diff options
author | Jenkins <jenkins@review.openstack.org> | 2016-10-14 22:50:17 +0000 |
---|---|---|
committer | Gerrit Code Review <review@openstack.org> | 2016-10-14 22:50:17 +0000 |
commit | 97b2da92a2c0d268e5946178388e27bd2f30bc2f (patch) | |
tree | 9c44ef1d3206996926f2887e429b5ad35446db03 /manifests/profile/base | |
parent | 33be802c705c857ce94a80252bc22b2e01e27fa8 (diff) | |
parent | 9ca75667940a203cd0536cb64c9966f4f951c95b (diff) |
Merge "Move heat domain/user creation into keystone profile"
Diffstat (limited to 'manifests/profile/base')
-rw-r--r-- | manifests/profile/base/heat.pp | 16 | ||||
-rw-r--r-- | manifests/profile/base/keystone.pp | 23 |
2 files changed, 24 insertions, 15 deletions
diff --git a/manifests/profile/base/heat.pp b/manifests/profile/base/heat.pp index 027ab7e..2035a4f 100644 --- a/manifests/profile/base/heat.pp +++ b/manifests/profile/base/heat.pp @@ -46,7 +46,7 @@ class tripleo::profile::base::heat ( $step = hiera('step'), $rabbit_hosts = hiera('rabbitmq_node_ips', undef), ) { - # Domain resources will be created at step5 on the bootstrap_node so we + # Domain resources will be created at step5 on the node running keystone.pp # configure heat.conf at step3 and 4 but actually create the domain later. if $step == 3 or $step == 4 { class { '::heat::keystone::domain': @@ -69,20 +69,6 @@ class tripleo::profile::base::heat ( if $manage_db_purge { include ::heat::cron::purge_deleted } - if $bootstrap_node == $::hostname { - # Class ::heat::keystone::domain has to run on bootstrap node - # because it creates DB entities via API calls. - include ::heat::keystone::domain - - Class['::keystone::roles::admin'] -> Class['::heat::keystone::domain'] - } else { - # On non-bootstrap node we don't need to create Keystone resources again - class { '::heat::keystone::domain': - manage_domain => false, - manage_user => false, - manage_role => false, - } - } } } diff --git a/manifests/profile/base/keystone.pp b/manifests/profile/base/keystone.pp index d515f8f..846296e 100644 --- a/manifests/profile/base/keystone.pp +++ b/manifests/profile/base/keystone.pp @@ -45,10 +45,12 @@ class tripleo::profile::base::keystone ( $sync_db = true $manage_roles = true $manage_endpoint = true + $manage_domain = true } else { $sync_db = false $manage_roles = false $manage_endpoint = false + $manage_domain = false } if $step >= 4 or ( $step >= 3 and $sync_db ) { @@ -76,6 +78,27 @@ class tripleo::profile::base::keystone ( include ::keystone::cron::token_flush } + if $step >= 5 and $manage_domain { + if hiera('heat_engine_enabled', false) { + # if Heat and Keystone are collocated, so we want to + # both configure heat.conf and create Keystone resources. + # note: domain_password is given via Hiera. + if defined(Class['::tripleo::profile::base::heat']) { + include ::heat::keystone::domain + } else { + # if Heat and Keystone are not collocated, we want Puppet + # to only create Keystone resources on the Keystone node + # but not try to configure Heat, to avoid leaking the password. + class { '::heat::keystone::domain': + domain_name => $::os_service_default, + domain_admin => $::os_service_default, + domain_password => $::os_service_default, + } + } + Class['::keystone::roles::admin'] -> Class['::heat::keystone::domain'] + } + } + if $step >= 5 and $manage_endpoint{ if hiera('aodh_api_enabled', false) { include ::aodh::keystone::auth |