diff options
Diffstat (limited to 'manifests')
85 files changed, 2533 insertions, 300 deletions
diff --git a/manifests/certmonger/ca/local.pp b/manifests/certmonger/ca/local.pp index ea08dec..b7b7328 100644 --- a/manifests/certmonger/ca/local.pp +++ b/manifests/certmonger/ca/local.pp @@ -29,9 +29,11 @@ class tripleo::certmonger::ca::local( $extract_cmd = "openssl pkcs12 -in ${ca_pkcs12} -out ${ca_pem} -nokeys -nodes -passin pass:''" $trust_ca_cmd = 'update-ca-trust extract' exec { 'extract-and-trust-ca': - command => "${extract_cmd} && ${trust_ca_cmd}", - path => '/usr/bin', - creates => $ca_pem, - require => Package['certmonger'], + command => "${extract_cmd} && ${trust_ca_cmd}", + path => '/usr/bin', + creates => $ca_pem, + tries => 5, + try_sleep => 1, + require => Service['certmonger'], } } diff --git a/manifests/certmonger/haproxy.pp b/manifests/certmonger/haproxy.pp index 2b738e6..504acf3 100644 --- a/manifests/certmonger/haproxy.pp +++ b/manifests/certmonger/haproxy.pp @@ -47,18 +47,21 @@ define tripleo::certmonger::haproxy ( $postsave_cmd, $principal = undef, ){ + include ::haproxy::params certmonger_certificate { "${title}-cert": hostname => $hostname, + dnsname => $hostname, certfile => $service_certificate, keyfile => $service_key, postsave_cmd => $postsave_cmd, principal => $principal, } concat { $service_pem : - ensure => present, - mode => '0640', - owner => 'haproxy', - group => 'haproxy', + ensure => present, + mode => '0640', + owner => 'haproxy', + group => 'haproxy', + require => Package[$::haproxy::params::package_name], } concat::fragment { "${title}-cert-fragment": target => $service_pem, diff --git a/manifests/haproxy.pp b/manifests/haproxy.pp index e72d915..2cac604 100644 --- a/manifests/haproxy.pp +++ b/manifests/haproxy.pp @@ -111,99 +111,99 @@ # # [*keystone_admin*] # (optional) Enable or not Keystone Admin API binding -# Defaults to false +# Defaults to hiera('keystone_enabled', false) # # [*keystone_public*] # (optional) Enable or not Keystone Public API binding -# Defaults to false +# Defaults to hiera('keystone_enabled', false) # # [*neutron*] # (optional) Enable or not Neutron API binding -# Defaults to false +# Defaults to hiera('neutron_api_enabled', false) # # [*cinder*] # (optional) Enable or not Cinder API binding -# Defaults to false +# Defaults to hiera('cinder_api_enabled', false) # # [*manila*] # (optional) Enable or not Manila API binding -# Defaults to false +# Defaults to hiera('manila_api_enabled', false) # # [*sahara*] # (optional) Enable or not Sahara API binding -# defaults to false +# defaults to hiera('sahara_api_enabled', false) # # [*trove*] # (optional) Enable or not Trove API binding -# defaults to false +# defaults to hiera('trove_api_enabled', false) # # [*glance_api*] # (optional) Enable or not Glance API binding -# Defaults to false +# Defaults to hiera('glance_api_enabled', false) # # [*glance_registry*] # (optional) Enable or not Glance registry binding -# Defaults to false +# Defaults to hiera('glance_registry_enabled', false) # # [*nova_osapi*] # (optional) Enable or not Nova API binding -# Defaults to false +# Defaults to hiera('nova_api_enabled', false) # # [*nova_metadata*] # (optional) Enable or not Nova metadata binding -# Defaults to false +# Defaults to hiera('nova_api_enabled', false) # # [*nova_novncproxy*] # (optional) Enable or not Nova novncproxy binding -# Defaults to false +# Defaults to hiera('nova_vnc_proxy_enabled', false) # # [*ceilometer*] # (optional) Enable or not Ceilometer API binding -# Defaults to false +# Defaults to hiera('ceilometer_api_enabled', false) # # [*aodh*] # (optional) Enable or not Aodh API binding -# Defaults to false +# Defaults to hiera('aodh_api_enabled', false) # # [*gnocchi*] # (optional) Enable or not Gnocchi API binding -# Defaults to false +# Defaults to hiera('gnocchi_api_enabled', false) # # [*mistral*] # (optional) Enable or not Mistral API binding -# Defaults to false +# Defaults to hiera('mistral_api_enabled', false) # # [*swift_proxy_server*] # (optional) Enable or not Swift API binding -# Defaults to false +# Defaults to hiera('swift_proxy_enabled', false) # # [*heat_api*] # (optional) Enable or not Heat API binding -# Defaults to false +# Defaults to hiera('heat_api_enabled', false) # # [*heat_cloudwatch*] # (optional) Enable or not Heat Cloudwatch API binding -# Defaults to false +# Defaults to hiera('heat_api_cloudwatch_enabled', false) # # [*heat_cfn*] # (optional) Enable or not Heat CFN API binding -# Defaults to false +# Defaults to hiera('heat_api_cfn_enabled', false) # # [*horizon*] # (optional) Enable or not Horizon dashboard binding -# Defaults to false +# Defaults to hiera('horizon_enabled', false) # # [*ironic*] # (optional) Enable or not Ironic API binding -# Defaults to false +# Defaults to hiera('ironic_enabled', false) # # [*ironic_inspector*] # (optional) Enable or not Ironic Inspector API binding -# Defaults to false +# Defaults to hiera('ironic_inspector_enabled', false) # # [*mysql*] # (optional) Enable or not MySQL Galera binding -# Defaults to false +# Defaults to hiera('mysql_enabled', false) # # [*mysql_clustercheck*] # (optional) Enable check via clustercheck for mysql @@ -215,7 +215,7 @@ # # [*redis*] # (optional) Enable or not Redis binding -# Defaults to false +# Defaults to hiera('redis_enabled', false) # # [*redis_password*] # (optional) Password for Redis authentication, eventually needed by the @@ -228,6 +228,18 @@ # # [*zaqar_api*] # (optional) Enable or not Zaqar Api binding +# Defaults to hiera('zaqar_api_enabled', false) +# +# [*ceph_rgw*] +# (optional) Enable or not Ceph RadosGW binding +# Defaults to hiera('ceph_rgw_enabled', false) +# +# [*opendaylight*] +# (optional) Enable or not OpenDaylight binding +# Defaults to hiera('opendaylight_api_enabled', false) +# +# [*zaqar_ws*] +# (optional) Enable or not Zaqar Websockets binding # Defaults to false # # [*service_ports*] @@ -277,6 +289,12 @@ # 'trove_api_ssl_port' (Defaults to 13779) # 'zaqar_api_port' (Defaults to 8888) # 'zaqar_api_ssl_port' (Defaults to 13888) +# 'ceph_rgw_port' (Defaults to 8080) +# 'ceph_rgw_ssl_port' (Defaults to 13808) +# 'zaqar_ws_port' (Defaults to 9000) +# 'zaqar_ws_ssl_port' (Defaults to 9000) +# * Note that for zaqar's websockets we don't support having a different +# port for SSL, because it ignores the handshake. # Defaults to {} # class tripleo::haproxy ( @@ -299,36 +317,39 @@ class tripleo::haproxy ( $ssl_cipher_suite = '!SSLv2:kEECDH:kRSA:kEDH:kPSK:+3DES:!aNULL:!eNULL:!MD5:!EXP:!RC4:!SEED:!IDEA:!DES', $ssl_options = 'no-sslv3', $haproxy_stats_certificate = undef, - $keystone_admin = false, - $keystone_public = false, - $neutron = false, - $cinder = false, - $sahara = false, - $trove = false, - $manila = false, - $glance_api = false, - $glance_registry = false, - $nova_osapi = false, - $nova_metadata = false, - $nova_novncproxy = false, - $ceilometer = false, - $aodh = false, - $gnocchi = false, - $mistral = false, - $swift_proxy_server = false, - $heat_api = false, - $heat_cloudwatch = false, - $heat_cfn = false, - $horizon = false, - $ironic = false, - $ironic_inspector = false, - $mysql = false, + $keystone_admin = hiera('keystone_enabled', false), + $keystone_public = hiera('keystone_enabled', false), + $neutron = hiera('neutron_api_enabled', false), + $cinder = hiera('cinder_api_enabled', false), + $manila = hiera('manila_api_enabled', false), + $sahara = hiera('sahara_api_enabled', false), + $trove = hiera('trove_api_enabled', false), + $glance_api = hiera('glance_api_enabled', false), + $glance_registry = hiera('glance_registry_enabled', false), + $nova_osapi = hiera('nova_api_enabled', false), + $nova_metadata = hiera('nova_api_enabled', false), + $nova_novncproxy = hiera('nova_vnc_proxy_enabled', false), + $ceilometer = hiera('ceilometer_api_enabled', false), + $aodh = hiera('aodh_api_enabled', false), + $gnocchi = hiera('gnocchi_api_enabled', false), + $mistral = hiera('mistral_api_enabled', false), + $swift_proxy_server = hiera('swift_proxy_enabled', false), + $heat_api = hiera('heat_api_enabled', false), + $heat_cloudwatch = hiera('heat_api_cloudwatch_enabled', false), + $heat_cfn = hiera('heat_api_cfn_enabled', false), + $horizon = hiera('horizon_enabled', false), + $ironic = hiera('ironic_api_enabled', false), + $ironic_inspector = hiera('ironic_inspector_enabled', false), + $mysql = hiera('mysql_enabled', false), $mysql_clustercheck = false, $rabbitmq = false, - $redis = false, + $redis = hiera('redis_enabled', false), $redis_password = undef, $midonet_api = false, - $zaqar_api = false, + $zaqar_api = hiera('zaqar_api_enabled', false), + $ceph_rgw = hiera('ceph_rgw_enabled', false), + $opendaylight = hiera('opendaylight_api_enabled', false), + $zaqar_ws = hiera('zaqar_api_enabled', false), $service_ports = {} ) { $default_service_ports = { @@ -376,6 +397,10 @@ class tripleo::haproxy ( trove_api_ssl_port => 13779, zaqar_api_port => 8888, zaqar_api_ssl_port => 13888, + ceph_rgw_port => 8080, + ceph_rgw_ssl_port => 13808, + zaqar_ws_port => 9000, + zaqar_ws_ssl_port => 9000, } $ports = merge($default_service_ports, $service_ports) @@ -582,6 +607,11 @@ class tripleo::haproxy ( service_port => $ports[manila_api_port], ip_addresses => hiera('manila_api_node_ips', $controller_hosts_real), server_names => $controller_hosts_names_real, + listen_options => { + 'http-request' => [ + 'set-header X-Forwarded-Proto https if { ssl_fc }', + 'set-header X-Forwarded-Proto http if !{ ssl_fc }'], + }, public_ssl_port => $ports[manila_api_ssl_port], } } @@ -884,7 +914,12 @@ class tripleo::haproxy ( options => { 'balance' => 'first', 'option' => ['tcp-check',], - 'tcp-check' => union($redis_tcp_check_options, ['send PING\r\n','expect string +PONG','send info\ replication\r\n','expect string role:master','send QUIT\r\n','expect string +OK']), + 'tcp-check' => union($redis_tcp_check_options, ['send PING\r\n', + 'expect string +PONG', + 'send info\ replication\r\n', + 'expect string role:master', + 'send QUIT\r\n', + 'expect string +OK']), }, collect_exported => false, } @@ -927,4 +962,60 @@ class tripleo::haproxy ( public_ssl_port => $ports[zaqar_api_ssl_port], } } + + if $ceph_rgw { + ::tripleo::haproxy::endpoint { 'ceph_rgw': + public_virtual_ip => $public_virtual_ip, + internal_ip => hiera('ceph_rgw_vip', $controller_virtual_ip), + service_port => $ports[ceph_rgw_port], + ip_addresses => hiera('ceph_rgw_node_ips', $controller_hosts_real), + server_names => $controller_hosts_names_real, + public_ssl_port => $ports[ceph_rgw_ssl_port], + } + } + + $opendaylight_api_vip = hiera('opendaylight_api_vip', $controller_virtual_ip) + $opendaylight_bind_opts = { + "${opendaylight_api_vip}:8081" => [], + "${public_virtual_ip}:8081" => [], + } + + if $opendaylight { + haproxy::listen { 'opendaylight': + bind => $opendaylight_bind_opts, + options => { + 'balance' => 'source', + }, + collect_exported => false, + } + haproxy::balancermember { 'opendaylight': + listening_service => 'opendaylight', + ports => '8081', + ipaddresses => hiera('opendaylight_api_node_ips', $controller_hosts_real), + server_names => $controller_hosts_names_real, + options => ['check', 'inter 2000', 'rise 2', 'fall 5'], + } + } + + if $zaqar_ws { + ::tripleo::haproxy::endpoint { 'zaqar_ws': + public_virtual_ip => $public_virtual_ip, + internal_ip => hiera('zaqar_ws_vip', $controller_virtual_ip), + service_port => $ports[zaqar_ws_port], + ip_addresses => hiera('zaqar_ws_node_ips', $controller_hosts_real), + server_names => $controller_hosts_names_real, + mode => 'http', + haproxy_listen_bind_param => [], # We don't use a transparent proxy here + listen_options => { + # NOTE(jaosorior): Websockets have more overhead in establishing + # connections than regular HTTP connections. Also, since it begins + # as an HTTP connection and then "upgrades" to a TCP connection, some + # timeouts get overriden by others at certain times of the connection. + # The following values were taken from the following site: + # http://blog.haproxy.com/2012/11/07/websockets-load-balancing-with-haproxy/ + 'timeout' => ['connect 5s', 'client 25s', 'server 25s', 'tunnel 3600s'], + }, + public_ssl_port => $ports[zaqar_ws_ssl_port], + } + } } diff --git a/manifests/haproxy/endpoint.pp b/manifests/haproxy/endpoint.pp index ac6cb6c..b7403a4 100644 --- a/manifests/haproxy/endpoint.pp +++ b/manifests/haproxy/endpoint.pp @@ -88,7 +88,8 @@ define tripleo::haproxy::endpoint ( # service exposed to the public network if $public_certificate { - $public_bind_opts = list_to_hash(suffix(any2array($public_virtual_ip), ":${public_ssl_port}"), union($haproxy_listen_bind_param, ['ssl', 'crt', $public_certificate])) + $public_bind_opts = list_to_hash(suffix(any2array($public_virtual_ip), ":${public_ssl_port}"), + union($haproxy_listen_bind_param, ['ssl', 'crt', $public_certificate])) } else { $public_bind_opts = list_to_hash(suffix(any2array($public_virtual_ip), ":${service_port}"), $haproxy_listen_bind_param) } @@ -98,7 +99,8 @@ define tripleo::haproxy::endpoint ( } if $internal_certificate { - $internal_bind_opts = list_to_hash(suffix(any2array($internal_ip), ":${service_port}"), union($haproxy_listen_bind_param, ['ssl', 'crt', $public_certificate])) + $internal_bind_opts = list_to_hash(suffix(any2array($internal_ip), ":${service_port}"), + union($haproxy_listen_bind_param, ['ssl', 'crt', $public_certificate])) } else { $internal_bind_opts = list_to_hash(suffix(any2array($internal_ip), ":${service_port}"), $haproxy_listen_bind_param) } diff --git a/manifests/host/sriov.pp b/manifests/host/sriov.pp new file mode 100644 index 0000000..a30db42 --- /dev/null +++ b/manifests/host/sriov.pp @@ -0,0 +1,27 @@ +# == Class: tripleo::host::sriov +# +# Configures host configuration for the SR-IOV interfaces +# +# === Parameters +# +# [*number_of_vfs*] +# (optional) List of <physical_network>:<number_of_vfs> specifying the number +# VFs to be exposed per physical interface. +# For example, to configure two interface with number of VFs, specify +# it as ['eth1:4','eth2:10'] +# Defaults to [] +# +class tripleo::host::sriov ( + $number_of_vfs = [], +) { + + if !empty($number_of_vfs) { + sriov_vf_config { $number_of_vfs: ensure => present } + + # the numvfs configuration needs to be persisted for every boot + tripleo::host::sriov::numvfs_persistence {'persistent_numvfs': + vf_defs => $number_of_vfs, + content_string => "#!/bin/bash\n" + } + } +} diff --git a/manifests/host/sriov/numvfs_persistence.pp b/manifests/host/sriov/numvfs_persistence.pp new file mode 100644 index 0000000..1ee402c --- /dev/null +++ b/manifests/host/sriov/numvfs_persistence.pp @@ -0,0 +1,55 @@ +# +# tripleo::host::sriov::numvfs_persistence used by tripleo::host::sriov +# +# === Parameters: +# +# [*vf_defs*] +# (required) Array of of <physical_interface>:<numvfs>. +# Example: ['eth1:10','eth2:8'] +# +# [*content_string*] +# (required) String which shall be written to the script file. +# +define tripleo::host::sriov::numvfs_persistence( + $vf_defs, + $content_string +){ + # Since reduce isn't available, we use recursion to iterate each entries of + # "physical_interface:vfs" and accumulate the content that needs to be + # written to the script file. + include ::stdlib + + if empty($vf_defs) { + file { '/etc/sysconfig/allocate_vfs': + ensure => file, + content => $content_string, + group => 'root', + mode => '0755', + owner => 'root', + } + + file { '/sbin/ifup-local': + group => 'root', + mode => '0755', + owner => 'root', + content => '#!/bin/bash', + replace => false + } + + file_line { 'call_ifup-local': + path => '/sbin/ifup-local', + line => '/etc/sysconfig/allocate_vfs $1', + require => File['/sbin/ifup-local'], + } + } else { + $vfspec = split($vf_defs[0], ':') + $interface = $vfspec[0] + $count = $vfspec[1] + $vfdef_str = "${content_string}[ \"${interface}\" == \"\$1\" ] && echo ${count} > /sys/class/net/${interface}/device/sriov_numvfs\n" + tripleo::host::sriov::numvfs_persistence{"mapped ${interface}": + vf_defs => delete_at($vf_defs, 0), + content_string => $vfdef_str + } + } +} + diff --git a/manifests/keepalived.pp b/manifests/keepalived.pp index 45d772e..c0fb3ef 100644 --- a/manifests/keepalived.pp +++ b/manifests/keepalived.pp @@ -54,6 +54,11 @@ # A string. # Defaults to false # +# [*redis_virtual_ip*] +# Virtual IP on the redis service. +# A string. +# Defaults to false +# class tripleo::keepalived ( $controller_virtual_ip, $control_virtual_interface, @@ -62,6 +67,7 @@ class tripleo::keepalived ( $internal_api_virtual_ip = false, $storage_virtual_ip = false, $storage_mgmt_virtual_ip = false, + $redis_virtual_ip = false, ) { case $::osfamily { @@ -141,4 +147,16 @@ class tripleo::keepalived ( } } + if $redis_virtual_ip and $redis_virtual_ip != $controller_virtual_ip { + $redis_virtual_interface = interface_for_ip($redis_virtual_ip) + # KEEPALIVE STORAGE MANAGEMENT NETWORK + keepalived::instance { '56': + interface => $redis_virtual_interface, + virtual_ips => [join([$redis_virtual_ip, ' dev ', $redis_virtual_interface])], + state => 'MASTER', + track_script => ['haproxy'], + priority => 101, + } + } + } diff --git a/manifests/network/contrail/analytics.pp b/manifests/network/contrail/analytics.pp new file mode 100644 index 0000000..4359a43 --- /dev/null +++ b/manifests/network/contrail/analytics.pp @@ -0,0 +1,245 @@ +# +# Copyright (C) 2015 Juniper Networks +# +# Licensed under the Apache License, Version 2.0 (the "License"); you may +# not use this file except in compliance with the License. You may obtain +# a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT +# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the +# License for the specific language governing permissions and limitations +# under the License. +# +# == Class: tripleo::network::contrail::analytics +# +# Configure Contrail Analytics services +# +# == Parameters: +# +# [*host_ip*] +# (required) host IP address of Analytics +# String (IPv4) value. +# +# [*admin_password*] +# (optional) admin password +# String value. +# Defaults to hiera('contrail::admin_password') +# +# [*admin_tenant_name*] +# (optional) admin tenant name. +# String value. +# Defaults to hiera('contrail::admin_tenant_name') +# +# [*admin_token*] +# (optional) admin token +# String value. +# Defaults to hiera('contrail::admin_token') +# +# [*admin_user*] +# (optional) admin user name. +# String value. +# Defaults to hiera('contrail::admin_user') +# +# [*auth_host*] +# (optional) keystone server ip address +# String (IPv4) value. +# Defaults to hiera('contrail::auth_host') +# +# [*auth_port*] +# (optional) keystone port. +# Integer value. +# Defaults to hiera('contrail::auth_port') +# +# [*auth_protocol*] +# (optional) authentication protocol. +# String value. +# Defaults to hiera('contrail::auth_protocol') +# +# [*cassandra_server_list*] +# (optional) List IPs+port of Cassandra servers +# Array of strings value. +# Defaults to hiera('contrail::cassandra_server_list') +# +# [*collector_http_server_port*] +# (optional) Collector http port +# Integer value. +# Defaults to 8089 +# +# [*collector_sandesh_port*] +# (optional) Collector sandesh port +# Integer value. +# Defaults to 8086 +# +# [*disc_server_ip*] +# (optional) IPv4 address of discovery server. +# String (IPv4) value. +# Defaults to hiera('contrail::disc_server_ip') +# +# [*disc_server_port*] +# (optional) port Discovery server listens on. +# Integer value. +# Defaults to hiera('contrail::disc_server_port') +# +# [*http_server_port*] +# (optional) Analytics http port +# Integer value. +# Defaults to 8090 +# +# [*insecure*] +# (optional) insecure mode. +# Boolean value. +# Defaults to falsehiera('contrail::insecure') +# +# [*kafka_broker_list*] +# (optional) List IPs+port of kafka servers +# Array of strings value. +# Defaults to hiera('contrail::kafka_broker_list') +# +# [*memcached_servers*] +# (optional) IPv4 address of memcached servers +# String (IPv4) value + port +# Defaults to hiera('contrail::memcached_server') +# +# [*redis_server*] +# (optional) IPv4 address of redis server. +# String (IPv4) value. +# Defaults to '127.0.0.1'. +# +# [*redis_server_port*] +# (optional) port Redis server listens on. +# Integer value. +# Defaults to 6379 +# +# [*rest_api_ip*] +# (optional) IP address Analytics rest interface listens on +# String (IPv4) value. +# Defaults to '0.0.0.0' +# +# [*rest_api_port*] +# (optional) Analytics rest port +# Integer value. +# Defaults to 8081 +# +# [*zk_server_ip*] +# (optional) List IPs+port of Zookeeper servers +# Array of strings value. +# Defaults to hiera('contrail::zk_server_ip') +# +class tripleo::network::contrail::analytics( + $host_ip, + $admin_password = hiera('contrail::admin_password'), + $admin_tenant_name = hiera('contrail::admin_tenant_name'), + $admin_token = hiera('contrail::admin_token'), + $admin_user = hiera('contrail::admin_user'), + $auth_host = hiera('contrail::auth_host'), + $auth_port = hiera('contrail::auth_port'), + $auth_protocol = hiera('contrail::auth_protocol'), + $cassandra_server_list = hiera('contrail::cassandra_server_list'), + $collector_http_server_port = 8089, + $collector_sandesh_port = 8086, + $disc_server_ip = hiera('contrail::disc_server_ip'), + $disc_server_port = hiera('contrail::disc_server_port'), + $http_server_port = 8090, + $insecure = hiera('contrail::insecure'), + $kafka_broker_list = hiera('contrail::kafka_broker_list'), + $memcached_servers = hiera('contrail::memcached_server'), + $redis_server = '127.0.0.1', + $redis_server_port = 6379, + $rest_api_ip = '0.0.0.0', + $rest_api_port = 8081, + $zk_server_ip = hiera('contrail::zk_server_ip'), +) +{ + class {'::contrail::keystone': + keystone_config => { + 'KEYSTONE' => { + 'admin_password' => $admin_password, + 'admin_tenant_name' => $admin_tenant_name, + 'admin_token' => $admin_token, + 'admin_user' => $admin_user, + 'auth_host' => $auth_host, + 'auth_port' => $auth_port, + 'auth_protocol' => $auth_protocol, + 'insecure' => $insecure, + 'memcached_servers' => $memcached_servers, + }, + }, + } -> + class {'::contrail::analytics': + analytics_api_config => { + 'DEFAULTS' => { + 'cassandra_server_list' => $cassandra_server_list, + 'host_ip' => $host_ip, + 'http_server_port' => $http_server_port, + 'redis_server' => $redis_server, + 'rest_api_ip' => $rest_api_ip, + 'rest_api_port' => $rest_api_port, + }, + 'DISCOVERY' => { + 'disc_server_ip' => $disc_server_ip, + 'disc_server_port' => $disc_server_port, + }, + 'REDIS' => { + 'redis_server_port' => $redis_server_port, + 'redis_query_port' => $redis_server_port, + 'server' => $redis_server, + }, + }, + collector_config => { + 'DEFAULTS' => { + 'cassandra_server_list' => $cassandra_server_list, + 'disc_server_ip' => $disc_server_ip, + 'hostip' => $host_ip, + 'http_server_port' => $collector_http_server_port, + 'kafka_broker_list' => $kafka_broker_list, + 'zookeeper_server_list' => $zk_server_ip, + }, + 'COLLECTOR' => { + 'port' => $collector_sandesh_port, + }, + 'DISCOVERY' => { + 'port' => $disc_server_port, + 'server' => $disc_server_ip, + }, + 'REDIS' => { + 'port' => $redis_server_port, + 'server' => $redis_server, + }, + }, + query_engine_config => { + 'DEFAULTS' => { + 'cassandra_server_list' => $cassandra_server_list, + 'hostip' => $host_ip, + }, + 'DISCOVERY' => { + 'port' => $disc_server_port, + 'server' => $disc_server_ip, + }, + 'REDIS' => { + 'port' => $redis_server_port, + 'server' => $redis_server, + }, + }, + snmp_collector_config => { + 'DEFAULTS' => { + 'zk_server_ip' => $zk_server_ip, + }, + 'DISCOVERY' => { + 'disc_server_ip' => $disc_server_ip, + 'disc_server_port' => $disc_server_port, + }, + }, + topology_config => { + 'DEFAULTS' => { + 'zk_server_ip' => $zk_server_ip, + }, + 'DISCOVERY' => { + 'disc_server_ip' => $disc_server_ip, + 'disc_server_port' => $disc_server_port, + }, + }, + } +} diff --git a/manifests/network/contrail/config.pp b/manifests/network/contrail/config.pp new file mode 100644 index 0000000..7b9c85f --- /dev/null +++ b/manifests/network/contrail/config.pp @@ -0,0 +1,215 @@ +# +# Copyright (C) 2015 Juniper Networks +# +# Licensed under the Apache License, Version 2.0 (the "License"); you may +# not use this file except in compliance with the License. You may obtain +# a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT +# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the +# License for the specific language governing permissions and limitations +# under the License. +# +# == Class: tripleo::network::contrail::config +# +# Configure Contrail Config services +# +# == Parameters: +# +# [*ifmap_password*] +# (required) ifmap password +# String value. +# +# [*ifmap_server_ip*] +# (required) ifmap server ip address. +# String value. +# +# [*ifmap_username*] +# (required) ifmap username +# String value. +# +# [*rabbit_server*] +# (required) IPv4 address of rabbit server. +# String (IPv4) value. +# +# [*admin_password*] +# (optional) admin password +# String value. +# Defaults to hiera('contrail::admin_password') +# +# [*admin_tenant_name*] +# (optional) admin tenant name. +# String value. +# Defaults to hiera('contrail::admin_tenant_name') +# +# [*admin_token*] +# (optional) admin token +# String value. +# Defaults to hiera('contrail::admin_token') +# +# [*admin_user*] +# (optional) admin user name. +# String value. +# Defaults to hiera('contrail::admin_user') +# +# [*auth*] +# (optional) Authentication method. +# Defaults to hiera('contrail::auth') +# +# [*auth_host*] +# (optional) keystone server ip address +# String (IPv4) value. +# Defaults to hiera('contrail::auth_host') +# +# [*auth_port*] +# (optional) keystone port. +# Defaults to hiera('contrail::auth_port') +# +# [*auth_protocol*] +# (optional) authentication protocol. +# Defaults to hiera('contrail::auth_protocol') +# +# [*cassandra_server_list*] +# (optional) List IPs+port of Cassandra servers +# Array of strings value. +# Defaults to hiera('contrail::cassandra_server_list') +# +# [*disc_server_ip*] +# (optional) IPv4 address of discovery server. +# String (IPv4) value. +# Defaults to hiera('contrail::disc_server_ip') +# +# [*insecure*] +# (optional) insecure mode. +# Defaults to hiera('contrail::insecure') +# +# [*listen_ip_address*] +# (optional) IP address to listen on. +# String (IPv4) value. +# Defaults to '0.0.0.0' +# +# [*listen_port*] +# (optional) Listen port for config-api +# Defaults to 8082 +# +# [*memcached_servers*] +# (optional) IPv4 address of memcached servers +# String (IPv4) value + port +# Defaults to hiera('contrail::memcached_server') +# +# [*multi_tenancy*] +# (optional) Defines if mutli-tenancy is enabled. +# Defaults to hiera('contrail::multi_tenancy') +# +# [*redis_server*] +# (optional) IPv4 address of redis server. +# String (IPv4) value. +# Defaults to '127.0.0.1' +# +# [*zk_server_ip*] +# (optional) List IPs+port of Zookeeper servers +# Array of strings value. +# Defaults to hiera('contrail::zk_server_ip') +# +class tripleo::network::contrail::config( + $ifmap_password, + $ifmap_server_ip, + $ifmap_username, + $rabbit_server, + $admin_password = hiera('contrail::admin_password'), + $admin_tenant_name = hiera('contrail::admin_tenant_name'), + $admin_token = hiera('contrail::admin_token'), + $admin_user = hiera('contrail::admin_user'), + $auth = hiera('contrail::auth'), + $auth_host = hiera('contrail::auth_host'), + $auth_port = hiera('contrail::auth_port'), + $auth_protocol = hiera('contrail::auth_protocol'), + $cassandra_server_list = hiera('contrail::cassandra_server_list'), + $disc_server_ip = hiera('contrail::disc_server_ip'), + $insecure = hiera('contrail::insecure'), + $listen_ip_address = '0.0.0.0', + $listen_port = 8082, + $memcached_servers = hiera('contrail::memcached_server'), + $multi_tenancy = hiera('contrail::multi_tenancy'), + $redis_server = '127.0.0.1', + $zk_server_ip = hiera('contrail::zk_server_ip'), +) +{ + validate_ip_address($listen_ip_address) + validate_ip_address($disc_server_ip) + validate_ip_address($ifmap_server_ip) + class {'::contrail::keystone': + keystone_config => { + 'KEYSTONE' => { + 'admin_password' => $admin_password, + 'admin_tenant_name' => $admin_tenant_name, + 'admin_token' => $admin_token, + 'admin_user' => $admin_user, + 'auth_host' => $auth_host, + 'auth_port' => $auth_port, + 'auth_protocol' => $auth_protocol, + 'insecure' => $insecure, + 'memcached_servers' => $memcached_servers, + }, + }, + } -> + class {'::contrail::config': + api_config => { + 'DEFAULTS' => { + 'auth' => $auth, + 'cassandra_server_list' => $cassandra_server_list, + 'disc_server_ip' => $disc_server_ip, + 'ifmap_password' => $ifmap_password, + 'ifmap_server_ip' => $ifmap_server_ip, + 'ifmap_username' => $ifmap_username, + 'listen_ip_addr' => $listen_ip_address, + 'listen_port' => $listen_port, + 'multi_tenancy' => $multi_tenancy, + 'rabbit_server' => $rabbit_server, + 'redis_server' => $redis_server, + 'zk_server_ip' => $zk_server_ip, + }, + }, + device_manager_config => { + 'DEFAULTS' => { + 'cassandra_server_list' => $cassandra_server_list, + 'disc_server_ip' => $disc_server_ip, + 'rabbit_server' => $rabbit_server, + 'redis_server' => $redis_server, + 'zk_server_ip' => $zk_server_ip, + }, + }, + schema_config => { + 'DEFAULTS' => { + 'cassandra_server_list' => $cassandra_server_list, + 'disc_server_ip' => $disc_server_ip, + 'ifmap_password' => $ifmap_password, + 'ifmap_server_ip' => $ifmap_server_ip, + 'ifmap_username' => $ifmap_username, + 'rabbit_server' => $rabbit_server, + 'redis_server' => $redis_server, + 'zk_server_ip' => $zk_server_ip, + }, + }, + discovery_config => { + 'DEFAULTS' => { + 'cassandra_server_list' => $cassandra_server_list, + 'zk_server_ip' => $zk_server_ip, + }, + }, + svc_monitor_config => { + 'DEFAULTS' => { + 'cassandra_server_list' => $cassandra_server_list, + 'disc_server_ip' => $disc_server_ip, + 'ifmap_password' => $ifmap_password, + 'ifmap_server_ip' => $ifmap_server_ip, + 'ifmap_username' => $ifmap_username, + 'rabbit_server' => $rabbit_server, + 'redis_server' => $redis_server, + }, + }, + } +} diff --git a/manifests/network/contrail/control.pp b/manifests/network/contrail/control.pp new file mode 100644 index 0000000..2e50108 --- /dev/null +++ b/manifests/network/contrail/control.pp @@ -0,0 +1,153 @@ +# +# Copyright (C) 2015 Juniper Networks +# +# Licensed under the Apache License, Version 2.0 (the "License"); you may +# not use this file except in compliance with the License. You may obtain +# a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT +# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the +# License for the specific language governing permissions and limitations +# under the License. +# +# == Class: tripleo::network::contrail::control +# +# Configure Contrail Control services +# +# == Parameters: +# +# [*host_ip*] +# (required) host IP address of Control +# String (IPv4) value. +# +# [*ifmap_password*] +# (required) ifmap password +# String value. +# +# [*ifmap_username*] +# (optional) ifmap username +# String value. +# Defaults to hiera('contrail::ifmap_username'), +# +# [*admin_password*] +# (optional) admin password +# String value. +# Defaults to hiera('contrail::admin_password'), +# +# [*admin_tenant_name*] +# (optional) admin tenant name. +# String value. +# Defaults to hiera('contrail::admin_tenant_name'), +# +# [*admin_token*] +# (optional) admin token +# String value. +# Defaults to hiera('contrail::admin_token'), +# +# [*admin_user*] +# (optional) admin user name. +# String value. +# Defaults to hiera('contrail::admin_user'), +# +# [*auth_host*] +# (optional) keystone server ip address +# String (IPv4) value. +# Defaults to hiera('contrail::auth_host'), +# +# [*auth_port*] +# (optional) keystone port. +# Defaults to hiera('contrail::auth_port'), +# +# [*auth_protocol*] +# (optional) authentication protocol. +# Defaults to hiera('contrail::auth_protocol'), +# +# [*disc_server_ip*] +# (optional) IPv4 address of discovery server. +# String (IPv4) value. +# Defaults to hiera('contrail::disc_server_ip'), +# +# [*disc_server_port*] +# (optional) port Discovery server listens on. +# Integer value. +# Defaults to hiera('contrail::disc_server_port'), +# +# [*insecure*] +# (optional) insecure mode. +# Defaults to hiera('contrail::insecure'), +# +# [*memcached_servers*] +# (optional) IPv4 address of memcached servers +# String (IPv4) value + port +# Defaults to hiera('contrail::memcached_servers'), +# +class tripleo::network::contrail::control( + $host_ip, + $ifmap_password, + $ifmap_username, + $admin_password = hiera('contrail::admin_password'), + $admin_tenant_name = hiera('contrail::admin_tenant_name'), + $admin_token = hiera('contrail::admin_token'), + $admin_user = hiera('contrail::admin_user'), + $auth_host = hiera('contrail::auth_host'), + $auth_port = hiera('contrail::auth_port'), + $auth_protocol = hiera('contrail::auth_protocol'), + $disc_server_ip = hiera('contrail::disc_server_ip'), + $disc_server_port = hiera('contrail::disc_server_port'), + $insecure = hiera('contrail::insecure'), + $memcached_servers = hiera('contrail::memcached_server'), +) +{ + class {'::contrail::keystone': + keystone_config => { + 'KEYSTONE' => { + 'admin_tenant_name' => $admin_tenant_name, + 'admin_token' => $admin_token, + 'admin_password' => $admin_password, + 'admin_user' => $admin_user, + 'auth_host' => $auth_host, + 'auth_port' => $auth_port, + 'auth_protocol' => $auth_protocol, + 'insecure' => $insecure, + 'memcached_servers' => $memcached_servers, + }, + }, + } -> + class {'::contrail::control': + control_config => { + 'DEFAULTS' => { + 'hostip' => $host_ip, + }, + 'DISCOVERY' => { + 'port' => $disc_server_port, + 'server' => $disc_server_ip, + }, + 'IFMAP' => { + 'password' => $ifmap_password, + 'user' => $ifmap_username, + }, + }, + dns_config => { + 'DEFAULTS' => { + 'hostip' => $host_ip, + }, + 'DISCOVERY' => { + 'port' => $disc_server_port, + 'server' => $disc_server_ip, + }, + 'IFMAP' => { + 'password' => $ifmap_password, + 'user' => $ifmap_username, + } + }, + control_nodemgr_config => { + 'DISCOVERY' => { + 'port' => $disc_server_port, + 'server' => $disc_server_ip, + }, + }, + } +} diff --git a/manifests/network/contrail/database.pp b/manifests/network/contrail/database.pp new file mode 100644 index 0000000..58f2670 --- /dev/null +++ b/manifests/network/contrail/database.pp @@ -0,0 +1,53 @@ +# +# Copyright (C) 2015 Juniper Networks +# +# Licensed under the Apache License, Version 2.0 (the "License"); you may +# not use this file except in compliance with the License. You may obtain +# a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT +# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the +# License for the specific language governing permissions and limitations +# under the License. +# +# == Class: tripleo::network::contrail::control +# +# Configure Contrail Control services +# +# == Parameters: +# +# [*host_ip*] +# (required) host IP address of Database node +# String (IPv4) value. +# +# [*disc_server_ip*] +# (optional) IPv4 address of discovery server. +# String (IPv4) value. +# Defaults to hiera('contrail::disc_server_ip') +# +# [*disc_server_port*] +# (optional) port Discovery server listens on. +# Integer value. +# Defaults to hiera('contrail::disc_server_port') +# +class tripleo::network::contrail::database( + $host_ip, + $disc_server_ip = hiera('contrail::disc_server_ip'), + $disc_server_port = hiera('contrail::disc_server_port'), +) +{ + class {'::contrail::database': + database_nodemgr_config => { + 'DEFAULTS' => { + 'hostip' => $host_ip, + }, + 'DISCOVERY' => { + 'port' => $disc_server_port, + 'server' => $disc_server_ip, + }, + }, + } +} diff --git a/manifests/network/contrail/webui.pp b/manifests/network/contrail/webui.pp new file mode 100644 index 0000000..0b308a4 --- /dev/null +++ b/manifests/network/contrail/webui.pp @@ -0,0 +1,108 @@ +# +# Copyright (C) 2015 Juniper Networks +# +# Licensed under the Apache License, Version 2.0 (the "License"); you may +# not use this file except in compliance with the License. You may obtain +# a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT +# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the +# License for the specific language governing permissions and limitations +# under the License. +# +# == Class: tripleo::network::contrail::webui +# +# Configure Contrail Webui services +# +# == Parameters: +# +# [*contrail_analytics_vip*] +# (required) VIP of Contrail Analytics +# String (IPv4) value. +# +# [*contrail_config_vip*] +# (required) VIP of Contrail Config +# String (IPv4) value. +# +# [*neutron_vip*] +# (required) VIP of Neutron +# String (IPv4) value. +# +# [*admin_password*] +# (optional) admin password +# String value. +# Defaults to hiera('contrail::admin_password') +# +# [*admin_tenant_name*] +# (optional) admin tenant name. +# String value. +# Defaults to hiera('contrail::admin_tenant_name') +# +# [*admin_token*] +# (optional) admin token +# String value. +# Defaults to hiera('contrail::admin_token') +# +# [*admin_user*] +# (optional) admin user name. +# String value. +# Defaults to hiera('contrail::admin_user') +# +# [*auth_host*] +# (optional) keystone server ip address +# String (IPv4) value. +# Defaults to hiera('contrail::auth_host') +# +# [*cassandra_server_list*] +# (optional) List IPs+port of Cassandra servers +# Array of strings value. +# Defaults to hiera('contrail::cassandra_server_list') +# +# [*contrail_webui_http_port*] +# (optional) Webui HTTP Port +# Integer value. +# Defaults to 8080 +# +# [*contrail_webui_https_port*] +# (optional) Webui HTTPS Port +# Integer value. +# Defaults to 8143 +# +# [*redis_ip*] +# (optional) IP of Redis +# String (IPv4) value. +# Defaults to '127.0.0.1' +# +class tripleo::network::contrail::webui( + $contrail_analytics_vip, + $contrail_config_vip, + $neutron_vip, + $admin_password = hiera('contrail::admin_password'), + $admin_tenant_name = hiera('contrail::admin_tenant_name'), + $admin_token = hiera('contrail::admin_token'), + $admin_user = hiera('contrail::admin_user'), + $auth_host = hiera('contrail::auth_host'), + $cassandra_server_list = hiera('contrail::cassandra_server_list'), + $contrail_webui_http_port = 8080, + $contrail_webui_https_port = 8143, + $redis_ip = '127.0.0.1', +) +{ + class {'::contrail::webui': + openstack_vip => $auth_host, + contrail_config_vip => $contrail_config_vip, + contrail_analytics_vip => $contrail_analytics_vip, + neutron_vip => $neutron_vip, + cassandra_ip => $cassandra_server_list, + redis_ip => $redis_ip, + contrail_webui_http_port => $contrail_webui_http_port, + contrail_webui_https_port => $contrail_webui_https_port, + admin_user => $admin_user, + admin_password => $admin_password, + admin_token => $admin_token, + admin_tenant_name => $admin_tenant_name, + } +} diff --git a/manifests/pacemaker/resource_restart_flag.pp b/manifests/pacemaker/resource_restart_flag.pp new file mode 100644 index 0000000..aded802 --- /dev/null +++ b/manifests/pacemaker/resource_restart_flag.pp @@ -0,0 +1,35 @@ +# Copyright 2016 Red Hat, Inc. +# +# Licensed under the Apache License, Version 2.0 (the "License"); you may +# not use this file except in compliance with the License. You may obtain +# a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT +# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the +# License for the specific language governing permissions and limitations +# under the License. +# +# == Define: tripleo::pacemaker::resource_restart_flag +# +# Creates a flag file on the filesystem to signify that a pacemaker +# resource needs restarting (usually to pick up config changes after +# they've been written on all nodes). +# +# === Parameters +# +# [*title*] +# The resource name in Pacemaker to restart. If it's a cloned +# resource, the name should include the '-clone' part. +# +define tripleo::pacemaker::resource_restart_flag() { + + exec { "${title} resource restart flag": + command => "touch /var/lib/tripleo/pacemaker-restarts/${title}", + path => ['/bin','/usr/bin','/sbin','/usr/sbin'], + refreshonly => true, + } + +} diff --git a/manifests/profile/base/aodh.pp b/manifests/profile/base/aodh.pp index 07c0a88..49a543a 100644 --- a/manifests/profile/base/aodh.pp +++ b/manifests/profile/base/aodh.pp @@ -27,9 +27,15 @@ # (Optional) The hostname of the node responsible for bootstrapping tasks # Defaults to hiera('bootstrap_nodeid') # +# [*rabbit_hosts*] +# list of the rabbbit host IPs +# Defaults to hiera('rabbitmq_node_ips') +# + class tripleo::profile::base::aodh ( $step = hiera('step'), $bootstrap_node = hiera('bootstrap_nodeid', undef), + $rabbit_hosts = hiera('rabbitmq_node_ips', undef), ) { if $::hostname == downcase($bootstrap_node) { @@ -38,12 +44,10 @@ class tripleo::profile::base::aodh ( $sync_db = false } - if $step >= 3 and $sync_db { - include ::aodh::db::mysql - } - if $step >= 4 or ($step >= 3 and $sync_db) { - include ::aodh + class { '::aodh' : + rabbit_hosts => $rabbit_hosts, + } include ::aodh::auth include ::aodh::config include ::aodh::client diff --git a/manifests/profile/base/aodh/api.pp b/manifests/profile/base/aodh/api.pp index 3c4c0b6..2dcf802 100644 --- a/manifests/profile/base/aodh/api.pp +++ b/manifests/profile/base/aodh/api.pp @@ -23,8 +23,14 @@ # for more details. # Defaults to hiera('step') # +# [*enable_combination_alarms*] +# (optional) Setting to enable combination alarms +# Defaults to: false +# + class tripleo::profile::base::aodh::api ( - $step = hiera('step'), + $step = hiera('step'), + $enable_combination_alarms = false, ) { include ::tripleo::profile::base::aodh @@ -32,5 +38,12 @@ class tripleo::profile::base::aodh::api ( if $step >= 4 { include ::aodh::api include ::aodh::wsgi::apache + + #NOTE: Combination alarms are deprecated in newton and disabled by default. + # we need a way to override this setting for users still using this type + # of alarms. + aodh_config { + 'api/enable_combination_alarms' : value => $enable_combination_alarms; + } } } diff --git a/manifests/profile/base/aodh/evaluator.pp b/manifests/profile/base/aodh/evaluator.pp index 610d5a8..d9b48b3 100644 --- a/manifests/profile/base/aodh/evaluator.pp +++ b/manifests/profile/base/aodh/evaluator.pp @@ -30,7 +30,9 @@ class tripleo::profile::base::aodh::evaluator ( include ::tripleo::profile::base::aodh if $step >= 4 { - include ::aodh::evaluator + class { '::aodh::evaluator': + coordination_url => join(['redis://:', hiera('aodh_redis_password'), '@', normalize_ip_for_uri(hiera('redis_vip')), ':6379/']), + } } } diff --git a/manifests/profile/base/ceilometer.pp b/manifests/profile/base/ceilometer.pp index 88818de..aaf904f 100644 --- a/manifests/profile/base/ceilometer.pp +++ b/manifests/profile/base/ceilometer.pp @@ -23,12 +23,19 @@ # for more details. # Defaults to hiera('step') # +# [*rabbit_hosts*] +# list of the rabbbit host IPs +# Defaults to hiera('rabbitmq_node_ips') + class tripleo::profile::base::ceilometer ( $step = hiera('step'), + $rabbit_hosts = hiera('rabbitmq_node_ips', undef), ) { if $step >= 3 { - include ::ceilometer + class { '::ceilometer' : + rabbit_hosts => $rabbit_hosts, + } include ::ceilometer::config } diff --git a/manifests/profile/base/ceilometer/agent/central.pp b/manifests/profile/base/ceilometer/agent/central.pp index c91e610..033d34c 100644 --- a/manifests/profile/base/ceilometer/agent/central.pp +++ b/manifests/profile/base/ceilometer/agent/central.pp @@ -30,7 +30,9 @@ class tripleo::profile::base::ceilometer::agent::central ( if $step >= 4 { include ::ceilometer::agent::auth - include ::ceilometer::agent::central + class { '::ceilometer::agent::central': + coordination_url => join(['redis://:', hiera('ceilometer_redis_password'), '@', normalize_ip_for_uri(hiera('redis_vip')), ':6379/']), + } } } diff --git a/manifests/profile/base/ceilometer/api.pp b/manifests/profile/base/ceilometer/api.pp index b6419c2..da94da2 100644 --- a/manifests/profile/base/ceilometer/api.pp +++ b/manifests/profile/base/ceilometer/api.pp @@ -30,9 +30,6 @@ class tripleo::profile::base::ceilometer::api ( if $step >= 4 { include ::ceilometer::api - #NOTE: remove conditional once tht changes are merged - if hiera('ceilometer_wsgi', false) { - include ::ceilometer::wsgi::apache - } + include ::ceilometer::wsgi::apache } } diff --git a/manifests/profile/base/ceilometer/collector.pp b/manifests/profile/base/ceilometer/collector.pp index baaf4c8..e892478 100644 --- a/manifests/profile/base/ceilometer/collector.pp +++ b/manifests/profile/base/ceilometer/collector.pp @@ -59,10 +59,6 @@ class tripleo::profile::base::ceilometer::collector ( include ::tripleo::profile::base::ceilometer - if $step >= 2 and $sync_db and $ceilometer_backend == 'mysql' { - include ::ceilometer::db::mysql - } - if $step >= 3 and $sync_db { include ::ceilometer::db::sync } diff --git a/manifests/profile/base/ceilometer/expirer.pp b/manifests/profile/base/ceilometer/expirer.pp index 0830307..eaaaefc 100644 --- a/manifests/profile/base/ceilometer/expirer.pp +++ b/manifests/profile/base/ceilometer/expirer.pp @@ -30,7 +30,8 @@ class tripleo::profile::base::ceilometer::expirer ( if $step >= 4 { include ::ceilometer::expirer - Cron <| title == 'ceilometer-expirer' |> { command => "sleep $((\$(od -A n -t d -N 3 /dev/urandom) % 86400)) && ${::ceilometer::params::expirer_command}" } + Cron <| title == 'ceilometer-expirer' |> + { command => "sleep $((\$(od -A n -t d -N 3 /dev/urandom) % 86400)) && ${::ceilometer::params::expirer_command}" } } } diff --git a/manifests/profile/base/ceph.pp b/manifests/profile/base/ceph.pp index 94166ac..6ffd4ef 100644 --- a/manifests/profile/base/ceph.pp +++ b/manifests/profile/base/ceph.pp @@ -18,22 +18,13 @@ # # === Parameters # -# [*ceph_ipv6*] -# (Optional) Force daemons to bind on IPv6 addresses -# Defaults to false -# # [*ceph_mon_initial_members*] # (Optional) List of IP addresses to use as mon_initial_members -# Defaults to undef +# Defaults to hiera('ceph_mon_node_names') # # [*ceph_mon_host*] # (Optional) List of IP addresses to use as mon_host -# Deftauls to undef -# -# [*ceph_mon_host_v6*] -# (Optional) List of IPv6 addresses, surrounded by brackets, used as -# mon_host when ceph_ipv6 is true -# Defaults to undef +# Deftauls to hiera('ceph_mon_node_ips') # # [*enable_ceph_storage*] # (Optional) enable_ceph_storage @@ -45,22 +36,29 @@ # Defaults to hiera('step') # class tripleo::profile::base::ceph ( - $ceph_ipv6 = false, - $ceph_mon_initial_members = undef, - $ceph_mon_host = undef, - $ceph_mon_host_v6 = undef, + $ceph_mon_initial_members = hiera('ceph_mon_node_names', undef), + $ceph_mon_host = hiera('ceph_mon_node_ips', '127.0.0.1'), $enable_ceph_storage = false, $step = hiera('step'), ) { if $step >= 2 { if $ceph_mon_initial_members { - $mon_initial_members = downcase($ceph_mon_initial_members) + if is_array($ceph_mon_initial_members) { + $mon_initial_members = downcase(join($ceph_mon_initial_members, ',')) + } else { + $mon_initial_members = downcase($ceph_mon_initial_members) + } } else { $mon_initial_members = undef } - if $ceph_ipv6 { - $mon_host = $ceph_mon_host_v6 + + if is_array($ceph_mon_host) { + if is_ipv6_address($ceph_mon_host[0]) { + $mon_host = join(enclose_ipv6($ceph_mon_host), ',') + } else { + $mon_host = join($ceph_mon_host, ',') + } } else { $mon_host = $ceph_mon_host } diff --git a/manifests/profile/base/ceph/rgw.pp b/manifests/profile/base/ceph/rgw.pp new file mode 100644 index 0000000..7cd2b6a --- /dev/null +++ b/manifests/profile/base/ceph/rgw.pp @@ -0,0 +1,63 @@ +# Copyright 2016 Red Hat, Inc. +# +# Licensed under the Apache License, Version 2.0 (the "License"); you may +# not use this file except in compliance with the License. You may obtain +# a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT +# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the +# License for the specific language governing permissions and limitations +# under the License. +# +# == Class: tripleo::profile::base::ceph::rgw +# +# Ceph RadosGW profile for tripleo +# +# === Parameters +# +# [*keystone_admin_token*] +# The keystone admin token +# +# [*keystone_url*] +# The internal or admin url for keystone +# +# [*rgw_key*] +# The cephx key for the RGW client service +# +# [*step*] +# (Optional) The current step in deployment. See tripleo-heat-templates +# for more details. +# Defaults to hiera('step') +# +class tripleo::profile::base::ceph::rgw ( + $keystone_admin_token, + $keystone_url, + $rgw_key, + $step = hiera('step'), +) { + + include ::tripleo::profile::base::ceph + + if $step >= 3 { + include ::ceph::profile::rgw + $rgw_name = hiera('ceph::profile::params::rgw_name', 'radosgw.gateway') + ceph::key { "client.${rgw_name}": + secret => $rgw_key, + cap_mon => 'allow *', + cap_osd => 'allow *', + inject => true, + } + } + + if $step >= 4 { + ceph::rgw::keystone { $rgw_name: + rgw_keystone_accepted_roles => ['admin', '_member_', 'Member'], + use_pki => false, + rgw_keystone_admin_token => $keystone_admin_token, + rgw_keystone_url => $keystone_url, + } + } +} diff --git a/manifests/profile/base/cinder.pp b/manifests/profile/base/cinder.pp index 43d95b4..510ea40 100644 --- a/manifests/profile/base/cinder.pp +++ b/manifests/profile/base/cinder.pp @@ -30,10 +30,15 @@ # (Optional) The current step of the deployment # Defaults to hiera('step') # +# [*rabbit_hosts*] +# list of the rabbbit host IPs +# Defaults to hiera('rabbitmq_node_ips') + class tripleo::profile::base::cinder ( $bootstrap_node = hiera('bootstrap_nodeid', undef), $cinder_enable_db_purge = true, $step = hiera('step'), + $rabbit_hosts = hiera('rabbitmq_node_ips', undef), ) { if $::hostname == downcase($bootstrap_node) { $sync_db = true @@ -42,7 +47,9 @@ class tripleo::profile::base::cinder ( } if $step >= 4 or ($step >= 3 and $sync_db) { - include ::cinder + class { '::cinder' : + rabbit_hosts => $rabbit_hosts, + } include ::cinder::config } diff --git a/manifests/profile/base/cinder/api.pp b/manifests/profile/base/cinder/api.pp index 370b402..31635eb 100644 --- a/manifests/profile/base/cinder/api.pp +++ b/manifests/profile/base/cinder/api.pp @@ -39,10 +39,6 @@ class tripleo::profile::base::cinder::api ( include ::tripleo::profile::base::cinder - if $step >= 3 and $sync_db { - include ::cinder::db::mysql - } - if $step >= 4 or ($step >= 3 and $sync_db) { include ::cinder::api include ::cinder::ceilometer diff --git a/manifests/profile/base/cinder/volume.pp b/manifests/profile/base/cinder/volume.pp index dfb034f..7d562ec 100644 --- a/manifests/profile/base/cinder/volume.pp +++ b/manifests/profile/base/cinder/volume.pp @@ -108,7 +108,13 @@ class tripleo::profile::base::cinder::volume ( $cinder_rbd_backend_name = undef } - $cinder_enabled_backends = delete_undef_values([$cinder_iscsi_backend_name, $cinder_rbd_backend_name, $cinder_eqlx_backend_name, $cinder_dellsc_backend_name, $cinder_netapp_backend_name, $cinder_nfs_backend_name, $cinder_user_enabled_backends]) + $cinder_enabled_backends = delete_undef_values([$cinder_iscsi_backend_name, + $cinder_rbd_backend_name, + $cinder_eqlx_backend_name, + $cinder_dellsc_backend_name, + $cinder_netapp_backend_name, + $cinder_nfs_backend_name, + $cinder_user_enabled_backends]) class { '::cinder::backends' : enabled_backends => $cinder_enabled_backends, } diff --git a/manifests/profile/base/cinder/volume/iscsi.pp b/manifests/profile/base/cinder/volume/iscsi.pp index d1d22bb..8baaf1c 100644 --- a/manifests/profile/base/cinder/volume/iscsi.pp +++ b/manifests/profile/base/cinder/volume/iscsi.pp @@ -52,8 +52,11 @@ class tripleo::profile::base::cinder::volume::iscsi ( size => join([$cinder_lvm_loop_device_size, 'M']), } + # NOTE(gfidente): never emit in hieradata: + # key: [ipv6] + # as it will cause hiera parsing errors cinder::backend::iscsi { $backend_name : - iscsi_ip_address => $cinder_iscsi_address, + iscsi_ip_address => normalize_ip_for_uri($cinder_iscsi_address), iscsi_helper => $cinder_iscsi_helper, } } diff --git a/manifests/profile/base/database/mongodb.pp b/manifests/profile/base/database/mongodb.pp index 1a19bb6..8967f5b 100644 --- a/manifests/profile/base/database/mongodb.pp +++ b/manifests/profile/base/database/mongodb.pp @@ -44,6 +44,13 @@ class tripleo::profile::base::database::mongodb ( include ::tripleo::profile::base::database::mongodbcommon if $bootstrap_node == $::hostname { + # make sure we can connect to all servers before forming the replset + tripleo::profile::pacemaker::database::mongodbvalidator { + $tripleo::profile::base::database::mongodbcommon::mongodb_node_ips : + port => $tripleo::profile::base::database::mongodbcommon::port, + require => Service['mongodb'], + before => Mongodb_replset[$mongodb_replset], + } mongodb_replset { $mongodb_replset : members => $tripleo::profile::base::database::mongodbcommon::mongo_node_ips_with_port_nobr, } diff --git a/manifests/profile/base/database/mysql.pp b/manifests/profile/base/database/mysql.pp index 49c9df3..9da1456 100644 --- a/manifests/profile/base/database/mysql.pp +++ b/manifests/profile/base/database/mysql.pp @@ -18,6 +18,14 @@ # # === Parameters # +# [*bind_address*] +# (Optional) The address that the local mysql instance should bind to. +# Defaults to $::hostname +# +# [*bootstrap_node*] +# (Optional) The hostname of the node responsible for bootstrapping tasks +# Defaults to hiera('bootstrap_nodeid') +# # [*manage_resources*] # (Optional) Whether or not manage root user, root my.cnf, and service. # Defaults to true @@ -37,13 +45,20 @@ # Defaults to hiera('step') # class tripleo::profile::base::database::mysql ( + $bind_address = $::hostname, + $bootstrap_node = hiera('bootstrap_nodeid', undef), $manage_resources = true, $mysql_server_options = {}, $remove_default_accounts = true, $step = hiera('step'), - ) { + if $::hostname == downcase($bootstrap_node) { + $sync_db = true + } else { + $sync_db = false + } + validate_hash($mysql_server_options) # non-ha scenario @@ -59,14 +74,14 @@ class tripleo::profile::base::database::mysql ( } else { $mysql_config_file = '/etc/my.cnf.d/server.cnf' } - # TODO Galara + # TODO Galera # FIXME: due to https://bugzilla.redhat.com/show_bug.cgi?id=1298671 we # set bind-address to a hostname instead of an ip address; to move Mysql # from internal_api on another network we'll have to customize both # MysqlNetwork and ControllerHostnameResolveNetwork in ServiceNetMap $mysql_server_default = { 'mysqld' => { - 'bind-address' => $::hostname, + 'bind-address' => $bind_address, 'max_connections' => hiera('mysql_max_connections'), 'open_files_limit' => '-1', } @@ -83,4 +98,51 @@ class tripleo::profile::base::database::mysql ( } } + if $step >= 2 and $sync_db { + Class['::mysql::server'] -> Mysql_database<||> + if hiera('aodh_api_enabled', false) { + include ::aodh::db::mysql + } + if hiera('ceilometer_collector_enabled', false) { + include ::ceilometer::db::mysql + } + if hiera('cinder_api_enabled', false) { + include ::cinder::db::mysql + } + if hiera('glance_registry_enabled', false) { + include ::glance::db::mysql + } + if hiera('gnocchi_api_enabled', false) { + include ::gnocchi::db::mysql + } + if hiera('heat_engine_enabled', false) { + include ::heat::db::mysql + } + if hiera('ironic_api_enabled', false) { + include ::ironic::db::mysql + } + if hiera('keystone_enabled', false) { + include ::keystone::db::mysql + } + if hiera('manila_api_enabled', false) { + include ::manila::db::mysql + } + if hiera('mistral_api_enabled', false) { + include ::mistral::db::mysql + } + if hiera('neutron_api_enabled', false) { + include ::neutron::db::mysql + } + if hiera('nova_api_enabled', false) { + include ::nova::db::mysql + include ::nova::db::mysql_api + } + if hiera('sahara_api_enabled', false) { + include ::sahara::db::mysql + } + if hiera('trove_api_enabled', false) { + include ::trove::db::mysql + } + } + } diff --git a/manifests/profile/base/glance/api.pp b/manifests/profile/base/glance/api.pp index 845fd41..ecffd7f 100644 --- a/manifests/profile/base/glance/api.pp +++ b/manifests/profile/base/glance/api.pp @@ -27,9 +27,14 @@ # for more details. # Defaults to hiera('step') # +# [*rabbit_hosts*] +# list of the rabbbit host IPs +# Defaults to hiera('rabbitmq_node_ips') + class tripleo::profile::base::glance::api ( $glance_backend = downcase(hiera('glance_backend', 'swift')), $step = hiera('step'), + $rabbit_hosts = hiera('rabbitmq_node_ips', undef), ) { if $step >= 4 { @@ -48,7 +53,9 @@ class tripleo::profile::base::glance::api ( class { '::glance::api': stores => $glance_store, } - include ::glance::notify::rabbitmq + class { '::glance::notify::rabbitmq' : + rabbit_hosts => $rabbit_hosts, + } include join(['::glance::backend::', $glance_backend]) } diff --git a/manifests/profile/base/glance/registry.pp b/manifests/profile/base/glance/registry.pp index ac6796a..9e2be9d 100644 --- a/manifests/profile/base/glance/registry.pp +++ b/manifests/profile/base/glance/registry.pp @@ -42,10 +42,6 @@ class tripleo::profile::base::glance::registry ( $sync_db = false } - if $step >= 3 and $sync_db { - include ::glance::db::mysql - } - if $step >= 4 or ( $step >= 3 and $sync_db ) { # TODO: notifications, scrubber, etc. include ::glance diff --git a/manifests/profile/base/gnocchi/api.pp b/manifests/profile/base/gnocchi/api.pp index 5e7e215..9a08551 100644 --- a/manifests/profile/base/gnocchi/api.pp +++ b/manifests/profile/base/gnocchi/api.pp @@ -45,14 +45,16 @@ class tripleo::profile::base::gnocchi::api ( include ::tripleo::profile::base::gnocchi if $step >= 3 and $sync_db { - include ::gnocchi::db::mysql include ::gnocchi::db::sync } if $step >= 4 { include ::gnocchi::api include ::gnocchi::wsgi::apache - include ::gnocchi::storage + + class { '::gnocchi::storage': + coordination_url => join(['redis://:', hiera('gnocchi_redis_password'), '@', normalize_ip_for_uri(hiera('redis_vip')), ':6379/']), + } case $gnocchi_backend { 'swift': { include ::gnocchi::storage::swift } 'file': { include ::gnocchi::storage::file } diff --git a/manifests/profile/base/gnocchi/metricd.pp b/manifests/profile/base/gnocchi/metricd.pp index 4d7eb89..e69bbd5 100644 --- a/manifests/profile/base/gnocchi/metricd.pp +++ b/manifests/profile/base/gnocchi/metricd.pp @@ -28,7 +28,9 @@ class tripleo::profile::base::gnocchi::metricd ( ) { include ::tripleo::profile::base::gnocchi - if $step >= 4 { + if $step >= 5 { include ::gnocchi::metricd + Keystone_endpoint<||> -> Service['gnocchi-metricd'] + Keystone_user_role<||> -> Service['gnocchi-metricd'] } } diff --git a/manifests/profile/base/gnocchi/statsd.pp b/manifests/profile/base/gnocchi/statsd.pp index 775b043..1fe4067 100644 --- a/manifests/profile/base/gnocchi/statsd.pp +++ b/manifests/profile/base/gnocchi/statsd.pp @@ -28,7 +28,9 @@ class tripleo::profile::base::gnocchi::statsd ( ) { include ::tripleo::profile::base::gnocchi - if $step >= 4 { + if $step >= 5 { include ::gnocchi::statsd + Keystone_endpoint<||> -> Service['gnocchi-statsd'] + Keystone_user_role<||> -> Service['gnocchi-statsd'] } } diff --git a/manifests/profile/base/haproxy.pp b/manifests/profile/base/haproxy.pp index 4f2f850..e018f36 100644 --- a/manifests/profile/base/haproxy.pp +++ b/manifests/profile/base/haproxy.pp @@ -79,9 +79,26 @@ class tripleo::profile::base::haproxy ( require => Class['::certmonger'], } create_resources('::tripleo::certmonger::haproxy', $certificates_specs) + # The haproxy fronends (or listen resources) depend on the certificate + # existing and need to be refreshed if it changed. + Tripleo::Certmonger::Haproxy<||> ~> Haproxy::Listen<||> } include ::tripleo::haproxy + + unless hiera('tripleo::haproxy::haproxy_service_manage', true) { + # Reload HAProxy configuration if the haproxy class has refreshed or any + # HAProxy frontend endpoint has changed. + exec { 'haproxy-reload': + command => 'systemctl reload haproxy', + path => ['/usr/bin', '/usr/sbin'], + refreshonly => true, + onlyif => 'pcs property | grep -q "maintenance-mode.*true"', + subscribe => Class['::haproxy'] + } + Haproxy::Listen<||> ~> Exec['haproxy-reload'] + Haproxy::Balancermember<||> ~> Exec['haproxy-reload'] + } } } diff --git a/manifests/profile/base/heat.pp b/manifests/profile/base/heat.pp index dcf0f21..027ab7e 100644 --- a/manifests/profile/base/heat.pp +++ b/manifests/profile/base/heat.pp @@ -35,11 +35,16 @@ # for more details. # Defaults to hiera('step') # +# [*rabbit_hosts*] +# list of the rabbbit host IPs +# Defaults to hiera('rabbitmq_node_ips') + class tripleo::profile::base::heat ( $bootstrap_node = downcase(hiera('bootstrap_nodeid')), $manage_db_purge = hiera('heat_enable_db_purge', true), $notification_driver = 'messaging', $step = hiera('step'), + $rabbit_hosts = hiera('rabbitmq_node_ips', undef), ) { # Domain resources will be created at step5 on the bootstrap_node so we # configure heat.conf at step3 and 4 but actually create the domain later. @@ -54,8 +59,10 @@ class tripleo::profile::base::heat ( if $step >= 4 { class { '::heat' : notification_driver => $notification_driver, + rabbit_hosts => $rabbit_hosts, } include ::heat::config + include ::heat::cors } if $step >= 5 { diff --git a/manifests/profile/base/heat/api.pp b/manifests/profile/base/heat/api.pp index 68de12b..7166298 100644 --- a/manifests/profile/base/heat/api.pp +++ b/manifests/profile/base/heat/api.pp @@ -26,8 +26,9 @@ class tripleo::profile::base::heat::api ( $step = hiera('step'), ) { + include ::tripleo::profile::base::heat + if $step >= 4 { - include ::tripleo::profile::base::heat include ::heat::api } } diff --git a/manifests/profile/base/heat/api_cfn.pp b/manifests/profile/base/heat/api_cfn.pp index 7c80fc6..c1adae6 100644 --- a/manifests/profile/base/heat/api_cfn.pp +++ b/manifests/profile/base/heat/api_cfn.pp @@ -26,8 +26,9 @@ class tripleo::profile::base::heat::api_cfn ( $step = hiera('step'), ) { + include ::tripleo::profile::base::heat + if $step >= 4 { - include ::tripleo::profile::base::heat include ::heat::api_cfn } } diff --git a/manifests/profile/base/heat/api_cloudwatch.pp b/manifests/profile/base/heat/api_cloudwatch.pp index 6362275..3004db9 100644 --- a/manifests/profile/base/heat/api_cloudwatch.pp +++ b/manifests/profile/base/heat/api_cloudwatch.pp @@ -26,8 +26,9 @@ class tripleo::profile::base::heat::api_cloudwatch ( $step = hiera('step'), ) { + include ::tripleo::profile::base::heat + if $step >= 4 { - include ::tripleo::profile::base::heat include ::heat::api_cloudwatch } } diff --git a/manifests/profile/base/heat/engine.pp b/manifests/profile/base/heat/engine.pp index 32a711f..479e1c6 100644 --- a/manifests/profile/base/heat/engine.pp +++ b/manifests/profile/base/heat/engine.pp @@ -37,12 +37,9 @@ class tripleo::profile::base::heat::engine ( $sync_db = false } - if $step >= 3 and $sync_db { - include ::heat::db::mysql - } + include ::tripleo::profile::base::heat if $step >= 4 or ( $step >= 3 and $sync_db ) { - include ::tripleo::profile::base::heat include ::heat::engine } diff --git a/manifests/profile/base/ironic.pp b/manifests/profile/base/ironic.pp index f098d37..c4e525a 100644 --- a/manifests/profile/base/ironic.pp +++ b/manifests/profile/base/ironic.pp @@ -26,9 +26,14 @@ # (Optional) The current step of the deployment # Defaults to hiera('step') # +# [*rabbit_hosts*] +# list of the rabbbit host IPs +# Defaults to hiera('rabbitmq_node_ips') + class tripleo::profile::base::ironic ( $bootstrap_node = hiera('bootstrap_nodeid', undef), $step = hiera('step'), + $rabbit_hosts = hiera('rabbitmq_node_ips', undef), ) { # Database is accessed by both API and conductor, hence it's here. if $::hostname == downcase($bootstrap_node) { @@ -37,13 +42,12 @@ class tripleo::profile::base::ironic ( $sync_db = false } - if $step >= 3 and $sync_db { - include ::ironic::db::mysql - } - if $step >= 4 or ($step >= 3 and $sync_db) { class { '::ironic': - sync_db => $sync_db, + sync_db => $sync_db, + rabbit_hosts => $rabbit_hosts, } + + include ::ironic::cors } } diff --git a/manifests/profile/base/ironic/conductor.pp b/manifests/profile/base/ironic/conductor.pp index 2cb61fb..4824648 100644 --- a/manifests/profile/base/ironic/conductor.pp +++ b/manifests/profile/base/ironic/conductor.pp @@ -22,15 +22,27 @@ # (Optional) The current step of the deployment # Defaults to hiera('step') # +# [*manage_pxe*] +# (Optional) Whether to manage the PXE/iPXE environment for the conductor. +# Defaults to true +# class tripleo::profile::base::ironic::conductor ( $step = hiera('step'), + $manage_pxe = true, ) { include ::tripleo::profile::base::ironic if $step >= 4 { - include ::ironic::drivers::deploy - include ::ironic::drivers::ipmi - include ::ironic::drivers::pxe include ::ironic::conductor + include ::ironic::drivers::pxe + if $manage_pxe { + include ::ironic::pxe + } + + # Configure a few popular drivers + include ::ironic::drivers::drac + include ::ironic::drivers::ilo + include ::ironic::drivers::ipmi + include ::ironic::drivers::ssh } } diff --git a/manifests/profile/base/keystone.pp b/manifests/profile/base/keystone.pp index d8c8e24..d515f8f 100644 --- a/manifests/profile/base/keystone.pp +++ b/manifests/profile/base/keystone.pp @@ -31,10 +31,15 @@ # for more details. # Defaults to hiera('step') # +# [*rabbit_hosts*] +# list of the rabbbit host IPs +# Defaults to hiera('rabbitmq_node_ips') + class tripleo::profile::base::keystone ( $bootstrap_node = hiera('bootstrap_nodeid', undef), $manage_db_purge = hiera('keystone_enable_db_purge', true), $step = hiera('step'), + $rabbit_hosts = hiera('rabbitmq_node_ips', undef), ) { if $::hostname == downcase($bootstrap_node) { $sync_db = true @@ -46,18 +51,16 @@ class tripleo::profile::base::keystone ( $manage_endpoint = false } - if $step >= 3 and $sync_db { - include ::keystone::db::mysql - } - if $step >= 4 or ( $step >= 3 and $sync_db ) { class { '::keystone': sync_db => $sync_db, enable_bootstrap => $sync_db, + rabbit_hosts => $rabbit_hosts, } include ::keystone::config include ::keystone::wsgi::apache + include ::keystone::cors if $manage_roles { include ::keystone::roles::admin @@ -72,5 +75,56 @@ class tripleo::profile::base::keystone ( if $step >= 5 and $manage_db_purge { include ::keystone::cron::token_flush } + + if $step >= 5 and $manage_endpoint{ + if hiera('aodh_api_enabled', false) { + include ::aodh::keystone::auth + } + if hiera('ceilometer_api_enabled', false) { + include ::ceilometer::keystone::auth + } + if hiera('ceph_rgw_enabled', false) { + include ::ceph::rgw::keystone::auth + } + if hiera('cinder_api_enabled', false) { + include ::cinder::keystone::auth + } + if hiera('glance_api_enabled', false) { + include ::glance::keystone::auth + } + if hiera('gnocchi_api_enabled', false) { + include ::gnocchi::keystone::auth + } + if hiera('heat_api_enabled', false) { + include ::heat::keystone::auth + } + if hiera('heat_api_cfn_enabled', false) { + include ::heat::keystone::auth_cfn + } + if hiera('ironic_api_enabled', false) { + include ::ironic::keystone::auth + } + if hiera('manila_api_enabled', false) { + include ::manila::keystone::auth + } + if hiera('mistral_api_enabled', false) { + include ::mistral::keystone::auth + } + if hiera('neutron_api_enabled', false) { + include ::neutron::keystone::auth + } + if hiera('nova_api_enabled', false) { + include ::nova::keystone::auth + } + if hiera('sahara_api_enabled', false) { + include ::sahara::keystone::auth + } + if hiera('swift_proxy_enabled', false) { + include ::swift::keystone::auth + } + if hiera('trove_api_enabled', false) { + include ::trove::keystone::auth + } + } } diff --git a/manifests/profile/base/logging/fluentd.pp b/manifests/profile/base/logging/fluentd.pp new file mode 100644 index 0000000..3ed7d88 --- /dev/null +++ b/manifests/profile/base/logging/fluentd.pp @@ -0,0 +1,180 @@ +# Copyright 2016 Red Hat, Inc. +# +# Licensed under the Apache License, Version 2.0 (the "License"); you may +# not use this file except in compliance with the License. You may obtain +# a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT +# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the +# License for the specific language governing permissions and limitations +# under the License. +# +# == Class: tripleo::profile::base::logging::fluentd +# +# FluentD configuration for TripleO +# +# === Parameters +# +# [*step*] +# (Optional) String. The current step of the deployment +# Defaults to hiera('step') +# +# [*fluentd_sources*] +# (Optional) List of dictionaries. A list of sources for fluentd. +# +# [*fluentd_filters*] +# (Optional) List of dictionaries. A list of filters for fluentd. +# +# [*fluentd_servers*] +# (Optional) List of dictionaries. A list of destination hosts for +# fluentd. Each should be of the form {host=>'my.host.name', +# 'port'=>24224} +# +# [*fluentd_groups*] +# (Optional) List of strings. Add the 'fluentd' user to these groups. +# +# [*fluentd_pos_file_path*] +# (Optional) String. Path to a directory that will be created +# if it does not exist and made writable by the fluentd user. +# +# [*fluentd_use_ssl*] +# (Optional) Boolean. If true, use the secure_forward plugin. +# +# [*fluentd_ssl_certificate*] +# (Required if fluentd_use_ssl is true) PEM encoded certificate data from +# for example "secure-forward-ca-generate". +# +# [*fluentd_shared_key*] +# (Required if fluentd_use_ssl is true) Shared secret key for fluentd +# secure-foward plugin. +# +# [*fluentd_listen_syslog*] +# (Optional, default true) When true, fluentd will listen for syslog +# messages on a local UDP port. +# +# [*fluentd_syslog_port*] +# (Optional, default 42185) Port on which fluentd should listen if +# $fluentd_listen_syslog is true. +class tripleo::profile::base::logging::fluentd ( + $step = hiera('step', undef), + $fluentd_sources = undef, + $fluentd_filters = undef, + $fluentd_servers = undef, + $fluentd_groups = undef, + $fluentd_pos_file_path = undef, + $fluentd_use_ssl = undef, + $fluentd_ssl_certificate = undef, + $fluentd_shared_key = undef, + $fluentd_listen_syslog = true, + $fluentd_syslog_port = 42185 +) { + if $step == undef or $step >= 3 { + include ::fluentd + + if $fluentd_groups { + user { $::fluentd::config_owner: + ensure => present, + groups => $fluentd_groups, + membership => 'minimum', + } + } + + if $fluentd_pos_file_path { + file { $fluentd_pos_file_path: + ensure => 'directory', + owner => $::fluentd::config_owner, + group => $::fluentd::config_group, + mode => '0750', + } + } + + ::fluentd::plugin { 'rubygem-fluent-plugin-add': + plugin_provider => 'yum', + } + + if $fluentd_sources { + ::fluentd::config { '100-openstack-sources.conf': + config => { + 'source' => $fluentd_sources, + } + } + } + + if $fluentd_listen_syslog { + # fluentd will receive syslog messages by listening on a local udp + # socket. + ::fluentd::config { '110-system-sources.conf': + config => { + 'source' => { + 'type' => 'syslog', + 'tag' => 'system.messages', + 'port' => $fluentd_syslog_port, + } + } + } + + file { '/etc/rsyslog.d/fluentd.conf': + content => "*.* @127.0.0.1:${fluentd_syslog_port}", + owner => 'root', + group => 'root', + mode => '0644', + } ~> exec { 'reload rsyslog': + command => '/bin/systemctl restart rsyslog', + } + } + + if $fluentd_filters { + ::fluentd::config { '200-openstack-filters.conf': + config => { + 'filter' => $fluentd_filters, + } + } + } + + if $fluentd_servers and !empty($fluentd_servers) { + if $fluentd_use_ssl { + ::fluentd::plugin { 'rubygem-fluent-plugin-secure-forward': + plugin_provider => 'yum', + } + + file {'/etc/fluentd/ca_cert.pem': + content => $fluentd_ssl_certificate, + owner => $::fluentd::config_owner, + group => $::fluentd::config_group, + mode => '0444', + } + + ::fluentd::config { '300-openstack-matches.conf': + config => { + 'match' => { + # lint:ignore:single_quote_string_with_variables + # lint:ignore:quoted_booleans + 'type' => 'secure_forward', + 'tag_pattern' => '**', + 'self_hostname' => '${hostname}', + 'secure' => 'true', + 'ca_cert_path' => '/etc/fluentd/ca_cert.pem', + 'shared_key' => $fluentd_shared_key, + 'server' => $fluentd_servers, + # lint:endignore + # lint:endignore + } + } + } + } else { + ::fluentd::config { '300-openstack-matches.conf': + config => { + 'match' => { + 'type' => 'forward', + 'tag_pattern' => '**', + 'server' => $fluentd_servers, + } + } + } + } + } + } +} diff --git a/manifests/profile/base/manila.pp b/manifests/profile/base/manila.pp new file mode 100644 index 0000000..5210284 --- /dev/null +++ b/manifests/profile/base/manila.pp @@ -0,0 +1,50 @@ +# Copyright 2016 Red Hat, Inc. +# +# Licensed under the Apache License, Version 2.0 (the "License"); you may +# not use this file except in compliance with the License. You may obtain +# a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT +# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the +# License for the specific language governing permissions and limitations +# under the License. +# +# == Class: tripleo::profile::base::manila +# +# Manila common profile for tripleo +# +# === Parameters +# +# [*bootstrap_node*] +# (Optional) The hostname of the node responsible for bootstrapping tasks +# Defaults to hiera('bootstrap_nodeid') +# +# [*step*] +# (Optional) The current step of the deployment +# Defaults to hiera('step') +# +# [*rabbit_hosts*] +# list of the rabbbit host IPs +# Defaults to hiera('rabbitmq_node_ips') + +class tripleo::profile::base::manila ( + $bootstrap_node = hiera('bootstrap_nodeid', undef), + $step = hiera('step'), + $rabbit_hosts = hiera('rabbitmq_node_ips', undef), +) { + if $::hostname == downcase($bootstrap_node) { + $sync_db = true + } else { + $sync_db = false + } + + if $step >= 4 or ($step >= 3 and $sync_db) { + class { '::manila' : + rabbit_hosts => $rabbit_hosts, + } + include ::manila::config + } +} diff --git a/manifests/profile/base/manila/api.pp b/manifests/profile/base/manila/api.pp index 9a3a314..1f78ab3 100644 --- a/manifests/profile/base/manila/api.pp +++ b/manifests/profile/base/manila/api.pp @@ -18,17 +18,28 @@ # # === Parameters # +# [*bootstrap_node*] +# (Optional) The hostname of the node responsible for bootstrapping tasks +# Defaults to hiera('bootstrap_nodeid') +# # [*step*] # (Optional) The current step in deployment. See tripleo-heat-templates # for more details. # Defaults to hiera('step') -# + class tripleo::profile::base::manila::api ( - $step = hiera('step'), + $bootstrap_node = hiera('bootstrap_nodeid', undef), + $step = hiera('step'), ) { - if $step >= 4 { - include ::manila + if $::hostname == downcase($bootstrap_node) { + $sync_db = true + } else { + $sync_db = false + } + + include ::tripleo::profile::base::manila + + if $step >= 4 or ($step >= 3 and $sync_db) { include ::manila::api } } - diff --git a/manifests/profile/base/manila/scheduler.pp b/manifests/profile/base/manila/scheduler.pp index 8581187..07ea676 100644 --- a/manifests/profile/base/manila/scheduler.pp +++ b/manifests/profile/base/manila/scheduler.pp @@ -18,34 +18,19 @@ # # === Parameters # -# [*bootstrap_node*] -# (Optional) The hostname of the node responsible for bootstrapping tasks -# Defaults to hiera('bootstrap_nodeid') -# # [*step*] # (Optional) The current step in deployment. See tripleo-heat-templates # for more details. # Defaults to hiera('step') # class tripleo::profile::base::manila::scheduler ( - $bootstrap_node = hiera('bootstrap_nodeid', undef), - $step = hiera('step'), + $step = hiera('step'), ) { - if $::hostname == downcase($bootstrap_node) { - $sync_db = true - } else { - $sync_db = false - } - - if $step >= 3 and $sync_db { - include ::manila::db::mysql - } + include ::tripleo::profile::base::manila if $step >= 4 { include ::manila::compute::nova include ::manila::network::neutron include ::manila::scheduler } - } - diff --git a/manifests/profile/base/manila/share.pp b/manifests/profile/base/manila/share.pp index ed64b29..d39c55c 100644 --- a/manifests/profile/base/manila/share.pp +++ b/manifests/profile/base/manila/share.pp @@ -26,8 +26,9 @@ class tripleo::profile::base::manila::share ( $step = hiera('step'), ) { + include ::tripleo::profile::base::manila + if $step >= 4 { include ::manila::share } } - diff --git a/manifests/profile/base/mistral.pp b/manifests/profile/base/mistral.pp index 0c41193..9986d22 100644 --- a/manifests/profile/base/mistral.pp +++ b/manifests/profile/base/mistral.pp @@ -27,9 +27,14 @@ # for more details. # Defaults to hiera('step') # +# [*rabbit_hosts*] +# list of the rabbbit host IPs +# Defaults to hiera('rabbitmq_node_ips') + class tripleo::profile::base::mistral ( $bootstrap_node = hiera('bootstrap_nodeid', undef), $step = hiera('step'), + $rabbit_hosts = hiera('rabbitmq_node_ips', undef), ) { if $::hostname == downcase($bootstrap_node) { $sync_db = true @@ -37,14 +42,13 @@ class tripleo::profile::base::mistral ( $sync_db = false } - if $step >= 3 and $sync_db { - include ::mistral::db::mysql - } - if $step >= 4 or ($step >= 3 and $sync_db) { - include ::mistral + class { '::mistral': + rabbit_hosts => $rabbit_hosts, + } include ::mistral::config include ::mistral::client include ::mistral::db::sync + include ::mistral::cors } } diff --git a/manifests/profile/base/neutron.pp b/manifests/profile/base/neutron.pp index 7b07b1f..90a5c23 100644 --- a/manifests/profile/base/neutron.pp +++ b/manifests/profile/base/neutron.pp @@ -22,11 +22,18 @@ # (Optional) The current step of the deployment # Defaults to hiera('step') # +# [*rabbit_hosts*] +# list of the rabbbit host IPs +# Defaults to hiera('rabbitmq_node_ips') + class tripleo::profile::base::neutron ( - $step = hiera('step'), + $step = hiera('step'), + $rabbit_hosts = hiera('rabbitmq_node_ips', undef), ) { if $step >= 3 { - include ::neutron + class { '::neutron' : + rabbit_hosts => $rabbit_hosts, + } include ::neutron::config } } diff --git a/manifests/profile/base/neutron/agents/ovn.pp b/manifests/profile/base/neutron/agents/ovn.pp new file mode 100644 index 0000000..443b164 --- /dev/null +++ b/manifests/profile/base/neutron/agents/ovn.pp @@ -0,0 +1,38 @@ +# Copyright 2016 Red Hat, Inc. +# +# Licensed under the Apache License, Version 2.0 (the "License"); you may +# not use this file except in compliance with the License. You may obtain +# a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT +# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the +# License for the specific language governing permissions and limitations +# under the License. +# +# == Class: tripleo::profile::base::neutron::agents::ovn +# +# OVN Neutron agent profile for tripleo +# +# [*ovn_db_host*] +# The IP-Address/Hostname where OVN DBs are deployed +# +# [*step*] +# (Optional) The current step in deployment. See tripleo-heat-templates +# for more details. +# Defaults to hiera('step') +# +class tripleo::profile::base::neutron::agents::ovn ( + $ovn_db_host, + $step = hiera('step') +) { + if $step >= 4 { + $ovn_sbdb_port = hiera('ovn::southbound::port') + class { '::ovn::controller': + ovn_remote => "tcp:${ovn_db_host}:${ovn_sbdb_port}", + ovn_encap_type => hiera('ovn::southboud::encap_type') + } + } +} diff --git a/manifests/profile/base/neutron/midonet.pp b/manifests/profile/base/neutron/midonet.pp index 9104cc3..3ba9dd9 100644 --- a/manifests/profile/base/neutron/midonet.pp +++ b/manifests/profile/base/neutron/midonet.pp @@ -67,8 +67,8 @@ class tripleo::profile::base::neutron::midonet ( $bind_address = hiera('neutron::bind_host', ''), $keystone_admin_token = hiera('keystone::admin_token', ''), $neutron_api_node_ips = hiera('neutron_api_node_ips', ''), - $neutron_auth_password = hiera('neutron::server::password', ''), - $neutron_auth_tenant = hiera('neutron::server::project_name', ''), + $neutron_auth_password = hiera('neutron::keystone::authtoken::password', ''), + $neutron_auth_tenant = hiera('neutron::keystone::authtoken::project_name', ''), $step = hiera('step'), $vip = hiera('public_virtual_ip'), $zk_on_controller = hiera('enable_zookeeper_on_controller', ''), diff --git a/manifests/profile/base/monitoring/fluentd.pp b/manifests/profile/base/neutron/opencontrail/vrouter.pp index 8160452..90ab71c 100644 --- a/manifests/profile/base/monitoring/fluentd.pp +++ b/manifests/profile/base/neutron/opencontrail/vrouter.pp @@ -12,28 +12,29 @@ # License for the specific language governing permissions and limitations # under the License. # -# == Class: tripleo::profile::base::monitoring::fluentd +# == Class: tripleo::profile::base::neutron::opencontrail::vrouter # -# FluentD configuration for TripleO +# Opencontrail profile to run the contrail vrouter # # === Parameters # # [*step*] -# (Optional) String. The current step of the deployment +# (Optional) The current step of the deployment # Defaults to hiera('step') # -class tripleo::profile::base::monitoring::fluentd ( - $step = hiera('step', undef) +class tripleo::profile::base::neutron::opencontrail::vrouter ( + $step = hiera('step'), ) { - if $step == undef or $step >= 3 { - include ::fluentd - ::fluentd::plugin { 'rubygem-fluent-plugin-add': - plugin_provider => 'yum', - } + if $step >= 4 { + + include ::contrail::vrouter + # NOTE: it's not possible to use this class without a functional + # contrail controller up and running + #class {'::contrail::vrouter::provision_vrouter': + # require => Class['contrail::vrouter'], + #} - ::fluentd::plugin { 'rubygem-fluent-plugin-elasticsearch': - plugin_provider => 'yum', - } } + } diff --git a/manifests/profile/base/neutron/opendaylight.pp b/manifests/profile/base/neutron/opendaylight.pp new file mode 100644 index 0000000..ffe28ce --- /dev/null +++ b/manifests/profile/base/neutron/opendaylight.pp @@ -0,0 +1,46 @@ +# Copyright 2016 Red Hat, Inc. +# +# Licensed under the Apache License, Version 2.0 (the "License"); you may +# not use this file except in compliance with the License. You may obtain +# a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT +# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the +# License for the specific language governing permissions and limitations +# under the License. +# +# == Class: tripleo::profile::base::neutron::opendaylight +# +# OpenDaylight Neutron profile for TripleO +# +# === Parameters +# +# [*step*] +# (Optional) The current step of the deployment +# Defaults to hiera('step') +# +# [*primary_controller*] +# (Optional) The hostname of the first controller +# Defaults to hiera('bootstrap_nodeid', undef) +# +class tripleo::profile::base::neutron::opendaylight ( + $step = hiera('step'), + $primary_controller = hiera('bootstrap_nodeid', undef), +) { + + include ::tripleo::profile::base::neutron + + if ! str2bool(hiera('opendaylight::enable_l3')) { + include ::tripleo::profile::base::neutron::l3 + } + + if $step >= 1 { + # Configure ODL only on first controller + if hiera('odl_on_controller') and $primary_controller == downcase($::hostname) { + include ::opendaylight + } + } +} diff --git a/manifests/profile/base/neutron/plugins/ml2.pp b/manifests/profile/base/neutron/plugins/ml2.pp index c89bc02..4f4de0b 100644 --- a/manifests/profile/base/neutron/plugins/ml2.pp +++ b/manifests/profile/base/neutron/plugins/ml2.pp @@ -63,5 +63,13 @@ class tripleo::profile::base::neutron::plugins::ml2 ( if 'bsn_ml2' in $mechanism_drivers { include ::neutron::plugins::ml2::bigswitch::restproxy } + + if 'opendaylight' in $mechanism_drivers { + include ::tripleo::profile::base::neutron::plugins::ml2::opendaylight + } + + if 'ovn' in $mechanism_drivers { + include ::tripleo::profile::base::neutron::plugins::ml2::ovn + } } } diff --git a/manifests/profile/base/neutron/plugins/ml2/opendaylight.pp b/manifests/profile/base/neutron/plugins/ml2/opendaylight.pp new file mode 100644 index 0000000..f25aea6 --- /dev/null +++ b/manifests/profile/base/neutron/plugins/ml2/opendaylight.pp @@ -0,0 +1,54 @@ +# Copyright 2016 Red Hat, Inc. +# +# Licensed under the Apache License, Version 2.0 (the "License"); you may +# not use this file except in compliance with the License. You may obtain +# a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT +# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the +# License for the specific language governing permissions and limitations +# under the License. +# +# == Class: tripleo::profile::base::neutron::plugins::ml2::opendaylight +# +# OpenDaylight ML2 Neutron profile for TripleO +# +# === Parameters +# +# [*odl_port*] +# (Optional) Port to use for OpenDaylight +# Defaults to hiera('opendaylight::odl_rest_port') +# +# [*conn_proto*] +# (Optional) Protocol to use to for ODL REST access +# Defaults to hiera('opendaylight::nb_connection_protocol') +# +# [*step*] +# (Optional) The current step in deployment. See tripleo-heat-templates +# for more details. +# Defaults to hiera('step') +# +class tripleo::profile::base::neutron::plugins::ml2::opendaylight ( + $odl_port = hiera('opendaylight::odl_rest_port'), + $conn_proto = hiera('opendaylight::nb_connection_protocol'), + $step = hiera('step'), +) { + + if $step >= 4 { + # Figure out ODL IP + if hiera('odl_on_controller') { + $odl_url_ip = hiera('opendaylight_api_vip') + } else { + $odl_url_ip = hiera('opendaylight::odl_bind_ip') + } + + if ! $odl_url_ip { fail('OpenDaylight Controller IP/VIP is Empty') } + + class { '::neutron::plugins::ml2::opendaylight': + odl_url => "${conn_proto}://${odl_url_ip}:${odl_port}/controller/nb/v2/neutron"; + } + } +} diff --git a/manifests/profile/base/neutron/plugins/ml2/ovn.pp b/manifests/profile/base/neutron/plugins/ml2/ovn.pp new file mode 100644 index 0000000..46477a7 --- /dev/null +++ b/manifests/profile/base/neutron/plugins/ml2/ovn.pp @@ -0,0 +1,46 @@ +# Copyright 2016 Red Hat, Inc. +# +# Licensed under the Apache License, Version 2.0 (the "License"); you may +# not use this file except in compliance with the License. You may obtain +# a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT +# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the +# License for the specific language governing permissions and limitations +# under the License. +# +# == Class: tripleo::profile::base::neutron::plugins::ml2::ovn +# +# OVN Neutron ML2 profile for tripleo +# +# [*ovn_db_host*] +# The IP-Address/Hostname where OVN DBs are deployed +# +# [*step*] +# (Optional) The current step in deployment. See tripleo-heat-templates +# for more details. +# Defaults to hiera('step') +# +class tripleo::profile::base::neutron::plugins::ml2::ovn ( + $ovn_db_host, + $step = hiera('step') +) { + if $step >= 4 { + if $::hostname == $ovn_db_host { + # NOTE: we might split northd from plugin later, in the case of + # micro-services, where neutron-server & northd are not in the same + # containers + include ::ovn::northd + } + $ovn_nb_port = hiera('ovn::northbound::port') + $ovn_sb_port = hiera('ovn::southbound::port') + class { '::neutron::plugins::ml2::ovn': + ovn_nb_connection => "tcp:${ovn_db_host}:${ovn_nb_port}", + ovn_sb_connection => "tcp:${ovn_db_host}:${ovn_sb_port}", + } + } +} + diff --git a/manifests/profile/base/neutron/plugins/ovs/opendaylight.pp b/manifests/profile/base/neutron/plugins/ovs/opendaylight.pp new file mode 100644 index 0000000..7548046 --- /dev/null +++ b/manifests/profile/base/neutron/plugins/ovs/opendaylight.pp @@ -0,0 +1,73 @@ +# Copyright 2016 Red Hat, Inc. +# +# Licensed under the Apache License, Version 2.0 (the "License"); you may +# not use this file except in compliance with the License. You may obtain +# a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT +# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the +# License for the specific language governing permissions and limitations +# under the License. +# +# == Class: tripleo::profile::base::neutron::plugins::ovs::opendaylight +# +# OpenDaylight Neutron OVS profile for TripleO +# +# === Parameters +# +# [*odl_port*] +# (Optional) Port to use for OpenDaylight +# Defaults to hiera('opendaylight::odl_rest_port') +# +# [*odl_check_url*] +# (Optional) URL path used to check if ODL is up +# Defaults to hiera('opendaylight_check_url') +# +# [*odl_api_ips*] +# (Optional) List of OpenStack Controller IPs for ODL API +# Defaults to hiera('opendaylight_api_node_ips') +# +# [*conn_proto*] +# (Optional) Protocol to use to for ODL REST access +# Defaults to hiera('opendaylight::nb_connection_protocol') +# +# [*step*] +# (Optional) The current step in deployment. See tripleo-heat-templates +# for more details. +# Defaults to hiera('step') +# +class tripleo::profile::base::neutron::plugins::ovs::opendaylight ( + $odl_port = hiera('opendaylight::odl_rest_port'), + $odl_check_url = hiera('opendaylight_check_url'), + $odl_api_ips = hiera('opendaylight_api_node_ips'), + $conn_proto = hiera('opendaylight::nb_connection_protocol'), + $step = hiera('step'), +) { + + if $step >= 4 { + # Figure out ODL IP (and VIP if on controller) + if hiera('odl_on_controller') { + $opendaylight_controller_ip = $odl_api_ips[0] + $odl_url_ip = hiera('opendaylight_api_vip') + } else { + $opendaylight_controller_ip = hiera('opendaylight::odl_bind_ip') + $odl_url_ip = $opendaylight_controller_ip + } + + if ! $opendaylight_controller_ip { fail('OpenDaylight Controller IP is Empty') } + + if ! $odl_url_ip { fail('OpenDaylight API VIP is Empty') } + + # Build URL to check if ODL is up before connecting OVS + $opendaylight_url = "${conn_proto}://${odl_url_ip}:${odl_port}/${odl_check_url}" + + class { '::neutron::plugins::ovs::opendaylight': + tunnel_ip => hiera('neutron::agents::ml2::ovs::local_ip'), + odl_check_url => $opendaylight_url, + odl_ovsdb_iface => "tcp:${opendaylight_controller_ip}:6640", + } + } +} diff --git a/manifests/profile/base/neutron/plumgrid.pp b/manifests/profile/base/neutron/plumgrid.pp new file mode 100644 index 0000000..03dc101 --- /dev/null +++ b/manifests/profile/base/neutron/plumgrid.pp @@ -0,0 +1,45 @@ +# Copyright 2016 Red Hat, Inc. +# +# Licensed under the Apache License, Version 2.0 (the "License"); you may +# not use this file except in compliance with the License. You may obtain +# a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT +# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the +# License for the specific language governing permissions and limitations +# under the License. +# +# == Class: tripleo::profile::base::neutron::plumgrid +# +# Plumgrid Neutron helper profile (extra settings for compute, etc. roles) +# +# === Parameters +# [*step*] +# (Optional) The current step of the deployment +# Defaults to hiera('step') +# +class tripleo::profile::base::neutron::plumgrid ( + $step = hiera('step'), +) { + + if $step >= 4 { + + # forward all ipv4 traffic + # this is required for the vms to pass through the gateways public interface + sysctl::value { 'net.ipv4.ip_forward': value => '1' } + + # ifc_ctl_pp needs to be invoked by root as part of the vif.py when a VM is powered on + file { '/etc/sudoers.d/ifc_ctl_sudoers': + ensure => file, + owner => root, + group => root, + mode => '0440', + content => "nova ALL=(root) NOPASSWD: /opt/pg/bin/ifc_ctl_pp *\n", + } + + } + +} diff --git a/manifests/profile/base/neutron/server.pp b/manifests/profile/base/neutron/server.pp index 5a1b377..82c2d5f 100644 --- a/manifests/profile/base/neutron/server.pp +++ b/manifests/profile/base/neutron/server.pp @@ -39,10 +39,6 @@ class tripleo::profile::base::neutron::server ( include ::tripleo::profile::base::neutron - if $step >= 3 and $sync_db { - include ::neutron::db::mysql - } - # We start neutron-server on the bootstrap node first, because # it will try to populate tables and we need to make sure this happens # before it starts on other nodes diff --git a/manifests/profile/base/neutron/sriov.pp b/manifests/profile/base/neutron/sriov.pp new file mode 100644 index 0000000..00ecc21 --- /dev/null +++ b/manifests/profile/base/neutron/sriov.pp @@ -0,0 +1,43 @@ +# Copyright 2016 Red Hat, Inc. +# +# Licensed under the Apache License, Version 2.0 (the "License"); you may +# not use this file except in compliance with the License. You may obtain +# a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT +# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the +# License for the specific language governing permissions and limitations +# under the License. +# +# == Class: tripleo::profile::base::neutron::sriov +# +# Neutron SR-IOV nic Agent profile for tripleo +# +# === Parameters +# +# [*step*] +# (Optional) The current step in deployment. See tripleo-heat-templates +# for more details. +# Defaults to hiera('step') +# +# [*mechanism_drivers*] +# (Optional) The mechanism drivers to use with the Ml2 plugin +# Defaults to hiera('neutron::plugins::ml2::mechanism_drivers') +# + +class tripleo::profile::base::neutron::sriov( + $step = hiera('step'), + $mechanism_drivers = hiera('neutron::plugins::ml2::mechanism_drivers'), +) { + + if $step >= 4 { + if 'sriovnicswitch' in $mechanism_drivers { + include ::neutron::agents::ml2::sriov + include ::tripleo::host::sriov + } + } + +} diff --git a/manifests/profile/base/nova.pp b/manifests/profile/base/nova.pp index b43b8e8..74f0460 100644 --- a/manifests/profile/base/nova.pp +++ b/manifests/profile/base/nova.pp @@ -38,12 +38,17 @@ # (Optional) The current step of the deployment # Defaults to hiera('step') # +# [*rabbit_hosts*] +# list of the rabbbit host IPs +# Defaults to hiera('rabbitmq_node_ips') + class tripleo::profile::base::nova ( $bootstrap_node = hiera('bootstrap_nodeid', undef), $libvirt_enabled = false, $manage_migration = false, $nova_compute_enabled = false, $step = hiera('step'), + $rabbit_hosts = hiera('rabbitmq_node_ips', undef), ) { if $::hostname == downcase($bootstrap_node) { $sync_db = true @@ -58,7 +63,9 @@ class tripleo::profile::base::nova ( } if hiera('step') >= 4 or (hiera('step') >= 3 and $sync_db) { - include ::nova + class { '::nova' : + rabbit_hosts => $rabbit_hosts, + } include ::nova::config class { '::nova::cache': enabled => true, diff --git a/manifests/profile/base/nova/api.pp b/manifests/profile/base/nova/api.pp index 285e0b7..3c472c5 100644 --- a/manifests/profile/base/nova/api.pp +++ b/manifests/profile/base/nova/api.pp @@ -37,11 +37,6 @@ class tripleo::profile::base::nova::api ( include ::tripleo::profile::base::nova - if $step >= 3 and $sync_db { - include ::nova::db::mysql - include ::nova::db::mysql_api - } - if $step >= 4 or ($step >= 3 and $sync_db) { class { '::nova::api': sync_db => $sync_db, diff --git a/manifests/profile/base/pacemaker.pp b/manifests/profile/base/pacemaker.pp index 2c70eab..0d628b5 100644 --- a/manifests/profile/base/pacemaker.pp +++ b/manifests/profile/base/pacemaker.pp @@ -75,6 +75,10 @@ class tripleo::profile::base::pacemaker ( Pacemaker::Resource::Service { op_params => 'start timeout=200s stop timeout=200s', } + + file { '/var/lib/tripleo/pacemaker-restarts': + ensure => directory, + } ~> Tripleo::Pacemaker::Resource_restart_flag<||> } if $step >= 2 { diff --git a/manifests/profile/base/sahara.pp b/manifests/profile/base/sahara.pp index 96d23a6..cf0ee90 100644 --- a/manifests/profile/base/sahara.pp +++ b/manifests/profile/base/sahara.pp @@ -26,9 +26,14 @@ # (Optional) The current step of the deployment # Defaults to hiera('step') # +# [*rabbit_hosts*] +# list of the rabbbit host IPs +# Defaults to hiera('rabbitmq_node_ips') + class tripleo::profile::base::sahara ( $bootstrap_node = hiera('bootstrap_nodeid', undef), $step = hiera('step'), + $rabbit_hosts = hiera('rabbitmq_node_ips', undef), ) { if $::hostname == downcase($bootstrap_node) { $sync_db = true @@ -38,7 +43,8 @@ class tripleo::profile::base::sahara ( if $step >= 4 or ($step >= 3 and $sync_db){ class { '::sahara': - sync_db => $sync_db, + sync_db => $sync_db, + rabbit_hosts => $rabbit_hosts, } } } diff --git a/manifests/profile/base/sahara/engine.pp b/manifests/profile/base/sahara/engine.pp index 4dbaa85..e2da0e7 100644 --- a/manifests/profile/base/sahara/engine.pp +++ b/manifests/profile/base/sahara/engine.pp @@ -39,10 +39,6 @@ class tripleo::profile::base::sahara::engine ( include ::tripleo::profile::base::sahara - if $step >= 3 and $sync_db { - include ::sahara::db::mysql - } - if $step >= 4 or ($step >= 3 and $sync_db) { include ::sahara::service::engine } diff --git a/manifests/profile/base/snmp.pp b/manifests/profile/base/snmp.pp index 2ed6752..301ac9a 100644 --- a/manifests/profile/base/snmp.pp +++ b/manifests/profile/base/snmp.pp @@ -43,7 +43,16 @@ class tripleo::profile::base::snmp ( } class { '::snmp': agentaddress => ['udp:161','udp6:[::1]:161'], - snmpd_config => [ join(['createUser ', $snmpd_user, ' MD5 "', $snmpd_password, '"']), join(['rouser ', $snmpd_user]), 'proc cron', 'includeAllDisks 10%', 'master agentx', 'trapsink localhost public', 'iquerySecName internalUser', 'rouser internalUser', 'defaultMonitors yes', 'linkUpDownNotifications yes' ], + snmpd_config => [ join(['createUser ', $snmpd_user, ' MD5 "', $snmpd_password, '"']), + join(['rouser ', $snmpd_user]), + 'proc cron', + 'includeAllDisks 10%', + 'master agentx', + 'trapsink localhost public', + 'iquerySecName internalUser', + 'rouser internalUser', + 'defaultMonitors yes', + 'linkUpDownNotifications yes' ], } } } diff --git a/manifests/profile/base/swift/add_devices.pp b/manifests/profile/base/swift/add_devices.pp index bd4c91c..909ddd6 100644 --- a/manifests/profile/base/swift/add_devices.pp +++ b/manifests/profile/base/swift/add_devices.pp @@ -39,7 +39,10 @@ define tripleo::profile::base::swift::add_devices( $zone = (($server_num%$swift_zones) + 1) # add the rings - $base = regsubst($name,'^r1.*-(.*)$','\1') + $base_notnormal = regsubst($name,'^r1.*-(.*)$','\1') + $ip_notnormal = regsubst($base_notnormal, ':%PORT%.*', '') + $ip = normalize_ip_for_uri($ip_notnormal) + $base = regsubst($base_notnormal, $ip_notnormal, $ip) $object = regsubst($base, '%PORT%', '6000') ring_object_device { $object: zone => '1', diff --git a/manifests/profile/base/swift/proxy.pp b/manifests/profile/base/swift/proxy.pp index 1e763a1..9d50462 100644 --- a/manifests/profile/base/swift/proxy.pp +++ b/manifests/profile/base/swift/proxy.pp @@ -23,14 +23,27 @@ # for more details. # Defaults to hiera('step') # +# [*memcache_servers*] +# (Optional) List of memcache servers +# Defaults to hiera('memcached_node_ips') +# +# [*memcache_port*] +# (Optional) memcache port +# Defaults to 11211 +# class tripleo::profile::base::swift::proxy ( $step = hiera('step'), + $memcache_servers = hiera('memcached_node_ips'), + $memcache_port = 11211, ) { if $step >= 4 { + $swift_memcache_servers = suffix(any2array(normalize_ip_for_uri($memcache_servers)), ":${memcache_port}") include ::swift::proxy include ::swift::proxy::proxy_logging include ::swift::proxy::healthcheck - include ::swift::proxy::cache + class { '::swift::proxy::cache': + memcache_servers => $swift_memcache_servers + } include ::swift::proxy::keystone include ::swift::proxy::authtoken include ::swift::proxy::staticweb diff --git a/manifests/profile/base/swift/ringbuilder.pp b/manifests/profile/base/swift/ringbuilder.pp index e0f67cd..c77d744 100644 --- a/manifests/profile/base/swift/ringbuilder.pp +++ b/manifests/profile/base/swift/ringbuilder.pp @@ -26,7 +26,8 @@ # Defaults to true # # [*devices*] -# (Optional) The swift devices +# (Optional) DEPRECATED The swift devices +# Should pass raw_disk_prefix, raw_disks and swift_storage_node_ips instead # Defaults to '' # # [*step*] @@ -38,12 +39,30 @@ # (Optional) The swift zones # Defaults to 1 # +# [*raw_disk_prefix*] +# (Optional) Disk prefix used to create devices list +# Defaults to 'r1z1-' +# +# [*raw_disks*] +# (Optional) list of raw disks in format +# [':%PORT%/device1', ':%PORT%/device2'] +# Combined with raw_disk_prefix and swift_storage_node_ips +# to create devices list +# Defaults to an empty list +# +# [*swift_storage_node_ips*] +# (Optional) list of ip addresses for nodes running swift_storage service +# Defaults to hiera('swift_storage_node_ips') or an empty list +# class tripleo::profile::base::swift::ringbuilder ( $replicas, $build_ring = true, - $devices = '', + $devices = undef, $step = hiera('step'), $swift_zones = '1', + $raw_disk_prefix = 'r1z1-', + $raw_disks = [], + $swift_storage_node_ips = hiera('swift_storage_node_ips', []), ) { if $step >= 2 { # pre-install swift here so we can build rings @@ -54,8 +73,11 @@ class tripleo::profile::base::swift::ringbuilder ( validate_bool($build_ring) if $build_ring { - - $device_array = strip(split(rstrip($devices), ',')) + if $devices { + $device_array = strip(split(rstrip($devices), ',')) + } else { + $device_array = tripleo_swift_devices($raw_disk_prefix, $swift_storage_node_ips, $raw_disks) + } # create local rings swift::ringbuilder::create{ ['object', 'account', 'container']: @@ -69,7 +91,7 @@ class tripleo::profile::base::swift::ringbuilder ( # rebalance swift::ringbuilder::rebalance{ ['object', 'account', 'container']: - seed => 999, + seed => '999', } Ring_object_device<| |> ~> Exec['rebalance_object'] diff --git a/manifests/profile/base/swift/storage.pp b/manifests/profile/base/swift/storage.pp index 0b09ea6..d1660de 100644 --- a/manifests/profile/base/swift/storage.pp +++ b/manifests/profile/base/swift/storage.pp @@ -41,7 +41,7 @@ class tripleo::profile::base::swift::storage ( ensure => directory, owner => 'swift', group => 'swift', - require => Package['openstack-swift'], + require => Package['swift'], } } $swift_components = ['account', 'container', 'object'] diff --git a/manifests/profile/base/trove/api.pp b/manifests/profile/base/trove/api.pp index 7a78171..bc16e6e 100644 --- a/manifests/profile/base/trove/api.pp +++ b/manifests/profile/base/trove/api.pp @@ -37,10 +37,6 @@ class tripleo::profile::base::trove::api ( $sync_db = false } - if $step >= 3 and $sync_db { - include ::trove::db::mysql - } - if $step >= 4 or ($step >= 3 and $sync_db) { include ::trove include ::trove::config diff --git a/manifests/profile/base/ui.pp b/manifests/profile/base/ui.pp new file mode 100644 index 0000000..681496a --- /dev/null +++ b/manifests/profile/base/ui.pp @@ -0,0 +1,26 @@ +# Copyright 2016 Red Hat, Inc. +# +# Licensed under the Apache License, Version 2.0 (the "License"); you may +# not use this file except in compliance with the License. You may obtain +# a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT +# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the +# License for the specific language governing permissions and limitations +# under the License. +# +# == Class: tripleo::profile::base::ui +# +# UI profile for tripleo +# +class tripleo::profile::base::ui () { + package {'openstack-tripleo-ui': } + + include ::apache + + include ::tripleo::ui +} + diff --git a/manifests/profile/base/validations.pp b/manifests/profile/base/validations.pp new file mode 100644 index 0000000..50a1a8a --- /dev/null +++ b/manifests/profile/base/validations.pp @@ -0,0 +1,29 @@ +# Copyright 2016 Red Hat, Inc. +# +# Licensed under the Apache License, Version 2.0 (the "License"); you may +# not use this file except in compliance with the License. You may obtain +# a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT +# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the +# License for the specific language governing permissions and limitations +# under the License. +# +# == Class: tripleo::profile::base::validations +# +# Validations profile for tripleo +# +class tripleo::profile::base::validations { + package {'openstack-tripleo-validations': } + user {'validations': + ensure => present, + comment => 'TripleO validations', + managehome => true, + home => '/home/validations', + shell => '/sbin/nologin', + } +} + diff --git a/manifests/profile/pacemaker/cinder/backup.pp b/manifests/profile/pacemaker/cinder/backup.pp index 20a0104..72ec456 100644 --- a/manifests/profile/pacemaker/cinder/backup.pp +++ b/manifests/profile/pacemaker/cinder/backup.pp @@ -47,6 +47,12 @@ class tripleo::profile::pacemaker::cinder::backup ( include ::tripleo::profile::base::cinder::backup + if $step >= 3 and $pacemaker_master and hiera('stack_action') == 'UPDATE' { + Cinder_config<||> + ~> + tripleo::pacemaker::resource_restart_flag { "${::cinder::params::backup_service}": } + } + if $step >= 5 and $pacemaker_master { pacemaker::resource::service { $::cinder::params::backup_service : } } diff --git a/manifests/profile/pacemaker/cinder/volume.pp b/manifests/profile/pacemaker/cinder/volume.pp index 5a581eb..82e2522 100644 --- a/manifests/profile/pacemaker/cinder/volume.pp +++ b/manifests/profile/pacemaker/cinder/volume.pp @@ -46,6 +46,12 @@ class tripleo::profile::pacemaker::cinder::volume ( include ::tripleo::profile::base::cinder::volume + if $step >= 3 and $pacemaker_master and hiera('stack_action') == 'UPDATE' { + Cinder_api_paste_ini<||> ~> Tripleo::Pacemaker::Resource_restart_flag["${::cinder::params::volume_service}"] + Cinder_config<||> ~> Tripleo::Pacemaker::Resource_restart_flag["${::cinder::params::volume_service}"] + tripleo::pacemaker::resource_restart_flag { "${::cinder::params::volume_service}": } + } + if $step >= 5 and $pacemaker_master { pacemaker::resource::service { $::cinder::params::volume_service : } } diff --git a/manifests/profile/pacemaker/database/mysql.pp b/manifests/profile/pacemaker/database/mysql.pp index 31d7d80..0169e16 100644 --- a/manifests/profile/pacemaker/database/mysql.pp +++ b/manifests/profile/pacemaker/database/mysql.pp @@ -18,22 +18,41 @@ # # === Parameters # +# [*bind_address*] +# (Optional) The address that the local mysql instance should bind to. +# Defaults to $::hostname +# +# [*gmcast_listen_addr*] +# (Optional) This variable defines the address on which the node listens to +# connections from other nodes in the cluster. +# Defaults to hiera('mysql_bind_host') +# # [*step*] # (Optional) The current step in deployment. See tripleo-heat-templates # for more details. # Defaults to hiera('step') # class tripleo::profile::pacemaker::database::mysql ( - $step = hiera('step'), + $bind_address = $::hostname, + $gmcast_listen_addr = hiera('mysql_bind_host'), + $step = hiera('step'), ) { if $::hostname == downcase(hiera('bootstrap_nodeid')) { $pacemaker_master = true } else { $pacemaker_master = false } - $mysql_bind_host = hiera('mysql_bind_host') - $galera_nodes = downcase(hiera('galera_node_names', $::hostname)) + + # use only mysql_node_names when we land a patch in t-h-t that + # switches to autogenerating these values from composable services + $galera_node_names_lookup = hiera('mysql_node_names', hiera('galera_node_names', $::hostname)) + if is_array($galera_node_names_lookup) { + $galera_nodes = downcase(join($galera_node_names_lookup, ',')) + } else { + $galera_nodes = downcase($galera_node_names_lookup) + } $galera_nodes_count = count(split($galera_nodes, ',')) + $mysqld_options = { 'mysqld' => { 'skip-name-resolve' => '1', @@ -43,7 +62,7 @@ class tripleo::profile::pacemaker::database::mysql ( 'innodb_locks_unsafe_for_binlog'=> '1', 'query_cache_size' => '0', 'query_cache_type' => '0', - 'bind-address' => $::hostname, + 'bind-address' => $bind_address, 'max_connections' => hiera('mysql_max_connections'), 'open_files_limit' => '-1', 'wsrep_on' => 'ON', @@ -61,7 +80,7 @@ class tripleo::profile::pacemaker::database::mysql ( 'wsrep_drupal_282555_workaround'=> '0', 'wsrep_causal_reads' => '0', 'wsrep_sst_method' => 'rsync', - 'wsrep_provider_options' => "gmcast.listen_addr=tcp://[${mysql_bind_host}]:4567;", + 'wsrep_provider_options' => "gmcast.listen_addr=tcp://${gmcast_listen_addr}:4567;", } } @@ -71,6 +90,12 @@ class tripleo::profile::pacemaker::database::mysql ( mysql_server_options => $mysqld_options, } + if $step >= 1 and $pacemaker_master and hiera('stack_action') == 'UPDATE' { + tripleo::pacemaker::resource_restart_flag { 'galera-master': + subscribe => File['mysql-config-file'], + } + } + if $step >= 2 { if $pacemaker_master { pacemaker::resource::ocf { 'galera' : @@ -105,6 +130,11 @@ class tripleo::profile::pacemaker::database::mysql ( table => '*.*', user => 'clustercheck@localhost', } + + # We create databases for services at step 2 as well. This ensures + # Galara is up before those get created + Exec['galera-ready'] -> Mysql_database<||> + } # This step is to create a sysconfig clustercheck file with the root user and empty password # on the first install only (because later on the clustercheck db user will be used) @@ -150,8 +180,12 @@ MYSQL_HOST=localhost\n", # with proper credentials. This step happens on every node because this sql # statement does not automatically replicate across nodes. $mysql_root_password = hiera('mysql::server::root_password') + $galera_set_pwd = "/bin/touch /root/.my.cnf && \ + /bin/echo \"UPDATE mysql.user SET Password = PASSWORD('${mysql_root_password}') WHERE user = 'root'; \ + flush privileges;\" | \ + /bin/mysql --defaults-extra-file=/root/.my.cnf -u root" exec { 'galera-set-root-password': - command => "/bin/touch /root/.my.cnf && /bin/echo \"UPDATE mysql.user SET Password = PASSWORD('${mysql_root_password}') WHERE user = 'root'; flush privileges;\" | /bin/mysql --defaults-extra-file=/root/.my.cnf -u root", + command => $galera_set_pwd, } file { '/root/.my.cnf' : ensure => file, diff --git a/manifests/profile/pacemaker/database/redis.pp b/manifests/profile/pacemaker/database/redis.pp index 8a37ce9..e081516 100644 --- a/manifests/profile/pacemaker/database/redis.pp +++ b/manifests/profile/pacemaker/database/redis.pp @@ -44,6 +44,14 @@ class tripleo::profile::pacemaker::database::redis ( if $step >= 1 { include ::redis + + if $pacemaker_master and hiera('stack_action') == 'UPDATE' { + tripleo::pacemaker::resource_restart_flag { 'redis-master': + # ouch, but trying to stay close how notification works in + # puppet-redis when pacemaker is not being used + subscribe => Exec["cp -p ${::redis::config_file_orig} ${::redis::config_file}"] + } + } } if $step >= 2 and $pacemaker_master { diff --git a/manifests/profile/pacemaker/haproxy.pp b/manifests/profile/pacemaker/haproxy.pp index 1b83d9b..b2e127b 100644 --- a/manifests/profile/pacemaker/haproxy.pp +++ b/manifests/profile/pacemaker/haproxy.pp @@ -44,6 +44,12 @@ class tripleo::profile::pacemaker::haproxy ( $pacemaker_master = false } + if $step >= 1 and $pacemaker_master and hiera('stack_action') == 'UPDATE' { + tripleo::pacemaker::resource_restart_flag { 'haproxy-clone': + subscribe => Concat['/etc/haproxy/haproxy.cfg'], + } + } + if $step >= 2 and $pacemaker_master and $enable_load_balancer { # FIXME: we should not have to access tripleo::haproxy class # parameters here to configure pacemaker VIPs. The configuration diff --git a/manifests/profile/pacemaker/manila.pp b/manifests/profile/pacemaker/manila.pp index 43ae875..a1ff5ca 100644 --- a/manifests/profile/pacemaker/manila.pp +++ b/manifests/profile/pacemaker/manila.pp @@ -22,84 +22,14 @@ # (Optional) The hostname of the node responsible for bootstrapping tasks # Defaults to hiera('bootstrap_nodeid') # -# [*cinder_volume_type*] -# (Optional) -# Defaults to hiera('manila::backend::generic::cinder_volume_type', '') -# -# [*driver_handles_share_servers*] -# (Optional) -# Defaults to hiera('manila::backend::generic::driver_handles_share_servers') -# -# [*manila_generic_enable*] -# (Optional) Enable the generic backend. -# Defaults to hiera('manila_generic_enable_backend', 'false') -# -# [*max_time_to_attach*] -# (Optional) -# Defaults to hiera('manila::backend::generic::max_time_to_attach') -# -# [*max_time_to_create_volume*] -# (Optional) -# Defaults to hiera('manila::backend::generic::max_time_to_create_volume') -# -# [*service_instance_flavor_id*] -# (Optional) -# Defaults to hiera('manila::service_instance::service_instance_flavor_id') -# -# [*service_instance_password*] -# (Optional) -# Defaults to hiera('manila::service_instance::service_instance_password') -# -# [*service_instance_smb_config_path*] -# (Optional) -# Defaults to downcase(hiera('manila::backend::generic::service_instance_smb_config_path')) -# -# [*service_instance_user*] -# (Optional) -# Defaults to hiera('manila::service_instance::service_instance_user') -# -# [*share_mount_path*] -# (Optional) -# Defaults to hiera('manila::backend::generic::share_mount_path') -# -# [*share_volume_fstype*] -# (Optional) -# Defaults to hiera('manila::backend::generic::share_volume_fstype') -# -# [*smb_template_config_path*] -# (Optional) -# Defaults to hiera('manila::backend::generic::smb_template_config_path') -# # [*step*] # (Optional) The current step in deployment. See tripleo-heat-templates # for more details. # Defaults to hiera('step') # -# [*volume_name_template*] -# (Optional) -# Defaults to hiera('manila::backend::generic::volume_name_template') -# -# [*volume_snapshot_name_template*] -# (Optional) -# Defaults to hiera('manila::backend::generic::volume_snapshot_name_template') -# class tripleo::profile::pacemaker::manila ( $bootstrap_node = hiera('bootstrap_nodeid'), - $cinder_volume_type = hiera('manila::backend::generic::cinder_volume_type', ''), - $driver_handles_share_servers = hiera('manila::backend::generic::driver_handles_share_servers'), - $manila_generic_enable = hiera('manila_generic_enable_backend', false), - $max_time_to_attach = hiera('manila::backend::generic::max_time_to_attach'), - $max_time_to_create_volume = hiera('manila::backend::generic::max_time_to_create_volume'), - $service_instance_flavor_id = hiera('manila::service_instance::service_instance_flavor_id'), - $service_instance_password = hiera('manila::service_instance::service_instance_password'), - $service_instance_smb_config_path = hiera('manila::backend::generic::service_instance_smb_config_path'), - $service_instance_user = hiera('manila::service_instance::service_instance_user'), - $share_mount_path = hiera('manila::backend::generic::share_mount_path'), - $share_volume_fstype = hiera('manila::backend::generic::share_volume_fstype'), - $smb_template_config_path = hiera('manila::backend::generic::smb_template_config_path'), $step = hiera('step'), - $volume_name_template = hiera('manila::backend::generic::volume_name_template'), - $volume_snapshot_name_template = hiera('manila::backend::generic::volume_snapshot_name_template'), ) { if $::hostname == downcase($bootstrap_node) { $pacemaker_master = true @@ -116,26 +46,31 @@ class tripleo::profile::pacemaker::manila ( stop => '/bin/true', } - if $step >= 4 { - include ::tripleo::profile::base::manila::api - include ::tripleo::profile::base::manila::scheduler - include ::tripleo::profile::base::manila::share + include ::tripleo::profile::base::manila::api + include ::tripleo::profile::base::manila::scheduler + include ::tripleo::profile::base::manila::share + if $step >= 4 { + # manila generic: + $manila_generic_enable = hiera('manila_generic_enable_backend', false) if $manila_generic_enable { $manila_generic_backend = hiera('manila::backend::generic::title') manila::backend::generic { $manila_generic_backend : - driver_handles_share_servers => $driver_handles_share_servers, - smb_template_config_path => $smb_template_config_path, - volume_name_template => $volume_name_template , - volume_snapshot_name_template => $volume_snapshot_name_template, - share_mount_path => $share_mount_path, - max_time_to_create_volume => $max_time_to_create_volume, - max_time_to_attach => $max_time_to_attach, - service_instance_smb_config_path => $service_instance_smb_config_path, - share_volume_fstype => $share_volume_fstype, - cinder_volume_type => $cinder_volume_type, + driver_handles_share_servers => hiera('manila::backend::generic::driver_handles_share_servers', true), + max_time_to_attach => hiera('manila::backend::generic::max_time_to_attach'), + max_time_to_create_volume => hiera('manila::backend::generic::max_time_to_create_volume'), + service_instance_smb_config_path => hiera('manila::backend::generic::service_instance_smb_config_path'), + share_mount_path => hiera('manila::backend::generic::share_mount_path'), + share_volume_fstype => hiera('manila::backend::generic::share_volume_fstype'), + smb_template_config_path => hiera('manila::backend::generic::smb_template_config_path'), + volume_name_template => hiera('manila::backend::generic::volume_name_template'), + volume_snapshot_name_template => hiera('manila::backend::generic::volume_snapshot_name_template'), + cinder_volume_type => hiera('manila::backend::generic::cinder_volume_type'), } + $service_instance_user = hiera('manila::service_instance::service_instance_user') + $service_instance_password = hiera('manila::service_instance::service_instance_password') + $service_instance_flavor_id = hiera('manila::service_instance::service_instance_flavor_id') manila_config { "${manila_generic_backend}/service_instance_user": value => $service_instance_user; "${manila_generic_backend}/service_instance_password": value => $service_instance_password; @@ -145,10 +80,60 @@ class tripleo::profile::pacemaker::manila ( include ::manila::volume::cinder } - $manila_enabled_backends = delete_undef_values([$manila_generic_backend]) + # manila cephfsnative: + $manila_cephfsnative_enable = hiera('manila::backend::cephfsnative::enable_backend', false) + if $manila_cephfsnative_enable { + $manila_cephfsnative_backend = hiera('manila::backend::cephfsnative::title') + manila::backend::cephfsnative { $manila_cephfsnative_backend : + driver_handles_share_servers => hiera('manila::backend::cephfsnative::driver_handles_share_servers', false), + share_backend_name => hiera('manila::backend::cephfsnative::share_backend_name'), + cephfs_conf_path => hiera('manila::backend::cephfsnative::cephfs_conf_path'), + cephfs_auth_id => hiera('manila::backend::cephfsnative::cephfs_auth_id'), + cephfs_cluster_name => hiera('manila::backend::cephfsnative::cephfs_cluster_name'), + cephfs_enable_snapshots => hiera('manila::backend::cephfsnative::cephfs_enable_snapshots'), + } + } + + # manila netapp: + $manila_netapp_enable = hiera('manila_netapp_enable_backend', false) + if $manila_netapp_enable { + $manila_netapp_backend = hiera('manila::backend::netapp::title') + manila::backend::netapp { $manila_netapp_backend : + driver_handles_share_servers => hiera('manila::backend::netapp::driver_handles_share_servers', true), + netapp_login => hiera('manila::backend::netapp::netapp_login'), + netapp_password => hiera('manila::backend::netapp::netapp_password'), + netapp_server_hostname => hiera('manila::backend::netapp::netapp_server_hostname'), + netapp_transport_type => hiera('manila::backend::netapp::netapp_transport_type'), + netapp_storage_family => hiera('manila::backend::netapp::netapp_storage_family'), + netapp_server_port => hiera('manila::backend::netapp::netapp_server_port'), + netapp_volume_name_template => hiera('manila::backend::netapp::netapp_volume_name_template'), + netapp_vserver => hiera('manila::backend::netapp::netapp_vserver'), + netapp_vserver_name_template => hiera('manila::backend::netapp::netapp_vserver_name_template'), + netapp_lif_name_template => hiera('manila::backend::netapp::netapp_lif_name_template'), + netapp_aggregate_name_search_pattern => hiera('manila::backend::netapp::netapp_aggregate_name_search_pattern'), + netapp_root_volume_aggregate => hiera('manila::backend::netapp::netapp_root_volume_aggregate'), + netapp_root_volume_name => hiera('manila::backend::netapp::netapp_root_volume'), + netapp_port_name_search_pattern => hiera('manila::backend::netapp::netapp_port_name_search_pattern'), + netapp_trace_flags => hiera('manila::backend::netapp::netapp_trace_flags'), + } + } + + $manila_enabled_backends = delete_undef_values( + [ + $manila_generic_backend, + $manila_cephfsnative_backend, + $manila_netapp_backend + ] + ) class { '::manila::backends' : enabled_share_backends => $manila_enabled_backends, } + + if $pacemaker_master and hiera('stack_action') == 'UPDATE' { + Manila_api_paste_ini<||> ~> Tripleo::Pacemaker::Resource_restart_flag["${::manila::params::share_service}"] + Manila_config<||> ~> Tripleo::Pacemaker::Resource_restart_flag["${::manila::params::share_service}"] + tripleo::pacemaker::resource_restart_flag { "${::manila::params::share_service}": } + } } if $step >= 5 and $pacemaker_master { diff --git a/manifests/profile/pacemaker/rabbitmq.pp b/manifests/profile/pacemaker/rabbitmq.pp index 93edec9..1f25e8b 100644 --- a/manifests/profile/pacemaker/rabbitmq.pp +++ b/manifests/profile/pacemaker/rabbitmq.pp @@ -54,6 +54,12 @@ class tripleo::profile::pacemaker::rabbitmq ( require => Class['::rabbitmq'], } + if $step >= 1 and $pacemaker_master and hiera('stack_action') == 'UPDATE' { + tripleo::pacemaker::resource_restart_flag { 'rabbitmq-clone': + subscribe => Class['rabbitmq::service'], + } + } + if $step >= 2 and $pacemaker_master { pacemaker::resource::ocf { 'rabbitmq': ocf_agent_name => 'heartbeat:rabbitmq-cluster', diff --git a/manifests/trusted_ca.pp b/manifests/trusted_ca.pp new file mode 100644 index 0000000..4e62418 --- /dev/null +++ b/manifests/trusted_ca.pp @@ -0,0 +1,39 @@ +# Copyright 2016 Red Hat, Inc. +# +# Licensed under the Apache License, Version 2.0 (the "License"); you may +# not use this file except in compliance with the License. You may obtain +# a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT +# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the +# License for the specific language governing permissions and limitations +# under the License. +# +# == Class: tripleo::trusted_ca +# +# Does the necessary action to deploy and trust a CA certificate. +# +# === Parameters +# +# [*content*] +# The content of the CA certificate in PEM format. +# +define tripleo::trusted_ca( + $content, +) { + file { "/etc/pki/ca-trust/source/anchors/${name}.pem": + content => $content, + mode => '0644', + owner => 'root', + group => 'root', + } + exec { "trust-ca-${name}": + command => 'update-ca-trust extract', + path => '/usr/bin', + subscribe => File["/etc/pki/ca-trust/source/anchors/${name}.pem"], + refreshonly => true, + } +} diff --git a/manifests/trusted_cas.pp b/manifests/trusted_cas.pp new file mode 100644 index 0000000..265a700 --- /dev/null +++ b/manifests/trusted_cas.pp @@ -0,0 +1,28 @@ +# Copyright 2016 Red Hat, Inc. +# +# Licensed under the Apache License, Version 2.0 (the "License"); you may +# not use this file except in compliance with the License. You may obtain +# a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT +# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the +# License for the specific language governing permissions and limitations +# under the License. +# +# == Class: tripleo::trusted_cas +# +# Does the necessary actions to deploy and trust a set of CA certificates. +# +# === Parameters +# +# [*ca_map*] +# The content of the CA certificate in PEM format. +# +class tripleo::trusted_cas( + $ca_map = {}, +) { + create_resources('::tripleo::trusted_ca', $ca_map) +} diff --git a/manifests/ui.pp b/manifests/ui.pp new file mode 100644 index 0000000..0a12af0 --- /dev/null +++ b/manifests/ui.pp @@ -0,0 +1,108 @@ +# Copyright 2016 Red Hat, Inc. +# All Rights Reserved. +# +# Licensed under the Apache License, Version 2.0 (the "License"); you may +# not use this file except in compliance with the License. You may obtain +# a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT +# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the +# License for the specific language governing permissions and limitations +# under the License. + +# == Class: tripleo::ui +# +# Configure TripleO UI. +# +# === Parameters: +# +# [*servername*] +# The servername for the virtualhost. +# Optional. Defaults to $::fqdn +# +# [*bind_host*] +# The host/ip address Apache will listen on. +# Optional. Defaults to undef (listen on all ip addresses). +# +# [*ui_port*] +# The port on which the UI is listening. +# Defaults to 3000 +# +# [*keystone_url*] +# The keystone service url +# Defaults to hiera('keystone::endpoint::public_url') +# +# [*heat_url*] +# The heat service url +# Defaults to hiera('heat::keystone::auth::public_url') +# +# [*heat_url*] +# The heat service url +# Defaults to hiera('heat::keystone::auth::public_url') +# +# [*heat_url*] +# The heat service url +# Defaults to hiera('heat::keystone::auth::public_url') +# +# [*ironic_url*] +# The ironic service url +# Defaults to hiera('ironic::keystone::auth::public_url') +# +# [*mistral_url*] +# The mistral service url +# Defaults to hiera('mistral::keystone::auth::public_url') +# +# [*swift_url*] +# The swift service url +# Defaults to hiera('swift::keystone::auth::public_url') +# +# [*zaqar_websocket_url*] +# The zaqar websocket url +# Defaults to hiera('zaquar::keystone::auth_websocket::public_url') +# +# [*zaqar_default_queue*] +# The zaqar default queue +# A string. +# Defaults to 'tripleo' +# +class tripleo::ui ( + $servername = $::fqdn, + $bind_host = undef, + $ui_port = 3000, + $keystone_url = hiera('keystone::endpoint::public_url'), + $heat_url = hiera('heat::keystone::auth::public_url', undef), + $ironic_url = hiera('ironic::keystone::auth::public_url', undef), + $mistral_url = hiera('mistral::keystone::auth::public_url', undef), + $swift_url = hiera('swift::keystone::auth::public_url', undef), + $zaqar_websocket_url = hiera('zaqar::keystone::auth_websocket::public_url', undef), + $zaqar_default_queue = 'tripleo' +) { + + ::apache::vhost { 'tripleo-ui': + ensure => 'present', + servername => $servername, + ip => $bind_host, + port => $ui_port, + docroot => '/var/www/openstack-tripleo-ui/dist', + options => ['Indexes', 'FollowSymLinks'], + rewrites => [ + { + comment => 'Redirect 404 to index', + rewrite_cond => ['%{REQUEST_FILENAME} !-f', '%{REQUEST_FILENAME} !-d'], + rewrite_rule => ['(.*) index.html'], + }, + ], + } + + file { '/var/www/openstack-tripleo-ui/dist/tripleo_ui_config.js' : + ensure => file, + content => template('tripleo/ui/tripleo_ui_config.js.erb'), + owner => 'root', + group => 'root', + mode => '0644', + } + +} diff --git a/manifests/vip_hosts.pp b/manifests/vip_hosts.pp new file mode 100644 index 0000000..7b260fd --- /dev/null +++ b/manifests/vip_hosts.pp @@ -0,0 +1,39 @@ +# Copyright 2016 Red Hat, Inc. +# All Rights Reserved. +# +# Licensed under the Apache License, Version 2.0 (the "License"); you may +# not use this file except in compliance with the License. You may obtain +# a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT +# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the +# License for the specific language governing permissions and limitations +# under the License. +# +# == Class: tripleo::vip_hosts +# +# Write the overcloud VIPs into /etc/hosts +# +# === Parameters +# +# [*hosts_spec*] +# The specification of the hosts that will be added to the /etc/hosts file. +# These come in the form of a hash that will be consumed by create_resources. +# e.g.: +# tripleo::hosts_spec: +# host-1: +# name: host1.domain +# ip: 127.0.0.1 +# host-2: +# name: host2.domain +# ip: 127.0.0.2 +# +class tripleo::vip_hosts ( + $hosts_spec +) { + create_resources('host', $hosts_spec) +} + |