[nova]Set up ssh keys auth for the nova user #446
Conversation
|
Skipping CI for Draft Pull Request. |
gibizer
changed the title
|
Build failed (check pipeline). Post https://review.rdoproject.org/zuul/buildset/771d8fdcd545417ea7d0d1cd596c2701 ✔️ openstack-k8s-operators-content-provider SUCCESS in 2h 07m 56s |
|
recheck |
|
Build failed (check pipeline). Post https://review.rdoproject.org/zuul/buildset/653e24168f0c4889a7321b9d4cbaa756 ✔️ openstack-k8s-operators-content-provider SUCCESS in 2h 10m 00s |
|
The CI failure is relevant. I'm working on a fix to this PR |
gibizer
force-pushed
the
copy-nova-migration-keys
branch
from
f15b3ba to
bc01d7f
Compare
|
Build failed (check pipeline). Post https://review.rdoproject.org/zuul/buildset/1018a42e375842b59e0fd361b1fa3f04 ✔️ openstack-k8s-operators-content-provider SUCCESS in 2h 05m 13s |
|
CI failure is relevant. The nova role now expects an ssh key passed in so I first need to modify the OpenStackDataPlaneService/nova sample and/or the install_yamls / ci_framework scripting to provide an extra secret to service |
gibizer
force-pushed
the
copy-nova-migration-keys
branch
from
20e8205 to
ca21079
Compare
|
This change depends on a change that failed to merge. Change #445 is needed. |
gibizer
force-pushed
the
copy-nova-migration-keys
branch
from
ca21079 to
c5793bc
Compare
|
Build failed (check pipeline). Post https://review.rdoproject.org/zuul/buildset/2721daa9b75d4a11b786012f4f8a481c ❌ openstack-k8s-operators-content-provider FAILURE in 10m 53s |
The nova role in edpm-ansible requires[1] an ssh key-pair that is then used as to authenticate the nova user when it copies data between compute nodes during migration. A placeholder Secret name for this key-pair is now added to the nova DataplaneService definition. The deployer (human, ci_framework, or install_yamls) needs to make sure that a secret is created with an SSH key-pair in it. [1] openstack-k8s-operators/edpm-ansible#446
The nova role in edpm-ansible requires[1] an ssh key-pair that is then used as to authenticate the nova user when it copies data between compute nodes during migration. A placeholder Secret name for this key-pair is now added to the nova DataplaneService definition. The deployer (human, ci_framework, or install_yamls) needs to make sure that a secret is created with an SSH key-pair in it. [1] openstack-k8s-operators/edpm-ansible#446
The nova role in edpm-ansible requires[1] an ssh key-pair that is then used as to authenticate the nova user when it copies data between compute nodes during migration. A placeholder Secret name for this key-pair is now added to the nova DataplaneService definition. The deployer (human, ci_framework, or install_yamls) needs to make sure that a secret is created with an SSH key-pair in it. [1] openstack-k8s-operators/edpm-ansible#446
gibizer
force-pushed
the
copy-nova-migration-keys
branch
from
c5793bc to
dec6f38
Compare
|
/hold need to land the dataplane-operator change first |
The nova role in edpm-ansible requires[1] an ssh key-pair that is then used as to authenticate the nova user when it copies data between compute nodes during migration. A placeholder Secret name for this key-pair is now added to the nova DataplaneService definition. The deployer (human, ci_framework, or install_yamls) needs to make sure that a secret is created with an SSH key-pair in it. [1] openstack-k8s-operators/edpm-ansible#446
|
This change depends on a change that failed to merge. Change openstack-k8s-operators/dataplane-operator#471 is needed. |
The nova user needs to be able to copy files between the compute nodes. The edpm_nova role now expects that a Secret is mounted to the AnsibleEE CR containing an ssh keypair (ssh-privatekey and ssh-publickey). This keypair is used to set up the auth for the nova user between the compute nodes. On the EDPM host the nova user will have the public key added as authorized_keys. While the nova user in the nova-compute container will have the private key added as identity in /var/lib/nova/.ssh. Also an ssh config file is added in the container to ensure that this identity is used for all the outgoing ssh connection.
gibizer
force-pushed
the
copy-nova-migration-keys
branch
from
b9ca9a5 to
2f45fb5
Compare
Thanks for the review. I resolved your comments. |
Now that the deployment is configured to support cold migration we can enable the relevant tempest tests as well. Depends-On: openstack-k8s-operators/edpm-ansible#446
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: gibizer, rebtoor The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
|
/unhold |
|
Build failed (check pipeline). Post https://review.rdoproject.org/zuul/buildset/2610e2b604214950a04780089bc29012 ✔️ openstack-k8s-operators-content-provider SUCCESS in 1h 58m 33s |
|
recheck |
|
Build failed (check pipeline). Post https://review.rdoproject.org/zuul/buildset/ccf6af9709f7447a86eb5e2747d37be0 ✔️ openstack-k8s-operators-content-provider SUCCESS in 2h 15m 40s |
|
As this was green before I think the depends-on is not working correctly. I guess when the needed dataplane-operator PR was still open the job picket it up, but now it is merged so the job thinks that it is available automatically, however it is not built into the openstack-operator yet so it is not available in the deployment. |
|
recheck dep is now merged |
|
the content provider job is proably not setup to support depends on currently. |
|
Build failed (check pipeline). Post https://review.rdoproject.org/zuul/buildset/42d17eda73034e429b86a2fa415cdc45 ✔️ openstack-k8s-operators-content-provider SUCCESS in 2h 08m 45s |
|
recheck |
Now that the deployment is configured to support cold migration we can enable the relevant tempest tests as well. Depends-On: openstack-k8s-operators/edpm-ansible#446
Now that the deployment is configured to support cold migration we can enable the relevant tempest tests as well. Depends-On: openstack-k8s-operators/edpm-ansible#446
Now that the deployment is configured to support cold migration we can enable the relevant tempest tests as well. Depends-On: openstack-k8s-operators/edpm-ansible#446
Now that the deployment is configured to support cold migration we can enable the relevant tempest tests as well. Depends-On: openstack-k8s-operators/edpm-ansible#446
The nova user needs to be able to copy files between the compute nodes.
The edpm_nova role now expects that a Secret is mounted to the AnsibleEE
CR containing an ssh keypair (ssh-privatekey and ssh-publickey). This
keypair is used to set up the auth for the nova user between the
compute nodes. On the EDPM host the nova user will have the public key
added as authorized_keys. While the nova user in the nova-compute
container will have the private key added as identity in
/var/lib/nova/.ssh. Also an ssh config file is added in the container to
ensure that this identity is used for all the outgoing ssh connection.
Depends-On: openstack-k8s-operators/dataplane-operator#471