Check the status of the ceph cluster.
Uses ceph health to check if cluster is in HEALTH_WARN state and prints a debug message.
hosts: ceph_mon
groups: post-deployment, post-ceph
parameters:
tripleo_delegate_to: {{ groups[‘ceph_mon’] | default([]) }}
osd_percentage_min: 0
roles: ceph
Role documentation
Ensure container status.
Detect failed containers and raise an error.
hosts: undercloud, overcloud
groups: pre-upgrade, post-deployment, post-upgrade
parameters:
roles: container_status
Role documentation
Verify docker containers are up and ports are open.
Ensure relevant docker containers are up and running, with ports open to listen. We iterate through a list of container names and ports provided in defaults, and ensure the system has those available.
hosts: undercloud
groups: post-deployment, pre-upgrade
parameters:
open_ports: [111, 873, 3000, 3306, 4369, 5000, 5050, 5672, 6000, 6001, 6002, 6379, 6385, 8000, 8004, 8080, 8088, 8774, 8775, 8778, 8787, 8888, 8989, 9000, 9292, 9696, 11211, 15672, 25672, 35357, 39422, {‘port’: 22, ‘search_regex’: ‘OpenSSH’}]
running_containers: [‘glance_api’, ‘heat_api’, ‘heat_api_cfn’, ‘heat_api_cron’, ‘heat_engine’, ‘ironic_api’, ‘ironic_conductor’, ‘ironic_inspector’, ‘ironic_inspector_dnsmasq’, ‘ironic_neutron_agent’, ‘ironic_pxe_http’, ‘ironic_pxe_tftp’, ‘iscsid’, ‘keystone’, ‘keystone_cron’, ‘logrotate_crond’, ‘memcached’, ‘mistral_api’, ‘mistral_engine’, ‘mistral_event_engine’, ‘mistral_executor’, ‘mysql’, ‘neutron_api’, ‘neutron_dhcp’, ‘neutron_l3_agent’, ‘neutron_ovs_agent’, ‘nova_api’, ‘nova_api_cron’, ‘nova_compute’, ‘nova_conductor’, ‘nova_metadata’, ‘nova_placement’, ‘nova_scheduler’, ‘rabbitmq’, ‘swift_account_auditor’, ‘swift_account_reaper’, ‘swift_account_replicator’, ‘swift_account_server’, ‘swift_container_auditor’, ‘swift_container_replicator’, ‘swift_container_server’, ‘swift_container_updater’, ‘swift_object_auditor’, ‘swift_object_expirer’, ‘swift_object_replicator’, ‘swift_object_server’, ‘swift_object_updater’, ‘swift_proxy’, ‘swift_rsync’, ‘tripleo_ui’, ‘zaqar’, ‘zaqar_websocket’]
roles: containerized_undercloud_docker
Role documentation
Verify that keystone admin token is disabled.
This validation checks that keystone admin token is disabled on both undercloud and overcloud controller after deployment.
hosts: undercloud, Controller
groups: post-deployment
parameters:
keystone_conf_file: /var/lib/config-data/puppet-generated/keystone/etc/keystone/keystone.conf
roles: controller_token
Role documentation
Check controller ulimits.
This will check the ulimits of each controller.
hosts: Controller
groups: post-deployment
parameters:
nofiles_min: 1024
nproc_min: 2048
roles: controller_ulimits
Role documentation
HAProxy configuration.
Verify the HAProxy configuration has recommended values.
hosts: Controller
groups: post-deployment
parameters:
config_file: /var/lib/config-data/puppet-generated/haproxy/etc/haproxy/haproxy.cfg
global_maxconn_min: 20480
defaults_maxconn_min: 4096
defaults_timeout_queue: 2m
defaults_timeout_client: 2m
defaults_timeout_server: 2m
defaults_timeout_check: 10s
roles: haproxy
Role documentation
Healthcheck systemd services Check.
Check for failed healthcheck systemd services.
hosts: undercloud, overcloud
groups: post-deployment
parameters:
retries_number: 1
delay_number: 1
inflight_healthcheck_services: []
roles: healthcheck_service_status
Role documentation
Verify image-serve service is working and answering.
Ensures image-serve vhost is configured and httpd is running.
hosts: undercloud
groups: pre-upgrade, post-deployment, post-upgrade
parameters:
roles: image_serve
Role documentation
MySQL Open Files Limit.
Verify the open-files-limit configuration is high enough https://access.redhat.com/solutions/1598733
hosts: Controller, Database
groups: post-deployment
parameters:
min_open_files_limit: 16384
roles: mysql_open_files_limit
Role documentation
Neutron Sanity Check.
Run neutron-sanity-check on the controller nodes to find out potential issues with Neutron’s configuration. The tool expects all the configuration files that are passed to the Neutron services.
hosts: Controller
groups: post-deployment
parameters:
configs: [‘/etc/neutron/neutron.conf’, ‘/usr/share/neutron/neutron-dist.conf’, ‘/etc/neutron/metadata_agent.ini’, ‘/etc/neutron/dhcp_agent.ini’, ‘/etc/neutron/l3_agent.ini’]
roles: neutron_sanity_check
Role documentation
Nova Event Callback Configuration Check.
/etc/nova/nova.conf: [DEFAULT]/vif_plugging_is_fatal = True [DEFAULT]/vif_plugging_timeout >= 300
/etc/neutron/neutron.conf: [nova]/auth_url = ‘http://nova_admin_auth_ip:5000’ [nova]/tenant_name = ‘service’ [DEFAULT]/notify_nova_on_port_data_changes = True [DEFAULT]/notify_nova_on_port_status_changes = True
hosts: Controller
groups: post-deployment
parameters:
nova_config_file: /var/lib/config-data/puppet-generated/nova/etc/nova/nova.conf
neutron_config_file: /var/lib/config-data/puppet-generated/neutron/etc/neutron/neutron.conf
vif_plugging_fatal_check: vif_plugging_is_fatal
vif_plugging_timeout_check: vif_plugging_timeout
vif_plugging_timeout_value_min: 300
notify_nova_on_port_data_check: notify_nova_on_port_data_changes
notify_nova_on_port_status_check: notify_nova_on_port_status_changes
tenant_name_check: tenant_name
roles: nova_event_callback
Role documentation
Verify all deployed nodes have their clock synchronised.
Each overcloud node should have their clocks synchronised. The deployment should configure and run chronyd. This validation verifies that it is indeed running and connected to an NTP server on all nodes.
hosts: overcloud
groups: post-deployment
parameters:
roles: ntp
Role documentation
Check connectivity to various OpenStack services.
This validation gets the PublicVip address from the deployment and tries to access Horizon and get a Keystone token.
hosts: undercloud
groups: post-deployment, pre-upgrade, post-upgrade
parameters:
roles: openstack_endpoints
Role documentation
Validates OVS DPDK PMD cores from all NUMA nodes..
OVS DPDK PMD cpus must be provided from all NUMA nodes. A failed status post-deployment indicates PMD CPU list is not configured correctly.
hosts: ComputeOvsDpdk
groups: post-deployment
parameters:
roles: ovs_dpdk_pmd
Role documentation
Check the status of the pacemaker cluster.
This runs pcs status and checks for any failed actions. A failed status post-deployment indicates something is not configured correctly. This should also be run before upgrade as the process will likely fail with a cluster that’s not completely healthy.
hosts: Controller
groups: post-deployment
parameters:
roles: pacemaker_status
Role documentation
Rabbitmq limits.
Make sure the rabbitmq file descriptor limits are set to reasonable values.
hosts: Controller
groups: post-deployment
parameters:
min_fd_limit: 16384
roles: rabbitmq_limits
Role documentation
Ensure services state.
Detect services status on the target host and fails if we find a failed service.
hosts: undercloud, overcloud
groups: prep, pre-deployment, pre-upgrade, post-deployment, post-upgrade
parameters:
roles: service_status
Role documentation
Validate stonith devices.
Verify that stonith devices are configured for your OpenStack Platform HA cluster. We don’t configure stonith device with TripleO Installer. Because the hardware configuration may be differ in each environment and requires different fence agents. How to configure fencing please read https://access.redhat.com/documentation/en/red-hat-openstack-platform/8/paged/director-installation-and-usage/86-fencing-the-controller-nodes
hosts: Controller
groups: post-deployment
parameters:
roles: stonith_exists
Role documentation
Confirm that overcloud nodes are setup correctly.
Checks that overcloud nodes are registered with IdM and that all certs being tracked by certmonger are in the MONITORING state.
hosts: overcloud
groups: post-deployment
parameters:
roles: tls_everywhere
Role documentation
validate-selinux.
Ensures we don’t have any SELinux denials on the system
hosts: all
groups: pre-deployment, post-deployment, pre-upgrade, post-upgrade
parameters:
validate_selinux_working_dir: /var/log/validations
validate_selinux_audit_source: /var/log/audit/audit.log
validate_selinux_skip_list_dest: {{ validate_selinux_working_dir }}/denials-skip-list.txt
validate_selinux_filtered_denials_dest: {{ validate_selinux_working_dir }}/denials-filtered.log
validate_selinux_strict: False
validate_selinux_filter: None
validate_selinux_skip_list: {}
roles: validate_selinux
Role documentation
Except where otherwise noted, this document is licensed under Creative Commons Attribution 3.0 License. See all OpenStack Legal Documents.