summaryrefslogtreecommitdiffstats
path: root/manifests
diff options
context:
space:
mode:
Diffstat (limited to 'manifests')
-rw-r--r--manifests/certmonger/mongodb.pp87
-rw-r--r--manifests/firewall.pp2
-rw-r--r--manifests/profile/base/ceilometer.pp19
-rw-r--r--manifests/profile/base/ceilometer/agent/notification.pp1
-rw-r--r--manifests/profile/base/ceilometer/agent/polling.pp5
-rw-r--r--manifests/profile/base/ceilometer/upgrade.pp49
-rw-r--r--manifests/profile/base/certmonger_user.pp9
-rw-r--r--manifests/profile/base/database/mysql.pp3
-rw-r--r--manifests/profile/base/docker.pp37
-rw-r--r--manifests/profile/base/keystone.pp3
-rw-r--r--manifests/profile/base/mistral/api.pp46
-rw-r--r--manifests/profile/base/nova.pp67
-rw-r--r--manifests/profile/base/pacemaker_remote.pp27
13 files changed, 303 insertions, 52 deletions
diff --git a/manifests/certmonger/mongodb.pp b/manifests/certmonger/mongodb.pp
new file mode 100644
index 0000000..0b2dd6a
--- /dev/null
+++ b/manifests/certmonger/mongodb.pp
@@ -0,0 +1,87 @@
+# Copyright 2017 Red Hat, Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License. You may obtain
+# a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations
+# under the License.
+#
+# == Class: tripleo::certmonger::mongodb
+#
+# Request a certificate for MongoDB and do the necessary setup.
+#
+# === Parameters
+#
+# [*hostname*]
+# The hostname of the node. this will be set in the CN of the certificate.
+#
+# [*service_certificate*]
+# The path to the certificate that will be used for TLS in this service.
+#
+# [*service_key*]
+# The path to the key that will be used for TLS in this service.
+#
+# [*service_pem*]
+# The file in PEM format that the HAProxy service will use as a certificate.
+#
+# [*certmonger_ca*]
+# (Optional) The CA that certmonger will use to generate the certificates.
+# Defaults to hiera('certmonger_ca', 'local').
+#
+# [*principal*]
+# (Optional) The service principal that is set for the service in kerberos.
+# Defaults to undef
+#
+class tripleo::certmonger::mongodb (
+ $hostname,
+ $service_certificate,
+ $service_key,
+ $service_pem,
+ $certmonger_ca = hiera('certmonger_ca', 'local'),
+ $principal = undef,
+) {
+ include ::certmonger
+ include ::mongodb::params
+
+ $postsave_cmd = "systemctl restart ${::mongodb::params::service_name}"
+ certmonger_certificate { 'mongodb' :
+ ensure => 'present',
+ certfile => $service_certificate,
+ keyfile => $service_key,
+ hostname => $hostname,
+ dnsname => $hostname,
+ principal => $principal,
+ postsave_cmd => $postsave_cmd,
+ ca => $certmonger_ca,
+ wait => true,
+ require => Class['::certmonger'],
+ }
+
+ concat { $service_pem :
+ ensure => present,
+ mode => '0640',
+ owner => $::mongodb::params::user,
+ group => $::mongodb::params::group,
+ }
+ concat::fragment { 'mongodb-key-fragment':
+ target => $service_pem,
+ source => $service_key,
+ order => '01',
+ require => Certmonger_certificate['mongodb'],
+ }
+ concat::fragment { 'mongodb-cert-fragment':
+ target => $service_pem,
+ source => $service_certificate,
+ order => '10',
+ require => Certmonger_certificate['mongodb'],
+ }
+
+ Concat::Fragment['mongodb-key-fragment'] ~> Service<| title == $::mongodb::params::service_name |>
+ Concat::Fragment['mongodb-cert-fragment'] ~> Service<| title == $::mongodb::params::service_name |>
+}
diff --git a/manifests/firewall.pp b/manifests/firewall.pp
index 8c6a53b..b4d51d9 100644
--- a/manifests/firewall.pp
+++ b/manifests/firewall.pp
@@ -63,7 +63,7 @@ class tripleo::firewall(
# anyone can add your own rules
# example with Hiera:
#
- # tripleo::firewall::rules:
+ # tripleo::firewall::firewall_rules:
# '300 allow custom application 1':
# port: 999
# proto: udp
diff --git a/manifests/profile/base/ceilometer.pp b/manifests/profile/base/ceilometer.pp
index e6a2f11..a85be5d 100644
--- a/manifests/profile/base/ceilometer.pp
+++ b/manifests/profile/base/ceilometer.pp
@@ -18,10 +18,6 @@
#
# === Parameters
#
-# [*bootstrap_node*]
-# (Optional) The hostname of the node responsible for bootstrapping tasks
-# Defaults to hiera('bootstrap_nodeid')
-#
# [*step*]
# (Optional) The current step in deployment. See tripleo-heat-templates
# for more details.
@@ -72,7 +68,6 @@
# Defaults to hiera('ceilometer::rabbit_use_ssl', '0')
class tripleo::profile::base::ceilometer (
- $bootstrap_node = hiera('bootstrap_nodeid', undef),
$step = hiera('step'),
$oslomsg_rpc_proto = hiera('messaging_rpc_service_name', 'rabbit'),
$oslomsg_rpc_hosts = any2array(hiera('rabbitmq_node_names', undef)),
@@ -86,11 +81,6 @@ class tripleo::profile::base::ceilometer (
$oslomsg_notify_username = hiera('ceilometer::rabbit_userid', 'guest'),
$oslomsg_use_ssl = hiera('ceilometer::rabbit_use_ssl', '0'),
) {
- if $::hostname == downcase($bootstrap_node) {
- $sync_db = true
- } else {
- $sync_db = false
- }
if $step >= 3 {
$oslomsg_use_ssl_real = sprintf('%s', bool2num(str2bool($oslomsg_use_ssl)))
@@ -114,13 +104,4 @@ class tripleo::profile::base::ceilometer (
}
include ::ceilometer::config
}
-
- # Run ceilometer-upgrade in step 5 so gnocchi resource types
- # are created safely.
- if $step >= 5 and $sync_db {
- exec {'ceilometer-db-upgrade':
- command => 'ceilometer-upgrade --skip-metering-database',
- path => ['/usr/bin', '/usr/sbin'],
- }
- }
}
diff --git a/manifests/profile/base/ceilometer/agent/notification.pp b/manifests/profile/base/ceilometer/agent/notification.pp
index 7fe8e81..3fa139a 100644
--- a/manifests/profile/base/ceilometer/agent/notification.pp
+++ b/manifests/profile/base/ceilometer/agent/notification.pp
@@ -27,6 +27,7 @@ class tripleo::profile::base::ceilometer::agent::notification (
$step = hiera('step'),
) {
include ::tripleo::profile::base::ceilometer
+ include ::tripleo::profile::base::ceilometer::upgrade
if $step >= 4 {
include ::ceilometer::agent::auth
diff --git a/manifests/profile/base/ceilometer/agent/polling.pp b/manifests/profile/base/ceilometer/agent/polling.pp
index 3706c2e..fedf035 100644
--- a/manifests/profile/base/ceilometer/agent/polling.pp
+++ b/manifests/profile/base/ceilometer/agent/polling.pp
@@ -51,6 +51,10 @@ class tripleo::profile::base::ceilometer::agent::polling (
) {
include ::tripleo::profile::base::ceilometer
+ if $central_namespace {
+ include ::tripleo::profile::base::ceilometer::upgrade
+ }
+
if $step >= 4 {
include ::ceilometer::agent::auth
class { '::ceilometer::agent::polling':
@@ -60,5 +64,4 @@ class tripleo::profile::base::ceilometer::agent::polling (
coordination_url => join(['redis://:', $ceilometer_redis_password, '@', normalize_ip_for_uri($redis_vip), ':6379/']),
}
}
-
}
diff --git a/manifests/profile/base/ceilometer/upgrade.pp b/manifests/profile/base/ceilometer/upgrade.pp
new file mode 100644
index 0000000..d0fc9be
--- /dev/null
+++ b/manifests/profile/base/ceilometer/upgrade.pp
@@ -0,0 +1,49 @@
+# Copyright 2016 Red Hat, Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License. You may obtain
+# a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations
+# under the License.
+#
+# == Class: tripleo::profile::base::ceilometer::upgrade
+#
+# Ceilometer upgrade profile for tripleo
+#
+# === Parameters
+#
+# [*bootstrap_node*]
+# (Optional) The hostname of the node responsible for bootstrapping tasks
+# Defaults to hiera('bootstrap_nodeid')
+#
+# [*step*]
+# (Optional) The current step in deployment. See tripleo-heat-templates
+# for more details.
+# Defaults to hiera('step')
+#
+
+class tripleo::profile::base::ceilometer::upgrade (
+ $bootstrap_node = hiera('bootstrap_nodeid', undef),
+ $step = hiera('step'),
+) {
+ if $::hostname == downcase($bootstrap_node) {
+ $sync_db = true
+ } else {
+ $sync_db = false
+ }
+
+ # Run ceilometer-upgrade in step 5 so gnocchi resource types
+ # are created safely.
+ if $step >= 5 and $sync_db {
+ exec {'ceilometer-db-upgrade':
+ command => 'ceilometer-upgrade --skip-metering-database',
+ path => ['/usr/bin', '/usr/sbin'],
+ }
+ }
+}
diff --git a/manifests/profile/base/certmonger_user.pp b/manifests/profile/base/certmonger_user.pp
index b63fb7f..4ba51ec 100644
--- a/manifests/profile/base/certmonger_user.pp
+++ b/manifests/profile/base/certmonger_user.pp
@@ -48,6 +48,11 @@
# it will create.
# Defaults to hiera('libvirt_certificates_specs', {}).
#
+# [*mongodb_certificate_specs*]
+# (Optional) The specifications to give to certmonger for the certificate(s)
+# it will create.
+# Defaults to hiera('mongodb_certificate_specs',{})
+#
# [*mysql_certificate_specs*]
# (Optional) The specifications to give to certmonger for the certificate(s)
# it will create.
@@ -67,6 +72,7 @@ class tripleo::profile::base::certmonger_user (
$apache_certificates_specs = hiera('apache_certificates_specs', {}),
$haproxy_certificates_specs = hiera('tripleo::profile::base::haproxy::certificates_specs', {}),
$libvirt_certificates_specs = hiera('libvirt_certificates_specs', {}),
+ $mongodb_certificate_specs = hiera('mongodb_certificate_specs',{}),
$mysql_certificate_specs = hiera('tripleo::profile::base::database::mysql::certificate_specs', {}),
$rabbitmq_certificate_specs = hiera('tripleo::profile::base::rabbitmq::certificate_specs', {}),
$etcd_certificate_specs = hiera('tripleo::profile::base::etcd::certificate_specs', {}),
@@ -87,6 +93,9 @@ class tripleo::profile::base::certmonger_user (
# existing and need to be refreshed if it changed.
Tripleo::Certmonger::Haproxy<||> ~> Haproxy::Listen<||>
}
+ unless empty($mongodb_certificate_specs) {
+ ensure_resource('class', 'tripleo::certmonger::mongodb', $mongodb_certificate_specs)
+ }
unless empty($mysql_certificate_specs) {
ensure_resource('class', 'tripleo::certmonger::mysql', $mysql_certificate_specs)
}
diff --git a/manifests/profile/base/database/mysql.pp b/manifests/profile/base/database/mysql.pp
index b4ac8ac..2dac028 100644
--- a/manifests/profile/base/database/mysql.pp
+++ b/manifests/profile/base/database/mysql.pp
@@ -199,6 +199,9 @@ class tripleo::profile::base::database::mysql (
if hiera('nova_placement_enabled', false) {
include ::nova::db::mysql_placement
}
+ if hiera('octavia_api_enabled', false) {
+ include ::octavia::db::mysql
+ }
if hiera('sahara_api_enabled', false) {
include ::sahara::db::mysql
}
diff --git a/manifests/profile/base/docker.pp b/manifests/profile/base/docker.pp
index d035f6a..29f8b75 100644
--- a/manifests/profile/base/docker.pp
+++ b/manifests/profile/base/docker.pp
@@ -32,6 +32,18 @@
# Configure a registry-mirror in the /etc/docker/daemon.json file.
# (defaults to false)
#
+# [*docker_options*]
+# OPTIONS that are used to startup the docker service. NOTE:
+# --selinux-enabled is dropped due to recommendations here:
+# https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/7.2_Release_Notes/technology-preview-file_systems.html
+# Defaults to '--log-driver=journald --signature-verification=false'
+#
+# [*configure_storage*]
+# Boolean. Whether to configure a docker storage backend. Defaults to true.
+#
+# [*storage_options*]
+# Storage options to configure. Defaults to '-s overlay2'
+#
# [*step*]
# step defaults to hiera('step')
#
@@ -39,6 +51,9 @@ class tripleo::profile::base::docker (
$docker_namespace = undef,
$insecure_registry = false,
$registry_mirror = false,
+ $docker_options = '--log-driver=journald --signature-verification=false',
+ $configure_storage = true,
+ $storage_options = '-s overlay2',
$step = hiera('step'),
) {
if $step >= 1 {
@@ -57,9 +72,11 @@ class tripleo::profile::base::docker (
fail('You must provide a $docker_namespace in order to configure insecure registry')
}
$namespace = strip($docker_namespace.split('/')[0])
- $changes = [ "set INSECURE_REGISTRY '\"--insecure-registry ${namespace}\"'", ]
+ $changes = [ "set INSECURE_REGISTRY '\"--insecure-registry ${namespace}\"'",
+ "set OPTIONS '\"${docker_options}\"'" ]
} else {
- $changes = [ 'rm INSECURE_REGISTRY', ]
+ $changes = [ 'rm INSECURE_REGISTRY',
+ "set OPTIONS '\"${docker_options}\"'" ]
}
augeas { 'docker-sysconfig':
@@ -95,6 +112,22 @@ class tripleo::profile::base::docker (
notify => Service['docker'],
require => File['/etc/docker/daemon.json'],
}
+ if $configure_storage {
+ if $storage_options == undef {
+ fail('You must provide a $storage_options in order to configure storage')
+ }
+ $storage_changes = [ "set DOCKER_STORAGE_OPTIONS '\" ${storage_options}\"'", ]
+ } else {
+ $storage_changes = [ 'rm DOCKER_STORAGE_OPTIONS', ]
+ }
+
+ augeas { 'docker-sysconfig-storage':
+ lens => 'Shellvars.lns',
+ incl => '/etc/sysconfig/docker-storage',
+ changes => $storage_changes,
+ notify => Service['docker'],
+ require => Package['docker'],
+ }
}
}
diff --git a/manifests/profile/base/keystone.pp b/manifests/profile/base/keystone.pp
index 31f5c93..72a7bc9 100644
--- a/manifests/profile/base/keystone.pp
+++ b/manifests/profile/base/keystone.pp
@@ -338,5 +338,8 @@ class tripleo::profile::base::keystone (
if hiera('ec2_api_enabled', false) {
include ::ec2api::keystone::auth
}
+ if hiera('novajoin_enabled', false) {
+ include ::nova::metadata::novajoin::auth
+ }
}
}
diff --git a/manifests/profile/base/mistral/api.pp b/manifests/profile/base/mistral/api.pp
index 50708f1..4f81725 100644
--- a/manifests/profile/base/mistral/api.pp
+++ b/manifests/profile/base/mistral/api.pp
@@ -18,6 +18,27 @@
#
# === Parameters
#
+# [*certificates_specs*]
+# (Optional) The specifications to give to certmonger for the certificate(s)
+# it will create.
+# Example with hiera:
+# apache_certificates_specs:
+# httpd-internal_api:
+# hostname: <overcloud controller fqdn>
+# service_certificate: <service certificate path>
+# service_key: <service key path>
+# principal: "haproxy/<overcloud controller fqdn>"
+# Defaults to hiera('apache_certificate_specs', {}).
+#
+# [*enable_internal_tls*]
+# (Optional) Whether TLS in the internal network is enabled or not.
+# Defaults to hiera('enable_internal_tls', false)
+#
+# [*mistral_api_network*]
+# (Optional) The network name where the mistral API endpoint is listening on.
+# This is set by t-h-t.
+# Defaults to hiera('mistral_api_network', undef)
+#
# [*bootstrap_node*]
# (Optional) The hostname of the node responsible for bootstrapping tasks
# Defaults to hiera('bootstrap_nodeid')
@@ -28,8 +49,11 @@
# Defaults to hiera('step')
#
class tripleo::profile::base::mistral::api (
- $bootstrap_node = hiera('bootstrap_nodeid', undef),
- $step = hiera('step'),
+ $bootstrap_node = hiera('bootstrap_nodeid', undef),
+ $certificates_specs = hiera('apache_certificates_specs', {}),
+ $enable_internal_tls = hiera('enable_internal_tls', false),
+ $mistral_api_network = hiera('mistral_api_network', undef),
+ $step = hiera('step'),
) {
if $::hostname == downcase($bootstrap_node) {
$sync_db = true
@@ -39,8 +63,24 @@ class tripleo::profile::base::mistral::api (
include ::tripleo::profile::base::mistral
- if $step >= 4 or ($step >= 3 and $sync_db) {
+ if $enable_internal_tls {
+ if !$mistral_api_network {
+ fail('mistral_api_network is not set in the hieradata.')
+ }
+ $tls_certfile = $certificates_specs["httpd-${mistral_api_network}"]['service_certificate']
+ $tls_keyfile = $certificates_specs["httpd-${mistral_api_network}"]['service_key']
+ } else {
+ $tls_certfile = undef
+ $tls_keyfile = undef
+ }
+
+ if $step >= 3 {
include ::mistral::api
+ include ::apache::mod::ssl
+ class { '::mistral::wsgi::apache':
+ ssl_cert => $tls_certfile,
+ ssl_key => $tls_keyfile,
+ }
}
}
diff --git a/manifests/profile/base/nova.pp b/manifests/profile/base/nova.pp
index 65355d4..d786940 100644
--- a/manifests/profile/base/nova.pp
+++ b/manifests/profile/base/nova.pp
@@ -129,6 +129,10 @@ class tripleo::profile::base::nova (
$memcache_servers = suffix(hiera('memcached_node_ips'), ':11211')
}
+ validate_array($migration_ssh_localaddrs)
+ $migration_ssh_localaddrs.each |$x| { validate_ip_address($x) }
+ $migration_ssh_localaddrs_real = unique($migration_ssh_localaddrs)
+
if $step >= 4 or ($step >= 3 and $sync_db) {
$oslomsg_use_ssl_real = sprintf('%s', bool2num(str2bool($oslomsg_use_ssl)))
include ::nova::config
@@ -183,10 +187,10 @@ class tripleo::profile::base::nova (
# Nova SSH tunnel setup (cold-migration)
# Server side
- if !empty($migration_ssh_localaddrs) {
- $allow_type = sprintf('LocalAddress %s User', join($migration_ssh_localaddrs,','))
+ if !empty($migration_ssh_localaddrs_real) {
+ $allow_type = sprintf('LocalAddress %s User', join($migration_ssh_localaddrs_real,','))
$deny_type = 'LocalAddress'
- $deny_name = sprintf('!%s', join($migration_ssh_localaddrs,',!'))
+ $deny_name = sprintf('!%s', join($migration_ssh_localaddrs_real,',!'))
ssh::server::match_block { 'nova_migration deny':
name => $deny_name,
@@ -217,31 +221,42 @@ class tripleo::profile::base::nova (
notify => Service['sshd']
}
- file { '/etc/nova/migration/authorized_keys':
- content => $migration_ssh_key['public_key'],
- mode => '0640',
- owner => 'root',
- group => 'nova_migration',
- require => Package['openstack-nova-migration'],
- }
+ $migration_authorized_keys = $migration_ssh_key['public_key']
+ $migration_identity = $migration_ssh_key['private_key']
+ $migration_user_shell = '/bin/bash'
+ }
+ else {
+ # Remove the keys and prevent login when migration over SSH is not enabled
+ $migration_authorized_keys = '# Migration over SSH disabled by TripleO'
+ $migration_identity = '# Migration over SSH disabled by TripleO'
+ $migration_user_shell = '/sbin/nologin'
+ }
- # Client side
- file { '/etc/nova/migration/identity':
- content => $migration_ssh_key['private_key'],
- mode => '0600',
- owner => 'nova',
- group => 'nova',
- require => Package['openstack-nova-migration'],
- }
- $migration_pkg_ensure = installed
- } else {
- $migration_pkg_ensure = absent
+ package { 'openstack-nova-migration':
+ ensure => present,
+ tag => ['openstack', 'nova-package'],
+ }
+
+ file { '/etc/nova/migration/authorized_keys':
+ content => $migration_authorized_keys,
+ mode => '0640',
+ owner => 'root',
+ group => 'nova_migration',
+ require => Package['openstack-nova-migration']
+ }
+
+ file { '/etc/nova/migration/identity':
+ content => $migration_identity,
+ mode => '0600',
+ owner => 'nova',
+ group => 'nova',
+ require => Package['openstack-nova-migration']
+ }
+
+ user {'nova_migration':
+ shell => $migration_user_shell,
+ require => Package['openstack-nova-migration']
}
- } else {
- $migration_pkg_ensure = absent
- }
- package {'openstack-nova-migration':
- ensure => $migration_pkg_ensure
}
}
}
diff --git a/manifests/profile/base/pacemaker_remote.pp b/manifests/profile/base/pacemaker_remote.pp
index e0fff63..dfe0a3e 100644
--- a/manifests/profile/base/pacemaker_remote.pp
+++ b/manifests/profile/base/pacemaker_remote.pp
@@ -22,6 +22,14 @@
# Authkey for pacemaker remote nodes
# Defaults to unset
#
+# [*pcs_tries*]
+# (Optional) The number of times pcs commands should be retried.
+# Defaults to hiera('pcs_tries', 20)
+#
+# [*enable_fencing*]
+# (Optional) Whether or not to manage stonith devices for nodes
+# Defaults to hiera('enable_fencing', false)
+#
# [*step*]
# (Optional) The current step in deployment. See tripleo-heat-templates
# for more details.
@@ -29,9 +37,28 @@
#
class tripleo::profile::base::pacemaker_remote (
$remote_authkey,
+ $pcs_tries = hiera('pcs_tries', 20),
+ $enable_fencing = hiera('enable_fencing', false),
$step = hiera('step'),
) {
class { '::pacemaker::remote':
remote_authkey => $remote_authkey,
}
+ $enable_fencing_real = str2bool($enable_fencing) and $step >= 5
+
+ class { '::pacemaker::stonith':
+ disable => !$enable_fencing_real,
+ tries => $pcs_tries,
+ }
+
+ if $enable_fencing_real {
+ include ::tripleo::fencing
+
+ # enable stonith after all Pacemaker resources have been created
+ Pcmk_resource<||> -> Class['tripleo::fencing']
+ Pcmk_constraint<||> -> Class['tripleo::fencing']
+ Exec <| tag == 'pacemaker_constraint' |> -> Class['tripleo::fencing']
+ # enable stonith after all fencing devices have been created
+ Class['tripleo::fencing'] -> Class['pacemaker::stonith']
+ }
}