diff options
| -rw-r--r-- | manifests/firewall/pre.pp | 6 | ||||
| -rw-r--r-- | manifests/profile/base/auditd.pp | 30 | ||||
| -rw-r--r-- | manifests/profile/base/docker_registry.pp | 17 | ||||
| -rw-r--r-- | manifests/profile/base/neutron.pp | 13 | ||||
| -rw-r--r-- | manifests/profile/base/neutron/server.pp | 24 | ||||
| -rw-r--r-- | manifests/profile/base/nova/api.pp | 21 | ||||
| -rw-r--r-- | releasenotes/notes/nova_cells_setup-2c3e3344d8adcc26.yaml | 3 | ||||
| -rw-r--r-- | releasenotes/notes/puppet-auditd-0f6cbd6a2d193aac.yaml | 4 | ||||
| -rw-r--r-- | spec/classes/tripleo_profile_base_nova_api_spec.rb | 7 |
9 files changed, 77 insertions, 48 deletions
diff --git a/manifests/firewall/pre.pp b/manifests/firewall/pre.pp index 7af7fbc..39120d9 100644 --- a/manifests/firewall/pre.pp +++ b/manifests/firewall/pre.pp @@ -54,4 +54,10 @@ class tripleo::firewall::pre( extras => $firewall_settings, } + tripleo::firewall::rule{ '004 accept ipv6 dhcpv6': + dport => '546', + proto => 'udp', + state => ['NEW'], + destination => 'fe80::/64', + } } diff --git a/manifests/profile/base/auditd.pp b/manifests/profile/base/auditd.pp new file mode 100644 index 0000000..628db08 --- /dev/null +++ b/manifests/profile/base/auditd.pp @@ -0,0 +1,30 @@ +# Copyright 2016 Red Hat, Inc. +# +# Licensed under the Apache License, Version 2.0 (the "License"); you may +# not use this file except in compliance with the License. You may obtain +# a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT +# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the +# License for the specific language governing permissions and limitations +# under the License. +# +# == class: tripleo::profile::base::auditd +# +# auditd profile for tripleo +# +# === Parameters +# +# [*step*] +# Defaults to hiera('step') +# +class tripleo::profile::base::auditd ( + $step = hiera('step'), +) { + if $step >= 4 { + include ::auditd + } +} diff --git a/manifests/profile/base/docker_registry.pp b/manifests/profile/base/docker_registry.pp index 05a516d..ebe84bf 100644 --- a/manifests/profile/base/docker_registry.pp +++ b/manifests/profile/base/docker_registry.pp @@ -19,21 +19,22 @@ # === Parameters: # # [*registry_host*] -# (String) IP address on which the Docker registry is listening on +# (String) IP address or hostname the Docker registry binds to # Defaults to hiera('controller_host') # # [*registry_port*] # (Integer) The port on which the Docker registry is listening on # Defaults to 8787 # -# [*controller_admin_vip*] -# (String) VIP of the host -# Defaults to hiera('controller_admin_vip') +# [*registry_admin_host*] +# (String) IP address or hostname the Docker registry binds to in the admin +# network +# Defaults to hiera('controller_admin_host') # class tripleo::profile::base::docker_registry ( - $registry_host = hiera('controller_host'), - $registry_port = 8787, - $controller_admin_vip = hiera('controller_admin_vip'), + $registry_host = hiera('controller_host'), + $registry_port = 8787, + $registry_admin_host = hiera('controller_admin_host'), ) { # We want a v2 registry package{'docker-registry': @@ -55,7 +56,7 @@ class tripleo::profile::base::docker_registry ( line => join ([ 'INSECURE_REGISTRY="', '--insecure-registry ', $registry_host, ':', $registry_port, ' ', - '--insecure-registry ', $controller_admin_vip, ':', $registry_port, '"']), + '--insecure-registry ', $registry_admin_host, ':', $registry_port, '"']), match => 'INSECURE_REGISTRY=', require => Package['docker'], notify => Service['docker'], diff --git a/manifests/profile/base/neutron.pp b/manifests/profile/base/neutron.pp index 3de50c2..e6a32db 100644 --- a/manifests/profile/base/neutron.pp +++ b/manifests/profile/base/neutron.pp @@ -35,22 +35,9 @@ class tripleo::profile::base::neutron ( $rabbit_hosts = hiera('rabbitmq_node_names', undef), $rabbit_port = hiera('neutron::rabbit_port', 5672), ) { - - # TODO(jaosorior): Remove this when we pass it via t-h-t - if hiera('enable_internal_tls', false) { - $bind_host = 'localhost' - } else { - # This is executed in all of the nodes that use something neutron-related, - # so we set the defalut, since the bind_host is only available in the - # controllers. Either way, this will be removed and set properly via t-h-t - # in a subsequent commit. - $bind_host = hiera('neutron::bind_host', $::os_service_default) - } - if $step >= 3 { $rabbit_endpoints = suffix(any2array($rabbit_hosts), ":${rabbit_port}") class { '::neutron' : - bind_host => $bind_host, rabbit_hosts => $rabbit_endpoints, } include ::neutron::config diff --git a/manifests/profile/base/neutron/server.pp b/manifests/profile/base/neutron/server.pp index 5a98f66..5d6909f 100644 --- a/manifests/profile/base/neutron/server.pp +++ b/manifests/profile/base/neutron/server.pp @@ -75,6 +75,21 @@ # for more details. # Defaults to hiera('step') # +# [*tls_proxy_bind_ip*] +# IP on which the TLS proxy will listen on. Required only if +# enable_internal_tls is set. +# Defaults to undef +# +# [*tls_proxy_fqdn*] +# fqdn on which the tls proxy will listen on. required only used if +# enable_internal_tls is set. +# defaults to undef +# +# [*tls_proxy_port*] +# port on which the tls proxy will listen on. Only used if +# enable_internal_tls is set. +# defaults to 9696 +# class tripleo::profile::base::neutron::server ( $bootstrap_node = hiera('bootstrap_nodeid', undef), $certificates_specs = hiera('apache_certificates_specs', {}), @@ -85,6 +100,9 @@ class tripleo::profile::base::neutron::server ( $l3_nodes = hiera('neutron_l3_short_node_names', []), $neutron_network = hiera('neutron_api_network', undef), $step = hiera('step'), + $tls_proxy_bind_ip = undef, + $tls_proxy_fqdn = undef, + $tls_proxy_port = 9696, ) { if $enable_internal_tls and $generate_service_certificates { ensure_resources('tripleo::certmonger::httpd', $certificates_specs) @@ -120,9 +138,9 @@ class tripleo::profile::base::neutron::server ( $tls_keyfile = $certificates_specs["httpd-${neutron_network}"]['service_key'] ::tripleo::tls_proxy { 'neutron-api': - servername => hiera("fqdn_${neutron_network}"), - ip => hiera('neutron::bind_host'), # This will be cleaned out - port => 9696, # This will be cleaned out + servername => $tls_proxy_fqdn, + ip => $tls_proxy_bind_ip, + port => $tls_proxy_port, tls_cert => $tls_certfile, tls_key => $tls_keyfile, notify => Class['::neutron::server'], diff --git a/manifests/profile/base/nova/api.pp b/manifests/profile/base/nova/api.pp index 8ded3ef..83baae2 100644 --- a/manifests/profile/base/nova/api.pp +++ b/manifests/profile/base/nova/api.pp @@ -85,25 +85,8 @@ class tripleo::profile::base::nova::api ( $tls_keyfile = undef } - if ($step >= 3 and $sync_db) { - $messaging_hosts_real = any2array($::tripleo::profile::base::nova::messaging_hosts) - # TODO(aschultz): remove sprintf once we properly type the port, needs - # to be a string for the os_transport_url function. - $messaging_port_real = sprintf('%s', $::tripleo::profile::base::nova::messaging_port) - $messaging_use_ssl_real = sprintf('%s', bool2num(str2bool($::tripleo::profile::base::nova::messaging_use_ssl))) - - #TODO(emilien): enable it again when it's fixed upstream in nova - # https://bugs.launchpad.net/tripleo/+bug/1649341 - # class { '::nova::db::sync_cell_v2': - # transport_url => os_transport_url({ - # 'transport' => $::tripleo::profile::base::nova::messaging_driver, - # 'hosts' => $messaging_hosts_real, - # 'port' => $messaging_port_real, - # 'username' => $::tripleo::profile::base::nova::messaging_username, - # 'password' => $::tripleo::profile::base::nova::messaging_password, - # 'ssl' => $messaging_use_ssl_real, - # }), - # } + if $step >= 3 and $sync_db { + include ::nova::cell_v2::simple_setup } if $step >= 4 or ($step >= 3 and $sync_db) { diff --git a/releasenotes/notes/nova_cells_setup-2c3e3344d8adcc26.yaml b/releasenotes/notes/nova_cells_setup-2c3e3344d8adcc26.yaml new file mode 100644 index 0000000..79439b2 --- /dev/null +++ b/releasenotes/notes/nova_cells_setup-2c3e3344d8adcc26.yaml @@ -0,0 +1,3 @@ +--- +features: + - Configure the basic cells setup for Nova, now required in Ocata. diff --git a/releasenotes/notes/puppet-auditd-0f6cbd6a2d193aac.yaml b/releasenotes/notes/puppet-auditd-0f6cbd6a2d193aac.yaml new file mode 100644 index 0000000..9eb7c79 --- /dev/null +++ b/releasenotes/notes/puppet-auditd-0f6cbd6a2d193aac.yaml @@ -0,0 +1,4 @@ +--- +features: + - Adds the ability to manage auditd.service and enter audit.rules + diff --git a/spec/classes/tripleo_profile_base_nova_api_spec.rb b/spec/classes/tripleo_profile_base_nova_api_spec.rb index 4aa7367..f930342 100644 --- a/spec/classes/tripleo_profile_base_nova_api_spec.rb +++ b/spec/classes/tripleo_profile_base_nova_api_spec.rb @@ -53,11 +53,8 @@ eos it { is_expected.to contain_class('tripleo::profile::base::nova::api') is_expected.to contain_class('tripleo::profile::base::nova') - #TODO(emilien): enable it again when it's fixed upstream in nova - # https://bugs.launchpad.net/tripleo/+bug/1649341 - # is_expected.to contain_class('nova::db::sync_cell_v2').with( - # :transport_url => 'rabbit://nova:foo@localhost:5672/?ssl=0') - # is_expected.to contain_class('nova::keystone::authtoken') + is_expected.to contain_class('nova::cell_v2::simple_setup') + is_expected.to contain_class('nova::keystone::authtoken') is_expected.to contain_class('nova::api') is_expected.to contain_class('nova::wsgi::apache_api') is_expected.to contain_class('nova::network::neutron') |