summaryrefslogtreecommitdiffstats
path: root/manifests
diff options
context:
space:
mode:
Diffstat (limited to 'manifests')
-rw-r--r--manifests/certmonger/ca/crl.pp149
-rw-r--r--manifests/haproxy.pp13
-rw-r--r--manifests/profile/base/certmonger_user.pp10
-rw-r--r--manifests/profile/base/docker.pp59
-rw-r--r--manifests/profile/base/ironic/conductor.pp1
-rw-r--r--manifests/profile/pacemaker/cinder/backup_bundle.pp146
-rw-r--r--manifests/profile/pacemaker/cinder/volume_bundle.pp141
-rw-r--r--manifests/profile/pacemaker/database/mysql.pp33
-rw-r--r--manifests/ui.pp39
9 files changed, 567 insertions, 24 deletions
diff --git a/manifests/certmonger/ca/crl.pp b/manifests/certmonger/ca/crl.pp
new file mode 100644
index 0000000..59a3681
--- /dev/null
+++ b/manifests/certmonger/ca/crl.pp
@@ -0,0 +1,149 @@
+# Copyright 2017 Red Hat, Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License. You may obtain
+# a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations
+# under the License.
+#
+# == class: tripleo::certmonger::ca::crl
+#
+# Class that downloads the appropriate CRL file from the CA. This can
+# furtherly be used by services in order for proper certificate revocation to
+# come into effect. The class also sets up a cron job that will refresh the CRL
+# once a week. Also, processing of the CRL file might be needed. e.g. most CAs
+# use DER format to distribute the CRLs, while services such as HAProxy expect
+# the CRL to be in PEM format.
+#
+# === Parameters
+#
+# [*crl_dest*]
+# (Optional) The file where the CRL file will be stored.
+# Defaults to '/etc/pki/CA/crl/overcloud-crl.pem'
+#
+# [*crl_source*]
+# (Optional) The URI where the CRL file will be fetched from.
+# Defaults to undef
+#
+# [*process*]
+# (Optional) Whether the CRL needs processing before being used. This means
+# transforming from DER to PEM format or viceversa. This is because most CRLs
+# by default come in DER format, so most likely it needs to be transformed.
+# Defaults to true
+#
+# [*crl_preprocessed*]
+# (Optional) The pre-processed CRL file which will be transformed.
+# Defaults to '/etc/pki/CA/crl/overcloud-crl.bin'
+#
+# [*crl_preprocessed_format*]
+# (Optional) The pre-processed CRL file's format which will be transformed.
+# Defaults to 'DER'
+#
+# [*minute*]
+# (optional) Defaults to '0'.
+#
+# [*hour*]
+# (optional) Defaults to '1'.
+#
+# [*monthday*]
+# (optional) Defaults to '*'.
+#
+# [*month*]
+# (optional) Defaults to '*'.
+#
+# [*weekday*]
+# (optional) Defaults to '6'.
+#
+# [*maxdelay*]
+# (optional) Seconds. Defaults to 0. Should be a positive integer.
+# Induces a random delay before running the cronjob to avoid running all
+# cron jobs at the same time on all hosts this job is configured.
+#
+# [*reload_cmds*]
+# (Optional) list of commands to be executed after fetching the CRL list in
+# the cron job. This will usually be a list of reload commands issued to
+# services that use the CRL.
+# Defaults to []
+#
+class tripleo::certmonger::ca::crl (
+ $crl_dest = '/etc/pki/CA/crl/overcloud-crl.pem',
+ $crl_source = undef,
+ $process = true,
+ $crl_preprocessed = '/etc/pki/CA/crl/overcloud-crl.bin',
+ $crl_preprocessed_format = 'DER',
+ $minute = '0',
+ $hour = '1',
+ $monthday = '*',
+ $month = '*',
+ $weekday = '6',
+ $maxdelay = 0,
+ $reload_cmds = [],
+) {
+ if $crl_source {
+ $ensure = 'present'
+ } else {
+ $ensure = 'absent'
+ }
+
+ if $maxdelay == 0 {
+ $sleep = ''
+ } else {
+ $sleep = "sleep `expr \${RANDOM} \\% ${maxdelay}`; "
+ }
+
+ if $process {
+ $fetched_crl = $crl_preprocessed
+ } else {
+ $fetched_crl = $crl_dest
+ }
+
+ file { 'tripleo-ca-crl' :
+ ensure => $ensure,
+ path => $fetched_crl,
+ source => $crl_source,
+ mode => '0644',
+ }
+
+ if $process and $ensure == 'present' {
+ $crl_dest_format = $crl_preprocessed_format ? {
+ 'PEM' => 'DER',
+ 'DER' => 'PEM'
+ }
+ # transform CRL from DER to PEM or viceversa
+ $process_cmd = "openssl crl -in ${$crl_preprocessed} -inform ${crl_preprocessed_format} -outform ${crl_dest_format} -out ${crl_dest}"
+ exec { 'tripleo-ca-crl-process-command' :
+ command => $process_cmd,
+ path => '/usr/bin',
+ refreshonly => true,
+ subscribe => File['tripleo-ca-crl']
+ }
+ } else {
+ $process_cmd = []
+ }
+
+ if $ensure == 'present' {
+ # Fetch CRL in cron job and notify needed services
+ $cmd_list = concat(["${sleep}curl -L -o ${fetched_crl} ${crl_source}"], $process_cmd, $reload_cmds)
+ $cron_cmd = join($cmd_list, ' && ')
+ } else {
+ $cron_cmd = absent
+ }
+
+ cron { 'tripleo-refresh-crl-file':
+ ensure => $ensure,
+ command => $cron_cmd,
+ environment => 'PATH=/usr/bin SHELL=/bin/sh',
+ user => 'root',
+ minute => $minute,
+ hour => $hour,
+ monthday => $monthday,
+ month => $month,
+ weekday => $weekday,
+ }
+}
diff --git a/manifests/haproxy.pp b/manifests/haproxy.pp
index 5f70647..208f328 100644
--- a/manifests/haproxy.pp
+++ b/manifests/haproxy.pp
@@ -146,6 +146,10 @@
# the servers it balances
# Defaults to '/etc/pki/ca-trust/extracted/openssl/ca-bundle.trust.crt'
#
+# [*crl_file*]
+# Path to the CRL file to be used for checking revoked certificates.
+# Defaults to undef
+#
# [*haproxy_stats_certificate*]
# Filename of an HAProxy-compatible certificate and key file
# When set, enables SSL on the haproxy stats endpoint using the specified file.
@@ -565,6 +569,7 @@ class tripleo::haproxy (
$ssl_cipher_suite = '!SSLv2:kEECDH:kRSA:kEDH:kPSK:+3DES:!aNULL:!eNULL:!MD5:!EXP:!RC4:!SEED:!IDEA:!DES',
$ssl_options = 'no-sslv3',
$ca_bundle = '/etc/pki/ca-trust/extracted/openssl/ca-bundle.trust.crt',
+ $crl_file = undef,
$haproxy_stats_certificate = undef,
$keystone_admin = hiera('keystone_enabled', false),
$keystone_public = hiera('keystone_enabled', false),
@@ -728,7 +733,13 @@ class tripleo::haproxy (
$ports = merge($default_service_ports, $service_ports)
if $enable_internal_tls {
- $internal_tls_member_options = ['ssl', 'verify required', "ca-file ${ca_bundle}"]
+ $base_internal_tls_member_options = ['ssl', 'verify required', "ca-file ${ca_bundle}"]
+
+ if $crl_file {
+ $internal_tls_member_options = concat($base_internal_tls_member_options, "crl-file ${crl_file}")
+ } else {
+ $internal_tls_member_options = $base_internal_tls_member_options
+ }
Haproxy::Balancermember {
verifyhost => true
}
diff --git a/manifests/profile/base/certmonger_user.pp b/manifests/profile/base/certmonger_user.pp
index 4ba51ec..7a6559e 100644
--- a/manifests/profile/base/certmonger_user.pp
+++ b/manifests/profile/base/certmonger_user.pp
@@ -77,6 +77,16 @@ class tripleo::profile::base::certmonger_user (
$rabbitmq_certificate_specs = hiera('tripleo::profile::base::rabbitmq::certificate_specs', {}),
$etcd_certificate_specs = hiera('tripleo::profile::base::etcd::certificate_specs', {}),
) {
+ unless empty($haproxy_certificates_specs) {
+ $reload_haproxy = ['systemctl reload haproxy']
+ Class['::tripleo::certmonger::ca::crl'] ~> Haproxy::Balancermember<||>
+ Class['::tripleo::certmonger::ca::crl'] ~> Class['::haproxy']
+ } else {
+ $reload_haproxy = []
+ }
+ class { '::tripleo::certmonger::ca::crl' :
+ reload_cmds => $reload_haproxy,
+ }
include ::tripleo::certmonger::ca::libvirt
unless empty($apache_certificates_specs) {
diff --git a/manifests/profile/base/docker.pp b/manifests/profile/base/docker.pp
index 29f8b75..67fbd71 100644
--- a/manifests/profile/base/docker.pp
+++ b/manifests/profile/base/docker.pp
@@ -47,6 +47,18 @@
# [*step*]
# step defaults to hiera('step')
#
+# [*configure_libvirt_polkit*]
+# Configures libvirt polkit to grant the kolla nova user access to the libvirtd unix domain socket on the host.
+# Defaults to true when nova_compute service is enabled, false when nova_compute is disabled
+#
+# [*docker_nova_uid*]
+# When configure_libvirt_polkit = true, the uid/gid of the nova user within the docker container.
+# Defaults to 42436
+#
+# [*services_enabled*]
+# List of TripleO services enabled on the role.
+# Defaults to hiera('services_names')
+#
class tripleo::profile::base::docker (
$docker_namespace = undef,
$insecure_registry = false,
@@ -55,7 +67,17 @@ class tripleo::profile::base::docker (
$configure_storage = true,
$storage_options = '-s overlay2',
$step = hiera('step'),
+ $configure_libvirt_polkit = undef,
+ $docker_nova_uid = 42436,
+ $services_enabled = hiera('service_names', [])
) {
+
+ if $configure_libvirt_polkit == undef {
+ $configure_libvirt_polkit_real = 'nova_compute' in $services_enabled
+ } else {
+ $configure_libvirt_polkit_real = $configure_libvirt_polkit
+ }
+
if $step >= 1 {
package {'docker':
ensure => installed,
@@ -130,4 +152,41 @@ class tripleo::profile::base::docker (
}
}
+ if ($step >= 4 and $configure_libvirt_polkit_real) {
+ # Workaround for polkit authorization for libvirtd socket on host
+ #
+ # This creates a local user with the kolla nova uid, and sets the polkit rule to
+ # allow both it and the nova user from the nova rpms, should it exist (uid 162).
+
+ group { 'docker_nova_group':
+ name => 'docker_nova',
+ gid => $docker_nova_uid
+ } ->
+ user { 'docker_nova_user':
+ name => 'docker_nova',
+ uid => $docker_nova_uid,
+ gid => $docker_nova_uid,
+ shell => '/sbin/nologin',
+ comment => 'OpenStack Nova Daemons',
+ groups => ['nobody']
+ }
+
+ # Similar to the polkit rule in the openstack-nova rpm spec
+ # but allow both the 'docker_nova' and 'nova' user
+ $docker_nova_polkit_rule = '// openstack-nova libvirt management permissions
+polkit.addRule(function(action, subject) {
+ if (action.id == "org.libvirt.unix.manage" &&
+ /^(docker_)?nova$/.test(subject.user)) {
+ return polkit.Result.YES;
+ }
+});
+'
+ package {'polkit':
+ ensure => installed,
+ } ->
+ file {'/etc/polkit-1/rules.d/50-nova.rules':
+ content => $docker_nova_polkit_rule,
+ mode => '0644'
+ }
+ }
}
diff --git a/manifests/profile/base/ironic/conductor.pp b/manifests/profile/base/ironic/conductor.pp
index 5ebf167..f7a2eb0 100644
--- a/manifests/profile/base/ironic/conductor.pp
+++ b/manifests/profile/base/ironic/conductor.pp
@@ -51,6 +51,7 @@ class tripleo::profile::base::ironic::conductor (
}
# Configure access to other services
+ include ::ironic::cinder
include ::ironic::drivers::inspector
include ::ironic::glance
include ::ironic::neutron
diff --git a/manifests/profile/pacemaker/cinder/backup_bundle.pp b/manifests/profile/pacemaker/cinder/backup_bundle.pp
new file mode 100644
index 0000000..cd06986
--- /dev/null
+++ b/manifests/profile/pacemaker/cinder/backup_bundle.pp
@@ -0,0 +1,146 @@
+# Copyright 2017 Red Hat, Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License. You may obtain
+# a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations
+# under the License.
+#
+# == Class: tripleo::profile::pacemaker::cinder::backup_bundle
+#
+# Containerized Redis Pacemaker HA profile for tripleo
+#
+# === Parameters
+#
+# [*cinder_backup_docker_image*]
+# (Optional) The docker image to use for creating the pacemaker bundle
+# Defaults to hiera('tripleo::profile::pacemaker::cinder::backup_bundle::cinder_docker_image', undef)
+#
+# [*pcs_tries*]
+# (Optional) The number of times pcs commands should be retried.
+# Defaults to hiera('pcs_tries', 20)
+#
+# [*bootstrap_node*]
+# (Optional) The hostname of the node responsible for bootstrapping tasks
+# Defaults to hiera('redis_short_bootstrap_node_name')
+#
+# [*step*]
+# (Optional) The current step in deployment. See tripleo-heat-templates
+# for more details.
+# Defaults to hiera('step')
+#
+#
+class tripleo::profile::pacemaker::cinder::backup_bundle (
+ $bootstrap_node = hiera('cinder_backup_short_bootstrap_node_name'),
+ $cinder_backup_docker_image = hiera('tripleo::profile::pacemaker::cinder::backup_bundle::cinder_backup_docker_image', undef),
+ $pcs_tries = hiera('pcs_tries', 20),
+ $step = hiera('step'),
+) {
+ if $::hostname == downcase($bootstrap_node) {
+ $pacemaker_master = true
+ } else {
+ $pacemaker_master = false
+ }
+
+ include ::tripleo::profile::base::cinder::backup
+
+ if $step >= 2 and $pacemaker_master {
+ $cinder_backup_short_node_names = hiera('cinder_backup_short_node_names')
+ $cinder_backup_short_node_names.each |String $node_name| {
+ pacemaker::property { "cinder-backup-role-${node_name}":
+ property => 'cinder-backup-role',
+ value => true,
+ tries => $pcs_tries,
+ node => $node_name,
+ before => Pacemaker::Resource::Bundle[$::cinder::params::backup_service],
+ }
+ }
+ }
+
+ if $step >= 5 {
+ if $pacemaker_master {
+ $cinder_backup_nodes_count = count(hiera('cinder_backup_short_node_names', []))
+
+ pacemaker::resource::bundle { $::cinder::params::backup_service :
+ image => $cinder_backup_docker_image,
+ replicas => 1,
+ location_rule => {
+ resource_discovery => 'exclusive',
+ score => 0,
+ expression => ['cinder-backup-role eq true'],
+ },
+ container_options => 'network=host',
+ options => '--ipc=host --privileged=true --user=root --log-driver=journald -e KOLLA_CONFIG_STRATEGY=COPY_ALWAYS',
+ run_command => '/bin/bash /usr/local/bin/kolla_start',
+ storage_maps => {
+ 'cinder-backup-cfg-files' => {
+ 'source-dir' => '/var/lib/kolla/config_files/cinder_backup.json',
+ 'target-dir' => '/var/lib/kolla/config_files/config.json',
+ 'options' => 'ro',
+ },
+ 'cinder-backup-cfg-data' => {
+ 'source-dir' => '/var/lib/config-data/cinder/etc/cinder',
+ 'target-dir' => '/etc/cinder',
+ 'options' => 'ro',
+ },
+ 'cinder-backup-cfg-ceph' => {
+ 'source-dir' => '/var/lib/config-data/cinder/etc/ceph',
+ 'target-dir' => '/etc/ceph',
+ 'options' => 'ro',
+ },
+ 'cinder-backup-hosts' => {
+ 'source-dir' => '/etc/hosts',
+ 'target-dir' => '/etc/hosts',
+ 'options' => 'ro',
+ },
+ 'cinder-backup-localtime' => {
+ 'source-dir' => '/etc/localtime',
+ 'target-dir' => '/etc/localtime',
+ 'options' => 'ro',
+ },
+ 'cinder-backup-dev' => {
+ 'source-dir' => '/dev',
+ 'target-dir' => '/dev',
+ 'options' => 'rw',
+ },
+ 'cinder-backup-run' => {
+ 'source-dir' => '/run',
+ 'target-dir' => '/run',
+ 'options' => 'rw',
+ },
+ 'cinder-backup-sys' => {
+ 'source-dir' => '/sys',
+ 'target-dir' => '/sys',
+ 'options' => 'rw',
+ },
+ 'cinder-backup-lib-modules' => {
+ 'source-dir' => '/lib/modules',
+ 'target-dir' => '/lib/modules',
+ 'options' => 'ro',
+ },
+ 'cinder-backup-iscsi' => {
+ 'source-dir' => '/etc/iscsi',
+ 'target-dir' => '/etc/iscsi',
+ 'options' => 'rw',
+ },
+ 'cinder-backup-var-lib-cinder' => {
+ 'source-dir' => '/var/lib/cinder',
+ 'target-dir' => '/var/lib/cinder',
+ 'options' => 'rw',
+ },
+ 'cinder-backup-var-log' => {
+ 'source-dir' => '/var/log/containers/cinder',
+ 'target-dir' => '/var/log/cinder',
+ 'options' => 'rw',
+ },
+ },
+ }
+ }
+ }
+}
diff --git a/manifests/profile/pacemaker/cinder/volume_bundle.pp b/manifests/profile/pacemaker/cinder/volume_bundle.pp
new file mode 100644
index 0000000..f0858c9
--- /dev/null
+++ b/manifests/profile/pacemaker/cinder/volume_bundle.pp
@@ -0,0 +1,141 @@
+# Copyright 2017 Red Hat, Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License. You may obtain
+# a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations
+# under the License.
+#
+# == Class: tripleo::profile::pacemaker::cinder::volume_bundle
+#
+# Containerized Redis Pacemaker HA profile for tripleo
+#
+# === Parameters
+#
+# [*cinder_volume_docker_image*]
+# (Optional) The docker image to use for creating the pacemaker bundle
+# Defaults to hiera('tripleo::profile::pacemaker::cinder::volume_bundle::cinder_docker_image', undef)
+#
+# [*pcs_tries*]
+# (Optional) The number of times pcs commands should be retried.
+# Defaults to hiera('pcs_tries', 20)
+#
+# [*bootstrap_node*]
+# (Optional) The hostname of the node responsible for bootstrapping tasks
+# Defaults to hiera('redis_short_bootstrap_node_name')
+#
+# [*step*]
+# (Optional) The current step in deployment. See tripleo-heat-templates
+# for more details.
+# Defaults to hiera('step')
+#
+#
+class tripleo::profile::pacemaker::cinder::volume_bundle (
+ $bootstrap_node = hiera('cinder_volume_short_bootstrap_node_name'),
+ $cinder_volume_docker_image = hiera('tripleo::profile::pacemaker::cinder::volume_bundle::cinder_volume_docker_image', undef),
+ $pcs_tries = hiera('pcs_tries', 20),
+ $step = hiera('step'),
+) {
+ if $::hostname == downcase($bootstrap_node) {
+ $pacemaker_master = true
+ } else {
+ $pacemaker_master = false
+ }
+
+ include ::tripleo::profile::base::cinder::volume
+
+ if $step >= 2 and $pacemaker_master {
+ $cinder_volume_short_node_names = hiera('cinder_volume_short_node_names')
+ $cinder_volume_short_node_names.each |String $node_name| {
+ pacemaker::property { "cinder-volume-role-${node_name}":
+ property => 'cinder-volume-role',
+ value => true,
+ tries => $pcs_tries,
+ node => $node_name,
+ before => Pacemaker::Resource::Bundle[$::cinder::params::volume_service],
+ }
+ }
+ }
+
+ if $step >= 5 {
+ if $pacemaker_master {
+ $cinder_volume_nodes_count = count(hiera('cinder_volume_short_node_names', []))
+
+ pacemaker::resource::bundle { $::cinder::params::volume_service:
+ image => $cinder_volume_docker_image,
+ replicas => 1,
+ location_rule => {
+ resource_discovery => 'exclusive',
+ score => 0,
+ expression => ['cinder-volume-role eq true'],
+ },
+ container_options => 'network=host',
+ options => '--ipc=host --privileged=true --user=root --log-driver=journald -e KOLLA_CONFIG_STRATEGY=COPY_ALWAYS',
+ run_command => '/bin/bash /usr/local/bin/kolla_start',
+ storage_maps => {
+ 'cinder-volume-cfg-files' => {
+ 'source-dir' => '/var/lib/kolla/config_files/cinder_volume.json',
+ 'target-dir' => '/var/lib/kolla/config_files/config.json',
+ 'options' => 'ro',
+ },
+ 'cinder-volume-cfg-data' => {
+ 'source-dir' => '/var/lib/config-data/cinder/etc/cinder',
+ 'target-dir' => '/etc/cinder',
+ 'options' => 'ro',
+ },
+ 'cinder-volume-hosts' => {
+ 'source-dir' => '/etc/hosts',
+ 'target-dir' => '/etc/hosts',
+ 'options' => 'ro',
+ },
+ 'cinder-volume-localtime' => {
+ 'source-dir' => '/etc/localtime',
+ 'target-dir' => '/etc/localtime',
+ 'options' => 'ro',
+ },
+ 'cinder-volume-dev' => {
+ 'source-dir' => '/dev',
+ 'target-dir' => '/dev',
+ 'options' => 'rw',
+ },
+ 'cinder-volume-run' => {
+ 'source-dir' => '/run',
+ 'target-dir' => '/run',
+ 'options' => 'rw',
+ },
+ 'cinder-volume-sys' => {
+ 'source-dir' => '/sys',
+ 'target-dir' => '/sys',
+ 'options' => 'rw',
+ },
+ 'cinder-volume-lib-modules' => {
+ 'source-dir' => '/lib/modules',
+ 'target-dir' => '/lib/modules',
+ 'options' => 'ro',
+ },
+ 'cinder-volume-iscsi' => {
+ 'source-dir' => '/etc/iscsi',
+ 'target-dir' => '/etc/iscsi',
+ 'options' => 'rw',
+ },
+ 'cinder-volume-var-lib-cinder' => {
+ 'source-dir' => '/var/lib/cinder',
+ 'target-dir' => '/var/lib/cinder',
+ 'options' => 'rw',
+ },
+ 'cinder-volume-var-log' => {
+ 'source-dir' => '/var/log/containers/cinder',
+ 'target-dir' => '/var/log/cinder',
+ 'options' => 'rw',
+ },
+ },
+ }
+ }
+ }
+}
diff --git a/manifests/profile/pacemaker/database/mysql.pp b/manifests/profile/pacemaker/database/mysql.pp
index 031e80c..d42d557 100644
--- a/manifests/profile/pacemaker/database/mysql.pp
+++ b/manifests/profile/pacemaker/database/mysql.pp
@@ -53,20 +53,22 @@ class tripleo::profile::pacemaker::database::mysql (
$pacemaker_master = false
}
- # use only mysql_node_names when we land a patch in t-h-t that
- # switches to autogenerating these values from composable services
- # The galera node names need to match the pacemaker node names... so if we
- # want to use FQDNs for this, the cluster will not finish bootstrapping,
- # since all the nodes will be marked as slaves. For now, we'll stick to the
- # short name which is already registered in pacemaker until we get around
- # this issue.
- $galera_node_names_lookup = hiera('mysql_short_node_names', hiera('mysql_node_names', $::hostname))
+ $galera_node_names_lookup = hiera('mysql_short_node_names', $::hostname)
+ $galera_fqdns_names_lookup = hiera('mysql_node_names', $::hostname)
+
if is_array($galera_node_names_lookup) {
- $galera_nodes = downcase(join($galera_node_names_lookup, ','))
+ $galera_nodes_count = length($galera_node_names_lookup)
+ $galera_nodes = downcase(join($galera_fqdns_names_lookup, ','))
+ $galera_name_pairs = zip($galera_node_names_lookup, $galera_fqdns_names_lookup)
} else {
+ $galera_nodes_count = 1
$galera_nodes = downcase($galera_node_names_lookup)
+ $galera_name_pairs = [[$galera_node_names_lookup, $galera_fqdns_names_lookup]]
}
- $galera_nodes_count = count(split($galera_nodes, ','))
+
+ # NOTE(jaosorior): The usage of cluster_host_map requires resource-agents-3.9.5-82.el7_3.11
+ $processed_galera_name_pairs = $galera_name_pairs.map |$pair| { join($pair, ':') }
+ $cluster_host_map = join($processed_galera_name_pairs, ';')
$mysqld_options = {
'mysqld' => {
@@ -100,6 +102,15 @@ class tripleo::profile::pacemaker::database::mysql (
}
}
+ # since we are configuring rsync for wsrep_sst_method, we ought to make sure
+ # it's installed. We only includ this at step 2 since puppet-rsync may be
+ # included later and also adds the package resource.
+ if $step == 2 {
+ if ! defined(Package['rsync']) {
+ package {'rsync':}
+ }
+ }
+
# remove_default_accounts parameter will execute some mysql commands
# to remove the default accounts created by MySQL package.
# We need MySQL running to run the commands successfully, so better to
@@ -136,7 +147,7 @@ class tripleo::profile::pacemaker::database::mysql (
op_params => 'promote timeout=300s on-fail=block',
master_params => '',
meta_params => "master-max=${galera_nodes_count} ordered=true",
- resource_params => "additional_parameters='--open-files-limit=16384' enable_creation=true wsrep_cluster_address='gcomm://${galera_nodes}'",
+ resource_params => "additional_parameters='--open-files-limit=16384' enable_creation=true wsrep_cluster_address='gcomm://${galera_nodes}' cluster_host_map='${cluster_host_map}'",
tries => $pcs_tries,
location_rule => {
resource_discovery => 'exclusive',
diff --git a/manifests/ui.pp b/manifests/ui.pp
index 1745535..825ffc2 100644
--- a/manifests/ui.pp
+++ b/manifests/ui.pp
@@ -65,10 +65,18 @@
# The ironic proxy endpoint url
# Defaults to undef
#
+# [*endpoint_proxy_ironic_inspector*]
+# The ironic inspector proxy endpoint url
+# Defaults to undef
+#
# [*endpoint_config_ironic*]
# The ironic config endpoint url
# Defaults to undef
#
+# [*endpoint_config_ironic_inspector*]
+# The ironic inspector config endpoint url
+# Defaults to undef
+#
# [*endpoint_proxy_mistral*]
# The mistral proxy endpoint url
# Defaults to undef
@@ -112,18 +120,20 @@ class tripleo::ui (
'ko-KR' => 'Korean',
'zh-CN' => 'Simplified Chinese'
},
- $endpoint_proxy_zaqar = undef,
- $endpoint_proxy_keystone = undef,
- $endpoint_proxy_heat = undef,
- $endpoint_proxy_ironic = undef,
- $endpoint_proxy_mistral = undef,
- $endpoint_proxy_swift = undef,
- $endpoint_config_zaqar = undef,
- $endpoint_config_keystone = undef,
- $endpoint_config_heat = undef,
- $endpoint_config_ironic = undef,
- $endpoint_config_mistral = undef,
- $endpoint_config_swift = undef,
+ $endpoint_proxy_zaqar = undef,
+ $endpoint_proxy_keystone = undef,
+ $endpoint_proxy_heat = undef,
+ $endpoint_proxy_ironic = undef,
+ $endpoint_proxy_ironic_inspector = undef,
+ $endpoint_proxy_mistral = undef,
+ $endpoint_proxy_swift = undef,
+ $endpoint_config_zaqar = undef,
+ $endpoint_config_keystone = undef,
+ $endpoint_config_heat = undef,
+ $endpoint_config_ironic = undef,
+ $endpoint_config_ironic_inspector = undef,
+ $endpoint_config_mistral = undef,
+ $endpoint_config_swift = undef,
) {
@@ -160,6 +170,11 @@ class tripleo::ui (
'reverse_urls' => $endpoint_proxy_ironic
},
{
+ 'path' => '/ironic-inspector',
+ 'url' => $endpoint_proxy_ironic_inspector,
+ 'reverse_urls' => $endpoint_proxy_ironic_inspector
+ },
+ {
'path' => '/mistral',
'url' => $endpoint_proxy_mistral,
'reverse_urls' => $endpoint_proxy_mistral