add and update ansible playbooks for infra

- [openstack_user_config]: remove NFS in favor of (properly isntalled)
  iscsi
- [openstack_user_config]: remove extraneous config in favor of shorter
  version
- [storage] install and enable targetd (target.service)
- [ansible] only run 'infra' tags on the first infra host - never on an
  AIO
- [ansible] change roles to use the ``host`` extra var to configure
  where to run to mitigate accidents
- [ansible] add aio steps to infra playbook
- [ansible] add storage host playbook to configure volumes and iscsi
- [ansible] aio: configure volume groups

.gitignore

@@ -2,3 +2,5 @@ id_ed25519
 .terraform/
 .envrc
 *.retry
+ansible/*.retry
+ansible/playbooks/files/buffer/*

ansible/playbooks/files/buffer/infra-id_rsa.pub

@@ -1 +0,0 @@
-ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQD1SYGS4jZOSofKLEuQUiaEcqrr4RTiXm43CvlGVWynqKJ+iUgpfutenu8hrhozZZCKhqJS1Z48RielPzIhRfcCBrcr7a2VeIKAaMnYQiAvu7DDbAXuGwQqhvqnn5F/3VQwGTvJXMqxhe+YQYL+sCihlMcx7baxudJGDkATXFCl3m+vekKhdIkIBv5i5+Dd9P8sUK+c9KFY8IbMNbHIY5CpNcPvtuP12YdBmCn2unPKm7H0aPKqe27OXqTen8ts9MgeVvq+soDOAGH/PD2Ud38O1WzhWlmnhPzP8VXgdz9/zVCOVUZcVzFQkMop+bc0qqPhUaOWIxehV4QQ+mo9y0XIiSOEbq41QFapCRQBHsl5ctp6wvCXmSJ3GVml1L86G+TI+IPyNeVdXQE+9dkeoNqBB8jDFw5xT6boCoIXLCbjsgHIA6Iq//uvGhQiQcH/OJABYm+8LujE3k6Ksu/W9Jad1xs9owNosFyh871ukfgQl7yr681BK/hHWKwgdH/K8Wcuwm0fbuYBJJufLB4dA4trJsnDySxm+tGYbU+HOiGnGkwImKUqIRZ++FBsX8cNvZ5mH4GaGtUOl5WzCgyXClZ5xXtx5swNN2Eeuhlit7jdIwwJc2IAklaA4zJ1rkNoD5l/4tIvpCsyuCLafxSJAQc5vcqrYQOgXfXdiAhhLTqQ/w== ansible-generated on ala-infra1

ansible/playbooks/files/openstack_user_config.yml

@@ -66,11 +66,19 @@ x-compute-hosts: &x-compute-hosts
   compute1:
     ip: 172.29.220.6
 x-storage-hosts: &x-storage-hosts
-  infra1:
+  storage1:
     ip: 172.29.220.7
     container_vars:
       cinder_backends:
         limit_container_types: cinder_volume
+          #nfs_volume:
+          #  volume_backend_name: NFS_VOLUME1
+          #  volume_driver: cinder.volume.drivers.nfs.NfsDriver
+          #  nfs_mount_options: "rsize=65535,wsize=65535,timeo=1200,actimeo=120"
+          #  nfs_shares_config: /etc/cinder/nfs_shares
+          #  shares:
+          #    - ip: "172.29.228.7"
+          #      share: "/vol/cinder"
         lvm:
           volume_group: cinder-volumes
           volume_driver: cinder.volume.drivers.lvm.LVMVolumeDriver
@@ -107,86 +115,5 @@ network_hosts:
   <<: *x-infra-hosts
 compute_hosts:
   <<: *x-compute-hosts
-#storage_hosts:
-#  <<: *x-storage-hosts
-
-###
-### Infrastructure
-###
-
-  ## galera, memcache, rabbitmq, utility
-  #shared-infra_hosts:
-  #  infra1:
-  #    ip: 172.29.220.5
-  #
-  ## repository (apt cache, python packages, etc)
-  #repo-infra_hosts:
-  #  infra1:
-  #    ip: 172.29.220.5
-  #
-  ## load balancer
-  #haproxy_hosts:
-  #  infra1:
-  #    ip: 172.29.220.5
-  #
-  ####
-  #### OpenStack
-  ####
-  #
-  ## keystone
-  #identity_hosts:
-  #  infra1:
-  #    ip: 172.29.220.5
-  #
-  ## cinder api services
-  #storage-infra_hosts:
-  #  infra1:
-  #    ip: 172.29.220.5
-  #
-  ## glance
-  #image_hosts:
-  #  infra1:
-  #    ip: 172.29.220.5
-  #
-  ## placement
-  #placement-infra_hosts:
-  #  infra1:
-  #    ip: 172.29.220.5
-  #
-  ## nova api, conductor, etc services
-  #compute-infra_hosts:
-  #  infra1:
-  #    ip: 172.29.220.5
-  #
-  ## heat
-  #orchestration_hosts:
-  #  infra1:
-  #    ip: 172.29.220.5
-  #
-  ## horizon
-  #dashboard_hosts:
-  #  infra1:
-  #    ip: 172.29.220.5
-  #
-  ## neutron server, agents (L3, etc)
-  #network_hosts:
-  #  infra1:
-  #    ip: 172.29.220.5
-  #
-  ## nova hypervisors
-  #compute_hosts:
-  #  compute1:
-  #    ip: 172.29.220.6
-  #
-  ## cinder storage host (LVM-backed)
-  #storage_hosts:
-  #  storage1:
-  #    ip: 172.29.220.7
-  #    container_vars:
-  #      cinder_backends:
-  #        limit_container_types: cinder_volume
-  #        lvm:
-  #          volume_group: cinder-volumes
-  #          volume_driver: cinder.volume.drivers.lvm.LVMVolumeDriver
-  #          volume_backend_name: LVM_iSCSI
-  #          iscsi_ip_address: "172.29.228.7"
+storage_hosts:
+  <<: *x-storage-hosts

ansible/playbooks/files/user_galera.yml

@@ -0,0 +1,4 @@
+---
+# Set max connections to 500 to support running all services
+#
+galera_max_connections: 500

ansible/playbooks/handlers/main.yml

@@ -3,3 +3,9 @@
   service:
     name: sshd
     state: restarted
+- name: enable_targetd
+  shell: "systemctl enable --now target"
+- name: restart_targetd
+  service:
+    name: target
+    state: restarted

ansible/playbooks/init-nodes.retry

@@ -1 +0,0 @@
-infra1

ansible/playbooks/init-nodes.yml

@@ -36,7 +36,7 @@
     - name: Set SELinux to permissive
       ansible.posix.selinux:
         policy: targeted
-        state: permissive
+        state: disabled
       tags: services
 
     - name: Ensure packages are upgraded
@@ -45,6 +45,31 @@
         state: latest
       tags: packages
 
+    - name: Generate SSH key
+      block:
+        - name: Create ssh key for root
+          ansible.builtin.user:
+            name: root
+            generate_ssh_key: yes
+            ssh_key_bits: 4096
+            ssh_key_file: .ssh/id_rsa
+          register: sshkey_register
+          tags: sshkey
+
+        - name: fetch_keys
+          tags: sshkey
+          fetch:
+            src: "~/.ssh/id_rsa.pub"
+            dest: "files/buffer/infra-id_rsa.pub"
+            flat: yes
+          when: sshkey_register.ssh_public_key != ""
+          register: sshkey_fetch
+
+      when: tag.find("infra") != -1 and name == "infra1"
+      tags:
+        - infra
+        - sshkey
+
     - name: Disable SSH Agent Forwarding
       lineinfile:
         dest: /etc/ssh/sshd_config

ansible/playbooks/role-infra-host.yml

@@ -1,7 +1,7 @@
 ---
 
 - name: Bootstrap
-  hosts: infra1
+  hosts: "{{ host }}"
   become: true
 
   handlers:
@@ -43,22 +43,23 @@
         - bootstrap
 
     - name: Deploy and setup configuration
+      when: not aio_install | default('true') # bootstrap-AIO script instead does these things.
       block:
         - name: Copy template to etc
           ansible.builtin.copy:
             remote_src: yes
-            src: /opt/openstack-ansible/etc/openstack_deploy
-            dest: /etc/
+            src: /opt/openstack-ansible/etc/openstack_deploy/
+            dest: /etc/openstack_deploy/
             directory_mode: yes
+            force: no
 
-        - name: Copy our openstack configs
+        - name: Copy distributed openstack configs
           ansible.builtin.copy:
             src: "files/{{ item }}.yml"
             dest: /etc/openstack_deploy/
             mode: '0644'
           with_items:
             - openstack_user_config
-            - user_lxc
 
         - name: Create secrets
           become: true
@@ -68,15 +69,47 @@
           args:
             creates: /etc/openstack_deploy/user_secrets.yml.tar
 
+    - name: "[AIO] Deploy and setup configuration / bootstrap"
+      when: aio_install | default('false')
+      block:
+        - name: Debug - Running AIO bootstrap
+          debug:
+            var: aio_install
+
+        - name: Run bootstrap ansible with included args
+          ansible.builtin.shell: scripts/bootstrap-aio.sh
+          become: true
+          args:
+            chdir: /opt/openstack-ansible/
+            creates: /etc/openstack_deploy/
+          tags:
+            - bootstrap
+            - aio
+
+        - name: Create volume group for cinder
+          lvg:
+            pv_options: --metadatasize=2048
+            pvs: "{{ cinder_pv_device | default('/dev/vdb') }}"
+            vg: cinder-volumes
+
+    - name: Copy common openstack configs
+      ansible.builtin.copy:
+        src: "files/{{ item }}.yml"
+        dest: /etc/openstack_deploy/
+        mode: '0644'
+      with_items:
+        - user_lxc
+        - user_galera
+
 
     - name: Check playbooks
       tags: syntax
       become: true
       ansible.builtin.shell:
-        cmd: openstack-ansible --syntax-check ${item}.yml
+        cmd: "openstack-ansible --syntax-check setup-{{ item }}.yml"
       args:
         chdir: /opt/openstack-ansible/playbooks/
-      with_items:
+      loop:
         - hosts
         - infrastructure
         - openstack

ansible/playbooks/role-storage-host.yml

@@ -0,0 +1,49 @@
+---
+# Setup the storage host. Install targetcli and make sure any volumes are mounted.
+
+- name: Storage Host Configuration
+  hosts: storage1
+  become: true
+
+  handlers:
+    - import_tasks: handlers/main.yml
+
+  pre_tasks:
+    - name: Check if ansible cannot be run here
+      stat:
+        path: /etc/no-ansible
+      register: no_ansible
+
+    - name: Verify if we can run ansible
+      assert:
+        that:
+          - "not no_ansible.stat.exists"
+        success_msg: "We are able to run on this node"
+        fail_msg: "/etc/no-ansible exists - skipping run on this node"
+
+  tasks:
+    - name: Loading Variables from OS Common
+      import_tasks: tasks/common_vars.yml
+
+    - name: Install required packages
+      become: true
+      dnf:
+        name: targetcli
+      notify: enable_targetd
+
+    - name: Create volume group for cinder
+      lvg:
+        pv_options: --metadatasize=2048
+        pvs: "{{ cinder_pv_device | default('/dev/vdb') }}"
+        vg: cinder-volumes
+
+
+  post_tasks:
+    - name: Touching run file that ansible has ran here
+      file:
+        path: /var/log/ansible.run
+        state: touch
+        mode: '0644'
+        owner: root
+        group: root
+...