summaryrefslogtreecommitdiffstats
path: root/manifests/profile/base
diff options
context:
space:
mode:
Diffstat (limited to 'manifests/profile/base')
-rw-r--r--manifests/profile/base/certmonger_user.pp10
-rw-r--r--manifests/profile/base/docker.pp59
-rw-r--r--manifests/profile/base/novajoin.pp83
3 files changed, 152 insertions, 0 deletions
diff --git a/manifests/profile/base/certmonger_user.pp b/manifests/profile/base/certmonger_user.pp
index 4ba51ec..7a6559e 100644
--- a/manifests/profile/base/certmonger_user.pp
+++ b/manifests/profile/base/certmonger_user.pp
@@ -77,6 +77,16 @@ class tripleo::profile::base::certmonger_user (
$rabbitmq_certificate_specs = hiera('tripleo::profile::base::rabbitmq::certificate_specs', {}),
$etcd_certificate_specs = hiera('tripleo::profile::base::etcd::certificate_specs', {}),
) {
+ unless empty($haproxy_certificates_specs) {
+ $reload_haproxy = ['systemctl reload haproxy']
+ Class['::tripleo::certmonger::ca::crl'] ~> Haproxy::Balancermember<||>
+ Class['::tripleo::certmonger::ca::crl'] ~> Class['::haproxy']
+ } else {
+ $reload_haproxy = []
+ }
+ class { '::tripleo::certmonger::ca::crl' :
+ reload_cmds => $reload_haproxy,
+ }
include ::tripleo::certmonger::ca::libvirt
unless empty($apache_certificates_specs) {
diff --git a/manifests/profile/base/docker.pp b/manifests/profile/base/docker.pp
index 29f8b75..67fbd71 100644
--- a/manifests/profile/base/docker.pp
+++ b/manifests/profile/base/docker.pp
@@ -47,6 +47,18 @@
# [*step*]
# step defaults to hiera('step')
#
+# [*configure_libvirt_polkit*]
+# Configures libvirt polkit to grant the kolla nova user access to the libvirtd unix domain socket on the host.
+# Defaults to true when nova_compute service is enabled, false when nova_compute is disabled
+#
+# [*docker_nova_uid*]
+# When configure_libvirt_polkit = true, the uid/gid of the nova user within the docker container.
+# Defaults to 42436
+#
+# [*services_enabled*]
+# List of TripleO services enabled on the role.
+# Defaults to hiera('services_names')
+#
class tripleo::profile::base::docker (
$docker_namespace = undef,
$insecure_registry = false,
@@ -55,7 +67,17 @@ class tripleo::profile::base::docker (
$configure_storage = true,
$storage_options = '-s overlay2',
$step = hiera('step'),
+ $configure_libvirt_polkit = undef,
+ $docker_nova_uid = 42436,
+ $services_enabled = hiera('service_names', [])
) {
+
+ if $configure_libvirt_polkit == undef {
+ $configure_libvirt_polkit_real = 'nova_compute' in $services_enabled
+ } else {
+ $configure_libvirt_polkit_real = $configure_libvirt_polkit
+ }
+
if $step >= 1 {
package {'docker':
ensure => installed,
@@ -130,4 +152,41 @@ class tripleo::profile::base::docker (
}
}
+ if ($step >= 4 and $configure_libvirt_polkit_real) {
+ # Workaround for polkit authorization for libvirtd socket on host
+ #
+ # This creates a local user with the kolla nova uid, and sets the polkit rule to
+ # allow both it and the nova user from the nova rpms, should it exist (uid 162).
+
+ group { 'docker_nova_group':
+ name => 'docker_nova',
+ gid => $docker_nova_uid
+ } ->
+ user { 'docker_nova_user':
+ name => 'docker_nova',
+ uid => $docker_nova_uid,
+ gid => $docker_nova_uid,
+ shell => '/sbin/nologin',
+ comment => 'OpenStack Nova Daemons',
+ groups => ['nobody']
+ }
+
+ # Similar to the polkit rule in the openstack-nova rpm spec
+ # but allow both the 'docker_nova' and 'nova' user
+ $docker_nova_polkit_rule = '// openstack-nova libvirt management permissions
+polkit.addRule(function(action, subject) {
+ if (action.id == "org.libvirt.unix.manage" &&
+ /^(docker_)?nova$/.test(subject.user)) {
+ return polkit.Result.YES;
+ }
+});
+'
+ package {'polkit':
+ ensure => installed,
+ } ->
+ file {'/etc/polkit-1/rules.d/50-nova.rules':
+ content => $docker_nova_polkit_rule,
+ mode => '0644'
+ }
+ }
}
diff --git a/manifests/profile/base/novajoin.pp b/manifests/profile/base/novajoin.pp
new file mode 100644
index 0000000..f9c1ea9
--- /dev/null
+++ b/manifests/profile/base/novajoin.pp
@@ -0,0 +1,83 @@
+# Copyright 2017 Red Hat, Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License. You may obtain
+# a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations
+# under the License.
+#
+# == Class: tripleo::profile::base::novajoin
+#
+# novajoin vendordata plugin profile for tripleo
+#
+# === Parameters
+#
+# [*service_password*]
+# The password for the novajoin service.
+#
+# [*enable_ipa_client_install*]
+# Enable FreeIPA client installation for the node this runs on.
+# Defaults to false
+#
+# [*oslomsg_rpc_hosts*]
+# list of the oslo messaging rpc host fqdns
+# Defaults to hiera('rabbitmq_node_names')
+#
+# [*oslomsg_rpc_proto*]
+# Protocol driver for the oslo messaging rpc service
+# Defaults to hiera('messaging_rpc_service_name', rabbit)
+#
+# [*oslomsg_rpc_password*]
+# Password for oslo messaging rpc service
+# Defaults to undef
+#
+# [*oslomsg_rpc_port*]
+# IP port for oslo messaging rpc service
+# Defaults to '5672'
+#
+# [*oslomsg_rpc_username*]
+# Username for oslo messaging rpc service
+# Defaults to 'guest'
+#
+# [*oslomsg_use_ssl*]
+# Enable ssl oslo messaging services
+# Defaults to '0'
+#
+# [*step*]
+# (Optional) The current step of the deployment
+# Defaults to hiera('step')
+#
+
+class tripleo::profile::base::novajoin (
+ $service_password,
+ $enable_ipa_client_install = false,
+ $oslomsg_rpc_hosts = any2array(hiera('rabbitmq_node_names', undef)),
+ $oslomsg_rpc_proto = hiera('messaging_rpc_service_name', 'rabbit'),
+ $oslomsg_rpc_password = undef,
+ $oslomsg_rpc_port = '5672',
+ $oslomsg_rpc_username = 'guest',
+ $oslomsg_use_ssl = '0',
+ $step = hiera('step'),
+) {
+ if $step >= 3 {
+ $oslomsg_use_ssl_real = sprintf('%s', bool2num(str2bool($oslomsg_use_ssl)))
+ class { '::nova::metadata::novajoin::api' :
+ service_password => $service_password,
+ enable_ipa_client_install => $enable_ipa_client_install,
+ transport_url => os_transport_url({
+ 'transport' => $oslomsg_rpc_proto,
+ 'hosts' => $oslomsg_rpc_hosts,
+ 'port' => sprintf('%s', $oslomsg_rpc_port),
+ 'username' => $oslomsg_rpc_username,
+ 'password' => $oslomsg_rpc_password,
+ 'ssl' => $oslomsg_use_ssl_real,
+ }),
+ }
+ }
+}