aboutsummaryrefslogtreecommitdiffstats
path: root/manifests/loadbalancer.pp
AgeCommit message (Collapse)AuthorFilesLines
2016-01-13Enable X-Forwarded-Proto header for cinderJuan Antonio Osorio Robles1-0/+4
Change-Id: I3bd836140537fc5b7e3fba600a712d6a9d6f1185
2016-01-07Merge "Haproxy has non-working Horizon session persistence."Jenkins1-1/+1
2016-01-06Merge "loadbalancer: fix MySQL timeout HAproxy config"Jenkins1-5/+7
2016-01-05Merge "Trove integration"Jenkins1-0/+43
2016-01-05Merge "Sahara integration"Jenkins1-0/+42
2016-01-05Merge "Enable X-Forwarded-Proto header for Heat and Nova"Jenkins1-0/+5
2016-01-05Merge "Enable X-Forwarded-Proto header for keystone_public"Jenkins1-0/+4
2016-01-05Haproxy has non-working Horizon session persistence.Sofer Athlan-Guyot1-1/+1
Haproxy is using session persistence[1] for horizon. It is not correctly configured though. The cookie is not properly set. This add the necessary code. [1]: http://blog.haproxy.com/2012/03/29/load-balancing-affinity-persistence-sticky-sessions-what-you-need-to-know/ Change-Id: Ic9d79475cf84c25fb8146ecbc5f0a45862c106f0 Closes-Bug: 1526786
2016-01-04Trove integrationEthan Gafford1-0/+43
Adds configuration for Trove to loadbalancer class. Partially-implements: blueprint trove-integration Change-Id: I3cdf43b6d63ad0ee68db047518743c62b6689f56
2016-01-04Sahara integrationEthan Gafford1-0/+42
Adds configuration for Sahara to loadbalancer class. Change-Id: I0f0a1dc2eaa57d8226bad8cfb250110296ab9614 Partially-implements: blueprint sahara-integration
2015-12-17Enable X-Forwarded-Proto header for Heat and NovaJuan Antonio Osorio Robles1-0/+5
Change-Id: Icd666d9988d14ac1e9581f55589bf95243cc7641
2015-12-17Merge "Allows customization of the HAProxy default timeouts"Jenkins1-1/+6
2015-12-11Adding MidoNet LoadBalancing optionsJaume Devesa1-0/+24
MidoNet API needs to be loadbalanced if the midonet environment is activated. Change-Id: I6f1ac659297b8cf6671e11ad23284f8f543568b0
2015-12-10Merge "loadbalancer: add Aodh API support"Jenkins1-0/+43
2015-12-10Allows customization of the HAProxy default timeoutsGiulio Fidente1-1/+6
Change-Id: I3fdb705bbac26b4bc43a18131407a0a86d36a8a5
2015-12-08Enable X-Forwarded-Proto header for keystone_publicJuan Antonio Osorio Robles1-0/+4
One of the ways to make use of TLS in keystone is through the usage of the X-Fowarded-Proto header, which will be forwarded with the request by the loadbalancer, and it will tell keystone what protocol was used to access it. This also requires configuration from the keystone side. Change-Id: I9b899ba95e28b7dfae0c1ed84ca8431054673925
2015-11-25Merge "Set tunnel timeout for nova_novncproxy"Jenkins1-0/+1
2015-11-25loadbalancer: add Aodh API supportEmilien Macchi1-0/+43
Add Aodh (Ceilometer Alarming) support in TripleO Loadbalancer config. Change-Id: I891985da9248a88c6ce2df1dd186881f582605ee
2015-10-22Resolve repeated ports for ssl frontends (nova vnc and swift proxy)Juan Antonio Osorio Robles1-1/+1
Nova vnc and swift proxy were listening on the same port if SSL is enabled in the load balancer Change-Id: Ibf4aa118d6c8e94f8f2a68bf270d5445ebda7593
2015-10-22Merge "Resolve repeated ports for ssl frontends"Jenkins1-1/+1
2015-10-21Resolve repeated ports for ssl frontendsJuan Antonio Osorio Robles1-1/+1
keystone and heat_cfn were listening on the same port if SSL is enabled inm the load balancer. Change-Id: I099119198ebf3322a783581f0c6758417e705a2e
2015-10-09Set tunnel timeout for nova_novncproxyJavier Pena1-0/+1
When using websockets in HAProxy, like nova_novncproxy does, we need to set "timeout tunnel" to avoid disconnections after a short period without traffic. Change-Id: I1b66cd9a1d20cbbe35a2ada5782a76a01b14bcd1 Closes-BZ: 1267043
2015-10-01loadbalancer: fix MySQL timeout HAproxy configEmilien Macchi1-5/+7
Current HAproxy config is broken for MySQL timeout parameters. This is what we have today by default in HAproxy logs: -------------- [WARNING] 238/115010 (13878) : config : missing timeouts for proxy 'mysql'. | While not properly invalid, you will certainly encounter various problems | with such a configuration. To fix this, please ensure that all following | timeouts are set to a non-zero value: 'client', 'connect', 'server'. -------------- This patch aims to: * Use the correct parameters to configure puppetlabs-haproxy * Update the database timeouts to higher values to prevent the services from disconnecting too frequently by setting the Galera HAProxy timeout to 90 minutes. Change-Id: I06dd4bf81d4f4fd3c01bb681f6f0b3152f2b8eea
2015-09-29Fix manila conditional statementGael Chamoulaud1-1/+1
- s/manila/$manila Change-Id: I7aaa8f83fe758484ab39af28c914fa3d78464633 Signed-off-by: Gael Chamoulaud <gchamoul@redhat.com>
2015-09-15Merge "Allow a user to specify the syslog address for HAProxy"Jenkins1-1/+6
2015-09-13loadbalancer: use http mode for Horizon haproxy configEmilien Macchi1-0/+1
The haproxy configuration for horizon does not have 'mode http' set. This proxy needs to be in http mode since it is using a cookie for persistence. The default section has 'mode tcp', which is fine, but horizon proxy needs to override this setting to get http mode. Without this, you will likely see an error like this: [WARNING] 238/115010 (13878) : config : cookie will be ignored for proxy 'horizon' (needs 'mode http').' Closes BZ-1257687 Change-Id: I397986ea022f47a33a5210696752509f4a2731a5
2015-09-11Allow a user to specify the syslog address for HAProxyYanis Guenane1-1/+6
Currently the address of the syslog server for HAProxy is hardcoded to /dev/log without a way to customize this setting. This commit aims to give a user more flexibility about which syslog server address to use. Change-Id: If7f7c8154e544e5d8a49f79f642e1ad01644a66d
2015-09-03loadbalancer: use 'source' for novnc balance modeEmilien Macchi1-0/+3
When establishing a connection from the client (Web Browser) to the novncproxy (loadbalanced by HAproxy), we need to make sure the client will stick on the same server the time he's connected, because HAproxy load-balance to another novncproxy node, the client will loose the connection and timeout like 'Connection Reset By Peer error'. This patch aims to configure novnc HAproxy configuration to balance using 'source' mode, so it will make sure the server remains the same while the connection is established. Change-Id: Ibbb7162b763f1fd2854a10a92a681910e0683c0a Closes-BZ: 1257324
2015-08-07Remove httpchk option from haproxy listenersGiulio Fidente1-55/+9
To make sure we don't use the ssl-hello-chk option set by the puppet-haproxy module we used to redefine the listener options for all listeners. With this change a default for the options hash is provided to the puppet class instead. This change also configures use of tcpka only where wanted, as documented by [1], removing it from the haproxy defaults section, given it wasn't used anyway by the other listeners which were indeed overriding options. 1. https://github.com/beekhof/osp-ha-deploy/blob/master/pcmk/lb.scenario Change-Id: Ic8deb77533f561cea7ce7db1d20f6be5e2dc0d33
2015-08-05Enable Manila ServiceRyan Hefner1-0/+46
Adds bindings to the Manila service for HAProxy. Change-Id: I175d5b7e35a781d04452fc6aee610e8dca005419
2015-07-27Fix HAProxy config for Nova EC2 APIJiri Stransky1-1/+1
EC2 API returns 400 for unauthenticated requests, making HAProxy believe that the service is down. We'll use TCP check instead of HTTP check for EC2 API. Change-Id: Ide7f9390603c9893b95cacd51d468461255dcf07
2015-07-17Listener options for Ironic/ceilometer/glance_registryJames Slagle1-0/+9
This updates some of the listener options set by loadbalancer.pp. Iroinc needs to pass in the option to do a httpchk, otherwise puppet-haproxy defaults it to doing a ssl-hello-chk, which won't work against the non-ssl loadbalancer server. Ceilometer and glance_registry both don't support a httpchk against the root (/) of their webservers (they return a straight 401) so disable those checks completely. Change-Id: Ibfc81175842a748eb077b132b0818c4ea17bbcf6
2015-07-16Add param to configure HAProxy default maxconn (per frontend)Giulio Fidente1-2/+8
The default per frontend maxconn is set to 2000, which can easily be reached with modern hardware with multiple logic cores; this change adds a parameter to configure the default maxconn value, default it to 4096 and also increases the global maxconn to 20480 to preserve the 1:5 ratio. Change-Id: I3fffc51ecc704ceccb86ca008ecba02578c29eb5
2015-07-10Add missing options to Ceilometer/Ironic/HorizonGiulio Fidente1-2/+3
Backend options for Ceilometer and Ironic are aligned with what we use for the other OpenStack services. Listener options for Horizon is updated so that we do cookie tracking as suggested by refarch doc. Change-Id: I4640d974a3ab8188919eaae79dde71463234b5ff
2015-07-08Remove mode tcp enforcement where unneeded, we default to mode tcpGiulio Fidente1-4/+0
Change-Id: Ic0ae6b743a732ccd2cf7e395b5ab172bf3daaf7d
2015-06-29Fix Heat 302 redirectsBen Nemec1-3/+9
When doing a heat stack-show, Heat initially returns a 302 redirect. With the existing loadbalancer config for SSL, this results in a redirect to an http:// address pointing at the SSL port, which naturally doesn't work. The fix for this is to use the rsprep haproxy option to rewrite the Location header in responses from the Heat api server. This allows us to properly handle redirect traffic as https. Also note that http header rewriting requires "mode http", so that is added here as well. Change-Id: I7e5c5b1877e9aa46c4b88dfba45c1fddf61727fc
2015-06-25Enable support for loadbalancing IronicBen Nemec1-0/+44
Just like any other OpenStack API endpoint. Change-Id: Iaa45d7bef94c3c42df0988a58f146bb8a530f74e
2015-06-25Merge "Introduce param to enable use of clustercheck"Jenkins1-4/+21
2015-06-25Merge "Use mode tcp for glance-registry balancing"Jenkins1-1/+1
2015-06-25Use mode tcp for glance-registry balancingGiulio Fidente1-1/+1
The glance-registry service is returning 401 to httpchk, which makes haproxy think it is down. This change switches the check mode to tcp. Closes-Bug: https://bugzilla.redhat.com/show_bug.cgi?id=1234637 Closes-Bug: 1468566 Change-Id: Icdd80aa9cd56e5afd3707eb7fa38aaedb8535af6
2015-06-25Introduce param to enable use of clustercheckGiulio Fidente1-4/+21
In the pacemaker scenario we want to use the clustercheck script to evict galera nodes which are out of sync. This change adds a parameter meant to enable use of clustercheck for the mysql service. Change-Id: I7199c7e5d759a76f58c0f48b40e9d460a3163886 Closes-Bug: 1456701
2015-06-23Remove control over the galera_master_nodeGiulio Fidente1-23/+2
We do not want to give users control over the galera_master_node, this should be gathered using the clustercheck script instead. Depends-On: I56ebd2d8405ac35c707666d993b396f04aeb683e Change-Id: Ib6a36e9283b73133251fb9ff3f33e71c50edb3db Closes-Bug: 1467918 Closes-Bug: https://bugzilla.redhat.com/show_bug.cgi?id=1234817
2015-06-03Configure virtual IPs for split out networksDan Prince1-33/+107
This patch optionally creates new virtual IPs for the storage, storage_mgmt, and internal_api networks if ip addresses are provided. Additionally the HAproxy configuration is updated to use hiera lookups to obtain virtual IPs for alternate networks. By default the ctlplane VIP is still used. Change-Id: I20483574920a1da689374b0eb1b39b0391c3d243
2015-06-02Use node IP lists for HA Proxy ipaddressesDan Prince1-19/+19
This patch updates the loadbalancer class so that it defaults to trying to use the node IP list for each respective service. This data is provided via Hiera directly (all-nodes-config provides it via the Heat templates). By default the ctlplane IP address list is still used if no service node IP list is provided. Change-Id: I34cbdf8bd525e6ab61859fe8b8c18fe613dabbfe
2015-06-02Drop nova_meta and glance_registry on public vipDan Prince1-2/+2
This patch removes the public VIP for the nova metadata and glance registry services. Change-Id: I0878f7b3eeed6e16c5d30bdf76ebca56eb49d042
2015-06-02Allow use of ssl for public api endpointsBen Nemec1-28/+261
There are two methods included: Setting $service_certificate will enable SSL for all public endpoints with the same cert file, while service-specific certificate settings allow using a cert file for just one service. Change-Id: I6f87ed2ebbea08ff1a0dff981559c8f4fc8b67cc
2015-05-14Increase global maxconn to 10000 and remove per-instance limitGiulio Fidente1-2/+6
The per-instance limit to 150 can easily be reached for the database when OpenStack services are running on hosts with many CPUs. The global maxconn is increased as per astapor. See [1]. 1. https://bugzilla.redhat.com/show_bug.cgi?id=1218322 Change-Id: Ia9258372ca4f707929f11097193a91c138069725
2015-05-11Add support for haproxy_service_manageGiulio Fidente1-1/+7
We want to let the caller decide upon having the haproxy service started and enabled or not on boot. Change-Id: I24a9fd2245a974120892a8887c8b58647c65cba9
2015-04-28Merge "Make setup of keepalived optional via manage_vip parameter"Jenkins1-37/+44
2015-04-20Merge "Enable access to HAProxy stats page"Jenkins1-2/+2