aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
-rw-r--r--manifests/profile/base/auditd.pp30
-rw-r--r--manifests/profile/base/docker_registry.pp17
-rw-r--r--manifests/profile/base/neutron.pp13
-rw-r--r--manifests/profile/base/neutron/server.pp24
-rw-r--r--manifests/profile/base/nova/api.pp21
-rw-r--r--releasenotes/notes/nova_cells_setup-2c3e3344d8adcc26.yaml3
-rw-r--r--releasenotes/notes/puppet-auditd-0f6cbd6a2d193aac.yaml4
-rw-r--r--spec/classes/tripleo_profile_base_nova_api_spec.rb7
8 files changed, 71 insertions, 48 deletions
diff --git a/manifests/profile/base/auditd.pp b/manifests/profile/base/auditd.pp
new file mode 100644
index 0000000..628db08
--- /dev/null
+++ b/manifests/profile/base/auditd.pp
@@ -0,0 +1,30 @@
+# Copyright 2016 Red Hat, Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License. You may obtain
+# a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations
+# under the License.
+#
+# == class: tripleo::profile::base::auditd
+#
+# auditd profile for tripleo
+#
+# === Parameters
+#
+# [*step*]
+# Defaults to hiera('step')
+#
+class tripleo::profile::base::auditd (
+ $step = hiera('step'),
+) {
+ if $step >= 4 {
+ include ::auditd
+ }
+}
diff --git a/manifests/profile/base/docker_registry.pp b/manifests/profile/base/docker_registry.pp
index 05a516d..ebe84bf 100644
--- a/manifests/profile/base/docker_registry.pp
+++ b/manifests/profile/base/docker_registry.pp
@@ -19,21 +19,22 @@
# === Parameters:
#
# [*registry_host*]
-# (String) IP address on which the Docker registry is listening on
+# (String) IP address or hostname the Docker registry binds to
# Defaults to hiera('controller_host')
#
# [*registry_port*]
# (Integer) The port on which the Docker registry is listening on
# Defaults to 8787
#
-# [*controller_admin_vip*]
-# (String) VIP of the host
-# Defaults to hiera('controller_admin_vip')
+# [*registry_admin_host*]
+# (String) IP address or hostname the Docker registry binds to in the admin
+# network
+# Defaults to hiera('controller_admin_host')
#
class tripleo::profile::base::docker_registry (
- $registry_host = hiera('controller_host'),
- $registry_port = 8787,
- $controller_admin_vip = hiera('controller_admin_vip'),
+ $registry_host = hiera('controller_host'),
+ $registry_port = 8787,
+ $registry_admin_host = hiera('controller_admin_host'),
) {
# We want a v2 registry
package{'docker-registry':
@@ -55,7 +56,7 @@ class tripleo::profile::base::docker_registry (
line => join ([
'INSECURE_REGISTRY="',
'--insecure-registry ', $registry_host, ':', $registry_port, ' ',
- '--insecure-registry ', $controller_admin_vip, ':', $registry_port, '"']),
+ '--insecure-registry ', $registry_admin_host, ':', $registry_port, '"']),
match => 'INSECURE_REGISTRY=',
require => Package['docker'],
notify => Service['docker'],
diff --git a/manifests/profile/base/neutron.pp b/manifests/profile/base/neutron.pp
index 3de50c2..e6a32db 100644
--- a/manifests/profile/base/neutron.pp
+++ b/manifests/profile/base/neutron.pp
@@ -35,22 +35,9 @@ class tripleo::profile::base::neutron (
$rabbit_hosts = hiera('rabbitmq_node_names', undef),
$rabbit_port = hiera('neutron::rabbit_port', 5672),
) {
-
- # TODO(jaosorior): Remove this when we pass it via t-h-t
- if hiera('enable_internal_tls', false) {
- $bind_host = 'localhost'
- } else {
- # This is executed in all of the nodes that use something neutron-related,
- # so we set the defalut, since the bind_host is only available in the
- # controllers. Either way, this will be removed and set properly via t-h-t
- # in a subsequent commit.
- $bind_host = hiera('neutron::bind_host', $::os_service_default)
- }
-
if $step >= 3 {
$rabbit_endpoints = suffix(any2array($rabbit_hosts), ":${rabbit_port}")
class { '::neutron' :
- bind_host => $bind_host,
rabbit_hosts => $rabbit_endpoints,
}
include ::neutron::config
diff --git a/manifests/profile/base/neutron/server.pp b/manifests/profile/base/neutron/server.pp
index 5a98f66..5d6909f 100644
--- a/manifests/profile/base/neutron/server.pp
+++ b/manifests/profile/base/neutron/server.pp
@@ -75,6 +75,21 @@
# for more details.
# Defaults to hiera('step')
#
+# [*tls_proxy_bind_ip*]
+# IP on which the TLS proxy will listen on. Required only if
+# enable_internal_tls is set.
+# Defaults to undef
+#
+# [*tls_proxy_fqdn*]
+# fqdn on which the tls proxy will listen on. required only used if
+# enable_internal_tls is set.
+# defaults to undef
+#
+# [*tls_proxy_port*]
+# port on which the tls proxy will listen on. Only used if
+# enable_internal_tls is set.
+# defaults to 9696
+#
class tripleo::profile::base::neutron::server (
$bootstrap_node = hiera('bootstrap_nodeid', undef),
$certificates_specs = hiera('apache_certificates_specs', {}),
@@ -85,6 +100,9 @@ class tripleo::profile::base::neutron::server (
$l3_nodes = hiera('neutron_l3_short_node_names', []),
$neutron_network = hiera('neutron_api_network', undef),
$step = hiera('step'),
+ $tls_proxy_bind_ip = undef,
+ $tls_proxy_fqdn = undef,
+ $tls_proxy_port = 9696,
) {
if $enable_internal_tls and $generate_service_certificates {
ensure_resources('tripleo::certmonger::httpd', $certificates_specs)
@@ -120,9 +138,9 @@ class tripleo::profile::base::neutron::server (
$tls_keyfile = $certificates_specs["httpd-${neutron_network}"]['service_key']
::tripleo::tls_proxy { 'neutron-api':
- servername => hiera("fqdn_${neutron_network}"),
- ip => hiera('neutron::bind_host'), # This will be cleaned out
- port => 9696, # This will be cleaned out
+ servername => $tls_proxy_fqdn,
+ ip => $tls_proxy_bind_ip,
+ port => $tls_proxy_port,
tls_cert => $tls_certfile,
tls_key => $tls_keyfile,
notify => Class['::neutron::server'],
diff --git a/manifests/profile/base/nova/api.pp b/manifests/profile/base/nova/api.pp
index 8ded3ef..83baae2 100644
--- a/manifests/profile/base/nova/api.pp
+++ b/manifests/profile/base/nova/api.pp
@@ -85,25 +85,8 @@ class tripleo::profile::base::nova::api (
$tls_keyfile = undef
}
- if ($step >= 3 and $sync_db) {
- $messaging_hosts_real = any2array($::tripleo::profile::base::nova::messaging_hosts)
- # TODO(aschultz): remove sprintf once we properly type the port, needs
- # to be a string for the os_transport_url function.
- $messaging_port_real = sprintf('%s', $::tripleo::profile::base::nova::messaging_port)
- $messaging_use_ssl_real = sprintf('%s', bool2num(str2bool($::tripleo::profile::base::nova::messaging_use_ssl)))
-
- #TODO(emilien): enable it again when it's fixed upstream in nova
- # https://bugs.launchpad.net/tripleo/+bug/1649341
- # class { '::nova::db::sync_cell_v2':
- # transport_url => os_transport_url({
- # 'transport' => $::tripleo::profile::base::nova::messaging_driver,
- # 'hosts' => $messaging_hosts_real,
- # 'port' => $messaging_port_real,
- # 'username' => $::tripleo::profile::base::nova::messaging_username,
- # 'password' => $::tripleo::profile::base::nova::messaging_password,
- # 'ssl' => $messaging_use_ssl_real,
- # }),
- # }
+ if $step >= 3 and $sync_db {
+ include ::nova::cell_v2::simple_setup
}
if $step >= 4 or ($step >= 3 and $sync_db) {
diff --git a/releasenotes/notes/nova_cells_setup-2c3e3344d8adcc26.yaml b/releasenotes/notes/nova_cells_setup-2c3e3344d8adcc26.yaml
new file mode 100644
index 0000000..79439b2
--- /dev/null
+++ b/releasenotes/notes/nova_cells_setup-2c3e3344d8adcc26.yaml
@@ -0,0 +1,3 @@
+---
+features:
+ - Configure the basic cells setup for Nova, now required in Ocata.
diff --git a/releasenotes/notes/puppet-auditd-0f6cbd6a2d193aac.yaml b/releasenotes/notes/puppet-auditd-0f6cbd6a2d193aac.yaml
new file mode 100644
index 0000000..9eb7c79
--- /dev/null
+++ b/releasenotes/notes/puppet-auditd-0f6cbd6a2d193aac.yaml
@@ -0,0 +1,4 @@
+---
+features:
+ - Adds the ability to manage auditd.service and enter audit.rules
+
diff --git a/spec/classes/tripleo_profile_base_nova_api_spec.rb b/spec/classes/tripleo_profile_base_nova_api_spec.rb
index 4aa7367..f930342 100644
--- a/spec/classes/tripleo_profile_base_nova_api_spec.rb
+++ b/spec/classes/tripleo_profile_base_nova_api_spec.rb
@@ -53,11 +53,8 @@ eos
it {
is_expected.to contain_class('tripleo::profile::base::nova::api')
is_expected.to contain_class('tripleo::profile::base::nova')
- #TODO(emilien): enable it again when it's fixed upstream in nova
- # https://bugs.launchpad.net/tripleo/+bug/1649341
- # is_expected.to contain_class('nova::db::sync_cell_v2').with(
- # :transport_url => 'rabbit://nova:foo@localhost:5672/?ssl=0')
- # is_expected.to contain_class('nova::keystone::authtoken')
+ is_expected.to contain_class('nova::cell_v2::simple_setup')
+ is_expected.to contain_class('nova::keystone::authtoken')
is_expected.to contain_class('nova::api')
is_expected.to contain_class('nova::wsgi::apache_api')
is_expected.to contain_class('nova::network::neutron')