Giuseppe Lavagetto has uploaded a new change for review.
https://gerrit.wikimedia.org/r/314657
Change subject: kubernetes: add etcd clusters for k8s, networking
......................................................................
kubernetes: add etcd clusters for k8s, networking
Add the two etcd clusters for kubernetes control and for the dynamic
networking that it uses.
Following somewhat the guidelines of the role/profile pattern:
- A "profile" role::etcd::common which could accomodate most etcd
installs is created. Here both hiera calls and class parametrization
are explicit.
- Two roles, role::etcd::kubernetes and role::etcd::networking are
created just including the common profile and standard/firewall
- All hiera calls are limited to the role/ namespace as much as possible.
Bug: T147620
Change-Id: I55f4568b4fe036aa6643eb13ee43b43e6f5e2dcd
---
A hieradata/role/common/etcd/kubernetes.yaml
A hieradata/role/common/etcd/networking.yaml
M manifests/site.pp
A modules/role/manifests/etcd/common.pp
A modules/role/manifests/etcd/kubernetes.pp
A modules/role/manifests/etcd/networking.pp
6 files changed, 93 insertions(+), 0 deletions(-)
git pull ssh://gerrit.wikimedia.org:29418/operations/puppet
refs/changes/57/314657/1
diff --git a/hieradata/role/common/etcd/kubernetes.yaml
b/hieradata/role/common/etcd/kubernetes.yaml
new file mode 100644
index 0000000..e6da6be
--- /dev/null
+++ b/hieradata/role/common/etcd/kubernetes.yaml
@@ -0,0 +1,8 @@
+debdeploy::grains:
+ debdeploy-etcd:
+ value: standard
+cluster: etcd
+etcd::cluster_name: 'k8s.eqiad'
+etcd::srv_dns: 'k8s.eqiad.wmnet'
+etcd::use_client_certs: false
+etcd::do_backup: true
diff --git a/hieradata/role/common/etcd/networking.yaml
b/hieradata/role/common/etcd/networking.yaml
new file mode 100644
index 0000000..a1d4d52
--- /dev/null
+++ b/hieradata/role/common/etcd/networking.yaml
@@ -0,0 +1,8 @@
+debdeploy::grains:
+ debdeploy-etcd:
+ value: standard
+cluster: etcd
+etcd::cluster_name: "net.k8s.%{::site}"
+etcd::srv_dns: "net.k8s.%{::site}.wmnet"
+etcd::use_client_certs: true
+etcd::do_backup: true
diff --git a/manifests/site.pp b/manifests/site.pp
index f2ac1ee..24bde72 100644
--- a/manifests/site.pp
+++ b/manifests/site.pp
@@ -1048,6 +1048,15 @@
include mariadb::mysqld_safe
}
+# Etcd cluster for kubernetes
+node /^etcd100[123]\.eqiad\.wmnet$/ {
+ role(etcd::kubernetes)
+}
+
+# Etcd cluster for "virtual" networking
+node /^etcd100[456]\.eqiad\.wmnet$/ {
+ role(etcd::networking)
+}
# Etherpad (virtual machine)
node 'etherpad1001.eqiad.wmnet' {
diff --git a/modules/role/manifests/etcd/common.pp
b/modules/role/manifests/etcd/common.pp
new file mode 100644
index 0000000..4d3855a
--- /dev/null
+++ b/modules/role/manifests/etcd/common.pp
@@ -0,0 +1,53 @@
+# Common class for all etcd clusters. Should be a profile
+# in the role/profile view
+class role::etcd::common {
+ # Configuration
+ $cluster_name = hiera('etcd::cluster_name', $::domain)
+ $srv_dns = hiera('etcd::srv_dns', undef)
+ $use_client_certs = hiera('etcd::use_client_certs', undef)
+ $peers_list = hiera('etcd::peers_list', undef)
+ $allowed_networks = hiera('etcd::allowed_networks', '$DOMAIN_NETWORKS')
+ $do_backup = hiera('etcd::do_backup', false)
+ $auth_enabled = hiera('etcd::auth_enabled', false)
+ $root_password = hiera('etcd::auth::common::root_password', undef)
+
+ # Service & firewalls
+ class { '::etcd':
+ host => $::fqdn,
+ cluster_name => $cluster_name,
+ srv_dns => $srv_dns,
+ peers_list => $peers_list,
+ use_ssl => true,
+ use_client_certs => $use_client_certs,
+ }
+
+ include etcd::monitoring
+ ferm::service{'etcd_clients':
+ proto => 'tcp',
+ port => hiera('etcd::client_port', '2379'),
+ srange => $allowed_networks,
+ }
+
+ ferm::service{'etcd_peers':
+ proto => 'tcp',
+ port => hiera('etcd::peer_port', '2380'),
+ srange => '$DOMAIN_NETWORKS',
+ }
+
+ # Backup
+ if $do_backup {
+ # Back up etcd
+ require etcd::backup
+ include role::backup::host
+ backup::set { 'etcd': }
+ }
+
+ # Authn/authz
+ class { '::etcd::auth::common':
+ root_password => $root_password,
+ active => $auth_enabled,
+
+ }
+ class { '::etcd::auth': }
+ class { '::etcd::auth::users': }
+}
diff --git a/modules/role/manifests/etcd/kubernetes.pp
b/modules/role/manifests/etcd/kubernetes.pp
new file mode 100644
index 0000000..ba15d17
--- /dev/null
+++ b/modules/role/manifests/etcd/kubernetes.pp
@@ -0,0 +1,8 @@
+# Role class for the etcd cluster used by kubernetes.
+# Should only include other roles.
+
+class role::etcd::kubernetes {
+ include standard
+ include base::firewall
+ include role::etcd::common
+}
diff --git a/modules/role/manifests/etcd/networking.pp
b/modules/role/manifests/etcd/networking.pp
new file mode 100644
index 0000000..9c555e6
--- /dev/null
+++ b/modules/role/manifests/etcd/networking.pp
@@ -0,0 +1,7 @@
+# Role to set up an etcd cluster for virtual networking
+# stacks as flannel and calico.
+class role::etcd::networking {
+ include standard
+ include base::firewall
+ include role::etcd::common
+}
--
To view, visit https://gerrit.wikimedia.org/r/314657
To unsubscribe, visit https://gerrit.wikimedia.org/r/settings
Gerrit-MessageType: newchange
Gerrit-Change-Id: I55f4568b4fe036aa6643eb13ee43b43e6f5e2dcd
Gerrit-PatchSet: 1
Gerrit-Project: operations/puppet
Gerrit-Branch: production
Gerrit-Owner: Giuseppe Lavagetto <[email protected]>
_______________________________________________
MediaWiki-commits mailing list
[email protected]
https://lists.wikimedia.org/mailman/listinfo/mediawiki-commits
