aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
-rw-r--r--README.md6
-rw-r--r--manifests/certmonger/haproxy.pp16
-rw-r--r--manifests/certmonger/haproxy_dirs.pp55
-rw-r--r--manifests/haproxy.pp51
-rw-r--r--manifests/haproxy/endpoint.pp8
-rw-r--r--manifests/haproxy/stats.pp74
-rw-r--r--manifests/profile/base/certmonger_user.pp6
-rw-r--r--manifests/profile/base/cinder/api.pp11
-rw-r--r--manifests/profile/base/cinder/volume.pp37
-rw-r--r--manifests/profile/base/cinder/volume/dellemc_unity.pp47
-rw-r--r--manifests/profile/base/database/mysql.pp22
-rw-r--r--manifests/profile/base/docker.pp62
-rw-r--r--manifests/profile/base/haproxy.pp7
-rw-r--r--manifests/profile/base/ironic.pp5
-rw-r--r--manifests/profile/base/nova/compute.pp11
-rw-r--r--manifests/profile/base/nova/libvirt.pp17
-rw-r--r--manifests/profile/base/pacemaker.pp20
-rw-r--r--manifests/profile/base/rabbitmq.pp15
-rw-r--r--manifests/profile/base/zaqar.pp48
-rw-r--r--manifests/profile/pacemaker/clustercheck.pp11
-rw-r--r--manifests/profile/pacemaker/database/mysql_bundle.pp192
-rw-r--r--manifests/profile/pacemaker/haproxy.pp10
-rw-r--r--manifests/profile/pacemaker/haproxy_bundle.pp115
-rw-r--r--manifests/profile/pacemaker/manila.pp22
-rw-r--r--manifests/profile/pacemaker/rabbitmq_bundle.pp128
-rw-r--r--releasenotes/notes/TLS-for-haproxy-stats-3ce3b7780f0ef5b7.yaml8
-rw-r--r--releasenotes/notes/Use-encryption-for-pacemaker-by-default-ca887dca02a21705.yaml6
-rw-r--r--releasenotes/notes/innodb_buffer_pool_size-6fa946cf008a4606.yaml4
-rw-r--r--spec/classes/tripleo_haproxy_stats_spec.rb104
-rw-r--r--spec/classes/tripleo_profile_base_cinder_api_spec.rb14
-rw-r--r--spec/classes/tripleo_profile_base_cinder_unity_spec.rb57
-rw-r--r--spec/classes/tripleo_profile_base_docker_spec.rb81
-rw-r--r--spec/classes/tripleo_profile_base_nova_compute_spec.rb14
-rw-r--r--spec/classes/tripleo_profile_base_nova_libvirt_spec.rb45
-rw-r--r--spec/classes/tripleo_profile_base_swift_proxy_spec.rb4
-rw-r--r--spec/fixtures/hieradata/step4.yaml3
-rw-r--r--test-requirements.txt2
37 files changed, 952 insertions, 386 deletions
diff --git a/README.md b/README.md
index 90e858b..71da517 100644
--- a/README.md
+++ b/README.md
@@ -1,7 +1,7 @@
Team and repository tags
========================
-[![Team and repository tags](http://governance.openstack.org/badges/puppet-tripleo.svg)](http://governance.openstack.org/reference/tags/index.html)
+[![Team and repository tags](https://governance.openstack.org/tc/badges/puppet-tripleo.svg)](https://governance.openstack.org/tc/reference/tags/index.html)
<!-- Change things from this point on -->
@@ -15,5 +15,5 @@ Lightweight composition layer for Puppet TripleO.
* Source: http://git.openstack.org/cgit/openstack/puppet-tripleo
* Bugs: http://bugs.launchpad.net/tripleo (tag: puppet)
* Documentation:
- * TripleO: http://docs.openstack.org/developer/tripleo-docs/index.html
- * Testing with puppet: https://docs.openstack.org/developer/puppet-openstack-guide/testing.html
+ * TripleO: https://docs.openstack.org/tripleo-docs/latest/
+ * Testing with puppet: https://docs.openstack.org/developer/puppet-openstack-guide/contributor/testing.html
diff --git a/manifests/certmonger/haproxy.pp b/manifests/certmonger/haproxy.pp
index a5d1bf8..d4f4ad2 100644
--- a/manifests/certmonger/haproxy.pp
+++ b/manifests/certmonger/haproxy.pp
@@ -84,19 +84,23 @@ define tripleo::certmonger::haproxy (
postsave_cmd => $postsave_cmd,
principal => $principal,
wait => true,
+ tag => 'haproxy-cert',
require => Class['::certmonger'],
}
concat { $service_pem :
- ensure => present,
- mode => '0640',
- owner => 'haproxy',
- group => 'haproxy',
- require => Package[$::haproxy::params::package_name],
+ ensure => present,
+ mode => '0640',
+ owner => 'haproxy',
+ group => 'haproxy',
+ tag => 'haproxy-cert',
}
+ Package<| name == $::haproxy::params::package_name |> -> Concat[$service_pem]
+
concat::fragment { "${title}-cert-fragment":
target => $service_pem,
source => $service_certificate,
order => '01',
+ tag => 'haproxy-cert',
require => Certmonger_certificate["${title}-cert"],
}
@@ -106,6 +110,7 @@ define tripleo::certmonger::haproxy (
target => $service_pem,
source => $ca_pem,
order => '10',
+ tag => 'haproxy-cert',
require => Class['tripleo::certmonger::ca::local'],
}
}
@@ -114,6 +119,7 @@ define tripleo::certmonger::haproxy (
target => $service_pem,
source => $service_key,
order => 20,
+ tag => 'haproxy-cert',
require => Certmonger_certificate["${title}-cert"],
}
}
diff --git a/manifests/certmonger/haproxy_dirs.pp b/manifests/certmonger/haproxy_dirs.pp
new file mode 100644
index 0000000..86058c3
--- /dev/null
+++ b/manifests/certmonger/haproxy_dirs.pp
@@ -0,0 +1,55 @@
+# Copyright 2017 Red Hat, Inc.
+#
+# Licensed under the haproxy License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License. You may obtain
+# a copy of the License at
+#
+# http://www.haproxy.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations
+# under the License.
+#
+# : = Class: tripleo::certmonger::haproxy_dirs
+#
+# Creates the necessary directories for haproxy's certificates and keys in the
+# assigned locations if specified. It also assigns the correct SELinux tags.
+#
+# === Parameters:
+#
+# [*certificate_dir*]
+# (Optional) Directory where haproxy's certificates will be stored. If left
+# unspecified, it won't be created.
+# Defaults to undef
+#
+# [*key_dir*]
+# (Optional) Directory where haproxy's keys will be stored.
+# Defaults to undef
+#
+class tripleo::certmonger::haproxy_dirs(
+ $certificate_dir = undef,
+ $key_dir = undef,
+){
+
+ if $certificate_dir {
+ file { $certificate_dir :
+ ensure => 'directory',
+ selrole => 'object_r',
+ seltype => 'cert_t',
+ seluser => 'system_u',
+ }
+ File[$certificate_dir] ~> Certmonger_certificate<| tag == 'haproxy-cert' |>
+ }
+
+ if $key_dir {
+ file { $key_dir :
+ ensure => 'directory',
+ selrole => 'object_r',
+ seltype => 'cert_t',
+ seluser => 'system_u',
+ }
+ File[$key_dir] ~> Certmonger_certificate<| tag == 'haproxy-cert' |>
+ }
+}
diff --git a/manifests/haproxy.pp b/manifests/haproxy.pp
index 924699b..a3d088a 100644
--- a/manifests/haproxy.pp
+++ b/manifests/haproxy.pp
@@ -53,6 +53,11 @@
# Should haproxy run in daemon mode or not
# Defaults to true
#
+# [*manage_firewall*]
+# (optional) Enable or disable firewall settings for ports exposed by HAProxy
+# (false means disabled, and true means enabled)
+# Defaults to hiera('tripleo::firewall::manage_firewall', true)
+#
# [*controller_hosts*]
# IPs of host or group of hosts to load-balance the services
# Can be a string or an array.
@@ -563,6 +568,7 @@ class tripleo::haproxy (
$haproxy_daemon = true,
$haproxy_stats_user = 'admin',
$haproxy_stats_password = undef,
+ $manage_firewall = hiera('tripleo::firewall::manage_firewall', true),
$controller_hosts = hiera('controller_node_ips'),
$controller_hosts_names = hiera('controller_node_names', undef),
$contrail_config_hosts = hiera('contrail_config_node_ips', undef),
@@ -766,12 +772,6 @@ class tripleo::haproxy (
$controller_hosts_names_real = downcase(any2array(split($controller_hosts_names, ',')))
}
- # TODO(bnemec): When we have support for SSL on private and admin endpoints,
- # have the haproxy stats endpoint use that certificate by default.
- if $haproxy_stats_certificate {
- $haproxy_stats_bind_certificate = $haproxy_stats_certificate
- }
-
$horizon_vip = hiera('horizon_vip', $controller_virtual_ip)
if $service_certificate {
# NOTE(jaosorior): If the horizon_vip and the public_virtual_ip are the
@@ -809,16 +809,6 @@ class tripleo::haproxy (
}
}
- if $haproxy_stats_bind_certificate {
- $haproxy_stats_bind_opts = {
- "${controller_virtual_ip}:1993" => union($haproxy_listen_bind_param, ['ssl', 'crt', $haproxy_stats_bind_certificate]),
- }
- } else {
- $haproxy_stats_bind_opts = {
- "${controller_virtual_ip}:1993" => $haproxy_listen_bind_param,
- }
- }
-
$mysql_vip = hiera('mysql_vip', $controller_virtual_ip)
$mysql_bind_opts = {
"${mysql_vip}:3306" => $haproxy_listen_bind_param,
@@ -881,22 +871,24 @@ class tripleo::haproxy (
use_internal_certificates => $use_internal_certificates,
internal_certificates_specs => $internal_certificates_specs,
listen_options => $default_listen_options,
+ manage_firewall => $manage_firewall,
}
if $haproxy_stats {
- $stats_base = ['enable', 'uri /']
- if $haproxy_stats_password {
- $stats_config = union($stats_base, ["auth ${haproxy_stats_user}:${haproxy_stats_password}"])
+ if $haproxy_stats_certificate {
+ $haproxy_stats_certificate_real = $haproxy_stats_certificate
+ } elsif $use_internal_certificates {
+ # NOTE(jaosorior): Right now it's hardcoded to use the ctlplane network
+ $haproxy_stats_certificate_real = $internal_certificates_specs["haproxy-ctlplane"]['service_pem']
} else {
- $stats_config = $stats_base
+ $haproxy_stats_certificate_real = undef
}
- haproxy::listen { 'haproxy.stats':
- bind => $haproxy_stats_bind_opts,
- mode => 'http',
- options => {
- 'stats' => $stats_config,
- },
- collect_exported => false,
+ class { '::tripleo::haproxy::stats':
+ haproxy_listen_bind_param => $haproxy_listen_bind_param,
+ ip => $controller_virtual_ip,
+ password => $haproxy_stats_password,
+ certificate => $haproxy_stats_certificate_real,
+ user => $haproxy_stats_user,
}
}
@@ -1361,7 +1353,7 @@ class tripleo::haproxy (
server_names => hiera('mysql_node_names', $controller_hosts_names_real),
options => $mysql_member_options_real,
}
- if hiera('tripleo::firewall::manage_firewall', true) {
+ if $manage_firewall {
include ::tripleo::firewall
$mysql_firewall_rules = {
'100 mysql_haproxy' => {
@@ -1443,7 +1435,7 @@ class tripleo::haproxy (
server_names => hiera('redis_node_names', $controller_hosts_names_real),
options => $haproxy_member_options,
}
- if hiera('tripleo::firewall::manage_firewall', true) {
+ if $manage_firewall {
include ::tripleo::firewall
$redis_firewall_rules = {
'100 redis_haproxy' => {
@@ -1483,6 +1475,7 @@ class tripleo::haproxy (
mode => 'http',
public_ssl_port => $ports[zaqar_api_ssl_port],
service_network => $zaqar_api_network,
+ member_options => union($haproxy_member_options, $internal_tls_member_options),
}
}
diff --git a/manifests/haproxy/endpoint.pp b/manifests/haproxy/endpoint.pp
index f1e80e8..9139061 100644
--- a/manifests/haproxy/endpoint.pp
+++ b/manifests/haproxy/endpoint.pp
@@ -86,6 +86,11 @@
# fetching the certificate for that specific network.
# Defaults to undef
#
+# [*manage_firewall*]
+# (optional) Enable or disable firewall settings for ports exposed by HAProxy
+# (false means disabled, and true means enabled)
+# Defaults to hiera('tripleo::firewall::manage_firewall', true)
+#
define tripleo::haproxy::endpoint (
$internal_ip,
$service_port,
@@ -103,6 +108,7 @@ define tripleo::haproxy::endpoint (
$use_internal_certificates = false,
$internal_certificates_specs = {},
$service_network = undef,
+ $manage_firewall = hiera('tripleo::firewall::manage_firewall', true),
) {
if $public_virtual_ip {
# service exposed to the public network
@@ -158,7 +164,7 @@ define tripleo::haproxy::endpoint (
server_names => $server_names,
options => $member_options,
}
- if hiera('tripleo::firewall::manage_firewall', true) {
+ if $manage_firewall {
include ::tripleo::firewall
# This block will construct firewall rules only when we specify
# a port for the regular service and also the ssl port for the service.
diff --git a/manifests/haproxy/stats.pp b/manifests/haproxy/stats.pp
new file mode 100644
index 0000000..f185c29
--- /dev/null
+++ b/manifests/haproxy/stats.pp
@@ -0,0 +1,74 @@
+# Copyright 2014 Red Hat, Inc.
+# All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License. You may obtain
+# a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations
+# under the License.
+
+# == Class: tripleo::haproxy::stats
+#
+# Configure the HAProxy stats interface
+#
+# [*haproxy_listen_bind_param*]
+# A list of params to be added to the HAProxy listener bind directive.
+#
+# [*ip*]
+# IP Address on which the stats interface is listening on. This right now
+# assumes that it's in the ctlplane network.
+#
+# [*password*]
+# Password for haproxy stats authentication. When set, authentication is
+# enabled on the haproxy stats endpoint.
+# A string.
+# Defaults to undef
+#
+# [*certificate*]
+# Filename of an HAProxy-compatible certificate and key file
+# When set, enables SSL on the haproxy stats endpoint using the specified file.
+# Defaults to undef
+#
+# [*user*]
+# Username for haproxy stats authentication.
+# A string.
+# Defaults to 'admin'
+#
+class tripleo::haproxy::stats (
+ $haproxy_listen_bind_param,
+ $ip,
+ $password = undef,
+ $certificate = undef,
+ $user = 'admin'
+) {
+ if $certificate {
+ $haproxy_stats_bind_opts = {
+ "${ip}:1993" => union($haproxy_listen_bind_param, ['ssl', 'crt', $certificate]),
+ }
+ } else {
+ $haproxy_stats_bind_opts = {
+ "${ip}:1993" => $haproxy_listen_bind_param,
+ }
+ }
+
+ $stats_base = ['enable', 'uri /']
+ if $password {
+ $stats_config = union($stats_base, ["auth ${user}:${password}"])
+ } else {
+ $stats_config = $stats_base
+ }
+ haproxy::listen { 'haproxy.stats':
+ bind => $haproxy_stats_bind_opts,
+ mode => 'http',
+ options => {
+ 'stats' => $stats_config,
+ },
+ collect_exported => false,
+ }
+}
diff --git a/manifests/profile/base/certmonger_user.pp b/manifests/profile/base/certmonger_user.pp
index 7a6559e..2ac4b6e 100644
--- a/manifests/profile/base/certmonger_user.pp
+++ b/manifests/profile/base/certmonger_user.pp
@@ -80,13 +80,16 @@ class tripleo::profile::base::certmonger_user (
unless empty($haproxy_certificates_specs) {
$reload_haproxy = ['systemctl reload haproxy']
Class['::tripleo::certmonger::ca::crl'] ~> Haproxy::Balancermember<||>
- Class['::tripleo::certmonger::ca::crl'] ~> Class['::haproxy']
+ if defined(Class['::haproxy']) {
+ Class['::tripleo::certmonger::ca::crl'] ~> Class['::haproxy']
+ }
} else {
$reload_haproxy = []
}
class { '::tripleo::certmonger::ca::crl' :
reload_cmds => $reload_haproxy,
}
+ Certmonger_certificate<||> -> Class['::tripleo::certmonger::ca::crl']
include ::tripleo::certmonger::ca::libvirt
unless empty($apache_certificates_specs) {
@@ -98,6 +101,7 @@ class tripleo::profile::base::certmonger_user (
ensure_resources('tripleo::certmonger::libvirt', $libvirt_certificates_specs)
}
unless empty($haproxy_certificates_specs) {
+ include ::tripleo::certmonger::haproxy_dirs
ensure_resources('tripleo::certmonger::haproxy', $haproxy_certificates_specs)
# The haproxy fronends (or listen resources) depend on the certificate
# existing and need to be refreshed if it changed.
diff --git a/manifests/profile/base/cinder/api.pp b/manifests/profile/base/cinder/api.pp
index 54880ad..892e4ed 100644
--- a/manifests/profile/base/cinder/api.pp
+++ b/manifests/profile/base/cinder/api.pp
@@ -43,6 +43,12 @@
# (Optional) Whether TLS in the internal network is enabled or not.
# Defaults to hiera('enable_internal_tls', false)
#
+# [*keymgr_api_class*]
+# (Optional) The encryption key manager API class. The default value
+# ensures Cinder's legacy key manager is enabled when no hiera value is
+# specified.
+# Defaults to hiera('cinder::api::keymgr_api_class', 'cinder.keymgr.conf_key_mgr.ConfKeyManager')
+#
# [*step*]
# (Optional) The current step in deployment. See tripleo-heat-templates
# for more details.
@@ -53,6 +59,7 @@ class tripleo::profile::base::cinder::api (
$certificates_specs = hiera('apache_certificates_specs', {}),
$cinder_api_network = hiera('cinder_api_network', undef),
$enable_internal_tls = hiera('enable_internal_tls', false),
+ $keymgr_api_class = hiera('cinder::api::keymgr_api_class', 'cinder.keymgr.conf_key_mgr.ConfKeyManager'),
$step = Integer(hiera('step')),
) {
if $::hostname == downcase($bootstrap_node) {
@@ -75,7 +82,9 @@ class tripleo::profile::base::cinder::api (
}
if $step >= 4 or ($step >= 3 and $sync_db) {
- include ::cinder::api
+ class { '::cinder::api':
+ keymgr_api_class => $keymgr_api_class,
+ }
include ::apache::mod::ssl
class { '::cinder::wsgi::apache':
ssl_cert => $tls_certfile,
diff --git a/manifests/profile/base/cinder/volume.pp b/manifests/profile/base/cinder/volume.pp
index bdfdd17..252bae1 100644
--- a/manifests/profile/base/cinder/volume.pp
+++ b/manifests/profile/base/cinder/volume.pp
@@ -26,6 +26,10 @@
# (Optional) Whether to enable the delsc backend
# Defaults to false
#
+# [*cinder_enable_dellemc_unity_backend*]
+# (Optional) Whether to enable the unity backend
+# Defaults to false
+#
# [*cinder_enable_hpelefthand_backend*]
# (Optional) Whether to enable the hpelefthand backend
# Defaults to false
@@ -68,18 +72,19 @@
# Defaults to hiera('step')
#
class tripleo::profile::base::cinder::volume (
- $cinder_enable_pure_backend = false,
- $cinder_enable_dellsc_backend = false,
- $cinder_enable_hpelefthand_backend = false,
- $cinder_enable_dellps_backend = false,
- $cinder_enable_iscsi_backend = true,
- $cinder_enable_netapp_backend = false,
- $cinder_enable_nfs_backend = false,
- $cinder_enable_rbd_backend = false,
- $cinder_enable_scaleio_backend = false,
- $cinder_enable_vrts_hs_backend = false,
- $cinder_user_enabled_backends = hiera('cinder_user_enabled_backends', undef),
- $step = Integer(hiera('step')),
+ $cinder_enable_pure_backend = false,
+ $cinder_enable_dellsc_backend = false,
+ $cinder_enable_dellemc_unity_backend = false,
+ $cinder_enable_hpelefthand_backend = false,
+ $cinder_enable_dellps_backend = false,
+ $cinder_enable_iscsi_backend = true,
+ $cinder_enable_netapp_backend = false,
+ $cinder_enable_nfs_backend = false,
+ $cinder_enable_rbd_backend = false,
+ $cinder_enable_scaleio_backend = false,
+ $cinder_enable_vrts_hs_backend = false,
+ $cinder_user_enabled_backends = hiera('cinder_user_enabled_backends', undef),
+ $step = Integer(hiera('step')),
) {
include ::tripleo::profile::base::cinder
@@ -100,6 +105,13 @@ class tripleo::profile::base::cinder::volume (
$cinder_dellsc_backend_name = undef
}
+ if $cinder_enable_dellemc_unity_backend {
+ include ::tripleo::profile::base::cinder::volume::dellemc_unity
+ $cinder_dellemc_unity_backend_name = hiera('cinder::backend::dellemc_unity::volume_backend_name', 'tripleo_dellemc_unity')
+ } else {
+ $cinder_dellemc_unity_backend_name = undef
+ }
+
if $cinder_enable_hpelefthand_backend {
include ::tripleo::profile::base::cinder::volume::hpelefthand
$cinder_hpelefthand_backend_name = hiera('cinder::backend::hpelefthand_iscsi::volume_backend_name', 'tripleo_hpelefthand')
@@ -161,6 +173,7 @@ class tripleo::profile::base::cinder::volume (
$cinder_pure_backend_name,
$cinder_dellps_backend_name,
$cinder_dellsc_backend_name,
+ $cinder_dellemc_unity_backend_name,
$cinder_hpelefthand_backend_name,
$cinder_netapp_backend_name,
$cinder_nfs_backend_name,
diff --git a/manifests/profile/base/cinder/volume/dellemc_unity.pp b/manifests/profile/base/cinder/volume/dellemc_unity.pp
new file mode 100644
index 0000000..fb9c36f
--- /dev/null
+++ b/manifests/profile/base/cinder/volume/dellemc_unity.pp
@@ -0,0 +1,47 @@
+# Copyright (c) 2016-2017 Dell Inc, or its subsidiaries.
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License. You may obtain
+# a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations
+# under the License.
+#
+# == Class: tripleo::profile::base::cinder::volume::dellemc_unity
+#
+# Cinder Volume dellemc_unity profile for tripleo
+#
+# === Parameters
+#
+# [*backend_name*]
+# (Optional) Name given to the Cinder backend stanza
+# Defaults to 'tripleo_dellemc_unity'
+#
+# [*step*]
+# (Optional) The current step in deployment. See tripleo-heat-templates
+# for more details.
+# Defaults to hiera('step')
+#
+class tripleo::profile::base::cinder::volume::dellemc_unity (
+ $backend_name = hiera('cinder::backend::dellemc_unity::volume_backend_name', 'tripleo_dellemc_unity'),
+ $step = Integer(hiera('step')),
+) {
+ include ::tripleo::profile::base::cinder::volume
+
+ if $step >= 4 {
+ cinder::backend::dellemc_unity { $backend_name :
+ san_ip => hiera('cinder::backend::dellemc_unity::san_ip', undef),
+ san_login => hiera('cinder::backend::dellemc_unity::san_login', undef),
+ san_password => hiera('cinder::backend::dellemc_unity::san_password', undef),
+ storage_protocol => hiera('cinder::backend::dellemc_unity::storage_protocol', undef),
+ unity_io_ports => hiera('cinder::backend::dellemc_unity::unity_io_ports', undef),
+ unity_storage_pool_names => hiera('cinder::backend::dellemc_unity::unity_storage_pool_names', undef),
+ }
+ }
+
+}
diff --git a/manifests/profile/base/database/mysql.pp b/manifests/profile/base/database/mysql.pp
index 3bf41cf..7e7d68b 100644
--- a/manifests/profile/base/database/mysql.pp
+++ b/manifests/profile/base/database/mysql.pp
@@ -47,6 +47,10 @@
# limit for the mysql service.
# Defaults to false
#
+# [*innodb_buffer_pool_size*]
+# (Optional) Configure the size of the MySQL buffer pool.
+# Defaults to hiera('innodb_buffer_pool_size', undef)
+#
# [*manage_resources*]
# (Optional) Whether or not manage root user, root my.cnf, and service.
# Defaults to true
@@ -76,6 +80,7 @@ class tripleo::profile::base::database::mysql (
$certificate_specs = {},
$enable_internal_tls = hiera('enable_internal_tls', false),
$generate_dropin_file_limit = false,
+ $innodb_buffer_pool_size = hiera('innodb_buffer_pool_size', undef),
$manage_resources = true,
$mysql_server_options = {},
$mysql_max_connections = hiera('mysql_max_connections', undef),
@@ -123,14 +128,15 @@ class tripleo::profile::base::database::mysql (
# MysqlNetwork and ControllerHostnameResolveNetwork in ServiceNetMap
$mysql_server_default = {
'mysqld' => {
- 'bind-address' => $bind_address,
- 'max_connections' => $mysql_max_connections,
- 'open_files_limit' => '-1',
- 'innodb_file_per_table' => 'ON',
- 'ssl' => $enable_internal_tls,
- 'ssl-key' => $tls_keyfile,
- 'ssl-cert' => $tls_certfile,
- 'ssl-ca' => undef,
+ 'bind-address' => $bind_address,
+ 'max_connections' => $mysql_max_connections,
+ 'open_files_limit' => '-1',
+ 'innodb_buffer_pool_size' => $innodb_buffer_pool_size,
+ 'innodb_file_per_table' => 'ON',
+ 'ssl' => $enable_internal_tls,
+ 'ssl-key' => $tls_keyfile,
+ 'ssl-cert' => $tls_certfile,
+ 'ssl-ca' => undef,
}
}
$mysql_server_options_real = deep_merge($mysql_server_default, $mysql_server_options)
diff --git a/manifests/profile/base/docker.pp b/manifests/profile/base/docker.pp
index e042947..d230366 100644
--- a/manifests/profile/base/docker.pp
+++ b/manifests/profile/base/docker.pp
@@ -32,7 +32,7 @@
# OPTIONS that are used to startup the docker service. NOTE:
# --selinux-enabled is dropped due to recommendations here:
# https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/7.2_Release_Notes/technology-preview-file_systems.html
-# Defaults to '--log-driver=journald --signature-verification=false'
+# Defaults to '--log-driver=journald --signature-verification=false --iptables=false'
#
# [*configure_storage*]
# Boolean. Whether to configure a docker storage backend. Defaults to true.
@@ -43,18 +43,6 @@
# [*step*]
# step defaults to hiera('step')
#
-# [*configure_libvirt_polkit*]
-# Configures libvirt polkit to grant the kolla nova user access to the libvirtd unix domain socket on the host.
-# Defaults to true when nova_compute service is enabled, false when nova_compute is disabled
-#
-# [*docker_nova_uid*]
-# When configure_libvirt_polkit = true, the uid/gid of the nova user within the docker container.
-# Defaults to 42436
-#
-# [*services_enabled*]
-# List of TripleO services enabled on the role.
-# Defaults to hiera('services_names')
-#
# DEPRECATED PARAMETERS
#
# [*docker_namespace*]
@@ -69,24 +57,15 @@
class tripleo::profile::base::docker (
$insecure_registry_address = undef,
$registry_mirror = false,
- $docker_options = '--log-driver=journald --signature-verification=false',
+ $docker_options = '--log-driver=journald --signature-verification=false --iptables=false',
$configure_storage = true,
$storage_options = '-s overlay2',
$step = Integer(hiera('step')),
- $configure_libvirt_polkit = undef,
- $docker_nova_uid = 42436,
- $services_enabled = hiera('service_names', []),
# DEPRECATED PARAMETERS
$docker_namespace = undef,
$insecure_registry = false,
) {
- if $configure_libvirt_polkit == undef {
- $configure_libvirt_polkit_real = 'nova_compute' in $services_enabled
- } else {
- $configure_libvirt_polkit_real = $configure_libvirt_polkit
- }
-
if $step >= 1 {
package {'docker':
ensure => installed,
@@ -176,41 +155,4 @@ class tripleo::profile::base::docker (
}
}
- if ($step >= 4 and $configure_libvirt_polkit_real) {
- # Workaround for polkit authorization for libvirtd socket on host
- #
- # This creates a local user with the kolla nova uid, and sets the polkit rule to
- # allow both it and the nova user from the nova rpms, should it exist (uid 162).
-
- group { 'docker_nova_group':
- name => 'docker_nova',
- gid => $docker_nova_uid
- }
- -> user { 'docker_nova_user':
- name => 'docker_nova',
- uid => $docker_nova_uid,
- gid => $docker_nova_uid,
- shell => '/sbin/nologin',
- comment => 'OpenStack Nova Daemons',
- groups => ['nobody']
- }
-
- # Similar to the polkit rule in the openstack-nova rpm spec
- # but allow both the 'docker_nova' and 'nova' user
- $docker_nova_polkit_rule = '// openstack-nova libvirt management permissions
-polkit.addRule(function(action, subject) {
- if (action.id == "org.libvirt.unix.manage" &&
- /^(docker_)?nova$/.test(subject.user)) {
- return polkit.Result.YES;
- }
-});
-'
- package {'polkit':
- ensure => installed,
- }
- -> file {'/etc/polkit-1/rules.d/50-nova.rules':
- content => $docker_nova_polkit_rule,
- mode => '0644'
- }
- }
}
diff --git a/manifests/profile/base/haproxy.pp b/manifests/profile/base/haproxy.pp
index 4f3322c..145f283 100644
--- a/manifests/profile/base/haproxy.pp
+++ b/manifests/profile/base/haproxy.pp
@@ -36,6 +36,11 @@
# (Optional) Whether or not loadbalancer is enabled.
# Defaults to hiera('enable_load_balancer', true).
#
+# [*manage_firewall*]
+# (optional) Enable or disable firewall settings for ports exposed by HAProxy
+# (false means disabled, and true means enabled)
+# Defaults to hiera('tripleo::firewall::manage_firewall', true)
+#
# [*step*]
# (Optional) The current step in deployment. See tripleo-heat-templates
# for more details.
@@ -44,12 +49,14 @@
class tripleo::profile::base::haproxy (
$certificates_specs = {},
$enable_load_balancer = hiera('enable_load_balancer', true),
+ $manage_firewall = hiera('tripleo::firewall::manage_firewall', true),
$step = Integer(hiera('step')),
) {
if $step >= 1 {
if $enable_load_balancer {
class {'::tripleo::haproxy':
internal_certificates_specs => $certificates_specs,
+ manage_firewall => $manage_firewall,
}
unless hiera('tripleo::haproxy::haproxy_service_manage', true) {
diff --git a/manifests/profile/base/ironic.pp b/manifests/profile/base/ironic.pp
index 2739f33..7e6efec 100644
--- a/manifests/profile/base/ironic.pp
+++ b/manifests/profile/base/ironic.pp
@@ -70,8 +70,9 @@ class tripleo::profile::base::ironic (
if $step >= 4 or ($step >= 3 and $sync_db) {
$oslomsg_use_ssl_real = sprintf('%s', bool2num(str2bool($oslomsg_use_ssl)))
class { '::ironic':
- sync_db => $sync_db,
- default_transport_url => os_transport_url({
+ sync_db => $sync_db,
+ db_online_data_migrations => $sync_db,
+ default_transport_url => os_transport_url({
'transport' => $oslomsg_rpc_proto,
'hosts' => $oslomsg_rpc_hosts,
'port' => sprintf('%s', $oslomsg_rpc_port),
diff --git a/manifests/profile/base/nova/compute.pp b/manifests/profile/base/nova/compute.pp
index 3eae880..a9a1f94 100644
--- a/manifests/profile/base/nova/compute.pp
+++ b/manifests/profile/base/nova/compute.pp
@@ -27,9 +27,16 @@
# (Optional) Whether or not Cinder is backed by NFS.
# Defaults to hiera('cinder_enable_nfs_backend', false)
#
+# [*keymgr_api_class*]
+# (Optional) The encryption key manager API class. The default value
+# ensures Nova's legacy key manager is enabled when no hiera value is
+# specified.
+# Defaults to hiera('nova::compute::keymgr_api_class', 'nova.keymgr.conf_key_mgr.ConfKeyManager')
+#
class tripleo::profile::base::nova::compute (
$step = Integer(hiera('step')),
$cinder_nfs_backend = hiera('cinder_enable_nfs_backend', false),
+ $keymgr_api_class = hiera('nova::compute::keymgr_api_class', 'nova.keymgr.conf_key_mgr.ConfKeyManager'),
) {
if $step >= 4 {
@@ -37,7 +44,9 @@ class tripleo::profile::base::nova::compute (
include ::tripleo::profile::base::nova
# deploy basic bits for nova-compute
- include ::nova::compute
+ class { '::nova::compute':
+ keymgr_api_class => $keymgr_api_class,
+ }
# If Service['nova-conductor'] is in catalog, make sure we start it
# before nova-compute.
Service<| title == 'nova-conductor' |> -> Service['nova-compute']
diff --git a/manifests/profile/base/nova/libvirt.pp b/manifests/profile/base/nova/libvirt.pp
index 83f0c38..6c865dc 100644
--- a/manifests/profile/base/nova/libvirt.pp
+++ b/manifests/profile/base/nova/libvirt.pp
@@ -23,8 +23,13 @@
# for more details.
# Defaults to hiera('step')
#
+# [*libvirtd_config*]
+# (Optional) Overrides for libvirtd config options
+# Default to {}
+#
class tripleo::profile::base::nova::libvirt (
$step = Integer(hiera('step')),
+ $libvirtd_config = {},
) {
include ::tripleo::profile::base::nova::compute_libvirt_shared
@@ -33,6 +38,18 @@ class tripleo::profile::base::nova::libvirt (
include ::tripleo::profile::base::nova::migration::client
include ::nova::compute::libvirt::services
+ $libvirtd_config_default = {
+ unix_sock_group => {value => '"libvirt"'},
+ auth_unix_ro => {value => '"none"'},
+ auth_unix_rw => {value => '"none"'},
+ unix_sock_ro_perms => {value => '"0777"'},
+ unix_sock_rw_perms => {value => '"0770"'}
+ }
+
+ class { '::nova::compute::libvirt::config':
+ libvirtd_config => merge($libvirtd_config_default, $libvirtd_config)
+ }
+
file { ['/etc/libvirt/qemu/networks/autostart/default.xml',
'/etc/libvirt/qemu/networks/default.xml']:
ensure => absent,
diff --git a/manifests/profile/base/pacemaker.pp b/manifests/profile/base/pacemaker.pp
index d468110..de7e069 100644
--- a/manifests/profile/base/pacemaker.pp
+++ b/manifests/profile/base/pacemaker.pp
@@ -63,6 +63,10 @@
# be set to 60s.
# Defaults to hiera('pacemaker_cluster_recheck_interval', undef)
#
+# [*encryption*]
+# (Optional) Whether or not to enable encryption of the pacemaker traffic
+# Defaults to true
+#
class tripleo::profile::base::pacemaker (
$step = Integer(hiera('step')),
$pcs_tries = hiera('pcs_tries', 20),
@@ -74,6 +78,7 @@ class tripleo::profile::base::pacemaker (
$remote_tries = hiera('pacemaker_remote_tries', 5),
$remote_try_sleep = hiera('pacemaker_remote_try_sleep', 60),
$cluster_recheck_interval = hiera('pacemaker_cluster_recheck_interval', undef),
+ $encryption = true,
) {
if count($remote_short_node_names) != count($remote_node_ips) {
@@ -98,9 +103,20 @@ class tripleo::profile::base::pacemaker (
$pacemaker_cluster_members = downcase(regsubst($pacemaker_short_node_names, ',', ' ', 'G'))
$corosync_ipv6 = str2bool(hiera('corosync_ipv6', false))
if $corosync_ipv6 {
- $cluster_setup_extras = { '--token' => hiera('corosync_token_timeout', 1000), '--ipv6' => '' }
+ $cluster_setup_extras_pre = {
+ '--token' => hiera('corosync_token_timeout', 1000),
+ '--ipv6' => ''
+ }
+ } else {
+ $cluster_setup_extras_pre = {
+ '--token' => hiera('corosync_token_timeout', 1000)
+ }
+ }
+
+ if $encryption {
+ $cluster_setup_extras = merge($cluster_setup_extras_pre, {'--encryption' => '1'})
} else {
- $cluster_setup_extras = { '--token' => hiera('corosync_token_timeout', 1000) }
+ $cluster_setup_extras = $cluster_setup_extras_pre
}
class { '::pacemaker':
hacluster_pwd => hiera('hacluster_pwd'),
diff --git a/manifests/profile/base/rabbitmq.pp b/manifests/profile/base/rabbitmq.pp
index d0b4a05..fbe5113 100644
--- a/manifests/profile/base/rabbitmq.pp
+++ b/manifests/profile/base/rabbitmq.pp
@@ -98,15 +98,6 @@ class tripleo::profile::base::rabbitmq (
$tls_keyfile = undef
}
- # IPv6 environment, necessary for RabbitMQ.
- if $ipv6 {
- $rabbit_env = merge($environment, {
- 'RABBITMQ_SERVER_START_ARGS' => '"-proto_dist inet6_tcp"',
- 'RABBITMQ_CTL_ERL_ARGS' => '"-proto_dist inet6_tcp"'
- })
- } else {
- $rabbit_env = $environment
- }
if $inet_dist_interface {
$real_kernel_variables = merge(
$kernel_variables,
@@ -125,10 +116,11 @@ class tripleo::profile::base::rabbitmq (
cluster_nodes => $nodes,
config_kernel_variables => $real_kernel_variables,
config_variables => $config_variables,
- environment_variables => $rabbit_env,
+ environment_variables => $environment,
# TLS options
ssl_cert => $tls_certfile,
ssl_key => $tls_keyfile,
+ ipv6 => $ipv6,
}
# when running multi-nodes without Pacemaker
if $manage_service {
@@ -144,10 +136,11 @@ class tripleo::profile::base::rabbitmq (
class { '::rabbitmq':
config_kernel_variables => $kernel_variables,
config_variables => $config_variables,
- environment_variables => $rabbit_env,
+ environment_variables => $environment,
# TLS options
ssl_cert => $tls_certfile,
ssl_key => $tls_keyfile,
+ ipv6 => $ipv6,
}
}
}
diff --git a/manifests/profile/base/zaqar.pp b/manifests/profile/base/zaqar.pp
index cd84d04..573984d 100644
--- a/manifests/profile/base/zaqar.pp
+++ b/manifests/profile/base/zaqar.pp
@@ -30,16 +30,40 @@
# (Optional) The messaging store for Zaqar.
# Defaults to 'mongodb'
#
+# [*certificates_specs*]
+# (Optional) The specifications to give to certmonger for the certificate(s)
+# it will create.
+# Example with hiera:
+# apache_certificates_specs:
+# httpd-internal_api:
+# hostname: <overcloud controller fqdn>
+# service_certificate: <service certificate path>
+# service_key: <service key path>
+# principal: "haproxy/<overcloud controller fqdn>"
+# Defaults to hiera('apache_certificate_specs', {}).
+#
+# [*enable_internal_tls*]
+# (Optional) Whether TLS in the internal network is enabled or not.
+# Defaults to hiera('enable_internal_tls', false)
+#
+# [*zaqar_api_network*]
+# (Optional) The network name where the zaqar API endpoint is listening on.
+# This is set by t-h-t.
+# Defaults to hiera('zaqar_api_network', undef)
+#
# [*step*]
# (Optional) The current step in deployment. See tripleo-heat-templates
# for more details.
# Defaults to hiera('step')
#
class tripleo::profile::base::zaqar (
- $bootstrap_node = hiera('bootstrap_nodeid', undef),
- $management_store = 'mongodb',
- $messaging_store = 'mongodb',
- $step = Integer(hiera('step')),
+ $bootstrap_node = hiera('bootstrap_nodeid', undef),
+ $management_store = 'mongodb',
+ $messaging_store = 'mongodb',
+ $certificates_specs = hiera('apache_certificates_specs', {}),
+ $enable_internal_tls = hiera('enable_internal_tls', false),
+ $zaqar_api_network = hiera('zaqar_api_network', undef),
+ $step = Integer(hiera('step')),
) {
if $::hostname == downcase($bootstrap_node) {
$is_bootstrap = true
@@ -47,6 +71,17 @@ class tripleo::profile::base::zaqar (
$is_bootstrap = false
}
+ if $enable_internal_tls {
+ if !$zaqar_api_network {
+ fail('zaqar_api_network is not set in the hieradata.')
+ }
+ $tls_certfile = $certificates_specs["httpd-${zaqar_api_network}"]['service_certificate']
+ $tls_keyfile = $certificates_specs["httpd-${zaqar_api_network}"]['service_key']
+ } else {
+ $tls_certfile = undef
+ $tls_keyfile = undef
+ }
+
if $step >= 4 or ( $step >= 3 and $is_bootstrap ) {
include ::zaqar
@@ -92,7 +127,10 @@ class tripleo::profile::base::zaqar (
class { '::zaqar::server':
service_name => 'httpd', # TODO cleanup when passed by t-h-t.
}
- include ::zaqar::wsgi::apache
+ class { '::zaqar::wsgi::apache':
+ ssl_cert => $tls_certfile,
+ ssl_key => $tls_keyfile,
+ }
zaqar::server_instance{ '1':
transport => 'websocket'
}
diff --git a/manifests/profile/pacemaker/clustercheck.pp b/manifests/profile/pacemaker/clustercheck.pp
index 958f4a2..c08bafc 100644
--- a/manifests/profile/pacemaker/clustercheck.pp
+++ b/manifests/profile/pacemaker/clustercheck.pp
@@ -26,14 +26,19 @@
# (Optional) The address that the local mysql instance should bind to.
# Defaults to hiera('mysql_bind_host')
#
+# [*clustercheck_user*]
+# (Optional) The name of the clustercheck user.
+# Defaults to 'clustercheck'
+#
# [*clustercheck_password*]
# (Optional) The password for the clustercheck user.
-# Defaults to hiera('mysql::server::root_password')
+# Defaults to hiera('mysql_clustercheck_password')
#
#
class tripleo::profile::pacemaker::clustercheck (
$step = Integer(hiera('step')),
- $clustercheck_password = hiera('mysql::server::root_password'),
+ $clustercheck_user = 'clustercheck',
+ $clustercheck_password = hiera('mysql_clustercheck_password'),
$bind_address = hiera('mysql_bind_host'),
) {
@@ -43,7 +48,7 @@ class tripleo::profile::pacemaker::clustercheck (
mode => '0600',
owner => 'mysql',
group => 'mysql',
- content => "MYSQL_USERNAME=root\n
+ content => "MYSQL_USERNAME=${clustercheck_user}\n
MYSQL_PASSWORD='${clustercheck_password}'\n
MYSQL_HOST=localhost\n",
}
diff --git a/manifests/profile/pacemaker/database/mysql_bundle.pp b/manifests/profile/pacemaker/database/mysql_bundle.pp
index 21d671c..e07ac2e 100644
--- a/manifests/profile/pacemaker/database/mysql_bundle.pp
+++ b/manifests/profile/pacemaker/database/mysql_bundle.pp
@@ -34,6 +34,27 @@
# (Optional) The address that the local mysql instance should bind to.
# Defaults to $::hostname
#
+# [*ca_file*]
+# (Optional) The path to the CA file that will be used for the TLS
+# configuration. It's only used if internal TLS is enabled.
+# Defaults to undef
+#
+# [*certificate_specs*]
+# (Optional) The specifications to give to certmonger for the certificate
+# it will create. Note that the certificate nickname must be 'mysql' in
+# the case of this service.
+# Example with hiera:
+# tripleo::profile::base::database::mysql::certificate_specs:
+# hostname: <overcloud controller fqdn>
+# service_certificate: <service certificate path>
+# service_key: <service key path>
+# principal: "mysql/<overcloud controller fqdn>"
+# Defaults to hiera('tripleo::profile::base::database::mysql::certificate_specs', {}).
+#
+# [*enable_internal_tls*]
+# (Optional) Whether TLS in the internal network is enabled or not.
+# Defaults to hiera('enable_internal_tls', false)
+#
# [*gmcast_listen_addr*]
# (Optional) This variable defines the address on which the node listens to
# connections from other nodes in the cluster.
@@ -50,13 +71,16 @@
#
#
class tripleo::profile::pacemaker::database::mysql_bundle (
- $mysql_docker_image = hiera('tripleo::profile::pacemaker::database::mysql_bundle::mysql_docker_image', undef),
- $control_port = hiera('tripleo::profile::pacemaker::database::mysql_bundle::control_port', '3123'),
- $bootstrap_node = hiera('mysql_short_bootstrap_node_name'),
- $bind_address = $::hostname,
- $gmcast_listen_addr = hiera('mysql_bind_host'),
- $pcs_tries = hiera('pcs_tries', 20),
- $step = Integer(hiera('step')),
+ $mysql_docker_image = hiera('tripleo::profile::pacemaker::database::mysql_bundle::mysql_docker_image', undef),
+ $control_port = hiera('tripleo::profile::pacemaker::database::mysql_bundle::control_port', '3123'),
+ $bootstrap_node = hiera('mysql_short_bootstrap_node_name'),
+ $bind_address = $::hostname,
+ $ca_file = undef,
+ $certificate_specs = hiera('tripleo::profile::base::database::mysql::certificate_specs', {}),
+ $enable_internal_tls = hiera('enable_internal_tls', false),
+ $gmcast_listen_addr = hiera('mysql_bind_host'),
+ $pcs_tries = hiera('pcs_tries', 20),
+ $step = Integer(hiera('step')),
) {
if $::hostname == downcase($bootstrap_node) {
$pacemaker_master = true
@@ -64,16 +88,11 @@ class tripleo::profile::pacemaker::database::mysql_bundle (
$pacemaker_master = false
}
- # use only mysql_node_names when we land a patch in t-h-t that
- # switches to autogenerating these values from composable services
- # The galera node names need to match the pacemaker node names... so if we
- # want to use FQDNs for this, the cluster will not finish bootstrapping,
- # since all the nodes will be marked as slaves. For now, we'll stick to the
- # short name which is already registered in pacemaker until we get around
- # this issue.
- $galera_node_names_lookup = hiera('mysql_short_node_names', hiera('mysql_node_names', $::hostname))
+ $galera_node_names_lookup = hiera('mysql_short_node_names', $::hostname)
+ $galera_fqdns_names_lookup = hiera('mysql_node_names', $::hostname)
+
if is_array($galera_node_names_lookup) {
- $galera_nodes = downcase(join($galera_node_names_lookup, ','))
+ $galera_nodes = downcase(join($galera_fqdns_names_lookup, ','))
} else {
$galera_nodes = downcase($galera_node_names_lookup)
}
@@ -87,6 +106,19 @@ class tripleo::profile::pacemaker::database::mysql_bundle (
}
$cluster_host_map_string = join($host_map_array, ';')
+ if $enable_internal_tls {
+ $tls_certfile = $certificate_specs['service_certificate']
+ $tls_keyfile = $certificate_specs['service_key']
+ if $ca_file {
+ $tls_ca_options = "socket.ssl_ca=${ca_file}"
+ } else {
+ $tls_ca_options = ''
+ }
+ $tls_options = "socket.ssl_key=${tls_keyfile};socket.ssl_cert=${tls_certfile};${tls_ca_options};"
+ } else {
+ $tls_options = ''
+ }
+
$mysqld_options = {
'mysqld' => {
'pid-file' => '/var/lib/mysql/mariadb.pid',
@@ -116,7 +148,7 @@ class tripleo::profile::pacemaker::database::mysql_bundle (
'wsrep_drupal_282555_workaround'=> '0',
'wsrep_causal_reads' => '0',
'wsrep_sst_method' => 'rsync',
- 'wsrep_provider_options' => "gmcast.listen_addr=tcp://${gmcast_listen_addr}:4567;",
+ 'wsrep_provider_options' => "gmcast.listen_addr=tcp://${gmcast_listen_addr}:4567;${tls_options}",
},
'mysqld_safe' => {
'pid-file' => '/var/lib/mysql/mariadb.pid',
@@ -195,6 +227,74 @@ MYSQL_HOST=localhost\n",
}
# lint:endignore
}
+
+ $storage_maps = {
+ 'mysql-cfg-files' => {
+ 'source-dir' => '/var/lib/kolla/config_files/mysql.json',
+ 'target-dir' => '/var/lib/kolla/config_files/config.json',
+ 'options' => 'ro',
+ },
+ 'mysql-cfg-data' => {
+ 'source-dir' => '/var/lib/config-data/puppet-generated/mysql/',
+ 'target-dir' => '/var/lib/kolla/config_files/src',
+ 'options' => 'ro',
+ },
+ 'mysql-hosts' => {
+ 'source-dir' => '/etc/hosts',
+ 'target-dir' => '/etc/hosts',
+ 'options' => 'ro',
+ },
+ 'mysql-localtime' => {
+ 'source-dir' => '/etc/localtime',
+ 'target-dir' => '/etc/localtime',
+ 'options' => 'ro',
+ },
+ 'mysql-lib' => {
+ 'source-dir' => '/var/lib/mysql',
+ 'target-dir' => '/var/lib/mysql',
+ 'options' => 'rw',
+ },
+ 'mysql-log-mariadb' => {
+ 'source-dir' => '/var/log/mariadb',
+ 'target-dir' => '/var/log/mariadb',
+ 'options' => 'rw',
+ },
+ 'mysql-dev-log' => {
+ 'source-dir' => '/dev/log',
+ 'target-dir' => '/dev/log',
+ 'options' => 'rw',
+ },
+ }
+
+ if $enable_internal_tls {
+ $mysql_storage_maps_tls = {
+ 'mysql-pki-gcomm-key' => {
+ 'source-dir' => '/etc/pki/tls/private/mysql.key',
+ 'target-dir' => '/var/lib/kolla/config_files/src-tls/etc/pki/tls/private/mysql.key',
+ 'options' => 'ro',
+ },
+ 'mysql-pki-gcomm-cert' => {
+ 'source-dir' => '/etc/pki/tls/certs/mysql.crt',
+ 'target-dir' => '/var/lib/kolla/config_files/src-tls/etc/pki/tls/certs/mysql.crt',
+ 'options' => 'ro',
+ },
+ }
+ if $ca_file {
+ $ca_storage_maps_tls = {
+ 'mysql-pki-gcomm-ca' => {
+ 'source-dir' => $ca_file,
+ 'target-dir' => "/var/lib/kolla/config_files/src-tls${ca_file}",
+ 'options' => 'ro',
+ },
+ }
+ } else {
+ $ca_storage_maps_tls = {}
+ }
+ $storage_maps_tls = merge($mysql_storage_maps_tls, $ca_storage_maps_tls)
+ } else {
+ $storage_maps_tls = {}
+ }
+
pacemaker::resource::bundle { 'galera-bundle':
image => $mysql_docker_image,
replicas => $galera_nodes_count,
@@ -208,63 +308,7 @@ MYSQL_HOST=localhost\n",
options => '--user=root --log-driver=journald -e KOLLA_CONFIG_STRATEGY=COPY_ALWAYS',
run_command => '/bin/bash /usr/local/bin/kolla_start',
network => "control-port=${control_port}",
- storage_maps => {
- 'mysql-cfg-files' => {
- 'source-dir' => '/var/lib/kolla/config_files/mysql.json',
- 'target-dir' => '/var/lib/kolla/config_files/config.json',
- 'options' => 'ro',
- },
- 'mysql-cfg-data' => {
- 'source-dir' => '/var/lib/config-data/puppet-generated/mysql/',
- 'target-dir' => '/var/lib/kolla/config_files/src',
- 'options' => 'ro',
- },
- 'mysql-hosts' => {
- 'source-dir' => '/etc/hosts',
- 'target-dir' => '/etc/hosts',
- 'options' => 'ro',
- },
- 'mysql-localtime' => {
- 'source-dir' => '/etc/localtime',
- 'target-dir' => '/etc/localtime',
- 'options' => 'ro',
- },
- 'mysql-lib' => {
- 'source-dir' => '/var/lib/mysql',
- 'target-dir' => '/var/lib/mysql',
- 'options' => 'rw',
- },
- 'mysql-log-mariadb' => {
- 'source-dir' => '/var/log/mariadb',
- 'target-dir' => '/var/log/mariadb',
- 'options' => 'rw',
- },
- 'mysql-pki-extracted' => {
- 'source-dir' => '/etc/pki/ca-trust/extracted',
- 'target-dir' => '/etc/pki/ca-trust/extracted',
- 'options' => 'ro',
- },
- 'mysql-pki-ca-bundle-crt' => {
- 'source-dir' => '/etc/pki/tls/certs/ca-bundle.crt',
- 'target-dir' => '/etc/pki/tls/certs/ca-bundle.crt',
- 'options' => 'ro',
- },
- 'mysql-pki-ca-bundle-trust-crt' => {
- 'source-dir' => '/etc/pki/tls/certs/ca-bundle.trust.crt',
- 'target-dir' => '/etc/pki/tls/certs/ca-bundle.trust.crt',
- 'options' => 'ro',
- },
- 'mysql-pki-cert' => {
- 'source-dir' => '/etc/pki/tls/cert.pem',
- 'target-dir' => '/etc/pki/tls/cert.pem',
- 'options' => 'ro',
- },
- 'mysql-dev-log' => {
- 'source-dir' => '/dev/log',
- 'target-dir' => '/dev/log',
- 'options' => 'rw',
- },
- },
+ storage_maps => merge($storage_maps, $storage_maps_tls),
}
pacemaker::resource::ocf { 'galera':
diff --git a/manifests/profile/pacemaker/haproxy.pp b/manifests/profile/pacemaker/haproxy.pp
index 7331071..5198243 100644
--- a/manifests/profile/pacemaker/haproxy.pp
+++ b/manifests/profile/pacemaker/haproxy.pp
@@ -26,6 +26,11 @@
# (Optional) Whether load balancing is enabled for this cluster
# Defaults to hiera('enable_load_balancer', true)
#
+# [*manage_firewall*]
+# (optional) Enable or disable firewall settings for ports exposed by HAProxy
+# (false means disabled, and true means enabled)
+# Defaults to hiera('tripleo::firewall::manage_firewall', true)
+#
# [*step*]
# (Optional) The current step in deployment. See tripleo-heat-templates
# for more details.
@@ -38,10 +43,13 @@
class tripleo::profile::pacemaker::haproxy (
$bootstrap_node = hiera('haproxy_short_bootstrap_node_name'),
$enable_load_balancer = hiera('enable_load_balancer', true),
+ $manage_firewall = hiera('tripleo::firewall::manage_firewall', true),
$step = Integer(hiera('step')),
$pcs_tries = hiera('pcs_tries', 20),
) {
- include ::tripleo::profile::base::haproxy
+ class {'::tripleo::profile::base::haproxy':
+ manage_firewall => $manage_firewall,
+ }
if $::hostname == downcase($bootstrap_node) {
$pacemaker_master = true
diff --git a/manifests/profile/pacemaker/haproxy_bundle.pp b/manifests/profile/pacemaker/haproxy_bundle.pp
index b785ea7..1b9a191 100644
--- a/manifests/profile/pacemaker/haproxy_bundle.pp
+++ b/manifests/profile/pacemaker/haproxy_bundle.pp
@@ -30,10 +30,34 @@
# (Optional) Whether load balancing is enabled for this cluster
# Defaults to hiera('enable_load_balancer', true)
#
+# [*ca_bundle*]
+# (Optional) The path to the CA file that will be used for the TLS
+# configuration. It's only used if internal TLS is enabled.
+# Defaults to hiera('tripleo::haproxy::ca_bundle', undef)
+#
+# [*crl_file*]
+# (Optional) The path to the file that contains the certificate
+# revocation list. It's only used if internal TLS is enabled.
+# Defaults to hiera('tripleo::haproxy::crl_file', undef)
+#
# [*deployed_ssl_cert_path*]
# (Optional) The filepath of the certificate as it will be stored in
# the controller.
-# Defaults to '/etc/pki/tls/private/overcloud_endpoint.pem'
+# Defaults to hiera('tripleo::haproxy::service_certificate', undef)
+#
+# [*enable_internal_tls*]
+# (Optional) Whether TLS in the internal network is enabled or not.
+# Defaults to hiera('enable_internal_tls', false)
+#
+# [*internal_certs_directory*]
+# (Optional) Directory the holds the certificates to be used when
+# when TLS is enabled in the internal network
+# Defaults to undef
+#
+# [*internal_keys_directory*]
+# (Optional) Directory the holds the certificates to be used when
+# when TLS is enabled in the internal network
+# Defaults to undef
#
# [*step*]
# (Optional) The current step in deployment. See tripleo-heat-templates
@@ -45,12 +69,17 @@
# Defaults to hiera('pcs_tries', 20)
#
class tripleo::profile::pacemaker::haproxy_bundle (
- $haproxy_docker_image = hiera('tripleo::profile::pacemaker::haproxy::haproxy_docker_image', undef),
- $bootstrap_node = hiera('haproxy_short_bootstrap_node_name'),
- $enable_load_balancer = hiera('enable_load_balancer', true),
- $deployed_ssl_cert_path = '/etc/pki/tls/private/overcloud_endpoint.pem',
- $step = Integer(hiera('step')),
- $pcs_tries = hiera('pcs_tries', 20),
+ $haproxy_docker_image = hiera('tripleo::profile::pacemaker::haproxy::haproxy_docker_image', undef),
+ $bootstrap_node = hiera('haproxy_short_bootstrap_node_name'),
+ $enable_load_balancer = hiera('enable_load_balancer', true),
+ $ca_bundle = hiera('tripleo::haproxy::ca_bundle', undef),
+ $crl_file = hiera('tripleo::haproxy::crl_file', undef),
+ $enable_internal_tls = hiera('enable_internal_tls', false),
+ $internal_certs_directory = undef,
+ $internal_keys_directory = undef,
+ $deployed_ssl_cert_path = hiera('tripleo::haproxy::service_certificate', undef),
+ $step = Integer(hiera('step')),
+ $pcs_tries = hiera('pcs_tries', 20),
) {
include ::tripleo::profile::base::haproxy
@@ -90,14 +119,8 @@ class tripleo::profile::pacemaker::haproxy_bundle (
$haproxy_nodes = hiera('haproxy_short_node_names')
$haproxy_nodes_count = count($haproxy_nodes)
- pacemaker::resource::bundle { 'haproxy-bundle':
- image => $haproxy_docker_image,
- replicas => $haproxy_nodes_count,
- location_rule => $haproxy_location_rule,
- container_options => 'network=host',
- options => '--user=root --log-driver=journald -e KOLLA_CONFIG_STRATEGY=COPY_ALWAYS',
- run_command => '/bin/bash /usr/local/bin/kolla_start',
- storage_maps => {
+
+ $storage_maps = {
'haproxy-cfg-files' => {
'source-dir' => '/var/lib/kolla/config_files/haproxy.json',
'target-dir' => '/var/lib/kolla/config_files/config.json',
@@ -143,12 +166,68 @@ class tripleo::profile::pacemaker::haproxy_bundle (
'target-dir' => '/dev/log',
'options' => 'rw',
},
- 'haproxy-cert' => {
+ };
+
+ if $deployed_ssl_cert_path {
+ $cert_storage_maps = {
+ 'haproxy-cert' => {
'source-dir' => $deployed_ssl_cert_path,
- 'target-dir' => $deployed_ssl_cert_path,
+ 'target-dir' => "/var/lib/kolla/config_files/src-tls${deployed_ssl_cert_path}",
'options' => 'ro',
},
- },
+ }
+ } else {
+ $cert_storage_maps = {}
+ }
+
+ if $enable_internal_tls {
+ $haproxy_storage_maps = {
+ 'haproxy-pki-certs' => {
+ 'source-dir' => $internal_certs_directory,
+ 'target-dir' => "/var/lib/kolla/config_files/src-tls${internal_certs_directory}",
+ 'options' => 'ro',
+ },
+ 'haproxy-pki-keys' => {
+ 'source-dir' => $internal_keys_directory,
+ 'target-dir' => "/var/lib/kolla/config_files/src-tls${internal_keys_directory}",
+ 'options' => 'ro',
+ },
+ }
+ if $ca_bundle {
+ $ca_storage_maps = {
+ 'haproxy-pki-ca-file' => {
+ 'source-dir' => $ca_bundle,
+ 'target-dir' => "/var/lib/kolla/config_files/src-tls${ca_bundle}",
+ 'options' => 'ro',
+ },
+ }
+ } else {
+ $ca_storage_maps = {}
+ }
+ if $crl_file {
+ $crl_storage_maps = {
+ 'haproxy-pki-crl-file' => {
+ 'source-dir' => $crl_file,
+ 'target-dir' => $crl_file,
+ 'options' => 'ro',
+ },
+ }
+ } else {
+ $crl_storage_maps = {}
+ }
+ $storage_maps_internal_tls = merge($haproxy_storage_maps, $ca_storage_maps, $crl_storage_maps)
+ } else {
+ $storage_maps_internal_tls = {}
+ }
+
+ pacemaker::resource::bundle { 'haproxy-bundle':
+ image => $haproxy_docker_image,
+ replicas => $haproxy_nodes_count,
+ location_rule => $haproxy_location_rule,
+ container_options => 'network=host',
+ options => '--user=root --log-driver=journald -e KOLLA_CONFIG_STRATEGY=COPY_ALWAYS',
+ run_command => '/bin/bash /usr/local/bin/kolla_start',
+ storage_maps => merge($storage_maps, $cert_storage_maps, $storage_maps_internal_tls),
}
$control_vip = hiera('controller_virtual_ip')
tripleo::pacemaker::haproxy_with_vip { 'haproxy_and_control_vip':
diff --git a/manifests/profile/pacemaker/manila.pp b/manifests/profile/pacemaker/manila.pp
index c22a033..25d389a 100644
--- a/manifests/profile/pacemaker/manila.pp
+++ b/manifests/profile/pacemaker/manila.pp
@@ -134,17 +134,19 @@ class tripleo::profile::pacemaker::manila (
cephfs_enable_snapshots => hiera('manila::backend::cephfsnative::cephfs_enable_snapshots'),
}
- ceph::key { "client.${cephfs_auth_id}" :
- secret => hiera('manila::backend::cephfsnative::ceph_client_key'),
- keyring_path => $keyring_path,
- # inject the new key into ceph cluster only if ceph is deployed by
- # tripleo (if external ceph is used it should be added manually)
- inject => $ceph_mds_enabled,
- user => 'manila',
- cap_mds => 'allow *',
- cap_mon => 'allow r, allow command \"auth del\", allow command \"auth caps\", \
+ if !defined(Resource['ceph::key', "client.${cephfs_auth_id}"]) {
+ ceph::key { "client.${cephfs_auth_id}" :
+ secret => hiera('manila::backend::cephfsnative::ceph_client_key'),
+ keyring_path => $keyring_path,
+ # inject the new key into ceph cluster only if ceph is deployed by
+ # tripleo (if external ceph is used it should be added manually)
+ inject => $ceph_mds_enabled,
+ user => 'manila',
+ cap_mds => 'allow *',
+ cap_mon => 'allow r, allow command \"auth del\", allow command \"auth caps\", \
allow command \"auth get\", allow command \"auth get-or-create\"',
- cap_osd => 'allow rw'
+ cap_osd => 'allow rw'
+ }
}
ceph_config {
diff --git a/manifests/profile/pacemaker/rabbitmq_bundle.pp b/manifests/profile/pacemaker/rabbitmq_bundle.pp
index 5dd22d2..4d6b9af 100644
--- a/manifests/profile/pacemaker/rabbitmq_bundle.pp
+++ b/manifests/profile/pacemaker/rabbitmq_bundle.pp
@@ -44,6 +44,10 @@
# (Optional) The list of rabbitmq nodes names
# Defaults to hiera('rabbitmq_node_names')
#
+# [*enable_internal_tls*]
+# (Optional) Whether TLS in the internal network is enabled or not.
+# Defaults to hiera('enable_internal_tls', false)
+#
# [*step*]
# (Optional) The current step in deployment. See tripleo-heat-templates
# for more details.
@@ -60,6 +64,7 @@ class tripleo::profile::pacemaker::rabbitmq_bundle (
$erlang_cookie = hiera('rabbitmq::erlang_cookie'),
$user_ha_queues = hiera('rabbitmq::nr_ha_queues', 0),
$rabbit_nodes = hiera('rabbitmq_node_names'),
+ $enable_internal_tls = hiera('enable_internal_tls', false),
$pcs_tries = hiera('pcs_tries', 20),
$step = Integer(hiera('step')),
) {
@@ -102,6 +107,76 @@ class tripleo::profile::pacemaker::rabbitmq_bundle (
}
}
+ $storage_maps = {
+ 'rabbitmq-cfg-files' => {
+ 'source-dir' => '/var/lib/kolla/config_files/rabbitmq.json',
+ 'target-dir' => '/var/lib/kolla/config_files/config.json',
+ 'options' => 'ro',
+ },
+ 'rabbitmq-cfg-data' => {
+ 'source-dir' => '/var/lib/config-data/puppet-generated/rabbitmq/',
+ 'target-dir' => '/var/lib/kolla/config_files/src',
+ 'options' => 'ro',
+ },
+ 'rabbitmq-hosts' => {
+ 'source-dir' => '/etc/hosts',
+ 'target-dir' => '/etc/hosts',
+ 'options' => 'ro',
+ },
+ 'rabbitmq-localtime' => {
+ 'source-dir' => '/etc/localtime',
+ 'target-dir' => '/etc/localtime',
+ 'options' => 'ro',
+ },
+ 'rabbitmq-lib' => {
+ 'source-dir' => '/var/lib/rabbitmq',
+ 'target-dir' => '/var/lib/rabbitmq',
+ 'options' => 'rw',
+ },
+ 'rabbitmq-pki-extracted' => {
+ 'source-dir' => '/etc/pki/ca-trust/extracted',
+ 'target-dir' => '/etc/pki/ca-trust/extracted',
+ 'options' => 'ro',
+ },
+ 'rabbitmq-pki-ca-bundle-crt' => {
+ 'source-dir' => '/etc/pki/tls/certs/ca-bundle.crt',
+ 'target-dir' => '/etc/pki/tls/certs/ca-bundle.crt',
+ 'options' => 'ro',
+ },
+ 'rabbitmq-pki-ca-bundle-trust-crt' => {
+ 'source-dir' => '/etc/pki/tls/certs/ca-bundle.trust.crt',
+ 'target-dir' => '/etc/pki/tls/certs/ca-bundle.trust.crt',
+ 'options' => 'ro',
+ },
+ 'rabbitmq-pki-cert' => {
+ 'source-dir' => '/etc/pki/tls/cert.pem',
+ 'target-dir' => '/etc/pki/tls/cert.pem',
+ 'options' => 'ro',
+ },
+ 'rabbitmq-dev-log' => {
+ 'source-dir' => '/dev/log',
+ 'target-dir' => '/dev/log',
+ 'options' => 'rw',
+ },
+ }
+
+ if $enable_internal_tls {
+ $storage_maps_tls = {
+ 'rabbitmq-pki-cert' => {
+ 'source-dir' => '/etc/pki/tls/certs/rabbitmq.crt',
+ 'target-dir' => '/var/lib/kolla/config_files/src-tls/etc/pki/tls/certs/rabbitmq.crt',
+ 'options' => 'ro',
+ },
+ 'rabbitmq-pki-key' => {
+ 'source-dir' => '/etc/pki/tls/private/rabbitmq.key',
+ 'target-dir' => '/var/lib/kolla/config_files/src-tls/etc/pki/tls/private/rabbitmq.key',
+ 'options' => 'ro',
+ },
+ }
+ } else {
+ $storage_maps_tls = {}
+ }
+
pacemaker::resource::bundle { 'rabbitmq-bundle':
image => $rabbitmq_docker_image,
replicas => $rabbitmq_nodes_count,
@@ -114,58 +189,7 @@ class tripleo::profile::pacemaker::rabbitmq_bundle (
options => '--user=root --log-driver=journald -e KOLLA_CONFIG_STRATEGY=COPY_ALWAYS',
run_command => '/bin/bash /usr/local/bin/kolla_start',
network => "control-port=${rabbitmq_docker_control_port}",
- storage_maps => {
- 'rabbitmq-cfg-files' => {
- 'source-dir' => '/var/lib/kolla/config_files/rabbitmq.json',
- 'target-dir' => '/var/lib/kolla/config_files/config.json',
- 'options' => 'ro',
- },
- 'rabbitmq-cfg-data' => {
- 'source-dir' => '/var/lib/config-data/puppet-generated/rabbitmq/',
- 'target-dir' => '/var/lib/kolla/config_files/src',
- 'options' => 'ro',
- },
- 'rabbitmq-hosts' => {
- 'source-dir' => '/etc/hosts',
- 'target-dir' => '/etc/hosts',
- 'options' => 'ro',
- },
- 'rabbitmq-localtime' => {
- 'source-dir' => '/etc/localtime',
- 'target-dir' => '/etc/localtime',
- 'options' => 'ro',
- },
- 'rabbitmq-lib' => {
- 'source-dir' => '/var/lib/rabbitmq',
- 'target-dir' => '/var/lib/rabbitmq',
- 'options' => 'rw',
- },
- 'rabbitmq-pki-extracted' => {
- 'source-dir' => '/etc/pki/ca-trust/extracted',
- 'target-dir' => '/etc/pki/ca-trust/extracted',
- 'options' => 'ro',
- },
- 'rabbitmq-pki-ca-bundle-crt' => {
- 'source-dir' => '/etc/pki/tls/certs/ca-bundle.crt',
- 'target-dir' => '/etc/pki/tls/certs/ca-bundle.crt',
- 'options' => 'ro',
- },
- 'rabbitmq-pki-ca-bundle-trust-crt' => {
- 'source-dir' => '/etc/pki/tls/certs/ca-bundle.trust.crt',
- 'target-dir' => '/etc/pki/tls/certs/ca-bundle.trust.crt',
- 'options' => 'ro',
- },
- 'rabbitmq-pki-cert' => {
- 'source-dir' => '/etc/pki/tls/cert.pem',
- 'target-dir' => '/etc/pki/tls/cert.pem',
- 'options' => 'ro',
- },
- 'rabbitmq-dev-log' => {
- 'source-dir' => '/dev/log',
- 'target-dir' => '/dev/log',
- 'options' => 'rw',
- },
- },
+ storage_maps => merge($storage_maps, $storage_maps_tls),
}
# The default nr of ha queues is ceiling(N/2)
diff --git a/releasenotes/notes/TLS-for-haproxy-stats-3ce3b7780f0ef5b7.yaml b/releasenotes/notes/TLS-for-haproxy-stats-3ce3b7780f0ef5b7.yaml
new file mode 100644
index 0000000..2f981a1
--- /dev/null
+++ b/releasenotes/notes/TLS-for-haproxy-stats-3ce3b7780f0ef5b7.yaml
@@ -0,0 +1,8 @@
+---
+features:
+ - When TLS everywhere is enabled, the HAProxy stats interface will also use
+ TLS. This requires the user to access the interface through the ctlplane
+ FQDN (which is configured by the CloudNameCtlplane parameter in
+ tripleo-heat-templates). Note that one can still use the
+ haproxy_stats_certificate parameter from the haproxy class, and that one
+ will take precedence if set.
diff --git a/releasenotes/notes/Use-encryption-for-pacemaker-by-default-ca887dca02a21705.yaml b/releasenotes/notes/Use-encryption-for-pacemaker-by-default-ca887dca02a21705.yaml
new file mode 100644
index 0000000..65b0316
--- /dev/null
+++ b/releasenotes/notes/Use-encryption-for-pacemaker-by-default-ca887dca02a21705.yaml
@@ -0,0 +1,6 @@
+---
+features:
+ - |
+ Encryption is used for pacemaker traffic by default. This is achieved by
+ using a pre shared key for all the pacemaker cluster nodes (same as the one
+ that was used for the pacemaker remote communication).
diff --git a/releasenotes/notes/innodb_buffer_pool_size-6fa946cf008a4606.yaml b/releasenotes/notes/innodb_buffer_pool_size-6fa946cf008a4606.yaml
new file mode 100644
index 0000000..b4663eb
--- /dev/null
+++ b/releasenotes/notes/innodb_buffer_pool_size-6fa946cf008a4606.yaml
@@ -0,0 +1,4 @@
+---
+features:
+ - |
+ Enable innodb_buffer_pool_size configuration for all MySQL databases.
diff --git a/spec/classes/tripleo_haproxy_stats_spec.rb b/spec/classes/tripleo_haproxy_stats_spec.rb
new file mode 100644
index 0000000..bad5bf1
--- /dev/null
+++ b/spec/classes/tripleo_haproxy_stats_spec.rb
@@ -0,0 +1,104 @@
+#
+# Copyright (C) 2016 Red Hat, Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License. You may obtain
+# a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations
+# under the License.
+#
+
+require 'spec_helper'
+
+describe 'tripleo::haproxy::stats' do
+
+ shared_examples_for 'tripleo::haproxy::stats' do
+ let :pre_condition do
+ "Haproxy::Listen {
+ config_file => '/etc/haproxy.cfg'
+ }"
+ end
+
+ context 'with only required parameters' do
+ let(:params) do
+ {
+ :ip => '127.0.0.1',
+ :haproxy_listen_bind_param => ['transparent'],
+ }
+ end
+ it 'should configure basic stats frontend' do
+ is_expected.to contain_haproxy__listen('haproxy.stats').with(
+ :bind => {
+ "127.0.0.1:1993" => ['transparent']
+ },
+ :mode => 'http',
+ :options => {
+ 'stats' => ['enable', 'uri /']
+ },
+ :collect_exported => false
+ )
+ end
+ end
+
+ context 'with auth parameters' do
+ let(:params) do
+ {
+ :ip => '127.0.0.1',
+ :haproxy_listen_bind_param => ['transparent'],
+ :user => 'myuser',
+ :password => 'superdupersecret',
+ }
+ end
+ it 'should configure stats frontend with auth enabled' do
+ is_expected.to contain_haproxy__listen('haproxy.stats').with(
+ :bind => {
+ "127.0.0.1:1993" => ['transparent']
+ },
+ :mode => 'http',
+ :options => {
+ 'stats' => ['enable', 'uri /', 'auth myuser:superdupersecret']
+ },
+ :collect_exported => false
+ )
+ end
+ end
+
+ context 'with certificate parameter' do
+ let(:params) do
+ {
+ :ip => '127.0.0.1',
+ :haproxy_listen_bind_param => ['transparent'],
+ :certificate => '/path/to/cert',
+ }
+ end
+ it 'should configure stats frontend with TLS enabled' do
+ is_expected.to contain_haproxy__listen('haproxy.stats').with(
+ :bind => {
+ "127.0.0.1:1993" => ['transparent', 'ssl', 'crt', '/path/to/cert']
+ },
+ :mode => 'http',
+ :options => {
+ 'stats' => ['enable', 'uri /']
+ },
+ :collect_exported => false
+ )
+ end
+ end
+ end
+
+ on_supported_os.each do |os, facts|
+ context "on #{os}" do
+ let(:facts) do
+ facts.merge({})
+ end
+
+ it_behaves_like 'tripleo::haproxy::stats'
+ end
+ end
+end
diff --git a/spec/classes/tripleo_profile_base_cinder_api_spec.rb b/spec/classes/tripleo_profile_base_cinder_api_spec.rb
index 03e2fd0..b9a9854 100644
--- a/spec/classes/tripleo_profile_base_cinder_api_spec.rb
+++ b/spec/classes/tripleo_profile_base_cinder_api_spec.rb
@@ -18,6 +18,10 @@ require 'spec_helper'
describe 'tripleo::profile::base::cinder::api' do
shared_examples_for 'tripleo::profile::base::cinder::api' do
+ before :each do
+ facts.merge!({ :step => params[:step] })
+ end
+
let(:pre_condition) do
"class { '::tripleo::profile::base::cinder': step => #{params[:step]}, oslomsg_rpc_hosts => ['127.0.0.1'] }"
end
@@ -40,7 +44,10 @@ describe 'tripleo::profile::base::cinder::api' do
} }
it 'should trigger complete configuration' do
- is_expected.to contain_class('cinder::api')
+ is_expected.to contain_class('cinder::api').with(
+ # Verify legacy key manager is enabled when none is set in hiera.
+ :keymgr_api_class => 'cinder.keymgr.conf_key_mgr.ConfKeyManager',
+ )
is_expected.to contain_class('cinder::ceilometer')
end
end
@@ -63,7 +70,10 @@ describe 'tripleo::profile::base::cinder::api' do
} }
it 'should trigger complete configuration' do
- is_expected.to contain_class('cinder::api')
+ is_expected.to contain_class('cinder::api').with(
+ # Verify proper key manager is enabled when value is set in hiera.
+ :keymgr_api_class => 'castellan.key_manager.barbican_key_manager.BarbicanKeyManager',
+ )
is_expected.to contain_class('cinder::ceilometer')
end
end
diff --git a/spec/classes/tripleo_profile_base_cinder_unity_spec.rb b/spec/classes/tripleo_profile_base_cinder_unity_spec.rb
new file mode 100644
index 0000000..38f362b
--- /dev/null
+++ b/spec/classes/tripleo_profile_base_cinder_unity_spec.rb
@@ -0,0 +1,57 @@
+# Copyright (c) 2016-2017 Dell Inc, or its subsidiaries
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License. You may obtain
+# a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations
+# under the License.
+#
+
+require 'spec_helper'
+
+describe 'tripleo::profile::base::cinder::volume::dellemc_unity' do
+ shared_examples_for 'tripleo::profile::base::cinder::volume::dellemc_unity' do
+ before :each do
+ facts.merge!({ :step => params[:step] })
+ end
+
+ context 'with step less than 4' do
+ let(:params) { { :step => 3 } }
+
+ it 'should do nothing' do
+ is_expected.to contain_class('tripleo::profile::base::cinder::volume::dellemc_unity')
+ is_expected.to contain_class('tripleo::profile::base::cinder::volume')
+ is_expected.to contain_class('tripleo::profile::base::cinder')
+ is_expected.to_not contain_cinder__backend__dellemc_unity('tripleo_dellemc_unity')
+ end
+ end
+
+ context 'with step 4' do
+ let(:params) { {
+ :step => 4,
+ } }
+
+ it 'should trigger complete configuration' do
+ # TODO(aschultz): check hiera parameters
+ is_expected.to contain_cinder__backend__dellemc_unity('tripleo_dellemc_unity')
+ end
+ end
+ end
+
+
+ on_supported_os.each do |os, facts|
+ context "on #{os}" do
+ let(:facts) do
+ facts.merge({ :hostname => 'node.example.com' })
+ end
+
+ it_behaves_like 'tripleo::profile::base::cinder::volume::dellemc_unity'
+ end
+ end
+end
diff --git a/spec/classes/tripleo_profile_base_docker_spec.rb b/spec/classes/tripleo_profile_base_docker_spec.rb
index dc5efa7..2a15362 100644
--- a/spec/classes/tripleo_profile_base_docker_spec.rb
+++ b/spec/classes/tripleo_profile_base_docker_spec.rb
@@ -28,7 +28,7 @@ describe 'tripleo::profile::base::docker' do
it { is_expected.to contain_service('docker') }
it {
is_expected.to contain_augeas('docker-sysconfig-options').with_changes([
- "set OPTIONS '\"--log-driver=journald --signature-verification=false\"'",
+ "set OPTIONS '\"--log-driver=journald --signature-verification=false --iptables=false\"'",
])
}
end
@@ -121,85 +121,6 @@ describe 'tripleo::profile::base::docker' do
}
end
- context 'with step 4 and configure_libvirt_polkit disabled' do
- let(:params) { {
- :step => 4,
- :configure_libvirt_polkit => false
- } }
- it {
- is_expected.to_not contain_group('docker_nova_group')
- is_expected.to_not contain_user('docker_nova_user')
- is_expected.to_not contain_package('polkit')
- is_expected.to_not contain_file('/etc/polkit-1/rules.d/50-nova.rules')
- }
- end
-
- context 'with step 4 and configure_libvirt_polkit enabled' do
- let(:params) { {
- :step => 4,
- :configure_libvirt_polkit => true
- } }
- it {
- is_expected.to contain_group('docker_nova_group').with(
- :name => 'docker_nova',
- :gid => 42436
- )
- is_expected.to contain_user('docker_nova_user').with(
- :name => 'docker_nova',
- :uid => 42436,
- :gid => 42436,
- :shell => '/sbin/nologin',
- :groups => ['nobody']
- )
- is_expected.to contain_package('polkit')
- is_expected.to contain_file('/etc/polkit-1/rules.d/50-nova.rules')
- }
- end
-
- context 'with step 4 and nova_compute service installed' do
- let(:params) { {
- :step => 4,
- :services_enabled => ['docker', 'nova_compute']
- } }
- it {
- is_expected.to contain_group('docker_nova_group').with(
- :name => 'docker_nova',
- :gid => 42436
- )
- is_expected.to contain_user('docker_nova_user').with(
- :name => 'docker_nova',
- :uid => 42436,
- :gid => 42436,
- :shell => '/sbin/nologin',
- :groups => ['nobody']
- )
- is_expected.to contain_package('polkit')
- is_expected.to contain_file('/etc/polkit-1/rules.d/50-nova.rules')
- }
- end
-
- context 'with step 4 and configure_libvirt_polkit enabled and docker_nova uid' do
- let(:params) { {
- :step => 4,
- :configure_libvirt_polkit => true,
- :docker_nova_uid => 12345
- } }
- it {
- is_expected.to contain_group('docker_nova_group').with(
- :name => 'docker_nova',
- :gid => 12345
- )
- is_expected.to contain_user('docker_nova_user').with(
- :name => 'docker_nova',
- :uid => 12345,
- :gid => 12345,
- :shell => '/sbin/nologin',
- :groups => ['nobody']
- )
- is_expected.to contain_package('polkit')
- is_expected.to contain_file('/etc/polkit-1/rules.d/50-nova.rules')
- }
- end
end
on_supported_os.each do |os, facts|
diff --git a/spec/classes/tripleo_profile_base_nova_compute_spec.rb b/spec/classes/tripleo_profile_base_nova_compute_spec.rb
index b3959c4..22881ac 100644
--- a/spec/classes/tripleo_profile_base_nova_compute_spec.rb
+++ b/spec/classes/tripleo_profile_base_nova_compute_spec.rb
@@ -18,12 +18,19 @@ require 'spec_helper'
describe 'tripleo::profile::base::nova::compute' do
shared_examples_for 'tripleo::profile::base::nova::compute' do
+ before :each do
+ facts.merge!({ :step => params[:step] })
+ end
context 'with step less than 5' do
let(:params) { { :step => 1, } }
it {
- is_expected.to contain_class('tripleo::profile::base::nova::compute')
+ is_expected.to contain_class('tripleo::profile::base::nova::compute').with(
+ # Verify legacy key manager is enabled when none is set in hiera.
+ :keymgr_api_class => 'nova.keymgr.conf_key_mgr.ConfKeyManager',
+ )
+
is_expected.to_not contain_class('tripleo::profile::base::nova')
is_expected.to_not contain_class('nova::compute')
is_expected.to_not contain_class('nova::network::neutron')
@@ -50,7 +57,10 @@ eos
let(:params) { { :step => 4, } }
it {
- is_expected.to contain_class('tripleo::profile::base::nova::compute')
+ is_expected.to contain_class('tripleo::profile::base::nova::compute').with(
+ # Verify proper key manager is enabled when value is set in hiera.
+ :keymgr_api_class => 'castellan.key_manager.barbican_key_manager.BarbicanKeyManager',
+ )
is_expected.to contain_class('tripleo::profile::base::nova')
is_expected.to contain_class('tripleo::profile::base::nova')
is_expected.to contain_class('nova::compute')
diff --git a/spec/classes/tripleo_profile_base_nova_libvirt_spec.rb b/spec/classes/tripleo_profile_base_nova_libvirt_spec.rb
index 0734a0f..65aa8c1 100644
--- a/spec/classes/tripleo_profile_base_nova_libvirt_spec.rb
+++ b/spec/classes/tripleo_profile_base_nova_libvirt_spec.rb
@@ -69,6 +69,51 @@ eos
is_expected.to contain_file('/etc/libvirt/qemu/networks/autostart/default.xml').with_ensure('absent')
is_expected.to contain_file('/etc/libvirt/qemu/networks/default.xml').with_ensure('absent')
is_expected.to contain_exec('libvirt-default-net-destroy')
+ is_expected.to contain_class('nova::compute::libvirt::config').with_libvirtd_config({
+ "unix_sock_group" => {"value" => '"libvirt"'},
+ "auth_unix_ro" => {"value" => '"none"'},
+ "auth_unix_rw" => {"value" => '"none"'},
+ "unix_sock_ro_perms" => {"value" => '"0777"'},
+ "unix_sock_rw_perms" => {"value" => '"0770"'}
+ })
+ }
+ end
+
+ context 'with step 4 and libvirtd_config' do
+ let(:pre_condition) do
+ <<-eos
+ class { '::tripleo::profile::base::nova':
+ step => #{params[:step]},
+ oslomsg_rpc_hosts => [ '127.0.0.1' ],
+ }
+ class { '::tripleo::profile::base::nova::migration':
+ step => #{params[:step]}
+ }
+ class { '::tripleo::profile::base::nova::migration::client':
+ step => #{params[:step]}
+ }
+ class { '::tripleo::profile::base::nova::compute_libvirt_shared':
+ step => #{params[:step]}
+ }
+eos
+ end
+
+ let(:params) { { :step => 4, :libvirtd_config => { "unix_sock_group" => {"value" => '"foobar"'}} } }
+
+ it {
+ is_expected.to contain_class('tripleo::profile::base::nova::libvirt')
+ is_expected.to contain_class('tripleo::profile::base::nova')
+ is_expected.to contain_class('nova::compute::libvirt::services')
+ is_expected.to contain_file('/etc/libvirt/qemu/networks/autostart/default.xml').with_ensure('absent')
+ is_expected.to contain_file('/etc/libvirt/qemu/networks/default.xml').with_ensure('absent')
+ is_expected.to contain_exec('libvirt-default-net-destroy')
+ is_expected.to contain_class('nova::compute::libvirt::config').with_libvirtd_config({
+ "unix_sock_group" => {"value" => '"foobar"'},
+ "auth_unix_ro" => {"value" => '"none"'},
+ "auth_unix_rw" => {"value" => '"none"'},
+ "unix_sock_ro_perms" => {"value" => '"0777"'},
+ "unix_sock_rw_perms" => {"value" => '"0770"'}
+ })
}
end
end
diff --git a/spec/classes/tripleo_profile_base_swift_proxy_spec.rb b/spec/classes/tripleo_profile_base_swift_proxy_spec.rb
index 68d7dde..0252237 100644
--- a/spec/classes/tripleo_profile_base_swift_proxy_spec.rb
+++ b/spec/classes/tripleo_profile_base_swift_proxy_spec.rb
@@ -30,7 +30,9 @@ describe 'tripleo::profile::base::swift::proxy' do
include ::memcached
class { '::swift::proxy':
proxy_local_net_ip => '127.0.0.1',
- }"
+ }
+ include ::swift::proxy::tempauth
+ "
end
context 'with ipv4 memcache servers' do
diff --git a/spec/fixtures/hieradata/step4.yaml b/spec/fixtures/hieradata/step4.yaml
index 0b53225..fd24beb 100644
--- a/spec/fixtures/hieradata/step4.yaml
+++ b/spec/fixtures/hieradata/step4.yaml
@@ -1,9 +1,10 @@
---
step: 4
+cinder::api::keymgr_api_class: 'castellan.key_manager.barbican_key_manager.BarbicanKeyManager'
+nova::compute::keymgr_api_class: 'castellan.key_manager.barbican_key_manager.BarbicanKeyManager'
# items needed for tripleo::profile::base::cinder::volume
tripleo::profile::base::cinder::volume::iscsi::cinder_iscsi_address: '127.0.0.1'
tripleo::profile::base::cinder::volume::nfs::cinder_nfs_servers:
- '127.0.0.1'
cinder::backend::eqlx::eqlx_chap_login: 'user'
cinder::backend::eqlx::eqlx_chap_password: 'user'
-
diff --git a/test-requirements.txt b/test-requirements.txt
index a23c7e7..629ab00 100644
--- a/test-requirements.txt
+++ b/test-requirements.txt
@@ -1,6 +1,6 @@
# This is required for the docs build jobs
sphinx>=1.6.2 # BSD
-openstackdocstheme>=1.11.0 # Apache-2.0
+openstackdocstheme>=1.16.0 # Apache-2.0
# This is required for the releasenotes build jobs
# FIXME: reno is manually pinned to !=2.0.0 because of bug #1651995