diff options
Diffstat (limited to 'manifests/profile/base')
63 files changed, 2883 insertions, 377 deletions
diff --git a/manifests/profile/base/aodh.pp b/manifests/profile/base/aodh.pp index 281e069..d6561a2 100644 --- a/manifests/profile/base/aodh.pp +++ b/manifests/profile/base/aodh.pp @@ -27,19 +27,64 @@ # (Optional) The hostname of the node responsible for bootstrapping tasks # Defaults to hiera('bootstrap_nodeid') # -# [*rabbit_hosts*] -# list of the rabbbit host IPs -# Defaults to hiera('rabbitmq_node_ips') +# [*oslomsg_rpc_proto*] +# Protocol driver for the oslo messaging rpc service +# Defaults to hiera('messaging_rpc_service_name', rabbit) # -# [*rabbit_port*] -# IP port for rabbitmq service +# [*oslomsg_rpc_hosts*] +# list of the oslo messaging rpc host fqdns +# Defaults to hiera('rabbitmq_node_names') +# +# [*oslomsg_rpc_port*] +# IP port for oslo messaging rpc service +# Defaults to hiera('aodh::rabbit_port', 5672) +# +# [*oslomsg_rpc_username*] +# Username for oslo messaging rpc service +# Defaults to hiera('aodh::rabbit_userid', 'guest') +# +# [*oslomsg_rpc_password*] +# Password for oslo messaging rpc service +# Defaults to hiera('aodh::rabbit_password') +# +# [*oslomsg_notify_proto*] +# Protocol driver for the oslo messaging notify service +# Defaults to hiera('messaging_notify_service_name', rabbit) +# +# [*oslomsg_notify_hosts*] +# list of the oslo messaging notify host fqdns +# Defaults to hiera('rabbitmq_node_names') +# +# [*oslomsg_notify_port*] +# IP port for oslo messaging notify service # Defaults to hiera('aodh::rabbit_port', 5672) +# +# [*oslomsg_notify_username*] +# Username for oslo messaging notify service +# Defaults to hiera('aodh::rabbit_userid', 'guest') +# +# [*oslomsg_notify_password*] +# Password for oslo messaging notify service +# Defaults to hiera('aodh::rabbit_password') +# +# [*oslomsg_use_ssl*] +# Enable ssl oslo messaging services +# Defaults to hiera('aodh::rabbit_use_ssl', '0') class tripleo::profile::base::aodh ( - $step = hiera('step'), - $bootstrap_node = hiera('bootstrap_nodeid', undef), - $rabbit_hosts = hiera('rabbitmq_node_ips', undef), - $rabbit_port = hiera('aodh::rabbit_port', 5672), + $step = hiera('step'), + $bootstrap_node = hiera('bootstrap_nodeid', undef), + $oslomsg_rpc_proto = hiera('messaging_rpc_service_name', 'rabbit'), + $oslomsg_rpc_hosts = any2array(hiera('rabbitmq_node_names', undef)), + $oslomsg_rpc_password = hiera('aodh::rabbit_password'), + $oslomsg_rpc_port = hiera('aodh::rabbit_port', '5672'), + $oslomsg_rpc_username = hiera('aodh::rabbit_userid', 'guest'), + $oslomsg_notify_proto = hiera('messaging_notify_service_name', 'rabbit'), + $oslomsg_notify_hosts = any2array(hiera('rabbitmq_node_names', undef)), + $oslomsg_notify_password = hiera('aodh::rabbit_password'), + $oslomsg_notify_port = hiera('aodh::rabbit_port', '5672'), + $oslomsg_notify_username = hiera('aodh::rabbit_userid', 'guest'), + $oslomsg_use_ssl = hiera('aodh::rabbit_use_ssl', '0'), ) { if $::hostname == downcase($bootstrap_node) { @@ -49,9 +94,24 @@ class tripleo::profile::base::aodh ( } if $step >= 4 or ($step >= 3 and $sync_db) { - $rabbit_endpoints = suffix(any2array(normalize_ip_for_uri($rabbit_hosts)), ":${rabbit_port}") + $oslomsg_use_ssl_real = sprintf('%s', bool2num(str2bool($oslomsg_use_ssl))) class { '::aodh' : - rabbit_hosts => $rabbit_endpoints, + default_transport_url => os_transport_url({ + 'transport' => $oslomsg_rpc_proto, + 'hosts' => $oslomsg_rpc_hosts, + 'port' => sprintf('%s', $oslomsg_rpc_port), + 'username' => $oslomsg_rpc_username, + 'password' => $oslomsg_rpc_password, + 'ssl' => $oslomsg_use_ssl_real, + }), + notification_transport_url => os_transport_url({ + 'transport' => $oslomsg_notify_proto, + 'hosts' => $oslomsg_notify_hosts, + 'port' => sprintf('%s', $oslomsg_notify_port), + 'username' => $oslomsg_notify_username, + 'password' => $oslomsg_notify_password, + 'ssl' => $oslomsg_use_ssl_real, + }), } include ::aodh::auth include ::aodh::config diff --git a/manifests/profile/base/aodh/api.pp b/manifests/profile/base/aodh/api.pp index 06dcfe5..af4a5b3 100644 --- a/manifests/profile/base/aodh/api.pp +++ b/manifests/profile/base/aodh/api.pp @@ -52,10 +52,6 @@ # for more details. # Defaults to hiera('step') # -# [*enable_combination_alarms*] -# (optional) Setting to enable combination alarms -# Defaults to: false -# class tripleo::profile::base::aodh::api ( $aodh_network = hiera('aodh_api_network', undef), @@ -63,7 +59,6 @@ class tripleo::profile::base::aodh::api ( $enable_internal_tls = hiera('enable_internal_tls', false), $generate_service_certificates = hiera('generate_service_certificates', false), $step = hiera('step'), - $enable_combination_alarms = false, ) { include ::tripleo::profile::base::aodh @@ -90,12 +85,5 @@ class tripleo::profile::base::aodh::api ( ssl_cert => $tls_certfile, ssl_key => $tls_keyfile, } - - #NOTE: Combination alarms are deprecated in newton and disabled by default. - # we need a way to override this setting for users still using this type - # of alarms. - aodh_config { - 'api/enable_combination_alarms' : value => $enable_combination_alarms; - } } } diff --git a/manifests/profile/base/auditd.pp b/manifests/profile/base/auditd.pp new file mode 100644 index 0000000..628db08 --- /dev/null +++ b/manifests/profile/base/auditd.pp @@ -0,0 +1,30 @@ +# Copyright 2016 Red Hat, Inc. +# +# Licensed under the Apache License, Version 2.0 (the "License"); you may +# not use this file except in compliance with the License. You may obtain +# a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT +# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the +# License for the specific language governing permissions and limitations +# under the License. +# +# == class: tripleo::profile::base::auditd +# +# auditd profile for tripleo +# +# === Parameters +# +# [*step*] +# Defaults to hiera('step') +# +class tripleo::profile::base::auditd ( + $step = hiera('step'), +) { + if $step >= 4 { + include ::auditd + } +} diff --git a/manifests/profile/base/barbican/api.pp b/manifests/profile/base/barbican/api.pp index b464317..64c2b62 100644 --- a/manifests/profile/base/barbican/api.pp +++ b/manifests/profile/base/barbican/api.pp @@ -56,6 +56,50 @@ # for more details. # Defaults to hiera('step') # +# [*oslomsg_rpc_proto*] +# Protocol driver for the oslo messaging rpc service +# Defaults to hiera('messaging_rpc_service_name', rabbit) +# +# [*oslomsg_rpc_hosts*] +# list of the oslo messaging rpc host fqdns +# Defaults to hiera('rabbitmq_node_names') +# +# [*oslomsg_rpc_port*] +# IP port for oslo messaging rpc service +# Defaults to hiera('barbican::api::rabbit_port', 5672) +# +# [*oslomsg_rpc_username*] +# Username for oslo messaging rpc service +# Defaults to hiera('barbican::api::rabbit_userid', 'guest') +# +# [*oslomsg_rpc_password*] +# Password for oslo messaging rpc service +# Defaults to hiera('barbican::api::rabbit_password') +# +# [*oslomsg_notify_proto*] +# Protocol driver for the oslo messaging notify service +# Defaults to hiera('messaging_notify_service_name', rabbit) +# +# [*oslomsg_notify_hosts*] +# list of the oslo messaging notify host fqdns +# Defaults to hiera('rabbitmq_node_names') +# +# [*oslomsg_notify_port*] +# IP port for oslo messaging notify service +# Defaults to hiera('barbican::api::rabbit_port', 5672) +# +# [*oslomsg_notify_username*] +# Username for oslo messaging notify service +# Defaults to hiera('barbican::api::rabbit_userid', 'guest') +# +# [*oslomsg_notify_password*] +# Password for oslo messaging notify service +# Defaults to hiera('barbican::api::rabbit_password') +# +# [*oslomsg_use_ssl*] +# Enable ssl oslo messaging services +# Defaults to hiera('barbican::api::rabbit_use_ssl', '0') + class tripleo::profile::base::barbican::api ( $barbican_network = hiera('barbican_api_network', undef), $bootstrap_node = hiera('bootstrap_nodeid', undef), @@ -63,6 +107,17 @@ class tripleo::profile::base::barbican::api ( $enable_internal_tls = hiera('enable_internal_tls', false), $generate_service_certificates = hiera('generate_service_certificates', false), $step = hiera('step'), + $oslomsg_rpc_proto = hiera('messaging_rpc_service_name', 'rabbit'), + $oslomsg_rpc_hosts = any2array(hiera('rabbitmq_node_names', undef)), + $oslomsg_rpc_password = hiera('barbican::api::rabbit_password'), + $oslomsg_rpc_port = hiera('barbican::api::rabbit_port', '5672'), + $oslomsg_rpc_username = hiera('barbican::api::rabbit_userid', 'guest'), + $oslomsg_notify_proto = hiera('messaging_notify_service_name', 'rabbit'), + $oslomsg_notify_hosts = any2array(hiera('rabbitmq_node_names', undef)), + $oslomsg_notify_password = hiera('barbican::api::rabbit_password'), + $oslomsg_notify_port = hiera('barbican::api::rabbit_port', '5672'), + $oslomsg_notify_username = hiera('barbican::api::rabbit_userid', 'guest'), + $oslomsg_use_ssl = hiera('barbican::api::rabbit_use_ssl', '0'), ) { if $::hostname == downcase($bootstrap_node) { $sync_db = true @@ -92,8 +147,25 @@ class tripleo::profile::base::barbican::api ( } if $step >= 4 or ( $step >= 3 and $sync_db ) { + $oslomsg_use_ssl_real = sprintf('%s', bool2num(str2bool($oslomsg_use_ssl))) class { '::barbican::api': - sync_db => $sync_db + sync_db => $sync_db, + default_transport_url => os_transport_url({ + 'transport' => $oslomsg_rpc_proto, + 'hosts' => $oslomsg_rpc_hosts, + 'port' => sprintf('%s', $oslomsg_rpc_port), + 'username' => $oslomsg_rpc_username, + 'password' => $oslomsg_rpc_password, + 'ssl' => $oslomsg_use_ssl_real, + }), + notification_transport_url => os_transport_url({ + 'transport' => $oslomsg_notify_proto, + 'hosts' => $oslomsg_notify_hosts, + 'port' => sprintf('%s', $oslomsg_notify_port), + 'username' => $oslomsg_notify_username, + 'password' => $oslomsg_notify_password, + 'ssl' => $oslomsg_use_ssl_real, + }), } include ::barbican::keystone::authtoken include ::barbican::api::logging diff --git a/manifests/profile/base/ceilometer.pp b/manifests/profile/base/ceilometer.pp index 392d0c7..61575d1 100644 --- a/manifests/profile/base/ceilometer.pp +++ b/manifests/profile/base/ceilometer.pp @@ -23,24 +23,84 @@ # for more details. # Defaults to hiera('step') # -# [*rabbit_hosts*] -# list of the rabbbit host IPs -# Defaults to hiera('rabbitmq_node_ips') +# [*oslomsg_rpc_proto*] +# Protocol driver for the oslo messaging rpc service +# Defaults to hiera('messaging_rpc_service_name', rabbit) # -# [*rabbit_port*] -# IP port for rabbitmq service +# [*oslomsg_rpc_hosts*] +# list of the oslo messaging rpc host fqdns +# Defaults to hiera('rabbitmq_node_names') +# +# [*oslomsg_rpc_port*] +# IP port for oslo messaging rpc service +# Defaults to hiera('ceilometer::rabbit_port', 5672) +# +# [*oslomsg_rpc_username*] +# Username for oslo messaging rpc service +# Defaults to hiera('ceilometer::rabbit_userid', 'guest') +# +# [*oslomsg_rpc_password*] +# Password for oslo messaging rpc service +# Defaults to hiera('ceilometer::rabbit_password') +# +# [*oslomsg_notify_proto*] +# Protocol driver for the oslo messaging notify service +# Defaults to hiera('messaging_notify_service_name', rabbit) +# +# [*oslomsg_notify_hosts*] +# list of the oslo messaging notify host fqdns +# Defaults to hiera('rabbitmq_node_names') +# +# [*oslomsg_notify_port*] +# IP port for oslo messaging notify service # Defaults to hiera('ceilometer::rabbit_port', 5672) +# +# [*oslomsg_notify_username*] +# Username for oslo messaging notify service +# Defaults to hiera('ceilometer::rabbit_userid', 'guest') +# +# [*oslomsg_notify_password*] +# Password for oslo messaging notify service +# Defaults to hiera('ceilometer::rabbit_password') +# +# [*oslomsg_use_ssl*] +# Enable ssl oslo messaging services +# Defaults to hiera('ceilometer::rabbit_use_ssl', '0') class tripleo::profile::base::ceilometer ( - $step = hiera('step'), - $rabbit_hosts = hiera('rabbitmq_node_ips', undef), - $rabbit_port = hiera('ceilometer::rabbit_port', 5672), + $step = hiera('step'), + $oslomsg_rpc_proto = hiera('messaging_rpc_service_name', 'rabbit'), + $oslomsg_rpc_hosts = any2array(hiera('rabbitmq_node_names', undef)), + $oslomsg_rpc_password = hiera('ceilometer::rabbit_password'), + $oslomsg_rpc_port = hiera('ceilometer::rabbit_port', '5672'), + $oslomsg_rpc_username = hiera('ceilometer::rabbit_userid', 'guest'), + $oslomsg_notify_proto = hiera('messaging_notify_service_name', 'rabbit'), + $oslomsg_notify_hosts = any2array(hiera('rabbitmq_node_names', undef)), + $oslomsg_notify_password = hiera('ceilometer::rabbit_password'), + $oslomsg_notify_port = hiera('ceilometer::rabbit_port', '5672'), + $oslomsg_notify_username = hiera('ceilometer::rabbit_userid', 'guest'), + $oslomsg_use_ssl = hiera('ceilometer::rabbit_use_ssl', '0'), ) { if $step >= 3 { - $rabbit_endpoints = suffix(any2array(normalize_ip_for_uri($rabbit_hosts)), ":${rabbit_port}") + $oslomsg_use_ssl_real = sprintf('%s', bool2num(str2bool($oslomsg_use_ssl))) class { '::ceilometer' : - rabbit_hosts => $rabbit_endpoints, + default_transport_url => os_transport_url({ + 'transport' => $oslomsg_rpc_proto, + 'hosts' => $oslomsg_rpc_hosts, + 'port' => sprintf('%s', $oslomsg_rpc_port), + 'username' => $oslomsg_rpc_username, + 'password' => $oslomsg_rpc_password, + 'ssl' => $oslomsg_use_ssl_real, + }), + notification_transport_url => os_transport_url({ + 'transport' => $oslomsg_notify_proto, + 'hosts' => $oslomsg_notify_hosts, + 'port' => sprintf('%s', $oslomsg_notify_port), + 'username' => $oslomsg_notify_username, + 'password' => $oslomsg_notify_password, + 'ssl' => $oslomsg_use_ssl_real, + }), } include ::ceilometer::config } diff --git a/manifests/profile/base/ceilometer/collector.pp b/manifests/profile/base/ceilometer/collector.pp index 3c0a361..20eab54 100644 --- a/manifests/profile/base/ceilometer/collector.pp +++ b/manifests/profile/base/ceilometer/collector.pp @@ -68,19 +68,8 @@ class tripleo::profile::base::ceilometer::collector ( if !$mongodb_replset { fail('mongodb_replset is required when using mongodb') } - # NOTE(gfidente): We need to pass the list of IPv6 addresses *with* port - # and without the brackets as 'members' argument for the 'mongodb_replset' - # resource. - if str2bool($mongodb_ipv6) { - $mongo_node_ips_with_port_prefixed = prefix($mongodb_node_ips, '[') - $mongo_node_ips_with_port = suffix($mongo_node_ips_with_port_prefixed, ']:27017') - $mongo_node_ips_with_port_nobr = suffix($mongodb_node_ips, ':27017') - } else { - $mongo_node_ips_with_port = suffix($mongodb_node_ips, ':27017') - $mongo_node_ips_with_port_nobr = suffix($mongodb_node_ips, ':27017') - } - $mongo_node_string = join($mongo_node_ips_with_port, ',') - + $mongo_nodes = suffix(any2array(normalize_ip_for_uri($mongodb_node_ips)), ':27017') + $mongo_node_string = join($mongo_nodes, ',') $ceilometer_mongodb_conn_string = "mongodb://${mongo_node_string}/ceilometer?replicaSet=${mongodb_replset}" class { '::ceilometer::db' : diff --git a/manifests/profile/base/ceph/mds.pp b/manifests/profile/base/ceph/mds.pp new file mode 100644 index 0000000..c5c7654 --- /dev/null +++ b/manifests/profile/base/ceph/mds.pp @@ -0,0 +1,35 @@ +# Copyright 2016 Red Hat, Inc. +# +# Licensed under the Apache License, Version 2.0 (the "License"); you may +# not use this file except in compliance with the License. You may obtain +# a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT +# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the +# License for the specific language governing permissions and limitations +# under the License. +# +# == Class: tripleo::profile::base::ceph::mds +# +# Ceph MDS profile for tripleo +# +# === Parameters +# +# [*step*] +# (Optional) The current step in deployment. See tripleo-heat-templates +# for more details. +# Defaults to hiera('step') +# +class tripleo::profile::base::ceph::mds ( + $step = hiera('step'), +) { + + include ::tripleo::profile::base::ceph + + if $step >= 3 { + include ::ceph::profile::mds + } +} diff --git a/manifests/profile/base/ceph/rgw.pp b/manifests/profile/base/ceph/rgw.pp index 2ecca52..8443de0 100644 --- a/manifests/profile/base/ceph/rgw.pp +++ b/manifests/profile/base/ceph/rgw.pp @@ -29,6 +29,10 @@ # [*keystone_admin_token*] # The keystone admin token # +# [*rgw_keystone_version*] The api version for keystone. +# Possible values 'v2.0', 'v3' +# Optional. Default is 'v2.0' +# # [*keystone_url*] # The internal or admin url for keystone # @@ -44,9 +48,10 @@ class tripleo::profile::base::ceph::rgw ( $keystone_admin_token, $keystone_url, $rgw_key, - $civetweb_bind_ip = '127.0.0.1', - $civetweb_bind_port = '8080', - $step = hiera('step'), + $civetweb_bind_ip = '127.0.0.1', + $civetweb_bind_port = '8080', + $rgw_keystone_version = 'v2.0', + $step = hiera('step'), ) { include ::tripleo::profile::base::ceph @@ -58,7 +63,8 @@ class tripleo::profile::base::ceph::rgw ( include ::ceph::profile::base ceph::rgw { $rgw_name: frontend_type => 'civetweb', - rgw_frontends => "civetweb port=${civetweb_bind_ip_real}:${civetweb_bind_port}" + rgw_frontends => "civetweb port=${civetweb_bind_ip_real}:${civetweb_bind_port}", + user => 'ceph', } ceph::key { "client.${rgw_name}": secret => $rgw_key, @@ -69,11 +75,24 @@ class tripleo::profile::base::ceph::rgw ( } if $step >= 4 { - ceph::rgw::keystone { $rgw_name: - rgw_keystone_accepted_roles => ['admin', '_member_', 'Member'], - use_pki => false, - rgw_keystone_admin_token => $keystone_admin_token, - rgw_keystone_url => $keystone_url, + if $rgw_keystone_version == 'v2.0' { + ceph::rgw::keystone { $rgw_name: + rgw_keystone_accepted_roles => ['admin', '_member_', 'Member'], + use_pki => false, + rgw_keystone_admin_token => $keystone_admin_token, + rgw_keystone_url => $keystone_url, + user => 'ceph', + } + } + else + { + ceph::rgw::keystone { $rgw_name: + rgw_keystone_accepted_roles => ['admin', '_member_', 'Member'], + use_pki => false, + rgw_keystone_url => $keystone_url, + rgw_keystone_version => $rgw_keystone_version, + user => 'ceph', + } } } } diff --git a/manifests/profile/base/cinder.pp b/manifests/profile/base/cinder.pp index 8023fcc..d6fad03 100644 --- a/manifests/profile/base/cinder.pp +++ b/manifests/profile/base/cinder.pp @@ -30,20 +30,65 @@ # (Optional) The current step of the deployment # Defaults to hiera('step') # -# [*rabbit_hosts*] -# list of the rabbbit host IPs -# Defaults to hiera('rabbitmq_node_ips') +# [*oslomsg_rpc_proto*] +# Protocol driver for the oslo messaging rpc service +# Defaults to hiera('messaging_rpc_service_name', rabbit) # -# [*rabbit_port*] -# IP port for rabbitmq service +# [*oslomsg_rpc_hosts*] +# list of the oslo messaging rpc host fqdns +# Defaults to hiera('rabbitmq_node_names') +# +# [*oslomsg_rpc_port*] +# IP port for oslo messaging rpc service # Defaults to hiera('cinder::rabbit_port', 5672) +# +# [*oslomsg_rpc_username*] +# Username for oslo messaging rpc service +# Defaults to hiera('cinder::rabbit_userid', 'guest') +# +# [*oslomsg_rpc_password*] +# Password for oslo messaging rpc service +# Defaults to hiera('cinder::rabbit_password') +# +# [*oslomsg_notify_proto*] +# Protocol driver for the oslo messaging notify service +# Defaults to hiera('messaging_notify_service_name', rabbit) +# +# [*oslomsg_notify_hosts*] +# list of the oslo messaging notify host fqdns +# Defaults to hiera('rabbitmq_node_names') +# +# [*oslomsg_notify_port*] +# IP port for oslo messaging notify service +# Defaults to hiera('cinder::rabbit_port', 5672) +# +# [*oslomsg_notify_username*] +# Username for oslo messaging notify service +# Defaults to hiera('cinder::rabbit_userid', 'guest') +# +# [*oslomsg_notify_password*] +# Password for oslo messaging notify service +# Defaults to hiera('cinder::rabbit_password') +# +# [*oslomsg_use_ssl*] +# Enable ssl oslo messaging services +# Defaults to hiera('cinder::rabbit_use_ssl', '0') class tripleo::profile::base::cinder ( - $bootstrap_node = hiera('bootstrap_nodeid', undef), - $cinder_enable_db_purge = true, - $step = hiera('step'), - $rabbit_hosts = hiera('rabbitmq_node_ips', undef), - $rabbit_port = hiera('cinder::rabbit_port', 5672), + $bootstrap_node = hiera('bootstrap_nodeid', undef), + $cinder_enable_db_purge = true, + $step = hiera('step'), + $oslomsg_rpc_proto = hiera('messaging_rpc_service_name', 'rabbit'), + $oslomsg_rpc_hosts = any2array(hiera('rabbitmq_node_names', undef)), + $oslomsg_rpc_password = hiera('cinder::rabbit_password'), + $oslomsg_rpc_port = hiera('cinder::rabbit_port', '5672'), + $oslomsg_rpc_username = hiera('cinder::rabbit_userid', 'guest'), + $oslomsg_notify_proto = hiera('messaging_notify_service_name', 'rabbit'), + $oslomsg_notify_hosts = any2array(hiera('rabbitmq_node_names', undef)), + $oslomsg_notify_password = hiera('cinder::rabbit_password'), + $oslomsg_notify_port = hiera('cinder::rabbit_port', '5672'), + $oslomsg_notify_username = hiera('cinder::rabbit_userid', 'guest'), + $oslomsg_use_ssl = hiera('cinder::rabbit_use_ssl', '0'), ) { if $::hostname == downcase($bootstrap_node) { $sync_db = true @@ -52,11 +97,29 @@ class tripleo::profile::base::cinder ( } if $step >= 4 or ($step >= 3 and $sync_db) { - $rabbit_endpoints = suffix(any2array(normalize_ip_for_uri($rabbit_hosts)), ":${rabbit_port}") + $oslomsg_use_ssl_real = sprintf('%s', bool2num(str2bool($oslomsg_use_ssl))) class { '::cinder' : - rabbit_hosts => $rabbit_endpoints, + default_transport_url => os_transport_url({ + 'transport' => $oslomsg_rpc_proto, + 'hosts' => $oslomsg_rpc_hosts, + 'port' => sprintf('%s', $oslomsg_rpc_port), + 'username' => $oslomsg_rpc_username, + 'password' => $oslomsg_rpc_password, + 'ssl' => $oslomsg_use_ssl_real, + }), + } + class { '::cinder::ceilometer' : + notification_transport_url => os_transport_url({ + 'transport' => $oslomsg_notify_proto, + 'hosts' => $oslomsg_notify_hosts, + 'port' => sprintf('%s', $oslomsg_notify_port), + 'username' => $oslomsg_notify_username, + 'password' => $oslomsg_notify_password, + 'ssl' => $oslomsg_use_ssl_real, + }), } include ::cinder::config + include ::cinder::glance } if $step >= 5 { diff --git a/manifests/profile/base/cinder/api.pp b/manifests/profile/base/cinder/api.pp index 5ea2058..450a8e6 100644 --- a/manifests/profile/base/cinder/api.pp +++ b/manifests/profile/base/cinder/api.pp @@ -94,7 +94,6 @@ class tripleo::profile::base::cinder::api ( ssl_key => $tls_keyfile, } include ::cinder::ceilometer - include ::cinder::glance } } diff --git a/manifests/profile/base/cinder/volume.pp b/manifests/profile/base/cinder/volume.pp index 7d562ec..9fb1594 100644 --- a/manifests/profile/base/cinder/volume.pp +++ b/manifests/profile/base/cinder/volume.pp @@ -22,8 +22,12 @@ # (Optional) Whether to enable the delsc backend # Defaults to true # -# [*cinder_enable_eqlx_backend*] -# (Optional) Whether to enable the eqlx backend +# [*cinder_enable_hpelefthand_backend*] +# (Optional) Whether to enable the hpelefthand backend +# Defaults to false +# +# [*cinder_enable_dellps_backend*] +# (Optional) Whether to enable the dellps backend # Defaults to true # # [*cinder_enable_iscsi_backend*] @@ -42,6 +46,10 @@ # (Optional) Whether to enable the rbd backend # Defaults to true # +# [*cinder_enable_scaleio_backend*] +# (Optional) Whether to enable the scaleio backend +# Defaults to true +# # [*cinder_user_enabled_backends*] # (Optional) List of additional backend stanzas to activate # Defaults to hiera('cinder_user_enabled_backends') @@ -52,14 +60,16 @@ # Defaults to hiera('step') # class tripleo::profile::base::cinder::volume ( - $cinder_enable_dellsc_backend = false, - $cinder_enable_eqlx_backend = false, - $cinder_enable_iscsi_backend = true, - $cinder_enable_netapp_backend = false, - $cinder_enable_nfs_backend = false, - $cinder_enable_rbd_backend = false, - $cinder_user_enabled_backends = hiera('cinder_user_enabled_backends', undef), - $step = hiera('step'), + $cinder_enable_dellsc_backend = false, + $cinder_enable_hpelefthand_backend = false, + $cinder_enable_dellps_backend = false, + $cinder_enable_iscsi_backend = true, + $cinder_enable_netapp_backend = false, + $cinder_enable_nfs_backend = false, + $cinder_enable_rbd_backend = false, + $cinder_enable_scaleio_backend = false, + $cinder_user_enabled_backends = hiera('cinder_user_enabled_backends', undef), + $step = hiera('step'), ) { include ::tripleo::profile::base::cinder @@ -73,11 +83,18 @@ class tripleo::profile::base::cinder::volume ( $cinder_dellsc_backend_name = undef } - if $cinder_enable_eqlx_backend { - include ::tripleo::profile::base::cinder::volume::eqlx - $cinder_eqlx_backend_name = hiera('cinder::backend::eqlx::volume_backend_name', 'tripleo_eqlx') + if $cinder_enable_hpelefthand_backend { + include ::tripleo::profile::base::cinder::volume::hpelefthand + $cinder_hpelefthand_backend_name = hiera('cinder::backend::hpelefthand_iscsi::volume_backend_name', 'tripleo_hpelefthand') + } else { + $cinder_hpelefthand_backend_name = undef + } + + if $cinder_enable_dellps_backend { + include ::tripleo::profile::base::cinder::volume::dellps + $cinder_dellps_backend_name = hiera('cinder::backend::dellps::volume_backend_name', 'tripleo_dellps') } else { - $cinder_eqlx_backend_name = undef + $cinder_dellps_backend_name = undef } if $cinder_enable_iscsi_backend { @@ -108,13 +125,28 @@ class tripleo::profile::base::cinder::volume ( $cinder_rbd_backend_name = undef } - $cinder_enabled_backends = delete_undef_values([$cinder_iscsi_backend_name, - $cinder_rbd_backend_name, - $cinder_eqlx_backend_name, - $cinder_dellsc_backend_name, - $cinder_netapp_backend_name, - $cinder_nfs_backend_name, - $cinder_user_enabled_backends]) + if $cinder_enable_scaleio_backend { + include ::tripleo::profile::base::cinder::volume::scaleio + $cinder_scaleio_backend_name = hiera('cinder::backend::scaleio::volume_backend_name', 'tripleo_scaleio') + } else { + $cinder_scaleio_backend_name = undef + } + + $backends = delete_undef_values([$cinder_iscsi_backend_name, + $cinder_rbd_backend_name, + $cinder_dellps_backend_name, + $cinder_dellsc_backend_name, + $cinder_hpelefthand_backend_name, + $cinder_netapp_backend_name, + $cinder_nfs_backend_name, + $cinder_scaleio_backend_name, + $cinder_user_enabled_backends]) + # NOTE(aschultz): during testing it was found that puppet 3 may incorrectly + # include a "" in the previous array which is not removed by the + # delete_undef_values function. So we need to make sure we don't have any + # "" strings in our array. + $cinder_enabled_backends = delete($backends, '') + class { '::cinder::backends' : enabled_backends => $cinder_enabled_backends, } diff --git a/manifests/profile/base/cinder/volume/eqlx.pp b/manifests/profile/base/cinder/volume/dellps.pp index fe24f4b..1338240 100644 --- a/manifests/profile/base/cinder/volume/eqlx.pp +++ b/manifests/profile/base/cinder/volume/dellps.pp @@ -12,23 +12,23 @@ # License for the specific language governing permissions and limitations # under the License. # -# == Class: tripleo::profile::base::cinder::volume::eqlx +# == Class: tripleo::profile::base::cinder::volume::dellps # -# Cinder Volume eqlx profile for tripleo +# Cinder Volume for dellps profile tripleo # # === Parameters # # [*backend_name*] # (Optional) Name given to the Cinder backend stanza -# Defaults to 'tripleo_eqlx' +# Defaults to 'tripleo_dellps' # # [*step*] # (Optional) The current step in deployment. See tripleo-heat-templates # for more details. # Defaults to hiera('step') # -class tripleo::profile::base::cinder::volume::eqlx ( - $backend_name = hiera('cinder::backend::eqlx::volume_backend_name', 'tripleo_eqlx'), +class tripleo::profile::base::cinder::volume::dellps ( + $backend_name = hiera('cinder::backend::eqlx::volume_backend_name', 'tripleo_dellps'), $step = hiera('step'), ) { include ::tripleo::profile::base::cinder::volume diff --git a/manifests/profile/base/cinder/volume/hpelefthand.pp b/manifests/profile/base/cinder/volume/hpelefthand.pp new file mode 100644 index 0000000..32f0976 --- /dev/null +++ b/manifests/profile/base/cinder/volume/hpelefthand.pp @@ -0,0 +1,71 @@ +# Copyright 2016 Hewlett-Packard Enterprise. +# +# Licensed under the Apache License, Version 2.0 (the "License"); you may +# not use this file except in compliance with the License. You may obtain +# a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT +# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the +# License for the specific language governing permissions and limitations +# under the License. +# +# == Class: tripleo::profile::base::cinder::volume::hpelefthand +# +# Cinder Volume hpelefthand profile for tripleo +# +# === Parameters +# +# [*backend_name*] +# (Optional) Name given to the Cinder backend stanza +# Defaults to 'tripleo_hpelefthand' +# +# [*cinder_hpelefthand_api_url*] +# (required) url for api access to lefthand - example https://10.x.x.x:8080/api/v1 +# +# [*cinder_hpelefthand_username*] +# (required) Username for HPElefthand admin user +# +# [*cinder_hpelefthand_password*] +# (required) Password for hpelefthand_username +# +# [*cinder_hpelefthand_iscsi_chap_enabled*] +# (required) setting to false by default +# +# [*cinder_hpelefthand_clustername*] +# (required) clustername of hpelefthand +# +# [*cinder_hpelefthand_debug*] +# (required) setting to false by default +# +# [*step*] +# (Optional) The current step in deployment. See tripleo-heat-templates +# for more details. +# Defaults to hiera('step') +# +class tripleo::profile::base::cinder::volume::hpelefthand ( + $backend_name = hiera('cinder::backend::hpelefthand_iscsi::volume_backend_name', 'tripleo_hpelefthand'), + $cinder_hpelefthand_username = hiera('cinder::backend::hpelefthand_iscsi::hpelefthand_username', undef), + $cinder_hpelefthand_password = hiera('cinder::backend::hpelefthand_iscsi::hpelefthand_password', undef), + $cinder_hpelefthand_clustername = hiera('cinder::backend::hpelefthand_iscsi::hpelefthand_clustername', undef), + $cinder_hpelefthand_api_url = hiera('cinder::backend::hpelefthand_iscsi::hpelefthand_api_url', undef), + $cinder_hpelefthand_iscsi_chap_enabled = hiera('cinder::backend::hpelefthand_iscsi::hpelefthand_iscsi_chap_enabled', undef), + $cinder_hpelefthand_debug = hiera('cinder::backend::hpelefthand_iscsi::hpelefthand_debug', undef), + $step = hiera('step'), +) { + include ::tripleo::profile::base::cinder::volume + + if $step >= 4 { + cinder::backend::hpelefthand_iscsi { $backend_name : + hpelefthand_username => $cinder_hpelefthand_username, + hpelefthand_password => $cinder_hpelefthand_password, + hpelefthand_clustername => $cinder_hpelefthand_clustername, + hpelefthand_api_url => $cinder_hpelefthand_api_url, + hpelefthand_iscsi_chap_enabled => $cinder_hpelefthand_iscsi_chap_enabled, + hpelefthand_debug => $cinder_hpelefthand_debug, + } + } + +} diff --git a/manifests/profile/base/cinder/volume/scaleio.pp b/manifests/profile/base/cinder/volume/scaleio.pp new file mode 100644 index 0000000..a30cffa --- /dev/null +++ b/manifests/profile/base/cinder/volume/scaleio.pp @@ -0,0 +1,56 @@ +# Copyright 2016 Red Hat, Inc. +# +# Licensed under the Apache License, Version 2.0 (the "License"); you may +# not use this file except in compliance with the License. You may obtain +# a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT +# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the +# License for the specific language governing permissions and limitations +# under the License. +# +# == Class: tripleo::profile::base::cinder::volume::scaleio +# +# Cinder Volume scaleio profile for tripleo +# +# === Parameters +# +# [*backend_name*] +# (Optional) Name given to the Cinder backend stanza +# Defaults to 'tripleo_scaleio' +# +# [*step*] +# (Optional) The current step in deployment. See tripleo-heat-templates +# for more details. +# Defaults to hiera('step') +# +class tripleo::profile::base::cinder::volume::scaleio ( + $backend_name = hiera('cinder::backend::scaleio::volume_backend_name', 'tripleo_scaleio'), + $step = hiera('step'), +) { + include ::tripleo::profile::base::cinder::volume + + if $step >= 4 { + cinder::backend::scaleio { $backend_name : + sio_login => hiera('cinder::backend::scaleio::sio_login', undef), + sio_password => hiera('cinder::backend::scaleio::sio_password', undef), + sio_server_hostname => hiera('cinder::backend::scaleio::sio_server_hostname', undef), + sio_server_port => hiera('cinder::backend::scaleio::sio_server_port', undef), + sio_verify_server_certificate => hiera('cinder::backend::scaleio::sio_verify_server_certificate', undef), + sio_server_certificate_path => hiera('cinder::backend::scaleio::sio_server_certificate_path', undef), + sio_protection_domain_name => hiera('cinder::backend::scaleio::sio_protection_domain_name', undef), + sio_protection_domain_id => hiera('cinder::backend::scaleio::sio_protection_domain_id', undef), + sio_storage_pool_id => hiera('cinder::backend::scaleio::sio_storage_pool_id', undef), + sio_storage_pool_name => hiera('cinder::backend::scaleio::sio_storage_pool_name', undef), + sio_storage_pools => hiera('cinder::backend::scaleio::sio_storage_pools', undef), + sio_round_volume_capacity => hiera('cinder::backend::scaleio::sio_round_volume_capacity', undef), + sio_unmap_volume_before_deletion => hiera('cinder::backend::scaleio::sio_unmap_volume_before_deletion', undef), + sio_max_over_subscription_ratio => hiera('cinder::backend::scaleio::sio_max_over_subscription_ratio', undef), + sio_thin_provision => hiera('cinder::backend::scaleio::sio_thin_provision', undef), + } + } + +} diff --git a/manifests/profile/base/congress.pp b/manifests/profile/base/congress.pp new file mode 100644 index 0000000..3d1a693 --- /dev/null +++ b/manifests/profile/base/congress.pp @@ -0,0 +1,86 @@ +# Copyright 2016 Red Hat, Inc. +# +# Licensed under the Apache License, Version 2.0 (the "License"); you may +# not use this file except in compliance with the License. You may obtain +# a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT +# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the +# License for the specific language governing permissions and limitations +# under the License. +# +# == Class: tripleo::profile::base::congress +# +# Congress server profile for tripleo +# +# === Parameters +# +# [*bootstrap_node*] +# (Optional) The hostname of the node responsible for bootstrapping tasks +# Defaults to hiera('bootstrap_nodeid') +# +# [*step*] +# (Optional) The current step of the deployment +# Defaults to hiera('step') +# +# [*oslomsg_rpc_proto*] +# Protocol driver for the oslo messaging rpc service +# Defaults to hiera('messaging_rpc_service_name', rabbit) +# +# [*oslomsg_rpc_hosts*] +# list of the oslo messaging rpc host fqdns +# Defaults to hiera('rabbitmq_node_names') +# +# [*oslomsg_rpc_port*] +# IP port for oslo messaging rpc service +# Defaults to hiera('congress::rabbit_port', 5672) +# +# [*oslomsg_rpc_username*] +# Username for oslo messaging rpc service +# Defaults to hiera('congress::rabbit_userid', 'guest') +# +# [*oslomsg_rpc_password*] +# Password for oslo messaging rpc service +# Defaults to hiera('congress::rabbit_password') +# +# [*oslomsg_use_ssl*] +# Enable ssl oslo messaging services +# Defaults to hiera('congress::rabbit_use_ssl', '0') + +class tripleo::profile::base::congress ( + $bootstrap_node = hiera('bootstrap_nodeid', undef), + $step = hiera('step'), + $oslomsg_rpc_proto = hiera('messaging_rpc_service_name', 'rabbit'), + $oslomsg_rpc_hosts = any2array(hiera('rabbitmq_node_names', undef)), + $oslomsg_rpc_password = hiera('congress::rabbit_password'), + $oslomsg_rpc_port = hiera('congress::rabbit_port', '5672'), + $oslomsg_rpc_username = hiera('congress::rabbit_userid', 'guest'), + $oslomsg_use_ssl = hiera('congress::rabbit_use_ssl', '0'), +) { + if $::hostname == downcase($bootstrap_node) { + $sync_db = true + } else { + $sync_db = false + } + + if $step >= 4 or ($step >= 3 and $sync_db){ + $oslomsg_use_ssl_real = sprintf('%s', bool2num(str2bool($oslomsg_use_ssl))) + class { '::congress': + sync_db => $sync_db, + default_transport_url => os_transport_url({ + 'transport' => $oslomsg_rpc_proto, + 'hosts' => $oslomsg_rpc_hosts, + 'port' => sprintf('%s', $oslomsg_rpc_port), + 'username' => $oslomsg_rpc_username, + 'password' => $oslomsg_rpc_password, + 'ssl' => $oslomsg_use_ssl_real, + }), + } + + include ::congress::server + include ::congress::db + } +} diff --git a/manifests/profile/base/database/mysql.pp b/manifests/profile/base/database/mysql.pp index 9da1456..d3c3f21 100644 --- a/manifests/profile/base/database/mysql.pp +++ b/manifests/profile/base/database/mysql.pp @@ -26,6 +26,28 @@ # (Optional) The hostname of the node responsible for bootstrapping tasks # Defaults to hiera('bootstrap_nodeid') # +# [*certificate_specs*] +# (Optional) The specifications to give to certmonger for the certificate +# it will create. Note that the certificate nickname must be 'mysql' in +# the case of this service. +# Example with hiera: +# tripleo::profile::base::database::mysql::certificate_specs: +# hostname: <overcloud controller fqdn> +# service_certificate: <service certificate path> +# service_key: <service key path> +# principal: "mysql/<overcloud controller fqdn>" +# Defaults to {}. +# +# [*enable_internal_tls*] +# (Optional) Whether TLS in the internal network is enabled or not. +# Defaults to hiera('enable_internal_tls', false) +# +# [*generate_service_certificates*] +# (Optional) Whether or not certmonger will generate certificates for +# MySQL. This could be as many as specified by the $certificates_specs +# variable. +# Defaults to hiera('generate_service_certificate', false). +# # [*manage_resources*] # (Optional) Whether or not manage root user, root my.cnf, and service. # Defaults to true @@ -44,13 +66,17 @@ # for more details. # Defaults to hiera('step') # +# class tripleo::profile::base::database::mysql ( - $bind_address = $::hostname, - $bootstrap_node = hiera('bootstrap_nodeid', undef), - $manage_resources = true, - $mysql_server_options = {}, - $remove_default_accounts = true, - $step = hiera('step'), + $bind_address = $::hostname, + $bootstrap_node = hiera('bootstrap_nodeid', undef), + $certificate_specs = {}, + $enable_internal_tls = hiera('enable_internal_tls', false), + $generate_service_certificates = hiera('generate_service_certificates', false), + $manage_resources = true, + $mysql_server_options = {}, + $remove_default_accounts = true, + $step = hiera('step'), ) { if $::hostname == downcase($bootstrap_node) { @@ -60,6 +86,18 @@ class tripleo::profile::base::database::mysql ( } validate_hash($mysql_server_options) + validate_hash($certificate_specs) + + if $enable_internal_tls { + if $generate_service_certificates { + ensure_resource('class', 'tripleo::certmonger::mysql', $certificate_specs) + } + $tls_certfile = $certificate_specs['service_certificate'] + $tls_keyfile = $certificate_specs['service_key'] + } else { + $tls_certfile = undef + $tls_keyfile = undef + } # non-ha scenario if $manage_resources { @@ -81,9 +119,14 @@ class tripleo::profile::base::database::mysql ( # MysqlNetwork and ControllerHostnameResolveNetwork in ServiceNetMap $mysql_server_default = { 'mysqld' => { - 'bind-address' => $bind_address, - 'max_connections' => hiera('mysql_max_connections'), - 'open_files_limit' => '-1', + 'bind-address' => $bind_address, + 'max_connections' => hiera('mysql_max_connections'), + 'open_files_limit' => '-1', + 'innodb_file_per_table' => 'ON', + 'ssl' => $enable_internal_tls, + 'ssl-key' => $tls_keyfile, + 'ssl-cert' => $tls_certfile, + 'ssl-ca' => undef, } } $mysql_server_options_real = deep_merge($mysql_server_default, $mysql_server_options) @@ -109,7 +152,10 @@ class tripleo::profile::base::database::mysql ( if hiera('cinder_api_enabled', false) { include ::cinder::db::mysql } - if hiera('glance_registry_enabled', false) { + if hiera('congress_enabled', false) { + include ::congress::db::mysql + } + if hiera('glance_api_enabled', false) { include ::glance::db::mysql } if hiera('gnocchi_api_enabled', false) { @@ -137,12 +183,24 @@ class tripleo::profile::base::database::mysql ( include ::nova::db::mysql include ::nova::db::mysql_api } + if hiera('nova_placement_enabled', false) { + include ::nova::db::mysql_placement + } if hiera('sahara_api_enabled', false) { include ::sahara::db::mysql } + if hiera('tacker_enabled', false) { + include ::tacker::db::mysql + } if hiera('trove_api_enabled', false) { include ::trove::db::mysql } + if hiera('panko_api_enabled', false) { + include ::panko::db::mysql + } + if hiera('ec2_api_enabled', false) { + include ::ec2api::db::mysql + } } } diff --git a/manifests/profile/base/database/mysql/client.pp b/manifests/profile/base/database/mysql/client.pp new file mode 100644 index 0000000..f23b97d --- /dev/null +++ b/manifests/profile/base/database/mysql/client.pp @@ -0,0 +1,72 @@ +# Copyright 2016 Red Hat, Inc. +# +# Licensed under the Apache License, Version 2.0 (the "License"); you may +# not use this file except in compliance with the License. You may obtain +# a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT +# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the +# License for the specific language governing permissions and limitations +# under the License. +# +# == Class: tripleo::profile::base::haproxy +# +# Loadbalancer profile for tripleo +# +# === Parameters +# +# [*mysql_read_default_file*] +# (Optional) Name of the file that will be passed to pymysql connection strings +# Defaults to hiera('tripleo::profile::base:database::mysql::read_default_file', '/etc/my.cnf.d/tripleo.cnf') +# +# [*mysql_read_default_group*] +# (Optional) Name of the ini section to be passed to pymysql connection strings +# Defaults to hiera('tripleo::profile::base:database::mysql::read_default_group', 'tripleo') +# +# [*mysql_client_bind_address*] +# (Optional) Client IP address of the host that will be written in the mysql_read_default_file +# Defaults to hiera('tripleo::profile::base:database::mysql::client_bind_address', undef) +# +# [*step*] +# (Optional) The current step in deployment. See tripleo-heat-templates +# for more details. +# Defaults to hiera('step') +# +class tripleo::profile::base::database::mysql::client ( + $mysql_read_default_file = hiera('tripleo::profile::base:database::mysql::read_default_file', '/etc/my.cnf.d/tripleo.cnf'), + $mysql_read_default_group = hiera('tripleo::profile::base:database::mysql::read_default_group', 'tripleo'), + $mysql_client_bind_address = hiera('tripleo::profile::base:database::mysql::client_bind_address', undef), + $step = hiera('step'), +) { + if $step >= 1 { + # If the folder /etc/my.cnf.d does not exist (e.g. if mariadb is not + # present in the base image but installed as a package afterwards), + # create it. We do not want to touch the permissions in case it already + # exists due to the mariadb server package being pre-installed + # Note: We use exec instead of file in the case that the mysql class is + # included on this node as well (we'd get duplicate declaration in such a + # situation when using file) + if $mysql_client_bind_address { + $changes = [ + "set ${mysql_read_default_group}/bind-address '${mysql_client_bind_address}'" + ] + } else { + $changes = [ + "rm ${mysql_read_default_group}/bind-address" + ] + } + exec { 'directory-create-etc-my.cnf.d': + command => 'mkdir -p /etc/my.cnf.d', + path => ['/usr/bin', '/usr/sbin', '/bin', '/sbin'], + } -> + # Create /etc/my.cnf.d/tripleo.cnf with the [tripleo]bind-address=<IP of the node in the mysql network> + augeas { 'mysql-bind-address': + incl => $mysql_read_default_file, + lens => 'Puppet.lns', + changes => $changes, + } + } +} diff --git a/manifests/profile/base/docker_registry.pp b/manifests/profile/base/docker_registry.pp new file mode 100644 index 0000000..ebe84bf --- /dev/null +++ b/manifests/profile/base/docker_registry.pp @@ -0,0 +1,74 @@ +# Copyright 2017 Red Hat, Inc. +# +# Licensed under the Apache License, Version 2.0 (the "License"); you may +# not use this file except in compliance with the License. You may obtain +# a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT +# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the +# License for the specific language governing permissions and limitations +# under the License. +# +# == Class: tripleo::profile::base::docker_registry +# +# Docker Registry profile for tripleo +# +# === Parameters: +# +# [*registry_host*] +# (String) IP address or hostname the Docker registry binds to +# Defaults to hiera('controller_host') +# +# [*registry_port*] +# (Integer) The port on which the Docker registry is listening on +# Defaults to 8787 +# +# [*registry_admin_host*] +# (String) IP address or hostname the Docker registry binds to in the admin +# network +# Defaults to hiera('controller_admin_host') +# +class tripleo::profile::base::docker_registry ( + $registry_host = hiera('controller_host'), + $registry_port = 8787, + $registry_admin_host = hiera('controller_admin_host'), +) { + # We want a v2 registry + package{'docker-registry': + ensure => absent, + } + package{'docker-distribution': } + package{'docker': } + file { '/etc/docker-distribution/registry/config.yml' : + ensure => file, + content => template('tripleo/docker_distribution/registry_config.yml.erb'), + owner => 'root', + group => 'root', + mode => '0644', + require => Package['docker-distribution'], + notify => Service['docker-distribution'], + } + file_line { 'docker insecure registry': + path => '/etc/sysconfig/docker', + line => join ([ + 'INSECURE_REGISTRY="', + '--insecure-registry ', $registry_host, ':', $registry_port, ' ', + '--insecure-registry ', $registry_admin_host, ':', $registry_port, '"']), + match => 'INSECURE_REGISTRY=', + require => Package['docker'], + notify => Service['docker'], + } + service { 'docker-distribution': + ensure => running, + enable => true, + require => Package['docker-distribution'], + } + service { 'docker': + ensure => running, + enable => true, + require => Package['docker'], + } +} diff --git a/manifests/profile/base/etcd.pp b/manifests/profile/base/etcd.pp new file mode 100644 index 0000000..505e29f --- /dev/null +++ b/manifests/profile/base/etcd.pp @@ -0,0 +1,66 @@ +# Copyright 2016 Red Hat, Inc. +# +# Licensed under the Apache License, Version 2.0 (the "License"); you may +# not use this file except in compliance with the License. You may obtain +# a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT +# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the +# License for the specific language governing permissions and limitations +# under the License. +# +# == Class: tripleo::profile::base::etcd +# +# etcd profile for tripleo +# +# === Parameters +# +# [*bind_ip*] +# (optional) IP to bind etcd service to. +# Defaults to '127.0.0.1'. +# +# [*client_port*] +# (optional) etcd client listening port. +# Defaults to '2379'. +# +# [*peer_port*] +# (optional) etcd peer listening port. +# Defaults to '2380'. +# +# [*nodes*] +# (Optional) Array of host(s) for etcd nodes. +# Defaults to hiera('etcd_node_ips', []). +# +# [*step*] +# (Optional) The current step in deployment. See tripleo-heat-templates +# for more details. +# Defaults to hiera('step') +# +class tripleo::profile::base::etcd ( + $bind_ip = '127.0.0.1', + $client_port = '2379', + $peer_port = '2380', + $nodes = hiera('etcd_node_names', []), + $step = hiera('step'), +) { + if $step >= 1 { + if count($nodes) > 1 { + $cluster_enabled = true + } else { + $cluster_enabled = false + } + + class {'::etcd': + listen_client_urls => "http://${bind_ip}:${client_port}", + advertise_client_urls => "http://${bind_ip}:${client_port}", + listen_peer_urls => "http://${bind_ip}:${peer_port}", + initial_advertise_peer_urls => "http://${bind_ip}:${peer_port}", + initial_cluster => regsubst($nodes, '.+', "\\0=http://\\0:${peer_port}"), + cluster_enabled => $cluster_enabled, + proxy => 'off', + } + } +} diff --git a/manifests/profile/base/glance/api.pp b/manifests/profile/base/glance/api.pp index af3b0ac..e5807f6 100644 --- a/manifests/profile/base/glance/api.pp +++ b/manifests/profile/base/glance/api.pp @@ -18,10 +18,43 @@ # # === Parameters # +# [*bootstrap_node*] +# (Optional) The hostname of the node responsible for bootstrapping tasks +# Defaults to hiera('bootstrap_nodeid') +# +# [*certificates_specs*] +# (Optional) The specifications to give to certmonger for the certificate(s) +# it will create. +# Example with hiera: +# apache_certificates_specs: +# httpd-internal_api: +# hostname: <overcloud controller fqdn> +# service_certificate: <service certificate path> +# service_key: <service key path> +# principal: "haproxy/<overcloud controller fqdn>" +# Defaults to hiera('apache_certificate_specs', {}). +# +# [*enable_internal_tls*] +# (Optional) Whether TLS in the internal network is enabled or not. +# Defaults to hiera('enable_internal_tls', false) +# +# [*generate_service_certificates*] +# (Optional) Whether or not certmonger will generate certificates for +# HAProxy. This could be as many as specified by the $certificates_specs +# variable. +# Note that this doesn't configure the certificates in haproxy, it merely +# creates the certificates. +# Defaults to hiera('generate_service_certificate', false). +# # [*glance_backend*] # (Optional) Glance backend(s) to use. # Defaults to downcase(hiera('glance_backend', 'swift')) # +# [*glance_network*] +# (Optional) The network name where the glance endpoint is listening on. +# This is set by t-h-t. +# Defaults to hiera('glance_api_network', undef) +# # [*glance_nfs_enabled*] # (Optional) Whether to use NFS mount as 'file' backend storage location. # Defaults to false @@ -32,26 +65,80 @@ # Defaults to hiera('step') # # [*rabbit_hosts*] -# list of the rabbbit host IPs -# Defaults to hiera('rabbitmq_node_ips') +# list of the rabbbit host fqdns +# Defaults to hiera('rabbitmq_node_names') # # [*rabbit_port*] # IP port for rabbitmq service # Defaults to hiera('glance::notify::rabbitmq::rabbit_port', 5672) - +# +# [*tls_proxy_bind_ip*] +# IP on which the TLS proxy will listen on. Required only if +# enable_internal_tls is set. +# Defaults to undef +# +# [*tls_proxy_fqdn*] +# fqdn on which the tls proxy will listen on. required only used if +# enable_internal_tls is set. +# defaults to undef +# +# [*tls_proxy_port*] +# port on which the tls proxy will listen on. Only used if +# enable_internal_tls is set. +# defaults to 9292 +# class tripleo::profile::base::glance::api ( - $glance_backend = downcase(hiera('glance_backend', 'swift')), - $glance_nfs_enabled = false, - $step = hiera('step'), - $rabbit_hosts = hiera('rabbitmq_node_ips', undef), - $rabbit_port = hiera('glance::notify::rabbitmq::rabbit_port', 5672), + $bootstrap_node = hiera('bootstrap_nodeid', undef), + $certificates_specs = hiera('apache_certificates_specs', {}), + $enable_internal_tls = hiera('enable_internal_tls', false), + $generate_service_certificates = hiera('generate_service_certificates', false), + $glance_backend = downcase(hiera('glance_backend', 'swift')), + $glance_network = hiera('glance_api_network', undef), + $glance_nfs_enabled = false, + $step = hiera('step'), + $rabbit_hosts = hiera('rabbitmq_node_names', undef), + $rabbit_port = hiera('glance::notify::rabbitmq::rabbit_port', 5672), + $tls_proxy_bind_ip = undef, + $tls_proxy_fqdn = undef, + $tls_proxy_port = 9292, ) { + if $enable_internal_tls and $generate_service_certificates { + ensure_resources('tripleo::certmonger::httpd', $certificates_specs) + } + + if $::hostname == downcase($bootstrap_node) { + $sync_db = true + } else { + $sync_db = false + } if $step >= 1 and $glance_nfs_enabled { include ::tripleo::glance::nfs_mount } - if $step >= 4 { + if $step >= 4 or ($step >= 3 and $sync_db) { + if $enable_internal_tls { + if !$glance_network { + fail('glance_api_network is not set in the hieradata.') + } + if !$tls_proxy_bind_ip { + fail('glance_api_tls_proxy_bind_ip is not set in the hieradata.') + } + if !$tls_proxy_fqdn { + fail('tls_proxy_fqdn is required if internal TLS is enabled.') + } + $tls_certfile = $certificates_specs["httpd-${glance_network}"]['service_certificate'] + $tls_keyfile = $certificates_specs["httpd-${glance_network}"]['service_key'] + + ::tripleo::tls_proxy { 'glance-api': + servername => $tls_proxy_fqdn, + ip => $tls_proxy_bind_ip, + port => $tls_proxy_port, + tls_cert => $tls_certfile, + tls_key => $tls_keyfile, + notify => Class['::glance::api'], + } + } case $glance_backend { 'swift': { $backend_store = 'glance.store.swift.Store' } 'file': { $backend_store = 'glance.store.filesystem.Store' } @@ -64,10 +151,12 @@ class tripleo::profile::base::glance::api ( # TODO: notifications, scrubber, etc. include ::glance include ::glance::config + # TODO(jaosorior): Remove bind_host when we set it up conditionally in t-h-t class { '::glance::api': - stores => $glance_store, + stores => $glance_store, + sync_db => $sync_db, } - $rabbit_endpoints = suffix(any2array(normalize_ip_for_uri($rabbit_hosts)), ":${rabbit_port}") + $rabbit_endpoints = suffix(any2array($rabbit_hosts), ":${rabbit_port}") class { '::glance::notify::rabbitmq' : rabbit_hosts => $rabbit_endpoints, } diff --git a/manifests/profile/base/gnocchi/metricd.pp b/manifests/profile/base/gnocchi/metricd.pp index e69bbd5..f6f80cd 100644 --- a/manifests/profile/base/gnocchi/metricd.pp +++ b/manifests/profile/base/gnocchi/metricd.pp @@ -30,7 +30,5 @@ class tripleo::profile::base::gnocchi::metricd ( if $step >= 5 { include ::gnocchi::metricd - Keystone_endpoint<||> -> Service['gnocchi-metricd'] - Keystone_user_role<||> -> Service['gnocchi-metricd'] } } diff --git a/manifests/profile/base/gnocchi/statsd.pp b/manifests/profile/base/gnocchi/statsd.pp index 1fe4067..7c98a0a 100644 --- a/manifests/profile/base/gnocchi/statsd.pp +++ b/manifests/profile/base/gnocchi/statsd.pp @@ -30,7 +30,5 @@ class tripleo::profile::base::gnocchi::statsd ( if $step >= 5 { include ::gnocchi::statsd - Keystone_endpoint<||> -> Service['gnocchi-statsd'] - Keystone_user_role<||> -> Service['gnocchi-statsd'] } } diff --git a/manifests/profile/base/heat.pp b/manifests/profile/base/heat.pp index 00a9809..171f51b 100644 --- a/manifests/profile/base/heat.pp +++ b/manifests/profile/base/heat.pp @@ -35,21 +35,66 @@ # for more details. # Defaults to hiera('step') # -# [*rabbit_hosts*] -# list of the rabbbit host IPs -# Defaults to hiera('rabbitmq_node_ips') +# [*oslomsg_rpc_proto*] +# Protocol driver for the oslo messaging rpc service +# Defaults to hiera('messaging_rpc_service_name', rabbit) # -# [*rabbit_port*] -# IP port for rabbitmq service +# [*oslomsg_rpc_hosts*] +# list of the oslo messaging rpc host fqdns +# Defaults to hiera('rabbitmq_node_names') +# +# [*oslomsg_rpc_port*] +# IP port for oslo messaging rpc service +# Defaults to hiera('heat::rabbit_port', 5672) +# +# [*oslomsg_rpc_username*] +# Username for oslo messaging rpc service +# Defaults to hiera('heat::rabbit_userid', 'guest') +# +# [*oslomsg_rpc_password*] +# Password for oslo messaging rpc service +# Defaults to hiera('heat::rabbit_password') +# +# [*oslomsg_notify_proto*] +# Protocol driver for the oslo messaging notify service +# Defaults to hiera('messaging_notify_service_name', rabbit) +# +# [*oslomsg_notify_hosts*] +# list of the oslo messaging notify host fqdns +# Defaults to hiera('rabbitmq_node_names') +# +# [*oslomsg_notify_port*] +# IP port for oslo messaging notify service # Defaults to hiera('heat::rabbit_port', 5672) +# +# [*oslomsg_notify_username*] +# Username for oslo messaging notify service +# Defaults to hiera('heat::rabbit_userid', 'guest') +# +# [*oslomsg_notify_password*] +# Password for oslo messaging notify service +# Defaults to hiera('heat::rabbit_password') +# +# [*oslomsg_use_ssl*] +# Enable ssl oslo messaging services +# Defaults to hiera('heat::rabbit_use_ssl', '0') class tripleo::profile::base::heat ( - $bootstrap_node = downcase(hiera('bootstrap_nodeid')), - $manage_db_purge = hiera('heat_enable_db_purge', true), - $notification_driver = 'messaging', - $step = hiera('step'), - $rabbit_hosts = hiera('rabbitmq_node_ips', undef), - $rabbit_port = hiera('heat::rabbit_port', 5672), + $bootstrap_node = downcase(hiera('bootstrap_nodeid')), + $manage_db_purge = hiera('heat_enable_db_purge', true), + $notification_driver = 'messaging', + $step = hiera('step'), + $oslomsg_rpc_proto = hiera('messaging_rpc_service_name', 'rabbit'), + $oslomsg_rpc_hosts = any2array(hiera('rabbitmq_node_names', undef)), + $oslomsg_rpc_password = hiera('heat::rabbit_password'), + $oslomsg_rpc_port = hiera('heat::rabbit_port', '5672'), + $oslomsg_rpc_username = hiera('heat::rabbit_userid', 'guest'), + $oslomsg_notify_proto = hiera('messaging_notify_service_name', 'rabbit'), + $oslomsg_notify_hosts = any2array(hiera('rabbitmq_node_names', undef)), + $oslomsg_notify_password = hiera('heat::rabbit_password'), + $oslomsg_notify_port = hiera('heat::rabbit_port', '5672'), + $oslomsg_notify_username = hiera('heat::rabbit_userid', 'guest'), + $oslomsg_use_ssl = hiera('heat::rabbit_use_ssl', '0'), ) { # Domain resources will be created at step5 on the node running keystone.pp # configure heat.conf at step3 and 4 but actually create the domain later. @@ -59,13 +104,29 @@ class tripleo::profile::base::heat ( manage_user => false, manage_role => false, } - } - if $step >= 4 { - $rabbit_endpoints = suffix(any2array(normalize_ip_for_uri($rabbit_hosts)), ":${rabbit_port}") + $oslomsg_use_ssl_real = sprintf('%s', bool2num(str2bool($oslomsg_use_ssl))) + + # TODO(ccamacho): remove sprintf once we properly type the port, needs + # to be a string for the os_transport_url function. class { '::heat' : - notification_driver => $notification_driver, - rabbit_hosts => $rabbit_endpoints, + notification_driver => $notification_driver, + default_transport_url => os_transport_url({ + 'transport' => $oslomsg_rpc_proto, + 'hosts' => $oslomsg_rpc_hosts, + 'port' => sprintf('%s', $oslomsg_rpc_port), + 'username' => $oslomsg_rpc_username, + 'password' => $oslomsg_rpc_password, + 'ssl' => $oslomsg_use_ssl_real, + }), + notification_transport_url => os_transport_url({ + 'transport' => $oslomsg_notify_proto, + 'hosts' => $oslomsg_notify_hosts, + 'port' => sprintf('%s', $oslomsg_notify_port), + 'username' => $oslomsg_notify_username, + 'password' => $oslomsg_notify_password, + 'ssl' => $oslomsg_use_ssl_real, + }), } include ::heat::config include ::heat::cors diff --git a/manifests/profile/base/horizon.pp b/manifests/profile/base/horizon.pp index 6f06456..1849435 100644 --- a/manifests/profile/base/horizon.pp +++ b/manifests/profile/base/horizon.pp @@ -35,7 +35,7 @@ class tripleo::profile::base::horizon ( # Horizon include ::apache::mod::remoteip include ::apache::mod::status - if 'cisco_n1kv' in hiera('neutron::plugins::ml2::mechanism_drivers') { + if 'cisco_n1kv' in hiera('neutron::plugins::ml2::mechanism_drivers', undef) { $_profile_support = 'cisco' } else { $_profile_support = 'None' diff --git a/manifests/profile/base/ironic.pp b/manifests/profile/base/ironic.pp index 7b44421..7ba629f 100644 --- a/manifests/profile/base/ironic.pp +++ b/manifests/profile/base/ironic.pp @@ -26,19 +26,39 @@ # (Optional) The current step of the deployment # Defaults to hiera('step') # -# [*rabbit_hosts*] -# list of the rabbbit host IPs -# Defaults to hiera('rabbitmq_node_ips') +# [*oslomsg_rpc_proto*] +# Protocol driver for the oslo messaging rpc service +# Defaults to hiera('messaging_rpc_service_name', rabbit) # -# [*rabbit_port*] -# IP port for rabbitmq service +# [*oslomsg_rpc_hosts*] +# list of the oslo messaging rpc host fqdns +# Defaults to hiera('rabbitmq_node_names') +# +# [*oslomsg_rpc_port*] +# IP port for oslo messaging rpc service # Defaults to hiera('ironic::rabbit_port', 5672) +# +# [*oslomsg_rpc_username*] +# Username for oslo messaging rpc service +# Defaults to hiera('ironic::rabbit_userid', 'guest') +# +# [*oslomsg_rpc_password*] +# Password for oslo messaging rpc service +# Defaults to hiera('ironic::rabbit_password') +# +# [*oslomsg_use_ssl*] +# Enable ssl oslo messaging services +# Defaults to hiera('ironic::rabbit_use_ssl', '0') class tripleo::profile::base::ironic ( - $bootstrap_node = hiera('bootstrap_nodeid', undef), - $step = hiera('step'), - $rabbit_hosts = hiera('rabbitmq_node_ips', undef), - $rabbit_port = hiera('ironic::rabbit_port', 5672), + $bootstrap_node = hiera('bootstrap_nodeid', undef), + $step = hiera('step'), + $oslomsg_rpc_proto = hiera('messaging_rpc_service_name', 'rabbit'), + $oslomsg_rpc_hosts = any2array(hiera('rabbitmq_node_names', undef)), + $oslomsg_rpc_password = hiera('ironic::rabbit_password'), + $oslomsg_rpc_port = hiera('ironic::rabbit_port', '5672'), + $oslomsg_rpc_username = hiera('ironic::rabbit_userid', 'guest'), + $oslomsg_use_ssl = hiera('ironic::rabbit_use_ssl', '0'), ) { # Database is accessed by both API and conductor, hence it's here. if $::hostname == downcase($bootstrap_node) { @@ -48,12 +68,20 @@ class tripleo::profile::base::ironic ( } if $step >= 4 or ($step >= 3 and $sync_db) { - $rabbit_endpoints = suffix(any2array(normalize_ip_for_uri($rabbit_hosts)), ":${rabbit_port}") + $oslomsg_use_ssl_real = sprintf('%s', bool2num(str2bool($oslomsg_use_ssl))) class { '::ironic': - sync_db => $sync_db, - rabbit_hosts => $rabbit_endpoints, + sync_db => $sync_db, + default_transport_url => os_transport_url({ + 'transport' => $oslomsg_rpc_proto, + 'hosts' => $oslomsg_rpc_hosts, + 'port' => sprintf('%s', $oslomsg_rpc_port), + 'username' => $oslomsg_rpc_username, + 'password' => $oslomsg_rpc_password, + 'ssl' => $oslomsg_use_ssl_real, + }), } + include ::ironic::config include ::ironic::cors } } diff --git a/manifests/profile/base/keepalived.pp b/manifests/profile/base/keepalived.pp index f2063d6..8dd03dc 100644 --- a/manifests/profile/base/keepalived.pp +++ b/manifests/profile/base/keepalived.pp @@ -27,13 +27,54 @@ # for more details. # Defaults to hiera('step') # +# [*control_virtual_interface*] +# (Optional) Interface specified for control plane network +# Defaults to hiera('tripleo::keepalived::control_virtual_interface', false) +# +# [*control_virtual_ip*] +# Virtual IP address used for control plane network +# Defaults to hiera('tripleo::keepalived::controller_virtual_ip') +# +# [*public_virtual_interface*] +# (Optional) Interface specified for public/external network +# Defaults to hiera('tripleo::keepalived::public_virtual_interface', false) +# +# [*public_virtual_ip*] +# Virtual IP address used for public/ network +# Defaults to hiera('tripleo::keepalived::public_virtual_ip') +# class tripleo::profile::base::keepalived ( - $enable_load_balancer = hiera('enable_load_balancer', true), - $step = hiera('step'), + $enable_load_balancer = hiera('enable_load_balancer', true), + $control_virtual_interface = hiera('tripleo::keepalived::control_virtual_interface', false), + $control_virtual_ip = hiera('tripleo::keepalived::controller_virtual_ip'), + $public_virtual_interface = hiera('tripleo::keepalived::public_virtual_interface', false), + $public_virtual_ip = hiera('tripleo::keepalived::public_virtual_ip'), + $step = hiera('step'), ) { if $step >= 1 { if $enable_load_balancer and hiera('enable_keepalived', true){ - include ::tripleo::keepalived + if ! $control_virtual_interface { + $control_detected_interface = interface_for_ip($control_virtual_ip) + if ! $control_detected_interface { + fail('Unable to find interface for control plane network') + } + } else { + $control_detected_interface = $control_virtual_interface + } + + if ! $public_virtual_interface { + $public_detected_interface = interface_for_ip($public_virtual_ip) + if ! $public_detected_interface { + fail('Unable to find interface for public network') + } + } else { + $public_detected_interface = $public_virtual_interface + } + + class { '::tripleo::keepalived': + control_virtual_interface => $control_detected_interface, + public_virtual_interface => $public_detected_interface, + } } } } diff --git a/manifests/profile/base/keystone.pp b/manifests/profile/base/keystone.pp index 9801eb2..994caad 100644 --- a/manifests/profile/base/keystone.pp +++ b/manifests/profile/base/keystone.pp @@ -51,6 +51,22 @@ # creates the certificates. # Defaults to hiera('generate_service_certificate', false). # +# [*heat_admin_domain*] +# domain name for heat admin +# Defaults to undef +# +# [*heat_admin_email*] +# heat admin email address +# Defaults to undef +# +# [*heat_admin_password*] +# heat admin password +# Defaults to undef +# +# [*heat_admin_user*] +# heat admin user name +# Defaults to undef +# # [*manage_db_purge*] # (Optional) Whether keystone token flushing should be enabled # Defaults to hiera('keystone_enable_db_purge', true) @@ -60,36 +76,54 @@ # This is set by t-h-t. # Defaults to hiera('keystone_public_api_network', undef) # +# [*oslomsg_rpc_proto*] +# Protocol driver for the oslo messaging rpc service +# Defaults to hiera('messaging_rpc_service_name', rabbit) # -# [*rabbit_hosts*] -# list of the rabbbit host IPs -# Defaults to hiera('rabbitmq_node_ips') +# [*oslomsg_rpc_hosts*] +# list of the oslo messaging rpc host fqdns +# Defaults to hiera('rabbitmq_node_names') # -# [*rabbit_port*] -# IP port for rabbitmq service +# [*oslomsg_rpc_port*] +# IP port for oslo messaging rpc service # Defaults to hiera('keystone::rabbit_port', 5672) # -# [*step*] -# (Optional) The current step in deployment. See tripleo-heat-templates -# for more details. -# Defaults to hiera('step') +# [*oslomsg_rpc_username*] +# Username for oslo messaging rpc service +# Defaults to hiera('keystone::rabbit_userid', 'guest') # -# [*heat_admin_domain*] -# domain name for heat admin -# Defaults to hiera('heat::keystone::domain::domain_name', 'heat') +# [*oslomsg_rpc_password*] +# Password for oslo messaging rpc service +# Defaults to hiera('keystone::rabbit_password') # -# [*heat_admin_user*] -# heat admin user name -# Defaults to hiera('heat::keystone::domain::domain_admin', 'heat_admin') +# [*oslomsg_notify_proto*] +# Protocol driver for the oslo messaging notify service +# Defaults to hiera('messaging_notify_service_name', rabbit) # -# [*heat_admin_email*] -# heat admin email address -# Defaults to hiera('heat::keystone::domain::domain_admin_email', -# 'heat_admin@localhost') +# [*oslomsg_notify_hosts*] +# list of the oslo messaging notify host fqdns +# Defaults to hiera('rabbitmq_node_names') # -# [*heat_admin_password*] -# heat admin password -# Defaults to hiera('heat::keystone::domain::domain_password') +# [*oslomsg_notify_port*] +# IP port for oslo messaging notify service +# Defaults to hiera('keystone::rabbit_port', 5672) +# +# [*oslomsg_notify_username*] +# Username for oslo messaging notify service +# Defaults to hiera('keystone::rabbit_userid', 'guest') +# +# [*oslomsg_notify_password*] +# Password for oslo messaging notify service +# Defaults to hiera('keystone::rabbit_password') +# +# [*oslomsg_use_ssl*] +# Enable ssl oslo messaging services +# Defaults to hiera('keystone::rabbit_use_ssl', '0') +# +# [*step*] +# (Optional) The current step in deployment. See tripleo-heat-templates +# for more details. +# Defaults to hiera('step') # class tripleo::profile::base::keystone ( $admin_endpoint_network = hiera('keystone_admin_api_network', undef), @@ -97,15 +131,24 @@ class tripleo::profile::base::keystone ( $certificates_specs = hiera('apache_certificates_specs', {}), $enable_internal_tls = hiera('enable_internal_tls', false), $generate_service_certificates = hiera('generate_service_certificates', false), + $heat_admin_domain = undef, + $heat_admin_email = undef, + $heat_admin_password = undef, + $heat_admin_user = undef, $manage_db_purge = hiera('keystone_enable_db_purge', true), $public_endpoint_network = hiera('keystone_public_api_network', undef), - $rabbit_hosts = hiera('rabbitmq_node_ips', undef), - $rabbit_port = hiera('keystone::rabbit_port', 5672), + $oslomsg_rpc_proto = hiera('messaging_rpc_service_name', 'rabbit'), + $oslomsg_rpc_hosts = any2array(hiera('rabbitmq_node_names', undef)), + $oslomsg_rpc_password = hiera('keystone::rabbit_password'), + $oslomsg_rpc_port = hiera('keystone::rabbit_port', '5672'), + $oslomsg_rpc_username = hiera('keystone::rabbit_userid', 'guest'), + $oslomsg_notify_proto = hiera('messaging_notify_service_name', 'rabbit'), + $oslomsg_notify_hosts = any2array(hiera('rabbitmq_node_names', undef)), + $oslomsg_notify_password = hiera('keystone::rabbit_password'), + $oslomsg_notify_port = hiera('keystone::rabbit_port', '5672'), + $oslomsg_notify_username = hiera('keystone::rabbit_userid', 'guest'), + $oslomsg_use_ssl = hiera('keystone::rabbit_use_ssl', '0'), $step = hiera('step'), - $heat_admin_domain = hiera('heat::keystone::domain::domain_name', 'heat'), - $heat_admin_user = hiera('heat::keystone::domain::domain_admin', 'heat_admin'), - $heat_admin_email = hiera('heat::keystone::domain::domain_admin_email', 'heat_admin@localhost'), - $heat_admin_password = hiera('heat::keystone::domain::domain_password'), ) { if $::hostname == downcase($bootstrap_node) { $sync_db = true @@ -143,11 +186,26 @@ class tripleo::profile::base::keystone ( } if $step >= 4 or ( $step >= 3 and $sync_db ) { - $rabbit_endpoints = suffix(any2array(normalize_ip_for_uri($rabbit_hosts)), ":${rabbit_port}") + $oslomsg_use_ssl_real = sprintf('%s', bool2num(str2bool($oslomsg_use_ssl))) class { '::keystone': - sync_db => $sync_db, - enable_bootstrap => $sync_db, - rabbit_hosts => $rabbit_endpoints, + sync_db => $sync_db, + enable_bootstrap => $sync_db, + default_transport_url => os_transport_url({ + 'transport' => $oslomsg_rpc_proto, + 'hosts' => $oslomsg_rpc_hosts, + 'port' => sprintf('%s', $oslomsg_rpc_port), + 'username' => $oslomsg_rpc_username, + 'password' => $oslomsg_rpc_password, + 'ssl' => $oslomsg_use_ssl_real, + }), + notification_transport_url => os_transport_url({ + 'transport' => $oslomsg_notify_proto, + 'hosts' => $oslomsg_notify_hosts, + 'port' => sprintf('%s', $oslomsg_notify_port), + 'username' => $oslomsg_notify_username, + 'password' => $oslomsg_notify_password, + 'ssl' => $oslomsg_use_ssl_real, + }), } include ::keystone::config @@ -158,22 +216,13 @@ class tripleo::profile::base::keystone ( ssl_key_admin => $tls_keyfile_admin, } include ::keystone::cors - - if $manage_roles { - include ::keystone::roles::admin - } - - if $manage_endpoint { - include ::keystone::endpoint - } - } - if $step >= 5 and $manage_db_purge { + if $step >= 4 and $manage_db_purge { include ::keystone::cron::token_flush } - if $step >= 5 and $manage_domain { + if $step == 3 and $manage_domain { if hiera('heat_engine_enabled', false) { # create these seperate and don't use ::heat::keystone::domain since # that class writes out the configs @@ -194,7 +243,12 @@ class tripleo::profile::base::keystone ( } } - if $step >= 5 and $manage_endpoint{ + if $step == 3 and $manage_roles { + include ::keystone::roles::admin + } + + if $step == 3 and $manage_endpoint { + include ::keystone::endpoint if hiera('aodh_api_enabled', false) { include ::aodh::keystone::auth } @@ -210,6 +264,9 @@ class tripleo::profile::base::keystone ( if hiera('cinder_api_enabled', false) { include ::cinder::keystone::auth } + if hiera('congress_enabled', false) { + include ::congress::keystone::auth + } if hiera('glance_api_enabled', false) { include ::glance::keystone::auth } @@ -237,12 +294,21 @@ class tripleo::profile::base::keystone ( if hiera('nova_api_enabled', false) { include ::nova::keystone::auth } + if hiera('nova_placement_enabled', false) { + include ::nova::keystone::auth_placement + } + if hiera('panko_api_enabled', false) { + include ::panko::keystone::auth + } if hiera('sahara_api_enabled', false) { include ::sahara::keystone::auth } if hiera('swift_proxy_enabled', false) { include ::swift::keystone::auth } + if hiera('tacker_enabled', false) { + include ::tacker::keystone::auth + } if hiera('trove_api_enabled', false) { include ::trove::keystone::auth } @@ -250,6 +316,8 @@ class tripleo::profile::base::keystone ( include ::zaqar::keystone::auth include ::zaqar::keystone::auth_websocket } + if hiera('ec2_api_enabled', false) { + include ::ec2api::keystone::auth + } } } - diff --git a/manifests/profile/base/manila.pp b/manifests/profile/base/manila.pp index 3e16dff..87179ab 100644 --- a/manifests/profile/base/manila.pp +++ b/manifests/profile/base/manila.pp @@ -26,19 +26,64 @@ # (Optional) The current step of the deployment # Defaults to hiera('step') # -# [*rabbit_hosts*] -# list of the rabbbit host IPs -# Defaults to hiera('rabbitmq_node_ips') +# [*oslomsg_rpc_proto*] +# Protocol driver for the oslo messaging rpc service +# Defaults to hiera('messaging_rpc_service_name', rabbit) # -# [*rabbit_port*] -# IP port for rabbitmq service +# [*oslomsg_rpc_hosts*] +# list of the oslo messaging rpc host fqdns +# Defaults to hiera('rabbitmq_node_names') +# +# [*oslomsg_rpc_port*] +# IP port for oslo messaging rpc service +# Defaults to hiera('manila::rabbit_port', 5672) +# +# [*oslomsg_rpc_username*] +# Username for oslo messaging rpc service +# Defaults to hiera('manila::rabbit_userid', 'guest') +# +# [*oslomsg_rpc_password*] +# Password for oslo messaging rpc service +# Defaults to hiera('manila::rabbit_password') +# +# [*oslomsg_notify_proto*] +# Protocol driver for the oslo messaging notify service +# Defaults to hiera('messaging_notify_service_name', rabbit) +# +# [*oslomsg_notify_hosts*] +# list of the oslo messaging notify host fqdns +# Defaults to hiera('rabbitmq_node_names') +# +# [*oslomsg_notify_port*] +# IP port for oslo messaging notify service # Defaults to hiera('manila::rabbit_port', 5672) +# +# [*oslomsg_notify_username*] +# Username for oslo messaging notify service +# Defaults to hiera('manila::rabbit_userid', 'guest') +# +# [*oslomsg_notify_password*] +# Password for oslo messaging notify service +# Defaults to hiera('manila::rabbit_password') +# +# [*oslomsg_use_ssl*] +# Enable ssl oslo messaging services +# Defaults to hiera('manila::rabbit_use_ssl', '0') class tripleo::profile::base::manila ( - $bootstrap_node = hiera('bootstrap_nodeid', undef), - $step = hiera('step'), - $rabbit_hosts = hiera('rabbitmq_node_ips', undef), - $rabbit_port = hiera('manila::rabbit_port', 5672), + $bootstrap_node = hiera('bootstrap_nodeid', undef), + $step = hiera('step'), + $oslomsg_rpc_proto = hiera('messaging_rpc_service_name', 'rabbit'), + $oslomsg_rpc_hosts = any2array(hiera('rabbitmq_node_names', undef)), + $oslomsg_rpc_password = hiera('manila::rabbit_password'), + $oslomsg_rpc_port = hiera('manila::rabbit_port', '5672'), + $oslomsg_rpc_username = hiera('manila::rabbit_userid', 'guest'), + $oslomsg_notify_proto = hiera('messaging_notify_service_name', 'rabbit'), + $oslomsg_notify_hosts = any2array(hiera('rabbitmq_node_names', undef)), + $oslomsg_notify_password = hiera('manila::rabbit_password'), + $oslomsg_notify_port = hiera('manila::rabbit_port', '5672'), + $oslomsg_notify_username = hiera('manila::rabbit_userid', 'guest'), + $oslomsg_use_ssl = hiera('manila::rabbit_use_ssl', '0'), ) { if $::hostname == downcase($bootstrap_node) { $sync_db = true @@ -47,9 +92,24 @@ class tripleo::profile::base::manila ( } if $step >= 4 or ($step >= 3 and $sync_db) { - $rabbit_endpoints = suffix(any2array(normalize_ip_for_uri($rabbit_hosts)), ":${rabbit_port}") + $oslomsg_use_ssl_real = sprintf('%s', bool2num(str2bool($oslomsg_use_ssl))) class { '::manila' : - rabbit_hosts => $rabbit_endpoints, + default_transport_url => os_transport_url({ + 'transport' => $oslomsg_rpc_proto, + 'hosts' => $oslomsg_rpc_hosts, + 'port' => sprintf('%s', $oslomsg_rpc_port), + 'username' => $oslomsg_rpc_username, + 'password' => $oslomsg_rpc_password, + 'ssl' => $oslomsg_use_ssl_real, + }), + notification_transport_url => os_transport_url({ + 'transport' => $oslomsg_notify_proto, + 'hosts' => $oslomsg_notify_hosts, + 'port' => sprintf('%s', $oslomsg_notify_port), + 'username' => $oslomsg_notify_username, + 'password' => $oslomsg_notify_password, + 'ssl' => $oslomsg_use_ssl_real, + }), } include ::manila::config } diff --git a/manifests/profile/base/metrics/collectd.pp b/manifests/profile/base/metrics/collectd.pp new file mode 100644 index 0000000..d8e6f89 --- /dev/null +++ b/manifests/profile/base/metrics/collectd.pp @@ -0,0 +1,103 @@ +# Copyright 2016 Red Hat, Inc. +# +# Licensed under the Apache License, Version 2.0 (the "License"); you may +# not use this file except in compliance with the License. You may obtain +# a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT +# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the +# License for the specific language governing permissions and limitations +# under the License. +# +# == Class: tripleo::profile::base::metrics::collectd +# +# Collectd configuration for TripleO +# +# === Parameters +# +# [*step*] +# (Optional) The current step in deployment. See tripleo-heat-templates +# for more details. +# Defaults to hiera('step') +# +# [*collectd_server*] +# (Optional) String. The name or address of a collectd server to +# which we should send metrics. +# +# [*collectd_port*] +# (Optional) Integer. The port to which we will connect on the +# collectd server. +# +# [*collectd_username*] +# (Optional) String. Username for authenticating to the remote +# collectd server. +# +# [*collectd_password*] +# (Optional) String. Password for authenticating to the remote +# collectd server. +# +# [*collectd_securitylevel*] +# (Optional) String. +# +# [*service_names*] +# (Optional) List of strings. A list of active services in this tripleo +# deployment. This is used to look up service-specific plugins that +# need to be installed. +class tripleo::profile::base::metrics::collectd ( + $step = hiera('step'), + + $collectd_server = undef, + $collectd_port = undef, + $collectd_username = undef, + $collectd_password = undef, + $collectd_securitylevel = undef, + $service_names = hiera('service_names', []) +) { + if $step >= 3 { + include ::collectd + + if ! ($collectd_securitylevel in [undef, 'None', 'Sign', 'Encrypt']) { + fail('collectd_securitylevel must be one of (None, Sign, Encrypt).') + } + + # Load per-service plugin configuration + ::tripleo::profile::base::metrics::collectd::collectd_service { + $service_names: } + + # Because THT doesn't allow us to default values to undef, we need + # to perform a number of transformations here to avoid passing a bunch of + # empty strings to the collectd plugins. + + $_collectd_username = empty($collectd_username) ? { + true => undef, + default => $collectd_username + } + + $_collectd_password = empty($collectd_password) ? { + true => undef, + default => $collectd_password + } + + $_collectd_port = empty($collectd_port) ? { + true => undef, + default => $collectd_port + } + + $_collectd_securitylevel = empty($collectd_securitylevel) ? { + true => undef, + default => $collectd_securitylevel + } + + if ! empty($collectd_server) { + ::collectd::plugin::network::server { $collectd_server: + username => $_collectd_username, + password => $_collectd_password, + port => $_collectd_port, + securitylevel => $_collectd_securitylevel, + } + } + } +} diff --git a/manifests/profile/base/metrics/collectd/collectd_plugin.pp b/manifests/profile/base/metrics/collectd/collectd_plugin.pp new file mode 100644 index 0000000..5ab940b --- /dev/null +++ b/manifests/profile/base/metrics/collectd/collectd_plugin.pp @@ -0,0 +1,6 @@ +# We use this to transform a list of unqualified plugin names +# (like ['disk', 'ntpd']) into the correct collectd plugin classes. +define tripleo::profile::base::metrics::collectd::collectd_plugin ( +) { + include "collectd::plugin::${title}" +} diff --git a/manifests/profile/base/metrics/collectd/collectd_service.pp b/manifests/profile/base/metrics/collectd/collectd_service.pp new file mode 100644 index 0000000..c1b3a60 --- /dev/null +++ b/manifests/profile/base/metrics/collectd/collectd_service.pp @@ -0,0 +1,11 @@ +# This is used to look up a list of service-specific collectd plugins +# in the hiera data provided by THT. +define tripleo::profile::base::metrics::collectd::collectd_service ( +) { + $plugins = hiera("tripleo.collectd.plugins.${title}", []) + + if $plugins { + ::tripleo::profile::base::metrics::collectd::collectd_plugin { + $plugins: } + } +} diff --git a/manifests/profile/base/metrics/collectd/plugin_helper.pp b/manifests/profile/base/metrics/collectd/plugin_helper.pp new file mode 100644 index 0000000..b624ee1 --- /dev/null +++ b/manifests/profile/base/metrics/collectd/plugin_helper.pp @@ -0,0 +1,6 @@ +# We use this to transform a list of unqualified plugin names +# (like ['disk', 'ntpd']) into the correct collectd plugin classes. +define tripleo::profile::base::metrics::collectd::plugin_helper ( +) { + include "collectd::plugin::${title}" +} diff --git a/manifests/profile/base/mistral.pp b/manifests/profile/base/mistral.pp index 3da754c..05773ac 100644 --- a/manifests/profile/base/mistral.pp +++ b/manifests/profile/base/mistral.pp @@ -27,19 +27,64 @@ # for more details. # Defaults to hiera('step') # -# [*rabbit_hosts*] -# list of the rabbbit host IPs -# Defaults to hiera('rabbitmq_node_ips') +# [*oslomsg_rpc_proto*] +# Protocol driver for the oslo messaging rpc service +# Defaults to hiera('messaging_rpc_service_name', rabbit) # -# [*rabbit_port*] -# IP port for rabbitmq service +# [*oslomsg_rpc_hosts*] +# list of the oslo messaging rpc host fqdns +# Defaults to hiera('rabbitmq_node_names') +# +# [*oslomsg_rpc_port*] +# IP port for oslo messaging rpc service +# Defaults to hiera('mistral::rabbit_port', 5672) +# +# [*oslomsg_rpc_username*] +# Username for oslo messaging rpc service +# Defaults to hiera('mistral::rabbit_userid', 'guest') +# +# [*oslomsg_rpc_password*] +# Password for oslo messaging rpc service +# Defaults to hiera('mistral::rabbit_password') +# +# [*oslomsg_notify_proto*] +# Protocol driver for the oslo messaging notify service +# Defaults to hiera('messaging_notify_service_name', rabbit) +# +# [*oslomsg_notify_hosts*] +# list of the oslo messaging notify host fqdns +# Defaults to hiera('rabbitmq_node_names') +# +# [*oslomsg_notify_port*] +# IP port for oslo messaging notify service # Defaults to hiera('mistral::rabbit_port', 5672) +# +# [*oslomsg_notify_username*] +# Username for oslo messaging notify service +# Defaults to hiera('mistral::rabbit_userid', 'guest') +# +# [*oslomsg_notify_password*] +# Password for oslo messaging notify service +# Defaults to hiera('mistral::rabbit_password') +# +# [*oslomsg_use_ssl*] +# Enable ssl oslo messaging services +# Defaults to hiera('mistral::rabbit_use_ssl', '0') class tripleo::profile::base::mistral ( - $bootstrap_node = hiera('bootstrap_nodeid', undef), - $step = hiera('step'), - $rabbit_hosts = hiera('rabbitmq_node_ips', undef), - $rabbit_port = hiera('mistral::rabbit_port', 5672), + $bootstrap_node = hiera('bootstrap_nodeid', undef), + $step = hiera('step'), + $oslomsg_rpc_proto = hiera('messaging_rpc_service_name', 'rabbit'), + $oslomsg_rpc_hosts = any2array(hiera('rabbitmq_node_names', undef)), + $oslomsg_rpc_password = hiera('mistral::rabbit_password'), + $oslomsg_rpc_port = hiera('mistral::rabbit_port', '5672'), + $oslomsg_rpc_username = hiera('mistral::rabbit_userid', 'guest'), + $oslomsg_notify_proto = hiera('messaging_notify_service_name', 'rabbit'), + $oslomsg_notify_hosts = any2array(hiera('rabbitmq_node_names', undef)), + $oslomsg_notify_password = hiera('mistral::rabbit_password'), + $oslomsg_notify_port = hiera('mistral::rabbit_port', '5672'), + $oslomsg_notify_username = hiera('mistral::rabbit_userid', 'guest'), + $oslomsg_use_ssl = hiera('mistral::rabbit_use_ssl', '0'), ) { if $::hostname == downcase($bootstrap_node) { $sync_db = true @@ -48,9 +93,24 @@ class tripleo::profile::base::mistral ( } if $step >= 4 or ($step >= 3 and $sync_db) { - $rabbit_endpoints = suffix(any2array(normalize_ip_for_uri($rabbit_hosts)), ":${rabbit_port}") + $oslomsg_use_ssl_real = sprintf('%s', bool2num(str2bool($oslomsg_use_ssl))) class { '::mistral': - rabbit_hosts => $rabbit_endpoints, + default_transport_url => os_transport_url({ + 'transport' => $oslomsg_rpc_proto, + 'hosts' => $oslomsg_rpc_hosts, + 'port' => sprintf('%s', $oslomsg_rpc_port), + 'username' => $oslomsg_rpc_username, + 'password' => $oslomsg_rpc_password, + 'ssl' => $oslomsg_use_ssl_real, + }), + notification_transport_url => os_transport_url({ + 'transport' => $oslomsg_notify_proto, + 'hosts' => $oslomsg_notify_hosts, + 'port' => sprintf('%s', $oslomsg_notify_port), + 'username' => $oslomsg_notify_username, + 'password' => $oslomsg_notify_password, + 'ssl' => $oslomsg_use_ssl_real, + }), } include ::mistral::config include ::mistral::client diff --git a/manifests/profile/base/neutron.pp b/manifests/profile/base/neutron.pp index 64f5f32..271003e 100644 --- a/manifests/profile/base/neutron.pp +++ b/manifests/profile/base/neutron.pp @@ -22,23 +22,83 @@ # (Optional) The current step of the deployment # Defaults to hiera('step') # -# [*rabbit_hosts*] -# list of the rabbbit host IPs -# Defaults to hiera('rabbitmq_node_ips') +# [*oslomsg_rpc_proto*] +# Protocol driver for the oslo messaging rpc service +# Defaults to hiera('messaging_rpc_service_name', rabbit) # -# [*rabbit_port*] -# IP port for rabbitmq service -# Defaults to hiera('neutron::rabbit_port', 5672 +# [*oslomsg_rpc_hosts*] +# list of the oslo messaging rpc host fqdns +# Defaults to hiera('rabbitmq_node_names') +# +# [*oslomsg_rpc_port*] +# IP port for oslo messaging rpc service +# Defaults to hiera('neutron::rabbit_port', 5672) +# +# [*oslomsg_rpc_username*] +# Username for oslo messaging rpc service +# Defaults to hiera('neutron::rabbit_userid', 'guest') +# +# [*oslomsg_rpc_password*] +# Password for oslo messaging rpc service +# Defaults to hiera('neutron::rabbit_password') +# +# [*oslomsg_notify_proto*] +# Protocol driver for the oslo messaging notify service +# Defaults to hiera('messaging_notify_service_name', rabbit) +# +# [*oslomsg_notify_hosts*] +# list of the oslo messaging notify host fqdns +# Defaults to hiera('rabbitmq_node_names') +# +# [*oslomsg_notify_port*] +# IP port for oslo messaging notify service +# Defaults to hiera('neutron::rabbit_port', 5672) +# +# [*oslomsg_notify_username*] +# Username for oslo messaging notify service +# Defaults to hiera('neutron::rabbit_userid', 'guest') +# +# [*oslomsg_notify_password*] +# Password for oslo messaging notify service +# Defaults to hiera('neutron::rabbit_password') +# +# [*oslomsg_use_ssl*] +# Enable ssl oslo messaging services +# Defaults to hiera('neutron::rabbit_use_ssl', '0') class tripleo::profile::base::neutron ( - $step = hiera('step'), - $rabbit_hosts = hiera('rabbitmq_node_ips', undef), - $rabbit_port = hiera('neutron::rabbit_port', 5672), + $step = hiera('step'), + $oslomsg_rpc_proto = hiera('messaging_rpc_service_name', 'rabbit'), + $oslomsg_rpc_hosts = any2array(hiera('rabbitmq_node_names', undef)), + $oslomsg_rpc_password = hiera('neutron::rabbit_password'), + $oslomsg_rpc_port = hiera('neutron::rabbit_port', '5672'), + $oslomsg_rpc_username = hiera('neutron::rabbit_userid', 'guest'), + $oslomsg_notify_proto = hiera('messaging_notify_service_name', 'rabbit'), + $oslomsg_notify_hosts = any2array(hiera('rabbitmq_node_names', undef)), + $oslomsg_notify_password = hiera('neutron::rabbit_password'), + $oslomsg_notify_port = hiera('neutron::rabbit_port', '5672'), + $oslomsg_notify_username = hiera('neutron::rabbit_userid', 'guest'), + $oslomsg_use_ssl = hiera('neutron::rabbit_use_ssl', '0'), ) { if $step >= 3 { - $rabbit_endpoints = suffix(any2array(normalize_ip_for_uri($rabbit_hosts)), ":${rabbit_port}") + $oslomsg_use_ssl_real = sprintf('%s', bool2num(str2bool($oslomsg_use_ssl))) class { '::neutron' : - rabbit_hosts => $rabbit_endpoints, + default_transport_url => os_transport_url({ + 'transport' => $oslomsg_rpc_proto, + 'hosts' => $oslomsg_rpc_hosts, + 'port' => sprintf('%s', $oslomsg_rpc_port), + 'username' => $oslomsg_rpc_username, + 'password' => $oslomsg_rpc_password, + 'ssl' => $oslomsg_use_ssl_real, + }), + notification_transport_url => os_transport_url({ + 'transport' => $oslomsg_notify_proto, + 'hosts' => $oslomsg_notify_hosts, + 'port' => sprintf('%s', $oslomsg_notify_port), + 'username' => $oslomsg_notify_username, + 'password' => $oslomsg_notify_password, + 'ssl' => $oslomsg_use_ssl_real, + }), } include ::neutron::config } diff --git a/manifests/profile/base/neutron/agents/ovn.pp b/manifests/profile/base/neutron/agents/ovn.pp index 443b164..a593092 100644 --- a/manifests/profile/base/neutron/agents/ovn.pp +++ b/manifests/profile/base/neutron/agents/ovn.pp @@ -17,7 +17,12 @@ # OVN Neutron agent profile for tripleo # # [*ovn_db_host*] -# The IP-Address/Hostname where OVN DBs are deployed +# (Optional) The IP-Address where OVN DBs are listening. +# Defaults to hiera('ovn_dbs_vip') +# +# [*ovn_sbdb_port*] +# (Optional) Port number on which southbound database is listening +# Defaults to hiera('ovn::southbound::port') # # [*step*] # (Optional) The current step in deployment. See tripleo-heat-templates @@ -25,14 +30,13 @@ # Defaults to hiera('step') # class tripleo::profile::base::neutron::agents::ovn ( - $ovn_db_host, - $step = hiera('step') + $ovn_db_host = hiera('ovn_dbs_vip'), + $ovn_sbdb_port = hiera('ovn::southbound::port'), + $step = hiera('step') ) { if $step >= 4 { - $ovn_sbdb_port = hiera('ovn::southbound::port') class { '::ovn::controller': ovn_remote => "tcp:${ovn_db_host}:${ovn_sbdb_port}", - ovn_encap_type => hiera('ovn::southboud::encap_type') } } } diff --git a/manifests/profile/base/neutron/opendaylight.pp b/manifests/profile/base/neutron/opendaylight.pp index a3f46ec..556fe63 100644 --- a/manifests/profile/base/neutron/opendaylight.pp +++ b/manifests/profile/base/neutron/opendaylight.pp @@ -22,24 +22,19 @@ # (Optional) The current step of the deployment # Defaults to hiera('step') # -# [*primary_controller*] -# (Optional) The hostname of the first controller +# [*primary_node*] +# (Optional) The hostname of the first node of this role type # Defaults to hiera('bootstrap_nodeid', undef) # class tripleo::profile::base::neutron::opendaylight ( - $step = hiera('step'), - $primary_controller = hiera('bootstrap_nodeid', undef), + $step = hiera('step'), + $primary_node = hiera('bootstrap_nodeid', undef), ) { - include ::tripleo::profile::base::neutron - - if ! str2bool(hiera('opendaylight::enable_l3')) { - include ::tripleo::profile::base::neutron::l3 - } - if $step >= 1 { - # Configure ODL only on first controller - if $primary_controller == downcase($::hostname) { + # Configure ODL only on first node of the role where this service is + # applied + if $primary_node == downcase($::hostname) { include ::opendaylight } } diff --git a/manifests/profile/base/neutron/ovn_northd.pp b/manifests/profile/base/neutron/ovn_northd.pp new file mode 100644 index 0000000..0b46d5c --- /dev/null +++ b/manifests/profile/base/neutron/ovn_northd.pp @@ -0,0 +1,40 @@ +# Copyright 2016 Red Hat, Inc. +# +# Licensed under the Apache License, Version 2.0 (the "License"); you may +# not use this file except in compliance with the License. You may obtain +# a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT +# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the +# License for the specific language governing permissions and limitations +# under the License. +# +# == Class: tripleo::profile::base::neutron::plugins::ml2::ovn +# +# OVN Neutron northd profile for tripleo +# +# [*bootstrap_node*] +# (Optional) The hostname of the node responsible for bootstrapping tasks +# Defaults to hiera('bootstrap_nodeid') +# +# [*step*] +# (Optional) The current step in deployment. See tripleo-heat-templates +# for more details. +# Defaults to hiera('step') +# +class tripleo::profile::base::neutron::ovn_northd ( + $bootstrap_node = hiera('bootstrap_nodeid', undef), + $step = hiera('step'), +) { + if $step >= 4 { + # Note this only runs on the first node in the cluster when + # deployed on a role where multiple nodes exist. + if $::hostname == downcase($bootstrap_node) { + include ::ovn::northd + } + } +} + diff --git a/manifests/profile/base/neutron/ovs.pp b/manifests/profile/base/neutron/ovs.pp index a4e0cd3..bec7e96 100644 --- a/manifests/profile/base/neutron/ovs.pp +++ b/manifests/profile/base/neutron/ovs.pp @@ -28,7 +28,7 @@ class tripleo::profile::base::neutron::ovs( ) { include ::tripleo::profile::base::neutron - if $step >= 4 { + if $step >= 5 { include ::neutron::agents::ml2::ovs # Optional since manage_service may be false and neutron server may not be colocated. diff --git a/manifests/profile/base/neutron/plugins/ml2.pp b/manifests/profile/base/neutron/plugins/ml2.pp index 4f4de0b..52d4ca1 100644 --- a/manifests/profile/base/neutron/plugins/ml2.pp +++ b/manifests/profile/base/neutron/plugins/ml2.pp @@ -64,12 +64,22 @@ class tripleo::profile::base::neutron::plugins::ml2 ( include ::neutron::plugins::ml2::bigswitch::restproxy } - if 'opendaylight' in $mechanism_drivers { + if ('opendaylight' in $mechanism_drivers) or ('opendaylight_v2' in $mechanism_drivers) { include ::tripleo::profile::base::neutron::plugins::ml2::opendaylight } if 'ovn' in $mechanism_drivers { include ::tripleo::profile::base::neutron::plugins::ml2::ovn } + + if 'fujitsu_cfab' in $mechanism_drivers { + include ::neutron::plugins::ml2::fujitsu + include ::neutron::plugins::ml2::fujitsu::cfab + } + + if 'fujitsu_fossw' in $mechanism_drivers { + include ::neutron::plugins::ml2::fujitsu + include ::neutron::plugins::ml2::fujitsu::fossw + } } } diff --git a/manifests/profile/base/neutron/plugins/ml2/ovn.pp b/manifests/profile/base/neutron/plugins/ml2/ovn.pp index 46477a7..b5b7a0a 100644 --- a/manifests/profile/base/neutron/plugins/ml2/ovn.pp +++ b/manifests/profile/base/neutron/plugins/ml2/ovn.pp @@ -17,7 +17,16 @@ # OVN Neutron ML2 profile for tripleo # # [*ovn_db_host*] -# The IP-Address/Hostname where OVN DBs are deployed +# The IP-Address where OVN DBs are listening. +# Defaults to hiera('ovn_dbs_vip') +# +# [*ovn_nb_port*] +# (Optional) Port number on which northbound database is listening +# Defaults to hiera('ovn::northbound::port') +# +# [*ovn_sb_port*] +# (Optional) Port number on which southbound database is listening +# Defaults to hiera('ovn::southbound::port') # # [*step*] # (Optional) The current step in deployment. See tripleo-heat-templates @@ -25,18 +34,12 @@ # Defaults to hiera('step') # class tripleo::profile::base::neutron::plugins::ml2::ovn ( - $ovn_db_host, - $step = hiera('step') + $ovn_db_host = hiera('ovn_dbs_vip'), + $ovn_nb_port = hiera('ovn::northbound::port'), + $ovn_sb_port = hiera('ovn::southbound::port'), + $step = hiera('step') ) { if $step >= 4 { - if $::hostname == $ovn_db_host { - # NOTE: we might split northd from plugin later, in the case of - # micro-services, where neutron-server & northd are not in the same - # containers - include ::ovn::northd - } - $ovn_nb_port = hiera('ovn::northbound::port') - $ovn_sb_port = hiera('ovn::southbound::port') class { '::neutron::plugins::ml2::ovn': ovn_nb_connection => "tcp:${ovn_db_host}:${ovn_nb_port}", ovn_sb_connection => "tcp:${ovn_db_host}:${ovn_sb_port}", diff --git a/manifests/profile/base/neutron/server.pp b/manifests/profile/base/neutron/server.pp index 82c2d5f..5d6909f 100644 --- a/manifests/profile/base/neutron/server.pp +++ b/manifests/profile/base/neutron/server.pp @@ -22,15 +22,92 @@ # (Optional) The hostname of the node responsible for bootstrapping tasks # Defaults to hiera('bootstrap_nodeid') # +# [*certificates_specs*] +# (Optional) The specifications to give to certmonger for the certificate(s) +# it will create. +# Example with hiera: +# apache_certificates_specs: +# httpd-internal_api: +# hostname: <overcloud controller fqdn> +# service_certificate: <service certificate path> +# service_key: <service key path> +# principal: "haproxy/<overcloud controller fqdn>" +# Defaults to hiera('apache_certificate_specs', {}). +# +# [*dvr_enabled*] +# (Optional) Is dvr enabled, used when no override is passed to +# l3_ha_override to calculate enabling l3 HA. +# Defaults to hiera('neutron::server::router_distributed') or false +# +# [*enable_internal_tls*] +# (Optional) Whether TLS in the internal network is enabled or not. +# Defaults to hiera('enable_internal_tls', false) +# +# [*generate_service_certificates*] +# (Optional) Whether or not certmonger will generate certificates for +# HAProxy. This could be as many as specified by the $certificates_specs +# variable. +# Note that this doesn't configure the certificates in haproxy, it merely +# creates the certificates. +# Defaults to hiera('generate_service_certificate', false). +# +# [*l3_ha_override*] +# (Optional) Override the calculated value for neutron::server::l3_ha +# by default this is calculated to enable when DVR is not enabled +# and the number of nodes running neutron api is more than one. +# Defaults to '' which aligns with the t-h-t default, and means use +# the calculated value. Other possible values are 'true' or 'false' +# +# [*l3_nodes*] +# (Optional) List of nodes running the l3 agent, used when no override +# is passed to l3_ha_override to calculate enabling l3 HA. +# Defaults to hiera('neutron_l3_short_node_names') or [] +# (we need to default neutron_l3_short_node_names to an empty list +# because some neutron backends disable the l3 agent) +# +# [*neutron_network*] +# (Optional) The network name where the neutron endpoint is listening on. +# This is set by t-h-t. +# Defaults to hiera('neutron_api_network', undef) +# # [*step*] # (Optional) The current step in deployment. See tripleo-heat-templates # for more details. # Defaults to hiera('step') # +# [*tls_proxy_bind_ip*] +# IP on which the TLS proxy will listen on. Required only if +# enable_internal_tls is set. +# Defaults to undef +# +# [*tls_proxy_fqdn*] +# fqdn on which the tls proxy will listen on. required only used if +# enable_internal_tls is set. +# defaults to undef +# +# [*tls_proxy_port*] +# port on which the tls proxy will listen on. Only used if +# enable_internal_tls is set. +# defaults to 9696 +# class tripleo::profile::base::neutron::server ( - $bootstrap_node = hiera('bootstrap_nodeid', undef), - $step = hiera('step'), + $bootstrap_node = hiera('bootstrap_nodeid', undef), + $certificates_specs = hiera('apache_certificates_specs', {}), + $dvr_enabled = hiera('neutron::server::router_distributed', false), + $enable_internal_tls = hiera('enable_internal_tls', false), + $generate_service_certificates = hiera('generate_service_certificates', false), + $l3_ha_override = '', + $l3_nodes = hiera('neutron_l3_short_node_names', []), + $neutron_network = hiera('neutron_api_network', undef), + $step = hiera('step'), + $tls_proxy_bind_ip = undef, + $tls_proxy_fqdn = undef, + $tls_proxy_port = 9696, ) { + if $enable_internal_tls and $generate_service_certificates { + ensure_resources('tripleo::certmonger::httpd', $certificates_specs) + } + if $::hostname == downcase($bootstrap_node) { $sync_db = true } else { @@ -39,21 +116,43 @@ class tripleo::profile::base::neutron::server ( include ::tripleo::profile::base::neutron + # Calculate neutron::server::l3_ha based on the number of API nodes + # combined with if DVR is enabled. + if $l3_ha_override != '' { + $l3_ha = str2bool($l3_ha_override) + } elsif ! str2bool($dvr_enabled) { + $l3_ha = size($l3_nodes) > 1 + } else { + $l3_ha = false + } + # We start neutron-server on the bootstrap node first, because # it will try to populate tables and we need to make sure this happens # before it starts on other nodes - if $step >= 4 and $sync_db { + if $step >= 4 and $sync_db or $step >= 5 and !$sync_db { + if $enable_internal_tls { + if !$neutron_network { + fail('neutron_api_network is not set in the hieradata.') + } + $tls_certfile = $certificates_specs["httpd-${neutron_network}"]['service_certificate'] + $tls_keyfile = $certificates_specs["httpd-${neutron_network}"]['service_key'] + + ::tripleo::tls_proxy { 'neutron-api': + servername => $tls_proxy_fqdn, + ip => $tls_proxy_bind_ip, + port => $tls_proxy_port, + tls_cert => $tls_certfile, + tls_key => $tls_keyfile, + notify => Class['::neutron::server'], + } + } + include ::neutron::server::notifications # We need to override the hiera value neutron::server::sync_db which is set # to true class { '::neutron::server': sync_db => $sync_db, - } - } - if $step >= 5 and !$sync_db { - include ::neutron::server::notifications - class { '::neutron::server': - sync_db => $sync_db, + l3_ha => $l3_ha, } } } diff --git a/manifests/profile/base/nova.pp b/manifests/profile/base/nova.pp index 4626465..7daed83 100644 --- a/manifests/profile/base/nova.pp +++ b/manifests/profile/base/nova.pp @@ -30,6 +30,50 @@ # (Optional) Whether or not manage Nova Live migration # Defaults to false # +# [*oslomsg_rpc_proto*] +# Protocol driver for the oslo messaging rpc service +# Defaults to hiera('messaging_rpc_service_name', rabbit) +# +# [*oslomsg_rpc_hosts*] +# list of the oslo messaging rpc host fqdns +# Defaults to hiera('rabbitmq_node_names') +# +# [*oslomsg_rpc_port*] +# IP port for oslo messaging rpc service +# Defaults to hiera('nova::rabbit_port', 5672) +# +# [*oslomsg_rpc_username*] +# Username for oslo messaging rpc service +# Defaults to hiera('nova::rabbit_userid', 'guest') +# +# [*oslomsg_rpc_password*] +# Password for oslo messaging rpc service +# Defaults to hiera('nova::rabbit_password') +# +# [*oslomsg_notify_proto*] +# Protocol driver for the oslo messaging notify service +# Defaults to hiera('messaging_notify_service_name', rabbit) +# +# [*oslomsg_notify_hosts*] +# list of the oslo messaging notify host fqdns +# Defaults to hiera('rabbitmq_node_names') +# +# [*oslomsg_notify_port*] +# IP port for oslo messaging notify service +# Defaults to hiera('nova::rabbit_port', 5672) +# +# [*oslomsg_notify_username*] +# Username for oslo messaging notify service +# Defaults to hiera('nova::rabbit_userid', 'guest') +# +# [*oslomsg_notify_password*] +# Password for oslo messaging notify service +# Defaults to hiera('nova::rabbit_password') +# +# [*oslomsg_use_ssl*] +# Enable ssl oslo messaging services +# Defaults to hiera('nova::rabbit_use_ssl', '0') +# # [*nova_compute_enabled*] # (Optional) Whether or not nova-compute is enabled. # Defaults to false @@ -38,22 +82,23 @@ # (Optional) The current step of the deployment # Defaults to hiera('step') # -# [*rabbit_hosts*] -# list of the rabbbit host IPs -# Defaults to hiera('rabbitmq_node_ips') -# -# [*rabbit_port*] -# IP port for rabbitmq service -# Defaults to hiera('nova::rabbit_port', 5672) - class tripleo::profile::base::nova ( - $bootstrap_node = hiera('bootstrap_nodeid', undef), - $libvirt_enabled = false, - $manage_migration = false, - $nova_compute_enabled = false, - $step = hiera('step'), - $rabbit_hosts = hiera('rabbitmq_node_ips', undef), - $rabbit_port = hiera('nova::rabbit_port', 5672), + $bootstrap_node = hiera('bootstrap_nodeid', undef), + $libvirt_enabled = false, + $manage_migration = false, + $oslomsg_rpc_proto = hiera('messaging_rpc_service_name', 'rabbit'), + $oslomsg_rpc_hosts = any2array(hiera('rabbitmq_node_names', undef)), + $oslomsg_rpc_password = hiera('nova::rabbit_password'), + $oslomsg_rpc_port = hiera('nova::rabbit_port', '5672'), + $oslomsg_rpc_username = hiera('nova::rabbit_userid', 'guest'), + $oslomsg_notify_proto = hiera('messaging_notify_service_name', 'rabbit'), + $oslomsg_notify_hosts = any2array(hiera('rabbitmq_node_names', undef)), + $oslomsg_notify_password = hiera('nova::rabbit_password'), + $oslomsg_notify_port = hiera('nova::rabbit_port', '5672'), + $oslomsg_notify_username = hiera('nova::rabbit_userid', 'guest'), + $oslomsg_use_ssl = hiera('nova::rabbit_use_ssl', '0'), + $nova_compute_enabled = false, + $step = hiera('step'), ) { if $::hostname == downcase($bootstrap_node) { $sync_db = true @@ -67,10 +112,27 @@ class tripleo::profile::base::nova ( $memcache_servers = suffix(hiera('memcached_node_ips'), ':11211') } - if hiera('step') >= 4 or (hiera('step') >= 3 and $sync_db) { - $rabbit_endpoints = suffix(any2array(normalize_ip_for_uri($rabbit_hosts)), ":${rabbit_port}") + if $step >= 4 or ($step >= 3 and $sync_db) { + $oslomsg_use_ssl_real = sprintf('%s', bool2num(str2bool($oslomsg_use_ssl))) + # TODO(ccamacho): remove sprintf once we properly type the port, needs + # to be a string for the os_transport_url function. class { '::nova' : - rabbit_hosts => $rabbit_endpoints, + default_transport_url => os_transport_url({ + 'transport' => $oslomsg_rpc_proto, + 'hosts' => $oslomsg_rpc_hosts, + 'port' => sprintf('%s', $oslomsg_rpc_port), + 'username' => $oslomsg_rpc_username, + 'password' => $oslomsg_rpc_password, + 'ssl' => $oslomsg_use_ssl_real, + }), + notification_transport_url => os_transport_url({ + 'transport' => $oslomsg_notify_proto, + 'hosts' => $oslomsg_notify_hosts, + 'port' => sprintf('%s', $oslomsg_notify_port), + 'username' => $oslomsg_notify_username, + 'password' => $oslomsg_notify_password, + 'ssl' => $oslomsg_use_ssl_real, + }), } include ::nova::config class { '::nova::cache': @@ -78,6 +140,7 @@ class tripleo::profile::base::nova ( backend => 'oslo_cache.memcache_pool', memcache_servers => $memcache_servers, } + include ::nova::placement } if $step >= 4 { diff --git a/manifests/profile/base/nova/api.pp b/manifests/profile/base/nova/api.pp index e660990..287d14c 100644 --- a/manifests/profile/base/nova/api.pp +++ b/manifests/profile/base/nova/api.pp @@ -49,6 +49,11 @@ # This is set by t-h-t. # Defaults to hiera('nova_api_network', undef) # +# [*nova_api_wsgi_enabled*] +# (Optional) Whether or not deploy Nova API in WSGI with Apache. +# Nova Team discourages it. +# Defaults to hiera('nova_wsgi_enabled', false) +# # [*step*] # (Optional) The current step in deployment. See tripleo-heat-templates # for more details. @@ -60,6 +65,7 @@ class tripleo::profile::base::nova::api ( $enable_internal_tls = hiera('enable_internal_tls', false), $generate_service_certificates = hiera('generate_service_certificates', false), $nova_api_network = hiera('nova_api_network', undef), + $nova_api_wsgi_enabled = hiera('nova_wsgi_enabled', false), $step = hiera('step'), ) { if $::hostname == downcase($bootstrap_node) { @@ -70,19 +76,8 @@ class tripleo::profile::base::nova::api ( include ::tripleo::profile::base::nova - if $enable_internal_tls { - if $generate_service_certificates { - ensure_resources('tripleo::certmonger::httpd', $certificates_specs) - } - - if !$nova_api_network { - fail('nova_api_network is not set in the hieradata.') - } - $tls_certfile = $certificates_specs["httpd-${nova_api_network}"]['service_certificate'] - $tls_keyfile = $certificates_specs["httpd-${nova_api_network}"]['service_key'] - } else { - $tls_certfile = undef - $tls_keyfile = undef + if $step >= 3 and $sync_db { + include ::nova::cell_v2::simple_setup } if $step >= 4 or ($step >= 3 and $sync_db) { @@ -101,17 +96,44 @@ class tripleo::profile::base::nova::api ( sync_db => $sync_db, sync_db_api => $sync_db, } - class { '::nova::wsgi::apache': - ssl_cert => $tls_certfile, - ssl_key => $tls_keyfile, - } include ::nova::network::neutron } + # Temporarily disable Nova API deployed in WSGI + # https://bugs.launchpad.net/nova/+bug/1661360 + if $nova_api_wsgi_enabled { + if $enable_internal_tls { + if $generate_service_certificates { + ensure_resources('tripleo::certmonger::httpd', $certificates_specs) + } + + if !$nova_api_network { + fail('nova_api_network is not set in the hieradata.') + } + $tls_certfile = $certificates_specs["httpd-${nova_api_network}"]['service_certificate'] + $tls_keyfile = $certificates_specs["httpd-${nova_api_network}"]['service_key'] + } else { + $tls_certfile = undef + $tls_keyfile = undef + } + if $step >= 4 or ($step >= 3 and $sync_db) { + class { '::nova::wsgi::apache_api': + ssl_cert => $tls_certfile, + ssl_key => $tls_keyfile, + } + } + } if $step >= 5 { if hiera('nova_enable_db_purge', true) { include ::nova::cron::archive_deleted_rows } + # At step 5, we consider all nova-compute services started and registred to nova-conductor + # So we want to update Nova Cells database to be aware of these hosts by executing the + # nova-cell_v2-discover_hosts command again. + # Doing it on a single nova-api node to avoid race condition. + if $sync_db { + Exec<| title == 'nova-cell_v2-discover_hosts' |> { refreshonly => false } + } } } diff --git a/manifests/profile/base/nova/compute.pp b/manifests/profile/base/nova/compute.pp index 076996a..0eb2ed7 100644 --- a/manifests/profile/base/nova/compute.pp +++ b/manifests/profile/base/nova/compute.pp @@ -42,6 +42,7 @@ class tripleo::profile::base::nova::compute ( # before nova-compute. Service<| title == 'nova-conductor' |> -> Service['nova-compute'] + # deploy bits to connect nova compute to neutron include ::nova::network::neutron diff --git a/manifests/profile/base/nova/compute/libvirt.pp b/manifests/profile/base/nova/compute/libvirt.pp index 956f8ad..cc9beb6 100644 --- a/manifests/profile/base/nova/compute/libvirt.pp +++ b/manifests/profile/base/nova/compute/libvirt.pp @@ -40,26 +40,17 @@ class tripleo::profile::base::nova::compute::libvirt ( } } - # TODO(emilien): Some work needs to be done in puppet-nova to separate nova-compute config - # when running libvirt and libvirt itself, so we allow micro-services deployments. - if str2bool(hiera('nova::use_ipv6', false)) { - $vncserver_listen = '::0' - } else { - $vncserver_listen = '0.0.0.0' - } - if $rbd_ephemeral_storage { class { '::nova::compute::libvirt': libvirt_disk_cachemodes => ['network=writeback'], libvirt_hw_disk_discard => 'unmap', - vncserver_listen => $vncserver_listen, } } else { - class { '::nova::compute::libvirt' : - vncserver_listen => $vncserver_listen, - } + include ::nova::compute::libvirt } + include ::nova::compute::libvirt::qemu + } } diff --git a/manifests/profile/base/nova/ec2api.pp b/manifests/profile/base/nova/ec2api.pp new file mode 100644 index 0000000..f34b071 --- /dev/null +++ b/manifests/profile/base/nova/ec2api.pp @@ -0,0 +1,35 @@ +# Copyright 2016 Red Hat, Inc. +# +# Licensed under the Apache License, Version 2.0 (the "License"); you may +# not use this file except in compliance with the License. You may obtain +# a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT +# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the +# License for the specific language governing permissions and limitations +# under the License. +# +# == Class: tripleo::profile::base::nova::ec2api +# +# EC2-compatible Nova API profile for tripleo +# +# === Parameters +# +# [*step*] +# (Optional) The current step in deployment. See tripleo-heat-templates +# for more details. +# Defaults to hiera('step') +# +class tripleo::profile::base::nova::ec2api ( + $step = hiera('step') +) { + if $step >= 4 { + include ::ec2api + include ::ec2api::api + include ::ec2api::db::sync + include ::ec2api::metadata + } +} diff --git a/manifests/profile/base/nova/placement.pp b/manifests/profile/base/nova/placement.pp new file mode 100644 index 0000000..c429373 --- /dev/null +++ b/manifests/profile/base/nova/placement.pp @@ -0,0 +1,96 @@ +# Copyright 2016 Red Hat, Inc. +# +# Licensed under the Apache License, Version 2.0 (the "License"); you may +# not use this file except in compliance with the License. You may obtain +# a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT +# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the +# License for the specific language governing permissions and limitations +# under the License. +# +# == Class: tripleo::profile::base::nova::placement +# +# Nova Placement API profile for tripleo +# +# [*bootstrap_node*] +# (Optional) The hostname of the node responsible for bootstrapping tasks +# Defaults to hiera('bootstrap_nodeid') +# +# [*certificates_specs*] +# (Optional) The specifications to give to certmonger for the certificate(s) +# it will create. +# Example with hiera: +# apache_certificates_specs: +# httpd-internal_api: +# hostname: <overcloud controller fqdn> +# service_certificate: <service certificate path> +# service_key: <service key path> +# principal: "haproxy/<overcloud controller fqdn>" +# Defaults to hiera('apache_certificate_specs', {}). +# +# [*enable_internal_tls*] +# (Optional) Whether TLS in the internal network is enabled or not. +# Defaults to hiera('enable_internal_tls', false) +# +# [*generate_service_certificates*] +# (Optional) Whether or not certmonger will generate certificates for +# HAProxy. This could be as many as specified by the $certificates_specs +# variable. +# Note that this doesn't configure the certificates in haproxy, it merely +# creates the certificates. +# Defaults to hiera('generate_service_certificate', false). +# +# [*nova_placement_network*] +# (Optional) The network name where the nova placement endpoint is listening on. +# This is set by t-h-t. +# Defaults to hiera('nova_placement_network', undef) +# +# [*step*] +# (Optional) The current step in deployment. See tripleo-heat-templates +# for more details. +# Defaults to hiera('step') +# +class tripleo::profile::base::nova::placement ( + $bootstrap_node = hiera('bootstrap_nodeid', undef), + $certificates_specs = hiera('apache_certificates_specs', {}), + $enable_internal_tls = hiera('enable_internal_tls', false), + $generate_service_certificates = hiera('generate_service_certificates', false), + $nova_placement_network = hiera('nova_placement_network', undef), + $step = hiera('step'), +) { + if $::hostname == downcase($bootstrap_node) { + $sync_db = true + } else { + $sync_db = false + } + + include ::tripleo::profile::base::nova + + if $enable_internal_tls { + if $generate_service_certificates { + ensure_resources('tripleo::certmonger::httpd', $certificates_specs) + } + + if !$nova_placement_network { + fail('nova_placement_network is not set in the hieradata.') + } + $tls_certfile = $certificates_specs["httpd-${nova_placement_network}"]['service_certificate'] + $tls_keyfile = $certificates_specs["httpd-${nova_placement_network}"]['service_key'] + } else { + $tls_certfile = undef + $tls_keyfile = undef + } + + if $step >= 3 { + class { '::nova::wsgi::apache_placement': + ssl_cert => $tls_certfile, + ssl_key => $tls_keyfile, + } + } + +} + diff --git a/manifests/profile/base/octavia.pp b/manifests/profile/base/octavia.pp new file mode 100644 index 0000000..e8310d8 --- /dev/null +++ b/manifests/profile/base/octavia.pp @@ -0,0 +1,72 @@ +# Copyright 2016 Red Hat, Inc. +# +# Licensed under the Apache License, Version 2.0 (the "License"); you may +# not use this file except in compliance with the License. You may obtain +# a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT +# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the +# License for the specific language governing permissions and limitations +# under the License. +# +# == Class: tripleo::profile::base::octavia +# +# Octavia server profile for tripleo +# +# === Parameters +# +# [*step*] +# (Optional) The current step of the deployment +# Defaults to hiera('step') +# +# [*oslomsg_rpc_proto*] +# Protocol driver for the oslo messaging rpc service +# Defaults to hiera('messaging_rpc_service_name', rabbit) +# +# [*oslomsg_rpc_hosts*] +# list of the oslo messaging rpc host fqdns +# Defaults to hiera('rabbitmq_node_names') +# +# [*oslomsg_rpc_port*] +# IP port for oslo messaging rpc service +# Defaults to hiera('octavia::rabbit_port', 5672) +# +# [*oslomsg_rpc_username*] +# Username for oslo messaging rpc service +# Defaults to hiera('octavia::rabbit_userid', 'guest') +# +# [*oslomsg_rpc_password*] +# Password for oslo messaging rpc service +# Defaults to hiera('octavia::rabbit_password') +# +# [*oslomsg_use_ssl*] +# Enable ssl oslo messaging services +# Defaults to hiera('octavia::rabbit_use_ssl', '0') + +class tripleo::profile::base::octavia ( + $step = hiera('step'), + $oslomsg_rpc_proto = hiera('messaging_rpc_service_name', 'rabbit'), + $oslomsg_rpc_hosts = any2array(hiera('rabbitmq_node_names', undef)), + $oslomsg_rpc_password = hiera('octavia::rabbit_password'), + $oslomsg_rpc_port = hiera('octavia::rabbit_port', '5672'), + $oslomsg_rpc_username = hiera('octavia::rabbit_userid', 'guest'), + $oslomsg_use_ssl = hiera('octavia::rabbit_use_ssl', '0'), +) { + if $step >= 3 { + $oslomsg_use_ssl_real = sprintf('%s', bool2num(str2bool($oslomsg_use_ssl))) + class { '::octavia' : + default_transport_url => os_transport_url({ + 'transport' => $oslomsg_rpc_proto, + 'hosts' => $oslomsg_rpc_hosts, + 'port' => sprintf('%s', $oslomsg_rpc_port), + 'username' => $oslomsg_rpc_username, + 'password' => $oslomsg_rpc_password, + 'ssl' => $oslomsg_use_ssl_real, + }), + } + include ::octavia::config + } +} diff --git a/manifests/profile/base/glance/registry.pp b/manifests/profile/base/octavia/api.pp index 9e2be9d..d457478 100644 --- a/manifests/profile/base/glance/registry.pp +++ b/manifests/profile/base/octavia/api.pp @@ -12,9 +12,9 @@ # License for the specific language governing permissions and limitations # under the License. # -# == Class: tripleo::profile::base::glance::registry +# == Class: tripleo::profile::base::octavia::api # -# Glance Registry profile for tripleo +# Octavia API server profile for tripleo # # === Parameters # @@ -22,18 +22,13 @@ # (Optional) The hostname of the node responsible for bootstrapping tasks # Defaults to hiera('bootstrap_nodeid') # -# [*glance_backend*] -# (Optional) Glance backend(s) to use. -# Defaults to downcase(hiera('glance_backend', 'swift')) -# # [*step*] # (Optional) The current step in deployment. See tripleo-heat-templates # for more details. # Defaults to hiera('step') # -class tripleo::profile::base::glance::registry ( +class tripleo::profile::base::octavia::api ( $bootstrap_node = hiera('bootstrap_nodeid', undef), - $glance_backend = downcase(hiera('glance_backend', 'swift')), $step = hiera('step'), ) { if $::hostname == downcase($bootstrap_node) { @@ -42,15 +37,18 @@ class tripleo::profile::base::glance::registry ( $sync_db = false } - if $step >= 4 or ( $step >= 3 and $sync_db ) { - # TODO: notifications, scrubber, etc. - include ::glance - include ::glance::config - class { '::glance::registry' : - sync_db => $sync_db, - } - include ::glance::notify::rabbitmq - include join(['::glance::backend::', $glance_backend]) + include ::tripleo::profile::base::octavia + + if $step >= 3 and $sync_db { + include ::octavia::db::mysql } + # We start the Octavia API server on the bootstrap node first, because + # it will try to populate tables and we need to make sure this happens + # before it starts on other nodes + if ($step >= 4 and $sync_db) or ($step >= 5 and !$sync_db) { + class { '::octavia::api': + sync_db => $sync_db, + } + } } diff --git a/manifests/profile/base/octavia/health_manager.pp b/manifests/profile/base/octavia/health_manager.pp new file mode 100644 index 0000000..bac5f65 --- /dev/null +++ b/manifests/profile/base/octavia/health_manager.pp @@ -0,0 +1,33 @@ +# Copyright 2016 Red Hat, Inc. +# +# Licensed under the Apache License, Version 2.0 (the "License"); you may +# not use this file except in compliance with the License. You may obtain +# a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT +# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the +# License for the specific language governing permissions and limitations +# under the License. +# +# == Class: tripleo::profile::base::octavia::health_manager +# +# Octavia Health Manager server for tripleo +# +# === Parameters +# +# [*step*] +# (Optional) The current step in deployment. See tripleo-heat-templates +# for more details. +# Defaults to hiera('step') +# +class tripleo::profile::base::octavia::health_manager ( + $step = hiera('step'), +) { + include ::tripleo::profile::base::octavia + if $step >= 5 { + include ::octavia::health_manager + } +} diff --git a/manifests/profile/base/octavia/housekeeping.pp b/manifests/profile/base/octavia/housekeeping.pp new file mode 100644 index 0000000..0dcd5cf --- /dev/null +++ b/manifests/profile/base/octavia/housekeeping.pp @@ -0,0 +1,34 @@ +# Copyright 2016 Red Hat, Inc. +# +# Licensed under the Apache License, Version 2.0 (the "License"); you may +# not use this file except in compliance with the License. You may obtain +# a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT +# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the +# License for the specific language governing permissions and limitations +# under the License. +# +# == Class: tripleo::profile::base::octavia::housekeeping +# +# Octavia Housekeeping profile for tripleo +# +# === Parameters +# +# [*step*] +# (Optional) The current step in deployment. See tripleo-heat-templates +# for more details. +# Defaults to hiera('step') +# +class tripleo::profile::base::octavia::housekeeping ( + $step = hiera('step'), +) { + include ::tripleo::profile::base::octavia + + if $step >= 5 { + include ::octavia::housekeeping + } +} diff --git a/manifests/profile/base/octavia/worker.pp b/manifests/profile/base/octavia/worker.pp new file mode 100644 index 0000000..7df324d --- /dev/null +++ b/manifests/profile/base/octavia/worker.pp @@ -0,0 +1,34 @@ +# Copyright 2016 Red Hat, Inc. +# +# Licensed under the Apache License, Version 2.0 (the "License"); you may +# not use this file except in compliance with the License. You may obtain +# a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT +# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the +# License for the specific language governing permissions and limitations +# under the License. +# +# == Class: tripleo::profile::base::octavia::worker +# +# Octavia Worker profile for tripleo +# +# === Parameters +# +# [*step*] +# (Optional) The current step in deployment. See tripleo-heat-templates +# for more details. +# Defaults to hiera('step') +# +class tripleo::profile::base::octavia::worker ( + $step = hiera('step'), +) { + include ::tripleo::profile::base::octavia + + if $step >= 5 { + include ::octavia::worker + } +} diff --git a/manifests/profile/base/pacemaker.pp b/manifests/profile/base/pacemaker.pp index cc5fd8a..6021731 100644 --- a/manifests/profile/base/pacemaker.pp +++ b/manifests/profile/base/pacemaker.pp @@ -23,15 +23,60 @@ # for more details. # Defaults to hiera('step') # +# [*pcs_tries*] +# (Optional) The number of times pcs commands should be retried. +# Defaults to hiera('pcs_tries', 20) +# +# [*remote_short_node_names*] +# (Optional) List of short node names for pacemaker remote nodes +# Defaults to hiera('pacemaker_remote_short_node_names', []) +# +# [*remote_node_ips*] +# (Optional) List of node ips for pacemaker remote nodes +# Defaults to hiera('pacemaker_remote_node_ips', []) +# +# [*remote_authkey*] +# (Optional) Authkey for pacemaker remote nodes +# Defaults to undef +# +# [*remote_reconnect_interval*] +# (Optional) Reconnect interval for the remote +# Defaults to hiera('pacemaker_remote_reconnect_interval', 60) +# +# [*remote_monitor_interval*] +# (Optional) Monitor interval for the remote +# Defaults to hiera('pacemaker_monitor_reconnect_interval', 20) +# +# [*remote_tries*] +# (Optional) Number of tries for the remote resource creation +# Defaults to hiera('pacemaker_remote_tries', 5) +# +# [*remote_try_sleep*] +# (Optional) Number of seconds to sleep between remote creation tries +# Defaults to hiera('pacemaker_remote_try_sleep', 60) +# class tripleo::profile::base::pacemaker ( - $step = hiera('step'), + $step = hiera('step'), + $pcs_tries = hiera('pcs_tries', 20), + $remote_short_node_names = hiera('pacemaker_remote_short_node_names', []), + $remote_node_ips = hiera('pacemaker_remote_node_ips', []), + $remote_authkey = undef, + $remote_reconnect_interval = hiera('pacemaker_remote_reconnect_interval', 60), + $remote_monitor_interval = hiera('pacemaker_remote_monitor_interval', 20), + $remote_tries = hiera('pacemaker_remote_tries', 5), + $remote_try_sleep = hiera('pacemaker_remote_try_sleep', 60), ) { + + if count($remote_short_node_names) != count($remote_node_ips) { + fail("Count of ${remote_short_node_names} is not equal to count of ${remote_node_ips}") + } + Pcmk_resource <| |> { tries => 10, try_sleep => 3, } - if $::hostname == downcase(hiera('bootstrap_nodeid')) { + if $::hostname == downcase(hiera('pacemaker_short_bootstrap_node_name')) { $pacemaker_master = true } else { $pacemaker_master = false @@ -40,7 +85,8 @@ class tripleo::profile::base::pacemaker ( $enable_fencing = str2bool(hiera('enable_fencing', false)) and $step >= 5 if $step >= 1 { - $pacemaker_cluster_members = downcase(regsubst(hiera('controller_node_names'), ',', ' ', 'G')) + $pacemaker_short_node_names = join(hiera('pacemaker_short_node_names'), ',') + $pacemaker_cluster_members = downcase(regsubst($pacemaker_short_node_names, ',', ' ', 'G')) $corosync_ipv6 = str2bool(hiera('corosync_ipv6', false)) if $corosync_ipv6 { $cluster_setup_extras = { '--token' => hiera('corosync_token_timeout', 1000), '--ipv6' => '' } @@ -54,9 +100,11 @@ class tripleo::profile::base::pacemaker ( cluster_members => $pacemaker_cluster_members, setup_cluster => $pacemaker_master, cluster_setup_extras => $cluster_setup_extras, + remote_authkey => $remote_authkey, } class { '::pacemaker::stonith': disable => !$enable_fencing, + tries => $pcs_tries, } if $enable_fencing { include ::tripleo::fencing @@ -68,6 +116,21 @@ class tripleo::profile::base::pacemaker ( # enable stonith after all fencing devices have been created Class['tripleo::fencing'] -> Class['pacemaker::stonith'] } + # We have pacemaker remote nodes configured so let's add them as resources + # We do this during step 1 right after wait-for-settle, because during step 2 + # resources might already be created on pacemaker remote nodes and we need + # a guarantee that remote nodes are already up + if $pacemaker_master and count($remote_short_node_names) > 0 { + # Creates a { "node" => "ip_address", ...} hash + $remotes_hash = hash(zip($remote_short_node_names, $remote_node_ips)) + pacemaker::resource::remote { $remote_short_node_names: + remote_address => $remotes_hash[$title], + reconnect_interval => $remote_reconnect_interval, + op_params => "monitor interval=${remote_monitor_interval}", + tries => $remote_tries, + try_sleep => $remote_try_sleep, + } + } } if $step >= 2 { diff --git a/manifests/profile/base/pacemaker_remote.pp b/manifests/profile/base/pacemaker_remote.pp new file mode 100644 index 0000000..e0fff63 --- /dev/null +++ b/manifests/profile/base/pacemaker_remote.pp @@ -0,0 +1,37 @@ +# Copyright 2016 Red Hat, Inc. +# +# Licensed under the Apache License, Version 2.0 (the "License"); you may +# not use this file except in compliance with the License. You may obtain +# a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT +# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the +# License for the specific language governing permissions and limitations +# under the License. +# +# == Class: tripleo::profile::base::pacemaker_remote +# +# Pacemaker remote profile for tripleo +# +# === Parameters +# +# [*remote_authkey*] +# Authkey for pacemaker remote nodes +# Defaults to unset +# +# [*step*] +# (Optional) The current step in deployment. See tripleo-heat-templates +# for more details. +# Defaults to hiera('step') +# +class tripleo::profile::base::pacemaker_remote ( + $remote_authkey, + $step = hiera('step'), +) { + class { '::pacemaker::remote': + remote_authkey => $remote_authkey, + } +} diff --git a/manifests/profile/base/panko.pp b/manifests/profile/base/panko.pp new file mode 100644 index 0000000..880cf7d --- /dev/null +++ b/manifests/profile/base/panko.pp @@ -0,0 +1,48 @@ +# Copyright 2016 Red Hat, Inc. +# +# Licensed under the Apache License, Version 2.0 (the "License"); you may +# not use this file except in compliance with the License. You may obtain +# a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT +# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the +# License for the specific language governing permissions and limitations +# under the License. +# +# == Class: tripleo::profile::base::panko +# +# panko profile for tripleo +# +# === Parameters +# +# [*step*] +# (Optional) The current step in deployment. See tripleo-heat-templates +# for more details. +# Defaults to hiera('step') +# +# [*bootstrap_node*] +# (Optional) The hostname of the node responsible for bootstrapping tasks +# Defaults to hiera('bootstrap_nodeid') + +class tripleo::profile::base::panko ( + $step = hiera('step'), + $bootstrap_node = hiera('bootstrap_nodeid', undef), +) { + + if $::hostname == downcase($bootstrap_node) { + $sync_db = true + } else { + $sync_db = false + } + + if $step >= 4 or ($step >= 3 and $sync_db) { + include ::panko + include ::panko::db + include ::panko::config + include ::panko::db::sync + } + +} diff --git a/manifests/profile/base/panko/api.pp b/manifests/profile/base/panko/api.pp new file mode 100644 index 0000000..45ee0c0 --- /dev/null +++ b/manifests/profile/base/panko/api.pp @@ -0,0 +1,86 @@ +# Copyright 2016 Red Hat, Inc. +# +# Licensed under the Apache License, Version 2.0 (the "License"); you may +# not use this file except in compliance with the License. You may obtain +# a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT +# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the +# License for the specific language governing permissions and limitations +# under the License. +# +# == Class: tripleo::profile::base::panko::api +# +# Panko API profile for tripleo +# +# === Parameters +# +# [*certificates_specs*] +# (Optional) The specifications to give to certmonger for the certificate(s) +# it will create. +# Example with hiera: +# apache_certificates_specs: +# httpd-internal_api: +# hostname: <overcloud controller fqdn> +# service_certificate: <service certificate path> +# service_key: <service key path> +# principal: "haproxy/<overcloud controller fqdn>" +# Defaults to hiera('apache_certificate_specs', {}). +# +# [*enable_internal_tls*] +# (Optional) Whether TLS in the internal network is enabled or not. +# Defaults to hiera('enable_internal_tls', false) +# +# [*generate_service_certificates*] +# (Optional) Whether or not certmonger will generate certificates for +# HAProxy. This could be as many as specified by the $certificates_specs +# variable. +# Note that this doesn't configure the certificates in haproxy, it merely +# creates the certificates. +# Defaults to hiera('generate_service_certificate', false). +# +# [*panko_network*] +# (Optional) The network name where the panko endpoint is listening on. +# This is set by t-h-t. +# Defaults to hiera('panko_api_network', undef) +# +# [*step*] +# (Optional) The current step in deployment. See tripleo-heat-templates +# for more details. +# Defaults to hiera('step') +# +class tripleo::profile::base::panko::api ( + $certificates_specs = hiera('apache_certificates_specs', {}), + $enable_internal_tls = hiera('enable_internal_tls', false), + $generate_service_certificates = hiera('generate_service_certificates', false), + $panko_network = hiera('panko_api_network', undef), + $step = hiera('step'), +) { + include ::tripleo::profile::base::panko + + if $enable_internal_tls { + if $generate_service_certificates { + ensure_resources('tripleo::certmonger::httpd', $certificates_specs) + } + + if !$panko_network { + fail('panko_api_network is not set in the hieradata.') + } + $tls_certfile = $certificates_specs["httpd-${panko_network}"]['service_certificate'] + $tls_keyfile = $certificates_specs["httpd-${panko_network}"]['service_key'] + } else { + $tls_certfile = undef + $tls_keyfile = undef + } + + if $step >= 4 { + include ::panko::api + class { '::panko::wsgi::apache': + ssl_cert => $tls_certfile, + ssl_key => $tls_keyfile, + } + } +} diff --git a/manifests/profile/base/rabbitmq.pp b/manifests/profile/base/rabbitmq.pp index d90805a..1eaabf0 100644 --- a/manifests/profile/base/rabbitmq.pp +++ b/manifests/profile/base/rabbitmq.pp @@ -34,9 +34,26 @@ # (Optional) RabbitMQ environment. # Defaults to hiera('rabbitmq_environment'). # +# [*inet_dist_interface*] +# (Optional) Address to bind the inter-cluster interface +# to. It is the inet_dist_use_interface option in the kernel variables +# Defaults to hiera('rabbitmq::interface', undef). +# # [*nodes*] # (Optional) Array of host(s) for RabbitMQ nodes. -# Defaults to hiera('rabbitmq_node_ips', []). +# Defaults to hiera('rabbitmq_node_names', []). +# +# [*rabbitmq_pass*] +# (Optional) RabbitMQ Default Password. +# Defaults to hiera('rabbitmq::default_pass') +# +# [*rabbitmq_user*] +# (Optional) RabbitMQ Default User. +# Defaults to hiera('rabbitmq::default_user') +# +# [*stack_action*] +# (Optional) Action of the stack deployment. +# Defaults to hiera('stack_action') # # [*step*] # (Optional) The current step in deployment. See tripleo-heat-templates @@ -44,12 +61,16 @@ # Defaults to hiera('step') # class tripleo::profile::base::rabbitmq ( - $config_variables = hiera('rabbitmq_config_variables'), - $environment = hiera('rabbitmq_environment'), - $ipv6 = str2bool(hiera('rabbit_ipv6', false)), - $kernel_variables = hiera('rabbitmq_kernel_variables'), - $nodes = hiera('rabbitmq_node_ips', []), - $step = hiera('step'), + $config_variables = hiera('rabbitmq_config_variables'), + $environment = hiera('rabbitmq_environment'), + $ipv6 = str2bool(hiera('rabbit_ipv6', false)), + $kernel_variables = hiera('rabbitmq_kernel_variables'), + $inet_dist_interface = hiera('rabbitmq::interface', undef), + $nodes = hiera('rabbitmq_node_names', []), + $rabbitmq_pass = hiera('rabbitmq::default_pass'), + $rabbitmq_user = hiera('rabbitmq::default_user'), + $stack_action = hiera('stack_action'), + $step = hiera('step'), ) { # IPv6 environment, necessary for RabbitMQ. if $ipv6 { @@ -60,6 +81,14 @@ class tripleo::profile::base::rabbitmq ( } else { $rabbit_env = $environment } + if $inet_dist_interface { + $real_kernel_variables = merge( + $kernel_variables, + { 'inet_dist_use_interface' => ip_to_erl_format($inet_dist_interface) }, + ) + } else { + $real_kernel_variables = $kernel_variables + } $manage_service = hiera('rabbitmq::service_manage', true) if $step >= 1 { @@ -68,7 +97,7 @@ class tripleo::profile::base::rabbitmq ( class { '::rabbitmq': config_cluster => $manage_service, cluster_nodes => $nodes, - config_kernel_variables => $kernel_variables, + config_kernel_variables => $real_kernel_variables, config_variables => $config_variables, environment_variables => $rabbit_env, } @@ -89,6 +118,17 @@ class tripleo::profile::base::rabbitmq ( environment_variables => $rabbit_env, } } + # In case of HA, starting of rabbitmq-server is managed by pacemaker, because of which, a dependency + # to Service['rabbitmq-server'] will not work. Sticking with UPDATE action. + if $stack_action == 'UPDATE' { + # Required for changing password on update scenario. Password will be changed only when + # called explicity, if the rabbitmq service is already running. + rabbitmq_user { $rabbitmq_user : + password => $rabbitmq_pass, + provider => 'rabbitmqctl', + admin => true, + } + } } } diff --git a/manifests/profile/base/sahara.pp b/manifests/profile/base/sahara.pp index f509225..9633dc3 100644 --- a/manifests/profile/base/sahara.pp +++ b/manifests/profile/base/sahara.pp @@ -26,19 +26,64 @@ # (Optional) The current step of the deployment # Defaults to hiera('step') # -# [*rabbit_hosts*] -# list of the rabbbit host IPs -# Defaults to hiera('rabbitmq_node_ips') +# [*oslomsg_rpc_proto*] +# Protocol driver for the oslo messaging rpc service +# Defaults to hiera('messaging_rpc_service_name', rabbit) # -# [*rabbit_port*] -# IP port for rabbitmq service +# [*oslomsg_rpc_hosts*] +# list of the oslo messaging rpc host fqdns +# Defaults to hiera('rabbitmq_node_names') +# +# [*oslomsg_rpc_port*] +# IP port for oslo messaging rpc service # Defaults to hiera('sahara::rabbit_port', 5672) +# +# [*oslomsg_rpc_username*] +# Username for oslo messaging rpc service +# Defaults to hiera('sahara::rabbit_userid', 'guest') +# +# [*oslomsg_rpc_password*] +# Password for oslo messaging rpc service +# Defaults to hiera('sahara::rabbit_password') +# +# [*oslomsg_notify_proto*] +# Protocol driver for the oslo messaging notify service +# Defaults to hiera('messaging_notify_service_name', rabbit) +# +# [*oslomsg_notify_hosts*] +# list of the oslo messaging notify host fqdns +# Defaults to hiera('rabbitmq_node_names') +# +# [*oslomsg_notify_port*] +# IP port for oslo messaging notify service +# Defaults to hiera('sahara::rabbit_port', 5672) +# +# [*oslomsg_notify_username*] +# Username for oslo messaging notify service +# Defaults to hiera('sahara::rabbit_userid', 'guest') +# +# [*oslomsg_notify_password*] +# Password for oslo messaging notify service +# Defaults to hiera('sahara::rabbit_password') +# +# [*oslomsg_use_ssl*] +# Enable ssl oslo messaging services +# Defaults to hiera('sahara::rabbit_use_ssl', '0') class tripleo::profile::base::sahara ( - $bootstrap_node = hiera('bootstrap_nodeid', undef), - $step = hiera('step'), - $rabbit_hosts = hiera('rabbitmq_node_ips', undef), - $rabbit_port = hiera('sahara::rabbit_port', 5672), + $bootstrap_node = hiera('bootstrap_nodeid', undef), + $step = hiera('step'), + $oslomsg_rpc_proto = hiera('messaging_rpc_service_name', 'rabbit'), + $oslomsg_rpc_hosts = any2array(hiera('rabbitmq_node_names', undef)), + $oslomsg_rpc_password = hiera('sahara::rabbit_password'), + $oslomsg_rpc_port = hiera('sahara::rabbit_port', '5672'), + $oslomsg_rpc_username = hiera('sahara::rabbit_userid', 'guest'), + $oslomsg_notify_proto = hiera('messaging_notify_service_name', 'rabbit'), + $oslomsg_notify_hosts = any2array(hiera('rabbitmq_node_names', undef)), + $oslomsg_notify_password = hiera('sahara::rabbit_password'), + $oslomsg_notify_port = hiera('sahara::rabbit_port', '5672'), + $oslomsg_notify_username = hiera('sahara::rabbit_userid', 'guest'), + $oslomsg_use_ssl = hiera('sahara::rabbit_use_ssl', '0'), ) { if $::hostname == downcase($bootstrap_node) { $sync_db = true @@ -47,10 +92,27 @@ class tripleo::profile::base::sahara ( } if $step >= 4 or ($step >= 3 and $sync_db){ - $rabbit_endpoints = suffix(any2array(normalize_ip_for_uri($rabbit_hosts)), ":${rabbit_port}") + $oslomsg_use_ssl_real = sprintf('%s', bool2num(str2bool($oslomsg_use_ssl))) class { '::sahara': - sync_db => $sync_db, - rabbit_hosts => $rabbit_endpoints, + sync_db => $sync_db, + default_transport_url => os_transport_url({ + 'transport' => $oslomsg_rpc_proto, + 'hosts' => $oslomsg_rpc_hosts, + 'port' => sprintf('%s', $oslomsg_rpc_port), + 'username' => $oslomsg_rpc_username, + 'password' => $oslomsg_rpc_password, + 'ssl' => $oslomsg_use_ssl_real, + }), + } + class { '::sahara::notify': + notification_transport_url => os_transport_url({ + 'transport' => $oslomsg_notify_proto, + 'hosts' => $oslomsg_notify_hosts, + 'port' => sprintf('%s', $oslomsg_notify_port), + 'username' => $oslomsg_notify_username, + 'password' => $oslomsg_notify_password, + 'ssl' => $oslomsg_use_ssl_real, + }), } } } diff --git a/manifests/profile/base/sshd.pp b/manifests/profile/base/sshd.pp new file mode 100644 index 0000000..e7916c1 --- /dev/null +++ b/manifests/profile/base/sshd.pp @@ -0,0 +1,61 @@ +# Copyright 2016 Red Hat, Inc. +# All Rights Reserved. +# +# Licensed under the Apache License, Version 2.0 (the "License"); you may +# not use this file except in compliance with the License. You may obtain +# a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT +# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the +# License for the specific language governing permissions and limitations +# under the License. +# +# == Class: tripleo::profile::base::sshd +# +# SSH profile for tripleo +# +# === Parameters +# +# [*bannertext*] +# The text used within SSH Banner +# Defaults to hiera('BannerText') +# +class tripleo::profile::base::sshd ( + $bannertext = hiera('BannerText', undef), +) { + + if $bannertext { + $action = 'set' + } else { + $action = 'rm' + } + + package {'openssh-server': + ensure => installed, + } + + augeas { 'sshd_config_banner': + context => '/files/etc/ssh/sshd_config', + changes => [ "${action} Banner /etc/issue" ], + notify => Service['sshd'] + } + + file { '/etc/issue': + ensure => file, + backup => false, + content => $bannertext, + owner => 'root', + group => 'root', + mode => '0600' + } + + service { 'sshd': + ensure => 'running', + enable => true, + hasstatus => false, + require => Package['openssh-server'], + } +} diff --git a/manifests/profile/base/swift/proxy.pp b/manifests/profile/base/swift/proxy.pp index 15b4686..0d9ba68 100644 --- a/manifests/profile/base/swift/proxy.pp +++ b/manifests/profile/base/swift/proxy.pp @@ -18,33 +18,58 @@ # # === Parameters # -# [*step*] -# (Optional) The current step in deployment. See tripleo-heat-templates -# for more details. -# Defaults to hiera('step') +# [*ceilometer_enabled*] +# Whether the ceilometer pipeline is enabled. +# Defaults to true # -# [*memcache_servers*] -# (Optional) List of memcache servers -# Defaults to hiera('memcached_node_ips') +# [*ceilometer_messaging_driver*] +# Driver for messaging service. +# Defaults to hiera('messaging_notify_service_name', 'rabbit') +# +# [*ceilometer_messaging_hosts*] +# list of the messaging host fqdns +# Defaults to hiera('rabbitmq_node_names') +# +# [*ceilometer_messaging_password*] +# Password for messaging nova queue +# Defaults to hiera('swift::proxy::ceilometer::rabbit_password', undef) +# +# [*ceilometer_messaging_port*] +# IP port for messaging service +# Defaults to hiera('tripleo::profile::base::swift::proxy::rabbit_port', 5672) +# +# [*ceilometer_messaging_use_ssl*] +# Flag indicating ssl usage. +# Defaults to '0' +# +# [*ceilometer_messaging_username*] +# Username for messaging nova queue +# Defaults to hiera('swift::proxy::ceilometer::rabbit_user', 'guest') # # [*memcache_port*] # (Optional) memcache port # Defaults to 11211 # -# [*rabbit_hosts*] -# list of the rabbbit host IPs -# Defaults to hiera('rabbitmq_node_ips') +# [*memcache_servers*] +# (Optional) List of memcache servers +# Defaults to hiera('memcached_node_ips') # -# [*rabbit_port*] -# IP port for rabbitmq service -# Defaults to hiera('swift::proxy::ceilometer::rabbit_port', 5672) +# [*step*] +# (Optional) The current step in deployment. See tripleo-heat-templates +# for more details. +# Defaults to hiera('step') # class tripleo::profile::base::swift::proxy ( - $step = hiera('step'), - $memcache_servers = hiera('memcached_node_ips'), - $memcache_port = 11211, - $rabbit_hosts = hiera('rabbitmq_node_ips', undef), - $rabbit_port = hiera('swift::proxy::ceilometer::rabbit_port', 5672), + $ceilometer_enabled = true, + $ceilometer_messaging_driver = hiera('messaging_notify_service_name', 'rabbit'), + $ceilometer_messaging_hosts = any2array(hiera('rabbitmq_node_names', undef)), + $ceilometer_messaging_password = hiera('swift::proxy::ceilometer::rabbit_password', undef), + $ceilometer_messaging_port = hiera('tripleo::profile::base::swift::proxy::rabbit_port', '5672'), + $ceilometer_messaging_use_ssl = '0', + $ceilometer_messaging_username = hiera('swift::proxy::ceilometer::rabbit_user', 'guest'), + $memcache_port = 11211, + $memcache_servers = hiera('memcached_node_ips'), + $step = hiera('step'), ) { if $step >= 4 { $swift_memcache_servers = suffix(any2array(normalize_ip_for_uri($memcache_servers)), ":${memcache_port}") @@ -63,10 +88,29 @@ class tripleo::profile::base::swift::proxy ( include ::swift::proxy::tempurl include ::swift::proxy::formpost include ::swift::proxy::bulk - $swift_rabbit_hosts = suffix(any2array(normalize_ip_for_uri($rabbit_hosts)), ":${rabbit_port}") - class { '::swift::proxy::ceilometer': - rabbit_hosts => $swift_rabbit_hosts, + $ceilometer_messaging_use_ssl_real = sprintf('%s', bool2num(str2bool($ceilometer_messaging_use_ssl))) + if $ceilometer_enabled { + class { '::swift::proxy::ceilometer': + default_transport_url => os_transport_url({ + 'transport' => $ceilometer_messaging_driver, + 'hosts' => $ceilometer_messaging_hosts, + 'port' => sprintf('%s', $ceilometer_messaging_port), + 'username' => $ceilometer_messaging_username, + 'password' => $ceilometer_messaging_password, + 'ssl' => $ceilometer_messaging_use_ssl_real, + }), + } } include ::swift::proxy::versioned_writes + include ::swift::proxy::slo + include ::swift::proxy::dlo + include ::swift::proxy::copy + include ::swift::proxy::container_quotas + include ::swift::proxy::account_quotas + + class { '::swift::objectexpirer': + pipeline => ['catch_errors', 'cache', 'proxy-server'], + memcache_servers => $swift_memcache_servers + } } } diff --git a/manifests/profile/base/swift/storage.pp b/manifests/profile/base/swift/storage.pp index 568be66..5018d77 100644 --- a/manifests/profile/base/swift/storage.pp +++ b/manifests/profile/base/swift/storage.pp @@ -34,8 +34,10 @@ class tripleo::profile::base::swift::storage ( ) { if $step >= 4 { if $enable_swift_storage { + include ::swift include ::swift::config include ::swift::storage::disks + include ::swift::storage::loopbacks include ::swift::storage::all if(!defined(File['/srv/node'])) { file { '/srv/node': diff --git a/manifests/profile/base/tacker.pp b/manifests/profile/base/tacker.pp new file mode 100644 index 0000000..fa85ec1 --- /dev/null +++ b/manifests/profile/base/tacker.pp @@ -0,0 +1,86 @@ +# Copyright 2016 Red Hat, Inc. +# +# Licensed under the Apache License, Version 2.0 (the "License"); you may +# not use this file except in compliance with the License. You may obtain +# a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT +# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the +# License for the specific language governing permissions and limitations +# under the License. +# +# == Class: tripleo::profile::base::tacker +# +# Tacker server profile for tripleo +# +# === Parameters +# +# [*bootstrap_node*] +# (Optional) The hostname of the node responsible for bootstrapping tasks +# Defaults to hiera('bootstrap_nodeid') +# +# [*oslomsg_rpc_proto*] +# Protocol driver for the oslo messaging rpc service +# Defaults to hiera('messaging_rpc_service_name', rabbit) +# +# [*oslomsg_rpc_hosts*] +# list of the oslo messaging rpc host fqdns +# Defaults to hiera('rabbitmq_node_names') +# +# [*oslomsg_rpc_port*] +# IP port for oslo messaging rpc service +# Defaults to hiera('tacker::rabbit_port', 5672) +# +# [*oslomsg_rpc_username*] +# Username for oslo messaging rpc service +# Defaults to hiera('tacker::rabbit_userid', 'guest') +# +# [*oslomsg_rpc_password*] +# Password for oslo messaging rpc service +# Defaults to hiera('tacker::rabbit_password') +# +# [*oslomsg_use_ssl*] +# Enable ssl oslo messaging services +# Defaults to hiera('tacker::rabbit_use_ssl', '0') +# +# [*step*] +# (Optional) The current step of the deployment +# Defaults to hiera('step') + +class tripleo::profile::base::tacker ( + $bootstrap_node = hiera('bootstrap_nodeid', undef), + $oslomsg_rpc_proto = hiera('messaging_rpc_service_name', 'rabbit'), + $oslomsg_rpc_hosts = any2array(hiera('rabbitmq_node_names', undef)), + $oslomsg_rpc_password = hiera('tacker::rabbit_password'), + $oslomsg_rpc_port = hiera('tacker::rabbit_port', '5672'), + $oslomsg_rpc_username = hiera('tacker::rabbit_userid', 'guest'), + $oslomsg_use_ssl = hiera('tacker::rabbit_use_ssl', '0'), + $step = hiera('step'), +) { + if $::hostname == downcase($bootstrap_node) { + $sync_db = true + } else { + $sync_db = false + } + + if $step >= 4 or ($step >= 3 and $sync_db){ + $oslomsg_use_ssl_real = sprintf('%s', bool2num(str2bool($oslomsg_use_ssl))) + class { '::tacker': + sync_db => $sync_db, + default_transport_url => os_transport_url({ + 'transport' => $oslomsg_rpc_proto, + 'hosts' => $oslomsg_rpc_hosts, + 'port' => sprintf('%s', $oslomsg_rpc_port), + 'username' => $oslomsg_rpc_username, + 'password' => $oslomsg_rpc_password, + 'ssl' => $oslomsg_use_ssl_real, + }), + } + + include ::tacker::server + include ::tacker::db + } +} diff --git a/manifests/profile/base/time/ntp.pp b/manifests/profile/base/time/ntp.pp new file mode 100644 index 0000000..c6ce309 --- /dev/null +++ b/manifests/profile/base/time/ntp.pp @@ -0,0 +1,28 @@ +# Copyright 2017 Red Hat, Inc. +# All Rights Reserved. +# +# Licensed under the Apache License, Version 2.0 (the "License"); you may +# not use this file except in compliance with the License. You may obtain +# a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT +# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the +# License for the specific language governing permissions and limitations +# under the License. +# +# == Class: tripleo::profile::base::ntp +# +# Enable NTP via composable services. +# + +class tripleo::profile::base::time::ntp { + # if installed, we don't want chrony to conflict with ntp. + package { 'chrony': + ensure => 'purged', + before => Service['ntp'], + } + include ::ntp +} |