aboutsummaryrefslogtreecommitdiffstats
path: root/manifests
diff options
context:
space:
mode:
Diffstat (limited to 'manifests')
-rw-r--r--manifests/haproxy.pp297
-rw-r--r--manifests/haproxy/endpoint.pp52
-rw-r--r--manifests/pacemaker/resource_restart_flag.pp11
-rw-r--r--manifests/packages.pp36
-rw-r--r--manifests/packages/upgrades.pp43
-rw-r--r--manifests/profile/base/ceilometer/collector.pp9
-rw-r--r--manifests/profile/base/cinder/volume/eqlx.pp2
-rw-r--r--manifests/profile/base/haproxy.pp4
-rw-r--r--manifests/profile/base/heat.pp16
-rw-r--r--manifests/profile/base/keystone.pp23
-rw-r--r--manifests/profile/base/nova/api.pp12
-rw-r--r--manifests/profile/base/pacemaker.pp4
-rw-r--r--manifests/profile/base/rabbitmq.pp3
-rw-r--r--manifests/profile/base/swift/proxy.pp1
-rw-r--r--manifests/profile/base/swift/ringbuilder.pp13
-rw-r--r--manifests/profile/pacemaker/database/redis.pp1
-rw-r--r--manifests/profile/pacemaker/manila.pp28
-rw-r--r--manifests/profile/pacemaker/rabbitmq.pp1
18 files changed, 415 insertions, 141 deletions
diff --git a/manifests/haproxy.pp b/manifests/haproxy.pp
index eab7cc9..c4d018d 100644
--- a/manifests/haproxy.pp
+++ b/manifests/haproxy.pp
@@ -89,10 +89,22 @@
# When set, enables SSL on the public API endpoints using the specified file.
# Defaults to undef
#
-# [*internal_certificate*]
-# Filename of an HAProxy-compatible certificate and key file
-# When set, enables SSL on the internal API endpoints using the specified file.
-# Defaults to undef
+# [*use_internal_certificates*]
+# Flag that indicates if we'll use an internal certificate for this specific
+# service. When set, enables SSL on the internal API endpoints using the file
+# that certmonger is tracking; this is derived from the network the service is
+# listening on.
+# Defaults to false
+#
+# [*internal_certificates_specs*]
+# A hash that should contain the specs that were used to create the
+# certificates. As the name indicates, only the internal certificates will be
+# fetched from here. And the keys should follow the following pattern
+# "haproxy-<network name>". The network name should be as it was defined in
+# tripleo-heat-templates.
+# Note that this is only taken into account if the $use_internal_certificates
+# flag is set.
+# Defaults to {}
#
# [*ssl_cipher_suite*]
# The default string describing the list of cipher algorithms ("cipher suite")
@@ -242,6 +254,106 @@
# (optional) Enable or not Zaqar Websockets binding
# Defaults to false
#
+# [*aodh_network*]
+# (optional) Specify the network aodh is running on.
+# Defaults to hiera('aodh_api_network', undef)
+#
+# [*ceilometer_network*]
+# (optional) Specify the network ceilometer is running on.
+# Defaults to hiera('ceilometer_api_network', undef)
+#
+# [*ceph_rgw_network*]
+# (optional) Specify the network ceph_rgw is running on.
+# Defaults to hiera('ceph_rgw_network', undef)
+#
+# [*cinder_network*]
+# (optional) Specify the network cinder is running on.
+# Defaults to hiera('cinder_api_network', undef)
+#
+# [*glance_api_network*]
+# (optional) Specify the network glance_api is running on.
+# Defaults to hiera('glance_api_network', undef)
+#
+# [*glance_registry_network*]
+# (optional) Specify the network glance_registry is running on.
+# Defaults to hiera('glance_registry_network', undef)
+#
+# [*gnocchi_network*]
+# (optional) Specify the network gnocchi is running on.
+# Defaults to hiera('gnocchi_api_network', undef)
+#
+# [*heat_api_network*]
+# (optional) Specify the network heat_api is running on.
+# Defaults to hiera('heat_api_network', undef)
+#
+# [*heat_cfn_network*]
+# (optional) Specify the network heat_cfn is running on.
+# Defaults to hiera('heat_api_cfn_network', undef)
+#
+# [*heat_cloudwatch_network*]
+# (optional) Specify the network heat_cloudwatch is running on.
+# Defaults to hiera('heat_api_cloudwatch_network', undef)
+#
+# [*ironic_inspector_network*]
+# (optional) Specify the network ironic_inspector is running on.
+# Defaults to hiera('ironic_inspector_network', undef)
+#
+# [*ironic_network*]
+# (optional) Specify the network ironic is running on.
+# Defaults to hiera('ironic_api_network', undef)
+#
+# [*keystone_admin_network*]
+# (optional) Specify the network keystone_admin is running on.
+# Defaults to hiera('keystone_network', undef)
+#
+# [*keystone_public_network*]
+# (optional) Specify the network keystone_public is running on.
+# Defaults to hiera('keystone_network', undef)
+#
+# [*manila_network*]
+# (optional) Specify the network manila is running on.
+# Defaults to hiera('manila_api_network', undef)
+#
+# [*mistral_network*]
+# (optional) Specify the network mistral is running on.
+# Defaults to hiera('mistral_api_network', undef)
+#
+# [*neutron_network*]
+# (optional) Specify the network neutron is running on.
+# Defaults to hiera('neutron_api_network', undef)
+#
+# [*nova_metadata_network*]
+# (optional) Specify the network nova_metadata is running on.
+# Defaults to hiera('nova_api_network', undef)
+#
+# [*nova_novncproxy_network*]
+# (optional) Specify the network nova_novncproxy is running on.
+# Defaults to hiera('nova_vncproxy_network', undef)
+#
+# [*nova_osapi_network*]
+# (optional) Specify the network nova_osapi is running on.
+# Defaults to hiera('nova_api_network', undef)
+#
+# [*opendaylight_network*]
+# (optional) Specify the network opendaylight is running on.
+# Defaults to hiera('opendaylight_api_network', undef)
+#
+# [*sahara_network*]
+# (optional) Specify the network sahara is running on.
+# Defaults to hiera('sahara_api_network', undef)
+#
+# [*swift_proxy_server_network*]
+# (optional) Specify the network swift_proxy_server is running on.
+# Defaults to hiera('swift_proxy_network', undef)
+#
+# [*trove_network*]
+# (optional) Specify the network trove is running on.
+# Defaults to hiera('trove_api_network', undef)
+#
+# [*zaqar_api_network*]
+# (optional) Specify the network zaqar_api is running on.
+# Defaults to hiera('zaqar_api_network', undef)
+#
# [*service_ports*]
# (optional) Hash that contains the values to override from the service ports
# The available keys to modify the services' ports are:
@@ -300,57 +412,82 @@
class tripleo::haproxy (
$controller_virtual_ip,
$public_virtual_ip,
- $keepalived = true,
- $haproxy_service_manage = true,
- $haproxy_global_maxconn = 20480,
- $haproxy_default_maxconn = 4096,
- $haproxy_default_timeout = [ 'http-request 10s', 'queue 1m', 'connect 10s', 'client 1m', 'server 1m', 'check 10s' ],
- $haproxy_listen_bind_param = [ 'transparent' ],
- $haproxy_member_options = [ 'check', 'inter 2000', 'rise 2', 'fall 5' ],
- $haproxy_log_address = '/dev/log',
- $haproxy_stats_user = 'admin',
- $haproxy_stats_password = undef,
- $controller_hosts = hiera('controller_node_ips'),
- $controller_hosts_names = hiera('controller_node_names', undef),
- $service_certificate = undef,
- $internal_certificate = undef,
- $ssl_cipher_suite = '!SSLv2:kEECDH:kRSA:kEDH:kPSK:+3DES:!aNULL:!eNULL:!MD5:!EXP:!RC4:!SEED:!IDEA:!DES',
- $ssl_options = 'no-sslv3',
- $haproxy_stats_certificate = undef,
- $keystone_admin = hiera('keystone_enabled', false),
- $keystone_public = hiera('keystone_enabled', false),
- $neutron = hiera('neutron_api_enabled', false),
- $cinder = hiera('cinder_api_enabled', false),
- $manila = hiera('manila_api_enabled', false),
- $sahara = hiera('sahara_api_enabled', false),
- $trove = hiera('trove_api_enabled', false),
- $glance_api = hiera('glance_api_enabled', false),
- $glance_registry = hiera('glance_registry_enabled', false),
- $nova_osapi = hiera('nova_api_enabled', false),
- $nova_metadata = hiera('nova_api_enabled', false),
- $nova_novncproxy = hiera('nova_vnc_proxy_enabled', false),
- $ceilometer = hiera('ceilometer_api_enabled', false),
- $aodh = hiera('aodh_api_enabled', false),
- $gnocchi = hiera('gnocchi_api_enabled', false),
- $mistral = hiera('mistral_api_enabled', false),
- $swift_proxy_server = hiera('swift_proxy_enabled', false),
- $heat_api = hiera('heat_api_enabled', false),
- $heat_cloudwatch = hiera('heat_api_cloudwatch_enabled', false),
- $heat_cfn = hiera('heat_api_cfn_enabled', false),
- $horizon = hiera('horizon_enabled', false),
- $ironic = hiera('ironic_api_enabled', false),
- $ironic_inspector = hiera('ironic_inspector_enabled', false),
- $mysql = hiera('mysql_enabled', false),
- $mysql_clustercheck = false,
- $rabbitmq = false,
- $redis = hiera('redis_enabled', false),
- $redis_password = undef,
- $midonet_api = false,
- $zaqar_api = hiera('zaqar_api_enabled', false),
- $ceph_rgw = hiera('ceph_rgw_enabled', false),
- $opendaylight = hiera('opendaylight_api_enabled', false),
- $zaqar_ws = hiera('zaqar_api_enabled', false),
- $service_ports = {}
+ $keepalived = true,
+ $haproxy_service_manage = true,
+ $haproxy_global_maxconn = 20480,
+ $haproxy_default_maxconn = 4096,
+ $haproxy_default_timeout = [ 'http-request 10s', 'queue 1m', 'connect 10s', 'client 1m', 'server 1m', 'check 10s' ],
+ $haproxy_listen_bind_param = [ 'transparent' ],
+ $haproxy_member_options = [ 'check', 'inter 2000', 'rise 2', 'fall 5' ],
+ $haproxy_log_address = '/dev/log',
+ $haproxy_stats_user = 'admin',
+ $haproxy_stats_password = undef,
+ $controller_hosts = hiera('controller_node_ips'),
+ $controller_hosts_names = hiera('controller_node_names', undef),
+ $service_certificate = undef,
+ $use_internal_certificates = false,
+ $internal_certificates_specs = {},
+ $ssl_cipher_suite = '!SSLv2:kEECDH:kRSA:kEDH:kPSK:+3DES:!aNULL:!eNULL:!MD5:!EXP:!RC4:!SEED:!IDEA:!DES',
+ $ssl_options = 'no-sslv3',
+ $haproxy_stats_certificate = undef,
+ $keystone_admin = hiera('keystone_enabled', false),
+ $keystone_public = hiera('keystone_enabled', false),
+ $neutron = hiera('neutron_api_enabled', false),
+ $cinder = hiera('cinder_api_enabled', false),
+ $manila = hiera('manila_api_enabled', false),
+ $sahara = hiera('sahara_api_enabled', false),
+ $trove = hiera('trove_api_enabled', false),
+ $glance_api = hiera('glance_api_enabled', false),
+ $glance_registry = hiera('glance_registry_enabled', false),
+ $nova_osapi = hiera('nova_api_enabled', false),
+ $nova_metadata = hiera('nova_api_enabled', false),
+ $nova_novncproxy = hiera('nova_vnc_proxy_enabled', false),
+ $ceilometer = hiera('ceilometer_api_enabled', false),
+ $aodh = hiera('aodh_api_enabled', false),
+ $gnocchi = hiera('gnocchi_api_enabled', false),
+ $mistral = hiera('mistral_api_enabled', false),
+ $swift_proxy_server = hiera('swift_proxy_enabled', false),
+ $heat_api = hiera('heat_api_enabled', false),
+ $heat_cloudwatch = hiera('heat_api_cloudwatch_enabled', false),
+ $heat_cfn = hiera('heat_api_cfn_enabled', false),
+ $horizon = hiera('horizon_enabled', false),
+ $ironic = hiera('ironic_api_enabled', false),
+ $ironic_inspector = hiera('ironic_inspector_enabled', false),
+ $mysql = hiera('mysql_enabled', false),
+ $mysql_clustercheck = false,
+ $rabbitmq = false,
+ $redis = hiera('redis_enabled', false),
+ $redis_password = undef,
+ $midonet_api = false,
+ $zaqar_api = hiera('zaqar_api_enabled', false),
+ $ceph_rgw = hiera('ceph_rgw_enabled', false),
+ $opendaylight = hiera('opendaylight_api_enabled', false),
+ $zaqar_ws = hiera('zaqar_api_enabled', false),
+ $aodh_network = hiera('aodh_api_network', undef),
+ $ceilometer_network = hiera('ceilometer_api_network', undef),
+ $ceph_rgw_network = hiera('ceph_rgw_network', undef),
+ $cinder_network = hiera('cinder_api_network', undef),
+ $glance_api_network = hiera('glance_api_network', undef),
+ $glance_registry_network = hiera('glance_registry_network', undef),
+ $gnocchi_network = hiera('gnocchi_api_network', undef),
+ $heat_api_network = hiera('heat_api_network', undef),
+ $heat_cfn_network = hiera('heat_api_cfn_network', undef),
+ $heat_cloudwatch_network = hiera('heat_api_cloudwatch_network', undef),
+ $ironic_inspector_network = hiera('ironic_inspector_network', undef),
+ $ironic_network = hiera('ironic_api_network', undef),
+ $keystone_admin_network = hiera('keystone_admin_api_network', undef),
+ $keystone_public_network = hiera('keystone_public_api_network', undef),
+ $manila_network = hiera('manila_api_network', undef),
+ $mistral_network = hiera('mistral_api_network', undef),
+ $neutron_network = hiera('neutron_api_network', undef),
+ $nova_metadata_network = hiera('nova_api_network', undef),
+ $nova_novncproxy_network = hiera('nova_vnc_proxy_network', undef),
+ $nova_osapi_network = hiera('nova_api_network', undef),
+ $sahara_network = hiera('sahara_api_network', undef),
+ $swift_proxy_server_network = hiera('swift_proxy_network', undef),
+ $trove_network = hiera('trove_api_network', undef),
+ $zaqar_api_network = hiera('zaqar_api_network', undef),
+ $service_ports = {}
) {
$default_service_ports = {
aodh_api_port => 8042,
@@ -506,10 +643,11 @@ class tripleo::haproxy (
}
Tripleo::Haproxy::Endpoint {
- haproxy_listen_bind_param => $haproxy_listen_bind_param,
- member_options => $haproxy_member_options,
- public_certificate => $service_certificate,
- internal_certificate => $internal_certificate,
+ haproxy_listen_bind_param => $haproxy_listen_bind_param,
+ member_options => $haproxy_member_options,
+ public_certificate => $service_certificate,
+ use_internal_certificates => $use_internal_certificates,
+ internal_certificates_specs => $internal_certificates_specs,
}
$stats_base = ['enable', 'uri /']
@@ -541,6 +679,7 @@ class tripleo::haproxy (
'set-header X-Forwarded-Proto http if !{ ssl_fc }'],
},
public_ssl_port => $ports[keystone_admin_api_ssl_port],
+ service_network => $keystone_admin_network,
}
}
@@ -569,6 +708,7 @@ class tripleo::haproxy (
mode => 'http',
listen_options => merge($keystone_listen_opts, $keystone_public_tls_listen_opts),
public_ssl_port => $ports[keystone_public_api_ssl_port],
+ service_network => $keystone_public_network,
}
}
@@ -580,6 +720,7 @@ class tripleo::haproxy (
ip_addresses => hiera('neutron_api_node_ips', $controller_hosts_real),
server_names => hiera('neutron_api_node_names', $controller_hosts_names_real),
public_ssl_port => $ports[neutron_api_ssl_port],
+ service_network => $neutron_network,
}
}
@@ -597,6 +738,7 @@ class tripleo::haproxy (
'set-header X-Forwarded-Proto http if !{ ssl_fc }'],
},
public_ssl_port => $ports[cinder_api_ssl_port],
+ service_network => $cinder_network,
}
}
@@ -613,6 +755,7 @@ class tripleo::haproxy (
'set-header X-Forwarded-Proto http if !{ ssl_fc }'],
},
public_ssl_port => $ports[manila_api_ssl_port],
+ service_network => $manila_network,
}
}
@@ -624,6 +767,7 @@ class tripleo::haproxy (
ip_addresses => hiera('sahara_api_node_ips', $controller_hosts_real),
server_names => hiera('sahara_api_node_names', $controller_hosts_names_real),
public_ssl_port => $ports[sahara_api_ssl_port],
+ service_network => $sahara_network,
}
}
@@ -635,6 +779,7 @@ class tripleo::haproxy (
ip_addresses => hiera('trove_api_node_ips', $controller_hosts_real),
server_names => hiera('trove_api_node_names', $controller_hosts_names_real),
public_ssl_port => $ports[trove_api_ssl_port],
+ service_network => $trove_network,
}
}
@@ -652,15 +797,17 @@ class tripleo::haproxy (
'set-header X-Forwarded-Proto https if { ssl_fc }',
'set-header X-Forwarded-Proto http if !{ ssl_fc }'],
},
+ service_network => $glance_api_network,
}
}
if $glance_registry {
::tripleo::haproxy::endpoint { 'glance_registry':
- internal_ip => hiera('glance_registry_vip', $controller_virtual_ip),
- service_port => $ports[glance_registry_port],
- ip_addresses => hiera('glance_registry_node_ips', $controller_hosts_real),
- server_names => hiera('glance_registry_node_names', $controller_hosts_names_real),
+ internal_ip => hiera('glance_registry_vip', $controller_virtual_ip),
+ service_port => $ports[glance_registry_port],
+ ip_addresses => hiera('glance_registry_node_ips', $controller_hosts_real),
+ server_names => hiera('glance_registry_node_names', $controller_hosts_names_real),
+ service_network => $glance_registry_network,
}
}
@@ -679,15 +826,17 @@ class tripleo::haproxy (
'set-header X-Forwarded-Proto http if !{ ssl_fc }'],
},
public_ssl_port => $ports[nova_api_ssl_port],
+ service_network => $nova_osapi_network,
}
}
if $nova_metadata {
::tripleo::haproxy::endpoint { 'nova_metadata':
- internal_ip => hiera('nova_metadata_vip', $controller_virtual_ip),
- service_port => $ports[nova_metadata_port],
- ip_addresses => hiera('nova_metadata_node_ips', $controller_hosts_real),
- server_names => hiera('nova_metadata_node_names', $controller_hosts_names_real),
+ internal_ip => hiera('nova_metadata_vip', $controller_virtual_ip),
+ service_port => $ports[nova_metadata_port],
+ ip_addresses => hiera('nova_metadata_node_ips', $controller_hosts_real),
+ server_names => hiera('nova_metadata_node_names', $controller_hosts_names_real),
+ service_network => $nova_metadata_network,
}
}
@@ -703,6 +852,7 @@ class tripleo::haproxy (
'timeout' => [ 'tunnel 1h' ],
},
public_ssl_port => $ports[nova_novnc_ssl_port],
+ service_network => $nova_novncproxy_network,
}
}
@@ -714,6 +864,7 @@ class tripleo::haproxy (
ip_addresses => hiera('ceilometer_api_node_ips', $controller_hosts_real),
server_names => hiera('ceilometer_api_node_names', $controller_hosts_names_real),
public_ssl_port => $ports[ceilometer_api_ssl_port],
+ service_network => $ceilometer_network,
}
}
@@ -725,6 +876,7 @@ class tripleo::haproxy (
ip_addresses => hiera('aodh_api_node_ips', $controller_hosts_real),
server_names => hiera('aodh_api_node_names', $controller_hosts_names_real),
public_ssl_port => $ports[aodh_api_ssl_port],
+ service_network => $aodh_network,
}
}
@@ -736,6 +888,7 @@ class tripleo::haproxy (
ip_addresses => hiera('gnocchi_api_node_ips', $controller_hosts_real),
server_names => hiera('gnocchi_api_node_names', $controller_hosts_names_real),
public_ssl_port => $ports[gnocchi_api_ssl_port],
+ service_network => $gnocchi_network,
}
}
@@ -747,6 +900,7 @@ class tripleo::haproxy (
ip_addresses => hiera('mistral_api_node_ips', $controller_hosts_real),
server_names => hiera('mistral_api_node_names', $controller_hosts_names_real),
public_ssl_port => $ports[mistral_api_ssl_port],
+ service_network => $mistral_network,
}
}
@@ -758,6 +912,7 @@ class tripleo::haproxy (
ip_addresses => hiera('swift_proxy_node_ips', $controller_hosts_real),
server_names => hiera('swift_proxy_node_names', $controller_hosts_names_real),
public_ssl_port => $ports[swift_proxy_ssl_port],
+ service_network => $swift_proxy_server_network,
}
}
@@ -786,6 +941,7 @@ class tripleo::haproxy (
mode => 'http',
listen_options => $heat_options,
public_ssl_port => $ports[heat_api_ssl_port],
+ service_network => $heat_api_network,
}
}
@@ -799,6 +955,7 @@ class tripleo::haproxy (
mode => 'http',
listen_options => $heat_options,
public_ssl_port => $ports[heat_cw_ssl_port],
+ service_network => $heat_cloudwatch_network,
}
}
@@ -812,6 +969,7 @@ class tripleo::haproxy (
mode => 'http',
listen_options => $heat_options,
public_ssl_port => $ports[heat_cfn_ssl_port],
+ service_network => $heat_cfn_network,
}
}
@@ -839,6 +997,7 @@ class tripleo::haproxy (
ip_addresses => hiera('ironic_api_node_ips', $controller_hosts_real),
server_names => hiera('ironic_api_node_names', $controller_hosts_names_real),
public_ssl_port => $ports[ironic_api_ssl_port],
+ service_network => $ironic_network,
}
}
@@ -850,6 +1009,7 @@ class tripleo::haproxy (
ip_addresses => hiera('ironic_inspector_node_ips', $controller_hosts_real),
server_names => hiera('ironic_inspector_node_names', $controller_hosts_names_real),
public_ssl_port => $ports[ironic_inspector_ssl_port],
+ service_network => $ironic_inspector_network,
}
}
@@ -960,6 +1120,7 @@ class tripleo::haproxy (
server_names => hiera('zaqar_api_node_names', $controller_hosts_names_real),
mode => 'http',
public_ssl_port => $ports[zaqar_api_ssl_port],
+ service_network => $zaqar_api_network,
}
}
@@ -971,6 +1132,7 @@ class tripleo::haproxy (
ip_addresses => hiera('ceph_rgw_node_ips', $controller_hosts_real),
server_names => hiera('ceph_rgw_node_names', $controller_hosts_names_real),
public_ssl_port => $ports[ceph_rgw_ssl_port],
+ service_network => $ceph_rgw_network,
}
}
@@ -1016,6 +1178,7 @@ class tripleo::haproxy (
'timeout' => ['connect 5s', 'client 25s', 'server 25s', 'tunnel 3600s'],
},
public_ssl_port => $ports[zaqar_ws_ssl_port],
+ service_network => $zaqar_api_network,
}
}
}
diff --git a/manifests/haproxy/endpoint.pp b/manifests/haproxy/endpoint.pp
index b7403a4..4311049 100644
--- a/manifests/haproxy/endpoint.pp
+++ b/manifests/haproxy/endpoint.pp
@@ -64,9 +64,27 @@
# Certificate path used to enable TLS for the public proxy endpoint.
# Defaults to undef.
#
-# [*internal_certificate*]
-# Certificate path used to enable TLS for the internal proxy endpoint.
-# Defaults to undef.
+# [*use_internal_certificates*]
+# Flag that indicates if we'll use an internal certificate for this specific
+# service. When set, enables SSL on the internal API endpoints using the file
+# that certmonger is tracking; this is derived from the network the service is
+# listening on.
+# Defaults to false
+#
+# [*internal_certificates_specs*]
+# A hash that should contain the specs that were used to create the
+# certificates. As the name indicates, only the internal certificates will be
+# fetched from here. And the keys should follow the following pattern
+# "haproxy-<network name>". The network name should be as it was defined in
+# tripleo-heat-templates.
+# Note that this is only taken into account if the $use_internal_certificates
+# flag is set.
+# Defaults to {}
+#
+# [*service_network*]
+# (optional) Indicates the network that the service is running on. Used for
+# fetching the certificate for that specific network.
+# Defaults to undef
#
define tripleo::haproxy::endpoint (
$internal_ip,
@@ -74,15 +92,17 @@ define tripleo::haproxy::endpoint (
$ip_addresses,
$server_names,
$member_options,
- $public_virtual_ip = undef,
- $mode = undef,
- $haproxy_listen_bind_param = undef,
- $listen_options = {
+ $public_virtual_ip = undef,
+ $mode = undef,
+ $haproxy_listen_bind_param = undef,
+ $listen_options = {
'option' => [],
},
- $public_ssl_port = undef,
- $public_certificate = undef,
- $internal_certificate = undef,
+ $public_ssl_port = undef,
+ $public_certificate = undef,
+ $use_internal_certificates = false,
+ $internal_certificates_specs = {},
+ $service_network = undef,
) {
if $public_virtual_ip {
# service exposed to the public network
@@ -98,9 +118,17 @@ define tripleo::haproxy::endpoint (
$public_bind_opts = {}
}
- if $internal_certificate {
+ if $use_internal_certificates {
+ if !$service_network {
+ fail("The service_network for this service is undefined. Can't configure TLS for the internal network.")
+ }
+ # NOTE(jaosorior): The key of the internal_certificates_specs hash must
+ # must match the convention haproxy-<network name> or else this
+ # will fail. Futherly, it must contain the path that we'll use under
+ # 'service_pem'.
+ $internal_cert_path = $internal_certificates_specs["haproxy-${service_network}"]['service_pem']
$internal_bind_opts = list_to_hash(suffix(any2array($internal_ip), ":${service_port}"),
- union($haproxy_listen_bind_param, ['ssl', 'crt', $public_certificate]))
+ union($haproxy_listen_bind_param, ['ssl', 'crt', $internal_cert_path]))
} else {
$internal_bind_opts = list_to_hash(suffix(any2array($internal_ip), ":${service_port}"), $haproxy_listen_bind_param)
}
diff --git a/manifests/pacemaker/resource_restart_flag.pp b/manifests/pacemaker/resource_restart_flag.pp
index aded802..c201c9b 100644
--- a/manifests/pacemaker/resource_restart_flag.pp
+++ b/manifests/pacemaker/resource_restart_flag.pp
@@ -26,10 +26,21 @@
#
define tripleo::pacemaker::resource_restart_flag() {
+ ensure_resource('file', ['/var/lib/tripleo', '/var/lib/tripleo/pacemaker-restarts'],
+ {
+ 'ensure' => 'directory',
+ 'owner' => 'root',
+ 'mode' => '0755',
+ 'group' => 'root',
+ }
+ )
+
exec { "${title} resource restart flag":
command => "touch /var/lib/tripleo/pacemaker-restarts/${title}",
path => ['/bin','/usr/bin','/sbin','/usr/sbin'],
refreshonly => true,
}
+ File['/var/lib/tripleo/pacemaker-restarts'] ->
+ Exec["${title} resource restart flag"]
}
diff --git a/manifests/packages.pp b/manifests/packages.pp
index 5e111fa..ec2635a 100644
--- a/manifests/packages.pp
+++ b/manifests/packages.pp
@@ -32,6 +32,9 @@ class tripleo::packages (
$enable_upgrade = false,
) {
+ # required for stages
+ include ::stdlib
+
if !$enable_install and !$enable_upgrade {
case $::osfamily {
'RedHat': {
@@ -45,33 +48,12 @@ class tripleo::packages (
if $enable_upgrade {
Package <| |> { ensure => 'latest' }
-
- case $::osfamily {
- 'RedHat': {
- $pkg_upgrade_cmd = 'yum -y update'
- }
- default: {
- warning('Please specify a package upgrade command for distribution.')
- }
- }
-
- exec { 'package-upgrade':
- command => $pkg_upgrade_cmd,
- path => '/usr/bin',
- timeout => 0,
- }
- # A resource chain to ensure the upgrade ordering we want:
- # 1) Upgrade all packages via exec.
- # Note: The Package Puppet resources can be managed after or before package-upgrade,
- # it does not matter. what we need to make sure is that they'll notify their
- # respective services (if they have ~> in their manifests or here with the ->)
- # for the other packages, they'll be upgraded before any Service notify.
- # This approach prevents from Puppet dependencies cycle.
- # 2) This upgrade will be run before any Service notified & managed by Puppet.
- # Note: For example, during the Puppet catalog, configuration will change for most of
- # the services so the Services will be likely restarted after the package upgrade.
- Exec['package-upgrade'] -> Service <| |>
-
+ # Running the package upgrade before managing Services in the main stage.
+ # So we're sure that services will be able to restart with the new version
+ # of the package.
+ ensure_resource('class', 'tripleo::packages::upgrades', {
+ 'stage' => 'setup',
+ })
}
}
diff --git a/manifests/packages/upgrades.pp b/manifests/packages/upgrades.pp
new file mode 100644
index 0000000..a6ca1c8
--- /dev/null
+++ b/manifests/packages/upgrades.pp
@@ -0,0 +1,43 @@
+# Copyright 2016 Red Hat, Inc.
+# All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License. You may obtain
+# a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations
+# under the License.
+
+# == Class: tripleo::packages::upgrades
+#
+# Upgrade packages using yum.
+#
+class tripleo::packages::upgrades {
+
+ # required for stages
+ include ::stdlib
+
+ case $::osfamily {
+ 'RedHat': {
+ $pkg_upgrade_cmd = 'yum -y update'
+ }
+ default: {
+ fail('Please specify a package upgrade command for distribution.')
+ }
+ }
+
+ # Running the package upgrade before managing Services in the main stage.
+ # So we're sure that services will be able to restart with the new version
+ # of the package.
+ ensure_resource('exec', 'package-upgrade', {
+ 'command' => $pkg_upgrade_cmd,
+ 'path' => '/usr/bin',
+ 'timeout' => 0,
+ })
+
+}
diff --git a/manifests/profile/base/ceilometer/collector.pp b/manifests/profile/base/ceilometer/collector.pp
index 443873f..3c0a361 100644
--- a/manifests/profile/base/ceilometer/collector.pp
+++ b/manifests/profile/base/ceilometer/collector.pp
@@ -60,10 +60,6 @@ class tripleo::profile::base::ceilometer::collector (
include ::tripleo::profile::base::ceilometer
- if $step >= 3 and $sync_db {
- include ::ceilometer::db::sync
- }
-
if $step >= 4 or ($step >= 3 and $sync_db) {
if downcase($ceilometer_backend) == 'mongodb' {
if empty($mongodb_node_ips) {
@@ -88,10 +84,13 @@ class tripleo::profile::base::ceilometer::collector (
$ceilometer_mongodb_conn_string = "mongodb://${mongo_node_string}/ceilometer?replicaSet=${mongodb_replset}"
class { '::ceilometer::db' :
+ sync_db => $sync_db,
database_connection => $ceilometer_mongodb_conn_string,
}
} else {
- include ::ceilometer::db
+ class { '::ceilometer::db' :
+ sync_db => $sync_db,
+ }
}
include ::ceilometer::collector
include ::ceilometer::dispatcher::gnocchi
diff --git a/manifests/profile/base/cinder/volume/eqlx.pp b/manifests/profile/base/cinder/volume/eqlx.pp
index 2399459..fe24f4b 100644
--- a/manifests/profile/base/cinder/volume/eqlx.pp
+++ b/manifests/profile/base/cinder/volume/eqlx.pp
@@ -43,7 +43,7 @@ class tripleo::profile::base::cinder::volume::eqlx (
eqlx_pool => hiera('cinder::backend::eqlx::eqlx_pool', undef),
eqlx_use_chap => hiera('cinder::backend::eqlx::eqlx_use_chap', undef),
eqlx_chap_login => hiera('cinder::backend::eqlx::eqlx_chap_login', undef),
- eqlx_chap_password => hiera('cinder::backend::eqlx::eqlx_san_password', undef),
+ eqlx_chap_password => hiera('cinder::backend::eqlx::eqlx_chap_password', undef),
}
}
diff --git a/manifests/profile/base/haproxy.pp b/manifests/profile/base/haproxy.pp
index e018f36..afeb8c0 100644
--- a/manifests/profile/base/haproxy.pp
+++ b/manifests/profile/base/haproxy.pp
@@ -84,7 +84,9 @@ class tripleo::profile::base::haproxy (
Tripleo::Certmonger::Haproxy<||> ~> Haproxy::Listen<||>
}
- include ::tripleo::haproxy
+ class {'::tripleo::haproxy':
+ internal_certificates_specs => $certificates_specs,
+ }
unless hiera('tripleo::haproxy::haproxy_service_manage', true) {
# Reload HAProxy configuration if the haproxy class has refreshed or any
diff --git a/manifests/profile/base/heat.pp b/manifests/profile/base/heat.pp
index 027ab7e..2035a4f 100644
--- a/manifests/profile/base/heat.pp
+++ b/manifests/profile/base/heat.pp
@@ -46,7 +46,7 @@ class tripleo::profile::base::heat (
$step = hiera('step'),
$rabbit_hosts = hiera('rabbitmq_node_ips', undef),
) {
- # Domain resources will be created at step5 on the bootstrap_node so we
+ # Domain resources will be created at step5 on the node running keystone.pp
# configure heat.conf at step3 and 4 but actually create the domain later.
if $step == 3 or $step == 4 {
class { '::heat::keystone::domain':
@@ -69,20 +69,6 @@ class tripleo::profile::base::heat (
if $manage_db_purge {
include ::heat::cron::purge_deleted
}
- if $bootstrap_node == $::hostname {
- # Class ::heat::keystone::domain has to run on bootstrap node
- # because it creates DB entities via API calls.
- include ::heat::keystone::domain
-
- Class['::keystone::roles::admin'] -> Class['::heat::keystone::domain']
- } else {
- # On non-bootstrap node we don't need to create Keystone resources again
- class { '::heat::keystone::domain':
- manage_domain => false,
- manage_user => false,
- manage_role => false,
- }
- }
}
}
diff --git a/manifests/profile/base/keystone.pp b/manifests/profile/base/keystone.pp
index d515f8f..846296e 100644
--- a/manifests/profile/base/keystone.pp
+++ b/manifests/profile/base/keystone.pp
@@ -45,10 +45,12 @@ class tripleo::profile::base::keystone (
$sync_db = true
$manage_roles = true
$manage_endpoint = true
+ $manage_domain = true
} else {
$sync_db = false
$manage_roles = false
$manage_endpoint = false
+ $manage_domain = false
}
if $step >= 4 or ( $step >= 3 and $sync_db ) {
@@ -76,6 +78,27 @@ class tripleo::profile::base::keystone (
include ::keystone::cron::token_flush
}
+ if $step >= 5 and $manage_domain {
+ if hiera('heat_engine_enabled', false) {
+ # if Heat and Keystone are collocated, so we want to
+ # both configure heat.conf and create Keystone resources.
+ # note: domain_password is given via Hiera.
+ if defined(Class['::tripleo::profile::base::heat']) {
+ include ::heat::keystone::domain
+ } else {
+ # if Heat and Keystone are not collocated, we want Puppet
+ # to only create Keystone resources on the Keystone node
+ # but not try to configure Heat, to avoid leaking the password.
+ class { '::heat::keystone::domain':
+ domain_name => $::os_service_default,
+ domain_admin => $::os_service_default,
+ domain_password => $::os_service_default,
+ }
+ }
+ Class['::keystone::roles::admin'] -> Class['::heat::keystone::domain']
+ }
+ }
+
if $step >= 5 and $manage_endpoint{
if hiera('aodh_api_enabled', false) {
include ::aodh::keystone::auth
diff --git a/manifests/profile/base/nova/api.pp b/manifests/profile/base/nova/api.pp
index 3c472c5..ca2f7dd 100644
--- a/manifests/profile/base/nova/api.pp
+++ b/manifests/profile/base/nova/api.pp
@@ -38,10 +38,22 @@ class tripleo::profile::base::nova::api (
include ::tripleo::profile::base::nova
if $step >= 4 or ($step >= 3 and $sync_db) {
+
+ if hiera('nova::use_ipv6', false) {
+ $memcache_servers = suffix(any2array(normalize_ip_for_uri(hiera('memcached_node_ips_v6'))), ':11211')
+ } else {
+ $memcache_servers = suffix(any2array(normalize_ip_for_uri(hiera('memcached_node_ips'))), ':11211')
+ }
+
+ class { '::nova::keystone::authtoken':
+ memcached_servers => $memcache_servers
+ }
+
class { '::nova::api':
sync_db => $sync_db,
sync_db_api => $sync_db,
}
+ include ::nova::wsgi::apache
include ::nova::network::neutron
}
diff --git a/manifests/profile/base/pacemaker.pp b/manifests/profile/base/pacemaker.pp
index 43edfaf..cc5fd8a 100644
--- a/manifests/profile/base/pacemaker.pp
+++ b/manifests/profile/base/pacemaker.pp
@@ -68,10 +68,6 @@ class tripleo::profile::base::pacemaker (
# enable stonith after all fencing devices have been created
Class['tripleo::fencing'] -> Class['pacemaker::stonith']
}
-
- file { '/var/lib/tripleo/pacemaker-restarts':
- ensure => directory,
- } ~> Tripleo::Pacemaker::Resource_restart_flag<||>
}
if $step >= 2 {
diff --git a/manifests/profile/base/rabbitmq.pp b/manifests/profile/base/rabbitmq.pp
index 2fd2347..b521999 100644
--- a/manifests/profile/base/rabbitmq.pp
+++ b/manifests/profile/base/rabbitmq.pp
@@ -54,7 +54,8 @@ class tripleo::profile::base::rabbitmq (
# IPv6 environment, necessary for RabbitMQ.
if $ipv6 {
$rabbit_env = merge($environment, {
- 'RABBITMQ_SERVER_START_ARGS' => '"-proto_dist inet6_tcp"'
+ 'RABBITMQ_SERVER_START_ARGS' => '"-proto_dist inet6_tcp"',
+ 'RABBITMQ_CTL_ERL_ARGS' => '"-proto_dist inet6_tcp"'
})
} else {
$rabbit_env = $environment
diff --git a/manifests/profile/base/swift/proxy.pp b/manifests/profile/base/swift/proxy.pp
index 321dccd..feabf86 100644
--- a/manifests/profile/base/swift/proxy.pp
+++ b/manifests/profile/base/swift/proxy.pp
@@ -54,5 +54,6 @@ class tripleo::profile::base::swift::proxy (
include ::swift::proxy::formpost
include ::swift::proxy::bulk
include ::swift::proxy::ceilometer
+ include ::swift::proxy::versioned_writes
}
}
diff --git a/manifests/profile/base/swift/ringbuilder.pp b/manifests/profile/base/swift/ringbuilder.pp
index c77d744..7e5fc74 100644
--- a/manifests/profile/base/swift/ringbuilder.pp
+++ b/manifests/profile/base/swift/ringbuilder.pp
@@ -54,6 +54,15 @@
# (Optional) list of ip addresses for nodes running swift_storage service
# Defaults to hiera('swift_storage_node_ips') or an empty list
#
+# [*part_power*]
+# (Optional) The total number of partitions that should exist in the ring.
+# This is expressed as a power of 2.
+# Defaults to undef
+#
+# [*min_part_hours*]
+# Minimum amount of time before partitions can be moved.
+# Defaults to undef
+#
class tripleo::profile::base::swift::ringbuilder (
$replicas,
$build_ring = true,
@@ -63,6 +72,8 @@ class tripleo::profile::base::swift::ringbuilder (
$raw_disk_prefix = 'r1z1-',
$raw_disks = [],
$swift_storage_node_ips = hiera('swift_storage_node_ips', []),
+ $part_power = undef,
+ $min_part_hours = undef,
) {
if $step >= 2 {
# pre-install swift here so we can build rings
@@ -81,7 +92,9 @@ class tripleo::profile::base::swift::ringbuilder (
# create local rings
swift::ringbuilder::create{ ['object', 'account', 'container']:
+ part_power => $part_power,
replicas => min(count($device_array), $replicas),
+ min_part_hours => $min_part_hours,
} ->
# add all other devices
diff --git a/manifests/profile/pacemaker/database/redis.pp b/manifests/profile/pacemaker/database/redis.pp
index e081516..261df30 100644
--- a/manifests/profile/pacemaker/database/redis.pp
+++ b/manifests/profile/pacemaker/database/redis.pp
@@ -60,6 +60,7 @@ class tripleo::profile::pacemaker::database::redis (
master_params => '',
meta_params => 'notify=true ordered=true interleave=true',
resource_params => 'wait_last_known_master=true',
+ op_params => 'start timeout=200s stop timeout=200s',
require => Class['::redis'],
}
}
diff --git a/manifests/profile/pacemaker/manila.pp b/manifests/profile/pacemaker/manila.pp
index 5cbeb7f..8d6c2a7 100644
--- a/manifests/profile/pacemaker/manila.pp
+++ b/manifests/profile/pacemaker/manila.pp
@@ -18,6 +18,18 @@
#
# === Parameters
#
+# [*backend_generic_enabled*]
+# (Optional) Whether or not the generic backend is enabled
+# Defaults to hiera('manila_backend_generic_enabled', false)
+#
+# [*backend_netapp_enabled*]
+# (Optional) Whether or not the netapp backend is enabled
+# Defaults to hiera('manila_backend_netapp_enabled', false)
+#
+# [*backend_cephfs_enabled*]
+# (Optional) Whether or not the cephfs backend is enabled
+# Defaults to hiera('manila_backend_cephfs_enabled', false)
+#
# [*bootstrap_node*]
# (Optional) The hostname of the node responsible for bootstrapping tasks
# Defaults to hiera('bootstrap_nodeid')
@@ -28,8 +40,11 @@
# Defaults to hiera('step')
#
class tripleo::profile::pacemaker::manila (
- $bootstrap_node = hiera('bootstrap_nodeid'),
- $step = hiera('step'),
+ $backend_generic_enabled = hiera('manila_backend_generic_enabled', false),
+ $backend_netapp_enabled = hiera('manila_backend_netapp_enabled', false),
+ $backend_cephfs_enabled = hiera('manila_backend_cephfs_enabled', false),
+ $bootstrap_node = hiera('bootstrap_nodeid'),
+ $step = hiera('step'),
) {
if $::hostname == downcase($bootstrap_node) {
$pacemaker_master = true
@@ -52,8 +67,7 @@ class tripleo::profile::pacemaker::manila (
if $step >= 4 {
# manila generic:
- $manila_generic_enable = hiera('manila_generic_enable_backend', false)
- if $manila_generic_enable {
+ if $backend_generic_enabled {
$manila_generic_backend = hiera('manila::backend::generic::title')
manila::backend::generic { $manila_generic_backend :
driver_handles_share_servers => hiera('manila::backend::generic::driver_handles_share_servers', true),
@@ -81,8 +95,7 @@ class tripleo::profile::pacemaker::manila (
}
# manila cephfsnative:
- $manila_cephfsnative_enable = hiera('manila::backend::cephfsnative::enable_backend', false)
- if $manila_cephfsnative_enable {
+ if $backend_cephfs_enabled {
$manila_cephfsnative_backend = hiera('manila::backend::cephfsnative::title')
manila::backend::cephfsnative { $manila_cephfsnative_backend :
driver_handles_share_servers => hiera('manila::backend::cephfsnative::driver_handles_share_servers', false),
@@ -95,8 +108,7 @@ class tripleo::profile::pacemaker::manila (
}
# manila netapp:
- $manila_netapp_enable = hiera('manila_netapp_enable_backend', false)
- if $manila_netapp_enable {
+ if $backend_netapp_enabled {
$manila_netapp_backend = hiera('manila::backend::netapp::title')
manila::backend::netapp { $manila_netapp_backend :
driver_handles_share_servers => hiera('manila::backend::netapp::driver_handles_share_servers', true),
diff --git a/manifests/profile/pacemaker/rabbitmq.pp b/manifests/profile/pacemaker/rabbitmq.pp
index 8d5f9d0..dba01e3 100644
--- a/manifests/profile/pacemaker/rabbitmq.pp
+++ b/manifests/profile/pacemaker/rabbitmq.pp
@@ -86,6 +86,7 @@ class tripleo::profile::pacemaker::rabbitmq (
resource_params => "set_policy='ha-all ^(?!amq\\.).* {\"ha-mode\":\"exactly\",\"ha-params\":${nr_ha_queues}}'",
clone_params => 'ordered=true interleave=true',
meta_params => 'notify=true',
+ op_params => 'start timeout=200s stop timeout=200s',
require => Class['::rabbitmq'],
}
}