diff options
| -rw-r--r-- | manifests/haproxy.pp | 31 | ||||
| -rw-r--r-- | manifests/profile/base/congress.pp | 86 | ||||
| -rw-r--r-- | manifests/profile/base/database/mysql.pp | 3 | ||||
| -rw-r--r-- | manifests/profile/base/keystone.pp | 3 | ||||
| -rw-r--r-- | manifests/profile/base/neutron.pp | 13 | ||||
| -rw-r--r-- | manifests/profile/base/neutron/server.pp | 81 | ||||
| -rw-r--r-- | manifests/profile/pacemaker/ceph/rbdmirror.pp | 22 |
7 files changed, 225 insertions, 14 deletions
diff --git a/manifests/haproxy.pp b/manifests/haproxy.pp index c399a96..f34c58f 100644 --- a/manifests/haproxy.pp +++ b/manifests/haproxy.pp @@ -143,6 +143,10 @@ # (optional) Enable or not Cinder API binding # Defaults to hiera('cinder_api_enabled', false) # +# [*congress*] +# (optional) Enable or not Congress API binding +# Defaults to hiera('congress_enabled', false) +# # [*manila*] # (optional) Enable or not Manila API binding # Defaults to hiera('manila_api_enabled', false) @@ -324,6 +328,10 @@ # (optional) Specify the network cinder is running on. # Defaults to hiera('cinder_api_network', undef) # +# [*congress_network*] +# (optional) Specify the network congress is running on. +# Defaults to hiera('congress_api_network', undef) +# # [*docker_registry_network*] # (optional) Specify the network docker-registry is running on. # Defaults to hiera('docker_registry_network', undef) @@ -523,6 +531,7 @@ class tripleo::haproxy ( $keystone_public = hiera('keystone_enabled', false), $neutron = hiera('neutron_api_enabled', false), $cinder = hiera('cinder_api_enabled', false), + $congress = hiera('congress_enabled', false), $manila = hiera('manila_api_enabled', false), $sahara = hiera('sahara_api_enabled', false), $tacker = hiera('tacker_enabled', false), @@ -567,6 +576,7 @@ class tripleo::haproxy ( $ceilometer_network = hiera('ceilometer_api_network', undef), $ceph_rgw_network = hiera('ceph_rgw_network', undef), $cinder_network = hiera('cinder_api_network', undef), + $congress_network = hiera('congress_api_network', undef), $docker_registry_network = hiera('docker_registry_network', undef), $glance_api_network = hiera('glance_api_network', undef), $gnocchi_network = hiera('gnocchi_api_network', undef), @@ -604,6 +614,8 @@ class tripleo::haproxy ( ceilometer_api_ssl_port => 13777, cinder_api_port => 8776, cinder_api_ssl_port => 13776, + congress_api_port => 1789, + congress_api_ssl_port => 13789, docker_registry_port => 8787, docker_registry_ssl_port => 13787, glance_api_port => 9292, @@ -863,6 +875,7 @@ class tripleo::haproxy ( }, public_ssl_port => $ports[neutron_api_ssl_port], service_network => $neutron_network, + member_options => union($haproxy_member_options, $internal_tls_member_options), } } @@ -885,6 +898,24 @@ class tripleo::haproxy ( } } + if $congress { + ::tripleo::haproxy::endpoint { 'congress': + public_virtual_ip => $public_virtual_ip, + internal_ip => hiera('congress_api_vip', $controller_virtual_ip), + service_port => $ports[congress_api_port], + ip_addresses => hiera('congress_node_ips', $controller_hosts_real), + server_names => hiera('congress_api_node_names', $controller_hosts_names_real), + mode => 'http', + listen_options => { + 'http-request' => [ + 'set-header X-Forwarded-Proto https if { ssl_fc }', + 'set-header X-Forwarded-Proto http if !{ ssl_fc }'], + }, + public_ssl_port => $ports[congress_api_ssl_port], + service_network => $congress_network, + } + } + if $manila { ::tripleo::haproxy::endpoint { 'manila': public_virtual_ip => $public_virtual_ip, diff --git a/manifests/profile/base/congress.pp b/manifests/profile/base/congress.pp new file mode 100644 index 0000000..1731e81 --- /dev/null +++ b/manifests/profile/base/congress.pp @@ -0,0 +1,86 @@ +# Copyright 2016 Red Hat, Inc. +# +# Licensed under the Apache License, Version 2.0 (the "License"); you may +# not use this file except in compliance with the License. You may obtain +# a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT +# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the +# License for the specific language governing permissions and limitations +# under the License. +# +# == Class: tripleo::profile::base::congress +# +# Congress server profile for tripleo +# +# === Parameters +# +# [*bootstrap_node*] +# (Optional) The hostname of the node responsible for bootstrapping tasks +# Defaults to hiera('bootstrap_nodeid') +# +# [*messaging_driver*] +# Driver for messaging service. +# Defaults to hiera('messaging_service_name', 'rabbit') +# +# [*messaging_hosts*] +# list of the messaging host fqdns +# Defaults to hiera('rabbitmq_node_names') +# +# [*messaging_password*] +# Password for messaging congress queue +# Defaults to hiera('congress::rabbit_password') +# +# [*messaging_port*] +# IP port for messaging service +# Defaults to hiera('congress::rabbit_port', 5672) +# +# [*messaging_username*] +# Username for messaging congress queue +# Defaults to hiera('congress::rabbit_userid', 'guest') +# +# [*messaging_use_ssl*] +# Flag indicating ssl usage. +# Defaults to hiera('congress::rabbit_use_ssl', '0') +# +# [*step*] +# (Optional) The current step of the deployment +# Defaults to hiera('step') + +class tripleo::profile::base::congress ( + $bootstrap_node = hiera('bootstrap_nodeid', undef), + $messaging_driver = hiera('messaging_service_name', 'rabbit'), + $messaging_hosts = any2array(hiera('rabbitmq_node_names', undef)), + $messaging_password = hiera('congress::rabbit_password'), + $messaging_port = hiera('congress::rabbit_port', '5672'), + $messaging_username = hiera('congress::rabbit_userid', 'guest'), + $messaging_use_ssl = hiera('congress::rabbit_use_ssl', '0'), + $step = hiera('step'), +) { + if $::hostname == downcase($bootstrap_node) { + $sync_db = true + } else { + $sync_db = false + } + + if $step >= 4 or ($step >= 3 and $sync_db){ + $messaging_use_ssl_real = sprintf('%s', bool2num(str2bool($messaging_use_ssl))) + class { '::congress': + sync_db => $sync_db, + default_transport_url => os_transport_url({ + 'transport' => $messaging_driver, + 'hosts' => $messaging_hosts, + 'port' => sprintf('%s', $messaging_port), + 'username' => $messaging_username, + 'password' => $messaging_password, + 'ssl' => $messaging_use_ssl_real, + }), + } + + include ::congress::server + include ::congress::db + } +} diff --git a/manifests/profile/base/database/mysql.pp b/manifests/profile/base/database/mysql.pp index 6f93903..4ccfabc 100644 --- a/manifests/profile/base/database/mysql.pp +++ b/manifests/profile/base/database/mysql.pp @@ -151,6 +151,9 @@ class tripleo::profile::base::database::mysql ( if hiera('cinder_api_enabled', false) { include ::cinder::db::mysql } + if hiera('congress_enabled', false) { + include ::congress::db::mysql + } if hiera('glance_api_enabled', false) { include ::glance::db::mysql } diff --git a/manifests/profile/base/keystone.pp b/manifests/profile/base/keystone.pp index e84e22f..72049e3 100644 --- a/manifests/profile/base/keystone.pp +++ b/manifests/profile/base/keystone.pp @@ -209,6 +209,9 @@ class tripleo::profile::base::keystone ( if hiera('cinder_api_enabled', false) { include ::cinder::keystone::auth } + if hiera('congress_enabled', false) { + include ::congress::keystone::auth + } if hiera('glance_api_enabled', false) { include ::glance::keystone::auth } diff --git a/manifests/profile/base/neutron.pp b/manifests/profile/base/neutron.pp index e6a32db..3de50c2 100644 --- a/manifests/profile/base/neutron.pp +++ b/manifests/profile/base/neutron.pp @@ -35,9 +35,22 @@ class tripleo::profile::base::neutron ( $rabbit_hosts = hiera('rabbitmq_node_names', undef), $rabbit_port = hiera('neutron::rabbit_port', 5672), ) { + + # TODO(jaosorior): Remove this when we pass it via t-h-t + if hiera('enable_internal_tls', false) { + $bind_host = 'localhost' + } else { + # This is executed in all of the nodes that use something neutron-related, + # so we set the defalut, since the bind_host is only available in the + # controllers. Either way, this will be removed and set properly via t-h-t + # in a subsequent commit. + $bind_host = hiera('neutron::bind_host', $::os_service_default) + } + if $step >= 3 { $rabbit_endpoints = suffix(any2array($rabbit_hosts), ":${rabbit_port}") class { '::neutron' : + bind_host => $bind_host, rabbit_hosts => $rabbit_endpoints, } include ::neutron::config diff --git a/manifests/profile/base/neutron/server.pp b/manifests/profile/base/neutron/server.pp index fcd804d..5a98f66 100644 --- a/manifests/profile/base/neutron/server.pp +++ b/manifests/profile/base/neutron/server.pp @@ -22,10 +22,34 @@ # (Optional) The hostname of the node responsible for bootstrapping tasks # Defaults to hiera('bootstrap_nodeid') # -# [*step*] -# (Optional) The current step in deployment. See tripleo-heat-templates -# for more details. -# Defaults to hiera('step') +# [*certificates_specs*] +# (Optional) The specifications to give to certmonger for the certificate(s) +# it will create. +# Example with hiera: +# apache_certificates_specs: +# httpd-internal_api: +# hostname: <overcloud controller fqdn> +# service_certificate: <service certificate path> +# service_key: <service key path> +# principal: "haproxy/<overcloud controller fqdn>" +# Defaults to hiera('apache_certificate_specs', {}). +# +# [*dvr_enabled*] +# (Optional) Is dvr enabled, used when no override is passed to +# l3_ha_override to calculate enabling l3 HA. +# Defaults to hiera('neutron::server::router_distributed') or false +# +# [*enable_internal_tls*] +# (Optional) Whether TLS in the internal network is enabled or not. +# Defaults to hiera('enable_internal_tls', false) +# +# [*generate_service_certificates*] +# (Optional) Whether or not certmonger will generate certificates for +# HAProxy. This could be as many as specified by the $certificates_specs +# variable. +# Note that this doesn't configure the certificates in haproxy, it merely +# creates the certificates. +# Defaults to hiera('generate_service_certificate', false). # # [*l3_ha_override*] # (Optional) Override the calculated value for neutron::server::l3_ha @@ -41,17 +65,31 @@ # (we need to default neutron_l3_short_node_names to an empty list # because some neutron backends disable the l3 agent) # -# [*dvr_enabled*] -# (Optional) Is dvr enabled, used when no override is passed to -# l3_ha_override to calculate enabling l3 HA. -# Defaults to hiera('neutron::server::router_distributed') or false +# [*neutron_network*] +# (Optional) The network name where the neutron endpoint is listening on. +# This is set by t-h-t. +# Defaults to hiera('neutron_api_network', undef) +# +# [*step*] +# (Optional) The current step in deployment. See tripleo-heat-templates +# for more details. +# Defaults to hiera('step') +# class tripleo::profile::base::neutron::server ( - $bootstrap_node = hiera('bootstrap_nodeid', undef), - $step = hiera('step'), - $l3_ha_override = '', - $l3_nodes = hiera('neutron_l3_short_node_names', []), - $dvr_enabled = hiera('neutron::server::router_distributed', false) + $bootstrap_node = hiera('bootstrap_nodeid', undef), + $certificates_specs = hiera('apache_certificates_specs', {}), + $dvr_enabled = hiera('neutron::server::router_distributed', false), + $enable_internal_tls = hiera('enable_internal_tls', false), + $generate_service_certificates = hiera('generate_service_certificates', false), + $l3_ha_override = '', + $l3_nodes = hiera('neutron_l3_short_node_names', []), + $neutron_network = hiera('neutron_api_network', undef), + $step = hiera('step'), ) { + if $enable_internal_tls and $generate_service_certificates { + ensure_resources('tripleo::certmonger::httpd', $certificates_specs) + } + if $::hostname == downcase($bootstrap_node) { $sync_db = true } else { @@ -74,6 +112,23 @@ class tripleo::profile::base::neutron::server ( # it will try to populate tables and we need to make sure this happens # before it starts on other nodes if $step >= 4 and $sync_db or $step >= 5 and !$sync_db { + if $enable_internal_tls { + if !$neutron_network { + fail('neutron_api_network is not set in the hieradata.') + } + $tls_certfile = $certificates_specs["httpd-${neutron_network}"]['service_certificate'] + $tls_keyfile = $certificates_specs["httpd-${neutron_network}"]['service_key'] + + ::tripleo::tls_proxy { 'neutron-api': + servername => hiera("fqdn_${neutron_network}"), + ip => hiera('neutron::bind_host'), # This will be cleaned out + port => 9696, # This will be cleaned out + tls_cert => $tls_certfile, + tls_key => $tls_keyfile, + notify => Class['::neutron::server'], + } + } + include ::neutron::server::notifications # We need to override the hiera value neutron::server::sync_db which is set # to true diff --git a/manifests/profile/pacemaker/ceph/rbdmirror.pp b/manifests/profile/pacemaker/ceph/rbdmirror.pp index ea445a1..4066225 100644 --- a/manifests/profile/pacemaker/ceph/rbdmirror.pp +++ b/manifests/profile/pacemaker/ceph/rbdmirror.pp @@ -26,6 +26,10 @@ # (Optional) Name assigned to the RBD mirror client # Defaults to 'rbd-mirror' # +# [*pcs_tries*] +# (Optional) The number of times pcs commands should be retried. +# Defaults to hiera('pcs_tries', 20) +# # [*stack_action*] # (Optional) Action executed on the stack. See tripleo-heat-templates # for more details. @@ -39,6 +43,7 @@ class tripleo::profile::pacemaker::ceph::rbdmirror ( $bootstrap_node = hiera('ceph_rbdmirror_short_bootstrap_node_name'), $client_name = 'openstack', + $pcs_tries = hiera('pcs_tries', 20), $stack_action = hiera('stack_action'), $step = hiera('step'), ) { @@ -57,6 +62,15 @@ class tripleo::profile::pacemaker::ceph::rbdmirror ( include ::tripleo::profile::base::ceph + if $step >= 2 { + pacemaker::property { 'ceph-rbdmirror-role-node-property': + property => 'ceph-rbdmirror-role', + value => true, + tries => $pcs_tries, + node => $::hostname, + } + } + if $step >= 3 { require ::ceph::profile::client ceph::mirror { $client_name: @@ -67,7 +81,13 @@ class tripleo::profile::pacemaker::ceph::rbdmirror ( # NOTE(gfidente): systemd uses the @ sign but it is an invalid # character in a pcmk resource name, so we need to use it only # for the name of the service - service_name => "ceph-rbd-mirror@${client_name}" + service_name => "ceph-rbd-mirror@${client_name}", + tries => $pcs_tries, + location_rule => { + resource_discovery => 'exclusive', + score => 0, + expression => ['ceph-rbdmirror-role eq true'], + } } } |