Skip to content

Commit 16491ee

Browse files
amartyasinhadanpawlik
amartyasinha
authored and
danpawlik
committed
Use role instead of playbooks - nfs.yml
Before simplifying 06-deploy-edpm.yml, it is necessary to take care of import_playbook calls within that play There are three import_playbook calls within 06-deploy-edpm.yml - validations.yml - nfs.yml - ceph.yml This PR takes care of nfs.yml It is continuation of simplification job execution [1]. [1] #2929
1 parent c8b0cc0 commit 16491ee

6 files changed

Lines changed: 227 additions & 1 deletion

File tree

‎playbooks/06-deploy-edpm.yml‎

Lines changed: 11 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -102,7 +102,17 @@
102102
name: edpm_deploy
103103

104104
- name: Deploy NFS server on target nodes
105-
ansible.builtin.import_playbook: "nfs.yml"
105+
become: true
106+
hosts: "{{ groups[cifmw_nfs_target | default('computes')][0] | default([]) }}"
107+
tasks:
108+
- name: Run cifmw_nfs role
109+
vars:
110+
nftables_path: /etc/nftables
111+
nftables_conf: /etc/sysconfig/nftables.conf
112+
when:
113+
- cifmw_edpm_deploy_nfs | default('false') | bool
114+
ansible.builtin.import_role:
115+
name: cifmw_nfs
106116

107117
- name: Clear ceph target hosts facts to force refreshing in HCI deployments
108118
hosts: "{{ cifmw_ceph_target | default('computes') }}"

‎playbooks/nfs.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,11 @@
1414
# License for the specific language governing permissions and limitations
1515
# under the License.
1616

17+
#
18+
# NOTE: Playbook migrated to: roles/cifmw_nfs/tasks/main.yml.
19+
# DO NOT EDIT THAT PLAYBOOK. IT WOULD BE REMOVED IN NEAR FUTURE.
20+
#
21+
1722
- name: Deploy an NFS server
1823
become: true
1924
hosts: "{{ groups[cifmw_nfs_target | default('computes')][0] | default([]) }}"

‎roles/cifmw_nfs/README.md‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
# cifmw_nfs
2+
This role deploys an NFS Server.
3+
4+
## Privilege escalation
5+
sudo privilege is required for this role.
6+
7+
## Parameters
8+
* `nftables_path`: path to nftables files
9+
* `nftables_conf`: path to nftables config file
10+
11+
## Examples
12+
```
13+
- name: Deploy NFS server on target nodes
14+
become: true
15+
hosts: "{{ groups[cifmw_nfs_target | default('computes')][0] | default([]) }}"
16+
vars:
17+
nftables_path: /etc/nftables
18+
nftables_conf: /etc/sysconfig/nftables.conf
19+
when:
20+
- cifmw_edpm_deploy_nfs | default('false') | bool
21+
ansible.builtin.import_role:
22+
name: cifmw_nfs
23+
```

‎roles/cifmw_nfs/defaults/main.yml‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
---
2+
# Copyright Red Hat, Inc.
3+
# All Rights Reserved.
4+
#
5+
# Licensed under the Apache License, Version 2.0 (the "License"); you may
6+
# not use this file except in compliance with the License. You may obtain
7+
# a copy of the License at
8+
#
9+
# http://www.apache.org/licenses/LICENSE-2.0
10+
#
11+
# Unless required by applicable law or agreed to in writing, software
12+
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
13+
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
14+
# License for the specific language governing permissions and limitations
15+
# under the License.
16+
17+
18+
# All variables intended for modification should be placed in this file.
19+
# All variables within this role should have a prefix of "cifmw_nfs"
20+
21+
cifmw_nfs_network: "storage"
22+
cifmw_nfs_target: "compute"

‎roles/cifmw_nfs/meta/main.yml‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
---
2+
# Copyright Red Hat, Inc.
3+
# All Rights Reserved.
4+
#
5+
# Licensed under the Apache License, Version 2.0 (the "License"); you may
6+
# not use this file except in compliance with the License. You may obtain
7+
# a copy of the License at
8+
#
9+
# http://www.apache.org/licenses/LICENSE-2.0
10+
#
11+
# Unless required by applicable law or agreed to in writing, software
12+
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
13+
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
14+
# License for the specific language governing permissions and limitations
15+
# under the License.
16+
17+
18+
galaxy_info:
19+
author: CI Framework
20+
description: CI Framework Role -- cifmw_nfs
21+
company: Red Hat
22+
license: Apache-2.0
23+
min_ansible_version: "2.14"
24+
namespace: cifmw
25+
galaxy_tags:
26+
- cifmw
27+
28+
# List your role dependencies here, one per line. Be sure to remove the '[]' above,
29+
# if you add dependencies to this list.
30+
dependencies: []

‎roles/cifmw_nfs/tasks/main.yml‎

Lines changed: 136 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,136 @@
1+
---
2+
# Copyright Red Hat, Inc.
3+
# All Rights Reserved.
4+
#
5+
# Licensed under the Apache License, Version 2.0 (the "License"); you may
6+
# not use this file except in compliance with the License. You may obtain
7+
# a copy of the License at
8+
#
9+
# http://www.apache.org/licenses/LICENSE-2.0
10+
#
11+
# Unless required by applicable law or agreed to in writing, software
12+
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
13+
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
14+
# License for the specific language governing permissions and limitations
15+
# under the License.
16+
17+
- name: Set custom cifmw PATH reusable fact
18+
tags:
19+
- always
20+
when:
21+
- cifmw_path is not defined
22+
ansible.builtin.set_fact:
23+
cifmw_path: "{{ ansible_user_dir }}/.crc/bin:{{ ansible_user_dir }}/.crc/bin/oc:{{ ansible_user_dir }}/bin:{{ ansible_env.PATH }}"
24+
cacheable: true
25+
26+
- name: Install required packages
27+
ansible.builtin.package:
28+
name:
29+
- nfs-utils
30+
- iptables
31+
32+
- name: Configure nfs to use v4 only
33+
community.general.ini_file:
34+
path: /etc/nfs.conf
35+
section: nfsd
36+
option: vers3
37+
value: n
38+
backup: true
39+
mode: "0644"
40+
41+
- name: Disable NFSv3-related services
42+
ansible.builtin.systemd_service:
43+
name: "{{ item }}"
44+
masked: true
45+
loop:
46+
- rpc-statd.service
47+
- rpcbind.service
48+
- rpcbind.socket
49+
50+
- name: Ensure shared folder exist
51+
ansible.builtin.file:
52+
path: "/data/{{ item }}"
53+
state: directory
54+
mode: '755'
55+
loop: "{{ cifmw_nfs_shares }}"
56+
57+
- name: Set nfs network vars
58+
delegate_to: controller
59+
environment:
60+
KUBECONFIG: "{{ cifmw_openshift_kubeconfig }}"
61+
PATH: "{{ cifmw_path }}"
62+
vars:
63+
_nfs_network_name: "{{ cifmw_nfs_network }}"
64+
_nfs_host: "{{ [groups[cifmw_nfs_target][0], ansible_domain] | select() | join('.') | default('') }}"
65+
_ipset_namespace: "{{ cifmw_install_yamls_defaults['NAMESPACE'] | default('openstack') }}"
66+
ansible.builtin.command:
67+
cmd: oc get ipset {{ _nfs_host }} -n {{ _ipset_namespace }} -o jsonpath='{.status.reservations[?(@.network=="{{ _nfs_network_name }}")]}'
68+
register: cifmw_nfs_network_out
69+
70+
- name: Store nfs network vars
71+
delegate_to: controller
72+
ansible.builtin.copy:
73+
dest: "{{ cifmw_basedir }}/artifacts/parameters/nfs-params.yml"
74+
content: >-
75+
{{
76+
{
77+
'cifmw_nfs_ip': cifmw_nfs_network_out.stdout | from_json | json_query('address'),
78+
'cifmw_nfs_network_range': cifmw_nfs_network_out.stdout | from_json | json_query('cidr')
79+
} | to_nice_yaml
80+
}}
81+
mode: "0644"
82+
83+
# NOTE: This represents a workaround because there's an edpm-nftables role
84+
# in edpm-ansible already. That role should contain the implementation
85+
# of the firewall rules for NFS, and they should be included in the
86+
# main edpm-rules.nft file. The following firewall config assumes that
87+
# the EDPM node has been configured in terms of networks and firewall.
88+
- name: Configure firewall
89+
become: true
90+
tags:
91+
- nft
92+
block:
93+
- name: Generate nftables rules file
94+
ansible.builtin.copy:
95+
content: |
96+
add rule inet filter EDPM_INPUT tcp dport 2049 accept
97+
dest: "{{ nftables_path }}/nfs-server.nft"
98+
mode: '0666'
99+
100+
- name: Update nftables.conf and include nfs rules at the bottom
101+
ansible.builtin.lineinfile:
102+
path: "{{ nftables_conf }}"
103+
line: include "{{ nftables_path }}/nfs-server.nft"
104+
insertafter: EOF
105+
106+
- name: Restart nftables service
107+
ansible.builtin.systemd:
108+
name: nftables
109+
state: restarted
110+
111+
- name: Configure the ip the nfs server should listen on
112+
community.general.ini_file:
113+
path: /etc/nfs.conf
114+
section: nfsd
115+
option: host
116+
value: "{{ cifmw_nfs_network_out.stdout | from_json | json_query('address') }}"
117+
backup: true
118+
mode: "0644"
119+
120+
- name: Enable and restart nfs-server service
121+
ansible.builtin.systemd:
122+
name: nfs-server
123+
state: restarted
124+
enabled: true
125+
126+
- name: Add shares to /etc/exports
127+
ansible.builtin.lineinfile:
128+
path: /etc/exports
129+
line: "/data/{{ item }} {{ cifmw_nfs_network_out.stdout | from_json | json_query('cidr') }}(rw,sync,no_root_squash)"
130+
loop: "{{ cifmw_nfs_shares }}"
131+
register: _export_shares
132+
133+
- name: Export the shares # noqa: no-handler
134+
when:
135+
- _export_shares.changed
136+
ansible.builtin.command: exportfs -a

0 commit comments

Comments
 (0)