diff options
Diffstat (limited to 'manifests/profile/base/glance')
-rw-r--r-- | manifests/profile/base/glance/api.pp | 91 | ||||
-rw-r--r-- | manifests/profile/base/glance/registry.pp | 50 |
2 files changed, 84 insertions, 57 deletions
diff --git a/manifests/profile/base/glance/api.pp b/manifests/profile/base/glance/api.pp index 8945fff..e5807f6 100644 --- a/manifests/profile/base/glance/api.pp +++ b/manifests/profile/base/glance/api.pp @@ -22,10 +22,39 @@ # (Optional) The hostname of the node responsible for bootstrapping tasks # Defaults to hiera('bootstrap_nodeid') # +# [*certificates_specs*] +# (Optional) The specifications to give to certmonger for the certificate(s) +# it will create. +# Example with hiera: +# apache_certificates_specs: +# httpd-internal_api: +# hostname: <overcloud controller fqdn> +# service_certificate: <service certificate path> +# service_key: <service key path> +# principal: "haproxy/<overcloud controller fqdn>" +# Defaults to hiera('apache_certificate_specs', {}). +# +# [*enable_internal_tls*] +# (Optional) Whether TLS in the internal network is enabled or not. +# Defaults to hiera('enable_internal_tls', false) +# +# [*generate_service_certificates*] +# (Optional) Whether or not certmonger will generate certificates for +# HAProxy. This could be as many as specified by the $certificates_specs +# variable. +# Note that this doesn't configure the certificates in haproxy, it merely +# creates the certificates. +# Defaults to hiera('generate_service_certificate', false). +# # [*glance_backend*] # (Optional) Glance backend(s) to use. # Defaults to downcase(hiera('glance_backend', 'swift')) # +# [*glance_network*] +# (Optional) The network name where the glance endpoint is listening on. +# This is set by t-h-t. +# Defaults to hiera('glance_api_network', undef) +# # [*glance_nfs_enabled*] # (Optional) Whether to use NFS mount as 'file' backend storage location. # Defaults to false @@ -42,15 +71,40 @@ # [*rabbit_port*] # IP port for rabbitmq service # Defaults to hiera('glance::notify::rabbitmq::rabbit_port', 5672) - +# +# [*tls_proxy_bind_ip*] +# IP on which the TLS proxy will listen on. Required only if +# enable_internal_tls is set. +# Defaults to undef +# +# [*tls_proxy_fqdn*] +# fqdn on which the tls proxy will listen on. required only used if +# enable_internal_tls is set. +# defaults to undef +# +# [*tls_proxy_port*] +# port on which the tls proxy will listen on. Only used if +# enable_internal_tls is set. +# defaults to 9292 +# class tripleo::profile::base::glance::api ( - $bootstrap_node = hiera('bootstrap_nodeid', undef), - $glance_backend = downcase(hiera('glance_backend', 'swift')), - $glance_nfs_enabled = false, - $step = hiera('step'), - $rabbit_hosts = hiera('rabbitmq_node_names', undef), - $rabbit_port = hiera('glance::notify::rabbitmq::rabbit_port', 5672), + $bootstrap_node = hiera('bootstrap_nodeid', undef), + $certificates_specs = hiera('apache_certificates_specs', {}), + $enable_internal_tls = hiera('enable_internal_tls', false), + $generate_service_certificates = hiera('generate_service_certificates', false), + $glance_backend = downcase(hiera('glance_backend', 'swift')), + $glance_network = hiera('glance_api_network', undef), + $glance_nfs_enabled = false, + $step = hiera('step'), + $rabbit_hosts = hiera('rabbitmq_node_names', undef), + $rabbit_port = hiera('glance::notify::rabbitmq::rabbit_port', 5672), + $tls_proxy_bind_ip = undef, + $tls_proxy_fqdn = undef, + $tls_proxy_port = 9292, ) { + if $enable_internal_tls and $generate_service_certificates { + ensure_resources('tripleo::certmonger::httpd', $certificates_specs) + } if $::hostname == downcase($bootstrap_node) { $sync_db = true @@ -63,6 +117,28 @@ class tripleo::profile::base::glance::api ( } if $step >= 4 or ($step >= 3 and $sync_db) { + if $enable_internal_tls { + if !$glance_network { + fail('glance_api_network is not set in the hieradata.') + } + if !$tls_proxy_bind_ip { + fail('glance_api_tls_proxy_bind_ip is not set in the hieradata.') + } + if !$tls_proxy_fqdn { + fail('tls_proxy_fqdn is required if internal TLS is enabled.') + } + $tls_certfile = $certificates_specs["httpd-${glance_network}"]['service_certificate'] + $tls_keyfile = $certificates_specs["httpd-${glance_network}"]['service_key'] + + ::tripleo::tls_proxy { 'glance-api': + servername => $tls_proxy_fqdn, + ip => $tls_proxy_bind_ip, + port => $tls_proxy_port, + tls_cert => $tls_certfile, + tls_key => $tls_keyfile, + notify => Class['::glance::api'], + } + } case $glance_backend { 'swift': { $backend_store = 'glance.store.swift.Store' } 'file': { $backend_store = 'glance.store.filesystem.Store' } @@ -75,6 +151,7 @@ class tripleo::profile::base::glance::api ( # TODO: notifications, scrubber, etc. include ::glance include ::glance::config + # TODO(jaosorior): Remove bind_host when we set it up conditionally in t-h-t class { '::glance::api': stores => $glance_store, sync_db => $sync_db, diff --git a/manifests/profile/base/glance/registry.pp b/manifests/profile/base/glance/registry.pp deleted file mode 100644 index cd40aeb..0000000 --- a/manifests/profile/base/glance/registry.pp +++ /dev/null @@ -1,50 +0,0 @@ -# Copyright 2016 Red Hat, Inc. -# -# Licensed under the Apache License, Version 2.0 (the "License"); you may -# not use this file except in compliance with the License. You may obtain -# a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT -# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the -# License for the specific language governing permissions and limitations -# under the License. -# -# == Class: tripleo::profile::base::glance::registry -# -# Glance Registry profile for tripleo -# -# === Parameters -# -# [*bootstrap_node*] -# DEPRECATED -# (Optional) The hostname of the node responsible for bootstrapping tasks -# Defaults to hiera('bootstrap_nodeid') -# -# [*glance_backend*] -# (Optional) Glance backend(s) to use. -# Defaults to downcase(hiera('glance_backend', 'swift')) -# -# [*step*] -# (Optional) The current step in deployment. See tripleo-heat-templates -# for more details. -# Defaults to hiera('step') -# -class tripleo::profile::base::glance::registry ( - $bootstrap_node = undef, - $glance_backend = downcase(hiera('glance_backend', 'swift')), - $step = hiera('step'), -) { - - if $step >= 4 { - # TODO: notifications, scrubber, etc. - include ::glance - include ::glance::config - include ::glance::registry - include ::glance::notify::rabbitmq - include join(['::glance::backend::', $glance_backend]) - } - -} |