compute_tsx

About The Role

An Ansible role to verify that the compute nodes have the appropriate TSX flags before proceeding with an upgrade.

RHEL-8.3 kernel disabled the Intel TSX (Transactional Synchronization Extensions) feature by default as a preemptive security measure, but it breaks live migration from RHEL-7.9 (or even RHEL-8.1 or RHEL-8.2) to RHEL-8.3.

Operators are expected to explicitly define the TSX flag in their KernelArgs for the compute role to prevent live-migration issues during the upgrade process.

This role is intended to be called by tripleo via the kernel deployment templates.

It’s also possible to call the role as a standalone.

This also impacts upstream CentOS systems

Requirements

This role needs to be run on an Undercloud with a deployed Overcloud.

Dependencies

No dependencies.

Example Playbook

Standard playbook:

- hosts: nova_libvirt
  roles:
    - { role: compute_tsx}

Reporting playbook with no failure:

- hosts: nova_libvirt
  vars:
    - compute_tsx_warning: true
  roles:
    - { role: compute_tsx }

License

Apache

Author Information

Red Hat TripleO DFG:Compute Squad:Deployment

Full Description

Role Documentation

Welcome to the “compute_tsx” role documentation.

Role Defaults

This section highlights all of the defaults and variables set within the “compute_tsx” role.

# All variables intended for modification should place placed in this file.

# All variables within this role should have a prefix of "compute_tsx"

# Debugging mode - Whether or not to print the computed variables during execution
compute_tsx_debug: false

# If set to `true` it will not return a failure, but will simply print the failure
compute_tsx_warning: false

# Variable used when this validation is called by tripleo-heat-templates
compute_tsx_kernel_args: ''

# Information message to be printed in warning/failure mode
compute_tsx_information_msg: |
  For more information on why we must explicitly define the TSX flag, please visit:
  https://access.redhat.com/solutions/6036141

Role Variables: main.yml

# While options found within the vars/ path can be overridden using extra
# vars, items within this path are considered part of the role and not
# intended to be modified.

# All variables within this role should have a prefix of "compute_tsx"

# This is the kernel version that changed the tsx default from true to false
compute_tsx_8_3_version: 4.18.0-240

Molecule Scenarios

Molecule is being used to test the “compute_tsx” role. The following section highlights the drivers in service and provides an example playbook showing how the role is leveraged.

Scenario: default

Driver: podman

Molecule Platform(s)

- name: centos
  hostname: centos
  image: centos/centos:stream8
  registry:
    url: quay.io
  dockerfile: ../../../../.config/molecule/Dockerfile
  pkg_extras: python*-setuptools python*-pyyaml
  volumes:
  - /etc/ci/mirror_info.sh:/etc/ci/mirror_info.sh:ro
  privileged: true
  environment:
    http_proxy: "{{ lookup('env', 'http_proxy') }}"
    https_proxy: "{{ lookup('env', 'https_proxy') }}"
  ulimits:
  - host

Molecule Inventory

hosts:
  all:
    hosts:
      centos:
        ansible_python_interpreter: /usr/bin/python3

Example default playbook

- name: Converge
  hosts: all
  vars:
    tsx_assertion: {}
  tasks:
  - name: Assert a failure
    block:
    - name: Loading role with failure
      include_role:
        name: compute_tsx
      vars:
        tsx_rhel_8_2: true
        tsx_cmdline: false
        tsx_cpu_support: true
        tsx_grub: false
    rescue:
    - name: Fail if no failure
      fail:
        msg: |
          {{ tsx_assertion }}
      when:
            # The logic is reversed here
      - tsx_assertion.failed

  - name: Assert a failure, with warning only
    block:
    - name: Loading role with failure
      include_role:
        name: compute_tsx
      vars:
        tsx_rhel_8_2: true
        tsx_cmdline: false
        tsx_cpu_support: true
        tsx_grub: false
        compute_tsx_warning: true
    rescue:
    - name: Fail if failure
      fail:
        msg: |
          {{ tsx_assertion }}
      when:
            # The logic is reversed here
      - not tsx_assertion.failed

  - name: Assert a success
    block:
    - name: Loading role with passed
      include_role:
        name: compute_tsx
      vars:
        tsx_rhel_8_2: true
        tsx_cmdline: true
        tsx_cpu_support: true
        tsx_grub: false
    rescue:
    - name: Fail if failure
      fail:
        msg: |
          {{ tsx_assertion }}
      when:
            # The logic is reversed here
      - not tsx_assertion.failed