diff options
Diffstat (limited to 'manifests')
48 files changed, 1046 insertions, 198 deletions
diff --git a/manifests/certmonger.pp b/manifests/certmonger.pp new file mode 100644 index 0000000..e5f5e04 --- /dev/null +++ b/manifests/certmonger.pp @@ -0,0 +1,37 @@ +# Copyright 2016 Red Hat, Inc. +# +# Licensed under the Apache License, Version 2.0 (the "License"); you may +# not use this file except in compliance with the License. You may obtain +# a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT +# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the +# License for the specific language governing permissions and limitations +# under the License. +# +# == Class: tripleo::certmonger +# +# Sets some default defaults necessary for the global certmonger setup. +# +# === Parameters +# +# [*global_ca*] +# The certmonger nickname for the CA that will be used. +# +class tripleo::certmonger ( + $global_ca +){ + include ::certmonger + + Certmonger_certificate { + ca => $global_ca, + ensure => 'present', + certbackend => 'FILE', + keybackend => 'FILE', + wait => true, + require => Class['::certmonger'], + } +} diff --git a/manifests/certmonger/ca/local.pp b/manifests/certmonger/ca/local.pp new file mode 100644 index 0000000..ea08dec --- /dev/null +++ b/manifests/certmonger/ca/local.pp @@ -0,0 +1,37 @@ +# Copyright 2016 Red Hat, Inc. +# +# Licensed under the Apache License, Version 2.0 (the "License"); you may +# not use this file except in compliance with the License. You may obtain +# a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT +# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the +# License for the specific language governing permissions and limitations +# under the License. +# +# == Class: tripleo::certmonger::ca::local +# +# Does the necessary action to extract and trust certmonger's local CA. +# +# === Parameters: +# +# [*ca_pem*] +# (optional) PEM file that will contain the local CA certificate. +# Defaults to '/etc/pki/ca-trust/source/anchors/cm-local-ca.pem' +# +class tripleo::certmonger::ca::local( + $ca_pem = '/etc/pki/ca-trust/source/anchors/cm-local-ca.pem', +){ + $ca_pkcs12 = '/var/lib/certmonger/local/creds' + $extract_cmd = "openssl pkcs12 -in ${ca_pkcs12} -out ${ca_pem} -nokeys -nodes -passin pass:''" + $trust_ca_cmd = 'update-ca-trust extract' + exec { 'extract-and-trust-ca': + command => "${extract_cmd} && ${trust_ca_cmd}", + path => '/usr/bin', + creates => $ca_pem, + require => Package['certmonger'], + } +} diff --git a/manifests/certmonger/haproxy.pp b/manifests/certmonger/haproxy.pp new file mode 100644 index 0000000..2b738e6 --- /dev/null +++ b/manifests/certmonger/haproxy.pp @@ -0,0 +1,75 @@ +# Copyright 2016 Red Hat, Inc. +# +# Licensed under the Apache License, Version 2.0 (the "License"); you may +# not use this file except in compliance with the License. You may obtain +# a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT +# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the +# License for the specific language governing permissions and limitations +# under the License. +# +# == Resource: tripleo::certmonger::haproxy +# +# Request a certificate for the HAProxy service and does the necessary logic to +# get it into a format that the service understands. +# +# === Parameters +# +# [*service_pem*] +# The file in PEM format that the HAProxy service will use as a certificate. +# +# [*service_certificate*] +# The certificate file that certmonger will be tracking. +# +# [*service_key*] +# The key file that certmonger will use for the certificate. +# +# [*hostname*] +# The hostname that certmonger will use as the common name for the +# certificate. +# +# [*postsave_cmd*] +# The post-save-command that certmonger will use once it renews the +# certificate. +# +# [*principal*] +# The haproxy service principal that is set for HAProxy in kerberos. +# +define tripleo::certmonger::haproxy ( + $service_pem, + $service_certificate, + $service_key, + $hostname, + $postsave_cmd, + $principal = undef, +){ + certmonger_certificate { "${title}-cert": + hostname => $hostname, + certfile => $service_certificate, + keyfile => $service_key, + postsave_cmd => $postsave_cmd, + principal => $principal, + } + concat { $service_pem : + ensure => present, + mode => '0640', + owner => 'haproxy', + group => 'haproxy', + } + concat::fragment { "${title}-cert-fragment": + target => $service_pem, + source => $service_certificate, + order => '01', + require => Certmonger_certificate["${title}-cert"], + } + concat::fragment { "${title}-key-fragment": + target => $service_pem, + source => $service_key, + order => 10, + require => Certmonger_certificate["${title}-cert"], + } +} diff --git a/manifests/haproxy.pp b/manifests/haproxy.pp index 33185dc..407fbb7 100644 --- a/manifests/haproxy.pp +++ b/manifests/haproxy.pp @@ -169,6 +169,10 @@ # (optional) Enable or not Gnocchi API binding # Defaults to false # +# [*mistral*] +# (optional) Enable or not Mistral API binding +# Defaults to false +# # [*swift_proxy_server*] # (optional) Enable or not Swift API binding # Defaults to false @@ -236,6 +240,8 @@ # 'glance_registry_port' (Defaults to 9191) # 'gnocchi_api_port' (Defaults to 8041) # 'gnocchi_api_ssl_port' (Defaults to 13041) +# 'mistral_api_port' (Defaults to 8989) +# 'mistral_api_ssl_port' (Defaults to 13989) # 'heat_api_port' (Defaults to 8004) # 'heat_api_ssl_port' (Defaults to 13004) # 'heat_cfn_port' (Defaults to 8000) @@ -302,6 +308,7 @@ class tripleo::haproxy ( $ceilometer = false, $aodh = false, $gnocchi = false, + $mistral = false, $swift_proxy_server = false, $heat_api = false, $heat_cloudwatch = false, @@ -329,6 +336,8 @@ class tripleo::haproxy ( glance_registry_port => 9191, gnocchi_api_port => 8041, gnocchi_api_ssl_port => 13041, + mistral_api_port => 8989, + mistral_api_ssl_port => 13989, heat_api_port => 8004, heat_api_ssl_port => 13004, heat_cfn_port => 8000, @@ -671,6 +680,17 @@ class tripleo::haproxy ( } } + if $mistral { + ::tripleo::haproxy::endpoint { 'mistral': + public_virtual_ip => $public_virtual_ip, + internal_ip => hiera('mistral_api_vip', $controller_virtual_ip), + service_port => $ports[mistral_api_port], + ip_addresses => hiera('mistral_api_node_ips', $controller_hosts_real), + server_names => $controller_hosts_names_real, + public_ssl_port => $ports[mistral_api_ssl_port], + } + } + if $swift_proxy_server { ::tripleo::haproxy::endpoint { 'swift_proxy_server': public_virtual_ip => $public_virtual_ip, diff --git a/manifests/haproxy/endpoint.pp b/manifests/haproxy/endpoint.pp index 94bfcff..ac6cb6c 100644 --- a/manifests/haproxy/endpoint.pp +++ b/manifests/haproxy/endpoint.pp @@ -117,4 +117,16 @@ define tripleo::haproxy::endpoint ( server_names => $server_names, options => $member_options, } + if hiera('manage_firewall', true) { + include ::tripleo::firewall + $firewall_rules = { + "100 ${name}_haproxy" => { + 'dport' => $service_port, + }, + "100 ${name}_haproxy_ssl" => { + 'dport' => $public_ssl_port, + }, + } + create_resources('tripleo::firewall::rule', $firewall_rules) + } } diff --git a/manifests/profile/base/ceilometer/collector.pp b/manifests/profile/base/ceilometer/collector.pp index c294e56..b0a986f 100644 --- a/manifests/profile/base/ceilometer/collector.pp +++ b/manifests/profile/base/ceilometer/collector.pp @@ -18,20 +18,24 @@ # # === Parameters # +# [*bootstrap_node*] +# (Optional) The hostname of the node responsible for bootstrapping tasks +# Defaults to hiera('bootstrap_nodeid') +# # [*step*] # (Optional) The current step in deployment. See tripleo-heat-templates # for more details. # Defaults to hiera('step') -# -# [*sync_db*] -# (Optional) Whether to run db sync -# Defaults to true -# class tripleo::profile::base::ceilometer::collector ( - $step = hiera('step'), - $sync_db = true, + $bootstrap_node = hiera('bootstrap_nodeid', undef), + $step = hiera('step'), ) { + if $::hostname == downcase($bootstrap_node) { + $sync_db = true + } else { + $sync_db = false + } $ceilometer_backend = downcase(hiera('ceilometer_backend', 'mongodb')) # MongoDB diff --git a/manifests/profile/base/cinder/api.pp b/manifests/profile/base/cinder/api.pp index a2da25f..ad970f6 100644 --- a/manifests/profile/base/cinder/api.pp +++ b/manifests/profile/base/cinder/api.pp @@ -18,19 +18,24 @@ # # === Parameters # -# [*sync_db*] -# (Optional) Whether to run db sync -# Defaults to true +# [*bootstrap_node*] +# (Optional) The hostname of the node responsible for bootstrapping tasks +# Defaults to hiera('bootstrap_nodeid') # # [*step*] # (Optional) The current step in deployment. See tripleo-heat-templates # for more details. # Defaults to hiera('step') -# + class tripleo::profile::base::cinder::api ( - $sync_db = true, - $step = hiera('step'), + $bootstrap_node = hiera('bootstrap_nodeid', undef), + $step = hiera('step'), ) { + if $::hostname == downcase($bootstrap_node) { + $sync_db = true + } else { + $sync_db = false + } class { '::tripleo::profile::base::cinder': pacemaker_master => $sync_db, diff --git a/manifests/profile/base/database/mysql.pp b/manifests/profile/base/database/mysql.pp new file mode 100644 index 0000000..27df6e4 --- /dev/null +++ b/manifests/profile/base/database/mysql.pp @@ -0,0 +1,85 @@ +# Copyright 2016 Red Hat, Inc. +# +# Licensed under the Apache License, Version 2.0 (the "License"); you may +# not use this file except in compliance with the License. You may obtain +# a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT +# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the +# License for the specific language governing permissions and limitations +# under the License. +# +# == Class: tripleo::profile::base::database::mysql +# +# MySQL profile for tripleo +# +# === Parameters +# +# [*step*] +# (Optional) The current step in deployment. See tripleo-heat-templates +# for more details. +# Defaults to hiera('step') +# +# [*mysql_server_options*] +# (Optional) Extras options to deploy MySQL. Useful when deploying Galera cluster. +# Should be an hash. +# Defaults to {} +# +# [*manage_resources*] +# (Optional) Whether or not manage root user, root my.cnf, and service. +# Defaults to true +# +# [*remove_default_accounts*] +# (Optional) Whether or not remove default MySQL accounts. +# Defaults to true +# +class tripleo::profile::base::database::mysql ( + $step = hiera('step'), + $mysql_server_options = {}, + $manage_resources = true, + $remove_default_accounts = true, +) { + + validate_hash($mysql_server_options) + + # non-ha scenario + if $manage_resources { + $mysql_step = 2 + } else { + # ha scenario + $mysql_step = 1 + } + if $step >= $mysql_step { + if str2bool(hiera('enable_galera', true)) { + $mysql_config_file = '/etc/my.cnf.d/galera.cnf' + } else { + $mysql_config_file = '/etc/my.cnf.d/server.cnf' + } + # TODO Galara + # FIXME: due to https://bugzilla.redhat.com/show_bug.cgi?id=1298671 we + # set bind-address to a hostname instead of an ip address; to move Mysql + # from internal_api on another network we'll have to customize both + # MysqlNetwork and ControllerHostnameResolveNetwork in ServiceNetMap + $mysql_server_default = { + 'mysqld' => { + 'bind-address' => $::hostname, + 'max_connections' => hiera('mysql_max_connections'), + 'open_files_limit' => '-1', + } + } + $mysql_server_options_real = deep_merge($mysql_server_default, $mysql_server_options) + class { '::mysql::server': + config_file => $mysql_config_file, + override_options => $mysql_server_options_real, + create_root_user => $manage_resources, + create_root_my_cnf => $manage_resources, + service_manage => $manage_resources, + service_enabled => $manage_resources, + remove_default_accounts => $remove_default_accounts, + } + } + +} diff --git a/manifests/profile/base/glance/registry.pp b/manifests/profile/base/glance/registry.pp index 774f646..ce89d12 100644 --- a/manifests/profile/base/glance/registry.pp +++ b/manifests/profile/base/glance/registry.pp @@ -18,9 +18,9 @@ # # === Parameters # -# [*sync_db*] -# (Optional) Whether to run db sync -# Defaults to true +# [*bootstrap_node*] +# (Optional) The hostname of the node responsible for bootstrapping tasks +# Defaults to hiera('bootstrap_nodeid') # # [*step*] # (Optional) The current step in deployment. See tripleo-heat-templates @@ -30,12 +30,17 @@ # [*glance_backend*] # (Optional) Glance backend(s) to use. # Defaults to downcase(hiera('glance_backend', 'swift')) -# + class tripleo::profile::base::glance::registry ( - $sync_db = true, + $bootstrap_node = hiera('bootstrap_nodeid', undef), $step = hiera('step'), $glance_backend = downcase(hiera('glance_backend', 'swift')), ) { + if $::hostname == downcase($bootstrap_node) { + $sync_db = true + } else { + $sync_db = false + } if $step >= 3 and $sync_db { include ::glance::db::mysql diff --git a/manifests/profile/base/gnocchi/api.pp b/manifests/profile/base/gnocchi/api.pp index d415ee9..870a9bb 100644 --- a/manifests/profile/base/gnocchi/api.pp +++ b/manifests/profile/base/gnocchi/api.pp @@ -22,20 +22,25 @@ # (Optional) Gnocchi backend string file, swift or rbd # Defaults to swift # +# [*bootstrap_node*] +# (Optional) The hostname of the node responsible for bootstrapping tasks +# Defaults to hiera('bootstrap_nodeid') +# # [*step*] # (Optional) The current step in deployment. See tripleo-heat-templates # for more details. # Defaults to hiera('step') -# -# [*sync_db*] -# (Optional) Whether to run db sync -# Defaults to undef class tripleo::profile::base::gnocchi::api ( $gnocchi_backend = downcase(hiera('gnocchi_backend', 'swift')), + $bootstrap_node = hiera('bootstrap_nodeid', undef), $step = hiera('step'), - $sync_db = true, ) { + if $::hostname == downcase($bootstrap_node) { + $sync_db = true + } else { + $sync_db = false + } include ::tripleo::profile::base::gnocchi diff --git a/manifests/profile/base/haproxy.pp b/manifests/profile/base/haproxy.pp index 31a5415..8e73ce3 100644 --- a/manifests/profile/base/haproxy.pp +++ b/manifests/profile/base/haproxy.pp @@ -27,13 +27,59 @@ # (Optional) Whether or not loadbalancer is enabled. # Defaults to hiera('enable_load_balancer', true). # +# [*generate_service_certificates*] +# (Optional) Whether or not certmonger will generate certificates for +# HAProxy. This could be as many as specified by the $certificates_specs +# variable. +# Note that this doesn't configure the certificates in haproxy, it merely +# creates the certificates. +# Defaults to hiera('generate_service_certificate', false). +# +# [*certmonger_ca*] +# (Optional) The CA that certmonger will use to generate the certificates. +# Defaults to hiera('certmonger_ca', 'local'). +# +# [*certificates_specs*] +# (Optional) The specifications to give to certmonger for the certificate(s) +# it will create. +# Example with hiera: +# tripleo::profile::base::haproxy::certificates_specs: +# undercloud-haproxy-public-cert: +# service_pem: <haproxy ready pem file> +# service_certificate: <service certificate path> +# service_key: <service key path> +# hostname: <undercloud fqdn> +# postsave_cmd: <command to update certificate on resubmit> +# principal: "haproxy/<undercloud fqdn>" +# Defaults to {}. +# class tripleo::profile::base::haproxy ( - $enable_load_balancer = hiera('enable_load_balancer', true), - $step = hiera('step'), + $enable_load_balancer = hiera('enable_load_balancer', true), + $step = hiera('step'), + $generate_service_certificates = hiera('generate_service_certificates', false), + $certmonger_ca = hiera('certmonger_ca', 'local'), + $certificates_specs = {}, ) { if $step >= 1 { if $enable_load_balancer { + if str2bool($generate_service_certificates) { + include ::certmonger + # This is only needed for certmonger's local CA. For any other CA this + # operation (trusting the CA) should be done by the deployer. + if $certmonger_ca == 'local' { + include ::tripleo::certmonger::ca::local + } + + Certmonger_certificate { + ca => $certmonger_ca, + ensure => 'present', + wait => true, + require => Class['::certmonger'], + } + create_resources('::tripleo::certmonger::haproxy', $certificates_specs) + } + include ::tripleo::haproxy } } diff --git a/manifests/profile/base/heat.pp b/manifests/profile/base/heat.pp index 0fc30d8..1311f20 100644 --- a/manifests/profile/base/heat.pp +++ b/manifests/profile/base/heat.pp @@ -42,6 +42,16 @@ class tripleo::profile::base::heat ( $manage_db_purge = hiera('heat_enable_db_purge', true), ) { + # Domain resources will be created at step5 on the pacemaker_master so we + # configure heat.conf at step3 and 4 but actually create the domain later. + if $step == 3 or $step == 4 { + class { '::heat::keystone::domain': + manage_domain => false, + manage_user => false, + manage_role => false, + } + } + if $step >= 4 { class { '::heat' : notification_driver => $notification_driver, diff --git a/manifests/profile/base/heat/engine.pp b/manifests/profile/base/heat/engine.pp index b48837c..1fd627f 100644 --- a/manifests/profile/base/heat/engine.pp +++ b/manifests/profile/base/heat/engine.pp @@ -18,19 +18,24 @@ # # === Parameters # -# [*sync_db*] -# (Optional) Whether to run db sync -# Defaults to undef +# [*bootstrap_node*] +# (Optional) The hostname of the node responsible for bootstrapping tasks +# Defaults to hiera('bootstrap_nodeid') # # [*step*] # (Optional) The current step in deployment. See tripleo-heat-templates # for more details. # Defaults to hiera('step') -# + class tripleo::profile::base::heat::engine ( - $sync_db = true, + $bootstrap_node = hiera('bootstrap_nodeid', undef), $step = hiera('step'), ) { + if $::hostname == downcase($bootstrap_node) { + $sync_db = true + } else { + $sync_db = false + } if $step >= 3 and $sync_db { include ::heat::db::mysql diff --git a/manifests/profile/base/ironic.pp b/manifests/profile/base/ironic.pp index 139654b..dd30dd7 100644 --- a/manifests/profile/base/ironic.pp +++ b/manifests/profile/base/ironic.pp @@ -18,18 +18,23 @@ # # === Parameters # +# [*bootstrap_node*] +# (Optional) The hostname of the node responsible for bootstrapping tasks +# Defaults to hiera('bootstrap_nodeid') +# # [*step*] # (Optional) The current step of the deployment # Defaults to hiera('step') -# -# [*sync_db*] -# (Optional) Whether to run db sync -# Defaults to true -# + class tripleo::profile::base::ironic ( - $step = hiera('step'), - $sync_db = true, + $bootstrap_node = hiera('bootstrap_nodeid', undef), + $step = hiera('step'), ) { + if $::hostname == downcase($bootstrap_node) { + $sync_db = true + } else { + $sync_db = false + } if $step >= 3 { include ::ironic diff --git a/manifests/profile/base/keystone.pp b/manifests/profile/base/keystone.pp index 706b78f..9617c11 100644 --- a/manifests/profile/base/keystone.pp +++ b/manifests/profile/base/keystone.pp @@ -18,34 +18,33 @@ # # === Parameters # -# [*sync_db*] -# (Optional) Whether to run db sync -# Defaults to true -# -# [*manage_roles*] -# (Optional) whether to create keystone admin role -# Defaults to true -# -# [*manage_endpoint*] -# (Optional) Whether to create keystone endpoints -# Defaults to true -# # [*manage_db_purge*] # (Optional) Whether keystone token flushing should be enabled # Defaults to hiera('keystone_enable_db_purge', true) # +# [*bootstrap_node*] +# (Optional) The hostname of the node responsible for bootstrapping tasks +# Defaults to hiera('bootstrap_nodeid') +# # [*step*] # (Optional) The current step in deployment. See tripleo-heat-templates # for more details. # Defaults to hiera('step') -# + class tripleo::profile::base::keystone ( - $sync_db = true, - $manage_roles = true, - $manage_endpoint = true, $manage_db_purge = hiera('keystone_enable_db_purge', true), + $bootstrap_node = hiera('bootstrap_nodeid', undef), $step = hiera('step'), ) { + if $::hostname == downcase($bootstrap_node) { + $sync_db = true + $manage_roles = true + $manage_endpoint = true + } else { + $sync_db = false + $manage_roles = false + $manage_endpoint = false + } if $step >= 3 and $sync_db { include ::keystone::db::mysql diff --git a/manifests/profile/base/manila/scheduler.pp b/manifests/profile/base/manila/scheduler.pp index b6d7593..3d39c4a 100644 --- a/manifests/profile/base/manila/scheduler.pp +++ b/manifests/profile/base/manila/scheduler.pp @@ -18,19 +18,24 @@ # # === Parameters # +# [*bootstrap_node*] +# (Optional) The hostname of the node responsible for bootstrapping tasks +# Defaults to hiera('bootstrap_nodeid') +# # [*step*] # (Optional) The current step in deployment. See tripleo-heat-templates # for more details. # Defaults to hiera('step') -# -# [*sync_db*] -# (Optiona) Whether to run db sync. -# Defaults to true. -# + class tripleo::profile::base::manila::scheduler ( + $bootstrap_node = hiera('bootstrap_nodeid', undef), $step = hiera('step'), - $sync_db = true, ) { + if $::hostname == downcase($bootstrap_node) { + $sync_db = true + } else { + $sync_db = false + } if $step >= 3 and $sync_db { include ::manila::db::mysql diff --git a/manifests/profile/base/mistral.pp b/manifests/profile/base/mistral.pp new file mode 100644 index 0000000..42507b9 --- /dev/null +++ b/manifests/profile/base/mistral.pp @@ -0,0 +1,39 @@ +# Copyright 2016 Red Hat, Inc. +# +# Licensed under the Apache License, Version 2.0 (the "License"); you may +# not use this file except in compliance with the License. You may obtain +# a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT +# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the +# License for the specific language governing permissions and limitations +# under the License. +# +# == Class: tripleo::profile::base::mistral +# +# Mistral profile for tripleo +# +# === Parameters +# +# [*sync_db*] +# (Optional) Whether to run db sync +# Defaults to true +# +# [*step*] +# (Optional) The current step in deployment. See tripleo-heat-templates +# for more details. +# Defaults to hiera('step') +# +class tripleo::profile::base::mistral ( + $sync_db = true, + $step = hiera('step'), +) { + + if $step >= 3 { + include ::mistral + include ::mistral::config + } +} diff --git a/manifests/profile/base/mistral/api.pp b/manifests/profile/base/mistral/api.pp new file mode 100644 index 0000000..b955c8d --- /dev/null +++ b/manifests/profile/base/mistral/api.pp @@ -0,0 +1,36 @@ +# Copyright 2016 Red Hat, Inc. +# +# Licensed under the Apache License, Version 2.0 (the "License"); you may +# not use this file except in compliance with the License. You may obtain +# a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT +# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the +# License for the specific language governing permissions and limitations +# under the License. +# +# == Class: tripleo::profile::base::mistral::api +# +# Mistral API profile for tripleo +# +# === Parameters +# +# [*step*] +# (Optional) The current step in deployment. See tripleo-heat-templates +# for more details. +# Defaults to hiera('step') +# +class tripleo::profile::base::mistral::api ( + $step = hiera('step'), +) { + + include ::tripleo::profile::base::mistral + + if $step >= 4 { + include ::mistral::api + } +} + diff --git a/manifests/profile/base/mistral/engine.pp b/manifests/profile/base/mistral/engine.pp new file mode 100644 index 0000000..141cbad --- /dev/null +++ b/manifests/profile/base/mistral/engine.pp @@ -0,0 +1,46 @@ +# Copyright 2016 Red Hat, Inc. +# +# Licensed under the Apache License, Version 2.0 (the "License"); you may +# not use this file except in compliance with the License. You may obtain +# a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT +# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the +# License for the specific language governing permissions and limitations +# under the License. +# +# == Class: tripleo::profile::base::mistral::engine +# +# Mistral Engine profile for tripleo +# +# === Parameters +# +# [*sync_db*] +# (Optional) Whether to run db sync +# Defaults to undef +# +# [*step*] +# (Optional) The current step in deployment. See tripleo-heat-templates +# for more details. +# Defaults to hiera('step') +# +class tripleo::profile::base::mistral::engine ( + $sync_db = true, + $step = hiera('step'), +) { + + include ::tripleo::profile::base::mistral + + if $step >= 3 and $sync_db { + include ::mistral::db::mysql + include ::mistral::db::sync + } + + if $step >= 4 { + include ::mistral::engine + } + +} diff --git a/manifests/profile/base/mistral/executor.pp b/manifests/profile/base/mistral/executor.pp new file mode 100644 index 0000000..d7b5776 --- /dev/null +++ b/manifests/profile/base/mistral/executor.pp @@ -0,0 +1,36 @@ +# Copyright 2016 Red Hat, Inc. +# +# Licensed under the Apache License, Version 2.0 (the "License"); you may +# not use this file except in compliance with the License. You may obtain +# a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT +# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the +# License for the specific language governing permissions and limitations +# under the License. +# +# == Class: tripleo::profile::base::mistral::executor +# +# Mistral Executor profile for tripleo +# +# === Parameters +# +# [*step*] +# (Optional) The current step in deployment. See tripleo-heat-templates +# for more details. +# Defaults to hiera('step') +# +class tripleo::profile::base::mistral::executor ( + $step = hiera('step'), +) { + + include ::tripleo::profile::base::mistral + + if $step >= 4 { + include ::mistral::executor + } + +} diff --git a/manifests/profile/base/neutron.pp b/manifests/profile/base/neutron.pp index 1ee2d90..7b07b1f 100644 --- a/manifests/profile/base/neutron.pp +++ b/manifests/profile/base/neutron.pp @@ -23,9 +23,9 @@ # Defaults to hiera('step') # class tripleo::profile::base::neutron ( - $step = hiera('step'), + $step = hiera('step'), ) { - if hiera('step') >= 3 { + if $step >= 3 { include ::neutron include ::neutron::config } diff --git a/manifests/profile/base/neutron/plugins/ml2.pp b/manifests/profile/base/neutron/plugins/ml2.pp index 8218c9e..0193615 100644 --- a/manifests/profile/base/neutron/plugins/ml2.pp +++ b/manifests/profile/base/neutron/plugins/ml2.pp @@ -22,20 +22,25 @@ # (Optional) The mechanism drivers to use with the Ml2 plugin # Defaults to hiera('neutron::plugins::ml2::mechanism_drivers') # -# [*sync_db*] -# (Optional) Whether to run Neutron DB sync operations -# Defaults to undef +# [*bootstrap_node*] +# (Optional) The hostname of the node responsible for bootstrapping tasks +# Defaults to hiera('bootstrap_nodeid') # # [*step*] # (Optional) The current step in deployment. See tripleo-heat-templates # for more details. # Defaults to hiera('step') -# + class tripleo::profile::base::neutron::plugins::ml2 ( $mechanism_drivers = hiera('neutron::plugins::ml2::mechanism_drivers'), - $sync_db = true, + $bootstrap_node = hiera('bootstrap_nodeid', undef), $step = hiera('step'), ) { + if $::hostname == downcase($bootstrap_node) { + $sync_db = true + } else { + $sync_db = false + } include ::tripleo::profile::base::neutron diff --git a/manifests/profile/base/neutron/plugins/nuage.pp b/manifests/profile/base/neutron/plugins/nuage.pp index 5d3661e..4ada340 100644 --- a/manifests/profile/base/neutron/plugins/nuage.pp +++ b/manifests/profile/base/neutron/plugins/nuage.pp @@ -16,19 +16,24 @@ # # Nuage Neutron profile for tripleo # +# [*bootstrap_node*] +# (Optional) The hostname of the node responsible for bootstrapping tasks +# Defaults to hiera('bootstrap_nodeid') +# # [*step*] # (Optional) The current step in deployment. See tripleo-heat-templates # for more details. # Defaults to hiera('step') -# -# [*sync_db*] -# (Optional) Whether to run Neutron DB sync operations -# Defaults to undef -# + class tripleo::profile::base::neutron::plugins::nuage ( - $step = hiera('step'), - $sync_db = true, + $bootstrap_node = hiera('bootstrap_nodeid', undef), + $step = hiera('step'), ) { + if $::hostname == downcase($bootstrap_node) { + $sync_db = true + } else { + $sync_db = false + } include ::tripleo::profile::base::neutron diff --git a/manifests/profile/base/neutron/plugins/opencontrail.pp b/manifests/profile/base/neutron/plugins/opencontrail.pp index 96d7421..6cd710a 100644 --- a/manifests/profile/base/neutron/plugins/opencontrail.pp +++ b/manifests/profile/base/neutron/plugins/opencontrail.pp @@ -16,19 +16,24 @@ # # Opencontrail Neutron profile for tripleo # +# [*bootstrap_node*] +# (Optional) The hostname of the node responsible for bootstrapping tasks +# Defaults to hiera('bootstrap_nodeid') +# # [*step*] # (Optional) The current step in deployment. See tripleo-heat-templates # for more details. # Defaults to hiera('step') -# -# [*sync_db*] -# (Optional) Whether to run Neutron DB sync operations -# Defaults to undef -# + class tripleo::profile::base::neutron::plugins::opencontrail ( - $step = hiera('step'), - $sync_db = true, + $bootstrap_node = hiera('bootstrap_nodeid', undef), + $step = hiera('step'), ) { + if $::hostname == downcase($bootstrap_node) { + $sync_db = true + } else { + $sync_db = false + } include ::tripleo::profile::base::neutron diff --git a/manifests/profile/base/neutron/plugins/plumgrid.pp b/manifests/profile/base/neutron/plugins/plumgrid.pp index f5cd273..efd75ac 100644 --- a/manifests/profile/base/neutron/plugins/plumgrid.pp +++ b/manifests/profile/base/neutron/plugins/plumgrid.pp @@ -18,19 +18,24 @@ # # === Parameters # +# [*bootstrap_node*] +# (Optional) The hostname of the node responsible for bootstrapping tasks +# Defaults to hiera('bootstrap_nodeid') +# # [*step*] # (Optional) The current step in deployment. See tripleo-heat-templates # for more details. # Defaults to hiera('step') -# -# [*sync_db*] -# (Optional) Whether to run Neutron DB sync operations -# Defaults to undef -# + class tripleo::profile::base::neutron::plugins::plumgrid ( - $step = hiera('step'), - $sync_db = true, + $bootstrap_node = hiera('bootstrap_nodeid', undef), + $step = hiera('step'), ) { + if $::hostname == downcase($bootstrap_node) { + $sync_db = true + } else { + $sync_db = false + } include ::tripleo::profile::base::neutron diff --git a/manifests/profile/base/neutron/server.pp b/manifests/profile/base/neutron/server.pp index 8b5539e..5a1b377 100644 --- a/manifests/profile/base/neutron/server.pp +++ b/manifests/profile/base/neutron/server.pp @@ -18,24 +18,46 @@ # # === Parameters # +# [*bootstrap_node*] +# (Optional) The hostname of the node responsible for bootstrapping tasks +# Defaults to hiera('bootstrap_nodeid') +# # [*step*] # (Optional) The current step in deployment. See tripleo-heat-templates # for more details. # Defaults to hiera('step') # class tripleo::profile::base::neutron::server ( - $step = hiera('step'), + $bootstrap_node = hiera('bootstrap_nodeid', undef), + $step = hiera('step'), ) { + if $::hostname == downcase($bootstrap_node) { + $sync_db = true + } else { + $sync_db = false + } include ::tripleo::profile::base::neutron - if $step >= 3 { + if $step >= 3 and $sync_db { include ::neutron::db::mysql } - if $step >= 4 { + # We start neutron-server on the bootstrap node first, because + # it will try to populate tables and we need to make sure this happens + # before it starts on other nodes + if $step >= 4 and $sync_db { include ::neutron::server::notifications - include ::neutron::server + # We need to override the hiera value neutron::server::sync_db which is set + # to true + class { '::neutron::server': + sync_db => $sync_db, + } + } + if $step >= 5 and !$sync_db { + include ::neutron::server::notifications + class { '::neutron::server': + sync_db => $sync_db, + } } - } diff --git a/manifests/profile/base/nova/api.pp b/manifests/profile/base/nova/api.pp index 3b36c57..285e0b7 100644 --- a/manifests/profile/base/nova/api.pp +++ b/manifests/profile/base/nova/api.pp @@ -16,21 +16,24 @@ # # Nova API profile for tripleo # -# === Parameters +# [*bootstrap_node*] +# (Optional) The hostname of the node responsible for bootstrapping tasks +# Defaults to hiera('bootstrap_nodeid') # # [*step*] # (Optional) The current step in deployment. See tripleo-heat-templates # for more details. # Defaults to hiera('step') # -# [*sync_db*] -# (Optional) Whether to run db sync -# Defaults to true -# class tripleo::profile::base::nova::api ( - $step = hiera('step'), - $sync_db = true, + $bootstrap_node = hiera('bootstrap_nodeid', undef), + $step = hiera('step'), ) { + if $::hostname == downcase($bootstrap_node) { + $sync_db = true + } else { + $sync_db = false + } include ::tripleo::profile::base::nova @@ -46,5 +49,11 @@ class tripleo::profile::base::nova::api ( } include ::nova::network::neutron } + + if $step >= 5 { + if hiera('nova_enable_db_purge', true) { + include ::nova::cron::archive_deleted_rows + } + } } diff --git a/manifests/profile/base/nova/compute.pp b/manifests/profile/base/nova/compute.pp index c734906..076996a 100644 --- a/manifests/profile/base/nova/compute.pp +++ b/manifests/profile/base/nova/compute.pp @@ -38,6 +38,9 @@ class tripleo::profile::base::nova::compute ( # deploy basic bits for nova-compute include ::nova::compute + # If Service['nova-conductor'] is in catalog, make sure we start it + # before nova-compute. + Service<| title == 'nova-conductor' |> -> Service['nova-compute'] # deploy bits to connect nova compute to neutron include ::nova::network::neutron diff --git a/manifests/profile/base/pacemaker.pp b/manifests/profile/base/pacemaker.pp new file mode 100644 index 0000000..1785656 --- /dev/null +++ b/manifests/profile/base/pacemaker.pp @@ -0,0 +1,93 @@ +# Copyright 2016 Red Hat, Inc. +# +# Licensed under the Apache License, Version 2.0 (the "License"); you may +# not use this file except in compliance with the License. You may obtain +# a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT +# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the +# License for the specific language governing permissions and limitations +# under the License. +# +# == Class: tripleo::profile::base::pacemaker +# +# Pacemaker profile for tripleo +# +# === Parameters +# +# [*step*] +# (Optional) The current step in deployment. See tripleo-heat-templates +# for more details. +# Defaults to hiera('step') +# +class tripleo::profile::base::pacemaker ( + $step = hiera('step'), +) { + + Pcmk_resource <| |> { + tries => 10, + try_sleep => 3, + } + + if $::hostname == downcase(hiera('bootstrap_nodeid')) { + $pacemaker_master = true + } else { + $pacemaker_master = false + } + + $enable_fencing = str2bool(hiera('enable_fencing', false)) and $step >= 5 + + if $step >= 1 { + $pacemaker_cluster_members = downcase(regsubst(hiera('controller_node_names'), ',', ' ', 'G')) + $corosync_ipv6 = str2bool(hiera('corosync_ipv6', false)) + if $corosync_ipv6 { + $cluster_setup_extras = { '--token' => hiera('corosync_token_timeout', 1000), '--ipv6' => '' } + } else { + $cluster_setup_extras = { '--token' => hiera('corosync_token_timeout', 1000) } + } + class { '::pacemaker': + hacluster_pwd => hiera('hacluster_pwd'), + } -> + class { '::pacemaker::corosync': + cluster_members => $pacemaker_cluster_members, + setup_cluster => $pacemaker_master, + cluster_setup_extras => $cluster_setup_extras, + } + class { '::pacemaker::stonith': + disable => !$enable_fencing, + } + if $enable_fencing { + include ::tripleo::fencing + + # enable stonith after all Pacemaker resources have been created + Pcmk_resource<||> -> Class['tripleo::fencing'] + Pcmk_constraint<||> -> Class['tripleo::fencing'] + Exec <| tag == 'pacemaker_constraint' |> -> Class['tripleo::fencing'] + # enable stonith after all fencing devices have been created + Class['tripleo::fencing'] -> Class['pacemaker::stonith'] + } + + # FIXME(gfidente): sets 200secs as default start timeout op + # param; until we can use pcmk global defaults we'll still + # need to add it to every resource which redefines op params + Pacemaker::Resource::Service { + op_params => 'start timeout=200s stop timeout=200s', + } + } + + if $step >= 2 { + if $pacemaker_master { + include ::pacemaker::resource_defaults + + # Create an openstack-core dummy resource. See RHBZ 1290121 + pacemaker::resource::ocf { 'openstack-core': + ocf_agent_name => 'heartbeat:Dummy', + clone_params => 'interleave=true', + } + } + } + +} diff --git a/manifests/profile/base/sahara/engine.pp b/manifests/profile/base/sahara/engine.pp index 8fa1f5f..f792a96 100644 --- a/manifests/profile/base/sahara/engine.pp +++ b/manifests/profile/base/sahara/engine.pp @@ -18,19 +18,25 @@ # # === Parameters # -# [*sync_db*] -# (Optional) Whether to run db sync -# Defaults to true +# [*bootstrap_node*] +# (Optional) The hostname of the node responsible for bootstrapping tasks +# Defaults to hiera('bootstrap_nodeid') # # [*step*] # (Optional) The current step in deployment. See tripleo-heat-templates # for more details. # Defaults to hiera('step') -# + class tripleo::profile::base::sahara::engine ( - $sync_db = true, - $step = hiera('step'), + $bootstrap_node = hiera('bootstrap_nodeid', undef), + $step = hiera('step'), ) { + if $::hostname == downcase($bootstrap_node) { + $sync_db = true + } else { + $sync_db = false + } + if $step >= 3 and $sync_db { include ::sahara::db::mysql } diff --git a/manifests/profile/base/trove/api.pp b/manifests/profile/base/trove/api.pp index a98f114..06edf7f 100644 --- a/manifests/profile/base/trove/api.pp +++ b/manifests/profile/base/trove/api.pp @@ -18,19 +18,24 @@ # # === Parameters # -# [*sync_db*] -# (Optional) Whether to run db sync -# Defaults to true +# [*bootstrap_node*] +# (Optional) The hostname of the node responsible for bootstrapping tasks +# Defaults to hiera('bootstrap_nodeid') # # [*step*] # (Optional) The current step in deployment. See tripleo-heat-templates # for more details. # Defaults to hiera('step') -# + class tripleo::profile::base::trove::api ( - $sync_db = true, - $step = hiera('step'), + $bootstrap_node = hiera('bootstrap_nodeid', undef), + $step = hiera('step'), ) { + if $::hostname == downcase($bootstrap_node) { + $sync_db = true + } else { + $sync_db = false + } if $step >= 3 and $sync_db { include ::trove::db::mysql diff --git a/manifests/profile/pacemaker/apache.pp b/manifests/profile/pacemaker/apache.pp new file mode 100644 index 0000000..f23d3e7 --- /dev/null +++ b/manifests/profile/pacemaker/apache.pp @@ -0,0 +1,48 @@ +# Copyright 2016 Red Hat, Inc. +# +# Licensed under the Apache License, Version 2.0 (the "License"); you may +# not use this file except in compliance with the License. You may obtain +# a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT +# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the +# License for the specific language governing permissions and limitations +# under the License. +# +# == Class: tripleo::profile::pacemaker::apache +# +# Apache Pacemaker HA profile for tripleo +# +# === Parameters +# +# [*bootstrap_node*] +# (Optional) The hostname of the node responsible for bootstrapping tasks +# Defaults to hiera('bootstrap_nodeid') +# +# [*step*] +# (Optional) The current step in deployment. See tripleo-heat-templates +# for more details. +# Defaults to hiera('step') +# +class tripleo::profile::pacemaker::apache ( + $bootstrap_node = hiera('bootstrap_nodeid'), + $step = hiera('step'), +) { + + if $::hostname == downcase($bootstrap_node) { + $pacemaker_master = true + } else { + $pacemaker_master = false + } + + if $step >= 5 and $pacemaker_master { + include ::apache::params + pacemaker::resource::service { $::apache::params::service_name: + clone_params => 'interleave=true', + verify_on_create => true, + } + } +} diff --git a/manifests/profile/pacemaker/ceilometer/collector.pp b/manifests/profile/pacemaker/ceilometer/collector.pp index 2a838f2..6610a07 100644 --- a/manifests/profile/pacemaker/ceilometer/collector.pp +++ b/manifests/profile/pacemaker/ceilometer/collector.pp @@ -40,9 +40,7 @@ class tripleo::profile::pacemaker::ceilometer::collector ( include ::ceilometer::params include ::tripleo::profile::pacemaker::ceilometer - class { '::tripleo::profile::base::ceilometer::collector': - sync_db => (downcase($::hostname) == $pacemaker_master), - } + include ::tripleo::profile::base::ceilometer::collector if $step >= 5 and downcase($::hostname) == $pacemaker_master { $ceilometer_backend = downcase(hiera('ceilometer_backend', 'mongodb')) diff --git a/manifests/profile/pacemaker/cinder/api.pp b/manifests/profile/pacemaker/cinder/api.pp index 2c9cedf..6354244 100644 --- a/manifests/profile/pacemaker/cinder/api.pp +++ b/manifests/profile/pacemaker/cinder/api.pp @@ -45,9 +45,7 @@ class tripleo::profile::pacemaker::cinder::api ( $pacemaker_master = false } - class { '::tripleo::profile::base::cinder::api': - sync_db => $pacemaker_master, - } + include ::tripleo::profile::base::cinder::api if $step >= 5 and $pacemaker_master { pacemaker::resource::service { $::cinder::params::api_service : diff --git a/manifests/profile/pacemaker/database/mysql.pp b/manifests/profile/pacemaker/database/mysql.pp new file mode 100644 index 0000000..80015d0 --- /dev/null +++ b/manifests/profile/pacemaker/database/mysql.pp @@ -0,0 +1,184 @@ +# Copyright 2016 Red Hat, Inc. +# +# Licensed under the Apache License, Version 2.0 (the "License"); you may +# not use this file except in compliance with the License. You may obtain +# a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT +# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the +# License for the specific language governing permissions and limitations +# under the License. +# +# == Class: tripleo::profile::pacemaker::database::mysql +# +# MySQL with Pacemaker profile for tripleo +# +# === Parameters +# +# [*step*] +# (Optional) The current step in deployment. See tripleo-heat-templates +# for more details. +# Defaults to hiera('step') +# +class tripleo::profile::pacemaker::database::mysql ( + $step = hiera('step'), +) { + + if $::hostname == downcase(hiera('bootstrap_nodeid')) { + $pacemaker_master = true + } else { + $pacemaker_master = false + } + $mysql_bind_host = hiera('mysql_bind_host') + $galera_nodes = downcase(hiera('galera_node_names', $::hostname)) + $galera_nodes_count = count(split($galera_nodes, ',')) + $mysqld_options = { + 'mysqld' => { + 'skip-name-resolve' => '1', + 'binlog_format' => 'ROW', + 'default-storage-engine' => 'innodb', + 'innodb_autoinc_lock_mode' => '2', + 'innodb_locks_unsafe_for_binlog'=> '1', + 'query_cache_size' => '0', + 'query_cache_type' => '0', + 'bind-address' => $::hostname, + 'max_connections' => hiera('mysql_max_connections'), + 'open_files_limit' => '-1', + 'wsrep_on' => 'ON', + 'wsrep_provider' => '/usr/lib64/galera/libgalera_smm.so', + 'wsrep_cluster_name' => 'galera_cluster', + 'wsrep_cluster_address' => "gcomm://${galera_nodes}", + 'wsrep_slave_threads' => '1', + 'wsrep_certify_nonPK' => '1', + 'wsrep_max_ws_rows' => '131072', + 'wsrep_max_ws_size' => '1073741824', + 'wsrep_debug' => '0', + 'wsrep_convert_LOCK_to_trx' => '0', + 'wsrep_retry_autocommit' => '1', + 'wsrep_auto_increment_control' => '1', + 'wsrep_drupal_282555_workaround'=> '0', + 'wsrep_causal_reads' => '0', + 'wsrep_sst_method' => 'rsync', + 'wsrep_provider_options' => "gmcast.listen_addr=tcp://[${mysql_bind_host}]:4567;", + } + } + + class { '::tripleo::profile::base::database::mysql': + manage_resources => false, + remove_default_accounts => $pacemaker_master, + mysql_server_options => $mysqld_options, + } + + if $step >= 2 and $pacemaker_master { + if $pacemaker_master { + pacemaker::resource::ocf { 'galera' : + ocf_agent_name => 'heartbeat:galera', + op_params => 'promote timeout=300s on-fail=block', + master_params => '', + meta_params => "master-max=${galera_nodes_count} ordered=true", + resource_params => "additional_parameters='--open-files-limit=16384' enable_creation=true wsrep_cluster_address='gcomm://${galera_nodes}'", + require => Class['::mysql::server'], + before => Exec['galera-ready'], + } + exec { 'galera-ready' : + command => '/usr/bin/clustercheck >/dev/null', + timeout => 30, + tries => 180, + try_sleep => 10, + environment => ['AVAILABLE_WHEN_READONLY=0'], + require => Exec['create-root-sysconfig-clustercheck'], + } + # We add a clustercheck db user and we will switch /etc/sysconfig/clustercheck + # to it in a later step. We do this only on one node as it will replicate on + # the other members. We also make sure that the permissions are the minimum necessary + mysql_user { 'clustercheck@localhost': + ensure => 'present', + password_hash => mysql_password(hiera('mysql_clustercheck_password')), + require => Exec['galera-ready'], + } + mysql_grant { 'clustercheck@localhost/*.*': + ensure => 'present', + options => ['GRANT'], + privileges => ['PROCESS'], + table => '*.*', + user => 'clustercheck@localhost', + } + } + # This step is to create a sysconfig clustercheck file with the root user and empty password + # on the first install only (because later on the clustercheck db user will be used) + # We are using exec and not file in order to not have duplicate definition errors in puppet + # when we later set the the file to contain the clustercheck data + exec { 'create-root-sysconfig-clustercheck': + command => "/bin/echo 'MYSQL_USERNAME=root\nMYSQL_PASSWORD=\'\'\nMYSQL_HOST=localhost\n' > /etc/sysconfig/clustercheck", + unless => '/bin/test -e /etc/sysconfig/clustercheck && grep -q clustercheck /etc/sysconfig/clustercheck', + } + xinetd::service { 'galera-monitor' : + port => '9200', + server => '/usr/bin/clustercheck', + per_source => 'UNLIMITED', + log_on_success => '', + log_on_failure => 'HOST', + flags => 'REUSE', + service_type => 'UNLISTED', + user => 'root', + group => 'root', + require => Exec['create-root-sysconfig-clustercheck'], + } + } + + if $step >= 4 or ( $step >= 3 and $pacemaker_master ) { + # At this stage we are guaranteed that the clustercheck db user exists + # so we switch the resource agent to use it. + $mysql_clustercheck_password = hiera('mysql_clustercheck_password') + file { '/etc/sysconfig/clustercheck' : + ensure => file, + mode => '0600', + owner => 'root', + group => 'root', + content => "MYSQL_USERNAME=clustercheck\n +MYSQL_PASSWORD='${mysql_clustercheck_password}'\n +MYSQL_HOST=localhost\n", + } + } + + if $step >= 5 { + # We now make sure that the root db password is set to a random one + # At first installation /root/.my.cnf will be empty and we connect without a root + # password. On second runs or updates /root/.my.cnf will already be populated + # with proper credentials. This step happens on every node because this sql + # statement does not automatically replicate across nodes. + $mysql_root_password = hiera('mysql::server::root_password') + exec { 'galera-set-root-password': + command => "/bin/touch /root/.my.cnf && /bin/echo \"UPDATE mysql.user SET Password = PASSWORD('${mysql_root_password}') WHERE user = 'root'; flush privileges;\" | /bin/mysql --defaults-extra-file=/root/.my.cnf -u root", + } + file { '/root/.my.cnf' : + ensure => file, + mode => '0600', + owner => 'root', + group => 'root', + content => "[client] + user=root + password=\"${mysql_root_password}\" + + [mysql] + user=root + password=\"${mysql_root_password}\"", + require => Exec['galera-set-root-password'], + } + if $pacemaker_master { + pacemaker::constraint::base { 'galera-then-openstack-core-constraint': + constraint_type => 'order', + first_resource => 'galera-master', + second_resource => 'openstack-core-clone', + first_action => 'promote', + second_action => 'start', + require => [Pacemaker::Resource::Ocf['galera'], + Pacemaker::Resource::Ocf['openstack-core']], + } + } + } + +} diff --git a/manifests/profile/pacemaker/database/redis.pp b/manifests/profile/pacemaker/database/redis.pp index 9bb96ae..27dcbe9 100644 --- a/manifests/profile/pacemaker/database/redis.pp +++ b/manifests/profile/pacemaker/database/redis.pp @@ -18,9 +18,6 @@ # # === Parameters # -# [*redis_vip*] -# Redis virtual IP -# # [*bootstrap_node*] # (Optional) The hostname of the node responsible for bootstrapping tasks # Defaults to hiera('bootstrap_nodeid') @@ -36,7 +33,6 @@ # class tripleo::profile::pacemaker::database::redis ( - $redis_vip, $bootstrap_node = hiera('bootstrap_nodeid'), $enable_load_balancer = hiera('enable_load_balancer', true), $step = hiera('step'), diff --git a/manifests/profile/pacemaker/glance.pp b/manifests/profile/pacemaker/glance.pp index 10f4f03..91fddf6 100644 --- a/manifests/profile/pacemaker/glance.pp +++ b/manifests/profile/pacemaker/glance.pp @@ -76,9 +76,7 @@ class tripleo::profile::pacemaker::glance ( } include ::tripleo::profile::base::glance::api - class { '::tripleo::profile::base::glance::registry': - sync_db => $pacemaker_master, - } + include ::tripleo::profile::base::glance::registry if $step >= 4 { if $glance_backend == 'file' and $glance_file_pcmk_manage { diff --git a/manifests/profile/pacemaker/gnocchi.pp b/manifests/profile/pacemaker/gnocchi.pp index a6d472c..edc1728 100644 --- a/manifests/profile/pacemaker/gnocchi.pp +++ b/manifests/profile/pacemaker/gnocchi.pp @@ -31,16 +31,11 @@ # for more details. # Defaults to hiera('step') # -# [*sync_db*] -# (Optional) Whether to run db sync -# Defaults to undef -# class tripleo::profile::pacemaker::gnocchi ( $gnocchi_indexer_backend = downcase(hiera('gnocchi_indexer_backend', 'mysql')), $bootstrap_node = hiera('bootstrap_nodeid'), $step = hiera('step'), - $sync_db = true, ) { Service <| tag == 'gnocchi-service' |> { @@ -64,11 +59,13 @@ class tripleo::profile::pacemaker::gnocchi ( } } - if $step >= 3 and $sync_db { + if $step >= 3 { include ::gnocchi include ::gnocchi::config include ::gnocchi::client - include ::gnocchi::db::sync + if $pacemaker_master { + include ::gnocchi::db::sync + } } if $step >= 5 and $pacemaker_master { diff --git a/manifests/profile/pacemaker/gnocchi/api.pp b/manifests/profile/pacemaker/gnocchi/api.pp index 684527f..ede4c9a 100644 --- a/manifests/profile/pacemaker/gnocchi/api.pp +++ b/manifests/profile/pacemaker/gnocchi/api.pp @@ -18,29 +18,19 @@ # # === Parameters # -# [*pacemaker_master*] -# (Optional) The hostname of the node responsible for bootstrapping tasks -# Defaults to hiera('bootstrap_nodeid') -# # [*step*] # (Optional) The current step in deployment. See tripleo-heat-templates # for more details. # Defaults to hiera('step') -# -# [*sync_db*] -# (Optional) Whether to run db sync -# Defaults to undef class tripleo::profile::pacemaker::gnocchi::api ( - $pacemaker_master = hiera('bootstrap_nodeid'), $step = hiera('step'), - $sync_db = true, ) { include ::tripleo::profile::pacemaker::gnocchi + include ::tripleo::profile::pacemaker::apache class { '::tripleo::profile::base::gnocchi::api': step => $step, - sync_db => (downcase($::hostname) == $pacemaker_master), } } diff --git a/manifests/profile/pacemaker/heat/engine.pp b/manifests/profile/pacemaker/heat/engine.pp index 47b8a09..158c138 100644 --- a/manifests/profile/pacemaker/heat/engine.pp +++ b/manifests/profile/pacemaker/heat/engine.pp @@ -39,9 +39,7 @@ class tripleo::profile::pacemaker::heat::engine ( } include ::tripleo::profile::pacemaker::heat - class { '::tripleo::profile::base::heat::engine': - sync_db => $pacemaker_master, - } + include ::tripleo::profile::base::heat::engine if $step >= 5 and $pacemaker_master { pacemaker::resource::service { $::heat::params::engine_service_name : diff --git a/manifests/profile/pacemaker/keystone.pp b/manifests/profile/pacemaker/keystone.pp index 46a40db..1cd5178 100644 --- a/manifests/profile/pacemaker/keystone.pp +++ b/manifests/profile/pacemaker/keystone.pp @@ -46,17 +46,12 @@ class tripleo::profile::pacemaker::keystone ( if $::hostname == downcase($bootstrap_node) { $pacemaker_master = true - $manage_roles = true } else { $pacemaker_master = false - $manage_roles = false } - class { '::tripleo::profile::base::keystone': - sync_db => $pacemaker_master, - manage_roles => $manage_roles, - manage_endpoint => $manage_roles - } + include ::tripleo::profile::base::keystone + include ::tripleo::profile::pacemaker::apache if $step >= 5 and $pacemaker_master and $enable_load_balancer { pacemaker::constraint::base { 'haproxy-then-keystone-constraint': @@ -82,6 +77,9 @@ class tripleo::profile::pacemaker::keystone ( require => [Pacemaker::Resource::Ocf['rabbitmq'], Pacemaker::Resource::Ocf['openstack-core']], } + File['/etc/keystone/ssl/certs/ca.pem'] -> Pacemaker::Resource::Service[$::apache::params::service_name] + File['/etc/keystone/ssl/private/signing_key.pem'] -> Pacemaker::Resource::Service[$::apache::params::service_name] + File['/etc/keystone/ssl/certs/signing_cert.pem'] -> Pacemaker::Resource::Service[$::apache::params::service_name] } } diff --git a/manifests/profile/pacemaker/neutron/plugins/ml2.pp b/manifests/profile/pacemaker/neutron/plugins/ml2.pp index 6c9d8b1..e5e13b7 100644 --- a/manifests/profile/pacemaker/neutron/plugins/ml2.pp +++ b/manifests/profile/pacemaker/neutron/plugins/ml2.pp @@ -18,19 +18,12 @@ # # === Parameters # -# [*pacemaker_master*] -# (Optional) The hostname of the pacemaker master -# Defaults to hiera('bootstrap_nodeid', undef) -# -class tripleo::profile::pacemaker::neutron::plugins::ml2 ( - $pacemaker_master = hiera('bootstrap_nodeid', undef), -) { +class tripleo::profile::pacemaker::neutron::plugins::ml2 +{ include ::neutron::params include ::tripleo::profile::pacemaker::neutron - class { '::tripleo::profile::base::neutron::plugins::ml2': - sync_db => ($::hostname == downcase($pacemaker_master)) - } + include ::tripleo::profile::base::neutron::plugins::ml2 } diff --git a/manifests/profile/pacemaker/neutron/plugins/nuage.pp b/manifests/profile/pacemaker/neutron/plugins/nuage.pp index ea40d38..de00761 100644 --- a/manifests/profile/pacemaker/neutron/plugins/nuage.pp +++ b/manifests/profile/pacemaker/neutron/plugins/nuage.pp @@ -18,16 +18,9 @@ # # === Parameters # -# [*pacemaker_master*] -# (Optional) The hostname of the pacemaker master -# Defaults to hiera('bootstrap_nodeid', undef) -# -class tripleo::profile::pacemaker::neutron::plugins::nuage ( - $pacemaker_master = hiera('bootstrap_nodeid', undef), -) { +class tripleo::profile::pacemaker::neutron::plugins::nuage +{ - class { '::tripleo::profile::base::neutron::plugins::nuage': - sync_db => ($::hostname == downcase($pacemaker_master)) - } + include ::tripleo::profile::base::neutron::plugins::nuage } diff --git a/manifests/profile/pacemaker/neutron/plugins/opencontrail.pp b/manifests/profile/pacemaker/neutron/plugins/opencontrail.pp index 8db3cb2..f1568e9 100644 --- a/manifests/profile/pacemaker/neutron/plugins/opencontrail.pp +++ b/manifests/profile/pacemaker/neutron/plugins/opencontrail.pp @@ -18,16 +18,9 @@ # # === Parameters # -# [*pacemaker_master*] -# (Optional) The hostname of the pacemaker master -# Defaults to hiera('bootstrap_nodeid', undef) -# -class tripleo::profile::pacemaker::neutron::plugins::opencontrail ( - $pacemaker_master = hiera('bootstrap_nodeid', undef), -) { +class tripleo::profile::pacemaker::neutron::plugins::opencontrail +{ - class { '::tripleo::profile::base::neutron::plugins::opencontrail': - sync_db => ($::hostname == downcase($pacemaker_master)) - } + include ::tripleo::profile::base::neutron::plugins::opencontrail } diff --git a/manifests/profile/pacemaker/neutron/plugins/plumgrid.pp b/manifests/profile/pacemaker/neutron/plugins/plumgrid.pp index 57f9e31..7313ef9 100644 --- a/manifests/profile/pacemaker/neutron/plugins/plumgrid.pp +++ b/manifests/profile/pacemaker/neutron/plugins/plumgrid.pp @@ -18,16 +18,9 @@ # # === Parameters # -# [*pacemaker_master*] -# (Optional) The hostname of the pacemaker master -# Defaults to hiera('bootstrap_nodeid', undef) -# -class tripleo::profile::pacemaker::neutron::plugins::plumgrid ( - $pacemaker_master = hiera('bootstrap_nodeid', undef), -) { +class tripleo::profile::pacemaker::neutron::plugins::plumgrid +{ - class { '::tripleo::profile::base::neutron::plugins::plumgrid': - sync_db => ($::hostname == downcase($pacemaker_master)) - } + include ::tripleo::profile::base::neutron::plugins::plumgrid } diff --git a/manifests/profile/pacemaker/nova/api.pp b/manifests/profile/pacemaker/nova/api.pp index 30ab733..8a6dc8d 100644 --- a/manifests/profile/pacemaker/nova/api.pp +++ b/manifests/profile/pacemaker/nova/api.pp @@ -42,9 +42,7 @@ class tripleo::profile::pacemaker::nova::api ( stop => '/bin/true', } - class { '::tripleo::profile::base::nova::api': - sync_db => (downcase($::hostname) == $pacemaker_master), - } + include ::tripleo::profile::base::nova::api if $step >= 5 and downcase($::hostname) == $pacemaker_master { pacemaker::resource::service { $::nova::params::api_service_name: diff --git a/manifests/profile/pacemaker/nova/conductor.pp b/manifests/profile/pacemaker/nova/conductor.pp index 495c92e..3d5e41e 100644 --- a/manifests/profile/pacemaker/nova/conductor.pp +++ b/manifests/profile/pacemaker/nova/conductor.pp @@ -47,6 +47,11 @@ class tripleo::profile::pacemaker::nova::conductor ( pacemaker::resource::service { $::nova::params::conductor_service_name: clone_params => 'interleave=true', } + # If Service['nova-compute'] is in catalog, make sure we start it after + # nova-conductor pcmk resource. + # Also make sure to restart nova-compute if nova-conductor pcmk resource changed + # the state, since nova-compute is deployed at a previous step. + Pacemaker::Resource::Service[$::nova::params::conductor_service_name] ~> Service<| title == 'nova-compute' |> } } diff --git a/manifests/profile/pacemaker/sahara/engine.pp b/manifests/profile/pacemaker/sahara/engine.pp index 6265e80..850c645 100644 --- a/manifests/profile/pacemaker/sahara/engine.pp +++ b/manifests/profile/pacemaker/sahara/engine.pp @@ -39,9 +39,7 @@ class tripleo::profile::pacemaker::sahara::engine ( } include ::tripleo::profile::pacemaker::sahara - class { '::tripleo::profile::base::sahara::engine': - sync_db => $pacemaker_master - } + include ::tripleo::profile::base::sahara::engine if $step >= 5 and $pacemaker_master { pacemaker::resource::service { $::sahara::params::engine_service_name : |