Portal:Cloud VPS/Admin/Projects lifecycle

This page describes how Cloud VPS projects are supposed to be created and deleted, i.e, the lifecycle. In the OpenStack world, project is known as tenant.

Creating a new project

The operator/engineer in charge of creating a new project should follow these steps.

Prerequisites:

• Project names should be all lower case, if not some errors will happen when requesting the puppet certificate
• users have a valid wikitech/LDAP account
• a phabricator request task exist https://phabricator.wikimedia.org/project/board/2875/

using horizon

Beware that horizon can be very slow.

• get the admin role in OpenStack
• jump to horizon https://horizon.wikimedia.org/
• switch to the admin project (top left drop-down menu)
• go to the identity zone https://horizon.wikimedia.org/identity/
• press the 'New project' button and follow the steps.
• amend quotas, if necessary (using the CLI or horizon?)
• Communicate with the requestor in the pabricator task

using CLI

• ssh to the corresponding control box (see deployments).
• get root and source the novaenv.sh file

aborrero@labcontrol1001:~ $ sudo su
root@labcontrol1001:/home/aborrero# cd
root@labcontrol1001:~# source novaenv.sh

• make sure the users requesting the project exists in LDAP

root@labcontrol1001:~# PYTHONIOENCODING=utf-8 openstack user list | grep -i user
| user                                   | User name                                                                                |

• create the project:

root@labcontrol1001:~# openstack --os-region-name eqiad project create --enable --description "a dockerised wikibase infrastructure" newp
+-------------+--------------------------------------+
| Field       | Value                                |
+-------------+--------------------------------------+
| description | a dockerised wikibase infrastructure |
| domain_id   | default                              |
| enabled     | True                                 |
| id          | newp                                 |
| is_domain   | False                                |
| name        | newp                                 |
| parent_id   | default                              |
+-------------+--------------------------------------+

• Modify quotas if required
• Add users to roles:

root@labcontrol1001:~# openstack role add --user aborrero --project newp projectadmin
root@labcontrol1001:~# openstack role add --user aborrero --project newp user
root@labcontrol1001:~# openstack role add --user tarrow --project newp user
root@labcontrol1001:~# openstack role add --user tarrow --project newp projectadmin
root@labcontrol1001:~# openstack role assignment list --project newp --names
+--------------+---------------------------------+-------+--------------+--------+-----------+
| Role         | User                            | Group | Project      | Domain | Inherited |
+--------------+---------------------------------+-------+--------------+--------+-----------+
| projectadmin | Arturo Borrero Gonzalez@Default |       | newp@Default |        | False     |
| user         | Arturo Borrero Gonzalez@Default |       | newp@Default |        | False     |
| projectadmin | novaadmin@Default               |       | newp@Default |        | False     |
| user         | novaadmin@Default               |       | newp@Default |        | False     |
| observer     | Novaobserver@Default            |       | newp@Default |        | False     |
| projectadmin | Tarrow@Default                  |       | newp@Default |        | False     |
| user         | Tarrow@Default                  |       | newp@Default |        | False     |
+--------------+---------------------------------+-------+--------------+--------+-----------+

• Communicate with the requester in the pabricator task

Deleting a project

Project deletion tends to leave orphaned resources lying about. Eventually this should all be handled by Designate or Keystone hooks, but until then:

1. Make sure there are no instances in the project. This can be done in Horizon or via the commandline:

   $ OS_TENANT_NAME=<project> openstack server list
   $ OS_TENANT_NAME=<project> openstack server delete <instance id>
   

2. Make sure there are no dns zones allocated to the project. This can be done in Horizon or via the commandline:

   $ OS_TENANT_NAME=puppet openstack zone list
   $ OS_TENANT_NAME=puppet openstack zone delete <zone id>
   

3. Delete any proxies the project may have via Horizon
4. Delete any prefix- or project-wide puppet configurations via Horizon
5. Finally, delete the project using Horizon or the commandline. If using Horizon, set your current project to 'Admin' and then delete the project using the Identity->Projects panel.

History

In previous versions of Cloud VPS all the projects lifecyle was handled via Wikitech itself, with some custom MediaWiki plugins to hook the Openstack API. This was eventually replaced by Horizon, which can handle all the operations by itself.

See also

• Portal:Cloud_VPS/Admin/Procedures_and_operations