diff options
223 files changed, 3037 insertions, 349 deletions
@@ -8,3 +8,12 @@ Team and repository tags # puppet-tripleo Lightweight composition layer for Puppet TripleO. + +## Contributing + +* Free software: Apache licence +* Source: http://git.openstack.org/cgit/openstack/puppet-tripleo +* Bugs: http://bugs.launchpad.net/tripleo (tag: puppet) +* Documentation: + * TripleO: http://docs.openstack.org/developer/tripleo-docs/index.html + * Testing with puppet: https://docs.openstack.org/developer/puppet-openstack-guide/testing.html diff --git a/lib/puppet/parser/functions/noop_resource.rb b/lib/puppet/parser/functions/noop_resource.rb index 921eb5d..02db633 100644 --- a/lib/puppet/parser/functions/noop_resource.rb +++ b/lib/puppet/parser/functions/noop_resource.rb @@ -46,7 +46,6 @@ module Puppet::Parser::Functions Puppet::Type.type(arg[0].downcase.to_sym).provide(:noop, :parent => Puppet::Provider::Noop) do defaultfor :osfamily => :redhat end - else end return true end diff --git a/manifests/certmonger/ca/crl.pp b/manifests/certmonger/ca/crl.pp new file mode 100644 index 0000000..59a3681 --- /dev/null +++ b/manifests/certmonger/ca/crl.pp @@ -0,0 +1,149 @@ +# Copyright 2017 Red Hat, Inc. +# +# Licensed under the Apache License, Version 2.0 (the "License"); you may +# not use this file except in compliance with the License. You may obtain +# a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT +# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the +# License for the specific language governing permissions and limitations +# under the License. +# +# == class: tripleo::certmonger::ca::crl +# +# Class that downloads the appropriate CRL file from the CA. This can +# furtherly be used by services in order for proper certificate revocation to +# come into effect. The class also sets up a cron job that will refresh the CRL +# once a week. Also, processing of the CRL file might be needed. e.g. most CAs +# use DER format to distribute the CRLs, while services such as HAProxy expect +# the CRL to be in PEM format. +# +# === Parameters +# +# [*crl_dest*] +# (Optional) The file where the CRL file will be stored. +# Defaults to '/etc/pki/CA/crl/overcloud-crl.pem' +# +# [*crl_source*] +# (Optional) The URI where the CRL file will be fetched from. +# Defaults to undef +# +# [*process*] +# (Optional) Whether the CRL needs processing before being used. This means +# transforming from DER to PEM format or viceversa. This is because most CRLs +# by default come in DER format, so most likely it needs to be transformed. +# Defaults to true +# +# [*crl_preprocessed*] +# (Optional) The pre-processed CRL file which will be transformed. +# Defaults to '/etc/pki/CA/crl/overcloud-crl.bin' +# +# [*crl_preprocessed_format*] +# (Optional) The pre-processed CRL file's format which will be transformed. +# Defaults to 'DER' +# +# [*minute*] +# (optional) Defaults to '0'. +# +# [*hour*] +# (optional) Defaults to '1'. +# +# [*monthday*] +# (optional) Defaults to '*'. +# +# [*month*] +# (optional) Defaults to '*'. +# +# [*weekday*] +# (optional) Defaults to '6'. +# +# [*maxdelay*] +# (optional) Seconds. Defaults to 0. Should be a positive integer. +# Induces a random delay before running the cronjob to avoid running all +# cron jobs at the same time on all hosts this job is configured. +# +# [*reload_cmds*] +# (Optional) list of commands to be executed after fetching the CRL list in +# the cron job. This will usually be a list of reload commands issued to +# services that use the CRL. +# Defaults to [] +# +class tripleo::certmonger::ca::crl ( + $crl_dest = '/etc/pki/CA/crl/overcloud-crl.pem', + $crl_source = undef, + $process = true, + $crl_preprocessed = '/etc/pki/CA/crl/overcloud-crl.bin', + $crl_preprocessed_format = 'DER', + $minute = '0', + $hour = '1', + $monthday = '*', + $month = '*', + $weekday = '6', + $maxdelay = 0, + $reload_cmds = [], +) { + if $crl_source { + $ensure = 'present' + } else { + $ensure = 'absent' + } + + if $maxdelay == 0 { + $sleep = '' + } else { + $sleep = "sleep `expr \${RANDOM} \\% ${maxdelay}`; " + } + + if $process { + $fetched_crl = $crl_preprocessed + } else { + $fetched_crl = $crl_dest + } + + file { 'tripleo-ca-crl' : + ensure => $ensure, + path => $fetched_crl, + source => $crl_source, + mode => '0644', + } + + if $process and $ensure == 'present' { + $crl_dest_format = $crl_preprocessed_format ? { + 'PEM' => 'DER', + 'DER' => 'PEM' + } + # transform CRL from DER to PEM or viceversa + $process_cmd = "openssl crl -in ${$crl_preprocessed} -inform ${crl_preprocessed_format} -outform ${crl_dest_format} -out ${crl_dest}" + exec { 'tripleo-ca-crl-process-command' : + command => $process_cmd, + path => '/usr/bin', + refreshonly => true, + subscribe => File['tripleo-ca-crl'] + } + } else { + $process_cmd = [] + } + + if $ensure == 'present' { + # Fetch CRL in cron job and notify needed services + $cmd_list = concat(["${sleep}curl -L -o ${fetched_crl} ${crl_source}"], $process_cmd, $reload_cmds) + $cron_cmd = join($cmd_list, ' && ') + } else { + $cron_cmd = absent + } + + cron { 'tripleo-refresh-crl-file': + ensure => $ensure, + command => $cron_cmd, + environment => 'PATH=/usr/bin SHELL=/bin/sh', + user => 'root', + minute => $minute, + hour => $hour, + monthday => $monthday, + month => $month, + weekday => $weekday, + } +} diff --git a/manifests/certmonger/mysql.pp b/manifests/certmonger/mysql.pp index dd9b184..0988c55 100644 --- a/manifests/certmonger/mysql.pp +++ b/manifests/certmonger/mysql.pp @@ -31,6 +31,12 @@ # (Optional) The CA that certmonger will use to generate the certificates. # Defaults to hiera('certmonger_ca', 'local'). # +# [*dnsnames*] +# (Optional) The DNS names that will be added for the SubjectAltNames entry +# in the certificate. If left unset, the value will be set to the $hostname. +# This parameter can take both a string or an array of strings. +# Defaults to $hostname +# # [*principal*] # (Optional) The haproxy service principal that is set for MySQL in kerberos. # Defaults to undef @@ -40,6 +46,7 @@ class tripleo::certmonger::mysql ( $service_certificate, $service_key, $certmonger_ca = hiera('certmonger_ca', 'local'), + $dnsnames = $hostname, $principal = undef, ) { include ::certmonger @@ -51,7 +58,7 @@ class tripleo::certmonger::mysql ( certfile => $service_certificate, keyfile => $service_key, hostname => $hostname, - dnsname => $hostname, + dnsname => $dnsnames, principal => $principal, postsave_cmd => $postsave_cmd, ca => $certmonger_ca, diff --git a/manifests/glance/nfs_mount.pp b/manifests/glance/nfs_mount.pp index 035191d..674bdd0 100644 --- a/manifests/glance/nfs_mount.pp +++ b/manifests/glance/nfs_mount.pp @@ -43,7 +43,7 @@ class tripleo::glance::nfs_mount ( $options = 'intr,context=system_u:object_r:glance_var_lib_t:s0', $edit_fstab = true, $fstab_fstype = 'nfs4', - $fstab_prepend_options = 'bg' + $fstab_prepend_options = '_netdev,bg' ) { $images_dir = '/var/lib/glance/images' diff --git a/manifests/haproxy.pp b/manifests/haproxy.pp index a449a49..2f29674 100644 --- a/manifests/haproxy.pp +++ b/manifests/haproxy.pp @@ -146,11 +146,19 @@ # the servers it balances # Defaults to '/etc/pki/ca-trust/extracted/openssl/ca-bundle.trust.crt' # +# [*crl_file*] +# Path to the CRL file to be used for checking revoked certificates. +# Defaults to undef +# # [*haproxy_stats_certificate*] # Filename of an HAProxy-compatible certificate and key file # When set, enables SSL on the haproxy stats endpoint using the specified file. # Defaults to undef # +# [*haproxy_stats*] +# (optional) Enable or not the haproxy stats interface +# Defaults to true +# # [*keystone_admin*] # (optional) Enable or not Keystone Admin API binding # Defaults to hiera('keystone_enabled', false) @@ -275,6 +283,10 @@ # (optional) Enable check via clustercheck for mysql # Defaults to false # +# [*mysql_max_conn*] +# (optional) Set the maxconn parameter for mysql +# Defaults to undef +# # [*mysql_member_options*] # The options to use for the mysql HAProxy balancer members. # If this parameter is undefined, the actual value configured will depend @@ -324,6 +336,11 @@ # (optional) Enable or not OVN northd binding # Defaults to hiera('ovn_dbs_enabled', false) # +# [*ovn_dbs_manage_lb*] +# (optional) Whether or not haproxy should configure OVN dbs for load balancing +# if ovn_dbs is enabled. +# Defaults to false +# # [*zaqar_ws*] # (optional) Enable or not Zaqar Websockets binding # Defaults to false @@ -513,7 +530,7 @@ # 'nova_novnc_port' (Defaults to 6080) # 'nova_novnc_ssl_port' (Defaults to 13080) # 'opendaylight_api_port' (Defaults to 8081) -# 'panko_api_port' (Defaults to 8779) +# 'panko_api_port' (Defaults to 8977) # 'panko_api_ssl_port' (Defaults to 13779) # 'ovn_nbdb_port' (Defaults to 6641) # 'ovn_sbdb_port' (Defaults to 6642) @@ -560,7 +577,9 @@ class tripleo::haproxy ( $ssl_cipher_suite = '!SSLv2:kEECDH:kRSA:kEDH:kPSK:+3DES:!aNULL:!eNULL:!MD5:!EXP:!RC4:!SEED:!IDEA:!DES', $ssl_options = 'no-sslv3', $ca_bundle = '/etc/pki/ca-trust/extracted/openssl/ca-bundle.trust.crt', + $crl_file = undef, $haproxy_stats_certificate = undef, + $haproxy_stats = true, $keystone_admin = hiera('keystone_enabled', false), $keystone_public = hiera('keystone_enabled', false), $neutron = hiera('neutron_api_enabled', false), @@ -592,6 +611,7 @@ class tripleo::haproxy ( $ironic_inspector = hiera('ironic_inspector_enabled', false), $mysql = hiera('mysql_enabled', false), $mysql_clustercheck = false, + $mysql_max_conn = undef, $mysql_member_options = undef, $rabbitmq = false, $etcd = hiera('etcd_enabled', false), @@ -603,6 +623,7 @@ class tripleo::haproxy ( $ceph_rgw = hiera('ceph_rgw_enabled', false), $opendaylight = hiera('opendaylight_api_enabled', false), $ovn_dbs = hiera('ovn_dbs_enabled', false), + $ovn_dbs_manage_lb = false, $zaqar_ws = hiera('zaqar_api_enabled', false), $ui = hiera('enable_ui', false), $aodh_network = hiera('aodh_api_network', undef), @@ -695,7 +716,7 @@ class tripleo::haproxy ( nova_novnc_port => 6080, nova_novnc_ssl_port => 13080, opendaylight_api_port => 8081, - panko_api_port => 8779, + panko_api_port => 8977, panko_api_ssl_port => 13779, ovn_nbdb_port => 6641, ovn_sbdb_port => 6642, @@ -722,7 +743,13 @@ class tripleo::haproxy ( $ports = merge($default_service_ports, $service_ports) if $enable_internal_tls { - $internal_tls_member_options = ['ssl', 'verify required', "ca-file ${ca_bundle}"] + $base_internal_tls_member_options = ['ssl', 'verify required', "ca-file ${ca_bundle}"] + + if $crl_file { + $internal_tls_member_options = concat($base_internal_tls_member_options, "crl-file ${crl_file}") + } else { + $internal_tls_member_options = $base_internal_tls_member_options + } Haproxy::Balancermember { verifyhost => true } @@ -763,7 +790,7 @@ class tripleo::haproxy ( 'cookie' => 'SERVERID insert indirect nocache', 'rsprep' => '^Location:\ http://(.*) Location:\ https://\1', # NOTE(jaosorior): We always redirect to https for the public_virtual_ip. - 'redirect' => "scheme https code 301 if { hdr(host) -i ${public_virtual_ip} } !{ ssl_fc }", + 'redirect' => 'scheme https code 301 if !{ ssl_fc }', 'option' => [ 'forwardfor', 'httpchk' ], 'http-request' => [ 'set-header X-Forwarded-Proto https if { ssl_fc }', @@ -854,19 +881,21 @@ class tripleo::haproxy ( listen_options => $default_listen_options, } - $stats_base = ['enable', 'uri /'] - if $haproxy_stats_password { - $stats_config = union($stats_base, ["auth ${haproxy_stats_user}:${haproxy_stats_password}"]) - } else { - $stats_config = $stats_base - } - haproxy::listen { 'haproxy.stats': - bind => $haproxy_stats_bind_opts, - mode => 'http', - options => { - 'stats' => $stats_config, - }, - collect_exported => false, + if $haproxy_stats { + $stats_base = ['enable', 'uri /'] + if $haproxy_stats_password { + $stats_config = union($stats_base, ["auth ${haproxy_stats_user}:${haproxy_stats_password}"]) + } else { + $stats_config = $stats_base + } + haproxy::listen { 'haproxy.stats': + bind => $haproxy_stats_bind_opts, + mode => 'http', + options => { + 'stats' => $stats_config, + }, + collect_exported => false, + } } if $keystone_admin { @@ -885,17 +914,8 @@ class tripleo::haproxy ( } if $keystone_public { - if $service_certificate { - $keystone_public_tls_listen_opts = { - 'rsprep' => '^Location:\ http://(.*) Location:\ https://\1', - # NOTE(jaosorior): We always redirect to https for the public_virtual_ip. - 'redirect' => "scheme https code 301 if { hdr(host) -i ${public_virtual_ip} } !{ ssl_fc }", - 'option' => 'forwardfor', - } - } else { - $keystone_public_tls_listen_opts = { - 'option' => [ 'httpchk GET /v3', ], - } + $keystone_listen_opts = { + 'option' => [ 'httpchk GET /v3', ], } ::tripleo::haproxy::endpoint { 'keystone_public': public_virtual_ip => $public_virtual_ip, @@ -904,7 +924,7 @@ class tripleo::haproxy ( ip_addresses => hiera('keystone_public_api_node_ips', $controller_hosts_real), server_names => hiera('keystone_public_api_node_names', $controller_hosts_names_real), mode => 'http', - listen_options => merge($default_listen_options, $keystone_public_tls_listen_opts), + listen_options => merge($default_listen_options, $keystone_listen_opts), public_ssl_port => $ports[keystone_public_api_ssl_port], service_network => $keystone_public_network, member_options => union($haproxy_member_options, $internal_tls_member_options), @@ -1306,6 +1326,7 @@ class tripleo::haproxy ( 'timeout server' => '90m', 'stick-table' => 'type ip size 1000', 'stick' => 'on dst', + 'maxconn' => $mysql_max_conn } if $mysql_member_options { $mysql_member_options_real = $mysql_member_options @@ -1316,6 +1337,7 @@ class tripleo::haproxy ( $mysql_listen_options = { 'timeout client' => '90m', 'timeout server' => '90m', + 'maxconn' => $mysql_max_conn } if $mysql_member_options { $mysql_member_options_real = $mysql_member_options @@ -1489,9 +1511,12 @@ class tripleo::haproxy ( } - if $ovn_dbs { + if $ovn_dbs and $ovn_dbs_manage_lb { # FIXME: is this config enough to ensure we only hit the first node in # ovn_northd_node_ips ? + # We only configure ovn_dbs_vip in haproxy if HA for OVN DB servers is + # disabled. + # If HA is enabled, pacemaker configures the OVN DB servers accordingly. $ovn_db_listen_options = { 'option' => [ 'tcpka' ], 'timeout client' => '90m', diff --git a/manifests/haproxy/endpoint.pp b/manifests/haproxy/endpoint.pp index 16e0bd1..f1e80e8 100644 --- a/manifests/haproxy/endpoint.pp +++ b/manifests/haproxy/endpoint.pp @@ -108,9 +108,20 @@ define tripleo::haproxy::endpoint ( # service exposed to the public network if $public_certificate { + if $mode == 'http' { + $tls_listen_options = { + 'rsprep' => '^Location:\ http://(.*) Location:\ https://\1', + 'redirect' => "scheme https code 301 if { hdr(host) -i ${public_virtual_ip} } !{ ssl_fc }", + 'option' => 'forwardfor', + } + $listen_options_real = merge($tls_listen_options, $listen_options) + } else { + $listen_options_real = $listen_options + } $public_bind_opts = list_to_hash(suffix(any2array($public_virtual_ip), ":${public_ssl_port}"), union($haproxy_listen_bind_param, ['ssl', 'crt', $public_certificate])) } else { + $listen_options_real = $listen_options $public_bind_opts = list_to_hash(suffix(any2array($public_virtual_ip), ":${service_port}"), $haproxy_listen_bind_param) } } else { @@ -138,7 +149,7 @@ define tripleo::haproxy::endpoint ( bind => $bind_opts, collect_exported => false, mode => $mode, - options => $listen_options, + options => $listen_options_real, } haproxy::balancermember { "${name}": listening_service => $name, diff --git a/manifests/network/contrail/analytics.pp b/manifests/network/contrail/analytics.pp index e34c7e6..296fa19 100644 --- a/manifests/network/contrail/analytics.pp +++ b/manifests/network/contrail/analytics.pp @@ -189,7 +189,7 @@ # Defaults to hiera('contrail::zk_server_ip') # class tripleo::network::contrail::analytics( - $step = hiera('step'), + $step = Integer(hiera('step')), $admin_password = hiera('contrail::admin_password'), $admin_tenant_name = hiera('contrail::admin_tenant_name'), $admin_token = hiera('contrail::admin_token'), diff --git a/manifests/network/contrail/analyticsdatabase.pp b/manifests/network/contrail/analyticsdatabase.pp index 88b0327..cf3016a 100644 --- a/manifests/network/contrail/analyticsdatabase.pp +++ b/manifests/network/contrail/analyticsdatabase.pp @@ -120,7 +120,7 @@ # Defaults to hiera('contrail_database_node_ips') # class tripleo::network::contrail::analyticsdatabase( - $step = hiera('step'), + $step = Integer(hiera('step')), $auth_host = hiera('contrail::auth_host'), $api_server = hiera('contrail_config_vip'), $api_port = hiera('contrail::api_port'), diff --git a/manifests/network/contrail/config.pp b/manifests/network/contrail/config.pp index d02ab44..3fc4fd8 100644 --- a/manifests/network/contrail/config.pp +++ b/manifests/network/contrail/config.pp @@ -216,7 +216,7 @@ # Defaults to hiera('contrail_database_node_ips') # class tripleo::network::contrail::config( - $step = hiera('step'), + $step = Integer(hiera('step')), $aaa_mode = hiera('contrail::aaa_mode'), $admin_password = hiera('contrail::admin_password'), $admin_tenant_name = hiera('contrail::admin_tenant_name'), diff --git a/manifests/network/contrail/control.pp b/manifests/network/contrail/control.pp index e9c7a9e..530d607 100644 --- a/manifests/network/contrail/control.pp +++ b/manifests/network/contrail/control.pp @@ -117,7 +117,7 @@ # Defaults to hiera('step') # class tripleo::network::contrail::control( - $step = hiera('step'), + $step = Integer(hiera('step')), $admin_password = hiera('contrail::admin_password'), $admin_tenant_name = hiera('contrail::admin_tenant_name'), $admin_user = hiera('contrail::admin_user'), diff --git a/manifests/network/contrail/database.pp b/manifests/network/contrail/database.pp index f74eb1c..3d6b40b 100644 --- a/manifests/network/contrail/database.pp +++ b/manifests/network/contrail/database.pp @@ -117,7 +117,7 @@ class tripleo::network::contrail::database( $host_ip = hiera('contrail::database::host_ip'), $host_name = $::hostname, $public_vip = hiera('public_virtual_ip'), - $step = hiera('step'), + $step = Integer(hiera('step')), $zookeeper_client_ip = hiera('contrail::database::host_ip'), $zookeeper_hostnames = hiera('contrail_database_short_node_names'), $zookeeper_server_ips = hiera('contrail_database_node_ips'), diff --git a/manifests/network/contrail/heat.pp b/manifests/network/contrail/heat.pp index 637fdda..4ef2a31 100644 --- a/manifests/network/contrail/heat.pp +++ b/manifests/network/contrail/heat.pp @@ -60,7 +60,7 @@ class tripleo::network::contrail::heat( $api_port = 8082, $api_server = hiera('contrail_config_vip'), $auth_host = hiera('contrail::auth_host'), - $step = hiera('step'), + $step = Integer(hiera('step')), $use_ssl = 'False', ) { diff --git a/manifests/network/contrail/provision.pp b/manifests/network/contrail/provision.pp index 3025737..742c4a2 100644 --- a/manifests/network/contrail/provision.pp +++ b/manifests/network/contrail/provision.pp @@ -71,7 +71,7 @@ class tripleo::network::contrail::provision( $auth_host = hiera('contrail::auth_host'), $auth_port = hiera('contrail::auth_port'), $auth_protocol = hiera('contrail::auth_protocol'), - $step = hiera('step'), + $step = Integer(hiera('step')), ) { if $step >= 5 { diff --git a/manifests/network/contrail/vrouter.pp b/manifests/network/contrail/vrouter.pp index 2bccd1d..678a77d 100644 --- a/manifests/network/contrail/vrouter.pp +++ b/manifests/network/contrail/vrouter.pp @@ -143,7 +143,7 @@ # Defaults to hiera('contrail::vrouter::is_tsn',false) # class tripleo::network::contrail::vrouter ( - $step = hiera('step'), + $step = Integer(hiera('step')), $admin_password = hiera('contrail::admin_password'), $admin_tenant_name = hiera('contrail::admin_tenant_name'), $admin_token = hiera('contrail::admin_token'), diff --git a/manifests/pacemaker/haproxy_with_vip.pp b/manifests/pacemaker/haproxy_with_vip.pp index 1fc3ff7..606ac26 100644 --- a/manifests/pacemaker/haproxy_with_vip.pp +++ b/manifests/pacemaker/haproxy_with_vip.pp @@ -69,6 +69,12 @@ define tripleo::pacemaker::haproxy_with_vip( $ipv6_addrlabel = '' } + $haproxy_in_container = hiera('haproxy_docker', false) + $constraint_target_name = $haproxy_in_container ? { + true => 'haproxy-bundle', + default => 'haproxy-clone' + } + pacemaker::resource::ip { "${vip_name}_vip": ip_address => $ip_address, cidr_netmask => $netmask, @@ -77,9 +83,10 @@ define tripleo::pacemaker::haproxy_with_vip( location_rule => $location_rule, tries => $pcs_tries, } + pacemaker::constraint::order { "${vip_name}_vip-then-haproxy": first_resource => "ip-${ip_address}", - second_resource => 'haproxy-clone', + second_resource => $constraint_target_name, first_action => 'start', second_action => 'start', constraint_params => 'kind=Optional', @@ -87,13 +94,18 @@ define tripleo::pacemaker::haproxy_with_vip( } pacemaker::constraint::colocation { "${vip_name}_vip-with-haproxy": source => "ip-${ip_address}", - target => 'haproxy-clone', + target => $constraint_target_name, score => 'INFINITY', tries => $pcs_tries, } + $service_resource = $haproxy_in_container ? { + true => Pacemaker::Resource::Bundle['haproxy-bundle'], + default => Pacemaker::Resource::Service['haproxy'] + } + Pacemaker::Resource::Ip["${vip_name}_vip"] -> - Pacemaker::Resource::Service['haproxy'] -> + $service_resource -> Pacemaker::Constraint::Order["${vip_name}_vip-then-haproxy"] -> Pacemaker::Constraint::Colocation["${vip_name}_vip-with-haproxy"] } diff --git a/manifests/profile/base/aodh.pp b/manifests/profile/base/aodh.pp index da8aaa6..bc219fa 100644 --- a/manifests/profile/base/aodh.pp +++ b/manifests/profile/base/aodh.pp @@ -72,7 +72,7 @@ # Defaults to hiera('aodh::rabbit_use_ssl', '0') class tripleo::profile::base::aodh ( - $step = hiera('step'), + $step = Integer(hiera('step')), $bootstrap_node = hiera('bootstrap_nodeid', undef), $oslomsg_rpc_proto = hiera('messaging_rpc_service_name', 'rabbit'), $oslomsg_rpc_hosts = any2array(hiera('rabbitmq_node_names', undef)), diff --git a/manifests/profile/base/aodh/api.pp b/manifests/profile/base/aodh/api.pp index 5c539fc..300c0ca 100644 --- a/manifests/profile/base/aodh/api.pp +++ b/manifests/profile/base/aodh/api.pp @@ -49,7 +49,7 @@ class tripleo::profile::base::aodh::api ( $aodh_network = hiera('aodh_api_network', undef), $certificates_specs = hiera('apache_certificates_specs', {}), $enable_internal_tls = hiera('enable_internal_tls', false), - $step = hiera('step'), + $step = Integer(hiera('step')), ) { include ::tripleo::profile::base::aodh diff --git a/manifests/profile/base/aodh/evaluator.pp b/manifests/profile/base/aodh/evaluator.pp index d9b48b3..1b25b37 100644 --- a/manifests/profile/base/aodh/evaluator.pp +++ b/manifests/profile/base/aodh/evaluator.pp @@ -24,7 +24,7 @@ # Defaults to hiera('step') # class tripleo::profile::base::aodh::evaluator ( - $step = hiera('step'), + $step = Integer(hiera('step')), ) { include ::tripleo::profile::base::aodh diff --git a/manifests/profile/base/aodh/listener.pp b/manifests/profile/base/aodh/listener.pp index d36e1bb..d225e71 100644 --- a/manifests/profile/base/aodh/listener.pp +++ b/manifests/profile/base/aodh/listener.pp @@ -24,7 +24,7 @@ # Defaults to hiera('step') # class tripleo::profile::base::aodh::listener ( - $step = hiera('step'), + $step = Integer(hiera('step')), ) { include ::tripleo::profile::base::aodh diff --git a/manifests/profile/base/aodh/notifier.pp b/manifests/profile/base/aodh/notifier.pp index d2a3945..bb79ed2 100644 --- a/manifests/profile/base/aodh/notifier.pp +++ b/manifests/profile/base/aodh/notifier.pp @@ -24,7 +24,7 @@ # Defaults to hiera('step') # class tripleo::profile::base::aodh::notifier ( - $step = hiera('step'), + $step = Integer(hiera('step')), ) { include ::tripleo::profile::base::aodh diff --git a/manifests/profile/base/auditd.pp b/manifests/profile/base/auditd.pp index 628db08..46eb564 100644 --- a/manifests/profile/base/auditd.pp +++ b/manifests/profile/base/auditd.pp @@ -22,7 +22,7 @@ # Defaults to hiera('step') # class tripleo::profile::base::auditd ( - $step = hiera('step'), + $step = Integer(hiera('step')), ) { if $step >= 4 { include ::auditd diff --git a/manifests/profile/base/barbican.pp b/manifests/profile/base/barbican.pp index f4d6230..7113fd0 100644 --- a/manifests/profile/base/barbican.pp +++ b/manifests/profile/base/barbican.pp @@ -25,7 +25,7 @@ # class tripleo::profile::base::barbican ( - $step = hiera('step'), + $step = Integer(hiera('step')), ) { if $step >= 3 { diff --git a/manifests/profile/base/barbican/api.pp b/manifests/profile/base/barbican/api.pp index 211e442..40a0a99 100644 --- a/manifests/profile/base/barbican/api.pp +++ b/manifests/profile/base/barbican/api.pp @@ -97,7 +97,7 @@ class tripleo::profile::base::barbican::api ( $bootstrap_node = hiera('bootstrap_nodeid', undef), $certificates_specs = hiera('apache_certificates_specs', {}), $enable_internal_tls = hiera('enable_internal_tls', false), - $step = hiera('step'), + $step = Integer(hiera('step')), $oslomsg_rpc_proto = hiera('messaging_rpc_service_name', 'rabbit'), $oslomsg_rpc_hosts = any2array(hiera('rabbitmq_node_names', undef)), $oslomsg_rpc_password = hiera('barbican::api::rabbit_password'), diff --git a/manifests/profile/base/ceilometer.pp b/manifests/profile/base/ceilometer.pp index e6a2f11..02ef037 100644 --- a/manifests/profile/base/ceilometer.pp +++ b/manifests/profile/base/ceilometer.pp @@ -18,10 +18,6 @@ # # === Parameters # -# [*bootstrap_node*] -# (Optional) The hostname of the node responsible for bootstrapping tasks -# Defaults to hiera('bootstrap_nodeid') -# # [*step*] # (Optional) The current step in deployment. See tripleo-heat-templates # for more details. @@ -72,8 +68,7 @@ # Defaults to hiera('ceilometer::rabbit_use_ssl', '0') class tripleo::profile::base::ceilometer ( - $bootstrap_node = hiera('bootstrap_nodeid', undef), - $step = hiera('step'), + $step = Integer(hiera('step')), $oslomsg_rpc_proto = hiera('messaging_rpc_service_name', 'rabbit'), $oslomsg_rpc_hosts = any2array(hiera('rabbitmq_node_names', undef)), $oslomsg_rpc_password = hiera('ceilometer::rabbit_password'), @@ -86,11 +81,6 @@ class tripleo::profile::base::ceilometer ( $oslomsg_notify_username = hiera('ceilometer::rabbit_userid', 'guest'), $oslomsg_use_ssl = hiera('ceilometer::rabbit_use_ssl', '0'), ) { - if $::hostname == downcase($bootstrap_node) { - $sync_db = true - } else { - $sync_db = false - } if $step >= 3 { $oslomsg_use_ssl_real = sprintf('%s', bool2num(str2bool($oslomsg_use_ssl))) @@ -114,13 +104,4 @@ class tripleo::profile::base::ceilometer ( } include ::ceilometer::config } - - # Run ceilometer-upgrade in step 5 so gnocchi resource types - # are created safely. - if $step >= 5 and $sync_db { - exec {'ceilometer-db-upgrade': - command => 'ceilometer-upgrade --skip-metering-database', - path => ['/usr/bin', '/usr/sbin'], - } - } } diff --git a/manifests/profile/base/ceilometer/agent/central.pp b/manifests/profile/base/ceilometer/agent/central.pp index 033d34c..b8f5d07 100644 --- a/manifests/profile/base/ceilometer/agent/central.pp +++ b/manifests/profile/base/ceilometer/agent/central.pp @@ -24,7 +24,7 @@ # Defaults to hiera('step') # class tripleo::profile::base::ceilometer::agent::central ( - $step = hiera('step'), + $step = Integer(hiera('step')), ) { include ::tripleo::profile::base::ceilometer diff --git a/manifests/profile/base/ceilometer/agent/compute.pp b/manifests/profile/base/ceilometer/agent/compute.pp index 749bc64..c054c35 100644 --- a/manifests/profile/base/ceilometer/agent/compute.pp +++ b/manifests/profile/base/ceilometer/agent/compute.pp @@ -24,7 +24,7 @@ # Defaults to hiera('step') # class tripleo::profile::base::ceilometer::agent::compute ( - $step = hiera('step'), + $step = Integer(hiera('step')), ) { include ::tripleo::profile::base::ceilometer diff --git a/manifests/profile/base/ceilometer/agent/notification.pp b/manifests/profile/base/ceilometer/agent/notification.pp index 7fe8e81..4286001 100644 --- a/manifests/profile/base/ceilometer/agent/notification.pp +++ b/manifests/profile/base/ceilometer/agent/notification.pp @@ -24,9 +24,10 @@ # Defaults to hiera('step') # class tripleo::profile::base::ceilometer::agent::notification ( - $step = hiera('step'), + $step = Integer(hiera('step')), ) { include ::tripleo::profile::base::ceilometer + include ::tripleo::profile::base::ceilometer::upgrade if $step >= 4 { include ::ceilometer::agent::auth diff --git a/manifests/profile/base/ceilometer/agent/polling.pp b/manifests/profile/base/ceilometer/agent/polling.pp index 3706c2e..84f5e46 100644 --- a/manifests/profile/base/ceilometer/agent/polling.pp +++ b/manifests/profile/base/ceilometer/agent/polling.pp @@ -47,10 +47,14 @@ class tripleo::profile::base::ceilometer::agent::polling ( $ipmi_namespace = hiera('ipmi_namespace', false), $ceilometer_redis_password = hiera('ceilometer_redis_password', undef), $redis_vip = hiera('redis_vip', undef), - $step = hiera('step'), + $step = Integer(hiera('step')), ) { include ::tripleo::profile::base::ceilometer + if $central_namespace { + include ::tripleo::profile::base::ceilometer::upgrade + } + if $step >= 4 { include ::ceilometer::agent::auth class { '::ceilometer::agent::polling': @@ -60,5 +64,4 @@ class tripleo::profile::base::ceilometer::agent::polling ( coordination_url => join(['redis://:', $ceilometer_redis_password, '@', normalize_ip_for_uri($redis_vip), ':6379/']), } } - } diff --git a/manifests/profile/base/ceilometer/api.pp b/manifests/profile/base/ceilometer/api.pp index 0176380..6a30a40 100644 --- a/manifests/profile/base/ceilometer/api.pp +++ b/manifests/profile/base/ceilometer/api.pp @@ -48,7 +48,7 @@ class tripleo::profile::base::ceilometer::api ( $ceilometer_network = hiera('ceilometer_api_network', undef), $certificates_specs = hiera('apache_certificates_specs', {}), $enable_internal_tls = hiera('enable_internal_tls', false), - $step = hiera('step'), + $step = Integer(hiera('step')), ) { include ::tripleo::profile::base::ceilometer diff --git a/manifests/profile/base/ceilometer/collector.pp b/manifests/profile/base/ceilometer/collector.pp index a2c1e29..9fcee7b 100644 --- a/manifests/profile/base/ceilometer/collector.pp +++ b/manifests/profile/base/ceilometer/collector.pp @@ -46,7 +46,7 @@ # class tripleo::profile::base::ceilometer::collector ( $bootstrap_node = hiera('bootstrap_nodeid', undef), - $step = hiera('step'), + $step = Integer(hiera('step')), $ceilometer_backend = hiera('ceilometer_backend', 'mongodb'), $mongodb_ipv6 = hiera('mongodb::server::ipv6', false), $mongodb_node_ips = hiera('mongodb_node_ips', []), diff --git a/manifests/profile/base/ceilometer/expirer.pp b/manifests/profile/base/ceilometer/expirer.pp index eaaaefc..20fa9d8 100644 --- a/manifests/profile/base/ceilometer/expirer.pp +++ b/manifests/profile/base/ceilometer/expirer.pp @@ -24,7 +24,7 @@ # Defaults to hiera('step') # class tripleo::profile::base::ceilometer::expirer ( - $step = hiera('step'), + $step = Integer(hiera('step')), ) { include ::tripleo::profile::base::ceilometer diff --git a/manifests/profile/base/ceilometer/upgrade.pp b/manifests/profile/base/ceilometer/upgrade.pp new file mode 100644 index 0000000..f192b48 --- /dev/null +++ b/manifests/profile/base/ceilometer/upgrade.pp @@ -0,0 +1,49 @@ +# Copyright 2016 Red Hat, Inc. +# +# Licensed under the Apache License, Version 2.0 (the "License"); you may +# not use this file except in compliance with the License. You may obtain +# a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT +# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the +# License for the specific language governing permissions and limitations +# under the License. +# +# == Class: tripleo::profile::base::ceilometer::upgrade +# +# Ceilometer upgrade profile for tripleo +# +# === Parameters +# +# [*bootstrap_node*] +# (Optional) The hostname of the node responsible for bootstrapping tasks +# Defaults to hiera('bootstrap_nodeid') +# +# [*step*] +# (Optional) The current step in deployment. See tripleo-heat-templates +# for more details. +# Defaults to hiera('step') +# + +class tripleo::profile::base::ceilometer::upgrade ( + $bootstrap_node = hiera('bootstrap_nodeid', undef), + $step = Integer(hiera('step')), +) { + if $::hostname == downcase($bootstrap_node) { + $sync_db = true + } else { + $sync_db = false + } + + # Run ceilometer-upgrade in step 5 so gnocchi resource types + # are created safely. + if $step >= 5 and $sync_db { + exec {'ceilometer-db-upgrade': + command => 'ceilometer-upgrade --skip-metering-database', + path => ['/usr/bin', '/usr/sbin'], + } + } +} diff --git a/manifests/profile/base/ceph.pp b/manifests/profile/base/ceph.pp index f4404e0..6ada505 100644 --- a/manifests/profile/base/ceph.pp +++ b/manifests/profile/base/ceph.pp @@ -39,7 +39,7 @@ class tripleo::profile::base::ceph ( $ceph_mon_initial_members = hiera('ceph_mon_short_node_names', undef), $ceph_mon_host = hiera('ceph_mon_node_ips', '127.0.0.1'), $enable_ceph_storage = false, - $step = hiera('step'), + $step = Integer(hiera('step')), ) { if ! $ceph_mon_initial_members { $ceph_mon_initial_members_real = hiera('ceph_mon_node_names', undef) diff --git a/manifests/profile/base/ceph/client.pp b/manifests/profile/base/ceph/client.pp index 53f09c2..a38a6c5 100644 --- a/manifests/profile/base/ceph/client.pp +++ b/manifests/profile/base/ceph/client.pp @@ -24,7 +24,7 @@ # Defaults to hiera('step') # class tripleo::profile::base::ceph::client ( - $step = hiera('step'), + $step = Integer(hiera('step')), ) { include ::tripleo::profile::base::ceph diff --git a/manifests/profile/base/ceph/mds.pp b/manifests/profile/base/ceph/mds.pp index c5c7654..9cc2b20 100644 --- a/manifests/profile/base/ceph/mds.pp +++ b/manifests/profile/base/ceph/mds.pp @@ -24,7 +24,7 @@ # Defaults to hiera('step') # class tripleo::profile::base::ceph::mds ( - $step = hiera('step'), + $step = Integer(hiera('step')), ) { include ::tripleo::profile::base::ceph diff --git a/manifests/profile/base/ceph/mon.pp b/manifests/profile/base/ceph/mon.pp index c0768b6..21c69e7 100644 --- a/manifests/profile/base/ceph/mon.pp +++ b/manifests/profile/base/ceph/mon.pp @@ -35,7 +35,7 @@ # class tripleo::profile::base::ceph::mon ( $ceph_pools = {}, - $step = hiera('step'), + $step = Integer(hiera('step')), ) { include ::tripleo::profile::base::ceph diff --git a/manifests/profile/base/ceph/osd.pp b/manifests/profile/base/ceph/osd.pp index 6940bca..8b3d3c2 100644 --- a/manifests/profile/base/ceph/osd.pp +++ b/manifests/profile/base/ceph/osd.pp @@ -29,7 +29,7 @@ # class tripleo::profile::base::ceph::osd ( $ceph_osd_selinux_permissive = false, - $step = hiera('step'), + $step = Integer(hiera('step')), ) { include ::tripleo::profile::base::ceph diff --git a/manifests/profile/base/ceph/rgw.pp b/manifests/profile/base/ceph/rgw.pp index d00f7cd..8a81efa 100644 --- a/manifests/profile/base/ceph/rgw.pp +++ b/manifests/profile/base/ceph/rgw.pp @@ -51,7 +51,7 @@ class tripleo::profile::base::ceph::rgw ( $civetweb_bind_ip = '127.0.0.1', $civetweb_bind_port = '8080', $rgw_keystone_version = 'v2.0', - $step = hiera('step'), + $step = Integer(hiera('step')), ) { include ::tripleo::profile::base::ceph diff --git a/manifests/profile/base/certmonger_user.pp b/manifests/profile/base/certmonger_user.pp index 4ba51ec..7a6559e 100644 --- a/manifests/profile/base/certmonger_user.pp +++ b/manifests/profile/base/certmonger_user.pp @@ -77,6 +77,16 @@ class tripleo::profile::base::certmonger_user ( $rabbitmq_certificate_specs = hiera('tripleo::profile::base::rabbitmq::certificate_specs', {}), $etcd_certificate_specs = hiera('tripleo::profile::base::etcd::certificate_specs', {}), ) { + unless empty($haproxy_certificates_specs) { + $reload_haproxy = ['systemctl reload haproxy'] + Class['::tripleo::certmonger::ca::crl'] ~> Haproxy::Balancermember<||> + Class['::tripleo::certmonger::ca::crl'] ~> Class['::haproxy'] + } else { + $reload_haproxy = [] + } + class { '::tripleo::certmonger::ca::crl' : + reload_cmds => $reload_haproxy, + } include ::tripleo::certmonger::ca::libvirt unless empty($apache_certificates_specs) { diff --git a/manifests/profile/base/cinder.pp b/manifests/profile/base/cinder.pp index fc3c659..9b1b35a 100644 --- a/manifests/profile/base/cinder.pp +++ b/manifests/profile/base/cinder.pp @@ -77,7 +77,7 @@ class tripleo::profile::base::cinder ( $bootstrap_node = hiera('bootstrap_nodeid', undef), $cinder_enable_db_purge = true, - $step = hiera('step'), + $step = Integer(hiera('step')), $oslomsg_rpc_proto = hiera('messaging_rpc_service_name', 'rabbit'), $oslomsg_rpc_hosts = any2array(hiera('rabbitmq_node_names', undef)), $oslomsg_rpc_password = hiera('cinder::rabbit_password'), diff --git a/manifests/profile/base/cinder/api.pp b/manifests/profile/base/cinder/api.pp index 2fd9a65..54880ad 100644 --- a/manifests/profile/base/cinder/api.pp +++ b/manifests/profile/base/cinder/api.pp @@ -53,7 +53,7 @@ class tripleo::profile::base::cinder::api ( $certificates_specs = hiera('apache_certificates_specs', {}), $cinder_api_network = hiera('cinder_api_network', undef), $enable_internal_tls = hiera('enable_internal_tls', false), - $step = hiera('step'), + $step = Integer(hiera('step')), ) { if $::hostname == downcase($bootstrap_node) { $sync_db = true diff --git a/manifests/profile/base/cinder/backup.pp b/manifests/profile/base/cinder/backup.pp index df015f7..ecf65ea 100644 --- a/manifests/profile/base/cinder/backup.pp +++ b/manifests/profile/base/cinder/backup.pp @@ -24,7 +24,7 @@ # Defaults to hiera('step') # class tripleo::profile::base::cinder::backup ( - $step = hiera('step'), + $step = Integer(hiera('step')), ) { include ::tripleo::profile::base::cinder diff --git a/manifests/profile/base/cinder/backup/ceph.pp b/manifests/profile/base/cinder/backup/ceph.pp index 67a666e..d6eb47b 100644 --- a/manifests/profile/base/cinder/backup/ceph.pp +++ b/manifests/profile/base/cinder/backup/ceph.pp @@ -24,7 +24,7 @@ # Defaults to hiera('step') # class tripleo::profile::base::cinder::backup::ceph ( - $step = hiera('step'), + $step = Integer(hiera('step')), ) { include ::tripleo::profile::base::cinder::backup diff --git a/manifests/profile/base/cinder/backup/swift.pp b/manifests/profile/base/cinder/backup/swift.pp index 12561bf..b9a38fe 100644 --- a/manifests/profile/base/cinder/backup/swift.pp +++ b/manifests/profile/base/cinder/backup/swift.pp @@ -24,7 +24,7 @@ # Defaults to hiera('step') # class tripleo::profile::base::cinder::backup::swift ( - $step = hiera('step'), + $step = Integer(hiera('step')), ) { include ::tripleo::profile::base::cinder::backup diff --git a/manifests/profile/base/cinder/scheduler.pp b/manifests/profile/base/cinder/scheduler.pp index 4586929..9fd172f 100644 --- a/manifests/profile/base/cinder/scheduler.pp +++ b/manifests/profile/base/cinder/scheduler.pp @@ -24,7 +24,7 @@ # Defaults to hiera('step') # class tripleo::profile::base::cinder::scheduler ( - $step = hiera('step'), + $step = Integer(hiera('step')), ) { include ::tripleo::profile::base::cinder diff --git a/manifests/profile/base/cinder/volume.pp b/manifests/profile/base/cinder/volume.pp index e1370a3..3581540 100644 --- a/manifests/profile/base/cinder/volume.pp +++ b/manifests/profile/base/cinder/volume.pp @@ -74,7 +74,7 @@ class tripleo::profile::base::cinder::volume ( $cinder_enable_rbd_backend = false, $cinder_enable_scaleio_backend = false, $cinder_user_enabled_backends = hiera('cinder_user_enabled_backends', undef), - $step = hiera('step'), + $step = Integer(hiera('step')), ) { include ::tripleo::profile::base::cinder diff --git a/manifests/profile/base/cinder/volume/dellps.pp b/manifests/profile/base/cinder/volume/dellps.pp index e825b61..e81a7e8 100644 --- a/manifests/profile/base/cinder/volume/dellps.pp +++ b/manifests/profile/base/cinder/volume/dellps.pp @@ -29,7 +29,7 @@ # class tripleo::profile::base::cinder::volume::dellps ( $backend_name = hiera('cinder::backend::eqlx::volume_backend_name', 'tripleo_dellps'), - $step = hiera('step'), + $step = Integer(hiera('step')), ) { include ::tripleo::profile::base::cinder::volume diff --git a/manifests/profile/base/cinder/volume/dellsc.pp b/manifests/profile/base/cinder/volume/dellsc.pp index a60eadf..3f3f61e 100644 --- a/manifests/profile/base/cinder/volume/dellsc.pp +++ b/manifests/profile/base/cinder/volume/dellsc.pp @@ -29,7 +29,7 @@ # class tripleo::profile::base::cinder::volume::dellsc ( $backend_name = hiera('cinder::backend::dellsc_iscsi::volume_backend_name', 'tripleo_dellsc'), - $step = hiera('step'), + $step = Integer(hiera('step')), ) { include ::tripleo::profile::base::cinder::volume diff --git a/manifests/profile/base/cinder/volume/hpelefthand.pp b/manifests/profile/base/cinder/volume/hpelefthand.pp index 32f0976..473791c 100644 --- a/manifests/profile/base/cinder/volume/hpelefthand.pp +++ b/manifests/profile/base/cinder/volume/hpelefthand.pp @@ -53,7 +53,7 @@ class tripleo::profile::base::cinder::volume::hpelefthand ( $cinder_hpelefthand_api_url = hiera('cinder::backend::hpelefthand_iscsi::hpelefthand_api_url', undef), $cinder_hpelefthand_iscsi_chap_enabled = hiera('cinder::backend::hpelefthand_iscsi::hpelefthand_iscsi_chap_enabled', undef), $cinder_hpelefthand_debug = hiera('cinder::backend::hpelefthand_iscsi::hpelefthand_debug', undef), - $step = hiera('step'), + $step = Integer(hiera('step')), ) { include ::tripleo::profile::base::cinder::volume diff --git a/manifests/profile/base/cinder/volume/iscsi.pp b/manifests/profile/base/cinder/volume/iscsi.pp index 4d333c8..7db5022 100644 --- a/manifests/profile/base/cinder/volume/iscsi.pp +++ b/manifests/profile/base/cinder/volume/iscsi.pp @@ -48,7 +48,7 @@ class tripleo::profile::base::cinder::volume::iscsi ( $cinder_iscsi_helper = 'tgtadm', $cinder_iscsi_protocol = 'iscsi', $cinder_lvm_loop_device_size = '10280', - $step = hiera('step'), + $step = Integer(hiera('step')), ) { include ::tripleo::profile::base::cinder::volume diff --git a/manifests/profile/base/cinder/volume/netapp.pp b/manifests/profile/base/cinder/volume/netapp.pp index 43978da..c58d937 100644 --- a/manifests/profile/base/cinder/volume/netapp.pp +++ b/manifests/profile/base/cinder/volume/netapp.pp @@ -29,7 +29,7 @@ # class tripleo::profile::base::cinder::volume::netapp ( $backend_name = hiera('cinder::backend::netapp::volume_backend_name', 'tripleo_netapp'), - $step = hiera('step'), + $step = Integer(hiera('step')), ) { include ::tripleo::profile::base::cinder::volume diff --git a/manifests/profile/base/cinder/volume/nfs.pp b/manifests/profile/base/cinder/volume/nfs.pp index e384a79..16a49e4 100644 --- a/manifests/profile/base/cinder/volume/nfs.pp +++ b/manifests/profile/base/cinder/volume/nfs.pp @@ -57,7 +57,7 @@ class tripleo::profile::base::cinder::volume::nfs ( $cinder_nfs_mount_options = '', $cinder_nas_secure_file_operations = $::os_service_default, $cinder_nas_secure_file_permissions = $::os_service_default, - $step = hiera('step'), + $step = Integer(hiera('step')), ) { include ::tripleo::profile::base::cinder::volume diff --git a/manifests/profile/base/cinder/volume/pure.pp b/manifests/profile/base/cinder/volume/pure.pp index e524919..c7ab1d1 100644 --- a/manifests/profile/base/cinder/volume/pure.pp +++ b/manifests/profile/base/cinder/volume/pure.pp @@ -48,7 +48,7 @@ # class tripleo::profile::base::cinder::volume::pure ( $backend_name = hiera('cinder::backend::pure::volume_backend_name', 'tripleo_pure'), - $step = hiera('step'), + $step = Integer(hiera('step')), ) { include ::tripleo::profile::base::cinder::volume diff --git a/manifests/profile/base/cinder/volume/rbd.pp b/manifests/profile/base/cinder/volume/rbd.pp index 1246de8..dee2e72 100644 --- a/manifests/profile/base/cinder/volume/rbd.pp +++ b/manifests/profile/base/cinder/volume/rbd.pp @@ -49,7 +49,7 @@ class tripleo::profile::base::cinder::volume::rbd ( $cinder_rbd_pool_name = 'volumes', $cinder_rbd_secret_uuid = hiera('ceph::profile::params::fsid', undef), $cinder_rbd_user_name = 'openstack', - $step = hiera('step'), + $step = Integer(hiera('step')), ) { include ::tripleo::profile::base::cinder::volume diff --git a/manifests/profile/base/cinder/volume/scaleio.pp b/manifests/profile/base/cinder/volume/scaleio.pp index a30cffa..bdd4dc9 100644 --- a/manifests/profile/base/cinder/volume/scaleio.pp +++ b/manifests/profile/base/cinder/volume/scaleio.pp @@ -29,7 +29,7 @@ # class tripleo::profile::base::cinder::volume::scaleio ( $backend_name = hiera('cinder::backend::scaleio::volume_backend_name', 'tripleo_scaleio'), - $step = hiera('step'), + $step = Integer(hiera('step')), ) { include ::tripleo::profile::base::cinder::volume diff --git a/manifests/profile/base/congress.pp b/manifests/profile/base/congress.pp index 3d1a693..424cd95 100644 --- a/manifests/profile/base/congress.pp +++ b/manifests/profile/base/congress.pp @@ -52,7 +52,7 @@ class tripleo::profile::base::congress ( $bootstrap_node = hiera('bootstrap_nodeid', undef), - $step = hiera('step'), + $step = Integer(hiera('step')), $oslomsg_rpc_proto = hiera('messaging_rpc_service_name', 'rabbit'), $oslomsg_rpc_hosts = any2array(hiera('rabbitmq_node_names', undef)), $oslomsg_rpc_password = hiera('congress::rabbit_password'), diff --git a/manifests/profile/base/database/mongodb.pp b/manifests/profile/base/database/mongodb.pp index 4740d67..48bdd82 100644 --- a/manifests/profile/base/database/mongodb.pp +++ b/manifests/profile/base/database/mongodb.pp @@ -37,7 +37,7 @@ class tripleo::profile::base::database::mongodb ( $mongodb_replset, $bootstrap_node = downcase(hiera('bootstrap_nodeid')), - $step = hiera('step'), + $step = Integer(hiera('step')), $memory_limit = '20G', ) { if $step >= 2 { diff --git a/manifests/profile/base/database/mysql.pp b/manifests/profile/base/database/mysql.pp index b4ac8ac..8eb6079 100644 --- a/manifests/profile/base/database/mysql.pp +++ b/manifests/profile/base/database/mysql.pp @@ -80,7 +80,7 @@ class tripleo::profile::base::database::mysql ( $mysql_server_options = {}, $mysql_max_connections = hiera('mysql_max_connections', undef), $remove_default_accounts = true, - $step = hiera('step'), + $step = Integer(hiera('step')), ) { if $::hostname == downcase($bootstrap_node) { @@ -199,6 +199,9 @@ class tripleo::profile::base::database::mysql ( if hiera('nova_placement_enabled', false) { include ::nova::db::mysql_placement } + if hiera('octavia_api_enabled', false) { + include ::octavia::db::mysql + } if hiera('sahara_api_enabled', false) { include ::sahara::db::mysql } diff --git a/manifests/profile/base/database/mysql/client.pp b/manifests/profile/base/database/mysql/client.pp index 3de1e97..1e55f05 100644 --- a/manifests/profile/base/database/mysql/client.pp +++ b/manifests/profile/base/database/mysql/client.pp @@ -50,7 +50,7 @@ class tripleo::profile::base::database::mysql::client ( $mysql_read_default_group = 'tripleo', $mysql_client_bind_address = undef, $ssl_ca = '/etc/pki/ca-trust/extracted/openssl/ca-bundle.trust.crt', - $step = hiera('step'), + $step = Integer(hiera('step')), ) { if $step >= 1 { # If the folder /etc/my.cnf.d does not exist (e.g. if mariadb is not diff --git a/manifests/profile/base/database/redis.pp b/manifests/profile/base/database/redis.pp index 14f6af4..e357359 100644 --- a/manifests/profile/base/database/redis.pp +++ b/manifests/profile/base/database/redis.pp @@ -34,10 +34,10 @@ class tripleo::profile::base::database::redis ( $bootstrap_nodeid = hiera('bootstrap_nodeid'), $redis_node_ips = hiera('redis_node_ips'), - $step = hiera('step'), + $step = Integer(hiera('step')), ) { if $step >= 2 { - if $bootstrap_nodeid == $::hostname { + if downcase($bootstrap_nodeid) == $::hostname { $slaveof = undef } else { $slaveof = "${bootstrap_nodeid} 6379" diff --git a/manifests/profile/base/docker.pp b/manifests/profile/base/docker.pp index bc784b5..28a2764 100644 --- a/manifests/profile/base/docker.pp +++ b/manifests/profile/base/docker.pp @@ -47,6 +47,18 @@ # [*step*] # step defaults to hiera('step') # +# [*configure_libvirt_polkit*] +# Configures libvirt polkit to grant the kolla nova user access to the libvirtd unix domain socket on the host. +# Defaults to true when nova_compute service is enabled, false when nova_compute is disabled +# +# [*docker_nova_uid*] +# When configure_libvirt_polkit = true, the uid/gid of the nova user within the docker container. +# Defaults to 42436 +# +# [*services_enabled*] +# List of TripleO services enabled on the role. +# Defaults to hiera('services_names') +# class tripleo::profile::base::docker ( $docker_namespace = undef, $insecure_registry = false, @@ -54,8 +66,18 @@ class tripleo::profile::base::docker ( $docker_options = '--log-driver=journald --signature-verification=false', $configure_storage = true, $storage_options = '-s overlay2', - $step = hiera('step'), + $step = Integer(hiera('step')), + $configure_libvirt_polkit = undef, + $docker_nova_uid = 42436, + $services_enabled = hiera('service_names', []) ) { + + if $configure_libvirt_polkit == undef { + $configure_libvirt_polkit_real = 'nova_compute' in $services_enabled + } else { + $configure_libvirt_polkit_real = $configure_libvirt_polkit + } + if $step >= 1 { package {'docker': ensure => installed, @@ -125,7 +147,46 @@ class tripleo::profile::base::docker ( lens => 'Shellvars.lns', incl => '/etc/sysconfig/docker-storage', changes => $storage_changes, + notify => Service['docker'], + require => Package['docker'], } } + if ($step >= 4 and $configure_libvirt_polkit_real) { + # Workaround for polkit authorization for libvirtd socket on host + # + # This creates a local user with the kolla nova uid, and sets the polkit rule to + # allow both it and the nova user from the nova rpms, should it exist (uid 162). + + group { 'docker_nova_group': + name => 'docker_nova', + gid => $docker_nova_uid + } -> + user { 'docker_nova_user': + name => 'docker_nova', + uid => $docker_nova_uid, + gid => $docker_nova_uid, + shell => '/sbin/nologin', + comment => 'OpenStack Nova Daemons', + groups => ['nobody'] + } + + # Similar to the polkit rule in the openstack-nova rpm spec + # but allow both the 'docker_nova' and 'nova' user + $docker_nova_polkit_rule = '// openstack-nova libvirt management permissions +polkit.addRule(function(action, subject) { + if (action.id == "org.libvirt.unix.manage" && + /^(docker_)?nova$/.test(subject.user)) { + return polkit.Result.YES; + } +}); +' + package {'polkit': + ensure => installed, + } -> + file {'/etc/polkit-1/rules.d/50-nova.rules': + content => $docker_nova_polkit_rule, + mode => '0644' + } + } } diff --git a/manifests/profile/base/etcd.pp b/manifests/profile/base/etcd.pp index 9f5d180..86240be 100644 --- a/manifests/profile/base/etcd.pp +++ b/manifests/profile/base/etcd.pp @@ -62,7 +62,7 @@ class tripleo::profile::base::etcd ( $nodes = hiera('etcd_node_names', []), $certificate_specs = {}, $enable_internal_tls = hiera('enable_internal_tls', false), - $step = hiera('step'), + $step = Integer(hiera('step')), ) { validate_hash($certificate_specs) diff --git a/manifests/profile/base/glance/api.pp b/manifests/profile/base/glance/api.pp index 8ed7fb7..2896185 100644 --- a/manifests/profile/base/glance/api.pp +++ b/manifests/profile/base/glance/api.pp @@ -86,7 +86,7 @@ class tripleo::profile::base::glance::api ( $glance_backend = downcase(hiera('glance_backend', 'swift')), $glance_network = hiera('glance_api_network', undef), $glance_nfs_enabled = false, - $step = hiera('step'), + $step = Integer(hiera('step')), $rabbit_hosts = hiera('rabbitmq_node_names', undef), $rabbit_port = hiera('glance::notify::rabbitmq::rabbit_port', 5672), $tls_proxy_bind_ip = undef, diff --git a/manifests/profile/base/gnocchi.pp b/manifests/profile/base/gnocchi.pp index 6a470ca..5b8c5fc 100644 --- a/manifests/profile/base/gnocchi.pp +++ b/manifests/profile/base/gnocchi.pp @@ -24,7 +24,7 @@ # Defaults to hiera('step') # class tripleo::profile::base::gnocchi ( - $step = hiera('step'), + $step = Integer(hiera('step')), ) { if $step >= 3 { include ::gnocchi diff --git a/manifests/profile/base/gnocchi/api.pp b/manifests/profile/base/gnocchi/api.pp index a4e9a30..3953f04 100644 --- a/manifests/profile/base/gnocchi/api.pp +++ b/manifests/profile/base/gnocchi/api.pp @@ -68,7 +68,7 @@ class tripleo::profile::base::gnocchi::api ( $gnocchi_network = hiera('gnocchi_api_network', undef), $gnocchi_redis_password = hiera('gnocchi_redis_password'), $redis_vip = hiera('redis_vip'), - $step = hiera('step'), + $step = Integer(hiera('step')), ) { if $::hostname == downcase($bootstrap_node) { $sync_db = true @@ -89,12 +89,11 @@ class tripleo::profile::base::gnocchi::api ( $tls_keyfile = undef } - if $step >= 3 and $sync_db { + if $step >= 4 and $sync_db { include ::gnocchi::db::sync } - if $step >= 3 { - include ::gnocchi::api + if $step >= 4 or ($step >= 3 and $sync_db) { include ::apache::mod::ssl class { '::gnocchi::wsgi::apache': ssl_cert => $tls_certfile, @@ -107,19 +106,20 @@ class tripleo::profile::base::gnocchi::api ( coordination_url => join(['redis://:', $gnocchi_redis_password, '@', normalize_ip_for_uri($redis_vip), ':6379/']), } case $gnocchi_backend { - 'swift': { include ::gnocchi::storage::swift } + 'swift': { + include ::gnocchi::storage::swift + if $sync_db { + include ::swift::deps + # Ensure we have swift proxy available before running gnocchi-upgrade + # as storage is initialized at this point. + Anchor<| title == 'swift::service::end' |> ~> Class['Gnocchi::db::sync'] + } + } 'file': { include ::gnocchi::storage::file } 'rbd': { include ::gnocchi::storage::ceph } default: { fail('Unrecognized gnocchi_backend parameter.') } } + include ::gnocchi::api } - # Re-run gnochci upgrade with storage as swift/ceph should be up at this - # stage. - if $step >= 5 and $sync_db { - exec {'run gnocchi upgrade with storage': - command => 'gnocchi-upgrade --config-file=/etc/gnocchi/gnocchi.conf', - path => ['/usr/bin', '/usr/sbin'], - } - } } diff --git a/manifests/profile/base/gnocchi/metricd.pp b/manifests/profile/base/gnocchi/metricd.pp index f6f80cd..c585e57 100644 --- a/manifests/profile/base/gnocchi/metricd.pp +++ b/manifests/profile/base/gnocchi/metricd.pp @@ -24,7 +24,7 @@ # Defaults to hiera('step') # class tripleo::profile::base::gnocchi::metricd ( - $step = hiera('step'), + $step = Integer(hiera('step')), ) { include ::tripleo::profile::base::gnocchi diff --git a/manifests/profile/base/gnocchi/statsd.pp b/manifests/profile/base/gnocchi/statsd.pp index 7c98a0a..184ff7b 100644 --- a/manifests/profile/base/gnocchi/statsd.pp +++ b/manifests/profile/base/gnocchi/statsd.pp @@ -24,7 +24,7 @@ # Defaults to hiera('step') # class tripleo::profile::base::gnocchi::statsd ( - $step = hiera('step'), + $step = Integer(hiera('step')), ) { include ::tripleo::profile::base::gnocchi diff --git a/manifests/profile/base/haproxy.pp b/manifests/profile/base/haproxy.pp index 9a03487..4f3322c 100644 --- a/manifests/profile/base/haproxy.pp +++ b/manifests/profile/base/haproxy.pp @@ -44,7 +44,7 @@ class tripleo::profile::base::haproxy ( $certificates_specs = {}, $enable_load_balancer = hiera('enable_load_balancer', true), - $step = hiera('step'), + $step = Integer(hiera('step')), ) { if $step >= 1 { if $enable_load_balancer { diff --git a/manifests/profile/base/heat.pp b/manifests/profile/base/heat.pp index 4ff5b41..ac1c6a2 100644 --- a/manifests/profile/base/heat.pp +++ b/manifests/profile/base/heat.pp @@ -83,7 +83,7 @@ class tripleo::profile::base::heat ( $bootstrap_node = downcase(hiera('bootstrap_nodeid')), $manage_db_purge = hiera('heat_enable_db_purge', true), $notification_driver = 'messaging', - $step = hiera('step'), + $step = Integer(hiera('step')), $oslomsg_rpc_proto = hiera('messaging_rpc_service_name', 'rabbit'), $oslomsg_rpc_hosts = any2array(hiera('rabbitmq_node_names', undef)), $oslomsg_rpc_password = hiera('heat::rabbit_password'), diff --git a/manifests/profile/base/heat/api.pp b/manifests/profile/base/heat/api.pp index 79eb77e..ff90590 100644 --- a/manifests/profile/base/heat/api.pp +++ b/manifests/profile/base/heat/api.pp @@ -48,7 +48,7 @@ class tripleo::profile::base::heat::api ( $certificates_specs = hiera('apache_certificates_specs', {}), $enable_internal_tls = hiera('enable_internal_tls', false), $heat_api_network = hiera('heat_api_network', undef), - $step = hiera('step'), + $step = Integer(hiera('step')), ) { include ::tripleo::profile::base::heat diff --git a/manifests/profile/base/heat/api_cfn.pp b/manifests/profile/base/heat/api_cfn.pp index dad7b76..e14760a 100644 --- a/manifests/profile/base/heat/api_cfn.pp +++ b/manifests/profile/base/heat/api_cfn.pp @@ -48,7 +48,7 @@ class tripleo::profile::base::heat::api_cfn ( $certificates_specs = hiera('apache_certificates_specs', {}), $enable_internal_tls = hiera('enable_internal_tls', false), $heat_api_cfn_network = hiera('heat_api_cfn_network', undef), - $step = hiera('step'), + $step = Integer(hiera('step')), ) { include ::tripleo::profile::base::heat diff --git a/manifests/profile/base/heat/api_cloudwatch.pp b/manifests/profile/base/heat/api_cloudwatch.pp index 428bcf2..83d5307 100644 --- a/manifests/profile/base/heat/api_cloudwatch.pp +++ b/manifests/profile/base/heat/api_cloudwatch.pp @@ -48,7 +48,7 @@ class tripleo::profile::base::heat::api_cloudwatch ( $certificates_specs = hiera('apache_certificates_specs', {}), $enable_internal_tls = hiera('enable_internal_tls', false), $heat_api_cloudwatch_network = hiera('heat_api_cloudwatch_network', undef), - $step = hiera('step'), + $step = Integer(hiera('step')), ) { include ::tripleo::profile::base::heat diff --git a/manifests/profile/base/heat/engine.pp b/manifests/profile/base/heat/engine.pp index 479e1c6..b9b44d1 100644 --- a/manifests/profile/base/heat/engine.pp +++ b/manifests/profile/base/heat/engine.pp @@ -29,7 +29,7 @@ # class tripleo::profile::base::heat::engine ( $bootstrap_node = hiera('bootstrap_nodeid', undef), - $step = hiera('step'), + $step = Integer(hiera('step')), ) { if $::hostname == downcase($bootstrap_node) { $sync_db = true diff --git a/manifests/profile/base/horizon.pp b/manifests/profile/base/horizon.pp index 10eaaa6..12482b6 100644 --- a/manifests/profile/base/horizon.pp +++ b/manifests/profile/base/horizon.pp @@ -28,7 +28,7 @@ # Defaults to hiera('horizon::neutron_options', {}) # class tripleo::profile::base::horizon ( - $step = hiera('step'), + $step = Integer(hiera('step')), $neutron_options = hiera('horizon::neutron_options', {}), ) { if $step >= 3 { diff --git a/manifests/profile/base/ironic.pp b/manifests/profile/base/ironic.pp index 7ba629f..2739f33 100644 --- a/manifests/profile/base/ironic.pp +++ b/manifests/profile/base/ironic.pp @@ -52,7 +52,7 @@ class tripleo::profile::base::ironic ( $bootstrap_node = hiera('bootstrap_nodeid', undef), - $step = hiera('step'), + $step = Integer(hiera('step')), $oslomsg_rpc_proto = hiera('messaging_rpc_service_name', 'rabbit'), $oslomsg_rpc_hosts = any2array(hiera('rabbitmq_node_names', undef)), $oslomsg_rpc_password = hiera('ironic::rabbit_password'), diff --git a/manifests/profile/base/ironic/api.pp b/manifests/profile/base/ironic/api.pp index 020cacb..94b7efe 100644 --- a/manifests/profile/base/ironic/api.pp +++ b/manifests/profile/base/ironic/api.pp @@ -23,7 +23,7 @@ # Defaults to hiera('step') # class tripleo::profile::base::ironic::api ( - $step = hiera('step'), + $step = Integer(hiera('step')), ) { include ::tripleo::profile::base::ironic diff --git a/manifests/profile/base/ironic/conductor.pp b/manifests/profile/base/ironic/conductor.pp index 5ebf167..390d547 100644 --- a/manifests/profile/base/ironic/conductor.pp +++ b/manifests/profile/base/ironic/conductor.pp @@ -27,7 +27,7 @@ # Defaults to true # class tripleo::profile::base::ironic::conductor ( - $step = hiera('step'), + $step = Integer(hiera('step')), $manage_pxe = true, ) { include ::tripleo::profile::base::ironic @@ -51,6 +51,7 @@ class tripleo::profile::base::ironic::conductor ( } # Configure access to other services + include ::ironic::cinder include ::ironic::drivers::inspector include ::ironic::glance include ::ironic::neutron diff --git a/manifests/profile/base/ironic_inspector.pp b/manifests/profile/base/ironic_inspector.pp index b4276c6..4e5e92f 100644 --- a/manifests/profile/base/ironic_inspector.pp +++ b/manifests/profile/base/ironic_inspector.pp @@ -28,7 +28,7 @@ class tripleo::profile::base::ironic_inspector ( $bootstrap_node = hiera('bootstrap_nodeid', undef), - $step = hiera('step'), + $step = Integer(hiera('step')), ) { if $::hostname == downcase($bootstrap_node) { diff --git a/manifests/profile/base/keepalived.pp b/manifests/profile/base/keepalived.pp index 8dd03dc..a841e06 100644 --- a/manifests/profile/base/keepalived.pp +++ b/manifests/profile/base/keepalived.pp @@ -49,7 +49,7 @@ class tripleo::profile::base::keepalived ( $control_virtual_ip = hiera('tripleo::keepalived::controller_virtual_ip'), $public_virtual_interface = hiera('tripleo::keepalived::public_virtual_interface', false), $public_virtual_ip = hiera('tripleo::keepalived::public_virtual_ip'), - $step = hiera('step'), + $step = Integer(hiera('step')), ) { if $step >= 1 { if $enable_load_balancer and hiera('enable_keepalived', true){ diff --git a/manifests/profile/base/kernel.pp b/manifests/profile/base/kernel.pp index df13a98..48caf37 100644 --- a/manifests/profile/base/kernel.pp +++ b/manifests/profile/base/kernel.pp @@ -17,14 +17,32 @@ # # Load and configure Kernel modules. # -class tripleo::profile::base::kernel { +# === Parameters +# +# [*module_list*] +# (Optional) List of kernel modules to load. +# Defaults to hiera('kernel_modules') +# +# [*sysctl_settings*] +# (Optional) List of sysctl settings to load. +# Defaults to hiera('sysctl_settings') +# +class tripleo::profile::base::kernel ( + $module_list = hiera('kernel_modules', undef), + $sysctl_settings = hiera('sysctl_settings', undef), +) { - if hiera('kernel_modules', undef) { - create_resources(kmod::load, hiera('kernel_modules'), { }) + if $module_list { + create_resources(kmod::load, $module_list, { }) } - if hiera('sysctl_settings', undef) { - create_resources(sysctl::value, hiera('sysctl_settings'), { }) + if $sysctl_settings { + create_resources(sysctl::value, $sysctl_settings, { }) } Exec <| tag == 'kmod::load' |> -> Sysctl <| |> + # RHEL 7.4+ workaround where this functionality is built into the + # kernel instead of being built as a module. + # That way, we can support both 7.3 and 7.4 RHEL versions. + # https://bugzilla.redhat.com/show_bug.cgi?id=1387537 + Exec <| title == 'modprobe nf_conntrack_proto_sctp' |> { returns => [0,1] } } diff --git a/manifests/profile/base/keystone.pp b/manifests/profile/base/keystone.pp index 31f5c93..91a660c 100644 --- a/manifests/profile/base/keystone.pp +++ b/manifests/profile/base/keystone.pp @@ -150,7 +150,7 @@ class tripleo::profile::base::keystone ( $oslomsg_notify_port = hiera('keystone::rabbit_port', '5672'), $oslomsg_notify_username = hiera('keystone::rabbit_userid', 'guest'), $oslomsg_use_ssl = hiera('keystone::rabbit_use_ssl', '0'), - $step = hiera('step'), + $step = Integer(hiera('step')), ) { if $::hostname == downcase($bootstrap_node) { $sync_db = true @@ -222,6 +222,12 @@ class tripleo::profile::base::keystone ( if $ldap_backend_enable { validate_hash($ldap_backends_config) + if !str2bool($::selinux) { + selboolean { 'authlogin_nsswitch_use_ldap': + value => on, + persistent => true, + } + } create_resources('::keystone::ldap_backend', $ldap_backends_config, { create_domain_entry => $manage_domain, }) @@ -338,5 +344,8 @@ class tripleo::profile::base::keystone ( if hiera('ec2_api_enabled', false) { include ::ec2api::keystone::auth } + if hiera('novajoin_enabled', false) { + include ::nova::metadata::novajoin::auth + } } } diff --git a/manifests/profile/base/logging/fluentd.pp b/manifests/profile/base/logging/fluentd.pp index fc996e9..51869d6 100644 --- a/manifests/profile/base/logging/fluentd.pp +++ b/manifests/profile/base/logging/fluentd.pp @@ -59,7 +59,7 @@ # (Optional, default 42185) Port on which fluentd should listen if # $fluentd_listen_syslog is true. class tripleo::profile::base::logging::fluentd ( - $step = hiera('step', undef), + $step = Integer(hiera('step')), $fluentd_sources = undef, $fluentd_filters = undef, $fluentd_servers = undef, diff --git a/manifests/profile/base/manila.pp b/manifests/profile/base/manila.pp index cad2cdf..6386e6c 100644 --- a/manifests/profile/base/manila.pp +++ b/manifests/profile/base/manila.pp @@ -72,7 +72,7 @@ class tripleo::profile::base::manila ( $bootstrap_node = hiera('bootstrap_nodeid', undef), - $step = hiera('step'), + $step = Integer(hiera('step')), $oslomsg_rpc_proto = hiera('messaging_rpc_service_name', 'rabbit'), $oslomsg_rpc_hosts = any2array(hiera('rabbitmq_node_names', undef)), $oslomsg_rpc_password = hiera('manila::rabbit_password'), diff --git a/manifests/profile/base/manila/api.pp b/manifests/profile/base/manila/api.pp index 021fffd..95607ae 100644 --- a/manifests/profile/base/manila/api.pp +++ b/manifests/profile/base/manila/api.pp @@ -44,7 +44,7 @@ class tripleo::profile::base::manila::api ( $backend_netapp_enabled = hiera('manila_backend_netapp_enabled', false), $backend_cephfs_enabled = hiera('manila_backend_cephfs_enabled', false), $bootstrap_node = hiera('bootstrap_nodeid', undef), - $step = hiera('step'), + $step = Integer(hiera('step')), ) { if $::hostname == downcase($bootstrap_node) { $sync_db = true diff --git a/manifests/profile/base/manila/scheduler.pp b/manifests/profile/base/manila/scheduler.pp index 07ea676..5c94bbe 100644 --- a/manifests/profile/base/manila/scheduler.pp +++ b/manifests/profile/base/manila/scheduler.pp @@ -24,7 +24,7 @@ # Defaults to hiera('step') # class tripleo::profile::base::manila::scheduler ( - $step = hiera('step'), + $step = Integer(hiera('step')), ) { include ::tripleo::profile::base::manila diff --git a/manifests/profile/base/manila/share.pp b/manifests/profile/base/manila/share.pp index d39c55c..13cedec 100644 --- a/manifests/profile/base/manila/share.pp +++ b/manifests/profile/base/manila/share.pp @@ -24,7 +24,7 @@ # Defaults to hiera('step') # class tripleo::profile::base::manila::share ( - $step = hiera('step'), + $step = Integer(hiera('step')), ) { include ::tripleo::profile::base::manila diff --git a/manifests/profile/base/memcached.pp b/manifests/profile/base/memcached.pp index 72a91e2..e33999a 100644 --- a/manifests/profile/base/memcached.pp +++ b/manifests/profile/base/memcached.pp @@ -24,7 +24,7 @@ # Defaults to hiera('step') # class tripleo::profile::base::memcached ( - $step = hiera('step'), + $step = Integer(hiera('step')), ) { if $step >= 1 { include ::memcached diff --git a/manifests/profile/base/metrics/collectd.pp b/manifests/profile/base/metrics/collectd.pp index d8e6f89..098f795 100644 --- a/manifests/profile/base/metrics/collectd.pp +++ b/manifests/profile/base/metrics/collectd.pp @@ -47,7 +47,7 @@ # deployment. This is used to look up service-specific plugins that # need to be installed. class tripleo::profile::base::metrics::collectd ( - $step = hiera('step'), + $step = Integer(hiera('step')), $collectd_server = undef, $collectd_port = undef, diff --git a/manifests/profile/base/mistral.pp b/manifests/profile/base/mistral.pp index 0eb849d..89577b8 100644 --- a/manifests/profile/base/mistral.pp +++ b/manifests/profile/base/mistral.pp @@ -73,7 +73,7 @@ class tripleo::profile::base::mistral ( $bootstrap_node = hiera('bootstrap_nodeid', undef), - $step = hiera('step'), + $step = Integer(hiera('step')), $oslomsg_rpc_proto = hiera('messaging_rpc_service_name', 'rabbit'), $oslomsg_rpc_hosts = any2array(hiera('rabbitmq_node_names', undef)), $oslomsg_rpc_password = hiera('mistral::rabbit_password'), diff --git a/manifests/profile/base/mistral/api.pp b/manifests/profile/base/mistral/api.pp index 50708f1..2ea5c9a 100644 --- a/manifests/profile/base/mistral/api.pp +++ b/manifests/profile/base/mistral/api.pp @@ -18,6 +18,27 @@ # # === Parameters # +# [*certificates_specs*] +# (Optional) The specifications to give to certmonger for the certificate(s) +# it will create. +# Example with hiera: +# apache_certificates_specs: +# httpd-internal_api: +# hostname: <overcloud controller fqdn> +# service_certificate: <service certificate path> +# service_key: <service key path> +# principal: "haproxy/<overcloud controller fqdn>" +# Defaults to hiera('apache_certificate_specs', {}). +# +# [*enable_internal_tls*] +# (Optional) Whether TLS in the internal network is enabled or not. +# Defaults to hiera('enable_internal_tls', false) +# +# [*mistral_api_network*] +# (Optional) The network name where the mistral API endpoint is listening on. +# This is set by t-h-t. +# Defaults to hiera('mistral_api_network', undef) +# # [*bootstrap_node*] # (Optional) The hostname of the node responsible for bootstrapping tasks # Defaults to hiera('bootstrap_nodeid') @@ -28,8 +49,11 @@ # Defaults to hiera('step') # class tripleo::profile::base::mistral::api ( - $bootstrap_node = hiera('bootstrap_nodeid', undef), - $step = hiera('step'), + $bootstrap_node = hiera('bootstrap_nodeid', undef), + $certificates_specs = hiera('apache_certificates_specs', {}), + $enable_internal_tls = hiera('enable_internal_tls', false), + $mistral_api_network = hiera('mistral_api_network', undef), + $step = Integer(hiera('step')), ) { if $::hostname == downcase($bootstrap_node) { $sync_db = true @@ -39,8 +63,24 @@ class tripleo::profile::base::mistral::api ( include ::tripleo::profile::base::mistral - if $step >= 4 or ($step >= 3 and $sync_db) { + if $enable_internal_tls { + if !$mistral_api_network { + fail('mistral_api_network is not set in the hieradata.') + } + $tls_certfile = $certificates_specs["httpd-${mistral_api_network}"]['service_certificate'] + $tls_keyfile = $certificates_specs["httpd-${mistral_api_network}"]['service_key'] + } else { + $tls_certfile = undef + $tls_keyfile = undef + } + + if $step >= 3 { include ::mistral::api + include ::apache::mod::ssl + class { '::mistral::wsgi::apache': + ssl_cert => $tls_certfile, + ssl_key => $tls_keyfile, + } } } diff --git a/manifests/profile/base/mistral/engine.pp b/manifests/profile/base/mistral/engine.pp index b2d8864..95581aa 100644 --- a/manifests/profile/base/mistral/engine.pp +++ b/manifests/profile/base/mistral/engine.pp @@ -29,7 +29,7 @@ # class tripleo::profile::base::mistral::engine ( $bootstrap_node = hiera('bootstrap_nodeid', undef), - $step = hiera('step'), + $step = Integer(hiera('step')), ) { if $::hostname == downcase($bootstrap_node) { $sync_db = true diff --git a/manifests/profile/base/mistral/event_engine.pp b/manifests/profile/base/mistral/event_engine.pp new file mode 100644 index 0000000..f9ea2f8 --- /dev/null +++ b/manifests/profile/base/mistral/event_engine.pp @@ -0,0 +1,46 @@ +# Copyright 2017 Red Hat, Inc. +# +# Licensed under the Apache License, Version 2.0 (the "License"); you may +# not use this file except in compliance with the License. You may obtain +# a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT +# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the +# License for the specific language governing permissions and limitations +# under the License. +# +# == Class: tripleo::profile::base::mistral::event_engine +# +# Mistral Event Engine profile for tripleo +# +# === Parameters +# +# [*bootstrap_node*] +# (Optional) The hostname of the node responsible for bootstrapping tasks +# Defaults to hiera('bootstrap_nodeid') +# +# [*step*] +# (Optional) The current step in deployment. See tripleo-heat-templates +# for more details. +# Defaults to hiera('step') +# +class tripleo::profile::base::mistral::event_engine ( + $bootstrap_node = hiera('bootstrap_nodeid', undef), + $step = Integer(hiera('step')), +) { + if $::hostname == downcase($bootstrap_node) { + $sync_db = true + } else { + $sync_db = false + } + + include ::tripleo::profile::base::mistral + + if $step >= 4 or ($step >= 3 and $sync_db) { + include ::mistral::event_engine + } + +} diff --git a/manifests/profile/base/mistral/executor.pp b/manifests/profile/base/mistral/executor.pp index 8e3f2c9..cce96dc 100644 --- a/manifests/profile/base/mistral/executor.pp +++ b/manifests/profile/base/mistral/executor.pp @@ -29,7 +29,7 @@ # class tripleo::profile::base::mistral::executor ( $bootstrap_node = hiera('bootstrap_nodeid', undef), - $step = hiera('step'), + $step = Integer(hiera('step')), ) { if $::hostname == downcase($bootstrap_node) { $sync_db = true diff --git a/manifests/profile/base/monitoring/sensu.pp b/manifests/profile/base/monitoring/sensu.pp index 91b7ac7..41db598 100644 --- a/manifests/profile/base/monitoring/sensu.pp +++ b/manifests/profile/base/monitoring/sensu.pp @@ -23,7 +23,7 @@ # Defaults to hiera('step') # class tripleo::profile::base::monitoring::sensu ( - $step = hiera('step', undef), + $step = Integer(hiera('step')), ) { include ::sensu package { 'osops-tools-monitoring-oschecks': diff --git a/manifests/profile/base/monitoring/uchiwa.pp b/manifests/profile/base/monitoring/uchiwa.pp index 2674b5f..153a0bd 100644 --- a/manifests/profile/base/monitoring/uchiwa.pp +++ b/manifests/profile/base/monitoring/uchiwa.pp @@ -23,9 +23,9 @@ # Defaults to hiera('step') # class tripleo::profile::base::monitoring::uchiwa ( - $step = hiera('step', undef), + $step = Integer(hiera('step')), ) { - if $step == undef or $step >= 3 { + if $step >= 3 { include ::uchiwa } } diff --git a/manifests/profile/base/neutron.pp b/manifests/profile/base/neutron.pp index 2f01b75..e409261 100644 --- a/manifests/profile/base/neutron.pp +++ b/manifests/profile/base/neutron.pp @@ -80,7 +80,7 @@ # class tripleo::profile::base::neutron ( - $step = hiera('step'), + $step = Integer(hiera('step')), $oslomsg_rpc_proto = hiera('messaging_rpc_service_name', 'rabbit'), $oslomsg_rpc_hosts = any2array(hiera('rabbitmq_node_names', undef)), $oslomsg_rpc_password = hiera('neutron::rabbit_password'), diff --git a/manifests/profile/base/neutron/agents/bagpipe.pp b/manifests/profile/base/neutron/agents/bagpipe.pp index fb5e000..de5bc17 100644 --- a/manifests/profile/base/neutron/agents/bagpipe.pp +++ b/manifests/profile/base/neutron/agents/bagpipe.pp @@ -27,7 +27,7 @@ # Defaults to hiera('step') # class tripleo::profile::base::neutron::agents::bagpipe ( - $step = hiera('step'), + $step = Integer(hiera('step')), ) { include ::tripleo::profile::base::neutron diff --git a/manifests/profile/base/neutron/agents/bigswitch.pp b/manifests/profile/base/neutron/agents/bigswitch.pp index 137dec0..e79c8a2 100644 --- a/manifests/profile/base/neutron/agents/bigswitch.pp +++ b/manifests/profile/base/neutron/agents/bigswitch.pp @@ -23,7 +23,7 @@ # Defaults to hiera('step') # class tripleo::profile::base::neutron::agents::bigswitch( - $step = hiera('step'), + $step = Integer(hiera('step')), ) { if $step >= 4 { include ::neutron::agents::bigswitch diff --git a/manifests/profile/base/neutron/agents/l2gw.pp b/manifests/profile/base/neutron/agents/l2gw.pp index 10cd662..a728fa3 100644 --- a/manifests/profile/base/neutron/agents/l2gw.pp +++ b/manifests/profile/base/neutron/agents/l2gw.pp @@ -27,7 +27,7 @@ # Defaults to hiera('step') # class tripleo::profile::base::neutron::agents::l2gw ( - $step = hiera('step'), + $step = Integer(hiera('step')), ) { if $step >= 4 { include ::neutron::agents::l2gw diff --git a/manifests/profile/base/neutron/agents/midonet.pp b/manifests/profile/base/neutron/agents/midonet.pp index f2ce94a..c967589 100644 --- a/manifests/profile/base/neutron/agents/midonet.pp +++ b/manifests/profile/base/neutron/agents/midonet.pp @@ -33,7 +33,7 @@ class tripleo::profile::base::neutron::agents::midonet ( $midonet_libvirt_qemu_data = hiera('midonet_libvirt_qemu_data', ''), $neutron_api_node_ips = hiera('neutron_api_node_ips', ''), - $step = hiera('step'), + $step = Integer(hiera('step')), ) { if $step >= 4 { # TODO(devvesa) provide non-controller ips for these services diff --git a/manifests/profile/base/neutron/agents/nuage.pp b/manifests/profile/base/neutron/agents/nuage.pp index 80beceb..2358a04 100644 --- a/manifests/profile/base/neutron/agents/nuage.pp +++ b/manifests/profile/base/neutron/agents/nuage.pp @@ -43,7 +43,7 @@ class tripleo::profile::base::neutron::agents::nuage ( $nova_metadata_ip = hiera('nova_metadata_node_ips', ''), $nova_os_password = hiera('nova_password', ''), $nova_os_tenant_name = hiera('nova::api::admin_tenant_name', ''), - $step = hiera('step'), + $step = Integer(hiera('step')), ) { if $step >= 4 { include ::nuage::vrs diff --git a/manifests/profile/base/neutron/agents/ovn.pp b/manifests/profile/base/neutron/agents/ovn.pp index a593092..9f37bbf 100644 --- a/manifests/profile/base/neutron/agents/ovn.pp +++ b/manifests/profile/base/neutron/agents/ovn.pp @@ -32,7 +32,7 @@ class tripleo::profile::base::neutron::agents::ovn ( $ovn_db_host = hiera('ovn_dbs_vip'), $ovn_sbdb_port = hiera('ovn::southbound::port'), - $step = hiera('step') + $step = Integer(hiera('step')) ) { if $step >= 4 { class { '::ovn::controller': diff --git a/manifests/profile/base/neutron/agents/vpp.pp b/manifests/profile/base/neutron/agents/vpp.pp index e961aa7..6c55b86 100644 --- a/manifests/profile/base/neutron/agents/vpp.pp +++ b/manifests/profile/base/neutron/agents/vpp.pp @@ -32,7 +32,7 @@ # Defaults to 2379 # class tripleo::profile::base::neutron::agents::vpp( - $step = hiera('step'), + $step = Integer(hiera('step')), $etcd_host = hiera('etcd_vip'), $etcd_port = 2379, ) { diff --git a/manifests/profile/base/neutron/bgpvpn.pp b/manifests/profile/base/neutron/bgpvpn.pp index d6fdf4e..b2187df 100644 --- a/manifests/profile/base/neutron/bgpvpn.pp +++ b/manifests/profile/base/neutron/bgpvpn.pp @@ -27,7 +27,7 @@ # Defaults to hiera('step') # class tripleo::profile::base::neutron::bgpvpn ( - $step = hiera('step'), + $step = Integer(hiera('step')), ) { include ::tripleo::profile::base::neutron diff --git a/manifests/profile/base/neutron/dhcp.pp b/manifests/profile/base/neutron/dhcp.pp index 24b1a35..54904f2 100644 --- a/manifests/profile/base/neutron/dhcp.pp +++ b/manifests/profile/base/neutron/dhcp.pp @@ -24,7 +24,7 @@ # Defaults to hiera('step') # class tripleo::profile::base::neutron::dhcp ( - $step = hiera('step'), + $step = Integer(hiera('step')), ) { if $step >= 4 { include ::tripleo::profile::base::neutron diff --git a/manifests/profile/base/neutron/l2gw.pp b/manifests/profile/base/neutron/l2gw.pp index da71108..cd6239e 100644 --- a/manifests/profile/base/neutron/l2gw.pp +++ b/manifests/profile/base/neutron/l2gw.pp @@ -27,7 +27,7 @@ # Defaults to hiera('step') # class tripleo::profile::base::neutron::l2gw ( - $step = hiera('step'), + $step = Integer(hiera('step')), ) { include ::tripleo::profile::base::neutron diff --git a/manifests/profile/base/neutron/l3.pp b/manifests/profile/base/neutron/l3.pp index 14ffa82..90d8ace 100644 --- a/manifests/profile/base/neutron/l3.pp +++ b/manifests/profile/base/neutron/l3.pp @@ -24,7 +24,7 @@ # Defaults to hiera('step') # class tripleo::profile::base::neutron::l3 ( - $step = hiera('step'), + $step = Integer(hiera('step')), ) { if $step >= 4 { include ::tripleo::profile::base::neutron diff --git a/manifests/profile/base/neutron/lbaas.pp b/manifests/profile/base/neutron/lbaas.pp new file mode 100644 index 0000000..8bce0b1 --- /dev/null +++ b/manifests/profile/base/neutron/lbaas.pp @@ -0,0 +1,44 @@ +# Copyright 2016 Red Hat, Inc. +# +# Licensed under the Apache License, Version 2.0 (the "License"); you may +# not use this file except in compliance with the License. You may obtain +# a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT +# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the +# License for the specific language governing permissions and limitations +# under the License. +# +# == Class: tripleo::profile::base::neutron::lbaas +# +# Neutron LBaaS Agent profile for tripleo +# +# === Parameters +# +# [*manage_haproxy_package*] +# (Optional) Whether to manage the haproxy package. +# Defaults to hiera('manage_haproxy_package', false) +# +# [*step*] +# (Optional) The current step in deployment. See tripleo-heat-templates +# for more details. +# Defaults to hiera('step') +# +class tripleo::profile::base::neutron::lbaas( + $manage_haproxy_package = hiera('manage_haproxy_package', false), + $step = Integer(hiera('step')), +) { + + include ::tripleo::profile::base::neutron + + #LBaaS Driver needs to be run @ $step>=5 as the neutron service needs to already be active which is run @ $step==4 + if $step >= 5 { + include ::neutron::services::lbaas + class {'::neutron::agents::lbaas': + manage_haproxy_package => $manage_haproxy_package + } + } +} diff --git a/manifests/profile/base/neutron/linuxbridge.pp b/manifests/profile/base/neutron/linuxbridge.pp index 9f4899a..36be214 100644 --- a/manifests/profile/base/neutron/linuxbridge.pp +++ b/manifests/profile/base/neutron/linuxbridge.pp @@ -10,7 +10,7 @@ # Defaults to hiera('step') # class tripleo::profile::base::neutron::linuxbridge( - $step = hiera('step'), + $step = Integer(hiera('step')), ) { include ::tripleo::profile::base::neutron diff --git a/manifests/profile/base/neutron/metadata.pp b/manifests/profile/base/neutron/metadata.pp index 4cc6748..66de883 100644 --- a/manifests/profile/base/neutron/metadata.pp +++ b/manifests/profile/base/neutron/metadata.pp @@ -24,7 +24,7 @@ # Defaults to hiera('step') # class tripleo::profile::base::neutron::metadata ( - $step = hiera('step'), + $step = Integer(hiera('step')), ) { if $step >= 4 { include ::tripleo::profile::base::neutron diff --git a/manifests/profile/base/neutron/midonet.pp b/manifests/profile/base/neutron/midonet.pp index 3ba9dd9..0e40ede 100644 --- a/manifests/profile/base/neutron/midonet.pp +++ b/manifests/profile/base/neutron/midonet.pp @@ -69,7 +69,7 @@ class tripleo::profile::base::neutron::midonet ( $neutron_api_node_ips = hiera('neutron_api_node_ips', ''), $neutron_auth_password = hiera('neutron::keystone::authtoken::password', ''), $neutron_auth_tenant = hiera('neutron::keystone::authtoken::project_name', ''), - $step = hiera('step'), + $step = Integer(hiera('step')), $vip = hiera('public_virtual_ip'), $zk_on_controller = hiera('enable_zookeeper_on_controller', ''), $zookeeper_client_ip = hiera('neutron::bind_host', ''), diff --git a/manifests/profile/base/neutron/n1k.pp b/manifests/profile/base/neutron/n1k.pp index 8c8cfbd..e61023d 100644 --- a/manifests/profile/base/neutron/n1k.pp +++ b/manifests/profile/base/neutron/n1k.pp @@ -34,7 +34,7 @@ class tripleo::profile::base::neutron::n1k ( $n1kv_source = hiera('n1kv_vem_source', undef), $n1kv_version = hiera('n1kv_vem_version', undef), - $step = hiera('step'), + $step = Integer(hiera('step')), ) { include ::neutron::plugins::ml2::cisco::nexus1000v include ::tripleo::profile::base::neutron diff --git a/manifests/profile/base/neutron/opencontrail/vrouter.pp b/manifests/profile/base/neutron/opencontrail/vrouter.pp index 90ab71c..4330dc4 100644 --- a/manifests/profile/base/neutron/opencontrail/vrouter.pp +++ b/manifests/profile/base/neutron/opencontrail/vrouter.pp @@ -23,7 +23,7 @@ # Defaults to hiera('step') # class tripleo::profile::base::neutron::opencontrail::vrouter ( - $step = hiera('step'), + $step = Integer(hiera('step')), ) { if $step >= 4 { diff --git a/manifests/profile/base/neutron/opendaylight.pp b/manifests/profile/base/neutron/opendaylight.pp index b5e6d11..5d25ae2 100644 --- a/manifests/profile/base/neutron/opendaylight.pp +++ b/manifests/profile/base/neutron/opendaylight.pp @@ -31,7 +31,7 @@ # Defaults to hiera('bootstack_nodeid') # class tripleo::profile::base::neutron::opendaylight ( - $step = hiera('step'), + $step = Integer(hiera('step')), $odl_api_ips = hiera('opendaylight_api_node_ips'), $node_name = hiera('bootstack_nodeid') ) { diff --git a/manifests/profile/base/neutron/ovn_northd.pp b/manifests/profile/base/neutron/ovn_northd.pp index 0b46d5c..721e84e 100644 --- a/manifests/profile/base/neutron/ovn_northd.pp +++ b/manifests/profile/base/neutron/ovn_northd.pp @@ -27,7 +27,7 @@ # class tripleo::profile::base::neutron::ovn_northd ( $bootstrap_node = hiera('bootstrap_nodeid', undef), - $step = hiera('step'), + $step = Integer(hiera('step')), ) { if $step >= 4 { # Note this only runs on the first node in the cluster when diff --git a/manifests/profile/base/neutron/ovs.pp b/manifests/profile/base/neutron/ovs.pp index 97eb8e9..8794d74 100644 --- a/manifests/profile/base/neutron/ovs.pp +++ b/manifests/profile/base/neutron/ovs.pp @@ -29,7 +29,7 @@ # client mode. class tripleo::profile::base::neutron::ovs( - $step = hiera('step'), + $step = Integer(hiera('step')), $vhostuser_socket_dir = hiera('neutron::agents::ml2::ovs::vhostuser_socket_dir', undef) ) { include ::tripleo::profile::base::neutron diff --git a/manifests/profile/base/neutron/plugins/ml2.pp b/manifests/profile/base/neutron/plugins/ml2.pp index 1702fed..1f440fa 100644 --- a/manifests/profile/base/neutron/plugins/ml2.pp +++ b/manifests/profile/base/neutron/plugins/ml2.pp @@ -34,7 +34,7 @@ class tripleo::profile::base::neutron::plugins::ml2 ( $bootstrap_node = hiera('bootstrap_nodeid', undef), $mechanism_drivers = hiera('neutron::plugins::ml2::mechanism_drivers'), - $step = hiera('step'), + $step = Integer(hiera('step')), ) { if $::hostname == downcase($bootstrap_node) { $sync_db = true @@ -85,5 +85,9 @@ class tripleo::profile::base::neutron::plugins::ml2 ( if 'vpp' in $mechanism_drivers { include ::tripleo::profile::base::neutron::plugins::ml2::vpp } + + if 'nuage' in $mechanism_drivers { + include ::tripleo::profile::base::neutron::plugins::ml2::nuage + } } } diff --git a/manifests/profile/base/neutron/plugins/ml2/bagpipe.pp b/manifests/profile/base/neutron/plugins/ml2/bagpipe.pp index 161cd75..44521ef 100644 --- a/manifests/profile/base/neutron/plugins/ml2/bagpipe.pp +++ b/manifests/profile/base/neutron/plugins/ml2/bagpipe.pp @@ -27,7 +27,7 @@ # Defaults to hiera('step') # class tripleo::profile::base::neutron::plugins::ml2::bagpipe ( - $step = hiera('step'), + $step = Integer(hiera('step')), ) { include ::tripleo::profile::base::neutron diff --git a/manifests/profile/base/neutron/plugins/ml2/nuage.pp b/manifests/profile/base/neutron/plugins/ml2/nuage.pp new file mode 100644 index 0000000..e9608d0 --- /dev/null +++ b/manifests/profile/base/neutron/plugins/ml2/nuage.pp @@ -0,0 +1,31 @@ +# Copyright 2017 Nuage Networks from Nokia Inc. +# +# Licensed under the Apache License, Version 2.0 (the "License"); you may +# not use this file except in compliance with the License. You may obtain +# a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT +# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the +# License for the specific language governing permissions and limitations +# under the License. +# +# == Class: tripleo::profile::base::neutron::plugins::ml2::nuage +# +# Nuage Neutron ML2 profile for tripleo +# +# [*step*] +# (Optional) The current step in deployment. See tripleo-heat-templates +# for more details. +# Defaults to hiera('step') +# +class tripleo::profile::base::neutron::plugins::ml2::nuage ( + $step = hiera('step'), +) { + + if $step >= 4 { + include ::neutron::plugins::ml2::nuage + } +} diff --git a/manifests/profile/base/neutron/plugins/ml2/opendaylight.pp b/manifests/profile/base/neutron/plugins/ml2/opendaylight.pp index 2618d4f..bffcb39 100644 --- a/manifests/profile/base/neutron/plugins/ml2/opendaylight.pp +++ b/manifests/profile/base/neutron/plugins/ml2/opendaylight.pp @@ -49,7 +49,7 @@ class tripleo::profile::base::neutron::plugins::ml2::opendaylight ( $odl_password = hiera('opendaylight::password'), $odl_url_ip = hiera('opendaylight_api_vip'), $conn_proto = hiera('opendaylight::nb_connection_protocol'), - $step = hiera('step'), + $step = Integer(hiera('step')), ) { if $step >= 4 { diff --git a/manifests/profile/base/neutron/plugins/ml2/ovn.pp b/manifests/profile/base/neutron/plugins/ml2/ovn.pp index b5b7a0a..fad907c 100644 --- a/manifests/profile/base/neutron/plugins/ml2/ovn.pp +++ b/manifests/profile/base/neutron/plugins/ml2/ovn.pp @@ -37,7 +37,7 @@ class tripleo::profile::base::neutron::plugins::ml2::ovn ( $ovn_db_host = hiera('ovn_dbs_vip'), $ovn_nb_port = hiera('ovn::northbound::port'), $ovn_sb_port = hiera('ovn::southbound::port'), - $step = hiera('step') + $step = Integer(hiera('step')) ) { if $step >= 4 { class { '::neutron::plugins::ml2::ovn': diff --git a/manifests/profile/base/neutron/plugins/ml2/vpp.pp b/manifests/profile/base/neutron/plugins/ml2/vpp.pp index 217e4cf..7d59239 100644 --- a/manifests/profile/base/neutron/plugins/ml2/vpp.pp +++ b/manifests/profile/base/neutron/plugins/ml2/vpp.pp @@ -32,7 +32,7 @@ # Defaults to 2379 # class tripleo::profile::base::neutron::plugins::ml2::vpp ( - $step = hiera('step'), + $step = Integer(hiera('step')), $etcd_host = hiera('etcd_vip'), $etcd_port = 2379, ) { diff --git a/manifests/profile/base/neutron/plugins/nsx_v3.pp b/manifests/profile/base/neutron/plugins/nsx_v3.pp index 33fa0cf..b534a2f 100644 --- a/manifests/profile/base/neutron/plugins/nsx_v3.pp +++ b/manifests/profile/base/neutron/plugins/nsx_v3.pp @@ -29,7 +29,7 @@ # class tripleo::profile::base::neutron::plugins::nsx_v3 ( $bootstrap_node = hiera('bootstrap_nodeid', undef), - $step = hiera('step'), + $step = Integer(hiera('step')), ) { if $::hostname == downcase($bootstrap_node) { $sync_db = true diff --git a/manifests/profile/base/neutron/plugins/nuage.pp b/manifests/profile/base/neutron/plugins/nuage.pp index 0843ec4..ccfcae1 100644 --- a/manifests/profile/base/neutron/plugins/nuage.pp +++ b/manifests/profile/base/neutron/plugins/nuage.pp @@ -27,7 +27,7 @@ # class tripleo::profile::base::neutron::plugins::nuage ( $bootstrap_node = hiera('bootstrap_nodeid', undef), - $step = hiera('step'), + $step = Integer(hiera('step')), ) { if $::hostname == downcase($bootstrap_node) { $sync_db = true diff --git a/manifests/profile/base/neutron/plugins/opencontrail.pp b/manifests/profile/base/neutron/plugins/opencontrail.pp index fbf46e7..d13af61 100644 --- a/manifests/profile/base/neutron/plugins/opencontrail.pp +++ b/manifests/profile/base/neutron/plugins/opencontrail.pp @@ -27,7 +27,7 @@ # class tripleo::profile::base::neutron::plugins::opencontrail ( $bootstrap_node = hiera('bootstrap_nodeid', undef), - $step = hiera('step'), + $step = Integer(hiera('step')), ) { if $::hostname == downcase($bootstrap_node) { $sync_db = true diff --git a/manifests/profile/base/neutron/plugins/ovs/opendaylight.pp b/manifests/profile/base/neutron/plugins/ovs/opendaylight.pp index 4da8df9..59060a6 100644 --- a/manifests/profile/base/neutron/plugins/ovs/opendaylight.pp +++ b/manifests/profile/base/neutron/plugins/ovs/opendaylight.pp @@ -49,7 +49,7 @@ class tripleo::profile::base::neutron::plugins::ovs::opendaylight ( $odl_api_ips = hiera('opendaylight_api_node_ips'), $odl_url_ip = hiera('opendaylight_api_vip'), $conn_proto = hiera('opendaylight::nb_connection_protocol'), - $step = hiera('step'), + $step = Integer(hiera('step')), ) { if $step >= 4 { diff --git a/manifests/profile/base/neutron/plugins/plumgrid.pp b/manifests/profile/base/neutron/plugins/plumgrid.pp index bc73d29..606f001 100644 --- a/manifests/profile/base/neutron/plugins/plumgrid.pp +++ b/manifests/profile/base/neutron/plugins/plumgrid.pp @@ -29,7 +29,7 @@ # class tripleo::profile::base::neutron::plugins::plumgrid ( $bootstrap_node = hiera('bootstrap_nodeid', undef), - $step = hiera('step'), + $step = Integer(hiera('step')), ) { if $::hostname == downcase($bootstrap_node) { $sync_db = true diff --git a/manifests/profile/base/neutron/plumgrid.pp b/manifests/profile/base/neutron/plumgrid.pp index 03dc101..cafeefe 100644 --- a/manifests/profile/base/neutron/plumgrid.pp +++ b/manifests/profile/base/neutron/plumgrid.pp @@ -22,7 +22,7 @@ # Defaults to hiera('step') # class tripleo::profile::base::neutron::plumgrid ( - $step = hiera('step'), + $step = Integer(hiera('step')), ) { if $step >= 4 { diff --git a/manifests/profile/base/neutron/server.pp b/manifests/profile/base/neutron/server.pp index d67a40c..0dee53e 100644 --- a/manifests/profile/base/neutron/server.pp +++ b/manifests/profile/base/neutron/server.pp @@ -90,7 +90,7 @@ class tripleo::profile::base::neutron::server ( $l3_ha_override = '', $l3_nodes = hiera('neutron_l3_short_node_names', []), $neutron_network = hiera('neutron_api_network', undef), - $step = hiera('step'), + $step = Integer(hiera('step')), $tls_proxy_bind_ip = undef, $tls_proxy_fqdn = undef, $tls_proxy_port = 9696, diff --git a/manifests/profile/base/neutron/sriov.pp b/manifests/profile/base/neutron/sriov.pp index 24c7b63..3c06beb 100644 --- a/manifests/profile/base/neutron/sriov.pp +++ b/manifests/profile/base/neutron/sriov.pp @@ -23,23 +23,15 @@ # for more details. # Defaults to hiera('step') # -# [*mechanism_drivers*] -# (Optional) The mechanism drivers to use with the Ml2 plugin -# Defaults to hiera('neutron::plugins::ml2::mechanism_drivers') -# class tripleo::profile::base::neutron::sriov( - $step = hiera('step'), - $mechanism_drivers = hiera('neutron::plugins::ml2::mechanism_drivers'), + $step = Integer(hiera('step')) ) { include ::tripleo::profile::base::neutron if $step >= 4 { - if 'sriovnicswitch' in $mechanism_drivers { - include ::neutron::agents::ml2::sriov - include ::tripleo::host::sriov - } + include ::neutron::agents::ml2::sriov + include ::tripleo::host::sriov } - } diff --git a/manifests/profile/base/nova.pp b/manifests/profile/base/nova.pp index d786940..65e8ebc 100644 --- a/manifests/profile/base/nova.pp +++ b/manifests/profile/base/nova.pp @@ -112,7 +112,7 @@ class tripleo::profile::base::nova ( $oslomsg_notify_username = hiera('nova::rabbit_userid', 'guest'), $oslomsg_use_ssl = hiera('nova::rabbit_use_ssl', '0'), $nova_compute_enabled = false, - $step = hiera('step'), + $step = Integer(hiera('step')), $migration_ssh_key = {}, $migration_ssh_localaddrs = [], $libvirt_tls = false diff --git a/manifests/profile/base/nova/api.pp b/manifests/profile/base/nova/api.pp index bdb3007..0dcc754 100644 --- a/manifests/profile/base/nova/api.pp +++ b/manifests/profile/base/nova/api.pp @@ -57,7 +57,7 @@ class tripleo::profile::base::nova::api ( $enable_internal_tls = hiera('enable_internal_tls', false), $nova_api_network = hiera('nova_api_network', undef), $nova_api_wsgi_enabled = hiera('nova_wsgi_enabled', false), - $step = hiera('step'), + $step = Integer(hiera('step')), ) { if $::hostname == downcase($bootstrap_node) { $sync_db = true diff --git a/manifests/profile/base/nova/authtoken.pp b/manifests/profile/base/nova/authtoken.pp index ee6c331..d8285ba 100644 --- a/manifests/profile/base/nova/authtoken.pp +++ b/manifests/profile/base/nova/authtoken.pp @@ -35,7 +35,7 @@ # Defaults to hiera('memcached_node_ips', ['127.0.0.1']) # class tripleo::profile::base::nova::authtoken ( - $step = hiera('step'), + $step = Integer(hiera('step')), $use_ipv6 = hiera('nova::use_ipv6', false), $memcache_nodes_ipv6 = hiera('memcached_node_ips_v6', ['::1']), $memcache_nodes_ipv4 = hiera('memcached_node_ips', ['127.0.0.1']), diff --git a/manifests/profile/base/nova/compute.pp b/manifests/profile/base/nova/compute.pp index 84b8bd5..bd50204 100644 --- a/manifests/profile/base/nova/compute.pp +++ b/manifests/profile/base/nova/compute.pp @@ -28,7 +28,7 @@ # Defaults to hiera('cinder_enable_nfs_backend', false) # class tripleo::profile::base::nova::compute ( - $step = hiera('step'), + $step = Integer(hiera('step')), $cinder_nfs_backend = hiera('cinder_enable_nfs_backend', false), ) { diff --git a/manifests/profile/base/nova/compute/ironic.pp b/manifests/profile/base/nova/compute/ironic.pp index c0213fb..52b3020 100644 --- a/manifests/profile/base/nova/compute/ironic.pp +++ b/manifests/profile/base/nova/compute/ironic.pp @@ -24,7 +24,7 @@ # Defaults to hiera('step') # class tripleo::profile::base::nova::compute::ironic ( - $step = hiera('step'), + $step = Integer(hiera('step')), ) { if $step >= 4 { include ::tripleo::profile::base::nova::compute diff --git a/manifests/profile/base/nova/compute/libvirt.pp b/manifests/profile/base/nova/compute/libvirt.pp index cc9beb6..ec592cb 100644 --- a/manifests/profile/base/nova/compute/libvirt.pp +++ b/manifests/profile/base/nova/compute/libvirt.pp @@ -24,7 +24,7 @@ # Defaults to hiera('step') # class tripleo::profile::base::nova::compute::libvirt ( - $step = hiera('step'), + $step = Integer(hiera('step')), ) { if $step >= 4 { include ::tripleo::profile::base::nova::compute diff --git a/manifests/profile/base/nova/conductor.pp b/manifests/profile/base/nova/conductor.pp index fa9f12b..d9d55d2 100644 --- a/manifests/profile/base/nova/conductor.pp +++ b/manifests/profile/base/nova/conductor.pp @@ -24,7 +24,7 @@ # Defaults to hiera('step') # class tripleo::profile::base::nova::conductor ( - $step = hiera('step'), + $step = Integer(hiera('step')), ) { include ::tripleo::profile::base::nova if $step >= 4 { diff --git a/manifests/profile/base/nova/consoleauth.pp b/manifests/profile/base/nova/consoleauth.pp index 8ccfb8c..4c2807c 100644 --- a/manifests/profile/base/nova/consoleauth.pp +++ b/manifests/profile/base/nova/consoleauth.pp @@ -24,7 +24,7 @@ # Defaults to hiera('step') # class tripleo::profile::base::nova::consoleauth ( - $step = hiera('step'), + $step = Integer(hiera('step')), ) { if $step >= 4 { include ::tripleo::profile::base::nova diff --git a/manifests/profile/base/nova/ec2api.pp b/manifests/profile/base/nova/ec2api.pp index f8817d2..00a6a14 100644 --- a/manifests/profile/base/nova/ec2api.pp +++ b/manifests/profile/base/nova/ec2api.pp @@ -24,7 +24,7 @@ # Defaults to hiera('step') # class tripleo::profile::base::nova::ec2api ( - $step = hiera('step') + $step = Integer(hiera('step')) ) { if $step >= 4 { include ::ec2api diff --git a/manifests/profile/base/nova/libvirt.pp b/manifests/profile/base/nova/libvirt.pp index 889b80d..b639858 100644 --- a/manifests/profile/base/nova/libvirt.pp +++ b/manifests/profile/base/nova/libvirt.pp @@ -24,7 +24,7 @@ # Defaults to hiera('step') # class tripleo::profile::base::nova::libvirt ( - $step = hiera('step'), + $step = Integer(hiera('step')), ) { if $step >= 4 { include ::tripleo::profile::base::nova diff --git a/manifests/profile/base/nova/placement.pp b/manifests/profile/base/nova/placement.pp index c78b3c2..ac78287 100644 --- a/manifests/profile/base/nova/placement.pp +++ b/manifests/profile/base/nova/placement.pp @@ -51,7 +51,7 @@ class tripleo::profile::base::nova::placement ( $certificates_specs = hiera('apache_certificates_specs', {}), $enable_internal_tls = hiera('enable_internal_tls', false), $nova_placement_network = hiera('nova_placement_network', undef), - $step = hiera('step'), + $step = Integer(hiera('step')), ) { if $::hostname == downcase($bootstrap_node) { $sync_db = true diff --git a/manifests/profile/base/nova/scheduler.pp b/manifests/profile/base/nova/scheduler.pp index 3c9b2c2..a9db318 100644 --- a/manifests/profile/base/nova/scheduler.pp +++ b/manifests/profile/base/nova/scheduler.pp @@ -24,7 +24,7 @@ # Defaults to hiera('step') # class tripleo::profile::base::nova::scheduler ( - $step = hiera('step'), + $step = Integer(hiera('step')), ) { if $step >= 4 { include ::tripleo::profile::base::nova diff --git a/manifests/profile/base/nova/vncproxy.pp b/manifests/profile/base/nova/vncproxy.pp index f654fef..25ab3fe 100644 --- a/manifests/profile/base/nova/vncproxy.pp +++ b/manifests/profile/base/nova/vncproxy.pp @@ -24,7 +24,7 @@ # Defaults to hiera('step') # class tripleo::profile::base::nova::vncproxy ( - $step = hiera('step'), + $step = Integer(hiera('step')), ) { if $step >= 4 { include ::tripleo::profile::base::nova diff --git a/manifests/profile/base/novajoin.pp b/manifests/profile/base/novajoin.pp new file mode 100644 index 0000000..c28508b --- /dev/null +++ b/manifests/profile/base/novajoin.pp @@ -0,0 +1,83 @@ +# Copyright 2017 Red Hat, Inc. +# +# Licensed under the Apache License, Version 2.0 (the "License"); you may +# not use this file except in compliance with the License. You may obtain +# a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT +# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the +# License for the specific language governing permissions and limitations +# under the License. +# +# == Class: tripleo::profile::base::novajoin +# +# novajoin vendordata plugin profile for tripleo +# +# === Parameters +# +# [*service_password*] +# The password for the novajoin service. +# +# [*enable_ipa_client_install*] +# Enable FreeIPA client installation for the node this runs on. +# Defaults to false +# +# [*oslomsg_rpc_hosts*] +# list of the oslo messaging rpc host fqdns +# Defaults to hiera('rabbitmq_node_names') +# +# [*oslomsg_rpc_proto*] +# Protocol driver for the oslo messaging rpc service +# Defaults to hiera('messaging_rpc_service_name', rabbit) +# +# [*oslomsg_rpc_password*] +# Password for oslo messaging rpc service +# Defaults to undef +# +# [*oslomsg_rpc_port*] +# IP port for oslo messaging rpc service +# Defaults to '5672' +# +# [*oslomsg_rpc_username*] +# Username for oslo messaging rpc service +# Defaults to 'guest' +# +# [*oslomsg_use_ssl*] +# Enable ssl oslo messaging services +# Defaults to '0' +# +# [*step*] +# (Optional) The current step of the deployment +# Defaults to hiera('step') +# + +class tripleo::profile::base::novajoin ( + $service_password, + $enable_ipa_client_install = false, + $oslomsg_rpc_hosts = any2array(hiera('rabbitmq_node_names', undef)), + $oslomsg_rpc_proto = hiera('messaging_rpc_service_name', 'rabbit'), + $oslomsg_rpc_password = undef, + $oslomsg_rpc_port = '5672', + $oslomsg_rpc_username = 'guest', + $oslomsg_use_ssl = '0', + $step = Integer(hiera('step')), +) { + if $step >= 3 { + $oslomsg_use_ssl_real = sprintf('%s', bool2num(str2bool($oslomsg_use_ssl))) + class { '::nova::metadata::novajoin::api' : + service_password => $service_password, + enable_ipa_client_install => $enable_ipa_client_install, + transport_url => os_transport_url({ + 'transport' => $oslomsg_rpc_proto, + 'hosts' => $oslomsg_rpc_hosts, + 'port' => sprintf('%s', $oslomsg_rpc_port), + 'username' => $oslomsg_rpc_username, + 'password' => $oslomsg_rpc_password, + 'ssl' => $oslomsg_use_ssl_real, + }), + } + } +} diff --git a/manifests/profile/base/octavia.pp b/manifests/profile/base/octavia.pp index e8310d8..00252e3 100644 --- a/manifests/profile/base/octavia.pp +++ b/manifests/profile/base/octavia.pp @@ -47,7 +47,7 @@ # Defaults to hiera('octavia::rabbit_use_ssl', '0') class tripleo::profile::base::octavia ( - $step = hiera('step'), + $step = Integer(hiera('step')), $oslomsg_rpc_proto = hiera('messaging_rpc_service_name', 'rabbit'), $oslomsg_rpc_hosts = any2array(hiera('rabbitmq_node_names', undef)), $oslomsg_rpc_password = hiera('octavia::rabbit_password'), diff --git a/manifests/profile/base/octavia/api.pp b/manifests/profile/base/octavia/api.pp index d457478..2604711 100644 --- a/manifests/profile/base/octavia/api.pp +++ b/manifests/profile/base/octavia/api.pp @@ -29,7 +29,7 @@ # class tripleo::profile::base::octavia::api ( $bootstrap_node = hiera('bootstrap_nodeid', undef), - $step = hiera('step'), + $step = Integer(hiera('step')), ) { if $::hostname == downcase($bootstrap_node) { $sync_db = true diff --git a/manifests/profile/base/octavia/health_manager.pp b/manifests/profile/base/octavia/health_manager.pp index bac5f65..8bb486a 100644 --- a/manifests/profile/base/octavia/health_manager.pp +++ b/manifests/profile/base/octavia/health_manager.pp @@ -24,7 +24,7 @@ # Defaults to hiera('step') # class tripleo::profile::base::octavia::health_manager ( - $step = hiera('step'), + $step = Integer(hiera('step')), ) { include ::tripleo::profile::base::octavia if $step >= 5 { diff --git a/manifests/profile/base/octavia/housekeeping.pp b/manifests/profile/base/octavia/housekeeping.pp index 0dcd5cf..d6f85ac 100644 --- a/manifests/profile/base/octavia/housekeeping.pp +++ b/manifests/profile/base/octavia/housekeeping.pp @@ -24,7 +24,7 @@ # Defaults to hiera('step') # class tripleo::profile::base::octavia::housekeeping ( - $step = hiera('step'), + $step = Integer(hiera('step')), ) { include ::tripleo::profile::base::octavia diff --git a/manifests/profile/base/octavia/worker.pp b/manifests/profile/base/octavia/worker.pp index 7df324d..ce49455 100644 --- a/manifests/profile/base/octavia/worker.pp +++ b/manifests/profile/base/octavia/worker.pp @@ -24,7 +24,7 @@ # Defaults to hiera('step') # class tripleo::profile::base::octavia::worker ( - $step = hiera('step'), + $step = Integer(hiera('step')), ) { include ::tripleo::profile::base::octavia diff --git a/manifests/profile/base/pacemaker.pp b/manifests/profile/base/pacemaker.pp index 811b911..bc15e62 100644 --- a/manifests/profile/base/pacemaker.pp +++ b/manifests/profile/base/pacemaker.pp @@ -64,7 +64,7 @@ # Defaults to hiera('pacemaker_cluster_recheck_interval', undef) # class tripleo::profile::base::pacemaker ( - $step = hiera('step'), + $step = Integer(hiera('step')), $pcs_tries = hiera('pcs_tries', 20), $remote_short_node_names = hiera('pacemaker_remote_short_node_names', []), $remote_node_ips = hiera('pacemaker_remote_node_ips', []), @@ -111,9 +111,11 @@ class tripleo::profile::base::pacemaker ( cluster_setup_extras => $cluster_setup_extras, remote_authkey => $remote_authkey, } - class { '::pacemaker::stonith': - disable => !$enable_fencing, - tries => $pcs_tries, + if $pacemaker_master { + class { '::pacemaker::stonith': + disable => !$enable_fencing, + tries => $pcs_tries, + } } if $enable_fencing { include ::tripleo::fencing diff --git a/manifests/profile/base/pacemaker_remote.pp b/manifests/profile/base/pacemaker_remote.pp index e0fff63..f4265ff 100644 --- a/manifests/profile/base/pacemaker_remote.pp +++ b/manifests/profile/base/pacemaker_remote.pp @@ -22,6 +22,14 @@ # Authkey for pacemaker remote nodes # Defaults to unset # +# [*pcs_tries*] +# (Optional) The number of times pcs commands should be retried. +# Defaults to hiera('pcs_tries', 20) +# +# [*enable_fencing*] +# (Optional) Whether or not to manage stonith devices for nodes +# Defaults to hiera('enable_fencing', false) +# # [*step*] # (Optional) The current step in deployment. See tripleo-heat-templates # for more details. @@ -29,9 +37,21 @@ # class tripleo::profile::base::pacemaker_remote ( $remote_authkey, - $step = hiera('step'), + $pcs_tries = hiera('pcs_tries', 20), + $enable_fencing = hiera('enable_fencing', false), + $step = Integer(hiera('step')), ) { class { '::pacemaker::remote': remote_authkey => $remote_authkey, } + $enable_fencing_real = str2bool($enable_fencing) and $step >= 5 + + if $enable_fencing_real { + include ::tripleo::fencing + + # enable stonith after all Pacemaker resources have been created + Pcmk_resource<||> -> Class['tripleo::fencing'] + Pcmk_constraint<||> -> Class['tripleo::fencing'] + Exec <| tag == 'pacemaker_constraint' |> -> Class['tripleo::fencing'] + } } diff --git a/manifests/profile/base/panko.pp b/manifests/profile/base/panko.pp index 286e4ac..8c31339 100644 --- a/manifests/profile/base/panko.pp +++ b/manifests/profile/base/panko.pp @@ -25,7 +25,7 @@ # class tripleo::profile::base::panko ( - $step = hiera('step'), + $step = Integer(hiera('step')), ) { if $step >= 3 { include ::panko diff --git a/manifests/profile/base/panko/api.pp b/manifests/profile/base/panko/api.pp index 165969f..3b1b8d9 100644 --- a/manifests/profile/base/panko/api.pp +++ b/manifests/profile/base/panko/api.pp @@ -53,7 +53,7 @@ class tripleo::profile::base::panko::api ( $certificates_specs = hiera('apache_certificates_specs', {}), $enable_internal_tls = hiera('enable_internal_tls', false), $panko_network = hiera('panko_api_network', undef), - $step = hiera('step'), + $step = Integer(hiera('step')), ) { if $::hostname == downcase($bootstrap_node) { $sync_db = true diff --git a/manifests/profile/base/qdr.pp b/manifests/profile/base/qdr.pp index 9827f2e..37cf9e5 100644 --- a/manifests/profile/base/qdr.pp +++ b/manifests/profile/base/qdr.pp @@ -40,7 +40,7 @@ class tripleo::profile::base::qdr ( $qdr_username = undef, $qdr_password = undef, $qdr_listener_port = hiera('tripleo::profile::base::qdr::qdr_listener_port', 5672), - $step = hiera('step'), + $step = Integer(hiera('step')), ) { if $step >= 1 { class { '::qdr': diff --git a/manifests/profile/base/rabbitmq.pp b/manifests/profile/base/rabbitmq.pp index 8551f19..8ab6049 100644 --- a/manifests/profile/base/rabbitmq.pp +++ b/manifests/profile/base/rabbitmq.pp @@ -88,7 +88,7 @@ class tripleo::profile::base::rabbitmq ( $rabbitmq_pass = hiera('rabbitmq::default_pass'), $rabbitmq_user = hiera('rabbitmq::default_user'), $stack_action = hiera('stack_action'), - $step = hiera('step'), + $step = Integer(hiera('step')), ) { if $enable_internal_tls { $tls_certfile = $certificate_specs['service_certificate'] diff --git a/manifests/profile/base/sahara.pp b/manifests/profile/base/sahara.pp index 7f4ecbe..d465304 100644 --- a/manifests/profile/base/sahara.pp +++ b/manifests/profile/base/sahara.pp @@ -72,7 +72,7 @@ class tripleo::profile::base::sahara ( $bootstrap_node = hiera('bootstrap_nodeid', undef), - $step = hiera('step'), + $step = Integer(hiera('step')), $oslomsg_rpc_proto = hiera('messaging_rpc_service_name', 'rabbit'), $oslomsg_rpc_hosts = any2array(hiera('rabbitmq_node_names', undef)), $oslomsg_rpc_password = hiera('sahara::rabbit_password'), diff --git a/manifests/profile/base/sahara/api.pp b/manifests/profile/base/sahara/api.pp index 1ead106..83f1956 100644 --- a/manifests/profile/base/sahara/api.pp +++ b/manifests/profile/base/sahara/api.pp @@ -24,7 +24,7 @@ # Defaults to hiera('step') # class tripleo::profile::base::sahara::api ( - $step = hiera('step'), + $step = Integer(hiera('step')), ) { include ::tripleo::profile::base::sahara diff --git a/manifests/profile/base/sahara/engine.pp b/manifests/profile/base/sahara/engine.pp index e2da0e7..1bbbfa2 100644 --- a/manifests/profile/base/sahara/engine.pp +++ b/manifests/profile/base/sahara/engine.pp @@ -29,7 +29,7 @@ # class tripleo::profile::base::sahara::engine ( $bootstrap_node = hiera('bootstrap_nodeid', undef), - $step = hiera('step'), + $step = Integer(hiera('step')), ) { if $::hostname == downcase($bootstrap_node) { $sync_db = true diff --git a/manifests/profile/base/securetty.pp b/manifests/profile/base/securetty.pp index 07f29f8..5c36fe6 100644 --- a/manifests/profile/base/securetty.pp +++ b/manifests/profile/base/securetty.pp @@ -29,7 +29,7 @@ # Defaults to hiera('securetty::tty_list') # class tripleo::profile::base::securetty ( - $step = hiera('step'), + $step = Integer(hiera('step')), $tty_list = hiera('tty_list', []), ) { validate_array($tty_list) diff --git a/manifests/profile/base/snmp.pp b/manifests/profile/base/snmp.pp index d12e34d..ecef5ae 100644 --- a/manifests/profile/base/snmp.pp +++ b/manifests/profile/base/snmp.pp @@ -34,7 +34,7 @@ class tripleo::profile::base::snmp ( $snmpd_password = hiera('snmpd_readonly_user_password'), $snmpd_user = hiera('snmpd_readonly_user_name'), - $step = hiera('step'), + $step = Integer(hiera('step')), ) { if $step >= 4 { snmp::snmpv3_user { $snmpd_user: diff --git a/manifests/profile/base/swift/proxy.pp b/manifests/profile/base/swift/proxy.pp index 4e0e568..b047c36 100644 --- a/manifests/profile/base/swift/proxy.pp +++ b/manifests/profile/base/swift/proxy.pp @@ -107,7 +107,7 @@ class tripleo::profile::base::swift::proxy ( $enable_internal_tls = hiera('enable_internal_tls', false), $memcache_port = 11211, $memcache_servers = hiera('memcached_node_ips'), - $step = hiera('step'), + $step = Integer(hiera('step')), $swift_proxy_network = hiera('swift_proxy_network', undef), $tls_proxy_bind_ip = undef, $tls_proxy_fqdn = undef, diff --git a/manifests/profile/base/swift/ringbuilder.pp b/manifests/profile/base/swift/ringbuilder.pp index f7cfea4..3ab3234 100644 --- a/manifests/profile/base/swift/ringbuilder.pp +++ b/manifests/profile/base/swift/ringbuilder.pp @@ -69,11 +69,15 @@ # [*swift_ring_put_tempurl*] # PUT tempurl to upload Swift rings to # +# [*skip_consistency_check*] +# If set to true, skip the recon check to ensure rings are identical on all +# nodes. Defaults to false +# class tripleo::profile::base::swift::ringbuilder ( $replicas, $build_ring = true, $devices = undef, - $step = hiera('step'), + $step = Integer(hiera('step')), $swift_zones = '1', $raw_disk_prefix = 'r1z1-', $raw_disks = [], @@ -82,9 +86,10 @@ class tripleo::profile::base::swift::ringbuilder ( $min_part_hours = undef, $swift_ring_get_tempurl = hiera('swift_ring_get_tempurl', ''), $swift_ring_put_tempurl = hiera('swift_ring_put_tempurl', ''), + $skip_consistency_check = false, ) { - if $step == 2 and $swift_ring_get_tempurl != '' { + if $step >= 2 and $swift_ring_get_tempurl != '' { exec{'fetch_swift_ring_tarball': path => ['/usr/bin'], command => "curl --insecure --silent '${swift_ring_get_tempurl}' -o /tmp/swift-rings.tar.gz", @@ -130,22 +135,35 @@ class tripleo::profile::base::swift::ringbuilder ( } Ring_object_device<| |> ~> Exec['rebalance_object'] - Ring_object_device<| |> ~> Exec['rebalance_account'] - Ring_object_device<| |> ~> Exec['rebalance_container'] + Ring_account_device<| |> ~> Exec['rebalance_account'] + Ring_container_device<| |> ~> Exec['rebalance_container'] } } - if $step == 5 and $build_ring and $swift_ring_put_tempurl != '' { - exec{'create_swift_ring_tarball': - path => ['/bin', '/usr/bin'], - command => 'tar cvzf /tmp/swift-rings.tar.gz /etc/swift/*.builder /etc/swift/*.ring.gz /etc/swift/backups/', - unless => 'swift-recon --md5 | grep -q "doesn\'t match"' - } ~> + if $step >= 5 and $build_ring and $swift_ring_put_tempurl != '' { + if $skip_consistency_check { + exec{'create_swift_ring_tarball': + path => ['/bin', '/usr/bin'], + command => 'tar cvzf /tmp/swift-rings.tar.gz /etc/swift/*.builder /etc/swift/*.ring.gz /etc/swift/backups/', + } + } else { + exec{'create_swift_ring_tarball': + path => ['/bin', '/usr/bin'], + command => 'tar cvzf /tmp/swift-rings.tar.gz /etc/swift/*.builder /etc/swift/*.ring.gz /etc/swift/backups/', + unless => 'swift-recon --md5 | grep -q "doesn\'t match"', + } + } exec{'upload_swift_ring_tarball': path => ['/usr/bin'], command => "curl --insecure --silent -X PUT '${$swift_ring_put_tempurl}' --data-binary @/tmp/swift-rings.tar.gz", require => Exec['create_swift_ring_tarball'], refreshonly => true, } + + Exec['rebalance_account'] ~> Exec['create_swift_ring_tarball'] + Exec['rebalance_container'] ~> Exec['create_swift_ring_tarball'] + Exec['rebalance_object'] ~> Exec['create_swift_ring_tarball'] + + Exec['create_swift_ring_tarball'] ~> Exec['upload_swift_ring_tarball'] } } diff --git a/manifests/profile/base/swift/storage.pp b/manifests/profile/base/swift/storage.pp index 5018d77..3d0ba16 100644 --- a/manifests/profile/base/swift/storage.pp +++ b/manifests/profile/base/swift/storage.pp @@ -30,7 +30,7 @@ class tripleo::profile::base::swift::storage ( # Deprecated conditional to support ControllerEnableSwiftStorage parameter $enable_swift_storage = true, - $step = hiera('step'), + $step = Integer(hiera('step')), ) { if $step >= 4 { if $enable_swift_storage { diff --git a/manifests/profile/base/tacker.pp b/manifests/profile/base/tacker.pp index fa85ec1..5d3a54f 100644 --- a/manifests/profile/base/tacker.pp +++ b/manifests/profile/base/tacker.pp @@ -58,7 +58,7 @@ class tripleo::profile::base::tacker ( $oslomsg_rpc_port = hiera('tacker::rabbit_port', '5672'), $oslomsg_rpc_username = hiera('tacker::rabbit_userid', 'guest'), $oslomsg_use_ssl = hiera('tacker::rabbit_use_ssl', '0'), - $step = hiera('step'), + $step = Integer(hiera('step')), ) { if $::hostname == downcase($bootstrap_node) { $sync_db = true diff --git a/manifests/profile/base/trove/api.pp b/manifests/profile/base/trove/api.pp index bc16e6e..aac5923 100644 --- a/manifests/profile/base/trove/api.pp +++ b/manifests/profile/base/trove/api.pp @@ -29,7 +29,7 @@ # class tripleo::profile::base::trove::api ( $bootstrap_node = hiera('bootstrap_nodeid', undef), - $step = hiera('step'), + $step = Integer(hiera('step')), ) { if $::hostname == downcase($bootstrap_node) { $sync_db = true diff --git a/manifests/profile/base/trove/conductor.pp b/manifests/profile/base/trove/conductor.pp index 0e95a40..cc6f039 100644 --- a/manifests/profile/base/trove/conductor.pp +++ b/manifests/profile/base/trove/conductor.pp @@ -24,7 +24,7 @@ # Defaults to hiera('step') # class tripleo::profile::base::trove::conductor ( - $step = hiera('step'), + $step = Integer(hiera('step')), ) { if $step >= 4 { diff --git a/manifests/profile/base/trove/taskmanager.pp b/manifests/profile/base/trove/taskmanager.pp index 3972c29..7fc2a81 100644 --- a/manifests/profile/base/trove/taskmanager.pp +++ b/manifests/profile/base/trove/taskmanager.pp @@ -24,7 +24,7 @@ # Defaults to hiera('step') # class tripleo::profile::base::trove::taskmanager ( - $step = hiera('step'), + $step = Integer(hiera('step')), ) { if $step >= 4 { diff --git a/manifests/profile/base/ui.pp b/manifests/profile/base/ui.pp index 681496a..710c210 100644 --- a/manifests/profile/base/ui.pp +++ b/manifests/profile/base/ui.pp @@ -17,10 +17,6 @@ # UI profile for tripleo # class tripleo::profile::base::ui () { - package {'openstack-tripleo-ui': } - - include ::apache - include ::tripleo::ui } diff --git a/manifests/profile/base/vpp.pp b/manifests/profile/base/vpp.pp index 05f52f9..90bc54e 100644 --- a/manifests/profile/base/vpp.pp +++ b/manifests/profile/base/vpp.pp @@ -24,7 +24,7 @@ # Defaults to hiera('step') # class tripleo::profile::base::vpp ( - $step = hiera('step'), + $step = Integer(hiera('step')), ) { if $step >= 1 { include ::fdio diff --git a/manifests/profile/base/zaqar.pp b/manifests/profile/base/zaqar.pp index 243dcc7..b9171b0 100644 --- a/manifests/profile/base/zaqar.pp +++ b/manifests/profile/base/zaqar.pp @@ -28,7 +28,7 @@ # Defaults to hiera('step') # class tripleo::profile::base::zaqar ( - $step = hiera('step'), + $step = Integer(hiera('step')), ) { if $step >= 4 { include ::zaqar diff --git a/manifests/profile/pacemaker/ceph/rbdmirror.pp b/manifests/profile/pacemaker/ceph/rbdmirror.pp index 4066225..6b566a7 100644 --- a/manifests/profile/pacemaker/ceph/rbdmirror.pp +++ b/manifests/profile/pacemaker/ceph/rbdmirror.pp @@ -45,7 +45,7 @@ class tripleo::profile::pacemaker::ceph::rbdmirror ( $client_name = 'openstack', $pcs_tries = hiera('pcs_tries', 20), $stack_action = hiera('stack_action'), - $step = hiera('step'), + $step = Integer(hiera('step')), ) { Service <| tag == 'ceph-rbd-mirror' |> { hasrestart => true, diff --git a/manifests/profile/pacemaker/cinder/backup.pp b/manifests/profile/pacemaker/cinder/backup.pp index ff0d8c9..933a735 100644 --- a/manifests/profile/pacemaker/cinder/backup.pp +++ b/manifests/profile/pacemaker/cinder/backup.pp @@ -33,7 +33,7 @@ # class tripleo::profile::pacemaker::cinder::backup ( $bootstrap_node = hiera('cinder_backup_short_bootstrap_node_name'), - $step = hiera('step'), + $step = Integer(hiera('step')), $pcs_tries = hiera('pcs_tries', 20), ) { diff --git a/manifests/profile/pacemaker/cinder/backup_bundle.pp b/manifests/profile/pacemaker/cinder/backup_bundle.pp new file mode 100644 index 0000000..a5e1a9b --- /dev/null +++ b/manifests/profile/pacemaker/cinder/backup_bundle.pp @@ -0,0 +1,146 @@ +# Copyright 2017 Red Hat, Inc. +# +# Licensed under the Apache License, Version 2.0 (the "License"); you may +# not use this file except in compliance with the License. You may obtain +# a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT +# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the +# License for the specific language governing permissions and limitations +# under the License. +# +# == Class: tripleo::profile::pacemaker::cinder::backup_bundle +# +# Containerized Redis Pacemaker HA profile for tripleo +# +# === Parameters +# +# [*cinder_backup_docker_image*] +# (Optional) The docker image to use for creating the pacemaker bundle +# Defaults to hiera('tripleo::profile::pacemaker::cinder::backup_bundle::cinder_docker_image', undef) +# +# [*pcs_tries*] +# (Optional) The number of times pcs commands should be retried. +# Defaults to hiera('pcs_tries', 20) +# +# [*bootstrap_node*] +# (Optional) The hostname of the node responsible for bootstrapping tasks +# Defaults to hiera('redis_short_bootstrap_node_name') +# +# [*step*] +# (Optional) The current step in deployment. See tripleo-heat-templates +# for more details. +# Defaults to hiera('step') +# +# +class tripleo::profile::pacemaker::cinder::backup_bundle ( + $bootstrap_node = hiera('cinder_backup_short_bootstrap_node_name'), + $cinder_backup_docker_image = hiera('tripleo::profile::pacemaker::cinder::backup_bundle::cinder_backup_docker_image', undef), + $pcs_tries = hiera('pcs_tries', 20), + $step = Integer(hiera('step')), +) { + if $::hostname == downcase($bootstrap_node) { + $pacemaker_master = true + } else { + $pacemaker_master = false + } + + include ::tripleo::profile::base::cinder::backup + + if $step >= 2 and $pacemaker_master { + $cinder_backup_short_node_names = hiera('cinder_backup_short_node_names') + $cinder_backup_short_node_names.each |String $node_name| { + pacemaker::property { "cinder-backup-role-${node_name}": + property => 'cinder-backup-role', + value => true, + tries => $pcs_tries, + node => $node_name, + before => Pacemaker::Resource::Bundle[$::cinder::params::backup_service], + } + } + } + + if $step >= 5 { + if $pacemaker_master { + $cinder_backup_nodes_count = count(hiera('cinder_backup_short_node_names', [])) + + pacemaker::resource::bundle { $::cinder::params::backup_service : + image => $cinder_backup_docker_image, + replicas => 1, + location_rule => { + resource_discovery => 'exclusive', + score => 0, + expression => ['cinder-backup-role eq true'], + }, + container_options => 'network=host', + options => '--ipc=host --privileged=true --user=root --log-driver=journald -e KOLLA_CONFIG_STRATEGY=COPY_ALWAYS', + run_command => '/bin/bash /usr/local/bin/kolla_start', + storage_maps => { + 'cinder-backup-cfg-files' => { + 'source-dir' => '/var/lib/kolla/config_files/cinder_backup.json', + 'target-dir' => '/var/lib/kolla/config_files/config.json', + 'options' => 'ro', + }, + 'cinder-backup-cfg-data' => { + 'source-dir' => '/var/lib/config-data/cinder/etc/cinder', + 'target-dir' => '/etc/cinder', + 'options' => 'ro', + }, + 'cinder-backup-cfg-ceph' => { + 'source-dir' => '/var/lib/config-data/cinder/etc/ceph', + 'target-dir' => '/etc/ceph', + 'options' => 'ro', + }, + 'cinder-backup-hosts' => { + 'source-dir' => '/etc/hosts', + 'target-dir' => '/etc/hosts', + 'options' => 'ro', + }, + 'cinder-backup-localtime' => { + 'source-dir' => '/etc/localtime', + 'target-dir' => '/etc/localtime', + 'options' => 'ro', + }, + 'cinder-backup-dev' => { + 'source-dir' => '/dev', + 'target-dir' => '/dev', + 'options' => 'rw', + }, + 'cinder-backup-run' => { + 'source-dir' => '/run', + 'target-dir' => '/run', + 'options' => 'rw', + }, + 'cinder-backup-sys' => { + 'source-dir' => '/sys', + 'target-dir' => '/sys', + 'options' => 'rw', + }, + 'cinder-backup-lib-modules' => { + 'source-dir' => '/lib/modules', + 'target-dir' => '/lib/modules', + 'options' => 'ro', + }, + 'cinder-backup-iscsi' => { + 'source-dir' => '/etc/iscsi', + 'target-dir' => '/etc/iscsi', + 'options' => 'rw', + }, + 'cinder-backup-var-lib-cinder' => { + 'source-dir' => '/var/lib/cinder', + 'target-dir' => '/var/lib/cinder', + 'options' => 'rw', + }, + 'cinder-backup-var-log' => { + 'source-dir' => '/var/log/containers/cinder', + 'target-dir' => '/var/log/cinder', + 'options' => 'rw', + }, + }, + } + } + } +} diff --git a/manifests/profile/pacemaker/cinder/volume.pp b/manifests/profile/pacemaker/cinder/volume.pp index 0d6a598..e993426 100644 --- a/manifests/profile/pacemaker/cinder/volume.pp +++ b/manifests/profile/pacemaker/cinder/volume.pp @@ -33,7 +33,7 @@ # class tripleo::profile::pacemaker::cinder::volume ( $bootstrap_node = hiera('cinder_volume_short_bootstrap_node_name'), - $step = hiera('step'), + $step = Integer(hiera('step')), $pcs_tries = hiera('pcs_tries', 20), ) { Service <| tag == 'cinder::volume' |> { diff --git a/manifests/profile/pacemaker/cinder/volume_bundle.pp b/manifests/profile/pacemaker/cinder/volume_bundle.pp new file mode 100644 index 0000000..39199a5 --- /dev/null +++ b/manifests/profile/pacemaker/cinder/volume_bundle.pp @@ -0,0 +1,141 @@ +# Copyright 2017 Red Hat, Inc. +# +# Licensed under the Apache License, Version 2.0 (the "License"); you may +# not use this file except in compliance with the License. You may obtain +# a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT +# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the +# License for the specific language governing permissions and limitations +# under the License. +# +# == Class: tripleo::profile::pacemaker::cinder::volume_bundle +# +# Containerized Redis Pacemaker HA profile for tripleo +# +# === Parameters +# +# [*cinder_volume_docker_image*] +# (Optional) The docker image to use for creating the pacemaker bundle +# Defaults to hiera('tripleo::profile::pacemaker::cinder::volume_bundle::cinder_docker_image', undef) +# +# [*pcs_tries*] +# (Optional) The number of times pcs commands should be retried. +# Defaults to hiera('pcs_tries', 20) +# +# [*bootstrap_node*] +# (Optional) The hostname of the node responsible for bootstrapping tasks +# Defaults to hiera('redis_short_bootstrap_node_name') +# +# [*step*] +# (Optional) The current step in deployment. See tripleo-heat-templates +# for more details. +# Defaults to hiera('step') +# +# +class tripleo::profile::pacemaker::cinder::volume_bundle ( + $bootstrap_node = hiera('cinder_volume_short_bootstrap_node_name'), + $cinder_volume_docker_image = hiera('tripleo::profile::pacemaker::cinder::volume_bundle::cinder_volume_docker_image', undef), + $pcs_tries = hiera('pcs_tries', 20), + $step = Integer(hiera('step')), +) { + if $::hostname == downcase($bootstrap_node) { + $pacemaker_master = true + } else { + $pacemaker_master = false + } + + include ::tripleo::profile::base::cinder::volume + + if $step >= 2 and $pacemaker_master { + $cinder_volume_short_node_names = hiera('cinder_volume_short_node_names') + $cinder_volume_short_node_names.each |String $node_name| { + pacemaker::property { "cinder-volume-role-${node_name}": + property => 'cinder-volume-role', + value => true, + tries => $pcs_tries, + node => $node_name, + before => Pacemaker::Resource::Bundle[$::cinder::params::volume_service], + } + } + } + + if $step >= 5 { + if $pacemaker_master { + $cinder_volume_nodes_count = count(hiera('cinder_volume_short_node_names', [])) + + pacemaker::resource::bundle { $::cinder::params::volume_service: + image => $cinder_volume_docker_image, + replicas => 1, + location_rule => { + resource_discovery => 'exclusive', + score => 0, + expression => ['cinder-volume-role eq true'], + }, + container_options => 'network=host', + options => '--ipc=host --privileged=true --user=root --log-driver=journald -e KOLLA_CONFIG_STRATEGY=COPY_ALWAYS', + run_command => '/bin/bash /usr/local/bin/kolla_start', + storage_maps => { + 'cinder-volume-cfg-files' => { + 'source-dir' => '/var/lib/kolla/config_files/cinder_volume.json', + 'target-dir' => '/var/lib/kolla/config_files/config.json', + 'options' => 'ro', + }, + 'cinder-volume-cfg-data' => { + 'source-dir' => '/var/lib/config-data/cinder/etc/cinder', + 'target-dir' => '/etc/cinder', + 'options' => 'ro', + }, + 'cinder-volume-hosts' => { + 'source-dir' => '/etc/hosts', + 'target-dir' => '/etc/hosts', + 'options' => 'ro', + }, + 'cinder-volume-localtime' => { + 'source-dir' => '/etc/localtime', + 'target-dir' => '/etc/localtime', + 'options' => 'ro', + }, + 'cinder-volume-dev' => { + 'source-dir' => '/dev', + 'target-dir' => '/dev', + 'options' => 'rw', + }, + 'cinder-volume-run' => { + 'source-dir' => '/run', + 'target-dir' => '/run', + 'options' => 'rw', + }, + 'cinder-volume-sys' => { + 'source-dir' => '/sys', + 'target-dir' => '/sys', + 'options' => 'rw', + }, + 'cinder-volume-lib-modules' => { + 'source-dir' => '/lib/modules', + 'target-dir' => '/lib/modules', + 'options' => 'ro', + }, + 'cinder-volume-iscsi' => { + 'source-dir' => '/etc/iscsi', + 'target-dir' => '/etc/iscsi', + 'options' => 'rw', + }, + 'cinder-volume-var-lib-cinder' => { + 'source-dir' => '/var/lib/cinder', + 'target-dir' => '/var/lib/cinder', + 'options' => 'rw', + }, + 'cinder-volume-var-log' => { + 'source-dir' => '/var/log/containers/cinder', + 'target-dir' => '/var/log/cinder', + 'options' => 'rw', + }, + }, + } + } + } +} diff --git a/manifests/profile/pacemaker/clustercheck.pp b/manifests/profile/pacemaker/clustercheck.pp new file mode 100644 index 0000000..958f4a2 --- /dev/null +++ b/manifests/profile/pacemaker/clustercheck.pp @@ -0,0 +1,65 @@ +# Copyright 2016 Red Hat, Inc. +# +# Licensed under the Apache License, Version 2.0 (the "License"); you may +# not use this file except in compliance with the License. You may obtain +# a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT +# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the +# License for the specific language governing permissions and limitations +# under the License. +# +# == Class: tripleo::profile::pacemaker::clustercheck +# +# Clustercheck, galera health check profile for tripleo +# +# === Parameters +# [*step*] +# (Optional) The current step in deployment. See tripleo-heat-templates +# for more details. +# Defaults to hiera('step') +# +# [*bind_address*] +# (Optional) The address that the local mysql instance should bind to. +# Defaults to hiera('mysql_bind_host') +# +# [*clustercheck_password*] +# (Optional) The password for the clustercheck user. +# Defaults to hiera('mysql::server::root_password') +# +# +class tripleo::profile::pacemaker::clustercheck ( + $step = Integer(hiera('step')), + $clustercheck_password = hiera('mysql::server::root_password'), + $bind_address = hiera('mysql_bind_host'), +) { + + if $step >= 1 { + file { '/etc/sysconfig/clustercheck' : + ensure => file, + mode => '0600', + owner => 'mysql', + group => 'mysql', + content => "MYSQL_USERNAME=root\n +MYSQL_PASSWORD='${clustercheck_password}'\n +MYSQL_HOST=localhost\n", + } + + # the clustercheck service is run via xinet in the container + xinetd::service { 'galera-monitor' : + bind => $bind_address, + port => '9200', + server => '/usr/bin/clustercheck', + per_source => 'UNLIMITED', + log_on_success => '', + log_on_failure => 'HOST', + flags => 'REUSE', + service_type => 'UNLISTED', + user => 'mysql', + group => 'mysql', + } + } +} diff --git a/manifests/profile/pacemaker/database/mysql.pp b/manifests/profile/pacemaker/database/mysql.pp index 031e80c..22adbe9 100644 --- a/manifests/profile/pacemaker/database/mysql.pp +++ b/manifests/profile/pacemaker/database/mysql.pp @@ -26,6 +26,27 @@ # (Optional) The address that the local mysql instance should bind to. # Defaults to $::hostname # +# [*ca_file*] +# (Optional) The path to the CA file that will be used for the TLS +# configuration. It's only used if internal TLS is enabled. +# Defaults to undef +# +# [*certificate_specs*] +# (Optional) The specifications to give to certmonger for the certificate +# it will create. Note that the certificate nickname must be 'mysql' in +# the case of this service. +# Example with hiera: +# tripleo::profile::base::database::mysql::certificate_specs: +# hostname: <overcloud controller fqdn> +# service_certificate: <service certificate path> +# service_key: <service key path> +# principal: "mysql/<overcloud controller fqdn>" +# Defaults to hiera('tripleo::profile::base::database::mysql::certificate_specs', {}). +# +# [*enable_internal_tls*] +# (Optional) Whether TLS in the internal network is enabled or not. +# Defaults to hiera('enable_internal_tls', false) +# # [*gmcast_listen_addr*] # (Optional) This variable defines the address on which the node listens to # connections from other nodes in the cluster. @@ -41,11 +62,14 @@ # Defaults to hiera('pcs_tries', 20) # class tripleo::profile::pacemaker::database::mysql ( - $bootstrap_node = hiera('mysql_short_bootstrap_node_name'), - $bind_address = $::hostname, - $gmcast_listen_addr = hiera('mysql_bind_host'), - $step = hiera('step'), - $pcs_tries = hiera('pcs_tries', 20), + $bootstrap_node = hiera('mysql_short_bootstrap_node_name'), + $bind_address = $::hostname, + $ca_file = undef, + $certificate_specs = hiera('tripleo::profile::base::database::mysql::certificate_specs', {}), + $enable_internal_tls = hiera('enable_internal_tls', false), + $gmcast_listen_addr = hiera('mysql_bind_host'), + $step = Integer(hiera('step')), + $pcs_tries = hiera('pcs_tries', 20), ) { if $::hostname == downcase($bootstrap_node) { $pacemaker_master = true @@ -53,20 +77,35 @@ class tripleo::profile::pacemaker::database::mysql ( $pacemaker_master = false } - # use only mysql_node_names when we land a patch in t-h-t that - # switches to autogenerating these values from composable services - # The galera node names need to match the pacemaker node names... so if we - # want to use FQDNs for this, the cluster will not finish bootstrapping, - # since all the nodes will be marked as slaves. For now, we'll stick to the - # short name which is already registered in pacemaker until we get around - # this issue. - $galera_node_names_lookup = hiera('mysql_short_node_names', hiera('mysql_node_names', $::hostname)) + $galera_node_names_lookup = hiera('mysql_short_node_names', $::hostname) + $galera_fqdns_names_lookup = hiera('mysql_node_names', $::hostname) + if is_array($galera_node_names_lookup) { - $galera_nodes = downcase(join($galera_node_names_lookup, ',')) + $galera_nodes_count = length($galera_node_names_lookup) + $galera_nodes = downcase(join($galera_fqdns_names_lookup, ',')) + $galera_name_pairs = zip($galera_node_names_lookup, $galera_fqdns_names_lookup) } else { + $galera_nodes_count = 1 $galera_nodes = downcase($galera_node_names_lookup) + $galera_name_pairs = [[$galera_node_names_lookup, $galera_fqdns_names_lookup]] + } + + # NOTE(jaosorior): The usage of cluster_host_map requires resource-agents-3.9.5-82.el7_3.11 + $processed_galera_name_pairs = $galera_name_pairs.map |$pair| { join($pair, ':') } + $cluster_host_map = join($processed_galera_name_pairs, ';') + + if $enable_internal_tls { + $tls_certfile = $certificate_specs['service_certificate'] + $tls_keyfile = $certificate_specs['service_key'] + if $ca_file { + $tls_ca_options = "socket.ssl_ca=${ca_file}" + } else { + $tls_ca_options = '' + } + $tls_options = "socket.ssl_key=${tls_keyfile};socket.ssl_cert=${tls_certfile};${tls_ca_options};" + } else { + $tls_options = '' } - $galera_nodes_count = count(split($galera_nodes, ',')) $mysqld_options = { 'mysqld' => { @@ -96,10 +135,19 @@ class tripleo::profile::pacemaker::database::mysql ( 'wsrep_drupal_282555_workaround'=> '0', 'wsrep_causal_reads' => '0', 'wsrep_sst_method' => 'rsync', - 'wsrep_provider_options' => "gmcast.listen_addr=tcp://${gmcast_listen_addr}:4567;", + 'wsrep_provider_options' => "gmcast.listen_addr=tcp://${gmcast_listen_addr}:4567;${tls_options}", } } + # since we are configuring rsync for wsrep_sst_method, we ought to make sure + # it's installed. We only includ this at step 2 since puppet-rsync may be + # included later and also adds the package resource. + if $step == 2 { + if ! defined(Package['rsync']) { + package {'rsync':} + } + } + # remove_default_accounts parameter will execute some mysql commands # to remove the default accounts created by MySQL package. # We need MySQL running to run the commands successfully, so better to @@ -136,7 +184,7 @@ class tripleo::profile::pacemaker::database::mysql ( op_params => 'promote timeout=300s on-fail=block', master_params => '', meta_params => "master-max=${galera_nodes_count} ordered=true", - resource_params => "additional_parameters='--open-files-limit=16384' enable_creation=true wsrep_cluster_address='gcomm://${galera_nodes}'", + resource_params => "additional_parameters='--open-files-limit=16384' enable_creation=true wsrep_cluster_address='gcomm://${galera_nodes}' cluster_host_map='${cluster_host_map}'", tries => $pcs_tries, location_rule => { resource_discovery => 'exclusive', diff --git a/manifests/profile/pacemaker/database/mysql_bundle.pp b/manifests/profile/pacemaker/database/mysql_bundle.pp new file mode 100644 index 0000000..56e9e28 --- /dev/null +++ b/manifests/profile/pacemaker/database/mysql_bundle.pp @@ -0,0 +1,307 @@ +# Copyright 2017 Red Hat, Inc. +# +# Licensed under the Apache License, Version 2.0 (the "License"); you may +# not use this file except in compliance with the License. You may obtain +# a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT +# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the +# License for the specific language governing permissions and limitations +# under the License. +# +# == Class: tripleo::profile::pacemaker::mysql_bundle +# +# Containerized Mysql Pacemaker HA profile for tripleo +# +# === Parameters +# +# [*mysql_docker_image*] +# (Optional) The docker image to use for creating the pacemaker bundle +# Defaults to hiera('tripleo::profile::pacemaker::database::redis_bundle::mysql_docker_image', undef) +# +# [*control_port*] +# (Optional) The bundle's pacemaker_remote control port on the host +# Defaults to hiera('tripleo::profile::pacemaker::database::redis_bundle::control_port', '3123') +# +# [*bootstrap_node*] +# (Optional) The hostname of the node responsible for bootstrapping tasks +# Defaults to hiera('mysql_short_bootstrap_node_name') +# +# [*bind_address*] +# (Optional) The address that the local mysql instance should bind to. +# Defaults to $::hostname +# +# [*gmcast_listen_addr*] +# (Optional) This variable defines the address on which the node listens to +# connections from other nodes in the cluster. +# Defaults to hiera('mysql_bind_host') +# +# [*pcs_tries*] +# (Optional) The number of times pcs commands should be retried. +# Defaults to hiera('pcs_tries', 20) +# +# [*step*] +# (Optional) The current step in deployment. See tripleo-heat-templates +# for more details. +# Defaults to hiera('step') +# +# +class tripleo::profile::pacemaker::database::mysql_bundle ( + $mysql_docker_image = hiera('tripleo::profile::pacemaker::database::mysql_bundle::mysql_docker_image', undef), + $control_port = hiera('tripleo::profile::pacemaker::database::mysql_bundle::control_port', '3123'), + $bootstrap_node = hiera('mysql_short_bootstrap_node_name'), + $bind_address = $::hostname, + $gmcast_listen_addr = hiera('mysql_bind_host'), + $pcs_tries = hiera('pcs_tries', 20), + $step = Integer(hiera('step')), +) { + if $::hostname == downcase($bootstrap_node) { + $pacemaker_master = true + } else { + $pacemaker_master = false + } + + # use only mysql_node_names when we land a patch in t-h-t that + # switches to autogenerating these values from composable services + # The galera node names need to match the pacemaker node names... so if we + # want to use FQDNs for this, the cluster will not finish bootstrapping, + # since all the nodes will be marked as slaves. For now, we'll stick to the + # short name which is already registered in pacemaker until we get around + # this issue. + $galera_node_names_lookup = hiera('mysql_short_node_names', hiera('mysql_node_names', $::hostname)) + if is_array($galera_node_names_lookup) { + $galera_nodes = downcase(join($galera_node_names_lookup, ',')) + } else { + $galera_nodes = downcase($galera_node_names_lookup) + } + $galera_nodes_array = split($galera_nodes, ',') + $galera_nodes_count = count($galera_nodes_array) + + # construct a galera-pacemaker name mapping for the resource agent + # [galera-bundle-0:galera_node[0], galera-bundle-1:galera_node[1], ... ,galera-bundle-n:galera_node[n]] + $host_map_array = $galera_nodes_array.map |$i, $host| { + "galera-bundle-${i}:${host}" + } + $cluster_host_map_string = join($host_map_array, ';') + + $mysqld_options = { + 'mysqld' => { + 'pid-file' => '/var/lib/mysql/mariadb.pid', + 'skip-name-resolve' => '1', + 'binlog_format' => 'ROW', + 'default-storage-engine' => 'innodb', + 'innodb_autoinc_lock_mode' => '2', + 'innodb_locks_unsafe_for_binlog'=> '1', + 'innodb_file_per_table' => 'ON', + 'query_cache_size' => '0', + 'query_cache_type' => '0', + 'bind-address' => $bind_address, + 'max_connections' => hiera('mysql_max_connections'), + 'open_files_limit' => '-1', + 'wsrep_on' => 'ON', + 'wsrep_provider' => '/usr/lib64/galera/libgalera_smm.so', + 'wsrep_cluster_name' => 'galera_cluster', + 'wsrep_cluster_address' => "gcomm://${galera_nodes}", + 'wsrep_slave_threads' => '1', + 'wsrep_certify_nonPK' => '1', + 'wsrep_max_ws_rows' => '131072', + 'wsrep_max_ws_size' => '1073741824', + 'wsrep_debug' => '0', + 'wsrep_convert_LOCK_to_trx' => '0', + 'wsrep_retry_autocommit' => '1', + 'wsrep_auto_increment_control' => '1', + 'wsrep_drupal_282555_workaround'=> '0', + 'wsrep_causal_reads' => '0', + 'wsrep_sst_method' => 'rsync', + 'wsrep_provider_options' => "gmcast.listen_addr=tcp://${gmcast_listen_addr}:4567;", + }, + 'mysqld_safe' => { + 'pid-file' => '/var/lib/mysql/mariadb.pid', + } + } + + # remove_default_accounts parameter will execute some mysql commands + # to remove the default accounts created by MySQL package. + # We need MySQL running to run the commands successfully, so better to + # wait step 2 before trying to run the commands. + if $step >= 2 and $pacemaker_master { + $remove_default_accounts = true + } else { + $remove_default_accounts = false + } + + if $step >= 1 and $pacemaker_master and hiera('stack_action') == 'UPDATE' { + tripleo::pacemaker::resource_restart_flag { 'galera-master': + subscribe => File['mysql-config-file'], + } + } + + $mysql_root_password = hiera('mysql::server::root_password') + + if $step >= 1 { + # Kolla sets the root password, expose it to the MySQL package + # so that it can initialize the database (e.g. create users) + file { '/root/.my.cnf' : + ensure => file, + mode => '0600', + owner => 'root', + group => 'root', + content => "[client] +user=root +password=\"${mysql_root_password}\" + +[mysql] +user=root +password=\"${mysql_root_password}\"", + } + + # Resource agent uses those credentials to poll galera state + file { '/etc/sysconfig/clustercheck' : + ensure => file, + mode => '0600', + owner => 'root', + group => 'root', + content => "MYSQL_USERNAME=root\n +MYSQL_PASSWORD='${mysql_root_password}'\n +MYSQL_HOST=localhost\n", + } + } + + if $step >= 2 { + # need that class to create all openstack credentials + # we don't include it in step 1 because the kolla bootstrap + # happens after step 1 baremetal + class { '::tripleo::profile::base::database::mysql': + bootstrap_node => $bootstrap_node, + manage_resources => false, + remove_default_accounts => $remove_default_accounts, + mysql_server_options => $mysqld_options, + } + + if $pacemaker_master { + $mysql_short_node_names = hiera('mysql_short_node_names') + $mysql_short_node_names.each |String $node_name| { + # lint:ignore:puppet-lint-2.0.1 does not work with multiline strings + # and blocks (remove this when we move to 2.2.0 where this works) + pacemaker::property { "galera-role-${node_name}": + property => 'galera-role', + value => true, + tries => $pcs_tries, + node => $node_name, + before => Pacemaker::Resource::Bundle['galera-bundle'], + } + # lint:endignore + } + pacemaker::resource::bundle { 'galera-bundle': + image => $mysql_docker_image, + replicas => $galera_nodes_count, + masters => $galera_nodes_count, + location_rule => { + resource_discovery => 'exclusive', + score => 0, + expression => ['galera-role eq true'], + }, + container_options => 'network=host', + options => '--user=root --log-driver=journald -e KOLLA_CONFIG_STRATEGY=COPY_ALWAYS', + run_command => '/bin/bash /usr/local/bin/kolla_start', + network => "control-port=${control_port}", + storage_maps => { + 'mysql-cfg-files' => { + 'source-dir' => '/var/lib/kolla/config_files/mysql.json', + 'target-dir' => '/var/lib/kolla/config_files/config.json', + 'options' => 'ro', + }, + 'mysql-cfg-data' => { + 'source-dir' => '/var/lib/config-data/mysql', + 'target-dir' => '/var/lib/kolla/config_files/src', + 'options' => 'ro', + }, + 'mysql-hosts' => { + 'source-dir' => '/etc/hosts', + 'target-dir' => '/etc/hosts', + 'options' => 'ro', + }, + 'mysql-localtime' => { + 'source-dir' => '/etc/localtime', + 'target-dir' => '/etc/localtime', + 'options' => 'ro', + }, + 'mysql-lib' => { + 'source-dir' => '/var/lib/mysql', + 'target-dir' => '/var/lib/mysql', + 'options' => 'rw', + }, + 'mysql-log-mariadb' => { + 'source-dir' => '/var/log/mariadb', + 'target-dir' => '/var/log/mariadb', + 'options' => 'rw', + }, + 'mysql-pki-extracted' => { + 'source-dir' => '/etc/pki/ca-trust/extracted', + 'target-dir' => '/etc/pki/ca-trust/extracted', + 'options' => 'ro', + }, + 'mysql-pki-ca-bundle-crt' => { + 'source-dir' => '/etc/pki/tls/certs/ca-bundle.crt', + 'target-dir' => '/etc/pki/tls/certs/ca-bundle.crt', + 'options' => 'ro', + }, + 'mysql-pki-ca-bundle-trust-crt' => { + 'source-dir' => '/etc/pki/tls/certs/ca-bundle.trust.crt', + 'target-dir' => '/etc/pki/tls/certs/ca-bundle.trust.crt', + 'options' => 'ro', + }, + 'mysql-pki-cert' => { + 'source-dir' => '/etc/pki/tls/cert.pem', + 'target-dir' => '/etc/pki/tls/cert.pem', + 'options' => 'ro', + }, + 'mysql-dev-log' => { + 'source-dir' => '/dev/log', + 'target-dir' => '/dev/log', + 'options' => 'rw', + }, + }, + } + + pacemaker::resource::ocf { 'galera': + ocf_agent_name => 'heartbeat:galera', + master_params => '', + meta_params => "master-max=${galera_nodes_count} ordered=true", + op_params => 'promote timeout=300s on-fail=block', + resource_params => "additional_parameters='--open-files-limit=16384' enable_creation=true wsrep_cluster_address='gcomm://${galera_nodes}' cluster_host_map='${cluster_host_map_string}'", + tries => $pcs_tries, + location_rule => { + resource_discovery => 'exclusive', + score => 0, + expression => ['galera-role eq true'], + }, + bundle => 'galera-bundle', + require => [Class['::mysql::server'], + Pacemaker::Resource::Bundle['galera-bundle']], + before => Exec['galera-ready'], + } + + exec { 'galera-ready' : + command => '/usr/bin/clustercheck >/dev/null', + timeout => 30, + tries => 180, + try_sleep => 10, + environment => ['AVAILABLE_WHEN_READONLY=0'], + tag => 'galera_ready' + } + + # We create databases and users for services at step 2 as well. This ensures + # Galera is up and ready before those get created + File['/root/.my.cnf'] -> Mysql_database<||> + File['/root/.my.cnf'] -> Mysql_user<||> + File['/etc/sysconfig/clustercheck'] -> Mysql_database<||> + File['/etc/sysconfig/clustercheck'] -> Mysql_user<||> + Exec['galera-ready'] -> Mysql_database<||> + Exec['galera-ready'] -> Mysql_user<||> + } + } +} diff --git a/manifests/profile/pacemaker/database/redis.pp b/manifests/profile/pacemaker/database/redis.pp index 4f5a861..bc91be7 100644 --- a/manifests/profile/pacemaker/database/redis.pp +++ b/manifests/profile/pacemaker/database/redis.pp @@ -46,7 +46,7 @@ class tripleo::profile::pacemaker::database::redis ( $bootstrap_node = hiera('redis_short_bootstrap_node_name'), $enable_load_balancer = hiera('enable_load_balancer', true), - $step = hiera('step'), + $step = Integer(hiera('step')), $redis_file_limit = undef, $pcs_tries = hiera('pcs_tries', 20), ) { diff --git a/manifests/profile/pacemaker/database/redis_bundle.pp b/manifests/profile/pacemaker/database/redis_bundle.pp new file mode 100644 index 0000000..dd090d7 --- /dev/null +++ b/manifests/profile/pacemaker/database/redis_bundle.pp @@ -0,0 +1,183 @@ +# Copyright 2017 Red Hat, Inc. +# +# Licensed under the Apache License, Version 2.0 (the "License"); you may +# not use this file except in compliance with the License. You may obtain +# a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT +# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the +# License for the specific language governing permissions and limitations +# under the License. +# +# == Class: tripleo::profile::pacemaker::database::redis_bundle +# +# Containerized Redis Pacemaker HA profile for tripleo +# +# === Parameters +# +# [*redis_docker_image*] +# (Optional) The docker image to use for creating the pacemaker bundle +# Defaults to hiera('tripleo::profile::pacemaker::redis_bundle::redis_docker_image', undef) +# +# [*redis_docker_control_port*] +# (Optional) The bundle's pacemaker_remote control port on the host +# Defaults to hiera('tripleo::profile::pacemaker::redis_bundle::control_port', '3121') +# +# [*pcs_tries*] +# (Optional) The number of times pcs commands should be retried. +# Defaults to hiera('pcs_tries', 20) +# +# [*bootstrap_node*] +# (Optional) The hostname of the node responsible for bootstrapping tasks +# Defaults to hiera('redis_short_bootstrap_node_name') +# +# [*step*] +# (Optional) The current step in deployment. See tripleo-heat-templates +# for more details. +# Defaults to hiera('step') +# +# +class tripleo::profile::pacemaker::database::redis_bundle ( + $bootstrap_node = hiera('redis_short_bootstrap_node_name'), + $redis_docker_image = hiera('tripleo::profile::pacemaker::database::redis_bundle::redis_docker_image', undef), + $redis_docker_control_port = hiera('tripleo::profile::pacemaker::database::redis_bundle::control_port', '3124'), + $pcs_tries = hiera('pcs_tries', 20), + $step = Integer(hiera('step')), +) { + if $::hostname == downcase($bootstrap_node) { + $pacemaker_master = true + } else { + $pacemaker_master = false + } + + include ::tripleo::profile::base::database::redis + + if $step >= 2 { + if $pacemaker_master { + $redis_short_node_names = hiera('redis_short_node_names') + $redis_nodes_count = count($redis_short_node_names) + $redis_short_node_names.each |String $node_name| { + pacemaker::property { "redis-role-${node_name}": + property => 'redis-role', + value => true, + tries => $pcs_tries, + node => $node_name, + before => Pacemaker::Resource::Bundle['redis-bundle'], + } + } + + pacemaker::resource::bundle { 'redis-bundle': + image => $redis_docker_image, + replicas => $redis_nodes_count, + masters => 1, + location_rule => { + resource_discovery => 'exclusive', + score => 0, + expression => ['redis-role eq true'], + }, + container_options => 'network=host', + options => '--user=root --log-driver=journald -e KOLLA_CONFIG_STRATEGY=COPY_ALWAYS', + run_command => '/bin/bash /usr/local/bin/kolla_start', + network => "control-port=${redis_docker_control_port}", + storage_maps => { + 'redis-cfg-files' => { + 'source-dir' => '/var/lib/kolla/config_files/redis.json', + 'target-dir' => '/var/lib/kolla/config_files/config.json', + 'options' => 'ro', + }, + 'redis-cfg-data-redis' => { + 'source-dir' => '/var/lib/config-data/redis/etc/redis', + 'target-dir' => '/etc/redis', + 'options' => 'ro', + }, + 'redis-cfg-data-redis-conf' => { + 'source-dir' => '/var/lib/config-data/redis/etc/redis.conf', + 'target-dir' => '/etc/redis.conf', + 'options' => 'ro', + }, + 'redis-cfg-data-redis-conf-puppet' => { + 'source-dir' => '/var/lib/config-data/redis/etc/redis.conf.puppet', + 'target-dir' => '/etc/redis.conf.puppet', + 'options' => 'ro', + }, + 'redis-cfg-data-redis-sentinel' => { + 'source-dir' => '/var/lib/config-data/redis/etc/redis-sentinel.conf', + 'target-dir' => '/etc/redis-sentinel.conf', + 'options' => 'ro', + }, + 'redis-hosts' => { + 'source-dir' => '/etc/hosts', + 'target-dir' => '/etc/hosts', + 'options' => 'ro', + }, + 'redis-localtime' => { + 'source-dir' => '/etc/localtime', + 'target-dir' => '/etc/localtime', + 'options' => 'ro', + }, + 'redis-lib' => { + 'source-dir' => '/var/lib/redis', + 'target-dir' => '/var/lib/redis', + 'options' => 'rw', + }, + 'redis-log' => { + 'source-dir' => '/var/log/redis', + 'target-dir' => '/var/log/redis', + 'options' => 'rw', + }, + 'redis-run' => { + 'source-dir' => '/var/run/redis', + 'target-dir' => '/var/run/redis', + 'options' => 'rw', + }, + 'redis-pki-extracted' => { + 'source-dir' => '/etc/pki/ca-trust/extracted', + 'target-dir' => '/etc/pki/ca-trust/extracted', + 'options' => 'ro', + }, + 'redis-pki-ca-bundle-crt' => { + 'source-dir' => '/etc/pki/tls/certs/ca-bundle.crt', + 'target-dir' => '/etc/pki/tls/certs/ca-bundle.crt', + 'options' => 'ro', + }, + 'redis-pki-ca-bundle-trust-crt' => { + 'source-dir' => '/etc/pki/tls/certs/ca-bundle.trust.crt', + 'target-dir' => '/etc/pki/tls/certs/ca-bundle.trust.crt', + 'options' => 'ro', + }, + 'redis-pki-cert' => { + 'source-dir' => '/etc/pki/tls/cert.pem', + 'target-dir' => '/etc/pki/tls/cert.pem', + 'options' => 'ro', + }, + 'redis-dev-log' => { + 'source-dir' => '/dev/log', + 'target-dir' => '/dev/log', + 'options' => 'rw', + }, + }, + } + + pacemaker::resource::ocf { 'redis': + ocf_agent_name => 'heartbeat:redis', + resource_params => 'wait_last_known_master=true', + master_params => '', + meta_params => 'notify=true ordered=true interleave=true', + op_params => 'start timeout=200s stop timeout=200s', + tries => $pcs_tries, + location_rule => { + resource_discovery => 'exclusive', + score => 0, + expression => ['redis-role eq true'], + }, + bundle => 'redis-bundle', + require => [Class['::redis'], + Pacemaker::Resource::Bundle['redis-bundle']], + } + + } + } +} diff --git a/manifests/profile/pacemaker/haproxy.pp b/manifests/profile/pacemaker/haproxy.pp index f006f78..7331071 100644 --- a/manifests/profile/pacemaker/haproxy.pp +++ b/manifests/profile/pacemaker/haproxy.pp @@ -38,7 +38,7 @@ class tripleo::profile::pacemaker::haproxy ( $bootstrap_node = hiera('haproxy_short_bootstrap_node_name'), $enable_load_balancer = hiera('enable_load_balancer', true), - $step = hiera('step'), + $step = Integer(hiera('step')), $pcs_tries = hiera('pcs_tries', 20), ) { include ::tripleo::profile::base::haproxy diff --git a/manifests/profile/pacemaker/haproxy_bundle.pp b/manifests/profile/pacemaker/haproxy_bundle.pp new file mode 100644 index 0000000..9c1bdf3 --- /dev/null +++ b/manifests/profile/pacemaker/haproxy_bundle.pp @@ -0,0 +1,197 @@ +# Copyright 2016 Red Hat, Inc. +# +# Licensed under the Apache License, Version 2.0 (the "License"); you may +# not use this file except in compliance with the License. You may obtain +# a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT +# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the +# License for the specific language governing permissions and limitations +# under the License. +# +# == Class: tripleo::profile::pacemaker::haproxy +# +# HAproxy with Pacemaker HA profile for tripleo +# +# === Parameters +# +# [*haproxy_docker_image*] +# (Optional) The docker image to use for creating the pacemaker bundle +# Defaults to hiera('tripleo::profile::pacemaker::haproxy::haproxy_docker_image', undef) +# +# [*bootstrap_node*] +# (Optional) The hostname of the node responsible for bootstrapping tasks +# Defaults to hiera('haproxy_short_bootstrap_node_name') +# +# [*enable_load_balancer*] +# (Optional) Whether load balancing is enabled for this cluster +# Defaults to hiera('enable_load_balancer', true) +# +# [*step*] +# (Optional) The current step in deployment. See tripleo-heat-templates +# for more details. +# Defaults to hiera('step') +# +# [*pcs_tries*] +# (Optional) The number of times pcs commands should be retried. +# Defaults to hiera('pcs_tries', 20) +# +class tripleo::profile::pacemaker::haproxy_bundle ( + $haproxy_docker_image = hiera('tripleo::profile::pacemaker::haproxy::haproxy_docker_image', undef), + $bootstrap_node = hiera('haproxy_short_bootstrap_node_name'), + $enable_load_balancer = hiera('enable_load_balancer', true), + $step = Integer(hiera('step')), + $pcs_tries = hiera('pcs_tries', 20), +) { + include ::tripleo::profile::base::haproxy + + if $::hostname == downcase($bootstrap_node) { + $pacemaker_master = true + } else { + $pacemaker_master = false + } + + if $step >= 1 and $pacemaker_master and hiera('stack_action') == 'UPDATE' and $enable_load_balancer { + tripleo::pacemaker::resource_restart_flag { 'haproxy-clone': + subscribe => Concat['/etc/haproxy/haproxy.cfg'], + } + } + + if $step >= 2 and $enable_load_balancer { + if $pacemaker_master { + $haproxy_short_node_names = hiera('haproxy_short_node_names') + $haproxy_short_node_names.each |String $node_name| { + pacemaker::property { "haproxy-role-${node_name}": + property => 'haproxy-role', + value => true, + tries => $pcs_tries, + node => $node_name, + before => Pacemaker::Resource::Bundle['haproxy-bundle'], + } + } + $haproxy_location_rule = { + resource_discovery => 'exclusive', + score => 0, + expression => ['haproxy-role eq true'], + } + # FIXME: we should not have to access tripleo::haproxy class + # parameters here to configure pacemaker VIPs. The configuration + # of pacemaker VIPs could move into puppet-tripleo or we should + # make use of less specific hiera parameters here for the settings. + $haproxy_nodes = hiera('haproxy_short_node_names') + $haproxy_nodes_count = count($haproxy_nodes) + + pacemaker::resource::bundle { 'haproxy-bundle': + image => $haproxy_docker_image, + replicas => $haproxy_nodes_count, + location_rule => $haproxy_location_rule, + container_options => 'network=host', + options => '--user=root --log-driver=journald -e KOLLA_CONFIG_STRATEGY=COPY_ALWAYS', + run_command => '/bin/bash /usr/local/bin/kolla_start', + storage_maps => { + 'haproxy-cfg-files' => { + 'source-dir' => '/var/lib/kolla/config_files/haproxy.json', + 'target-dir' => '/var/lib/kolla/config_files/config.json', + 'options' => 'ro', + }, + 'haproxy-cfg-data' => { + 'source-dir' => '/var/lib/config-data/haproxy/etc', + 'target-dir' => '/etc', + 'options' => 'ro', + }, + 'haproxy-hosts' => { + 'source-dir' => '/etc/hosts', + 'target-dir' => '/etc/hosts', + 'options' => 'ro', + }, + 'haproxy-localtime' => { + 'source-dir' => '/etc/localtime', + 'target-dir' => '/etc/localtime', + 'options' => 'ro', + }, + 'haproxy-pki-extracted' => { + 'source-dir' => '/etc/pki/ca-trust/extracted', + 'target-dir' => '/etc/pki/ca-trust/extracted', + 'options' => 'ro', + }, + 'haproxy-pki-ca-bundle-crt' => { + 'source-dir' => '/etc/pki/tls/certs/ca-bundle.crt', + 'target-dir' => '/etc/pki/tls/certs/ca-bundle.crt', + 'options' => 'ro', + }, + 'haproxy-pki-ca-bundle-trust-crt' => { + 'source-dir' => '/etc/pki/tls/certs/ca-bundle.trust.crt', + 'target-dir' => '/etc/pki/tls/certs/ca-bundle.trust.crt', + 'options' => 'ro', + }, + 'haproxy-pki-cert' => { + 'source-dir' => '/etc/pki/tls/cert.pem', + 'target-dir' => '/etc/pki/tls/cert.pem', + 'options' => 'ro', + }, + 'haproxy-dev-log' => { + 'source-dir' => '/dev/log', + 'target-dir' => '/dev/log', + 'options' => 'rw', + }, + }, + } + $control_vip = hiera('controller_virtual_ip') + tripleo::pacemaker::haproxy_with_vip { 'haproxy_and_control_vip': + vip_name => 'control', + ip_address => $control_vip, + location_rule => $haproxy_location_rule, + pcs_tries => $pcs_tries, + } + + $public_vip = hiera('public_virtual_ip') + tripleo::pacemaker::haproxy_with_vip { 'haproxy_and_public_vip': + ensure => $public_vip and $public_vip != $control_vip, + vip_name => 'public', + ip_address => $public_vip, + location_rule => $haproxy_location_rule, + pcs_tries => $pcs_tries, + } + + $redis_vip = hiera('redis_vip') + tripleo::pacemaker::haproxy_with_vip { 'haproxy_and_redis_vip': + ensure => $redis_vip and $redis_vip != $control_vip, + vip_name => 'redis', + ip_address => $redis_vip, + location_rule => $haproxy_location_rule, + pcs_tries => $pcs_tries, + } + + $internal_api_vip = hiera('internal_api_virtual_ip') + tripleo::pacemaker::haproxy_with_vip { 'haproxy_and_internal_api_vip': + ensure => $internal_api_vip and $internal_api_vip != $control_vip, + vip_name => 'internal_api', + ip_address => $internal_api_vip, + location_rule => $haproxy_location_rule, + pcs_tries => $pcs_tries, + } + + $storage_vip = hiera('storage_virtual_ip') + tripleo::pacemaker::haproxy_with_vip { 'haproxy_and_storage_vip': + ensure => $storage_vip and $storage_vip != $control_vip, + vip_name => 'storage', + ip_address => $storage_vip, + location_rule => $haproxy_location_rule, + pcs_tries => $pcs_tries, + } + + $storage_mgmt_vip = hiera('storage_mgmt_virtual_ip') + tripleo::pacemaker::haproxy_with_vip { 'haproxy_and_storage_mgmt_vip': + ensure => $storage_mgmt_vip and $storage_mgmt_vip != $control_vip, + vip_name => 'storage_mgmt', + ip_address => $storage_mgmt_vip, + location_rule => $haproxy_location_rule, + pcs_tries => $pcs_tries, + } + } + } + +} diff --git a/manifests/profile/pacemaker/manila.pp b/manifests/profile/pacemaker/manila.pp index 7bcf8d6..c22a033 100644 --- a/manifests/profile/pacemaker/manila.pp +++ b/manifests/profile/pacemaker/manila.pp @@ -55,7 +55,7 @@ class tripleo::profile::pacemaker::manila ( $backend_cephfs_enabled = hiera('manila_backend_cephfs_enabled', false), $ceph_mds_enabled = hiera('ceph_mds_enabled', false), $bootstrap_node = hiera('manila_share_short_bootstrap_node_name'), - $step = hiera('step'), + $step = Integer(hiera('step')), $pcs_tries = hiera('pcs_tries', 20), ) { if $::hostname == downcase($bootstrap_node) { diff --git a/manifests/profile/pacemaker/neutron/lbaas.pp b/manifests/profile/pacemaker/neutron/lbaas.pp new file mode 100644 index 0000000..9e86dfe --- /dev/null +++ b/manifests/profile/pacemaker/neutron/lbaas.pp @@ -0,0 +1,44 @@ +# Copyright 2016 Red Hat, Inc. +# +# Licensed under the Apache License, Version 2.0 (the "License"); you may +# not use this file except in compliance with the License. You may obtain +# a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT +# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the +# License for the specific language governing permissions and limitations +# under the License. +# +# == Class: tripleo::profile::pacemaker::neutron::lbaas +# +# Neutron LBaaS Agent Pacemaker HA profile for tripleo +# +# === Parameters +# +# [*step*] +# (Optional) The current step in deployment. See tripleo-heat-templates +# for more details. +# Defaults to hiera('step') +# +# [*pacemaker_master*] +# (Optional) The hostname of the pacemaker master +# Defaults to hiera('bootstrap_nodeid') +# +class tripleo::profile::pacemaker::neutron::lbaas ( + $step = Integer(hiera('step')), + $pacemaker_master = hiera('bootstrap_nodeid'), +) { + + include ::neutron::params + include ::tripleo::profile::pacemaker::neutron + include ::tripleo::profile::base::neutron::lbaas + + if $step >= 5 and downcase($::hostname) == $pacemaker_master { + pacemaker::resource::service { $::neutron::params::lbaasv2_agent_service: + clone_params => 'interleave=true', + } + } +} diff --git a/manifests/profile/pacemaker/ovn_northd.pp b/manifests/profile/pacemaker/ovn_northd.pp new file mode 100644 index 0000000..212c345 --- /dev/null +++ b/manifests/profile/pacemaker/ovn_northd.pp @@ -0,0 +1,99 @@ +# Copyright 2017 Red Hat, Inc. +# +# Licensed under the Apache License, Version 2.0 (the "License"); you may +# not use this file except in compliance with the License. You may obtain +# a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT +# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the +# License for the specific language governing permissions and limitations +# under the License. +# +# == Class: tripleo::profile::pacemaker::neutron::plugins::ml2::ovn +# +# Neutron ML2 driver Pacemaker HA profile for tripleo +# +# === Parameters +# +# [*pacemaker_master*] +# (Optional) The hostname of the pacemaker master +# Defaults to hiera('ovn_dbs_short_bootstrap_node_name') +# +# [*step*] +# (Optional) The current step in deployment. See tripleo-heat-templates +# for more details. +# Defaults to hiera('step') +# +# [*pcs_tries*] +# (Optional) The number of times pcs commands should be retried. +# Defaults to hiera('pcs_tries', 20) +# +# [*ovn_dbs_vip*] +# (Optional) The vip to be used for OVN DB servers. It is expected that +# the vip resource to be created before calling this class. +# Defaults to hiera('ovn_dbs_vip') +# +# [*nb_db_port*] +# The TCP port in which the OVN Northbound DB listens to. +# Defaults to 6641 +# +# [*sb_db_port*] +# The TCP port in which the OVN Southbound DB listens to. +# Defaults to 6642 +# + +class tripleo::profile::pacemaker::ovn_northd ( + $pacemaker_master = hiera('ovn_dbs_short_bootstrap_node_name'), + $step = Integer(hiera('step')), + $pcs_tries = hiera('pcs_tries', 20), + $ovn_dbs_vip = hiera('ovn_dbs_vip'), + $nb_db_port = 6641, + $sb_db_port = 6642 +) { + + if $step >= 2 { + pacemaker::property { 'ovndb-role-node-property': + property => 'ovndb-role', + value => true, + tries => $pcs_tries, + node => $::hostname, + } + } + + if $step >= 3 and downcase($::hostname) == $pacemaker_master { + $ovndb_servers_resource_name = 'ovndb_servers' + $ovndb_servers_ocf_name = 'ovn:ovndb-servers' + $ovndb_vip_resource_name = "ip-${ovn_dbs_vip}" + + # By step 3, all the VIPs would have been created. + # After creating ovn ocf resource, colocate it with the + # VIP - ip-${ovn_dbs_vip}. + pacemaker::resource::ocf { "${ovndb_servers_resource_name}": + ocf_agent_name => "${ovndb_servers_ocf_name}", + master_params => '', + op_params => 'start timeout=200s stop timeout=200s', + resource_params => "master_ip=${ovn_dbs_vip} nb_master_port=${nb_db_port} sb_master_port=${sb_db_port} manage_northd=yes", + tries => $pcs_tries, + location_rule => { + resource_discovery => 'exclusive', + score => 0, + expression => ['ovndb-role eq true'], + }, + meta_params => 'notify=true' + } + + pacemaker::constraint::colocation { "${ovndb_vip_resource_name}-with-${ovndb_servers_resource_name}": + source => "${ovndb_vip_resource_name}", + target => "${ovndb_servers_resource_name}-master", + master_slave => true, + score => 'INFINITY', + tries => $pcs_tries, + } + + Pacemaker::Resource::Ocf["${ovndb_servers_resource_name}"] -> + Pacemaker::Constraint::Colocation["${ovndb_vip_resource_name}-with-${ovndb_servers_resource_name}"] + } +} diff --git a/manifests/profile/pacemaker/rabbitmq.pp b/manifests/profile/pacemaker/rabbitmq.pp index bf6a38d..3d87598 100644 --- a/manifests/profile/pacemaker/rabbitmq.pp +++ b/manifests/profile/pacemaker/rabbitmq.pp @@ -51,7 +51,7 @@ class tripleo::profile::pacemaker::rabbitmq ( $user_ha_queues = hiera('rabbitmq::nr_ha_queues', 0), $rabbit_nodes = hiera('rabbitmq_node_names'), $pcs_tries = hiera('pcs_tries', 20), - $step = hiera('step'), + $step = Integer(hiera('step')), ) { if $::hostname == downcase($bootstrap_node) { $pacemaker_master = true diff --git a/manifests/profile/pacemaker/rabbitmq_bundle.pp b/manifests/profile/pacemaker/rabbitmq_bundle.pp new file mode 100644 index 0000000..0a6295c --- /dev/null +++ b/manifests/profile/pacemaker/rabbitmq_bundle.pp @@ -0,0 +1,199 @@ +# Copyright 2017 Red Hat, Inc. +# +# Licensed under the Apache License, Version 2.0 (the "License"); you may +# not use this file except in compliance with the License. You may obtain +# a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT +# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the +# License for the specific language governing permissions and limitations +# under the License. +# +# == Class: tripleo::profile::pacemaker::rabbitmq_bundle +# +# Containerized RabbitMQ Pacemaker HA profile for tripleo +# +# === Parameters +# +# [*rabbitmq_docker_image*] +# (Optional) The docker image to use for creating the pacemaker bundle +# Defaults to hiera('tripleo::profile::pacemaker::rabbitmq_bundle::rabbitmq_docker_image', undef) +# +# [*rabbitmq_docker_control_port*] +# (Optional) The bundle's pacemaker_remote control port on the host +# Defaults to hiera('tripleo::profile::pacemaker::rabbitmq_bundle::control_port', '3121') +# +# [*bootstrap_node*] +# (Optional) The hostname of the node responsible for bootstrapping tasks +# Defaults to hiera('rabbitmq_short_bootstrap_node_name') +# +# [*erlang_cookie*] +# (Optional) Content of erlang cookie. +# Defaults to hiera('rabbitmq::erlang_cookie'). +# +# [*user_ha_queues*] +# (Optional) The number of HA queues in to be configured in rabbitmq +# Defaults to hiera('rabbitmq::nr_ha_queues'), which is usually 0 meaning +# that the queues number will be CEIL(N/2) where N is the number of rabbitmq +# nodes. +# +# [*rabbit_nodes*] +# (Optional) The list of rabbitmq nodes names +# Defaults to hiera('rabbitmq_node_names') +# +# [*step*] +# (Optional) The current step in deployment. See tripleo-heat-templates +# for more details. +# Defaults to hiera('step') +# +# [*pcs_tries*] +# (Optional) The number of times pcs commands should be retried. +# Defaults to hiera('pcs_tries', 20) +# +class tripleo::profile::pacemaker::rabbitmq_bundle ( + $rabbitmq_docker_image = hiera('tripleo::profile::pacemaker::rabbitmq_bundle::rabbitmq_docker_image', undef), + $rabbitmq_docker_control_port = hiera('tripleo::profile::pacemaker::rabbitmq_bundle::control_port', '3121'), + $bootstrap_node = hiera('rabbitmq_short_bootstrap_node_name'), + $erlang_cookie = hiera('rabbitmq::erlang_cookie'), + $user_ha_queues = hiera('rabbitmq::nr_ha_queues', 0), + $rabbit_nodes = hiera('rabbitmq_node_names'), + $pcs_tries = hiera('pcs_tries', 20), + $step = Integer(hiera('step')), +) { + if $::hostname == downcase($bootstrap_node) { + $pacemaker_master = true + } else { + $pacemaker_master = false + } + + include ::tripleo::profile::base::rabbitmq + + file { '/var/lib/rabbitmq/.erlang.cookie': + ensure => file, + owner => 'rabbitmq', + group => 'rabbitmq', + mode => '0400', + content => $erlang_cookie, + replace => true, + require => Class['::rabbitmq'], + } + + if $step >= 1 and $pacemaker_master and hiera('stack_action') == 'UPDATE' { + tripleo::pacemaker::resource_restart_flag { 'rabbitmq-clone': + subscribe => Class['rabbitmq::service'], + } + } + + + if $step >= 2 { + if $pacemaker_master { + $rabbitmq_short_node_names = hiera('rabbitmq_short_node_names') + $rabbitmq_nodes_count = count($rabbitmq_short_node_names) + $rabbitmq_short_node_names.each |String $node_name| { + pacemaker::property { "rabbitmq-role-${node_name}": + property => 'rabbitmq-role', + value => true, + tries => $pcs_tries, + node => $node_name, + before => Pacemaker::Resource::Bundle['rabbitmq-bundle'], + } + } + + pacemaker::resource::bundle { 'rabbitmq-bundle': + image => $rabbitmq_docker_image, + replicas => $rabbitmq_nodes_count, + location_rule => { + resource_discovery => 'exclusive', + score => 0, + expression => ['rabbitmq-role eq true'], + }, + container_options => 'network=host', + options => '--user=root --log-driver=journald -e KOLLA_CONFIG_STRATEGY=COPY_ALWAYS', + run_command => '/bin/bash /usr/local/bin/kolla_start', + network => "control-port=${rabbitmq_docker_control_port}", + storage_maps => { + 'rabbitmq-cfg-files' => { + 'source-dir' => '/var/lib/kolla/config_files/rabbitmq.json', + 'target-dir' => '/var/lib/kolla/config_files/config.json', + 'options' => 'ro', + }, + 'rabbitmq-cfg-data' => { + 'source-dir' => '/var/lib/config-data/rabbitmq/etc/rabbitmq', + 'target-dir' => '/etc/rabbitmq', + 'options' => 'ro', + }, + 'rabbitmq-hosts' => { + 'source-dir' => '/etc/hosts', + 'target-dir' => '/etc/hosts', + 'options' => 'ro', + }, + 'rabbitmq-localtime' => { + 'source-dir' => '/etc/localtime', + 'target-dir' => '/etc/localtime', + 'options' => 'ro', + }, + 'rabbitmq-lib' => { + 'source-dir' => '/var/lib/rabbitmq', + 'target-dir' => '/var/lib/rabbitmq', + 'options' => 'rw', + }, + 'rabbitmq-pki-extracted' => { + 'source-dir' => '/etc/pki/ca-trust/extracted', + 'target-dir' => '/etc/pki/ca-trust/extracted', + 'options' => 'ro', + }, + 'rabbitmq-pki-ca-bundle-crt' => { + 'source-dir' => '/etc/pki/tls/certs/ca-bundle.crt', + 'target-dir' => '/etc/pki/tls/certs/ca-bundle.crt', + 'options' => 'ro', + }, + 'rabbitmq-pki-ca-bundle-trust-crt' => { + 'source-dir' => '/etc/pki/tls/certs/ca-bundle.trust.crt', + 'target-dir' => '/etc/pki/tls/certs/ca-bundle.trust.crt', + 'options' => 'ro', + }, + 'rabbitmq-pki-cert' => { + 'source-dir' => '/etc/pki/tls/cert.pem', + 'target-dir' => '/etc/pki/tls/cert.pem', + 'options' => 'ro', + }, + 'rabbitmq-dev-log' => { + 'source-dir' => '/dev/log', + 'target-dir' => '/dev/log', + 'options' => 'rw', + }, + }, + } + + # The default nr of ha queues is ceiling(N/2) + if $user_ha_queues == 0 { + $nr_rabbit_nodes = size($rabbit_nodes) + $nr_ha_queues = $nr_rabbit_nodes / 2 + ($nr_rabbit_nodes % 2) + $params = "set_policy='ha-all ^(?!amq\\.).* {\"ha-mode\":\"exactly\",\"ha-params\":${nr_ha_queues}}'" + } elsif $user_ha_queues == -1 { + $params = 'set_policy=\'ha-all ^(?!amq\.).* {"ha-mode":"all"}\'' + } else { + $nr_ha_queues = $user_ha_queues + $params = "set_policy='ha-all ^(?!amq\\.).* {\"ha-mode\":\"exactly\",\"ha-params\":${nr_ha_queues}}'" + } + pacemaker::resource::ocf { 'rabbitmq': + ocf_agent_name => 'heartbeat:rabbitmq-cluster', + resource_params => $params, + meta_params => 'notify=true', + op_params => 'start timeout=200s stop timeout=200s', + tries => $pcs_tries, + location_rule => { + resource_discovery => 'exclusive', + score => 0, + expression => ['rabbitmq-role eq true'], + }, + bundle => 'rabbitmq-bundle', + require => [Class['::rabbitmq'], + Pacemaker::Resource::Bundle['rabbitmq-bundle']], + } + } + } +} diff --git a/manifests/ui.pp b/manifests/ui.pp index 1745535..d744044 100644 --- a/manifests/ui.pp +++ b/manifests/ui.pp @@ -65,10 +65,18 @@ # The ironic proxy endpoint url # Defaults to undef # +# [*endpoint_proxy_ironic_inspector*] +# The ironic inspector proxy endpoint url +# Defaults to undef +# # [*endpoint_config_ironic*] # The ironic config endpoint url # Defaults to undef # +# [*endpoint_config_ironic_inspector*] +# The ironic inspector config endpoint url +# Defaults to undef +# # [*endpoint_proxy_mistral*] # The mistral proxy endpoint url # Defaults to undef @@ -112,27 +120,32 @@ class tripleo::ui ( 'ko-KR' => 'Korean', 'zh-CN' => 'Simplified Chinese' }, - $endpoint_proxy_zaqar = undef, - $endpoint_proxy_keystone = undef, - $endpoint_proxy_heat = undef, - $endpoint_proxy_ironic = undef, - $endpoint_proxy_mistral = undef, - $endpoint_proxy_swift = undef, - $endpoint_config_zaqar = undef, - $endpoint_config_keystone = undef, - $endpoint_config_heat = undef, - $endpoint_config_ironic = undef, - $endpoint_config_mistral = undef, - $endpoint_config_swift = undef, + $endpoint_proxy_zaqar = undef, + $endpoint_proxy_keystone = undef, + $endpoint_proxy_heat = undef, + $endpoint_proxy_ironic = undef, + $endpoint_proxy_ironic_inspector = undef, + $endpoint_proxy_mistral = undef, + $endpoint_proxy_swift = undef, + $endpoint_config_zaqar = undef, + $endpoint_config_keystone = undef, + $endpoint_config_heat = undef, + $endpoint_config_ironic = undef, + $endpoint_config_ironic_inspector = undef, + $endpoint_config_mistral = undef, + $endpoint_config_swift = undef, ) { + package {'openstack-tripleo-ui': } + include ::apache include ::apache::mod::proxy include ::apache::mod::proxy_http include ::apache::mod::proxy_wstunnel ::apache::vhost { 'tripleo-ui': ensure => 'present', + require => Package['openstack-tripleo-ui'], servername => $servername, ip => $bind_host, port => $ui_port, @@ -160,6 +173,11 @@ class tripleo::ui ( 'reverse_urls' => $endpoint_proxy_ironic }, { + 'path' => '/ironic-inspector', + 'url' => $endpoint_proxy_ironic_inspector, + 'reverse_urls' => $endpoint_proxy_ironic_inspector + }, + { 'path' => '/mistral', 'url' => $endpoint_proxy_mistral, 'reverse_urls' => $endpoint_proxy_mistral diff --git a/metadata.json b/metadata.json index 32b5d95..2bb3304 100644 --- a/metadata.json +++ b/metadata.json @@ -1,6 +1,6 @@ { "name": "openstack-tripleo", - "version": "7.0.0", + "version": "7.1.0", "author": "OpenStack Contributors", "summary": "Puppet module for TripleO", "license": "Apache-2.0", diff --git a/releasenotes/notes/Add-CRL-resource-d2263462d40f01c0.yaml b/releasenotes/notes/Add-CRL-resource-d2263462d40f01c0.yaml new file mode 100644 index 0000000..7826b87 --- /dev/null +++ b/releasenotes/notes/Add-CRL-resource-d2263462d40f01c0.yaml @@ -0,0 +1,4 @@ +--- +features: + - The resource ::tripleo::certmonger::ca::crl was added. The purpose of this + resource is to fetch a CRL file and set up a cron job to refresh that file. diff --git a/releasenotes/notes/Composable_role_for_neutron_lbaas-acdf08f1a9dfd3fe.yaml b/releasenotes/notes/Composable_role_for_neutron_lbaas-acdf08f1a9dfd3fe.yaml new file mode 100644 index 0000000..20e5994 --- /dev/null +++ b/releasenotes/notes/Composable_role_for_neutron_lbaas-acdf08f1a9dfd3fe.yaml @@ -0,0 +1,3 @@ +--- +features: + - Adds composable service interface for Neutron LBaaSv2 service. diff --git a/releasenotes/notes/HAProxy-CRL-d05b555f92ff55ed.yaml b/releasenotes/notes/HAProxy-CRL-d05b555f92ff55ed.yaml new file mode 100644 index 0000000..cdfb859 --- /dev/null +++ b/releasenotes/notes/HAProxy-CRL-d05b555f92ff55ed.yaml @@ -0,0 +1,6 @@ +--- +security: + - If the crl_file parameter is given to the ::tripleo::haproxy resource and + TLS is enabled in the internal network, it will configure the CRL file for + all the nodes it's proxying and thus properly handle revocation of the + server certificates. diff --git a/releasenotes/notes/add-mistral-event-engine-05097cb76834f09d.yaml b/releasenotes/notes/add-mistral-event-engine-05097cb76834f09d.yaml new file mode 100644 index 0000000..29768c0 --- /dev/null +++ b/releasenotes/notes/add-mistral-event-engine-05097cb76834f09d.yaml @@ -0,0 +1,4 @@ +--- +features: + - Add support for Mistral event engine. + diff --git a/releasenotes/notes/add-mysql_maxconn-to-haproxy-84a5ad07d8d14ddd.yaml b/releasenotes/notes/add-mysql_maxconn-to-haproxy-84a5ad07d8d14ddd.yaml new file mode 100644 index 0000000..8359456 --- /dev/null +++ b/releasenotes/notes/add-mysql_maxconn-to-haproxy-84a5ad07d8d14ddd.yaml @@ -0,0 +1,5 @@ +--- +features: + - | + Added new parameter mysql_maxconn to the tripleo::haproxy class, + allowing haproxy maxconn to be configured for the MySQL server. diff --git a/releasenotes/notes/add-support-for-proxying-ironic-inspector-via-apache-ea70e9fa1ad04553.yaml b/releasenotes/notes/add-support-for-proxying-ironic-inspector-via-apache-ea70e9fa1ad04553.yaml new file mode 100644 index 0000000..940c20e --- /dev/null +++ b/releasenotes/notes/add-support-for-proxying-ironic-inspector-via-apache-ea70e9fa1ad04553.yaml @@ -0,0 +1,6 @@ +--- +features: + - | + Added variables for endpoint_proxy_ironic_inspector, + endpoint_config_ironic_inspector, and Apache mod_proxy configuration to + proxy ironic-inspector service just like similar services diff --git a/releasenotes/notes/calculate-dhcp-agents-per-network-3089c5e7b15f8b7b.yaml b/releasenotes/notes/calculate-dhcp-agents-per-network-3089c5e7b15f8b7b.yaml index 800cedc..1e6c327 100644 --- a/releasenotes/notes/calculate-dhcp-agents-per-network-3089c5e7b15f8b7b.yaml +++ b/releasenotes/notes/calculate-dhcp-agents-per-network-3089c5e7b15f8b7b.yaml @@ -1,5 +1,6 @@ --- -features: | - - Unless a non-default value is provided, the dhcp_agents_per_network +features: + - | + Unless a non-default value is provided, the dhcp_agents_per_network neutron configuration variable is set to the number of deployed neutron dhcp agents. diff --git a/releasenotes/notes/galera-install-rsync-b2f2504f12cc0cfd.yaml b/releasenotes/notes/galera-install-rsync-b2f2504f12cc0cfd.yaml new file mode 100644 index 0000000..4b2fe0d --- /dev/null +++ b/releasenotes/notes/galera-install-rsync-b2f2504f12cc0cfd.yaml @@ -0,0 +1,6 @@ +--- +fixes: + - The mysql pacemaker profile now makes sure that the + rsync package is installed since it configures + wsrep_sst_method for galera to use rsync. See + https://bugs.launchpad.net/tripleo/+bug/1693003 diff --git a/releasenotes/notes/mistral-mod-wsgi-1a1d3eb279daa7fd.yaml b/releasenotes/notes/mistral-mod-wsgi-1a1d3eb279daa7fd.yaml new file mode 100644 index 0000000..ae6401f --- /dev/null +++ b/releasenotes/notes/mistral-mod-wsgi-1a1d3eb279daa7fd.yaml @@ -0,0 +1,7 @@ +--- +features: + - Move Mistral API to use mod_wsgi under Apache. +upgrade: + - Mistral API systemd service will be stopped and + disabled. + diff --git a/releasenotes/notes/nf_conntrack_proto_sctp-a64300a3fc7b4e55.yaml b/releasenotes/notes/nf_conntrack_proto_sctp-a64300a3fc7b4e55.yaml new file mode 100644 index 0000000..9aad5ee --- /dev/null +++ b/releasenotes/notes/nf_conntrack_proto_sctp-a64300a3fc7b4e55.yaml @@ -0,0 +1,9 @@ +--- +issues: + - | + Ignore failures if nf_conntrack_proto_sctp module failed to load. + Since RHEL 7.4, nf_conntrack_proto_sctp module is compiled into the + kernel instead of as a module as the sctp support. + TripleO will still try to load the module to support RHEL 7.3, but + in the future will remove the module management and rely on the kernel + provided in newer versions of RHEL. diff --git a/releasenotes/notes/ovn-ha-c7668c26aefb8f2d.yaml b/releasenotes/notes/ovn-ha-c7668c26aefb8f2d.yaml new file mode 100644 index 0000000..09c5111 --- /dev/null +++ b/releasenotes/notes/ovn-ha-c7668c26aefb8f2d.yaml @@ -0,0 +1,4 @@ +--- +features: + - Support HA for OVN db servers and ovn-northd using Pacemaker + diff --git a/releasenotes/notes/swift-container-ring-mgmt-ecf65b9fbae0d297.yaml b/releasenotes/notes/swift-container-ring-mgmt-ecf65b9fbae0d297.yaml new file mode 100644 index 0000000..dff2bb0 --- /dev/null +++ b/releasenotes/notes/swift-container-ring-mgmt-ecf65b9fbae0d297.yaml @@ -0,0 +1,8 @@ +--- +fixes: + - | + Fixes the step conditions in the Swift ring building process and + also chains the tarball creation to the rebalance. Adds an option to + disable the recon check before uploading modified rings. These fixes + are required to properly manage rings when used in containerized + environments. diff --git a/releasenotes/source/conf.py b/releasenotes/source/conf.py index e293b07..4661b77 100644 --- a/releasenotes/source/conf.py +++ b/releasenotes/source/conf.py @@ -52,9 +52,9 @@ copyright = u'2017, Puppet TripleO Developers' # built documents. # # The short X.Y version. -version = '7.0.0' +version = '7.1.0' # The full version, including alpha/beta/rc tags. -release = '7.0.0' +release = '7.1.0' # The language for content autogenerated by Sphinx. Refer to documentation # for a list of supported languages. diff --git a/releasenotes/source/ocata.rst b/releasenotes/source/ocata.rst index ebe62f4..53fb86e 100644 --- a/releasenotes/source/ocata.rst +++ b/releasenotes/source/ocata.rst @@ -3,4 +3,4 @@ =================================== .. release-notes:: - :branch: origin/stable/ocata + :branch: stable/ocata @@ -3,7 +3,7 @@ name = puppet-tripleo summary = Puppet module for OpenStack TripleO description-file = README.md -author = Puppet Labs and OpenStack Contributors +author = OpenStack author-email = openstack-dev@lists.openstack.org home-page = http://www.openstack.org/ classifier = diff --git a/spec/classes/tripleo_certmonger_ca_crl_spec.rb b/spec/classes/tripleo_certmonger_ca_crl_spec.rb new file mode 100644 index 0000000..1e605ce --- /dev/null +++ b/spec/classes/tripleo_certmonger_ca_crl_spec.rb @@ -0,0 +1,104 @@ +# +# Copyright (C) 2017 Red Hat Inc. +# +# Licensed under the Apache License, Version 2.0 (the "License"); you may +# not use this file except in compliance with the License. You may obtain +# a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT +# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the +# License for the specific language governing permissions and limitations +# under the License. +# +# Unit tests for tripleo +# + +require 'spec_helper' + +describe 'tripleo::certmonger::ca::crl' do + + shared_examples_for 'tripleo::certmonger::ca::crl' do + + context 'with default parameters (no crl_source)' do + it 'should ensure no CRL nor cron job are present' do + is_expected.to contain_file('tripleo-ca-crl').with( + :ensure => 'absent' + ) + is_expected.to contain_cron('tripleo-refresh-crl-file').with( + :ensure => 'absent' + ) + end + end + + context 'with defined CRL source' do + let :params do + { + :crl_dest => '/etc/pki/CA/crl/overcloud-crl.pem', + :crl_preprocessed => '/etc/pki/CA/crl/overcloud-crl.bin', + :crl_source => 'file://tmp/some/crl.bin', + } + end + + let :process_cmd do + "openssl crl -in #{params[:crl_preprocessed]} -inform DER -outform PEM -out #{params[:crl_dest]}" + end + + let :cron_cmd do + "curl -L -o #{params[:crl_preprocessed]} #{params[:crl_source]} && #{process_cmd}" + end + + it 'should create and process CRL file' do + is_expected.to contain_file('tripleo-ca-crl').with( + :ensure => 'present', + :source => params[:crl_source] + ) + is_expected.to contain_exec('tripleo-ca-crl-process-command').with( + :command => process_cmd + ) + is_expected.to contain_cron('tripleo-refresh-crl-file').with( + :ensure => 'present', + :command => cron_cmd + ) + end + end + + context 'with defined CRL source and no processing' do + let :params do + { + :crl_dest => '/etc/pki/CA/crl/overcloud-crl.pem', + :crl_source => 'file://tmp/some/crl.pem', + :process => false + } + end + + let :cron_cmd do + "curl -L -o #{params[:crl_dest]} #{params[:crl_source]}" + end + + it 'should create and process CRL file' do + is_expected.to contain_file('tripleo-ca-crl').with( + :ensure => 'present', + :source => params[:crl_source] + ) + is_expected.to_not contain_exec('tripleo-ca-crl-process-command') + is_expected.to contain_cron('tripleo-refresh-crl-file').with( + :ensure => 'present', + :command => cron_cmd + ) + end + end + end + + on_supported_os.each do |os, facts| + context "on #{os}" do + let(:facts) do + facts.merge({}) + end + + it_behaves_like 'tripleo::certmonger::ca::crl' + end + end +end diff --git a/spec/classes/tripleo_certmonger_ca_local.rb b/spec/classes/tripleo_certmonger_ca_local_spec.rb index 7ee9383..7ee9383 100644 --- a/spec/classes/tripleo_certmonger_ca_local.rb +++ b/spec/classes/tripleo_certmonger_ca_local_spec.rb diff --git a/spec/classes/tripleo_certmonger_etcd.rb b/spec/classes/tripleo_certmonger_etcd_spec.rb index fc0aad3..fc0aad3 100644 --- a/spec/classes/tripleo_certmonger_etcd.rb +++ b/spec/classes/tripleo_certmonger_etcd_spec.rb diff --git a/spec/classes/tripleo_certmonger_mysql.rb b/spec/classes/tripleo_certmonger_mysql_spec.rb index 23b1e4f..23b1e4f 100644 --- a/spec/classes/tripleo_certmonger_mysql.rb +++ b/spec/classes/tripleo_certmonger_mysql_spec.rb diff --git a/spec/classes/tripleo_certmonger_rabbitmq.rb b/spec/classes/tripleo_certmonger_rabbitmq_spec.rb index 5c011ce..5c011ce 100644 --- a/spec/classes/tripleo_certmonger_rabbitmq.rb +++ b/spec/classes/tripleo_certmonger_rabbitmq_spec.rb diff --git a/spec/classes/tripleo_haproxy_spec.rb b/spec/classes/tripleo_haproxy_spec.rb new file mode 100644 index 0000000..966729a --- /dev/null +++ b/spec/classes/tripleo_haproxy_spec.rb @@ -0,0 +1,115 @@ +# Copyright 2016 Red Hat, Inc. +# All Rights Reserved. +# +# Licensed under the Apache License, Version 2.0 (the "License"); you may +# not use this file except in compliance with the License. You may obtain +# a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT +# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the +# License for the specific language governing permissions and limitations +# under the License. +# + +require 'spec_helper' + +describe 'tripleo::haproxy' do + + shared_examples_for 'tripleo::haproxy' do + let :params do { + :controller_virtual_ip => '10.1.0.1', + :public_virtual_ip => '192.168.0.1' + } + end + + describe "default settings" do + it 'should configure haproxy' do + is_expected.to contain_haproxy__listen('mysql').with( + :options => { + 'timeout client' => "90m", + 'timeout server' => "90m", + 'maxconn' => :undef + } + ) + end + end + + describe "set clustercheck" do + before :each do + params.merge!({ + :mysql_clustercheck => true, + }) + end + + it 'should configure haproxy with clustercheck' do + is_expected.to contain_haproxy__listen('mysql').with( + :options => { + 'timeout client' => "90m", + 'timeout server' => "90m", + 'option' => ["tcpka", "httpchk"], + 'timeout client' => "90m", + 'timeout server' => "90m", + 'stick-table' => "type ip size 1000", + 'stick' => "on dst", + 'maxconn' => :undef + } + ) + end + end + + describe "override maxconn with clustercheck" do + before :each do + params.merge!({ + :mysql_clustercheck => true, + :mysql_max_conn => 6500, + }) + end + + it 'should configure haproxy' do + is_expected.to contain_haproxy__listen('mysql').with( + :options => { + 'option' => ["tcpka", "httpchk"], + 'timeout client' => "90m", + 'timeout server' => "90m", + 'stick-table' => "type ip size 1000", + 'stick' => "on dst", + 'maxconn' => 6500 + } + ) + end + end + + describe "override maxconn without clustercheck" do + before :each do + params.merge!({ + :mysql_max_conn => 6500, + }) + end + + it 'should configure haproxy' do + is_expected.to contain_haproxy__listen('mysql').with( + :options => { + 'timeout client' => "90m", + 'timeout server' => "90m", + 'maxconn' => 6500 + } + ) + end + end + + end + + on_supported_os.each do |os, facts| + context "on #{os}" do + let(:facts) do + facts.merge({ }) + end + + it_behaves_like 'tripleo::haproxy' + end + end + +end
\ No newline at end of file diff --git a/spec/classes/tripleo_profile_base_ceilometer_spec.rb b/spec/classes/tripleo_profile_base_ceilometer_spec.rb index 8c1d507..bc4ffac 100644 --- a/spec/classes/tripleo_profile_base_ceilometer_spec.rb +++ b/spec/classes/tripleo_profile_base_ceilometer_spec.rb @@ -43,30 +43,6 @@ describe 'tripleo::profile::base::ceilometer' do end end - context 'with step 5 with bootstrap node' do - let(:params) { { - :bootstrap_node => 'node.example.com', - :step => 5, - :oslomsg_rpc_hosts => [ '127.0.0.1' ], - :oslomsg_rpc_username => 'ceilometer', - :oslomsg_rpc_password => 'foo', - } } - - it 'should trigger complete configuration' do - is_expected.to contain_exec('ceilometer-db-upgrade') - end - end - - context 'with step 5 without bootstrap node' do - let(:params) { { - :bootstrap_node => 'somethingelse.example.com', - :step => 5, - } } - - it 'should trigger complete configuration' do - is_expected.to_not contain_exec('ceilometer-db-upgrade') - end - end end diff --git a/spec/classes/tripleo_profile_base_database_redis_spec.rb b/spec/classes/tripleo_profile_base_database_redis_spec.rb new file mode 100644 index 0000000..8f94cc9 --- /dev/null +++ b/spec/classes/tripleo_profile_base_database_redis_spec.rb @@ -0,0 +1,106 @@ +# +# Copyright (C) 2017 Red Hat, Inc. +# +# Licensed under the Apache License, Version 2.0 (the "License"); you may +# not use this file except in compliance with the License. You may obtain +# a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT +# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the +# License for the specific language governing permissions and limitations +# under the License. +# + +require 'spec_helper' + +describe 'tripleo::profile::base::database::redis' do + shared_examples_for 'tripleo::profile::base::database::redis' do + + context 'with step less than 2' do + let(:params) { { + :step => 1, + :bootstrap_nodeid => 'node.example.com', + :redis_node_ips => [] + } } + + it 'should do nothing' do + is_expected.to contain_class('tripleo::profile::base::database::redis') + is_expected.to_not contain_class('redis') + is_expected.to_not contain_class('redis::sentinel') + is_expected.to_not contain_class('tripleo::redis_notification') + end + end + + context 'with step 2 on bootstrap node' do + let(:params) { { + :step => 2, + :bootstrap_nodeid => 'node.example.com', + :redis_node_ips => ['10.0.0.1'] + } } + + it 'should configure redis' do + is_expected.to contain_class('tripleo::profile::base::database::redis') + is_expected.to contain_class('redis') + is_expected.to_not contain_class('redis::sentinel') + is_expected.to_not contain_class('tripleo::redis_notification') + end + end + + context 'with step 2 on bootstrap node with capital letters' do + let(:params) { { + :step => 2, + :bootstrap_nodeid => 'NODE.example.com', + :redis_node_ips => ['10.0.0.1'] + } } + + it 'should configure redis' do + is_expected.to contain_class('tripleo::profile::base::database::redis') + is_expected.to contain_class('redis').with(:slaveof => nil) + end + end + + context 'with step 2 not on bootstrap node' do + let(:params) { { + :step => 2, + :bootstrap_nodeid => 'othernode.example.com', + :redis_node_ips => ['10.0.0.1'] + } } + + it 'should configure redis' do + is_expected.to contain_class('tripleo::profile::base::database::redis') + is_expected.to contain_class('redis').with(:slaveof => "#{params[:bootstrap_nodeid]} 6379") + is_expected.to_not contain_class('redis::sentinel') + is_expected.to_not contain_class('tripleo::redis_notification') + end + end + + context 'with step 2 with multiple nodes' do + let(:params) { { + :step => 2, + :bootstrap_nodeid => 'othernode.example.com', + :redis_node_ips => ['10.0.0.1', '10.0.0.2'] + } } + + it 'should configure redis' do + is_expected.to contain_class('tripleo::profile::base::database::redis') + is_expected.to contain_class('redis').with(:slaveof => "#{params[:bootstrap_nodeid]} 6379") + is_expected.to contain_class('redis::sentinel') + is_expected.to contain_class('tripleo::redis_notification') + end + end + + end + + on_supported_os.each do |os, facts| + context "on #{os}" do + let(:facts) do + facts.merge({ :hostname => 'node.example.com' }) + end + + it_behaves_like 'tripleo::profile::base::database::redis' + end + end +end diff --git a/spec/classes/tripleo_profile_base_docker_spec.rb b/spec/classes/tripleo_profile_base_docker_spec.rb index 0b988f6..bb21055 100644 --- a/spec/classes/tripleo_profile_base_docker_spec.rb +++ b/spec/classes/tripleo_profile_base_docker_spec.rb @@ -124,6 +124,85 @@ describe 'tripleo::profile::base::docker' do } end + context 'with step 4 and configure_libvirt_polkit disabled' do + let(:params) { { + :step => 4, + :configure_libvirt_polkit => false + } } + it { + is_expected.to_not contain_group('docker_nova_group') + is_expected.to_not contain_user('docker_nova_user') + is_expected.to_not contain_package('polkit') + is_expected.to_not contain_file('/etc/polkit-1/rules.d/50-nova.rules') + } + end + + context 'with step 4 and configure_libvirt_polkit enabled' do + let(:params) { { + :step => 4, + :configure_libvirt_polkit => true + } } + it { + is_expected.to contain_group('docker_nova_group').with( + :name => 'docker_nova', + :gid => 42436 + ) + is_expected.to contain_user('docker_nova_user').with( + :name => 'docker_nova', + :uid => 42436, + :gid => 42436, + :shell => '/sbin/nologin', + :groups => ['nobody'] + ) + is_expected.to contain_package('polkit') + is_expected.to contain_file('/etc/polkit-1/rules.d/50-nova.rules') + } + end + + context 'with step 4 and nova_compute service installed' do + let(:params) { { + :step => 4, + :services_enabled => ['docker', 'nova_compute'] + } } + it { + is_expected.to contain_group('docker_nova_group').with( + :name => 'docker_nova', + :gid => 42436 + ) + is_expected.to contain_user('docker_nova_user').with( + :name => 'docker_nova', + :uid => 42436, + :gid => 42436, + :shell => '/sbin/nologin', + :groups => ['nobody'] + ) + is_expected.to contain_package('polkit') + is_expected.to contain_file('/etc/polkit-1/rules.d/50-nova.rules') + } + end + + context 'with step 4 and configure_libvirt_polkit enabled and docker_nova uid' do + let(:params) { { + :step => 4, + :configure_libvirt_polkit => true, + :docker_nova_uid => 12345 + } } + it { + is_expected.to contain_group('docker_nova_group').with( + :name => 'docker_nova', + :gid => 12345 + ) + is_expected.to contain_user('docker_nova_user').with( + :name => 'docker_nova', + :uid => 12345, + :gid => 12345, + :shell => '/sbin/nologin', + :groups => ['nobody'] + ) + is_expected.to contain_package('polkit') + is_expected.to contain_file('/etc/polkit-1/rules.d/50-nova.rules') + } + end end on_supported_os.each do |os, facts| diff --git a/spec/classes/tripleo_profile_base_gnocchi_api_spec.rb b/spec/classes/tripleo_profile_base_gnocchi_api_spec.rb index 6c04e9d..90bdea0 100644 --- a/spec/classes/tripleo_profile_base_gnocchi_api_spec.rb +++ b/spec/classes/tripleo_profile_base_gnocchi_api_spec.rb @@ -36,9 +36,9 @@ describe 'tripleo::profile::base::gnocchi::api' do } end - context 'with step 3 on bootstrap' do + context 'with step 4 on bootstrap' do let(:params) { { - :step => 3, + :step => 4, :bootstrap_node => 'node.example.com', :gnocchi_redis_password => 'gnocchi', :redis_vip => '127.0.0.1' @@ -51,20 +51,6 @@ describe 'tripleo::profile::base::gnocchi::api' do } end - context 'with step 3' do - let(:params) { { - :step => 3, - :gnocchi_redis_password => 'gnocchi', - :redis_vip => '127.0.0.1' - } } - - it { - is_expected.to_not contain_class('gnocchi::db::sync') - is_expected.to contain_class('gnocchi::api') - is_expected.to contain_class('gnocchi::wsgi::apache') - } - end - context 'with step 4' do let(:params) { { :step => 4, @@ -129,10 +115,6 @@ describe 'tripleo::profile::base::gnocchi::api' do it { is_expected.to contain_class('gnocchi::api') is_expected.to contain_class('gnocchi::wsgi::apache') - is_expected.to contain_exec('run gnocchi upgrade with storage').with( - :command => 'gnocchi-upgrade --config-file=/etc/gnocchi/gnocchi.conf', - :path => ['/usr/bin', '/usr/sbin'] - ) } end end diff --git a/spec/classes/tripleo_profile_base_kernel_spec.rb b/spec/classes/tripleo_profile_base_kernel_spec.rb new file mode 100644 index 0000000..4c2aab2 --- /dev/null +++ b/spec/classes/tripleo_profile_base_kernel_spec.rb @@ -0,0 +1,59 @@ +# +# Copyright (C) 2017 Red Hat, Inc. +# +# Licensed under the Apache License, Version 2.0 (the "License"); you may +# not use this file except in compliance with the License. You may obtain +# a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT +# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the +# License for the specific language governing permissions and limitations +# under the License. +# + +require 'spec_helper' + +describe 'tripleo::profile::base::kernel' do + + shared_examples_for 'tripleo::profile::base::kernel' do + context 'with kernel modules' do + let :params do + { + :module_list => { + 'nf_conntrack' => {}, + } + } + end + + it 'should load kernel module' do + is_expected.to contain_kmod__load('nf_conntrack') + end + end + context 'with sysctl settings' do + let :params do + { + :sysctl_settings => { + 'net.ipv4.tcp_keepalive_intvl' => { 'value' => '1'}, + } + } + end + + it 'should load kernel module' do + is_expected.to contain_sysctl__value('net.ipv4.tcp_keepalive_intvl') + end + end + end + + on_supported_os.each do |os, facts| + context "on #{os}" do + let(:facts) { + facts + } + + it_behaves_like 'tripleo::profile::base::kernel' + end + end +end diff --git a/spec/classes/tripleo_profile_base_novajoin_spec.rb b/spec/classes/tripleo_profile_base_novajoin_spec.rb new file mode 100644 index 0000000..e157d4f --- /dev/null +++ b/spec/classes/tripleo_profile_base_novajoin_spec.rb @@ -0,0 +1,126 @@ +# +# Copyright (C) 2017 Red Hat, Inc. +# +# Licensed under the Apache License, Version 2.0 (the "License"); you may +# not use this file except in compliance with the License. You may obtain +# a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT +# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the +# License for the specific language governing permissions and limitations +# under the License. +# + +require 'spec_helper' + +describe 'tripleo::profile::base::novajoin' do + + let :pre_condition do + "include nova + class { '::nova::metadata::novajoin::authtoken': + password => 'passw0rd', + }" + end + + let :params do + { :oslomsg_rpc_hosts => ['some.server.com'], + :oslomsg_rpc_password => 'somepassword', + :service_password => 'passw0rd', + :step => 5 + } + end + + shared_examples_for 'tripleo::profile::base::novajoin' do + + context 'with step less than 3' do + before do + params.merge!({ :step => 2 }) + end + + it 'should not do anything' do + is_expected.to_not contain_class('nova::metadata::novajoin::api') + end + end + + context 'with step 3' do + before do + params.merge!({ :step => 3 }) + end + + it 'should provide basic initialization' do + is_expected.to contain_class('nova::metadata::novajoin::api').with( + :transport_url => 'rabbit://guest:somepassword@some.server.com:5672/?ssl=0' + ) + end + end + + context 'with multiple hosts' do + before do + params.merge!({ :oslomsg_rpc_hosts => ['some.server.com', 'someother.server.com'] }) + end + + it 'should construct a multihost URL' do + is_expected.to contain_class('nova::metadata::novajoin::api').with( + :transport_url => 'rabbit://guest:somepassword@some.server.com:5672,guest:somepassword@someother.server.com:5672/?ssl=0' + ) + end + end + + context 'with username provided' do + before do + params.merge!({ :oslomsg_rpc_username => 'bunny' }) + end + + it 'should construct URL with username' do + is_expected.to contain_class('nova::metadata::novajoin::api').with( + :transport_url => 'rabbit://bunny:somepassword@some.server.com:5672/?ssl=0' + ) + end + end + + context 'with username and password provided' do + before do + params.merge!( + { :oslomsg_rpc_username => 'bunny', + :oslomsg_rpc_password => 'carrot' + } + ) + end + + it 'should construct URL with username and password' do + is_expected.to contain_class('nova::metadata::novajoin::api').with( + :transport_url => 'rabbit://bunny:carrot@some.server.com:5672/?ssl=0' + ) + end + end + + context 'with multiple hosts and user info provided' do + before do + params.merge!( + { :oslomsg_rpc_hosts => ['some.server.com', 'someother.server.com'], + :oslomsg_rpc_username => 'bunny', + :oslomsg_rpc_password => 'carrot' + } + ) + end + + it 'should distributed user info across hosts URL' do + is_expected.to contain_class('nova::metadata::novajoin::api').with( + :transport_url => 'rabbit://bunny:carrot@some.server.com:5672,bunny:carrot@someother.server.com:5672/?ssl=0' + ) + end + end + end + + on_supported_os.each do |os, facts| + context "on #{os}" do + let(:facts) do + facts.merge({}) + end + it_behaves_like 'tripleo::profile::base::novajoin' + end + end +end diff --git a/spec/classes/tripleo_profile_base_swift_ringbuilder.rb b/spec/classes/tripleo_profile_base_swift_ringbuilder_spec.rb index 0139815..0139815 100644 --- a/spec/classes/tripleo_profile_base_swift_ringbuilder.rb +++ b/spec/classes/tripleo_profile_base_swift_ringbuilder_spec.rb diff --git a/spec/classes/tripleo_certmonger_httpd.rb b/spec/defines/tripleo_certmonger_httpd_spec.rb index da5ce94..f01e594 100644 --- a/spec/classes/tripleo_certmonger_httpd.rb +++ b/spec/defines/tripleo_certmonger_httpd_spec.rb @@ -20,6 +20,8 @@ require 'spec_helper' describe 'tripleo::certmonger::httpd' do + let(:title) { 'httpd-cert' } + shared_examples_for 'tripleo::certmonger::httpd' do let :params do { diff --git a/spec/fixtures/hieradata/default.yaml b/spec/fixtures/hieradata/default.yaml index ad2da39..a0f4efc 100644 --- a/spec/fixtures/hieradata/default.yaml +++ b/spec/fixtures/hieradata/default.yaml @@ -6,6 +6,7 @@ not_hash: string aodh::rabbit_password: 'password' aodh_redis_password: 'password' redis_vip: '127.0.0.1' +redis::bind: '10.0.0.1' aodh::auth::auth_password: 'password' aodh::db::mysql::password: 'password' aodh::keystone::authtoken::password: 'password' @@ -32,6 +33,9 @@ cinder::keystone::authtoken::password: 'password' gnocchi::keystone::authtoken::password: 'password' gnocchi::storage::ceph::ceph_username: 'gnocchi' gnocchi::storage::ceph::ceph_secret: 'password' +# haproxy related items +mysql_enabled: true +controller_node_ips: '10.1.0.1,10.1.0.2' # nova related items nova::rabbit_password: 'password' nova::keystone::authtoken::password: 'password' diff --git a/templates/ui/tripleo_ui_config.js.erb b/templates/ui/tripleo_ui_config.js.erb index f179637..cd02798 100644 --- a/templates/ui/tripleo_ui_config.js.erb +++ b/templates/ui/tripleo_ui_config.js.erb @@ -7,6 +7,7 @@ window.tripleOUiConfig = { 'keystone': '<%= @endpoint_config_keystone %>', 'heat': '<%= @endpoint_config_heat %>', 'ironic': '<%= @endpoint_config_ironic %>', + 'ironic-inspector': '<%= @endpoint_config_ironic_inspector %>', 'mistral': '<%= @endpoint_config_mistral %>', 'swift': '<%= @endpoint_config_swift %>', 'zaqar-websocket': '<%= @endpoint_config_zaqar %>', diff --git a/test-requirements.txt b/test-requirements.txt index 1ea50a8..152ebef 100644 --- a/test-requirements.txt +++ b/test-requirements.txt @@ -1,7 +1,7 @@ # This is required for the docs build jobs -sphinx>=1.5.1 # BSD +sphinx!=1.6.1,>=1.5.1 # BSD oslosphinx>=4.7.0 # Apache-2.0 # This is required for the releasenotes build jobs # FIXME: reno is manually pinned to !=2.0.0 because of bug #1651995 -reno>=1.8.0,!=2.0.0 # Apache-2.0 +reno!=2.0.0,!=2.3.1,>=1.8.0 # Apache-2.0 @@ -7,5 +7,5 @@ envlist = releasenotes install_command = pip install -c{env:UPPER_CONSTRAINTS_FILE:https://git.openstack.org/cgit/openstack/requirements/plain/upper-constraints.txt} {opts} {packages} [testenv:releasenotes] -deps = -rtest-requirements.txt +deps = -r{toxinidir}/test-requirements.txt commands = sphinx-build -a -E -W -d releasenotes/build/doctrees -b html releasenotes/source releasenotes/build/html |