aboutsummaryrefslogtreecommitdiffstats
AgeCommit message (Collapse)AuthorFilesLines
2016-11-29Enable object-expirer on Swift proxy profileChristian Schwede1-0/+2
This service is required to delete expired automatically. It is often run on the proxy nodes, therefore adding it to the Swift proxy profile. Change-Id: I3250c205ffc166ae628bc427de2e3492d086c3bb Closes-Bug: 1645657
2016-11-28Merge "Enable TLS in the internal network for Panko API"Jenkins1-2/+53
2016-11-28Merge "adding new swift middleware that is typically enabled by default"Jenkins1-0/+5
2016-11-25Merge "Enable internal TLS for MySQL"Jenkins2-6/+131
2016-11-25Merge "Do not configure state matching when using GRE"Jenkins2-3/+12
2016-11-25Enable TLS in the internal network for Panko APIJuan Antonio Osorio Robles1-2/+53
This optionally enables TLS for Panko API in the internal network. If internal TLS is enabled, each node that is serving the Panko API service will use certmonger to request its certificate. bp tls-via-certmonger Change-Id: Ie9be7ce19601435b1b83b4ba58d9c7e8d53f23ba
2016-11-25Enable internal TLS for MySQLJuan Antonio Osorio Robles2-6/+131
this adds the necessary code in the manfiest to configure TLS if internal TLS is enabled. this also adds the capability of auto-generating the certificate via certmonger. bp tls-via-certmonger Change-Id: I7275e5afb3a6550cf2abbb9a8007dedb62ada4b4
2016-11-24Do not configure state matching when using GREBrent Eagles2-3/+12
The firewall rule quite reasonably sets up a default state matching rule but this is invalid for GRE. This patch conditionally adds the state matching if the protocol is not GRE. Closes-Bug: #1644360 Change-Id: Ie4ca41d0f36e79ba6822c358e21b827105736dd7
2016-11-23Merge "Remove Combination alarms support"Jenkins2-28/+0
2016-11-23Merge "Proxy manila in http mode"Jenkins1-0/+1
2016-11-23Merge "Move calculation of neutron l3_ha into puppet profile"Jenkins1-0/+33
2016-11-22Merge "Use mode 'http' in haproxy for ceilometer, neutron, aodh and gnocchi"Jenkins1-0/+4
2016-11-22Proxy manila in http modeJuan Antonio Osorio Robles1-0/+1
It needs it so HAProxy will be able to set the X-Forwarded-Proto header. Related-Bug: #1640126 Change-Id: I1726fa1742bc70518338b80fc6d27567bb020e7c
2016-11-22Use mode 'http' in haproxy for ceilometer, neutron, aodh and gnocchiJuan Antonio Osorio Robles1-0/+4
HAProxy won't pass X-Forwarded-Proto to these services in mode tcp, so we need to switch it to http in order for it to work and for the services to properly set the protocol in the links they serve. Change-Id: Ib10282159fb9269eebe81af23171ec9fb1297cd0 Closes-Bug: #1640126
2016-11-22Merge "firewall: stop using stdlib stages"Jenkins1-4/+3
2016-11-21Merge "Adds auto-detection for VIP interfaces"Jenkins2-15/+44
2016-11-21Merge "Add panko service support"Jenkins5-0/+120
2016-11-21firewall: stop using stdlib stagesEmilien Macchi1-4/+3
Using Puppet stdlib in TripleO is risky because it exposes deployments to dependency cycles in the catalog. We should rather use native functions to make orchestrations, like ordering and dependencies management. This patch: - removes usage of stages from stdlib - use ordering to make sure we run pre rules before post - use ordering to make sure we start all Services in catalog before post rules. It ensure that we don't drop all traffic before starting the services, which could lead to services errors (e.g. trying to reach database or amqp) Change-Id: Iec4705d6b785a40ccf6f43809b94b726ccd47fef Closes-Bug: #1643575
2016-11-21Move calculation of neutron l3_ha into puppet profileSteven Hardy1-0/+33
This is currently calculated in t-h-t but has a hard-coded reference to the ControllerCount which is incompatible with custom-roles. So instead calculate the setting based on the number of neutron API services running (on any role, not just Controller), combined with whether DVR is enabled (equivalent to current t-h-t logic). To avoid breaking the NeutronL3HA parameter in t-h-t we maintain an optional parameter to override the calculated value. Change-Id: I01c50973eec8138ec61304f2982d5026142f267c Partial-Bug: #1629187
2016-11-20Adds auto-detection for VIP interfacesTim Rozet2-15/+44
Previously the ctrl plane VIP would default to 'br-ex' which in non-vlan deployments ends up being the wrong interface. The public VIP interface was also defaulted to 'br-ex' which would be incorrect for vlan based deployments. Since a user has already given the nic template (and in most cases the subnet that corresponds to the nic) the installer should be able to figure out which interface the public/control vip should be on. These changes enable that type of auto-detection, unless a user explicitly overrides the heat parameters for ControlVirtualInterface and PublicVirtualInterface. Also removes calling keepalived from haproxy now that the services are composed separately on the Controller role. Partial-Bug: 1606632 Change-Id: I05105fce85be8ace986db351cdca2916f405ed04 Signed-off-by: Tim Rozet <trozet@redhat.com>
2016-11-17Replace hard-coded haproxy/keepalived couplingSteven Hardy1-3/+3
We have a variable in hiera which tells us if the keepalived service is enabled, so use it here. Without this any deployment disabling OS::TripleO::Services::Keepalived will fail. Change-Id: I90faf51881bd05920067c1e1d82baf5d7586af23 Closes-Bug: #1642677
2016-11-17Remove Combination alarms supportPradeep Kilambi2-28/+0
combination alarms are completely removed in Ocata. Remove this from tripleo. Change-Id: Icdf81d2f489db33533a1a0979cba3b5a652535d5
2016-11-17Merge "Sort parameters in keystone profile alphabetically"Jenkins1-20/+20
2016-11-16Merge "Prepare 6.0.0 (ocata-1)"Jenkins1-1/+1
2016-11-16Sort parameters in keystone profile alphabeticallyJuan Antonio Osorio Robles1-20/+20
Change-Id: I035c26e0f50e4b3fc0f6085fa5a4bf524e4852b7
2016-11-16Remove explicit hiera calls for heat in keystone profileJuan Antonio Osorio Robles1-9/+8
These are now passed via the heat profiles in t-h-t (via heat-base.yaml and heat-engine.yaml) and use the actual names of keystone parameters instead. Change-Id: Id0f5dd03b6757df989339c93b58a5b7eac3402a2 Depends-On: I0e5124d57fdc519262fdec2dbeaaac85afaeebdf
2016-11-15Prepare 6.0.0 (ocata-1)Emilien Macchi1-1/+1
Prepare the first release of Ocata. Change-Id: Ib8173d1ce26752216aeaab835f483503cf82b217
2016-11-15Merge " Enable TLS in the internal network for Barbican API"Jenkins2-4/+56
2016-11-14Add panko service supportPradeep Kilambi5-0/+120
Change-Id: I35f283bdf8dd0ed979c65633724f0464695130a4
2016-11-14Merge "Fix barbican server name to not use aodh hiera"Jenkins1-1/+1
2016-11-14 Enable TLS in the internal network for Barbican APIJuan Antonio Osorio Robles2-4/+56
This optionally enables TLS for Barbican API in the internal network. If internal TLS is enabled, each node that is serving the Barbican API service will use certmonger to request its certificate. bp tls-via-certmonger Change-Id: I1c1d3dab9bba7bec6296a55747e9ade242c47bd9
2016-11-11Merge "Normalize civetweb binding address if IPv6"Jenkins2-6/+30
2016-11-11Merge "Enable TLS in the internal network for Cinder API"Jenkins2-3/+55
2016-11-11Merge "Ensure keepalived is restarted when necessary."Jenkins1-0/+11
2016-11-11Normalize civetweb binding address if IPv6Giulio Fidente2-6/+30
The civetweb binding format is IP:PORT; this change ensures the IP is enclosed in brackets if IPv6. To do so we add the bind_ip and bind_port parameters to the rgw service class. Change-Id: Ib84fa3479c2598bff7e89ad60a1c7d5f2c22c18c Co-Authored-By: Lukas Bezdicka <social@v3.sk> Related-Bug: #1636515
2016-11-11Fix barbican server name to not use aodh hieraPradeep Kilambi1-1/+1
this looks like a copy/paste error. Let barbican use its own hiera data. Change-Id: I84118c1a561c3db2f18504b55c5a8c4f042e7e3b
2016-11-10Fix puppet lint failureBen Nemec1-3/+3
I'm not sure how this merged, but it's causing failures in other patches to puppet-tripleo. Change-Id: Ib20d349fa9abd6347739190bb29a02b6e3eb839d
2016-11-09adding new swift middleware that is typically enabled by defaultThiago da Silva1-0/+5
These are features that are typically enabled by default in any swift cluster. Change-Id: Ie323f68255a73d46e774cbf49d9353c3bf90c35e Signed-off-by: Thiago da Silva <thiago@redhat.com>
2016-11-09Merge "Enable TLS in the internal network for Nova API"Jenkins2-3/+55
2016-11-09Merge "Better way to ensure keepalived before haproxy."Jenkins2-4/+2
2016-11-09Merge "Wrong default in docstring"Jenkins1-1/+1
2016-11-09Merge "Pass X-Forwarded-Proto for missing services"Jenkins1-0/+20
2016-11-09Ensure keepalived is restarted when necessary.Sofer Athlan-Guyot1-0/+11
If os-collect-config/config.json is updated before an upgrade/update, then the os-net-config run will automatically erase the keepalived managed ips. This is a hackish way to ensure that keepalived is restarted during the next phase in order to have the ip recreated. It basically adds a comment line to the keepalived.conf file (making it different than the puppet one) if it's there. This will force a puppet restart of the keepalive service puting the ips back on the undercloud. Change-Id: I56b706ff44ba31aa87a63f870940831ce02a6e77 Closes-Bug: #1640213 Related-Bug: #1638029
2016-11-08Merge "Add proper handling of IPv6 addresses for rabbit host/port handling"Jenkins12-13/+24
2016-11-08Better way to ensure keepalived before haproxy.Sofer Athlan-Guyot2-4/+2
The lastest patchset of https://review.openstack.org/393361 was actually not working. The `if defined` idiom depends on *evaluation* order. At the time it's red in the haproxy.pp class, the line that loads the class 'haproxy' has still not yet been reached and thus the `defined` result is false. The constraint is not added. For this reason, the use of `defined` in module is not advised by puppetlabs[1]. [1] https://docs.puppet.com/puppet/latest/reference/function.html#defined Change-Id: Ibd352cb313f8863d62db8987419378bed5b87256 Relates-To: #1638029
2016-11-08Merge "Enable TLS in the internal network for gnocchi"Jenkins2-4/+56
2016-11-08Merge "Improve failed mysql node removal time in HA deploys."Jenkins1-3/+20
2016-11-08Wrong default in docstringMikeG4511-1/+1
Update default doc default for bind_host to match previous change http://review.openstack.org/386817/ Change-Id: Iff048ba7152c1b7e945f284311215c8f872c1409 Closes-bug: #1640104
2016-11-08Pass X-Forwarded-Proto for missing servicesJuan Antonio Osorio Robles1-0/+20
aodh, ceilometer, gnocchi and neutron need the X-Forwarded-Proto in order to return links with the correct protocol when SSL is enabled. This enables it in HAProxy Change-Id: Icceab92f86b1cc40d42195fa4ba0c75f302795b8 Closes-Bug: #1640126
2016-11-08Improve failed mysql node removal time in HA deploys.Chris Jones1-3/+20
In HA deployments, we now check mysql nodes every 1s and removed them immediately if they are failed. Previously we would check every 2s and allow them to fail 5 checks before being removed, producing errors from other OpenStack services for 10s, which causes confusion and delay for operators. Additionally, these check options are now also a class parameter so can be overridden by operators. Closes-Bug: #1639189 Change-Id: I0b915f790ae5a4b018a212d3aa83cca507be05e9