diff options
Diffstat (limited to 'manifests/profile')
35 files changed, 1224 insertions, 226 deletions
diff --git a/manifests/profile/base/auditd.pp b/manifests/profile/base/auditd.pp new file mode 100644 index 0000000..628db08 --- /dev/null +++ b/manifests/profile/base/auditd.pp @@ -0,0 +1,30 @@ +# Copyright 2016 Red Hat, Inc. +# +# Licensed under the Apache License, Version 2.0 (the "License"); you may +# not use this file except in compliance with the License. You may obtain +# a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT +# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the +# License for the specific language governing permissions and limitations +# under the License. +# +# == class: tripleo::profile::base::auditd +# +# auditd profile for tripleo +# +# === Parameters +# +# [*step*] +# Defaults to hiera('step') +# +class tripleo::profile::base::auditd ( + $step = hiera('step'), +) { + if $step >= 4 { + include ::auditd + } +} diff --git a/manifests/profile/base/ceilometer/api.pp b/manifests/profile/base/ceilometer/api.pp index 2e7986b..6ef4748 100644 --- a/manifests/profile/base/ceilometer/api.pp +++ b/manifests/profile/base/ceilometer/api.pp @@ -18,10 +18,6 @@ # # === Parameters # -# [*enable_legacy_api*] -# (Optional) Enable legacy ceilometer api service. -# Defaults to hiera('enable_legacy_api', false) -# # [*ceilometer_network*] # (Optional) The network name where the ceilometer endpoint is listening on. # This is set by t-h-t. @@ -57,7 +53,6 @@ # Defaults to hiera('step') # class tripleo::profile::base::ceilometer::api ( - $enable_legacy_api = hiera('enable_legacy_ceilometer_api', false), $ceilometer_network = hiera('ceilometer_api_network', undef), $certificates_specs = hiera('apache_certificates_specs', {}), $enable_internal_tls = hiera('enable_internal_tls', false), @@ -81,7 +76,7 @@ class tripleo::profile::base::ceilometer::api ( $tls_keyfile = undef } - if $step >= 4 and $enable_legacy_api { + if $step >= 4 { include ::ceilometer::api class { '::ceilometer::wsgi::apache': ssl_cert => $tls_certfile, diff --git a/manifests/profile/base/cinder.pp b/manifests/profile/base/cinder.pp index 6a821f3..6e8fbb2 100644 --- a/manifests/profile/base/cinder.pp +++ b/manifests/profile/base/cinder.pp @@ -57,6 +57,7 @@ class tripleo::profile::base::cinder ( rabbit_hosts => $rabbit_endpoints, } include ::cinder::config + include ::cinder::glance } if $step >= 5 { diff --git a/manifests/profile/base/cinder/api.pp b/manifests/profile/base/cinder/api.pp index 5ea2058..450a8e6 100644 --- a/manifests/profile/base/cinder/api.pp +++ b/manifests/profile/base/cinder/api.pp @@ -94,7 +94,6 @@ class tripleo::profile::base::cinder::api ( ssl_key => $tls_keyfile, } include ::cinder::ceilometer - include ::cinder::glance } } diff --git a/manifests/profile/base/congress.pp b/manifests/profile/base/congress.pp new file mode 100644 index 0000000..1731e81 --- /dev/null +++ b/manifests/profile/base/congress.pp @@ -0,0 +1,86 @@ +# Copyright 2016 Red Hat, Inc. +# +# Licensed under the Apache License, Version 2.0 (the "License"); you may +# not use this file except in compliance with the License. You may obtain +# a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT +# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the +# License for the specific language governing permissions and limitations +# under the License. +# +# == Class: tripleo::profile::base::congress +# +# Congress server profile for tripleo +# +# === Parameters +# +# [*bootstrap_node*] +# (Optional) The hostname of the node responsible for bootstrapping tasks +# Defaults to hiera('bootstrap_nodeid') +# +# [*messaging_driver*] +# Driver for messaging service. +# Defaults to hiera('messaging_service_name', 'rabbit') +# +# [*messaging_hosts*] +# list of the messaging host fqdns +# Defaults to hiera('rabbitmq_node_names') +# +# [*messaging_password*] +# Password for messaging congress queue +# Defaults to hiera('congress::rabbit_password') +# +# [*messaging_port*] +# IP port for messaging service +# Defaults to hiera('congress::rabbit_port', 5672) +# +# [*messaging_username*] +# Username for messaging congress queue +# Defaults to hiera('congress::rabbit_userid', 'guest') +# +# [*messaging_use_ssl*] +# Flag indicating ssl usage. +# Defaults to hiera('congress::rabbit_use_ssl', '0') +# +# [*step*] +# (Optional) The current step of the deployment +# Defaults to hiera('step') + +class tripleo::profile::base::congress ( + $bootstrap_node = hiera('bootstrap_nodeid', undef), + $messaging_driver = hiera('messaging_service_name', 'rabbit'), + $messaging_hosts = any2array(hiera('rabbitmq_node_names', undef)), + $messaging_password = hiera('congress::rabbit_password'), + $messaging_port = hiera('congress::rabbit_port', '5672'), + $messaging_username = hiera('congress::rabbit_userid', 'guest'), + $messaging_use_ssl = hiera('congress::rabbit_use_ssl', '0'), + $step = hiera('step'), +) { + if $::hostname == downcase($bootstrap_node) { + $sync_db = true + } else { + $sync_db = false + } + + if $step >= 4 or ($step >= 3 and $sync_db){ + $messaging_use_ssl_real = sprintf('%s', bool2num(str2bool($messaging_use_ssl))) + class { '::congress': + sync_db => $sync_db, + default_transport_url => os_transport_url({ + 'transport' => $messaging_driver, + 'hosts' => $messaging_hosts, + 'port' => sprintf('%s', $messaging_port), + 'username' => $messaging_username, + 'password' => $messaging_password, + 'ssl' => $messaging_use_ssl_real, + }), + } + + include ::congress::server + include ::congress::db + } +} diff --git a/manifests/profile/base/database/mysql.pp b/manifests/profile/base/database/mysql.pp index 1692108..4ccfabc 100644 --- a/manifests/profile/base/database/mysql.pp +++ b/manifests/profile/base/database/mysql.pp @@ -151,6 +151,9 @@ class tripleo::profile::base::database::mysql ( if hiera('cinder_api_enabled', false) { include ::cinder::db::mysql } + if hiera('congress_enabled', false) { + include ::congress::db::mysql + } if hiera('glance_api_enabled', false) { include ::glance::db::mysql } @@ -185,12 +188,18 @@ class tripleo::profile::base::database::mysql ( if hiera('sahara_api_enabled', false) { include ::sahara::db::mysql } + if hiera('tacker_enabled', false) { + include ::tacker::db::mysql + } if hiera('trove_api_enabled', false) { include ::trove::db::mysql } if hiera('panko_api_enabled', false) { include ::panko::db::mysql } + if hiera('ec2_api_enabled', false) { + include ::ec2api::db::mysql + } } } diff --git a/manifests/profile/base/docker_registry.pp b/manifests/profile/base/docker_registry.pp index 05a516d..ebe84bf 100644 --- a/manifests/profile/base/docker_registry.pp +++ b/manifests/profile/base/docker_registry.pp @@ -19,21 +19,22 @@ # === Parameters: # # [*registry_host*] -# (String) IP address on which the Docker registry is listening on +# (String) IP address or hostname the Docker registry binds to # Defaults to hiera('controller_host') # # [*registry_port*] # (Integer) The port on which the Docker registry is listening on # Defaults to 8787 # -# [*controller_admin_vip*] -# (String) VIP of the host -# Defaults to hiera('controller_admin_vip') +# [*registry_admin_host*] +# (String) IP address or hostname the Docker registry binds to in the admin +# network +# Defaults to hiera('controller_admin_host') # class tripleo::profile::base::docker_registry ( - $registry_host = hiera('controller_host'), - $registry_port = 8787, - $controller_admin_vip = hiera('controller_admin_vip'), + $registry_host = hiera('controller_host'), + $registry_port = 8787, + $registry_admin_host = hiera('controller_admin_host'), ) { # We want a v2 registry package{'docker-registry': @@ -55,7 +56,7 @@ class tripleo::profile::base::docker_registry ( line => join ([ 'INSECURE_REGISTRY="', '--insecure-registry ', $registry_host, ':', $registry_port, ' ', - '--insecure-registry ', $controller_admin_vip, ':', $registry_port, '"']), + '--insecure-registry ', $registry_admin_host, ':', $registry_port, '"']), match => 'INSECURE_REGISTRY=', require => Package['docker'], notify => Service['docker'], diff --git a/manifests/profile/base/etcd.pp b/manifests/profile/base/etcd.pp new file mode 100644 index 0000000..505e29f --- /dev/null +++ b/manifests/profile/base/etcd.pp @@ -0,0 +1,66 @@ +# Copyright 2016 Red Hat, Inc. +# +# Licensed under the Apache License, Version 2.0 (the "License"); you may +# not use this file except in compliance with the License. You may obtain +# a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT +# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the +# License for the specific language governing permissions and limitations +# under the License. +# +# == Class: tripleo::profile::base::etcd +# +# etcd profile for tripleo +# +# === Parameters +# +# [*bind_ip*] +# (optional) IP to bind etcd service to. +# Defaults to '127.0.0.1'. +# +# [*client_port*] +# (optional) etcd client listening port. +# Defaults to '2379'. +# +# [*peer_port*] +# (optional) etcd peer listening port. +# Defaults to '2380'. +# +# [*nodes*] +# (Optional) Array of host(s) for etcd nodes. +# Defaults to hiera('etcd_node_ips', []). +# +# [*step*] +# (Optional) The current step in deployment. See tripleo-heat-templates +# for more details. +# Defaults to hiera('step') +# +class tripleo::profile::base::etcd ( + $bind_ip = '127.0.0.1', + $client_port = '2379', + $peer_port = '2380', + $nodes = hiera('etcd_node_names', []), + $step = hiera('step'), +) { + if $step >= 1 { + if count($nodes) > 1 { + $cluster_enabled = true + } else { + $cluster_enabled = false + } + + class {'::etcd': + listen_client_urls => "http://${bind_ip}:${client_port}", + advertise_client_urls => "http://${bind_ip}:${client_port}", + listen_peer_urls => "http://${bind_ip}:${peer_port}", + initial_advertise_peer_urls => "http://${bind_ip}:${peer_port}", + initial_cluster => regsubst($nodes, '.+', "\\0=http://\\0:${peer_port}"), + cluster_enabled => $cluster_enabled, + proxy => 'off', + } + } +} diff --git a/manifests/profile/base/glance/api.pp b/manifests/profile/base/glance/api.pp index 8945fff..e5807f6 100644 --- a/manifests/profile/base/glance/api.pp +++ b/manifests/profile/base/glance/api.pp @@ -22,10 +22,39 @@ # (Optional) The hostname of the node responsible for bootstrapping tasks # Defaults to hiera('bootstrap_nodeid') # +# [*certificates_specs*] +# (Optional) The specifications to give to certmonger for the certificate(s) +# it will create. +# Example with hiera: +# apache_certificates_specs: +# httpd-internal_api: +# hostname: <overcloud controller fqdn> +# service_certificate: <service certificate path> +# service_key: <service key path> +# principal: "haproxy/<overcloud controller fqdn>" +# Defaults to hiera('apache_certificate_specs', {}). +# +# [*enable_internal_tls*] +# (Optional) Whether TLS in the internal network is enabled or not. +# Defaults to hiera('enable_internal_tls', false) +# +# [*generate_service_certificates*] +# (Optional) Whether or not certmonger will generate certificates for +# HAProxy. This could be as many as specified by the $certificates_specs +# variable. +# Note that this doesn't configure the certificates in haproxy, it merely +# creates the certificates. +# Defaults to hiera('generate_service_certificate', false). +# # [*glance_backend*] # (Optional) Glance backend(s) to use. # Defaults to downcase(hiera('glance_backend', 'swift')) # +# [*glance_network*] +# (Optional) The network name where the glance endpoint is listening on. +# This is set by t-h-t. +# Defaults to hiera('glance_api_network', undef) +# # [*glance_nfs_enabled*] # (Optional) Whether to use NFS mount as 'file' backend storage location. # Defaults to false @@ -42,15 +71,40 @@ # [*rabbit_port*] # IP port for rabbitmq service # Defaults to hiera('glance::notify::rabbitmq::rabbit_port', 5672) - +# +# [*tls_proxy_bind_ip*] +# IP on which the TLS proxy will listen on. Required only if +# enable_internal_tls is set. +# Defaults to undef +# +# [*tls_proxy_fqdn*] +# fqdn on which the tls proxy will listen on. required only used if +# enable_internal_tls is set. +# defaults to undef +# +# [*tls_proxy_port*] +# port on which the tls proxy will listen on. Only used if +# enable_internal_tls is set. +# defaults to 9292 +# class tripleo::profile::base::glance::api ( - $bootstrap_node = hiera('bootstrap_nodeid', undef), - $glance_backend = downcase(hiera('glance_backend', 'swift')), - $glance_nfs_enabled = false, - $step = hiera('step'), - $rabbit_hosts = hiera('rabbitmq_node_names', undef), - $rabbit_port = hiera('glance::notify::rabbitmq::rabbit_port', 5672), + $bootstrap_node = hiera('bootstrap_nodeid', undef), + $certificates_specs = hiera('apache_certificates_specs', {}), + $enable_internal_tls = hiera('enable_internal_tls', false), + $generate_service_certificates = hiera('generate_service_certificates', false), + $glance_backend = downcase(hiera('glance_backend', 'swift')), + $glance_network = hiera('glance_api_network', undef), + $glance_nfs_enabled = false, + $step = hiera('step'), + $rabbit_hosts = hiera('rabbitmq_node_names', undef), + $rabbit_port = hiera('glance::notify::rabbitmq::rabbit_port', 5672), + $tls_proxy_bind_ip = undef, + $tls_proxy_fqdn = undef, + $tls_proxy_port = 9292, ) { + if $enable_internal_tls and $generate_service_certificates { + ensure_resources('tripleo::certmonger::httpd', $certificates_specs) + } if $::hostname == downcase($bootstrap_node) { $sync_db = true @@ -63,6 +117,28 @@ class tripleo::profile::base::glance::api ( } if $step >= 4 or ($step >= 3 and $sync_db) { + if $enable_internal_tls { + if !$glance_network { + fail('glance_api_network is not set in the hieradata.') + } + if !$tls_proxy_bind_ip { + fail('glance_api_tls_proxy_bind_ip is not set in the hieradata.') + } + if !$tls_proxy_fqdn { + fail('tls_proxy_fqdn is required if internal TLS is enabled.') + } + $tls_certfile = $certificates_specs["httpd-${glance_network}"]['service_certificate'] + $tls_keyfile = $certificates_specs["httpd-${glance_network}"]['service_key'] + + ::tripleo::tls_proxy { 'glance-api': + servername => $tls_proxy_fqdn, + ip => $tls_proxy_bind_ip, + port => $tls_proxy_port, + tls_cert => $tls_certfile, + tls_key => $tls_keyfile, + notify => Class['::glance::api'], + } + } case $glance_backend { 'swift': { $backend_store = 'glance.store.swift.Store' } 'file': { $backend_store = 'glance.store.filesystem.Store' } @@ -75,6 +151,7 @@ class tripleo::profile::base::glance::api ( # TODO: notifications, scrubber, etc. include ::glance include ::glance::config + # TODO(jaosorior): Remove bind_host when we set it up conditionally in t-h-t class { '::glance::api': stores => $glance_store, sync_db => $sync_db, diff --git a/manifests/profile/base/horizon.pp b/manifests/profile/base/horizon.pp index be07c0e..bd28ab0 100644 --- a/manifests/profile/base/horizon.pp +++ b/manifests/profile/base/horizon.pp @@ -30,7 +30,7 @@ class tripleo::profile::base::horizon ( # Horizon include ::apache::mod::remoteip include ::apache::mod::status - if 'cisco_n1kv' in hiera('neutron::plugins::ml2::mechanism_drivers') { + if 'cisco_n1kv' in hiera('neutron::plugins::ml2::mechanism_drivers', undef) { $_profile_support = 'cisco' } else { $_profile_support = 'None' diff --git a/manifests/profile/base/keystone.pp b/manifests/profile/base/keystone.pp index a388def..72049e3 100644 --- a/manifests/profile/base/keystone.pp +++ b/manifests/profile/base/keystone.pp @@ -209,6 +209,9 @@ class tripleo::profile::base::keystone ( if hiera('cinder_api_enabled', false) { include ::cinder::keystone::auth } + if hiera('congress_enabled', false) { + include ::congress::keystone::auth + } if hiera('glance_api_enabled', false) { include ::glance::keystone::auth } @@ -248,6 +251,9 @@ class tripleo::profile::base::keystone ( if hiera('swift_proxy_enabled', false) { include ::swift::keystone::auth } + if hiera('tacker_enabled', false) { + include ::tacker::keystone::auth + } if hiera('trove_api_enabled', false) { include ::trove::keystone::auth } @@ -255,6 +261,8 @@ class tripleo::profile::base::keystone ( include ::zaqar::keystone::auth include ::zaqar::keystone::auth_websocket } + if hiera('ec2_api_enabled', false) { + include ::ec2api::keystone::auth + } } } - diff --git a/manifests/profile/base/metrics/collectd.pp b/manifests/profile/base/metrics/collectd.pp index 0f738d1..d8e6f89 100644 --- a/manifests/profile/base/metrics/collectd.pp +++ b/manifests/profile/base/metrics/collectd.pp @@ -1,13 +1,27 @@ +# Copyright 2016 Red Hat, Inc. +# +# Licensed under the Apache License, Version 2.0 (the "License"); you may +# not use this file except in compliance with the License. You may obtain +# a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT +# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the +# License for the specific language governing permissions and limitations +# under the License. +# # == Class: tripleo::profile::base::metrics::collectd # # Collectd configuration for TripleO # # === Parameters # -# [*collectd_plugins*] -# (Optional) List. A list of collectd plugins to configure (the -# corresponding collectd::plugin::NAME class must exist in the -# collectd package). +# [*step*] +# (Optional) The current step in deployment. See tripleo-heat-templates +# for more details. +# Defaults to hiera('step') # # [*collectd_server*] # (Optional) String. The name or address of a collectd server to @@ -28,61 +42,62 @@ # [*collectd_securitylevel*] # (Optional) String. # -# [*collectd_interface*] -# (Optional) String. Name of a network interface. -# -# [*collectd_graphite_server*] -# (Optional) String. The name or address of a graphite server to -# which we should send metrics. -# -# [*collectd_graphite_port*] -# (Optional) Integer. This is the port to which we will connect on -# the graphite server. Defaults to 2004. -# -# [*collectd_graphite_prefix*] -# (Optional) String. Prefix to add to metric names. Defaults to -# 'overcloud.'. -# -# [*collectd_graphite_protocol*] -# (Optional) String. One of 'udp' or 'tcp'. -# +# [*service_names*] +# (Optional) List of strings. A list of active services in this tripleo +# deployment. This is used to look up service-specific plugins that +# need to be installed. class tripleo::profile::base::metrics::collectd ( - $collectd_plugins = [], + $step = hiera('step'), $collectd_server = undef, - $collectd_port = 25826, + $collectd_port = undef, $collectd_username = undef, $collectd_password = undef, $collectd_securitylevel = undef, - - $collectd_graphite_server = undef, - $collectd_graphite_port = 2004, - $collectd_graphite_prefix = undef, - $collectd_graphite_protocol = 'udp' + $service_names = hiera('service_names', []) ) { - include ::collectd - ::tripleo::profile::base::metrics::collectd::plugin_helper { $collectd_plugins: } + if $step >= 3 { + include ::collectd - if ! ($collectd_graphite_protocol in ['udp', 'tcp']) { - fail("collectd_graphite_protocol must be one of 'udp' or 'tcp'") - } + if ! ($collectd_securitylevel in [undef, 'None', 'Sign', 'Encrypt']) { + fail('collectd_securitylevel must be one of (None, Sign, Encrypt).') + } + + # Load per-service plugin configuration + ::tripleo::profile::base::metrics::collectd::collectd_service { + $service_names: } + + # Because THT doesn't allow us to default values to undef, we need + # to perform a number of transformations here to avoid passing a bunch of + # empty strings to the collectd plugins. - if $collectd_server { - ::collectd::plugin::network::server { $collectd_server: - username => $collectd_username, - password => $collectd_password, - port => $collectd_port, - securitylevel => $collectd_securitylevel, + $_collectd_username = empty($collectd_username) ? { + true => undef, + default => $collectd_username + } + + $_collectd_password = empty($collectd_password) ? { + true => undef, + default => $collectd_password } - } - if $collectd_graphite_server { - ::collectd::plugin::write_graphite::carbon { 'openstack_graphite': - graphitehost => $collectd_graphite_server, - graphiteport => $collectd_graphite_port, - graphiteprefix => $collectd_graphite_prefix, - protocol => $collectd_graphite_protocol, + $_collectd_port = empty($collectd_port) ? { + true => undef, + default => $collectd_port + } + + $_collectd_securitylevel = empty($collectd_securitylevel) ? { + true => undef, + default => $collectd_securitylevel + } + + if ! empty($collectd_server) { + ::collectd::plugin::network::server { $collectd_server: + username => $_collectd_username, + password => $_collectd_password, + port => $_collectd_port, + securitylevel => $_collectd_securitylevel, + } } } } - diff --git a/manifests/profile/base/metrics/collectd/collectd_plugin.pp b/manifests/profile/base/metrics/collectd/collectd_plugin.pp new file mode 100644 index 0000000..5ab940b --- /dev/null +++ b/manifests/profile/base/metrics/collectd/collectd_plugin.pp @@ -0,0 +1,6 @@ +# We use this to transform a list of unqualified plugin names +# (like ['disk', 'ntpd']) into the correct collectd plugin classes. +define tripleo::profile::base::metrics::collectd::collectd_plugin ( +) { + include "collectd::plugin::${title}" +} diff --git a/manifests/profile/base/metrics/collectd/collectd_service.pp b/manifests/profile/base/metrics/collectd/collectd_service.pp new file mode 100644 index 0000000..c1b3a60 --- /dev/null +++ b/manifests/profile/base/metrics/collectd/collectd_service.pp @@ -0,0 +1,11 @@ +# This is used to look up a list of service-specific collectd plugins +# in the hiera data provided by THT. +define tripleo::profile::base::metrics::collectd::collectd_service ( +) { + $plugins = hiera("tripleo.collectd.plugins.${title}", []) + + if $plugins { + ::tripleo::profile::base::metrics::collectd::collectd_plugin { + $plugins: } + } +} diff --git a/manifests/profile/base/neutron/server.pp b/manifests/profile/base/neutron/server.pp index 4667ae2..5d6909f 100644 --- a/manifests/profile/base/neutron/server.pp +++ b/manifests/profile/base/neutron/server.pp @@ -22,10 +22,34 @@ # (Optional) The hostname of the node responsible for bootstrapping tasks # Defaults to hiera('bootstrap_nodeid') # -# [*step*] -# (Optional) The current step in deployment. See tripleo-heat-templates -# for more details. -# Defaults to hiera('step') +# [*certificates_specs*] +# (Optional) The specifications to give to certmonger for the certificate(s) +# it will create. +# Example with hiera: +# apache_certificates_specs: +# httpd-internal_api: +# hostname: <overcloud controller fqdn> +# service_certificate: <service certificate path> +# service_key: <service key path> +# principal: "haproxy/<overcloud controller fqdn>" +# Defaults to hiera('apache_certificate_specs', {}). +# +# [*dvr_enabled*] +# (Optional) Is dvr enabled, used when no override is passed to +# l3_ha_override to calculate enabling l3 HA. +# Defaults to hiera('neutron::server::router_distributed') or false +# +# [*enable_internal_tls*] +# (Optional) Whether TLS in the internal network is enabled or not. +# Defaults to hiera('enable_internal_tls', false) +# +# [*generate_service_certificates*] +# (Optional) Whether or not certmonger will generate certificates for +# HAProxy. This could be as many as specified by the $certificates_specs +# variable. +# Note that this doesn't configure the certificates in haproxy, it merely +# creates the certificates. +# Defaults to hiera('generate_service_certificate', false). # # [*l3_ha_override*] # (Optional) Override the calculated value for neutron::server::l3_ha @@ -41,17 +65,49 @@ # (we need to default neutron_l3_short_node_names to an empty list # because some neutron backends disable the l3 agent) # -# [*dvr_enabled*] -# (Optional) Is dvr enabled, used when no override is passed to -# l3_ha_override to calculate enabling l3 HA. -# Defaults to hiera('neutron::server::router_distributed') or false +# [*neutron_network*] +# (Optional) The network name where the neutron endpoint is listening on. +# This is set by t-h-t. +# Defaults to hiera('neutron_api_network', undef) +# +# [*step*] +# (Optional) The current step in deployment. See tripleo-heat-templates +# for more details. +# Defaults to hiera('step') +# +# [*tls_proxy_bind_ip*] +# IP on which the TLS proxy will listen on. Required only if +# enable_internal_tls is set. +# Defaults to undef +# +# [*tls_proxy_fqdn*] +# fqdn on which the tls proxy will listen on. required only used if +# enable_internal_tls is set. +# defaults to undef +# +# [*tls_proxy_port*] +# port on which the tls proxy will listen on. Only used if +# enable_internal_tls is set. +# defaults to 9696 +# class tripleo::profile::base::neutron::server ( - $bootstrap_node = hiera('bootstrap_nodeid', undef), - $step = hiera('step'), - $l3_ha_override = '', - $l3_nodes = hiera('neutron_l3_short_node_names', []), - $dvr_enabled = hiera('neutron::server::router_distributed', false) + $bootstrap_node = hiera('bootstrap_nodeid', undef), + $certificates_specs = hiera('apache_certificates_specs', {}), + $dvr_enabled = hiera('neutron::server::router_distributed', false), + $enable_internal_tls = hiera('enable_internal_tls', false), + $generate_service_certificates = hiera('generate_service_certificates', false), + $l3_ha_override = '', + $l3_nodes = hiera('neutron_l3_short_node_names', []), + $neutron_network = hiera('neutron_api_network', undef), + $step = hiera('step'), + $tls_proxy_bind_ip = undef, + $tls_proxy_fqdn = undef, + $tls_proxy_port = 9696, ) { + if $enable_internal_tls and $generate_service_certificates { + ensure_resources('tripleo::certmonger::httpd', $certificates_specs) + } + if $::hostname == downcase($bootstrap_node) { $sync_db = true } else { @@ -73,7 +129,24 @@ class tripleo::profile::base::neutron::server ( # We start neutron-server on the bootstrap node first, because # it will try to populate tables and we need to make sure this happens # before it starts on other nodes - if $step >= 4 and $sync_db { + if $step >= 4 and $sync_db or $step >= 5 and !$sync_db { + if $enable_internal_tls { + if !$neutron_network { + fail('neutron_api_network is not set in the hieradata.') + } + $tls_certfile = $certificates_specs["httpd-${neutron_network}"]['service_certificate'] + $tls_keyfile = $certificates_specs["httpd-${neutron_network}"]['service_key'] + + ::tripleo::tls_proxy { 'neutron-api': + servername => $tls_proxy_fqdn, + ip => $tls_proxy_bind_ip, + port => $tls_proxy_port, + tls_cert => $tls_certfile, + tls_key => $tls_keyfile, + notify => Class['::neutron::server'], + } + } + include ::neutron::server::notifications # We need to override the hiera value neutron::server::sync_db which is set # to true @@ -82,11 +155,4 @@ class tripleo::profile::base::neutron::server ( l3_ha => $l3_ha, } } - if $step >= 5 and !$sync_db { - include ::neutron::server::notifications - class { '::neutron::server': - sync_db => $sync_db, - l3_ha => $l3_ha, - } - } } diff --git a/manifests/profile/base/nova.pp b/manifests/profile/base/nova.pp index dae627c..fe1e6a6 100644 --- a/manifests/profile/base/nova.pp +++ b/manifests/profile/base/nova.pp @@ -110,6 +110,7 @@ class tripleo::profile::base::nova ( } if $step >= 4 { + include ::nova::placement if $manage_migration { class { '::nova::migration::libvirt': configure_libvirt => $libvirt_enabled, diff --git a/manifests/profile/base/nova/api.pp b/manifests/profile/base/nova/api.pp index 8ded3ef..83baae2 100644 --- a/manifests/profile/base/nova/api.pp +++ b/manifests/profile/base/nova/api.pp @@ -85,25 +85,8 @@ class tripleo::profile::base::nova::api ( $tls_keyfile = undef } - if ($step >= 3 and $sync_db) { - $messaging_hosts_real = any2array($::tripleo::profile::base::nova::messaging_hosts) - # TODO(aschultz): remove sprintf once we properly type the port, needs - # to be a string for the os_transport_url function. - $messaging_port_real = sprintf('%s', $::tripleo::profile::base::nova::messaging_port) - $messaging_use_ssl_real = sprintf('%s', bool2num(str2bool($::tripleo::profile::base::nova::messaging_use_ssl))) - - #TODO(emilien): enable it again when it's fixed upstream in nova - # https://bugs.launchpad.net/tripleo/+bug/1649341 - # class { '::nova::db::sync_cell_v2': - # transport_url => os_transport_url({ - # 'transport' => $::tripleo::profile::base::nova::messaging_driver, - # 'hosts' => $messaging_hosts_real, - # 'port' => $messaging_port_real, - # 'username' => $::tripleo::profile::base::nova::messaging_username, - # 'password' => $::tripleo::profile::base::nova::messaging_password, - # 'ssl' => $messaging_use_ssl_real, - # }), - # } + if $step >= 3 and $sync_db { + include ::nova::cell_v2::simple_setup } if $step >= 4 or ($step >= 3 and $sync_db) { diff --git a/manifests/profile/base/nova/ec2api.pp b/manifests/profile/base/nova/ec2api.pp new file mode 100644 index 0000000..f34b071 --- /dev/null +++ b/manifests/profile/base/nova/ec2api.pp @@ -0,0 +1,35 @@ +# Copyright 2016 Red Hat, Inc. +# +# Licensed under the Apache License, Version 2.0 (the "License"); you may +# not use this file except in compliance with the License. You may obtain +# a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT +# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the +# License for the specific language governing permissions and limitations +# under the License. +# +# == Class: tripleo::profile::base::nova::ec2api +# +# EC2-compatible Nova API profile for tripleo +# +# === Parameters +# +# [*step*] +# (Optional) The current step in deployment. See tripleo-heat-templates +# for more details. +# Defaults to hiera('step') +# +class tripleo::profile::base::nova::ec2api ( + $step = hiera('step') +) { + if $step >= 4 { + include ::ec2api + include ::ec2api::api + include ::ec2api::db::sync + include ::ec2api::metadata + } +} diff --git a/manifests/profile/base/nova/placement.pp b/manifests/profile/base/nova/placement.pp index 7edd4e8..aa8c3c7 100644 --- a/manifests/profile/base/nova/placement.pp +++ b/manifests/profile/base/nova/placement.pp @@ -86,8 +86,6 @@ class tripleo::profile::base::nova::placement ( } if $step >= 4 { - include ::nova::placement - class { '::nova::wsgi::apache_placement': ssl_cert => $tls_certfile, ssl_key => $tls_keyfile, diff --git a/manifests/profile/base/octavia.pp b/manifests/profile/base/octavia.pp new file mode 100644 index 0000000..46ca009 --- /dev/null +++ b/manifests/profile/base/octavia.pp @@ -0,0 +1,57 @@ +# Copyright 2016 Red Hat, Inc. +# +# Licensed under the Apache License, Version 2.0 (the "License"); you may +# not use this file except in compliance with the License. You may obtain +# a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT +# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the +# License for the specific language governing permissions and limitations +# under the License. +# +# == Class: tripleo::profile::base::octavia +# +# Octavia server profile for tripleo +# +# === Parameters +# +# [*step*] +# (Optional) The current step of the deployment +# Defaults to hiera('step') +# +# [*rabbit_user*] +# [*rabbit_password*] +# (Optional) RabbitMQ user details +# Defaults to undef +# +# [*rabbit_hosts*] +# list of the rabbbit host fqdns +# Defaults to hiera('rabbitmq_node_names') +# +# [*rabbit_port*] +# IP port for rabbitmq service +# Defaults to 5672. +# +class tripleo::profile::base::octavia ( + $step = hiera('step'), + $rabbit_user = undef, + $rabbit_password = undef, + $rabbit_hosts = hiera('rabbitmq_node_names', undef), + $rabbit_port = '5672' +) { + if $step >= 3 { + class { '::octavia' : + default_transport_url => os_transport_url({ + 'transport' => 'rabbit', + 'hosts' => $rabbit_hosts, + 'port' => sprintf('%s', $rabbit_port), + 'username' => $rabbit_user, + 'password' => $rabbit_password + }) + } + include ::octavia::config + } +} diff --git a/manifests/profile/base/glance/registry.pp b/manifests/profile/base/octavia/api.pp index cd40aeb..d457478 100644 --- a/manifests/profile/base/glance/registry.pp +++ b/manifests/profile/base/octavia/api.pp @@ -12,39 +12,43 @@ # License for the specific language governing permissions and limitations # under the License. # -# == Class: tripleo::profile::base::glance::registry +# == Class: tripleo::profile::base::octavia::api # -# Glance Registry profile for tripleo +# Octavia API server profile for tripleo # # === Parameters # # [*bootstrap_node*] -# DEPRECATED # (Optional) The hostname of the node responsible for bootstrapping tasks # Defaults to hiera('bootstrap_nodeid') # -# [*glance_backend*] -# (Optional) Glance backend(s) to use. -# Defaults to downcase(hiera('glance_backend', 'swift')) -# # [*step*] # (Optional) The current step in deployment. See tripleo-heat-templates # for more details. # Defaults to hiera('step') # -class tripleo::profile::base::glance::registry ( - $bootstrap_node = undef, - $glance_backend = downcase(hiera('glance_backend', 'swift')), +class tripleo::profile::base::octavia::api ( + $bootstrap_node = hiera('bootstrap_nodeid', undef), $step = hiera('step'), ) { + if $::hostname == downcase($bootstrap_node) { + $sync_db = true + } else { + $sync_db = false + } - if $step >= 4 { - # TODO: notifications, scrubber, etc. - include ::glance - include ::glance::config - include ::glance::registry - include ::glance::notify::rabbitmq - include join(['::glance::backend::', $glance_backend]) + include ::tripleo::profile::base::octavia + + if $step >= 3 and $sync_db { + include ::octavia::db::mysql } + # We start the Octavia API server on the bootstrap node first, because + # it will try to populate tables and we need to make sure this happens + # before it starts on other nodes + if ($step >= 4 and $sync_db) or ($step >= 5 and !$sync_db) { + class { '::octavia::api': + sync_db => $sync_db, + } + } } diff --git a/manifests/profile/base/pacemaker.pp b/manifests/profile/base/pacemaker.pp index 19eb52b..6021731 100644 --- a/manifests/profile/base/pacemaker.pp +++ b/manifests/profile/base/pacemaker.pp @@ -23,15 +23,60 @@ # for more details. # Defaults to hiera('step') # +# [*pcs_tries*] +# (Optional) The number of times pcs commands should be retried. +# Defaults to hiera('pcs_tries', 20) +# +# [*remote_short_node_names*] +# (Optional) List of short node names for pacemaker remote nodes +# Defaults to hiera('pacemaker_remote_short_node_names', []) +# +# [*remote_node_ips*] +# (Optional) List of node ips for pacemaker remote nodes +# Defaults to hiera('pacemaker_remote_node_ips', []) +# +# [*remote_authkey*] +# (Optional) Authkey for pacemaker remote nodes +# Defaults to undef +# +# [*remote_reconnect_interval*] +# (Optional) Reconnect interval for the remote +# Defaults to hiera('pacemaker_remote_reconnect_interval', 60) +# +# [*remote_monitor_interval*] +# (Optional) Monitor interval for the remote +# Defaults to hiera('pacemaker_monitor_reconnect_interval', 20) +# +# [*remote_tries*] +# (Optional) Number of tries for the remote resource creation +# Defaults to hiera('pacemaker_remote_tries', 5) +# +# [*remote_try_sleep*] +# (Optional) Number of seconds to sleep between remote creation tries +# Defaults to hiera('pacemaker_remote_try_sleep', 60) +# class tripleo::profile::base::pacemaker ( - $step = hiera('step'), + $step = hiera('step'), + $pcs_tries = hiera('pcs_tries', 20), + $remote_short_node_names = hiera('pacemaker_remote_short_node_names', []), + $remote_node_ips = hiera('pacemaker_remote_node_ips', []), + $remote_authkey = undef, + $remote_reconnect_interval = hiera('pacemaker_remote_reconnect_interval', 60), + $remote_monitor_interval = hiera('pacemaker_remote_monitor_interval', 20), + $remote_tries = hiera('pacemaker_remote_tries', 5), + $remote_try_sleep = hiera('pacemaker_remote_try_sleep', 60), ) { + + if count($remote_short_node_names) != count($remote_node_ips) { + fail("Count of ${remote_short_node_names} is not equal to count of ${remote_node_ips}") + } + Pcmk_resource <| |> { tries => 10, try_sleep => 3, } - if $::hostname == downcase(hiera('bootstrap_nodeid')) { + if $::hostname == downcase(hiera('pacemaker_short_bootstrap_node_name')) { $pacemaker_master = true } else { $pacemaker_master = false @@ -55,9 +100,11 @@ class tripleo::profile::base::pacemaker ( cluster_members => $pacemaker_cluster_members, setup_cluster => $pacemaker_master, cluster_setup_extras => $cluster_setup_extras, + remote_authkey => $remote_authkey, } class { '::pacemaker::stonith': disable => !$enable_fencing, + tries => $pcs_tries, } if $enable_fencing { include ::tripleo::fencing @@ -69,6 +116,21 @@ class tripleo::profile::base::pacemaker ( # enable stonith after all fencing devices have been created Class['tripleo::fencing'] -> Class['pacemaker::stonith'] } + # We have pacemaker remote nodes configured so let's add them as resources + # We do this during step 1 right after wait-for-settle, because during step 2 + # resources might already be created on pacemaker remote nodes and we need + # a guarantee that remote nodes are already up + if $pacemaker_master and count($remote_short_node_names) > 0 { + # Creates a { "node" => "ip_address", ...} hash + $remotes_hash = hash(zip($remote_short_node_names, $remote_node_ips)) + pacemaker::resource::remote { $remote_short_node_names: + remote_address => $remotes_hash[$title], + reconnect_interval => $remote_reconnect_interval, + op_params => "monitor interval=${remote_monitor_interval}", + tries => $remote_tries, + try_sleep => $remote_try_sleep, + } + } } if $step >= 2 { diff --git a/manifests/profile/base/pacemaker_remote.pp b/manifests/profile/base/pacemaker_remote.pp new file mode 100644 index 0000000..e0fff63 --- /dev/null +++ b/manifests/profile/base/pacemaker_remote.pp @@ -0,0 +1,37 @@ +# Copyright 2016 Red Hat, Inc. +# +# Licensed under the Apache License, Version 2.0 (the "License"); you may +# not use this file except in compliance with the License. You may obtain +# a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT +# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the +# License for the specific language governing permissions and limitations +# under the License. +# +# == Class: tripleo::profile::base::pacemaker_remote +# +# Pacemaker remote profile for tripleo +# +# === Parameters +# +# [*remote_authkey*] +# Authkey for pacemaker remote nodes +# Defaults to unset +# +# [*step*] +# (Optional) The current step in deployment. See tripleo-heat-templates +# for more details. +# Defaults to hiera('step') +# +class tripleo::profile::base::pacemaker_remote ( + $remote_authkey, + $step = hiera('step'), +) { + class { '::pacemaker::remote': + remote_authkey => $remote_authkey, + } +} diff --git a/manifests/profile/base/rabbitmq.pp b/manifests/profile/base/rabbitmq.pp index 15bab44..fd8de8f 100644 --- a/manifests/profile/base/rabbitmq.pp +++ b/manifests/profile/base/rabbitmq.pp @@ -34,6 +34,11 @@ # (Optional) RabbitMQ environment. # Defaults to hiera('rabbitmq_environment'). # +# [*inet_dist_interface*] +# (Optional) Address to bind the inter-cluster interface +# to. It is the inet_dist_use_interface option in the kernel variables +# Defaults to hiera('rabbitmq::interface', undef). +# # [*nodes*] # (Optional) Array of host(s) for RabbitMQ nodes. # Defaults to hiera('rabbitmq_node_names', []). @@ -44,12 +49,13 @@ # Defaults to hiera('step') # class tripleo::profile::base::rabbitmq ( - $config_variables = hiera('rabbitmq_config_variables'), - $environment = hiera('rabbitmq_environment'), - $ipv6 = str2bool(hiera('rabbit_ipv6', false)), - $kernel_variables = hiera('rabbitmq_kernel_variables'), - $nodes = hiera('rabbitmq_node_names', []), - $step = hiera('step'), + $config_variables = hiera('rabbitmq_config_variables'), + $environment = hiera('rabbitmq_environment'), + $ipv6 = str2bool(hiera('rabbit_ipv6', false)), + $kernel_variables = hiera('rabbitmq_kernel_variables'), + $inet_dist_interface = hiera('rabbitmq::interface', undef), + $nodes = hiera('rabbitmq_node_names', []), + $step = hiera('step'), ) { # IPv6 environment, necessary for RabbitMQ. if $ipv6 { @@ -60,6 +66,14 @@ class tripleo::profile::base::rabbitmq ( } else { $rabbit_env = $environment } + if $inet_dist_interface { + $real_kernel_variables = merge( + $kernel_variables, + { 'inet_dist_use_interface' => ip_to_erl_format($inet_dist_interface) }, + ) + } else { + $real_kernel_variables = $kernel_variables + } $manage_service = hiera('rabbitmq::service_manage', true) if $step >= 1 { @@ -68,7 +82,7 @@ class tripleo::profile::base::rabbitmq ( class { '::rabbitmq': config_cluster => $manage_service, cluster_nodes => $nodes, - config_kernel_variables => $kernel_variables, + config_kernel_variables => $real_kernel_variables, config_variables => $config_variables, environment_variables => $rabbit_env, } diff --git a/manifests/profile/base/swift/proxy.pp b/manifests/profile/base/swift/proxy.pp index 2db3a42..5f3408d 100644 --- a/manifests/profile/base/swift/proxy.pp +++ b/manifests/profile/base/swift/proxy.pp @@ -18,38 +18,58 @@ # # === Parameters # -# [*step*] -# (Optional) The current step in deployment. See tripleo-heat-templates -# for more details. -# Defaults to hiera('step') +# [*ceilometer_enabled*] +# Whether the ceilometer pipeline is enabled. +# Defaults to true # -# [*memcache_servers*] -# (Optional) List of memcache servers -# Defaults to hiera('memcached_node_ips') +# [*ceilometer_messaging_driver*] +# Driver for messaging service. +# Defaults to hiera('messaging_service_name', 'rabbit') +# +# [*ceilometer_messaging_hosts*] +# list of the messaging host fqdns +# Defaults to hiera('rabbitmq_node_names') +# +# [*ceilometer_messaging_password*] +# Password for messaging nova queue +# Defaults to hiera('swift::proxy::ceilometer::rabbit_password', undef) +# +# [*ceilometer_messaging_port*] +# IP port for messaging service +# Defaults to hiera('tripleo::profile::base::swift::proxy::rabbit_port', 5672) +# +# [*ceilometer_messaging_use_ssl*] +# Flag indicating ssl usage. +# Defaults to '0' +# +# [*ceilometer_messaging_username*] +# Username for messaging nova queue +# Defaults to hiera('swift::proxy::ceilometer::rabbit_user', 'guest') # # [*memcache_port*] # (Optional) memcache port # Defaults to 11211 # -# [*rabbit_hosts*] -# list of the rabbbit host fqdns -# Defaults to hiera('rabbitmq_node_names') -# -# [*rabbit_port*] -# IP port for rabbitmq service -# Defaults to 5672 +# [*memcache_servers*] +# (Optional) List of memcache servers +# Defaults to hiera('memcached_node_ips') # -# [*ceilometer_enabled*] -# Whether the ceilometer pipeline is enabled. -# Defaults to true +# [*step*] +# (Optional) The current step in deployment. See tripleo-heat-templates +# for more details. +# Defaults to hiera('step') # class tripleo::profile::base::swift::proxy ( - $step = hiera('step'), - $memcache_servers = hiera('memcached_node_ips'), - $memcache_port = 11211, - $rabbit_hosts = hiera('rabbitmq_node_names', undef), - $rabbit_port = 5672, - $ceilometer_enabled = true, + $ceilometer_enabled = true, + $ceilometer_messaging_driver = hiera('messaging_service_name', 'rabbit'), + $ceilometer_messaging_hosts = any2array(hiera('rabbitmq_node_names', undef)), + $ceilometer_messaging_password = hiera('swift::proxy::ceilometer::rabbit_password', undef), + $ceilometer_messaging_port = hiera('tripleo::profile::base::swift::proxy::rabbit_port', '5672'), + $ceilometer_messaging_use_ssl = '0', + $ceilometer_messaging_username = hiera('swift::proxy::ceilometer::rabbit_user', 'guest'), + $memcache_port = 11211, + $memcache_servers = hiera('memcached_node_ips'), + $step = hiera('step'), ) { if $step >= 4 { $swift_memcache_servers = suffix(any2array(normalize_ip_for_uri($memcache_servers)), ":${memcache_port}") @@ -68,10 +88,17 @@ class tripleo::profile::base::swift::proxy ( include ::swift::proxy::tempurl include ::swift::proxy::formpost include ::swift::proxy::bulk - $swift_rabbit_hosts = suffix(any2array($rabbit_hosts), ":${rabbit_port}") + $ceilometer_messaging_use_ssl_real = sprintf('%s', bool2num(str2bool($ceilometer_messaging_use_ssl))) if $ceilometer_enabled { class { '::swift::proxy::ceilometer': - rabbit_hosts => $swift_rabbit_hosts, + default_transport_url => os_transport_url({ + 'transport' => $ceilometer_messaging_driver, + 'hosts' => $ceilometer_messaging_hosts, + 'port' => sprintf('%s', $ceilometer_messaging_port), + 'username' => $ceilometer_messaging_username, + 'password' => $ceilometer_messaging_password, + 'ssl' => $ceilometer_messaging_use_ssl_real, + }), } } include ::swift::proxy::versioned_writes diff --git a/manifests/profile/base/tacker.pp b/manifests/profile/base/tacker.pp new file mode 100644 index 0000000..e9f6b77 --- /dev/null +++ b/manifests/profile/base/tacker.pp @@ -0,0 +1,86 @@ +# Copyright 2016 Red Hat, Inc. +# +# Licensed under the Apache License, Version 2.0 (the "License"); you may +# not use this file except in compliance with the License. You may obtain +# a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT +# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the +# License for the specific language governing permissions and limitations +# under the License. +# +# == Class: tripleo::profile::base::tacker +# +# Tacker server profile for tripleo +# +# === Parameters +# +# [*bootstrap_node*] +# (Optional) The hostname of the node responsible for bootstrapping tasks +# Defaults to hiera('bootstrap_nodeid') +# +# [*messaging_driver*] +# Driver for messaging service. +# Defaults to hiera('messaging_service_name', 'rabbit') +# +# [*messaging_hosts*] +# list of the messaging host fqdns +# Defaults to hiera('rabbitmq_node_names') +# +# [*messaging_password*] +# Password for messaging nova queue +# Defaults to hiera('nova::rabbit_password') +# +# [*messaging_port*] +# IP port for messaging service +# Defaults to hiera('nova::rabbit_port', 5672) +# +# [*messaging_username*] +# Username for messaging nova queue +# Defaults to hiera('nova::rabbit_userid', 'guest') +# +# [*messaging_use_ssl*] +# Flag indicating ssl usage. +# Defaults to hiera('nova::rabbit_use_ssl', '0') +# +# [*step*] +# (Optional) The current step of the deployment +# Defaults to hiera('step') + +class tripleo::profile::base::tacker ( + $bootstrap_node = hiera('bootstrap_nodeid', undef), + $messaging_driver = hiera('messaging_service_name', 'rabbit'), + $messaging_hosts = any2array(hiera('rabbitmq_node_names', undef)), + $messaging_password = hiera('tacker::rabbit_password'), + $messaging_port = hiera('tacker::rabbit_port', '5672'), + $messaging_username = hiera('tacker::rabbit_userid', 'guest'), + $messaging_use_ssl = hiera('tacker::rabbit_use_ssl', '0'), + $step = hiera('step'), +) { + if $::hostname == downcase($bootstrap_node) { + $sync_db = true + } else { + $sync_db = false + } + + if $step >= 4 or ($step >= 3 and $sync_db){ + $messaging_use_ssl_real = sprintf('%s', bool2num(str2bool($messaging_use_ssl))) + class { '::tacker': + sync_db => $sync_db, + default_transport_url => os_transport_url({ + 'transport' => $messaging_driver, + 'hosts' => $messaging_hosts, + 'port' => sprintf('%s', $messaging_port), + 'username' => $messaging_username, + 'password' => $messaging_password, + 'ssl' => $messaging_use_ssl_real, + }), + } + + include ::tacker::server + include ::tacker::db + } +} diff --git a/manifests/profile/base/time/ntp.pp b/manifests/profile/base/time/ntp.pp new file mode 100644 index 0000000..c6ce309 --- /dev/null +++ b/manifests/profile/base/time/ntp.pp @@ -0,0 +1,28 @@ +# Copyright 2017 Red Hat, Inc. +# All Rights Reserved. +# +# Licensed under the Apache License, Version 2.0 (the "License"); you may +# not use this file except in compliance with the License. You may obtain +# a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT +# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the +# License for the specific language governing permissions and limitations +# under the License. +# +# == Class: tripleo::profile::base::ntp +# +# Enable NTP via composable services. +# + +class tripleo::profile::base::time::ntp { + # if installed, we don't want chrony to conflict with ntp. + package { 'chrony': + ensure => 'purged', + before => Service['ntp'], + } + include ::ntp +} diff --git a/manifests/profile/pacemaker/ceph/rbdmirror.pp b/manifests/profile/pacemaker/ceph/rbdmirror.pp new file mode 100644 index 0000000..4066225 --- /dev/null +++ b/manifests/profile/pacemaker/ceph/rbdmirror.pp @@ -0,0 +1,98 @@ +# Copyright 2016 Red Hat, Inc. +# +# Licensed under the Apache License, Version 2.0 (the "License"); you may +# not use this file except in compliance with the License. You may obtain +# a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT +# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the +# License for the specific language governing permissions and limitations +# under the License. +# +# == Class: tripleo::profile::pacemaker::ceph::rbdmirror +# +# Ceph RBD mirror Pacemaker profile for tripleo +# +# === Parameters +# +# [*bootstrap_node*] +# (Optional) The hostname of the node responsible for bootstrapping tasks +# Defaults to hiera('ceph_rbdmirror_bootstrap_short_node_name') +# +# [*client_name*] +# (Optional) Name assigned to the RBD mirror client +# Defaults to 'rbd-mirror' +# +# [*pcs_tries*] +# (Optional) The number of times pcs commands should be retried. +# Defaults to hiera('pcs_tries', 20) +# +# [*stack_action*] +# (Optional) Action executed on the stack. See tripleo-heat-templates +# for more details. +# Defaults to hiera('stack_action') +# +# [*step*] +# (Optional) The current step in deployment. See tripleo-heat-templates +# for more details. +# Defaults to hiera('step') +# +class tripleo::profile::pacemaker::ceph::rbdmirror ( + $bootstrap_node = hiera('ceph_rbdmirror_short_bootstrap_node_name'), + $client_name = 'openstack', + $pcs_tries = hiera('pcs_tries', 20), + $stack_action = hiera('stack_action'), + $step = hiera('step'), +) { + Service <| tag == 'ceph-rbd-mirror' |> { + hasrestart => true, + restart => '/bin/true', + start => '/bin/true', + stop => '/bin/true', + } + + if $::hostname == downcase($bootstrap_node) { + $pacemaker_master = true + } else { + $pacemaker_master = false + } + + include ::tripleo::profile::base::ceph + + if $step >= 2 { + pacemaker::property { 'ceph-rbdmirror-role-node-property': + property => 'ceph-rbdmirror-role', + value => true, + tries => $pcs_tries, + node => $::hostname, + } + } + + if $step >= 3 { + require ::ceph::profile::client + ceph::mirror { $client_name: + rbd_mirror_enable => false, + rbd_mirror_ensure => 'stopped', + } -> + pacemaker::resource::service { "ceph-rbd-mirror_${client_name}": + # NOTE(gfidente): systemd uses the @ sign but it is an invalid + # character in a pcmk resource name, so we need to use it only + # for the name of the service + service_name => "ceph-rbd-mirror@${client_name}", + tries => $pcs_tries, + location_rule => { + resource_discovery => 'exclusive', + score => 0, + expression => ['ceph-rbdmirror-role eq true'], + } + } + } + + if $step >= 3 and $pacemaker_master and $stack_action == 'UPDATE' { + Ceph_config<||> ~> Tripleo::Pacemaker::Resource_restart_flag["ceph-rbd-mirror@${client_name}"] + tripleo::pacemaker::resource_restart_flag { "ceph-rbd-mirror@${client_name}": } + } +} diff --git a/manifests/profile/pacemaker/cinder/backup.pp b/manifests/profile/pacemaker/cinder/backup.pp index 63988d6..ff0d8c9 100644 --- a/manifests/profile/pacemaker/cinder/backup.pp +++ b/manifests/profile/pacemaker/cinder/backup.pp @@ -20,16 +20,21 @@ # # [*bootstrap_node*] # (Optional) The hostname of the node responsible for bootstrapping tasks -# Defaults to hiera('bootstrap_nodeid') +# Defaults to hiera('cinder_backup_short_bootstrap_node_name') # # [*step*] # (Optional) The current step in deployment. See tripleo-heat-templates # for more details. # Defaults to hiera('step') # +# [*pcs_tries*] +# (Optional) The number of times pcs commands should be retried. +# Defaults to hiera('pcs_tries', 20) +# class tripleo::profile::pacemaker::cinder::backup ( - $bootstrap_node = hiera('bootstrap_nodeid'), + $bootstrap_node = hiera('cinder_backup_short_bootstrap_node_name'), $step = hiera('step'), + $pcs_tries = hiera('pcs_tries', 20), ) { Service <| tag == 'cinder::backup' |> { @@ -47,6 +52,15 @@ class tripleo::profile::pacemaker::cinder::backup ( include ::tripleo::profile::base::cinder::backup + if $step >= 2 { + pacemaker::property { 'cinder-backup-role-node-property': + property => 'cinder-backup-role', + value => true, + tries => $pcs_tries, + node => $::hostname, + } + } + if $step >= 3 and $pacemaker_master and hiera('stack_action') == 'UPDATE' { Cinder_config<||> ~> @@ -55,7 +69,13 @@ class tripleo::profile::pacemaker::cinder::backup ( if $step >= 5 and $pacemaker_master { pacemaker::resource::service { $::cinder::params::backup_service : - op_params => 'start timeout=200s stop timeout=200s', + op_params => 'start timeout=200s stop timeout=200s', + tries => $pcs_tries, + location_rule => { + resource_discovery => 'exclusive', + score => 0, + expression => ['cinder-backup-role eq true'], + } } } diff --git a/manifests/profile/pacemaker/cinder/volume.pp b/manifests/profile/pacemaker/cinder/volume.pp index 46e8b79..0d6a598 100644 --- a/manifests/profile/pacemaker/cinder/volume.pp +++ b/manifests/profile/pacemaker/cinder/volume.pp @@ -20,16 +20,21 @@ # # [*bootstrap_node*] # (Optional) The hostname of the node responsible for bootstrapping tasks -# Defaults to hiera('bootstrap_nodeid') +# Defaults to hiera('cinder_volume_short_bootstrap_node_name') # # [*step*] # (Optional) The current step in deployment. See tripleo-heat-templates # for more details. # Defaults to hiera('step') # +# [*pcs_tries*] +# (Optional) The number of times pcs commands should be retried. +# Defaults to hiera('pcs_tries', 20) +# class tripleo::profile::pacemaker::cinder::volume ( - $bootstrap_node = hiera('bootstrap_nodeid'), + $bootstrap_node = hiera('cinder_volume_short_bootstrap_node_name'), $step = hiera('step'), + $pcs_tries = hiera('pcs_tries', 20), ) { Service <| tag == 'cinder::volume' |> { hasrestart => true, @@ -46,6 +51,15 @@ class tripleo::profile::pacemaker::cinder::volume ( include ::tripleo::profile::base::cinder::volume + if $step >= 2 { + pacemaker::property { 'cinder-volume-role-node-property': + property => 'cinder-volume-role', + value => true, + tries => $pcs_tries, + node => $::hostname, + } + } + if $step >= 3 and $pacemaker_master and hiera('stack_action') == 'UPDATE' { Cinder_api_paste_ini<||> ~> Tripleo::Pacemaker::Resource_restart_flag["${::cinder::params::volume_service}"] Cinder_config<||> ~> Tripleo::Pacemaker::Resource_restart_flag["${::cinder::params::volume_service}"] @@ -54,7 +68,13 @@ class tripleo::profile::pacemaker::cinder::volume ( if $step >= 5 and $pacemaker_master { pacemaker::resource::service { $::cinder::params::volume_service : - op_params => 'start timeout=200s stop timeout=200s', + op_params => 'start timeout=200s stop timeout=200s', + tries => $pcs_tries, + location_rule => { + resource_discovery => 'exclusive', + score => 0, + expression => ['cinder-volume-role eq true'], + } } } diff --git a/manifests/profile/pacemaker/database/mysql.pp b/manifests/profile/pacemaker/database/mysql.pp index edd09bd..6a83f10 100644 --- a/manifests/profile/pacemaker/database/mysql.pp +++ b/manifests/profile/pacemaker/database/mysql.pp @@ -18,6 +18,10 @@ # # === Parameters # +# [*bootstrap_node*] +# (Optional) The hostname of the node responsible for bootstrapping tasks +# Defaults to hiera('mysql_short_bootstrap_node_name') +# # [*bind_address*] # (Optional) The address that the local mysql instance should bind to. # Defaults to $::hostname @@ -32,12 +36,18 @@ # for more details. # Defaults to hiera('step') # +# [*pcs_tries*] +# (Optional) The number of times pcs commands should be retried. +# Defaults to hiera('pcs_tries', 20) +# class tripleo::profile::pacemaker::database::mysql ( + $bootstrap_node = hiera('mysql_short_bootstrap_node_name'), $bind_address = $::hostname, $gmcast_listen_addr = hiera('mysql_bind_host'), $step = hiera('step'), + $pcs_tries = hiera('pcs_tries', 20), ) { - if $::hostname == downcase(hiera('bootstrap_nodeid')) { + if $::hostname == downcase($bootstrap_node) { $pacemaker_master = true } else { $pacemaker_master = false @@ -100,6 +110,7 @@ class tripleo::profile::pacemaker::database::mysql ( } class { '::tripleo::profile::base::database::mysql': + bootstrap_node => $bootstrap_node, manage_resources => false, remove_default_accounts => $remove_default_accounts, mysql_server_options => $mysqld_options, @@ -112,6 +123,12 @@ class tripleo::profile::pacemaker::database::mysql ( } if $step >= 2 { + pacemaker::property { 'galera-role-node-property': + property => 'galera-role', + value => true, + tries => $pcs_tries, + node => $::hostname, + } if $pacemaker_master { pacemaker::resource::ocf { 'galera' : ocf_agent_name => 'heartbeat:galera', @@ -119,7 +136,14 @@ class tripleo::profile::pacemaker::database::mysql ( master_params => '', meta_params => "master-max=${galera_nodes_count} ordered=true", resource_params => "additional_parameters='--open-files-limit=16384' enable_creation=true wsrep_cluster_address='gcomm://${galera_nodes}'", - require => Class['::mysql::server'], + tries => $pcs_tries, + location_rule => { + resource_discovery => 'exclusive', + score => 0, + expression => ['galera-role eq true'], + }, + require => [Class['::mysql::server'], + Pacemaker::Property['galera-role-node-property']], before => Exec['galera-ready'], } exec { 'galera-ready' : diff --git a/manifests/profile/pacemaker/database/redis.pp b/manifests/profile/pacemaker/database/redis.pp index 37c36aa..3ef6815 100644 --- a/manifests/profile/pacemaker/database/redis.pp +++ b/manifests/profile/pacemaker/database/redis.pp @@ -20,7 +20,7 @@ # # [*bootstrap_node*] # (Optional) The hostname of the node responsible for bootstrapping tasks -# Defaults to hiera('bootstrap_nodeid') +# Defaults to hiera('redis_short_bootstrap_node_name') # # [*enable_load_balancer*] # (Optional) Whether load balancing is enabled for this cluster @@ -36,11 +36,16 @@ # for when redis is managed by pacemaker. Defaults to hiera('redis_file_limit') # or 10240 (default in redis systemd limits) # +# [*pcs_tries*] +# (Optional) The number of times pcs commands should be retried. +# Defaults to hiera('pcs_tries', 20) +# class tripleo::profile::pacemaker::database::redis ( - $bootstrap_node = hiera('bootstrap_nodeid'), + $bootstrap_node = hiera('redis_short_bootstrap_node_name'), $enable_load_balancer = hiera('enable_load_balancer', true), $step = hiera('step'), $redis_file_limit = hiera('redis_file_limit', 10240), + $pcs_tries = hiera('pcs_tries', 20), ) { if $::hostname == downcase($bootstrap_node) { $pacemaker_master = true @@ -71,14 +76,29 @@ class tripleo::profile::pacemaker::database::redis ( } } - if $step >= 2 and $pacemaker_master { - pacemaker::resource::ocf { 'redis': - ocf_agent_name => 'heartbeat:redis', - master_params => '', - meta_params => 'notify=true ordered=true interleave=true', - resource_params => 'wait_last_known_master=true', - op_params => 'start timeout=200s stop timeout=200s', - require => Class['::redis'], + if $step >= 2 { + pacemaker::property { 'redis-role-node-property': + property => 'redis-role', + value => true, + tries => $pcs_tries, + node => $::hostname, + } + if $pacemaker_master { + pacemaker::resource::ocf { 'redis': + ocf_agent_name => 'heartbeat:redis', + master_params => '', + meta_params => 'notify=true ordered=true interleave=true', + resource_params => 'wait_last_known_master=true', + op_params => 'start timeout=200s stop timeout=200s', + tries => $pcs_tries, + location_rule => { + resource_discovery => 'exclusive', + score => 0, + expression => ['redis-role eq true'], + }, + require => [Class['::redis'], + Pacemaker::Property['redis-role-node-property']], + } } } } diff --git a/manifests/profile/pacemaker/haproxy.pp b/manifests/profile/pacemaker/haproxy.pp index 605bb15..f006f78 100644 --- a/manifests/profile/pacemaker/haproxy.pp +++ b/manifests/profile/pacemaker/haproxy.pp @@ -20,7 +20,7 @@ # # [*bootstrap_node*] # (Optional) The hostname of the node responsible for bootstrapping tasks -# Defaults to hiera('bootstrap_nodeid') +# Defaults to hiera('haproxy_short_bootstrap_node_name') # # [*enable_load_balancer*] # (Optional) Whether load balancing is enabled for this cluster @@ -31,10 +31,15 @@ # for more details. # Defaults to hiera('step') # +# [*pcs_tries*] +# (Optional) The number of times pcs commands should be retried. +# Defaults to hiera('pcs_tries', 20) +# class tripleo::profile::pacemaker::haproxy ( - $bootstrap_node = hiera('bootstrap_nodeid'), + $bootstrap_node = hiera('haproxy_short_bootstrap_node_name'), $enable_load_balancer = hiera('enable_load_balancer', true), $step = hiera('step'), + $pcs_tries = hiera('pcs_tries', 20), ) { include ::tripleo::profile::base::haproxy @@ -50,56 +55,90 @@ class tripleo::profile::pacemaker::haproxy ( } } - if $step >= 2 and $pacemaker_master and $enable_load_balancer { + if $step >= 2 and $enable_load_balancer { + pacemaker::property { 'haproxy-role-node-property': + property => 'haproxy-role', + value => true, + tries => $pcs_tries, + node => $::hostname, + } + if $pacemaker_master { + $haproxy_location_rule = { + resource_discovery => 'exclusive', + score => 0, + expression => ['haproxy-role eq true'], + } # FIXME: we should not have to access tripleo::haproxy class # parameters here to configure pacemaker VIPs. The configuration # of pacemaker VIPs could move into puppet-tripleo or we should # make use of less specific hiera parameters here for the settings. pacemaker::resource::service { 'haproxy': - op_params => 'start timeout=200s stop timeout=200s', - clone_params => true, + op_params => 'start timeout=200s stop timeout=200s', + clone_params => true, + location_rule => $haproxy_location_rule, + tries => $pcs_tries, + require => Pacemaker::Property['haproxy-role-node-property'], } $control_vip = hiera('controller_virtual_ip') tripleo::pacemaker::haproxy_with_vip { 'haproxy_and_control_vip': - vip_name => 'control', - ip_address => $control_vip, + vip_name => 'control', + ip_address => $control_vip, + location_rule => $haproxy_location_rule, + pcs_tries => $pcs_tries, + require => Pacemaker::Property['haproxy-role-node-property'], } $public_vip = hiera('public_virtual_ip') tripleo::pacemaker::haproxy_with_vip { 'haproxy_and_public_vip': - ensure => $public_vip and $public_vip != $control_vip, - vip_name => 'public', - ip_address => $public_vip, + ensure => $public_vip and $public_vip != $control_vip, + vip_name => 'public', + ip_address => $public_vip, + location_rule => $haproxy_location_rule, + pcs_tries => $pcs_tries, + require => Pacemaker::Property['haproxy-role-node-property'], } $redis_vip = hiera('redis_vip') tripleo::pacemaker::haproxy_with_vip { 'haproxy_and_redis_vip': - ensure => $redis_vip and $redis_vip != $control_vip, - vip_name => 'redis', - ip_address => $redis_vip, + ensure => $redis_vip and $redis_vip != $control_vip, + vip_name => 'redis', + ip_address => $redis_vip, + location_rule => $haproxy_location_rule, + pcs_tries => $pcs_tries, + require => Pacemaker::Property['haproxy-role-node-property'], } $internal_api_vip = hiera('internal_api_virtual_ip') tripleo::pacemaker::haproxy_with_vip { 'haproxy_and_internal_api_vip': - ensure => $internal_api_vip and $internal_api_vip != $control_vip, - vip_name => 'internal_api', - ip_address => $internal_api_vip, + ensure => $internal_api_vip and $internal_api_vip != $control_vip, + vip_name => 'internal_api', + ip_address => $internal_api_vip, + location_rule => $haproxy_location_rule, + pcs_tries => $pcs_tries, + require => Pacemaker::Property['haproxy-role-node-property'], } $storage_vip = hiera('storage_virtual_ip') tripleo::pacemaker::haproxy_with_vip { 'haproxy_and_storage_vip': - ensure => $storage_vip and $storage_vip != $control_vip, - vip_name => 'storage', - ip_address => $storage_vip, + ensure => $storage_vip and $storage_vip != $control_vip, + vip_name => 'storage', + ip_address => $storage_vip, + location_rule => $haproxy_location_rule, + pcs_tries => $pcs_tries, + require => Pacemaker::Property['haproxy-role-node-property'], } $storage_mgmt_vip = hiera('storage_mgmt_virtual_ip') tripleo::pacemaker::haproxy_with_vip { 'haproxy_and_storage_mgmt_vip': - ensure => $storage_mgmt_vip and $storage_mgmt_vip != $control_vip, - vip_name => 'storage_mgmt', - ip_address => $storage_mgmt_vip, + ensure => $storage_mgmt_vip and $storage_mgmt_vip != $control_vip, + vip_name => 'storage_mgmt', + ip_address => $storage_mgmt_vip, + location_rule => $haproxy_location_rule, + pcs_tries => $pcs_tries, + require => Pacemaker::Property['haproxy-role-node-property'], } + } } } diff --git a/manifests/profile/pacemaker/manila.pp b/manifests/profile/pacemaker/manila.pp index 4d79782..7bcf8d6 100644 --- a/manifests/profile/pacemaker/manila.pp +++ b/manifests/profile/pacemaker/manila.pp @@ -30,21 +30,33 @@ # (Optional) Whether or not the cephfs backend is enabled # Defaults to hiera('manila_backend_cephfs_enabled', false) # +# [*ceph_mds_enabled*] +# (Optional) Whether or not the ceph mds is enabled. This option is used +# to distinguish if an external ceph is used or if ceph is deployed by +# tripleo. By default ceph mds is not deployed by tripleo. +# Defaults to hiera('ceph_mds_enabled', false) +# # [*bootstrap_node*] # (Optional) The hostname of the node responsible for bootstrapping tasks -# Defaults to hiera('bootstrap_nodeid') +# Defaults to hiera('manila_share_short_bootstrap_node_name') # # [*step*] # (Optional) The current step in deployment. See tripleo-heat-templates # for more details. # Defaults to hiera('step') # +# [*pcs_tries*] +# (Optional) The number of times pcs commands should be retried. +# Defaults to hiera('pcs_tries', 20) +# class tripleo::profile::pacemaker::manila ( $backend_generic_enabled = hiera('manila_backend_generic_enabled', false), $backend_netapp_enabled = hiera('manila_backend_netapp_enabled', false), $backend_cephfs_enabled = hiera('manila_backend_cephfs_enabled', false), - $bootstrap_node = hiera('bootstrap_nodeid'), + $ceph_mds_enabled = hiera('ceph_mds_enabled', false), + $bootstrap_node = hiera('manila_share_short_bootstrap_node_name'), $step = hiera('step'), + $pcs_tries = hiera('pcs_tries', 20), ) { if $::hostname == downcase($bootstrap_node) { $pacemaker_master = true @@ -63,6 +75,15 @@ class tripleo::profile::pacemaker::manila ( include ::tripleo::profile::base::manila::share + if $step >= 2 { + pacemaker::property { 'manila-share-role-node-property': + property => 'manila-share-role', + value => true, + tries => $pcs_tries, + node => $::hostname, + } + } + if $step >= 4 { # manila generic: if $backend_generic_enabled { @@ -95,14 +116,42 @@ class tripleo::profile::pacemaker::manila ( # manila cephfsnative: if $backend_cephfs_enabled { $manila_cephfsnative_backend = hiera('manila::backend::cephfsnative::title') + $cephfs_auth_id = hiera('manila::backend::cephfsnative::cephfs_auth_id') + $keyring_path = "/etc/ceph/ceph.client.${cephfs_auth_id}.keyring" + + # $ceph_mds_enabled is used to distinguish if an external ceph is used or + # if ceph is deployed by TripleO + if $ceph_mds_enabled { + include ::ceph::profile::fs + } + manila::backend::cephfsnative { $manila_cephfsnative_backend : driver_handles_share_servers => hiera('manila::backend::cephfsnative::driver_handles_share_servers', false), share_backend_name => hiera('manila::backend::cephfsnative::share_backend_name'), cephfs_conf_path => hiera('manila::backend::cephfsnative::cephfs_conf_path'), - cephfs_auth_id => hiera('manila::backend::cephfsnative::cephfs_auth_id'), + cephfs_auth_id => $cephfs_auth_id, cephfs_cluster_name => hiera('manila::backend::cephfsnative::cephfs_cluster_name'), cephfs_enable_snapshots => hiera('manila::backend::cephfsnative::cephfs_enable_snapshots'), } + + ceph::key { "client.${cephfs_auth_id}" : + secret => hiera('manila::backend::cephfsnative::ceph_client_key'), + keyring_path => $keyring_path, + # inject the new key into ceph cluster only if ceph is deployed by + # tripleo (if external ceph is used it should be added manually) + inject => $ceph_mds_enabled, + user => 'manila', + cap_mds => 'allow *', + cap_mon => 'allow r, allow command \"auth del\", allow command \"auth caps\", \ +allow command \"auth get\", allow command \"auth get-or-create\"', + cap_osd => 'allow rw' + } + + ceph_config { + "client.${cephfs_auth_id}/keyring": value => $keyring_path; + "client.${cephfs_auth_id}/client mount uid": value => 0; + "client.${cephfs_auth_id}/client mount gid": value => 0; + } } # manila netapp: @@ -150,7 +199,13 @@ class tripleo::profile::pacemaker::manila ( # only manila-share is pacemaker managed, and in a/p pacemaker::resource::service { $::manila::params::share_service : - op_params => 'start timeout=200s stop timeout=200s', + op_params => 'start timeout=200s stop timeout=200s', + tries => $pcs_tries, + location_rule => { + resource_discovery => 'exclusive', + score => 0, + expression => ['manila-share-role eq true'], + }, } } diff --git a/manifests/profile/pacemaker/rabbitmq.pp b/manifests/profile/pacemaker/rabbitmq.pp index dba01e3..f4b679a 100644 --- a/manifests/profile/pacemaker/rabbitmq.pp +++ b/manifests/profile/pacemaker/rabbitmq.pp @@ -20,7 +20,7 @@ # # [*bootstrap_node*] # (Optional) The hostname of the node responsible for bootstrapping tasks -# Defaults to hiera('bootstrap_nodeid') +# Defaults to hiera('rabbitmq_short_bootstrap_node_name') # # [*erlang_cookie*] # (Optional) Content of erlang cookie. @@ -41,11 +41,16 @@ # for more details. # Defaults to hiera('step') # +# [*pcs_tries*] +# (Optional) The number of times pcs commands should be retried. +# Defaults to hiera('pcs_tries', 20) +# class tripleo::profile::pacemaker::rabbitmq ( - $bootstrap_node = hiera('bootstrap_nodeid'), + $bootstrap_node = hiera('rabbitmq_short_bootstrap_node_name'), $erlang_cookie = hiera('rabbitmq::erlang_cookie'), $user_ha_queues = hiera('rabbitmq::nr_ha_queues', 0), $rabbit_nodes = hiera('rabbitmq_node_names'), + $pcs_tries = hiera('pcs_tries', 20), $step = hiera('step'), ) { if $::hostname == downcase($bootstrap_node) { @@ -72,22 +77,37 @@ class tripleo::profile::pacemaker::rabbitmq ( } } - if $step >= 2 and $pacemaker_master { - include ::stdlib - # The default nr of ha queues is ceiling(N/2) - if $user_ha_queues == 0 { - $nr_rabbit_nodes = size($rabbit_nodes) - $nr_ha_queues = $nr_rabbit_nodes / 2 + ($nr_rabbit_nodes % 2) - } else { - $nr_ha_queues = $user_ha_queues + if $step >= 2 { + pacemaker::property { 'rabbitmq-role-node-property': + property => 'rabbitmq-role', + value => true, + tries => $pcs_tries, + node => $::hostname, } - pacemaker::resource::ocf { 'rabbitmq': - ocf_agent_name => 'heartbeat:rabbitmq-cluster', - resource_params => "set_policy='ha-all ^(?!amq\\.).* {\"ha-mode\":\"exactly\",\"ha-params\":${nr_ha_queues}}'", - clone_params => 'ordered=true interleave=true', - meta_params => 'notify=true', - op_params => 'start timeout=200s stop timeout=200s', - require => Class['::rabbitmq'], + if $pacemaker_master { + include ::stdlib + # The default nr of ha queues is ceiling(N/2) + if $user_ha_queues == 0 { + $nr_rabbit_nodes = size($rabbit_nodes) + $nr_ha_queues = $nr_rabbit_nodes / 2 + ($nr_rabbit_nodes % 2) + } else { + $nr_ha_queues = $user_ha_queues + } + pacemaker::resource::ocf { 'rabbitmq': + ocf_agent_name => 'heartbeat:rabbitmq-cluster', + resource_params => "set_policy='ha-all ^(?!amq\\.).* {\"ha-mode\":\"exactly\",\"ha-params\":${nr_ha_queues}}'", + clone_params => 'ordered=true interleave=true', + meta_params => 'notify=true', + op_params => 'start timeout=200s stop timeout=200s', + tries => $pcs_tries, + location_rule => { + resource_discovery => 'exclusive', + score => 0, + expression => ['rabbitmq-role eq true'], + }, + require => [Class['::rabbitmq'], + Pacemaker::Property['rabbitmq-role-node-property']], + } } } } |