summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
-rw-r--r--README.md9
-rw-r--r--manifests/certmonger/ca/crl.pp149
-rw-r--r--manifests/haproxy.pp13
-rw-r--r--manifests/profile/base/certmonger_user.pp10
-rw-r--r--manifests/profile/base/docker.pp59
-rw-r--r--manifests/profile/base/ironic/conductor.pp1
-rw-r--r--manifests/profile/base/novajoin.pp83
-rw-r--r--manifests/profile/base/swift/ringbuilder.pp4
-rw-r--r--manifests/profile/pacemaker/cinder/backup_bundle.pp146
-rw-r--r--manifests/profile/pacemaker/cinder/volume_bundle.pp141
-rw-r--r--manifests/profile/pacemaker/database/mysql.pp33
-rw-r--r--manifests/profile/pacemaker/database/mysql_bundle.pp5
-rw-r--r--manifests/profile/pacemaker/database/redis_bundle.pp5
-rw-r--r--manifests/profile/pacemaker/haproxy_bundle.pp1
-rw-r--r--manifests/profile/pacemaker/rabbitmq_bundle.pp5
-rw-r--r--manifests/ui.pp39
-rw-r--r--releasenotes/notes/Add-CRL-resource-d2263462d40f01c0.yaml4
-rw-r--r--releasenotes/notes/HAProxy-CRL-d05b555f92ff55ed.yaml6
-rw-r--r--releasenotes/notes/add-support-for-proxying-ironic-inspector-via-apache-ea70e9fa1ad04553.yaml6
-rw-r--r--releasenotes/notes/galera-install-rsync-b2f2504f12cc0cfd.yaml6
-rw-r--r--spec/classes/tripleo_certmonger_ca_crl_spec.rb104
-rw-r--r--spec/classes/tripleo_certmonger_ca_local_spec.rb (renamed from spec/classes/tripleo_certmonger_ca_local.rb)0
-rw-r--r--spec/classes/tripleo_certmonger_etcd_spec.rb (renamed from spec/classes/tripleo_certmonger_etcd.rb)0
-rw-r--r--spec/classes/tripleo_certmonger_mysql_spec.rb (renamed from spec/classes/tripleo_certmonger_mysql.rb)0
-rw-r--r--spec/classes/tripleo_certmonger_rabbitmq_spec.rb (renamed from spec/classes/tripleo_certmonger_rabbitmq.rb)0
-rw-r--r--spec/classes/tripleo_profile_base_docker_spec.rb79
-rw-r--r--spec/classes/tripleo_profile_base_novajoin_spec.rb126
-rw-r--r--spec/classes/tripleo_profile_base_swift_ringbuilder_spec.rb (renamed from spec/classes/tripleo_profile_base_swift_ringbuilder.rb)0
-rw-r--r--spec/defines/tripleo_certmonger_httpd_spec.rb (renamed from spec/classes/tripleo_certmonger_httpd.rb)2
-rw-r--r--templates/ui/tripleo_ui_config.js.erb1
-rw-r--r--test-requirements.txt4
31 files changed, 1013 insertions, 28 deletions
diff --git a/README.md b/README.md
index 7ca7610..90e858b 100644
--- a/README.md
+++ b/README.md
@@ -8,3 +8,12 @@ Team and repository tags
# puppet-tripleo
Lightweight composition layer for Puppet TripleO.
+
+## Contributing
+
+* Free software: Apache licence
+* Source: http://git.openstack.org/cgit/openstack/puppet-tripleo
+* Bugs: http://bugs.launchpad.net/tripleo (tag: puppet)
+* Documentation:
+ * TripleO: http://docs.openstack.org/developer/tripleo-docs/index.html
+ * Testing with puppet: https://docs.openstack.org/developer/puppet-openstack-guide/testing.html
diff --git a/manifests/certmonger/ca/crl.pp b/manifests/certmonger/ca/crl.pp
new file mode 100644
index 0000000..59a3681
--- /dev/null
+++ b/manifests/certmonger/ca/crl.pp
@@ -0,0 +1,149 @@
+# Copyright 2017 Red Hat, Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License. You may obtain
+# a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations
+# under the License.
+#
+# == class: tripleo::certmonger::ca::crl
+#
+# Class that downloads the appropriate CRL file from the CA. This can
+# furtherly be used by services in order for proper certificate revocation to
+# come into effect. The class also sets up a cron job that will refresh the CRL
+# once a week. Also, processing of the CRL file might be needed. e.g. most CAs
+# use DER format to distribute the CRLs, while services such as HAProxy expect
+# the CRL to be in PEM format.
+#
+# === Parameters
+#
+# [*crl_dest*]
+# (Optional) The file where the CRL file will be stored.
+# Defaults to '/etc/pki/CA/crl/overcloud-crl.pem'
+#
+# [*crl_source*]
+# (Optional) The URI where the CRL file will be fetched from.
+# Defaults to undef
+#
+# [*process*]
+# (Optional) Whether the CRL needs processing before being used. This means
+# transforming from DER to PEM format or viceversa. This is because most CRLs
+# by default come in DER format, so most likely it needs to be transformed.
+# Defaults to true
+#
+# [*crl_preprocessed*]
+# (Optional) The pre-processed CRL file which will be transformed.
+# Defaults to '/etc/pki/CA/crl/overcloud-crl.bin'
+#
+# [*crl_preprocessed_format*]
+# (Optional) The pre-processed CRL file's format which will be transformed.
+# Defaults to 'DER'
+#
+# [*minute*]
+# (optional) Defaults to '0'.
+#
+# [*hour*]
+# (optional) Defaults to '1'.
+#
+# [*monthday*]
+# (optional) Defaults to '*'.
+#
+# [*month*]
+# (optional) Defaults to '*'.
+#
+# [*weekday*]
+# (optional) Defaults to '6'.
+#
+# [*maxdelay*]
+# (optional) Seconds. Defaults to 0. Should be a positive integer.
+# Induces a random delay before running the cronjob to avoid running all
+# cron jobs at the same time on all hosts this job is configured.
+#
+# [*reload_cmds*]
+# (Optional) list of commands to be executed after fetching the CRL list in
+# the cron job. This will usually be a list of reload commands issued to
+# services that use the CRL.
+# Defaults to []
+#
+class tripleo::certmonger::ca::crl (
+ $crl_dest = '/etc/pki/CA/crl/overcloud-crl.pem',
+ $crl_source = undef,
+ $process = true,
+ $crl_preprocessed = '/etc/pki/CA/crl/overcloud-crl.bin',
+ $crl_preprocessed_format = 'DER',
+ $minute = '0',
+ $hour = '1',
+ $monthday = '*',
+ $month = '*',
+ $weekday = '6',
+ $maxdelay = 0,
+ $reload_cmds = [],
+) {
+ if $crl_source {
+ $ensure = 'present'
+ } else {
+ $ensure = 'absent'
+ }
+
+ if $maxdelay == 0 {
+ $sleep = ''
+ } else {
+ $sleep = "sleep `expr \${RANDOM} \\% ${maxdelay}`; "
+ }
+
+ if $process {
+ $fetched_crl = $crl_preprocessed
+ } else {
+ $fetched_crl = $crl_dest
+ }
+
+ file { 'tripleo-ca-crl' :
+ ensure => $ensure,
+ path => $fetched_crl,
+ source => $crl_source,
+ mode => '0644',
+ }
+
+ if $process and $ensure == 'present' {
+ $crl_dest_format = $crl_preprocessed_format ? {
+ 'PEM' => 'DER',
+ 'DER' => 'PEM'
+ }
+ # transform CRL from DER to PEM or viceversa
+ $process_cmd = "openssl crl -in ${$crl_preprocessed} -inform ${crl_preprocessed_format} -outform ${crl_dest_format} -out ${crl_dest}"
+ exec { 'tripleo-ca-crl-process-command' :
+ command => $process_cmd,
+ path => '/usr/bin',
+ refreshonly => true,
+ subscribe => File['tripleo-ca-crl']
+ }
+ } else {
+ $process_cmd = []
+ }
+
+ if $ensure == 'present' {
+ # Fetch CRL in cron job and notify needed services
+ $cmd_list = concat(["${sleep}curl -L -o ${fetched_crl} ${crl_source}"], $process_cmd, $reload_cmds)
+ $cron_cmd = join($cmd_list, ' && ')
+ } else {
+ $cron_cmd = absent
+ }
+
+ cron { 'tripleo-refresh-crl-file':
+ ensure => $ensure,
+ command => $cron_cmd,
+ environment => 'PATH=/usr/bin SHELL=/bin/sh',
+ user => 'root',
+ minute => $minute,
+ hour => $hour,
+ monthday => $monthday,
+ month => $month,
+ weekday => $weekday,
+ }
+}
diff --git a/manifests/haproxy.pp b/manifests/haproxy.pp
index 5f70647..208f328 100644
--- a/manifests/haproxy.pp
+++ b/manifests/haproxy.pp
@@ -146,6 +146,10 @@
# the servers it balances
# Defaults to '/etc/pki/ca-trust/extracted/openssl/ca-bundle.trust.crt'
#
+# [*crl_file*]
+# Path to the CRL file to be used for checking revoked certificates.
+# Defaults to undef
+#
# [*haproxy_stats_certificate*]
# Filename of an HAProxy-compatible certificate and key file
# When set, enables SSL on the haproxy stats endpoint using the specified file.
@@ -565,6 +569,7 @@ class tripleo::haproxy (
$ssl_cipher_suite = '!SSLv2:kEECDH:kRSA:kEDH:kPSK:+3DES:!aNULL:!eNULL:!MD5:!EXP:!RC4:!SEED:!IDEA:!DES',
$ssl_options = 'no-sslv3',
$ca_bundle = '/etc/pki/ca-trust/extracted/openssl/ca-bundle.trust.crt',
+ $crl_file = undef,
$haproxy_stats_certificate = undef,
$keystone_admin = hiera('keystone_enabled', false),
$keystone_public = hiera('keystone_enabled', false),
@@ -728,7 +733,13 @@ class tripleo::haproxy (
$ports = merge($default_service_ports, $service_ports)
if $enable_internal_tls {
- $internal_tls_member_options = ['ssl', 'verify required', "ca-file ${ca_bundle}"]
+ $base_internal_tls_member_options = ['ssl', 'verify required', "ca-file ${ca_bundle}"]
+
+ if $crl_file {
+ $internal_tls_member_options = concat($base_internal_tls_member_options, "crl-file ${crl_file}")
+ } else {
+ $internal_tls_member_options = $base_internal_tls_member_options
+ }
Haproxy::Balancermember {
verifyhost => true
}
diff --git a/manifests/profile/base/certmonger_user.pp b/manifests/profile/base/certmonger_user.pp
index 4ba51ec..7a6559e 100644
--- a/manifests/profile/base/certmonger_user.pp
+++ b/manifests/profile/base/certmonger_user.pp
@@ -77,6 +77,16 @@ class tripleo::profile::base::certmonger_user (
$rabbitmq_certificate_specs = hiera('tripleo::profile::base::rabbitmq::certificate_specs', {}),
$etcd_certificate_specs = hiera('tripleo::profile::base::etcd::certificate_specs', {}),
) {
+ unless empty($haproxy_certificates_specs) {
+ $reload_haproxy = ['systemctl reload haproxy']
+ Class['::tripleo::certmonger::ca::crl'] ~> Haproxy::Balancermember<||>
+ Class['::tripleo::certmonger::ca::crl'] ~> Class['::haproxy']
+ } else {
+ $reload_haproxy = []
+ }
+ class { '::tripleo::certmonger::ca::crl' :
+ reload_cmds => $reload_haproxy,
+ }
include ::tripleo::certmonger::ca::libvirt
unless empty($apache_certificates_specs) {
diff --git a/manifests/profile/base/docker.pp b/manifests/profile/base/docker.pp
index 29f8b75..67fbd71 100644
--- a/manifests/profile/base/docker.pp
+++ b/manifests/profile/base/docker.pp
@@ -47,6 +47,18 @@
# [*step*]
# step defaults to hiera('step')
#
+# [*configure_libvirt_polkit*]
+# Configures libvirt polkit to grant the kolla nova user access to the libvirtd unix domain socket on the host.
+# Defaults to true when nova_compute service is enabled, false when nova_compute is disabled
+#
+# [*docker_nova_uid*]
+# When configure_libvirt_polkit = true, the uid/gid of the nova user within the docker container.
+# Defaults to 42436
+#
+# [*services_enabled*]
+# List of TripleO services enabled on the role.
+# Defaults to hiera('services_names')
+#
class tripleo::profile::base::docker (
$docker_namespace = undef,
$insecure_registry = false,
@@ -55,7 +67,17 @@ class tripleo::profile::base::docker (
$configure_storage = true,
$storage_options = '-s overlay2',
$step = hiera('step'),
+ $configure_libvirt_polkit = undef,
+ $docker_nova_uid = 42436,
+ $services_enabled = hiera('service_names', [])
) {
+
+ if $configure_libvirt_polkit == undef {
+ $configure_libvirt_polkit_real = 'nova_compute' in $services_enabled
+ } else {
+ $configure_libvirt_polkit_real = $configure_libvirt_polkit
+ }
+
if $step >= 1 {
package {'docker':
ensure => installed,
@@ -130,4 +152,41 @@ class tripleo::profile::base::docker (
}
}
+ if ($step >= 4 and $configure_libvirt_polkit_real) {
+ # Workaround for polkit authorization for libvirtd socket on host
+ #
+ # This creates a local user with the kolla nova uid, and sets the polkit rule to
+ # allow both it and the nova user from the nova rpms, should it exist (uid 162).
+
+ group { 'docker_nova_group':
+ name => 'docker_nova',
+ gid => $docker_nova_uid
+ } ->
+ user { 'docker_nova_user':
+ name => 'docker_nova',
+ uid => $docker_nova_uid,
+ gid => $docker_nova_uid,
+ shell => '/sbin/nologin',
+ comment => 'OpenStack Nova Daemons',
+ groups => ['nobody']
+ }
+
+ # Similar to the polkit rule in the openstack-nova rpm spec
+ # but allow both the 'docker_nova' and 'nova' user
+ $docker_nova_polkit_rule = '// openstack-nova libvirt management permissions
+polkit.addRule(function(action, subject) {
+ if (action.id == "org.libvirt.unix.manage" &&
+ /^(docker_)?nova$/.test(subject.user)) {
+ return polkit.Result.YES;
+ }
+});
+'
+ package {'polkit':
+ ensure => installed,
+ } ->
+ file {'/etc/polkit-1/rules.d/50-nova.rules':
+ content => $docker_nova_polkit_rule,
+ mode => '0644'
+ }
+ }
}
diff --git a/manifests/profile/base/ironic/conductor.pp b/manifests/profile/base/ironic/conductor.pp
index 5ebf167..f7a2eb0 100644
--- a/manifests/profile/base/ironic/conductor.pp
+++ b/manifests/profile/base/ironic/conductor.pp
@@ -51,6 +51,7 @@ class tripleo::profile::base::ironic::conductor (
}
# Configure access to other services
+ include ::ironic::cinder
include ::ironic::drivers::inspector
include ::ironic::glance
include ::ironic::neutron
diff --git a/manifests/profile/base/novajoin.pp b/manifests/profile/base/novajoin.pp
new file mode 100644
index 0000000..f9c1ea9
--- /dev/null
+++ b/manifests/profile/base/novajoin.pp
@@ -0,0 +1,83 @@
+# Copyright 2017 Red Hat, Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License. You may obtain
+# a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations
+# under the License.
+#
+# == Class: tripleo::profile::base::novajoin
+#
+# novajoin vendordata plugin profile for tripleo
+#
+# === Parameters
+#
+# [*service_password*]
+# The password for the novajoin service.
+#
+# [*enable_ipa_client_install*]
+# Enable FreeIPA client installation for the node this runs on.
+# Defaults to false
+#
+# [*oslomsg_rpc_hosts*]
+# list of the oslo messaging rpc host fqdns
+# Defaults to hiera('rabbitmq_node_names')
+#
+# [*oslomsg_rpc_proto*]
+# Protocol driver for the oslo messaging rpc service
+# Defaults to hiera('messaging_rpc_service_name', rabbit)
+#
+# [*oslomsg_rpc_password*]
+# Password for oslo messaging rpc service
+# Defaults to undef
+#
+# [*oslomsg_rpc_port*]
+# IP port for oslo messaging rpc service
+# Defaults to '5672'
+#
+# [*oslomsg_rpc_username*]
+# Username for oslo messaging rpc service
+# Defaults to 'guest'
+#
+# [*oslomsg_use_ssl*]
+# Enable ssl oslo messaging services
+# Defaults to '0'
+#
+# [*step*]
+# (Optional) The current step of the deployment
+# Defaults to hiera('step')
+#
+
+class tripleo::profile::base::novajoin (
+ $service_password,
+ $enable_ipa_client_install = false,
+ $oslomsg_rpc_hosts = any2array(hiera('rabbitmq_node_names', undef)),
+ $oslomsg_rpc_proto = hiera('messaging_rpc_service_name', 'rabbit'),
+ $oslomsg_rpc_password = undef,
+ $oslomsg_rpc_port = '5672',
+ $oslomsg_rpc_username = 'guest',
+ $oslomsg_use_ssl = '0',
+ $step = hiera('step'),
+) {
+ if $step >= 3 {
+ $oslomsg_use_ssl_real = sprintf('%s', bool2num(str2bool($oslomsg_use_ssl)))
+ class { '::nova::metadata::novajoin::api' :
+ service_password => $service_password,
+ enable_ipa_client_install => $enable_ipa_client_install,
+ transport_url => os_transport_url({
+ 'transport' => $oslomsg_rpc_proto,
+ 'hosts' => $oslomsg_rpc_hosts,
+ 'port' => sprintf('%s', $oslomsg_rpc_port),
+ 'username' => $oslomsg_rpc_username,
+ 'password' => $oslomsg_rpc_password,
+ 'ssl' => $oslomsg_use_ssl_real,
+ }),
+ }
+ }
+}
diff --git a/manifests/profile/base/swift/ringbuilder.pp b/manifests/profile/base/swift/ringbuilder.pp
index f7cfea4..f6f8f06 100644
--- a/manifests/profile/base/swift/ringbuilder.pp
+++ b/manifests/profile/base/swift/ringbuilder.pp
@@ -130,8 +130,8 @@ class tripleo::profile::base::swift::ringbuilder (
}
Ring_object_device<| |> ~> Exec['rebalance_object']
- Ring_object_device<| |> ~> Exec['rebalance_account']
- Ring_object_device<| |> ~> Exec['rebalance_container']
+ Ring_account_device<| |> ~> Exec['rebalance_account']
+ Ring_container_device<| |> ~> Exec['rebalance_container']
}
}
diff --git a/manifests/profile/pacemaker/cinder/backup_bundle.pp b/manifests/profile/pacemaker/cinder/backup_bundle.pp
new file mode 100644
index 0000000..cd06986
--- /dev/null
+++ b/manifests/profile/pacemaker/cinder/backup_bundle.pp
@@ -0,0 +1,146 @@
+# Copyright 2017 Red Hat, Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License. You may obtain
+# a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations
+# under the License.
+#
+# == Class: tripleo::profile::pacemaker::cinder::backup_bundle
+#
+# Containerized Redis Pacemaker HA profile for tripleo
+#
+# === Parameters
+#
+# [*cinder_backup_docker_image*]
+# (Optional) The docker image to use for creating the pacemaker bundle
+# Defaults to hiera('tripleo::profile::pacemaker::cinder::backup_bundle::cinder_docker_image', undef)
+#
+# [*pcs_tries*]
+# (Optional) The number of times pcs commands should be retried.
+# Defaults to hiera('pcs_tries', 20)
+#
+# [*bootstrap_node*]
+# (Optional) The hostname of the node responsible for bootstrapping tasks
+# Defaults to hiera('redis_short_bootstrap_node_name')
+#
+# [*step*]
+# (Optional) The current step in deployment. See tripleo-heat-templates
+# for more details.
+# Defaults to hiera('step')
+#
+#
+class tripleo::profile::pacemaker::cinder::backup_bundle (
+ $bootstrap_node = hiera('cinder_backup_short_bootstrap_node_name'),
+ $cinder_backup_docker_image = hiera('tripleo::profile::pacemaker::cinder::backup_bundle::cinder_backup_docker_image', undef),
+ $pcs_tries = hiera('pcs_tries', 20),
+ $step = hiera('step'),
+) {
+ if $::hostname == downcase($bootstrap_node) {
+ $pacemaker_master = true
+ } else {
+ $pacemaker_master = false
+ }
+
+ include ::tripleo::profile::base::cinder::backup
+
+ if $step >= 2 and $pacemaker_master {
+ $cinder_backup_short_node_names = hiera('cinder_backup_short_node_names')
+ $cinder_backup_short_node_names.each |String $node_name| {
+ pacemaker::property { "cinder-backup-role-${node_name}":
+ property => 'cinder-backup-role',
+ value => true,
+ tries => $pcs_tries,
+ node => $node_name,
+ before => Pacemaker::Resource::Bundle[$::cinder::params::backup_service],
+ }
+ }
+ }
+
+ if $step >= 5 {
+ if $pacemaker_master {
+ $cinder_backup_nodes_count = count(hiera('cinder_backup_short_node_names', []))
+
+ pacemaker::resource::bundle { $::cinder::params::backup_service :
+ image => $cinder_backup_docker_image,
+ replicas => 1,
+ location_rule => {
+ resource_discovery => 'exclusive',
+ score => 0,
+ expression => ['cinder-backup-role eq true'],
+ },
+ container_options => 'network=host',
+ options => '--ipc=host --privileged=true --user=root --log-driver=journald -e KOLLA_CONFIG_STRATEGY=COPY_ALWAYS',
+ run_command => '/bin/bash /usr/local/bin/kolla_start',
+ storage_maps => {
+ 'cinder-backup-cfg-files' => {
+ 'source-dir' => '/var/lib/kolla/config_files/cinder_backup.json',
+ 'target-dir' => '/var/lib/kolla/config_files/config.json',
+ 'options' => 'ro',
+ },
+ 'cinder-backup-cfg-data' => {
+ 'source-dir' => '/var/lib/config-data/cinder/etc/cinder',
+ 'target-dir' => '/etc/cinder',
+ 'options' => 'ro',
+ },
+ 'cinder-backup-cfg-ceph' => {
+ 'source-dir' => '/var/lib/config-data/cinder/etc/ceph',
+ 'target-dir' => '/etc/ceph',
+ 'options' => 'ro',
+ },
+ 'cinder-backup-hosts' => {
+ 'source-dir' => '/etc/hosts',
+ 'target-dir' => '/etc/hosts',
+ 'options' => 'ro',
+ },
+ 'cinder-backup-localtime' => {
+ 'source-dir' => '/etc/localtime',
+ 'target-dir' => '/etc/localtime',
+ 'options' => 'ro',
+ },
+ 'cinder-backup-dev' => {
+ 'source-dir' => '/dev',
+ 'target-dir' => '/dev',
+ 'options' => 'rw',
+ },
+ 'cinder-backup-run' => {
+ 'source-dir' => '/run',
+ 'target-dir' => '/run',
+ 'options' => 'rw',
+ },
+ 'cinder-backup-sys' => {
+ 'source-dir' => '/sys',
+ 'target-dir' => '/sys',
+ 'options' => 'rw',
+ },
+ 'cinder-backup-lib-modules' => {
+ 'source-dir' => '/lib/modules',
+ 'target-dir' => '/lib/modules',
+ 'options' => 'ro',
+ },
+ 'cinder-backup-iscsi' => {
+ 'source-dir' => '/etc/iscsi',
+ 'target-dir' => '/etc/iscsi',
+ 'options' => 'rw',
+ },
+ 'cinder-backup-var-lib-cinder' => {
+ 'source-dir' => '/var/lib/cinder',
+ 'target-dir' => '/var/lib/cinder',
+ 'options' => 'rw',
+ },
+ 'cinder-backup-var-log' => {
+ 'source-dir' => '/var/log/containers/cinder',
+ 'target-dir' => '/var/log/cinder',
+ 'options' => 'rw',
+ },
+ },
+ }
+ }
+ }
+}
diff --git a/manifests/profile/pacemaker/cinder/volume_bundle.pp b/manifests/profile/pacemaker/cinder/volume_bundle.pp
new file mode 100644
index 0000000..f0858c9
--- /dev/null
+++ b/manifests/profile/pacemaker/cinder/volume_bundle.pp
@@ -0,0 +1,141 @@
+# Copyright 2017 Red Hat, Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License. You may obtain
+# a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations
+# under the License.
+#
+# == Class: tripleo::profile::pacemaker::cinder::volume_bundle
+#
+# Containerized Redis Pacemaker HA profile for tripleo
+#
+# === Parameters
+#
+# [*cinder_volume_docker_image*]
+# (Optional) The docker image to use for creating the pacemaker bundle
+# Defaults to hiera('tripleo::profile::pacemaker::cinder::volume_bundle::cinder_docker_image', undef)
+#
+# [*pcs_tries*]
+# (Optional) The number of times pcs commands should be retried.
+# Defaults to hiera('pcs_tries', 20)
+#
+# [*bootstrap_node*]
+# (Optional) The hostname of the node responsible for bootstrapping tasks
+# Defaults to hiera('redis_short_bootstrap_node_name')
+#
+# [*step*]
+# (Optional) The current step in deployment. See tripleo-heat-templates
+# for more details.
+# Defaults to hiera('step')
+#
+#
+class tripleo::profile::pacemaker::cinder::volume_bundle (
+ $bootstrap_node = hiera('cinder_volume_short_bootstrap_node_name'),
+ $cinder_volume_docker_image = hiera('tripleo::profile::pacemaker::cinder::volume_bundle::cinder_volume_docker_image', undef),
+ $pcs_tries = hiera('pcs_tries', 20),
+ $step = hiera('step'),
+) {
+ if $::hostname == downcase($bootstrap_node) {
+ $pacemaker_master = true
+ } else {
+ $pacemaker_master = false
+ }
+
+ include ::tripleo::profile::base::cinder::volume
+
+ if $step >= 2 and $pacemaker_master {
+ $cinder_volume_short_node_names = hiera('cinder_volume_short_node_names')
+ $cinder_volume_short_node_names.each |String $node_name| {
+ pacemaker::property { "cinder-volume-role-${node_name}":
+ property => 'cinder-volume-role',
+ value => true,
+ tries => $pcs_tries,
+ node => $node_name,
+ before => Pacemaker::Resource::Bundle[$::cinder::params::volume_service],
+ }
+ }
+ }
+
+ if $step >= 5 {
+ if $pacemaker_master {
+ $cinder_volume_nodes_count = count(hiera('cinder_volume_short_node_names', []))
+
+ pacemaker::resource::bundle { $::cinder::params::volume_service:
+ image => $cinder_volume_docker_image,
+ replicas => 1,
+ location_rule => {
+ resource_discovery => 'exclusive',
+ score => 0,
+ expression => ['cinder-volume-role eq true'],
+ },
+ container_options => 'network=host',
+ options => '--ipc=host --privileged=true --user=root --log-driver=journald -e KOLLA_CONFIG_STRATEGY=COPY_ALWAYS',
+ run_command => '/bin/bash /usr/local/bin/kolla_start',
+ storage_maps => {
+ 'cinder-volume-cfg-files' => {
+ 'source-dir' => '/var/lib/kolla/config_files/cinder_volume.json',
+ 'target-dir' => '/var/lib/kolla/config_files/config.json',
+ 'options' => 'ro',
+ },
+ 'cinder-volume-cfg-data' => {
+ 'source-dir' => '/var/lib/config-data/cinder/etc/cinder',
+ 'target-dir' => '/etc/cinder',
+ 'options' => 'ro',
+ },
+ 'cinder-volume-hosts' => {
+ 'source-dir' => '/etc/hosts',
+ 'target-dir' => '/etc/hosts',
+ 'options' => 'ro',
+ },
+ 'cinder-volume-localtime' => {
+ 'source-dir' => '/etc/localtime',
+ 'target-dir' => '/etc/localtime',
+ 'options' => 'ro',
+ },
+ 'cinder-volume-dev' => {
+ 'source-dir' => '/dev',
+ 'target-dir' => '/dev',
+ 'options' => 'rw',
+ },
+ 'cinder-volume-run' => {
+ 'source-dir' => '/run',
+ 'target-dir' => '/run',
+ 'options' => 'rw',
+ },
+ 'cinder-volume-sys' => {
+ 'source-dir' => '/sys',
+ 'target-dir' => '/sys',
+ 'options' => 'rw',
+ },
+ 'cinder-volume-lib-modules' => {
+ 'source-dir' => '/lib/modules',
+ 'target-dir' => '/lib/modules',
+ 'options' => 'ro',
+ },
+ 'cinder-volume-iscsi' => {
+ 'source-dir' => '/etc/iscsi',
+ 'target-dir' => '/etc/iscsi',
+ 'options' => 'rw',
+ },
+ 'cinder-volume-var-lib-cinder' => {
+ 'source-dir' => '/var/lib/cinder',
+ 'target-dir' => '/var/lib/cinder',
+ 'options' => 'rw',
+ },
+ 'cinder-volume-var-log' => {
+ 'source-dir' => '/var/log/containers/cinder',
+ 'target-dir' => '/var/log/cinder',
+ 'options' => 'rw',
+ },
+ },
+ }
+ }
+ }
+}
diff --git a/manifests/profile/pacemaker/database/mysql.pp b/manifests/profile/pacemaker/database/mysql.pp
index 031e80c..d42d557 100644
--- a/manifests/profile/pacemaker/database/mysql.pp
+++ b/manifests/profile/pacemaker/database/mysql.pp
@@ -53,20 +53,22 @@ class tripleo::profile::pacemaker::database::mysql (
$pacemaker_master = false
}
- # use only mysql_node_names when we land a patch in t-h-t that
- # switches to autogenerating these values from composable services
- # The galera node names need to match the pacemaker node names... so if we
- # want to use FQDNs for this, the cluster will not finish bootstrapping,
- # since all the nodes will be marked as slaves. For now, we'll stick to the
- # short name which is already registered in pacemaker until we get around
- # this issue.
- $galera_node_names_lookup = hiera('mysql_short_node_names', hiera('mysql_node_names', $::hostname))
+ $galera_node_names_lookup = hiera('mysql_short_node_names', $::hostname)
+ $galera_fqdns_names_lookup = hiera('mysql_node_names', $::hostname)
+
if is_array($galera_node_names_lookup) {
- $galera_nodes = downcase(join($galera_node_names_lookup, ','))
+ $galera_nodes_count = length($galera_node_names_lookup)
+ $galera_nodes = downcase(join($galera_fqdns_names_lookup, ','))
+ $galera_name_pairs = zip($galera_node_names_lookup, $galera_fqdns_names_lookup)
} else {
+ $galera_nodes_count = 1
$galera_nodes = downcase($galera_node_names_lookup)
+ $galera_name_pairs = [[$galera_node_names_lookup, $galera_fqdns_names_lookup]]
}
- $galera_nodes_count = count(split($galera_nodes, ','))
+
+ # NOTE(jaosorior): The usage of cluster_host_map requires resource-agents-3.9.5-82.el7_3.11
+ $processed_galera_name_pairs = $galera_name_pairs.map |$pair| { join($pair, ':') }
+ $cluster_host_map = join($processed_galera_name_pairs, ';')
$mysqld_options = {
'mysqld' => {
@@ -100,6 +102,15 @@ class tripleo::profile::pacemaker::database::mysql (
}
}
+ # since we are configuring rsync for wsrep_sst_method, we ought to make sure
+ # it's installed. We only includ this at step 2 since puppet-rsync may be
+ # included later and also adds the package resource.
+ if $step == 2 {
+ if ! defined(Package['rsync']) {
+ package {'rsync':}
+ }
+ }
+
# remove_default_accounts parameter will execute some mysql commands
# to remove the default accounts created by MySQL package.
# We need MySQL running to run the commands successfully, so better to
@@ -136,7 +147,7 @@ class tripleo::profile::pacemaker::database::mysql (
op_params => 'promote timeout=300s on-fail=block',
master_params => '',
meta_params => "master-max=${galera_nodes_count} ordered=true",
- resource_params => "additional_parameters='--open-files-limit=16384' enable_creation=true wsrep_cluster_address='gcomm://${galera_nodes}'",
+ resource_params => "additional_parameters='--open-files-limit=16384' enable_creation=true wsrep_cluster_address='gcomm://${galera_nodes}' cluster_host_map='${cluster_host_map}'",
tries => $pcs_tries,
location_rule => {
resource_discovery => 'exclusive',
diff --git a/manifests/profile/pacemaker/database/mysql_bundle.pp b/manifests/profile/pacemaker/database/mysql_bundle.pp
index 451d7f7..a127a5c 100644
--- a/manifests/profile/pacemaker/database/mysql_bundle.pp
+++ b/manifests/profile/pacemaker/database/mysql_bundle.pp
@@ -199,6 +199,11 @@ MYSQL_HOST=localhost\n",
image => $mysql_docker_image,
replicas => $galera_nodes_count,
masters => $galera_nodes_count,
+ location_rule => {
+ resource_discovery => 'exclusive',
+ score => 0,
+ expression => ['galera-role eq true'],
+ },
container_options => 'network=host',
options => '--user=root --log-driver=journald -e KOLLA_CONFIG_STRATEGY=COPY_ALWAYS',
run_command => '/bin/bash /usr/local/bin/kolla_start',
diff --git a/manifests/profile/pacemaker/database/redis_bundle.pp b/manifests/profile/pacemaker/database/redis_bundle.pp
index 167e54a..8e30c2f 100644
--- a/manifests/profile/pacemaker/database/redis_bundle.pp
+++ b/manifests/profile/pacemaker/database/redis_bundle.pp
@@ -73,6 +73,11 @@ class tripleo::profile::pacemaker::database::redis_bundle (
image => $redis_docker_image,
replicas => $redis_nodes_count,
masters => 1,
+ location_rule => {
+ resource_discovery => 'exclusive',
+ score => 0,
+ expression => ['redis-role eq true'],
+ },
container_options => 'network=host',
options => '--user=root --log-driver=journald -e KOLLA_CONFIG_STRATEGY=COPY_ALWAYS',
run_command => '/bin/bash /usr/local/bin/kolla_start',
diff --git a/manifests/profile/pacemaker/haproxy_bundle.pp b/manifests/profile/pacemaker/haproxy_bundle.pp
index 3e7b7dd..292c9dd 100644
--- a/manifests/profile/pacemaker/haproxy_bundle.pp
+++ b/manifests/profile/pacemaker/haproxy_bundle.pp
@@ -87,6 +87,7 @@ class tripleo::profile::pacemaker::haproxy_bundle (
pacemaker::resource::bundle { 'haproxy-bundle':
image => $haproxy_docker_image,
replicas => $haproxy_nodes_count,
+ location_rule => $haproxy_location_rule,
container_options => 'network=host',
options => '--user=root --log-driver=journald -e KOLLA_CONFIG_STRATEGY=COPY_ALWAYS',
run_command => '/bin/bash /usr/local/bin/kolla_start',
diff --git a/manifests/profile/pacemaker/rabbitmq_bundle.pp b/manifests/profile/pacemaker/rabbitmq_bundle.pp
index b05b0b1..f6c5044 100644
--- a/manifests/profile/pacemaker/rabbitmq_bundle.pp
+++ b/manifests/profile/pacemaker/rabbitmq_bundle.pp
@@ -105,6 +105,11 @@ class tripleo::profile::pacemaker::rabbitmq_bundle (
pacemaker::resource::bundle { 'rabbitmq-bundle':
image => $rabbitmq_docker_image,
replicas => $rabbitmq_nodes_count,
+ location_rule => {
+ resource_discovery => 'exclusive',
+ score => 0,
+ expression => ['rabbitmq-role eq true'],
+ },
container_options => 'network=host',
options => '--user=root --log-driver=journald -e KOLLA_CONFIG_STRATEGY=COPY_ALWAYS',
run_command => '/bin/bash /usr/local/bin/kolla_start',
diff --git a/manifests/ui.pp b/manifests/ui.pp
index 1745535..825ffc2 100644
--- a/manifests/ui.pp
+++ b/manifests/ui.pp
@@ -65,10 +65,18 @@
# The ironic proxy endpoint url
# Defaults to undef
#
+# [*endpoint_proxy_ironic_inspector*]
+# The ironic inspector proxy endpoint url
+# Defaults to undef
+#
# [*endpoint_config_ironic*]
# The ironic config endpoint url
# Defaults to undef
#
+# [*endpoint_config_ironic_inspector*]
+# The ironic inspector config endpoint url
+# Defaults to undef
+#
# [*endpoint_proxy_mistral*]
# The mistral proxy endpoint url
# Defaults to undef
@@ -112,18 +120,20 @@ class tripleo::ui (
'ko-KR' => 'Korean',
'zh-CN' => 'Simplified Chinese'
},
- $endpoint_proxy_zaqar = undef,
- $endpoint_proxy_keystone = undef,
- $endpoint_proxy_heat = undef,
- $endpoint_proxy_ironic = undef,
- $endpoint_proxy_mistral = undef,
- $endpoint_proxy_swift = undef,
- $endpoint_config_zaqar = undef,
- $endpoint_config_keystone = undef,
- $endpoint_config_heat = undef,
- $endpoint_config_ironic = undef,
- $endpoint_config_mistral = undef,
- $endpoint_config_swift = undef,
+ $endpoint_proxy_zaqar = undef,
+ $endpoint_proxy_keystone = undef,
+ $endpoint_proxy_heat = undef,
+ $endpoint_proxy_ironic = undef,
+ $endpoint_proxy_ironic_inspector = undef,
+ $endpoint_proxy_mistral = undef,
+ $endpoint_proxy_swift = undef,
+ $endpoint_config_zaqar = undef,
+ $endpoint_config_keystone = undef,
+ $endpoint_config_heat = undef,
+ $endpoint_config_ironic = undef,
+ $endpoint_config_ironic_inspector = undef,
+ $endpoint_config_mistral = undef,
+ $endpoint_config_swift = undef,
) {
@@ -160,6 +170,11 @@ class tripleo::ui (
'reverse_urls' => $endpoint_proxy_ironic
},
{
+ 'path' => '/ironic-inspector',
+ 'url' => $endpoint_proxy_ironic_inspector,
+ 'reverse_urls' => $endpoint_proxy_ironic_inspector
+ },
+ {
'path' => '/mistral',
'url' => $endpoint_proxy_mistral,
'reverse_urls' => $endpoint_proxy_mistral
diff --git a/releasenotes/notes/Add-CRL-resource-d2263462d40f01c0.yaml b/releasenotes/notes/Add-CRL-resource-d2263462d40f01c0.yaml
new file mode 100644
index 0000000..7826b87
--- /dev/null
+++ b/releasenotes/notes/Add-CRL-resource-d2263462d40f01c0.yaml
@@ -0,0 +1,4 @@
+---
+features:
+ - The resource ::tripleo::certmonger::ca::crl was added. The purpose of this
+ resource is to fetch a CRL file and set up a cron job to refresh that file.
diff --git a/releasenotes/notes/HAProxy-CRL-d05b555f92ff55ed.yaml b/releasenotes/notes/HAProxy-CRL-d05b555f92ff55ed.yaml
new file mode 100644
index 0000000..cdfb859
--- /dev/null
+++ b/releasenotes/notes/HAProxy-CRL-d05b555f92ff55ed.yaml
@@ -0,0 +1,6 @@
+---
+security:
+ - If the crl_file parameter is given to the ::tripleo::haproxy resource and
+ TLS is enabled in the internal network, it will configure the CRL file for
+ all the nodes it's proxying and thus properly handle revocation of the
+ server certificates.
diff --git a/releasenotes/notes/add-support-for-proxying-ironic-inspector-via-apache-ea70e9fa1ad04553.yaml b/releasenotes/notes/add-support-for-proxying-ironic-inspector-via-apache-ea70e9fa1ad04553.yaml
new file mode 100644
index 0000000..940c20e
--- /dev/null
+++ b/releasenotes/notes/add-support-for-proxying-ironic-inspector-via-apache-ea70e9fa1ad04553.yaml
@@ -0,0 +1,6 @@
+---
+features:
+ - |
+ Added variables for endpoint_proxy_ironic_inspector,
+ endpoint_config_ironic_inspector, and Apache mod_proxy configuration to
+ proxy ironic-inspector service just like similar services
diff --git a/releasenotes/notes/galera-install-rsync-b2f2504f12cc0cfd.yaml b/releasenotes/notes/galera-install-rsync-b2f2504f12cc0cfd.yaml
new file mode 100644
index 0000000..4b2fe0d
--- /dev/null
+++ b/releasenotes/notes/galera-install-rsync-b2f2504f12cc0cfd.yaml
@@ -0,0 +1,6 @@
+---
+fixes:
+ - The mysql pacemaker profile now makes sure that the
+ rsync package is installed since it configures
+ wsrep_sst_method for galera to use rsync. See
+ https://bugs.launchpad.net/tripleo/+bug/1693003
diff --git a/spec/classes/tripleo_certmonger_ca_crl_spec.rb b/spec/classes/tripleo_certmonger_ca_crl_spec.rb
new file mode 100644
index 0000000..1e605ce
--- /dev/null
+++ b/spec/classes/tripleo_certmonger_ca_crl_spec.rb
@@ -0,0 +1,104 @@
+#
+# Copyright (C) 2017 Red Hat Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License. You may obtain
+# a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations
+# under the License.
+#
+# Unit tests for tripleo
+#
+
+require 'spec_helper'
+
+describe 'tripleo::certmonger::ca::crl' do
+
+ shared_examples_for 'tripleo::certmonger::ca::crl' do
+
+ context 'with default parameters (no crl_source)' do
+ it 'should ensure no CRL nor cron job are present' do
+ is_expected.to contain_file('tripleo-ca-crl').with(
+ :ensure => 'absent'
+ )
+ is_expected.to contain_cron('tripleo-refresh-crl-file').with(
+ :ensure => 'absent'
+ )
+ end
+ end
+
+ context 'with defined CRL source' do
+ let :params do
+ {
+ :crl_dest => '/etc/pki/CA/crl/overcloud-crl.pem',
+ :crl_preprocessed => '/etc/pki/CA/crl/overcloud-crl.bin',
+ :crl_source => 'file://tmp/some/crl.bin',
+ }
+ end
+
+ let :process_cmd do
+ "openssl crl -in #{params[:crl_preprocessed]} -inform DER -outform PEM -out #{params[:crl_dest]}"
+ end
+
+ let :cron_cmd do
+ "curl -L -o #{params[:crl_preprocessed]} #{params[:crl_source]} && #{process_cmd}"
+ end
+
+ it 'should create and process CRL file' do
+ is_expected.to contain_file('tripleo-ca-crl').with(
+ :ensure => 'present',
+ :source => params[:crl_source]
+ )
+ is_expected.to contain_exec('tripleo-ca-crl-process-command').with(
+ :command => process_cmd
+ )
+ is_expected.to contain_cron('tripleo-refresh-crl-file').with(
+ :ensure => 'present',
+ :command => cron_cmd
+ )
+ end
+ end
+
+ context 'with defined CRL source and no processing' do
+ let :params do
+ {
+ :crl_dest => '/etc/pki/CA/crl/overcloud-crl.pem',
+ :crl_source => 'file://tmp/some/crl.pem',
+ :process => false
+ }
+ end
+
+ let :cron_cmd do
+ "curl -L -o #{params[:crl_dest]} #{params[:crl_source]}"
+ end
+
+ it 'should create and process CRL file' do
+ is_expected.to contain_file('tripleo-ca-crl').with(
+ :ensure => 'present',
+ :source => params[:crl_source]
+ )
+ is_expected.to_not contain_exec('tripleo-ca-crl-process-command')
+ is_expected.to contain_cron('tripleo-refresh-crl-file').with(
+ :ensure => 'present',
+ :command => cron_cmd
+ )
+ end
+ end
+ end
+
+ on_supported_os.each do |os, facts|
+ context "on #{os}" do
+ let(:facts) do
+ facts.merge({})
+ end
+
+ it_behaves_like 'tripleo::certmonger::ca::crl'
+ end
+ end
+end
diff --git a/spec/classes/tripleo_certmonger_ca_local.rb b/spec/classes/tripleo_certmonger_ca_local_spec.rb
index 7ee9383..7ee9383 100644
--- a/spec/classes/tripleo_certmonger_ca_local.rb
+++ b/spec/classes/tripleo_certmonger_ca_local_spec.rb
diff --git a/spec/classes/tripleo_certmonger_etcd.rb b/spec/classes/tripleo_certmonger_etcd_spec.rb
index fc0aad3..fc0aad3 100644
--- a/spec/classes/tripleo_certmonger_etcd.rb
+++ b/spec/classes/tripleo_certmonger_etcd_spec.rb
diff --git a/spec/classes/tripleo_certmonger_mysql.rb b/spec/classes/tripleo_certmonger_mysql_spec.rb
index 23b1e4f..23b1e4f 100644
--- a/spec/classes/tripleo_certmonger_mysql.rb
+++ b/spec/classes/tripleo_certmonger_mysql_spec.rb
diff --git a/spec/classes/tripleo_certmonger_rabbitmq.rb b/spec/classes/tripleo_certmonger_rabbitmq_spec.rb
index 5c011ce..5c011ce 100644
--- a/spec/classes/tripleo_certmonger_rabbitmq.rb
+++ b/spec/classes/tripleo_certmonger_rabbitmq_spec.rb
diff --git a/spec/classes/tripleo_profile_base_docker_spec.rb b/spec/classes/tripleo_profile_base_docker_spec.rb
index 0b988f6..bb21055 100644
--- a/spec/classes/tripleo_profile_base_docker_spec.rb
+++ b/spec/classes/tripleo_profile_base_docker_spec.rb
@@ -124,6 +124,85 @@ describe 'tripleo::profile::base::docker' do
}
end
+ context 'with step 4 and configure_libvirt_polkit disabled' do
+ let(:params) { {
+ :step => 4,
+ :configure_libvirt_polkit => false
+ } }
+ it {
+ is_expected.to_not contain_group('docker_nova_group')
+ is_expected.to_not contain_user('docker_nova_user')
+ is_expected.to_not contain_package('polkit')
+ is_expected.to_not contain_file('/etc/polkit-1/rules.d/50-nova.rules')
+ }
+ end
+
+ context 'with step 4 and configure_libvirt_polkit enabled' do
+ let(:params) { {
+ :step => 4,
+ :configure_libvirt_polkit => true
+ } }
+ it {
+ is_expected.to contain_group('docker_nova_group').with(
+ :name => 'docker_nova',
+ :gid => 42436
+ )
+ is_expected.to contain_user('docker_nova_user').with(
+ :name => 'docker_nova',
+ :uid => 42436,
+ :gid => 42436,
+ :shell => '/sbin/nologin',
+ :groups => ['nobody']
+ )
+ is_expected.to contain_package('polkit')
+ is_expected.to contain_file('/etc/polkit-1/rules.d/50-nova.rules')
+ }
+ end
+
+ context 'with step 4 and nova_compute service installed' do
+ let(:params) { {
+ :step => 4,
+ :services_enabled => ['docker', 'nova_compute']
+ } }
+ it {
+ is_expected.to contain_group('docker_nova_group').with(
+ :name => 'docker_nova',
+ :gid => 42436
+ )
+ is_expected.to contain_user('docker_nova_user').with(
+ :name => 'docker_nova',
+ :uid => 42436,
+ :gid => 42436,
+ :shell => '/sbin/nologin',
+ :groups => ['nobody']
+ )
+ is_expected.to contain_package('polkit')
+ is_expected.to contain_file('/etc/polkit-1/rules.d/50-nova.rules')
+ }
+ end
+
+ context 'with step 4 and configure_libvirt_polkit enabled and docker_nova uid' do
+ let(:params) { {
+ :step => 4,
+ :configure_libvirt_polkit => true,
+ :docker_nova_uid => 12345
+ } }
+ it {
+ is_expected.to contain_group('docker_nova_group').with(
+ :name => 'docker_nova',
+ :gid => 12345
+ )
+ is_expected.to contain_user('docker_nova_user').with(
+ :name => 'docker_nova',
+ :uid => 12345,
+ :gid => 12345,
+ :shell => '/sbin/nologin',
+ :groups => ['nobody']
+ )
+ is_expected.to contain_package('polkit')
+ is_expected.to contain_file('/etc/polkit-1/rules.d/50-nova.rules')
+ }
+ end
end
on_supported_os.each do |os, facts|
diff --git a/spec/classes/tripleo_profile_base_novajoin_spec.rb b/spec/classes/tripleo_profile_base_novajoin_spec.rb
new file mode 100644
index 0000000..e157d4f
--- /dev/null
+++ b/spec/classes/tripleo_profile_base_novajoin_spec.rb
@@ -0,0 +1,126 @@
+#
+# Copyright (C) 2017 Red Hat, Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License. You may obtain
+# a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations
+# under the License.
+#
+
+require 'spec_helper'
+
+describe 'tripleo::profile::base::novajoin' do
+
+ let :pre_condition do
+ "include nova
+ class { '::nova::metadata::novajoin::authtoken':
+ password => 'passw0rd',
+ }"
+ end
+
+ let :params do
+ { :oslomsg_rpc_hosts => ['some.server.com'],
+ :oslomsg_rpc_password => 'somepassword',
+ :service_password => 'passw0rd',
+ :step => 5
+ }
+ end
+
+ shared_examples_for 'tripleo::profile::base::novajoin' do
+
+ context 'with step less than 3' do
+ before do
+ params.merge!({ :step => 2 })
+ end
+
+ it 'should not do anything' do
+ is_expected.to_not contain_class('nova::metadata::novajoin::api')
+ end
+ end
+
+ context 'with step 3' do
+ before do
+ params.merge!({ :step => 3 })
+ end
+
+ it 'should provide basic initialization' do
+ is_expected.to contain_class('nova::metadata::novajoin::api').with(
+ :transport_url => 'rabbit://guest:somepassword@some.server.com:5672/?ssl=0'
+ )
+ end
+ end
+
+ context 'with multiple hosts' do
+ before do
+ params.merge!({ :oslomsg_rpc_hosts => ['some.server.com', 'someother.server.com'] })
+ end
+
+ it 'should construct a multihost URL' do
+ is_expected.to contain_class('nova::metadata::novajoin::api').with(
+ :transport_url => 'rabbit://guest:somepassword@some.server.com:5672,guest:somepassword@someother.server.com:5672/?ssl=0'
+ )
+ end
+ end
+
+ context 'with username provided' do
+ before do
+ params.merge!({ :oslomsg_rpc_username => 'bunny' })
+ end
+
+ it 'should construct URL with username' do
+ is_expected.to contain_class('nova::metadata::novajoin::api').with(
+ :transport_url => 'rabbit://bunny:somepassword@some.server.com:5672/?ssl=0'
+ )
+ end
+ end
+
+ context 'with username and password provided' do
+ before do
+ params.merge!(
+ { :oslomsg_rpc_username => 'bunny',
+ :oslomsg_rpc_password => 'carrot'
+ }
+ )
+ end
+
+ it 'should construct URL with username and password' do
+ is_expected.to contain_class('nova::metadata::novajoin::api').with(
+ :transport_url => 'rabbit://bunny:carrot@some.server.com:5672/?ssl=0'
+ )
+ end
+ end
+
+ context 'with multiple hosts and user info provided' do
+ before do
+ params.merge!(
+ { :oslomsg_rpc_hosts => ['some.server.com', 'someother.server.com'],
+ :oslomsg_rpc_username => 'bunny',
+ :oslomsg_rpc_password => 'carrot'
+ }
+ )
+ end
+
+ it 'should distributed user info across hosts URL' do
+ is_expected.to contain_class('nova::metadata::novajoin::api').with(
+ :transport_url => 'rabbit://bunny:carrot@some.server.com:5672,bunny:carrot@someother.server.com:5672/?ssl=0'
+ )
+ end
+ end
+ end
+
+ on_supported_os.each do |os, facts|
+ context "on #{os}" do
+ let(:facts) do
+ facts.merge({})
+ end
+ it_behaves_like 'tripleo::profile::base::novajoin'
+ end
+ end
+end
diff --git a/spec/classes/tripleo_profile_base_swift_ringbuilder.rb b/spec/classes/tripleo_profile_base_swift_ringbuilder_spec.rb
index 0139815..0139815 100644
--- a/spec/classes/tripleo_profile_base_swift_ringbuilder.rb
+++ b/spec/classes/tripleo_profile_base_swift_ringbuilder_spec.rb
diff --git a/spec/classes/tripleo_certmonger_httpd.rb b/spec/defines/tripleo_certmonger_httpd_spec.rb
index da5ce94..f01e594 100644
--- a/spec/classes/tripleo_certmonger_httpd.rb
+++ b/spec/defines/tripleo_certmonger_httpd_spec.rb
@@ -20,6 +20,8 @@ require 'spec_helper'
describe 'tripleo::certmonger::httpd' do
+ let(:title) { 'httpd-cert' }
+
shared_examples_for 'tripleo::certmonger::httpd' do
let :params do
{
diff --git a/templates/ui/tripleo_ui_config.js.erb b/templates/ui/tripleo_ui_config.js.erb
index f179637..cd02798 100644
--- a/templates/ui/tripleo_ui_config.js.erb
+++ b/templates/ui/tripleo_ui_config.js.erb
@@ -7,6 +7,7 @@ window.tripleOUiConfig = {
'keystone': '<%= @endpoint_config_keystone %>',
'heat': '<%= @endpoint_config_heat %>',
'ironic': '<%= @endpoint_config_ironic %>',
+ 'ironic-inspector': '<%= @endpoint_config_ironic_inspector %>',
'mistral': '<%= @endpoint_config_mistral %>',
'swift': '<%= @endpoint_config_swift %>',
'zaqar-websocket': '<%= @endpoint_config_zaqar %>',
diff --git a/test-requirements.txt b/test-requirements.txt
index 1ea50a8..152ebef 100644
--- a/test-requirements.txt
+++ b/test-requirements.txt
@@ -1,7 +1,7 @@
# This is required for the docs build jobs
-sphinx>=1.5.1 # BSD
+sphinx!=1.6.1,>=1.5.1 # BSD
oslosphinx>=4.7.0 # Apache-2.0
# This is required for the releasenotes build jobs
# FIXME: reno is manually pinned to !=2.0.0 because of bug #1651995
-reno>=1.8.0,!=2.0.0 # Apache-2.0
+reno!=2.0.0,!=2.3.1,>=1.8.0 # Apache-2.0