diff options
Diffstat (limited to 'manifests')
| -rw-r--r-- | manifests/haproxy.pp | 50 | ||||
| -rw-r--r-- | manifests/haproxy/endpoint.pp | 8 | ||||
| -rw-r--r-- | manifests/haproxy/stats.pp | 74 | ||||
| -rw-r--r-- | manifests/profile/base/haproxy.pp | 7 | ||||
| -rw-r--r-- | manifests/profile/pacemaker/haproxy.pp | 10 |
5 files changed, 118 insertions, 31 deletions
diff --git a/manifests/haproxy.pp b/manifests/haproxy.pp index 5a59c10..a3d088a 100644 --- a/manifests/haproxy.pp +++ b/manifests/haproxy.pp @@ -53,6 +53,11 @@ # Should haproxy run in daemon mode or not # Defaults to true # +# [*manage_firewall*] +# (optional) Enable or disable firewall settings for ports exposed by HAProxy +# (false means disabled, and true means enabled) +# Defaults to hiera('tripleo::firewall::manage_firewall', true) +# # [*controller_hosts*] # IPs of host or group of hosts to load-balance the services # Can be a string or an array. @@ -563,6 +568,7 @@ class tripleo::haproxy ( $haproxy_daemon = true, $haproxy_stats_user = 'admin', $haproxy_stats_password = undef, + $manage_firewall = hiera('tripleo::firewall::manage_firewall', true), $controller_hosts = hiera('controller_node_ips'), $controller_hosts_names = hiera('controller_node_names', undef), $contrail_config_hosts = hiera('contrail_config_node_ips', undef), @@ -766,12 +772,6 @@ class tripleo::haproxy ( $controller_hosts_names_real = downcase(any2array(split($controller_hosts_names, ','))) } - # TODO(bnemec): When we have support for SSL on private and admin endpoints, - # have the haproxy stats endpoint use that certificate by default. - if $haproxy_stats_certificate { - $haproxy_stats_bind_certificate = $haproxy_stats_certificate - } - $horizon_vip = hiera('horizon_vip', $controller_virtual_ip) if $service_certificate { # NOTE(jaosorior): If the horizon_vip and the public_virtual_ip are the @@ -809,16 +809,6 @@ class tripleo::haproxy ( } } - if $haproxy_stats_bind_certificate { - $haproxy_stats_bind_opts = { - "${controller_virtual_ip}:1993" => union($haproxy_listen_bind_param, ['ssl', 'crt', $haproxy_stats_bind_certificate]), - } - } else { - $haproxy_stats_bind_opts = { - "${controller_virtual_ip}:1993" => $haproxy_listen_bind_param, - } - } - $mysql_vip = hiera('mysql_vip', $controller_virtual_ip) $mysql_bind_opts = { "${mysql_vip}:3306" => $haproxy_listen_bind_param, @@ -881,22 +871,24 @@ class tripleo::haproxy ( use_internal_certificates => $use_internal_certificates, internal_certificates_specs => $internal_certificates_specs, listen_options => $default_listen_options, + manage_firewall => $manage_firewall, } if $haproxy_stats { - $stats_base = ['enable', 'uri /'] - if $haproxy_stats_password { - $stats_config = union($stats_base, ["auth ${haproxy_stats_user}:${haproxy_stats_password}"]) + if $haproxy_stats_certificate { + $haproxy_stats_certificate_real = $haproxy_stats_certificate + } elsif $use_internal_certificates { + # NOTE(jaosorior): Right now it's hardcoded to use the ctlplane network + $haproxy_stats_certificate_real = $internal_certificates_specs["haproxy-ctlplane"]['service_pem'] } else { - $stats_config = $stats_base + $haproxy_stats_certificate_real = undef } - haproxy::listen { 'haproxy.stats': - bind => $haproxy_stats_bind_opts, - mode => 'http', - options => { - 'stats' => $stats_config, - }, - collect_exported => false, + class { '::tripleo::haproxy::stats': + haproxy_listen_bind_param => $haproxy_listen_bind_param, + ip => $controller_virtual_ip, + password => $haproxy_stats_password, + certificate => $haproxy_stats_certificate_real, + user => $haproxy_stats_user, } } @@ -1361,7 +1353,7 @@ class tripleo::haproxy ( server_names => hiera('mysql_node_names', $controller_hosts_names_real), options => $mysql_member_options_real, } - if hiera('tripleo::firewall::manage_firewall', true) { + if $manage_firewall { include ::tripleo::firewall $mysql_firewall_rules = { '100 mysql_haproxy' => { @@ -1443,7 +1435,7 @@ class tripleo::haproxy ( server_names => hiera('redis_node_names', $controller_hosts_names_real), options => $haproxy_member_options, } - if hiera('tripleo::firewall::manage_firewall', true) { + if $manage_firewall { include ::tripleo::firewall $redis_firewall_rules = { '100 redis_haproxy' => { diff --git a/manifests/haproxy/endpoint.pp b/manifests/haproxy/endpoint.pp index f1e80e8..9139061 100644 --- a/manifests/haproxy/endpoint.pp +++ b/manifests/haproxy/endpoint.pp @@ -86,6 +86,11 @@ # fetching the certificate for that specific network. # Defaults to undef # +# [*manage_firewall*] +# (optional) Enable or disable firewall settings for ports exposed by HAProxy +# (false means disabled, and true means enabled) +# Defaults to hiera('tripleo::firewall::manage_firewall', true) +# define tripleo::haproxy::endpoint ( $internal_ip, $service_port, @@ -103,6 +108,7 @@ define tripleo::haproxy::endpoint ( $use_internal_certificates = false, $internal_certificates_specs = {}, $service_network = undef, + $manage_firewall = hiera('tripleo::firewall::manage_firewall', true), ) { if $public_virtual_ip { # service exposed to the public network @@ -158,7 +164,7 @@ define tripleo::haproxy::endpoint ( server_names => $server_names, options => $member_options, } - if hiera('tripleo::firewall::manage_firewall', true) { + if $manage_firewall { include ::tripleo::firewall # This block will construct firewall rules only when we specify # a port for the regular service and also the ssl port for the service. diff --git a/manifests/haproxy/stats.pp b/manifests/haproxy/stats.pp new file mode 100644 index 0000000..f185c29 --- /dev/null +++ b/manifests/haproxy/stats.pp @@ -0,0 +1,74 @@ +# Copyright 2014 Red Hat, Inc. +# All Rights Reserved. +# +# Licensed under the Apache License, Version 2.0 (the "License"); you may +# not use this file except in compliance with the License. You may obtain +# a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT +# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the +# License for the specific language governing permissions and limitations +# under the License. + +# == Class: tripleo::haproxy::stats +# +# Configure the HAProxy stats interface +# +# [*haproxy_listen_bind_param*] +# A list of params to be added to the HAProxy listener bind directive. +# +# [*ip*] +# IP Address on which the stats interface is listening on. This right now +# assumes that it's in the ctlplane network. +# +# [*password*] +# Password for haproxy stats authentication. When set, authentication is +# enabled on the haproxy stats endpoint. +# A string. +# Defaults to undef +# +# [*certificate*] +# Filename of an HAProxy-compatible certificate and key file +# When set, enables SSL on the haproxy stats endpoint using the specified file. +# Defaults to undef +# +# [*user*] +# Username for haproxy stats authentication. +# A string. +# Defaults to 'admin' +# +class tripleo::haproxy::stats ( + $haproxy_listen_bind_param, + $ip, + $password = undef, + $certificate = undef, + $user = 'admin' +) { + if $certificate { + $haproxy_stats_bind_opts = { + "${ip}:1993" => union($haproxy_listen_bind_param, ['ssl', 'crt', $certificate]), + } + } else { + $haproxy_stats_bind_opts = { + "${ip}:1993" => $haproxy_listen_bind_param, + } + } + + $stats_base = ['enable', 'uri /'] + if $password { + $stats_config = union($stats_base, ["auth ${user}:${password}"]) + } else { + $stats_config = $stats_base + } + haproxy::listen { 'haproxy.stats': + bind => $haproxy_stats_bind_opts, + mode => 'http', + options => { + 'stats' => $stats_config, + }, + collect_exported => false, + } +} diff --git a/manifests/profile/base/haproxy.pp b/manifests/profile/base/haproxy.pp index 4f3322c..145f283 100644 --- a/manifests/profile/base/haproxy.pp +++ b/manifests/profile/base/haproxy.pp @@ -36,6 +36,11 @@ # (Optional) Whether or not loadbalancer is enabled. # Defaults to hiera('enable_load_balancer', true). # +# [*manage_firewall*] +# (optional) Enable or disable firewall settings for ports exposed by HAProxy +# (false means disabled, and true means enabled) +# Defaults to hiera('tripleo::firewall::manage_firewall', true) +# # [*step*] # (Optional) The current step in deployment. See tripleo-heat-templates # for more details. @@ -44,12 +49,14 @@ class tripleo::profile::base::haproxy ( $certificates_specs = {}, $enable_load_balancer = hiera('enable_load_balancer', true), + $manage_firewall = hiera('tripleo::firewall::manage_firewall', true), $step = Integer(hiera('step')), ) { if $step >= 1 { if $enable_load_balancer { class {'::tripleo::haproxy': internal_certificates_specs => $certificates_specs, + manage_firewall => $manage_firewall, } unless hiera('tripleo::haproxy::haproxy_service_manage', true) { diff --git a/manifests/profile/pacemaker/haproxy.pp b/manifests/profile/pacemaker/haproxy.pp index 7331071..5198243 100644 --- a/manifests/profile/pacemaker/haproxy.pp +++ b/manifests/profile/pacemaker/haproxy.pp @@ -26,6 +26,11 @@ # (Optional) Whether load balancing is enabled for this cluster # Defaults to hiera('enable_load_balancer', true) # +# [*manage_firewall*] +# (optional) Enable or disable firewall settings for ports exposed by HAProxy +# (false means disabled, and true means enabled) +# Defaults to hiera('tripleo::firewall::manage_firewall', true) +# # [*step*] # (Optional) The current step in deployment. See tripleo-heat-templates # for more details. @@ -38,10 +43,13 @@ class tripleo::profile::pacemaker::haproxy ( $bootstrap_node = hiera('haproxy_short_bootstrap_node_name'), $enable_load_balancer = hiera('enable_load_balancer', true), + $manage_firewall = hiera('tripleo::firewall::manage_firewall', true), $step = Integer(hiera('step')), $pcs_tries = hiera('pcs_tries', 20), ) { - include ::tripleo::profile::base::haproxy + class {'::tripleo::profile::base::haproxy': + manage_firewall => $manage_firewall, + } if $::hostname == downcase($bootstrap_node) { $pacemaker_master = true |