summaryrefslogtreecommitdiffstats
path: root/manifests/haproxy.pp
diff options
context:
space:
mode:
Diffstat (limited to 'manifests/haproxy.pp')
-rw-r--r--manifests/haproxy.pp81
1 files changed, 74 insertions, 7 deletions
diff --git a/manifests/haproxy.pp b/manifests/haproxy.pp
index bd708af..5b69edd 100644
--- a/manifests/haproxy.pp
+++ b/manifests/haproxy.pp
@@ -37,7 +37,7 @@
#
# [*haproxy_default_timeout*]
# The value to use as timeout in the HAProxy default config section.
-# Defaults to [ 'http-request 10s', 'queue 1m', 'connect 10s', 'client 1m', 'server 1m', 'check 10s' ]
+# Defaults to [ 'http-request 10s', 'queue 2m', 'connect 10s', 'client 2m', 'server 2m', 'check 10s' ]
#
# [*haproxy_listen_bind_param*]
# A list of params to be added to the HAProxy listener bind directive. By
@@ -182,6 +182,10 @@
# (optional) Enable or not Aodh API binding
# Defaults to hiera('aodh_api_enabled', false)
#
+# [*barbican*]
+# (optional) Enable or not Barbican API binding
+# Defaults to hiera('barbican_api_enabled', false)
+#
# [*gnocchi*]
# (optional) Enable or not Gnocchi API binding
# Defaults to hiera('gnocchi_api_enabled', false)
@@ -226,6 +230,14 @@
# (optional) Enable check via clustercheck for mysql
# Defaults to false
#
+# [*mysql_member_options*]
+# The options to use for the mysql HAProxy balancer members.
+# If this parameter is undefined, the actual value configured will depend
+# on the value of $mysql_clustercheck. If cluster checking is enabled,
+# the mysql member options will be: "['backup', 'port 9200', 'on-marked-down shutdown-sessions', 'check', 'inter 1s']"
+# and if mysql cluster checking is disabled, the member options will be: "union($haproxy_member_options, ['backup'])"
+# Defaults to undef
+#
# [*rabbitmq*]
# (optional) Enable or not RabbitMQ binding
# Defaults to false
@@ -271,6 +283,10 @@
# (optional) Specify the network aodh is running on.
# Defaults to hiera('aodh_api_network', undef)
#
+# [*barbican_network*]
+# (optional) Specify the network barbican is running on.
+# Defaults to hiera('barbican_api_network', undef)
+#
# [*ceilometer_network*]
# (optional) Specify the network ceilometer is running on.
# Defaults to hiera('ceilometer_api_network', undef)
@@ -376,6 +392,8 @@
# The available keys to modify the services' ports are:
# 'aodh_api_port' (Defaults to 8042)
# 'aodh_api_ssl_port' (Defaults to 13042)
+# 'barbican_api_port' (Defaults to 9311)
+# 'barbican_api_ssl_port' (Defaults to 13311)
# 'ceilometer_api_port' (Defaults to 8777)
# 'ceilometer_api_ssl_port' (Defaults to 13777)
# 'cinder_api_port' (Defaults to 8776)
@@ -435,7 +453,7 @@ class tripleo::haproxy (
$haproxy_service_manage = true,
$haproxy_global_maxconn = 20480,
$haproxy_default_maxconn = 4096,
- $haproxy_default_timeout = [ 'http-request 10s', 'queue 1m', 'connect 10s', 'client 1m', 'server 1m', 'check 10s' ],
+ $haproxy_default_timeout = [ 'http-request 10s', 'queue 2m', 'connect 10s', 'client 2m', 'server 2m', 'check 10s' ],
$haproxy_listen_bind_param = [ 'transparent' ],
$haproxy_member_options = [ 'check', 'inter 2000', 'rise 2', 'fall 5' ],
$haproxy_log_address = '/dev/log',
@@ -464,6 +482,7 @@ class tripleo::haproxy (
$nova_novncproxy = hiera('nova_vnc_proxy_enabled', false),
$ceilometer = hiera('ceilometer_api_enabled', false),
$aodh = hiera('aodh_api_enabled', false),
+ $barbican = hiera('barbican_api_enabled', false),
$gnocchi = hiera('gnocchi_api_enabled', false),
$mistral = hiera('mistral_api_enabled', false),
$swift_proxy_server = hiera('swift_proxy_enabled', false),
@@ -475,6 +494,7 @@ class tripleo::haproxy (
$ironic_inspector = hiera('ironic_inspector_enabled', false),
$mysql = hiera('mysql_enabled', false),
$mysql_clustercheck = false,
+ $mysql_member_options = undef,
$rabbitmq = false,
$docker_registry = hiera('enable_docker_registry', false),
$redis = hiera('redis_enabled', false),
@@ -486,6 +506,7 @@ class tripleo::haproxy (
$zaqar_ws = hiera('zaqar_api_enabled', false),
$ui = hiera('enable_ui', false),
$aodh_network = hiera('aodh_api_network', undef),
+ $barbican_network = hiera('barbican_api_network', false),
$ceilometer_network = hiera('ceilometer_api_network', undef),
$ceph_rgw_network = hiera('ceph_rgw_network', undef),
$cinder_network = hiera('cinder_api_network', undef),
@@ -515,6 +536,8 @@ class tripleo::haproxy (
$default_service_ports = {
aodh_api_port => 8042,
aodh_api_ssl_port => 13042,
+ barbican_api_port => 9311,
+ barbican_api_ssl_port => 13311,
ceilometer_api_port => 8777,
ceilometer_api_ssl_port => 13777,
cinder_api_port => 8776,
@@ -585,6 +608,8 @@ class tripleo::haproxy (
# This code will be removed once we switch undercloud and overcloud to use both haproxy & keepalived roles.
if $keepalived {
include ::tripleo::keepalived
+ # Make sure keepalive starts before haproxy.
+ Class['::keepalived::service'] -> Class['::haproxy']
}
# TODO(bnemec): When we have support for SSL on private and admin endpoints,
@@ -759,6 +784,11 @@ class tripleo::haproxy (
service_port => $ports[neutron_api_port],
ip_addresses => hiera('neutron_api_node_ips', $controller_hosts_real),
server_names => hiera('neutron_api_node_names', $controller_hosts_names_real),
+ listen_options => {
+ 'http-request' => [
+ 'set-header X-Forwarded-Proto https if { ssl_fc }',
+ 'set-header X-Forwarded-Proto http if !{ ssl_fc }'],
+ },
public_ssl_port => $ports[neutron_api_ssl_port],
service_network => $neutron_network,
}
@@ -868,6 +898,7 @@ class tripleo::haproxy (
},
public_ssl_port => $ports[nova_api_ssl_port],
service_network => $nova_osapi_network,
+ member_options => union($haproxy_member_options, $internal_tls_member_options),
}
}
@@ -904,6 +935,11 @@ class tripleo::haproxy (
service_port => $ports[ceilometer_api_port],
ip_addresses => hiera('ceilometer_api_node_ips', $controller_hosts_real),
server_names => hiera('ceilometer_api_node_names', $controller_hosts_names_real),
+ listen_options => {
+ 'http-request' => [
+ 'set-header X-Forwarded-Proto https if { ssl_fc }',
+ 'set-header X-Forwarded-Proto http if !{ ssl_fc }'],
+ },
public_ssl_port => $ports[ceilometer_api_ssl_port],
service_network => $ceilometer_network,
member_options => union($haproxy_member_options, $internal_tls_member_options),
@@ -917,12 +953,29 @@ class tripleo::haproxy (
service_port => $ports[aodh_api_port],
ip_addresses => hiera('aodh_api_node_ips', $controller_hosts_real),
server_names => hiera('aodh_api_node_names', $controller_hosts_names_real),
+ listen_options => {
+ 'http-request' => [
+ 'set-header X-Forwarded-Proto https if { ssl_fc }',
+ 'set-header X-Forwarded-Proto http if !{ ssl_fc }'],
+ },
public_ssl_port => $ports[aodh_api_ssl_port],
service_network => $aodh_network,
member_options => union($haproxy_member_options, $internal_tls_member_options),
}
}
+ if $barbican {
+ ::tripleo::haproxy::endpoint { 'barbican':
+ public_virtual_ip => $public_virtual_ip,
+ internal_ip => hiera('barbican_api_vip', $controller_virtual_ip),
+ service_port => $ports[barbican_api_port],
+ ip_addresses => hiera('barbican_api_node_ips', $controller_hosts_real),
+ server_names => hiera('aodh_api_node_names', $controller_hosts_names_real),
+ public_ssl_port => $ports[barbican_api_ssl_port],
+ service_network => $barbican_network
+ }
+ }
+
if $gnocchi {
::tripleo::haproxy::endpoint { 'gnocchi':
public_virtual_ip => $public_virtual_ip,
@@ -930,8 +983,14 @@ class tripleo::haproxy (
service_port => $ports[gnocchi_api_port],
ip_addresses => hiera('gnocchi_api_node_ips', $controller_hosts_real),
server_names => hiera('gnocchi_api_node_names', $controller_hosts_names_real),
+ listen_options => {
+ 'http-request' => [
+ 'set-header X-Forwarded-Proto https if { ssl_fc }',
+ 'set-header X-Forwarded-Proto http if !{ ssl_fc }'],
+ },
public_ssl_port => $ports[gnocchi_api_ssl_port],
service_network => $gnocchi_network,
+ member_options => union($haproxy_member_options, $internal_tls_member_options),
}
}
@@ -1069,13 +1128,21 @@ class tripleo::haproxy (
'stick-table' => 'type ip size 1000',
'stick' => 'on dst',
}
- $mysql_member_options = union($haproxy_member_options, ['backup', 'port 9200', 'on-marked-down shutdown-sessions'])
+ if $mysql_member_options {
+ $mysql_member_options_real = $mysql_member_options
+ } else {
+ $mysql_member_options_real = ['backup', 'port 9200', 'on-marked-down shutdown-sessions', 'check', 'inter 1s']
+ }
} else {
$mysql_listen_options = {
'timeout client' => '90m',
'timeout server' => '90m',
}
- $mysql_member_options = union($haproxy_member_options, ['backup'])
+ if $mysql_member_options {
+ $mysql_member_options_real = $mysql_member_options
+ } else {
+ $mysql_member_options_real = union($haproxy_member_options, ['backup'])
+ }
}
if $mysql {
@@ -1089,7 +1156,7 @@ class tripleo::haproxy (
ports => '3306',
ipaddresses => hiera('mysql_node_ips', $controller_hosts_real),
server_names => hiera('mysql_node_names', $controller_hosts_names_real),
- options => $mysql_member_options,
+ options => $mysql_member_options_real,
}
}
@@ -1198,8 +1265,8 @@ class tripleo::haproxy (
$opendaylight_api_vip = hiera('opendaylight_api_vip', $controller_virtual_ip)
$opendaylight_bind_opts = {
- "${opendaylight_api_vip}:8081" => [],
- "${public_virtual_ip}:8081" => [],
+ "${opendaylight_api_vip}:8081" => $haproxy_listen_bind_param,
+ "${public_virtual_ip}:8081" => $haproxy_listen_bind_param,
}
if $opendaylight {