diff options
Diffstat (limited to 'manifests/profile/base')
| -rw-r--r-- | manifests/profile/base/auditd.pp | 30 | ||||
| -rw-r--r-- | manifests/profile/base/congress.pp | 86 | ||||
| -rw-r--r-- | manifests/profile/base/database/mysql.pp | 3 | ||||
| -rw-r--r-- | manifests/profile/base/docker_registry.pp | 17 | ||||
| -rw-r--r-- | manifests/profile/base/horizon.pp | 2 | ||||
| -rw-r--r-- | manifests/profile/base/keystone.pp | 3 | ||||
| -rw-r--r-- | manifests/profile/base/neutron/server.pp | 99 | ||||
| -rw-r--r-- | manifests/profile/base/nova/api.pp | 21 | ||||
| -rw-r--r-- | manifests/profile/base/octavia/health_manager.pp | 33 | ||||
| -rw-r--r-- | manifests/profile/base/octavia/housekeeping.pp | 34 | ||||
| -rw-r--r-- | manifests/profile/base/octavia/worker.pp | 34 | ||||
| -rw-r--r-- | manifests/profile/base/swift/proxy.pp | 78 |
12 files changed, 374 insertions, 66 deletions
diff --git a/manifests/profile/base/auditd.pp b/manifests/profile/base/auditd.pp new file mode 100644 index 0000000..628db08 --- /dev/null +++ b/manifests/profile/base/auditd.pp @@ -0,0 +1,30 @@ +# Copyright 2016 Red Hat, Inc. +# +# Licensed under the Apache License, Version 2.0 (the "License"); you may +# not use this file except in compliance with the License. You may obtain +# a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT +# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the +# License for the specific language governing permissions and limitations +# under the License. +# +# == class: tripleo::profile::base::auditd +# +# auditd profile for tripleo +# +# === Parameters +# +# [*step*] +# Defaults to hiera('step') +# +class tripleo::profile::base::auditd ( + $step = hiera('step'), +) { + if $step >= 4 { + include ::auditd + } +} diff --git a/manifests/profile/base/congress.pp b/manifests/profile/base/congress.pp new file mode 100644 index 0000000..1731e81 --- /dev/null +++ b/manifests/profile/base/congress.pp @@ -0,0 +1,86 @@ +# Copyright 2016 Red Hat, Inc. +# +# Licensed under the Apache License, Version 2.0 (the "License"); you may +# not use this file except in compliance with the License. You may obtain +# a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT +# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the +# License for the specific language governing permissions and limitations +# under the License. +# +# == Class: tripleo::profile::base::congress +# +# Congress server profile for tripleo +# +# === Parameters +# +# [*bootstrap_node*] +# (Optional) The hostname of the node responsible for bootstrapping tasks +# Defaults to hiera('bootstrap_nodeid') +# +# [*messaging_driver*] +# Driver for messaging service. +# Defaults to hiera('messaging_service_name', 'rabbit') +# +# [*messaging_hosts*] +# list of the messaging host fqdns +# Defaults to hiera('rabbitmq_node_names') +# +# [*messaging_password*] +# Password for messaging congress queue +# Defaults to hiera('congress::rabbit_password') +# +# [*messaging_port*] +# IP port for messaging service +# Defaults to hiera('congress::rabbit_port', 5672) +# +# [*messaging_username*] +# Username for messaging congress queue +# Defaults to hiera('congress::rabbit_userid', 'guest') +# +# [*messaging_use_ssl*] +# Flag indicating ssl usage. +# Defaults to hiera('congress::rabbit_use_ssl', '0') +# +# [*step*] +# (Optional) The current step of the deployment +# Defaults to hiera('step') + +class tripleo::profile::base::congress ( + $bootstrap_node = hiera('bootstrap_nodeid', undef), + $messaging_driver = hiera('messaging_service_name', 'rabbit'), + $messaging_hosts = any2array(hiera('rabbitmq_node_names', undef)), + $messaging_password = hiera('congress::rabbit_password'), + $messaging_port = hiera('congress::rabbit_port', '5672'), + $messaging_username = hiera('congress::rabbit_userid', 'guest'), + $messaging_use_ssl = hiera('congress::rabbit_use_ssl', '0'), + $step = hiera('step'), +) { + if $::hostname == downcase($bootstrap_node) { + $sync_db = true + } else { + $sync_db = false + } + + if $step >= 4 or ($step >= 3 and $sync_db){ + $messaging_use_ssl_real = sprintf('%s', bool2num(str2bool($messaging_use_ssl))) + class { '::congress': + sync_db => $sync_db, + default_transport_url => os_transport_url({ + 'transport' => $messaging_driver, + 'hosts' => $messaging_hosts, + 'port' => sprintf('%s', $messaging_port), + 'username' => $messaging_username, + 'password' => $messaging_password, + 'ssl' => $messaging_use_ssl_real, + }), + } + + include ::congress::server + include ::congress::db + } +} diff --git a/manifests/profile/base/database/mysql.pp b/manifests/profile/base/database/mysql.pp index 6f93903..4ccfabc 100644 --- a/manifests/profile/base/database/mysql.pp +++ b/manifests/profile/base/database/mysql.pp @@ -151,6 +151,9 @@ class tripleo::profile::base::database::mysql ( if hiera('cinder_api_enabled', false) { include ::cinder::db::mysql } + if hiera('congress_enabled', false) { + include ::congress::db::mysql + } if hiera('glance_api_enabled', false) { include ::glance::db::mysql } diff --git a/manifests/profile/base/docker_registry.pp b/manifests/profile/base/docker_registry.pp index 05a516d..ebe84bf 100644 --- a/manifests/profile/base/docker_registry.pp +++ b/manifests/profile/base/docker_registry.pp @@ -19,21 +19,22 @@ # === Parameters: # # [*registry_host*] -# (String) IP address on which the Docker registry is listening on +# (String) IP address or hostname the Docker registry binds to # Defaults to hiera('controller_host') # # [*registry_port*] # (Integer) The port on which the Docker registry is listening on # Defaults to 8787 # -# [*controller_admin_vip*] -# (String) VIP of the host -# Defaults to hiera('controller_admin_vip') +# [*registry_admin_host*] +# (String) IP address or hostname the Docker registry binds to in the admin +# network +# Defaults to hiera('controller_admin_host') # class tripleo::profile::base::docker_registry ( - $registry_host = hiera('controller_host'), - $registry_port = 8787, - $controller_admin_vip = hiera('controller_admin_vip'), + $registry_host = hiera('controller_host'), + $registry_port = 8787, + $registry_admin_host = hiera('controller_admin_host'), ) { # We want a v2 registry package{'docker-registry': @@ -55,7 +56,7 @@ class tripleo::profile::base::docker_registry ( line => join ([ 'INSECURE_REGISTRY="', '--insecure-registry ', $registry_host, ':', $registry_port, ' ', - '--insecure-registry ', $controller_admin_vip, ':', $registry_port, '"']), + '--insecure-registry ', $registry_admin_host, ':', $registry_port, '"']), match => 'INSECURE_REGISTRY=', require => Package['docker'], notify => Service['docker'], diff --git a/manifests/profile/base/horizon.pp b/manifests/profile/base/horizon.pp index be07c0e..bd28ab0 100644 --- a/manifests/profile/base/horizon.pp +++ b/manifests/profile/base/horizon.pp @@ -30,7 +30,7 @@ class tripleo::profile::base::horizon ( # Horizon include ::apache::mod::remoteip include ::apache::mod::status - if 'cisco_n1kv' in hiera('neutron::plugins::ml2::mechanism_drivers') { + if 'cisco_n1kv' in hiera('neutron::plugins::ml2::mechanism_drivers', undef) { $_profile_support = 'cisco' } else { $_profile_support = 'None' diff --git a/manifests/profile/base/keystone.pp b/manifests/profile/base/keystone.pp index e84e22f..72049e3 100644 --- a/manifests/profile/base/keystone.pp +++ b/manifests/profile/base/keystone.pp @@ -209,6 +209,9 @@ class tripleo::profile::base::keystone ( if hiera('cinder_api_enabled', false) { include ::cinder::keystone::auth } + if hiera('congress_enabled', false) { + include ::congress::keystone::auth + } if hiera('glance_api_enabled', false) { include ::glance::keystone::auth } diff --git a/manifests/profile/base/neutron/server.pp b/manifests/profile/base/neutron/server.pp index fcd804d..5d6909f 100644 --- a/manifests/profile/base/neutron/server.pp +++ b/manifests/profile/base/neutron/server.pp @@ -22,10 +22,34 @@ # (Optional) The hostname of the node responsible for bootstrapping tasks # Defaults to hiera('bootstrap_nodeid') # -# [*step*] -# (Optional) The current step in deployment. See tripleo-heat-templates -# for more details. -# Defaults to hiera('step') +# [*certificates_specs*] +# (Optional) The specifications to give to certmonger for the certificate(s) +# it will create. +# Example with hiera: +# apache_certificates_specs: +# httpd-internal_api: +# hostname: <overcloud controller fqdn> +# service_certificate: <service certificate path> +# service_key: <service key path> +# principal: "haproxy/<overcloud controller fqdn>" +# Defaults to hiera('apache_certificate_specs', {}). +# +# [*dvr_enabled*] +# (Optional) Is dvr enabled, used when no override is passed to +# l3_ha_override to calculate enabling l3 HA. +# Defaults to hiera('neutron::server::router_distributed') or false +# +# [*enable_internal_tls*] +# (Optional) Whether TLS in the internal network is enabled or not. +# Defaults to hiera('enable_internal_tls', false) +# +# [*generate_service_certificates*] +# (Optional) Whether or not certmonger will generate certificates for +# HAProxy. This could be as many as specified by the $certificates_specs +# variable. +# Note that this doesn't configure the certificates in haproxy, it merely +# creates the certificates. +# Defaults to hiera('generate_service_certificate', false). # # [*l3_ha_override*] # (Optional) Override the calculated value for neutron::server::l3_ha @@ -41,17 +65,49 @@ # (we need to default neutron_l3_short_node_names to an empty list # because some neutron backends disable the l3 agent) # -# [*dvr_enabled*] -# (Optional) Is dvr enabled, used when no override is passed to -# l3_ha_override to calculate enabling l3 HA. -# Defaults to hiera('neutron::server::router_distributed') or false +# [*neutron_network*] +# (Optional) The network name where the neutron endpoint is listening on. +# This is set by t-h-t. +# Defaults to hiera('neutron_api_network', undef) +# +# [*step*] +# (Optional) The current step in deployment. See tripleo-heat-templates +# for more details. +# Defaults to hiera('step') +# +# [*tls_proxy_bind_ip*] +# IP on which the TLS proxy will listen on. Required only if +# enable_internal_tls is set. +# Defaults to undef +# +# [*tls_proxy_fqdn*] +# fqdn on which the tls proxy will listen on. required only used if +# enable_internal_tls is set. +# defaults to undef +# +# [*tls_proxy_port*] +# port on which the tls proxy will listen on. Only used if +# enable_internal_tls is set. +# defaults to 9696 +# class tripleo::profile::base::neutron::server ( - $bootstrap_node = hiera('bootstrap_nodeid', undef), - $step = hiera('step'), - $l3_ha_override = '', - $l3_nodes = hiera('neutron_l3_short_node_names', []), - $dvr_enabled = hiera('neutron::server::router_distributed', false) + $bootstrap_node = hiera('bootstrap_nodeid', undef), + $certificates_specs = hiera('apache_certificates_specs', {}), + $dvr_enabled = hiera('neutron::server::router_distributed', false), + $enable_internal_tls = hiera('enable_internal_tls', false), + $generate_service_certificates = hiera('generate_service_certificates', false), + $l3_ha_override = '', + $l3_nodes = hiera('neutron_l3_short_node_names', []), + $neutron_network = hiera('neutron_api_network', undef), + $step = hiera('step'), + $tls_proxy_bind_ip = undef, + $tls_proxy_fqdn = undef, + $tls_proxy_port = 9696, ) { + if $enable_internal_tls and $generate_service_certificates { + ensure_resources('tripleo::certmonger::httpd', $certificates_specs) + } + if $::hostname == downcase($bootstrap_node) { $sync_db = true } else { @@ -74,6 +130,23 @@ class tripleo::profile::base::neutron::server ( # it will try to populate tables and we need to make sure this happens # before it starts on other nodes if $step >= 4 and $sync_db or $step >= 5 and !$sync_db { + if $enable_internal_tls { + if !$neutron_network { + fail('neutron_api_network is not set in the hieradata.') + } + $tls_certfile = $certificates_specs["httpd-${neutron_network}"]['service_certificate'] + $tls_keyfile = $certificates_specs["httpd-${neutron_network}"]['service_key'] + + ::tripleo::tls_proxy { 'neutron-api': + servername => $tls_proxy_fqdn, + ip => $tls_proxy_bind_ip, + port => $tls_proxy_port, + tls_cert => $tls_certfile, + tls_key => $tls_keyfile, + notify => Class['::neutron::server'], + } + } + include ::neutron::server::notifications # We need to override the hiera value neutron::server::sync_db which is set # to true diff --git a/manifests/profile/base/nova/api.pp b/manifests/profile/base/nova/api.pp index 8ded3ef..83baae2 100644 --- a/manifests/profile/base/nova/api.pp +++ b/manifests/profile/base/nova/api.pp @@ -85,25 +85,8 @@ class tripleo::profile::base::nova::api ( $tls_keyfile = undef } - if ($step >= 3 and $sync_db) { - $messaging_hosts_real = any2array($::tripleo::profile::base::nova::messaging_hosts) - # TODO(aschultz): remove sprintf once we properly type the port, needs - # to be a string for the os_transport_url function. - $messaging_port_real = sprintf('%s', $::tripleo::profile::base::nova::messaging_port) - $messaging_use_ssl_real = sprintf('%s', bool2num(str2bool($::tripleo::profile::base::nova::messaging_use_ssl))) - - #TODO(emilien): enable it again when it's fixed upstream in nova - # https://bugs.launchpad.net/tripleo/+bug/1649341 - # class { '::nova::db::sync_cell_v2': - # transport_url => os_transport_url({ - # 'transport' => $::tripleo::profile::base::nova::messaging_driver, - # 'hosts' => $messaging_hosts_real, - # 'port' => $messaging_port_real, - # 'username' => $::tripleo::profile::base::nova::messaging_username, - # 'password' => $::tripleo::profile::base::nova::messaging_password, - # 'ssl' => $messaging_use_ssl_real, - # }), - # } + if $step >= 3 and $sync_db { + include ::nova::cell_v2::simple_setup } if $step >= 4 or ($step >= 3 and $sync_db) { diff --git a/manifests/profile/base/octavia/health_manager.pp b/manifests/profile/base/octavia/health_manager.pp new file mode 100644 index 0000000..bac5f65 --- /dev/null +++ b/manifests/profile/base/octavia/health_manager.pp @@ -0,0 +1,33 @@ +# Copyright 2016 Red Hat, Inc. +# +# Licensed under the Apache License, Version 2.0 (the "License"); you may +# not use this file except in compliance with the License. You may obtain +# a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT +# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the +# License for the specific language governing permissions and limitations +# under the License. +# +# == Class: tripleo::profile::base::octavia::health_manager +# +# Octavia Health Manager server for tripleo +# +# === Parameters +# +# [*step*] +# (Optional) The current step in deployment. See tripleo-heat-templates +# for more details. +# Defaults to hiera('step') +# +class tripleo::profile::base::octavia::health_manager ( + $step = hiera('step'), +) { + include ::tripleo::profile::base::octavia + if $step >= 5 { + include ::octavia::health_manager + } +} diff --git a/manifests/profile/base/octavia/housekeeping.pp b/manifests/profile/base/octavia/housekeeping.pp new file mode 100644 index 0000000..0dcd5cf --- /dev/null +++ b/manifests/profile/base/octavia/housekeeping.pp @@ -0,0 +1,34 @@ +# Copyright 2016 Red Hat, Inc. +# +# Licensed under the Apache License, Version 2.0 (the "License"); you may +# not use this file except in compliance with the License. You may obtain +# a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT +# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the +# License for the specific language governing permissions and limitations +# under the License. +# +# == Class: tripleo::profile::base::octavia::housekeeping +# +# Octavia Housekeeping profile for tripleo +# +# === Parameters +# +# [*step*] +# (Optional) The current step in deployment. See tripleo-heat-templates +# for more details. +# Defaults to hiera('step') +# +class tripleo::profile::base::octavia::housekeeping ( + $step = hiera('step'), +) { + include ::tripleo::profile::base::octavia + + if $step >= 5 { + include ::octavia::housekeeping + } +} diff --git a/manifests/profile/base/octavia/worker.pp b/manifests/profile/base/octavia/worker.pp new file mode 100644 index 0000000..7df324d --- /dev/null +++ b/manifests/profile/base/octavia/worker.pp @@ -0,0 +1,34 @@ +# Copyright 2016 Red Hat, Inc. +# +# Licensed under the Apache License, Version 2.0 (the "License"); you may +# not use this file except in compliance with the License. You may obtain +# a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT +# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the +# License for the specific language governing permissions and limitations +# under the License. +# +# == Class: tripleo::profile::base::octavia::worker +# +# Octavia Worker profile for tripleo +# +# === Parameters +# +# [*step*] +# (Optional) The current step in deployment. See tripleo-heat-templates +# for more details. +# Defaults to hiera('step') +# +class tripleo::profile::base::octavia::worker ( + $step = hiera('step'), +) { + include ::tripleo::profile::base::octavia + + if $step >= 5 { + include ::octavia::worker + } +} diff --git a/manifests/profile/base/swift/proxy.pp b/manifests/profile/base/swift/proxy.pp index 5bd75bd..5f3408d 100644 --- a/manifests/profile/base/swift/proxy.pp +++ b/manifests/profile/base/swift/proxy.pp @@ -18,38 +18,58 @@ # # === Parameters # -# [*step*] -# (Optional) The current step in deployment. See tripleo-heat-templates -# for more details. -# Defaults to hiera('step') +# [*ceilometer_enabled*] +# Whether the ceilometer pipeline is enabled. +# Defaults to true # -# [*memcache_servers*] -# (Optional) List of memcache servers -# Defaults to hiera('memcached_node_ips') +# [*ceilometer_messaging_driver*] +# Driver for messaging service. +# Defaults to hiera('messaging_service_name', 'rabbit') +# +# [*ceilometer_messaging_hosts*] +# list of the messaging host fqdns +# Defaults to hiera('rabbitmq_node_names') +# +# [*ceilometer_messaging_password*] +# Password for messaging nova queue +# Defaults to hiera('swift::proxy::ceilometer::rabbit_password', undef) +# +# [*ceilometer_messaging_port*] +# IP port for messaging service +# Defaults to hiera('tripleo::profile::base::swift::proxy::rabbit_port', 5672) +# +# [*ceilometer_messaging_use_ssl*] +# Flag indicating ssl usage. +# Defaults to '0' +# +# [*ceilometer_messaging_username*] +# Username for messaging nova queue +# Defaults to hiera('swift::proxy::ceilometer::rabbit_user', 'guest') # # [*memcache_port*] # (Optional) memcache port # Defaults to 11211 # -# [*rabbit_hosts*] -# list of the rabbbit host fqdns -# Defaults to hiera('rabbitmq_node_names') -# -# [*rabbit_port*] -# IP port for rabbitmq service -# Defaults to 5672 +# [*memcache_servers*] +# (Optional) List of memcache servers +# Defaults to hiera('memcached_node_ips') # -# [*ceilometer_enabled*] -# Whether the ceilometer pipeline is enabled. -# Defaults to true +# [*step*] +# (Optional) The current step in deployment. See tripleo-heat-templates +# for more details. +# Defaults to hiera('step') # class tripleo::profile::base::swift::proxy ( - $step = hiera('step'), - $memcache_servers = hiera('memcached_node_ips'), - $memcache_port = 11211, - $rabbit_hosts = hiera('rabbitmq_node_names', undef), - $rabbit_port = 5672, - $ceilometer_enabled = true, + $ceilometer_enabled = true, + $ceilometer_messaging_driver = hiera('messaging_service_name', 'rabbit'), + $ceilometer_messaging_hosts = any2array(hiera('rabbitmq_node_names', undef)), + $ceilometer_messaging_password = hiera('swift::proxy::ceilometer::rabbit_password', undef), + $ceilometer_messaging_port = hiera('tripleo::profile::base::swift::proxy::rabbit_port', '5672'), + $ceilometer_messaging_use_ssl = '0', + $ceilometer_messaging_username = hiera('swift::proxy::ceilometer::rabbit_user', 'guest'), + $memcache_port = 11211, + $memcache_servers = hiera('memcached_node_ips'), + $step = hiera('step'), ) { if $step >= 4 { $swift_memcache_servers = suffix(any2array(normalize_ip_for_uri($memcache_servers)), ":${memcache_port}") @@ -68,10 +88,17 @@ class tripleo::profile::base::swift::proxy ( include ::swift::proxy::tempurl include ::swift::proxy::formpost include ::swift::proxy::bulk - $swift_rabbit_hosts = suffix(any2array($rabbit_hosts), ":${rabbit_port}") + $ceilometer_messaging_use_ssl_real = sprintf('%s', bool2num(str2bool($ceilometer_messaging_use_ssl))) if $ceilometer_enabled { class { '::swift::proxy::ceilometer': - rabbit_hosts => $swift_rabbit_hosts, + default_transport_url => os_transport_url({ + 'transport' => $ceilometer_messaging_driver, + 'hosts' => $ceilometer_messaging_hosts, + 'port' => sprintf('%s', $ceilometer_messaging_port), + 'username' => $ceilometer_messaging_username, + 'password' => $ceilometer_messaging_password, + 'ssl' => $ceilometer_messaging_use_ssl_real, + }), } } include ::swift::proxy::versioned_writes @@ -82,6 +109,7 @@ class tripleo::profile::base::swift::proxy ( include ::swift::proxy::account_quotas class { '::swift::objectexpirer': + pipeline => ['catch_errors', 'cache', 'proxy-server'], memcache_servers => $swift_memcache_servers } } |