aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
-rw-r--r--.gitignore3
-rw-r--r--Puppetfile_extras7
-rw-r--r--Rakefile6
-rw-r--r--lib/puppet/parser/functions/ip_to_erl_format.rb31
-rw-r--r--lib/puppet/parser/functions/noop_resource.rb53
-rw-r--r--lib/puppet/provider/package/norpm.rb8
-rw-r--r--manifests/certmonger/mysql.pp16
-rw-r--r--manifests/fencing.pp3
-rw-r--r--manifests/firewall/pre.pp6
-rw-r--r--manifests/firewall/rule.pp51
-rw-r--r--manifests/haproxy.pp376
-rw-r--r--manifests/haproxy/endpoint.pp33
-rw-r--r--manifests/host/sriov.pp3
-rw-r--r--manifests/host/sriov/numvfs_persistence.pp25
-rw-r--r--manifests/keepalived.pp28
-rw-r--r--manifests/network/contrail/analytics.pp331
-rw-r--r--manifests/network/contrail/analyticsdatabase.pp202
-rw-r--r--manifests/network/contrail/config.pp397
-rw-r--r--manifests/network/contrail/control.pp197
-rw-r--r--manifests/network/contrail/database.pp149
-rw-r--r--manifests/network/contrail/heat.pp80
-rw-r--r--manifests/network/contrail/neutron_plugin.pp203
-rw-r--r--manifests/network/contrail/provision.pp92
-rw-r--r--manifests/network/contrail/vrouter.pp302
-rw-r--r--manifests/network/contrail/webui.pp104
-rw-r--r--manifests/pacemaker/haproxy_with_vip.pp52
-rw-r--r--manifests/packages.pp4
-rw-r--r--manifests/profile/base/auditd.pp30
-rw-r--r--manifests/profile/base/ceph/mds.pp35
-rw-r--r--manifests/profile/base/ceph/rgw.pp37
-rw-r--r--manifests/profile/base/cinder.pp1
-rw-r--r--manifests/profile/base/cinder/api.pp1
-rw-r--r--manifests/profile/base/cinder/volume.pp56
-rw-r--r--manifests/profile/base/cinder/volume/dellps.pp (renamed from manifests/profile/base/cinder/volume/eqlx.pp)10
-rw-r--r--manifests/profile/base/cinder/volume/hpelefthand.pp71
-rw-r--r--manifests/profile/base/cinder/volume/scaleio.pp56
-rw-r--r--manifests/profile/base/congress.pp86
-rw-r--r--manifests/profile/base/database/mysql.pp28
-rw-r--r--manifests/profile/base/docker_registry.pp74
-rw-r--r--manifests/profile/base/etcd.pp66
-rw-r--r--manifests/profile/base/glance/api.pp105
-rw-r--r--manifests/profile/base/gnocchi/metricd.pp2
-rw-r--r--manifests/profile/base/gnocchi/statsd.pp2
-rw-r--r--manifests/profile/base/heat.pp57
-rw-r--r--manifests/profile/base/horizon.pp2
-rw-r--r--manifests/profile/base/ironic.pp1
-rw-r--r--manifests/profile/base/keystone.pp33
-rw-r--r--manifests/profile/base/metrics/collectd.pp103
-rw-r--r--manifests/profile/base/metrics/collectd/collectd_plugin.pp6
-rw-r--r--manifests/profile/base/metrics/collectd/collectd_service.pp11
-rw-r--r--manifests/profile/base/metrics/collectd/plugin_helper.pp6
-rw-r--r--manifests/profile/base/neutron/agents/ovn.pp14
-rw-r--r--manifests/profile/base/neutron/opendaylight.pp19
-rw-r--r--manifests/profile/base/neutron/ovn_northd.pp40
-rw-r--r--manifests/profile/base/neutron/ovs.pp2
-rw-r--r--manifests/profile/base/neutron/plugins/ml2.pp12
-rw-r--r--manifests/profile/base/neutron/plugins/ml2/ovn.pp25
-rw-r--r--manifests/profile/base/neutron/server.pp108
-rw-r--r--manifests/profile/base/nova.pp56
-rw-r--r--manifests/profile/base/nova/api.pp56
-rw-r--r--manifests/profile/base/nova/compute.pp1
-rw-r--r--manifests/profile/base/nova/compute/libvirt.pp15
-rw-r--r--manifests/profile/base/nova/ec2api.pp35
-rw-r--r--manifests/profile/base/nova/placement.pp96
-rw-r--r--manifests/profile/base/octavia.pp57
-rw-r--r--manifests/profile/base/octavia/api.pp (renamed from manifests/profile/base/glance/registry.pp)32
-rw-r--r--manifests/profile/base/octavia/health_manager.pp33
-rw-r--r--manifests/profile/base/octavia/housekeeping.pp34
-rw-r--r--manifests/profile/base/octavia/worker.pp34
-rw-r--r--manifests/profile/base/pacemaker.pp69
-rw-r--r--manifests/profile/base/pacemaker_remote.pp37
-rw-r--r--manifests/profile/base/panko.pp1
-rw-r--r--manifests/profile/base/rabbitmq.pp54
-rw-r--r--manifests/profile/base/sshd.pp61
-rw-r--r--manifests/profile/base/swift/proxy.pp81
-rw-r--r--manifests/profile/base/swift/storage.pp2
-rw-r--r--manifests/profile/base/tacker.pp86
-rw-r--r--manifests/profile/base/time/ntp.pp28
-rw-r--r--manifests/profile/pacemaker/ceph/rbdmirror.pp98
-rw-r--r--manifests/profile/pacemaker/cinder/backup.pp26
-rw-r--r--manifests/profile/pacemaker/cinder/volume.pp26
-rw-r--r--manifests/profile/pacemaker/database/mysql.pp31
-rw-r--r--manifests/profile/pacemaker/database/redis.pp40
-rw-r--r--manifests/profile/pacemaker/haproxy.pp83
-rw-r--r--manifests/profile/pacemaker/manila.pp65
-rw-r--r--manifests/profile/pacemaker/rabbitmq.pp54
-rw-r--r--manifests/tls_proxy.pp60
-rw-r--r--manifests/ui.pp127
-rw-r--r--metadata.json6
-rw-r--r--releasenotes/notes/6.2.0-64eaf596539f3ed1.yaml64
-rw-r--r--releasenotes/notes/add-support-for-octavia-f1e472af89e9a05c.yaml4
-rw-r--r--releasenotes/notes/hpelefthand_8474c416b0d411e6.yaml3
-rw-r--r--releasenotes/notes/innodb_file_per_table-f925b3bbf29d44ea.yaml20
-rw-r--r--releasenotes/notes/nova_cells_setup-2c3e3344d8adcc26.yaml3
-rw-r--r--releasenotes/notes/proxy-api-endpoints-359e5fb64d80d400.yaml6
-rw-r--r--releasenotes/notes/puppet-auditd-0f6cbd6a2d193aac.yaml4
-rw-r--r--releasenotes/notes/rabbitmq_password_change-4fce15c9ebb0e20c.yaml4
-rw-r--r--releasenotes/notes/remove-old-urls-dea2b7fdcb50dd48.yaml12
-rw-r--r--releasenotes/notes/rgw-keystone-v3-43ef17dd10f825be.yaml5
-rw-r--r--releasenotes/notes/sshd-437c531301f458bb.yaml3
-rw-r--r--releasenotes/notes/use-reno-80402e5526a598aa.yaml6
-rw-r--r--releasenotes/notes/vncserver_listen-4417377cac38464c.yaml7
-rw-r--r--releasenotes/source/_static/.placeholder0
-rw-r--r--releasenotes/source/conf.py262
-rw-r--r--releasenotes/source/index.rst9
-rw-r--r--releasenotes/source/ocata.rst6
-rw-r--r--releasenotes/source/unreleased.rst5
-rw-r--r--setup.cfg13
-rw-r--r--setup.py22
-rw-r--r--spec/classes/tripleo_firewall_spec.rb87
-rw-r--r--spec/classes/tripleo_midonet_agent_spec.rb58
-rw-r--r--spec/classes/tripleo_profile_base_ceilometer_api_spec.rb2
-rw-r--r--spec/classes/tripleo_profile_base_ceph_mds_spec.rb59
-rw-r--r--spec/classes/tripleo_profile_base_ceph_rgw_spec.rb11
-rw-r--r--spec/classes/tripleo_profile_base_cinder_api_spec.rb4
-rw-r--r--spec/classes/tripleo_profile_base_cinder_scaleio_spec.rb58
-rw-r--r--spec/classes/tripleo_profile_base_cinder_spec.rb6
-rw-r--r--spec/classes/tripleo_profile_base_cinder_volume_dellps_spec.rb (renamed from spec/classes/tripleo_profile_base_cinder_volume_eqlx_spec.rb)12
-rw-r--r--spec/classes/tripleo_profile_base_cinder_volume_spec.rb18
-rw-r--r--spec/classes/tripleo_profile_base_nova_api_spec.rb137
-rw-r--r--spec/classes/tripleo_profile_base_nova_compute_ironic_spec.rb67
-rw-r--r--spec/classes/tripleo_profile_base_nova_compute_libvirt_spec.rb69
-rw-r--r--spec/classes/tripleo_profile_base_nova_compute_spec.rb87
-rw-r--r--spec/classes/tripleo_profile_base_nova_conductor_spec.rb61
-rw-r--r--spec/classes/tripleo_profile_base_nova_consoleauth_spec.rb62
-rw-r--r--spec/classes/tripleo_profile_base_nova_libvirt_spec.rb68
-rw-r--r--spec/classes/tripleo_profile_base_nova_scheduler_spec.rb64
-rw-r--r--spec/classes/tripleo_profile_base_nova_spec.rb135
-rw-r--r--spec/classes/tripleo_profile_base_nova_vncproxy_spec.rb62
-rw-r--r--spec/classes/tripleo_profile_base_octavia_api_spec.rb138
-rw-r--r--spec/classes/tripleo_profile_base_octavia_spec.rb119
-rw-r--r--spec/classes/tripleo_profile_base_sshd_spec.rb (renamed from manifests/vip_hosts.pp)37
-rw-r--r--spec/classes/tripleo_profile_pacemaker_ceph_rbdmirror_spec.rp64
-rw-r--r--spec/classes/tripleo_ui_spec.rb121
-rw-r--r--spec/defines/tripleo_host_sriov_numvfs_persistence_spec.rb11
-rw-r--r--spec/fixtures/hieradata/default.yaml16
-rw-r--r--spec/functions/ip_to_erl_format_spec.rb11
-rw-r--r--templates/docker_distribution/registry_config.yml.erb11
-rw-r--r--templates/ui/tripleo_ui_config.js.erb31
-rw-r--r--test-requirements.txt4
-rw-r--r--tox.ini8
141 files changed, 6640 insertions, 861 deletions
diff --git a/.gitignore b/.gitignore
index 15c55ef..263f4a7 100644
--- a/.gitignore
+++ b/.gitignore
@@ -9,3 +9,6 @@ coverage/
*.swp
*.iml
openstack/
+# Files created from releasenotes build
+releasenotes/build
+.tox
diff --git a/Puppetfile_extras b/Puppetfile_extras
index b9f664f..b927d99 100644
--- a/Puppetfile_extras
+++ b/Puppetfile_extras
@@ -5,10 +5,6 @@ mod 'haproxy',
:git => 'https://github.com/puppetlabs/puppetlabs-haproxy',
:ref => 'master'
-mod 'midonet',
- :git => 'https://github.com/midonet/puppet-midonet',
- :ref => 'v2015.06.7'
-
mod 'tomcat',
:git => 'https://github.com/puppetlabs/puppetlabs-tomcat',
:ref => '1.3.2'
@@ -29,3 +25,6 @@ mod 'datacat',
:git => 'https://github.com/richardc/puppet-datacat',
:ref => '0.6.2'
+mod 'etcd',
+ :git => 'https://github.com/cristifalcas/puppet-etcd',
+ :ref => '1.10.0'
diff --git a/Rakefile b/Rakefile
index 168d108..0ff1f03 100644
--- a/Rakefile
+++ b/Rakefile
@@ -1 +1,7 @@
require 'puppet-openstack_spec_helper/rake_tasks'
+
+# We disable the unquoted node name check because puppet-pacemaker node
+# properies make use of attributes called 'node' and puppet-lint breaks on
+# them: https://github.com/rodjek/puppet-lint/issues/501
+# We are not using site.pp with nodes so this is safe.
+PuppetLint.configuration.send('disable_unquoted_node_name')
diff --git a/lib/puppet/parser/functions/ip_to_erl_format.rb b/lib/puppet/parser/functions/ip_to_erl_format.rb
new file mode 100644
index 0000000..4c066b9
--- /dev/null
+++ b/lib/puppet/parser/functions/ip_to_erl_format.rb
@@ -0,0 +1,31 @@
+require 'ipaddr'
+
+# Custom function to convert an IP4/6 address from a string to the
+# erlang inet kernel format.
+# For example from "172.17.0.16" to {172,17,0,16}
+# See http://erlang.org/doc/man/kernel_app.html and http://erlang.org/doc/man/inet.html
+# for more information.
+module Puppet::Parser::Functions
+ newfunction(:ip_to_erl_format, :type => :rvalue, :doc => "Convert an IP address to the erlang inet format.") do |arg|
+ if arg[0].class != String
+ raise Puppet::ParseError, "Syntax error: #{arg[0]} must be a String"
+ end
+ ip = IPAddr.new arg[0]
+ output = '{'
+ if ip.ipv6?
+ split_char = ':'
+ base = 16
+ else
+ split_char = '.'
+ base = 10
+ end
+ # to_string() prints the canonicalized form
+ ip.to_string().split(split_char).each {
+ |x| output += x.to_i(base).to_s + ','
+ }
+ # Remove the last spurious comma
+ output = output.chomp(',')
+ output += '}'
+ return output
+ end
+end
diff --git a/lib/puppet/parser/functions/noop_resource.rb b/lib/puppet/parser/functions/noop_resource.rb
new file mode 100644
index 0000000..921eb5d
--- /dev/null
+++ b/lib/puppet/parser/functions/noop_resource.rb
@@ -0,0 +1,53 @@
+# Copyright 2017 Red Hat, Inc.
+# All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License. You may obtain
+# a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations
+# under the License.
+#
+# Author: Dan Prince <dprince@redhat.com>
+#
+# A function to create noop providers (set as the default) for the named
+# resource. This works alongside of 'puppet apply --tags' to disable
+# some custom resource types that still attempt to run commands during
+# prefetch, etc.
+class Puppet::Provider::Noop < Puppet::Provider
+
+ def create
+ true
+ end
+
+ def destroy
+ true
+ end
+
+ def exists?
+ false
+ end
+
+ # some puppet-keystone resources require this
+ def self.resource_to_name(domain, name, check_for_default = true)
+ return name
+ end
+
+end
+
+module Puppet::Parser::Functions
+ newfunction(:noop_resource, :type => :rvalue, :doc => "Create a default noop provider for the specified resource.") do |arg|
+ if arg[0].class == String
+ Puppet::Type.type(arg[0].downcase.to_sym).provide(:noop, :parent => Puppet::Provider::Noop) do
+ defaultfor :osfamily => :redhat
+ end
+ else
+ end
+ return true
+ end
+end
diff --git a/lib/puppet/provider/package/norpm.rb b/lib/puppet/provider/package/norpm.rb
index 1616e57..0764265 100644
--- a/lib/puppet/provider/package/norpm.rb
+++ b/lib/puppet/provider/package/norpm.rb
@@ -33,4 +33,12 @@ Puppet::Type.type(:package).provide :norpm, :source => :rpm, :parent => :rpm do
true
end
+ def purge
+ true
+ end
+
+ def self.instances
+ return []
+ end
+
end
diff --git a/manifests/certmonger/mysql.pp b/manifests/certmonger/mysql.pp
index 62aff9a..dd9b184 100644
--- a/manifests/certmonger/mysql.pp
+++ b/manifests/certmonger/mysql.pp
@@ -31,11 +31,6 @@
# (Optional) The CA that certmonger will use to generate the certificates.
# Defaults to hiera('certmonger_ca', 'local').
#
-# [*mysql_network*]
-# (Optional) The network name where the mysql endpoint is listening on.
-# This is set by t-h-t.
-# Defaults to hiera('mysql_network', undef)
-#
# [*principal*]
# (Optional) The haproxy service principal that is set for MySQL in kerberos.
# Defaults to undef
@@ -45,17 +40,12 @@ class tripleo::certmonger::mysql (
$service_certificate,
$service_key,
$certmonger_ca = hiera('certmonger_ca', 'local'),
- $mysql_network = hiera('mysql_network', undef),
$principal = undef,
) {
include ::certmonger
include ::mysql::params
- if !$mysql_network {
- fail('mysql_network is not set in the hieradata.')
- }
-
- $postsave_cmd = "systemctl reload ${::mysql::params::service_name}"
+ $postsave_cmd = "systemctl reload ${::mysql::params::server_service_name}"
certmonger_certificate { 'mysql' :
ensure => 'present',
certfile => $service_certificate,
@@ -79,6 +69,6 @@ class tripleo::certmonger::mysql (
require => Certmonger_certificate['mysql'],
}
- File[$service_certificate] ~> Service<| title == $::mysql::params::service_name |>
- File[$service_key] ~> Service<| title == $::mysql::params::service_name |>
+ File[$service_certificate] ~> Service<| title == $::mysql::params::server_service_name |>
+ File[$service_key] ~> Service<| title == $::mysql::params::server_service_name |>
}
diff --git a/manifests/fencing.pp b/manifests/fencing.pp
index 55280a9..fa8c2e5 100644
--- a/manifests/fencing.pp
+++ b/manifests/fencing.pp
@@ -59,4 +59,7 @@ class tripleo::fencing(
$ipmilan_devices = local_fence_devices('fence_ipmilan', $all_devices)
create_resources('pacemaker::stonith::fence_ipmilan', $ipmilan_devices, $common_params)
+
+ $ironic_devices = local_fence_devices('fence_ironic', $all_devices)
+ create_resources('pacemaker::stonith::fence_ironic', $ironic_devices, $common_params)
}
diff --git a/manifests/firewall/pre.pp b/manifests/firewall/pre.pp
index 7af7fbc..39120d9 100644
--- a/manifests/firewall/pre.pp
+++ b/manifests/firewall/pre.pp
@@ -54,4 +54,10 @@ class tripleo::firewall::pre(
extras => $firewall_settings,
}
+ tripleo::firewall::rule{ '004 accept ipv6 dhcpv6':
+ dport => '546',
+ proto => 'udp',
+ state => ['NEW'],
+ destination => 'fe80::/64',
+ }
}
diff --git a/manifests/firewall/rule.pp b/manifests/firewall/rule.pp
index 6801dc4..688144e 100644
--- a/manifests/firewall/rule.pp
+++ b/manifests/firewall/rule.pp
@@ -45,7 +45,7 @@
#
# [*source*]
# (optional) The source IP address associated to the rule.
-# Defaults to '0.0.0.0/0'
+# Defaults to undef
#
# [*iniface*]
# (optional) The network interface associated to the rule.
@@ -70,15 +70,23 @@ define tripleo::firewall::rule (
$proto = 'tcp',
$action = 'accept',
$state = ['NEW'],
- $source = '0.0.0.0/0',
+ $source = undef,
$iniface = undef,
$chain = 'INPUT',
$destination = undef,
$extras = {},
) {
+ if $port == 'all' {
+ warning("All ${proto} traffic will be open on this host.")
+ # undef so the IPtables rule won't have any port specified.
+ $port_real = undef
+ } else {
+ $port_real = $port
+ }
+
$basic = {
- 'port' => $port,
+ 'port' => $port_real,
'dport' => $dport,
'sport' => $sport,
'proto' => $proto,
@@ -88,6 +96,16 @@ define tripleo::firewall::rule (
'chain' => $chain,
'destination' => $destination,
}
+ if $proto == 'icmp' {
+ $ipv6 = {
+ 'provider' => 'ip6tables',
+ 'proto' => 'ipv6-icmp',
+ }
+ } else {
+ $ipv6 = {
+ 'provider' => 'ip6tables',
+ }
+ }
if $proto != 'gre' {
$state_rule = {
'state' => $state
@@ -97,9 +115,30 @@ define tripleo::firewall::rule (
}
- $rule = merge($basic, $state_rule, $extras)
- validate_hash($rule)
+ $ipv4_rule = merge($basic, $state_rule, $extras)
+ $ipv6_rule = merge($basic, $state_rule, $ipv6, $extras)
+ validate_hash($ipv4_rule)
+ validate_hash($ipv6_rule)
- create_resources('firewall', { "${title}" => $rule })
+ # This conditional will ensure that TCP and UDP firewall rules have
+ # a port specified in the configuration when using INPUT or OUTPUT chains.
+ # If not, the Puppet catalog will fail.
+ # If we don't do this sanity check, a user could create some TCP/UDP
+ # rules without port, and the result would be an iptables rule that allow any
+ # traffic on the host.
+ if ($proto in ['tcp', 'udp']) and (! ($port or $dport or $sport) and ($chain != 'FORWARD')) {
+ fail("${title} firewall rule cannot be created. TCP or UDP rules for INPUT or OUTPUT need port or sport or dport.")
+ }
+ if $source or $destination {
+ if ('.' in $destination or '.' in $source) {
+ create_resources('firewall', { "${title} ipv4" => $ipv4_rule })
+ }
+ if (':' in $destination or ':' in $source) {
+ create_resources('firewall', { "${title} ipv6" => $ipv6_rule })
+ }
+ } else {
+ create_resources('firewall', { "${title} ipv4" => $ipv4_rule })
+ create_resources('firewall', { "${title} ipv6" => $ipv6_rule })
+ }
}
diff --git a/manifests/haproxy.pp b/manifests/haproxy.pp
index a4ab0cc..13d4ba5 100644
--- a/manifests/haproxy.pp
+++ b/manifests/haproxy.pp
@@ -64,6 +64,26 @@
# Can be a string or an array.
# Defaults to undef
#
+# [*contrail_config_hosts*]
+# (optional) Specify the contrail config hosts ips.
+# Defaults to hiera('contrail_config_node_ips')
+#
+# [*contrail_config_hosts_names*]
+# (optional) Specify the contrail config hosts.
+# Defaults to hiera('contrail_config_node_ips')
+#
+# [*contrail_config*]
+# (optional) Switch to check that contrail config is enabled.
+# Defaults to hiera('contrail_config_enabled')
+#
+# [*contrail_webui*]
+# (optional) Switch to check that contrail config is enabled.
+# Defaults to hiera('contrail_webui_enabled')
+#
+# [*contrail_analytics*]
+# (optional) Switch to check that contrail config is enabled.
+# Defaults to hiera('contrail_analytics_enabled')
+#
# [*public_virtual_ip*]
# Public IP or group of IPs to bind the pools
# Can be a string or an array.
@@ -143,6 +163,10 @@
# (optional) Enable or not Cinder API binding
# Defaults to hiera('cinder_api_enabled', false)
#
+# [*congress*]
+# (optional) Enable or not Congress API binding
+# Defaults to hiera('congress_enabled', false)
+#
# [*manila*]
# (optional) Enable or not Manila API binding
# Defaults to hiera('manila_api_enabled', false)
@@ -151,6 +175,10 @@
# (optional) Enable or not Sahara API binding
# defaults to hiera('sahara_api_enabled', false)
#
+# [*tacker*]
+# (optional) Enable or not Tacker API binding
+# Defaults to hiera('tacker_enabled', false)
+#
# [*trove*]
# (optional) Enable or not Trove API binding
# defaults to hiera('trove_api_enabled', false)
@@ -159,14 +187,14 @@
# (optional) Enable or not Glance API binding
# Defaults to hiera('glance_api_enabled', false)
#
-# [*glance_registry*]
-# (optional) Enable or not Glance registry binding
-# Defaults to hiera('glance_registry_enabled', false)
-#
# [*nova_osapi*]
# (optional) Enable or not Nova API binding
# Defaults to hiera('nova_api_enabled', false)
#
+# [*nova_placement*]
+# (optional) Enable or not Nova Placement API binding
+# Defaults to hiera('nova_placement_enabled', false)
+#
# [*nova_metadata*]
# (optional) Enable or not Nova metadata binding
# Defaults to hiera('nova_api_enabled', false)
@@ -175,6 +203,14 @@
# (optional) Enable or not Nova novncproxy binding
# Defaults to hiera('nova_vnc_proxy_enabled', false)
#
+# [*ec2_api*]
+# (optional) Enable or not EC2 API binding
+# Defaults to hiera('ec2_api_enabled', false)
+#
+# [*ec2_api_metadata*]
+# (optional) Enable or not EC2 API metadata binding
+# Defaults to hiera('ec2_api_enabled', false)
+#
# [*ceilometer*]
# (optional) Enable or not Ceilometer API binding
# Defaults to hiera('ceilometer_api_enabled', false)
@@ -247,6 +283,10 @@
# (optional) Enable or not RabbitMQ binding
# Defaults to false
#
+# [*etcd*]
+# (optional) Enable or not Etcd binding
+# Defaults to hiera('etcd_enabled', false)
+#
# [*docker_registry*]
# (optional) Enable or not the Docker Registry API binding
# Defaults to hiera('enable_docker_registry', false)
@@ -276,6 +316,10 @@
# (optional) Enable or not OpenDaylight binding
# Defaults to hiera('opendaylight_api_enabled', false)
#
+# [*ovn_dbs*]
+# (optional) Enable or not OVN northd binding
+# Defaults to hiera('ovn_dbs_enabled', false)
+#
# [*zaqar_ws*]
# (optional) Enable or not Zaqar Websockets binding
# Defaults to false
@@ -304,6 +348,10 @@
# (optional) Specify the network cinder is running on.
# Defaults to hiera('cinder_api_network', undef)
#
+# [*congress_network*]
+# (optional) Specify the network congress is running on.
+# Defaults to hiera('congress_api_network', undef)
+#
# [*docker_registry_network*]
# (optional) Specify the network docker-registry is running on.
# Defaults to hiera('docker_registry_network', undef)
@@ -312,10 +360,6 @@
# (optional) Specify the network glance_api is running on.
# Defaults to hiera('glance_api_network', undef)
#
-# [*glance_registry_network*]
-# (optional) Specify the network glance_registry is running on.
-# Defaults to hiera('glance_registry_network', undef)
-#
# [*gnocchi_network*]
# (optional) Specify the network gnocchi is running on.
# Defaults to hiera('gnocchi_api_network', undef)
@@ -372,6 +416,18 @@
# (optional) Specify the network nova_osapi is running on.
# Defaults to hiera('nova_api_network', undef)
#
+# [*nova_placement_network*]
+# (optional) Specify the network nova_placement is running on.
+# Defaults to hiera('nova_placement_network', undef)
+#
+# [*ec2_api_network*]
+# (optional) Specify the network ec2_api is running on.
+# Defaults to hiera('ec2_api_network', undef)
+#
+# [*ec2_api_metadata_network*]
+# (optional) Specify the network ec2_api_metadata is running on.
+# Defaults to hiera('ec2_api_network', undef)
+#
# [*opendaylight_network*]
# (optional) Specify the network opendaylight is running on.
# Defaults to hiera('opendaylight_api_network', undef)
@@ -380,6 +436,10 @@
# (optional) Specify the network panko is running on.
# Defaults to hiera('panko_api_network', undef)
#
+# [*ovn_dbs_network*]
+# (optional) Specify the network ovn_dbs is running on.
+# Defaults to hiera('ovn_dbs_network', undef)
+#
# [*sahara_network*]
# (optional) Specify the network sahara is running on.
# Defaults to hiera('sahara_api_network', undef)
@@ -388,6 +448,10 @@
# (optional) Specify the network swift_proxy_server is running on.
# Defaults to hiera('swift_proxy_network', undef)
#
+# [*tacker_network*]
+# (optional) Specify the network tacker is running on.
+# Defaults to hiera('tacker_api_network', undef)
+#
# [*trove_network*]
# (optional) Specify the network trove is running on.
# Defaults to hiera('trove_api_network', undef)
@@ -411,7 +475,6 @@
# 'docker_registry_ssl_port' (Defaults to 13787)
# 'glance_api_port' (Defaults to 9292)
# 'glance_api_ssl_port' (Defaults to 13292)
-# 'glance_registry_port' (Defaults to 9191)
# 'gnocchi_api_port' (Defaults to 8041)
# 'gnocchi_api_ssl_port' (Defaults to 13041)
# 'mistral_api_port' (Defaults to 8989)
@@ -436,11 +499,16 @@
# 'neutron_api_ssl_port' (Defaults to 13696)
# 'nova_api_port' (Defaults to 8774)
# 'nova_api_ssl_port' (Defaults to 13774)
+# 'nova_placement_port' (Defaults to 8778)
+# 'nova_placement_ssl_port' (Defaults to 13778)
# 'nova_metadata_port' (Defaults to 8775)
# 'nova_novnc_port' (Defaults to 6080)
# 'nova_novnc_ssl_port' (Defaults to 13080)
+# 'opendaylight_api_port' (Defaults to 8081)
# 'panko_api_port' (Defaults to 8779)
# 'panko_api_ssl_port' (Defaults to 13779)
+# 'ovn_nbdb_port' (Defaults to 6641)
+# 'ovn_sbdb_port' (Defaults to 6642)
# 'sahara_api_port' (Defaults to 8386)
# 'sahara_api_ssl_port' (Defaults to 13386)
# 'swift_proxy_port' (Defaults to 8080)
@@ -471,6 +539,11 @@ class tripleo::haproxy (
$haproxy_stats_password = undef,
$controller_hosts = hiera('controller_node_ips'),
$controller_hosts_names = hiera('controller_node_names', undef),
+ $contrail_config_hosts = hiera('contrail_config_node_ips', undef),
+ $contrail_config_hosts_names = hiera('contrail_config_node_names', undef),
+ $contrail_analytics = hiera('contrail_analytics_enabled', false),
+ $contrail_config = hiera('contrail_config_enabled', false),
+ $contrail_webui = hiera('contrail_webui_enabled', false),
$service_certificate = undef,
$use_internal_certificates = false,
$internal_certificates_specs = {},
@@ -483,14 +556,18 @@ class tripleo::haproxy (
$keystone_public = hiera('keystone_enabled', false),
$neutron = hiera('neutron_api_enabled', false),
$cinder = hiera('cinder_api_enabled', false),
+ $congress = hiera('congress_enabled', false),
$manila = hiera('manila_api_enabled', false),
$sahara = hiera('sahara_api_enabled', false),
+ $tacker = hiera('tacker_enabled', false),
$trove = hiera('trove_api_enabled', false),
$glance_api = hiera('glance_api_enabled', false),
- $glance_registry = hiera('glance_registry_enabled', false),
$nova_osapi = hiera('nova_api_enabled', false),
+ $nova_placement = hiera('nova_placement_enabled', false),
$nova_metadata = hiera('nova_api_enabled', false),
$nova_novncproxy = hiera('nova_vnc_proxy_enabled', false),
+ $ec2_api = hiera('ec2_api_enabled', false),
+ $ec2_api_metadata = hiera('ec2_api_enabled', false),
$ceilometer = hiera('ceilometer_api_enabled', false),
$aodh = hiera('aodh_api_enabled', false),
$panko = hiera('panko_api_enabled', false),
@@ -508,6 +585,7 @@ class tripleo::haproxy (
$mysql_clustercheck = false,
$mysql_member_options = undef,
$rabbitmq = false,
+ $etcd = hiera('etcd_enabled', false),
$docker_registry = hiera('enable_docker_registry', false),
$redis = hiera('redis_enabled', false),
$redis_password = undef,
@@ -515,6 +593,7 @@ class tripleo::haproxy (
$zaqar_api = hiera('zaqar_api_enabled', false),
$ceph_rgw = hiera('ceph_rgw_enabled', false),
$opendaylight = hiera('opendaylight_api_enabled', false),
+ $ovn_dbs = hiera('ovn_dbs_enabled', false),
$zaqar_ws = hiera('zaqar_api_enabled', false),
$ui = hiera('enable_ui', false),
$aodh_network = hiera('aodh_api_network', undef),
@@ -522,9 +601,9 @@ class tripleo::haproxy (
$ceilometer_network = hiera('ceilometer_api_network', undef),
$ceph_rgw_network = hiera('ceph_rgw_network', undef),
$cinder_network = hiera('cinder_api_network', undef),
+ $congress_network = hiera('congress_api_network', undef),
$docker_registry_network = hiera('docker_registry_network', undef),
$glance_api_network = hiera('glance_api_network', undef),
- $glance_registry_network = hiera('glance_registry_network', undef),
$gnocchi_network = hiera('gnocchi_api_network', undef),
$heat_api_network = hiera('heat_api_network', undef),
$heat_cfn_network = hiera('heat_api_cfn_network', undef),
@@ -539,9 +618,14 @@ class tripleo::haproxy (
$nova_metadata_network = hiera('nova_api_network', undef),
$nova_novncproxy_network = hiera('nova_vnc_proxy_network', undef),
$nova_osapi_network = hiera('nova_api_network', undef),
+ $nova_placement_network = hiera('nova_placement_network', undef),
$panko_network = hiera('panko_api_network', undef),
+ $ovn_dbs_network = hiera('ovn_dbs_network', undef),
+ $ec2_api_network = hiera('ec2_api_network', undef),
+ $ec2_api_metadata_network = hiera('ec2_api_network', undef),
$sahara_network = hiera('sahara_api_network', undef),
$swift_proxy_server_network = hiera('swift_proxy_network', undef),
+ $tacker_network = hiera('tacker_api_network', undef),
$trove_network = hiera('trove_api_network', undef),
$zaqar_api_network = hiera('zaqar_api_network', undef),
$service_ports = {}
@@ -555,11 +639,20 @@ class tripleo::haproxy (
ceilometer_api_ssl_port => 13777,
cinder_api_port => 8776,
cinder_api_ssl_port => 13776,
+ congress_api_port => 1789,
+ congress_api_ssl_port => 13789,
+ contrail_config_port => 8082,
+ contrail_config_ssl_port => 18082,
+ contrail_discovery_port => 5998,
+ contrail_discovery_ssl_port => 15998,
+ contrail_analytics_port => 8090,
+ contrail_analytics_ssl_port => 18090,
+ contrail_webui_http_port => 8080,
+ contrail_webui_https_port => 8143,
docker_registry_port => 8787,
docker_registry_ssl_port => 13787,
glance_api_port => 9292,
glance_api_ssl_port => 13292,
- glance_registry_port => 9191,
gnocchi_api_port => 8041,
gnocchi_api_ssl_port => 13041,
mistral_api_port => 8989,
@@ -580,19 +673,30 @@ class tripleo::haproxy (
keystone_public_api_ssl_port => 13000,
manila_api_port => 8786,
manila_api_ssl_port => 13786,
+ midonet_cluster_port => 8181,
neutron_api_port => 9696,
neutron_api_ssl_port => 13696,
nova_api_port => 8774,
nova_api_ssl_port => 13774,
+ nova_placement_port => 8778,
+ nova_placement_ssl_port => 13778,
nova_metadata_port => 8775,
nova_novnc_port => 6080,
nova_novnc_ssl_port => 13080,
+ opendaylight_api_port => 8081,
panko_api_port => 8779,
panko_api_ssl_port => 13779,
+ ovn_nbdb_port => 6641,
+ ovn_sbdb_port => 6642,
+ ec2_api_port => 8788,
+ ec2_api_ssl_port => 13788,
+ ec2_api_metadata_port => 8789,
sahara_api_port => 8386,
sahara_api_ssl_port => 13386,
swift_proxy_port => 8080,
swift_proxy_ssl_port => 13808,
+ tacker_api_port => 9890,
+ tacker_api_ssl_port => 13989,
trove_api_port => 8779,
trove_api_ssl_port => 13779,
ui_port => 3000,
@@ -687,6 +791,11 @@ class tripleo::haproxy (
"${redis_vip}:6379" => $haproxy_listen_bind_param,
}
+ $etcd_vip = hiera('etcd_vip', $controller_virtual_ip)
+ $etcd_bind_opts = {
+ "${etcd_vip}:2379" => $haproxy_listen_bind_param,
+ }
+
class { '::haproxy':
service_manage => $haproxy_service_manage,
global_options => {
@@ -799,6 +908,7 @@ class tripleo::haproxy (
},
public_ssl_port => $ports[neutron_api_ssl_port],
service_network => $neutron_network,
+ member_options => union($haproxy_member_options, $internal_tls_member_options),
}
}
@@ -821,6 +931,24 @@ class tripleo::haproxy (
}
}
+ if $congress {
+ ::tripleo::haproxy::endpoint { 'congress':
+ public_virtual_ip => $public_virtual_ip,
+ internal_ip => hiera('congress_api_vip', $controller_virtual_ip),
+ service_port => $ports[congress_api_port],
+ ip_addresses => hiera('congress_node_ips', $controller_hosts_real),
+ server_names => hiera('congress_api_node_names', $controller_hosts_names_real),
+ mode => 'http',
+ listen_options => {
+ 'http-request' => [
+ 'set-header X-Forwarded-Proto https if { ssl_fc }',
+ 'set-header X-Forwarded-Proto http if !{ ssl_fc }'],
+ },
+ public_ssl_port => $ports[congress_api_ssl_port],
+ service_network => $congress_network,
+ }
+ }
+
if $manila {
::tripleo::haproxy::endpoint { 'manila':
public_virtual_ip => $public_virtual_ip,
@@ -851,6 +979,24 @@ class tripleo::haproxy (
}
}
+ if $tacker {
+ ::tripleo::haproxy::endpoint { 'tacker':
+ public_virtual_ip => $public_virtual_ip,
+ internal_ip => hiera('tacker_api_vip', $controller_virtual_ip),
+ service_port => $ports[tacker_api_port],
+ ip_addresses => hiera('tacker_node_ips', $controller_hosts_real),
+ server_names => hiera('tacker_api_node_names', $controller_hosts_names_real),
+ mode => 'http',
+ listen_options => {
+ 'http-request' => [
+ 'set-header X-Forwarded-Proto https if { ssl_fc }',
+ 'set-header X-Forwarded-Proto http if !{ ssl_fc }'],
+ },
+ public_ssl_port => $ports[tacker_api_ssl_port],
+ service_network => $tacker_network,
+ }
+ }
+
if $trove {
::tripleo::haproxy::endpoint { 'trove':
public_virtual_ip => $public_virtual_ip,
@@ -878,16 +1024,7 @@ class tripleo::haproxy (
'set-header X-Forwarded-Proto http if !{ ssl_fc }'],
},
service_network => $glance_api_network,
- }
- }
-
- if $glance_registry {
- ::tripleo::haproxy::endpoint { 'glance_registry':
- internal_ip => hiera('glance_registry_vip', $controller_virtual_ip),
- service_port => $ports[glance_registry_port],
- ip_addresses => hiera('glance_registry_node_ips', $controller_hosts_real),
- server_names => hiera('glance_registry_node_names', $controller_hosts_names_real),
- service_network => $glance_registry_network,
+ member_options => union($haproxy_member_options, $internal_tls_member_options),
}
}
@@ -907,6 +1044,26 @@ class tripleo::haproxy (
},
public_ssl_port => $ports[nova_api_ssl_port],
service_network => $nova_osapi_network,
+ #member_options => union($haproxy_member_options, $internal_tls_member_options),
+ }
+ }
+
+ $nova_placement_vip = hiera('nova_placement_vip', $controller_virtual_ip)
+ if $nova_placement {
+ ::tripleo::haproxy::endpoint { 'nova_placement':
+ public_virtual_ip => $public_virtual_ip,
+ internal_ip => $nova_placement_vip,
+ service_port => $ports[nova_placement_port],
+ ip_addresses => hiera('nova_placement_node_ips', $controller_hosts_real),
+ server_names => hiera('nova_placement_node_names', $controller_hosts_names_real),
+ mode => 'http',
+ listen_options => {
+ 'http-request' => [
+ 'set-header X-Forwarded-Proto https if { ssl_fc }',
+ 'set-header X-Forwarded-Proto http if !{ ssl_fc }'],
+ },
+ public_ssl_port => $ports[nova_placement_ssl_port],
+ service_network => $nova_placement_network,
member_options => union($haproxy_member_options, $internal_tls_member_options),
}
}
@@ -937,6 +1094,34 @@ class tripleo::haproxy (
}
}
+ if $ec2_api {
+ ::tripleo::haproxy::endpoint { 'ec2_api':
+ public_virtual_ip => $public_virtual_ip,
+ internal_ip => hiera('ec2_api_vip', $controller_virtual_ip),
+ service_port => $ports[ec2_api_port],
+ ip_addresses => hiera('ec2_api_node_ips', $controller_hosts_real),
+ server_names => hiera('ec2_api_node_names', $controller_hosts_names_real),
+ mode => 'http',
+ listen_options => {
+ 'http-request' => [
+ 'set-header X-Forwarded-Proto https if { ssl_fc }',
+ 'set-header X-Forwarded-Proto http if !{ ssl_fc }'],
+ },
+ public_ssl_port => $ports[ec2_api_ssl_port],
+ service_network => $ec2_api_network,
+ }
+ }
+
+ if $ec2_api_metadata {
+ ::tripleo::haproxy::endpoint { 'ec2_api_metadata':
+ internal_ip => hiera('ec2_api_vip', $controller_virtual_ip),
+ service_port => $ports[ec2_api_metadata_port],
+ ip_addresses => hiera('ec2_api_node_ips', $controller_hosts_real),
+ server_names => hiera('ec2_api_node_names', $controller_hosts_names_real),
+ service_network => $ec2_api_metadata_network,
+ }
+ }
+
if $ceilometer {
::tripleo::haproxy::endpoint { 'ceilometer':
public_virtual_ip => $public_virtual_ip,
@@ -1189,6 +1374,15 @@ class tripleo::haproxy (
server_names => hiera('mysql_node_names', $controller_hosts_names_real),
options => $mysql_member_options_real,
}
+ if hiera('manage_firewall', true) {
+ include ::tripleo::firewall
+ $mysql_firewall_rules = {
+ '100 mysql_haproxy' => {
+ 'dport' => 3306,
+ }
+ }
+ create_resources('tripleo::firewall::rule', $mysql_firewall_rules)
+ }
}
if $rabbitmq {
@@ -1209,6 +1403,23 @@ class tripleo::haproxy (
}
}
+ if $etcd {
+ haproxy::listen { 'etcd':
+ bind => $etcd_bind_opts,
+ options => {
+ 'balance' => 'source',
+ },
+ collect_exported => false,
+ }
+ haproxy::balancermember { 'etcd':
+ listening_service => 'etcd',
+ ports => '2379',
+ ipaddresses => hiera('etcd_node_ips', $controller_hosts_real),
+ server_names => hiera('etcd_node_names', $controller_hosts_names_real),
+ options => $haproxy_member_options,
+ }
+ }
+
if $docker_registry {
::tripleo::haproxy::endpoint { 'docker-registry':
public_virtual_ip => $public_virtual_ip,
@@ -1248,12 +1459,21 @@ class tripleo::haproxy (
server_names => hiera('redis_node_names', $controller_hosts_names_real),
options => $haproxy_member_options,
}
+ if hiera('manage_firewall', true) {
+ include ::tripleo::firewall
+ $redis_firewall_rules = {
+ '100 redis_haproxy' => {
+ 'dport' => 6379,
+ }
+ }
+ create_resources('tripleo::firewall::rule', $redis_firewall_rules)
+ }
}
- $midonet_api_vip = hiera('midonet_api_vip', $controller_virtual_ip)
+ $midonet_cluster_vip = hiera('midonet_cluster_vip', $controller_virtual_ip)
$midonet_bind_opts = {
- "${midonet_api_vip}:8081" => [],
- "${public_virtual_ip}:8081" => [],
+ "${midonet_cluster_vip}:${ports[midonet_cluster_port]}" => [],
+ "${public_virtual_ip}:${ports[midonet_cluster_port]}" => [],
}
if $midonet_api {
@@ -1263,7 +1483,7 @@ class tripleo::haproxy (
}
haproxy::balancermember { 'midonet_api':
listening_service => 'midonet_api',
- ports => '8081',
+ ports => $ports[midonet_cluster_port],
ipaddresses => hiera('midonet_api_node_ips', $controller_hosts_real),
server_names => hiera('midonet_api_node_names', $controller_hosts_names_real),
options => $haproxy_member_options,
@@ -1294,26 +1514,49 @@ class tripleo::haproxy (
}
}
- $opendaylight_api_vip = hiera('opendaylight_api_vip', $controller_virtual_ip)
- $opendaylight_bind_opts = {
- "${opendaylight_api_vip}:8081" => $haproxy_listen_bind_param,
- "${public_virtual_ip}:8081" => $haproxy_listen_bind_param,
- }
-
if $opendaylight {
- haproxy::listen { 'opendaylight':
- bind => $opendaylight_bind_opts,
- options => {
+ ::tripleo::haproxy::endpoint { 'opendaylight':
+ internal_ip => unique([hiera('opendaylight_api_vip', $controller_virtual_ip), $controller_virtual_ip]),
+ service_port => $ports[opendaylight_api_port],
+ ip_addresses => hiera('opendaylight_api_node_ips', $controller_hosts_real),
+ server_names => hiera('opendaylight_api_node_names', $controller_hosts_names_real),
+ mode => 'http',
+ listen_options => {
'balance' => 'source',
},
- collect_exported => false,
}
- haproxy::balancermember { 'opendaylight':
- listening_service => 'opendaylight',
- ports => '8081',
- ipaddresses => hiera('opendaylight_api_node_ips', $controller_hosts_real),
- server_names => hiera('opendaylight_api_node_names', $controller_hosts_names_real),
- options => ['check', 'inter 2000', 'rise 2', 'fall 5'],
+ }
+
+
+ if $ovn_dbs {
+ # FIXME: is this config enough to ensure we only hit the first node in
+ # ovn_northd_node_ips ?
+ $ovn_db_listen_options = {
+ 'option' => [ 'tcpka' ],
+ 'timeout client' => '90m',
+ 'timeout server' => '90m',
+ 'stick-table' => 'type ip size 1000',
+ 'stick' => 'on dst',
+ }
+ ::tripleo::haproxy::endpoint { 'ovn_nbdb':
+ public_virtual_ip => $public_virtual_ip,
+ internal_ip => hiera('ovn_dbs_vip', $controller_virtual_ip),
+ service_port => $ports[ovn_nbdb_port],
+ ip_addresses => hiera('ovn_dbs_node_ips', $controller_hosts_real),
+ server_names => hiera('ovn_dbs_node_names', $controller_hosts_names_real),
+ service_network => $ovn_dbs_network,
+ listen_options => $ovn_db_listen_options,
+ mode => 'tcp'
+ }
+ ::tripleo::haproxy::endpoint { 'ovn_sbdb':
+ public_virtual_ip => $public_virtual_ip,
+ internal_ip => hiera('ovn_dbs_vip', $controller_virtual_ip),
+ service_port => $ports[ovn_sbdb_port],
+ ip_addresses => hiera('ovn_dbs_node_ips', $controller_hosts_real),
+ server_names => hiera('ovn_dbs_node_names', $controller_hosts_names_real),
+ service_network => $ovn_dbs_network,
+ listen_options => $ovn_db_listen_options,
+ mode => 'tcp'
}
}
@@ -1330,7 +1573,7 @@ class tripleo::haproxy (
# NOTE(jaosorior): Websockets have more overhead in establishing
# connections than regular HTTP connections. Also, since it begins
# as an HTTP connection and then "upgrades" to a TCP connection, some
- # timeouts get overriden by others at certain times of the connection.
+ # timeouts get overridden by others at certain times of the connection.
# The following values were taken from the following site:
# http://blog.haproxy.com/2012/11/07/websockets-load-balancing-with-haproxy/
'timeout' => ['connect 5s', 'client 25s', 'server 25s', 'tunnel 3600s'],
@@ -1351,5 +1594,50 @@ class tripleo::haproxy (
public_ssl_port => $ports[ui_ssl_port],
}
}
-
+ if $contrail_config {
+ ::tripleo::haproxy::endpoint { 'contrail_config':
+ public_virtual_ip => $public_virtual_ip,
+ internal_ip => hiera('contrail_config_vip', $controller_virtual_ip),
+ service_port => $ports[contrail_config_port],
+ ip_addresses => hiera('contrail_config_node_ips'),
+ server_names => hiera('contrail_config_node_ips'),
+ public_ssl_port => $ports[contrail_config_ssl_port],
+ }
+ ::tripleo::haproxy::endpoint { 'contrail_discovery':
+ public_virtual_ip => $public_virtual_ip,
+ internal_ip => hiera('contrail_config_vip', $controller_virtual_ip),
+ service_port => $ports[contrail_discovery_port],
+ ip_addresses => hiera('contrail_config_node_ips'),
+ server_names => hiera('contrail_config_node_ips'),
+ public_ssl_port => $ports[contrail_discovery_ssl_port],
+ }
+ }
+ if $contrail_analytics {
+ ::tripleo::haproxy::endpoint { 'contrail_analytics':
+ public_virtual_ip => $public_virtual_ip,
+ internal_ip => hiera('contrail_analytics_vip', $controller_virtual_ip),
+ service_port => $ports[contrail_analytics_port],
+ ip_addresses => hiera('contrail_config_node_ips'),
+ server_names => hiera('contrail_config_node_ips'),
+ public_ssl_port => $ports[contrail_analytics_ssl_port],
+ }
+ }
+ if $contrail_webui {
+ ::tripleo::haproxy::endpoint { 'contrail_webui_http':
+ public_virtual_ip => $public_virtual_ip,
+ internal_ip => hiera('contrail_webui_vip', $controller_virtual_ip),
+ service_port => $ports[contrail_webui_http_port],
+ ip_addresses => hiera('contrail_config_node_ips'),
+ server_names => hiera('contrail_config_node_ips'),
+ public_ssl_port => $ports[contrail_webui_http_port],
+ }
+ ::tripleo::haproxy::endpoint { 'contrail_webui_https':
+ public_virtual_ip => $public_virtual_ip,
+ internal_ip => hiera('contrail_webui_vip', $controller_virtual_ip),
+ service_port => $ports[contrail_webui_https_port],
+ ip_addresses => hiera('contrail_config_node_ips'),
+ server_names => hiera('contrail_config_node_ips'),
+ public_ssl_port => $ports[contrail_webui_https_port],
+ }
+ }
}
diff --git a/manifests/haproxy/endpoint.pp b/manifests/haproxy/endpoint.pp
index 4311049..da2aba3 100644
--- a/manifests/haproxy/endpoint.pp
+++ b/manifests/haproxy/endpoint.pp
@@ -36,7 +36,7 @@
#
# [*public_virtual_ip*]
# Address in which the proxy endpoint will be listening in the public network.
-# If this service is internal only this should be ommited.
+# If this service is internal only this should be ommitted.
# Defaults to undef.
#
# [*mode*]
@@ -149,14 +149,29 @@ define tripleo::haproxy::endpoint (
}
if hiera('manage_firewall', true) {
include ::tripleo::firewall
- $firewall_rules = {
- "100 ${name}_haproxy" => {
- 'dport' => $service_port,
- },
- "100 ${name}_haproxy_ssl" => {
- 'dport' => $public_ssl_port,
- },
+ # This block will construct firewall rules only when we specify
+ # a port for the regular service and also the ssl port for the service.
+ # It makes sure we're not trying to create TCP iptables rules where no port
+ # is specified.
+ if $service_port {
+ $haproxy_firewall_rules = {
+ "100 ${name}_haproxy" => {
+ 'dport' => $service_port,
+ },
+ }
+ }
+ if $public_ssl_port {
+ $haproxy_ssl_firewall_rules = {
+ "100 ${name}_haproxy_ssl" => {
+ 'dport' => $public_ssl_port,
+ },
+ }
+ } else {
+ $haproxy_ssl_firewall_rules = {}
+ }
+ $firewall_rules = merge($haproxy_firewall_rules, $haproxy_ssl_firewall_rules)
+ if $service_port or $public_ssl_port {
+ create_resources('tripleo::firewall::rule', $firewall_rules)
}
- create_resources('tripleo::firewall::rule', $firewall_rules)
}
}
diff --git a/manifests/host/sriov.pp b/manifests/host/sriov.pp
index a30db42..b94c472 100644
--- a/manifests/host/sriov.pp
+++ b/manifests/host/sriov.pp
@@ -21,7 +21,8 @@ class tripleo::host::sriov (
# the numvfs configuration needs to be persisted for every boot
tripleo::host::sriov::numvfs_persistence {'persistent_numvfs':
vf_defs => $number_of_vfs,
- content_string => "#!/bin/bash\n"
+ content_string => "#!/bin/bash\n",
+ udev_rules => ''
}
}
}
diff --git a/manifests/host/sriov/numvfs_persistence.pp b/manifests/host/sriov/numvfs_persistence.pp
index 1ee402c..4c6af83 100644
--- a/manifests/host/sriov/numvfs_persistence.pp
+++ b/manifests/host/sriov/numvfs_persistence.pp
@@ -4,15 +4,22 @@
# === Parameters:
#
# [*vf_defs*]
-# (required) Array of of <physical_interface>:<numvfs>.
+# (required) Array of <physical_interface>:<numvfs>.
# Example: ['eth1:10','eth2:8']
#
# [*content_string*]
# (required) String which shall be written to the script file.
#
+# [*udev_rules*]
+# (required) String of lines to write to udev rules to ensure
+# VFs are reconfigured if the PCI devices are removed and
+# readded without rebooting (e.g. when physical functions were
+# allocated to VMs)
+#
define tripleo::host::sriov::numvfs_persistence(
$vf_defs,
- $content_string
+ $content_string,
+ $udev_rules
){
# Since reduce isn't available, we use recursion to iterate each entries of
# "physical_interface:vfs" and accumulate the content that needs to be
@@ -36,6 +43,16 @@ define tripleo::host::sriov::numvfs_persistence(
replace => false
}
+ file { '/etc/udev/rules.d/70-tripleo-reset-sriov.rules':
+ ensure => file,
+ group => 'root',
+ mode => '0755',
+ owner => 'root',
+ content => $udev_rules,
+ replace => true,
+ }
+
+
file_line { 'call_ifup-local':
path => '/sbin/ifup-local',
line => '/etc/sysconfig/allocate_vfs $1',
@@ -46,9 +63,11 @@ define tripleo::host::sriov::numvfs_persistence(
$interface = $vfspec[0]
$count = $vfspec[1]
$vfdef_str = "${content_string}[ \"${interface}\" == \"\$1\" ] && echo ${count} > /sys/class/net/${interface}/device/sriov_numvfs\n"
+ $udev_str = "${udev_rules}KERNEL==\"${interface}\", RUN+=\"/etc/sysconfig/allocate_vfs %k\"\n"
tripleo::host::sriov::numvfs_persistence{"mapped ${interface}":
vf_defs => delete_at($vf_defs, 0),
- content_string => $vfdef_str
+ content_string => $vfdef_str,
+ udev_rules => $udev_str
}
}
}
diff --git a/manifests/keepalived.pp b/manifests/keepalived.pp
index 0e9262d..a6d5832 100644
--- a/manifests/keepalived.pp
+++ b/manifests/keepalived.pp
@@ -113,10 +113,15 @@ class tripleo::keepalived (
if $internal_api_virtual_ip and $internal_api_virtual_ip != $controller_virtual_ip {
$internal_api_virtual_interface = interface_for_ip($internal_api_virtual_ip)
+ if is_ipv6_address($internal_api_virtual_ip) {
+ $internal_api_virtual_netmask = '64'
+ } else {
+ $internal_api_virtual_netmask = '32'
+ }
# KEEPALIVE INTERNAL API NETWORK
keepalived::instance { '53':
interface => $internal_api_virtual_interface,
- virtual_ips => [join([$internal_api_virtual_ip, ' dev ', $internal_api_virtual_interface])],
+ virtual_ips => [join(["${internal_api_virtual_ip}/${internal_api_virtual_netmask}", ' dev ', $internal_api_virtual_interface])],
state => 'MASTER',
track_script => ['haproxy'],
priority => 101,
@@ -125,10 +130,15 @@ class tripleo::keepalived (
if $storage_virtual_ip and $storage_virtual_ip != $controller_virtual_ip {
$storage_virtual_interface = interface_for_ip($storage_virtual_ip)
+ if is_ipv6_address($storage_virtual_ip) {
+ $storage_virtual_netmask = '64'
+ } else {
+ $storage_virtual_netmask = '32'
+ }
# KEEPALIVE STORAGE NETWORK
keepalived::instance { '54':
interface => $storage_virtual_interface,
- virtual_ips => [join([$storage_virtual_ip, ' dev ', $storage_virtual_interface])],
+ virtual_ips => [join(["${storage_virtual_ip}/${storage_virtual_netmask}", ' dev ', $storage_virtual_interface])],
state => 'MASTER',
track_script => ['haproxy'],
priority => 101,
@@ -137,10 +147,15 @@ class tripleo::keepalived (
if $storage_mgmt_virtual_ip and $storage_mgmt_virtual_ip != $controller_virtual_ip {
$storage_mgmt_virtual_interface = interface_for_ip($storage_mgmt_virtual_ip)
+ if is_ipv6_address($storage_mgmt_virtual_ip) {
+ $storage_mgmt_virtual_netmask = '64'
+ } else {
+ $storage_mgmt_virtual_netmask = '32'
+ }
# KEEPALIVE STORAGE MANAGEMENT NETWORK
keepalived::instance { '55':
interface => $storage_mgmt_virtual_interface,
- virtual_ips => [join([$storage_mgmt_virtual_ip, ' dev ', $storage_mgmt_virtual_interface])],
+ virtual_ips => [join(["${storage_mgmt_virtual_ip}/${storage_mgmt_virtual_netmask}", ' dev ', $storage_mgmt_virtual_interface])],
state => 'MASTER',
track_script => ['haproxy'],
priority => 101,
@@ -149,10 +164,15 @@ class tripleo::keepalived (
if $redis_virtual_ip and $redis_virtual_ip != $controller_virtual_ip {
$redis_virtual_interface = interface_for_ip($redis_virtual_ip)
+ if is_ipv6_address($redis_virtual_ip) {
+ $redis_virtual_netmask = '64'
+ } else {
+ $redis_virtual_netmask = '32'
+ }
# KEEPALIVE STORAGE MANAGEMENT NETWORK
keepalived::instance { '56':
interface => $redis_virtual_interface,
- virtual_ips => [join([$redis_virtual_ip, ' dev ', $redis_virtual_interface])],
+ virtual_ips => [join(["${redis_virtual_ip}/${redis_virtual_netmask}", ' dev ', $redis_virtual_interface])],
state => 'MASTER',
track_script => ['haproxy'],
priority => 101,
diff --git a/manifests/network/contrail/analytics.pp b/manifests/network/contrail/analytics.pp
index 4359a43..e34c7e6 100644
--- a/manifests/network/contrail/analytics.pp
+++ b/manifests/network/contrail/analytics.pp
@@ -43,6 +43,21 @@
# String value.
# Defaults to hiera('contrail::admin_user')
#
+# [*api_server*]
+# (optional) IP address of api server
+# String value.
+# Defaults to hiera('contrail_config_vip')
+#
+# [*api_port*]
+# (optional) port of api server
+# String value.
+# Defaults to hiera('contrail::api_port')
+#
+# [*analytics_aaa_mode*]
+# (optional) analytics aaa mode parameter
+# String value.
+# Defaults to hiera('contrail::analytics_aaa_mode')
+#
# [*auth_host*]
# (optional) keystone server ip address
# String (IPv4) value.
@@ -53,11 +68,26 @@
# Integer value.
# Defaults to hiera('contrail::auth_port')
#
+# [*auth_port_ssl*]
+# (optional) keystone ssl port.
+# Integer value.
+# Defaults to hiera('contrail::auth_port_ssl')
+#
# [*auth_protocol*]
# (optional) authentication protocol.
# String value.
# Defaults to hiera('contrail::auth_protocol')
#
+# [*ca_file*]
+# (optional) ca file name
+# String value.
+# Defaults to hiera('contrail::service_certificate',false)
+#
+# [*cert_file*]
+# (optional) cert file name
+# String value.
+# Defaults to hiera('contrail::service_certificate',false)
+#
# [*cassandra_server_list*]
# (optional) List IPs+port of Cassandra servers
# Array of strings value.
@@ -76,7 +106,7 @@
# [*disc_server_ip*]
# (optional) IPv4 address of discovery server.
# String (IPv4) value.
-# Defaults to hiera('contrail::disc_server_ip')
+# Defaults to hiera('contrail_config_vip')
#
# [*disc_server_port*]
# (optional) port Discovery server listens on.
@@ -103,6 +133,31 @@
# String (IPv4) value + port
# Defaults to hiera('contrail::memcached_server')
#
+# [*public_vip*]
+# (optional) Public virtual IP address
+# String (IPv4) value
+# Defaults to hiera('public_virtual_ip')
+#
+# [*rabbit_server*]
+# (optional) IPv4 addresses of rabbit server.
+# Array of String (IPv4) value.
+# Defaults to hiera('rabbitmq_node_ips')
+#
+# [*rabbit_user*]
+# (optional) Rabbit user
+# String value.
+# Defaults to hiera('contrail::rabbit_user')
+#
+# [*rabbit_password*]
+# (optional) Rabbit password
+# String value.
+# Defaults to hiera('contrail::rabbit_password')
+#
+# [*rabbit_port*]
+# (optional) port of rabbit server
+# String value.
+# Defaults to hiera('contrail::rabbit_port')
+#
# [*redis_server*]
# (optional) IPv4 address of redis server.
# String (IPv4) value.
@@ -123,123 +178,209 @@
# Integer value.
# Defaults to 8081
#
+# [*step*]
+# (optional) Step stack is in
+# Integer value.
+# Defaults to hiera('step')
+#
# [*zk_server_ip*]
# (optional) List IPs+port of Zookeeper servers
# Array of strings value.
# Defaults to hiera('contrail::zk_server_ip')
#
class tripleo::network::contrail::analytics(
- $host_ip,
- $admin_password = hiera('contrail::admin_password'),
- $admin_tenant_name = hiera('contrail::admin_tenant_name'),
- $admin_token = hiera('contrail::admin_token'),
- $admin_user = hiera('contrail::admin_user'),
- $auth_host = hiera('contrail::auth_host'),
- $auth_port = hiera('contrail::auth_port'),
- $auth_protocol = hiera('contrail::auth_protocol'),
- $cassandra_server_list = hiera('contrail::cassandra_server_list'),
- $collector_http_server_port = 8089,
- $collector_sandesh_port = 8086,
- $disc_server_ip = hiera('contrail::disc_server_ip'),
- $disc_server_port = hiera('contrail::disc_server_port'),
- $http_server_port = 8090,
- $insecure = hiera('contrail::insecure'),
- $kafka_broker_list = hiera('contrail::kafka_broker_list'),
- $memcached_servers = hiera('contrail::memcached_server'),
- $redis_server = '127.0.0.1',
- $redis_server_port = 6379,
- $rest_api_ip = '0.0.0.0',
- $rest_api_port = 8081,
- $zk_server_ip = hiera('contrail::zk_server_ip'),
+ $step = hiera('step'),
+ $admin_password = hiera('contrail::admin_password'),
+ $admin_tenant_name = hiera('contrail::admin_tenant_name'),
+ $admin_token = hiera('contrail::admin_token'),
+ $admin_user = hiera('contrail::admin_user'),
+ $api_server = hiera('contrail_config_vip'),
+ $api_port = hiera('contrail::api_port'),
+ $auth_host = hiera('contrail::auth_host'),
+ $auth_port = hiera('contrail::auth_port'),
+ $auth_protocol = hiera('contrail::auth_protocol'),
+ $auth_port_ssl = hiera('contrail::auth_port_ssl'),
+ $analytics_aaa_mode = hiera('contrail::analytics_aaa_mode'),
+ $cassandra_server_list = hiera('contrail_analytics_database_node_ips'),
+ $ca_file = hiera('contrail::service_certificate',false),
+ $cert_file = hiera('contrail::service_certificate',false),
+ $collector_http_server_port = hiera('contrail::analytics::collector_http_server_port'),
+ $collector_sandesh_port = hiera('contrail::analytics::collector_sandesh_port'),
+ $disc_server_ip = hiera('contrail_config_vip'),
+ $disc_server_port = hiera('contrail::disc_server_port'),
+ $http_server_port = hiera('contrail::analytics::http_server_port'),
+ $host_ip = hiera('contrail::analytics::host_ip'),
+ $insecure = hiera('contrail::insecure'),
+ $kafka_broker_list = hiera('contrail_analytics_database_node_ips'),
+ $memcached_servers = hiera('contrail::memcached_server'),
+ $public_vip = hiera('public_virtual_ip'),
+ $rabbit_server = hiera('rabbitmq_node_ips'),
+ $rabbit_user = hiera('contrail::rabbit_user'),
+ $rabbit_password = hiera('contrail::rabbit_password'),
+ $rabbit_port = hiera('contrail::rabbit_port'),
+ $redis_server = hiera('contrail::analytics::redis_server'),
+ $redis_server_port = hiera('contrail::analytics::redis_server_port'),
+ $rest_api_ip = hiera('contrail::analytics::rest_api_ip'),
+ $rest_api_port = hiera('contrail::analytics::rest_api_port'),
+ $zk_server_ip = hiera('contrail_database_node_ips'),
)
{
- class {'::contrail::keystone':
- keystone_config => {
- 'KEYSTONE' => {
+ $cassandra_server_list_9042 = join([join($cassandra_server_list, ':9042 '),':9042'],'')
+ $kafka_broker_list_9092 = join([join($kafka_broker_list, ':9092 '),':9092'],'')
+ $rabbit_server_list_5672 = join([join($rabbit_server, ":${rabbit_port},"),":${rabbit_port}"],'')
+ $redis_config = "bind ${host_ip} 127.0.0.1"
+ $zk_server_ip_2181 = join([join($zk_server_ip, ':2181 '),':2181'],'')
+ $zk_server_ip_2181_comma = join([join($zk_server_ip, ':2181,'),':2181'],'')
+
+ if $auth_protocol == 'https' {
+ $keystone_config = {
'admin_password' => $admin_password,
'admin_tenant_name' => $admin_tenant_name,
- 'admin_token' => $admin_token,
'admin_user' => $admin_user,
'auth_host' => $auth_host,
- 'auth_port' => $auth_port,
+ 'auth_port' => $auth_port_ssl,
'auth_protocol' => $auth_protocol,
'insecure' => $insecure,
- 'memcached_servers' => $memcached_servers,
- },
- },
- } ->
- class {'::contrail::analytics':
- analytics_api_config => {
- 'DEFAULTS' => {
- 'cassandra_server_list' => $cassandra_server_list,
- 'host_ip' => $host_ip,
- 'http_server_port' => $http_server_port,
- 'redis_server' => $redis_server,
- 'rest_api_ip' => $rest_api_ip,
- 'rest_api_port' => $rest_api_port,
- },
- 'DISCOVERY' => {
- 'disc_server_ip' => $disc_server_ip,
- 'disc_server_port' => $disc_server_port,
- },
- 'REDIS' => {
- 'redis_server_port' => $redis_server_port,
- 'redis_query_port' => $redis_server_port,
- 'server' => $redis_server,
- },
- },
- collector_config => {
- 'DEFAULTS' => {
- 'cassandra_server_list' => $cassandra_server_list,
- 'disc_server_ip' => $disc_server_ip,
- 'hostip' => $host_ip,
- 'http_server_port' => $collector_http_server_port,
- 'kafka_broker_list' => $kafka_broker_list,
- 'zookeeper_server_list' => $zk_server_ip,
- },
- 'COLLECTOR' => {
- 'port' => $collector_sandesh_port,
+ 'certfile' => $cert_file,
+ 'cafile' => $ca_file,
+ }
+ $vnc_api_lib_config = {
+ 'auth' => {
+ 'AUTHN_SERVER' => $public_vip,
+ 'AUTHN_PORT' => $auth_port_ssl,
+ 'AUTHN_PROTOCOL' => $auth_protocol,
+ 'certfile' => $cert_file,
+ 'cafile' => $ca_file,
},
- 'DISCOVERY' => {
- 'port' => $disc_server_port,
- 'server' => $disc_server_ip,
+ }
+ } else {
+ $keystone_config = {
+ 'admin_password' => $admin_password,
+ 'admin_tenant_name' => $admin_tenant_name,
+ 'admin_user' => $admin_user,
+ 'auth_host' => $auth_host,
+ 'auth_port' => $auth_port,
+ 'auth_protocol' => $auth_protocol,
+ 'insecure' => $insecure,
+ }
+ $vnc_api_lib_config = {
+ 'auth' => {
+ 'AUTHN_SERVER' => $public_vip,
},
- 'REDIS' => {
- 'port' => $redis_server_port,
- 'server' => $redis_server,
+ }
+ }
+ if $step >= 3 {
+ class {'::contrail::analytics':
+ alarm_gen_config => {
+ 'DEFAULTS' => {
+ 'host_ip' => $host_ip,
+ 'kafka_broker_list' => $kafka_broker_list_9092,
+ 'rabbitmq_server_list' => $rabbit_server_list_5672,
+ 'rabbitmq_user' => $rabbit_user,
+ 'rabbitmq_password' => $rabbit_password,
+ 'zk_list' => $zk_server_ip_2181,
+ },
+ 'DISCOVERY' => {
+ 'disc_server_ip' => $disc_server_ip,
+ 'disc_server_port' => $disc_server_port,
+ },
},
- },
- query_engine_config => {
- 'DEFAULTS' => {
- 'cassandra_server_list' => $cassandra_server_list,
- 'hostip' => $host_ip,
+ analytics_nodemgr_config => {
+ 'DISCOVERY' => {
+ 'server' => $disc_server_ip,
+ 'port' => $disc_server_port,
+ },
},
- 'DISCOVERY' => {
- 'port' => $disc_server_port,
- 'server' => $disc_server_ip,
+ analytics_api_config => {
+ 'DEFAULTS' => {
+ 'api_server' => "${api_server}:${api_port}",
+ 'aaa_mode' => $analytics_aaa_mode,
+ 'cassandra_server_list' => $cassandra_server_list_9042,
+ 'host_ip' => $host_ip,
+ 'http_server_port' => $http_server_port,
+ 'rest_api_ip' => $rest_api_ip,
+ 'rest_api_port' => $rest_api_port,
+ },
+ 'DISCOVERY' => {
+ 'disc_server_ip' => $disc_server_ip,
+ 'disc_server_port' => $disc_server_port,
+ },
+ 'REDIS' => {
+ 'redis_server_port' => $redis_server_port,
+ 'redis_query_port' => $redis_server_port,
+ 'server' => $redis_server,
+ },
+ 'KEYSTONE' => $keystone_config,
},
- 'REDIS' => {
- 'port' => $redis_server_port,
- 'server' => $redis_server,
+ collector_config => {
+ 'DEFAULT' => {
+ 'cassandra_server_list' => $cassandra_server_list_9042,
+ 'hostip' => $host_ip,
+ 'http_server_port' => $collector_http_server_port,
+ 'kafka_broker_list' => $kafka_broker_list_9092,
+ 'zookeeper_server_list' => $zk_server_ip_2181_comma,
+ },
+ 'COLLECTOR' => {
+ 'port' => $collector_sandesh_port,
+ },
+ 'DISCOVERY' => {
+ 'port' => $disc_server_port,
+ 'server' => $disc_server_ip,
+ },
+ 'REDIS' => {
+ 'port' => $redis_server_port,
+ 'server' => $redis_server,
+ },
},
- },
- snmp_collector_config => {
- 'DEFAULTS' => {
- 'zk_server_ip' => $zk_server_ip,
+ query_engine_config => {
+ 'DEFAULT' => {
+ 'cassandra_server_list' => $cassandra_server_list_9042,
+ 'hostip' => $host_ip,
+ },
+ 'DISCOVERY' => {
+ 'port' => $disc_server_port,
+ 'server' => $disc_server_ip,
+ },
+ 'REDIS' => {
+ 'port' => $redis_server_port,
+ 'server' => $redis_server,
+ },
},
- 'DISCOVERY' => {
- 'disc_server_ip' => $disc_server_ip,
- 'disc_server_port' => $disc_server_port,
+ snmp_collector_config => {
+ 'DEFAULTS' => {
+ 'zookeeper' => $zk_server_ip_2181_comma,
+ },
+ 'DISCOVERY' => {
+ 'disc_server_ip' => $disc_server_ip,
+ 'disc_server_port' => $disc_server_port,
+ },
},
- },
- topology_config => {
- 'DEFAULTS' => {
- 'zk_server_ip' => $zk_server_ip,
+ redis_config => $redis_config,
+ topology_config => {
+ 'DEFAULTS' => {
+ 'zookeeper' => $zk_server_ip_2181_comma,
+ },
+ 'DISCOVERY' => {
+ 'disc_server_ip' => $disc_server_ip,
+ 'disc_server_port' => $disc_server_port,
+ },
},
- 'DISCOVERY' => {
- 'disc_server_ip' => $disc_server_ip,
- 'disc_server_port' => $disc_server_port,
+ vnc_api_lib_config => $vnc_api_lib_config,
+ keystone_config => {
+ 'KEYSTONE' => $keystone_config,
},
- },
+ }
+ }
+ if $step >= 5 {
+ class {'::contrail::analytics::provision_analytics':
+ api_address => $api_server,
+ api_port => $api_port,
+ analytics_node_address => $host_ip,
+ analytics_node_name => $::fqdn,
+ keystone_admin_user => $admin_user,
+ keystone_admin_password => $admin_password,
+ keystone_admin_tenant_name => $admin_tenant_name,
+ openstack_vip => $public_vip,
+ }
}
}
diff --git a/manifests/network/contrail/analyticsdatabase.pp b/manifests/network/contrail/analyticsdatabase.pp
new file mode 100644
index 0000000..88b0327
--- /dev/null
+++ b/manifests/network/contrail/analyticsdatabase.pp
@@ -0,0 +1,202 @@
+#
+# Copyright (C) 2015 Juniper Networks
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License. You may obtain
+# a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations
+# under the License.
+#
+# == Class: tripleo::network::contrail::analyticsdatabase
+#
+# Configure Contrail Analytics Database services
+#
+# == Parameters:
+#
+# [*auth_host*]
+# (optional) IPv4 VIP of Keystone
+# String (IPv4) value
+# Defaults to hiera('contrail::auth_host')
+#
+# [*auth_port_ssl*]
+# (optional) keystone ssl port.
+# Integer value.
+# Defaults to hiera('contrail::auth_port_ssl')
+#
+# [*auth_protocol*]
+# (optional) authentication protocol.
+# String value.
+# Defaults to hiera('contrail::auth_protocol')
+#
+# [*api_server*]
+# (optional) IPv4 VIP of Contrail Config API
+# String (IPv4) value
+# Defaults to hiera('contrail_config_vip')
+#
+# [*api_port*]
+# (optional) Port of Contrail Config API
+# String value
+# Defaults to hiera('contrail::api_port')
+#
+# [*admin_password*]
+# (optional) Keystone Admin password
+# String value
+# Defaults to hiera('contrail::admin_password')
+#
+# [*admin_tenant_name*]
+# (optional) Keystone Admin tenant name
+# String value
+# Defaults to hiera('contrail::admin_tenant_name')
+#
+# [*admin_token*]
+# (optional) Keystone Admin token
+# String value
+# Defaults to hiera('contrail::admin_token')
+#
+# [*admin_user*]
+# (optional) Keystone Admin user
+# String value
+# Defaults to hiera('contrail::admin_user')
+#
+# [*ca_file*]
+# (optional) ca file name
+# String value.
+# Defaults to hiera('contrail::service_certificate',false)
+#
+# [*cert_file*]
+# (optional) cert file name
+# String value.
+# Defaults to hiera('contrail::service_certificate',false)
+#
+# [*cassandra_servers*]
+# (optional) List of analytics cassandra servers
+# List (IPv4) value
+# Defaults to hiera('contrail_analytics_database_node_ips')
+#
+# [*disc_server_ip*]
+# (optional) IPv4 VIP of Contrail Discovery
+# String (IPv4) value
+# Defaults to hiera('contrail_config_vip')
+#
+# [*disc_server_port*]
+# (optional) port Discovery server listens on.
+# Integer value.
+# Defaults to hiera('contrail::disc_server_port')
+#
+# [*host_ip*]
+# (optional) host IP address of Database node
+# String (IPv4) value.
+# Defaults to hiera('contrail::analytics::database::host_ip')
+#
+# [*host_name*]
+# (optional) host name of database node
+# String value
+# Defaults to $::hostname
+#
+# [*kafka_hostnames*]
+# (optional) list of kafka server hostnames
+# List value
+# Defaults to hiera('contrail_analytics_database_short_node_names', '')
+#
+# [*public_vip*]
+# (optional) Public VIP
+# String (IPv4) value
+# Defaults to hiera('public_virtual_ip')
+#
+# [*step*]
+# (optional) step in the stack
+# String value
+# Defaults to hiera('step')
+#
+# [*zookeeper_server_ips*]
+# (optional) list of zookeeper server IPs
+# List value
+# Defaults to hiera('contrail_database_node_ips')
+#
+class tripleo::network::contrail::analyticsdatabase(
+ $step = hiera('step'),
+ $auth_host = hiera('contrail::auth_host'),
+ $api_server = hiera('contrail_config_vip'),
+ $api_port = hiera('contrail::api_port'),
+ $admin_password = hiera('contrail::admin_password'),
+ $admin_tenant_name = hiera('contrail::admin_tenant_name'),
+ $admin_token = hiera('contrail::admin_token'),
+ $admin_user = hiera('contrail::admin_user'),
+ $auth_port_ssl = hiera('contrail::auth_port_ssl'),
+ $auth_protocol = hiera('contrail::auth_protocol'),
+ $cassandra_servers = hiera('contrail_analytics_database_node_ips'),
+ $ca_file = hiera('contrail::service_certificate',false),
+ $cert_file = hiera('contrail::service_certificate',false),
+ $disc_server_ip = hiera('contrail_config_vip'),
+ $disc_server_port = hiera('contrail::disc_server_port'),
+ $host_ip = hiera('contrail::analytics::database::host_ip'),
+ $host_name = $::hostname,
+ $kafka_hostnames = hiera('contrail_analytics_database_short_node_names', ''),
+ $public_vip = hiera('public_virtual_ip'),
+ $zookeeper_server_ips = hiera('contrail_database_node_ips'),
+)
+{
+ if $auth_protocol == 'https' {
+ $vnc_api_lib_config = {
+ 'auth' => {
+ 'AUTHN_SERVER' => $public_vip,
+ 'AUTHN_PORT' => $auth_port_ssl,
+ 'AUTHN_PROTOCOL' => $auth_protocol,
+ 'certfile' => $cert_file,
+ 'cafile' => $ca_file,
+ },
+ }
+ } else {
+ $vnc_api_lib_config = {
+ 'auth' => {
+ 'AUTHN_SERVER' => $public_vip,
+ },
+ }
+ }
+ if $step == 2 {
+ class {'::contrail::analyticsdatabase':
+ analyticsdatabase_params => {
+ 'auth_host' => $auth_host,
+ 'api_server' => $api_server,
+ 'admin_password' => $admin_password,
+ 'admin_tenant_name' => $admin_tenant_name,
+ 'admin_token' => $admin_token,
+ 'admin_user' => $admin_user,
+ 'cassandra_servers' => $cassandra_servers,
+ 'host_ip' => $host_ip,
+ 'disc_server_ip' => $disc_server_ip,
+ 'disc_server_port' => $disc_server_port,
+ 'kafka_hostnames' => $kafka_hostnames,
+ 'zookeeper_server_ips' => $zookeeper_server_ips,
+ database_nodemgr_config => {
+ 'DEFAULT' => {
+ 'hostip' => $host_ip,
+ },
+ 'DISCOVERY' => {
+ 'port' => $disc_server_port,
+ 'server' => $disc_server_ip,
+ },
+ },
+ vnc_api_lib_config => $vnc_api_lib_config,
+ }
+ }
+ }
+ if $step >= 5 {
+ class {'::contrail::database::provision_database':
+ api_address => $api_server,
+ api_port => $api_port,
+ database_node_address => $host_ip,
+ database_node_name => $host_name,
+ keystone_admin_user => $admin_user,
+ keystone_admin_password => $admin_password,
+ keystone_admin_tenant_name => $admin_tenant_name,
+ openstack_vip => $public_vip,
+ }
+ }
+}
diff --git a/manifests/network/contrail/config.pp b/manifests/network/contrail/config.pp
index 7b9c85f..d02ab44 100644
--- a/manifests/network/contrail/config.pp
+++ b/manifests/network/contrail/config.pp
@@ -19,21 +19,11 @@
#
# == Parameters:
#
-# [*ifmap_password*]
-# (required) ifmap password
-# String value.
-#
-# [*ifmap_server_ip*]
-# (required) ifmap server ip address.
-# String value.
#
-# [*ifmap_username*]
-# (required) ifmap username
+# [*aaa_mode*]
+# (optional) aaa mode parameter
# String value.
-#
-# [*rabbit_server*]
-# (required) IPv4 address of rabbit server.
-# String (IPv4) value.
+# Defaults to hiera('contrail::aaa_mode')
#
# [*admin_password*]
# (optional) admin password
@@ -55,6 +45,16 @@
# String value.
# Defaults to hiera('contrail::admin_user')
#
+# [*api_server*]
+# (optional) VIP of Config API
+# String (IPv4) value.
+# Defaults to hiera('contrail_config_vip')
+#
+# [*api_port*]
+# (optional) Port of Config API
+# String value.
+# Defaults to hiera('contrail::api_port')
+#
# [*auth*]
# (optional) Authentication method.
# Defaults to hiera('contrail::auth')
@@ -68,81 +68,232 @@
# (optional) keystone port.
# Defaults to hiera('contrail::auth_port')
#
+# [*auth_port_ssl*]
+# (optional) keystone ssl port.
+# Integer value.
+# Defaults to hiera('contrail::auth_port_ssl')
+#
# [*auth_protocol*]
# (optional) authentication protocol.
# Defaults to hiera('contrail::auth_protocol')
#
+# [*ca_file*]
+# (optional) ca file name
+# String value.
+# Defaults to hiera('contrail::service_certificate',false)
+#
+# [*cert_file*]
+# (optional) cert file name
+# String value.
+# Defaults to hiera('contrail::service_certificate',false)
+#
# [*cassandra_server_list*]
# (optional) List IPs+port of Cassandra servers
# Array of strings value.
# Defaults to hiera('contrail::cassandra_server_list')
#
+# [*config_hostnames*]
+# (optional) Config hostname list
+# Array of string value.
+# Defaults to hiera('contrail_config_short_node_names')
+#
+# [*control_server_list*]
+# (optional) IPv4 addresses of control server.
+# Array of string (IPv4) value.
+# Defaults to hiera('contrail_control_node_ips')
+#
# [*disc_server_ip*]
# (optional) IPv4 address of discovery server.
# String (IPv4) value.
-# Defaults to hiera('contrail::disc_server_ip')
+# Defaults to hiera('contrail_config_vip'),
+#
+# [*disc_server_port*]
+# (optional) port of discovery server
+# String value.
+# Defaults to hiera('contrail::disc_server_port')
+#
+# [*host_ip*]
+# (optional) IPv4 address of Config server
+# String (IPv4) value.
+# Defaults to hiera('contrail::config::host_ip')
+#
+# [*ifmap_password*]
+# (optional) ifmap password
+# String value.
+# Defaults to hiera('contrail::config::ifmap_password')
+#
+# [*ifmap_server_ip*]
+# (optional) ifmap server ip address.
+# String value.
+# Defaults to hiera('contrail::config::host_ip')
+#
+# [*ifmap_username*]
+# (optional) ifmap username
+# String value.
+# Defaults to hiera('contrail::config::ifmap_password')
#
# [*insecure*]
# (optional) insecure mode.
# Defaults to hiera('contrail::insecure')
#
+# [*ipfabric_service_port*]
+# (optional) linklocal ip fabric port
+# String value
+# Defaults to 8775
+#
# [*listen_ip_address*]
# (optional) IP address to listen on.
# String (IPv4) value.
-# Defaults to '0.0.0.0'
+# Defaults to hiera('contrail::config::listen_ip_address')
#
# [*listen_port*]
# (optional) Listen port for config-api
-# Defaults to 8082
+# Defaults to hiera('contrail::api_port')
+#
+# [*linklocal_service_name*]
+# (optional) name of link local service
+# String value
+# Defaults to metadata
+#
+# [*linklocal_service_port*]
+# (optional) port of link local service
+# String value
+# Defaults to 80
+#
+# [*linklocal_service_name*]
+# (optional) name of link local service
+# String value
+# Defaults to metadata
+#
+# [*linklocal_service_ip*]
+# (optional) IPv4 address of link local service
+# String (IPv4) value
+# Defaults to 169.254.169.254
#
# [*memcached_servers*]
# (optional) IPv4 address of memcached servers
# String (IPv4) value + port
# Defaults to hiera('contrail::memcached_server')
#
-# [*multi_tenancy*]
-# (optional) Defines if mutli-tenancy is enabled.
-# Defaults to hiera('contrail::multi_tenancy')
+# [*public_vip*]
+# (optional) Public virtual ip
+# String value.
+# Defaults to hiera('public_virtual_ip')
+#
+# [*step*]
+# (optional) Step stack is in
+# Integer value.
+# Defaults to hiera('step')
+#
+# [*rabbit_server*]
+# (optional) rabbit server
+# Array of string value.
+# Defaults to hiera('rabbitmq_node_ips')
+#
+# [*rabbit_user*]
+# (optional) rabbit user
+# String value.
+# Defaults to hiera('contrail::rabbit_user')
+#
+# [*rabbit_password*]
+# (optional) rabbit password
+# String value.
+# Defaults to hiera('contrail::rabbit_password')
+#
+# [*rabbit_port*]
+# (optional) rabbit server port
+# String value.
+# Defaults to hiera('contrail::rabbit_port')
#
# [*redis_server*]
# (optional) IPv4 address of redis server.
# String (IPv4) value.
-# Defaults to '127.0.0.1'
+# Defaults to hiera('contrail::config::redis_server')
#
# [*zk_server_ip*]
# (optional) List IPs+port of Zookeeper servers
# Array of strings value.
-# Defaults to hiera('contrail::zk_server_ip')
+# Defaults to hiera('contrail_database_node_ips')
#
class tripleo::network::contrail::config(
- $ifmap_password,
- $ifmap_server_ip,
- $ifmap_username,
- $rabbit_server,
- $admin_password = hiera('contrail::admin_password'),
- $admin_tenant_name = hiera('contrail::admin_tenant_name'),
- $admin_token = hiera('contrail::admin_token'),
- $admin_user = hiera('contrail::admin_user'),
- $auth = hiera('contrail::auth'),
- $auth_host = hiera('contrail::auth_host'),
- $auth_port = hiera('contrail::auth_port'),
- $auth_protocol = hiera('contrail::auth_protocol'),
- $cassandra_server_list = hiera('contrail::cassandra_server_list'),
- $disc_server_ip = hiera('contrail::disc_server_ip'),
- $insecure = hiera('contrail::insecure'),
- $listen_ip_address = '0.0.0.0',
- $listen_port = 8082,
- $memcached_servers = hiera('contrail::memcached_server'),
- $multi_tenancy = hiera('contrail::multi_tenancy'),
- $redis_server = '127.0.0.1',
- $zk_server_ip = hiera('contrail::zk_server_ip'),
+ $step = hiera('step'),
+ $aaa_mode = hiera('contrail::aaa_mode'),
+ $admin_password = hiera('contrail::admin_password'),
+ $admin_tenant_name = hiera('contrail::admin_tenant_name'),
+ $admin_token = hiera('contrail::admin_token'),
+ $admin_user = hiera('contrail::admin_user'),
+ $api_server = hiera('contrail_config_vip'),
+ $api_port = hiera('contrail::api_port'),
+ $auth = hiera('contrail::auth'),
+ $auth_host = hiera('contrail::auth_host'),
+ $auth_port = hiera('contrail::auth_port'),
+ $auth_port_ssl = hiera('contrail::auth_port_ssl'),
+ $auth_protocol = hiera('contrail::auth_protocol'),
+ $cassandra_server_list = hiera('contrail_database_node_ips'),
+ $ca_file = hiera('contrail::service_certificate',false),
+ $cert_file = hiera('contrail::service_certificate',false),
+ $config_hostnames = hiera('contrail_config_short_node_names'),
+ $control_server_list = hiera('contrail_control_node_ips'),
+ $disc_server_ip = hiera('contrail_config_vip'),
+ $disc_server_port = hiera('contrail::disc_server_port'),
+ $host_ip = hiera('contrail::config::host_ip'),
+ $ifmap_password = hiera('contrail::config::ifmap_password'),
+ $ifmap_server_ip = hiera('contrail::config::host_ip'),
+ $ifmap_username = hiera('contrail::config::ifmap_username'),
+ $insecure = hiera('contrail::insecure'),
+ $ipfabric_service_port = 8775,
+ $listen_ip_address = hiera('contrail::config::listen_ip_address'),
+ $listen_port = hiera('contrail::api_port'),
+ $linklocal_service_port = 80,
+ $linklocal_service_name = 'metadata',
+ $linklocal_service_ip = '169.254.169.254',
+ $memcached_servers = hiera('contrail::memcached_server'),
+ $public_vip = hiera('public_virtual_ip'),
+ $rabbit_server = hiera('rabbitmq_node_ips'),
+ $rabbit_user = hiera('contrail::rabbit_user'),
+ $rabbit_password = hiera('contrail::rabbit_password'),
+ $rabbit_port = hiera('contrail::rabbit_port'),
+ $redis_server = hiera('contrail::config::redis_server'),
+ $zk_server_ip = hiera('contrail_database_node_ips'),
)
{
validate_ip_address($listen_ip_address)
validate_ip_address($disc_server_ip)
validate_ip_address($ifmap_server_ip)
- class {'::contrail::keystone':
- keystone_config => {
+ $basicauthusers_property_control = map($control_server_list) |$item| { "${item}.control:${item}.control" }
+ $basicauthusers_property_dns = $control_server_list.map |$item| { "${item}.dns:${item}.dns" }
+ $basicauthusers_property = concat($basicauthusers_property_control, $basicauthusers_property_dns)
+ $cassandra_server_list_9160 = join([join($cassandra_server_list, ':9160 '),':9160'],'')
+ $rabbit_server_list_5672 = join([join($rabbit_server, ':5672,'),':5672'],'')
+ $zk_server_ip_2181 = join([join($zk_server_ip, ':2181,'),':2181'],'')
+
+ if $auth_protocol == 'https' {
+ $keystone_config = {
+ 'KEYSTONE' => {
+ 'admin_password' => $admin_password,
+ 'admin_tenant_name' => $admin_tenant_name,
+ 'admin_token' => $admin_token,
+ 'admin_user' => $admin_user,
+ 'auth_host' => $auth_host,
+ 'auth_port' => $auth_port_ssl,
+ 'auth_protocol' => $auth_protocol,
+ 'insecure' => $insecure,
+ 'memcached_servers' => $memcached_servers,
+ 'certfile' => $cert_file,
+ 'cafile' => $ca_file,
+ },
+ }
+ $vnc_api_lib_config = {
+ 'auth' => {
+ 'AUTHN_SERVER' => $public_vip,
+ 'AUTHN_PORT' => $auth_port_ssl,
+ 'AUTHN_PROTOCOL' => $auth_protocol,
+ 'certfile' => $cert_file,
+ 'cafile' => $ca_file,
+ },
+ }
+ } else {
+ $keystone_config = {
'KEYSTONE' => {
'admin_password' => $admin_password,
'admin_tenant_name' => $admin_tenant_name,
@@ -154,62 +305,116 @@ class tripleo::network::contrail::config(
'insecure' => $insecure,
'memcached_servers' => $memcached_servers,
},
- },
- } ->
- class {'::contrail::config':
- api_config => {
- 'DEFAULTS' => {
- 'auth' => $auth,
- 'cassandra_server_list' => $cassandra_server_list,
- 'disc_server_ip' => $disc_server_ip,
- 'ifmap_password' => $ifmap_password,
- 'ifmap_server_ip' => $ifmap_server_ip,
- 'ifmap_username' => $ifmap_username,
- 'listen_ip_addr' => $listen_ip_address,
- 'listen_port' => $listen_port,
- 'multi_tenancy' => $multi_tenancy,
- 'rabbit_server' => $rabbit_server,
- 'redis_server' => $redis_server,
- 'zk_server_ip' => $zk_server_ip,
+ }
+ $vnc_api_lib_config = {
+ 'auth' => {
+ 'AUTHN_SERVER' => $public_vip,
},
- },
- device_manager_config => {
- 'DEFAULTS' => {
- 'cassandra_server_list' => $cassandra_server_list,
- 'disc_server_ip' => $disc_server_ip,
- 'rabbit_server' => $rabbit_server,
- 'redis_server' => $redis_server,
- 'zk_server_ip' => $zk_server_ip,
+ }
+ }
+ if $step >= 3 {
+ class {'::contrail::config':
+ api_config => {
+ 'DEFAULTS' => {
+ 'aaa_mode' => $aaa_mode,
+ 'auth' => $auth,
+ 'cassandra_server_list' => $cassandra_server_list_9160,
+ 'disc_server_ip' => $disc_server_ip,
+ 'ifmap_password' => $ifmap_password,
+ 'ifmap_server_ip' => $ifmap_server_ip,
+ 'ifmap_username' => $ifmap_username,
+ 'listen_ip_addr' => $listen_ip_address,
+ 'listen_port' => $listen_port,
+ 'rabbit_server' => $rabbit_server_list_5672,
+ 'rabbit_user' => $rabbit_user,
+ 'rabbit_password' => $rabbit_password,
+ 'redis_server' => $redis_server,
+ 'zk_server_ip' => $zk_server_ip_2181,
+ },
},
- },
- schema_config => {
- 'DEFAULTS' => {
- 'cassandra_server_list' => $cassandra_server_list,
- 'disc_server_ip' => $disc_server_ip,
- 'ifmap_password' => $ifmap_password,
- 'ifmap_server_ip' => $ifmap_server_ip,
- 'ifmap_username' => $ifmap_username,
- 'rabbit_server' => $rabbit_server,
- 'redis_server' => $redis_server,
- 'zk_server_ip' => $zk_server_ip,
+ basicauthusers_property => $basicauthusers_property,
+ config_nodemgr_config => {
+ 'DISCOVERY' => {
+ 'server' => $disc_server_ip,
+ 'port' => $disc_server_port,
+ },
},
- },
- discovery_config => {
- 'DEFAULTS' => {
- 'cassandra_server_list' => $cassandra_server_list,
- 'zk_server_ip' => $zk_server_ip,
+ device_manager_config => {
+ 'DEFAULTS' => {
+ 'cassandra_server_list' => $cassandra_server_list_9160,
+ 'disc_server_ip' => $disc_server_ip,
+ 'disc_server_port' => $disc_server_port,
+ 'rabbit_server' => $rabbit_server_list_5672,
+ 'rabbit_user' => $rabbit_user,
+ 'rabbit_password' => $rabbit_password,
+ 'redis_server' => $redis_server,
+ 'zk_server_ip' => $zk_server_ip_2181,
+ },
},
- },
- svc_monitor_config => {
- 'DEFAULTS' => {
- 'cassandra_server_list' => $cassandra_server_list,
- 'disc_server_ip' => $disc_server_ip,
- 'ifmap_password' => $ifmap_password,
- 'ifmap_server_ip' => $ifmap_server_ip,
- 'ifmap_username' => $ifmap_username,
- 'rabbit_server' => $rabbit_server,
- 'redis_server' => $redis_server,
+ discovery_config => {
+ 'DEFAULTS' => {
+ 'cassandra_server_list' => $cassandra_server_list_9160,
+ 'zk_server_ip' => $zk_server_ip_2181,
+ },
},
- },
+ keystone_config => $keystone_config,
+ schema_config => {
+ 'DEFAULTS' => {
+ 'cassandra_server_list' => $cassandra_server_list_9160,
+ 'disc_server_ip' => $disc_server_ip,
+ 'disc_server_port' => $disc_server_port,
+ 'ifmap_password' => $ifmap_password,
+ 'ifmap_server_ip' => $ifmap_server_ip,
+ 'ifmap_username' => $ifmap_username,
+ 'rabbit_server' => $rabbit_server_list_5672,
+ 'rabbit_user' => $rabbit_user,
+ 'rabbit_password' => $rabbit_password,
+ 'redis_server' => $redis_server,
+ 'zk_server_ip' => $zk_server_ip_2181,
+ },
+ },
+ svc_monitor_config => {
+ 'DEFAULTS' => {
+ 'cassandra_server_list' => $cassandra_server_list_9160,
+ 'disc_server_ip' => $disc_server_ip,
+ 'disc_server_port' => $disc_server_port,
+ 'ifmap_password' => $ifmap_password,
+ 'ifmap_server_ip' => $ifmap_server_ip,
+ 'ifmap_username' => $ifmap_username,
+ 'rabbit_server' => $rabbit_server_list_5672,
+ 'rabbit_user' => $rabbit_user,
+ 'rabbit_password' => $rabbit_password,
+ 'redis_server' => $redis_server,
+ 'zk_server_ip' => $zk_server_ip_2181,
+ },
+ },
+ vnc_api_lib_config => $vnc_api_lib_config,
+ }
+ }
+ if $step >= 5 {
+ class {'::contrail::config::provision_config':
+ api_address => $api_server,
+ api_port => $api_port,
+ config_node_address => $host_ip,
+ config_node_name => $::hostname,
+ keystone_admin_user => $admin_user,
+ keystone_admin_password => $admin_password,
+ keystone_admin_tenant_name => $admin_tenant_name,
+ openstack_vip => $public_vip,
+ }
+ if $config_hostnames[0] == $::hostname {
+ class {'::contrail::config::provision_linklocal':
+ api_address => $api_server,
+ api_port => $api_port,
+ ipfabric_service_ip => $api_server,
+ ipfabric_service_port => $ipfabric_service_port,
+ keystone_admin_user => $admin_user,
+ keystone_admin_password => $admin_password,
+ keystone_admin_tenant_name => $admin_tenant_name,
+ linklocal_service_name => $linklocal_service_name,
+ linklocal_service_ip => $linklocal_service_ip,
+ linklocal_service_port => $linklocal_service_port,
+ }
+ }
}
}
diff --git a/manifests/network/contrail/control.pp b/manifests/network/contrail/control.pp
index 2e50108..e9c7a9e 100644
--- a/manifests/network/contrail/control.pp
+++ b/manifests/network/contrail/control.pp
@@ -19,19 +19,6 @@
#
# == Parameters:
#
-# [*host_ip*]
-# (required) host IP address of Control
-# String (IPv4) value.
-#
-# [*ifmap_password*]
-# (required) ifmap password
-# String value.
-#
-# [*ifmap_username*]
-# (optional) ifmap username
-# String value.
-# Defaults to hiera('contrail::ifmap_username'),
-#
# [*admin_password*]
# (optional) admin password
# String value.
@@ -42,16 +29,21 @@
# String value.
# Defaults to hiera('contrail::admin_tenant_name'),
#
-# [*admin_token*]
-# (optional) admin token
-# String value.
-# Defaults to hiera('contrail::admin_token'),
-#
# [*admin_user*]
# (optional) admin user name.
# String value.
# Defaults to hiera('contrail::admin_user'),
#
+# [*api_server*]
+# (optional) IP address of api server
+# String value.
+# Defaults to hiera('contrail_config_vip')
+#
+# [*api_port*]
+# (optional) port of api server
+# String value.
+# Defaults to hiera('contrail::api_port')
+#
# [*auth_host*]
# (optional) keystone server ip address
# String (IPv4) value.
@@ -68,13 +60,33 @@
# [*disc_server_ip*]
# (optional) IPv4 address of discovery server.
# String (IPv4) value.
-# Defaults to hiera('contrail::disc_server_ip'),
+# Defaults to hiera('contrail_config_vip')
#
# [*disc_server_port*]
# (optional) port Discovery server listens on.
# Integer value.
# Defaults to hiera('contrail::disc_server_port'),
#
+# [*host_ip*]
+# (optional) IP address of host
+# String (IPv4) value.
+# Defaults to hiera('contrail::control::host_ip')
+#
+# [*ibgp_auto_mesh*]
+# (optional) iBPG auto mesh
+# String value.
+# Defaults to true
+#
+# [*ifmap_password*]
+# (optional) ifmap password
+# String value.
+# Defaults to hiera('contrail::ifmap_password'),
+#
+# [*ifmap_username*]
+# (optional) ifmap username
+# String value.
+# Defaults to hiera('contrail::ifmap_username'),
+#
# [*insecure*]
# (optional) insecure mode.
# Defaults to hiera('contrail::insecure'),
@@ -84,70 +96,103 @@
# String (IPv4) value + port
# Defaults to hiera('contrail::memcached_servers'),
#
+# [*public_vip*]
+# (optional) Public Virtual IP address
+# String (IPv4) value
+# Defaults to hiera('public_virtual_ip')
+#
+# [*router_asn*]
+# (optional) Autonomus System Number
+# String value
+# Defaults to hiera('contrail::control::asn')
+#
+# [*secret*]
+# (optional) RNDC secret for named
+# String value
+# Defaults to hiera('contrail::control::rndc_secret')
+#
+# [*step*]
+# (optional) Step stack is in
+# Integer value.
+# Defaults to hiera('step')
+#
class tripleo::network::contrail::control(
- $host_ip,
- $ifmap_password,
- $ifmap_username,
- $admin_password = hiera('contrail::admin_password'),
+ $step = hiera('step'),
+ $admin_password = hiera('contrail::admin_password'),
$admin_tenant_name = hiera('contrail::admin_tenant_name'),
- $admin_token = hiera('contrail::admin_token'),
- $admin_user = hiera('contrail::admin_user'),
- $auth_host = hiera('contrail::auth_host'),
- $auth_port = hiera('contrail::auth_port'),
- $auth_protocol = hiera('contrail::auth_protocol'),
- $disc_server_ip = hiera('contrail::disc_server_ip'),
- $disc_server_port = hiera('contrail::disc_server_port'),
- $insecure = hiera('contrail::insecure'),
+ $admin_user = hiera('contrail::admin_user'),
+ $api_server = hiera('contrail_config_vip'),
+ $api_port = hiera('contrail::api_port'),
+ $auth_host = hiera('contrail::auth_host'),
+ $auth_port = hiera('contrail::auth_port'),
+ $auth_protocol = hiera('contrail::auth_protocol'),
+ $disc_server_ip = hiera('contrail_config_vip'),
+ $disc_server_port = hiera('contrail::disc_server_port'),
+ $host_ip = hiera('contrail::control::host_ip'),
+ $ibgp_auto_mesh = true,
+ $ifmap_password = hiera('contrail::control::host_ip'),
+ $ifmap_username = hiera('contrail::control::host_ip'),
+ $insecure = hiera('contrail::insecure'),
$memcached_servers = hiera('contrail::memcached_server'),
+ $public_vip = hiera('public_virtual_ip'),
+ $router_asn = hiera('contrail::control::asn'),
+ $secret = hiera('contrail::control::rndc_secret'),
)
{
- class {'::contrail::keystone':
- keystone_config => {
- 'KEYSTONE' => {
- 'admin_tenant_name' => $admin_tenant_name,
- 'admin_token' => $admin_token,
- 'admin_password' => $admin_password,
- 'admin_user' => $admin_user,
- 'auth_host' => $auth_host,
- 'auth_port' => $auth_port,
- 'auth_protocol' => $auth_protocol,
- 'insecure' => $insecure,
- 'memcached_servers' => $memcached_servers,
+ $control_ifmap_user = "${ifmap_username}.control"
+ $control_ifmap_password = "${ifmap_username}.control"
+ $dns_ifmap_user = "${ifmap_username}.dns"
+ $dns_ifmap_password = "${ifmap_username}.dns"
+
+ if $step >= 3 {
+ class {'::contrail::control':
+ secret => $secret,
+ control_config => {
+ 'DEFAULT' => {
+ 'hostip' => $host_ip,
+ },
+ 'DISCOVERY' => {
+ 'port' => $disc_server_port,
+ 'server' => $disc_server_ip,
+ },
+ 'IFMAP' => {
+ 'password' => $control_ifmap_user,
+ 'user' => $control_ifmap_password,
+ },
},
- },
- } ->
- class {'::contrail::control':
- control_config => {
- 'DEFAULTS' => {
- 'hostip' => $host_ip,
+ dns_config => {
+ 'DEFAULT' => {
+ 'hostip' => $host_ip,
+ 'rndc_secret' => $secret,
+ },
+ 'DISCOVERY' => {
+ 'port' => $disc_server_port,
+ 'server' => $disc_server_ip,
+ },
+ 'IFMAP' => {
+ 'password' => $dns_ifmap_user,
+ 'user' => $dns_ifmap_password,
+ }
},
- 'DISCOVERY' => {
- 'port' => $disc_server_port,
- 'server' => $disc_server_ip,
+ control_nodemgr_config => {
+ 'DISCOVERY' => {
+ 'port' => $disc_server_port,
+ 'server' => $disc_server_ip,
+ },
},
- 'IFMAP' => {
- 'password' => $ifmap_password,
- 'user' => $ifmap_username,
- },
- },
- dns_config => {
- 'DEFAULTS' => {
- 'hostip' => $host_ip,
- },
- 'DISCOVERY' => {
- 'port' => $disc_server_port,
- 'server' => $disc_server_ip,
- },
- 'IFMAP' => {
- 'password' => $ifmap_password,
- 'user' => $ifmap_username,
- }
- },
- control_nodemgr_config => {
- 'DISCOVERY' => {
- 'port' => $disc_server_port,
- 'server' => $disc_server_ip,
- },
- },
+ }
+ }
+ if $step >= 5 {
+ class {'::contrail::control::provision_control':
+ api_address => $api_server,
+ api_port => $api_port,
+ control_node_address => $host_ip,
+ control_node_name => $::hostname,
+ ibgp_auto_mesh => $ibgp_auto_mesh,
+ keystone_admin_user => $admin_user,
+ keystone_admin_password => $admin_password,
+ keystone_admin_tenant_name => $admin_tenant_name,
+ router_asn => $router_asn,
+ }
}
}
diff --git a/manifests/network/contrail/database.pp b/manifests/network/contrail/database.pp
index 58f2670..f74eb1c 100644
--- a/manifests/network/contrail/database.pp
+++ b/manifests/network/contrail/database.pp
@@ -13,41 +13,154 @@
# License for the specific language governing permissions and limitations
# under the License.
#
-# == Class: tripleo::network::contrail::control
+# == Class: tripleo::network::contrail::database
#
-# Configure Contrail Control services
+# Configure Contrail Database services
#
# == Parameters:
#
-# [*host_ip*]
-# (required) host IP address of Database node
+# [*admin_password*]
+# (optional) admin password
+# String value.
+# Defaults to hiera('contrail::admin_password')
+#
+# [*admin_tenant_name*]
+# (optional) admin tenant name.
+# String value.
+# Defaults to hiera('contrail::admin_tenant_name')
+#
+# [*admin_token*]
+# (optional) admin token
+# String value.
+# Defaults to hiera('contrail::admin_token')
+#
+# [*admin_user*]
+# (optional) admin user name.
+# String value.
+# Defaults to hiera('contrail::admin_user')
+#
+# [*api_port*]
+# (optional) Port of Config API
+# String value.
+# Defaults to hiera('contrail::api_port')
+#
+# [*api_server*]
+# (optional) VIP of Config API
+# String (IPv4) value.
+# Defaults to hiera('contrail_config_vip')
+#
+# [*auth_host*]
+# (optional) keystone server ip address
# String (IPv4) value.
+# Defaults to hiera('contrail::auth_host')
+#
+# [*cassandra_servers*]
+# (optional) List IPs+port of Cassandra servers
+# Array of strings value.
+# Defaults to hiera('contrail_database_node_ips')
#
# [*disc_server_ip*]
# (optional) IPv4 address of discovery server.
# String (IPv4) value.
-# Defaults to hiera('contrail::disc_server_ip')
+# Defaults to hiera('contrail_config_vip'),
#
# [*disc_server_port*]
# (optional) port Discovery server listens on.
# Integer value.
# Defaults to hiera('contrail::disc_server_port')
#
+# [*host_ip*]
+# (required) host IP address of Database node
+# String (IPv4) value.
+#
+# [*host_name*]
+# (optional) host name of Database node
+# String value.
+# Defaults to $::hostname
+#
+# [*public_vip*]
+# (optional) Public virtual ip
+# String value.
+# Defaults to hiera('public_virtual_ip')
+#
+# [*step*]
+# (optional) Step stack is in
+# Integer value.
+# Defaults to hiera('step')
+#
+# [*zookeeper_client_ip*]
+# (optional) Zookeeper listen address
+# String (IPv4) value.
+# Defaults to hiera('contrail::database::host_ip')
+#
+# [*zookeeper_hostnames*]
+# (optional) Zookeeper hostname list
+# Array of string value.
+# Defaults to hiera('contrail_database_short_node_names')
+#
+# [*zookeeper_server_ips*]
+# (optional) Zookeeper ip list
+# Array of string (IPv4) values
+# Defaults to hiera('contrail_database_node_ips')
+#
class tripleo::network::contrail::database(
- $host_ip,
- $disc_server_ip = hiera('contrail::disc_server_ip'),
- $disc_server_port = hiera('contrail::disc_server_port'),
+ $admin_password = hiera('contrail::admin_password'),
+ $admin_tenant_name = hiera('contrail::admin_tenant_name'),
+ $admin_token = hiera('contrail::admin_token'),
+ $admin_user = hiera('contrail::admin_user'),
+ $api_port = hiera('contrail::api_port'),
+ $api_server = hiera('contrail_config_vip'),
+ $auth_host = hiera('contrail::auth_host'),
+ $cassandra_servers = hiera('contrail_database_node_ips'),
+ $disc_server_ip = hiera('contrail_config_vip'),
+ $disc_server_port = hiera('contrail::disc_server_port'),
+ $host_ip = hiera('contrail::database::host_ip'),
+ $host_name = $::hostname,
+ $public_vip = hiera('public_virtual_ip'),
+ $step = hiera('step'),
+ $zookeeper_client_ip = hiera('contrail::database::host_ip'),
+ $zookeeper_hostnames = hiera('contrail_database_short_node_names'),
+ $zookeeper_server_ips = hiera('contrail_database_node_ips'),
)
{
- class {'::contrail::database':
- database_nodemgr_config => {
- 'DEFAULTS' => {
- 'hostip' => $host_ip,
- },
- 'DISCOVERY' => {
- 'port' => $disc_server_port,
- 'server' => $disc_server_ip,
- },
- },
+ if $step == 2 {
+ class {'::contrail::database':
+ database_params => {
+ 'auth_host' => $auth_host,
+ 'api_server' => $api_server,
+ 'admin_password' => $admin_password,
+ 'admin_tenant_name' => $admin_tenant_name,
+ 'admin_token' => $admin_token,
+ 'admin_user' => $admin_user,
+ 'cassandra_servers' => $cassandra_servers,
+ 'host_ip' => $host_ip,
+ 'disc_server_ip' => $disc_server_ip,
+ 'disc_server_port' => $disc_server_port,
+ 'zookeeper_client_ip' => $zookeeper_client_ip,
+ 'zookeeper_hostnames' => $zookeeper_hostnames,
+ 'zookeeper_server_ips' => $zookeeper_server_ips,
+ database_nodemgr_config => {
+ 'DEFAULT' => {
+ 'hostip' => $host_ip,
+ },
+ 'DISCOVERY' => {
+ 'port' => $disc_server_port,
+ 'server' => $disc_server_ip,
+ },
+ },
+ }
+ }
+ }
+ if $step >= 5 {
+ class {'::contrail::database::provision_database':
+ api_address => $api_server,
+ api_port => $api_port,
+ database_node_address => $host_ip,
+ database_node_name => $host_name,
+ keystone_admin_user => $admin_user,
+ keystone_admin_password => $admin_password,
+ keystone_admin_tenant_name => $admin_tenant_name,
+ openstack_vip => $public_vip,
+ }
}
}
diff --git a/manifests/network/contrail/heat.pp b/manifests/network/contrail/heat.pp
new file mode 100644
index 0000000..637fdda
--- /dev/null
+++ b/manifests/network/contrail/heat.pp
@@ -0,0 +1,80 @@
+#
+# Copyright (C) 2015 Juniper Networks
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License. You may obtain
+# a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations
+# under the License.
+#
+# == Class: tripleo::network::contrail::heat
+#
+# Configure Contrail Heat plugin
+#
+# == Parameters:
+#
+# [*admin_password*]
+# (optional) admin password
+# String value.
+# Defaults to hiera('contrail::admin_password')
+#
+# [*admin_user*]
+# (optional) admin user name.
+# String value.
+# Defaults to hiera('contrail::admin_user')
+#
+# [*api_port*]
+# (optional) port of api server
+# String value.
+# Defaults to hiera('contrail::api_port')
+#
+# [*api_server*]
+# (optional) IP address of api server
+# String value.
+# Defaults to hiera('contrail_config_vip')
+#
+# [*auth_host*]
+# (optional) keystone server ip address
+# String (IPv4) value.
+# Defaults to hiera('contrail::auth_host')
+#
+# [*step*]
+# (optional) Step stack is in
+# Integer value.
+# Defaults to hiera('step')
+#
+# [*use_ssl*]
+# (optional) switch for ssl usage
+# String value.
+# Defaults to 'False'
+#
+class tripleo::network::contrail::heat(
+ $admin_password = hiera('contrail::admin_password'),
+ $admin_user = hiera('contrail::admin_user'),
+ $api_port = 8082,
+ $api_server = hiera('contrail_config_vip'),
+ $auth_host = hiera('contrail::auth_host'),
+ $step = hiera('step'),
+ $use_ssl = 'False',
+)
+{
+ class {'::contrail::heat':
+ heat_config => {
+ 'clients_contrail' => {
+ 'api_base_url' => '/',
+ 'api_server' => $api_server,
+ 'api_port' => $api_port,
+ 'auth_host_ip' => $auth_host,
+ 'user' => $admin_user,
+ 'password' => $admin_password,
+ 'use_ssl' => $use_ssl,
+ },
+ },
+ }
+}
diff --git a/manifests/network/contrail/neutron_plugin.pp b/manifests/network/contrail/neutron_plugin.pp
new file mode 100644
index 0000000..d9aa587
--- /dev/null
+++ b/manifests/network/contrail/neutron_plugin.pp
@@ -0,0 +1,203 @@
+# This class installs and configures Opencontrail Neutron Plugin.
+#
+# === Parameters
+#
+# [*admin_password*]
+# (optional) admin password
+# String value.
+# Defaults to hiera('contrail::admin_password')
+#
+# [*admin_tenant_name*]
+# (optional) admin tenant name.
+# String value.
+# Defaults to hiera('contrail::admin_tenant_name')
+#
+# [*admin_token*]
+# (optional) admin token
+# String value.
+# Defaults to hiera('contrail::admin_token')
+#
+# [*admin_user*]
+# (optional) admin user name.
+# String value.
+# Defaults to hiera('contrail::admin_user')
+#
+# [*api_port*]
+# (optional) port of api server
+# String value.
+# Defaults to hiera('contrail::api_port')
+#
+# [*api_server*]
+# (optional) IP address of api server
+# String value.
+# Defaults to hiera('contrail_config_vip')
+#
+# [*auth_host*]
+# (optional) keystone server ip address
+# String (IPv4) value.
+# Defaults to hiera('contrail::auth_host')
+#
+# [*auth_port*]
+# (optional) keystone port.
+# Integer value.
+# Defaults to hiera('contrail::auth_port')
+#
+# [*auth_port_ssl*]
+# (optional) keystone ssl port.
+# Integer value.
+# Defaults to hiera('contrail::auth_port_ssl')
+#
+# [*auth_protocol*]
+# (optional) authentication protocol.
+# String value.
+# Defaults to hiera('contrail::auth_protocol')
+#
+# [*ca_file*]
+# (optional) ca file name
+# String value.
+# Defaults to hiera('contrail::service_certificate',false)
+#
+# [*cert_file*]
+# (optional) cert file name
+# String value.
+# Defaults to hiera('contrail::service_certificate',false)
+#
+# [*contrail_extensions*]
+# Array of OpenContrail extensions to be supported
+# Defaults to $::os_service_default
+# Example:
+#
+# class {'neutron::plugins::opencontrail' :
+# contrail_extensions => ['ipam:neutron_plugin_contrail.plugins.opencontrail.contrail_plugin_ipam.NeutronPluginContrailIpam']
+# }
+#
+# [*package_ensure*]
+# (optional) Ensure state for package.
+# Defaults to 'present'.
+#
+# [*purge_config*]
+# (optional) Whether to set only the specified config options
+# in the opencontrail config.
+# Defaults to false.
+#
+class tripleo::network::contrail::neutron_plugin (
+ $admin_password = hiera('contrail::admin_password'),
+ $admin_tenant_name = hiera('contrail::admin_tenant_name'),
+ $admin_token = hiera('contrail::admin_token'),
+ $admin_user = hiera('contrail::admin_user'),
+ $api_port = hiera('contrail::api_port'),
+ $api_server = hiera('contrail_config_vip'),
+ $auth_host = hiera('contrail::auth_host'),
+ $auth_port = hiera('contrail::auth_port'),
+ $auth_port_ssl = hiera('contrail::auth_port_ssl'),
+ $auth_protocol = hiera('contrail::auth_protocol'),
+ $ca_file = hiera('tripleo::haproxy::service_certificate',false),
+ $cert_file = hiera('tripleo::haproxy::service_certificate',false),
+ $contrail_extensions = hiera('contrail::vrouter::contrail_extensions'),
+ $package_ensure = 'present',
+ $purge_config = false,
+) {
+
+ include ::neutron::deps
+ include ::neutron::params
+
+ validate_array($contrail_extensions)
+
+ package { 'neutron-plugin-contrail':
+ ensure => $package_ensure,
+ name => $::neutron::params::opencontrail_plugin_package,
+ tag => ['neutron-package', 'openstack'],
+ }
+ package {'python-contrail':
+ ensure => installed,
+ }
+
+ ensure_resource('file', '/etc/neutron/plugins/opencontrail', {
+ ensure => directory,
+ owner => 'root',
+ group => 'neutron',
+ mode => '0640'}
+ )
+
+ if $::osfamily == 'Debian' {
+ file_line { '/etc/default/neutron-server:NEUTRON_PLUGIN_CONFIG':
+ path => '/etc/default/neutron-server',
+ match => '^NEUTRON_PLUGIN_CONFIG=(.*)$',
+ line => "NEUTRON_PLUGIN_CONFIG=${::neutron::params::opencontrail_config_file}",
+ tag => 'neutron-file-line',
+ }
+ }
+
+ if $::osfamily == 'Redhat' {
+ file { '/etc/neutron/plugin.ini':
+ ensure => link,
+ target => $::neutron::params::opencontrail_config_file,
+ require => Package[$::neutron::params::opencontrail_plugin_package],
+ tag => 'neutron-config-file',
+ }
+ $api_paste_config_file = '/usr/share/neutron/api-paste.ini'
+ }
+ ini_setting { 'filter:user_token':
+ ensure => present,
+ path => $api_paste_config_file,
+ section => 'filter:user_token',
+ setting => 'paste.filter_factory',
+ value => 'neutron_plugin_contrail.plugins.opencontrail.neutron_middleware:token_factory',
+ }
+ ini_setting { 'composite:neutronapi_v2_0':
+ ensure => present,
+ path => $api_paste_config_file,
+ section => 'composite:neutronapi_v2_0',
+ setting => 'keystone',
+ value => 'user_token cors http_proxy_to_wsgi request_id catch_errors authtoken keystonecontext extensions neutronapiapp_v2_0',
+ }
+ resources { 'neutron_plugin_opencontrail':
+ purge => $purge_config,
+ }
+
+ exec { 'add neutron user to haproxy group':
+ command => '/usr/sbin/usermod -a -G haproxy neutron',
+ }
+
+ if $auth_protocol == 'https' {
+ $auth_url = join([$auth_protocol,'://',$auth_host,':',$auth_port_ssl,'/v2.0'])
+ neutron_plugin_opencontrail {
+ 'APISERVER/api_server_ip': value => $api_server;
+ 'APISERVER/api_server_port': value => $api_port;
+ 'APISERVER/contrail_extensions': value => join($contrail_extensions, ',');
+ 'KEYSTONE/auth_url': value => $auth_url;
+ 'KEYSTONE/admin_user' : value => $admin_user;
+ 'KEYSTONE/admin_tenant_name': value => $admin_tenant_name;
+ 'KEYSTONE/admin_password': value => $admin_password, secret =>true;
+ 'KEYSTONE/admin_token': value => $admin_token, secret =>true;
+ 'KEYSTONE/cafile': value => $ca_file;
+ 'KEYSTONE/certfile': value => $cert_file;
+ 'keystone_authtoken/admin_user': value => $admin_user;
+ 'keystone_authtoken/admin_tenant': value => $admin_tenant_name;
+ 'keystone_authtoken/admin_password': value => $admin_password, secret =>true;
+ 'keystone_authtoken/auth_host': value => $auth_host;
+ 'keystone_authtoken/auth_protocol': value => $auth_protocol;
+ 'keystone_authtoken/auth_port': value => $auth_port_ssl;
+ 'keystone_authtoken/cafile': value => $ca_file;
+ 'keystone_authtoken/certfile': value => $cert_file;
+ }
+ } else {
+ $auth_url = join([$auth_protocol,'://',$auth_host,':',$auth_port,'/v2.0'])
+ neutron_plugin_opencontrail {
+ 'APISERVER/api_server_ip': value => $api_server;
+ 'APISERVER/api_server_port': value => $api_port;
+ 'APISERVER/contrail_extensions': value => join($contrail_extensions, ',');
+ 'KEYSTONE/auth_url': value => $auth_url;
+ 'KEYSTONE/admin_user' : value => $admin_user;
+ 'KEYSTONE/admin_tenant_name': value => $admin_tenant_name;
+ 'KEYSTONE/admin_password': value => $admin_password, secret =>true;
+ 'KEYSTONE/admin_token': value => $admin_token, secret =>true;
+ 'keystone_authtoken/admin_user': value => $admin_user;
+ 'keystone_authtoken/admin_tenant': value => $admin_tenant_name;
+ 'keystone_authtoken/admin_password': value => $admin_password, secret =>true;
+ 'keystone_authtoken/auth_host': value => $auth_host;
+ 'keystone_authtoken/auth_protocol': value => $auth_protocol;
+ 'keystone_authtoken/auth_port': value => $auth_port;
+ }
+ }
+}
diff --git a/manifests/network/contrail/provision.pp b/manifests/network/contrail/provision.pp
new file mode 100644
index 0000000..3025737
--- /dev/null
+++ b/manifests/network/contrail/provision.pp
@@ -0,0 +1,92 @@
+#
+# Copyright (C) 2015 Juniper Networks
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License. You may obtain
+# a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations
+# under the License.
+#
+# == Class: tripleo::network::contrail::provision
+#
+# Provisions Contrail Control and link local services
+#
+# == Parameters:
+#
+# [*admin_password*]
+# (optional) admin password
+# String value.
+# Defaults to hiera('contrail::admin_password'),
+#
+# [*admin_tenant_name*]
+# (optional) admin tenant name.
+# String value.
+# Defaults to hiera('contrail::admin_tenant_name'),
+#
+# [*admin_token*]
+# (optional) admin token
+# String value.
+# Defaults to hiera('contrail::admin_token'),
+#
+# [*admin_user*]
+# (optional) admin user name.
+# String value.
+# Defaults to hiera('contrail::admin_user'),
+#
+# [*api_server*]
+# (optional) IP address of api server
+# String value.
+# Defaults to hiera('contrail_config_vip')
+#
+# [*auth_host*]
+# (optional) keystone server ip address
+# String (IPv4) value.
+# Defaults to hiera('contrail::auth_host'),
+#
+# [*auth_port*]
+# (optional) keystone port.
+# Defaults to hiera('contrail::auth_port'),
+#
+# [*auth_protocol*]
+# (optional) authentication protocol.
+# Defaults to hiera('contrail::auth_protocol'),
+#
+# [*step*]
+# (optional) Step stack is in
+# Integer value.
+# Defaults to hiera('step')
+#
+class tripleo::network::contrail::provision(
+ $admin_password = hiera('contrail::admin_password'),
+ $admin_tenant_name = hiera('contrail::admin_tenant_name'),
+ $admin_token = hiera('contrail::admin_token'),
+ $admin_user = hiera('contrail::admin_user'),
+ $api_server = hiera('contrail_config_vip'),
+ $auth_host = hiera('contrail::auth_host'),
+ $auth_port = hiera('contrail::auth_port'),
+ $auth_protocol = hiera('contrail::auth_protocol'),
+ $step = hiera('step'),
+)
+{
+ if $step >= 5 {
+ class {'::contrail::control::provision_control':
+ api_address => $api_server,
+ keystone_admin_user => $admin_user,
+ keystone_admin_password => $admin_password,
+ keystone_admin_tenant_name => $admin_tenant_name,
+ }
+ class {'::contrail::control::provision_linklocal':
+ api_address => $api_server,
+ keystone_admin_user => $admin_user,
+ keystone_admin_password => $admin_password,
+ keystone_admin_tenant_name => $admin_tenant_name,
+ ipfabric_service_ip => $api_server,
+ }
+ }
+}
diff --git a/manifests/network/contrail/vrouter.pp b/manifests/network/contrail/vrouter.pp
new file mode 100644
index 0000000..2bccd1d
--- /dev/null
+++ b/manifests/network/contrail/vrouter.pp
@@ -0,0 +1,302 @@
+# Copyright 2016 Red Hat, Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License. You may obtain
+# a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations
+# under the License.
+#
+# == Class: tripleo::profile::base::neutron::opencontrail::vrouter
+#
+# Opencontrail profile to run the contrail vrouter
+#
+# === Parameters
+#
+# [*step*]
+# (Optional) The current step of the deployment
+# Defaults to hiera('step')
+#
+# [*admin_password*]
+# (optional) admin password
+# String value.
+# Defaults to hiera('contrail::admin_password')
+#
+# [*admin_tenant_name*]
+# (optional) admin tenant name.
+# String value.
+# Defaults to hiera('contrail::admin_tenant_name')
+#
+# [*admin_token*]
+# (optional) admin token
+# String value.
+# Defaults to hiera('contrail::admin_token')
+#
+# [*admin_user*]
+# (optional) admin user name.
+# String value.
+# Defaults to hiera('contrail::admin_user')
+#
+# [*api_server*]
+# (optional) IP address of api server
+# String value.
+# Defaults to hiera('contrail_config_vip')
+#
+# [*api_port*]
+# (optional) port of api server
+# String value.
+# Defaults to hiera('contrail::api_port')
+#
+# [*auth_host*]
+# (optional) keystone server ip address
+# String (IPv4) value.
+# Defaults to hiera('contrail::auth_host')
+#
+# [*auth_port*]
+# (optional) keystone port.
+# Integer value.
+# Defaults to hiera('contrail::auth_port')
+#
+# [*auth_port_ssl*]
+# (optional) keystone ssl port.
+# Integer value.
+# Defaults to hiera('contrail::auth_port_ssl')
+#
+# [*auth_protocol*]
+# (optional) authentication protocol.
+# String value.
+# Defaults to hiera('contrail::auth_protocol')
+#
+# [*ca_file*]
+# (optional) ca file name
+# String value.
+# Defaults to hiera('contrail::service_certificate',false)
+#
+# [*cert_file*]
+# (optional) cert file name
+# String value.
+# Defaults to hiera('contrail::service_certificate',false)
+#
+# [*control_server*]
+# (optional) Contrail control server IP
+# Array of String (IPv4) value.
+# Defaults to hiera('contrail_control_node_ips')
+#
+# [*disc_server_ip*]
+# (optional) IPv4 address of discovery server.
+# String (IPv4) value.
+# Defaults to hiera('contrail_config_vip'),
+#
+# [*disc_server_port*]
+# (optional) port Discovery server listens on.
+# Integer value.
+# Defaults to hiera('contrail::disc_server_port')
+#
+# [*gateway*]
+# (optional) Default GW for vrouter
+# String (IPv4) value.
+# Defaults to hiera('contrail::vrouter::gateway')
+#
+# [*host_ip*]
+# (optional) host IP address of vrouter
+# String (IPv4) value.
+# Defaults to hiera('contrail::vrouter::host_ip')
+#
+# [*insecure*]
+# (optional) insecure connections allowed
+# String value.
+# Defaults to hiera('contrail::insecure')
+#
+# [*memcached_servers*]
+# (optional) memcached server ip
+# String (IPv4) value.
+# Defaults to hiera('contrail::memcached_server')
+#
+# [*metadata_secret*]
+# (optional) secret for metadata
+# String value.
+# Defaults to hiera('contrail::vrouter::metadata_proxy_shared_secret')
+#
+# [*netmask*]
+# (optional) netmask for vrouter interface
+# String (IPv4) value.
+# Defaults to hiera('contrail::vrouter::netmask')
+#
+# [*physical_interface*]
+# (optional) vrouter interface
+# String value.
+# Defaults to hiera('contrail::vrouter::physical_interface')
+#
+# [*public_vip*]
+# (optional) Public VIP to Keystone
+# String (IPv4) value.
+# Defaults to hiera('public_virtual_ip')
+#
+# [*is_tsn*]
+# (optional) Turns vrouter into TSN
+# String value.
+# Defaults to hiera('contrail::vrouter::is_tsn',false)
+#
+class tripleo::network::contrail::vrouter (
+ $step = hiera('step'),
+ $admin_password = hiera('contrail::admin_password'),
+ $admin_tenant_name = hiera('contrail::admin_tenant_name'),
+ $admin_token = hiera('contrail::admin_token'),
+ $admin_user = hiera('contrail::admin_user'),
+ $api_port = hiera('contrail::api_port'),
+ $api_server = hiera('contrail_config_vip'),
+ $auth_host = hiera('contrail::auth_host'),
+ $auth_port = hiera('contrail::auth_port'),
+ $auth_port_ssl = hiera('contrail::auth_port_ssl'),
+ $auth_protocol = hiera('contrail::auth_protocol'),
+ $ca_file = hiera('contrail::service_certificate',false),
+ $cert_file = hiera('contrail::service_certificate',false),
+ $control_server = hiera('contrail_control_node_ips'),
+ $disc_server_ip = hiera('contrail_config_vip'),
+ $disc_server_port = hiera('contrail::disc_server_port'),
+ $gateway = hiera('contrail::vrouter::gateway'),
+ $host_ip = hiera('contrail::vrouter::host_ip'),
+ $insecure = hiera('contrail::insecure'),
+ $memcached_servers = hiera('contrail::memcached_server'),
+ $metadata_secret = hiera('contrail::vrouter::metadata_proxy_shared_secret'),
+ $netmask = hiera('contrail::vrouter::netmask'),
+ $physical_interface = hiera('contrail::vrouter::physical_interface'),
+ $public_vip = hiera('public_virtual_ip'),
+ $is_tsn = hiera('contrail::vrouter::is_tsn',false),
+) {
+ $cidr = netmask_to_cidr($netmask)
+ notify { 'cidr':
+ message => $cidr,
+ }
+ $macaddress = inline_template("<%= scope.lookupvar('::macaddress_${physical_interface}') -%>")
+ #include ::contrail::vrouter
+ # NOTE: it's not possible to use this class without a functional
+ # contrail controller up and running
+ $control_server_list = join($control_server, ' ')
+ if $auth_protocol == 'https' {
+ $keystone_config = {
+ 'KEYSTONE' => {
+ 'admin_password' => $admin_password,
+ 'admin_tenant_name' => $admin_tenant_name,
+ 'admin_token' => $admin_token,
+ 'admin_user' => $admin_user,
+ 'auth_host' => $auth_host,
+ 'auth_port' => $auth_port_ssl,
+ 'auth_protocol' => $auth_protocol,
+ 'insecure' => $insecure,
+ 'memcached_servers' => $memcached_servers,
+ 'certfile' => $cert_file,
+ 'cafile' => $ca_file,
+ },
+ }
+ $vnc_api_lib_config = {
+ 'auth' => {
+ 'AUTHN_SERVER' => $public_vip,
+ 'AUTHN_PORT' => $auth_port_ssl,
+ 'AUTHN_PROTOCOL' => $auth_protocol,
+ 'certfile' => $cert_file,
+ 'cafile' => $ca_file,
+ },
+ }
+ } else {
+ $keystone_config = {
+ 'KEYSTONE' => {
+ 'admin_password' => $admin_password,
+ 'admin_tenant_name' => $admin_tenant_name,
+ 'admin_token' => $admin_token,
+ 'admin_user' => $admin_user,
+ 'auth_host' => $auth_host,
+ 'auth_port' => $auth_port,
+ 'auth_protocol' => $auth_protocol,
+ 'insecure' => $insecure,
+ 'memcached_servers' => $memcached_servers,
+ },
+ }
+ $vnc_api_lib_config = {
+ 'auth' => {
+ 'AUTHN_SERVER' => $public_vip,
+ },
+ }
+ }
+ if $is_tsn {
+ $vrouter_agent_config = {
+ 'DEBUG' => {
+ 'agent_mode' => 'tsn',
+ },
+ 'CONTROL-NODE' => {
+ 'server' => $control_server_list,
+ },
+ 'VIRTUAL-HOST-INTERFACE' => {
+ 'compute_node_address' => $host_ip,
+ 'gateway' => $gateway,
+ 'ip' => "${host_ip}/${cidr}",
+ 'name' => 'vhost0',
+ 'physical_interface' => $physical_interface,
+ },
+ 'METADATA' => {
+ 'metadata_proxy_secret' => $metadata_secret,
+ },
+ 'DISCOVERY' => {
+ 'server' => $disc_server_ip,
+ 'port' => $disc_server_port,
+ },
+ }
+ } else {
+ $vrouter_agent_config = {
+ 'CONTROL-NODE' => {
+ 'server' => $control_server_list,
+ },
+ 'VIRTUAL-HOST-INTERFACE' => {
+ 'compute_node_address' => $host_ip,
+ 'gateway' => $gateway,
+ 'ip' => "${host_ip}/${cidr}",
+ 'name' => 'vhost0',
+ 'physical_interface' => $physical_interface,
+ },
+ 'METADATA' => {
+ 'metadata_proxy_secret' => $metadata_secret,
+ },
+ 'DISCOVERY' => {
+ 'server' => $disc_server_ip,
+ 'port' => $disc_server_port,
+ },
+ }
+ }
+ class {'::contrail::vrouter':
+ discovery_ip => $disc_server_ip,
+ gateway => $gateway,
+ host_ip => $host_ip,
+ is_tsn => $is_tsn,
+ macaddr => $macaddress,
+ mask => $cidr,
+ netmask => $netmask,
+ physical_interface => $physical_interface,
+ vhost_ip => $host_ip,
+ keystone_config => $keystone_config,
+ vrouter_agent_config => $vrouter_agent_config,
+ vrouter_nodemgr_config => {
+ 'DISCOVERY' => {
+ 'server' => $disc_server_ip,
+ 'port' => $disc_server_port,
+ },
+ },
+ vnc_api_lib_config => $vnc_api_lib_config,
+ }
+ if $step >= 5 {
+ class {'::contrail::vrouter::provision_vrouter':
+ api_address => $api_server,
+ api_port => $api_port,
+ host_ip => $host_ip,
+ node_name => $::hostname,
+ keystone_admin_user => $admin_user,
+ keystone_admin_password => $admin_password,
+ keystone_admin_tenant_name => $admin_tenant_name,
+ is_tsn => $is_tsn,
+ }
+ }
+}
diff --git a/manifests/network/contrail/webui.pp b/manifests/network/contrail/webui.pp
index 0b308a4..b621811 100644
--- a/manifests/network/contrail/webui.pp
+++ b/manifests/network/contrail/webui.pp
@@ -19,18 +19,6 @@
#
# == Parameters:
#
-# [*contrail_analytics_vip*]
-# (required) VIP of Contrail Analytics
-# String (IPv4) value.
-#
-# [*contrail_config_vip*]
-# (required) VIP of Contrail Config
-# String (IPv4) value.
-#
-# [*neutron_vip*]
-# (required) VIP of Neutron
-# String (IPv4) value.
-#
# [*admin_password*]
# (optional) admin password
# String value.
@@ -56,11 +44,46 @@
# String (IPv4) value.
# Defaults to hiera('contrail::auth_host')
#
+# [*auth_port_public*]
+# (optional) keystone port.
+# Integer value.
+# Defaults to hiera('contrail::auth_port_public')
+#
+# [*auth_port_ssl*]
+# (optional) keystone ssl port.
+# Integer value.
+# Defaults to hiera('contrail::auth_port_ssl')
+#
+# [*auth_port_ssl_public*]
+# (optional) keystone public ssl port.
+# Integer value.
+# Defaults to hiera('contrail::auth_port_ssl_public')
+#
+# [*auth_protocol*]
+# (optional) authentication protocol.
+# String value.
+# Defaults to hiera('contrail::auth_protocol')
+#
+# [*cert_file*]
+# (optional) cert file name
+# String value.
+# Defaults to hiera('contrail::service_certificate',false)
+#
# [*cassandra_server_list*]
# (optional) List IPs+port of Cassandra servers
# Array of strings value.
# Defaults to hiera('contrail::cassandra_server_list')
#
+# [*contrail_analytics_vip*]
+# (optional) VIP of Contrail Analytics
+# String (IPv4) value.
+# Defaults to hiera('contrail_analytics_vip')
+#
+# [*contrail_config_vip*]
+# (optional) VIP of Contrail Config
+# String (IPv4) value.
+# Defaults to hiera('contrail_config_vip')
+#
# [*contrail_webui_http_port*]
# (optional) Webui HTTP Port
# Integer value.
@@ -71,38 +94,55 @@
# Integer value.
# Defaults to 8143
#
+# [*neutron_vip*]
+# (optional) VIP of Neutron
+# String (IPv4) value.
+# Defaults to hiera('neutron_api_vip')
+#
# [*redis_ip*]
# (optional) IP of Redis
# String (IPv4) value.
# Defaults to '127.0.0.1'
#
class tripleo::network::contrail::webui(
- $contrail_analytics_vip,
- $contrail_config_vip,
- $neutron_vip,
- $admin_password = hiera('contrail::admin_password'),
- $admin_tenant_name = hiera('contrail::admin_tenant_name'),
- $admin_token = hiera('contrail::admin_token'),
- $admin_user = hiera('contrail::admin_user'),
- $auth_host = hiera('contrail::auth_host'),
- $cassandra_server_list = hiera('contrail::cassandra_server_list'),
- $contrail_webui_http_port = 8080,
- $contrail_webui_https_port = 8143,
- $redis_ip = '127.0.0.1',
+ $admin_password = hiera('contrail::admin_password'),
+ $admin_tenant_name = hiera('contrail::admin_tenant_name'),
+ $admin_token = hiera('contrail::admin_token'),
+ $admin_user = hiera('contrail::admin_user'),
+ $auth_host = hiera('contrail::auth_host'),
+ $auth_protocol = hiera('contrail::auth_protocol'),
+ $auth_port_public = hiera('contrail::auth_port_public'),
+ $auth_port_ssl_public = hiera('contrail::auth_port_ssl_public'),
+ $cassandra_server_list = hiera('contrail_database_node_ips'),
+ $cert_file = hiera('contrail::cert_file'),
+ $contrail_analytics_vip = hiera('contrail_analytics_vip'),
+ $contrail_config_vip = hiera('contrail_config_vip'),
+ $contrail_webui_http_port = hiera('contrail::webui::http_port'),
+ $contrail_webui_https_port = hiera('contrail::webui::https_port'),
+ $neutron_vip = hiera('neutron_api_vip'),
+ $redis_ip = hiera('contrail::webui::redis_ip'),
)
{
+ if $auth_protocol == 'https' {
+ $auth_port = $auth_port_ssl_public
+ } else {
+ $auth_port = $auth_port_public
+ }
class {'::contrail::webui':
- openstack_vip => $auth_host,
- contrail_config_vip => $contrail_config_vip,
- contrail_analytics_vip => $contrail_analytics_vip,
- neutron_vip => $neutron_vip,
- cassandra_ip => $cassandra_server_list,
- redis_ip => $redis_ip,
- contrail_webui_http_port => $contrail_webui_http_port,
- contrail_webui_https_port => $contrail_webui_https_port,
admin_user => $admin_user,
admin_password => $admin_password,
admin_token => $admin_token,
admin_tenant_name => $admin_tenant_name,
+ auth_port => $auth_port,
+ auth_protocol => $auth_protocol,
+ cassandra_ip => $cassandra_server_list,
+ cert_file => $cert_file,
+ contrail_config_vip => $contrail_config_vip,
+ contrail_analytics_vip => $contrail_analytics_vip,
+ contrail_webui_http_port => $contrail_webui_http_port,
+ contrail_webui_https_port => $contrail_webui_https_port,
+ neutron_vip => $neutron_vip,
+ openstack_vip => $auth_host,
+ redis_ip => $redis_ip,
}
}
diff --git a/manifests/pacemaker/haproxy_with_vip.pp b/manifests/pacemaker/haproxy_with_vip.pp
index 0539beb..a27b94b 100644
--- a/manifests/pacemaker/haproxy_with_vip.pp
+++ b/manifests/pacemaker/haproxy_with_vip.pp
@@ -27,11 +27,35 @@
# (String) IP address on which HAProxy is colocated
# Required
#
+# [*location_rule*]
+# (optional) Add a location constraint before actually enabling
+# the resource. Must be a hash like the following example:
+# location_rule => {
+# resource_discovery => 'exclusive', # optional
+# role => 'master|slave', # optional
+# score => 0, # optional
+# score_attribute => foo, # optional
+# # Multiple expressions can be used
+# expression => ['opsrole eq controller']
+# }
+# Defaults to undef
+#
+# [*pcs_tries*]
+# (Optional) The number of times pcs commands should be retried.
+# Defaults to 1
+#
# [*ensure*]
# (Boolean) Create the all the resources only if true. False won't
# destroy the resource, it will just not create them.
# Default to true
-define tripleo::pacemaker::haproxy_with_vip($vip_name, $ip_address, $ensure = true) {
+#
+define tripleo::pacemaker::haproxy_with_vip(
+ $vip_name,
+ $ip_address,
+ $location_rule = undef,
+ $pcs_tries = 1,
+ $ensure = true)
+{
if($ensure) {
if is_ipv6_address($ip_address) {
$netmask = '64'
@@ -40,25 +64,29 @@ define tripleo::pacemaker::haproxy_with_vip($vip_name, $ip_address, $ensure = tr
}
pacemaker::resource::ip { "${vip_name}_vip":
- ip_address => $ip_address,
- cidr_netmask => $netmask,
+ ip_address => $ip_address,
+ cidr_netmask => $netmask,
+ location_rule => $location_rule,
+ tries => $pcs_tries,
}
- pacemaker::constraint::base { "${vip_name}_vip-then-haproxy":
- constraint_type => 'order',
+ pacemaker::constraint::order { "${vip_name}_vip-then-haproxy":
first_resource => "ip-${ip_address}",
second_resource => 'haproxy-clone',
first_action => 'start',
second_action => 'start',
constraint_params => 'kind=Optional',
- require => [Pacemaker::Resource::Service['haproxy'],
- Pacemaker::Resource::Ip["${vip_name}_vip"]],
+ tries => $pcs_tries,
}
pacemaker::constraint::colocation { "${vip_name}_vip-with-haproxy":
- source => "ip-${ip_address}",
- target => 'haproxy-clone',
- score => 'INFINITY',
- require => [Pacemaker::Resource::Service['haproxy'],
- Pacemaker::Resource::Ip["${vip_name}_vip"]],
+ source => "ip-${ip_address}",
+ target => 'haproxy-clone',
+ score => 'INFINITY',
+ tries => $pcs_tries,
}
+
+ Pacemaker::Resource::Ip["${vip_name}_vip"] ->
+ Pacemaker::Resource::Service['haproxy'] ->
+ Pacemaker::Constraint::Order["${vip_name}_vip-then-haproxy"] ->
+ Pacemaker::Constraint::Colocation["${vip_name}_vip-with-haproxy"]
}
}
diff --git a/manifests/packages.pp b/manifests/packages.pp
index ec2635a..147c76a 100644
--- a/manifests/packages.pp
+++ b/manifests/packages.pp
@@ -35,7 +35,7 @@ class tripleo::packages (
# required for stages
include ::stdlib
- if !$enable_install and !$enable_upgrade {
+ if !str2bool($enable_install) and !str2bool($enable_upgrade) {
case $::osfamily {
'RedHat': {
Package <| |> { provider => 'norpm' }
@@ -46,7 +46,7 @@ class tripleo::packages (
}
}
- if $enable_upgrade {
+ if str2bool($enable_upgrade) {
Package <| |> { ensure => 'latest' }
# Running the package upgrade before managing Services in the main stage.
# So we're sure that services will be able to restart with the new version
diff --git a/manifests/profile/base/auditd.pp b/manifests/profile/base/auditd.pp
new file mode 100644
index 0000000..628db08
--- /dev/null
+++ b/manifests/profile/base/auditd.pp
@@ -0,0 +1,30 @@
+# Copyright 2016 Red Hat, Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License. You may obtain
+# a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations
+# under the License.
+#
+# == class: tripleo::profile::base::auditd
+#
+# auditd profile for tripleo
+#
+# === Parameters
+#
+# [*step*]
+# Defaults to hiera('step')
+#
+class tripleo::profile::base::auditd (
+ $step = hiera('step'),
+) {
+ if $step >= 4 {
+ include ::auditd
+ }
+}
diff --git a/manifests/profile/base/ceph/mds.pp b/manifests/profile/base/ceph/mds.pp
new file mode 100644
index 0000000..c5c7654
--- /dev/null
+++ b/manifests/profile/base/ceph/mds.pp
@@ -0,0 +1,35 @@
+# Copyright 2016 Red Hat, Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License. You may obtain
+# a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations
+# under the License.
+#
+# == Class: tripleo::profile::base::ceph::mds
+#
+# Ceph MDS profile for tripleo
+#
+# === Parameters
+#
+# [*step*]
+# (Optional) The current step in deployment. See tripleo-heat-templates
+# for more details.
+# Defaults to hiera('step')
+#
+class tripleo::profile::base::ceph::mds (
+ $step = hiera('step'),
+) {
+
+ include ::tripleo::profile::base::ceph
+
+ if $step >= 3 {
+ include ::ceph::profile::mds
+ }
+}
diff --git a/manifests/profile/base/ceph/rgw.pp b/manifests/profile/base/ceph/rgw.pp
index 2ecca52..8443de0 100644
--- a/manifests/profile/base/ceph/rgw.pp
+++ b/manifests/profile/base/ceph/rgw.pp
@@ -29,6 +29,10 @@
# [*keystone_admin_token*]
# The keystone admin token
#
+# [*rgw_keystone_version*] The api version for keystone.
+# Possible values 'v2.0', 'v3'
+# Optional. Default is 'v2.0'
+#
# [*keystone_url*]
# The internal or admin url for keystone
#
@@ -44,9 +48,10 @@ class tripleo::profile::base::ceph::rgw (
$keystone_admin_token,
$keystone_url,
$rgw_key,
- $civetweb_bind_ip = '127.0.0.1',
- $civetweb_bind_port = '8080',
- $step = hiera('step'),
+ $civetweb_bind_ip = '127.0.0.1',
+ $civetweb_bind_port = '8080',
+ $rgw_keystone_version = 'v2.0',
+ $step = hiera('step'),
) {
include ::tripleo::profile::base::ceph
@@ -58,7 +63,8 @@ class tripleo::profile::base::ceph::rgw (
include ::ceph::profile::base
ceph::rgw { $rgw_name:
frontend_type => 'civetweb',
- rgw_frontends => "civetweb port=${civetweb_bind_ip_real}:${civetweb_bind_port}"
+ rgw_frontends => "civetweb port=${civetweb_bind_ip_real}:${civetweb_bind_port}",
+ user => 'ceph',
}
ceph::key { "client.${rgw_name}":
secret => $rgw_key,
@@ -69,11 +75,24 @@ class tripleo::profile::base::ceph::rgw (
}
if $step >= 4 {
- ceph::rgw::keystone { $rgw_name:
- rgw_keystone_accepted_roles => ['admin', '_member_', 'Member'],
- use_pki => false,
- rgw_keystone_admin_token => $keystone_admin_token,
- rgw_keystone_url => $keystone_url,
+ if $rgw_keystone_version == 'v2.0' {
+ ceph::rgw::keystone { $rgw_name:
+ rgw_keystone_accepted_roles => ['admin', '_member_', 'Member'],
+ use_pki => false,
+ rgw_keystone_admin_token => $keystone_admin_token,
+ rgw_keystone_url => $keystone_url,
+ user => 'ceph',
+ }
+ }
+ else
+ {
+ ceph::rgw::keystone { $rgw_name:
+ rgw_keystone_accepted_roles => ['admin', '_member_', 'Member'],
+ use_pki => false,
+ rgw_keystone_url => $keystone_url,
+ rgw_keystone_version => $rgw_keystone_version,
+ user => 'ceph',
+ }
}
}
}
diff --git a/manifests/profile/base/cinder.pp b/manifests/profile/base/cinder.pp
index 6a821f3..6e8fbb2 100644
--- a/manifests/profile/base/cinder.pp
+++ b/manifests/profile/base/cinder.pp
@@ -57,6 +57,7 @@ class tripleo::profile::base::cinder (
rabbit_hosts => $rabbit_endpoints,
}
include ::cinder::config
+ include ::cinder::glance
}
if $step >= 5 {
diff --git a/manifests/profile/base/cinder/api.pp b/manifests/profile/base/cinder/api.pp
index 5ea2058..450a8e6 100644
--- a/manifests/profile/base/cinder/api.pp
+++ b/manifests/profile/base/cinder/api.pp
@@ -94,7 +94,6 @@ class tripleo::profile::base::cinder::api (
ssl_key => $tls_keyfile,
}
include ::cinder::ceilometer
- include ::cinder::glance
}
}
diff --git a/manifests/profile/base/cinder/volume.pp b/manifests/profile/base/cinder/volume.pp
index 64927b6..9fb1594 100644
--- a/manifests/profile/base/cinder/volume.pp
+++ b/manifests/profile/base/cinder/volume.pp
@@ -22,8 +22,12 @@
# (Optional) Whether to enable the delsc backend
# Defaults to true
#
-# [*cinder_enable_eqlx_backend*]
-# (Optional) Whether to enable the eqlx backend
+# [*cinder_enable_hpelefthand_backend*]
+# (Optional) Whether to enable the hpelefthand backend
+# Defaults to false
+#
+# [*cinder_enable_dellps_backend*]
+# (Optional) Whether to enable the dellps backend
# Defaults to true
#
# [*cinder_enable_iscsi_backend*]
@@ -42,6 +46,10 @@
# (Optional) Whether to enable the rbd backend
# Defaults to true
#
+# [*cinder_enable_scaleio_backend*]
+# (Optional) Whether to enable the scaleio backend
+# Defaults to true
+#
# [*cinder_user_enabled_backends*]
# (Optional) List of additional backend stanzas to activate
# Defaults to hiera('cinder_user_enabled_backends')
@@ -52,14 +60,16 @@
# Defaults to hiera('step')
#
class tripleo::profile::base::cinder::volume (
- $cinder_enable_dellsc_backend = false,
- $cinder_enable_eqlx_backend = false,
- $cinder_enable_iscsi_backend = true,
- $cinder_enable_netapp_backend = false,
- $cinder_enable_nfs_backend = false,
- $cinder_enable_rbd_backend = false,
- $cinder_user_enabled_backends = hiera('cinder_user_enabled_backends', undef),
- $step = hiera('step'),
+ $cinder_enable_dellsc_backend = false,
+ $cinder_enable_hpelefthand_backend = false,
+ $cinder_enable_dellps_backend = false,
+ $cinder_enable_iscsi_backend = true,
+ $cinder_enable_netapp_backend = false,
+ $cinder_enable_nfs_backend = false,
+ $cinder_enable_rbd_backend = false,
+ $cinder_enable_scaleio_backend = false,
+ $cinder_user_enabled_backends = hiera('cinder_user_enabled_backends', undef),
+ $step = hiera('step'),
) {
include ::tripleo::profile::base::cinder
@@ -73,11 +83,18 @@ class tripleo::profile::base::cinder::volume (
$cinder_dellsc_backend_name = undef
}
- if $cinder_enable_eqlx_backend {
- include ::tripleo::profile::base::cinder::volume::eqlx
- $cinder_eqlx_backend_name = hiera('cinder::backend::eqlx::volume_backend_name', 'tripleo_eqlx')
+ if $cinder_enable_hpelefthand_backend {
+ include ::tripleo::profile::base::cinder::volume::hpelefthand
+ $cinder_hpelefthand_backend_name = hiera('cinder::backend::hpelefthand_iscsi::volume_backend_name', 'tripleo_hpelefthand')
} else {
- $cinder_eqlx_backend_name = undef
+ $cinder_hpelefthand_backend_name = undef
+ }
+
+ if $cinder_enable_dellps_backend {
+ include ::tripleo::profile::base::cinder::volume::dellps
+ $cinder_dellps_backend_name = hiera('cinder::backend::dellps::volume_backend_name', 'tripleo_dellps')
+ } else {
+ $cinder_dellps_backend_name = undef
}
if $cinder_enable_iscsi_backend {
@@ -108,12 +125,21 @@ class tripleo::profile::base::cinder::volume (
$cinder_rbd_backend_name = undef
}
+ if $cinder_enable_scaleio_backend {
+ include ::tripleo::profile::base::cinder::volume::scaleio
+ $cinder_scaleio_backend_name = hiera('cinder::backend::scaleio::volume_backend_name', 'tripleo_scaleio')
+ } else {
+ $cinder_scaleio_backend_name = undef
+ }
+
$backends = delete_undef_values([$cinder_iscsi_backend_name,
$cinder_rbd_backend_name,
- $cinder_eqlx_backend_name,
+ $cinder_dellps_backend_name,
$cinder_dellsc_backend_name,
+ $cinder_hpelefthand_backend_name,
$cinder_netapp_backend_name,
$cinder_nfs_backend_name,
+ $cinder_scaleio_backend_name,
$cinder_user_enabled_backends])
# NOTE(aschultz): during testing it was found that puppet 3 may incorrectly
# include a "" in the previous array which is not removed by the
diff --git a/manifests/profile/base/cinder/volume/eqlx.pp b/manifests/profile/base/cinder/volume/dellps.pp
index fe24f4b..1338240 100644
--- a/manifests/profile/base/cinder/volume/eqlx.pp
+++ b/manifests/profile/base/cinder/volume/dellps.pp
@@ -12,23 +12,23 @@
# License for the specific language governing permissions and limitations
# under the License.
#
-# == Class: tripleo::profile::base::cinder::volume::eqlx
+# == Class: tripleo::profile::base::cinder::volume::dellps
#
-# Cinder Volume eqlx profile for tripleo
+# Cinder Volume for dellps profile tripleo
#
# === Parameters
#
# [*backend_name*]
# (Optional) Name given to the Cinder backend stanza
-# Defaults to 'tripleo_eqlx'
+# Defaults to 'tripleo_dellps'
#
# [*step*]
# (Optional) The current step in deployment. See tripleo-heat-templates
# for more details.
# Defaults to hiera('step')
#
-class tripleo::profile::base::cinder::volume::eqlx (
- $backend_name = hiera('cinder::backend::eqlx::volume_backend_name', 'tripleo_eqlx'),
+class tripleo::profile::base::cinder::volume::dellps (
+ $backend_name = hiera('cinder::backend::eqlx::volume_backend_name', 'tripleo_dellps'),
$step = hiera('step'),
) {
include ::tripleo::profile::base::cinder::volume
diff --git a/manifests/profile/base/cinder/volume/hpelefthand.pp b/manifests/profile/base/cinder/volume/hpelefthand.pp
new file mode 100644
index 0000000..32f0976
--- /dev/null
+++ b/manifests/profile/base/cinder/volume/hpelefthand.pp
@@ -0,0 +1,71 @@
+# Copyright 2016 Hewlett-Packard Enterprise.
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License. You may obtain
+# a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations
+# under the License.
+#
+# == Class: tripleo::profile::base::cinder::volume::hpelefthand
+#
+# Cinder Volume hpelefthand profile for tripleo
+#
+# === Parameters
+#
+# [*backend_name*]
+# (Optional) Name given to the Cinder backend stanza
+# Defaults to 'tripleo_hpelefthand'
+#
+# [*cinder_hpelefthand_api_url*]
+# (required) url for api access to lefthand - example https://10.x.x.x:8080/api/v1
+#
+# [*cinder_hpelefthand_username*]
+# (required) Username for HPElefthand admin user
+#
+# [*cinder_hpelefthand_password*]
+# (required) Password for hpelefthand_username
+#
+# [*cinder_hpelefthand_iscsi_chap_enabled*]
+# (required) setting to false by default
+#
+# [*cinder_hpelefthand_clustername*]
+# (required) clustername of hpelefthand
+#
+# [*cinder_hpelefthand_debug*]
+# (required) setting to false by default
+#
+# [*step*]
+# (Optional) The current step in deployment. See tripleo-heat-templates
+# for more details.
+# Defaults to hiera('step')
+#
+class tripleo::profile::base::cinder::volume::hpelefthand (
+ $backend_name = hiera('cinder::backend::hpelefthand_iscsi::volume_backend_name', 'tripleo_hpelefthand'),
+ $cinder_hpelefthand_username = hiera('cinder::backend::hpelefthand_iscsi::hpelefthand_username', undef),
+ $cinder_hpelefthand_password = hiera('cinder::backend::hpelefthand_iscsi::hpelefthand_password', undef),
+ $cinder_hpelefthand_clustername = hiera('cinder::backend::hpelefthand_iscsi::hpelefthand_clustername', undef),
+ $cinder_hpelefthand_api_url = hiera('cinder::backend::hpelefthand_iscsi::hpelefthand_api_url', undef),
+ $cinder_hpelefthand_iscsi_chap_enabled = hiera('cinder::backend::hpelefthand_iscsi::hpelefthand_iscsi_chap_enabled', undef),
+ $cinder_hpelefthand_debug = hiera('cinder::backend::hpelefthand_iscsi::hpelefthand_debug', undef),
+ $step = hiera('step'),
+) {
+ include ::tripleo::profile::base::cinder::volume
+
+ if $step >= 4 {
+ cinder::backend::hpelefthand_iscsi { $backend_name :
+ hpelefthand_username => $cinder_hpelefthand_username,
+ hpelefthand_password => $cinder_hpelefthand_password,
+ hpelefthand_clustername => $cinder_hpelefthand_clustername,
+ hpelefthand_api_url => $cinder_hpelefthand_api_url,
+ hpelefthand_iscsi_chap_enabled => $cinder_hpelefthand_iscsi_chap_enabled,
+ hpelefthand_debug => $cinder_hpelefthand_debug,
+ }
+ }
+
+}
diff --git a/manifests/profile/base/cinder/volume/scaleio.pp b/manifests/profile/base/cinder/volume/scaleio.pp
new file mode 100644
index 0000000..a30cffa
--- /dev/null
+++ b/manifests/profile/base/cinder/volume/scaleio.pp
@@ -0,0 +1,56 @@
+# Copyright 2016 Red Hat, Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License. You may obtain
+# a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations
+# under the License.
+#
+# == Class: tripleo::profile::base::cinder::volume::scaleio
+#
+# Cinder Volume scaleio profile for tripleo
+#
+# === Parameters
+#
+# [*backend_name*]
+# (Optional) Name given to the Cinder backend stanza
+# Defaults to 'tripleo_scaleio'
+#
+# [*step*]
+# (Optional) The current step in deployment. See tripleo-heat-templates
+# for more details.
+# Defaults to hiera('step')
+#
+class tripleo::profile::base::cinder::volume::scaleio (
+ $backend_name = hiera('cinder::backend::scaleio::volume_backend_name', 'tripleo_scaleio'),
+ $step = hiera('step'),
+) {
+ include ::tripleo::profile::base::cinder::volume
+
+ if $step >= 4 {
+ cinder::backend::scaleio { $backend_name :
+ sio_login => hiera('cinder::backend::scaleio::sio_login', undef),
+ sio_password => hiera('cinder::backend::scaleio::sio_password', undef),
+ sio_server_hostname => hiera('cinder::backend::scaleio::sio_server_hostname', undef),
+ sio_server_port => hiera('cinder::backend::scaleio::sio_server_port', undef),
+ sio_verify_server_certificate => hiera('cinder::backend::scaleio::sio_verify_server_certificate', undef),
+ sio_server_certificate_path => hiera('cinder::backend::scaleio::sio_server_certificate_path', undef),
+ sio_protection_domain_name => hiera('cinder::backend::scaleio::sio_protection_domain_name', undef),
+ sio_protection_domain_id => hiera('cinder::backend::scaleio::sio_protection_domain_id', undef),
+ sio_storage_pool_id => hiera('cinder::backend::scaleio::sio_storage_pool_id', undef),
+ sio_storage_pool_name => hiera('cinder::backend::scaleio::sio_storage_pool_name', undef),
+ sio_storage_pools => hiera('cinder::backend::scaleio::sio_storage_pools', undef),
+ sio_round_volume_capacity => hiera('cinder::backend::scaleio::sio_round_volume_capacity', undef),
+ sio_unmap_volume_before_deletion => hiera('cinder::backend::scaleio::sio_unmap_volume_before_deletion', undef),
+ sio_max_over_subscription_ratio => hiera('cinder::backend::scaleio::sio_max_over_subscription_ratio', undef),
+ sio_thin_provision => hiera('cinder::backend::scaleio::sio_thin_provision', undef),
+ }
+ }
+
+}
diff --git a/manifests/profile/base/congress.pp b/manifests/profile/base/congress.pp
new file mode 100644
index 0000000..1731e81
--- /dev/null
+++ b/manifests/profile/base/congress.pp
@@ -0,0 +1,86 @@
+# Copyright 2016 Red Hat, Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License. You may obtain
+# a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations
+# under the License.
+#
+# == Class: tripleo::profile::base::congress
+#
+# Congress server profile for tripleo
+#
+# === Parameters
+#
+# [*bootstrap_node*]
+# (Optional) The hostname of the node responsible for bootstrapping tasks
+# Defaults to hiera('bootstrap_nodeid')
+#
+# [*messaging_driver*]
+# Driver for messaging service.
+# Defaults to hiera('messaging_service_name', 'rabbit')
+#
+# [*messaging_hosts*]
+# list of the messaging host fqdns
+# Defaults to hiera('rabbitmq_node_names')
+#
+# [*messaging_password*]
+# Password for messaging congress queue
+# Defaults to hiera('congress::rabbit_password')
+#
+# [*messaging_port*]
+# IP port for messaging service
+# Defaults to hiera('congress::rabbit_port', 5672)
+#
+# [*messaging_username*]
+# Username for messaging congress queue
+# Defaults to hiera('congress::rabbit_userid', 'guest')
+#
+# [*messaging_use_ssl*]
+# Flag indicating ssl usage.
+# Defaults to hiera('congress::rabbit_use_ssl', '0')
+#
+# [*step*]
+# (Optional) The current step of the deployment
+# Defaults to hiera('step')
+
+class tripleo::profile::base::congress (
+ $bootstrap_node = hiera('bootstrap_nodeid', undef),
+ $messaging_driver = hiera('messaging_service_name', 'rabbit'),
+ $messaging_hosts = any2array(hiera('rabbitmq_node_names', undef)),
+ $messaging_password = hiera('congress::rabbit_password'),
+ $messaging_port = hiera('congress::rabbit_port', '5672'),
+ $messaging_username = hiera('congress::rabbit_userid', 'guest'),
+ $messaging_use_ssl = hiera('congress::rabbit_use_ssl', '0'),
+ $step = hiera('step'),
+) {
+ if $::hostname == downcase($bootstrap_node) {
+ $sync_db = true
+ } else {
+ $sync_db = false
+ }
+
+ if $step >= 4 or ($step >= 3 and $sync_db){
+ $messaging_use_ssl_real = sprintf('%s', bool2num(str2bool($messaging_use_ssl)))
+ class { '::congress':
+ sync_db => $sync_db,
+ default_transport_url => os_transport_url({
+ 'transport' => $messaging_driver,
+ 'hosts' => $messaging_hosts,
+ 'port' => sprintf('%s', $messaging_port),
+ 'username' => $messaging_username,
+ 'password' => $messaging_password,
+ 'ssl' => $messaging_use_ssl_real,
+ }),
+ }
+
+ include ::congress::server
+ include ::congress::db
+ }
+}
diff --git a/manifests/profile/base/database/mysql.pp b/manifests/profile/base/database/mysql.pp
index a039439..d3c3f21 100644
--- a/manifests/profile/base/database/mysql.pp
+++ b/manifests/profile/base/database/mysql.pp
@@ -66,6 +66,7 @@
# for more details.
# Defaults to hiera('step')
#
+#
class tripleo::profile::base::database::mysql (
$bind_address = $::hostname,
$bootstrap_node = hiera('bootstrap_nodeid', undef),
@@ -118,13 +119,14 @@ class tripleo::profile::base::database::mysql (
# MysqlNetwork and ControllerHostnameResolveNetwork in ServiceNetMap
$mysql_server_default = {
'mysqld' => {
- 'bind-address' => $bind_address,
- 'max_connections' => hiera('mysql_max_connections'),
- 'open_files_limit' => '-1',
- 'ssl' => $enable_internal_tls,
- 'ssl-key' => $tls_keyfile,
- 'ssl-cert' => $tls_certfile,
- 'ssl-ca' => undef,
+ 'bind-address' => $bind_address,
+ 'max_connections' => hiera('mysql_max_connections'),
+ 'open_files_limit' => '-1',
+ 'innodb_file_per_table' => 'ON',
+ 'ssl' => $enable_internal_tls,
+ 'ssl-key' => $tls_keyfile,
+ 'ssl-cert' => $tls_certfile,
+ 'ssl-ca' => undef,
}
}
$mysql_server_options_real = deep_merge($mysql_server_default, $mysql_server_options)
@@ -150,6 +152,9 @@ class tripleo::profile::base::database::mysql (
if hiera('cinder_api_enabled', false) {
include ::cinder::db::mysql
}
+ if hiera('congress_enabled', false) {
+ include ::congress::db::mysql
+ }
if hiera('glance_api_enabled', false) {
include ::glance::db::mysql
}
@@ -178,15 +183,24 @@ class tripleo::profile::base::database::mysql (
include ::nova::db::mysql
include ::nova::db::mysql_api
}
+ if hiera('nova_placement_enabled', false) {
+ include ::nova::db::mysql_placement
+ }
if hiera('sahara_api_enabled', false) {
include ::sahara::db::mysql
}
+ if hiera('tacker_enabled', false) {
+ include ::tacker::db::mysql
+ }
if hiera('trove_api_enabled', false) {
include ::trove::db::mysql
}
if hiera('panko_api_enabled', false) {
include ::panko::db::mysql
}
+ if hiera('ec2_api_enabled', false) {
+ include ::ec2api::db::mysql
+ }
}
}
diff --git a/manifests/profile/base/docker_registry.pp b/manifests/profile/base/docker_registry.pp
new file mode 100644
index 0000000..ebe84bf
--- /dev/null
+++ b/manifests/profile/base/docker_registry.pp
@@ -0,0 +1,74 @@
+# Copyright 2017 Red Hat, Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License. You may obtain
+# a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations
+# under the License.
+#
+# == Class: tripleo::profile::base::docker_registry
+#
+# Docker Registry profile for tripleo
+#
+# === Parameters:
+#
+# [*registry_host*]
+# (String) IP address or hostname the Docker registry binds to
+# Defaults to hiera('controller_host')
+#
+# [*registry_port*]
+# (Integer) The port on which the Docker registry is listening on
+# Defaults to 8787
+#
+# [*registry_admin_host*]
+# (String) IP address or hostname the Docker registry binds to in the admin
+# network
+# Defaults to hiera('controller_admin_host')
+#
+class tripleo::profile::base::docker_registry (
+ $registry_host = hiera('controller_host'),
+ $registry_port = 8787,
+ $registry_admin_host = hiera('controller_admin_host'),
+) {
+ # We want a v2 registry
+ package{'docker-registry':
+ ensure => absent,
+ }
+ package{'docker-distribution': }
+ package{'docker': }
+ file { '/etc/docker-distribution/registry/config.yml' :
+ ensure => file,
+ content => template('tripleo/docker_distribution/registry_config.yml.erb'),
+ owner => 'root',
+ group => 'root',
+ mode => '0644',
+ require => Package['docker-distribution'],
+ notify => Service['docker-distribution'],
+ }
+ file_line { 'docker insecure registry':
+ path => '/etc/sysconfig/docker',
+ line => join ([
+ 'INSECURE_REGISTRY="',
+ '--insecure-registry ', $registry_host, ':', $registry_port, ' ',
+ '--insecure-registry ', $registry_admin_host, ':', $registry_port, '"']),
+ match => 'INSECURE_REGISTRY=',
+ require => Package['docker'],
+ notify => Service['docker'],
+ }
+ service { 'docker-distribution':
+ ensure => running,
+ enable => true,
+ require => Package['docker-distribution'],
+ }
+ service { 'docker':
+ ensure => running,
+ enable => true,
+ require => Package['docker'],
+ }
+}
diff --git a/manifests/profile/base/etcd.pp b/manifests/profile/base/etcd.pp
new file mode 100644
index 0000000..505e29f
--- /dev/null
+++ b/manifests/profile/base/etcd.pp
@@ -0,0 +1,66 @@
+# Copyright 2016 Red Hat, Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License. You may obtain
+# a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations
+# under the License.
+#
+# == Class: tripleo::profile::base::etcd
+#
+# etcd profile for tripleo
+#
+# === Parameters
+#
+# [*bind_ip*]
+# (optional) IP to bind etcd service to.
+# Defaults to '127.0.0.1'.
+#
+# [*client_port*]
+# (optional) etcd client listening port.
+# Defaults to '2379'.
+#
+# [*peer_port*]
+# (optional) etcd peer listening port.
+# Defaults to '2380'.
+#
+# [*nodes*]
+# (Optional) Array of host(s) for etcd nodes.
+# Defaults to hiera('etcd_node_ips', []).
+#
+# [*step*]
+# (Optional) The current step in deployment. See tripleo-heat-templates
+# for more details.
+# Defaults to hiera('step')
+#
+class tripleo::profile::base::etcd (
+ $bind_ip = '127.0.0.1',
+ $client_port = '2379',
+ $peer_port = '2380',
+ $nodes = hiera('etcd_node_names', []),
+ $step = hiera('step'),
+) {
+ if $step >= 1 {
+ if count($nodes) > 1 {
+ $cluster_enabled = true
+ } else {
+ $cluster_enabled = false
+ }
+
+ class {'::etcd':
+ listen_client_urls => "http://${bind_ip}:${client_port}",
+ advertise_client_urls => "http://${bind_ip}:${client_port}",
+ listen_peer_urls => "http://${bind_ip}:${peer_port}",
+ initial_advertise_peer_urls => "http://${bind_ip}:${peer_port}",
+ initial_cluster => regsubst($nodes, '.+', "\\0=http://\\0:${peer_port}"),
+ cluster_enabled => $cluster_enabled,
+ proxy => 'off',
+ }
+ }
+}
diff --git a/manifests/profile/base/glance/api.pp b/manifests/profile/base/glance/api.pp
index 5ba7a0b..e5807f6 100644
--- a/manifests/profile/base/glance/api.pp
+++ b/manifests/profile/base/glance/api.pp
@@ -18,10 +18,43 @@
#
# === Parameters
#
+# [*bootstrap_node*]
+# (Optional) The hostname of the node responsible for bootstrapping tasks
+# Defaults to hiera('bootstrap_nodeid')
+#
+# [*certificates_specs*]
+# (Optional) The specifications to give to certmonger for the certificate(s)
+# it will create.
+# Example with hiera:
+# apache_certificates_specs:
+# httpd-internal_api:
+# hostname: <overcloud controller fqdn>
+# service_certificate: <service certificate path>
+# service_key: <service key path>
+# principal: "haproxy/<overcloud controller fqdn>"
+# Defaults to hiera('apache_certificate_specs', {}).
+#
+# [*enable_internal_tls*]
+# (Optional) Whether TLS in the internal network is enabled or not.
+# Defaults to hiera('enable_internal_tls', false)
+#
+# [*generate_service_certificates*]
+# (Optional) Whether or not certmonger will generate certificates for
+# HAProxy. This could be as many as specified by the $certificates_specs
+# variable.
+# Note that this doesn't configure the certificates in haproxy, it merely
+# creates the certificates.
+# Defaults to hiera('generate_service_certificate', false).
+#
# [*glance_backend*]
# (Optional) Glance backend(s) to use.
# Defaults to downcase(hiera('glance_backend', 'swift'))
#
+# [*glance_network*]
+# (Optional) The network name where the glance endpoint is listening on.
+# This is set by t-h-t.
+# Defaults to hiera('glance_api_network', undef)
+#
# [*glance_nfs_enabled*]
# (Optional) Whether to use NFS mount as 'file' backend storage location.
# Defaults to false
@@ -38,20 +71,74 @@
# [*rabbit_port*]
# IP port for rabbitmq service
# Defaults to hiera('glance::notify::rabbitmq::rabbit_port', 5672)
-
+#
+# [*tls_proxy_bind_ip*]
+# IP on which the TLS proxy will listen on. Required only if
+# enable_internal_tls is set.
+# Defaults to undef
+#
+# [*tls_proxy_fqdn*]
+# fqdn on which the tls proxy will listen on. required only used if
+# enable_internal_tls is set.
+# defaults to undef
+#
+# [*tls_proxy_port*]
+# port on which the tls proxy will listen on. Only used if
+# enable_internal_tls is set.
+# defaults to 9292
+#
class tripleo::profile::base::glance::api (
- $glance_backend = downcase(hiera('glance_backend', 'swift')),
- $glance_nfs_enabled = false,
- $step = hiera('step'),
- $rabbit_hosts = hiera('rabbitmq_node_names', undef),
- $rabbit_port = hiera('glance::notify::rabbitmq::rabbit_port', 5672),
+ $bootstrap_node = hiera('bootstrap_nodeid', undef),
+ $certificates_specs = hiera('apache_certificates_specs', {}),
+ $enable_internal_tls = hiera('enable_internal_tls', false),
+ $generate_service_certificates = hiera('generate_service_certificates', false),
+ $glance_backend = downcase(hiera('glance_backend', 'swift')),
+ $glance_network = hiera('glance_api_network', undef),
+ $glance_nfs_enabled = false,
+ $step = hiera('step'),
+ $rabbit_hosts = hiera('rabbitmq_node_names', undef),
+ $rabbit_port = hiera('glance::notify::rabbitmq::rabbit_port', 5672),
+ $tls_proxy_bind_ip = undef,
+ $tls_proxy_fqdn = undef,
+ $tls_proxy_port = 9292,
) {
+ if $enable_internal_tls and $generate_service_certificates {
+ ensure_resources('tripleo::certmonger::httpd', $certificates_specs)
+ }
+
+ if $::hostname == downcase($bootstrap_node) {
+ $sync_db = true
+ } else {
+ $sync_db = false
+ }
if $step >= 1 and $glance_nfs_enabled {
include ::tripleo::glance::nfs_mount
}
- if $step >= 4 {
+ if $step >= 4 or ($step >= 3 and $sync_db) {
+ if $enable_internal_tls {
+ if !$glance_network {
+ fail('glance_api_network is not set in the hieradata.')
+ }
+ if !$tls_proxy_bind_ip {
+ fail('glance_api_tls_proxy_bind_ip is not set in the hieradata.')
+ }
+ if !$tls_proxy_fqdn {
+ fail('tls_proxy_fqdn is required if internal TLS is enabled.')
+ }
+ $tls_certfile = $certificates_specs["httpd-${glance_network}"]['service_certificate']
+ $tls_keyfile = $certificates_specs["httpd-${glance_network}"]['service_key']
+
+ ::tripleo::tls_proxy { 'glance-api':
+ servername => $tls_proxy_fqdn,
+ ip => $tls_proxy_bind_ip,
+ port => $tls_proxy_port,
+ tls_cert => $tls_certfile,
+ tls_key => $tls_keyfile,
+ notify => Class['::glance::api'],
+ }
+ }
case $glance_backend {
'swift': { $backend_store = 'glance.store.swift.Store' }
'file': { $backend_store = 'glance.store.filesystem.Store' }
@@ -64,8 +151,10 @@ class tripleo::profile::base::glance::api (
# TODO: notifications, scrubber, etc.
include ::glance
include ::glance::config
+ # TODO(jaosorior): Remove bind_host when we set it up conditionally in t-h-t
class { '::glance::api':
- stores => $glance_store,
+ stores => $glance_store,
+ sync_db => $sync_db,
}
$rabbit_endpoints = suffix(any2array($rabbit_hosts), ":${rabbit_port}")
class { '::glance::notify::rabbitmq' :
diff --git a/manifests/profile/base/gnocchi/metricd.pp b/manifests/profile/base/gnocchi/metricd.pp
index e69bbd5..f6f80cd 100644
--- a/manifests/profile/base/gnocchi/metricd.pp
+++ b/manifests/profile/base/gnocchi/metricd.pp
@@ -30,7 +30,5 @@ class tripleo::profile::base::gnocchi::metricd (
if $step >= 5 {
include ::gnocchi::metricd
- Keystone_endpoint<||> -> Service['gnocchi-metricd']
- Keystone_user_role<||> -> Service['gnocchi-metricd']
}
}
diff --git a/manifests/profile/base/gnocchi/statsd.pp b/manifests/profile/base/gnocchi/statsd.pp
index 1fe4067..7c98a0a 100644
--- a/manifests/profile/base/gnocchi/statsd.pp
+++ b/manifests/profile/base/gnocchi/statsd.pp
@@ -30,7 +30,5 @@ class tripleo::profile::base::gnocchi::statsd (
if $step >= 5 {
include ::gnocchi::statsd
- Keystone_endpoint<||> -> Service['gnocchi-statsd']
- Keystone_user_role<||> -> Service['gnocchi-statsd']
}
}
diff --git a/manifests/profile/base/heat.pp b/manifests/profile/base/heat.pp
index c743ce0..1b3cc75 100644
--- a/manifests/profile/base/heat.pp
+++ b/manifests/profile/base/heat.pp
@@ -26,6 +26,30 @@
# (Optional) Whether keystone token flushing should be enabled
# Defaults to hiera('keystone_enable_db_purge', true)
#
+# [*messaging_driver*]
+# Driver for messaging service.
+# Defaults to hiera('messaging_service_name', 'rabbit')
+#
+# [*messaging_hosts*]
+# list of the messaging host fqdns
+# Defaults to hiera('rabbitmq_node_names')
+#
+# [*messaging_password*]
+# Password for messaging heat queue
+# Defaults to hiera('heat::rabbit_password')
+#
+# [*messaging_port*]
+# IP port for messaging service
+# Defaults to hiera('heat::rabbit_port', 5672)
+#
+# [*messaging_username*]
+# Username for messaging heat queue
+# Defaults to hiera('heat::rabbit_userid', 'guest')
+#
+# [*messaging_use_ssl*]
+# Flag indicating ssl usage.
+# Defaults to hiera('heat::rabbit_use_ssl', '0')
+#
# [*notification_driver*]
# (Optional) Heat notification driver to use.
# Defaults to 'messaging'
@@ -35,21 +59,18 @@
# for more details.
# Defaults to hiera('step')
#
-# [*rabbit_hosts*]
-# list of the rabbbit host fqdns
-# Defaults to hiera('rabbitmq_node_names')
-#
-# [*rabbit_port*]
-# IP port for rabbitmq service
-# Defaults to hiera('heat::rabbit_port', 5672)
class tripleo::profile::base::heat (
$bootstrap_node = downcase(hiera('bootstrap_nodeid')),
$manage_db_purge = hiera('heat_enable_db_purge', true),
+ $messaging_driver = hiera('messaging_service_name', 'rabbit'),
+ $messaging_hosts = any2array(hiera('rabbitmq_node_names', undef)),
+ $messaging_password = hiera('heat::rabbit_password'),
+ $messaging_port = hiera('heat::rabbit_port', '5672'),
+ $messaging_username = hiera('heat::rabbit_userid', 'guest'),
+ $messaging_use_ssl = hiera('heat::rabbit_use_ssl', '0'),
$notification_driver = 'messaging',
$step = hiera('step'),
- $rabbit_hosts = hiera('rabbitmq_node_names', undef),
- $rabbit_port = hiera('heat::rabbit_port', 5672),
) {
# Domain resources will be created at step5 on the node running keystone.pp
# configure heat.conf at step3 and 4 but actually create the domain later.
@@ -59,13 +80,21 @@ class tripleo::profile::base::heat (
manage_user => false,
manage_role => false,
}
- }
- if $step >= 4 {
- $rabbit_endpoints = suffix(any2array($rabbit_hosts), ":${rabbit_port}")
+ $messaging_use_ssl_real = sprintf('%s', bool2num(str2bool($messaging_use_ssl)))
+
+ # TODO(ccamacho): remove sprintf once we properly type the port, needs
+ # to be a string for the os_transport_url function.
class { '::heat' :
- notification_driver => $notification_driver,
- rabbit_hosts => $rabbit_endpoints,
+ notification_driver => $notification_driver,
+ default_transport_url => os_transport_url({
+ 'transport' => $messaging_driver,
+ 'hosts' => $messaging_hosts,
+ 'password' => $messaging_password,
+ 'port' => sprintf('%s', $messaging_port),
+ 'username' => $messaging_username,
+ 'ssl' => $messaging_use_ssl_real,
+ }),
}
include ::heat::config
include ::heat::cors
diff --git a/manifests/profile/base/horizon.pp b/manifests/profile/base/horizon.pp
index be07c0e..bd28ab0 100644
--- a/manifests/profile/base/horizon.pp
+++ b/manifests/profile/base/horizon.pp
@@ -30,7 +30,7 @@ class tripleo::profile::base::horizon (
# Horizon
include ::apache::mod::remoteip
include ::apache::mod::status
- if 'cisco_n1kv' in hiera('neutron::plugins::ml2::mechanism_drivers') {
+ if 'cisco_n1kv' in hiera('neutron::plugins::ml2::mechanism_drivers', undef) {
$_profile_support = 'cisco'
} else {
$_profile_support = 'None'
diff --git a/manifests/profile/base/ironic.pp b/manifests/profile/base/ironic.pp
index 5db1e1f..94619ad 100644
--- a/manifests/profile/base/ironic.pp
+++ b/manifests/profile/base/ironic.pp
@@ -54,6 +54,7 @@ class tripleo::profile::base::ironic (
rabbit_hosts => $rabbit_endpoints,
}
+ include ::ironic::config
include ::ironic::cors
}
}
diff --git a/manifests/profile/base/keystone.pp b/manifests/profile/base/keystone.pp
index 26e7b1f..999bcf6 100644
--- a/manifests/profile/base/keystone.pp
+++ b/manifests/profile/base/keystone.pp
@@ -157,22 +157,13 @@ class tripleo::profile::base::keystone (
ssl_key_admin => $tls_keyfile_admin,
}
include ::keystone::cors
-
- if $manage_roles {
- include ::keystone::roles::admin
- }
-
- if $manage_endpoint {
- include ::keystone::endpoint
- }
-
}
- if $step >= 5 and $manage_db_purge {
+ if $step >= 4 and $manage_db_purge {
include ::keystone::cron::token_flush
}
- if $step >= 5 and $manage_domain {
+ if $step == 3 and $manage_domain {
if hiera('heat_engine_enabled', false) {
# create these seperate and don't use ::heat::keystone::domain since
# that class writes out the configs
@@ -193,7 +184,12 @@ class tripleo::profile::base::keystone (
}
}
- if $step >= 5 and $manage_endpoint{
+ if $step == 3 and $manage_roles {
+ include ::keystone::roles::admin
+ }
+
+ if $step == 3 and $manage_endpoint {
+ include ::keystone::endpoint
if hiera('aodh_api_enabled', false) {
include ::aodh::keystone::auth
}
@@ -209,6 +205,9 @@ class tripleo::profile::base::keystone (
if hiera('cinder_api_enabled', false) {
include ::cinder::keystone::auth
}
+ if hiera('congress_enabled', false) {
+ include ::congress::keystone::auth
+ }
if hiera('glance_api_enabled', false) {
include ::glance::keystone::auth
}
@@ -236,6 +235,9 @@ class tripleo::profile::base::keystone (
if hiera('nova_api_enabled', false) {
include ::nova::keystone::auth
}
+ if hiera('nova_placement_enabled', false) {
+ include ::nova::keystone::auth_placement
+ }
if hiera('panko_api_enabled', false) {
include ::panko::keystone::auth
}
@@ -245,6 +247,9 @@ class tripleo::profile::base::keystone (
if hiera('swift_proxy_enabled', false) {
include ::swift::keystone::auth
}
+ if hiera('tacker_enabled', false) {
+ include ::tacker::keystone::auth
+ }
if hiera('trove_api_enabled', false) {
include ::trove::keystone::auth
}
@@ -252,6 +257,8 @@ class tripleo::profile::base::keystone (
include ::zaqar::keystone::auth
include ::zaqar::keystone::auth_websocket
}
+ if hiera('ec2_api_enabled', false) {
+ include ::ec2api::keystone::auth
+ }
}
}
-
diff --git a/manifests/profile/base/metrics/collectd.pp b/manifests/profile/base/metrics/collectd.pp
new file mode 100644
index 0000000..d8e6f89
--- /dev/null
+++ b/manifests/profile/base/metrics/collectd.pp
@@ -0,0 +1,103 @@
+# Copyright 2016 Red Hat, Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License. You may obtain
+# a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations
+# under the License.
+#
+# == Class: tripleo::profile::base::metrics::collectd
+#
+# Collectd configuration for TripleO
+#
+# === Parameters
+#
+# [*step*]
+# (Optional) The current step in deployment. See tripleo-heat-templates
+# for more details.
+# Defaults to hiera('step')
+#
+# [*collectd_server*]
+# (Optional) String. The name or address of a collectd server to
+# which we should send metrics.
+#
+# [*collectd_port*]
+# (Optional) Integer. The port to which we will connect on the
+# collectd server.
+#
+# [*collectd_username*]
+# (Optional) String. Username for authenticating to the remote
+# collectd server.
+#
+# [*collectd_password*]
+# (Optional) String. Password for authenticating to the remote
+# collectd server.
+#
+# [*collectd_securitylevel*]
+# (Optional) String.
+#
+# [*service_names*]
+# (Optional) List of strings. A list of active services in this tripleo
+# deployment. This is used to look up service-specific plugins that
+# need to be installed.
+class tripleo::profile::base::metrics::collectd (
+ $step = hiera('step'),
+
+ $collectd_server = undef,
+ $collectd_port = undef,
+ $collectd_username = undef,
+ $collectd_password = undef,
+ $collectd_securitylevel = undef,
+ $service_names = hiera('service_names', [])
+) {
+ if $step >= 3 {
+ include ::collectd
+
+ if ! ($collectd_securitylevel in [undef, 'None', 'Sign', 'Encrypt']) {
+ fail('collectd_securitylevel must be one of (None, Sign, Encrypt).')
+ }
+
+ # Load per-service plugin configuration
+ ::tripleo::profile::base::metrics::collectd::collectd_service {
+ $service_names: }
+
+ # Because THT doesn't allow us to default values to undef, we need
+ # to perform a number of transformations here to avoid passing a bunch of
+ # empty strings to the collectd plugins.
+
+ $_collectd_username = empty($collectd_username) ? {
+ true => undef,
+ default => $collectd_username
+ }
+
+ $_collectd_password = empty($collectd_password) ? {
+ true => undef,
+ default => $collectd_password
+ }
+
+ $_collectd_port = empty($collectd_port) ? {
+ true => undef,
+ default => $collectd_port
+ }
+
+ $_collectd_securitylevel = empty($collectd_securitylevel) ? {
+ true => undef,
+ default => $collectd_securitylevel
+ }
+
+ if ! empty($collectd_server) {
+ ::collectd::plugin::network::server { $collectd_server:
+ username => $_collectd_username,
+ password => $_collectd_password,
+ port => $_collectd_port,
+ securitylevel => $_collectd_securitylevel,
+ }
+ }
+ }
+}
diff --git a/manifests/profile/base/metrics/collectd/collectd_plugin.pp b/manifests/profile/base/metrics/collectd/collectd_plugin.pp
new file mode 100644
index 0000000..5ab940b
--- /dev/null
+++ b/manifests/profile/base/metrics/collectd/collectd_plugin.pp
@@ -0,0 +1,6 @@
+# We use this to transform a list of unqualified plugin names
+# (like ['disk', 'ntpd']) into the correct collectd plugin classes.
+define tripleo::profile::base::metrics::collectd::collectd_plugin (
+) {
+ include "collectd::plugin::${title}"
+}
diff --git a/manifests/profile/base/metrics/collectd/collectd_service.pp b/manifests/profile/base/metrics/collectd/collectd_service.pp
new file mode 100644
index 0000000..c1b3a60
--- /dev/null
+++ b/manifests/profile/base/metrics/collectd/collectd_service.pp
@@ -0,0 +1,11 @@
+# This is used to look up a list of service-specific collectd plugins
+# in the hiera data provided by THT.
+define tripleo::profile::base::metrics::collectd::collectd_service (
+) {
+ $plugins = hiera("tripleo.collectd.plugins.${title}", [])
+
+ if $plugins {
+ ::tripleo::profile::base::metrics::collectd::collectd_plugin {
+ $plugins: }
+ }
+}
diff --git a/manifests/profile/base/metrics/collectd/plugin_helper.pp b/manifests/profile/base/metrics/collectd/plugin_helper.pp
new file mode 100644
index 0000000..b624ee1
--- /dev/null
+++ b/manifests/profile/base/metrics/collectd/plugin_helper.pp
@@ -0,0 +1,6 @@
+# We use this to transform a list of unqualified plugin names
+# (like ['disk', 'ntpd']) into the correct collectd plugin classes.
+define tripleo::profile::base::metrics::collectd::plugin_helper (
+) {
+ include "collectd::plugin::${title}"
+}
diff --git a/manifests/profile/base/neutron/agents/ovn.pp b/manifests/profile/base/neutron/agents/ovn.pp
index 443b164..a593092 100644
--- a/manifests/profile/base/neutron/agents/ovn.pp
+++ b/manifests/profile/base/neutron/agents/ovn.pp
@@ -17,7 +17,12 @@
# OVN Neutron agent profile for tripleo
#
# [*ovn_db_host*]
-# The IP-Address/Hostname where OVN DBs are deployed
+# (Optional) The IP-Address where OVN DBs are listening.
+# Defaults to hiera('ovn_dbs_vip')
+#
+# [*ovn_sbdb_port*]
+# (Optional) Port number on which southbound database is listening
+# Defaults to hiera('ovn::southbound::port')
#
# [*step*]
# (Optional) The current step in deployment. See tripleo-heat-templates
@@ -25,14 +30,13 @@
# Defaults to hiera('step')
#
class tripleo::profile::base::neutron::agents::ovn (
- $ovn_db_host,
- $step = hiera('step')
+ $ovn_db_host = hiera('ovn_dbs_vip'),
+ $ovn_sbdb_port = hiera('ovn::southbound::port'),
+ $step = hiera('step')
) {
if $step >= 4 {
- $ovn_sbdb_port = hiera('ovn::southbound::port')
class { '::ovn::controller':
ovn_remote => "tcp:${ovn_db_host}:${ovn_sbdb_port}",
- ovn_encap_type => hiera('ovn::southboud::encap_type')
}
}
}
diff --git a/manifests/profile/base/neutron/opendaylight.pp b/manifests/profile/base/neutron/opendaylight.pp
index a3f46ec..556fe63 100644
--- a/manifests/profile/base/neutron/opendaylight.pp
+++ b/manifests/profile/base/neutron/opendaylight.pp
@@ -22,24 +22,19 @@
# (Optional) The current step of the deployment
# Defaults to hiera('step')
#
-# [*primary_controller*]
-# (Optional) The hostname of the first controller
+# [*primary_node*]
+# (Optional) The hostname of the first node of this role type
# Defaults to hiera('bootstrap_nodeid', undef)
#
class tripleo::profile::base::neutron::opendaylight (
- $step = hiera('step'),
- $primary_controller = hiera('bootstrap_nodeid', undef),
+ $step = hiera('step'),
+ $primary_node = hiera('bootstrap_nodeid', undef),
) {
- include ::tripleo::profile::base::neutron
-
- if ! str2bool(hiera('opendaylight::enable_l3')) {
- include ::tripleo::profile::base::neutron::l3
- }
-
if $step >= 1 {
- # Configure ODL only on first controller
- if $primary_controller == downcase($::hostname) {
+ # Configure ODL only on first node of the role where this service is
+ # applied
+ if $primary_node == downcase($::hostname) {
include ::opendaylight
}
}
diff --git a/manifests/profile/base/neutron/ovn_northd.pp b/manifests/profile/base/neutron/ovn_northd.pp
new file mode 100644
index 0000000..0b46d5c
--- /dev/null
+++ b/manifests/profile/base/neutron/ovn_northd.pp
@@ -0,0 +1,40 @@
+# Copyright 2016 Red Hat, Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License. You may obtain
+# a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations
+# under the License.
+#
+# == Class: tripleo::profile::base::neutron::plugins::ml2::ovn
+#
+# OVN Neutron northd profile for tripleo
+#
+# [*bootstrap_node*]
+# (Optional) The hostname of the node responsible for bootstrapping tasks
+# Defaults to hiera('bootstrap_nodeid')
+#
+# [*step*]
+# (Optional) The current step in deployment. See tripleo-heat-templates
+# for more details.
+# Defaults to hiera('step')
+#
+class tripleo::profile::base::neutron::ovn_northd (
+ $bootstrap_node = hiera('bootstrap_nodeid', undef),
+ $step = hiera('step'),
+) {
+ if $step >= 4 {
+ # Note this only runs on the first node in the cluster when
+ # deployed on a role where multiple nodes exist.
+ if $::hostname == downcase($bootstrap_node) {
+ include ::ovn::northd
+ }
+ }
+}
+
diff --git a/manifests/profile/base/neutron/ovs.pp b/manifests/profile/base/neutron/ovs.pp
index a4e0cd3..bec7e96 100644
--- a/manifests/profile/base/neutron/ovs.pp
+++ b/manifests/profile/base/neutron/ovs.pp
@@ -28,7 +28,7 @@ class tripleo::profile::base::neutron::ovs(
) {
include ::tripleo::profile::base::neutron
- if $step >= 4 {
+ if $step >= 5 {
include ::neutron::agents::ml2::ovs
# Optional since manage_service may be false and neutron server may not be colocated.
diff --git a/manifests/profile/base/neutron/plugins/ml2.pp b/manifests/profile/base/neutron/plugins/ml2.pp
index 4f4de0b..52d4ca1 100644
--- a/manifests/profile/base/neutron/plugins/ml2.pp
+++ b/manifests/profile/base/neutron/plugins/ml2.pp
@@ -64,12 +64,22 @@ class tripleo::profile::base::neutron::plugins::ml2 (
include ::neutron::plugins::ml2::bigswitch::restproxy
}
- if 'opendaylight' in $mechanism_drivers {
+ if ('opendaylight' in $mechanism_drivers) or ('opendaylight_v2' in $mechanism_drivers) {
include ::tripleo::profile::base::neutron::plugins::ml2::opendaylight
}
if 'ovn' in $mechanism_drivers {
include ::tripleo::profile::base::neutron::plugins::ml2::ovn
}
+
+ if 'fujitsu_cfab' in $mechanism_drivers {
+ include ::neutron::plugins::ml2::fujitsu
+ include ::neutron::plugins::ml2::fujitsu::cfab
+ }
+
+ if 'fujitsu_fossw' in $mechanism_drivers {
+ include ::neutron::plugins::ml2::fujitsu
+ include ::neutron::plugins::ml2::fujitsu::fossw
+ }
}
}
diff --git a/manifests/profile/base/neutron/plugins/ml2/ovn.pp b/manifests/profile/base/neutron/plugins/ml2/ovn.pp
index 46477a7..b5b7a0a 100644
--- a/manifests/profile/base/neutron/plugins/ml2/ovn.pp
+++ b/manifests/profile/base/neutron/plugins/ml2/ovn.pp
@@ -17,7 +17,16 @@
# OVN Neutron ML2 profile for tripleo
#
# [*ovn_db_host*]
-# The IP-Address/Hostname where OVN DBs are deployed
+# The IP-Address where OVN DBs are listening.
+# Defaults to hiera('ovn_dbs_vip')
+#
+# [*ovn_nb_port*]
+# (Optional) Port number on which northbound database is listening
+# Defaults to hiera('ovn::northbound::port')
+#
+# [*ovn_sb_port*]
+# (Optional) Port number on which southbound database is listening
+# Defaults to hiera('ovn::southbound::port')
#
# [*step*]
# (Optional) The current step in deployment. See tripleo-heat-templates
@@ -25,18 +34,12 @@
# Defaults to hiera('step')
#
class tripleo::profile::base::neutron::plugins::ml2::ovn (
- $ovn_db_host,
- $step = hiera('step')
+ $ovn_db_host = hiera('ovn_dbs_vip'),
+ $ovn_nb_port = hiera('ovn::northbound::port'),
+ $ovn_sb_port = hiera('ovn::southbound::port'),
+ $step = hiera('step')
) {
if $step >= 4 {
- if $::hostname == $ovn_db_host {
- # NOTE: we might split northd from plugin later, in the case of
- # micro-services, where neutron-server & northd are not in the same
- # containers
- include ::ovn::northd
- }
- $ovn_nb_port = hiera('ovn::northbound::port')
- $ovn_sb_port = hiera('ovn::southbound::port')
class { '::neutron::plugins::ml2::ovn':
ovn_nb_connection => "tcp:${ovn_db_host}:${ovn_nb_port}",
ovn_sb_connection => "tcp:${ovn_db_host}:${ovn_sb_port}",
diff --git a/manifests/profile/base/neutron/server.pp b/manifests/profile/base/neutron/server.pp
index 4667ae2..5d6909f 100644
--- a/manifests/profile/base/neutron/server.pp
+++ b/manifests/profile/base/neutron/server.pp
@@ -22,10 +22,34 @@
# (Optional) The hostname of the node responsible for bootstrapping tasks
# Defaults to hiera('bootstrap_nodeid')
#
-# [*step*]
-# (Optional) The current step in deployment. See tripleo-heat-templates
-# for more details.
-# Defaults to hiera('step')
+# [*certificates_specs*]
+# (Optional) The specifications to give to certmonger for the certificate(s)
+# it will create.
+# Example with hiera:
+# apache_certificates_specs:
+# httpd-internal_api:
+# hostname: <overcloud controller fqdn>
+# service_certificate: <service certificate path>
+# service_key: <service key path>
+# principal: "haproxy/<overcloud controller fqdn>"
+# Defaults to hiera('apache_certificate_specs', {}).
+#
+# [*dvr_enabled*]
+# (Optional) Is dvr enabled, used when no override is passed to
+# l3_ha_override to calculate enabling l3 HA.
+# Defaults to hiera('neutron::server::router_distributed') or false
+#
+# [*enable_internal_tls*]
+# (Optional) Whether TLS in the internal network is enabled or not.
+# Defaults to hiera('enable_internal_tls', false)
+#
+# [*generate_service_certificates*]
+# (Optional) Whether or not certmonger will generate certificates for
+# HAProxy. This could be as many as specified by the $certificates_specs
+# variable.
+# Note that this doesn't configure the certificates in haproxy, it merely
+# creates the certificates.
+# Defaults to hiera('generate_service_certificate', false).
#
# [*l3_ha_override*]
# (Optional) Override the calculated value for neutron::server::l3_ha
@@ -41,17 +65,49 @@
# (we need to default neutron_l3_short_node_names to an empty list
# because some neutron backends disable the l3 agent)
#
-# [*dvr_enabled*]
-# (Optional) Is dvr enabled, used when no override is passed to
-# l3_ha_override to calculate enabling l3 HA.
-# Defaults to hiera('neutron::server::router_distributed') or false
+# [*neutron_network*]
+# (Optional) The network name where the neutron endpoint is listening on.
+# This is set by t-h-t.
+# Defaults to hiera('neutron_api_network', undef)
+#
+# [*step*]
+# (Optional) The current step in deployment. See tripleo-heat-templates
+# for more details.
+# Defaults to hiera('step')
+#
+# [*tls_proxy_bind_ip*]
+# IP on which the TLS proxy will listen on. Required only if
+# enable_internal_tls is set.
+# Defaults to undef
+#
+# [*tls_proxy_fqdn*]
+# fqdn on which the tls proxy will listen on. required only used if
+# enable_internal_tls is set.
+# defaults to undef
+#
+# [*tls_proxy_port*]
+# port on which the tls proxy will listen on. Only used if
+# enable_internal_tls is set.
+# defaults to 9696
+#
class tripleo::profile::base::neutron::server (
- $bootstrap_node = hiera('bootstrap_nodeid', undef),
- $step = hiera('step'),
- $l3_ha_override = '',
- $l3_nodes = hiera('neutron_l3_short_node_names', []),
- $dvr_enabled = hiera('neutron::server::router_distributed', false)
+ $bootstrap_node = hiera('bootstrap_nodeid', undef),
+ $certificates_specs = hiera('apache_certificates_specs', {}),
+ $dvr_enabled = hiera('neutron::server::router_distributed', false),
+ $enable_internal_tls = hiera('enable_internal_tls', false),
+ $generate_service_certificates = hiera('generate_service_certificates', false),
+ $l3_ha_override = '',
+ $l3_nodes = hiera('neutron_l3_short_node_names', []),
+ $neutron_network = hiera('neutron_api_network', undef),
+ $step = hiera('step'),
+ $tls_proxy_bind_ip = undef,
+ $tls_proxy_fqdn = undef,
+ $tls_proxy_port = 9696,
) {
+ if $enable_internal_tls and $generate_service_certificates {
+ ensure_resources('tripleo::certmonger::httpd', $certificates_specs)
+ }
+
if $::hostname == downcase($bootstrap_node) {
$sync_db = true
} else {
@@ -73,7 +129,24 @@ class tripleo::profile::base::neutron::server (
# We start neutron-server on the bootstrap node first, because
# it will try to populate tables and we need to make sure this happens
# before it starts on other nodes
- if $step >= 4 and $sync_db {
+ if $step >= 4 and $sync_db or $step >= 5 and !$sync_db {
+ if $enable_internal_tls {
+ if !$neutron_network {
+ fail('neutron_api_network is not set in the hieradata.')
+ }
+ $tls_certfile = $certificates_specs["httpd-${neutron_network}"]['service_certificate']
+ $tls_keyfile = $certificates_specs["httpd-${neutron_network}"]['service_key']
+
+ ::tripleo::tls_proxy { 'neutron-api':
+ servername => $tls_proxy_fqdn,
+ ip => $tls_proxy_bind_ip,
+ port => $tls_proxy_port,
+ tls_cert => $tls_certfile,
+ tls_key => $tls_keyfile,
+ notify => Class['::neutron::server'],
+ }
+ }
+
include ::neutron::server::notifications
# We need to override the hiera value neutron::server::sync_db which is set
# to true
@@ -82,11 +155,4 @@ class tripleo::profile::base::neutron::server (
l3_ha => $l3_ha,
}
}
- if $step >= 5 and !$sync_db {
- include ::neutron::server::notifications
- class { '::neutron::server':
- sync_db => $sync_db,
- l3_ha => $l3_ha,
- }
- }
}
diff --git a/manifests/profile/base/nova.pp b/manifests/profile/base/nova.pp
index 7f1c862..cb34521 100644
--- a/manifests/profile/base/nova.pp
+++ b/manifests/profile/base/nova.pp
@@ -30,6 +30,30 @@
# (Optional) Whether or not manage Nova Live migration
# Defaults to false
#
+# [*messaging_driver*]
+# Driver for messaging service.
+# Defaults to hiera('messaging_service_name', 'rabbit')
+#
+# [*messaging_hosts*]
+# list of the messaging host fqdns
+# Defaults to hiera('rabbitmq_node_names')
+#
+# [*messaging_password*]
+# Password for messaging nova queue
+# Defaults to hiera('nova::rabbit_password')
+#
+# [*messaging_port*]
+# IP port for messaging service
+# Defaults to hiera('nova::rabbit_port', 5672)
+#
+# [*messaging_username*]
+# Username for messaging nova queue
+# Defaults to hiera('nova::rabbit_userid', 'guest')
+#
+# [*messaging_use_ssl*]
+# Flag indicating ssl usage.
+# Defaults to hiera('nova::rabbit_use_ssl', '0')
+#
# [*nova_compute_enabled*]
# (Optional) Whether or not nova-compute is enabled.
# Defaults to false
@@ -38,22 +62,18 @@
# (Optional) The current step of the deployment
# Defaults to hiera('step')
#
-# [*rabbit_hosts*]
-# list of the rabbbit host fqdns
-# Defaults to hiera('rabbitmq_node_names')
-#
-# [*rabbit_port*]
-# IP port for rabbitmq service
-# Defaults to hiera('nova::rabbit_port', 5672)
-
class tripleo::profile::base::nova (
$bootstrap_node = hiera('bootstrap_nodeid', undef),
$libvirt_enabled = false,
$manage_migration = false,
+ $messaging_driver = hiera('messaging_service_name', 'rabbit'),
+ $messaging_hosts = any2array(hiera('rabbitmq_node_names', undef)),
+ $messaging_password = hiera('nova::rabbit_password'),
+ $messaging_port = hiera('nova::rabbit_port', '5672'),
+ $messaging_username = hiera('nova::rabbit_userid', 'guest'),
+ $messaging_use_ssl = hiera('nova::rabbit_use_ssl', '0'),
$nova_compute_enabled = false,
$step = hiera('step'),
- $rabbit_hosts = hiera('rabbitmq_node_names', undef),
- $rabbit_port = hiera('nova::rabbit_port', 5672),
) {
if $::hostname == downcase($bootstrap_node) {
$sync_db = true
@@ -67,10 +87,19 @@ class tripleo::profile::base::nova (
$memcache_servers = suffix(hiera('memcached_node_ips'), ':11211')
}
- if hiera('step') >= 4 or (hiera('step') >= 3 and $sync_db) {
- $rabbit_endpoints = suffix(any2array($rabbit_hosts), ":${rabbit_port}")
+ if $step >= 4 or ($step >= 3 and $sync_db) {
+ $messaging_use_ssl_real = sprintf('%s', bool2num(str2bool($messaging_use_ssl)))
+ # TODO(ccamacho): remove sprintf once we properly type the port, needs
+ # to be a string for the os_transport_url function.
class { '::nova' :
- rabbit_hosts => $rabbit_endpoints,
+ default_transport_url => os_transport_url({
+ 'transport' => $messaging_driver,
+ 'hosts' => $messaging_hosts,
+ 'port' => sprintf('%s', $messaging_port),
+ 'username' => $messaging_username,
+ 'password' => $messaging_password,
+ 'ssl' => $messaging_use_ssl_real,
+ }),
}
include ::nova::config
class { '::nova::cache':
@@ -78,6 +107,7 @@ class tripleo::profile::base::nova (
backend => 'oslo_cache.memcache_pool',
memcache_servers => $memcache_servers,
}
+ include ::nova::placement
}
if $step >= 4 {
diff --git a/manifests/profile/base/nova/api.pp b/manifests/profile/base/nova/api.pp
index e660990..287d14c 100644
--- a/manifests/profile/base/nova/api.pp
+++ b/manifests/profile/base/nova/api.pp
@@ -49,6 +49,11 @@
# This is set by t-h-t.
# Defaults to hiera('nova_api_network', undef)
#
+# [*nova_api_wsgi_enabled*]
+# (Optional) Whether or not deploy Nova API in WSGI with Apache.
+# Nova Team discourages it.
+# Defaults to hiera('nova_wsgi_enabled', false)
+#
# [*step*]
# (Optional) The current step in deployment. See tripleo-heat-templates
# for more details.
@@ -60,6 +65,7 @@ class tripleo::profile::base::nova::api (
$enable_internal_tls = hiera('enable_internal_tls', false),
$generate_service_certificates = hiera('generate_service_certificates', false),
$nova_api_network = hiera('nova_api_network', undef),
+ $nova_api_wsgi_enabled = hiera('nova_wsgi_enabled', false),
$step = hiera('step'),
) {
if $::hostname == downcase($bootstrap_node) {
@@ -70,19 +76,8 @@ class tripleo::profile::base::nova::api (
include ::tripleo::profile::base::nova
- if $enable_internal_tls {
- if $generate_service_certificates {
- ensure_resources('tripleo::certmonger::httpd', $certificates_specs)
- }
-
- if !$nova_api_network {
- fail('nova_api_network is not set in the hieradata.')
- }
- $tls_certfile = $certificates_specs["httpd-${nova_api_network}"]['service_certificate']
- $tls_keyfile = $certificates_specs["httpd-${nova_api_network}"]['service_key']
- } else {
- $tls_certfile = undef
- $tls_keyfile = undef
+ if $step >= 3 and $sync_db {
+ include ::nova::cell_v2::simple_setup
}
if $step >= 4 or ($step >= 3 and $sync_db) {
@@ -101,17 +96,44 @@ class tripleo::profile::base::nova::api (
sync_db => $sync_db,
sync_db_api => $sync_db,
}
- class { '::nova::wsgi::apache':
- ssl_cert => $tls_certfile,
- ssl_key => $tls_keyfile,
- }
include ::nova::network::neutron
}
+ # Temporarily disable Nova API deployed in WSGI
+ # https://bugs.launchpad.net/nova/+bug/1661360
+ if $nova_api_wsgi_enabled {
+ if $enable_internal_tls {
+ if $generate_service_certificates {
+ ensure_resources('tripleo::certmonger::httpd', $certificates_specs)
+ }
+
+ if !$nova_api_network {
+ fail('nova_api_network is not set in the hieradata.')
+ }
+ $tls_certfile = $certificates_specs["httpd-${nova_api_network}"]['service_certificate']
+ $tls_keyfile = $certificates_specs["httpd-${nova_api_network}"]['service_key']
+ } else {
+ $tls_certfile = undef
+ $tls_keyfile = undef
+ }
+ if $step >= 4 or ($step >= 3 and $sync_db) {
+ class { '::nova::wsgi::apache_api':
+ ssl_cert => $tls_certfile,
+ ssl_key => $tls_keyfile,
+ }
+ }
+ }
if $step >= 5 {
if hiera('nova_enable_db_purge', true) {
include ::nova::cron::archive_deleted_rows
}
+ # At step 5, we consider all nova-compute services started and registred to nova-conductor
+ # So we want to update Nova Cells database to be aware of these hosts by executing the
+ # nova-cell_v2-discover_hosts command again.
+ # Doing it on a single nova-api node to avoid race condition.
+ if $sync_db {
+ Exec<| title == 'nova-cell_v2-discover_hosts' |> { refreshonly => false }
+ }
}
}
diff --git a/manifests/profile/base/nova/compute.pp b/manifests/profile/base/nova/compute.pp
index 076996a..0eb2ed7 100644
--- a/manifests/profile/base/nova/compute.pp
+++ b/manifests/profile/base/nova/compute.pp
@@ -42,6 +42,7 @@ class tripleo::profile::base::nova::compute (
# before nova-compute.
Service<| title == 'nova-conductor' |> -> Service['nova-compute']
+
# deploy bits to connect nova compute to neutron
include ::nova::network::neutron
diff --git a/manifests/profile/base/nova/compute/libvirt.pp b/manifests/profile/base/nova/compute/libvirt.pp
index 956f8ad..cc9beb6 100644
--- a/manifests/profile/base/nova/compute/libvirt.pp
+++ b/manifests/profile/base/nova/compute/libvirt.pp
@@ -40,26 +40,17 @@ class tripleo::profile::base::nova::compute::libvirt (
}
}
- # TODO(emilien): Some work needs to be done in puppet-nova to separate nova-compute config
- # when running libvirt and libvirt itself, so we allow micro-services deployments.
- if str2bool(hiera('nova::use_ipv6', false)) {
- $vncserver_listen = '::0'
- } else {
- $vncserver_listen = '0.0.0.0'
- }
-
if $rbd_ephemeral_storage {
class { '::nova::compute::libvirt':
libvirt_disk_cachemodes => ['network=writeback'],
libvirt_hw_disk_discard => 'unmap',
- vncserver_listen => $vncserver_listen,
}
} else {
- class { '::nova::compute::libvirt' :
- vncserver_listen => $vncserver_listen,
- }
+ include ::nova::compute::libvirt
}
+ include ::nova::compute::libvirt::qemu
+
}
}
diff --git a/manifests/profile/base/nova/ec2api.pp b/manifests/profile/base/nova/ec2api.pp
new file mode 100644
index 0000000..f34b071
--- /dev/null
+++ b/manifests/profile/base/nova/ec2api.pp
@@ -0,0 +1,35 @@
+# Copyright 2016 Red Hat, Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License. You may obtain
+# a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations
+# under the License.
+#
+# == Class: tripleo::profile::base::nova::ec2api
+#
+# EC2-compatible Nova API profile for tripleo
+#
+# === Parameters
+#
+# [*step*]
+# (Optional) The current step in deployment. See tripleo-heat-templates
+# for more details.
+# Defaults to hiera('step')
+#
+class tripleo::profile::base::nova::ec2api (
+ $step = hiera('step')
+) {
+ if $step >= 4 {
+ include ::ec2api
+ include ::ec2api::api
+ include ::ec2api::db::sync
+ include ::ec2api::metadata
+ }
+}
diff --git a/manifests/profile/base/nova/placement.pp b/manifests/profile/base/nova/placement.pp
new file mode 100644
index 0000000..c429373
--- /dev/null
+++ b/manifests/profile/base/nova/placement.pp
@@ -0,0 +1,96 @@
+# Copyright 2016 Red Hat, Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License. You may obtain
+# a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations
+# under the License.
+#
+# == Class: tripleo::profile::base::nova::placement
+#
+# Nova Placement API profile for tripleo
+#
+# [*bootstrap_node*]
+# (Optional) The hostname of the node responsible for bootstrapping tasks
+# Defaults to hiera('bootstrap_nodeid')
+#
+# [*certificates_specs*]
+# (Optional) The specifications to give to certmonger for the certificate(s)
+# it will create.
+# Example with hiera:
+# apache_certificates_specs:
+# httpd-internal_api:
+# hostname: <overcloud controller fqdn>
+# service_certificate: <service certificate path>
+# service_key: <service key path>
+# principal: "haproxy/<overcloud controller fqdn>"
+# Defaults to hiera('apache_certificate_specs', {}).
+#
+# [*enable_internal_tls*]
+# (Optional) Whether TLS in the internal network is enabled or not.
+# Defaults to hiera('enable_internal_tls', false)
+#
+# [*generate_service_certificates*]
+# (Optional) Whether or not certmonger will generate certificates for
+# HAProxy. This could be as many as specified by the $certificates_specs
+# variable.
+# Note that this doesn't configure the certificates in haproxy, it merely
+# creates the certificates.
+# Defaults to hiera('generate_service_certificate', false).
+#
+# [*nova_placement_network*]
+# (Optional) The network name where the nova placement endpoint is listening on.
+# This is set by t-h-t.
+# Defaults to hiera('nova_placement_network', undef)
+#
+# [*step*]
+# (Optional) The current step in deployment. See tripleo-heat-templates
+# for more details.
+# Defaults to hiera('step')
+#
+class tripleo::profile::base::nova::placement (
+ $bootstrap_node = hiera('bootstrap_nodeid', undef),
+ $certificates_specs = hiera('apache_certificates_specs', {}),
+ $enable_internal_tls = hiera('enable_internal_tls', false),
+ $generate_service_certificates = hiera('generate_service_certificates', false),
+ $nova_placement_network = hiera('nova_placement_network', undef),
+ $step = hiera('step'),
+) {
+ if $::hostname == downcase($bootstrap_node) {
+ $sync_db = true
+ } else {
+ $sync_db = false
+ }
+
+ include ::tripleo::profile::base::nova
+
+ if $enable_internal_tls {
+ if $generate_service_certificates {
+ ensure_resources('tripleo::certmonger::httpd', $certificates_specs)
+ }
+
+ if !$nova_placement_network {
+ fail('nova_placement_network is not set in the hieradata.')
+ }
+ $tls_certfile = $certificates_specs["httpd-${nova_placement_network}"]['service_certificate']
+ $tls_keyfile = $certificates_specs["httpd-${nova_placement_network}"]['service_key']
+ } else {
+ $tls_certfile = undef
+ $tls_keyfile = undef
+ }
+
+ if $step >= 3 {
+ class { '::nova::wsgi::apache_placement':
+ ssl_cert => $tls_certfile,
+ ssl_key => $tls_keyfile,
+ }
+ }
+
+}
+
diff --git a/manifests/profile/base/octavia.pp b/manifests/profile/base/octavia.pp
new file mode 100644
index 0000000..46ca009
--- /dev/null
+++ b/manifests/profile/base/octavia.pp
@@ -0,0 +1,57 @@
+# Copyright 2016 Red Hat, Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License. You may obtain
+# a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations
+# under the License.
+#
+# == Class: tripleo::profile::base::octavia
+#
+# Octavia server profile for tripleo
+#
+# === Parameters
+#
+# [*step*]
+# (Optional) The current step of the deployment
+# Defaults to hiera('step')
+#
+# [*rabbit_user*]
+# [*rabbit_password*]
+# (Optional) RabbitMQ user details
+# Defaults to undef
+#
+# [*rabbit_hosts*]
+# list of the rabbbit host fqdns
+# Defaults to hiera('rabbitmq_node_names')
+#
+# [*rabbit_port*]
+# IP port for rabbitmq service
+# Defaults to 5672.
+#
+class tripleo::profile::base::octavia (
+ $step = hiera('step'),
+ $rabbit_user = undef,
+ $rabbit_password = undef,
+ $rabbit_hosts = hiera('rabbitmq_node_names', undef),
+ $rabbit_port = '5672'
+) {
+ if $step >= 3 {
+ class { '::octavia' :
+ default_transport_url => os_transport_url({
+ 'transport' => 'rabbit',
+ 'hosts' => $rabbit_hosts,
+ 'port' => sprintf('%s', $rabbit_port),
+ 'username' => $rabbit_user,
+ 'password' => $rabbit_password
+ })
+ }
+ include ::octavia::config
+ }
+}
diff --git a/manifests/profile/base/glance/registry.pp b/manifests/profile/base/octavia/api.pp
index 9e2be9d..d457478 100644
--- a/manifests/profile/base/glance/registry.pp
+++ b/manifests/profile/base/octavia/api.pp
@@ -12,9 +12,9 @@
# License for the specific language governing permissions and limitations
# under the License.
#
-# == Class: tripleo::profile::base::glance::registry
+# == Class: tripleo::profile::base::octavia::api
#
-# Glance Registry profile for tripleo
+# Octavia API server profile for tripleo
#
# === Parameters
#
@@ -22,18 +22,13 @@
# (Optional) The hostname of the node responsible for bootstrapping tasks
# Defaults to hiera('bootstrap_nodeid')
#
-# [*glance_backend*]
-# (Optional) Glance backend(s) to use.
-# Defaults to downcase(hiera('glance_backend', 'swift'))
-#
# [*step*]
# (Optional) The current step in deployment. See tripleo-heat-templates
# for more details.
# Defaults to hiera('step')
#
-class tripleo::profile::base::glance::registry (
+class tripleo::profile::base::octavia::api (
$bootstrap_node = hiera('bootstrap_nodeid', undef),
- $glance_backend = downcase(hiera('glance_backend', 'swift')),
$step = hiera('step'),
) {
if $::hostname == downcase($bootstrap_node) {
@@ -42,15 +37,18 @@ class tripleo::profile::base::glance::registry (
$sync_db = false
}
- if $step >= 4 or ( $step >= 3 and $sync_db ) {
- # TODO: notifications, scrubber, etc.
- include ::glance
- include ::glance::config
- class { '::glance::registry' :
- sync_db => $sync_db,
- }
- include ::glance::notify::rabbitmq
- include join(['::glance::backend::', $glance_backend])
+ include ::tripleo::profile::base::octavia
+
+ if $step >= 3 and $sync_db {
+ include ::octavia::db::mysql
}
+ # We start the Octavia API server on the bootstrap node first, because
+ # it will try to populate tables and we need to make sure this happens
+ # before it starts on other nodes
+ if ($step >= 4 and $sync_db) or ($step >= 5 and !$sync_db) {
+ class { '::octavia::api':
+ sync_db => $sync_db,
+ }
+ }
}
diff --git a/manifests/profile/base/octavia/health_manager.pp b/manifests/profile/base/octavia/health_manager.pp
new file mode 100644
index 0000000..bac5f65
--- /dev/null
+++ b/manifests/profile/base/octavia/health_manager.pp
@@ -0,0 +1,33 @@
+# Copyright 2016 Red Hat, Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License. You may obtain
+# a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations
+# under the License.
+#
+# == Class: tripleo::profile::base::octavia::health_manager
+#
+# Octavia Health Manager server for tripleo
+#
+# === Parameters
+#
+# [*step*]
+# (Optional) The current step in deployment. See tripleo-heat-templates
+# for more details.
+# Defaults to hiera('step')
+#
+class tripleo::profile::base::octavia::health_manager (
+ $step = hiera('step'),
+) {
+ include ::tripleo::profile::base::octavia
+ if $step >= 5 {
+ include ::octavia::health_manager
+ }
+}
diff --git a/manifests/profile/base/octavia/housekeeping.pp b/manifests/profile/base/octavia/housekeeping.pp
new file mode 100644
index 0000000..0dcd5cf
--- /dev/null
+++ b/manifests/profile/base/octavia/housekeeping.pp
@@ -0,0 +1,34 @@
+# Copyright 2016 Red Hat, Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License. You may obtain
+# a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations
+# under the License.
+#
+# == Class: tripleo::profile::base::octavia::housekeeping
+#
+# Octavia Housekeeping profile for tripleo
+#
+# === Parameters
+#
+# [*step*]
+# (Optional) The current step in deployment. See tripleo-heat-templates
+# for more details.
+# Defaults to hiera('step')
+#
+class tripleo::profile::base::octavia::housekeeping (
+ $step = hiera('step'),
+) {
+ include ::tripleo::profile::base::octavia
+
+ if $step >= 5 {
+ include ::octavia::housekeeping
+ }
+}
diff --git a/manifests/profile/base/octavia/worker.pp b/manifests/profile/base/octavia/worker.pp
new file mode 100644
index 0000000..7df324d
--- /dev/null
+++ b/manifests/profile/base/octavia/worker.pp
@@ -0,0 +1,34 @@
+# Copyright 2016 Red Hat, Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License. You may obtain
+# a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations
+# under the License.
+#
+# == Class: tripleo::profile::base::octavia::worker
+#
+# Octavia Worker profile for tripleo
+#
+# === Parameters
+#
+# [*step*]
+# (Optional) The current step in deployment. See tripleo-heat-templates
+# for more details.
+# Defaults to hiera('step')
+#
+class tripleo::profile::base::octavia::worker (
+ $step = hiera('step'),
+) {
+ include ::tripleo::profile::base::octavia
+
+ if $step >= 5 {
+ include ::octavia::worker
+ }
+}
diff --git a/manifests/profile/base/pacemaker.pp b/manifests/profile/base/pacemaker.pp
index cc5fd8a..6021731 100644
--- a/manifests/profile/base/pacemaker.pp
+++ b/manifests/profile/base/pacemaker.pp
@@ -23,15 +23,60 @@
# for more details.
# Defaults to hiera('step')
#
+# [*pcs_tries*]
+# (Optional) The number of times pcs commands should be retried.
+# Defaults to hiera('pcs_tries', 20)
+#
+# [*remote_short_node_names*]
+# (Optional) List of short node names for pacemaker remote nodes
+# Defaults to hiera('pacemaker_remote_short_node_names', [])
+#
+# [*remote_node_ips*]
+# (Optional) List of node ips for pacemaker remote nodes
+# Defaults to hiera('pacemaker_remote_node_ips', [])
+#
+# [*remote_authkey*]
+# (Optional) Authkey for pacemaker remote nodes
+# Defaults to undef
+#
+# [*remote_reconnect_interval*]
+# (Optional) Reconnect interval for the remote
+# Defaults to hiera('pacemaker_remote_reconnect_interval', 60)
+#
+# [*remote_monitor_interval*]
+# (Optional) Monitor interval for the remote
+# Defaults to hiera('pacemaker_monitor_reconnect_interval', 20)
+#
+# [*remote_tries*]
+# (Optional) Number of tries for the remote resource creation
+# Defaults to hiera('pacemaker_remote_tries', 5)
+#
+# [*remote_try_sleep*]
+# (Optional) Number of seconds to sleep between remote creation tries
+# Defaults to hiera('pacemaker_remote_try_sleep', 60)
+#
class tripleo::profile::base::pacemaker (
- $step = hiera('step'),
+ $step = hiera('step'),
+ $pcs_tries = hiera('pcs_tries', 20),
+ $remote_short_node_names = hiera('pacemaker_remote_short_node_names', []),
+ $remote_node_ips = hiera('pacemaker_remote_node_ips', []),
+ $remote_authkey = undef,
+ $remote_reconnect_interval = hiera('pacemaker_remote_reconnect_interval', 60),
+ $remote_monitor_interval = hiera('pacemaker_remote_monitor_interval', 20),
+ $remote_tries = hiera('pacemaker_remote_tries', 5),
+ $remote_try_sleep = hiera('pacemaker_remote_try_sleep', 60),
) {
+
+ if count($remote_short_node_names) != count($remote_node_ips) {
+ fail("Count of ${remote_short_node_names} is not equal to count of ${remote_node_ips}")
+ }
+
Pcmk_resource <| |> {
tries => 10,
try_sleep => 3,
}
- if $::hostname == downcase(hiera('bootstrap_nodeid')) {
+ if $::hostname == downcase(hiera('pacemaker_short_bootstrap_node_name')) {
$pacemaker_master = true
} else {
$pacemaker_master = false
@@ -40,7 +85,8 @@ class tripleo::profile::base::pacemaker (
$enable_fencing = str2bool(hiera('enable_fencing', false)) and $step >= 5
if $step >= 1 {
- $pacemaker_cluster_members = downcase(regsubst(hiera('controller_node_names'), ',', ' ', 'G'))
+ $pacemaker_short_node_names = join(hiera('pacemaker_short_node_names'), ',')
+ $pacemaker_cluster_members = downcase(regsubst($pacemaker_short_node_names, ',', ' ', 'G'))
$corosync_ipv6 = str2bool(hiera('corosync_ipv6', false))
if $corosync_ipv6 {
$cluster_setup_extras = { '--token' => hiera('corosync_token_timeout', 1000), '--ipv6' => '' }
@@ -54,9 +100,11 @@ class tripleo::profile::base::pacemaker (
cluster_members => $pacemaker_cluster_members,
setup_cluster => $pacemaker_master,
cluster_setup_extras => $cluster_setup_extras,
+ remote_authkey => $remote_authkey,
}
class { '::pacemaker::stonith':
disable => !$enable_fencing,
+ tries => $pcs_tries,
}
if $enable_fencing {
include ::tripleo::fencing
@@ -68,6 +116,21 @@ class tripleo::profile::base::pacemaker (
# enable stonith after all fencing devices have been created
Class['tripleo::fencing'] -> Class['pacemaker::stonith']
}
+ # We have pacemaker remote nodes configured so let's add them as resources
+ # We do this during step 1 right after wait-for-settle, because during step 2
+ # resources might already be created on pacemaker remote nodes and we need
+ # a guarantee that remote nodes are already up
+ if $pacemaker_master and count($remote_short_node_names) > 0 {
+ # Creates a { "node" => "ip_address", ...} hash
+ $remotes_hash = hash(zip($remote_short_node_names, $remote_node_ips))
+ pacemaker::resource::remote { $remote_short_node_names:
+ remote_address => $remotes_hash[$title],
+ reconnect_interval => $remote_reconnect_interval,
+ op_params => "monitor interval=${remote_monitor_interval}",
+ tries => $remote_tries,
+ try_sleep => $remote_try_sleep,
+ }
+ }
}
if $step >= 2 {
diff --git a/manifests/profile/base/pacemaker_remote.pp b/manifests/profile/base/pacemaker_remote.pp
new file mode 100644
index 0000000..e0fff63
--- /dev/null
+++ b/manifests/profile/base/pacemaker_remote.pp
@@ -0,0 +1,37 @@
+# Copyright 2016 Red Hat, Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License. You may obtain
+# a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations
+# under the License.
+#
+# == Class: tripleo::profile::base::pacemaker_remote
+#
+# Pacemaker remote profile for tripleo
+#
+# === Parameters
+#
+# [*remote_authkey*]
+# Authkey for pacemaker remote nodes
+# Defaults to unset
+#
+# [*step*]
+# (Optional) The current step in deployment. See tripleo-heat-templates
+# for more details.
+# Defaults to hiera('step')
+#
+class tripleo::profile::base::pacemaker_remote (
+ $remote_authkey,
+ $step = hiera('step'),
+) {
+ class { '::pacemaker::remote':
+ remote_authkey => $remote_authkey,
+ }
+}
diff --git a/manifests/profile/base/panko.pp b/manifests/profile/base/panko.pp
index 4abed56..880cf7d 100644
--- a/manifests/profile/base/panko.pp
+++ b/manifests/profile/base/panko.pp
@@ -40,6 +40,7 @@ class tripleo::profile::base::panko (
if $step >= 4 or ($step >= 3 and $sync_db) {
include ::panko
+ include ::panko::db
include ::panko::config
include ::panko::db::sync
}
diff --git a/manifests/profile/base/rabbitmq.pp b/manifests/profile/base/rabbitmq.pp
index 15bab44..1eaabf0 100644
--- a/manifests/profile/base/rabbitmq.pp
+++ b/manifests/profile/base/rabbitmq.pp
@@ -34,22 +34,43 @@
# (Optional) RabbitMQ environment.
# Defaults to hiera('rabbitmq_environment').
#
+# [*inet_dist_interface*]
+# (Optional) Address to bind the inter-cluster interface
+# to. It is the inet_dist_use_interface option in the kernel variables
+# Defaults to hiera('rabbitmq::interface', undef).
+#
# [*nodes*]
# (Optional) Array of host(s) for RabbitMQ nodes.
# Defaults to hiera('rabbitmq_node_names', []).
#
+# [*rabbitmq_pass*]
+# (Optional) RabbitMQ Default Password.
+# Defaults to hiera('rabbitmq::default_pass')
+#
+# [*rabbitmq_user*]
+# (Optional) RabbitMQ Default User.
+# Defaults to hiera('rabbitmq::default_user')
+#
+# [*stack_action*]
+# (Optional) Action of the stack deployment.
+# Defaults to hiera('stack_action')
+#
# [*step*]
# (Optional) The current step in deployment. See tripleo-heat-templates
# for more details.
# Defaults to hiera('step')
#
class tripleo::profile::base::rabbitmq (
- $config_variables = hiera('rabbitmq_config_variables'),
- $environment = hiera('rabbitmq_environment'),
- $ipv6 = str2bool(hiera('rabbit_ipv6', false)),
- $kernel_variables = hiera('rabbitmq_kernel_variables'),
- $nodes = hiera('rabbitmq_node_names', []),
- $step = hiera('step'),
+ $config_variables = hiera('rabbitmq_config_variables'),
+ $environment = hiera('rabbitmq_environment'),
+ $ipv6 = str2bool(hiera('rabbit_ipv6', false)),
+ $kernel_variables = hiera('rabbitmq_kernel_variables'),
+ $inet_dist_interface = hiera('rabbitmq::interface', undef),
+ $nodes = hiera('rabbitmq_node_names', []),
+ $rabbitmq_pass = hiera('rabbitmq::default_pass'),
+ $rabbitmq_user = hiera('rabbitmq::default_user'),
+ $stack_action = hiera('stack_action'),
+ $step = hiera('step'),
) {
# IPv6 environment, necessary for RabbitMQ.
if $ipv6 {
@@ -60,6 +81,14 @@ class tripleo::profile::base::rabbitmq (
} else {
$rabbit_env = $environment
}
+ if $inet_dist_interface {
+ $real_kernel_variables = merge(
+ $kernel_variables,
+ { 'inet_dist_use_interface' => ip_to_erl_format($inet_dist_interface) },
+ )
+ } else {
+ $real_kernel_variables = $kernel_variables
+ }
$manage_service = hiera('rabbitmq::service_manage', true)
if $step >= 1 {
@@ -68,7 +97,7 @@ class tripleo::profile::base::rabbitmq (
class { '::rabbitmq':
config_cluster => $manage_service,
cluster_nodes => $nodes,
- config_kernel_variables => $kernel_variables,
+ config_kernel_variables => $real_kernel_variables,
config_variables => $config_variables,
environment_variables => $rabbit_env,
}
@@ -89,6 +118,17 @@ class tripleo::profile::base::rabbitmq (
environment_variables => $rabbit_env,
}
}
+ # In case of HA, starting of rabbitmq-server is managed by pacemaker, because of which, a dependency
+ # to Service['rabbitmq-server'] will not work. Sticking with UPDATE action.
+ if $stack_action == 'UPDATE' {
+ # Required for changing password on update scenario. Password will be changed only when
+ # called explicity, if the rabbitmq service is already running.
+ rabbitmq_user { $rabbitmq_user :
+ password => $rabbitmq_pass,
+ provider => 'rabbitmqctl',
+ admin => true,
+ }
+ }
}
}
diff --git a/manifests/profile/base/sshd.pp b/manifests/profile/base/sshd.pp
new file mode 100644
index 0000000..e7916c1
--- /dev/null
+++ b/manifests/profile/base/sshd.pp
@@ -0,0 +1,61 @@
+# Copyright 2016 Red Hat, Inc.
+# All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License. You may obtain
+# a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations
+# under the License.
+#
+# == Class: tripleo::profile::base::sshd
+#
+# SSH profile for tripleo
+#
+# === Parameters
+#
+# [*bannertext*]
+# The text used within SSH Banner
+# Defaults to hiera('BannerText')
+#
+class tripleo::profile::base::sshd (
+ $bannertext = hiera('BannerText', undef),
+) {
+
+ if $bannertext {
+ $action = 'set'
+ } else {
+ $action = 'rm'
+ }
+
+ package {'openssh-server':
+ ensure => installed,
+ }
+
+ augeas { 'sshd_config_banner':
+ context => '/files/etc/ssh/sshd_config',
+ changes => [ "${action} Banner /etc/issue" ],
+ notify => Service['sshd']
+ }
+
+ file { '/etc/issue':
+ ensure => file,
+ backup => false,
+ content => $bannertext,
+ owner => 'root',
+ group => 'root',
+ mode => '0600'
+ }
+
+ service { 'sshd':
+ ensure => 'running',
+ enable => true,
+ hasstatus => false,
+ require => Package['openssh-server'],
+ }
+}
diff --git a/manifests/profile/base/swift/proxy.pp b/manifests/profile/base/swift/proxy.pp
index 974a725..5f3408d 100644
--- a/manifests/profile/base/swift/proxy.pp
+++ b/manifests/profile/base/swift/proxy.pp
@@ -18,33 +18,58 @@
#
# === Parameters
#
-# [*step*]
-# (Optional) The current step in deployment. See tripleo-heat-templates
-# for more details.
-# Defaults to hiera('step')
+# [*ceilometer_enabled*]
+# Whether the ceilometer pipeline is enabled.
+# Defaults to true
#
-# [*memcache_servers*]
-# (Optional) List of memcache servers
-# Defaults to hiera('memcached_node_ips')
+# [*ceilometer_messaging_driver*]
+# Driver for messaging service.
+# Defaults to hiera('messaging_service_name', 'rabbit')
+#
+# [*ceilometer_messaging_hosts*]
+# list of the messaging host fqdns
+# Defaults to hiera('rabbitmq_node_names')
+#
+# [*ceilometer_messaging_password*]
+# Password for messaging nova queue
+# Defaults to hiera('swift::proxy::ceilometer::rabbit_password', undef)
+#
+# [*ceilometer_messaging_port*]
+# IP port for messaging service
+# Defaults to hiera('tripleo::profile::base::swift::proxy::rabbit_port', 5672)
+#
+# [*ceilometer_messaging_use_ssl*]
+# Flag indicating ssl usage.
+# Defaults to '0'
+#
+# [*ceilometer_messaging_username*]
+# Username for messaging nova queue
+# Defaults to hiera('swift::proxy::ceilometer::rabbit_user', 'guest')
#
# [*memcache_port*]
# (Optional) memcache port
# Defaults to 11211
#
-# [*rabbit_hosts*]
-# list of the rabbbit host fqdns
-# Defaults to hiera('rabbitmq_node_names')
+# [*memcache_servers*]
+# (Optional) List of memcache servers
+# Defaults to hiera('memcached_node_ips')
#
-# [*rabbit_port*]
-# IP port for rabbitmq service
-# Defaults to hiera('swift::proxy::ceilometer::rabbit_port', 5672)
+# [*step*]
+# (Optional) The current step in deployment. See tripleo-heat-templates
+# for more details.
+# Defaults to hiera('step')
#
class tripleo::profile::base::swift::proxy (
- $step = hiera('step'),
- $memcache_servers = hiera('memcached_node_ips'),
- $memcache_port = 11211,
- $rabbit_hosts = hiera('rabbitmq_node_names', undef),
- $rabbit_port = hiera('swift::proxy::ceilometer::rabbit_port', 5672),
+ $ceilometer_enabled = true,
+ $ceilometer_messaging_driver = hiera('messaging_service_name', 'rabbit'),
+ $ceilometer_messaging_hosts = any2array(hiera('rabbitmq_node_names', undef)),
+ $ceilometer_messaging_password = hiera('swift::proxy::ceilometer::rabbit_password', undef),
+ $ceilometer_messaging_port = hiera('tripleo::profile::base::swift::proxy::rabbit_port', '5672'),
+ $ceilometer_messaging_use_ssl = '0',
+ $ceilometer_messaging_username = hiera('swift::proxy::ceilometer::rabbit_user', 'guest'),
+ $memcache_port = 11211,
+ $memcache_servers = hiera('memcached_node_ips'),
+ $step = hiera('step'),
) {
if $step >= 4 {
$swift_memcache_servers = suffix(any2array(normalize_ip_for_uri($memcache_servers)), ":${memcache_port}")
@@ -63,9 +88,18 @@ class tripleo::profile::base::swift::proxy (
include ::swift::proxy::tempurl
include ::swift::proxy::formpost
include ::swift::proxy::bulk
- $swift_rabbit_hosts = suffix(any2array($rabbit_hosts), ":${rabbit_port}")
- class { '::swift::proxy::ceilometer':
- rabbit_hosts => $swift_rabbit_hosts,
+ $ceilometer_messaging_use_ssl_real = sprintf('%s', bool2num(str2bool($ceilometer_messaging_use_ssl)))
+ if $ceilometer_enabled {
+ class { '::swift::proxy::ceilometer':
+ default_transport_url => os_transport_url({
+ 'transport' => $ceilometer_messaging_driver,
+ 'hosts' => $ceilometer_messaging_hosts,
+ 'port' => sprintf('%s', $ceilometer_messaging_port),
+ 'username' => $ceilometer_messaging_username,
+ 'password' => $ceilometer_messaging_password,
+ 'ssl' => $ceilometer_messaging_use_ssl_real,
+ }),
+ }
}
include ::swift::proxy::versioned_writes
include ::swift::proxy::slo
@@ -73,5 +107,10 @@ class tripleo::profile::base::swift::proxy (
include ::swift::proxy::copy
include ::swift::proxy::container_quotas
include ::swift::proxy::account_quotas
+
+ class { '::swift::objectexpirer':
+ pipeline => ['catch_errors', 'cache', 'proxy-server'],
+ memcache_servers => $swift_memcache_servers
+ }
}
}
diff --git a/manifests/profile/base/swift/storage.pp b/manifests/profile/base/swift/storage.pp
index 568be66..5018d77 100644
--- a/manifests/profile/base/swift/storage.pp
+++ b/manifests/profile/base/swift/storage.pp
@@ -34,8 +34,10 @@ class tripleo::profile::base::swift::storage (
) {
if $step >= 4 {
if $enable_swift_storage {
+ include ::swift
include ::swift::config
include ::swift::storage::disks
+ include ::swift::storage::loopbacks
include ::swift::storage::all
if(!defined(File['/srv/node'])) {
file { '/srv/node':
diff --git a/manifests/profile/base/tacker.pp b/manifests/profile/base/tacker.pp
new file mode 100644
index 0000000..e9f6b77
--- /dev/null
+++ b/manifests/profile/base/tacker.pp
@@ -0,0 +1,86 @@
+# Copyright 2016 Red Hat, Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License. You may obtain
+# a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations
+# under the License.
+#
+# == Class: tripleo::profile::base::tacker
+#
+# Tacker server profile for tripleo
+#
+# === Parameters
+#
+# [*bootstrap_node*]
+# (Optional) The hostname of the node responsible for bootstrapping tasks
+# Defaults to hiera('bootstrap_nodeid')
+#
+# [*messaging_driver*]
+# Driver for messaging service.
+# Defaults to hiera('messaging_service_name', 'rabbit')
+#
+# [*messaging_hosts*]
+# list of the messaging host fqdns
+# Defaults to hiera('rabbitmq_node_names')
+#
+# [*messaging_password*]
+# Password for messaging nova queue
+# Defaults to hiera('nova::rabbit_password')
+#
+# [*messaging_port*]
+# IP port for messaging service
+# Defaults to hiera('nova::rabbit_port', 5672)
+#
+# [*messaging_username*]
+# Username for messaging nova queue
+# Defaults to hiera('nova::rabbit_userid', 'guest')
+#
+# [*messaging_use_ssl*]
+# Flag indicating ssl usage.
+# Defaults to hiera('nova::rabbit_use_ssl', '0')
+#
+# [*step*]
+# (Optional) The current step of the deployment
+# Defaults to hiera('step')
+
+class tripleo::profile::base::tacker (
+ $bootstrap_node = hiera('bootstrap_nodeid', undef),
+ $messaging_driver = hiera('messaging_service_name', 'rabbit'),
+ $messaging_hosts = any2array(hiera('rabbitmq_node_names', undef)),
+ $messaging_password = hiera('tacker::rabbit_password'),
+ $messaging_port = hiera('tacker::rabbit_port', '5672'),
+ $messaging_username = hiera('tacker::rabbit_userid', 'guest'),
+ $messaging_use_ssl = hiera('tacker::rabbit_use_ssl', '0'),
+ $step = hiera('step'),
+) {
+ if $::hostname == downcase($bootstrap_node) {
+ $sync_db = true
+ } else {
+ $sync_db = false
+ }
+
+ if $step >= 4 or ($step >= 3 and $sync_db){
+ $messaging_use_ssl_real = sprintf('%s', bool2num(str2bool($messaging_use_ssl)))
+ class { '::tacker':
+ sync_db => $sync_db,
+ default_transport_url => os_transport_url({
+ 'transport' => $messaging_driver,
+ 'hosts' => $messaging_hosts,
+ 'port' => sprintf('%s', $messaging_port),
+ 'username' => $messaging_username,
+ 'password' => $messaging_password,
+ 'ssl' => $messaging_use_ssl_real,
+ }),
+ }
+
+ include ::tacker::server
+ include ::tacker::db
+ }
+}
diff --git a/manifests/profile/base/time/ntp.pp b/manifests/profile/base/time/ntp.pp
new file mode 100644
index 0000000..c6ce309
--- /dev/null
+++ b/manifests/profile/base/time/ntp.pp
@@ -0,0 +1,28 @@
+# Copyright 2017 Red Hat, Inc.
+# All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License. You may obtain
+# a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations
+# under the License.
+#
+# == Class: tripleo::profile::base::ntp
+#
+# Enable NTP via composable services.
+#
+
+class tripleo::profile::base::time::ntp {
+ # if installed, we don't want chrony to conflict with ntp.
+ package { 'chrony':
+ ensure => 'purged',
+ before => Service['ntp'],
+ }
+ include ::ntp
+}
diff --git a/manifests/profile/pacemaker/ceph/rbdmirror.pp b/manifests/profile/pacemaker/ceph/rbdmirror.pp
new file mode 100644
index 0000000..4066225
--- /dev/null
+++ b/manifests/profile/pacemaker/ceph/rbdmirror.pp
@@ -0,0 +1,98 @@
+# Copyright 2016 Red Hat, Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License. You may obtain
+# a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations
+# under the License.
+#
+# == Class: tripleo::profile::pacemaker::ceph::rbdmirror
+#
+# Ceph RBD mirror Pacemaker profile for tripleo
+#
+# === Parameters
+#
+# [*bootstrap_node*]
+# (Optional) The hostname of the node responsible for bootstrapping tasks
+# Defaults to hiera('ceph_rbdmirror_bootstrap_short_node_name')
+#
+# [*client_name*]
+# (Optional) Name assigned to the RBD mirror client
+# Defaults to 'rbd-mirror'
+#
+# [*pcs_tries*]
+# (Optional) The number of times pcs commands should be retried.
+# Defaults to hiera('pcs_tries', 20)
+#
+# [*stack_action*]
+# (Optional) Action executed on the stack. See tripleo-heat-templates
+# for more details.
+# Defaults to hiera('stack_action')
+#
+# [*step*]
+# (Optional) The current step in deployment. See tripleo-heat-templates
+# for more details.
+# Defaults to hiera('step')
+#
+class tripleo::profile::pacemaker::ceph::rbdmirror (
+ $bootstrap_node = hiera('ceph_rbdmirror_short_bootstrap_node_name'),
+ $client_name = 'openstack',
+ $pcs_tries = hiera('pcs_tries', 20),
+ $stack_action = hiera('stack_action'),
+ $step = hiera('step'),
+) {
+ Service <| tag == 'ceph-rbd-mirror' |> {
+ hasrestart => true,
+ restart => '/bin/true',
+ start => '/bin/true',
+ stop => '/bin/true',
+ }
+
+ if $::hostname == downcase($bootstrap_node) {
+ $pacemaker_master = true
+ } else {
+ $pacemaker_master = false
+ }
+
+ include ::tripleo::profile::base::ceph
+
+ if $step >= 2 {
+ pacemaker::property { 'ceph-rbdmirror-role-node-property':
+ property => 'ceph-rbdmirror-role',
+ value => true,
+ tries => $pcs_tries,
+ node => $::hostname,
+ }
+ }
+
+ if $step >= 3 {
+ require ::ceph::profile::client
+ ceph::mirror { $client_name:
+ rbd_mirror_enable => false,
+ rbd_mirror_ensure => 'stopped',
+ } ->
+ pacemaker::resource::service { "ceph-rbd-mirror_${client_name}":
+ # NOTE(gfidente): systemd uses the @ sign but it is an invalid
+ # character in a pcmk resource name, so we need to use it only
+ # for the name of the service
+ service_name => "ceph-rbd-mirror@${client_name}",
+ tries => $pcs_tries,
+ location_rule => {
+ resource_discovery => 'exclusive',
+ score => 0,
+ expression => ['ceph-rbdmirror-role eq true'],
+ }
+ }
+ }
+
+ if $step >= 3 and $pacemaker_master and $stack_action == 'UPDATE' {
+ Ceph_config<||> ~> Tripleo::Pacemaker::Resource_restart_flag["ceph-rbd-mirror@${client_name}"]
+ tripleo::pacemaker::resource_restart_flag { "ceph-rbd-mirror@${client_name}": }
+ }
+}
diff --git a/manifests/profile/pacemaker/cinder/backup.pp b/manifests/profile/pacemaker/cinder/backup.pp
index 63988d6..ff0d8c9 100644
--- a/manifests/profile/pacemaker/cinder/backup.pp
+++ b/manifests/profile/pacemaker/cinder/backup.pp
@@ -20,16 +20,21 @@
#
# [*bootstrap_node*]
# (Optional) The hostname of the node responsible for bootstrapping tasks
-# Defaults to hiera('bootstrap_nodeid')
+# Defaults to hiera('cinder_backup_short_bootstrap_node_name')
#
# [*step*]
# (Optional) The current step in deployment. See tripleo-heat-templates
# for more details.
# Defaults to hiera('step')
#
+# [*pcs_tries*]
+# (Optional) The number of times pcs commands should be retried.
+# Defaults to hiera('pcs_tries', 20)
+#
class tripleo::profile::pacemaker::cinder::backup (
- $bootstrap_node = hiera('bootstrap_nodeid'),
+ $bootstrap_node = hiera('cinder_backup_short_bootstrap_node_name'),
$step = hiera('step'),
+ $pcs_tries = hiera('pcs_tries', 20),
) {
Service <| tag == 'cinder::backup' |> {
@@ -47,6 +52,15 @@ class tripleo::profile::pacemaker::cinder::backup (
include ::tripleo::profile::base::cinder::backup
+ if $step >= 2 {
+ pacemaker::property { 'cinder-backup-role-node-property':
+ property => 'cinder-backup-role',
+ value => true,
+ tries => $pcs_tries,
+ node => $::hostname,
+ }
+ }
+
if $step >= 3 and $pacemaker_master and hiera('stack_action') == 'UPDATE' {
Cinder_config<||>
~>
@@ -55,7 +69,13 @@ class tripleo::profile::pacemaker::cinder::backup (
if $step >= 5 and $pacemaker_master {
pacemaker::resource::service { $::cinder::params::backup_service :
- op_params => 'start timeout=200s stop timeout=200s',
+ op_params => 'start timeout=200s stop timeout=200s',
+ tries => $pcs_tries,
+ location_rule => {
+ resource_discovery => 'exclusive',
+ score => 0,
+ expression => ['cinder-backup-role eq true'],
+ }
}
}
diff --git a/manifests/profile/pacemaker/cinder/volume.pp b/manifests/profile/pacemaker/cinder/volume.pp
index 46e8b79..0d6a598 100644
--- a/manifests/profile/pacemaker/cinder/volume.pp
+++ b/manifests/profile/pacemaker/cinder/volume.pp
@@ -20,16 +20,21 @@
#
# [*bootstrap_node*]
# (Optional) The hostname of the node responsible for bootstrapping tasks
-# Defaults to hiera('bootstrap_nodeid')
+# Defaults to hiera('cinder_volume_short_bootstrap_node_name')
#
# [*step*]
# (Optional) The current step in deployment. See tripleo-heat-templates
# for more details.
# Defaults to hiera('step')
#
+# [*pcs_tries*]
+# (Optional) The number of times pcs commands should be retried.
+# Defaults to hiera('pcs_tries', 20)
+#
class tripleo::profile::pacemaker::cinder::volume (
- $bootstrap_node = hiera('bootstrap_nodeid'),
+ $bootstrap_node = hiera('cinder_volume_short_bootstrap_node_name'),
$step = hiera('step'),
+ $pcs_tries = hiera('pcs_tries', 20),
) {
Service <| tag == 'cinder::volume' |> {
hasrestart => true,
@@ -46,6 +51,15 @@ class tripleo::profile::pacemaker::cinder::volume (
include ::tripleo::profile::base::cinder::volume
+ if $step >= 2 {
+ pacemaker::property { 'cinder-volume-role-node-property':
+ property => 'cinder-volume-role',
+ value => true,
+ tries => $pcs_tries,
+ node => $::hostname,
+ }
+ }
+
if $step >= 3 and $pacemaker_master and hiera('stack_action') == 'UPDATE' {
Cinder_api_paste_ini<||> ~> Tripleo::Pacemaker::Resource_restart_flag["${::cinder::params::volume_service}"]
Cinder_config<||> ~> Tripleo::Pacemaker::Resource_restart_flag["${::cinder::params::volume_service}"]
@@ -54,7 +68,13 @@ class tripleo::profile::pacemaker::cinder::volume (
if $step >= 5 and $pacemaker_master {
pacemaker::resource::service { $::cinder::params::volume_service :
- op_params => 'start timeout=200s stop timeout=200s',
+ op_params => 'start timeout=200s stop timeout=200s',
+ tries => $pcs_tries,
+ location_rule => {
+ resource_discovery => 'exclusive',
+ score => 0,
+ expression => ['cinder-volume-role eq true'],
+ }
}
}
diff --git a/manifests/profile/pacemaker/database/mysql.pp b/manifests/profile/pacemaker/database/mysql.pp
index e5882e7..bc5e644 100644
--- a/manifests/profile/pacemaker/database/mysql.pp
+++ b/manifests/profile/pacemaker/database/mysql.pp
@@ -18,6 +18,10 @@
#
# === Parameters
#
+# [*bootstrap_node*]
+# (Optional) The hostname of the node responsible for bootstrapping tasks
+# Defaults to hiera('mysql_short_bootstrap_node_name')
+#
# [*bind_address*]
# (Optional) The address that the local mysql instance should bind to.
# Defaults to $::hostname
@@ -32,12 +36,18 @@
# for more details.
# Defaults to hiera('step')
#
+# [*pcs_tries*]
+# (Optional) The number of times pcs commands should be retried.
+# Defaults to hiera('pcs_tries', 20)
+#
class tripleo::profile::pacemaker::database::mysql (
+ $bootstrap_node = hiera('mysql_short_bootstrap_node_name'),
$bind_address = $::hostname,
$gmcast_listen_addr = hiera('mysql_bind_host'),
$step = hiera('step'),
+ $pcs_tries = hiera('pcs_tries', 20),
) {
- if $::hostname == downcase(hiera('bootstrap_nodeid')) {
+ if $::hostname == downcase($bootstrap_node) {
$pacemaker_master = true
} else {
$pacemaker_master = false
@@ -65,6 +75,7 @@ class tripleo::profile::pacemaker::database::mysql (
'default-storage-engine' => 'innodb',
'innodb_autoinc_lock_mode' => '2',
'innodb_locks_unsafe_for_binlog'=> '1',
+ 'innodb_file_per_table' => 'ON',
'query_cache_size' => '0',
'query_cache_type' => '0',
'bind-address' => $bind_address,
@@ -100,6 +111,7 @@ class tripleo::profile::pacemaker::database::mysql (
}
class { '::tripleo::profile::base::database::mysql':
+ bootstrap_node => $bootstrap_node,
manage_resources => false,
remove_default_accounts => $remove_default_accounts,
mysql_server_options => $mysqld_options,
@@ -112,6 +124,12 @@ class tripleo::profile::pacemaker::database::mysql (
}
if $step >= 2 {
+ pacemaker::property { 'galera-role-node-property':
+ property => 'galera-role',
+ value => true,
+ tries => $pcs_tries,
+ node => $::hostname,
+ }
if $pacemaker_master {
pacemaker::resource::ocf { 'galera' :
ocf_agent_name => 'heartbeat:galera',
@@ -119,7 +137,14 @@ class tripleo::profile::pacemaker::database::mysql (
master_params => '',
meta_params => "master-max=${galera_nodes_count} ordered=true",
resource_params => "additional_parameters='--open-files-limit=16384' enable_creation=true wsrep_cluster_address='gcomm://${galera_nodes}'",
- require => Class['::mysql::server'],
+ tries => $pcs_tries,
+ location_rule => {
+ resource_discovery => 'exclusive',
+ score => 0,
+ expression => ['galera-role eq true'],
+ },
+ require => [Class['::mysql::server'],
+ Pacemaker::Property['galera-role-node-property']],
before => Exec['galera-ready'],
}
exec { 'galera-ready' :
@@ -155,7 +180,7 @@ class tripleo::profile::pacemaker::database::mysql (
# This step is to create a sysconfig clustercheck file with the root user and empty password
# on the first install only (because later on the clustercheck db user will be used)
# We are using exec and not file in order to not have duplicate definition errors in puppet
- # when we later set the the file to contain the clustercheck data
+ # when we later set the file to contain the clustercheck data
exec { 'create-root-sysconfig-clustercheck':
command => "/bin/echo 'MYSQL_USERNAME=root\nMYSQL_PASSWORD=\'\'\nMYSQL_HOST=localhost\n' > /etc/sysconfig/clustercheck",
unless => '/bin/test -e /etc/sysconfig/clustercheck && grep -q clustercheck /etc/sysconfig/clustercheck',
diff --git a/manifests/profile/pacemaker/database/redis.pp b/manifests/profile/pacemaker/database/redis.pp
index 37c36aa..3ef6815 100644
--- a/manifests/profile/pacemaker/database/redis.pp
+++ b/manifests/profile/pacemaker/database/redis.pp
@@ -20,7 +20,7 @@
#
# [*bootstrap_node*]
# (Optional) The hostname of the node responsible for bootstrapping tasks
-# Defaults to hiera('bootstrap_nodeid')
+# Defaults to hiera('redis_short_bootstrap_node_name')
#
# [*enable_load_balancer*]
# (Optional) Whether load balancing is enabled for this cluster
@@ -36,11 +36,16 @@
# for when redis is managed by pacemaker. Defaults to hiera('redis_file_limit')
# or 10240 (default in redis systemd limits)
#
+# [*pcs_tries*]
+# (Optional) The number of times pcs commands should be retried.
+# Defaults to hiera('pcs_tries', 20)
+#
class tripleo::profile::pacemaker::database::redis (
- $bootstrap_node = hiera('bootstrap_nodeid'),
+ $bootstrap_node = hiera('redis_short_bootstrap_node_name'),
$enable_load_balancer = hiera('enable_load_balancer', true),
$step = hiera('step'),
$redis_file_limit = hiera('redis_file_limit', 10240),
+ $pcs_tries = hiera('pcs_tries', 20),
) {
if $::hostname == downcase($bootstrap_node) {
$pacemaker_master = true
@@ -71,14 +76,29 @@ class tripleo::profile::pacemaker::database::redis (
}
}
- if $step >= 2 and $pacemaker_master {
- pacemaker::resource::ocf { 'redis':
- ocf_agent_name => 'heartbeat:redis',
- master_params => '',
- meta_params => 'notify=true ordered=true interleave=true',
- resource_params => 'wait_last_known_master=true',
- op_params => 'start timeout=200s stop timeout=200s',
- require => Class['::redis'],
+ if $step >= 2 {
+ pacemaker::property { 'redis-role-node-property':
+ property => 'redis-role',
+ value => true,
+ tries => $pcs_tries,
+ node => $::hostname,
+ }
+ if $pacemaker_master {
+ pacemaker::resource::ocf { 'redis':
+ ocf_agent_name => 'heartbeat:redis',
+ master_params => '',
+ meta_params => 'notify=true ordered=true interleave=true',
+ resource_params => 'wait_last_known_master=true',
+ op_params => 'start timeout=200s stop timeout=200s',
+ tries => $pcs_tries,
+ location_rule => {
+ resource_discovery => 'exclusive',
+ score => 0,
+ expression => ['redis-role eq true'],
+ },
+ require => [Class['::redis'],
+ Pacemaker::Property['redis-role-node-property']],
+ }
}
}
}
diff --git a/manifests/profile/pacemaker/haproxy.pp b/manifests/profile/pacemaker/haproxy.pp
index 605bb15..f006f78 100644
--- a/manifests/profile/pacemaker/haproxy.pp
+++ b/manifests/profile/pacemaker/haproxy.pp
@@ -20,7 +20,7 @@
#
# [*bootstrap_node*]
# (Optional) The hostname of the node responsible for bootstrapping tasks
-# Defaults to hiera('bootstrap_nodeid')
+# Defaults to hiera('haproxy_short_bootstrap_node_name')
#
# [*enable_load_balancer*]
# (Optional) Whether load balancing is enabled for this cluster
@@ -31,10 +31,15 @@
# for more details.
# Defaults to hiera('step')
#
+# [*pcs_tries*]
+# (Optional) The number of times pcs commands should be retried.
+# Defaults to hiera('pcs_tries', 20)
+#
class tripleo::profile::pacemaker::haproxy (
- $bootstrap_node = hiera('bootstrap_nodeid'),
+ $bootstrap_node = hiera('haproxy_short_bootstrap_node_name'),
$enable_load_balancer = hiera('enable_load_balancer', true),
$step = hiera('step'),
+ $pcs_tries = hiera('pcs_tries', 20),
) {
include ::tripleo::profile::base::haproxy
@@ -50,56 +55,90 @@ class tripleo::profile::pacemaker::haproxy (
}
}
- if $step >= 2 and $pacemaker_master and $enable_load_balancer {
+ if $step >= 2 and $enable_load_balancer {
+ pacemaker::property { 'haproxy-role-node-property':
+ property => 'haproxy-role',
+ value => true,
+ tries => $pcs_tries,
+ node => $::hostname,
+ }
+ if $pacemaker_master {
+ $haproxy_location_rule = {
+ resource_discovery => 'exclusive',
+ score => 0,
+ expression => ['haproxy-role eq true'],
+ }
# FIXME: we should not have to access tripleo::haproxy class
# parameters here to configure pacemaker VIPs. The configuration
# of pacemaker VIPs could move into puppet-tripleo or we should
# make use of less specific hiera parameters here for the settings.
pacemaker::resource::service { 'haproxy':
- op_params => 'start timeout=200s stop timeout=200s',
- clone_params => true,
+ op_params => 'start timeout=200s stop timeout=200s',
+ clone_params => true,
+ location_rule => $haproxy_location_rule,
+ tries => $pcs_tries,
+ require => Pacemaker::Property['haproxy-role-node-property'],
}
$control_vip = hiera('controller_virtual_ip')
tripleo::pacemaker::haproxy_with_vip { 'haproxy_and_control_vip':
- vip_name => 'control',
- ip_address => $control_vip,
+ vip_name => 'control',
+ ip_address => $control_vip,
+ location_rule => $haproxy_location_rule,
+ pcs_tries => $pcs_tries,
+ require => Pacemaker::Property['haproxy-role-node-property'],
}
$public_vip = hiera('public_virtual_ip')
tripleo::pacemaker::haproxy_with_vip { 'haproxy_and_public_vip':
- ensure => $public_vip and $public_vip != $control_vip,
- vip_name => 'public',
- ip_address => $public_vip,
+ ensure => $public_vip and $public_vip != $control_vip,
+ vip_name => 'public',
+ ip_address => $public_vip,
+ location_rule => $haproxy_location_rule,
+ pcs_tries => $pcs_tries,
+ require => Pacemaker::Property['haproxy-role-node-property'],
}
$redis_vip = hiera('redis_vip')
tripleo::pacemaker::haproxy_with_vip { 'haproxy_and_redis_vip':
- ensure => $redis_vip and $redis_vip != $control_vip,
- vip_name => 'redis',
- ip_address => $redis_vip,
+ ensure => $redis_vip and $redis_vip != $control_vip,
+ vip_name => 'redis',
+ ip_address => $redis_vip,
+ location_rule => $haproxy_location_rule,
+ pcs_tries => $pcs_tries,
+ require => Pacemaker::Property['haproxy-role-node-property'],
}
$internal_api_vip = hiera('internal_api_virtual_ip')
tripleo::pacemaker::haproxy_with_vip { 'haproxy_and_internal_api_vip':
- ensure => $internal_api_vip and $internal_api_vip != $control_vip,
- vip_name => 'internal_api',
- ip_address => $internal_api_vip,
+ ensure => $internal_api_vip and $internal_api_vip != $control_vip,
+ vip_name => 'internal_api',
+ ip_address => $internal_api_vip,
+ location_rule => $haproxy_location_rule,
+ pcs_tries => $pcs_tries,
+ require => Pacemaker::Property['haproxy-role-node-property'],
}
$storage_vip = hiera('storage_virtual_ip')
tripleo::pacemaker::haproxy_with_vip { 'haproxy_and_storage_vip':
- ensure => $storage_vip and $storage_vip != $control_vip,
- vip_name => 'storage',
- ip_address => $storage_vip,
+ ensure => $storage_vip and $storage_vip != $control_vip,
+ vip_name => 'storage',
+ ip_address => $storage_vip,
+ location_rule => $haproxy_location_rule,
+ pcs_tries => $pcs_tries,
+ require => Pacemaker::Property['haproxy-role-node-property'],
}
$storage_mgmt_vip = hiera('storage_mgmt_virtual_ip')
tripleo::pacemaker::haproxy_with_vip { 'haproxy_and_storage_mgmt_vip':
- ensure => $storage_mgmt_vip and $storage_mgmt_vip != $control_vip,
- vip_name => 'storage_mgmt',
- ip_address => $storage_mgmt_vip,
+ ensure => $storage_mgmt_vip and $storage_mgmt_vip != $control_vip,
+ vip_name => 'storage_mgmt',
+ ip_address => $storage_mgmt_vip,
+ location_rule => $haproxy_location_rule,
+ pcs_tries => $pcs_tries,
+ require => Pacemaker::Property['haproxy-role-node-property'],
}
+ }
}
}
diff --git a/manifests/profile/pacemaker/manila.pp b/manifests/profile/pacemaker/manila.pp
index 8d6c2a7..7bcf8d6 100644
--- a/manifests/profile/pacemaker/manila.pp
+++ b/manifests/profile/pacemaker/manila.pp
@@ -30,21 +30,33 @@
# (Optional) Whether or not the cephfs backend is enabled
# Defaults to hiera('manila_backend_cephfs_enabled', false)
#
+# [*ceph_mds_enabled*]
+# (Optional) Whether or not the ceph mds is enabled. This option is used
+# to distinguish if an external ceph is used or if ceph is deployed by
+# tripleo. By default ceph mds is not deployed by tripleo.
+# Defaults to hiera('ceph_mds_enabled', false)
+#
# [*bootstrap_node*]
# (Optional) The hostname of the node responsible for bootstrapping tasks
-# Defaults to hiera('bootstrap_nodeid')
+# Defaults to hiera('manila_share_short_bootstrap_node_name')
#
# [*step*]
# (Optional) The current step in deployment. See tripleo-heat-templates
# for more details.
# Defaults to hiera('step')
#
+# [*pcs_tries*]
+# (Optional) The number of times pcs commands should be retried.
+# Defaults to hiera('pcs_tries', 20)
+#
class tripleo::profile::pacemaker::manila (
$backend_generic_enabled = hiera('manila_backend_generic_enabled', false),
$backend_netapp_enabled = hiera('manila_backend_netapp_enabled', false),
$backend_cephfs_enabled = hiera('manila_backend_cephfs_enabled', false),
- $bootstrap_node = hiera('bootstrap_nodeid'),
+ $ceph_mds_enabled = hiera('ceph_mds_enabled', false),
+ $bootstrap_node = hiera('manila_share_short_bootstrap_node_name'),
$step = hiera('step'),
+ $pcs_tries = hiera('pcs_tries', 20),
) {
if $::hostname == downcase($bootstrap_node) {
$pacemaker_master = true
@@ -61,10 +73,17 @@ class tripleo::profile::pacemaker::manila (
stop => '/bin/true',
}
- include ::tripleo::profile::base::manila::api
- include ::tripleo::profile::base::manila::scheduler
include ::tripleo::profile::base::manila::share
+ if $step >= 2 {
+ pacemaker::property { 'manila-share-role-node-property':
+ property => 'manila-share-role',
+ value => true,
+ tries => $pcs_tries,
+ node => $::hostname,
+ }
+ }
+
if $step >= 4 {
# manila generic:
if $backend_generic_enabled {
@@ -97,14 +116,42 @@ class tripleo::profile::pacemaker::manila (
# manila cephfsnative:
if $backend_cephfs_enabled {
$manila_cephfsnative_backend = hiera('manila::backend::cephfsnative::title')
+ $cephfs_auth_id = hiera('manila::backend::cephfsnative::cephfs_auth_id')
+ $keyring_path = "/etc/ceph/ceph.client.${cephfs_auth_id}.keyring"
+
+ # $ceph_mds_enabled is used to distinguish if an external ceph is used or
+ # if ceph is deployed by TripleO
+ if $ceph_mds_enabled {
+ include ::ceph::profile::fs
+ }
+
manila::backend::cephfsnative { $manila_cephfsnative_backend :
driver_handles_share_servers => hiera('manila::backend::cephfsnative::driver_handles_share_servers', false),
share_backend_name => hiera('manila::backend::cephfsnative::share_backend_name'),
cephfs_conf_path => hiera('manila::backend::cephfsnative::cephfs_conf_path'),
- cephfs_auth_id => hiera('manila::backend::cephfsnative::cephfs_auth_id'),
+ cephfs_auth_id => $cephfs_auth_id,
cephfs_cluster_name => hiera('manila::backend::cephfsnative::cephfs_cluster_name'),
cephfs_enable_snapshots => hiera('manila::backend::cephfsnative::cephfs_enable_snapshots'),
}
+
+ ceph::key { "client.${cephfs_auth_id}" :
+ secret => hiera('manila::backend::cephfsnative::ceph_client_key'),
+ keyring_path => $keyring_path,
+ # inject the new key into ceph cluster only if ceph is deployed by
+ # tripleo (if external ceph is used it should be added manually)
+ inject => $ceph_mds_enabled,
+ user => 'manila',
+ cap_mds => 'allow *',
+ cap_mon => 'allow r, allow command \"auth del\", allow command \"auth caps\", \
+allow command \"auth get\", allow command \"auth get-or-create\"',
+ cap_osd => 'allow rw'
+ }
+
+ ceph_config {
+ "client.${cephfs_auth_id}/keyring": value => $keyring_path;
+ "client.${cephfs_auth_id}/client mount uid": value => 0;
+ "client.${cephfs_auth_id}/client mount gid": value => 0;
+ }
}
# manila netapp:
@@ -152,7 +199,13 @@ class tripleo::profile::pacemaker::manila (
# only manila-share is pacemaker managed, and in a/p
pacemaker::resource::service { $::manila::params::share_service :
- op_params => 'start timeout=200s stop timeout=200s',
+ op_params => 'start timeout=200s stop timeout=200s',
+ tries => $pcs_tries,
+ location_rule => {
+ resource_discovery => 'exclusive',
+ score => 0,
+ expression => ['manila-share-role eq true'],
+ },
}
}
diff --git a/manifests/profile/pacemaker/rabbitmq.pp b/manifests/profile/pacemaker/rabbitmq.pp
index dba01e3..f4b679a 100644
--- a/manifests/profile/pacemaker/rabbitmq.pp
+++ b/manifests/profile/pacemaker/rabbitmq.pp
@@ -20,7 +20,7 @@
#
# [*bootstrap_node*]
# (Optional) The hostname of the node responsible for bootstrapping tasks
-# Defaults to hiera('bootstrap_nodeid')
+# Defaults to hiera('rabbitmq_short_bootstrap_node_name')
#
# [*erlang_cookie*]
# (Optional) Content of erlang cookie.
@@ -41,11 +41,16 @@
# for more details.
# Defaults to hiera('step')
#
+# [*pcs_tries*]
+# (Optional) The number of times pcs commands should be retried.
+# Defaults to hiera('pcs_tries', 20)
+#
class tripleo::profile::pacemaker::rabbitmq (
- $bootstrap_node = hiera('bootstrap_nodeid'),
+ $bootstrap_node = hiera('rabbitmq_short_bootstrap_node_name'),
$erlang_cookie = hiera('rabbitmq::erlang_cookie'),
$user_ha_queues = hiera('rabbitmq::nr_ha_queues', 0),
$rabbit_nodes = hiera('rabbitmq_node_names'),
+ $pcs_tries = hiera('pcs_tries', 20),
$step = hiera('step'),
) {
if $::hostname == downcase($bootstrap_node) {
@@ -72,22 +77,37 @@ class tripleo::profile::pacemaker::rabbitmq (
}
}
- if $step >= 2 and $pacemaker_master {
- include ::stdlib
- # The default nr of ha queues is ceiling(N/2)
- if $user_ha_queues == 0 {
- $nr_rabbit_nodes = size($rabbit_nodes)
- $nr_ha_queues = $nr_rabbit_nodes / 2 + ($nr_rabbit_nodes % 2)
- } else {
- $nr_ha_queues = $user_ha_queues
+ if $step >= 2 {
+ pacemaker::property { 'rabbitmq-role-node-property':
+ property => 'rabbitmq-role',
+ value => true,
+ tries => $pcs_tries,
+ node => $::hostname,
}
- pacemaker::resource::ocf { 'rabbitmq':
- ocf_agent_name => 'heartbeat:rabbitmq-cluster',
- resource_params => "set_policy='ha-all ^(?!amq\\.).* {\"ha-mode\":\"exactly\",\"ha-params\":${nr_ha_queues}}'",
- clone_params => 'ordered=true interleave=true',
- meta_params => 'notify=true',
- op_params => 'start timeout=200s stop timeout=200s',
- require => Class['::rabbitmq'],
+ if $pacemaker_master {
+ include ::stdlib
+ # The default nr of ha queues is ceiling(N/2)
+ if $user_ha_queues == 0 {
+ $nr_rabbit_nodes = size($rabbit_nodes)
+ $nr_ha_queues = $nr_rabbit_nodes / 2 + ($nr_rabbit_nodes % 2)
+ } else {
+ $nr_ha_queues = $user_ha_queues
+ }
+ pacemaker::resource::ocf { 'rabbitmq':
+ ocf_agent_name => 'heartbeat:rabbitmq-cluster',
+ resource_params => "set_policy='ha-all ^(?!amq\\.).* {\"ha-mode\":\"exactly\",\"ha-params\":${nr_ha_queues}}'",
+ clone_params => 'ordered=true interleave=true',
+ meta_params => 'notify=true',
+ op_params => 'start timeout=200s stop timeout=200s',
+ tries => $pcs_tries,
+ location_rule => {
+ resource_discovery => 'exclusive',
+ score => 0,
+ expression => ['rabbitmq-role eq true'],
+ },
+ require => [Class['::rabbitmq'],
+ Pacemaker::Property['rabbitmq-role-node-property']],
+ }
}
}
}
diff --git a/manifests/tls_proxy.pp b/manifests/tls_proxy.pp
new file mode 100644
index 0000000..36d6b6d
--- /dev/null
+++ b/manifests/tls_proxy.pp
@@ -0,0 +1,60 @@
+# Copyright 2016 Red Hat, Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License. You may obtain
+# a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations
+# under the License.
+#
+# == Class: tripleo::tls_proxy
+#
+# Sets up a TLS proxy using mod_proxy that redirects towards localhost.
+#
+# === Parameters
+#
+# [*ip*]
+# The IP address that the proxy will be listening on.
+#
+# [*port*]
+# The port that the proxy will be listening on.
+#
+# [*servername*]
+# The vhost servername that contains the FQDN to identify the virtual host.
+#
+# [*tls_cert*]
+# The path to the TLS certificate that the proxy will be serving.
+#
+# [*tls_key*]
+# The path to the key used for the specified certificate.
+#
+define tripleo::tls_proxy(
+ $ip,
+ $port,
+ $servername,
+ $tls_cert,
+ $tls_key,
+) {
+ ::apache::vhost { "${title}-proxy":
+ ensure => 'present',
+ docroot => undef, # This is required by the manifest
+ manage_docroot => false,
+ servername => $servername,
+ ip => $ip,
+ port => $port,
+ ssl => true,
+ ssl_cert => $tls_cert,
+ ssl_key => $tls_key,
+ request_headers => ['set X-Forwarded-Proto "https"'],
+ proxy_pass => {
+ path => '/',
+ url => "http://localhost:${port}/",
+ params => {retry => '10'},
+ }
+ }
+}
diff --git a/manifests/ui.pp b/manifests/ui.pp
index 27e3e50..7b87397 100644
--- a/manifests/ui.pp
+++ b/manifests/ui.pp
@@ -31,37 +31,53 @@
# The port on which the UI is listening.
# Defaults to 3000
#
-# [*keystone_url*]
-# The keystone service url
-# Defaults to hiera('keystone::endpoint::public_url')
+# [*endpoint_proxy_keystone*]
+# The keystone proxy endpoint url
+# Defaults to undef
#
-# [*heat_url*]
-# The heat service url
-# Defaults to hiera('heat::keystone::auth::public_url')
+# [*endpoint_config_keystone*]
+# The keystone config endpoint url
+# Defaults to undef
#
-# [*heat_url*]
-# The heat service url
-# Defaults to hiera('heat::keystone::auth::public_url')
+# [*endpoint_proxy_heat*]
+# The heat proxy endpoint url
+# Defaults to undef
#
-# [*heat_url*]
-# The heat service url
-# Defaults to hiera('heat::keystone::auth::public_url')
+# [*endpoint_config_heat*]
+# The heat config endpoint url
+# Defaults to undef
#
-# [*ironic_url*]
-# The ironic service url
-# Defaults to hiera('ironic::keystone::auth::public_url')
+# [*endpoint_proxy_ironic*]
+# The ironic proxy endpoint url
+# Defaults to undef
#
-# [*mistral_url*]
-# The mistral service url
-# Defaults to hiera('mistral::keystone::auth::public_url')
+# [*endpoint_config_ironic*]
+# The ironic config endpoint url
+# Defaults to undef
#
-# [*swift_url*]
-# The swift service url
-# Defaults to hiera('swift::keystone::auth::public_url')
+# [*endpoint_proxy_mistral*]
+# The mistral proxy endpoint url
+# Defaults to undef
#
-# [*zaqar_websocket_url*]
-# The zaqar websocket url
-# Defaults to hiera('zaquar::keystone::auth_websocket::public_url')
+# [*endpoint_config_mistral*]
+# The mistral config endpoint url
+# Defaults to undef
+#
+# [*endpoint_proxy_swift*]
+# The swift proxy endpoint url
+# Defaults to undef
+#
+# [*endpoint_config_swift*]
+# The swift config endpoint url
+# Defaults to undef
+#
+# [*endpoint_proxy_zaqar*]
+# The zaqar proxy endpoint url
+# Defaults to undef
+#
+# [*endpoint_config_zaqar*]
+# The zaqar config endpoint url
+# Defaults to undf
#
# [*zaqar_default_queue*]
# The zaqar default queue
@@ -69,18 +85,29 @@
# Defaults to 'tripleo'
#
class tripleo::ui (
- $servername = $::fqdn,
- $bind_host = hiera('controller_host'),
- $ui_port = 3000,
- $keystone_url = hiera('keystone_auth_uri_v2'),
- $heat_url = hiera('heat::keystone::auth::public_url', undef),
- $ironic_url = hiera('ironic::keystone::auth::public_url', undef),
- $mistral_url = hiera('mistral::keystone::auth::public_url', undef),
- $swift_url = hiera('swift::keystone::auth::public_url', undef),
- $zaqar_websocket_url = hiera('zaqar::keystone::auth_websocket::public_url', undef),
- $zaqar_default_queue = 'tripleo'
+ $servername = $::fqdn,
+ $bind_host = hiera('controller_host'),
+ $ui_port = 3000,
+ $zaqar_default_queue = 'tripleo',
+ $endpoint_proxy_zaqar = undef,
+ $endpoint_proxy_keystone = undef,
+ $endpoint_proxy_heat = undef,
+ $endpoint_proxy_ironic = undef,
+ $endpoint_proxy_mistral = undef,
+ $endpoint_proxy_swift = undef,
+ $endpoint_config_zaqar = undef,
+ $endpoint_config_keystone = undef,
+ $endpoint_config_heat = undef,
+ $endpoint_config_ironic = undef,
+ $endpoint_config_mistral = undef,
+ $endpoint_config_swift = undef,
+
) {
+ include ::apache::mod::proxy
+ include ::apache::mod::proxy_http
+ include ::apache::mod::proxy_wstunnel
+
::apache::vhost { 'tripleo-ui':
ensure => 'present',
servername => $servername,
@@ -89,6 +116,38 @@ class tripleo::ui (
docroot => '/var/www/openstack-tripleo-ui/dist',
options => ['Indexes', 'FollowSymLinks'],
fallbackresource => '/index.html',
+ proxy_pass => [
+ {
+ 'path' => '/zaqar',
+ 'url' => $endpoint_proxy_zaqar
+ },
+ {
+ 'path' => '/keystone',
+ 'url' => $endpoint_proxy_keystone,
+ 'reverse_urls' => $endpoint_proxy_keystone
+ },
+ {
+ 'path' => '/heat',
+ 'url' => $endpoint_proxy_heat,
+ 'reverse_urls' => $endpoint_proxy_heat
+ },
+ {
+ 'path' => '/ironic',
+ 'url' => $endpoint_proxy_ironic,
+ 'reverse_urls' => $endpoint_proxy_ironic
+ },
+ {
+ 'path' => '/mistral',
+ 'url' => $endpoint_proxy_mistral,
+ 'reverse_urls' => $endpoint_proxy_mistral
+ },
+ {
+ 'path' => '/swift',
+ 'url' => $endpoint_proxy_swift,
+ 'reverse_urls' => $endpoint_proxy_swift
+ },
+ ],
+
}
# We already use apache::vhost to generate our own
diff --git a/metadata.json b/metadata.json
index 1aa1b4d..0db84c7 100644
--- a/metadata.json
+++ b/metadata.json
@@ -1,6 +1,6 @@
{
"name": "openstack-tripleo",
- "version": "6.1.0",
+ "version": "6.2.0",
"author": "OpenStack Contributors",
"summary": "Puppet module for TripleO",
"license": "Apache-2.0",
@@ -9,8 +9,8 @@
"issues_url": "https://bugs.launchpad.net/puppet-tripleo",
"description": "Installs and configures Tripleo.",
"requirements": [
- { "name": "pe","version_requirement": "3.x" },
- { "name": "puppet","version_requirement": "3.x" }
+ { "name": "pe","version_requirement": "4.x" },
+ { "name": "puppet","version_requirement": "4.x" }
],
"operatingsystem_support": [
{
diff --git a/releasenotes/notes/6.2.0-64eaf596539f3ed1.yaml b/releasenotes/notes/6.2.0-64eaf596539f3ed1.yaml
new file mode 100644
index 0000000..c41deab
--- /dev/null
+++ b/releasenotes/notes/6.2.0-64eaf596539f3ed1.yaml
@@ -0,0 +1,64 @@
+---
+features:
+ - Add networking-fujitsu support to Neutron ML2 profile.
+ - Split OVN plugin and northd configuration.
+ - Introduce tripleo::tls_proxy used to set up a TLS proxy using
+ mod_proxy that redirects towards localhost.
+ - HPELeftHandISCSIDriver support for Cinder Volume profile.
+ - Add support for CollectD profile, for performance monitoring.
+ - Configure Nova Cells v2 database, required in Ocata.
+ - Configure the basic setup for Nova Cells v2.
+ - Support for opendalight_v2 mechanism_driver in Neutron ML2 profile.
+ - Support for Ceph MDS service profile.
+ - Add IPv6 support to Firewall rules. It will create both IPv4 & IPv6 rules
+ at the same time. It automatically converts icmp rules to ipv6-icmp. When
+ a source or destination is specified, it will only create rules to the
+ right version of IP that is needed.
+ - Add support for not using admin_token in Ceph/RGW profile.
+ - Add Docker Registry profile.
+ - Add Nova Placement API profile.
+ - Add NTP profile.
+ - Add etcd profile, used by networking-vpp ML2 plugin.
+ - Add profiles for Octavia services.
+ - Enable object-expirer on Swift proxy profile.
+ - Set memcache_servers in /etc/swift/object-expirer.conf.
+ - Add support for fence_ironic fencing agent.
+ - Add a noop_resource function, which allow to disable any resource type
+ in a catalog, with --tags option to puppet apply.
+ - Add Ceph RBD mirrog Pacemaker profile.
+ - Remove Glance Registry profile, not used anymore. Glance API v1 is not
+ available anymore.
+ - Add Nova EC2API profile.
+ - Add support for Pacemaker Remote with a new profile.
+ - Updates Pacemaker profiles for Composable HA architecture.
+ - Add Tacker profile.
+ - Add Congress profile.
+ - Add a default rule for dhcpv6 traffic.
+ - Re-organizes Contrail services to the correct roles.
+ - Set innodb_file_per_table to ON for MySQL / Galera
+ - Switch Nova / Libvirt VNC server binding to use the IP address
+ provided in Hiera instead of 0.0.0.0.
+ - Proxy API endpoints that TripleO UI uses.
+ - Rebranding of Eqlx to Dell EMC PS Series.
+ - Add support for ScaleIO backend in Cinder Volume profile.
+ - Add support to changing the Rabbitmq password on stack-update.
+deprecations:
+ - Remove tripleo::vip_hosts class, no longer used.
+security:
+ - CVE-2016-9599 Enforce Firewall TCP / UDP rules management, by
+ sanitizing dynamic HAproxy endpoints firewall rules, securing
+ firewall rules creations (disallow TCP/UDP rules without sport or
+ dport), but allow to open all traffic for TCP/UDP when actually
+ desired.
+fixes:
+ - Fixes `bug 1648736
+ <https://bugs.launchpad.net/tripleo/+bug/1648736>`__ so swift-proxy
+ is decoupled from ceilometer packages.
+ - Fixes `bug 1652107
+ <https://bugs.launchpad.net/tripleo/+bug/1652107>`__ so we ensure
+ package updates don't happen unexpectedly.
+ - Fixes `bug 1645898
+ <https://bugs.launchpad.net/tripleo/+bug/1645898>`__ so we ensure
+ to bind the rabbit inter-cluster to a specific interface.
+other:
+ - Introduce more Puppet rspec tests that improve testing quality.
diff --git a/releasenotes/notes/add-support-for-octavia-f1e472af89e9a05c.yaml b/releasenotes/notes/add-support-for-octavia-f1e472af89e9a05c.yaml
new file mode 100644
index 0000000..62744e0
--- /dev/null
+++ b/releasenotes/notes/add-support-for-octavia-f1e472af89e9a05c.yaml
@@ -0,0 +1,4 @@
+---
+features:
+ - |
+ Add profiles for the Octavia LBaaS service.
diff --git a/releasenotes/notes/hpelefthand_8474c416b0d411e6.yaml b/releasenotes/notes/hpelefthand_8474c416b0d411e6.yaml
new file mode 100644
index 0000000..a92cbae
--- /dev/null
+++ b/releasenotes/notes/hpelefthand_8474c416b0d411e6.yaml
@@ -0,0 +1,3 @@
+---
+features:
+ - Added hpelefthand_iscsi backend support for cinder
diff --git a/releasenotes/notes/innodb_file_per_table-f925b3bbf29d44ea.yaml b/releasenotes/notes/innodb_file_per_table-f925b3bbf29d44ea.yaml
new file mode 100644
index 0000000..e0b7c3c
--- /dev/null
+++ b/releasenotes/notes/innodb_file_per_table-f925b3bbf29d44ea.yaml
@@ -0,0 +1,20 @@
+---
+features:
+ - Enable innodb_file_per_table for MySQL/MariaDB databases
+upgrade:
+ - |
+ Newly created MySQL database tables will be stored in their own datafiles,
+ instead of in a single monolithic ibdata file.
+ - |
+ Existing MySQL database tables that are persisted within the monolithic
+ ibdata file will remain so unless the database is migrated as well.
+ - |
+ Migration of all current database tables out of the monolithic ibdata
+ file is possible by dumping and restoring the whole database to a new data
+ directory, however when using Galera the entire cluster must be shut
+ down and upgraded at once.
+ - |
+ Migration of individual tables to datafiles is possible using the
+ MySQL command "ALTER TABLE <databasename>.<tablename> ENGINE=InnoDB;",
+ however this will not shrink the ibdata file and also is not safe to run
+ on a running Galera cluster for large tables.
diff --git a/releasenotes/notes/nova_cells_setup-2c3e3344d8adcc26.yaml b/releasenotes/notes/nova_cells_setup-2c3e3344d8adcc26.yaml
new file mode 100644
index 0000000..79439b2
--- /dev/null
+++ b/releasenotes/notes/nova_cells_setup-2c3e3344d8adcc26.yaml
@@ -0,0 +1,3 @@
+---
+features:
+ - Configure the basic cells setup for Nova, now required in Ocata.
diff --git a/releasenotes/notes/proxy-api-endpoints-359e5fb64d80d400.yaml b/releasenotes/notes/proxy-api-endpoints-359e5fb64d80d400.yaml
new file mode 100644
index 0000000..63830e5
--- /dev/null
+++ b/releasenotes/notes/proxy-api-endpoints-359e5fb64d80d400.yaml
@@ -0,0 +1,6 @@
+---
+features:
+ - Added ability to proxy API service endpoints through
+ Apache mod_rewrite rules by creating ProxyPass and
+ ProxyPassReverse directives for each API service
+
diff --git a/releasenotes/notes/puppet-auditd-0f6cbd6a2d193aac.yaml b/releasenotes/notes/puppet-auditd-0f6cbd6a2d193aac.yaml
new file mode 100644
index 0000000..9eb7c79
--- /dev/null
+++ b/releasenotes/notes/puppet-auditd-0f6cbd6a2d193aac.yaml
@@ -0,0 +1,4 @@
+---
+features:
+ - Adds the ability to manage auditd.service and enter audit.rules
+
diff --git a/releasenotes/notes/rabbitmq_password_change-4fce15c9ebb0e20c.yaml b/releasenotes/notes/rabbitmq_password_change-4fce15c9ebb0e20c.yaml
new file mode 100644
index 0000000..351db74
--- /dev/null
+++ b/releasenotes/notes/rabbitmq_password_change-4fce15c9ebb0e20c.yaml
@@ -0,0 +1,4 @@
+---
+issues:
+ - Invoke rabbitmq_user resource explicity to apply password change during
+ update, if any.
diff --git a/releasenotes/notes/remove-old-urls-dea2b7fdcb50dd48.yaml b/releasenotes/notes/remove-old-urls-dea2b7fdcb50dd48.yaml
new file mode 100644
index 0000000..d82ff11
--- /dev/null
+++ b/releasenotes/notes/remove-old-urls-dea2b7fdcb50dd48.yaml
@@ -0,0 +1,12 @@
+---
+upgrade:
+ - |
+ Removed the following URL configuration variables from tripleo::ui:
+
+ * keystone_url
+ * heat_url
+ * ironic_url
+ * mistral_url
+ * swift_url
+ * zaqar_websocket_url
+
diff --git a/releasenotes/notes/rgw-keystone-v3-43ef17dd10f825be.yaml b/releasenotes/notes/rgw-keystone-v3-43ef17dd10f825be.yaml
new file mode 100644
index 0000000..6159415
--- /dev/null
+++ b/releasenotes/notes/rgw-keystone-v3-43ef17dd10f825be.yaml
@@ -0,0 +1,5 @@
+---
+features:
+ - Add support for configuring Ceph RGW to use
+ keystone V3 service authentication instead
+ of admin token authentication
diff --git a/releasenotes/notes/sshd-437c531301f458bb.yaml b/releasenotes/notes/sshd-437c531301f458bb.yaml
new file mode 100644
index 0000000..0086cb0
--- /dev/null
+++ b/releasenotes/notes/sshd-437c531301f458bb.yaml
@@ -0,0 +1,3 @@
+---
+features:
+ - Added manifest and template to enable configuration of sshd_config
diff --git a/releasenotes/notes/use-reno-80402e5526a598aa.yaml b/releasenotes/notes/use-reno-80402e5526a598aa.yaml
new file mode 100644
index 0000000..8102962
--- /dev/null
+++ b/releasenotes/notes/use-reno-80402e5526a598aa.yaml
@@ -0,0 +1,6 @@
+---
+prelude: >
+ Release notes are generated by Reno.
+features:
+ - Release notes are no longer maintained by hand, we now use the reno tool to
+ manage them. \ No newline at end of file
diff --git a/releasenotes/notes/vncserver_listen-4417377cac38464c.yaml b/releasenotes/notes/vncserver_listen-4417377cac38464c.yaml
new file mode 100644
index 0000000..0c0f8ea
--- /dev/null
+++ b/releasenotes/notes/vncserver_listen-4417377cac38464c.yaml
@@ -0,0 +1,7 @@
+---
+features:
+ - Configure VNC server to be binded on internal network interface on compute nodes.
+ This value comes from tripleo-heat-templates and is configured by default to use
+ an IP address from the internal API network.
+ We use the ServiceNetMap in tripleo-heat-templates to compute the IP address, and we won't
+ configure 0.0.0.0 anymore as it used to open the binding to any network, which is unsecure.
diff --git a/releasenotes/source/_static/.placeholder b/releasenotes/source/_static/.placeholder
new file mode 100644
index 0000000..e69de29
--- /dev/null
+++ b/releasenotes/source/_static/.placeholder
diff --git a/releasenotes/source/conf.py b/releasenotes/source/conf.py
new file mode 100644
index 0000000..5cc0c41
--- /dev/null
+++ b/releasenotes/source/conf.py
@@ -0,0 +1,262 @@
+# -*- coding: utf-8 -*-
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+# implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+# If extensions (or modules to document with autodoc) are in another directory,
+# add these directories to sys.path here. If the directory is relative to the
+# documentation root, use os.path.abspath to make it absolute, like shown here.
+#sys.path.insert(0, os.path.abspath('.'))
+
+# -- General configuration ------------------------------------------------
+
+# If your documentation needs a minimal Sphinx version, state it here.
+#needs_sphinx = '1.0'
+
+# Add any Sphinx extension module names here, as strings. They can be
+# extensions coming with Sphinx (named 'sphinx.ext.*') or your custom
+# ones.
+extensions = [
+ 'oslosphinx',
+ 'reno.sphinxext',
+]
+
+# Add any paths that contain templates here, relative to this directory.
+templates_path = ['_templates']
+
+# The suffix of source filenames.
+source_suffix = '.rst'
+
+# The encoding of source files.
+#source_encoding = 'utf-8-sig'
+
+# The master toctree document.
+master_doc = 'index'
+
+# General information about the project.
+project = u'puppet-tripleo Release Notes'
+copyright = u'2016, Puppet TripleO Developers'
+
+# The version info for the project you're documenting, acts as replacement for
+# |version| and |release|, also used in various other places throughout the
+# built documents.
+#
+# The short X.Y version.
+version = '6.2.0'
+# The full version, including alpha/beta/rc tags.
+release = '6.2.0'
+
+# The language for content autogenerated by Sphinx. Refer to documentation
+# for a list of supported languages.
+#language = None
+
+# There are two options for replacing |today|: either, you set today to some
+# non-false value, then it is used:
+#today = ''
+# Else, today_fmt is used as the format for a strftime call.
+#today_fmt = '%B %d, %Y'
+
+# List of patterns, relative to source directory, that match files and
+# directories to ignore when looking for source files.
+exclude_patterns = []
+
+# The reST default role (used for this markup: `text`) to use for all
+# documents.
+#default_role = None
+
+# If true, '()' will be appended to :func: etc. cross-reference text.
+#add_function_parentheses = True
+
+# If true, the current module name will be prepended to all description
+# unit titles (such as .. function::).
+#add_module_names = True
+
+# If true, sectionauthor and moduleauthor directives will be shown in the
+# output. They are ignored by default.
+#show_authors = False
+
+# The name of the Pygments (syntax highlighting) style to use.
+pygments_style = 'sphinx'
+
+# A list of ignored prefixes for module index sorting.
+#modindex_common_prefix = []
+
+# If true, keep warnings as "system message" paragraphs in the built documents.
+#keep_warnings = False
+
+
+# -- Options for HTML output ----------------------------------------------
+
+# The theme to use for HTML and HTML Help pages. See the documentation for
+# a list of builtin themes.
+html_theme = 'default'
+
+# Theme options are theme-specific and customize the look and feel of a theme
+# further. For a list of options available for each theme, see the
+# documentation.
+#html_theme_options = {}
+
+# Add any paths that contain custom themes here, relative to this directory.
+#html_theme_path = []
+
+# The name for this set of Sphinx documents. If None, it defaults to
+# "<project> v<release> documentation".
+#html_title = None
+
+# A shorter title for the navigation bar. Default is the same as html_title.
+#html_short_title = None
+
+# The name of an image file (relative to this directory) to place at the top
+# of the sidebar.
+#html_logo = None
+
+# The name of an image file (within the static path) to use as favicon of the
+# docs. This file should be a Windows icon file (.ico) being 16x16 or 32x32
+# pixels large.
+#html_favicon = None
+
+# Add any paths that contain custom static files (such as style sheets) here,
+# relative to this directory. They are copied after the builtin static files,
+# so a file named "default.css" will overwrite the builtin "default.css".
+html_static_path = ['_static']
+
+# Add any extra paths that contain custom files (such as robots.txt or
+# .htaccess) here, relative to this directory. These files are copied
+# directly to the root of the documentation.
+#html_extra_path = []
+
+# If not '', a 'Last updated on:' timestamp is inserted at every page bottom,
+# using the given strftime format.
+#html_last_updated_fmt = '%b %d, %Y'
+
+# If true, SmartyPants will be used to convert quotes and dashes to
+# typographically correct entities.
+#html_use_smartypants = True
+
+# Custom sidebar templates, maps document names to template names.
+#html_sidebars = {}
+
+# Additional templates that should be rendered to pages, maps page names to
+# template names.
+#html_additional_pages = {}
+
+# If false, no module index is generated.
+#html_domain_indices = True
+
+# If false, no index is generated.
+#html_use_index = True
+
+# If true, the index is split into individual pages for each letter.
+#html_split_index = False
+
+# If true, links to the reST sources are added to the pages.
+#html_show_sourcelink = True
+
+# If true, "Created using Sphinx" is shown in the HTML footer. Default is True.
+#html_show_sphinx = True
+
+# If true, "(C) Copyright ..." is shown in the HTML footer. Default is True.
+#html_show_copyright = True
+
+# If true, an OpenSearch description file will be output, and all pages will
+# contain a <link> tag referring to it. The value of this option must be the
+# base URL from which the finished HTML is served.
+#html_use_opensearch = ''
+
+# This is the file name suffix for HTML files (e.g. ".xhtml").
+#html_file_suffix = None
+
+# Output file base name for HTML help builder.
+htmlhelp_basename = 'puppet-tripleoReleaseNotesdoc'
+
+
+# -- Options for LaTeX output ---------------------------------------------
+
+latex_elements = {
+# The paper size ('letterpaper' or 'a4paper').
+#'papersize': 'letterpaper',
+
+# The font size ('10pt', '11pt' or '12pt').
+#'pointsize': '10pt',
+
+# Additional stuff for the LaTeX preamble.
+#'preamble': '',
+}
+
+# Grouping the document tree into LaTeX files. List of tuples
+# (source start file, target name, title,
+# author, documentclass [howto, manual, or own class]).
+latex_documents = [
+ ('index', 'puppet-tripleoReleaseNotes.tex', u'puppet-tripleo Release Notes Documentation',
+ u'2016, Puppet TripleO Developers', 'manual'),
+]
+
+# The name of an image file (relative to this directory) to place at the top of
+# the title page.
+#latex_logo = None
+
+# For "manual" documents, if this is true, then toplevel headings are parts,
+# not chapters.
+#latex_use_parts = False
+
+# If true, show page references after internal links.
+#latex_show_pagerefs = False
+
+# If true, show URL addresses after external links.
+#latex_show_urls = False
+
+# Documents to append as an appendix to all manuals.
+#latex_appendices = []
+
+# If false, no module index is generated.
+#latex_domain_indices = True
+
+
+# -- Options for manual page output ---------------------------------------
+
+# One entry per manual page. List of tuples
+# (source start file, name, description, authors, manual section).
+man_pages = [
+ ('index', 'puppet-tripleoreleasenotes', u'puppet-tripleo Release Notes Documentation',
+ [u'2016, Puppet TripleO Developers'], 1)
+]
+
+# If true, show URL addresses after external links.
+#man_show_urls = False
+
+
+# -- Options for Texinfo output -------------------------------------------
+
+# Grouping the document tree into Texinfo files. List of tuples
+# (source start file, target name, title, author,
+# dir menu entry, description, category)
+texinfo_documents = [
+ ('index', 'puppet-tripleoReleaseNotes', u'puppet-tripleo Release Notes Documentation',
+ u'2016, Puppet TripleO Developers', 'puppet-tripleoReleaseNotes', 'Puppet TripleO Project.',
+ 'Miscellaneous'),
+]
+
+# Documents to append as an appendix to all manuals.
+#texinfo_appendices = []
+
+# If false, no module index is generated.
+#texinfo_domain_indices = True
+
+# How to display URL addresses: 'footnote', 'no', or 'inline'.
+#texinfo_show_urls = 'footnote'
+
+# If true, do not generate a @detailmenu in the "Top" node's menu.
+#texinfo_no_detailmenu = False
+
+# -- Options for Internationalization output ------------------------------
+locale_dirs = ['locale/']
diff --git a/releasenotes/source/index.rst b/releasenotes/source/index.rst
new file mode 100644
index 0000000..b6dd81d
--- /dev/null
+++ b/releasenotes/source/index.rst
@@ -0,0 +1,9 @@
+============================
+puppet-tripleo Release Notes
+============================
+
+.. toctree::
+ :maxdepth: 1
+
+ unreleased
+ ocata
diff --git a/releasenotes/source/ocata.rst b/releasenotes/source/ocata.rst
new file mode 100644
index 0000000..ebe62f4
--- /dev/null
+++ b/releasenotes/source/ocata.rst
@@ -0,0 +1,6 @@
+===================================
+ Ocata Series Release Notes
+===================================
+
+.. release-notes::
+ :branch: origin/stable/ocata
diff --git a/releasenotes/source/unreleased.rst b/releasenotes/source/unreleased.rst
new file mode 100644
index 0000000..3bf0e9c
--- /dev/null
+++ b/releasenotes/source/unreleased.rst
@@ -0,0 +1,5 @@
+==============================
+ Current Series Release Notes
+==============================
+
+ .. release-notes:: \ No newline at end of file
diff --git a/setup.cfg b/setup.cfg
new file mode 100644
index 0000000..5eab1d8
--- /dev/null
+++ b/setup.cfg
@@ -0,0 +1,13 @@
+[metadata]
+name = puppet-tripleo
+summary = Puppet module for OpenStack TripleO
+description-file =
+ README.md
+author = Puppet Labs and OpenStack Contributors
+author-email = openstack-dev@lists.openstack.org
+home-page = http://www.openstack.org/
+classifier =
+ Intended Audience :: Developers
+ Intended Audience :: System Administrators
+ License :: OSI Approved :: Apache Software License
+ Operating System :: POSIX :: Linux \ No newline at end of file
diff --git a/setup.py b/setup.py
new file mode 100644
index 0000000..7eeb36b
--- /dev/null
+++ b/setup.py
@@ -0,0 +1,22 @@
+#!/usr/bin/env python
+# Copyright (c) 2013 Hewlett-Packard Development Company, L.P.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+# implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# THIS FILE IS MANAGED BY THE GLOBAL REQUIREMENTS REPO - DO NOT EDIT
+import setuptools
+
+setuptools.setup(
+ setup_requires=['pbr'],
+ pbr=True) \ No newline at end of file
diff --git a/spec/classes/tripleo_firewall_spec.rb b/spec/classes/tripleo_firewall_spec.rb
index 3116a51..92b51e5 100644
--- a/spec/classes/tripleo_firewall_spec.rb
+++ b/spec/classes/tripleo_firewall_spec.rb
@@ -34,35 +34,65 @@ describe 'tripleo::firewall' do
end
it 'configure basic pre firewall rules' do
- is_expected.to contain_firewall('000 accept related established rules').with(
+ is_expected.to contain_firewall('000 accept related established rules ipv4').with(
:proto => 'all',
:state => ['RELATED', 'ESTABLISHED'],
:action => 'accept',
)
- is_expected.to contain_firewall('001 accept all icmp').with(
+ is_expected.to contain_firewall('000 accept related established rules ipv6').with(
+ :proto => 'all',
+ :state => ['RELATED', 'ESTABLISHED'],
+ :action => 'accept',
+ :provider => 'ip6tables',
+ )
+ is_expected.to contain_firewall('001 accept all icmp ipv4').with(
:proto => 'icmp',
:action => 'accept',
:state => ['NEW'],
)
- is_expected.to contain_firewall('002 accept all to lo interface').with(
+ is_expected.to contain_firewall('001 accept all icmp ipv6').with(
+ :proto => 'ipv6-icmp',
+ :action => 'accept',
+ :state => ['NEW'],
+ :provider => 'ip6tables',
+ )
+ is_expected.to contain_firewall('002 accept all to lo interface ipv4').with(
:proto => 'all',
:iniface => 'lo',
:action => 'accept',
:state => ['NEW'],
)
- is_expected.to contain_firewall('003 accept ssh').with(
+ is_expected.to contain_firewall('002 accept all to lo interface ipv6').with(
+ :proto => 'all',
+ :iniface => 'lo',
+ :action => 'accept',
+ :state => ['NEW'],
+ :provider => 'ip6tables',
+ )
+ is_expected.to contain_firewall('003 accept ssh ipv4').with(
:dport => '22',
:proto => 'tcp',
:action => 'accept',
:state => ['NEW'],
)
+ is_expected.to contain_firewall('003 accept ssh ipv6').with(
+ :dport => '22',
+ :proto => 'tcp',
+ :action => 'accept',
+ :state => ['NEW'],
+ :provider => 'ip6tables',
+ )
end
it 'configure basic post firewall rules' do
- is_expected.to contain_firewall('999 drop all').with(
+ is_expected.to contain_firewall('999 drop all ipv4').with(
:proto => 'all',
:action => 'drop',
- :source => '0.0.0.0/0',
+ )
+ is_expected.to contain_firewall('999 drop all ipv6').with(
+ :proto => 'all',
+ :action => 'drop',
+ :provider => 'ip6tables',
)
end
end
@@ -74,44 +104,71 @@ describe 'tripleo::firewall' do
:firewall_rules => {
'300 add custom application 1' => {'port' => '999', 'proto' => 'udp', 'action' => 'accept'},
'301 add custom application 2' => {'port' => '8081', 'proto' => 'tcp', 'action' => 'accept'},
- '302 fwd custom cidr 1' => {'chain' => 'FORWARD', 'destination' => '192.0.2.0/24'},
+ '302 fwd custom cidr 1' => {'port' => 'all', 'chain' => 'FORWARD', 'destination' => '192.0.2.0/24'},
'303 add custom application 3' => {'dport' => '8081', 'proto' => 'tcp', 'action' => 'accept'},
'304 add custom application 4' => {'sport' => '1000', 'proto' => 'tcp', 'action' => 'accept'},
- '305 add gre rule' => {'proto' => 'gre'}
+ '305 add gre rule' => {'proto' => 'gre'},
+ '306 add custom cidr 2' => {'port' => 'all', 'destination' => '::1/24'},
}
)
end
it 'configure custom firewall rules' do
- is_expected.to contain_firewall('300 add custom application 1').with(
+ is_expected.to contain_firewall('300 add custom application 1 ipv4').with(
:port => '999',
:proto => 'udp',
:action => 'accept',
:state => ['NEW'],
)
- is_expected.to contain_firewall('301 add custom application 2').with(
+ is_expected.to contain_firewall('301 add custom application 2 ipv4').with(
:port => '8081',
:proto => 'tcp',
:action => 'accept',
:state => ['NEW'],
)
- is_expected.to contain_firewall('302 fwd custom cidr 1').with(
+ is_expected.to contain_firewall('302 fwd custom cidr 1 ipv4').with(
:chain => 'FORWARD',
- :destination => '192.0.2.0/24',
+ :proto => 'tcp',
+ :destination => '192.0.2.0/24',
)
- is_expected.to contain_firewall('303 add custom application 3').with(
+ is_expected.to_not contain_firewall('302 fwd custom cidr 1 ipv6')
+ is_expected.to contain_firewall('303 add custom application 3 ipv4').with(
:dport => '8081',
:proto => 'tcp',
:action => 'accept',
:state => ['NEW'],
)
- is_expected.to contain_firewall('304 add custom application 4').with(
+ is_expected.to contain_firewall('304 add custom application 4 ipv4').with(
:sport => '1000',
:proto => 'tcp',
:action => 'accept',
:state => ['NEW'],
)
- is_expected.to contain_firewall('305 add gre rule').without(:state)
+ is_expected.to contain_firewall('304 add custom application 4 ipv6').with(
+ :sport => '1000',
+ :proto => 'tcp',
+ :action => 'accept',
+ :state => ['NEW'],
+ )
+ is_expected.to contain_firewall('305 add gre rule ipv4').without(:state)
+ is_expected.to contain_firewall('306 add custom cidr 2 ipv6').with(
+ :proto => 'tcp',
+ :destination => '::1/24',
+ :action => 'accept',
+ :provider => 'ip6tables',
+ )
+ end
+ end
+
+ context 'with TCP rule without port or dport or sport specified' do
+ before :each do
+ params.merge!(
+ :manage_firewall => true,
+ :firewall_rules => {
+ '500 wrong tcp rule' => {'proto' => 'tcp', 'action' => 'accept'},
+ }
+ )
end
+ it_raises 'a Puppet::Error', /500 wrong tcp rule firewall rule cannot be created. TCP or UDP rules for INPUT or OUTPUT need port or sport or dport./
end
end
diff --git a/spec/classes/tripleo_midonet_agent_spec.rb b/spec/classes/tripleo_midonet_agent_spec.rb
deleted file mode 100644
index 73d90b6..0000000
--- a/spec/classes/tripleo_midonet_agent_spec.rb
+++ /dev/null
@@ -1,58 +0,0 @@
-#
-# Copyright (C) 2015 Midokura SARL
-#
-# Licensed under the Apache License, Version 2.0 (the "License"); you may
-# not use this file except in compliance with the License. You may obtain
-# a copy of the License at
-#
-# http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
-# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
-# License for the specific language governing permissions and limitations
-# under the License.
-#
-# Unit tests for the midonet agent
-
-require 'spec_helper'
-
-describe 'tripleo::network::midonet::agent' do
-
- shared_examples_for 'tripleo::network::midonet::agent' do
-
- let :params do
- {
- :zookeeper_servers => ['192.168.2.2', '192.168.2.3'],
- :cassandra_seeds => ['192.168.2.2', '192.168.2.3']
- }
- end
-
- it 'should stop openvswitch' do
- is_expected.to contain_service('openvswitch').with(
- :ensure => 'stopped',
- :enable => false
- )
- end
-
- it 'should run the agent with a list of maps' do
- is_expected.to contain_class('midonet::midonet_agent').with(
- :zk_servers => [{'ip' => '192.168.2.2',
- 'port' => 2181},
- {'ip' => '192.168.2.3',
- 'port' => 2181}],
- :cassandra_seeds => ['192.168.2.2','192.168.2.3']
- )
- end
- end
-
- on_supported_os.each do |os, facts|
- context "on #{os}" do
- let(:facts) do
- facts.merge({})
- end
-
- it_behaves_like 'tripleo::network::midonet::agent'
- end
- end
-end
diff --git a/spec/classes/tripleo_profile_base_ceilometer_api_spec.rb b/spec/classes/tripleo_profile_base_ceilometer_api_spec.rb
index 935e9e8..acc9b51 100644
--- a/spec/classes/tripleo_profile_base_ceilometer_api_spec.rb
+++ b/spec/classes/tripleo_profile_base_ceilometer_api_spec.rb
@@ -34,7 +34,7 @@ describe 'tripleo::profile::base::ceilometer::api' do
context 'with step 4' do
let(:params) { {
- :step => 4,
+ :step => 4,
} }
it 'should trigger complete configuration' do
diff --git a/spec/classes/tripleo_profile_base_ceph_mds_spec.rb b/spec/classes/tripleo_profile_base_ceph_mds_spec.rb
new file mode 100644
index 0000000..a129103
--- /dev/null
+++ b/spec/classes/tripleo_profile_base_ceph_mds_spec.rb
@@ -0,0 +1,59 @@
+#
+# Copyright (C) 2016 Red Hat, Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License. You may obtain
+# a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations
+# under the License.
+#
+
+require 'spec_helper'
+
+describe 'tripleo::profile::base::ceph::mds' do
+ shared_examples_for 'tripleo::profile::base::ceph::mds' do
+ let (:pre_condition) do
+ <<-eof
+ class { '::tripleo::profile::base::ceph':
+ step => #{params[:step]}
+ }
+ eof
+ end
+
+ context 'with step less than 3' do
+ let(:params) { { :step => 2 } }
+ it 'should do nothing' do
+ is_expected.to contain_class('tripleo::profile::base::ceph')
+ is_expected.to_not contain_class('ceph::profile::mds')
+ end
+ end
+
+ context 'with step 3' do
+ let(:params) { {
+ :step => 3,
+ } }
+
+ it 'should include mds configuration' do
+ is_expected.to contain_class('tripleo::profile::base::ceph')
+ is_expected.to contain_class('ceph::profile::mds')
+ end
+ end
+
+ end
+
+ on_supported_os.each do |os, facts|
+ context "on #{os}" do
+ let(:facts) do
+ facts.merge({ :hostname => 'node.example.com' })
+ end
+
+ it_behaves_like 'tripleo::profile::base::ceph::mds'
+ end
+ end
+end
diff --git a/spec/classes/tripleo_profile_base_ceph_rgw_spec.rb b/spec/classes/tripleo_profile_base_ceph_rgw_spec.rb
index 88f971b..4ebf521 100644
--- a/spec/classes/tripleo_profile_base_ceph_rgw_spec.rb
+++ b/spec/classes/tripleo_profile_base_ceph_rgw_spec.rb
@@ -85,6 +85,17 @@ describe 'tripleo::profile::base::ceph::rgw' do
)
end
end
+
+ context 'with step 4 and keystone v3' do
+ let(:params) { default_params.merge({ :step => 4, :rgw_keystone_version => 'v3' }) }
+ it 'should include rgw configuration' do
+ is_expected.to contain_ceph__rgw__keystone('radosgw.gateway').with(
+ :rgw_keystone_accepted_roles => ["admin", "_member_", "Member"],
+ :use_pki => false,
+ :rgw_keystone_url => 'url'
+ )
+ end
+ end
end
on_supported_os.each do |os, facts|
diff --git a/spec/classes/tripleo_profile_base_cinder_api_spec.rb b/spec/classes/tripleo_profile_base_cinder_api_spec.rb
index a0c607d..6a36632 100644
--- a/spec/classes/tripleo_profile_base_cinder_api_spec.rb
+++ b/spec/classes/tripleo_profile_base_cinder_api_spec.rb
@@ -30,7 +30,6 @@ describe 'tripleo::profile::base::cinder::api' do
is_expected.to contain_class('tripleo::profile::base::cinder')
is_expected.to_not contain_class('cinder::api')
is_expected.to_not contain_class('cinder::ceilometer')
- is_expected.to_not contain_class('cinder::glance')
end
end
@@ -43,7 +42,6 @@ describe 'tripleo::profile::base::cinder::api' do
it 'should trigger complete configuration' do
is_expected.to contain_class('cinder::api')
is_expected.to contain_class('cinder::ceilometer')
- is_expected.to contain_class('cinder::glance')
end
end
@@ -56,7 +54,6 @@ describe 'tripleo::profile::base::cinder::api' do
it 'should not trigger any configuration' do
is_expected.to_not contain_class('cinder::api')
is_expected.to_not contain_class('cinder::ceilometer')
- is_expected.to_not contain_class('cinder::glance')
end
end
@@ -68,7 +65,6 @@ describe 'tripleo::profile::base::cinder::api' do
it 'should trigger complete configuration' do
is_expected.to contain_class('cinder::api')
is_expected.to contain_class('cinder::ceilometer')
- is_expected.to contain_class('cinder::glance')
end
end
end
diff --git a/spec/classes/tripleo_profile_base_cinder_scaleio_spec.rb b/spec/classes/tripleo_profile_base_cinder_scaleio_spec.rb
new file mode 100644
index 0000000..0f12b0a
--- /dev/null
+++ b/spec/classes/tripleo_profile_base_cinder_scaleio_spec.rb
@@ -0,0 +1,58 @@
+#
+# Copyright (C) 2016 Red Hat, Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License. You may obtain
+# a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations
+# under the License.
+#
+
+require 'spec_helper'
+
+describe 'tripleo::profile::base::cinder::volume::scaleio' do
+ shared_examples_for 'tripleo::profile::base::cinder::volume::scaleio' do
+ before :each do
+ facts.merge!({ :step => params[:step] })
+ end
+
+ context 'with step less than 4' do
+ let(:params) { { :step => 3 } }
+
+ it 'should do nothing' do
+ is_expected.to contain_class('tripleo::profile::base::cinder::volume::scaleio')
+ is_expected.to contain_class('tripleo::profile::base::cinder::volume')
+ is_expected.to contain_class('tripleo::profile::base::cinder')
+ is_expected.to_not contain_cinder__backend__scaleio('tripleo_scaleio')
+ end
+ end
+
+ context 'with step 4' do
+ let(:params) { {
+ :step => 4,
+ } }
+
+ it 'should trigger complete configuration' do
+ # TODO(aschultz): check hiera parameters
+ is_expected.to contain_cinder__backend__scaleio('tripleo_scaleio')
+ end
+ end
+ end
+
+
+ on_supported_os.each do |os, facts|
+ context "on #{os}" do
+ let(:facts) do
+ facts.merge({ :hostname => 'node.example.com' })
+ end
+
+ it_behaves_like 'tripleo::profile::base::cinder::volume::scaleio'
+ end
+ end
+end
diff --git a/spec/classes/tripleo_profile_base_cinder_spec.rb b/spec/classes/tripleo_profile_base_cinder_spec.rb
index 6a36152..81fa047 100644
--- a/spec/classes/tripleo_profile_base_cinder_spec.rb
+++ b/spec/classes/tripleo_profile_base_cinder_spec.rb
@@ -24,6 +24,7 @@ describe 'tripleo::profile::base::cinder' do
is_expected.to contain_class('tripleo::profile::base::cinder')
is_expected.to_not contain_class('cinder')
is_expected.to_not contain_class('cinder::config')
+ is_expected.to_not contain_class('cinder::glance')
is_expected.to_not contain_class('cinder:::cron::db_purge')
end
end
@@ -41,6 +42,7 @@ describe 'tripleo::profile::base::cinder' do
:rabbit_hosts => params[:rabbit_hosts].map{ |h| "#{h}:#{params[:rabbit_port]}" }
)
is_expected.to contain_class('cinder::config')
+ is_expected.to contain_class('cinder::glance')
is_expected.to_not contain_class('cinder::cron::db_purge')
end
end
@@ -54,6 +56,7 @@ describe 'tripleo::profile::base::cinder' do
it 'should not trigger any configuration' do
is_expected.to_not contain_class('cinder')
is_expected.to_not contain_class('cinder::config')
+ is_expected.to_not contain_class('cinder::glance')
is_expected.to_not contain_class('cinder:::cron::db_purge')
end
end
@@ -71,6 +74,7 @@ describe 'tripleo::profile::base::cinder' do
:rabbit_hosts => params[:rabbit_hosts].map{ |h| "#{h}:#{params[:rabbit_port]}" }
)
is_expected.to contain_class('cinder::config')
+ is_expected.to contain_class('cinder::glance')
is_expected.to_not contain_class('cinder:::cron::db_purge')
end
end
@@ -87,6 +91,7 @@ describe 'tripleo::profile::base::cinder' do
:rabbit_hosts => params[:rabbit_hosts].map{ |h| "#{h}:5672" }
)
is_expected.to contain_class('cinder::config')
+ is_expected.to contain_class('cinder::glance')
is_expected.to contain_class('cinder::cron::db_purge')
end
end
@@ -104,6 +109,7 @@ describe 'tripleo::profile::base::cinder' do
:rabbit_hosts => params[:rabbit_hosts].map{ |h| "#{h}:5672" }
)
is_expected.to contain_class('cinder::config')
+ is_expected.to contain_class('cinder::glance')
is_expected.to_not contain_class('cinder::cron::db_purge')
end
end
diff --git a/spec/classes/tripleo_profile_base_cinder_volume_eqlx_spec.rb b/spec/classes/tripleo_profile_base_cinder_volume_dellps_spec.rb
index 1a188aa..313b87c 100644
--- a/spec/classes/tripleo_profile_base_cinder_volume_eqlx_spec.rb
+++ b/spec/classes/tripleo_profile_base_cinder_volume_dellps_spec.rb
@@ -16,8 +16,8 @@
require 'spec_helper'
-describe 'tripleo::profile::base::cinder::volume::eqlx' do
- shared_examples_for 'tripleo::profile::base::cinder::volume::eqlx' do
+describe 'tripleo::profile::base::cinder::volume::dellps' do
+ shared_examples_for 'tripleo::profile::base::cinder::volume::dellps' do
before :each do
facts.merge!({ :step => params[:step] })
end
@@ -26,10 +26,10 @@ describe 'tripleo::profile::base::cinder::volume::eqlx' do
let(:params) { { :step => 3 } }
it 'should do nothing' do
- is_expected.to contain_class('tripleo::profile::base::cinder::volume::eqlx')
+ is_expected.to contain_class('tripleo::profile::base::cinder::volume::dellps')
is_expected.to contain_class('tripleo::profile::base::cinder::volume')
is_expected.to contain_class('tripleo::profile::base::cinder')
- is_expected.to_not contain_cinder__backend__eqlx('tripleo_eqlx')
+ is_expected.to_not contain_cinder__backend__eqlx('tripleo_dellps')
end
end
@@ -40,7 +40,7 @@ describe 'tripleo::profile::base::cinder::volume::eqlx' do
it 'should trigger complete configuration' do
# TODO(aschultz): check hiera parameters
- is_expected.to contain_cinder__backend__eqlx('tripleo_eqlx')
+ is_expected.to contain_cinder__backend__eqlx('tripleo_dellps')
end
end
end
@@ -52,7 +52,7 @@ describe 'tripleo::profile::base::cinder::volume::eqlx' do
facts.merge({ :hostname => 'node.example.com' })
end
- it_behaves_like 'tripleo::profile::base::cinder::volume::eqlx'
+ it_behaves_like 'tripleo::profile::base::cinder::volume::dellps'
end
end
end
diff --git a/spec/classes/tripleo_profile_base_cinder_volume_spec.rb b/spec/classes/tripleo_profile_base_cinder_volume_spec.rb
index e0ec9de..f4501c8 100644
--- a/spec/classes/tripleo_profile_base_cinder_volume_spec.rb
+++ b/spec/classes/tripleo_profile_base_cinder_volume_spec.rb
@@ -74,21 +74,21 @@ describe 'tripleo::profile::base::cinder::volume' do
end
end
- context 'with only eqlx' do
+ context 'with only dellps' do
before :each do
params.merge!({
- :cinder_enable_eqlx_backend => true,
+ :cinder_enable_dellps_backend => true,
:cinder_enable_iscsi_backend => false,
})
end
- it 'should configure only eqlx' do
- is_expected.to contain_class('tripleo::profile::base::cinder::volume::eqlx')
+ it 'should configure only dellps' do
+ is_expected.to contain_class('tripleo::profile::base::cinder::volume::dellps')
is_expected.to_not contain_class('tripleo::profile::base::cinder::volume::iscsi')
is_expected.to contain_class('tripleo::profile::base::cinder::volume')
is_expected.to contain_class('tripleo::profile::base::cinder')
is_expected.to contain_class('cinder::volume')
is_expected.to contain_class('cinder::backends').with(
- :enabled_backends => ['tripleo_eqlx']
+ :enabled_backends => ['tripleo_dellps']
)
end
end
@@ -160,7 +160,7 @@ describe 'tripleo::profile::base::cinder::volume' do
it 'should configure only user backend' do
is_expected.to_not contain_class('tripleo::profile::base::cinder::volume::iscsi')
is_expected.to_not contain_class('tripleo::profile::base::cinder::volume::dellsc')
- is_expected.to_not contain_class('tripleo::profile::base::cinder::volume::eqlx')
+ is_expected.to_not contain_class('tripleo::profile::base::cinder::volume::dellps')
is_expected.to_not contain_class('tripleo::profile::base::cinder::volume::netapp')
is_expected.to_not contain_class('tripleo::profile::base::cinder::volume::nfs')
is_expected.to_not contain_class('tripleo::profile::base::cinder::volume::rbd')
@@ -178,7 +178,7 @@ describe 'tripleo::profile::base::cinder::volume' do
params.merge!({
:cinder_enable_iscsi_backend => true,
:cinder_enable_dellsc_backend => true,
- :cinder_enable_eqlx_backend => true,
+ :cinder_enable_dellps_backend => true,
:cinder_enable_netapp_backend => true,
:cinder_enable_nfs_backend => true,
:cinder_enable_rbd_backend => true,
@@ -187,7 +187,7 @@ describe 'tripleo::profile::base::cinder::volume' do
it 'should configure all backends' do
is_expected.to contain_class('tripleo::profile::base::cinder::volume::iscsi')
is_expected.to contain_class('tripleo::profile::base::cinder::volume::dellsc')
- is_expected.to contain_class('tripleo::profile::base::cinder::volume::eqlx')
+ is_expected.to contain_class('tripleo::profile::base::cinder::volume::dellps')
is_expected.to contain_class('tripleo::profile::base::cinder::volume::netapp')
is_expected.to contain_class('tripleo::profile::base::cinder::volume::nfs')
is_expected.to contain_class('tripleo::profile::base::cinder::volume::rbd')
@@ -195,7 +195,7 @@ describe 'tripleo::profile::base::cinder::volume' do
is_expected.to contain_class('tripleo::profile::base::cinder')
is_expected.to contain_class('cinder::volume')
is_expected.to contain_class('cinder::backends').with(
- :enabled_backends => ['tripleo_iscsi', 'tripleo_ceph', 'tripleo_eqlx',
+ :enabled_backends => ['tripleo_iscsi', 'tripleo_ceph', 'tripleo_dellps',
'tripleo_dellsc', 'tripleo_netapp','tripleo_nfs']
)
end
diff --git a/spec/classes/tripleo_profile_base_nova_api_spec.rb b/spec/classes/tripleo_profile_base_nova_api_spec.rb
new file mode 100644
index 0000000..2072438
--- /dev/null
+++ b/spec/classes/tripleo_profile_base_nova_api_spec.rb
@@ -0,0 +1,137 @@
+#
+# Copyright (C) 2017 Red Hat, Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License. You may obtain
+# a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations
+# under the License.
+#
+
+require 'spec_helper'
+
+describe 'tripleo::profile::base::nova::api' do
+ shared_examples_for 'tripleo::profile::base::nova::api' do
+ let(:pre_condition) do
+ <<-eos
+ class { '::tripleo::profile::base::nova':
+ step => #{params[:step]},
+ messaging_hosts => [ 'localhost' ],
+ messaging_username => 'nova',
+ messaging_password => 'foo'
+ }
+eos
+ end
+
+ context 'with step less than 3' do
+ let(:params) { {
+ :step => 1,
+ } }
+
+ it {
+ is_expected.to contain_class('tripleo::profile::base::nova::api')
+ is_expected.to contain_class('tripleo::profile::base::nova')
+ is_expected.to_not contain_class('nova::keystone::authtoken')
+ is_expected.to_not contain_class('nova::api')
+ is_expected.to_not contain_class('nova::wsgi::apache_api')
+ is_expected.to_not contain_class('nova::network::neutron')
+ }
+ end
+
+ context 'with step 3 on bootstrap node' do
+ let(:params) { {
+ :step => 3,
+ :bootstrap_node => 'node.example.com',
+ } }
+
+ it {
+ is_expected.to contain_class('tripleo::profile::base::nova::api')
+ is_expected.to contain_class('tripleo::profile::base::nova')
+ is_expected.to contain_class('nova::cell_v2::simple_setup')
+ is_expected.to contain_class('nova::keystone::authtoken')
+ is_expected.to contain_class('nova::api')
+ is_expected.to_not contain_class('nova::wsgi::apache_api')
+ is_expected.to contain_class('nova::network::neutron')
+ }
+ end
+
+ context 'with step 3 on bootstrap node' do
+ let(:params) { {
+ :step => 3,
+ :bootstrap_node => 'node.example.com',
+ } }
+
+ it {
+ is_expected.to contain_class('tripleo::profile::base::nova::api')
+ is_expected.to contain_class('tripleo::profile::base::nova')
+ is_expected.to contain_class('nova::cell_v2::simple_setup')
+ is_expected.to contain_class('nova::keystone::authtoken')
+ is_expected.to contain_class('nova::api')
+ is_expected.to_not contain_class('nova::wsgi::apache_api')
+ is_expected.to contain_class('nova::network::neutron')
+ }
+ end
+
+ context 'with step 4 not on bootstrap node' do
+ let(:params) { {
+ :step => 4,
+ :bootstrap_node => 'other.example.com',
+ } }
+
+ it {
+ is_expected.to_not contain_class('nova::db::sync_cell_v2')
+ is_expected.to contain_class('nova::keystone::authtoken')
+ is_expected.to contain_class('nova::api')
+ is_expected.to_not contain_class('nova::wsgi::apache_api')
+ is_expected.to contain_class('nova::network::neutron')
+ }
+ end
+
+ context 'with step 4 not on bootstrap node' do
+ let(:params) { {
+ :step => 4,
+ :bootstrap_node => 'other.example.com',
+ :nova_api_wsgi_enabled => true,
+ } }
+
+ it {
+ is_expected.to contain_class('tripleo::profile::base::nova::api')
+ is_expected.to contain_class('tripleo::profile::base::nova')
+ is_expected.to_not contain_class('nova::db::sync_cell_v2')
+ is_expected.to contain_class('nova::keystone::authtoken')
+ is_expected.to contain_class('nova::api')
+ is_expected.to contain_class('nova::wsgi::apache_api')
+ is_expected.to contain_class('nova::network::neutron')
+ }
+ end
+
+ context 'with step 5' do
+ let(:params) { {
+ :step => 5,
+ :bootstrap_node => 'other.example.com',
+ } }
+
+ it {
+ is_expected.to contain_class('nova::cron::archive_deleted_rows')
+ }
+ end
+
+ end
+
+
+ on_supported_os.each do |os, facts|
+ context "on #{os}" do
+ let(:facts) do
+ facts.merge({ :hostname => 'node.example.com' })
+ end
+
+ it_behaves_like 'tripleo::profile::base::nova::api'
+ end
+ end
+end
diff --git a/spec/classes/tripleo_profile_base_nova_compute_ironic_spec.rb b/spec/classes/tripleo_profile_base_nova_compute_ironic_spec.rb
new file mode 100644
index 0000000..2155695
--- /dev/null
+++ b/spec/classes/tripleo_profile_base_nova_compute_ironic_spec.rb
@@ -0,0 +1,67 @@
+#
+# Copyright (C) 2017 Red Hat, Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License. You may obtain
+# a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations
+# under the License.
+#
+
+require 'spec_helper'
+
+describe 'tripleo::profile::base::nova::compute::ironic' do
+ shared_examples_for 'tripleo::profile::base::nova::compute::ironic' do
+
+ context 'with step less than 4' do
+ let(:params) { { :step => 1, } }
+
+ it {
+ is_expected.to contain_class('tripleo::profile::base::nova::compute::ironic')
+ is_expected.to_not contain_class('tripleo::profile::base::nova')
+ is_expected.to_not contain_class('nova::compute::ironic')
+ is_expected.to_not contain_class('nova::network::neutron')
+ }
+ end
+
+ context 'with step 4' do
+ let(:pre_condition) do
+ <<-eos
+ class { '::tripleo::profile::base::nova':
+ step => #{params[:step]},
+ messaging_hosts => [ '127.0.0.1' ],
+ }
+ class { '::tripleo::profile::base::nova::compute':
+ step => #{params[:step]},
+ }
+eos
+ end
+
+ let(:params) { { :step => 4, } }
+
+ it {
+ is_expected.to contain_class('tripleo::profile::base::nova::compute::ironic')
+ is_expected.to contain_class('tripleo::profile::base::nova')
+ is_expected.to contain_class('nova::compute::ironic')
+ is_expected.to contain_class('nova::network::neutron')
+ }
+ end
+ end
+
+
+ on_supported_os.each do |os, facts|
+ context "on #{os}" do
+ let(:facts) do
+ facts.merge({ :hostname => 'node.example.com' })
+ end
+
+ it_behaves_like 'tripleo::profile::base::nova::compute::ironic'
+ end
+ end
+end
diff --git a/spec/classes/tripleo_profile_base_nova_compute_libvirt_spec.rb b/spec/classes/tripleo_profile_base_nova_compute_libvirt_spec.rb
new file mode 100644
index 0000000..0b33123
--- /dev/null
+++ b/spec/classes/tripleo_profile_base_nova_compute_libvirt_spec.rb
@@ -0,0 +1,69 @@
+#
+# Copyright (C) 2017 Red Hat, Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License. You may obtain
+# a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations
+# under the License.
+#
+
+require 'spec_helper'
+
+describe 'tripleo::profile::base::nova::compute::libvirt' do
+ shared_examples_for 'tripleo::profile::base::nova::compute::libvirt' do
+
+ context 'with step less than 4' do
+ let(:params) { { :step => 1, } }
+
+ it {
+ is_expected.to contain_class('tripleo::profile::base::nova::compute::libvirt')
+ is_expected.to_not contain_class('tripleo::profile::base::nova')
+ is_expected.to_not contain_class('tripleo::profile::base::nova::compute')
+ is_expected.to_not contain_class('nova::compute::libvirt')
+ is_expected.to_not contain_class('nova::compute::libvirt::qemu')
+ }
+ end
+
+ context 'with step 4' do
+ let(:pre_condition) do
+ <<-eos
+ class { '::tripleo::profile::base::nova':
+ step => #{params[:step]},
+ messaging_hosts => [ '127.0.0.1' ],
+ }
+ class { '::tripleo::profile::base::nova::compute':
+ step => #{params[:step]},
+ }
+eos
+ end
+
+ let(:params) { { :step => 4, } }
+
+ it {
+ is_expected.to contain_class('tripleo::profile::base::nova::compute::libvirt')
+ is_expected.to contain_class('tripleo::profile::base::nova')
+ is_expected.to contain_class('tripleo::profile::base::nova::compute')
+ is_expected.to contain_class('nova::compute::libvirt')
+ is_expected.to contain_class('nova::compute::libvirt::qemu')
+ }
+ end
+ end
+
+
+ on_supported_os.each do |os, facts|
+ context "on #{os}" do
+ let(:facts) do
+ facts.merge({ :hostname => 'node.example.com' })
+ end
+
+ it_behaves_like 'tripleo::profile::base::nova::compute::libvirt'
+ end
+ end
+end
diff --git a/spec/classes/tripleo_profile_base_nova_compute_spec.rb b/spec/classes/tripleo_profile_base_nova_compute_spec.rb
new file mode 100644
index 0000000..a6fdbd6
--- /dev/null
+++ b/spec/classes/tripleo_profile_base_nova_compute_spec.rb
@@ -0,0 +1,87 @@
+#
+# Copyright (C) 2017 Red Hat, Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License. You may obtain
+# a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations
+# under the License.
+#
+
+require 'spec_helper'
+
+describe 'tripleo::profile::base::nova::compute' do
+ shared_examples_for 'tripleo::profile::base::nova::compute' do
+
+ context 'with step less than 5' do
+ let(:params) { { :step => 1, } }
+
+ it {
+ is_expected.to contain_class('tripleo::profile::base::nova::compute')
+ is_expected.to_not contain_class('tripleo::profile::base::nova')
+ is_expected.to_not contain_class('nova::compute')
+ is_expected.to_not contain_class('nova::network::neutron')
+ is_expected.to_not contain_exec('reset-iscsi-initiator-name')
+ is_expected.to_not contain_file('/etc/iscsi/.initiator_reset')
+ }
+ end
+
+ context 'with step 5' do
+ let(:pre_condition) do
+ <<-eos
+ class { '::tripleo::profile::base::nova':
+ step => #{params[:step]},
+ messaging_hosts => [ '127.0.0.1' ],
+ }
+eos
+ end
+
+ context 'default params' do
+ let(:params) { { :step => 4, } }
+
+ it {
+ is_expected.to contain_class('tripleo::profile::base::nova::compute')
+ is_expected.to contain_class('tripleo::profile::base::nova')
+ is_expected.to contain_class('tripleo::profile::base::nova')
+ is_expected.to contain_class('nova::compute')
+ is_expected.to contain_class('nova::network::neutron')
+ is_expected.to contain_exec('reset-iscsi-initiator-name')
+ is_expected.to contain_file('/etc/iscsi/.initiator_reset')
+ is_expected.to_not contain_package('nfs-utils')
+ }
+ end
+
+ context 'cinder nfs backend' do
+ let(:params) { { :step => 4, :cinder_nfs_backend => true } }
+
+ it {
+ is_expected.to contain_class('tripleo::profile::base::nova::compute')
+ is_expected.to contain_class('tripleo::profile::base::nova')
+ is_expected.to contain_class('tripleo::profile::base::nova')
+ is_expected.to contain_class('nova::compute')
+ is_expected.to contain_class('nova::network::neutron')
+ is_expected.to contain_exec('reset-iscsi-initiator-name')
+ is_expected.to contain_file('/etc/iscsi/.initiator_reset')
+ is_expected.to contain_package('nfs-utils')
+ }
+ end
+ end
+ end
+
+
+ on_supported_os.each do |os, facts|
+ context "on #{os}" do
+ let(:facts) do
+ facts.merge({ :hostname => 'node.example.com' })
+ end
+
+ it_behaves_like 'tripleo::profile::base::nova::compute'
+ end
+ end
+end
diff --git a/spec/classes/tripleo_profile_base_nova_conductor_spec.rb b/spec/classes/tripleo_profile_base_nova_conductor_spec.rb
new file mode 100644
index 0000000..8cdf8b0
--- /dev/null
+++ b/spec/classes/tripleo_profile_base_nova_conductor_spec.rb
@@ -0,0 +1,61 @@
+#
+# Copyright (C) 2017 Red Hat, Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License. You may obtain
+# a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations
+# under the License.
+#
+
+require 'spec_helper'
+
+describe 'tripleo::profile::base::nova::conductor' do
+ shared_examples_for 'tripleo::profile::base::nova::conductor' do
+ let(:pre_condition) do
+ <<-eos
+ class { '::tripleo::profile::base::nova':
+ step => #{params[:step]},
+ messaging_hosts => [ '127.0.0.1' ],
+ }
+eos
+ end
+
+ context 'with step less than 4' do
+ let(:params) { { :step => 1, } }
+
+ it {
+ is_expected.to contain_class('tripleo::profile::base::nova::conductor')
+ is_expected.to contain_class('tripleo::profile::base::nova')
+ is_expected.to_not contain_class('nova::conductor')
+ }
+ end
+
+ context 'with step 4' do
+ let(:params) { { :step => 4, } }
+
+ it {
+ is_expected.to contain_class('tripleo::profile::base::nova::conductor')
+ is_expected.to contain_class('tripleo::profile::base::nova')
+ is_expected.to contain_class('nova::conductor')
+ }
+ end
+ end
+
+
+ on_supported_os.each do |os, facts|
+ context "on #{os}" do
+ let(:facts) do
+ facts.merge({ :hostname => 'node.example.com' })
+ end
+
+ it_behaves_like 'tripleo::profile::base::nova::conductor'
+ end
+ end
+end
diff --git a/spec/classes/tripleo_profile_base_nova_consoleauth_spec.rb b/spec/classes/tripleo_profile_base_nova_consoleauth_spec.rb
new file mode 100644
index 0000000..e8a2dff
--- /dev/null
+++ b/spec/classes/tripleo_profile_base_nova_consoleauth_spec.rb
@@ -0,0 +1,62 @@
+#
+# Copyright (C) 2017 Red Hat, Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License. You may obtain
+# a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations
+# under the License.
+#
+
+require 'spec_helper'
+
+describe 'tripleo::profile::base::nova::consoleauth' do
+ shared_examples_for 'tripleo::profile::base::nova::consoleauth' do
+
+ context 'with step less than 4' do
+ let(:params) { { :step => 1, } }
+
+ it {
+ is_expected.to contain_class('tripleo::profile::base::nova::consoleauth')
+ is_expected.to_not contain_class('tripleo::profile::base::nova')
+ is_expected.to_not contain_class('nova::consoleauth')
+ }
+ end
+
+ context 'with step 4' do
+ let(:pre_condition) do
+ <<-eos
+ class { '::tripleo::profile::base::nova':
+ step => #{params[:step]},
+ messaging_hosts => [ '127.0.0.1' ],
+ }
+eos
+ end
+
+ let(:params) { { :step => 4, } }
+
+ it {
+ is_expected.to contain_class('tripleo::profile::base::nova::consoleauth')
+ is_expected.to contain_class('tripleo::profile::base::nova')
+ is_expected.to contain_class('nova::consoleauth')
+ }
+ end
+ end
+
+
+ on_supported_os.each do |os, facts|
+ context "on #{os}" do
+ let(:facts) do
+ facts.merge({ :hostname => 'node.example.com' })
+ end
+
+ it_behaves_like 'tripleo::profile::base::nova::consoleauth'
+ end
+ end
+end
diff --git a/spec/classes/tripleo_profile_base_nova_libvirt_spec.rb b/spec/classes/tripleo_profile_base_nova_libvirt_spec.rb
new file mode 100644
index 0000000..d263a74
--- /dev/null
+++ b/spec/classes/tripleo_profile_base_nova_libvirt_spec.rb
@@ -0,0 +1,68 @@
+#
+# Copyright (C) 2017 Red Hat, Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License. You may obtain
+# a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations
+# under the License.
+#
+
+require 'spec_helper'
+
+describe 'tripleo::profile::base::nova::libvirt' do
+ shared_examples_for 'tripleo::profile::base::nova::libvirt' do
+
+ context 'with step less than 4' do
+ let(:params) { { :step => 1, } }
+
+ it {
+ is_expected.to contain_class('tripleo::profile::base::nova::libvirt')
+ is_expected.to_not contain_class('tripleo::profile::base::nova')
+ is_expected.to_not contain_class('nova::compute::libvirt::services')
+ is_expected.to_not contain_file('/etclibvirt/qemu/networks/autostart/default.xml')
+ is_expected.to_not contain_file('/etclibvirt/qemu/networks/default.xml')
+ is_expected.to_not contain_exec('libvirt-default-net-destroy')
+ }
+ end
+
+ context 'with step 4' do
+ let(:pre_condition) do
+ <<-eos
+ class { '::tripleo::profile::base::nova':
+ step => #{params[:step]},
+ messaging_hosts => [ '127.0.0.1' ],
+ }
+eos
+ end
+
+ let(:params) { { :step => 4, } }
+
+ it {
+ is_expected.to contain_class('tripleo::profile::base::nova::libvirt')
+ is_expected.to contain_class('tripleo::profile::base::nova')
+ is_expected.to contain_class('nova::compute::libvirt::services')
+ is_expected.to contain_file('/etc/libvirt/qemu/networks/autostart/default.xml').with_ensure('absent')
+ is_expected.to contain_file('/etc/libvirt/qemu/networks/default.xml').with_ensure('absent')
+ is_expected.to contain_exec('libvirt-default-net-destroy')
+ }
+ end
+ end
+
+
+ on_supported_os.each do |os, facts|
+ context "on #{os}" do
+ let(:facts) do
+ facts.merge({ :hostname => 'node.example.com' })
+ end
+
+ it_behaves_like 'tripleo::profile::base::nova::libvirt'
+ end
+ end
+end
diff --git a/spec/classes/tripleo_profile_base_nova_scheduler_spec.rb b/spec/classes/tripleo_profile_base_nova_scheduler_spec.rb
new file mode 100644
index 0000000..87783c1
--- /dev/null
+++ b/spec/classes/tripleo_profile_base_nova_scheduler_spec.rb
@@ -0,0 +1,64 @@
+#
+# Copyright (C) 2017 Red Hat, Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License. You may obtain
+# a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations
+# under the License.
+#
+
+require 'spec_helper'
+
+describe 'tripleo::profile::base::nova::scheduler' do
+ shared_examples_for 'tripleo::profile::base::nova::scheduler' do
+
+ context 'with step less than 4' do
+ let(:params) { { :step => 1, } }
+
+ it {
+ is_expected.to contain_class('tripleo::profile::base::nova::scheduler')
+ is_expected.to_not contain_class('tripleo::profile::base::nova')
+ is_expected.to_not contain_class('nova::scheduler')
+ is_expected.to_not contain_class('nova::scheduler::filter')
+ }
+ end
+
+ context 'with step 4' do
+ let(:pre_condition) do
+ <<-eos
+ class { '::tripleo::profile::base::nova':
+ step => #{params[:step]},
+ messaging_hosts => [ '127.0.0.1' ],
+ }
+eos
+ end
+
+ let(:params) { { :step => 4, } }
+
+ it {
+ is_expected.to contain_class('tripleo::profile::base::nova::scheduler')
+ is_expected.to contain_class('tripleo::profile::base::nova')
+ is_expected.to contain_class('nova::scheduler')
+ is_expected.to contain_class('nova::scheduler::filter')
+ }
+ end
+ end
+
+
+ on_supported_os.each do |os, facts|
+ context "on #{os}" do
+ let(:facts) do
+ facts.merge({ :hostname => 'node.example.com' })
+ end
+
+ it_behaves_like 'tripleo::profile::base::nova::scheduler'
+ end
+ end
+end
diff --git a/spec/classes/tripleo_profile_base_nova_spec.rb b/spec/classes/tripleo_profile_base_nova_spec.rb
new file mode 100644
index 0000000..68b01e9
--- /dev/null
+++ b/spec/classes/tripleo_profile_base_nova_spec.rb
@@ -0,0 +1,135 @@
+#
+# Copyright (C) 2017 Red Hat, Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License. You may obtain
+# a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations
+# under the License.
+#
+
+require 'spec_helper'
+
+describe 'tripleo::profile::base::nova' do
+ shared_examples_for 'tripleo::profile::base::nova' do
+
+ context 'with step less than 3' do
+ let(:params) { {
+ :step => 1,
+ :messaging_hosts => [ 'localhost' ],
+ :messaging_password => 'foo'
+ } }
+
+ it {
+ is_expected.to contain_class('tripleo::profile::base::nova')
+ is_expected.to_not contain_class('nova')
+ is_expected.to_not contain_class('nova::config')
+ is_expected.to_not contain_class('nova::cache')
+ }
+ end
+
+ context 'with step 3 on bootstrap node' do
+ let(:params) { {
+ :step => 3,
+ :bootstrap_node => 'node.example.com',
+ :messaging_hosts => [ 'localhost' ],
+ :messaging_username => 'nova',
+ :messaging_password => 'foo',
+ } }
+
+ it {
+ is_expected.to contain_class('tripleo::profile::base::nova')
+ is_expected.to contain_class('nova').with(
+ :default_transport_url => 'rabbit://nova:foo@localhost:5672/?ssl=0'
+ )
+ is_expected.to contain_class('nova::config')
+ is_expected.to contain_class('nova::placement')
+ is_expected.to contain_class('nova::cache').with(
+ :enabled => true,
+ :backend => 'oslo_cache.memcache_pool',
+ :memcache_servers => ['127.0.0.1:11211']
+ )
+ }
+ end
+
+ context 'with step 3 not on bootstrap node' do
+ let(:params) { {
+ :step => 3,
+ :bootstrap_node => 'other.example.com',
+ :messaging_hosts => [ 'localhost' ],
+ :messaging_password => 'foo'
+ } }
+
+ it {
+ is_expected.to contain_class('tripleo::profile::base::nova')
+ is_expected.to_not contain_class('nova')
+ is_expected.to_not contain_class('nova::config')
+ is_expected.to_not contain_class('nova::cache')
+ is_expected.to_not contain_class('nova::placement')
+ }
+ end
+
+ context 'with step 4' do
+ let(:params) { {
+ :step => 4,
+ :bootstrap_node => 'other.example.com',
+ :messaging_hosts => [ 'localhost' ],
+ :messaging_password => 'foo',
+ } }
+
+ it {
+ is_expected.to contain_class('tripleo::profile::base::nova')
+ is_expected.to contain_class('nova')
+ is_expected.to contain_class('nova::config')
+ is_expected.to contain_class('nova::cache')
+ is_expected.to contain_class('nova::placement')
+ is_expected.to_not contain_class('nova::migration::libvirt')
+ }
+ end
+
+ context 'with step 4 with libvirt' do
+ let(:pre_condition) {
+ 'include ::nova::compute::libvirt::services'
+ }
+ let(:params) { {
+ :step => 4,
+ :libvirt_enabled => true,
+ :manage_migration => true,
+ :nova_compute_enabled => true,
+ :bootstrap_node => 'node.example.com',
+ :messaging_hosts => [ 'localhost' ],
+ :messaging_password => 'foo',
+ } }
+
+ it {
+ is_expected.to contain_class('tripleo::profile::base::nova')
+ is_expected.to contain_class('nova')
+ is_expected.to contain_class('nova::config')
+ is_expected.to contain_class('nova::placement')
+ is_expected.to contain_class('nova::cache')
+ is_expected.to contain_class('nova::migration::libvirt').with(
+ :configure_libvirt => params[:libvirt_enabled],
+ :configure_nova => params[:nova_compute_enabled]
+ )
+ }
+ end
+
+ end
+
+
+ on_supported_os.each do |os, facts|
+ context "on #{os}" do
+ let(:facts) do
+ facts.merge({ :hostname => 'node.example.com' })
+ end
+
+ it_behaves_like 'tripleo::profile::base::nova'
+ end
+ end
+end
diff --git a/spec/classes/tripleo_profile_base_nova_vncproxy_spec.rb b/spec/classes/tripleo_profile_base_nova_vncproxy_spec.rb
new file mode 100644
index 0000000..f077875
--- /dev/null
+++ b/spec/classes/tripleo_profile_base_nova_vncproxy_spec.rb
@@ -0,0 +1,62 @@
+#
+# Copyright (C) 2017 Red Hat, Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License. You may obtain
+# a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations
+# under the License.
+#
+
+require 'spec_helper'
+
+describe 'tripleo::profile::base::nova::vncproxy' do
+ shared_examples_for 'tripleo::profile::base::nova::vncproxy' do
+
+ context 'with step less than 4' do
+ let(:params) { { :step => 1, } }
+
+ it {
+ is_expected.to contain_class('tripleo::profile::base::nova::vncproxy')
+ is_expected.to_not contain_class('tripleo::profile::base::nova')
+ is_expected.to_not contain_class('nova::vncproxy')
+ }
+ end
+
+ context 'with step 4' do
+ let(:pre_condition) do
+ <<-eos
+ class { '::tripleo::profile::base::nova':
+ step => #{params[:step]},
+ messaging_hosts => [ '127.0.0.1' ],
+ }
+eos
+ end
+
+ let(:params) { { :step => 4, } }
+
+ it {
+ is_expected.to contain_class('tripleo::profile::base::nova::vncproxy')
+ is_expected.to contain_class('tripleo::profile::base::nova')
+ is_expected.to contain_class('nova::vncproxy')
+ }
+ end
+ end
+
+
+ on_supported_os.each do |os, facts|
+ context "on #{os}" do
+ let(:facts) do
+ facts.merge({ :hostname => 'node.example.com' })
+ end
+
+ it_behaves_like 'tripleo::profile::base::nova::vncproxy'
+ end
+ end
+end
diff --git a/spec/classes/tripleo_profile_base_octavia_api_spec.rb b/spec/classes/tripleo_profile_base_octavia_api_spec.rb
new file mode 100644
index 0000000..e94e00c
--- /dev/null
+++ b/spec/classes/tripleo_profile_base_octavia_api_spec.rb
@@ -0,0 +1,138 @@
+#
+# Copyright (C) 2016 Red Hat, Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License. You may obtain
+# a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations
+# under the License.
+#
+
+require 'spec_helper'
+
+describe 'tripleo::profile::base::octavia::api' do
+
+ let :params do
+ { :step => 5,
+ :bootstrap_node => 'notbootstrap.example.com'
+ }
+ end
+
+ shared_examples_for 'tripleo::profile::base::octavia::api' do
+ before :each do
+ facts.merge!({ :step => params[:step] })
+ end
+
+ let(:pre_condition) do
+ <<-eos
+ class { 'tripleo::profile::base::octavia' :
+ step => #{params[:step]},
+ rabbit_user => 'bugs',
+ rabbit_password => 'rabbits_R_c00l',
+ rabbit_hosts => ['hole.field.com']
+ }
+ class { 'octavia::db::mysql':
+ password => 'some_password'
+ }
+ class { 'octavia::keystone::authtoken':
+ password => 'some_password'
+ }
+eos
+ end
+
+ context 'with step less than 3 on bootstrap' do
+ before do
+ params.merge!({
+ :step => 2,
+ :bootstrap_node => 'node.example.com'
+ })
+ end
+
+ it 'should not do anything' do
+ is_expected.to_not contain_class('octavia::api')
+ end
+ end
+
+ context 'with step less than 3 on non-bootstrap' do
+ before do
+ params.merge!({ :step => 2 })
+ end
+
+ it 'should not do anything' do
+ is_expected.to_not contain_class('octavia::api')
+ end
+ end
+
+ context 'with step 3 on bootstrap node' do
+ before do
+ params.merge!({
+ :step => 3,
+ :bootstrap_node => 'node.example.com'
+ })
+ end
+
+ it 'should should start configurating database' do
+ is_expected.to_not contain_class('octavia::api')
+ end
+ end
+
+ context 'with step 3 on non-bootstrap node' do
+ before do
+ params.merge!({ :step => 3 })
+ end
+
+ it 'should do nothing' do
+ is_expected.to_not contain_class('octavia::api')
+ end
+ end
+
+ context 'with step 4 on bootstrap node' do
+ before do
+ params.merge!({
+ :step => 4,
+ :bootstrap_node => 'node.example.com'
+ })
+ end
+
+ it 'should should sync database' do
+ is_expected.to contain_class('octavia::api').with(:sync_db => true)
+ end
+ end
+
+ context 'with step 4 on non-bootstrap node' do
+ before do
+ params.merge!({ :step => 4 })
+ end
+
+ it 'should do nothing' do
+ is_expected.to_not contain_class('octavia::api')
+ end
+ end
+
+ context 'with step 5 on non-bootstrap node' do
+ before do
+ params.merge!({ :step => 5 })
+ end
+
+ it 'should do nothing' do
+ is_expected.to contain_class('octavia::api').with(:sync_db => false)
+ end
+ end
+ end
+
+ on_supported_os.each do |os, facts|
+ context "on #{os}" do
+ let(:facts) do
+ facts.merge({ :hostname => 'node.example.com' })
+ end
+ it_behaves_like 'tripleo::profile::base::octavia::api'
+ end
+ end
+end
+
diff --git a/spec/classes/tripleo_profile_base_octavia_spec.rb b/spec/classes/tripleo_profile_base_octavia_spec.rb
new file mode 100644
index 0000000..89820ef
--- /dev/null
+++ b/spec/classes/tripleo_profile_base_octavia_spec.rb
@@ -0,0 +1,119 @@
+#
+# Copyright (C) 2016 Red Hat, Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License. You may obtain
+# a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations
+# under the License.
+#
+
+require 'spec_helper'
+
+describe 'tripleo::profile::base::octavia' do
+
+ let :params do
+ { :rabbit_hosts => ['some.server.com'],
+ :step => 5
+ }
+ end
+
+ shared_examples_for 'tripleo::profile::base::octavia' do
+
+ context 'with step less than 3' do
+ before do
+ params.merge!({ :step => 2 })
+ end
+
+ it 'should not do anything' do
+ is_expected.to_not contain_class('octavia')
+ is_expected.to_not contain_class('octavia::config')
+ end
+ end
+
+ context 'with step 3' do
+ before do
+ params.merge!({ :step => 3 })
+ end
+
+ it 'should provide basic initialization' do
+ is_expected.to contain_class('octavia').with(
+ :default_transport_url => 'rabbit://some.server.com:5672/'
+ )
+ is_expected.to contain_class('octavia::config')
+ end
+ end
+
+ context 'with multiple hosts' do
+ before do
+ params.merge!({ :rabbit_hosts => ['some.server.com', 'someother.server.com'] })
+ end
+
+ it 'should construct a multihost URL' do
+ is_expected.to contain_class('octavia').with(
+ :default_transport_url => 'rabbit://some.server.com:5672,someother.server.com:5672/'
+ )
+ end
+ end
+
+ context 'with username provided' do
+ before do
+ params.merge!({ :rabbit_user => 'bunny' })
+ end
+
+ it 'should construct URL with username' do
+ is_expected.to contain_class('octavia').with(
+ :default_transport_url => 'rabbit://bunny@some.server.com:5672/'
+ )
+ end
+ end
+
+ context 'with username and password provided' do
+ before do
+ params.merge!(
+ { :rabbit_user => 'bunny',
+ :rabbit_password => 'carrot'
+ }
+ )
+ end
+
+ it 'should construct URL with username and password' do
+ is_expected.to contain_class('octavia').with(
+ :default_transport_url => 'rabbit://bunny:carrot@some.server.com:5672/'
+ )
+ end
+ end
+
+ context 'with multiple hosts and user info provided' do
+ before do
+ params.merge!(
+ { :rabbit_hosts => ['some.server.com', 'someother.server.com'],
+ :rabbit_user => 'bunny',
+ :rabbit_password => 'carrot'
+ }
+ )
+ end
+
+ it 'should distributed user info across hosts URL' do
+ is_expected.to contain_class('octavia').with(
+ :default_transport_url => 'rabbit://bunny:carrot@some.server.com:5672,bunny:carrot@someother.server.com:5672/'
+ )
+ end
+ end
+ end
+
+ on_supported_os.each do |os, facts|
+ context "on #{os}" do
+ let(:facts) do
+ facts.merge({})
+ end
+ it_behaves_like 'tripleo::profile::base::octavia'
+ end
+ end
+end
diff --git a/manifests/vip_hosts.pp b/spec/classes/tripleo_profile_base_sshd_spec.rb
index 7b260fd..210b41c 100644
--- a/manifests/vip_hosts.pp
+++ b/spec/classes/tripleo_profile_base_sshd_spec.rb
@@ -13,27 +13,18 @@
# License for the specific language governing permissions and limitations
# under the License.
#
-# == Class: tripleo::vip_hosts
-#
-# Write the overcloud VIPs into /etc/hosts
-#
-# === Parameters
-#
-# [*hosts_spec*]
-# The specification of the hosts that will be added to the /etc/hosts file.
-# These come in the form of a hash that will be consumed by create_resources.
-# e.g.:
-# tripleo::hosts_spec:
-# host-1:
-# name: host1.domain
-# ip: 127.0.0.1
-# host-2:
-# name: host2.domain
-# ip: 127.0.0.2
-#
-class tripleo::vip_hosts (
- $hosts_spec
-) {
- create_resources('host', $hosts_spec)
-}
+require 'spec_helper'
+
+describe 'tripleo::profile::base::sshd' do
+
+ context 'with banner configured' do
+ it do
+ is_expected.to contain_file('/etc/issue').with({
+ 'owner' => 'root',
+ 'group' => 'root',
+ 'mode' => '0600',
+ })
+ end
+ end
+end
diff --git a/spec/classes/tripleo_profile_pacemaker_ceph_rbdmirror_spec.rp b/spec/classes/tripleo_profile_pacemaker_ceph_rbdmirror_spec.rp
new file mode 100644
index 0000000..4df0a09
--- /dev/null
+++ b/spec/classes/tripleo_profile_pacemaker_ceph_rbdmirror_spec.rp
@@ -0,0 +1,64 @@
+#
+# Copyright (C) 2016 Red Hat, Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License. You may obtain
+# a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations
+# under the License.
+#
+
+require 'spec_helper'
+
+describe 'tripleo::profile::pacemaker::ceph::rbdmirror' do
+ shared_examples_for 'tripleo::profile::pacemaker::ceph::rbdmirror' do
+ let (:pre_condition) do
+ <<-eof
+ class { '::tripleo::profile::base::ceph':
+ step => #{params[:step]}
+ }
+ eof
+ end
+
+ context 'with step less than 3' do
+ let(:params) { { :step => 2 } }
+ it 'should do nothing' do
+ is_expected.to contain_class('tripleo::profile::base::ceph')
+ is_expected.to_not contain_class('ceph::mirror')
+ end
+ end
+
+ context 'with step 3 and client_name' do
+ let(:params) { {
+ :step => 3,
+ :client_name => 'myname',
+ } }
+
+ it 'should include rbdmirror configuration' do
+ is_expected.to contain_class('tripleo::profile::base::ceph')
+ is_expected.to contain_class('ceph::rbdmirror').with(
+ :rbd_mirror_enable => false,
+ :rbd_mirror_ensure => 'stopped',
+ )
+ is_expected.to contain_class('pacemaker::resource::service')
+ end
+ end
+
+ end
+
+ on_supported_os.each do |os, facts|
+ context "on #{os}" do
+ let(:facts) do
+ facts.merge({ :hostname => 'node.example.com' })
+ end
+
+ it_behaves_like 'tripleo::profile::pacemaker::ceph::rbdmirror'
+ end
+ end
+end
diff --git a/spec/classes/tripleo_ui_spec.rb b/spec/classes/tripleo_ui_spec.rb
new file mode 100644
index 0000000..f3a4f25
--- /dev/null
+++ b/spec/classes/tripleo_ui_spec.rb
@@ -0,0 +1,121 @@
+#
+# Copyright (C) 2016 Red Hat, Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License. You may obtain
+# a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations
+# under the License.
+#
+
+require 'spec_helper'
+
+describe 'tripleo::ui' do
+ shared_examples_for 'tripleo::ui' do
+ let(:pre_condition) do
+ 'include ::apache'
+ end
+
+ context 'with required parameters' do
+ let(:params) { {
+ :servername => facts[:hostname],
+ :bind_host => '127.0.0.1',
+ :endpoint_proxy_keystone => 'http://127.0.0.1:5000',
+ :endpoint_proxy_zaqar => 'ws://127.0.0.1:9000/zaqar',
+ :endpoint_proxy_heat => 'http://127.0.0.1:8004',
+ :endpoint_proxy_ironic => 'http://127.0.0.1:6385',
+ :endpoint_proxy_mistral => 'http://127.0.0.1:8989',
+ :endpoint_proxy_swift => 'http://127.0.0.1:8080',
+ :endpoint_config_keystone => 'https://127.0.0.1:443/keystone/v2.0',
+ :endpoint_config_zaqar => 'wss://127.0.0.1:443/zaqar',
+ :endpoint_config_heat => 'https://127.0.0.1:443/heat/v1/%(tenant_id)s',
+ :endpoint_config_ironic => 'https://127.0.0.1:443/ironic',
+ :endpoint_config_mistral => 'https://127.0.0.1:443/mistral/v2',
+ :endpoint_config_swift => 'https://127.0.0.1:443/swift/v1/AUTH_%(tenant_id)s'
+ } }
+
+ it 'should configure tripleo ui' do
+ is_expected.to contain_class('tripleo::ui')
+ is_expected.to contain_apache__vhost('tripleo-ui').with(
+ :ensure => 'present',
+ :servername => facts[:hostname],
+ :ip => '127.0.0.1',
+ :port => 3000,
+ :docroot => '/var/www/openstack-tripleo-ui/dist',
+ :options => [ 'Indexes', 'FollowSymLinks' ],
+ :fallbackresource => '/index.html'
+ )
+ is_expected.to contain_file('/etc/httpd/conf.d/openstack-tripleo-ui.conf').with_content(/cleaned by Puppet/)
+ is_expected.to contain_file('/var/www/openstack-tripleo-ui/dist/tripleo_ui_config.js')
+ .with_content(/'keystone': 'https:\/\/127.0.0.1:443\/keystone\/v2.0'/)
+ .with_content(/'heat': 'https:\/\/127.0.0.1:443\/heat\/v1\/%\(tenant_id\)s'/)
+ .with_content(/'zaqar-websocket': 'wss:\/\/127.0.0.1:443\/zaqar'/)
+ .with_content(/'ironic': 'https:\/\/127.0.0.1:443\/ironic'/)
+ .with_content(/'mistral': 'https:\/\/127.0.0.1:443\/mistral\/v2'/)
+ .with_content(/'swift': 'https:\/\/127.0.0.1:443\/swift\/v1\/AUTH_%\(tenant_id\)s'/)
+ .with_content(/'zaqar_default_queue': 'tripleo'/)
+ end
+ end
+
+ context 'with all parameters' do
+ let(:params) { {
+ :servername => 'custom.example.com',
+ :bind_host => '127.0.0.2',
+ :ui_port => 3001,
+ :endpoint_proxy_keystone => 'http://127.0.0.1:5000',
+ :endpoint_proxy_zaqar => 'ws://127.0.0.1:9000/zaqar',
+ :endpoint_proxy_heat => 'http://127.0.0.1:8004',
+ :endpoint_proxy_ironic => 'http://127.0.0.1:6385',
+ :endpoint_proxy_mistral => 'http://127.0.0.1:8989',
+ :endpoint_proxy_swift => 'http://127.0.0.1:8080',
+ :endpoint_config_keystone => 'https://127.0.0.1:443/keystone/v2.0',
+ :endpoint_config_zaqar => 'wss://127.0.0.1:443/zaqar',
+ :endpoint_config_heat => 'https://127.0.0.1:443/heat/v1/%(tenant_id)s',
+ :endpoint_config_ironic => 'https://127.0.0.1:443/ironic',
+ :endpoint_config_mistral => 'https://127.0.0.1:443/mistral/v2',
+ :endpoint_config_swift => 'https://127.0.0.1:443/swift/v1/AUTH_%(tenant_id)s',
+ :zaqar_default_queue => 'tripleo'
+ } }
+
+ it 'should configure tripleo ui' do
+ is_expected.to contain_class('tripleo::ui')
+ is_expected.to contain_apache__vhost('tripleo-ui').with(
+ :ensure => 'present',
+ :servername => 'custom.example.com',
+ :ip => '127.0.0.2',
+ :port => 3001,
+ :docroot => '/var/www/openstack-tripleo-ui/dist',
+ :options => [ 'Indexes', 'FollowSymLinks' ],
+ :fallbackresource => '/index.html'
+ )
+ is_expected.to contain_file('/etc/httpd/conf.d/openstack-tripleo-ui.conf').with_content(/cleaned by Puppet/)
+ is_expected.to contain_file('/var/www/openstack-tripleo-ui/dist/tripleo_ui_config.js')
+ .with_content(/'keystone': 'https:\/\/127.0.0.1:443\/keystone\/v2.0'/)
+ .with_content(/'heat': 'https:\/\/127.0.0.1:443\/heat\/v1\/%\(tenant_id\)s'/)
+ .with_content(/'zaqar-websocket': 'wss:\/\/127.0.0.1:443\/zaqar'/)
+ .with_content(/'ironic': 'https:\/\/127.0.0.1:443\/ironic'/)
+ .with_content(/'mistral': 'https:\/\/127.0.0.1:443\/mistral\/v2'/)
+ .with_content(/'swift': 'https:\/\/127.0.0.1:443\/swift\/v1\/AUTH_%\(tenant_id\)s'/)
+ .with_content(/'zaqar_default_queue': 'tripleo'/)
+ end
+ end
+
+ end
+
+
+ on_supported_os.each do |os, facts|
+ context "on #{os}" do
+ let(:facts) do
+ facts.merge({ :hostname => 'node.example.com' })
+ end
+
+ it_behaves_like 'tripleo::ui'
+ end
+ end
+end
diff --git a/spec/defines/tripleo_host_sriov_numvfs_persistence_spec.rb b/spec/defines/tripleo_host_sriov_numvfs_persistence_spec.rb
index 57559a2..153b105 100644
--- a/spec/defines/tripleo_host_sriov_numvfs_persistence_spec.rb
+++ b/spec/defines/tripleo_host_sriov_numvfs_persistence_spec.rb
@@ -12,7 +12,8 @@ describe 'tripleo::host::sriov::numvfs_persistence' do
{
:name => 'persistence',
:vf_defs => ['eth0:10','eth1:8'],
- :content_string => "Hashbang\n"
+ :content_string => "Hashbang\n",
+ :udev_rules => ""
}
end
@@ -31,6 +32,14 @@ describe 'tripleo::host::sriov::numvfs_persistence' do
:content => '#!/bin/bash',
:replace => false,
)
+ is_expected.to contain_file('/etc/udev/rules.d/70-tripleo-reset-sriov.rules').with(
+ :ensure => 'file',
+ :content => "KERNEL==\"eth0\", RUN+=\"/etc/sysconfig/allocate_vfs %k\"\nKERNEL==\"eth1\", RUN+=\"/etc/sysconfig/allocate_vfs %k\"\n",
+ :group => 'root',
+ :mode => '0755',
+ :owner => 'root',
+ :replace => true
+ )
is_expected.to contain_file_line('call_ifup-local').with(
:path => '/sbin/ifup-local',
:line => '/etc/sysconfig/allocate_vfs $1',
diff --git a/spec/fixtures/hieradata/default.yaml b/spec/fixtures/hieradata/default.yaml
index d63fc76..4d5dc99 100644
--- a/spec/fixtures/hieradata/default.yaml
+++ b/spec/fixtures/hieradata/default.yaml
@@ -14,6 +14,22 @@ barbican::keystone::authtoken::password: 'password'
ceilometer::keystone::authtoken::password: 'password'
# ceph related items
ceph::profile::params::mon_key: 'password'
+# NOTE(gfidente): we want to use keystone v3 API for RGW so the following are
+# needed to comply with the if condition:
+# https://github.com/openstack/puppet-ceph/blob/master/manifests/rgw/keystone.pp#L111
+ceph::profile::params::rgw_keystone_admin_domain: 'keystone_domain'
+ceph::profile::params::rgw_keystone_admin_project: 'keystone_project'
+ceph::profile::params::rgw_keystone_admin_user: 'keystone_admin_user'
+ceph::profile::params::rgw_keystone_admin_password: 'keystone_admin_password'
# cinder related items
cinder::rabbit_password: 'password'
cinder::keystone::authtoken::password: 'password'
+# nova related items
+nova::rabbit_password: 'password'
+nova::keystone::authtoken::password: 'password'
+nova::network::neutron::neutron_password: 'password'
+# memcache related items
+memcached_node_ips_v6:
+ - '::1'
+memcached_node_ips:
+ - '127.0.0.1'
diff --git a/spec/functions/ip_to_erl_format_spec.rb b/spec/functions/ip_to_erl_format_spec.rb
new file mode 100644
index 0000000..b587164
--- /dev/null
+++ b/spec/functions/ip_to_erl_format_spec.rb
@@ -0,0 +1,11 @@
+require 'spec_helper'
+require 'puppet'
+
+describe 'ip_to_erl_format' do
+ it { should run.with_params('192.168.2.1').and_return('{192,168,2,1}') }
+ it { should run.with_params('0.0.0.0').and_return('{0,0,0,0}') }
+ it { should run.with_params('5a40:79cf:8251:5dc5:1624:3c03:3c04:9ba8').and_return('{23104,31183,33361,24005,5668,15363,15364,39848}') }
+ it { should run.with_params('fe80::204:acff:fe17:bf38').and_return('{65152,0,0,0,516,44287,65047,48952}') }
+ it { should run.with_params('::1:2').and_return('{0,0,0,0,0,0,1,2}') }
+ it { should run.with_params('192.256.0.0').and_raise_error(IPAddr::InvalidAddressError) }
+end
diff --git a/templates/docker_distribution/registry_config.yml.erb b/templates/docker_distribution/registry_config.yml.erb
new file mode 100644
index 0000000..d5228fb
--- /dev/null
+++ b/templates/docker_distribution/registry_config.yml.erb
@@ -0,0 +1,11 @@
+version: 0.1
+log:
+ fields:
+ service: registry
+storage:
+ cache:
+ layerinfo: inmemory
+ filesystem:
+ rootdirectory: /var/lib/registry
+http:
+ addr: <%= @registry_host %>:<%= @registry_port %>
diff --git a/templates/ui/tripleo_ui_config.js.erb b/templates/ui/tripleo_ui_config.js.erb
index fef8afb..d49fe8e 100644
--- a/templates/ui/tripleo_ui_config.js.erb
+++ b/templates/ui/tripleo_ui_config.js.erb
@@ -1,14 +1,25 @@
window.tripleOUiConfig = {
- "keystone": "<%= @keystone_url %>",
-
- // The UI automatically discovers below URLs by querying keystone but can be
- // changed here if desired.
- //"heat": "<%= @heat_url %>",
- //"ironic": "<%= @ironic_url %>",
- //"mistral": "<%= @mistral_url %>",
- //"swift": "<%= @swift_url %>",
- //"zaqar-websocket": "<%= @zaqar_websocket_url %>",
+ // Service URLs (defaults to UI host)
+ //
+ // A valid Keystone service URL is required. The other endpoints
+ // will then be obtained automatically from the Keystone catalog.
+ //
+ 'keystone': '<%= @endpoint_config_keystone %>',
+ 'heat': '<%= @endpoint_config_heat %>',
+ 'ironic': '<%= @endpoint_config_ironic %>',
+ 'mistral': '<%= @endpoint_config_mistral %>',
+ 'swift': '<%= @endpoint_config_swift %>',
+ 'zaqar-websocket': '<%= @endpoint_config_zaqar %>',
// Default websocket queue name
- "zaqar_default_queue": "<%= @zaqar_default_queue %>"
+ 'zaqar_default_queue': '<%= @zaqar_default_queue %>'
+
+ // Languages
+ // If you choose more than one language, a language switcher will appear in
+ // the navigation bar.
+ // Only 'en' (English) is enabled by default.
+ // 'languages': ['en-GB', 'en', 'ja', 'ko-KR', 'zh-CN', 'es'],
+
+ // Logging
+ // 'loggers': ['console']
};
diff --git a/test-requirements.txt b/test-requirements.txt
new file mode 100644
index 0000000..bedd666
--- /dev/null
+++ b/test-requirements.txt
@@ -0,0 +1,4 @@
+# this is required for the docs build jobs
+sphinx!=1.2.0,!=1.3b1,<1.3,>=1.1.2
+oslosphinx>=2.5.0 # Apache-2.0
+reno>=0.1.1 # Apache-2.0
diff --git a/tox.ini b/tox.ini
new file mode 100644
index 0000000..aea06c8
--- /dev/null
+++ b/tox.ini
@@ -0,0 +1,8 @@
+[tox]
+minversion = 1.6
+skipsdist = True
+envlist = releasenotes
+
+[testenv:releasenotes]
+deps = -rtest-requirements.txt
+commands = sphinx-build -a -E -W -d releasenotes/build/doctrees -b html releasenotes/source releasenotes/build/html