aodh: Split aodh out of ceilometer barclamp

Alarming has its own service as part of the telemetry group of services in OpenStack. This change splits the deployment of Aodh out of Ceilometer barclamp to make it clear which settings and attributes belong to which part of the telemetry services.

aodh.yml

@@ -0,0 +1,41 @@
+#
+# Copyright 2017, SUSE LINUX GmbH
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+barclamp:
+  name: 'aodh'
+  display: 'Aodh'
+  description: 'OpenStack Telemetry: Alarming service'
+  version: 0
+  user_managed: true
+  requires:
+    - '@crowbar'
+    - 'pacemaker'
+    - 'database'
+    - 'rabbitmq'
+    - 'keystone'
+    - 'ceilometer'
+  member:
+    - 'openstack'
+
+crowbar:
+  layout: 1
+  order: 99
+  run_order: 99
+  chef_order: 99
+  proposal_schema_version: 3
+
+smoketest:
+  timeout: 1200

bin/crowbar_aodh

@@ -0,0 +1,22 @@
+#!/usr/bin/env ruby
+#
+# Copyright 2017, SUSE LINUX GmbH
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+require File.join(File.expand_path(File.dirname(__FILE__)), "barclamp_lib")
+@barclamp = "aodh"
+@timeout = 3600
+
+main

chef/cookbooks/aodh/attributes/default.rb

@@ -54,6 +54,10 @@
 default[:aodh][:evaluator][:service_name] = evaluator_service_name
 default[:aodh][:notifier][:service_name]  = notifier_service_name
 default[:aodh][:listener][:service_name]  = listener_service_name
+default[:aodh][:alarm_threshold_evaluation_interval] = 600
+
+default[:aodh][:debug] = false
+default[:aodh][:verbose] = false
 
 default[:aodh][:user] = "aodh"
 default[:aodh][:group] = "aodh"
@@ -62,6 +66,13 @@
 default[:aodh][:service_user] = "aodh"
 default[:aodh][:service_password] = ""
 
+default[:aodh][:ssl][:certfile] = "/etc/aodh/ssl/certs/signing_cert.pem"
+default[:aodh][:ssl][:keyfile] = "/etc/aodh/ssl/private/signing_key.pem"
+default[:aodh][:ssl][:generate_certs] = false
+default[:aodh][:ssl][:insecure] = false
+default[:aodh][:ssl][:cert_required] = false
+default[:aodh][:ssl][:ca_certs] = "/etc/aodh/ssl/certs/ca.pem"
+
 default[:aodh][:api][:protocol] = "http"
 default[:aodh][:api][:host] = "0.0.0.0"
 default[:aodh][:api][:port] = 8042
@@ -73,6 +84,7 @@
 default[:aodh][:db][:user] = "aodh"
 default[:aodh][:db][:password] = ""
 
+default[:aodh][:ha][:server][:enabled] = false
 default[:aodh][:ha][:evaluator][:agent] = "systemd:#{evaluator_service_name}"
 default[:aodh][:ha][:evaluator][:op][:monitor][:interval] = "10s"
 default[:aodh][:ha][:notifier][:agent] = "systemd:#{notifier_service_name}"

chef/cookbooks/aodh/recipes/aodh.rb

@@ -1,60 +1,70 @@
-ha_enabled = node[:ceilometer][:ha][:server][:enabled]
+ha_enabled = node[:aodh][:ha][:server][:enabled]
 
 node[:aodh][:platform][:packages].each do |p|
   package p
 end
 
-# mongdb setup has been already done by server.rb recipe
-unless node[:ceilometer][:use_mongodb]
-  db_settings = fetch_database_settings
 
-  include_recipe "database::client"
-  include_recipe "#{db_settings[:backend_name]}::client"
-  include_recipe "#{db_settings[:backend_name]}::python-client"
+db_settings = fetch_database_settings
 
-  crowbar_pacemaker_sync_mark "wait-aodh_database"
+include_recipe "database::client"
+include_recipe "#{db_settings[:backend_name]}::client"
+include_recipe "#{db_settings[:backend_name]}::python-client"
 
-  # Create the Aodh Database
-  database "create #{node[:aodh][:db][:database]} database" do
-    connection db_settings[:connection]
-    database_name node[:aodh][:db][:database]
-    provider db_settings[:provider]
-    action :create
-    only_if { !ha_enabled || CrowbarPacemakerHelper.is_cluster_founder?(node) }
-  end
+crowbar_pacemaker_sync_mark "wait-aodh_database"
 
-  database_user "create aodh database user" do
-    host "%"
-    connection db_settings[:connection]
-    username node[:aodh][:db][:user]
-    password node[:aodh][:db][:password]
-    provider db_settings[:user_provider]
-    action :create
-    only_if { !ha_enabled || CrowbarPacemakerHelper.is_cluster_founder?(node) }
-  end
+# Create the Aodh Database
+database "create #{node[:aodh][:db][:database]} database" do
+  connection db_settings[:connection]
+  database_name node[:aodh][:db][:database]
+  provider db_settings[:provider]
+  action :create
+  only_if { !ha_enabled || CrowbarPacemakerHelper.is_cluster_founder?(node) }
+end
 
-  database_user "grant database access for aodh database user" do
-    connection db_settings[:connection]
-    username node[:aodh][:db][:user]
-    password node[:aodh][:db][:password]
-    database_name node[:aodh][:db][:database]
-    host "%"
-    privileges db_settings[:privs]
-    provider db_settings[:user_provider]
-    action :grant
-    only_if { !ha_enabled || CrowbarPacemakerHelper.is_cluster_founder?(node) }
-  end
+database_user "create aodh database user" do
+  host "%"
+  connection db_settings[:connection]
+  username node[:aodh][:db][:user]
+  password node[:aodh][:db][:password]
+  provider db_settings[:user_provider]
+  action :create
+  only_if { !ha_enabled || CrowbarPacemakerHelper.is_cluster_founder?(node) }
+end
 
-  crowbar_pacemaker_sync_mark "create-aodh_database"
+database_user "grant database access for aodh database user" do
+  connection db_settings[:connection]
+  username node[:aodh][:db][:user]
+  password node[:aodh][:db][:password]
+  database_name node[:aodh][:db][:database]
+  host "%"
+  privileges db_settings[:privs]
+  provider db_settings[:user_provider]
+  action :grant
+  only_if { !ha_enabled || CrowbarPacemakerHelper.is_cluster_founder?(node) }
 end
 
+crowbar_pacemaker_sync_mark "create-aodh_database"
+
 directory "/var/cache/aodh" do
   owner node[:aodh][:user]
   group "root"
   mode 00755
   action :create
 end unless node[:platform_family] == "suse"
 
+if node[:aodh][:api][:protocol] == "https"
+  ssl_setup "setting up ssl for aodh" do
+    generate_certs node[:aodh][:ssl][:generate_certs]
+    certfile node[:aodh][:ssl][:certfile]
+    keyfile node[:aodh][:ssl][:keyfile]
+    group node[:aodh][:group]
+    fqdn node[:fqdn]
+    cert_required node[:aodh][:ssl][:cert_required]
+    ca_certs node[:aodh][:ssl][:ca_certs]
+  end
+end
+
 keystone_settings = KeystoneHelper.keystone_settings(node, @cookbook_name)
 
 register_auth_hash = { user: keystone_settings["admin_user"],
@@ -119,38 +129,13 @@
   action :add_endpoint_template
 end
 
-if node[:ceilometer][:use_mongodb]
-  db_connection = nil
-
-  if node[:ceilometer][:ha][:server][:enabled]
-    db_hosts = search(:node,
-                      "ceilometer_ha_mongodb_replica_set_member:true AND roles:ceilometer-server AND "\
-                      "ceilometer_config_environment:#{node[:ceilometer][:config][:environment]}"
-                     )
-    unless db_hosts.empty?
-      mongodb_servers = db_hosts.map { |s| "#{Chef::Recipe::Barclamp::Inventory.get_network_by_type(s, "admin").address}:#{s[:ceilometer][:mongodb][:port]}" }
-      db_connection = "mongodb://#{mongodb_servers.sort.join(",")}/ceilometer?replicaSet=#{node[:ceilometer][:ha][:mongodb][:replica_set][:name]}"
-    end
-  end
-
-  # if this is a cluster, but the replica set member attribute hasn't
-  # been set on any node (yet), we just fallback to using the first
-  # ceilometer-server node
-  if db_connection.nil?
-    db_hosts = search_env_filtered(:node, "roles:ceilometer-server")
-    db_host = db_hosts.first || node
-    mongodb_ip = Chef::Recipe::Barclamp::Inventory.get_network_by_type(db_host, "admin").address
-    db_connection = "mongodb://#{mongodb_ip}:#{db_host[:ceilometer][:mongodb][:port]}/ceilometer"
-  end
-else
-  db_name = node[:aodh][:db][:database]
-  db_user = node[:aodh][:db][:user]
-  db_password = node[:aodh][:db][:password]
-  db_connection =
+db_name = node[:aodh][:db][:database]
+db_user = node[:aodh][:db][:user]
+db_password = node[:aodh][:db][:password]
+db_connection =
     "#{db_settings[:url_scheme]}://#{db_user}:#{db_password}@#{db_settings[:address]}/#{db_name}"
-end
 
-if node[:ceilometer][:ha][:server][:enabled]
+if node[:aodh][:ha][:server][:enabled]
   admin_address = Chef::Recipe::Barclamp::Inventory.get_network_by_type(node, "admin").address
   bind_host = admin_address
   bind_port = node[:aodh][:ha][:ports][:api]
@@ -165,15 +150,16 @@
   group node[:aodh][:group]
   mode "0640"
   variables(
-    debug: node[:ceilometer][:debug],
-    verbose: node[:ceilometer][:verbose],
+    debug: node[:aodh][:debug],
+    verbose: node[:aodh][:verbose],
     rabbit_settings: fetch_rabbitmq_settings,
     keystone_settings: keystone_settings,
     bind_host: bind_host,
     bind_port: bind_port,
     database_connection: db_connection,
     node_hostname: node["hostname"],
-    alarm_threshold_evaluation_interval: node[:ceilometer][:alarm_threshold_evaluation_interval]
+    aodh_ssl: node[:aodh][:ssl],
+    alarm_threshold_evaluation_interval: node[:aodh][:alarm_threshold_evaluation_interval]
   )
   notifies :reload, resources(service: "apache2")
 end
@@ -218,6 +204,15 @@
   daemon_process "aodh-api"
   user node[:aodh][:user]
   group node[:aodh][:group]
+  script_alias "/srv/www/aodh-api/app.wsgi"
+  pass_authorization true
+  limit_request_body 114688
+  ssl_enable node[:aodh][:api][:protocol] == "https"
+  ssl_certfile node[:aodh][:ssl][:certfile]
+  ssl_keyfile node[:aodh][:ssl][:keyfile]
+  if node[:cinder][:ssl][:cert_required]
+    ssl_cacert node[:aodh][:ssl][:ca_certs]
+  end
 end
 
 apache_site "aodh-api.conf" do

chef/cookbooks/aodh/recipes/aodh_ha.rb

@@ -18,8 +18,8 @@
 haproxy_loadbalancer "aodh-api" do
   address "0.0.0.0"
   port node[:aodh][:api][:port]
-  use_ssl false
-  servers CrowbarPacemakerHelper.haproxy_servers_for_service(node, "aodh", "ceilometer-server", "api")
+  use_ssl(node[:aodh][:api][:protocol] == "https")
+  servers CrowbarPacemakerHelper.haproxy_servers_for_service(node, "aodh", "aodh-server", "api")
   action :nothing
 end.run_action(:create)
 
@@ -67,20 +67,7 @@
 
 order_only_existing = ["rabbitmq", "cl-keystone", clone_name]
 
-if node[:ceilometer][:use_mongodb]
-  pacemaker_order "o-ceilometer-mongo" do
-    score "Mandatory"
-    ordering "cl-mongodb #{clone_name}"
-    action :update
-    only_if { CrowbarPacemakerHelper.is_cluster_founder?(node) }
-  end
-  transaction_objects << "pacemaker_order[o-ceilometer-mongo]"
-else
-  # we don't make the db mandatory if not mongodb; this is debatable, but
-  # oslo.db is supposed to deal well with reconnections; it's less clear about
-  # mongodb
-  order_only_existing.unshift "postgresql"
-end
+order_only_existing.unshift "postgresql"
 
 location_name = openstack_pacemaker_controller_only_location_for clone_name
 transaction_objects << "pacemaker_location[#{location_name}]"

chef/cookbooks/aodh/recipes/role_aodh_server.rb

@@ -0,0 +1,19 @@
+#
+# Copyright 2017, SUSE LINUX GmbH
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+if CrowbarRoleRecipe.node_state_valid_for_role?(node, "aodh", "aodh-server")
+  include_recipe "aodh::aodh"
+end

chef/cookbooks/ceilometer/attributes/default.rb

@@ -21,24 +21,18 @@
 api_service_name = "ceilometer-api"
 collector_service_name = "ceilometer-collector"
 agent_notification_service_name = "ceilometer-agent-notification"
-alarm_evaluator_service_name = "ceilometer-alarm-evaluator"
-alarm_notifier_service_name = "ceilometer-alarm-notifier"
 
 if %w(rhel suse).include?(node[:platform_family])
   central_service_name = "openstack-ceilometer-agent-central"
   api_service_name = "openstack-ceilometer-api"
   collector_service_name = "openstack-ceilometer-collector"
   agent_notification_service_name = "openstack-ceilometer-agent-notification"
-  alarm_evaluator_service_name = "openstack-ceilometer-alarm-evaluator"
-  alarm_notifier_service_name = "openstack-ceilometer-alarm-notifier"
 end
 
 default[:ceilometer][:api][:service_name] = api_service_name
 default[:ceilometer][:collector][:service_name] = collector_service_name
 default[:ceilometer][:agent_notification][:service_name] = agent_notification_service_name
 default[:ceilometer][:central][:service_name] = central_service_name
-default["ceilometer"]["alarm_evaluator"]["service_name"] = alarm_evaluator_service_name
-default["ceilometer"]["alarm_notifier"]["service_name"] = alarm_notifier_service_name
 
 default[:ceilometer][:debug] = false
 default[:ceilometer][:verbose] = false
@@ -77,11 +71,6 @@
 default[:ceilometer][:ha][:agent_notification][:agent] = "systemd:#{agent_notification_service_name}"
 default[:ceilometer][:ha][:agent_notification][:op][:monitor][:interval] = "10s"
 
-default["ceilometer"]["ha"]["alarm_evaluator"]["agent"] = "systemd:#{alarm_evaluator_service_name}"
-default["ceilometer"]["ha"]["alarm_evaluator"]["op"]["monitor"]["interval"] = "10s"
-default["ceilometer"]["ha"]["alarm_notifier"]["agent"] = "systemd:#{alarm_notifier_service_name}"
-default["ceilometer"]["ha"]["alarm_notifier"]["op"]["monitor"]["interval"] = "10s"
-
 default[:ceilometer][:ha][:central][:enabled] = false
 default[:ceilometer][:ha][:central][:agent] = "systemd:#{central_service_name}"
 default[:ceilometer][:ha][:central][:op][:monitor][:interval] = "10s"

chef/cookbooks/ceilometer/metadata.rb

@@ -11,6 +11,5 @@
 depends "crowbar-openstack"
 depends "crowbar-pacemaker"
 depends "utils"
-depends "aodh"
 
 recommends "hyperv"

chef/cookbooks/ceilometer/recipes/server.rb

@@ -125,7 +125,6 @@
 end
 
 include_recipe "#{@cookbook_name}::common"
-include_recipe "aodh::aodh"
 
 directory "/var/cache/ceilometer" do
   owner node[:ceilometer][:user]