIC_REDFISH_EMULATOR_CONFIG)
fi
cat - <<EOF > $IRONIC_REDFISH_EMULATOR_CONFIG
SUSHY_EMULATOR_BOOT_LOADER_MAP = {
'UEFI': {
'$IRONIC_HW_ARCH': '$UEFI_LOADER_PATH'
},
'Legacy': {
'$IRONIC_HW_ARCH': None
}
}
SUSHY_EMULATOR_FEATURE_SET = "$IRONIC_REDFISH_EMULATOR_FEATURE_SET"
EOF
}
function setup_sushy {
if use_library_from_git "sushy"; then
git_clone_by_name "sushy"
setup_dev_lib "sushy"
else
pip_install_gr "sushy"
fi
}
# install_ironic() - Install the things!
function install_ironic {
# NOTE(vsaienko) do not check required_services on subnode
if [[ "$HOST_TOPOLOGY_ROLE" != "subnode" ]]; then
# make sure all needed service were enabled
local req_services="key"
if is_service_enabled nova && [[ "$VIRT_DRIVER" == "ironic" ]]; then
req_services+=" nova glance neutron"
fi
for srv in $req_services; do
if ! is_service_enabled "$srv"; then
die $LINENO "$srv should be enabled for Ironic."
fi
done
fi
setup_develop $IRONIC_DIR
install_apache_wsgi
if is_redfish_enabled || is_deployed_by_redfish; then
setup_sushy
fi
if [[ "$IRONIC_IS_HARDWARE" == "False" ]]; then
if is_deployed_by_ipmi; then
install_virtualbmc
fi
if is_deployed_by_snmp; then
install_virtualpdu
fi
if is_deployed_by_redfish; then
install_redfish
fi
fi
if is_drac_enabled; then
pip_install python-dracclient
fi
if is_irmc_enabled; then
pip_install python-scciclient pysnmp
fi
if is_ansible_deploy_enabled; then
pip_install "$(grep '^ansible' $IRONIC_DIR/driver-requirements.txt | awk '{print $1}')"
fi
if is_service_enabled ir-novnc; then
# a websockets/html5 VNC console for bare metal hosts
NOVNC_FROM_PACKAGE=$(trueorfalse False NOVNC_FROM_PACKAGE)
if [ "$NOVNC_FROM_PACKAGE" = "True" ]; then
# Installing novnc on Debian bullseye breaks the global pip
# install. This happens because novnc pulls in distro cryptography
# which will be preferred by distro pip, but if anything has
# installed pyOpenSSL from pypi (keystone) that is not compatible
# with distro cryptography. Fix this by installing
# python3-openssl (pyOpenSSL) from the distro which pip will prefer
# on Debian. Ubuntu has inverse problems so we only do this for
# Debian.
local novnc_packages
novnc_packages="novnc"
GetOSVersion
if [[ "$os_VENDOR" = "Debian" ]] ; then
novnc_packages="$novnc_packages python3-openssl"
fi
NOVNC_WEB_DIR=/usr/share/novnc
install_package $novnc_packages
else
NOVNC_WEB_DIR=$DEST/novnc
git_clone $NOVNC_REPO $NOVNC_WEB_DIR $NOVNC_BRANCH
fi
# podman, systemd-container required by the systemd container provider
# buildah required below to build the VNC container
install_package podman systemd-container buildah
pushd $IRONIC_DIR/tools/vnc-container
buildah bud -f ./Containerfile -t localhost/ironic-vnc-container
popd
fi
}
# install_ironicclient() - Collect sources and prepare
function install_ironicclient {
if use_library_from_git "python-ironicclient"; then
git_clone_by_name "python-ironicclient"
setup_dev_lib "python-ironicclient"
else
# nothing actually "requires" ironicclient, so force instally from pypi
pip_install_gr python-ironicclient
fi
}
# _cleanup_ironic_apache_additions() - Remove uwsgi files, disable and remove apache vhost file
function _cleanup_ironic_apache_additions {
if is_http_server_required; then
sudo rm -rf $IRONIC_HTTP_DIR
# TODO(dtantsur): rename the site, it's also used for direct deploy
disable_apache_site ipxe-ironic
sudo rm -f $(apache_site_config_for ipxe-ironic)
fi
remove_uwsgi_config "$IRONIC_UWSGI_CONF" "$IRONIC_UWSGI"
restart_apache_server
}
# _config_ironic_apache_additions() - Configure ironic IPXE site
function _config_ironic_apache_additions {
local ipxe_apache_conf
ipxe_apache_conf=$(apache_site_config_for ipxe-ironic)
sudo cp $IRONIC_DEVSTACK_FILES_DIR/apache-ipxe-ironic.template $ipxe_apache_conf
sudo sed -e "
s|%PUBLICPORT%|$IRONIC_HTTP_PORT|g;
s|%HTTPROOT%|$IRONIC_HTTP_DIR|g;
s|%APACHELOGDIR%|$APACHE_LOG_DIR|g;
" -i $ipxe_apache_conf
enable_apache_site ipxe-ironic
}
# cleanup_ironic_config_files() - Remove residual cache/config/log files,
# left over from previous runs that would need to clean up.
function cleanup_ironic_config_files {
sudo rm -rf $IRONIC_AUTH_CACHE_DIR $IRONIC_CONF_DIR
sudo rm -rf $IRONIC_VM_LOG_DIR/*
}
function cleanup_switch_bridges {
interfaces=$(ip link |grep swbr|cut -d":" -f2)
for interface in interfaces; do
sudo ip link del dev $interface
done
}
# cleanup_ironic() - Clean everything left from Ironic
function cleanup_ironic {
cleanup_ironic_config_files
# Cleanup additions made to Apache
_cleanup_ironic_apache_additions
cleanup_virtualbmc
cleanup_virtualpdu
cleanup_redfish
cleanup_switch_bridges
# Remove the hook to disable log rotate
sudo rm -rf $IRONIC_LIBVIRT_HOOKS_PATH/qemu
# Force fresh rebuild of local build IPA on next run
if [[ "$IRONIC_BUILD_DEPLOY_RAMDISK" == "True" ]]; then
sudo rm -f $IRONIC_DEPLOY_KERNEL
sudo rm -f $IRONIC_DEPLOY_RAMDISK
sudo rm -f $IRONIC_DEPLOY_ISO
fi
}
# configure_ironic_dirs() - Create all directories required by Ironic and
# associated services.
function configure_ironic_dirs {
sudo install -d -o $STACK_USER $IRONIC_CONF_DIR $STACK_USER $IRONIC_DATA_DIR \
$IRONIC_STATE_PATH $IRONIC_TFTPBOOT_DIR $IRONIC_TFTPBOOT_DIR/pxelinux.cfg
sudo chown -R $STACK_USER:$STACK_USER $IRONIC_TFTPBOOT_DIR
if is_http_server_required; then
sudo install -d -o $STACK_USER -g $STACK_USER $IRONIC_HTTP_DIR
fi
# Deprecated - Remove at some point.
if [ ! -f "$IRONIC_PXE_BOOT_IMAGE" ] && [[ ! -z $IRONIC_LOADER_PATHS ]]; then
die $LINENO "PXE boot file $IRONIC_PXE_BOOT_IMAGE not found."
fi
# Copy PXE binary
# NOTE(mjturek): The PXE binary is x86_64 specific. So it should only be copied when
# deploying to an x86_64 node.
if [[ $IRONIC_HW_ARCH == "x86_64" ]]; then
cp $IRONIC_PXE_BOOT_IMAGE $IRONIC_TFTPBOOT_DIR
setup_syslinux_modules
fi
if [[ -z $IRONIC_LOADER_PATHS ]]; then
# This takes a slightly different model then the legacy
# path of devstack. If file exists, add it to the list.
# NOTE(TheJulia): All of these paths are for booting x86
# machines only, others arches can be used, just few distros
# pre-package such loader files.
if [[ "$IRONIC_BOOT_MODE" == "uefi" ]]; then
if is_ubuntu; then
if [[ $IRONIC_HW_ARCH == "x86_64" ]]; then
# NOTE(TheJulia): This is done separately here as this allows
# the script to have hirtuse/bionic compatibility.
if [[ -f /usr/lib/ipxe/snponly.efi ]]; then
update_loader_copy_paths snponly.efi:/usr/lib/ipxe/snponly.efi
elif [[ -f /usr/lib/ipxe/ipxe.efi ]]; then
update_loader_copy_paths snponly.efi:/usr/lib/ipxe/ipxe.efi
fi
elif [[ $IRONIC_HW_ARCH == "aarch64" ]]; then
# NOTE(cid): Ensure ARM-specific binaries are prepared if they don't already exist
if [[ ! -f /usr/lib/ipxe/arm/snponly.efi ]]; then
sudo mkdir -p /usr/lib/ipxe/arm
sudo wget -O /usr/lib/ipxe/arm/snponly.efi http://boot.ipxe.org/arm64-efi/snponly.efi
fi
if [[ -f /usr/lib/ipxe/arm/snponly.efi ]]; then
update_loader_copy_paths snponly.efi:/usr/lib/ipxe/arm/snponly.efi
elif [[ -f /usr/lib/ipxe/arm/ipxe.efi ]]; then
update_loader_copy_paths snponly.efi:/usr/lib/ipxe/arm/ipxe.efi
fi
fi
fi
if is_fedora; then
if [[ $IRONIC_HW_ARCH == "x86_64" ]]; then
if [[ -f /usr/share/ipxe/ipxe-snponly-x86_64.efi ]]; then
# NOTE(TheJulia): I think this file got renamed at some
# point during its centos8 run, but this is current.
update_loader_copy_paths snponly.efi:/usr/share/ipxe/ipxe-snponly-x86_64.efi
fi
elif [[ $IRONIC_HW_ARCH == "aarch64" ]]; then
if [[ -f /usr/share/ipxe/arm/ipxe-snponly-aarch64.efi ]]; then
update_loader_copy_paths snponly.efi:/usr/share/ipxe/arm/ipxe-snponly-aarch64.efi
fi
fi
fi
if [[ "$IRONIC_HW_ARCH" == "aarch64" ]]; then
if [ -f $IRONIC_GRUB2_SHIM_FILE ]; then
update_loader_copy_paths "bootaa64.efi:$IRONIC_GRUB2_SHIM_FILE"
update_loader_copy_paths "grubaa64.efi:$IRONIC_GRUB2_FILE"
fi
else
if [ -f $IRONIC_GRUB2_SHIM_FILE ]; then
update_loader_copy_paths "bootx64.efi:$IRONIC_GRUB2_SHIM_FILE"
fi
if [ -f $IRONIC_GRUB2_SHIM_FILE ]; then
update_loader_copy_paths "grubx64.efi:$IRONIC_GRUB2_NETWORK_FILE"
fi
fi
else
if [[ -f /usr/lib/ipxe/undionly.kpxe ]]; then
update_loader_copy_paths undionly.kpxe:/usr/lib/ipxe/undionly.kpxe
elif [[ -f /usr/share/ipxe/undionly.kpxe ]]; then
update_loader_copy_paths undionly.kpxe:/usr/share/ipxe/undionly.kpxe
fi
fi
fi # end of IRONIC_LOADER_PATHS check
if [[ "$IRONIC_BOOT_MODE" == "uefi" ]]; then
if [[ "$IRONIC_IS_HARDWARE" == "False" ]]; then
local uefi_loader
local uefi_nvram
# Copy the OVMF images to libvirt's path
uefi_loader=$(get_uefi_loader)
uefi_nvram=$(get_uefi_nvram)
sudo cp $uefi_loader $UEFI_LOADER_PATH
sudo cp $uefi_nvram $UEFI_NVRAM_PATH
fi
fi
# Create the logs directory when saving the deploy logs to the filesystem
if [[ "$IRONIC_DEPLOY_LOGS_STORAGE_BACKEND" == "local" && "$IRONIC_DEPLOY_LOGS_COLLECT" != "never" ]]; then
install -d -o $STACK_USER $IRONIC_DEPLOY_LOGS_LOCAL_PATH
fi
}
function configure_ironic_networks {
if [[ -n "${IRONIC_PROVISION_NETWORK_NAME}" ]]; then
echo_summary "Configuring Ironic provisioning network"
configure_ironic_provision_network
fi
echo_summary "Configuring Ironic cleaning network"
configure_ironic_cleaning_network
echo_summary "Configuring Ironic rescue network"
configure_ironic_rescue_network
echo_summary "Configuring Neutron Private Subnet, if needed."
configure_ironic_private_subnet
echo_summary "Configuring Ironic inspection network"
configure_ironic_inspection_network
}
function configure_ironic_private_subnet {
if [[ "${IRONIC_ANACONDA_IMAGE_REF:-}" != "" ]]; then
# NOTE(TheJulia): Anaconda needs DNS for FQDN resolution
# and devstack doesn't create this network with dns.
subnet_id=$(openstack --os-cloud $OS_CLOUD subnet show private-subnet -f value -c id)
openstack --os-cloud $OS_CLOUD subnet set --dns-nameserver 8.8.8.8 $subnet_id
fi
}
function configure_ironic_cleaning_network {
iniset $IRONIC_CONF_FILE neutron cleaning_network $IRONIC_CLEAN_NET_NAME
}
function configure_ironic_rescue_network {
iniset $IRONIC_CONF_FILE neutron rescuing_network $IRONIC_RESCUE_NET_NAME
}
function configure_ironic_inspection_network {
iniset $IRONIC_CONF_FILE neutron inspection_network $IRONIC_INSPECTION_NET_NAME
}
function configure_ironic_provision_network {
if [[ "$HOST_TOPOLOGY" == "multinode" ]]; then
# This should artificially drop the default before we get any
# further into the overall process, as post neutron setup, before
# the plugin proceeds past neutorn, this gets set. Which is fine, but
# if we're in a multinode topology, we need to pin this down to match.
iniset $NEUTRON_CONF DEFAULT global_physnet_mtu "$PUBLIC_BRIDGE_MTU"
fi
configure_neutron_dhcp_enable_addr6_list
if [[ "$IRONIC_IP_VERSION" == "6" ]]; then
# NOTE(TheJulia): Ideally we should let this happen
# with our global address, but iPXE seems to have in
# consistent behavior in this configuration with devstack.
# so we will setup a dummy interface and use that.
if ! ( ping -c1 -w1 $IRONIC_HOST_IPV6 ); then
# But before we create an interface, lets make sure it is
# not already working.
sudo ip link add magicv6 type dummy
sudo ip link set dev magicv6 up
sudo ip -6 addr add $IRONIC_HOST_IPV6/64 dev magicv6
fi
fi
# This is only called if IRONIC_PROVISION_NETWORK_NAME has been set and
# means we are using multi-tenant networking.
local net_id
local ironic_provision_network_ip
# NOTE(vsaienko) For multinode case there is no need to create a new provisioning
# network on subnode, as it was created on primary node. Just get an existed network UUID.
if [[ "$HOST_TOPOLOGY_ROLE" != "subnode" ]]; then
die_if_not_set $LINENO IRONIC_PROVISION_SUBNET_PREFIX "You must specify the IRONIC_PROVISION_SUBNET_PREFIX"
die_if_not_set $LINENO PHYSICAL_NETWORK "You must specify the PHYSICAL_NETWORK"
die_if_not_set $LINENO IRONIC_PROVISION_SUBNET_GATEWAY "You must specify the IRONIC_PROVISION_SUBNET_GATEWAY"
net_id=$(openstack --os-cloud $OS_CLOUD network create --provider-network-type $IRONIC_PROVISION_PROVIDER_NETWORK_TYPE \
--provider-physical-network "$PHYSICAL_NETWORK" \
${IRONIC_PROVISION_SEGMENTATION_ID:+--provider-segment $IRONIC_PROVISION_SEGMENTATION_ID} \
${IRONIC_PROVISION_NETWORK_NAME} -f value -c id)
die_if_not_set $LINENO net_id "Failure creating net_id for $IRONIC_PROVISION_NETWORK_NAME"
if [[ "${IRONIC_USE_NEUTRON_SEGMENTS}" == "True" ]]; then
local net_segment_id
net_segment_id=$(openstack --os-cloud $OS_CLOUD network segment list --network $net_id -f value -c ID)
die_if_not_set $LINENO net_segment_id "Failure getting net_segment_id for $IRONIC_PROVISION_NETWORK_NAME"
fi
local subnet_id
if [[ "$IRONIC_IP_VERSION" == '4' ]]; then
subnet_id="$(openstack --os-cloud $OS_CLOUD subnet create --ip-version 4 \
${IRONIC_PROVISION_ALLOCATION_POOL:+--allocation-pool $IRONIC_PROVISION_ALLOCATION_POOL} \
${net_segment_id:+--network-segment $net_segment_id} \
$IRONIC_PROVISION_PROVIDER_SUBNET_NAME \
--gateway $IRONIC_PROVISION_SUBNET_GATEWAY --network $net_id \
--subnet-range $IRONIC_PROVISION_SUBNET_PREFIX \
--dns-nameserver 8.8.8.8 -f value -c id)"
else
# NOTE(hjensas) Ensure mtu matches public bridge mtu, to avoid "dropped over-mtu packet" issue on IPv6
if [[ -n "$PUBLIC_BRIDGE_MTU" ]]; then
openstack network set --mtu "$PUBLIC_BRIDGE_MTU" $net_id
fi
subnet_id="$(openstack --os-cloud $OS_CLOUD subnet create --ip-version 6 \
--ipv6-address-mode $IRONIC_IPV6_ADDRESS_MODE \
--ipv6-ra-mode $IRONIC_IPV6_ADDRESS_MODE \
--dns-nameserver 2001:4860:4860::8888 \
${net_segment_id:+--network-segment $net_segment_id} \
$IRONIC_PROVISION_PROVIDER_SUBNET_NAME \
--gateway $IRONIC_PROVISION_SUBNET_GATEWAY --network $net_id \
--subnet-range $IRONIC_PROVISION_SUBNET_PREFIX -f value -c id)"
# NOTE(TheJulia): router must be attached to the subnet for RAs.
openstack --os-cloud $OS_CLOUD router add subnet $IRONIC_ROUTER_NAME $subnet_id
# We're going to be using this router of public access to tenant networks
PUBLIC_ROUTER_ID=$(openstack --os-cloud $OS_CLOUD router show -c id -f value $IRONIC_ROUTER_NAME)
fi
die_if_not_set $LINENO subnet_id "Failure creating SUBNET_ID for $IRONIC_PROVISION_NETWORK_NAME"
ironic_provision_network_ip=$IRONIC_PROVISION_SUBNET_GATEWAY
else
net_id=$(openstack --os-cloud $OS_CLOUD network show $IRONIC_PROVISION_NETWORK_NAME -f value -c id)
ironic_provision_network_ip=$IRONIC_PROVISION_SUBNET_SUBNODE_IP
fi
IRONIC_PROVISION_SEGMENTATION_ID=${IRONIC_PROVISION_SEGMENTATION_ID:-`openstack --os-cloud $OS_CLOUD network show ${net_id} -f value -c provider:segmentation_id`}
provision_net_prefix=${IRONIC_PROVISION_SUBNET_PREFIX##*/}
# Set provision network GW on physical interface
# Add vlan on br interface in case of IRONIC_PROVISION_PROVIDER_NETWORK_TYPE==vlan
# otherwise assign ip to br interface directly.
sudo ip link set dev $OVS_PHYSICAL_BRIDGE up
if [[ "$IRONIC_IP_VERSION" == "4" ]]; then
if [[ "$IRONIC_PROVISION_PROVIDER_NETWORK_TYPE" == "vlan" ]]; then
sudo ip link add link $OVS_PHYSICAL_BRIDGE name $OVS_PHYSICAL_BRIDGE.$IRONIC_PROVISION_SEGMENTATION_ID type vlan id $IRONIC_PROVISION_SEGMENTATION_ID
sudo ip link set dev $OVS_PHYSICAL_BRIDGE.$IRONIC_PROVISION_SEGMENTATION_ID up
sudo ip -$IRONIC_IP_VERSION addr add dev $OVS_PHYSICAL_BRIDGE.$IRONIC_PROVISION_SEGMENTATION_ID $ironic_provision_network_ip/$provision_net_prefix
else
sudo ip -$IRONIC_IP_VERSION addr add dev $OVS_PHYSICAL_BRIDGE $ironic_provision_network_ip/$provision_net_prefix
fi
else
# Turn on the external/integration bridges, for IPV6.
sudo ip link set dev br-ex up
sudo ip link set dev br-int up
sudo ip6tables -I FORWARD -i brbm -j LOG || true
sudo ip6tables -I FORWARD -i br-ex -j LOG || true
fi
iniset $IRONIC_CONF_FILE neutron provisioning_network $IRONIC_PROVISION_NETWORK_NAME
}
function cleanup_ironic_provision_network {
# Cleanup OVS_PHYSICAL_BRIDGE subinterfaces
local bridge_subint
bridge_subint=$(cat /proc/net/dev | sed -n "s/^\(${OVS_PHYSICAL_BRIDGE}\.[0-9]*\).*/\1/p")
for sub_int in $bridge_subint; do
sudo ip link set dev $sub_int down
sudo ip link del dev $sub_int
done
}
function configure_neutron_l3_lower_v6_ra {
iniset $Q_L3_CONF_FILE DEFAULT min_rtr_adv_interval 5
}
function configure_neutron_dhcp_enable_addr6_list {
if is_service_enabled q-dhcp; then
iniset $Q_DHCP_CONF_FILE DEFAULT dnsmasq_enable_addr6_list true
restart_service devstack@q-dhcp.service
fi
}
# configure_ironic() - Set config files, create data dirs, etc
function configure_ironic {
configure_ironic_dirs
# (re)create ironic configuration file and configure common parameters.
rm -f $IRONIC_CONF_FILE
iniset $IRONIC_CONF_FILE DEFAULT debug True
inicomment $IRONIC_CONF_FILE DEFAULT log_file
iniset $IRONIC_CONF_FILE database connection `database_connection_url ironic`
iniset $IRONIC_CONF_FILE DEFAULT state_path $IRONIC_STATE_PATH
iniset $IRONIC_CONF_FILE DEFAULT use_syslog $SYSLOG
# NOTE(vsaienko) with multinode each conductor should have its own host.
iniset $IRONIC_CONF_FILE DEFAULT host $LOCAL_HOSTNAME
# NOTE(TheJulia) Set a minimum amount of memory that is more in-line with
# OpenStack CI and the images deployed.
iniset $IRONIC_CONF_FILE DEFAULT minimum_required_memory 256
# Retrieve deployment logs
iniset $IRONIC_CONF_FILE agent deploy_logs_collect $IRONIC_DEPLOY_LOGS_COLLECT
iniset $IRONIC_CONF_FILE agent deploy_logs_storage_backend $IRONIC_DEPLOY_LOGS_STORAGE_BACKEND
iniset $IRONIC_CONF_FILE agent deploy_logs_local_path $IRONIC_DEPLOY_LOGS_LOCAL_PATH
# Allow ironic to set permissions for the tftp test usage.
iniset $IRONIC_CONF_FILE pxe dir_permission 493
# Set image_download_source for direct interface
if [[ -n "$IRONIC_AGENT_IMAGE_DOWNLOAD_SOURCE" ]]; then
iniset $IRONIC_CONF_FILE agent image_download_source $IRONIC_AGENT_IMAGE_DOWNLOAD_SOURCE
fi
# Configure JSON RPC backend
iniset $IRONIC_CONF_FILE DEFAULT rpc_transport $IRONIC_RPC_TRANSPORT
iniset $IRONIC_CONF_FILE json_rpc port $IRONIC_JSON_RPC_PORT
if [[ "$IRONIC_JSON_RPC_AUTH_STRATEGY" != "" ]]; then
iniset $IRONIC_CONF_FILE json_rpc auth_strategy $IRONIC_JSON_RPC_AUTH_STRATEGY
fi
if [[ "$IRONIC_JSON_RPC_AUTH_STRATEGY" == "http_basic" ]]; then
iniset $IRONIC_CONF_FILE json_rpc username myName
iniset $IRONIC_CONF_FILE json_rpc password myPassword
# json-rpc auth file with bcrypt hash of myPassword
echo 'myName:$2y$05$lE3eGtyj41jZwrzS87KTqe6.JETVCWBkc32C63UP2aYrGoYOEpbJm' > /etc/ironic/htpasswd-json-rpc
fi
if [[ "$IRONIC_JSON_RPC_AUTH_STRATEGY" == "" ]] || [[ "$IRONIC_JSON_RPC_AUTH_STRATEGY" == "keystone" ]]; then
configure_client_for json_rpc
fi
if [[ "$IRONIC_ENFORCE_SCOPE" == "False" ]]; then
iniset $IRONIC_CONF_FILE oslo_policy enforce_scope false
iniset $IRONIC_CONF_FILE oslo_policy enforce_new_defaults false
else
# NOTE(TheJulia): In devstack, services by default get service role
# accounts in a service project. Under normal circumstances, they
# need to be able to have elevated access if not explicitly
# configured for a system scoped account.
iniset $IRONIC_CONF_FILE DEFAULT rbac_service_role_elevated_access true
fi
if [[ "${SERVICE_PROJECT_NAME:-service}" != "service" ]]; then
iniset $IRONIC_CONF_FILE DEFAULT rbac_service_project_name $SERVICE_PROJECT_NAME
fi
# Set fast track options
iniset $IRONIC_CONF_FILE deploy fast_track $IRONIC_DEPLOY_FAST_TRACK
if is_service_enabled swift && [[ "$SWIFT_ENABLE_TEMPURLS" == "True" ]]; then
iniset $IRONIC_CONF_FILE deploy configdrive_use_object_store True
fi
# No need to check if RabbitMQ is enabled, this call does it in a smart way
if [[ "$IRONIC_RPC_TRANSPORT" == "oslo" ]]; then
iniset_rpc_backend ironic $IRONIC_CONF_FILE
fi
# Configure Ironic conductor, if it was enabled.
if is_service_enabled ir-cond; then
configure_ironic_conductor
fi
# Configure Ironic API, if it was enabled.
if is_service_enabled ir-api; then
configure_ironic_api
fi
# Configure Ironic noVNC proxy, if it was enabled.
if is_service_enabled ir-novnc; then
configure_ironic_novnc
fi
# Format logging
setup_logging $IRONIC_CONF_FILE
# Adds ironic site for IPXE and direct deploy
if is_http_server_required; then
_config_ironic_apache_additions
fi
# Adds uWSGI for Ironic API
write_uwsgi_config "$IRONIC_UWSGI_CONF" "$IRONIC_UWSGI" "/baremetal" "" "ironic-api"
if [[ "$os_VENDOR" =~ (Debian|Ubuntu) ]]; then
# The groups change with newer libvirt. Older Ubuntu used
# 'libvirtd', but now uses libvirt like Debian. Do a quick check
# to see if libvirtd group already exists to handle grenade's case.
LIBVIRT_GROUP=$(cut -d ':' -f 1 /etc/group | grep 'libvirtd$' || true)
LIBVIRT_GROUP=${LIBVIRT_GROUP:-libvirt}
else
LIBVIRT_GROUP=libvirtd
fi
if ! getent group $LIBVIRT_GROUP >/dev/null; then
sudo groupadd $LIBVIRT_GROUP
fi
# NOTE(vsaienko) Add stack to libvirt group when installing without nova.
if ! is_service_enabled nova; then
# Disable power state change callbacks to nova.
iniset $IRONIC_CONF_FILE nova send_power_notifications false
add_user_to_group $STACK_USER $LIBVIRT_GROUP
# This is the basic set of devices allowed / required by all virtual machines.
# Add /dev/net/tun to cgroup_device_acl, needed for type=ethernet interfaces
if ! sudo grep -q '^cgroup_device_acl' /etc/libvirt/qemu.conf; then
cat <<EOF | sudo tee -a /etc/libvirt/qemu.conf
cgroup_device_acl = [
"/dev/null", "/dev/full", "/dev/zero",
"/dev/random", "/dev/urandom",
"/dev/ptmx", "/dev/kvm", "/dev/kqemu",
"/dev/rtc", "/dev/hpet","/dev/net/tun",
"/dev/vfio/vfio",
]
EOF
restart_libvirt
fi
# Standalone jobs may use some different paths, that is okay
iniset $IRONIC_CONF_FILE conductor file_url_allowed_paths /var/lib/ironic,/shared/html,/templates,/opt/cache/files,/vagrant,/opt/stack/ironic
fi
if [[ "$IRONIC_IS_HARDWARE" == "False" ]]; then
if is_deployed_by_ipmi; then
configure_virtualbmc
start_virtualbmc
fi
if is_deployed_by_snmp; then
configure_virtualpdu
start_virtualpdu
fi
if is_deployed_by_redfish; then
configure_redfish
start_redfish
fi
fi
}
# configure_ironic_api() - Is used by configure_ironic(). Performs
# API specific configuration.
function configure_ironic_api {
iniset $IRONIC_CONF_FILE DEFAULT auth_strategy $IRONIC_AUTH_STRATEGY
configure_keystone_authtoken_middleware $IRONIC_CONF_FILE ironic
iniset $IRONIC_CONF_FILE keystone_authtoken service_token_roles_required True
iniset $IRONIC_CONF_FILE oslo_middleware enable_proxy_headers_parsing True
}
# configure_client_for() - is used by configure_ironic_conductor.
# Sets options to instantiate clients for other services
# single argument - config section to fill
function configure_client_for {
local service_config_section
service_config_section=$1
local use_system_scope="False"
# keystoneauth auth plugin options
iniset $IRONIC_CONF_FILE $service_config_section auth_type password
iniset $IRONIC_CONF_FILE $service_config_section auth_url $KEYSTONE_SERVICE_URI
# NOTE(TheJulia): Below are services which we know, as of late 2021, which support
# explicit scope based ops *and* have knobs.
if [[ "$service_config_section" == "inspector" ]] && [[ "$IRONIC_INSPECTOR_ENFORCE_SCOPE" == "True" ]]; then
use_system_scope="True"
fi
if [[ "$use_system_scope" == "True" ]]; then
iniset $IRONIC_CONF_FILE $service_config_section system_scope all
iniset $IRONIC_CONF_FILE $service_config_section username admin
iniset $IRONIC_CONF_FILE $service_config_section password $ADMIN_PASSWORD
else
iniset $IRONIC_CONF_FILE $service_config_section username ironic
iniset $IRONIC_CONF_FILE $service_config_section password $SERVICE_PASSWORD
iniset $IRONIC_CONF_FILE $service_config_section project_name $SERVICE_PROJECT_NAME
iniset $IRONIC_CONF_FILE $service_config_section project_domain_id default
fi
iniset $IRONIC_CONF_FILE $service_config_section user_domain_id default
# keystoneauth session options
iniset $IRONIC_CONF_FILE $service_config_section cafile $SSL_BUNDLE_FILE
# keystoneauth adapter options
# NOTE(pas-ha) relying on defaults for valid_interfaces being "internal,public" in ironic
iniset $IRONIC_CONF_FILE $service_config_section region_name $REGION_NAME
}
# configure_ironic_conductor() - Is used by configure_ironic().
# Sets conductor specific settings.
function configure_ironic_conductor {
# NOTE(pas-ha) service_catalog section is used to discover
# ironic API endpoint from keystone catalog
local client_sections="neutron swift glance inspector cinder service_catalog nova"
for conf_section in $client_sections; do
configure_client_for $conf_section
done
# set up drivers / hardware types
iniset $IRONIC_CONF_FILE DEFAULT enabled_hardware_types $IRONIC_ENABLED_HARDWARE_TYPES
iniset $IRONIC_CONF_FILE conductor automated_clean $IRONIC_AUTOMATED_CLEAN_ENABLED
# configure enabled and default interfaces
local iface
local iface_var
local iface_uppercase
local default_iface_var
for iface in ${IRONIC_DRIVER_INTERFACE_TYPES}; do
iface_uppercase="${iface^^}"
iface_var="IRONIC_ENABLED_${iface_uppercase}_INTERFACES"
iniset $IRONIC_CONF_FILE DEFAULT enabled_${iface}_interfaces ${!iface_var}
default_iface_var="IRONIC_DEFAULT_${iface_uppercase}_INTERFACE"
if [[ -n "${!default_iface_var}" ]]; then
if [[ ! "${!iface_var}" =~ ${!default_iface_var} ]]; then
die $LINENO "Default interface set for ${iface} interface is not enabled."
fi
iniset $IRONIC_CONF_FILE DEFAULT default_${iface}_interface ${!default_iface_var}
fi
done
if is_deployed_by_snmp; then
iniset $IRONIC_CONF_FILE pxe enable_netboot_fallback True
fi
if is_ansible_deploy_enabled; then
if is_ansible_with_tinyipa; then
if [[ ! -f $IRONIC_ANSIBLE_SSH_KEY ]]; then
# generate ssh key if absent as we will rebuild the ramdisk
# TODO(pas-ha) make it work for multi-node DevStack:
# - generate outside of this script
# - pass path in as $IRONIC_ANSIBLE_SSH_KEY
# - distribute private key to subnodes under the same path
# Similar to what we do for n-g-s, may be even reuse its key.
ssh-keygen -t rsa -N '' -f $IRONIC_ANSIBLE_SSH_KEY
chmod 600 $IRONIC_ANSIBLE_SSH_KEY
fi
if [[ -z $IRONIC_ANSIBLE_SSH_USER ]]; then
# we definitely know the default username to use for TinyIPA image
IRONIC_ANSIBLE_SSH_USER='devuser'
fi
# (rpittau) most recent tinyipa uses python3 natively so we need to change
# the default ansible python interpreter.
iniset $IRONIC_CONF_FILE ansible default_python_interpreter /usr/bin/python3
fi
iniset $IRONIC_CONF_FILE ansible default_key_file $IRONIC_ANSIBLE_SSH_KEY
if [[ -n $IRONIC_ANSIBLE_SSH_USER ]]; then
iniset $IRONIC_CONF_FILE ansible default_username $IRONIC_ANSIBLE_SSH_USER
fi
# TODO(pas-ha) find a way to include the CA bundle into the image during rebuild,
# at least for the tinyipa ramdisk
iniset $IRONIC_CONF_FILE ansible image_store_insecure "True"
fi
if [[ -n $IRONIC_LOADER_PATHS ]]; then
iniset $IRONIC_CONF_FILE pxe loader_file_paths $IRONIC_LOADER_PATHS
fi
iniset $IRONIC_CONF_FILE service_catalog endpoint_override "$IRONIC_SERVICE_PROTOCOL://$([[ $IRONIC_HTTP_SERVER =~ : ]] && echo "[$IRONIC_HTTP_SERVER]" || echo $IRONIC_HTTP_SERVER)/baremetal"
if [[ -n "$IRONIC_CALLBACK_TIMEOUT" ]]; then
iniset $IRONIC_CONF_FILE conductor deploy_callback_timeout $IRONIC_CALLBACK_TIMEOUT
fi
if [[ "$IRONIC_IP_VERSION" == "6" ]]; then
iniset $IRONIC_CONF_FILE pxe tftp_server $IRONIC_HOST_IPV6
else
iniset $IRONIC_CONF_FILE pxe tftp_server $IRONIC_TFTPSERVER_IP
fi
iniset $IRONIC_CONF_FILE pxe tftp_root $IRONIC_TFTPBOOT_DIR
iniset $IRONIC_CONF_FILE pxe tftp_master_path $IRONIC_TFTPBOOT_DIR/master_images
if [[ -n "$IRONIC_PXE_BOOT_RETRY_TIMEOUT" ]]; then
iniset $IRONIC_CONF_FILE pxe boot_retry_timeout $IRONIC_PXE_BOOT_RETRY_TIMEOUT
fi
if [[ "$IRONIC_TERMINAL_SSL" == "True" ]]; then
# Make sure the cert directory exist
sudo mkdir -p $IRONIC_TERMINAL_CERT_DIR
sudo chown $STACK_USER $IRONIC_TERMINAL_CERT_DIR
iniset $IRONIC_CONF_FILE console terminal_cert_dir $IRONIC_TERMINAL_CERT_DIR
# Generate the SSL certificate
openssl req \
-x509 \
-days 365 \
-newkey rsa:1024 \
-nodes \
-keyout $IRONIC_TERMINAL_CERT_DIR/certificate.pem.key \
-out $IRONIC_TERMINAL_CERT_DIR/certificate.pem \
-subj '/O=OpenStack/OU=DevStack Servers'
fi
local pxe_params="nofb console=${IRONIC_TTY_DEV}"
pxe_params+=" systemd.journald.forward_to_console=yes"
if is_service_enabled tls-proxy; then
pxe_params+=" ipa-insecure=1"
fi
pxe_params+=" $IRONIC_EXTRA_PXE_PARAMS"
if [[ -n "$pxe_params" ]]; then
iniset $IRONIC_CONF_FILE pxe kernel_append_params "$pxe_params"
fi
local kernel_append_params="nofb console=${IRONIC_TTY_DEV}"
kernel_append_params+=" systemd.journald.forward_to_console=yes"
# NOTE(dtantsur): avoid setting ipa-insecure for redfish, we have a way to
# pass the TLS certificate.
iniset $IRONIC_CONF_FILE redfish kernel_append_params "$kernel_append_params"
if is_service_enabled tls-proxy; then
deploy_int_CA "$IRONIC_STATE_PATH/ironic-ca.pem"
iniset $IRONIC_CONF_FILE agent api_ca_file "$IRONIC_STATE_PATH/ironic-ca.pem"
fi
# Set these options for scenarios in which the agent fetches the image
# directly from glance, and don't set them where the image is pushed
# over iSCSI.
if is_glance_configuration_required; then
if [[ "$SWIFT_ENABLE_TEMPURLS" == "False" ]] ; then
die $LINENO "SWIFT_ENABLE_TEMPURLS must be True. This is " \
"required either because " \
"IRONIC_AGENT_IMAGE_DOWNLOAD_SOURCE was set to swift " \
"OR configuration of Glance with Swift was explicitly " \
"requested with IRONIC_CONFIGURE_GLANCE_WITH_SWIFT=True"
fi
iniset $IRONIC_CONF_FILE glance swift_temp_url_duration 3600
fi
if is_deployed_by_agent; then
iniset $IRONIC_CONF_FILE api ramdisk_heartbeat_timeout 30
fi
# FIXME: this really needs to be tested in the gate. For now, any
# test using the agent ramdisk should skip the erase_devices clean
# step because it is too slow to run in the gate.
iniset $IRONIC_CONF_FILE deploy erase_devices_priority 0
if is_http_server_required; then
iniset $IRONIC_CONF_FILE deploy http_root $IRONIC_HTTP_DIR
iniset $IRONIC_CONF_FILE deploy http_url "http://$([[ $IRONIC_HTTP_SERVER =~ : ]] && echo "[$IRONIC_HTTP_SERVER]" || echo $IRONIC_HTTP_SERVER):$IRONIC_HTTP_PORT"
fi
if [[ "$IRONIC_IPXE_USE_SWIFT" == "True" ]]; then
iniset $IRONIC_CONF_FILE pxe ipxe_use_swift True
fi
if [[ "$IRONIC_IS_HARDWARE" == "False" ]]; then
iniset $IRONIC_CONF_FILE neutron port_setup_delay 15
fi
iniset $IRONIC_CONF_FILE dhcp dhcp_provider $IRONIC_DHCP_PROVIDER
isolinux=$(find -L /usr -type f -name "isolinux.bin" | head -1)
if [[ -n "$isolinux" ]]; then
iniset $IRONIC_CONF_FILE DEFAULT isolinux_bin "$isolinux"
fi
configure_inspection
}
# configure_inspection() - Set up in-band inspection
function configure_inspection {
local allow_unmanaged="$IRONIC_UNMANAGED_INSPECTION"
# Note: IRONIC_INSPECTOR_MANAGED_BOOT is defined in the ironic-inspector's devstack plugin
if [[ "$IRONIC_ENABLED_INSPECT_INTERFACES" =~ inspector ]] && [[ "${IRONIC_INSPECTOR_MANAGED_BOOT:-False}" != True ]]; then
allow_unmanaged=True
fi
if [[ "$allow_unmanaged" == False ]]; then
iniset "$IRONIC_CONF_FILE" inspector require_managed_boot True
fi
}
# configure_ironic_novnc() - Is used by configure_ironic(). Performs
# noVNC proxy specific configuration.
function configure_ironic_novnc {
local service_port=$IRONIC_NOVNCPROXY_PORT
# TODO(stevebaker) handle configuring tls-proxy
local service_protocol=http
# TODO(stevebaker) check for existence of vnc_lite.html vs vnc_auto.html
# from older NoVNC releases
novnc_url=$service_protocol://$SERVICE_HOST:$service_port/vnc_lite.html
iniset $IRONIC_CONF_FILE vnc enabled True
iniset $IRONIC_CONF_FILE vnc public_url $novnc_url
iniset $IRONIC_CONF_FILE vnc host_ip $SERVICE_HOST
iniset $IRONIC_CONF_FILE vnc port $service_port
iniset $IRONIC_CONF_FILE vnc novnc_web $NOVNC_WEB_DIR
iniset $IRONIC_CONF_FILE vnc container_provider systemd
iniset $IRONIC_CONF_FILE vnc console_image localhost/ironic-vnc-container
}
# create_ironic_cache_dir() - Part of the init_ironic() process
function create_ironic_cache_dir {
# Create cache dir
sudo mkdir -p $IRONIC_AUTH_CACHE_DIR/api
sudo chown $STACK_USER $IRONIC_AUTH_CACHE_DIR/api
rm -f $IRONIC_AUTH_CACHE_DIR/api/*
sudo mkdir -p $IRONIC_AUTH_CACHE_DIR/registry
sudo chown $STACK_USER $IRONIC_AUTH_CACHE_DIR/registry
rm -f $IRONIC_AUTH_CACHE_DIR/registry/*
}
# create_systemd_container_dir() - Part of the init_ironic() process
function create_systemd_container_dir {
local uid=$(id -u)
local user_dir=/etc/containers/systemd/users/$uid
if [ ! -d "$user_dir" ]; then
sudo mkdir -p $user_dir
sudo chown $STACK_USER $user_dir
# container files have BMC credentials, limit non stack user
sudo chmod 0750 $user_dir
fi
}
# create_ironic_accounts() - Set up common required ironic accounts
# Project User Roles
# ------------------------------------------------------------------
# service ironic admin
# service nova baremetal_admin # Legacy, Pre-SRBAC effort
# demo demo baremetal_observer # Legacy, Pre-SRBAC effort
function create_ironic_accounts {
if [[ "$ENABLED_SERVICES" =~ "ir-api" && "$ENABLED_SERVICES" =~ "key" ]]; then
# Define service and endpoints in Keystone
get_or_create_service "ironic" "baremetal" "Ironic baremetal provisioning service"
get_or_create_endpoint "baremetal" \
"$REGION_NAME" \
"$IRONIC_SERVICE_PROTOCOL://$IRONIC_HOSTPORT"
# Create ironic service user
# TODO(tenbrae): make this work with the 'service' role
# https://bugs.launchpad.net/ironic/+bug/1605398
create_service_user "ironic" "admin"
# Create additional bare metal tenant and roles
# TODO(TheJulia): Remove when we remove the legacy RBAC policies.
get_or_create_role baremetal_admin
get_or_create_role baremetal_observer
if is_service_enabled nova; then
get_or_add_user_project_role baremetal_admin nova $SERVICE_PROJECT_NAME
fi
get_or_add_user_project_role baremetal_observer demo demo
fi
}
# init_ironic() - Initialize databases, etc.
function init_ironic {
if [[ "$HOST_TOPOLOGY_ROLE" != "subnode" ]]; then
# (Re)create ironic database
recreate_database ironic
# Migrate ironic database
$IRONIC_BIN_DIR/ironic-dbsync --config-file=$IRONIC_CONF_FILE
fi
create_ironic_cache_dir
# NOTE(rloo): We're not upgrading but want to make sure this command works,
# even though we're not parsing the output of this command.
$IRONIC_BIN_DIR/ironic-status upgrade check
$IRONIC_BIN_DIR/ironic-status upgrade check && ret_val=$? || ret_val=$?
if [ $ret_val -gt 1 ] ; then
die $LINENO "The `ironic-status upgrade check` command returned an error. Cannot proceed."
fi
if is_service_enabled ir-novnc; then
create_systemd_container_dir
fi
}
# _ironic_bm_vm_names() - Generates list of names for baremetal VMs.
function _ironic_bm_vm_names {
local idx
local num_vms
num_vms=$(($IRONIC_VM_COUNT - 1))
for idx in $(seq 0 $num_vms); do
echo "$(get_ironic_node_prefix)-${idx}"
done
}
# start_ironic() - Start running processes, including screen
function start_ironic {
# Start Ironic API server, if enabled.
if is_service_enabled ir-api; then
start_ironic_api
fi
# Start Ironic conductor, if enabled.
if is_service_enabled ir-cond; then
start_ironic_conductor
fi
# Start Ironic noVNC proxy server, if enabled.
if is_service_enabled ir-novnc; then
start_ironic_novnc
fi
# Start Apache if iPXE or agent+http is enabled
if is_http_server_required; then
restart_apache_server
fi
}
# start_ironic_api() - Used by start_ironic().
# Starts Ironic API server.
function start_ironic_api {
local service_port=$IRONIC_SERVICE_PORT
local service_protocol=$IRONIC_SERVICE_PROTOCOL
local ironic_url
# Get right service port for testing
if is_service_enabled tls-proxy; then
service_port=$IRONIC_SERVICE_PORT_INT
service_protocol="http"
fi
run_process "ir-api" "$(which uwsgi) --procname-prefix ironic-api --ini $IRONIC_UWSGI_CONF"
ironic_url=$service_protocol://$SERVICE_HOST/baremetal
echo "Waiting for ir-api ($ironic_url) to start..."
if ! timeout $SERVICE_TIMEOUT sh -c "while ! wget --no-proxy -q -O- $ironic_url; do sleep 1; done"; then
die $LINENO "ir-api did not start"
fi
if is_service_enabled tls-proxy; then
start_tls_proxy ironic '*' $IRONIC_SERVICE_PORT $SERVICE_HOST $IRONIC_SERVICE_PORT_INT
fi
}
# start_ironic_conductor() - Used by start_ironic().
# Starts Ironic conductor.
function start_ironic_conductor {
# NOTE(stevebaker) set DBUS_SESSION_BUS_ADDRESS so that systemd calls can be made
# for the systemd console container provider.
run_process ir-cond "$IRONIC_BIN_DIR/ironic-conductor --config-file=$IRONIC_CONF_FILE" "" "" "DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/$UID/bus"
# Unset variables which we shouldn't have... Grenade resets these :\
# in grenade/projects/60_nova/resources.sh as part of the resource
# creation tests.
unset OS_TENANT_NAME
unset OS_USERNAME
unset OS_PROJECT_NAME
unset OS_PASSWORD
# Wait up to 30 seconds for ironic-conductor to start and register itself
local attempt
local max_attempts=7
for attempt in $(seq 1 $max_attempts); do
if openstack --os-cloud $IRONIC_OS_CLOUD baremetal driver list | grep -q $IRONIC_DEPLOY_DRIVER; then
break
fi
if [ $attempt -eq $max_attempts ]; then
die $LINENO "Driver $IRONIC_DEPLOY_DRIVER did not appear in the driver list"
fi
echo "Still waiting for ironic-conductor to start, current state:"
openstack --os-cloud $IRONIC_OS_CLOUD baremetal driver list
sleep 5
done
}
# start_ironic_novnc() - Used by start_ironic().
# Starts Ironic noVNC proxy server.
function start_ironic_novnc {
run_process ir-novnc "$IRONIC_BIN_DIR/ironic-novncproxy --config-file=$IRONIC_CONF_FILE"
# TODO(stevebaker) confirm the web server is returning content
}
# stop_ironic() - Stop running processes
function stop_ironic {
stop_process ir-api
stop_process ir-cond
stop_process ir-novnc
stop_process ir-sw-sim
}
# create_ovs_taps is also called by the devstack/upgrade/resources.sh script
#
# create_ovs_taps ironic_network_id
# NOTE(vsaienko) Ironic supports only Flat Neutron network.
# create_ovs_taps are needed in order to provide connectivity from ironic-conductor
# to VM. With Neutron Flat network it will be not needed.
function create_ovs_taps {
local ironic_net_id
ironic_net_id=$1
die_if_not_set $LINENO ironic_net_id "Failed to get ironic network id"
# Work around: No netns exists on host until a Neutron port is created. We
# need to create one in Neutron to know what netns to tap into prior to the
# first node booting.
if [[ "$Q_AGENT" != "ovn" ]]; then
# NOTE(TheJulia): So.. Neutron doesn't allow a port to be created as a
# system scoped admin, which makes sense.
local port_id
port_id=$(openstack --os-cloud devstack-admin port create --network ${ironic_net_id} temp_port -c id -f value)
die_if_not_set $LINENO port_id "Failed to create neutron port"
local tapdev
local tapdev_cmd="sudo ip netns exec qdhcp-${ironic_net_id} ip link list | grep ' tap' | cut -d':' -f2 | cut -d'@' -f1 | cut -b2- | grep '^tap'"
# retry tap device discovery to make sure the tag has been set to port
tapdev=$(test_with_retry "$tapdev_cmd" "Failed to get tap device id" 20 1)
local tag_id
tag_id=$(sudo ovs-vsctl get port ${tapdev} tag)
die_if_not_set $LINENO tag_id "Failed to get tag id"
# Remove the port needed only for workaround.
openstack --os-cloud $OS_CLOUD port delete $port_id
else
# ovs-vsctl set Open_vSwitch . external-ids:ovn-cms-options=\"enable-chassis-as-gw\"
# should already be set -> external-ids:ovn-bridge-mappings=\"public:br-ex\"
# so the tl;dr is that the tag in this port, based on ovn config
# may be something like 841 on public, which in default devstack is
# br-ex. We don't care though, it is a vlan tag and previously we
# just used the integration bridge to make the connection with the
# tag. Basically the same.
# NOTE(TheJulia): Show the network data to ease troubleshooting,
# Normally, this will be the private network for devstack.
tag_id=$(openstack --os-cloud $OS_CLOUD network show $ironic_net_id -c "provider:segmentation_id" -f value)
die_if_not_set $LINENO tag_id "Failed to get tag id"
fi
local ovs_tap=ovs-tap
local brbm_tap=brbm-tap
# make sure veth pair is not existing, otherwise delete its links
sudo ip link show $ovs_tap && sudo ip link delete $ovs_tap
sudo ip link show $brbm_tap && sudo ip link delete $brbm_tap
# create veth pair for future interconnection between br-int and brbm
sudo ip link add $brbm_tap type veth peer name $ovs_tap
sudo ip link set dev $brbm_tap up
sudo ip link set dev $ovs_tap up
sudo ip link set dev br-int up
sudo ip link set dev br-ex up
# What is happening here:
# We are taking the vlan tag ID which is reserved, and physically cross connecting
# it over to be available on $ovs_tap, which later on would be bound to $brbm_tap,
# better known as brbm. If we're doing *anything* else for VM networking, we need
# to wire this all up differently.
if [[ "$Q_AGENT" != "ovn" ]]; then
sudo ovs-vsctl -- --if-exists del-port $ovs_tap -- add-port br-int $ovs_tap tag=$tag_id
else
# OVN defaults to everything on "public" which is br-ex
sudo ovs-vsctl -- --if-exists del-port $ovs_tap -- add-port br-ex $ovs_tap tag=$tag_id
fi
if [[ "${IRONIC_NETWORK_SIMULATOR:-ovs}" == "ovs" ]]; then
# This binds the $brbm_tap to the $IRONIC_VM_NETWORK_BRIDGE (typically brbm)
sudo ovs-vsctl -- --if-exists del-port $brbm_tap -- add-port $IRONIC_VM_NETWORK_BRIDGE $brbm_tap
fi
# In the event this doesn't match, then the physical network bridge is not attached
# And nodes *must* be attached somehow, but not inhernetly directly by default.
# Finally, share the fixed tenant network across all tenants. This allows the host
# to serve TFTP to a single network namespace via the tap device created above.
openstack --os-cloud $OS_CLOUD network set $ironic_net_id --share
}
function setup_qemu_log_hook {
# Make sure the libvirt hooks directory exist
sudo mkdir -p $IRONIC_LIBVIRT_HOOKS_PATH
# Copy the qemu hook to the right directory
sudo cp $IRONIC_DEVSTACK_FILES_DIR/hooks/qemu.py $IRONIC_LIBVIRT_HOOKS_PATH/qemu
sudo chmod -v +x $IRONIC_LIBVIRT_HOOKS_PATH/qemu
sudo sed -e "
s|%LOG_DIR%|$IRONIC_VM_LOG_DIR|g;
" -i $IRONIC_LIBVIRT_HOOKS_PATH/qemu
restart_libvirt
mkdir -p $IRONIC_VM_LOG_DIR
cat >${IRONIC_VM_LOG_DIR}/README << EOF
This directory contains the serial console log files from the virtual Ironic
bare-metal nodes. The *_console_* log files are the original log files and
include ANSI control codes which can make the output difficult to read. The
*_no_ansi_* log files have had ANSI control codes removed from the file and are
easier to read.
On some occasions there won't be a corresponding *_no_ansi_* log file, for
example if the job failed due to a time-out. You may see a log file without a
date/time in the file name. In that case you can display the logfile in your
console by doing:
$ curl URL_TO_LOGFILE
This will have your terminal process the ANSI escape codes.
Another option, if you have the 'pv' executable installed, is to simulate a
low-speed connection. In this example simulate a 300 Bytes/second connection.
$ curl URL_TO_LOGFILE | pv -q -L 300
This can allow you to see some of the content before the screen is cleared by
an ANSI escape sequence.
EOF
}
function initialize_libvirt_storage_pool {
[ -d $LIBVIRT_STORAGE_POOL_PATH ] || sudo mkdir -p $LIBVIRT_STORAGE_POOL_PATH
if ! sudo virsh pool-list --all | grep -q $LIBVIRT_STORAGE_POOL; then
sudo virsh pool-define-as --name $LIBVIRT_STORAGE_POOL dir \
--target $LIBVIRT_STORAGE_POOL_PATH >&2
sudo virsh pool-autostart $LIBVIRT_STORAGE_POOL >&2
sudo virsh pool-start $LIBVIRT_STORAGE_POOL >&2
fi
pool_state=$(sudo virsh pool-info $LIBVIRT_STORAGE_POOL | grep State | awk '{ print $2 }')
if [ "$pool_state" != "running" ] ; then
sudo virsh pool-start $LIBVIRT_STORAGE_POOL >&2
fi
}
function create_bridge_and_vms {
if [[ "${IRONIC_NETWORK_SIMULATOR:-ovs}" == "ovs" ]]; then
# Call libvirt setup scripts in a new shell to ensure any new group membership
sudo su $STACK_USER -c "$IRONIC_SCRIPTS_DIR/setup-network.sh $IRONIC_VM_NETWORK_BRIDGE $PUBLIC_BRIDGE_MTU ${IRONIC_NETWORK_SIMULATOR:-ovs}"
fi
if [[ "$IRONIC_VM_LOG_CONSOLE" == "True" ]] ; then
local log_arg="-l $IRONIC_VM_LOG_DIR"
if [[ "$IRONIC_VM_LOG_ROTATE" == "True" ]] ; then
setup_qemu_log_hook
fi
else
local log_arg=""
fi
if [ -x /etc/redhat-release ]; then
# We're on a rhel-ey distro, and default permissions
# restrict other users from reading these artifacts by
# default which prevents VMs from launching.
sudo chmod +r /var/lib/libvirt/images
fi
local vbmc_port=$IRONIC_VBMC_PORT_RANGE_START
local pdu_outlet=$IRONIC_VPDU_PORT_RANGE_START
local vm_name
local vm_opts=""
if [[ -n "$IRONIC_VM_EMULATOR" ]]; then
vm_opts+=" -e $IRONIC_VM_EMULATOR"
fi
vm_opts+=" -E $IRONIC_VM_ENGINE"
if [[ "$IRONIC_BOOT_MODE" == "uefi" ]]; then
vm_opts+=" -L $UEFI_LOADER_PATH -N $UEFI_NVRAM_PATH"
fi
if [[ -n "$LIBVIRT_NIC_DRIVER" ]]; then
vm_opts+=" -D $LIBVIRT_NIC_DRIVER"
elif [[ "$IRONIC_BOOT_MODE" == "uefi" ]]; then
# Note(derekh) UEFI for the moment doesn't work with the e1000 net driver
vm_opts+=" -D virtio"
fi
initialize_libvirt_storage_pool
local bridge_mac
bridge_mac=$(ip link show dev $IRONIC_VM_NETWORK_BRIDGE | grep -Eo "ether [A-Za-z0-9:]+"|sed "s/ether\ //")
for vm_name in $(_ironic_bm_vm_names); do
# pick up the $LIBVIRT_GROUP we have possibly joint
newgrp $LIBVIRT_GROUP <<SUBSHELL
$IRONIC_SCRIPTS_DIR/create-node.sh -n $vm_name \
-c $IRONIC_VM_SPECS_CPU -m $IRONIC_VM_SPECS_RAM -d $IRONIC_VM_SPECS_DISK \
-a $IRONIC_HW_ARCH -b $IRONIC_VM_NETWORK_BRIDGE $vm_opts -p $vbmc_port -o $pdu_outlet \
-i $IRONIC_VM_INTERFACE_COUNT -f $IRONIC_VM_SPECS_DISK_FORMAT -M $PUBLIC_BRIDGE_MTU $log_arg \
-v $IRONIC_VM_VOLUME_COUNT -P $LIBVIRT_STORAGE_POOL \
-t $IRONIC_MACHINE_TYPE -B $IRONIC_VM_BLOCK_SIZE \
-s ${IRONIC_NETWORK_SIMULATOR:-ovs} >> $IRONIC_VM_MACS_CSV_FILE
SUBSHELL
if is_deployed_by_ipmi; then
vbmc --no-daemon add $vm_name --port $vbmc_port
vbmc --no-daemon start $vm_name
fi
echo " ${bridge_mac} $IRONIC_VM_NETWORK_BRIDGE" >> $IRONIC_VM_MACS_CSV_FILE
vbmc_port=$((vbmc_port+1))
pdu_outlet=$((pdu_outlet+1))
# It is sometimes useful to dump out the VM configuration to validate it.
sudo virsh dumpxml $vm_name
done
if [[ -z "${IRONIC_PROVISION_NETWORK_NAME}" ]]; then
local ironic_net_id
ironic_net_id=$(openstack --os-cloud $OS_CLOUD network show "$PRIVATE_NETWORK_NAME" -c id -f value)
create_ovs_taps $ironic_net_id
# NOTE(vsaienko) Neutron no longer setup routing to private network.
# https://github.com/openstack-dev/devstack/commit/1493bdeba24674f6634160d51b8081c571df4017
# Add route here to have connection to VMs during provisioning.
local pub_router_id
local r_net_gateway
local dns_server
local replace_range
if [[ "$IRONIC_IP_VERSION" == '4' ]]; then
dns_server="8.8.8.8"
if [[ -z "${SUBNETPOOL_V4_ID}" ]]; then
replace_range=${FIXED_RANGE}
else
replace_range=${SUBNETPOOL_PREFIX_V4}
fi
else
dns_server="2001:4860:4860::8888"
if [[ -z "${SUBNETPOOL_V6_ID}" ]]; then
replace_range=${FIXED_RANGE_V6}
else
replace_range=${SUBNETPOOL_PREFIX_V6}
fi
fi
if [[ "$Q_AGENT" != "ovn" ]]; then
pub_router_id=$(openstack --os-cloud $OS_CLOUD router show $Q_ROUTER_NAME -f value -c id)
# Select the text starting at "src ", and grabbing the following field.
r_net_gateway=$(sudo ip netns exec qrouter-$pub_router_id ip -$IRONIC_IP_VERSION route get $dns_server |grep dev | sed s/^.*src\ // |awk '{ print $1 }')
sudo ip route replace $replace_range via $r_net_gateway
else
openstack router set --disable-snat --external-gateway public $Q_ROUTER_NAME
# Need to handle the json dict we get from the API (yeah, wut?!)
# and transform that so jq can do the needful. We also can't store
# it as a variable in ram, otherwise bash tries to escape it.
# Example gw_info (wrapped for readability)
# {'network_id': '3caae040-c0ac-4e8a-883b-12470f3fdeae',
# 'external_fixed_ips': [
# {'subnet_id': 'a8b6641e-53e1-4156-aa2f-2cda79dd4f4a',
# 'ip_address': '172.24.5.36'},
# {'subnet_id': 'bddf41dc-47f6-4124-9afd-744fa7343320',
# 'ip_address': '2001:db8::4d'}], 'enable_snat': False}
# Transform to json jq can parse, which includes replacing Python
# boolean strings.
external_gw_v4=$(openstack router show $Q_ROUTER_NAME -c external_gateway_info -f json | jq -r .external_gateway_info.external_fixed_ips[0].ip_address)
sudo ip addr
sudo ip link set dev br-ex up || true
# This route is only used *if* we actually provision with a
# dedicated ironic provisioning network which does not *always*
# happen. i.e. job specific config.
mtu=$(($PUBLIC_BRIDGE_MTU - 30))
v4mss=$(($PUBLIC_BRIDGE_MTU - 40 ))
# FIXME(TheJulia): We have a conundrum with MTUs.
# 1) OVN mtu handling is not great
# (https://bugs.launchpad.net/neutron/+bug/2032817)
# 2) We previously restricted the MTU down 100 bytes for
# VXLAN tunnel overhead for multinode jobs. This sort
# of conflicts. If we use the stock public bridge mtu,
# We would likely be okay, in the grand scheme of the
# world, but until we figure out that path, we need
# to clamp things, for now.
# NOTE(TheJulia): v6mss should be -60 once it is supported.
# NOTE(TheJulia): The route commands below set *and* lock a
# default MTU (disable PMTU discovery) and sets an Maximum Segment
# Size to advertise for packets to be sent along the path. Normally
# it is derived from the outbound interface MTU, which is wrong in
# this scenario. We're tracking this as LP#2032817.
sudo ip route add $IRONIC_PROVISION_SUBNET_PREFIX via $external_gw_v4 mtu lock $mtu advmss $v4mss
# This is the default space fallback for all neutron networking,
# since this is only if we create a dedicated provisioning
# network in the job config.
sudo ip route add $IPV4_ADDRS_SAFE_TO_USE via $external_gw_v4 mtu lock $mtu advmss $v4mss
fi
fi
# Here is a good place to restart tcpdump to begin capturing packets.
# See: https://docs.openstack.org/devstack/latest/debugging.html
# stop_tcpdump
# start_tcpdump
if [[ "$IRONIC_IP_VERSION" == "6" ]]; then
# route us back through the neutron router!
sudo ip -6 route add $IRONIC_PROVISION_SUBNET_PREFIX via $IPV6_ROUTER_GW_IP
sudo ip link set dev br-ex up || true
# Route back to our test subnet. Static should be safe for a while.
sudo ip -6 route add fd00::/8 via $IPV6_ROUTER_GW_IP
fi
if [[ "${IRONIC_NETWORK_SIMULATOR:-ovs}" != "ovs" ]]; then
create_network_simulator
fi
} # End: create_bridge_and_vms
function create_network_simulator {
# Variables
local sim_trunk="sim-trunk"
local mgmt_int="sim-mgmt"
# *first* - Create the simulator. It needs to be bound to tap interfaces
create_network_simulator_vm $IRONIC_NETWORK_SIMULATOR $mgmt_int $sim_trunk
# *second* - Ensure our interfaces for the switch is up
# The VM Creation *creates* tap interfaces, which we then need to bind to.
sudo ip link set dev $sim_trunk up
sudo ip link set dev $mgmt_int up
# *third* - determine network bridge and attach that to the VM.
if [[ "$Q_AGENT" != "ovn" ]]; then
local network_bridge="br-int"
else
local network_bridge="br-ex"
fi
#
# Attach the trunk to a veth tap and all, and attach the whole thing.
sudo ovs-vsctl -- --if-exists del-port $sim_trunk -- add-port $network_bridge $sim_trunk
# Seems like br-infra might be right for the switch management access
sudo ovs-vsctl -- --if-exists del-port $mgmt_int -- add-port br-infra $mgmt_int
# *forth* - Join the rest of the interfaces
attach_switch_taps_to_vm_veth
# *fifth* - Apply NGS configuration
# This is done now because we can't do it earlier, as ngs gets pulled in
# and setup before ironic. So we will also need to restart neutron in this
# step to load the new configuration. This is actually for the best because
# you can't expect an operator to pre-configure neutron perfectly
# and the plugin needs to be able to handle "oh, I didn't know about that
# network cases as well.
configure_ngs_for_simulator
}
function configure_ngs_for_simulator {
# Ironic is using a network simulator which has been bolted into
# place. As such, configuration is going to be different, and we
# can begin configuring it from here.
if [ -f $DEST/networking-generic-switch/devstack/plugin.sh ]; then
source $DEST/networking-generic-switch/devstack/plugin.sh
fi
switch="genericswitch:$IRONIC_NETWORK_SIMULATOR"
case "$IRONIC_NETWORK_SIMULATOR" in
"force10_9")
switch_type="netmiko_dell_force10"
trunk_port="forty0/0"
switch_pass="admin_secret"
enable_pass=""
;;
"force10_10")
switch_type="netmiko_dell_os10"
trunk_port="ethernet1/1/1"
switch_pass="system_secret"
enable_pass=""
;;
"cisco_nexus9k")
switch_type="netmiko_cisco_nxos"
trunk_port="ethernet1/1"
switch_pass="system_s3cret!"
enable_pass=""
;;
sonic)
switch_type="netmiko_sonic"
trunk_port="Ethernet0"
switch_pass="YourPaSsWoRd"
enable_pass=""
;;
esac
# NOTE(TheJulia) This is for a dell force10 switch, and it may need
# to be broken up to be more in-line with per-type options.
add_generic_switch_to_ml2_config $switch "" admin 172.24.5.20 $switch_type "" "" "$switch_pass" "$enable_pass" "$trunk_port"
stop_neutron
# Start neutron and agents
start_neutron_service_and_check
start_neutron_agents
}
function attach_switch_taps_to_vm_veth {
# Count always starts at 2, since we pre-bind the switch interface
echo_summary "Creating bridges to bind the VM veths to the switch VM taps"
count=2
for i in $(ip link show up |cut -f1 -d "@" |grep "sim-node"|cut -f2 -d" "|cut -d":" -f1); do
local vm_int=$i
local sw_int=$( echo -n $i | sed s/sim/sw/ )
local sw_br_int="swbr-$count"
sudo ip link del dev $sw_br_int || true
sudo ip link add name $sw_br_int type bridge
sudo ip link set dev $sw_br_int up
sudo ip link set dev $vm_int up
sudo ip link set dev $sw_int up
sudo ip link set dev $vm_int master $sw_br_int
sudo ip link set dev $sw_int master $sw_br_int
count=$(( count + 1 ))
done
}
function create_network_simulator_vm {
# $1 is the simulator
# $2 is the management interface
# $3 is the network trunk
case $1 in
force10_9)
create_network_simulator_vm_force10_9 $2 $3
;;
force10_10)
create_network_simulator_vm_force10_10 $2 $3
;;
cisco_nexus9k)
create_network_simulator_vm_cisco_nexus $2 $3
;;
sonic)
create_network_simulator_vm_sonic $2 $3
;;
esac
}
function create_network_simulator_vm_force10_10 {
# Dell does not supply a easy to access download url for these assets.
# And blocks non-browsers from accessing the artifacts. So this requires
# some advance setup.
# 1) Download via https://www.dell.com/support/product-details/en-us/product/smartfabric-os10-emp-partner/drivers
# 2) Unzip files
# 3) Fix variables.
local base_image=/opt/stack/OS10_Virtualization_10.6.0.2.74V.zip
# Unzipping the package puts us in a clean state to get started.
unzip -d /opt/stack -o $base_image
local onie_disk=/opt/stack/OS10-Disk-1.0.0.vmdk
local installer_disk=/opt/stack/OS10-Installer-10.6.0.2.74.vmdk
local profile_disk=/opt/stack/OS10-platform-S5248F-10.6.0.2.74.vmdk
if ! test -f $onie_disk || ! test -f $installer_disk || ! test -f $profile_disk; then
die $LINENO "Failed to find required artifacts for Force 10 OS10 setup."
fi
# For extra context:
# * 4 GB of RAM
# * 2 vCPU
# * Must boot from ONIE disk as a SATA device, and all other devices must
# be attached as virtio devices for the installer to succeed.
# * BIOS mode/Q35 hardware.
# * e1000 for each port
# First port is mapped to management0/0
local emu_cmd="$IRONIC_VM_EMULATOR -boot order=b -enable-kvm -machine q35 -drive file=$onie_disk,id=diska,format=vmdk,if=none -device ich9-ahci,id=ahci -device ide-hd,drive=diska,bus=ahci.0 -drive file=$installer_disk,id=diskb,format=vmdk,if=none -device virtio-blk-pci,drive=diskb -drive file=$profile_disk,id=diskc,format=vmdk,if=none -device virtio-blk-pci,drive=diskc -m 4G -smp cpus=2 -display none -serial telnet:localhost:55001,server,nowait"
# Base interfaces, attaches the trunk and the management interfaces.
emu_cmd+=" -device e1000,netdev=net0 -netdev tap,id=net0,ifname=$1,script=no,downscript=no -device e1000,netdev=net1 -netdev tap,id=net1,ifname=$2,script=no,downscript=no,sndbuf=1048576"
# Get a list of links, cut everything *after* "@" since taps duplicate
# entries, limit to "sim-node" to match our nodes, and extract only
# the actual interface name.
local net_interface=2
for i in $(ip link show up |cut -f1 -d "@" |grep "sim-node"|cut -f2 -d" "|cut -d":" -f1|sed s/sim/sw/g); do
emu_cmd+=" -device e1000,netdev=net$net_interface -netdev tap,id=net$net_interface,ifname=$i,sndbuf=1048576"
net_interface=$(( net_interface + 1))
done
run_process ir-sw-sim "$emu_cmd" "root" "root"
# wait for the enable prompt
# Connect to localhost on 55001, wait 120 seconds to start,
# try 10 times, look for the "login prompt".
# Because we must start from a clean state, it takes the switch about
# 400-500 seconds to get into a deployed ready state.
wait_for_switch_prompt localhost 55001 500 10 "^OS10 login:" False
# NOTE(TheJulia): default credentials is admin/admin
# Start base configuration, but we also need to login and set a password
send_switch_config_line localhost 55001 "admin" # username
# This seems sufficient to wake up the VM's tty management service
sleep 6
send_switch_config_line localhost 55001 "admin" # username
send_switch_config_line localhost 55001 "admin" # password
# It takes a moment or six for the ability to execute the command shell to engage.
sleep 6
send_switch_config_line localhost 55001 "configure terminal"
# And it takes a moment for configuration mode to load...
sleep 2
# NOTE(TheJulia): Force10 OS doesn't let admin be in the password.
# Also, once this is set, a new console connection doesn't seem to work,
# however post-setup we can verify that NGS is configuring ports as we
# expect.
send_switch_config_line localhost 55001 "username admin password system_secret role sysadmin"
send_switch_config_line localhost 55001 "ip ssh server enable"
send_switch_config_line localhost 55001 "ip ssh server password-authentication"
send_switch_config_line localhost 55001 "int mgmt1/1/1"
send_switch_config_line localhost 55001 "no ip address dhcp"
send_switch_config_line localhost 55001 "no ipv6 address autoconfig"
send_switch_config_line localhost 55001 "ip address 172.24.5.20/24"
send_switch_config_line localhost 55001 "exit" # Must always exit each interface.
send_switch_config_line localhost 55001 "int ethernet1/1/1"
send_switch_config_line localhost 55001 "switchport mode trunk"
send_switch_config_line localhost 55001 "exit"
# Interfaces in *order*
# ethernet1/1/2 through ethernet 1/1/9
for interface in 2 3 4 5 6 7 8 9; do
send_switch_config_line localhost 55001 "int ethernet1/1/$interface"
send_switch_config_line localhost 55001 "lldp port-description-tlv advertise port-id"
send_switch_config_line localhost 55001 "exit"
done
send_switch_config_line localhost 55001 "exit"
sleep 10
send_switch_config_line localhost 55001 "exit"
send_switch_config_line localhost 55001 "write memory"
} # End of Force 10 OS10 setup
function create_network_simulator_vm_force10_9 {
# Pattern for this method is do the specific needful to get the emulator *up*.
# Download the OS
wget https://downloads.dell.com/translatedpdf/force10/os9/FTOS-SI-9.13.0.0.zip
unzip FTOS-SI-9.13.0.0.zip
mv FTOS-SI-9.13.0.0.iso /opt/stack
# Make a 30G disk, required.
qemu-img create -f qcow2 /opt/stack/FTOS.qcow2 30G
# Next step is to make the command line for the VM. Libvirt is so built
# around providing a graphical device, that it won't invoke qemu in the way
# necessary to create a telnet-able console to enable configuration.
# It works on direct launch via command line, likely because nothing in the
# stack is trying to do much more than basic serial IO on a console.
#
# For extra context:
# * 30G disk storage
# * 1 GB of RAM
# * 2 vCPU
# * Must boot from CD
# * BIOS Mode - No-display
# * e1000 for each port
# First port is mapped to management0/0
local emu_cmd="$IRONIC_VM_EMULATOR -boot d -cdrom /opt/stack/FTOS-SI-9.13.0.0.iso -enable-kvm -hda /opt/stack/FTOS.qcow2 -m 1G -smp cpus=2 -serial telnet:localhost:55001,server,nowait -display none"
# Base interfaces, attaches the trunk and the management interfaces.
emu_cmd+=" -device e1000,netdev=net0 -netdev tap,id=net0,ifname=$1,script=no,downscript=no -device e1000,netdev=net1 -netdev tap,id=net1,ifname=$2,script=no,downscript=no,sndbuf=1048576"
# Get a list of links, cut everything *after* "@" since taps duplicate
# entries, limit to "sim-node" to match our nodes, and extract only
# the actual interface name.
local net_interface=2
for i in $(ip link show up |cut -f1 -d "@" |grep "sim-node"|cut -f2 -d" "|cut -d":" -f1|sed s/sim/sw/g); do
emu_cmd+=" -device e1000,netdev=net$net_interface -netdev tap,id=net$net_interface,ifname=$i,sndbuf=1048576"
net_interface=$(( net_interface + 1))
done
# TODO, figure out if we can just run this as stack... We might not be able to
# due to permissions.
run_process ir-sw-sim "$emu_cmd" "root" "root"
# wait for the enable prompt
# Connect to localhost on 55001, wait 120 seconds to start,
# try 10 times, look for the "Dell#" prompt.
wait_for_switch_prompt localhost 55001 400 10 "^Dell#"
# NOTE(TheJulia): default credentials is admin/admin
# Start base configuration
send_switch_config_line localhost 55001 "conf t"
send_switch_config_line localhost 55001 "int management 0/0"
send_switch_config_line localhost 55001 "no shutdown"
send_switch_config_line localhost 55001 "no keepalive"
# FIXME(TheJulia) This won't work for a multinode job, but I doubt
# we will ever try this with multinode CI jobs as there is not really
# value in doing so for a simulated switch.
send_switch_config_line localhost 55001 "ip address 172.24.5.20 255.255.255.0"
send_switch_config_line localhost 55001 "exit"
# Interfaces in *order*
# fortygig0/0, 4, 8, 12, 16, 20, 24, 28, 32, 36, 40, 44, 48, 52, 56, 60,
# 64, 68, 72, 76, 80, 84, 88, 92, 96, 100, 104, 108, 112, 116, 120, 124
for interface in 0/0 0/4 0/8 0/12 0/16 0/20 0/24 0/28 0/32 0/36; do
send_switch_config_line localhost 55001 "int fortygigE $interface"
send_switch_config_line localhost 55001 "no keepalive"
send_switch_config_line localhost 55001 "no shutdown"
# Setting switchport helps avoid errors like:
# % Error: Port is not in Layer-2 mode
send_switch_config_line localhost 55001 "switchport"
send_switch_config_line localhost 55001 "protocol lldp"
send_switch_config_line localhost 55001 "exit"
done
# Setup SSH server
send_switch_config_line localhost 55001 "exit"
send_switch_config_line localhost 55001 "username admin secret admin_secret"
send_switch_config_line localhost 55001 "enable secret admin_secret"
# Looks like setting up the ssh server automatically sets up
# the crypto key
send_switch_config_line localhost 55001 "ip ssh server enable"
# Need to wait before proceeding since crypto key generation
# takes a moment or ten.
sleep 10
send_switch_config_line localhost 55001 "exit"
send_switch_config_line localhost 55001 "wri mem"
}
function create_network_simulator_vm_cisco_nexus {
# Cisco's Nexus network switch simulator starts as a disk image,
# however if there are failures, the saved state on the disk image can
# be inconsistent state. As such, for sanity, we're going to copy the
# disk image.
# The TLDR how to use this, just download and set the variable below
# to one of the images.
local base_image=/opt/stack/nexus9300v64.10.3.7.M.qcow2
local use_disk=/opt/stack/nexus_disk_image.qcow2
local gns3_edk2_file=/opt/stack/OVMF-edk2-stable202305.fd
# The disk image stores persistent state, so we need to replace it.
cp $base_image $use_disk
# This is specifically so we have what seems to be a switch friendly
# edk2 firmware rom.
wget https://sourceforge.net/projects/gns-3/files/Qemu%20Appliances/OVMF-edk2-stable202305.fd.zip/download -O $gns3_edk2_file.zip
unzip $gns3_edk2_file.zip -d /opt/stack
# For extra context:
# * 8096 MB of RAM
# * 2 vCPU
# * UEFI mode/Q35 hardware.
# * SATA for the disk.
# * e1000 for each port
# First port is mapped to mgmt0.
# The VM will crash if the first interface is not present.
local emu_cmd="$IRONIC_VM_EMULATOR -enable-kvm -machine q35 -smbios type=0,uefi=on -drive if=pflash,format=raw,readonly=on,file=$gns3_edk2_file -drive file=$use_disk,id=disk0,format=qcow2,if=none -device ahci,id=ahci -device ide-hd,drive=disk0,bus=ahci.0 -m 8096M -smp cpus=2 -display none -serial telnet:localhost:55001,server,nowait "
# Base interfaces, attaches the trunk and the management interfaces.
emu_cmd+=" -device e1000,netdev=net0 -netdev tap,id=net0,ifname=$1,script=no,downscript=no -device e1000,netdev=net1 -netdev tap,id=net1,ifname=$2,script=no,downscript=no,sndbuf=1048576"
# Get a list of links, cut everything *after* "@" since taps duplicate
# entries, limit to "sim-node" to match our nodes, and extract only
# the actual interface name.
local net_interface=2
for i in $(ip link show up |cut -f1 -d "@" |grep "sim-node"|cut -f2 -d" "|cut -d":" -f1|sed s/sim/sw/g); do
emu_cmd+=" -device e1000,netdev=net$net_interface -netdev tap,id=net$net_interface,ifname=$i,sndbuf=1048576"
net_interface=$(( net_interface + 1))
done
run_process ir-sw-sim "$emu_cmd" "root" "root"
# wait for the enable prompt
# Connect to localhost on 55001, wait 120 seconds to start,
# try 10 times, look for the "login prompt".
# Because we must start from a clean state, it takes the switch about
# 400-500 seconds to get into a deployed ready state.
wait_for_switch_prompt localhost 55001 500 10 "Abort Power On Auto Provisioning" False
sleep 2
send_switch_config_line localhost 55001 "skip" # username
# When you skip POAP, it is noted by the CLI that doing os
# can take 5-15 minutes. In reality, this seems to only take
# ~120 seconds on the virtual switch simulator.
wait_for_switch_prompt localhost 55001 120 10 "login:" False
sleep 1
# Default credentials are "admin" and an empty password
send_switch_config_line localhost 55001 "admin" # username
sleep 1
send_switch_config_line localhost 55001 "" # blank password
sleep 4
send_switch_config_line localhost 55001 "configure"
sleep 1
send_switch_config_line localhost 55001 "feature lldp"
send_switch_config_line localhost 55001 "username admin password system_s3cret! role network-admin"
send_switch_config_line localhost 55001 "int mgmt0"
send_switch_config_line localhost 55001 "ip address 172.24.5.20/24"
send_switch_config_line localhost 55001 "lldp transmit"
send_switch_config_line localhost 55001 "exit"
send_switch_config_line localhost 55001 "int ethernet1/1"
send_switch_config_line localhost 55001 "switchport mode trunk"
# Just allow *everything*, but not required.
send_switch_config_line localhost 55001 "switchport trunk allowed vlan all"
send_switch_config_line localhost 55001 "exit"
# Interfaces in *order*
# ethernet1/2 through 1/7
for interface in 2 3 4 5 6 7 8 9; do
send_switch_config_line localhost 55001 "int ethernet1/$interface"
send_switch_config_line localhost 55001 "switchport mode access"
send_switch_config_line localhost 55001 "lldp transmit"
send_switch_config_line localhost 55001 "exit"
done
sleep 10
send_switch_config_line localhost 55001 "exit"
send_switch_config_line localhost 55001 "copy run start"
} # End of Cisco Nexus 9k simulator setup
function create_network_simulator_vm_sonic {
local sonic_image=/opt/stack/sonic-vs.img
if [ ! -f $sonic_image ]; then
sonic_url=$(curl -s https://sonic.software/builds.json | jq -r '.["master"]["sonic-vs.img.gz"]["url"]')
wget -O $sonic_image.gz $sonic_url
gzip -d $sonic_image.gz
fi
cp $sonic_image $sonic_image.qcow2
# For extra context:
# * 4GB of RAM
# * e1000 interfaces
# * virtio disk interface
# * boot_priority set to d
# First port is mapped to eth0.
# The VM will crash if the first interface is not present.
local emu_cmd="$IRONIC_VM_EMULATOR -enable-kvm -drive file=$sonic_image.qcow2,id=disk0,format=qcow2,if=none --device virtio-blk-pci,drive=disk0 -m 4096M -smp cpus=2 -display none -serial telnet:localhost:55001,server,nowait "
# Base interfaces, attaches the trunk and the management interfaces.
emu_cmd+=" -device e1000,netdev=net0 -netdev tap,id=net0,ifname=$1,script=no,downscript=no -device e1000,netdev=net1 -netdev tap,id=net1,ifname=$2,script=no,downscript=no,sndbuf=1048576"
# Get a list of links, cut everything *after* "@" since taps duplicate
# entries, limit to "sim-node" to match our nodes, and extract only
# the actual interface name.
local net_interface=2
for i in $(ip link show up |cut -f1 -d "@" |grep "sim-node"|cut -f2 -d" "|cut -d":" -f1|sed s/sim/sw/g); do
emu_cmd+=" -device e1000,netdev=net$net_interface -netdev tap,id=net$net_interface,ifname=$i,sndbuf=1048576"
net_interface=$(( net_interface + 1))
done
run_process ir-sw-sim "$emu_cmd" "root" "root"
# wait for the enable prompt
wait_for_switch_prompt localhost 55001 80 10 "sonic login:" False
sleep 4
send_switch_config_line localhost 55001 admin
sleep 2
send_switch_config_line localhost 55001 "YourPaSsWoRd"
sleep 10
# SONiC doesn't provide a means for this configuration through the CLI
# https://github.com/sonic-net/SONiC/blob/master/doc/SONiC-User-Manual.md#31-configuring-management-interface-and-loopback-interface
send_switch_config_line localhost 55001 "sudo /sbin/ifconfig eth0 172.24.5.20/24"
send_switch_config_line localhost 55001 "sonic-cli"
send_switch_config_line localhost 55001 "configure terminal"
send_switch_config_line localhost 55001 "sudo config interface ip remove Ethernet0 10.0.0.0/31"
send_switch_config_line localhost 55001 "sudo config switchport mode trunk Ethernet0"
send_switch_config_line localhost 55001 "sudo config interface ip remove Ethernet4 10.0.0.2/31"
send_switch_config_line localhost 55001 "sudo config switchport mode access Ethernet4"
send_switch_config_line localhost 55001 "sudo config interface ip remove Ethernet8 10.0.0.4/31"
send_switch_config_line localhost 55001 "sudo config switchport mode access Ethernet8"
send_switch_config_line localhost 55001 "sudo config interface ip remove Ethernet12 10.0.0.6/31"
send_switch_config_line localhost 55001 "sudo config switchport mode access Ethernet12"
send_switch_config_line localhost 55001 "sudo config interface ip remove Ethernet16 10.0.0.8/31"
send_switch_config_line localhost 55001 "sudo config switchport mode access Ethernet16"
send_switch_config_line localhost 55001 "sudo config interface ip remove Ethernet20 10.0.0.10/31"
send_switch_config_line localhost 55001 "sudo config switchport mode access Ethernet20"
send_switch_config_line localhost 55001 "sudo config interface ip remove Ethernet24 10.0.0.12/31"
send_switch_config_line localhost 55001 "sudo config switchport mode access Ethernet24"
} # End of SONiC configuration
function wait_for_switch_prompt {
local host=$1
local port=$2
local sleep_first=$3
local max_attempts=$4
local expeted_string=$5
local use_enable=$6
echo_summary "Waiting for $sleep_first seconds before polling the switch"
sleep $sleep_first
local attempt=1
if [[ -n "$use_enable" ]] && [[ "$use_enable" != "False" ]]; then
use_enable="True"
fi
for i in $(seq 1 $max_attempts); do
# NOTE(TheJulia): Strip non-ascii characters so we suppress the control
# characters which would otherwise make grep complain about binary output.
# NOTE(TheJulia): This will likely fail on the first attempt even if the
# switch is ready as the pre-written command prompt on the buffer has not
# yet updated from the command.
if [[ "$use_enable" == "True" ]]; then
if $(echo "en" | nc -w1 $host $port | strings |grep -q "$expected_string"); then
echo_summary "Got switch prompt - Switch ready for configuration."
return 0
else
echo_summary "Switch not online yet."
fi
else
if $(echo "" | nc -w1 $host $port | strings |grep -q "$expected_string"); then
echo_summary "Got switch prompt - Switch ready for configuration."
return 0
else
echo_summary "Switch not online yet."
fi
fi
if [ $attempt -gt $max_attempts ]; then
die $LINENO "Failed to find switch prompt in the allotted time."
return 1
fi
attempt=$(( attempt + 1))
sleep 15
done
}
function send_switch_config_line {
local host=$1
local port=$2
local cmd=$3
# FIXME(TheJulia): There has to be a better way to do this,
# but we also need to bootstrap some very early configuration...
# NOTE(TheJulia): *Always* strings the output, in case 0xFF can
# break devstack's executor.
echo "$cmd" | nc -w1 $host $port | strings
# Sleep briefy to allow the execution to occur and finish.
sleep 1
}
function wait_for_nova_resources {
# After nodes have been enrolled, we need to wait for both ironic and
# nova's periodic tasks to populate the resource tracker with available
# nodes and resources. Wait up to 2 minutes for a given resource before
# timing out.
local expected_count=$1
local resource_class=${IRONIC_DEFAULT_RESOURCE_CLASS^^}
# TODO(dtantsur): switch to Placement OSC plugin, once it exists
# Normally, we would want to use IRONIC_OS_CLOUD, but tokens need to be
# scoped. In this case, devstack-admin is the appropriate os-cloud to use.
local token
token=$(openstack --os-cloud devstack-admin token issue -f value -c id)
local endpoint
endpoint=$(openstack --os-cloud devstack-admin endpoint list --service placement --interface public -f value -c URL)
die_if_not_set $LINENO endpoint "Cannot find Placement API endpoint"
local i
local count
echo_summary "Waiting up to 3 minutes for placement to pick up $expected_count nodes"
for i in $(seq 1 12); do
# Fetch provider UUIDs from Placement
local providers
providers=$(curl --noproxy '*' -sH "X-Auth-Token: $token" $endpoint/resource_providers \
| jq -r '.resource_providers[].uuid')
local p
# Total count of the resource class, has to be equal to nodes count
count=0
for p in $providers; do
local amount
# A resource class inventory record looks something like
# {"max_unit": 1, "min_unit": 1, "step_size": 1, "reserved": 0, "total": 1, "allocation_ratio": 1}
# Subtrack reserved from total (defaulting both to 0)
amount=$(curl --noproxy '*' -sH "X-Auth-Token: $token" $endpoint/resource_providers/$p/inventories \
| jq ".inventories.CUSTOM_$resource_class as \$cls
| (\$cls.total // 0) - (\$cls.reserved // 0)")
# Check whether the resource provider has all expected traits
# registered against it.
rp_traits=$(curl --noproxy '*' -sH "X-Auth-Token: $token" \
-H "OpenStack-API-Version: placement 1.6" \
$endpoint/resource_providers/$p/traits)
for trait in $IRONIC_DEFAULT_TRAITS; do
if [[ $(echo "$rp_traits" | jq ".traits | contains([\"$trait\"])") == false ]]; then
amount=0
fi
done
if [ $amount -gt 0 ]; then
count=$(( count + $amount ))
fi
done
if [ $count -ge $expected_count ]; then
return 0
fi
if is_service_enabled n-api; then
$TOP_DIR/tools/discover_hosts.sh
fi
sleep 15
done
die $LINENO "Timed out waiting for Nova to track $expected_count nodes"
}
function _clean_ncpu_failure {
SCREEN_NAME=${SCREEN_NAME:-stack}
SERVICE_DIR=${SERVICE_DIR:-${DEST}/status}
n_cpu_failure="$SERVICE_DIR/$SCREEN_NAME/n-cpu.failure"
if [ -f ${n_cpu_failure} ]; then
mv ${n_cpu_failure} "${n_cpu_failure}.before-restart-by-ironic"
fi
}
function provide_nodes {
local nodes=$@
for node_id in $nodes; do
$IRONIC_CMD node provide $node_id
done
local attempt
for attempt in $(seq 1 $IRONIC_CLEANING_ATTEMPTS); do
local available
available=$(openstack --os-cloud $IRONIC_OS_CLOUD baremetal node list --provision-state available -f value -c UUID)
local nodes_not_finished=
for node_id in $nodes; do
if ! echo $available | grep -q $node_id; then
nodes_not_finished+=" $node_id"
fi
done
nodes=$nodes_not_finished
if [[ "$nodes" == "" ]]; then
break
fi
echo "Waiting for nodes to become available: $nodes"
echo "Currently available: $available"
sleep $IRONIC_CLEANING_DELAY
done
if [[ "$nodes" != "" ]]; then
die $LINENO "Some nodes did not finish cleaning: $nodes"
fi
}
function wait_for_ironic_neutron_agent_report_state_for_all_nodes {
local nodes=$@
echo "Waiting for ironic-neutron-agent to report state for nodes: $nodes"
local attempt
for attempt in $(seq 1 $IRONIC_NEUTRON_AGENT_REPORT_STATE_ATTEMPTS); do
local reported
reported=$(openstack --os-cloud $OS_CLOUD network agent list -f value -c Host -c Binary | grep ironic-neutron-agent | cut -d ' ' -f 1 | paste -s -d ' ')
echo "Currently reported nodes: $reported"
local can_break
for node_id in $nodes; do
if echo $reported | grep -q $node_id; then
can_break="True"
else
can_break="False"
break
fi
done
if [[ $can_break == "True" ]]; then
break
fi
sleep $IRONIC_NEUTRON_AGENT_REPORT_STATE_DELAY
done
if [[ "$can_break" == "False" ]]; then
die $LINENO "ironic-neutron-agent did not report some nodes."
fi
}
function enroll_nodes {
local chassis_id
chassis_id=$($IRONIC_CMD chassis create --description "ironic test chassis" -f value -c uuid)
die_if_not_set $LINENO chassis_id "Failed to create chassis"
local node_prefix
node_prefix=$(get_ironic_node_prefix)
local interface_info
if [[ "$IRONIC_IS_HARDWARE" == "False" ]]; then
local ironic_node_cpu=$IRONIC_VM_SPECS_CPU
local ironic_node_ram=$IRONIC_VM_SPECS_RAM
local ironic_node_disk=$IRONIC_VM_SPECS_DISK
local ironic_ephemeral_disk=$IRONIC_VM_EPHEMERAL_DISK
local ironic_node_arch=$IRONIC_HW_ARCH
if [[ ! -f $IRONIC_VM_MACS_CSV_FILE ]]; then
touch $IRONIC_VM_MACS_CSV_FILE
fi
local ironic_hwinfo_file=$IRONIC_VM_MACS_CSV_FILE
if is_deployed_by_ipmi; then
local deploy_options="\
--driver-info ipmi_address=${HOST_IP} \
--driver-info ipmi_username=admin \
--driver-info ipmi_password=password"
elif is_deployed_by_snmp; then
local deploy_options="\
--driver-info snmp_driver=${IRONIC_VPDU_SNMPDRIVER} \
--driver-info snmp_address=${HOST_IP} \
--driver-info snmp_port=${IRONIC_VPDU_LISTEN_PORT} \
--driver-info snmp_protocol=2c \
--driver-info snmp_community=${IRONIC_VPDU_COMMUNITY}"
elif is_deployed_by_redfish; then
local deploy_options="\
--driver-info redfish_address=http://${HOST_IP}:${IRONIC_REDFISH_EMULATOR_PORT} \
--driver-info redfish_username=admin \
--driver-info redfish_password=password"
fi
else
local ironic_node_cpu=$IRONIC_HW_NODE_CPU
local ironic_node_ram=$IRONIC_HW_NODE_RAM
local ironic_node_disk=$IRONIC_HW_NODE_DISK
local ironic_ephemeral_disk=$IRONIC_HW_EPHEMERAL_DISK
local ironic_node_arch=$IRONIC_HW_ARCH
local ironic_hwinfo_file=$IRONIC_HWINFO_FILE
fi
local total_nodes=0
local total_cpus=0
local node_uuids=
local node_id
while read hardware_info; do
echo "Processing $hardware_info"
local node_name
node_name=$node_prefix-$total_nodes
local node_options="$deploy_options"
local node_capabilities=""
if [[ "$IRONIC_BOOT_MODE" == "uefi" ]]; then
node_capabilities+=" --property capabilities=boot_mode:uefi"
fi
if [[ "$IRONIC_BOOT_MODE" == "bios" ]]; then
node_capabilities+=" --property capabilities=boot_mode:bios"
fi
if [[ "$IRONIC_SECURE_BOOT" == "True" ]]; then
if [[ -n "$node_capabilities" ]]; then
node_capabilities+=",secure_boot:true"
else
node_capabilities+=" --property capabilities=secure_boot:true"
fi
fi
if [[ "$IRONIC_IS_HARDWARE" == "False" ]]; then
interface_info=$(echo $hardware_info | awk '{print $1}')
if is_deployed_by_ipmi; then
local vbmc_port
vbmc_port=$(echo $hardware_info | awk '{print $2}')
node_options+=" --driver-info ipmi_port=$vbmc_port"
elif is_deployed_by_snmp; then
local pdu_outlet
pdu_outlet=$(echo $hardware_info | awk '{print $3}')
node_options+=" --driver-info snmp_outlet=$pdu_outlet"
elif is_deployed_by_redfish; then
node_options+=" --driver-info redfish_system_id=/redfish/v1/Systems/$node_name"
fi
# Local-link-connection options
local llc_opts=""
if [[ "${IRONIC_USE_LINK_LOCAL}" == "True" ]]; then
local switch_info
local switch_id
if [[ "${IRONIC_NETWORK_SIMULATOR:-ovs}" == "ovs" ]]; then
switch_id=$(echo $hardware_info |awk '{print $4}')
if [[ "$SUBNODE_ID" == "" ]]; then
switch_info=$(echo $hardware_info |awk '{print $5}')
else
switch_info="sub$SUBNODE_ID$(echo $hardware_info |awk '{print $5}')"
fi
else
switch_id="00:00:00:00:00:00"
switch_info=${IRONIC_NETWORK_SIMULATOR:-brbm}
fi
# NOTE(vsaienko) we will add port_id later in the code.
llc_opts="--local-link-connection switch_id=${switch_id} \
--local-link-connection switch_info=${switch_info} "
fi
if [[ "${IRONIC_STORAGE_INTERFACE}" == "cinder" ]]; then
local connector_iqn="iqn.2017-05.org.openstack.$node_prefix-$total_nodes"
if [[ -n "$node_capabilities" ]]; then
node_capabilities+=",iscsi_boot:True"
else
node_capabilities+=" --property capabilities=iscsi_boot:True"
fi
fi
else
# Currently we require all hardware platform have same CPU/RAM/DISK info
# in future, this can be enhanced to support different type, and then
# we create the bare metal flavor with minimum value
local bmc_address
bmc_address=$(echo $hardware_info |awk '{print $1}')
local mac_address
mac_address=$(echo $hardware_info |awk '{print $2}')
local bmc_username
bmc_username=$(echo $hardware_info |awk '{print $3}')
local bmc_passwd
bmc_passwd=$(echo $hardware_info |awk '{print $4}')
local node_options=""
if is_deployed_by_ipmi; then
node_options+=" --driver-info ipmi_address=$bmc_address \
--driver-info ipmi_password=$bmc_passwd \
--driver-info ipmi_username=$bmc_username"
elif is_deployed_by_ilo; then
node_options+=" --driver-info ilo_address=$bmc_address \
--driver-info ilo_password=$bmc_passwd \
--driver-info ilo_username=$bmc_username"
if [[ $IRONIC_ENABLED_BOOT_INTERFACES == *"ilo-virtual-media"* ]]; then
node_options+=" --driver-info deploy_iso=$IRONIC_DEPLOY_ISO_ID"
fi
elif is_deployed_by_drac; then
node_options+=" --driver-info drac_address=$bmc_address \
--driver-info drac_password=$bmc_passwd \
--driver-info drac_username=$bmc_username"
elif is_deployed_by_redfish; then
local bmc_redfish_system_id
bmc_redfish_system_id=$(echo $hardware_info |awk '{print $5}')
node_options+=" --driver-info redfish_address=https://$bmc_address \
--driver-info redfish_system_id=$bmc_redfish_system_id \
--driver-info redfish_password=$bmc_passwd \
--driver-info redfish_username=$bmc_username \
--driver-info redfish_verify_ca=False"
elif is_deployed_by_irmc; then
node_options+=" --driver-info irmc_address=$bmc_address \
--driver-info irmc_password=$bmc_passwd \
--driver-info irmc_username=$bmc_username"
if [[ -n "$IRONIC_DEPLOY_ISO_ID" ]]; then
node_options+=" --driver-info deploy_iso=$IRONIC_DEPLOY_ISO_ID"
fi
fi
interface_info="${mac_address}"
fi
# First node created will be used for testing in ironic w/o glance
# scenario, so we need to know its UUID.
local standalone_node_uuid=""
if [ $total_nodes -eq 0 ]; then
standalone_node_uuid="--uuid $IRONIC_NODE_UUID"
fi
# TODO(dtantsur): it would be cool to test with different resource
# classes, but for now just use the same.
node_id=$($IRONIC_CMD node create $standalone_node_uuid \
--chassis $chassis_id \
--driver $IRONIC_DEPLOY_DRIVER \
--name $node_name \
--resource-class $IRONIC_DEFAULT_RESOURCE_CLASS \
--property cpu_arch=$ironic_node_arch \
$node_capabilities \
$node_options \
-f value -c uuid)
die_if_not_set $LINENO node_id "Failed to create node"
node_uuids+=" $node_id"
if [[ -n $IRONIC_DEFAULT_TRAITS ]]; then
$IRONIC_CMD node add trait $node_id $IRONIC_DEFAULT_TRAITS
fi
if [[ -n "$IRONIC_SET_NODE_OWNER" ]]; then
# If set, apply an owner project project ID to the node,
# to allow tools like metalsmith to be abel to view and
# allocate the node.
owner_project_id=$(openstack project show $IRONIC_SET_NODE_OWNER -f value -c id)
$IRONIC_CMD node set --owner $owner_project_id $node_id
fi
$IRONIC_CMD node manage $node_id --wait $IRONIC_MANAGE_TIMEOUT || \
die $LINENO "Node did not reach manageable state in $IRONIC_MANAGE_TIMEOUT seconds"
# NOTE(vsaienko) IPA didn't automatically recognize root devices less than 4Gb.
# Setting root hint allows to install OS on such devices.
# 0x1af4 is VirtIO vendor device ID.
if [[ "$ironic_node_disk" -lt "4" && is_deployed_by_agent ]]; then
$IRONIC_CMD node set $node_id --property \
root_device='{"vendor": "0x1af4"}'
fi
if [[ $IRONIC_SHARDS == "1" ]]; then
openstack --os-cloud devstack-system-admin baremetal node set $node_id --shard $IRONIC_NODE_SHARD_NAME
fi
# In case we using portgroups, we should API version that support them.
# Otherwise API will return 406 ERROR
# NOTE(vsaienko) interface_info is in the following format here:
# mac1,tap-node0i1;mac2,tap-node0i2;...;macN,tap-node0iN
if [[ $IRONIC_USE_PORT_GROUP == "True" ]]; then
pg_mac_address=$(echo ${interface_info} | awk -F ';' '{print $1}' | awk -F ',' '{print $1}')
pg_id=$($IRONIC_CMD port group create --node $node_id --address $pg_mac_address --mode ${IRONIC_PORT_GROUP_MODE} -f value -c uuid)
die_if_not_set $LINENO pg_id "Failed to create portgroup"
fi
for info in ${interface_info//;/ }; do
local mac_address=""
local port_id=""
local llc_port_opt=""
local physical_network=""
local portgroup=""
echo "Processing Interface Info $interface_info"
mac_address=$(echo $info| awk -F ',' '{print $1}')
port_id=$(echo $info| awk -F ',' '{print $2}')
if [[ "${IRONIC_USE_LINK_LOCAL}" == "True" ]]; then
if [[ "${IRONIC_NETWORK_SIMULATOR:-ovs}" == "ovs" ]]; then
llc_port_opt+=" --local-link-connection port_id=${port_id} "
else
llc_port_opt+=" --local-link-connection port_id=$(identify_port_for_switch $IRONIC_NETWORK_SIMULATOR $port_id) "
fi
fi
if [[ "${IRONIC_USE_NEUTRON_SEGMENTS}" == "True" ]]; then
physical_network=" --physical-network ${PHYSICAL_NETWORK} "
fi
if [[ $IRONIC_USE_PORT_GROUP == "True" ]]; then
portgroup="--port-group ${pg_id}"
fi
$IRONIC_CMD port create --node $node_id $llc_opts $llc_port_opt $mac_address $physical_network $portgroup
done
# NOTE(vsaienko) use node-update instead of specifying network_interface
# during node creation. If node is added with latest version of API it
# will NOT go to available state automatically.
if [[ -n "${IRONIC_NETWORK_INTERFACE}" ]]; then
$IRONIC_CMD node set $node_id --network-interface $IRONIC_NETWORK_INTERFACE || \
die $LINENO "Failed to update network interface for node"
fi
if [[ -n "${IRONIC_STORAGE_INTERFACE}" ]]; then
$IRONIC_CMD node set $node_id --storage-interface $IRONIC_STORAGE_INTERFACE || \
die $LINENO "Failed to update storage interface for node $node_id"
if [[ -n "${connector_iqn}" ]]; then
$IRONIC_CMD volume connector create --node $node_id --type iqn \
--connector-id $connector_iqn || \
die $LINENO "Failed to create volume connector for node $node_id"
fi
fi
total_nodes=$((total_nodes+1))
done < $ironic_hwinfo_file
# NOTE(hjensas): ensure ironic-neutron-agent has done report_state for all
# nodes we attempt cleaning.
if [[ "${IRONIC_USE_NEUTRON_SEGMENTS}" == "True" ]]; then
wait_for_ironic_neutron_agent_report_state_for_all_nodes $node_uuids
fi
# NOTE(dtantsur): doing it outside of the loop, because of cleaning
provide_nodes $node_uuids
if is_service_enabled nova && [[ "$VIRT_DRIVER" == "ironic" ]]; then
if [[ "$HOST_TOPOLOGY_ROLE" != "subnode" ]]; then
local adjusted_disk
adjusted_disk=$(($ironic_node_disk - $ironic_ephemeral_disk))
openstack --os-cloud $OS_CLOUD flavor create --ephemeral $ironic_ephemeral_disk --ram $ironic_node_ram --disk $adjusted_disk --vcpus $ironic_node_cpu baremetal
local resource_class=${IRONIC_DEFAULT_RESOURCE_CLASS^^}
openstack --os-cloud $OS_CLOUD flavor set baremetal --property "resources:CUSTOM_$resource_class"="1"
openstack --os-cloud $OS_CLOUD flavor set baremetal --property "resources:DISK_GB"="0"
openstack --os-cloud $OS_CLOUD flavor set baremetal --property "resources:MEMORY_MB"="0"
openstack --os-cloud $OS_CLOUD flavor set baremetal --property "resources:VCPU"="0"
openstack --os-cloud $OS_CLOUD flavor set baremetal --property "cpu_arch"="$ironic_node_arch"
if [[ "$IRONIC_BOOT_MODE" == "uefi" ]]; then
openstack --os-cloud $OS_CLOUD flavor set baremetal --property "capabilities:boot_mode"="uefi"
fi
if [[ "$IRONIC_BOOT_MODE" == "bios" ]]; then
openstack --os-cloud $OS_CLOUD flavor set baremetal --property "capabilities:boot_mode"="bios"
fi
for trait in $IRONIC_DEFAULT_TRAITS; do
openstack --os-cloud $OS_CLOUD flavor set baremetal --property "trait:$trait"="required"
done
if [[ "$IRONIC_SECURE_BOOT" == "True" ]]; then
openstack --os-cloud $OS_CLOUD flavor set baremetal --property "capabilities:secure_boot"="true"
fi
# NOTE(dtantsur): sometimes nova compute fails to start with ironic due
# to keystone restarting and not being able to authenticate us.
# Restart it just to be sure (and avoid gate problems like bug 1537076)
stop_nova_compute || /bin/true
# NOTE(pas-ha) if nova compute failed before restart, .failure file
# that was created will fail the service_check in the end of the deployment
_clean_ncpu_failure
start_nova_compute
fi
if [[ "$IRONIC_SHARD_1_NAME" != "$IRONIC_NODE_SHARD_NAME" ]]; then
# If we're running in a disjointed shard configuration, we may see
# only one node, the other compute services are the ones in use,
# which means our total local count is invalid and can't be used.
# So, we just make sure we can see *one* node successfully.
if [[ "$HOST_TOPOLOGY_ROLE" == "subnode" ]]; then
# If we're on a subnode, just wait for at least one node.
# If we're on the controller, we won't see any nodes.
wait_for_nova_resources $total_nodes
fi
# TODO(TheJulia): We should check the primary/controller node
# to ensure that nova-compute doesn't see the node configured
# for it if we are so configured. We would do that as the else
# of the above logic, which *should* never see the ironic baremetal
# node entry by default.
else
# In this case, we're looking to match all the nodes on this host,
# itself. Meaning the tests focus on the use of this node and we
# need to ensure we have all the nodes.
wait_for_nova_resources $total_nodes
fi
fi
}
function die_if_module_not_loaded {
if ! grep -q $1 /proc/modules; then
die $LINENO "$1 kernel module is not loaded"
fi
}
function identify_port_for_switch {
# TODO(TheJulia): The exisence of this function is kind of awful.
# tl;dr, we don't have the port id for ngs, so we *should wire things
# up so inspection can trigger and we can discover these via lldp...
# Ideall, before the fixme so the fixme is just a bug.
# FIXME(TheJulia): this only maps up with 2 ports per VM.
local simulator=$1
local vm_port=$2
case $simulator in
force10_9)
identify_force10_9_port $vm_port
;; # end of force10_9
force10_10)
identify_force10_10_port $vm_port
;;
cisco_nexus9k)
identify_cisco_nexus_port $vm_port
;;
sonic)
identify_sonic_port $vm_port
;;
esac
}
function identify_force10_port {
case $1 in
tap-node-0i1)
echo -n "forty0/4"
;;
tap-node-0i2)
echo -n "forty0/8"
;;
tap-node-1i1)
echo -n "forty0/12"
;;
tap-node-1i2)
echo -n "forty0/16"
;;
tap-node-2i1)
echo -n "forty0/20"
;;
tap-node-2i2)
echo -n "forty0/24"
;;
esac
}
function identify_force10_10_port {
case $1 in
tap-node-0i1)
echo -n "ethernet1/1/2"
;;
tap-node-0i2)
echo -n "ethernet1/1/3"
;;
tap-node-1i1)
echo -n "ethernet1/1/4"
;;
tap-node-1i2)
echo -n "ethernet1/1/5"
;;
tap-node-2i1)
echo -n "ethernet1/1/6"
;;
tap-node-2i2)
echo -n "ethernet1/1/7"
;;
esac
}
function identify_cisco_nexus_port {
case $1 in
tap-node-0i1)
echo -n "ethernet1/2"
;;
tap-node-0i2)
echo -n "ethernet1/3"
;;
tap-node-1i1)
echo -n "ethernet1/4"
;;
tap-node-1i2)
echo -n "ethernet1/5"
;;
tap-node-2i1)
echo -n "ethernet1/6"
;;
tap-node-2i2)
echo -n "ethernet1/7"
;;
esac
}
function identify_sonic_port {
case $1 in
tap-node-0i1)
echo -n "Ethernet4"
;;
tap-node-0i2)
echo -n "Ethernet8"
;;
tap-node-1i1)
echo -n "Ethernet12"
;;
tap-node-1i2)
echo -n "Ethernet16"
;;
tap-node-2i1)
echo -n "Ethernet20"
;;
tap-node-2i2)
echo -n "Ethernet24"
;;
esac
}
function configure_iptables {
# enable tftp natting for allowing connections to HOST_IP's tftp server
if ! running_in_container; then
sudo modprobe nf_conntrack_tftp
sudo modprobe nf_nat_tftp
else
die_if_module_not_loaded nf_conntrack_tftp
die_if_module_not_loaded nf_nat_tftp
fi
################ NETWORK DHCP
# explicitly allow DHCP - packets are occasionally being dropped here
sudo iptables -I INPUT -p udp --dport 67:68 --sport 67:68 -j ACCEPT || true
# nodes boot from TFTP and callback to the API server listening on $HOST_IP
sudo iptables -I INPUT -d $IRONIC_TFTPSERVER_IP -p udp --dport 69 -j ACCEPT || true
# dhcpv6 which is the only way to transmit boot options
sudo ip6tables -I INPUT -d $IRONIC_HOST_IPV6 -p udp --dport 546:547 --sport 546:547 -j ACCEPT || true
sudo ip6tables -I INPUT -d $IRONIC_HOST_IPV6 -p udp --dport 69 -j ACCEPT || true
################ Webserver/API
# To use named /baremetal endpoint we should open default apache port
sudo iptables -I INPUT -d $HOST_IP -p tcp --dport 80 -j ACCEPT || true
sudo iptables -I INPUT -d $HOST_IP -p tcp --dport 443 -j ACCEPT || true
# open ironic API on baremetal network
sudo iptables -I INPUT -d $IRONIC_HTTP_SERVER -p tcp --dport 80 -j ACCEPT || true
sudo ip6tables -I INPUT -d $IRONIC_HTTP_SERVER -p tcp --dport 80 -j ACCEPT || true
sudo iptables -I INPUT -d $IRONIC_HTTP_SERVER -p tcp --dport 443 -j ACCEPT || true
sudo ip6tables -I INPUT -d $IRONIC_HTTP_SERVER -p tcp --dport 443 -j ACCEPT || true
if is_deployed_by_agent; then
# agent ramdisk gets instance image from swift
sudo iptables -I INPUT -d $HOST_IP -p tcp --dport ${SWIFT_DEFAULT_BIND_PORT:-8080} -j ACCEPT || true
sudo iptables -I INPUT -d $HOST_IP -p tcp --dport $GLANCE_SERVICE_PORT -j ACCEPT || true
fi
if is_http_server_required; then
sudo iptables -I INPUT -d $IRONIC_HTTP_SERVER -p tcp --dport $IRONIC_HTTP_PORT -j ACCEPT || true
sudo ip6tables -I INPUT -d $IRONIC_HOST_IPV6 -p tcp --dport $IRONIC_HTTP_PORT -j ACCEPT || true
fi
if [[ "${IRONIC_STORAGE_INTERFACE}" == "cinder" ]]; then
sudo iptables -I INPUT -d $HOST_IP -p tcp --dport $ISCSI_SERVICE_PORT -s $FLOATING_RANGE -j ACCEPT || true
fi
# (rpittau) workaround to allow TFTP traffic on ubuntu bionic with conntrack helper disabled
local qrouter
qrouter=$(sudo ip netns list | grep qrouter | awk '{print $1;}')
if [[ ! -z "$qrouter" ]]; then
sudo ip netns exec $qrouter iptables -A PREROUTING -t raw -p udp --dport 69 -j CT --helper tftp
sudo ip netns exec $qrouter ip6tables -A PREROUTING -t raw -p udp --dport 69 -j CT --helper tftp || true
fi
}
function configure_tftpd {
if [[ "${IRONIC_ENABLE_TFTP:-True}" == "True" ]]; then
# stop tftpd and setup serving via xinetd
stop_service tftpd-hpa || true
[ -f /etc/init/tftpd-hpa.conf ] && echo "manual" | sudo tee /etc/init/tftpd-hpa.override
sudo cp $IRONIC_TEMPLATES_DIR/tftpd-xinetd.template /etc/xinetd.d/tftp
sudo sed -e "s|%TFTPBOOT_DIR%|$IRONIC_TFTPBOOT_DIR|g" -i /etc/xinetd.d/tftp
sudo sed -e "s|%MAX_BLOCKSIZE%|$IRONIC_TFTP_BLOCKSIZE|g" -i /etc/xinetd.d/tftp
if [[ "$IRONIC_IP_VERSION" == '6' ]]; then
sudo sed -e "s|IPv4|IPv6|g" -i /etc/xinetd.d/tftp
fi
# setup tftp file mapping to satisfy requests at the root (booting) and
# /tftpboot/ sub-dir (as per deploy-ironic elements)
# this section is only for ubuntu and fedora
if [[ "$IRONIC_IPXE_ENABLED" == "False" && \
( "$IRONIC_BOOT_MODE" == "uefi" || "$IRONIC_SECURE_BOOT" == "True" ) && \
"$IRONIC_UEFI_BOOT_LOADER" == "grub2" ]]; then
echo "re ^($IRONIC_TFTPBOOT_DIR/) $IRONIC_TFTPBOOT_DIR/\2" >$IRONIC_TFTPBOOT_DIR/map-file
echo "re ^$IRONIC_TFTPBOOT_DIR/ $IRONIC_TFTPBOOT_DIR/" >>$IRONIC_TFTPBOOT_DIR/map-file
echo "re ^(^/) $IRONIC_TFTPBOOT_DIR/\1" >>$IRONIC_TFTPBOOT_DIR/map-file
echo "re ^([^/]) $IRONIC_TFTPBOOT_DIR/\1" >>$IRONIC_TFTPBOOT_DIR/map-file
else
echo "r ^([^/]) $IRONIC_TFTPBOOT_DIR/\1" >$IRONIC_TFTPBOOT_DIR/map-file
echo "r ^(/tftpboot/) $IRONIC_TFTPBOOT_DIR/\2" >>$IRONIC_TFTPBOOT_DIR/map-file
fi
sudo chmod -R 0755 $IRONIC_TFTPBOOT_DIR
restart_service xinetd
fi
}
function build_ipa_ramdisk {
local kernel_path=$1
local ramdisk_path=$2
local iso_path=$3
case $IRONIC_RAMDISK_TYPE in
'tinyipa')
build_tinyipa_ramdisk $kernel_path $ramdisk_path $iso_path
;;
'dib')
build_ipa_dib_ramdisk $kernel_path $ramdisk_path $iso_path
;;
*)
die $LINENO "Unrecognised IRONIC_RAMDISK_TYPE: $IRONIC_RAMDISK_TYPE. Expected either of 'dib' or 'tinyipa'."
;;
esac
}
function setup_ipa_builder {
git_clone $IRONIC_PYTHON_AGENT_BUILDER_REPO $IRONIC_PYTHON_AGENT_BUILDER_DIR $IRONIC_PYTHON_AGENT_BUILDER_BRANCH
}
function build_tinyipa_ramdisk {
echo "Building ironic-python-agent deploy ramdisk"
local kernel_path=$1
local ramdisk_path=$2
local iso_path=$3
cd $IRONIC_PYTHON_AGENT_BUILDER_DIR/tinyipa
export BUILD_AND_INSTALL_TINYIPA=true
if is_ansible_deploy_enabled; then
export AUTHORIZE_SSH=true
export SSH_PUBLIC_KEY=$IRONIC_ANSIBLE_SSH_KEY.pub
fi
make
cp tinyipa.gz $ramdisk_path
cp tinyipa.vmlinuz $kernel_path
if is_deploy_iso_required; then
make iso
cp tinyipa.iso $iso_path
fi
make clean
cd -
}
function rebuild_tinyipa_for_ansible {
local ansible_tinyipa_ramdisk_name
pushd $IRONIC_PYTHON_AGENT_BUILDER_DIR/tinyipa
export TINYIPA_RAMDISK_FILE=$IRONIC_DEPLOY_RAMDISK
export SSH_PUBLIC_KEY=$IRONIC_ANSIBLE_SSH_KEY.pub
make addssh
ansible_tinyipa_ramdisk_name="ansible-$(basename $IRONIC_DEPLOY_RAMDISK)"
mv $ansible_tinyipa_ramdisk_name $TOP_DIR/files
make clean
popd
IRONIC_DEPLOY_RAMDISK=$TOP_DIR/files/$ansible_tinyipa_ramdisk_name
}
# install_diskimage_builder() - Collect source and prepare or install from pip
function install_diskimage_builder {
if use_library_from_git "diskimage-builder"; then
git_clone_by_name "diskimage-builder"
setup_dev_lib -bindep "diskimage-builder"
else
local bindep_file
bindep_file=$(mktemp)
curl -o "$bindep_file" "$IRONIC_DIB_BINDEP_FILE"
install_bindep "$bindep_file"
pip_install_gr "diskimage-builder"
fi
}
function build_ipa_dib_ramdisk {
local kernel_path=$1
local ramdisk_path=$2
local iso_path=$3
local tempdir
tempdir=$(mktemp -d --tmpdir=${DEST})
# install diskimage-builder if not present
if ! $(type -P disk-image-create > /dev/null); then
install_diskimage_builder
fi
echo "Building IPA ramdisk with DIB options: $IRONIC_DIB_RAMDISK_OPTIONS"
if is_deploy_iso_required; then
IRONIC_DIB_RAMDISK_OPTIONS+=" iso"
fi
if is_ansible_deploy_enabled; then
IRONIC_DIB_RAMDISK_OPTIONS+=" devuser"
fi
git_clone $IRONIC_PYTHON_AGENT_BUILDER_REPO $IRONIC_PYTHON_AGENT_BUILDER_DIR $IRONIC_PYTHON_AGENT_BUILDER_BRANCH
ELEMENTS_PATH="$IRONIC_PYTHON_AGENT_BUILDER_DIR/dib" \
DIB_DHCP_TIMEOUT=$IRONIC_DIB_DHCP_TIMEOUT \
DIB_RELEASE=$IRONIC_DIB_RAMDISK_RELEASE \
DIB_REPOLOCATION_ironic_python_agent="$IRONIC_PYTHON_AGENT_DIR" \
DIB_REPOREF_ironic_python_agent=$TARGET_BRANCH \
DIB_REPOLOCATION_requirements="$DEST/requirements" \
DIB_REPOREF_requirements=$TARGET_BRANCH \
DIB_DEVUSER_PWDLESS_SUDO=yes \
DIB_DEVUSER_AUTHORIZED_KEYS=$IRONIC_ANSIBLE_SSH_KEY.pub \
disk-image-create "$IRONIC_DIB_RAMDISK_OPTIONS" \
-x -o "$tempdir/ironic-agent" \
ironic-python-agent-ramdisk
chmod -R +r $tempdir
mv "$tempdir/ironic-agent.kernel" "$kernel_path"
mv "$tempdir/ironic-agent.initramfs" "$ramdisk_path"
if is_deploy_iso_required; then
mv "$tempdir/ironic-agent.iso" "$iso_path"
fi
rm -rf $tempdir
}
function build_dib_image {
local target_path=$1
local tempdir
tempdir=$(mktemp -d --tmpdir=${DEST})
# install diskimage-builder if not present
if ! $(type -P disk-image-create > /dev/null); then
install_diskimage_builder
fi
DIB_GROWVOLS_TRIGGER=systemd \
DIB_GROWVOLS_ARGS="img-rootfs=60%" \
DIB_BLOCK_SIZE=$IRONIC_VM_BLOCK_SIZE \
DIB_RELEASE=$IRONIC_DIB_IMAGE_RELEASE \
DIB_BLOCK_DEVICE_CONFIG=file://$IRONIC_DEVSTACK_FILES_DIR/ci-block-device-for-lvm.yaml \
disk-image-create "$IRONIC_DIB_IMAGE_OPTIONS" \
-x -t qcow2 -o "$tempdir/target-os-image" --image-size 7
chmod -R +r $tempdir
mv "$tempdir/target-os-image.qcow2" "$target_path"
rm -rf $tempdir
}
function upload_image_if_needed {
if [[ "$IRONIC_PARTITIONED_IMAGE_NAME" =~ cirros ]] && is_service_enabled glance; then
echo Building a Cirros image suitable for local boot
local dest
IRONIC_PARTITIONED_IMAGE_NAME=cirros-${CIRROS_VERSION}-${IRONIC_HW_ARCH}-partition
dest="$IRONIC_DATA_DIR/$IRONIC_PARTITIONED_IMAGE_NAME.img"
# Export some variables that the script is using.
CIRROS_ARCH=$IRONIC_HW_ARCH CIRROS_VERSION=$CIRROS_VERSION \
IRONIC_TTY_DEV=$IRONIC_TTY_DEV VERBOSE=$VERBOSE \
$IRONIC_SCRIPTS_DIR/cirros-partition.sh "$dest"
# TODO(dtantsur): stop uploading kernel/ramdisk when image_type support
# lands.
local kernel_id
kernel_id=$(openstack image list -f value -c ID -c Name \
| awk '/cirros.*kernel/ { print $1; exit 0; }')
die_if_not_set $LINENO kernel_id "Cannot find cirros kernel"
local ramdisk_id
ramdisk_id=$(openstack image list -f value -c ID -c Name \
| awk '/cirros.*ramdisk/ { print $1; exit 0; }')
die_if_not_set $LINENO ramdisk_id "Cannot find cirros ramdisk"
openstack image create $IRONIC_PARTITIONED_IMAGE_NAME \
--public --disk-format raw --container-format bare \
--property kernel_id=$kernel_id --property ramdisk_id=$ramdisk_id \
--file $(readlink -f "$dest")
# Change the default image only if the provided settings prevent the
# default cirros image from working.
if [[ "$IRONIC_TEMPEST_WHOLE_DISK_IMAGE" != True ]]; then
IRONIC_IMAGE_NAME=$IRONIC_PARTITIONED_IMAGE_NAME
DEFAULT_IMAGE_NAME=$IRONIC_IMAGE_NAME
fi
fi
}
function upload_dib_image_if_needed {
if [[ "$IRONIC_BUILD_DIB_IMAGE" == "True" ]] && is_service_enabled glance; then
echo "Building a DIB image suitable for local boot"
IRONIC_IMAGE_NAME="ironic-dib-image.img"
local dest
dest="$FILES/$IRONIC_IMAGE_NAME"
build_dib_image "$dest"
openstack image create $IRONIC_IMAGE_NAME \
--public --disk-format qcow2 --container-format bare \
--file $(readlink -f "$dest")
# Change the default image only if the provided settings prevent the
# default cirros image from working.
if [[ "$IRONIC_TEMPEST_WHOLE_DISK_IMAGE" != True ]]; then
IRONIC_IMAGE_NAME=$IRONIC_IMAGE_NAME
DEFAULT_IMAGE_NAME=$IRONIC_IMAGE_NAME
IRONIC_WHOLEDISK_IMAGE_NAME=$IRONIC_IMAGE_NAME
fi
fi
}
# download EFI boot loader image and upload it to glance
# this function sets ``IRONIC_EFIBOOT_ID``
function upload_baremetal_ironic_efiboot {
declare -g IRONIC_EFIBOOT_ID
local efiboot_name
efiboot_name=$(basename $IRONIC_EFIBOOT)
echo_summary "Building and uploading EFI boot image for ironic"
if [ ! -e "$IRONIC_EFIBOOT" ]; then
# NOTE(dtantsur): update doc/source/admin/drivers/redfish.rst when
# changing this procedure.
local efiboot_path
efiboot_path=$(mktemp -d --tmpdir=${DEST})/$efiboot_name
local efiboot_mount
efiboot_mount=$(mktemp -d --tmpdir=${DEST})
dd if=/dev/zero \
of=$efiboot_path \
bs=4096 count=1024
mkfs.fat -s 4 -r 512 -S 4096 $efiboot_path
sudo mount $efiboot_path $efiboot_mount
sudo mkdir -p $efiboot_mount/efi/boot
if [[ "$IRONIC_GRUB2_SHIM_FILE" =~ "http".* ]]; then
sudo wget "$IRONIC_GRUB2_SHIM_FILE" -O $efiboot_mount/efi/boot/boot${GRUB_ARCH}.efi
else
sudo cp "$IRONIC_GRUB2_SHIM_FILE" $efiboot_mount/efi/boot/boot${GRUB_ARCH}.efi
fi
if [[ "$IRONIC_GRUB2_FILE" =~ "http".* ]]; then
sudo wget "$IRONIC_GRUB2_FILE" -O $efiboot_mount/efi/boot/grub${GRUB_ARCH}.efi
else
sudo cp "$IRONIC_GRUB2_FILE" $efiboot_mount/efi/boot/grub${GRUB_ARCH}.efi
fi
sudo umount $efiboot_mount
mv $efiboot_path $IRONIC_EFIBOOT
fi
# load efiboot into glance
# NOTE(TheJulia): Glance requires a project ID be submitted with the
# request *or* we just do it as the project scoped admin using the admin
# project which in devstack's case is the demo project.
# In other words, we can't use devstack-system-admin to upload the image
# unless we set the project_id in the create request.
IRONIC_EFIBOOT_ID=$(openstack --os-cloud devstack-admin \
image create \
$efiboot_name \
--public --disk-format=raw \
--container-format=bare \
-f value -c id \
--file $(readlink -f $IRONIC_EFIBOOT))
die_if_not_set $LINENO IRONIC_EFIBOOT_ID "Failed to load EFI bootloader image into glance"
iniset $IRONIC_CONF_FILE conductor bootloader $IRONIC_EFIBOOT_ID
local efi_grub_path
if is_ubuntu; then
efi_grub_path=EFI/ubuntu/grub.cfg
elif is_fedora; then
if grep -qi CentOS /etc/redhat-release; then
efi_grub_path=EFI/centos/grub.cfg
else
efi_grub_path=EFI/fedora/grub.cfg
fi
else
# NOTE(dtantsur): this is likely incorrect
efi_grub_path=EFI/BOOT/grub.cfg
fi
iniset $IRONIC_CONF_FILE DEFAULT grub_config_path ${IRONIC_GRUB2_CONFIG_PATH:-$efi_grub_path}
}
# build deploy kernel+ramdisk, then upload them to glance
# this function sets ``IRONIC_DEPLOY_KERNEL_ID``, ``IRONIC_DEPLOY_RAMDISK_ID``
function upload_baremetal_ironic_deploy {
declare -g IRONIC_DEPLOY_KERNEL_ID IRONIC_DEPLOY_RAMDISK_ID
local ironic_deploy_kernel_name
local ironic_deploy_ramdisk_name
ironic_deploy_kernel_name=$(basename $IRONIC_DEPLOY_KERNEL)
ironic_deploy_ramdisk_name=$(basename $IRONIC_DEPLOY_RAMDISK)
if [[ "$HOST_TOPOLOGY_ROLE" != "subnode" ]]; then
echo_summary "Creating and uploading baremetal images for ironic"
if [ ! -e "$IRONIC_DEPLOY_RAMDISK" ] || \
[ ! -e "$IRONIC_DEPLOY_KERNEL" ] || \
( is_deploy_iso_required && [ ! -e "$IRONIC_DEPLOY_ISO" ] ); then
# setup IRONIC_PYTHON_AGENT_BUILDER_DIR
setup_ipa_builder
# files don't exist, need to build them
if [ "$IRONIC_BUILD_DEPLOY_RAMDISK" = "True" ]; then
# we can build them only if we're not offline
if [ "$OFFLINE" != "True" ]; then
build_ipa_ramdisk $IRONIC_DEPLOY_KERNEL $IRONIC_DEPLOY_RAMDISK $IRONIC_DEPLOY_ISO
else
die $LINENO "Deploy kernel+ramdisk or iso files don't exist and cannot be built in OFFLINE mode"
fi
else
# Grab the agent image tarball, either from a local file or remote URL
if [[ "$IRONIC_AGENT_KERNEL_URL" =~ "file://" ]]; then
cp ${IRONIC_AGENT_KERNEL_URL:7} $IRONIC_DEPLOY_KERNEL
else
download_with_retry "$IRONIC_AGENT_KERNEL_URL" $IRONIC_DEPLOY_KERNEL
fi
if [[ "$IRONIC_AGENT_RAMDISK_URL" =~ "file://" ]]; then
cp ${IRONIC_AGENT_RAMDISK_URL:7} $IRONIC_DEPLOY_RAMDISK
else
download_with_retry "$IRONIC_AGENT_RAMDISK_URL" $IRONIC_DEPLOY_RAMDISK
fi
if is_ansible_with_tinyipa; then
# NOTE(pas-ha) if using ansible-deploy and tinyipa,
# this will rebuild ramdisk and override $IRONIC_DEPLOY_RAMDISK
rebuild_tinyipa_for_ansible
fi
fi
fi
# load them into glance
if ! is_deploy_iso_required; then
IRONIC_DEPLOY_KERNEL_ID=$(openstack --os-cloud devstack-admin \
image create \
$ironic_deploy_kernel_name \
--public --disk-format=raw \
--container-format=bare \
--file $(readlink -f $IRONIC_DEPLOY_KERNEL) | \
grep ' id ' | get_field 2)
die_if_not_set $LINENO IRONIC_DEPLOY_KERNEL_ID "Failed to load kernel image into glance"
IRONIC_DEPLOY_RAMDISK_ID=$(openstack --os-cloud devstack-admin \
image create \
$ironic_deploy_ramdisk_name \
--public --disk-format=raw \
--container-format=bare \
--file $(readlink -f $IRONIC_DEPLOY_RAMDISK) | \
grep ' id ' | get_field 2)
die_if_not_set $LINENO IRONIC_DEPLOY_RAMDISK_ID "Failed to load ramdisk image into glance"
else
IRONIC_DEPLOY_ISO_ID=$(openstack --os-cloud devstack-admin \
image create \
$(basename $IRONIC_DEPLOY_ISO) \
--public --disk-format=iso \
--container-format=bare \
--file $(readlink -f $IRONIC_DEPLOY_ISO) -f value -c id)
die_if_not_set $LINENO IRONIC_DEPLOY_ISO_ID "Failed to load deploy iso into glance"
fi
else
if is_ansible_with_tinyipa; then
ironic_deploy_ramdisk_name="ansible-$ironic_deploy_ramdisk_name"
fi
IRONIC_DEPLOY_KERNEL_ID=$(openstack --os-cloud $OS_CLOUD image show $ironic_deploy_kernel_name -f value -c id)
IRONIC_DEPLOY_RAMDISK_ID=$(openstack --os-cloud $OS_CLOUD image show $ironic_deploy_ramdisk_name -f value -c id)
fi
iniset $IRONIC_CONF_FILE conductor deploy_kernel $IRONIC_DEPLOY_KERNEL_ID
iniset $IRONIC_CONF_FILE conductor deploy_ramdisk $IRONIC_DEPLOY_RAMDISK_ID
iniset $IRONIC_CONF_FILE conductor rescue_kernel $IRONIC_DEPLOY_KERNEL_ID
iniset $IRONIC_CONF_FILE conductor rescue_ramdisk $IRONIC_DEPLOY_RAMDISK_ID
if [[ "${IRONIC_ANACONDA_INSECURE_HEARTBEAT:-}" != "" ]]; then
iniset $IRONIC_CONF_FILE anaconda insecure_heartbeat ${IRONIC_ANACONDA_INSECURE_HEARTBEAT:-}
fi
# NOTE(TheJulia): Compared to an image deploy, anaconda is relatively
# slow as it installs packages one at a time. As such, we need an option
# to extend.
if [[ "${IRONIC_DEPLOY_CALLBACK_WAIT_TIMEOUT:-}" != "" ]]; then
iniset $IRONIC_CONF_FILE conductor deploy_callback_timeout ${IRONIC_DEPLOY_CALLBACK_WAIT_TIMEOUT:-}
fi
}
function prepare_baremetal_basic_ops {
if [[ "$IRONIC_BAREMETAL_BASIC_OPS" != "True" ]]; then
return 0
fi
if ! is_service_enabled nova && is_http_server_required; then
local image_file_path
if [[ ${IRONIC_WHOLEDISK_IMAGE_NAME} =~ \.img$ ]]; then
image_file_path=$FILES/${IRONIC_WHOLEDISK_IMAGE_NAME}
else
image_file_path=$FILES/${IRONIC_WHOLEDISK_IMAGE_NAME}.img
fi
sudo install -g $LIBVIRT_GROUP -o $STACK_USER -m 644 $image_file_path $IRONIC_HTTP_DIR
fi
upload_baremetal_ironic_deploy
if [[ "$IRONIC_BOOT_MODE" == "uefi" && is_deployed_by_redfish ]]; then
upload_baremetal_ironic_efiboot
fi
upload_image_if_needed
upload_dib_image_if_needed
configure_tftpd
configure_iptables
}
function cleanup_baremetal_basic_ops {
if [[ "$IRONIC_BAREMETAL_BASIC_OPS" != "True" ]]; then
return 0
fi
rm -f $IRONIC_VM_MACS_CSV_FILE
sudo rm -rf $IRONIC_DATA_DIR $IRONIC_STATE_PATH
local vm_name
for vm_name in $(_ironic_bm_vm_names); do
# Delete the Virtual BMCs
if is_deployed_by_ipmi; then
vbmc --no-daemon list | grep -a $vm_name && vbmc --no-daemon delete $vm_name || /bin/true
fi
# pick up the $LIBVIRT_GROUP we have possibly joint
newgrp $LIBVIRT_GROUP <<SUBSHELL
$IRONIC_SCRIPTS_DIR/cleanup-node.sh $vm_name
SUBSHELL
# Cleanup node bridge/interfaces
for i in $(seq 1 $IRONIC_VM_INTERFACE_COUNT); do
sudo ip link del dev tap-${vm_name}i${i}
done
done
sudo ovs-vsctl --if-exists del-br $IRONIC_VM_NETWORK_BRIDGE
sudo rm -rf /etc/xinetd.d/tftp /etc/init/tftpd-hpa.override
restart_service xinetd
sudo iptables -D INPUT -d $HOST_IP -p udp --dport 69 -j ACCEPT || true
sudo iptables -D INPUT -d $HOST_IP -p tcp --dport $IRONIC_SERVICE_PORT -j ACCEPT || true
sudo iptables -D INPUT -d $HOST_IP -p tcp --dport 80 -j ACCEPT || true
sudo iptables -D INPUT -d $HOST_IP -p tcp --dport 443 -j ACCEPT || true
if is_deployed_by_agent; then
# agent ramdisk gets instance image from swift
sudo iptables -D INPUT -d $HOST_IP -p tcp --dport ${SWIFT_DEFAULT_BIND_PORT:-8080} -j ACCEPT || true
fi
sudo rmmod nf_conntrack_tftp || true
sudo rmmod nf_nat_tftp || true
}
function ironic_configure_tempest {
iniset $TEMPEST_CONFIG service_available ironic True
if [[ -n "$TEMPEST_BAREMETAL_MIN_MICROVERSION" ]]; then
iniset $TEMPEST_CONFIG baremetal min_microversion $TEMPEST_BAREMETAL_MIN_MICROVERSION
fi
if [[ -n "$TEMPEST_BAREMETAL_MAX_MICROVERSION" ]]; then
iniset $TEMPEST_CONFIG baremetal max_microversion $TEMPEST_BAREMETAL_MAX_MICROVERSION
fi
if [[ -n "$IRONIC_PING_TIMEOUT" ]]; then
iniset $TEMPEST_CONFIG validation ping_timeout $IRONIC_PING_TIMEOUT
fi
if [[ -n "$IRONIC_IP_VERSION" ]]; then
iniset $TEMPEST_CONFIG validation ip_version_for_ssh $IRONIC_IP_VERSION
fi
if [[ -n "$IRONIC_BOOT_MODE" ]]; then
iniset $TEMPEST_CONFIG baremetal boot_mode $IRONIC_BOOT_MODE
fi
if [[ "$IRONIC_IP_VERSION" == "6" ]]; then
# No FIPs in V6 and we dynamically create networks...
# network_for_ssh is defaulted to public
iniset $TEMPEST_CONFIG validation network_for_ssh
iniset $TEMPEST_CONFIG validation connect_method fixed
iniset $TEMPEST_CONFIG network ipv6-private-subnet
if [ -n "${PUBLIC_ROUTER_ID:-}" ] ; then
# For IPv6 tempest is going to use a precreated router for
# access to the tenant networks (as we have set up routes to it)
# it needs to know the ID of the router and be admin to attach to it
iniset $TEMPEST_CONFIG network public_router_id $PUBLIC_ROUTER_ID
iniset $TEMPEST_CONFIG auth tempest_roles "admin"
fi
fi
if is_service_enabled nova; then
local bm_flavor_id
bm_flavor_id=$(openstack --os-cloud devstack-admin flavor show baremetal -f value -c id)
die_if_not_set $LINENO bm_flavor_id "Failed to get id of baremetal flavor"
iniset $TEMPEST_CONFIG compute flavor_ref $bm_flavor_id
iniset $TEMPEST_CONFIG compute flavor_ref_alt $bm_flavor_id
iniset $TEMPEST_CONFIG compute build_interval 10
iniset $TEMPEST_CONFIG compute-feature-enabled disk_config False
if [[ "$IRONIC_NETWORK_INTERFACE" == "neutron" && $IRONIC_VM_INTERFACE_COUNT -gt 1 ]]; then
iniset $TEMPEST_CONFIG compute-feature-enabled interface_attach True
else
iniset $TEMPEST_CONFIG compute-feature-enabled interface_attach False
fi
fi
# NOTE(jlvillal): If IRONIC_PROVISION_NETWORK_NAME is set it means that
# nodes are using the neutron network driver / multi-tenant networking.
# Otherwise we are using a flat-network.
if [[ -n "${IRONIC_PROVISION_NETWORK_NAME}" ]]; then
# multi-tenant networking
iniset $TEMPEST_CONFIG baremetal use_provision_network True
else
# flat-network
iniset $TEMPEST_CONFIG compute fixed_network_name $PRIVATE_NETWORK_NAME
# NOTE(jroll) this disables multitenant network tests from tempest's
# tree, but not from our tree. This is a bit inconsistent, we should
# fix it.
iniset $TEMPEST_CONFIG auth create_isolated_networks False
iniset $TEMPEST_CONFIG network shared_physical_network True
fi
if is_service_enabled glance; then
local image_uuid
image_uuid=$(openstack --os-cloud $OS_CLOUD image show $IRONIC_IMAGE_NAME -f value -c id)
iniset $TEMPEST_CONFIG compute image_ref $image_uuid
iniset $TEMPEST_CONFIG compute image_ref_alt $image_uuid
image_uuid=$(openstack --os-cloud $OS_CLOUD image show $IRONIC_WHOLEDISK_IMAGE_NAME -f value -c id)
iniset $TEMPEST_CONFIG baremetal whole_disk_image_ref $image_uuid
image_uuid=$(openstack --os-cloud $OS_CLOUD image show $IRONIC_PARTITIONED_IMAGE_NAME -f value -c id)
iniset $TEMPEST_CONFIG baremetal partition_image_ref $image_uuid
fi
# Our cirros images cannot do local boot and we don't support
# Netboot anymore, but the conditional is still used because
# some boot constraints exist around cirros. i.e. the setting
# likely should just be "don't attempt the partition boot test.
if [[ "${IRONIC_PARTITIONED_IMAGE_NAME}" =~ cirros ]]; then
iniset $TEMPEST_CONFIG baremetal partition_netboot True
else
iniset $TEMPEST_CONFIG baremetal partition_netboot False
fi
if [[ "$IRONIC_IP_VERSION" == "6" ]]; then
iniset $TEMPEST_CONFIG baremetal whole_disk_image_url "http://$IRONIC_HOST_IPV6:$IRONIC_HTTP_PORT/${IRONIC_WHOLEDISK_IMAGE_NAME}.img"
else
iniset $TEMPEST_CONFIG baremetal whole_disk_image_url "http://$IRONIC_HTTP_SERVER:$IRONIC_HTTP_PORT/${IRONIC_WHOLEDISK_IMAGE_NAME}.img"
fi
iniset $TEMPEST_CONFIG baremetal whole_disk_image_checksum $(sha256sum $FILES/${IRONIC_WHOLEDISK_IMAGE_NAME}.img)
if [[ "$IRONIC_RAMDISK_IMAGE" != "" ]]; then
iniset $TEMPEST_CONFIG baremetal ramdisk_iso_image_ref "$IRONIC_RAMDISK_IMAGE"
fi
if [[ "${IRONIC_ANACONDA_IMAGE_REF:-}" != "" ]]; then
# In a perfect world we would use *just* the opendev repo
# mirror, and let things be magical, but OpenDev Infra cannot
# mirror the /images path with the limited storage space.
iniset $TEMPEST_CONFIG baremetal anaconda_image_ref ${IRONIC_ANACONDA_IMAGE_REF:-}
fi
if [[ "${IRONIC_ANACONDA_KERNEL_REF:-}" != "" ]]; then
iniset $TEMPEST_CONFIG baremetal anaconda_kernel_ref ${IRONIC_ANACONDA_KERNEL_REF:-}
fi
if [[ "${IRONIC_ANACONDA_RAMDISK_REF:-}" != "" ]]; then
iniset $TEMPEST_CONFIG baremetal anaconda_initial_ramdisk_ref ${IRONIC_ANACONDA_RAMDISK_REF:-}
fi
if [[ "${IRONIC_ANACONDA_STAGE2_REF:-}" != "" ]]; then
iniset $TEMPEST_CONFIG baremetal anaconda_stage2_ramdisk_ref ${IRONIC_ANACONDA_STAGE2_REF:-}
fi
# NOTE(dtantsur): keep this option here until the defaults change in
# ironic-tempest-plugin to disable classic drivers testing.
iniset $TEMPEST_CONFIG baremetal enabled_drivers ""
iniset $TEMPEST_CONFIG baremetal enabled_hardware_types $IRONIC_ENABLED_HARDWARE_TYPES
iniset $TEMPEST_CONFIG baremetal enabled_bios_interfaces $IRONIC_ENABLED_BIOS_INTERFACES
iniset $TEMPEST_CONFIG baremetal enabled_deploy_interfaces $IRONIC_ENABLED_DEPLOY_INTERFACES
iniset $TEMPEST_CONFIG baremetal enabled_boot_interfaces $IRONIC_ENABLED_BOOT_INTERFACES
iniset $TEMPEST_CONFIG baremetal enabled_rescue_interfaces $IRONIC_ENABLED_RESCUE_INTERFACES
iniset $TEMPEST_CONFIG baremetal enabled_inspect_interfaces $IRONIC_ENABLED_INSPECT_INTERFACES
iniset $TEMPEST_CONFIG baremetal default_rescue_interface $IRONIC_DEFAULT_RESCUE_INTERFACE
# Driver for API tests
iniset $TEMPEST_CONFIG baremetal driver fake-hardware
# NOTE(dtantsur): remove this when the tempest plugin no longer supports
# netboot (i.e. when Zed is the oldest supported branch).
iniset $TEMPEST_CONFIG baremetal default_boot_option local
local adjusted_root_disk_size_gb
if [[ "$IRONIC_IS_HARDWARE" == "False" ]]; then
adjusted_root_disk_size_gb=$(( ${IRONIC_VM_SPECS_DISK} - ${IRONIC_VM_EPHEMERAL_DISK} ))
else
adjusted_root_disk_size_gb=$(( ${IRONIC_HW_NODE_DISK} - ${IRONIC_HW_EPHEMERAL_DISK} ))
fi
iniset $TEMPEST_CONFIG baremetal adjusted_root_disk_size_gb $adjusted_root_disk_size_gb
if [[ -n "${IRONIC_TEMPEST_BUILD_TIMEOUT}" ]]; then
iniset $TEMPEST_CONFIG baremetal unprovision_timeout $IRONIC_TEMPEST_BUILD_TIMEOUT
iniset $TEMPEST_CONFIG baremetal active_timeout $IRONIC_TEMPEST_BUILD_TIMEOUT
iniset $TEMPEST_CONFIG baremetal deploywait_timeout $IRONIC_TEMPEST_BUILD_TIMEOUT
iniset $TEMPEST_CONFIG baremetal power_timeout $IRONIC_TEMPEST_BUILD_TIMEOUT
iniset $TEMPEST_CONFIG baremetal rescue_timeout $IRONIC_TEMPEST_BUILD_TIMEOUT
iniset $TEMPEST_CONFIG baremetal unrescue_timeout $IRONIC_TEMPEST_BUILD_TIMEOUT
iniset $TEMPEST_CONFIG baremetal inspect_timeout $IRONIC_TEMPEST_BUILD_TIMEOUT
fi
if [[ $IRONIC_VM_VOLUME_COUNT -gt 1 ]]; then
iniset $TEMPEST_CONFIG baremetal_feature_enabled software_raid True
iniset $TEMPEST_CONFIG baremetal_feature_enabled deploy_time_raid True
fi
# Enabled features
iniset $TEMPEST_CONFIG baremetal_feature_enabled ipxe_enabled $IRONIC_IPXE_ENABLED
iniset $TEMPEST_CONFIG baremetal_feature_enabled fast_track_discovery $IRONIC_DEPLOY_FAST_TRACK
if [[ "$IRONIC_IS_HARDWARE" == "False" ]]; then
# Adoption requires reading or guessing the BMC credentials, so let's
# not enable it for real hardware, at least for now.
iniset $TEMPEST_CONFIG baremetal_feature_enabled adoption True
fi
if [[ "$IRONIC_ENFORCE_SCOPE" == "True" ]]; then
iniset $TEMPEST_CONFIG enforce_scope ironic True
iniset $TEMPEST_CONFIG enforce_scope ironic_inspector True
fi
}
function get_ironic_node_prefix {
local node_prefix="node"
if [[ "$HOST_TOPOLOGY_ROLE" == "subnode" ]]; then
node_prefix="$(cat /etc/devstack-host|sed s/compute/c/)node"
fi
echo $node_prefix
}
function setup_vxlan_network {
sudo ip link add phy-brbm-infra type bridge
sudo ip link set dev phy-brbm-infra up
sudo ovs-vsctl add-port $IRONIC_VM_NETWORK_BRIDGE phy-brbm-infra
sudo ip link add phy-infra-brbm type bridge
sudo ip link set dev phy-infra-brbm up
sudo ovs-vsctl add-port $PUBLIC_BRIDGE phy-infra-brbm
sudo ovs-vsctl set interface phy-brbm-infra type=patch
sudo ovs-vsctl set interface phy-infra-brbm type=patch
sudo ovs-vsctl set interface phy-infra-brbm options:peer=phy-brbm-infra
sudo ovs-vsctl set interface phy-brbm-infra options:peer=phy-infra-brbm
}
function downgrade_dnsmasq {
if is_ubuntu; then
# NOTE(JayF): This checks out the unreleased dnsmasq commit which
# includes the fix for the crash issue described in
# https://bugs.launchpad.net/ironic/+bug/2026757
# This patch has yet to be included in a release.
if [[ -f /opt/stack/.patched-dnsmasq ]]; then
# NOTE(JayF) Keep Ironic devstack plugin idempotent by skipping
# downgrade if we already have the desired version.
echo "Dnsmasq already downgraded, continuing..."
else
echo "Downgrading dnsmasq..."
sudo dpkg -r dnsmasq-base
# NOTE(JayF) Cannot shallow clone; need to checkout a commit that
# is not part of a named tag
DNSMASQ_DIR=$(mktemp --tmpdir -u dnsmasq.XXXXXX)
git clone http://thekelleys.org.uk/git/dnsmasq.git $DNSMASQ_DIR
pushd $DNSMASQ_DIR
# https://thekelleys.org.uk/gitweb/?p=dnsmasq.git;a=commitdiff;h=f006be7842104a9f86fbf419326b7aad08ade61d
# above is the specific patch we need; but using the 2.91 RC which
# includes that (and more)
git checkout v2.91rc5
sudo make PREFIX=/usr install
sudo touch /opt/stack/.patched-dnsmasq
popd
rm -rf $DNSMASQ_DIR
fi
fi
}
# Restore xtrace + pipefail
$_XTRACE_IRONIC
$_PIPEFAIL_IRONIC
View Git Blame Copy Permalink