Adds security group mode configuration

Security grouop mode defaults to stateful in Boron release. Red Hat
based systems less than 7.3 release are unable to use stateful.  This
patch detects those OS types and fallsback to 'learn' mode.  The mode is
also configurable as a new param to the opendaylight class.

Change-Id: I45ac251a99194bce63a80e8c0b4777ab4001d2a3
Signed-off-by: Tim Rozet <tdrozet@gmail.com>
Signed-off-by: Daniel Farrell <dfarrell@redhat.com>

diff --git a/README.markdown b/README.markdown
index 0a5b8fa19ded8456ec266a962eef5dcddac40874..142013b084c3ad65c398359eedca9e21a179582f 100644 (file)
--- a/README.markdown
+++ b/README.markdown
@@ -410,6 +410,14 @@ Default: `'https://github.com/dfarrell07/opendaylight-systemd/archive/master/ope
 Valid options: A valid URL to an ODL systemd .service file (archived in a
 tarball) as a string.
 
+##### `security_group_mode`
+
+Specifies the mode to use for security groups.
+
+Default: `stateful`
+
+Valid options: `transparent`, `learn`, `statless`
+
 ## Limitations
 
 * Tested on Fedora 22, 23, CentOS 7 and Ubuntu 14.04.

diff --git a/manifests/config.pp b/manifests/config.pp
index f164278ead7765e0bb0cb315c0aab1c87be532fa..d185dcd4d41fe4a36c1110e767379b5c39842a20 100644 (file)
--- a/manifests/config.pp
+++ b/manifests/config.pp
@@ -77,4 +77,39 @@ class opendaylight::config {
       fail("Number of HA nodes less than 2: ${ha_node_count} and HA Enabled")
     }
   }
+
+  # Configure ACL security group
+  # Requires at least CentOS 7.3 for RHEL/CentOS systems
+  if ('odl-netvirt-openstack' in $opendaylight::features) {
+    if $opendaylight::security_group_mode == 'stateful' {
+      if $opendaylight::stateful_unsupported {
+        warning("Stateful is unsupported in ${::operatingsystemrelease} setting to 'learn'")
+        $sg_mode = 'learn'
+      } else {
+        $sg_mode = 'stateful'
+      }
+    } else {
+      $sg_mode = $opendaylight::security_group_mode
+    }
+
+    $odl_datastore = [ '/opt/opendaylight/etc/opendaylight', '/opt/opendaylight/etc/opendaylight/datastore',
+                       '/opt/opendaylight/etc/opendaylight/datastore/initial',
+                       '/opt/opendaylight/etc/opendaylight/datastore/initial/config',
+                     ]
+
+    file { $odl_datastore:
+      ensure  =>  directory,
+      mode    =>  0755,
+      owner   => 'odl',
+      group   => 'odl',
+    }
+    ->
+    file { 'netvirt-aclservice-config.xml':
+      ensure  => file,
+      path    => '/opt/opendaylight/etc/opendaylight/datastore/initial/config/netvirt-aclservice-config.xml',
+      owner   => 'odl',
+      group   => 'odl',
+      content => template('opendaylight/netvirt-aclservice-config.xml.erb'),
+    }
+  }
 }

diff --git a/manifests/init.pp b/manifests/init.pp
index 17b2a8f730e4eaf2fd42f5a3a946f52cc1d4eda3..69d73fa2255a25a1fb29be3433a5e917a34abe83 100644 (file)
--- a/manifests/init.pp
+++ b/manifests/init.pp
@@ -29,21 +29,24 @@
 #   Array of IPs for each node in the HA cluster.
 # [*ha_node_index*]
 #   Index of ha_node_ips for this node.
+# [*security_group_mode*]
+#   Sets the mode to use for security groups (stateful, learn, stateless, transparent)
 #
 class opendaylight (
-  $default_features = $::opendaylight::params::default_features,
-  $extra_features = $::opendaylight::params::extra_features,
-  $odl_rest_port = $::opendaylight::params::odl_rest_port,
-  $odl_bind_ip = $::opendaylight::params::odl_bind_ip,
-  $install_method = $::opendaylight::params::install_method,
-  $rpm_repo = $::opendaylight::params::rpm_repo,
-  $tarball_url = $::opendaylight::params::tarball_url,
-  $unitfile_url = $::opendaylight::params::unitfile_url,
-  $enable_l3 = $::opendaylight::params::enable_l3,
-  $log_levels = $::opendaylight::params::log_levels,
-  $enable_ha = $::opendaylight::params::enable_ha,
-  $ha_node_ips = $::opendaylight::params::ha_node_ips,
-  $ha_node_index = $::opendaylight::params::ha_node_index,
+  $default_features    = $::opendaylight::params::default_features,
+  $extra_features      = $::opendaylight::params::extra_features,
+  $odl_rest_port       = $::opendaylight::params::odl_rest_port,
+  $odl_bind_ip         = $::opendaylight::params::odl_bind_ip,
+  $install_method      = $::opendaylight::params::install_method,
+  $rpm_repo            = $::opendaylight::params::rpm_repo,
+  $tarball_url         = $::opendaylight::params::tarball_url,
+  $unitfile_url        = $::opendaylight::params::unitfile_url,
+  $enable_l3           = $::opendaylight::params::enable_l3,
+  $log_levels          = $::opendaylight::params::log_levels,
+  $enable_ha           = $::opendaylight::params::enable_ha,
+  $ha_node_ips         = $::opendaylight::params::ha_node_ips,
+  $ha_node_index       = $::opendaylight::params::ha_node_index,
+  $security_group_mode = $::opendaylight::params::security_group_mode,
 ) inherits ::opendaylight::params {
 
   # Validate OS family
@@ -63,6 +66,9 @@ class opendaylight (
       if $::operatingsystemmajrelease != '7' {
         # RHEL/CentOS versions < 7 not supported as they lack systemd
         fail("Unsupported OS: ${::operatingsystem} ${::operatingsystemmajrelease}")
+      } elsif (versioncmp($::operatingsystemrelease, '7.3') < 0) {
+        # Versions < 7.3 do not support stateful security groups
+        $stateful_unsupported = true
       }
     }
     fedora: {

diff --git a/manifests/params.pp b/manifests/params.pp
index 00c8abd52dbbdf9063a4ee7a681b8bd84a679ba2..405475a225372141ea53e4b7d042e89508fd4950 100644 (file)
--- a/manifests/params.pp
+++ b/manifests/params.pp
@@ -22,4 +22,5 @@ class opendaylight::params {
   $enable_ha = false
   $ha_node_ips = []
   $ha_node_index = ''
+  $security_group_mode = 'stateful'
 }

diff --git a/spec/classes/opendaylight_spec.rb b/spec/classes/opendaylight_spec.rb
index 20783e961d5b02fe49c7faa6068ef218cba3548f..44b444c5a5d7d7d44a859334f1af507db8f99c77 100644 (file)
--- a/spec/classes/opendaylight_spec.rb
+++ b/spec/classes/opendaylight_spec.rb
@@ -699,4 +699,78 @@ describe 'opendaylight' do
       end
     end
   end
+  # Security Group Tests
+  describe 'security group tests' do
+    # Non-OS-type tests assume CentOS 7
+    #   See issue #43 for reasoning:
+    #   https://github.com/dfarrell07/puppet-opendaylight/issues/43#issue-57343159
+    osfamily = 'RedHat'
+    operatingsystem = 'CentOS'
+    operatingsystemmajrelease = '7'
+    context 'using supported stateful' do
+      let(:facts) {{
+        :osfamily => osfamily,
+        :operatingsystem => operatingsystem,
+        :operatingsystemmajrelease => operatingsystemmajrelease,
+        :operatingsystemrelease => '7.3',
+      }}
+
+      let(:params) {{
+        :security_group_mode => 'stateful',
+        :extra_features      => ['odl-netvirt-openstack'],
+      }}
+
+      # Run shared tests applicable to all supported OSs
+      # Note that this function is defined in spec_helper
+      generic_tests
+
+      # Run test that specialize in checking security groups
+      # Note that this function is defined in spec_helper
+      enable_sg_tests(security_group_mode: 'stateful', osrelease: '7.3')
+    end
+
+    context 'using unsupported stateful' do
+      let(:facts) {{
+        :osfamily => osfamily,
+        :operatingsystem => operatingsystem,
+        :operatingsystemmajrelease => operatingsystemmajrelease,
+        :operatingsystemrelease => '7.2.1511',
+      }}
+
+      let(:params) {{
+        :security_group_mode => 'stateful',
+        :extra_features      => ['odl-netvirt-openstack'],
+      }}
+
+      # Run shared tests applicable to all supported OSs
+      # Note that this function is defined in spec_helper
+      generic_tests
+
+      # Run test that specialize in checking security groups
+      # Note that this function is defined in spec_helper
+      enable_sg_tests(security_group_mode: 'stateful', osrelease: '7.2.1511')
+    end
+
+    context 'using transparent with unsupported stateful' do
+      let(:facts) {{
+        :osfamily => osfamily,
+        :operatingsystem => operatingsystem,
+        :operatingsystemmajrelease => operatingsystemmajrelease,
+        :operatingsystemrelease => '7.2.1511',
+      }}
+
+      let(:params) {{
+        :security_group_mode => 'transparent',
+        :extra_features      => ['odl-netvirt-openstack'],
+      }}
+
+      # Run shared tests applicable to all supported OSs
+      # Note that this function is defined in spec_helper
+      generic_tests
+
+      # Run test that specialize in checking security groups
+      # Note that this function is defined in spec_helper
+      enable_sg_tests(security_group_mode: 'transparent', osrelease: '7.2.1511')
+    end
+  end
 end

diff --git a/spec/spec_helper.rb b/spec/spec_helper.rb
index db1fe00ff11127f72df4aca53e716ef8c1f3f9b3..5777a1c92870c9dc1605951ed93658eb95245c44 100644 (file)
--- a/spec/spec_helper.rb
+++ b/spec/spec_helper.rb
@@ -410,3 +410,36 @@ def unsupported_os_tests(options = {})
   it { expect { should contain_service('opendaylight') }.to raise_error(Puppet::Error, /#{expected_msg}/) }
   it { expect { should contain_file('org.apache.karaf.features.cfg') }.to raise_error(Puppet::Error, /#{expected_msg}/) }
 end
+
+# Shared tests that specialize in testing enabling L3 via ODL OVSDB
+def enable_sg_tests(options = {})
+  # Extract params
+  # NB: This default value should be the same as one in opendaylight::params
+  # TODO: Remove this possible source of bugs^^
+  sg_mode = options.fetch(:security_group_mode, 'stateful')
+  os_release = options.fetch(:osrelease)
+
+  if !os_release.include? '7.3' and ['stateful'].include? sg_mode
+    # Confirm sg_mode becomes learn
+    it {
+      should contain_file('netvirt-aclservice-config.xml').with(
+        'ensure'      => 'file',
+        'path'        => '/opt/opendaylight/etc/opendaylight/datastore/initial/config/netvirt-aclservice-config.xml',
+        'owner'   => 'odl',
+        'group'   => 'odl',
+        'content'     => /learn/
+      )
+    }
+  else
+    # Confirm other sg_mode is passed correctly
+    it {
+      should contain_file('netvirt-aclservice-config.xml').with(
+        'ensure'      => 'file',
+        'path'        => '/opt/opendaylight/etc/opendaylight/datastore/initial/config/netvirt-aclservice-config.xml',
+        'owner'   => 'odl',
+        'group'   => 'odl',
+        'content'     => /#{sg_mode}/
+      )
+    }
+  end
+end

diff --git a/templates/netvirt-aclservice-config.xml.erb b/templates/netvirt-aclservice-config.xml.erb
new file mode 100644 (file)
index 0000000..25aaa0e
--- /dev/null
+++ b/templates/netvirt-aclservice-config.xml.erb
@@ -0,0 +1,3 @@
+<aclservice-config xmlns="urn:opendaylight:netvirt:aclservice-config">
+  <security-group-mode><%= scope.lookupvar('opendaylight::config::sg_mode') %></security-group-mode>
+</aclservice-config>