déploie OpenStack 2025.2 avec Kolla-Ansible (tout-en-un, API sur dummy0)
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
Adam Belkacemi
parent
87c8aac5f5
commit
db2842689a
12 changed files with 978 additions and 3 deletions
597
kolla/all-in-one
Normal file
597
kolla/all-in-one
Normal file
|
|
@ -0,0 +1,597 @@
|
|||
# These initial groups are the only groups required to be modified. The
|
||||
# additional groups are for more control of the environment.
|
||||
[control]
|
||||
localhost ansible_connection=local
|
||||
|
||||
[network]
|
||||
localhost ansible_connection=local
|
||||
|
||||
[compute]
|
||||
localhost ansible_connection=local
|
||||
|
||||
[storage]
|
||||
localhost ansible_connection=local
|
||||
|
||||
[monitoring]
|
||||
localhost ansible_connection=local
|
||||
|
||||
[deployment]
|
||||
localhost ansible_connection=local
|
||||
|
||||
# You can explicitly specify which hosts run each project by updating the
|
||||
# groups in the sections below. Common services are grouped together.
|
||||
|
||||
[common:children]
|
||||
control
|
||||
network
|
||||
compute
|
||||
storage
|
||||
monitoring
|
||||
|
||||
[collectd:children]
|
||||
compute
|
||||
|
||||
[baremetal:children]
|
||||
control
|
||||
|
||||
[tls-backend:children]
|
||||
control
|
||||
network
|
||||
|
||||
[grafana:children]
|
||||
monitoring
|
||||
|
||||
[etcd:children]
|
||||
control
|
||||
|
||||
[telegraf:children]
|
||||
compute
|
||||
control
|
||||
monitoring
|
||||
network
|
||||
storage
|
||||
|
||||
[hacluster:children]
|
||||
control
|
||||
|
||||
[hacluster-remote:children]
|
||||
compute
|
||||
|
||||
[loadbalancer:children]
|
||||
network
|
||||
|
||||
[mariadb:children]
|
||||
control
|
||||
|
||||
[rabbitmq:children]
|
||||
control
|
||||
|
||||
[keystone:children]
|
||||
control
|
||||
|
||||
[glance:children]
|
||||
control
|
||||
|
||||
[nova:children]
|
||||
control
|
||||
|
||||
[neutron:children]
|
||||
network
|
||||
|
||||
[openvswitch:children]
|
||||
network
|
||||
compute
|
||||
manila-share
|
||||
|
||||
[cinder:children]
|
||||
control
|
||||
|
||||
[cloudkitty:children]
|
||||
control
|
||||
|
||||
[memcached:children]
|
||||
control
|
||||
|
||||
[horizon:children]
|
||||
control
|
||||
|
||||
[barbican:children]
|
||||
control
|
||||
|
||||
[heat:children]
|
||||
control
|
||||
|
||||
[ironic:children]
|
||||
control
|
||||
|
||||
[influxdb:children]
|
||||
monitoring
|
||||
|
||||
[prometheus:children]
|
||||
monitoring
|
||||
|
||||
[magnum:children]
|
||||
control
|
||||
|
||||
[mistral:children]
|
||||
control
|
||||
|
||||
[manila:children]
|
||||
control
|
||||
|
||||
[gnocchi:children]
|
||||
control
|
||||
|
||||
[ceilometer:children]
|
||||
control
|
||||
|
||||
[aodh:children]
|
||||
control
|
||||
|
||||
[cyborg:children]
|
||||
control
|
||||
|
||||
[tacker:children]
|
||||
control
|
||||
|
||||
[trove:children]
|
||||
control
|
||||
|
||||
[watcher:children]
|
||||
control
|
||||
|
||||
[octavia:children]
|
||||
control
|
||||
|
||||
[designate:children]
|
||||
control
|
||||
|
||||
[placement:children]
|
||||
control
|
||||
|
||||
[bifrost:children]
|
||||
deployment
|
||||
|
||||
[zun:children]
|
||||
control
|
||||
|
||||
[skyline:children]
|
||||
control
|
||||
|
||||
# TODO(vurmil): Remove after G/2026.1 release as Redis migration is no longer required
|
||||
[redis:children]
|
||||
control
|
||||
|
||||
[valkey:children]
|
||||
control
|
||||
|
||||
[blazar:children]
|
||||
control
|
||||
|
||||
[letsencrypt:children]
|
||||
loadbalancer
|
||||
|
||||
# Additional control implemented here. These groups allow you to control which
|
||||
# services run on which hosts at a per-service level.
|
||||
#
|
||||
# Word of caution: Some services are required to run on the same host to
|
||||
# function appropriately. For example, neutron-metadata-agent must run on the
|
||||
# same host as the l3-agent and (depending on configuration) the dhcp-agent.
|
||||
|
||||
# Common
|
||||
[cron:children]
|
||||
common
|
||||
|
||||
[fluentd:children]
|
||||
common
|
||||
|
||||
[kolla-logs:children]
|
||||
common
|
||||
|
||||
[kolla-toolbox:children]
|
||||
common
|
||||
|
||||
[opensearch:children]
|
||||
control
|
||||
|
||||
# Opensearch dashboards
|
||||
[opensearch-dashboards:children]
|
||||
opensearch
|
||||
|
||||
# Glance
|
||||
[glance-api:children]
|
||||
glance
|
||||
|
||||
# Nova
|
||||
[nova-api:children]
|
||||
nova
|
||||
|
||||
[nova-conductor:children]
|
||||
nova
|
||||
|
||||
[nova-metadata:children]
|
||||
nova
|
||||
|
||||
[nova-super-conductor:children]
|
||||
nova
|
||||
|
||||
[nova-novncproxy:children]
|
||||
nova
|
||||
|
||||
[nova-scheduler:children]
|
||||
nova
|
||||
|
||||
[nova-spicehtml5proxy:children]
|
||||
nova
|
||||
|
||||
[nova-compute-ironic:children]
|
||||
nova
|
||||
|
||||
[nova-serialproxy:children]
|
||||
nova
|
||||
|
||||
# Neutron
|
||||
[ironic-neutron-agent:children]
|
||||
neutron
|
||||
|
||||
[neutron-bgp-dragent:children]
|
||||
neutron
|
||||
|
||||
[neutron-dhcp-agent:children]
|
||||
neutron
|
||||
|
||||
[neutron-infoblox-ipam-agent:children]
|
||||
neutron
|
||||
|
||||
[neutron-l3-agent:children]
|
||||
neutron
|
||||
|
||||
[neutron-metadata-agent:children]
|
||||
neutron
|
||||
|
||||
[neutron-metering-agent:children]
|
||||
neutron
|
||||
|
||||
[neutron-periodic-worker:children]
|
||||
control
|
||||
|
||||
[neutron-rpc-server:children]
|
||||
control
|
||||
|
||||
[neutron-server:children]
|
||||
control
|
||||
|
||||
[neutron-ovn-agent:children]
|
||||
compute
|
||||
network
|
||||
|
||||
[neutron-ovn-maintenance-worker:children]
|
||||
control
|
||||
|
||||
[neutron-ovn-metadata-agent:children]
|
||||
compute
|
||||
network
|
||||
|
||||
# Cinder
|
||||
[cinder-api:children]
|
||||
cinder
|
||||
|
||||
[cinder-backup:children]
|
||||
storage
|
||||
|
||||
[cinder-scheduler:children]
|
||||
cinder
|
||||
|
||||
[cinder-volume:children]
|
||||
storage
|
||||
|
||||
# Cloudkitty
|
||||
[cloudkitty-api:children]
|
||||
cloudkitty
|
||||
|
||||
[cloudkitty-processor:children]
|
||||
cloudkitty
|
||||
|
||||
# iSCSI
|
||||
[iscsid:children]
|
||||
compute
|
||||
storage
|
||||
ironic
|
||||
|
||||
[tgtd:children]
|
||||
storage
|
||||
|
||||
# Manila
|
||||
[manila-api:children]
|
||||
manila
|
||||
|
||||
[manila-scheduler:children]
|
||||
manila
|
||||
|
||||
[manila-share:children]
|
||||
network
|
||||
|
||||
[manila-data:children]
|
||||
manila
|
||||
|
||||
# Barbican
|
||||
[barbican-api:children]
|
||||
barbican
|
||||
|
||||
[barbican-keystone-listener:children]
|
||||
barbican
|
||||
|
||||
[barbican-worker:children]
|
||||
barbican
|
||||
|
||||
# Trove
|
||||
[trove-api:children]
|
||||
trove
|
||||
|
||||
[trove-conductor:children]
|
||||
trove
|
||||
|
||||
[trove-taskmanager:children]
|
||||
trove
|
||||
|
||||
# Heat
|
||||
[heat-api:children]
|
||||
heat
|
||||
|
||||
[heat-api-cfn:children]
|
||||
heat
|
||||
|
||||
[heat-engine:children]
|
||||
heat
|
||||
|
||||
# Ironic
|
||||
[ironic-api:children]
|
||||
ironic
|
||||
|
||||
[ironic-conductor:children]
|
||||
ironic
|
||||
|
||||
[ironic-dnsmasq:children]
|
||||
ironic
|
||||
|
||||
[ironic-tftp:children]
|
||||
ironic
|
||||
|
||||
[ironic-http:children]
|
||||
ironic
|
||||
|
||||
# Magnum
|
||||
[magnum-api:children]
|
||||
magnum
|
||||
|
||||
[magnum-conductor:children]
|
||||
magnum
|
||||
|
||||
# Mistral
|
||||
[mistral-api:children]
|
||||
mistral
|
||||
|
||||
[mistral-executor:children]
|
||||
mistral
|
||||
|
||||
[mistral-engine:children]
|
||||
mistral
|
||||
|
||||
[mistral-event-engine:children]
|
||||
mistral
|
||||
|
||||
# Aodh
|
||||
[aodh-api:children]
|
||||
aodh
|
||||
|
||||
[aodh-evaluator:children]
|
||||
aodh
|
||||
|
||||
[aodh-listener:children]
|
||||
aodh
|
||||
|
||||
[aodh-notifier:children]
|
||||
aodh
|
||||
|
||||
# Cyborg
|
||||
[cyborg-api:children]
|
||||
cyborg
|
||||
|
||||
[cyborg-agent:children]
|
||||
compute
|
||||
|
||||
[cyborg-conductor:children]
|
||||
cyborg
|
||||
|
||||
# Gnocchi
|
||||
[gnocchi-api:children]
|
||||
gnocchi
|
||||
|
||||
[gnocchi-statsd:children]
|
||||
gnocchi
|
||||
|
||||
[gnocchi-metricd:children]
|
||||
gnocchi
|
||||
|
||||
# Ceilometer
|
||||
[ceilometer-central:children]
|
||||
ceilometer
|
||||
|
||||
[ceilometer-notification:children]
|
||||
ceilometer
|
||||
|
||||
[ceilometer-compute:children]
|
||||
compute
|
||||
|
||||
[ceilometer-ipmi:children]
|
||||
compute
|
||||
|
||||
# Multipathd
|
||||
[multipathd:children]
|
||||
compute
|
||||
storage
|
||||
|
||||
# Watcher
|
||||
[watcher-api:children]
|
||||
watcher
|
||||
|
||||
[watcher-engine:children]
|
||||
watcher
|
||||
|
||||
[watcher-applier:children]
|
||||
watcher
|
||||
|
||||
# Octavia
|
||||
[octavia-api:children]
|
||||
octavia
|
||||
|
||||
[octavia-driver-agent:children]
|
||||
octavia
|
||||
|
||||
[octavia-health-manager:children]
|
||||
octavia
|
||||
|
||||
[octavia-housekeeping:children]
|
||||
octavia
|
||||
|
||||
[octavia-worker:children]
|
||||
octavia
|
||||
|
||||
# Designate
|
||||
[designate-api:children]
|
||||
designate
|
||||
|
||||
[designate-central:children]
|
||||
designate
|
||||
|
||||
[designate-producer:children]
|
||||
designate
|
||||
|
||||
[designate-mdns:children]
|
||||
network
|
||||
|
||||
[designate-worker:children]
|
||||
designate
|
||||
|
||||
[designate-sink:children]
|
||||
designate
|
||||
|
||||
[designate-backend-bind9:children]
|
||||
designate
|
||||
|
||||
# Placement
|
||||
[placement-api:children]
|
||||
placement
|
||||
|
||||
# Zun
|
||||
[zun-api:children]
|
||||
zun
|
||||
|
||||
[zun-wsproxy:children]
|
||||
zun
|
||||
|
||||
[zun-compute:children]
|
||||
compute
|
||||
|
||||
[zun-cni-daemon:children]
|
||||
compute
|
||||
|
||||
# Skyline
|
||||
[skyline-apiserver:children]
|
||||
skyline
|
||||
|
||||
[skyline-console:children]
|
||||
skyline
|
||||
|
||||
# Tacker
|
||||
[tacker-server:children]
|
||||
tacker
|
||||
|
||||
[tacker-conductor:children]
|
||||
tacker
|
||||
|
||||
# Blazar
|
||||
[blazar-api:children]
|
||||
blazar
|
||||
|
||||
[blazar-manager:children]
|
||||
blazar
|
||||
|
||||
# Prometheus
|
||||
[prometheus-node-exporter:children]
|
||||
monitoring
|
||||
control
|
||||
compute
|
||||
network
|
||||
storage
|
||||
|
||||
[prometheus-mysqld-exporter:children]
|
||||
mariadb
|
||||
|
||||
[prometheus-memcached-exporter:children]
|
||||
memcached
|
||||
|
||||
[prometheus-cadvisor:children]
|
||||
monitoring
|
||||
control
|
||||
compute
|
||||
network
|
||||
storage
|
||||
|
||||
[prometheus-alertmanager:children]
|
||||
monitoring
|
||||
|
||||
[prometheus-openstack-exporter:children]
|
||||
monitoring
|
||||
|
||||
[prometheus-elasticsearch-exporter:children]
|
||||
opensearch
|
||||
|
||||
[prometheus-blackbox-exporter:children]
|
||||
monitoring
|
||||
|
||||
[prometheus-libvirt-exporter:children]
|
||||
compute
|
||||
|
||||
[masakari-api:children]
|
||||
control
|
||||
|
||||
[masakari-engine:children]
|
||||
control
|
||||
|
||||
[masakari-hostmonitor:children]
|
||||
control
|
||||
|
||||
[masakari-instancemonitor:children]
|
||||
compute
|
||||
|
||||
[ovn-controller:children]
|
||||
ovn-controller-compute
|
||||
ovn-controller-network
|
||||
|
||||
[ovn-controller-compute:children]
|
||||
compute
|
||||
|
||||
[ovn-controller-network:children]
|
||||
network
|
||||
|
||||
[ovn-database:children]
|
||||
control
|
||||
|
||||
[ovn-northd:children]
|
||||
ovn-database
|
||||
|
||||
[ovn-nb-db:children]
|
||||
ovn-database
|
||||
|
||||
[ovn-sb-db:children]
|
||||
ovn-database
|
||||
|
||||
[ovn-sb-db-relay:children]
|
||||
ovn-database
|
||||
|
||||
[letsencrypt-webserver:children]
|
||||
letsencrypt
|
||||
|
||||
[letsencrypt-lego:children]
|
||||
letsencrypt
|
||||
53
kolla/globals.yml
Normal file
53
kolla/globals.yml
Normal file
|
|
@ -0,0 +1,53 @@
|
|||
---
|
||||
# Configuration Kolla-Ansible 2025.2 (Flamingo) — Syllabus, serveur tout-en-un.
|
||||
# Noms d'options vérifiés dans etc/kolla/globals.yml de la branche stable/2025.2.
|
||||
# Aucun secret ici : les mots de passe sont dans /etc/kolla/passwords.yml,
|
||||
# uniquement sur le serveur (chmod 600, jamais dans Git).
|
||||
|
||||
workaround_ansible_issue_8743: yes
|
||||
|
||||
# Images : Debian bookworm (tag quay.io « 2025.2-debian-bookworm », vérifié).
|
||||
kolla_base_distro: "debian"
|
||||
openstack_release: "2025.2"
|
||||
|
||||
# Réseau (voir étape 4 et docs/journal.md) :
|
||||
# - dummy0 (10.10.0.1) porte toutes les API et services internes : rien sur eno1.
|
||||
# - veth-ext-ovs est le bout de la paire veth donné à Neutron comme réseau externe.
|
||||
network_interface: "dummy0"
|
||||
neutron_external_interface: "veth-ext-ovs"
|
||||
kolla_internal_vip_address: "10.10.0.1"
|
||||
|
||||
# Un seul nœud : pas de VIP flottante, donc ni HAProxy ni keepalived.
|
||||
enable_haproxy: "no"
|
||||
enable_keepalived: "no"
|
||||
# ProxySQL écoute sur la VIP:3306. Sans HAProxy, la VIP est l'IP du nœud :
|
||||
# il prenait le port de MariaDB (« Address already in use », 2026-10-07).
|
||||
enable_proxysql: "no"
|
||||
|
||||
# Neutron avec OVN (choix de CLAUDE.md, section 3).
|
||||
neutron_plugin_agent: "ovn"
|
||||
|
||||
# Services.
|
||||
enable_horizon: "no" # pas d'interface web OpenStack : le portail Syllabus la remplace
|
||||
enable_heat: "yes" # chaque lab est un modèle Heat
|
||||
enable_nova_serialconsole_proxy: "yes" # console élève (nova-serialproxy)
|
||||
nova_compute_virt_type: "kvm" # VT-x vérifié à l'étape 1
|
||||
enable_prometheus: "yes" # supervision (étape 7)
|
||||
enable_grafana: "yes"
|
||||
|
||||
# Cinder désactivé pour l'instant : les deux disques sont entièrement pris par
|
||||
# le RAID 1 (/), il n'y a pas de place pour un groupe de volumes LVM dédié.
|
||||
# Les VM élèves utilisent des disques éphémères Nova. À revoir (Ceph, bloc C).
|
||||
enable_cinder: "no"
|
||||
|
||||
# Kolla ne doit pas toucher au pare-feu : il est géré par le rôle Ansible
|
||||
# `durcissement` (nftables). Sur Debian, cette option ne ferait qu'essayer de
|
||||
# désactiver ufw (absent ici), mais on la fixe explicitement.
|
||||
disable_firewall: false
|
||||
|
||||
# Docker (installé par bootstrap-servers) : Kolla fixe déjà iptables: false,
|
||||
# mais depuis Docker 27 l'IPv6 a son propre réglage, activé par défaut. Sans
|
||||
# cette ligne, Docker crée des tables « ip6 nat » et « ip6 filter » dans
|
||||
# nftables (constaté le 2026-10-07). Fusionné dans /etc/docker/daemon.json.
|
||||
docker_custom_config:
|
||||
ip6tables: false
|
||||
Loading…
Add table
Add a link
Reference in a new issue