Check the status of the ceph cluster.
Uses ceph health to check if cluster is in HEALTH_WARN state and prints a debug message.
hosts: Controller
groups: post-deployment
parameters:
osd_percentage_min: 0
roles: ceph
Role documentation
Ensure container status.
Detect failed containers and raise an error.
hosts: undercloud, overcloud
groups: pre-upgrade, post-deployment, post-upgrade
parameters:
roles: container-status
Role documentation
Verify docker containers are up and ports are open.
Ensure relevant docker containers are up and running, with ports open to listen. We iterate through a list of container names and ports provided in defaults, and ensure the system has those available.
hosts: undercloud
groups: post-deployment, pre-upgrade
parameters:
open_ports: [111, 873, 3000, 3306, 4369, 5000, 5050, 5672, 6000, 6001, 6002, 6379, 6385, 8000, 8004, 8080, 8088, 8774, 8775, 8778, 8787, 8888, 8989, 9000, 9292, 9696, 11211, 15672, 25672, 35357, 39422, {‘port’: 22, ‘search_regex’: ‘OpenSSH’}]
running_containers: [‘glance_api’, ‘heat_api’, ‘heat_api_cfn’, ‘heat_api_cron’, ‘heat_engine’, ‘ironic_api’, ‘ironic_conductor’, ‘ironic_inspector’, ‘ironic_inspector_dnsmasq’, ‘ironic_neutron_agent’, ‘ironic_pxe_http’, ‘ironic_pxe_tftp’, ‘iscsid’, ‘keystone’, ‘keystone_cron’, ‘logrotate_crond’, ‘memcached’, ‘mistral_api’, ‘mistral_engine’, ‘mistral_event_engine’, ‘mistral_executor’, ‘mysql’, ‘neutron_api’, ‘neutron_dhcp’, ‘neutron_l3_agent’, ‘neutron_ovs_agent’, ‘nova_api’, ‘nova_api_cron’, ‘nova_compute’, ‘nova_conductor’, ‘nova_metadata’, ‘nova_placement’, ‘nova_scheduler’, ‘rabbitmq’, ‘swift_account_auditor’, ‘swift_account_reaper’, ‘swift_account_replicator’, ‘swift_account_server’, ‘swift_container_auditor’, ‘swift_container_replicator’, ‘swift_container_server’, ‘swift_container_updater’, ‘swift_object_auditor’, ‘swift_object_expirer’, ‘swift_object_replicator’, ‘swift_object_server’, ‘swift_object_updater’, ‘swift_proxy’, ‘swift_rsync’, ‘tripleo_ui’, ‘zaqar’, ‘zaqar_websocket’]
roles: containerized-undercloud-docker
Role documentation
Verify that keystone admin token is disabled.
This validation checks that keystone admin token is disabled on both undercloud and overcloud controller after deployment.
hosts: undercloud, Controller
groups: post-deployment
parameters:
keystone_conf_file: /var/lib/config-data/puppet-generated/keystone/etc/keystone/keystone.conf
roles: controller-token
Role documentation
Check controller ulimits.
This will check the ulimits of each controller.
hosts: Controller
groups: post-deployment
parameters:
nofiles_min: 1024
nproc_min: 2048
roles: controller-ulimits
Role documentation
HAProxy configuration.
Verify the HAProxy configuration has recommended values.
hosts: Controller
groups: post-deployment
parameters:
config_file: /var/lib/config-data/puppet-generated/haproxy/etc/haproxy/haproxy.cfg
global_maxconn_min: 20480
defaults_maxconn_min: 4096
defaults_timeout_queue: 2m
defaults_timeout_client: 2m
defaults_timeout_server: 2m
defaults_timeout_check: 10s
roles: haproxy
Role documentation
Healthcheck systemd services Check.
Check for failed healthcheck systemd services.
hosts: undercloud, overcloud
groups: post-deployment
parameters:
retries_number: 1
delay_number: 1
inflight_healthcheck_services: []
roles: healthcheck-service-status
Role documentation
Verify image-serve service is working and answering.
Ensures image-serve vhost is configured and httpd is running.
hosts: undercloud
groups: pre-upgrade, post-deployment, post-upgrade
parameters:
roles: image-serve
Role documentation
MySQL Open Files Limit.
Verify the open-files-limit configuration is high enough https://access.redhat.com/solutions/1598733
hosts: Controller, Database
groups: post-deployment
parameters:
min_open_files_limit: 16384
roles: mysql-open-files-limit
Role documentation
Neutron Sanity Check.
Run neutron-sanity-check on the controller nodes to find out potential issues with Neutron’s configuration. The tool expects all the configuration files that are passed to the Neutron services.
hosts: Controller
groups: post-deployment
parameters:
configs: [‘/etc/neutron/neutron.conf’, ‘/usr/share/neutron/neutron-dist.conf’, ‘/etc/neutron/metadata_agent.ini’, ‘/etc/neutron/dhcp_agent.ini’, ‘/etc/neutron/fwaas_driver.ini’, ‘/etc/neutron/l3_agent.ini’]
roles: neutron-sanity-check
Role documentation
Verify NoOpFirewallDriver is set in Nova.
When using Neutron, the firewall_driver option in Nova must be set to NoopFirewallDriver.
hosts: nova_compute
groups: post-deployment
parameters:
nova_conf_path: /var/lib/config-data/puppet-generated/nova_libvirt/etc/nova/nova.conf
roles: no-op-firewall-nova-driver
Role documentation
Nova Event Callback Configuration Check.
/etc/nova/nova.conf: [DEFAULT]/vif_plugging_is_fatal = True [DEFAULT]/vif_plugging_timeout >= 300
/etc/neutron/neutron.conf: [nova]/auth_url = ‘http://nova_admin_auth_ip:5000’ [nova]/tenant_name = ‘service’ [DEFAULT]/notify_nova_on_port_data_changes = True [DEFAULT]/notify_nova_on_port_status_changes = True
hosts: Controller
groups: post-deployment
parameters:
nova_config_file: /var/lib/config-data/puppet-generated/nova/etc/nova/nova.conf
neutron_config_file: /var/lib/config-data/puppet-generated/neutron/etc/neutron/neutron.conf
vif_plugging_fatal_check: vif_plugging_is_fatal
vif_plugging_timeout_check: vif_plugging_timeout
vif_plugging_timeout_value_min: 300
notify_nova_on_port_data_check: notify_nova_on_port_data_changes
notify_nova_on_port_status_check: notify_nova_on_port_status_changes
tenant_name_check: tenant_name
roles: nova-event-callback
Role documentation
Verify all deployed nodes have their clock synchronised.
Each overcloud node should have their clocks synchronised. The deployment should configure and run chronyd. This validation verifies that it is indeed running and connected to an NTP server on all nodes.
hosts: overcloud
groups: post-deployment
parameters:
roles: ntp
Role documentation
Check connectivity to various OpenStack services.
This validation gets the PublicVip address from the deployment and tries to access Horizon and get a Keystone token.
hosts: undercloud
groups: post-deployment, pre-upgrade, post-upgrade
parameters:
roles: openstack-endpoints
Role documentation
Validates OVS DPDK PMD cores from all NUMA nodes..
OVS DPDK PMD cpus must be provided from all NUMA nodes. A failed status post-deployment indicates PMD CPU list is not configured correctly.
hosts: ComputeOvsDpdk
groups: post-deployment
parameters:
roles: ovs-dpdk-pmd
Role documentation
Check the status of the pacemaker cluster.
This runs pcs status and checks for any failed actions. A failed status post-deployment indicates something is not configured correctly. This should also be run before upgrade as the process will likely fail with a cluster that’s not completely healthy.
hosts: Controller
groups: post-deployment
parameters:
roles: pacemaker-status
Role documentation
Rabbitmq limits.
Make sure the rabbitmq file descriptor limits are set to reasonable values.
hosts: Controller
groups: post-deployment
parameters:
min_fd_limit: 16384
roles: rabbitmq-limits
Role documentation
Ensure services state.
Detect services status on the target host and fails if we find a failed service.
hosts: undercloud, overcloud
groups: prep, pre-deployment, pre-upgrade, post-deployment, post-upgrade
parameters:
roles: service-status
Role documentation
Validate stonith devices.
Verify that stonith devices are configured for your OpenStack Platform HA cluster. We don’t configure stonith device with TripleO Installer. Because the hardware configuration may be differ in each environment and requires different fence agents. How to configure fencing please read https://access.redhat.com/documentation/en/red-hat-openstack-platform/8/paged/director-installation-and-usage/86-fencing-the-controller-nodes
hosts: Controller
groups: post-deployment
parameters:
roles: stonith-exists
Role documentation
Confirm that overcloud nodes are setup correctly.
Checks that overcloud nodes are registered with IdM and that all certs being tracked by certmonger are in the MONITORING state.
hosts: overcloud
groups: post-deployment
parameters:
roles: tls-everywhere
Role documentation
Except where otherwise noted, this document is licensed under Creative Commons Attribution 3.0 License. See all OpenStack Legal Documents.