3 files changed, 24 insertions, 28 deletions

diff --git a/manifests/profile/base/heat.pp b/manifests/profile/base/heat.pp
index 027ab7e..2035a4f 100644
--- a/manifests/profile/base/heat.pp
+++ b/manifests/profile/base/heat.pp
@@ -46,7 +46,7 @@ class tripleo::profile::base::heat (
   $step                = hiera('step'),
   $rabbit_hosts        = hiera('rabbitmq_node_ips', undef),
 ) {
-  # Domain resources will be created at step5 on the bootstrap_node so we
+  # Domain resources will be created at step5 on the node running keystone.pp
   # configure heat.conf at step3 and 4 but actually create the domain later.
   if $step == 3 or $step == 4 {
     class { '::heat::keystone::domain':
@@ -69,20 +69,6 @@ class tripleo::profile::base::heat (
     if $manage_db_purge {
       include ::heat::cron::purge_deleted
     }
-    if $bootstrap_node == $::hostname {
-      # Class ::heat::keystone::domain has to run on bootstrap node
-      # because it creates DB entities via API calls.
-      include ::heat::keystone::domain
-
-      Class['::keystone::roles::admin'] -> Class['::heat::keystone::domain']
-    } else {
-      # On non-bootstrap node we don't need to create Keystone resources again
-      class { '::heat::keystone::domain':
-        manage_domain => false,
-        manage_user   => false,
-        manage_role   => false,
-      }
-    }
   }
 }
 
diff --git a/manifests/profile/base/keystone.pp b/manifests/profile/base/keystone.pp
index d515f8f..846296e 100644
--- a/manifests/profile/base/keystone.pp
+++ b/manifests/profile/base/keystone.pp
@@ -45,10 +45,12 @@ class tripleo::profile::base::keystone (
     $sync_db = true
     $manage_roles = true
     $manage_endpoint = true
+    $manage_domain = true
   } else {
     $sync_db = false
     $manage_roles = false
     $manage_endpoint = false
+    $manage_domain = false
   }
 
   if $step >= 4 or ( $step >= 3 and $sync_db ) {
@@ -76,6 +78,27 @@ class tripleo::profile::base::keystone (
     include ::keystone::cron::token_flush
   }
 
+  if $step >= 5 and $manage_domain {
+    if hiera('heat_engine_enabled', false) {
+      # if Heat and Keystone are collocated, so we want to
+      # both configure heat.conf and create Keystone resources.
+      # note: domain_password is given via Hiera.
+      if defined(Class['::tripleo::profile::base::heat']) {
+        include ::heat::keystone::domain
+      } else {
+        # if Heat and Keystone are not collocated, we want Puppet
+        # to only create Keystone resources on the Keystone node
+        # but not try to configure Heat, to avoid leaking the password.
+        class { '::heat::keystone::domain':
+          domain_name     => $::os_service_default,
+          domain_admin    => $::os_service_default,
+          domain_password => $::os_service_default,
+        }
+      }
+      Class['::keystone::roles::admin'] -> Class['::heat::keystone::domain']
+    }
+  }
+
   if $step >= 5 and $manage_endpoint{
     if hiera('aodh_api_enabled', false) {
       include ::aodh::keystone::auth
diff --git a/manifests/profile/base/nova/api.pp b/manifests/profile/base/nova/api.pp
index beadbbf..6aedd3e 100644
--- a/manifests/profile/base/nova/api.pp
+++ b/manifests/profile/base/nova/api.pp
@@ -39,19 +39,6 @@ class tripleo::profile::base::nova::api (
 
   if $step >= 4 or ($step >= 3 and $sync_db) {
 
-    # Manages the migration to Nova API in mod_wsgi with Apache.
-    # - First update nova.conf with new parameters
-    # - Stop nova-api process before starting apache to avoid binding error
-    # - Start apache after configuring all vhosts
-    exec { 'stop_nova-api':
-      command     => 'service openstack-nova-api stop',
-      path        => ['/usr/bin', '/usr/sbin'],
-      onlyif      => 'systemctl is-active openstack-nova-api',
-      refreshonly => true,
-    }
-    Nova_config<||> ~> Exec['stop_nova-api']
-    Exec['stop_nova-api'] -> Service['httpd']
-
     class { '::nova::api':
       sync_db     => $sync_db,
       sync_db_api => $sync_db,