Technology articles

Continued from http://teknoarticles.blogspot.com.es/2017/08/automating-local-mirrors-creation-in.html In the previous blogpost, I explained how to automate the RHEL mirror creation using https://github.com/redhat-nfvpe/rhel-local-mirrors . Now we are going to learn how to deploy and upgrade TripleO using those. Deploying TripleO Undercloud To use local mirrors in the undercloud, you simply need to get the generated osp<version>.repo that you generated with the rhel-local-mirrors playbook, and copy it to /etc/yum.repos.d/ , in the undercloud host: sudo curl http://<local_mirror_ip>/osp<version>_repo/osp<version>.repo \ -o /etc/yum.repos.d/osp.repo Then proceed with the standard instructions for deploy. Overcloud Each node from the overcloud (controllers, computes, etc...) needs to have a copy of the repository file from our server where we host the local mirrors. To achieve it, you can include an script that downloads the osp<version>.repo fi...

Sometimes there is a need to consume RHEL mirrors locally, not using the Red Hat content delivery network. It may be needed to speed up some deployment, or due to network constraints. I create an ansible playbook, rhel-local-mirrors ( https://github.com/redhat-nfvpe/rhel-local-mirrors ), that can help with that. What does rhel-local-mirrors do? It is basically a tool that connects to the Red Hat CDN, and syncs the repositories locally, allowing to populate the desired mirrors, that can be accessed by other systems via HTTP. The playbook is performing several tasks, that can be run together or independently: register a system on the Red Hat Network prepare the system to host mirrors create the specified mirrors schedule automatic updates of the mirrors How to use it? It is an Ansible playbook, so start by installing it, in any prefered format. Then continue by cloning the playbook: git clone https://github.com/redhat-nfvpe/rhel-local-mirrors.git This playbook exp...

Starting to apply since Pike Concept of security hardened images Normally the images used for overcloud deployment in TripleO are not security hardened. It means, the images lack all the extra security measures needed to accomplish with ANSSI requirements. These extra measures are needed to deploy TripleO in environments where security is an important feature. The following recommendations are given to accomplish with security guidelines: ensure that /tmp is mounted on a separate volume or partition, and that it is mounted with rw,nosuid,nodev,noexec,relatime flags ensure that /var, /var/log and /var/log/audit are mounted on separates volumes or partitions, and that are mounted with rw,relatime flags. ensure that /home is mounted on a separate partition or volume, and that it is mounted with rw,nodev,relatime flags. include extra kernel boot flag to enable auditing: add audit=1 to GRUB_CMDLINE_LINUX setting disable kernel support for USB via bootloader configuration...

This article is going to cover how to deploy TripleO Quickstart on baremetal. The undercloud will still be virtualized, but controller and compute will be deployed on baremetal. This post belongs to a serie. In order to get more knowledge about TOAD and tripleo-quickstart, please read http://teknoarticles.blogspot.com/2017/02/automated-osp-deployments-with-tripleo.html and http://teknoarticles.blogspot.com/2017/02/describing-cira-continuous-integration.html Requirements Hardware A baremetal server is needed to act as Jenkins slave + contain virtualized undercloud. A multi-core CPU, 16GB of RAM and 60GB of disk is the recommended setup. One server for each controller/compute that needs to be deployed. They need to have at least 8GB of RAM. Network IPMI access is needed for each controller/compute server  A provisioning network is required, the jenkins slave and the controller/compute nodes need to be on the same network, and the defined CIDR cannot be used for any ot...

In this article I'm going to show a method for automating OSP (RedHat OpenStack platform) deployments. These automated deployments can be very useful for CI, or simply to experiment and test with the system. Components involved TOAD : set of playbooks to deploy Jenkins, jenkins-job-builder and an optional ELK stack. This will install a ready to use system with all the preconfigured jobs (including OSP10 deployments and image building). TOAD jenkins-jobs : A set of job templates and macros, using jenkins-job-builder syntax, that get converted into Jenkins jobs for building the OSP base images and for deploying the system. TOAD job-configs : A set of job configurations to be used along with the jenkins-jobs repo. It provides a set of basic configs to build OpenStack using RDO or OSP. TripleO quickstart : set of ansible playbooks, used for building images and for RDO/OSP deployments. System requirements One VM to run a Jenkins master + nginx provided by TOAD. If you wa...

An overview of the TOAD framework and the advantages What is TOAD? Fully automated deployment using Ansible (single command spin up) Main goal: to automate OSP deployments for continuous integration (CI) and development purposes TOAD is a CI framework using off-the-shelf components that many partners are familiar with: Jenkins Jenkins Job Builder (JJB): http://docs.openstack.org/infra/jenkins-job-builder/   TripleO Quickstart (oooq): https://www.rdoproject.org/tripleo/   Optional ELK Stack (ElasticSearch, Logstash, Kibana)  Its core component is TripleO Quickstart , used for TripleO upstream testing Fully customizable with oooq settings; can be extended Deploy environments with one click; trash after finished  Of course it’s open source! :) https://github.com/redhat-nfvpe/toad https://github.com/redhat-nfvpe/jenkins-jobs   https://github.com/redhat-nfvpe/job-configs What components make up TOAD? Requirements to install TOAD Two...

Continued from http://teknoarticles.blogspot.com.es/2016/12/start-using-whole-disk-images-with.html For security reasons, there may be the need of encrypting several partitions of volumes on your images. And you can have a pre-created image with that encryption on place, instead of having to do manually after boot. This can be done with guestfs and luks . The following script will show how to perform that encryption and mount it automatically: #!/usr/bin/env python import binascii import guestfs import os # remove old generated drive try:     os.unlink("/tmp/overcloud-full-partitioned.qcow2") except:     pass g = guestfs.GuestFS(python_return_dict=True) # import old and new images print("Creating new repartitioned image") g.add_drive_opts("/tmp/overcloud-full.qcow2", format="qcow2", readonly=1) g.disk_create("/tmp/overcloud-full-partitioned.qcow2", "qcow2", 10 * 1024 * 1024 * 1024) #10G g.add_drive_opts("/tmp/o...