summaryrefslogtreecommitdiffstats
path: root/manifests/profile/pacemaker
diff options
context:
space:
mode:
Diffstat (limited to 'manifests/profile/pacemaker')
-rw-r--r--manifests/profile/pacemaker/database/redis.pp65
1 files changed, 65 insertions, 0 deletions
diff --git a/manifests/profile/pacemaker/database/redis.pp b/manifests/profile/pacemaker/database/redis.pp
index bc91be7..e6a2bf8 100644
--- a/manifests/profile/pacemaker/database/redis.pp
+++ b/manifests/profile/pacemaker/database/redis.pp
@@ -22,6 +22,21 @@
# (Optional) The hostname of the node responsible for bootstrapping tasks
# Defaults to hiera('redis_short_bootstrap_node_name')
#
+# [*certificate_specs*]
+# (Optional) The specifications to give to certmonger for the certificate(s)
+# it will create.
+# Example with hiera:
+# redis_certificate_specs:
+# hostname: <overcloud controller fqdn>
+# service_certificate: <service certificate path>
+# service_key: <service key path>
+# principal: "haproxy/<overcloud controller fqdn>"
+# Defaults to hiera('redis_certificate_specs', {}).
+#
+# [*enable_internal_tls*]
+# (Optional) Whether TLS in the internal network is enabled or not.
+# Defaults to hiera('enable_internal_tls', false)
+#
# [*enable_load_balancer*]
# (Optional) Whether load balancing is enabled for this cluster
# Defaults to hiera('enable_load_balancer', true)
@@ -39,16 +54,42 @@
# https://github.com/arioch/puppet-redis/pull/192. Set redis::ulimit via hiera
# to control this limit.
#
+# [*redis_network*]
+# (Optional) The network name where the redis endpoint is listening on.
+# This is set by t-h-t.
+# Defaults to hiera('redis_network', undef)
+#
# [*pcs_tries*]
# (Optional) The number of times pcs commands should be retried.
# Defaults to hiera('pcs_tries', 20)
#
+# [*tls_proxy_bind_ip*]
+# IP on which the TLS proxy will listen on. Required only if
+# enable_internal_tls is set.
+# Defaults to undef
+#
+# [*tls_proxy_fqdn*]
+# fqdn on which the tls proxy will listen on. required only used if
+# enable_internal_tls is set.
+# defaults to undef
+#
+# [*tls_proxy_port*]
+# port on which the tls proxy will listen on. Only used if
+# enable_internal_tls is set.
+# defaults to 6379
+#
class tripleo::profile::pacemaker::database::redis (
+ $certificate_specs = hiera('redis_certificate_specs', {}),
+ $enable_internal_tls = hiera('enable_internal_tls', false),
$bootstrap_node = hiera('redis_short_bootstrap_node_name'),
$enable_load_balancer = hiera('enable_load_balancer', true),
$step = Integer(hiera('step')),
$redis_file_limit = undef,
+ $redis_network = hiera('redis_network', undef),
$pcs_tries = hiera('pcs_tries', 20),
+ $tls_proxy_bind_ip = undef,
+ $tls_proxy_fqdn = undef,
+ $tls_proxy_port = 6379,
) {
if $::hostname == downcase($bootstrap_node) {
$pacemaker_master = true
@@ -57,6 +98,30 @@ class tripleo::profile::pacemaker::database::redis (
}
if $step >= 1 {
+ if $enable_internal_tls {
+ if !$redis_network {
+ fail('redis_network is not set in the hieradata.')
+ }
+ if !$tls_proxy_bind_ip {
+ fail('tls_proxy_bind_ip is not set in the hieradata.')
+ }
+ if !$tls_proxy_fqdn {
+ fail('tls_proxy_fqdn is required if internal TLS is enabled.')
+ }
+ $tls_certfile = $certificate_specs['service_certificate']
+ $tls_keyfile = $certificate_specs['service_key']
+
+ include ::tripleo::stunnel
+
+ ::tripleo::stunnel::service_proxy { 'redis':
+ accept_host => $tls_proxy_bind_ip,
+ accept_port => $tls_proxy_port,
+ connect_port => $tls_proxy_port,
+ certificate => $tls_certfile,
+ key => $tls_keyfile,
+ notify => Class['::redis'],
+ }
+ }
# If the old hiera key exists we use that to set the ulimit in order not to break
# operators which set it. We might remove this in a later release (post pike anyway)
$old_redis_file_limit = hiera('redis_file_limit', undef)