summaryrefslogtreecommitdiffstats
path: root/manifests/profile
AgeCommit message (Collapse)AuthorFilesLines
2016-11-16Sort parameters in keystone profile alphabeticallyJuan Antonio Osorio Robles1-20/+20
Change-Id: I035c26e0f50e4b3fc0f6085fa5a4bf524e4852b7
2016-11-16Remove explicit hiera calls for heat in keystone profileJuan Antonio Osorio Robles1-9/+8
These are now passed via the heat profiles in t-h-t (via heat-base.yaml and heat-engine.yaml) and use the actual names of keystone parameters instead. Change-Id: Id0f5dd03b6757df989339c93b58a5b7eac3402a2 Depends-On: I0e5124d57fdc519262fdec2dbeaaac85afaeebdf
2016-11-14 Enable TLS in the internal network for Barbican APIJuan Antonio Osorio Robles1-3/+54
This optionally enables TLS for Barbican API in the internal network. If internal TLS is enabled, each node that is serving the Barbican API service will use certmonger to request its certificate. bp tls-via-certmonger Change-Id: I1c1d3dab9bba7bec6296a55747e9ade242c47bd9
2016-11-11Merge "Normalize civetweb binding address if IPv6"Jenkins1-2/+18
2016-11-11Merge "Enable TLS in the internal network for Cinder API"Jenkins1-3/+54
2016-11-11Normalize civetweb binding address if IPv6Giulio Fidente1-2/+18
The civetweb binding format is IP:PORT; this change ensures the IP is enclosed in brackets if IPv6. To do so we add the bind_ip and bind_port parameters to the rgw service class. Change-Id: Ib84fa3479c2598bff7e89ad60a1c7d5f2c22c18c Co-Authored-By: Lukas Bezdicka <social@v3.sk> Related-Bug: #1636515
2016-11-10Fix puppet lint failureBen Nemec1-3/+3
I'm not sure how this merged, but it's causing failures in other patches to puppet-tripleo. Change-Id: Ib20d349fa9abd6347739190bb29a02b6e3eb839d
2016-11-09Merge "Enable TLS in the internal network for Nova API"Jenkins1-3/+54
2016-11-08Merge "Add proper handling of IPv6 addresses for rabbit host/port handling"Jenkins12-13/+24
2016-11-08Merge "Enable TLS in the internal network for gnocchi"Jenkins1-4/+55
2016-11-08Add proper handling of IPv6 addresses for rabbit host/port handlingBrent Eagles12-13/+24
This patch changes the rabbit_hosts config generation to work properly with IPv6 addresses. Closes-Bug: #1639881 Change-Id: I07cd983880a4a75a051e081dcb96134cb5c6f5e8
2016-11-04swift/proxy: configure rabbitmq properlyEmilien Macchi1-3/+16
Use rabbitmq_node_ips to find out where rabbitmq nodes are, and have correct ipv6 syntax if required. Closes-Bug: 1637443 Change-Id: Ibc0ed642931dd3ada7ee594bb8c70a1c3462206d
2016-11-02Create heat user in keystone profileAlex Schultz2-16/+37
Rather than use the heat::keystone::domain class which also includes the configuration options, we should just create the user for heat in keystone independently of the configuration. Change-Id: I7d42d04ef0c53dc1e62d684d8edacfed9fd28fbe Related-Bug: #1638350 Closes-Bug: #1638626
2016-11-02Enable TLS in the internal network for Cinder APIJuan Antonio Osorio Robles1-3/+54
This optionally enables TLS for Cinder API in the internal network. If internal TLS is enabled, each node that is serving the Cinder API service will use certmonger to request its certificate. bp tls-via-certmonger Change-Id: Ib4a9c8d3ca57f1b02e1bb0d150f333db501e9863
2016-11-01Merge "Add barbican profile"Jenkins3-0/+95
2016-11-01Merge "NFS mounting for Glance file backend"Jenkins1-4/+13
2016-11-01Enable TLS in the internal network for Nova APIJuan Antonio Osorio Robles1-3/+54
This optionally enables TLS for Nova API in the internal network. If internal TLS is enabled, each node that is serving the Nova API service will use certmonger to request its certificate. Note that this doesn't enable internal TLS for the nova metadata service since it doesn't run over httpd. This will be handled in a later commit. bp tls-via-certmonger Change-Id: I88380a1ed8fd597a1a80488cbc6ce357f133bd70
2016-10-31Merge "Calculate zaqar mongo from mongodb_node_ips"Jenkins1-2/+17
2016-10-31Merge "Reload haproxy if any configuration changes on HA"Jenkins1-1/+1
2016-10-31Merge "Enable TLS in the internal network for aodh"Jenkins1-3/+55
2016-10-31Merge "Enable TLS in the internal network for ceilometer"Jenkins1-2/+53
2016-10-27Clean up service name from cinder apiJuan Antonio Osorio Robles1-3/+1
Since the service_name is now being passed from t-h-t, we can clean it up from the profile in puppet. Change-Id: I724af8c355c3077be64cf472cedbca80af55da01 Depends-On: I13638cd1af52537bef8540f0d5fa5f5f7decd392
2016-10-27Calculate zaqar mongo from mongodb_node_ipsBrad P. Crochet1-2/+17
In order to make the zaqar service fully composable, the mongo ips need to be calculated without assuming that mongo and zaqar are on the same node. Change-Id: I0b077e85ba5fcd9fdfd33956cf33ce2403fcb088
2016-10-27Merge "Set redis file descriptor limit when run via pacemaker"Jenkins1-0/+17
2016-10-26Reload haproxy if any configuration changes on HAJuan Antonio Osorio Robles1-1/+1
In some cases, for instance, when updating from a non-SSL setup in HAProxy to an SSL setup, we don't reload haproxy's configuration. This is problematic since we need HAProxy to serve the certificates and the new endpoints. This forces the reload when puppet notices changes. Change-Id: Ie1dd809e6beef33fadad48de55e488219fb7d686 Closes-Bug: #1636921
2016-10-26Merge "Deploy cinder over Apache httpd"Jenkins1-1/+4
2016-10-26Merge "Only restart haproxy services when enable_load_balancer is defined"Jenkins1-1/+1
2016-10-26Merge "Remove the hardcoded tcp_keepalive false parameter"Jenkins1-2/+0
2016-10-25Only restart haproxy services when enable_load_balancer is definedMichele Baldessari1-1/+1
If we upgrade a cloud that was configured with external load balancer the process will fail during convergence step because it will try to restart haproxy which is not configured when an external load balancer is configured. Closes-Bug: #1636527 Change-Id: I6f6caec3e5c96e77437c1c83e625f39649a66c48
2016-10-25Set redis file descriptor limit when run via pacemakerMichele Baldessari1-0/+17
The current redis file descriptor limit is 4096 because of two reasons: - It is run via the redis user - It is not started via systemd which has explicit LimitNOFILE set to 10240 (which matches the default configuration of maximum 10000 clients) Create an /etc/security/limits.d/redis.conf file in order to increase the fd limit value With this change we correctly get the following limits: [root@overcloud-controller-0 ~]# pcs status |grep -A2 redis Master/Slave Set: redis-master [redis] Masters: [ overcloud-controller-2 ] Slaves: [ overcloud-controller-0 overcloud-controller-1 ] [root@overcloud-controller-0 ~]# cat /proc/`pgrep redis`/limits | grep open Max open files 10240 10240 files Previously this limit was set to 4096. Change-Id: I7691581bad92ad9442cecd82cf44f5ac78ed169f Closes-Bug: #1635334
2016-10-21Merge "Deploy monitoring/logging agents sooner"Jenkins2-86/+82
2016-10-21Merge "Add zaqar profiles"Jenkins2-0/+52
2016-10-21NFS mounting for Glance file backendJiri Stransky1-4/+13
Previously we did this with Pacemaker, but with move to NG HA architecture we lost the ability to use NFS mounts as image storage for Glance. This reimplements the mounting without utilizing Pacemaker. The mount is by default also written to /etc/fstab so that it persists over reboot, but this behavior can be disabled. This could also go to puppet-glance eventually, but not yet -- we need this backported to Newton because it's a TripleO regression. I don't think puppet-glance would allow backporting this to Newton, because from their point of view it would be a RFE rather than a regression. Change-Id: I45ad34c36587a8d695069368cf791f1efb68256c Related-Bug: #1635606
2016-10-21Merge "Removes logic dependent on 'odl_on_controller'"Jenkins3-15/+4
2016-10-21Merge "Enable TLS in the internal network for keystone"Jenkins1-11/+79
2016-10-21Deploy monitoring/logging agents soonerMartin Mágr2-86/+82
To be able to monitor during deployment, we need sensu clients and fluentd collectors be deployed as soon as it is possible. Change-Id: I952f0d6de6f6327d5c923b8f1d7a5979758dbc59
2016-10-21Remove the hardcoded tcp_keepalive false parameterMichele Baldessari1-2/+0
In change I35921652bd84d1d6be0727051294983d4a0dde10 we want to remove all those duplicate tcp_listen_option entries. One consequence of that is that we need to set rabbitmq::tcp_keepalive to true via hiera (as opposed to forcing it via the tcp_listen_option hash). For this to work we need to remove this forced parameter override. Note that even if I35921652bd84d1d6be0727051294983d4a0dde10 and this change don't merge at the exact same time it is still okay because we do force tcp_keepalive to true via the tcp_listen_options. Change-Id: I608477d5714a5081b3b4ab3b9fc2932bdd598301
2016-10-20Merge "pacemaker/mysql: wait step 2 to remove default accounts"Jenkins1-1/+11
2016-10-20Merge "Fixes missing ODL ML2 Authentication info"Jenkins1-4/+16
2016-10-19Enable TLS in the internal network for gnocchiJuan Antonio Osorio Robles1-4/+55
This optionally enables TLS for gnocchi in the internal network. If internal TLS is enabled, each node that is serving the gnocchi service will use certmonger to request its certificate. bp tls-via-certmonger Change-Id: Ie983933e062ac6a7f0af4d88b32634e6ce17838b
2016-10-19Enable TLS in the internal network for aodhJuan Antonio Osorio Robles1-3/+55
This optionally enables TLS for aodh in the internal network. If internal TLS is enabled, each node that is serving the aodh service will use certmonger to request its certificate. This, in turn should also configure a command that should be ran when the certificate is refreshed (which requires the service to be restarted). bp tls-via-certmonger Change-Id: I50ef0c8fbecb19d6597a28290daa61a91f3b13fc
2016-10-19Enable TLS in the internal network for ceilometerJuan Antonio Osorio Robles1-2/+53
This optionally enables TLS for aodh in the internal network. If internal TLS is enabled, each node that is serving the ceilometer service will use certmonger to request its certificate. This, in turn should also configure a command that should be ran when the certificate is refreshed (which requires the service to be restarted). bp tls-via-certmonger Change-Id: Ib5609f77a31b17ed12baea419ecfab5d5f676496
2016-10-19Enable TLS in the internal network for keystoneJuan Antonio Osorio Robles1-11/+79
This optionally enables TLS for keystone in the internal network. If internal TLS is enabled, each node that is serving the keystone service will use certmonger to request its certificate. This, in turn should also configure a command that should be ran when the certificate is refreshed (which requires the service to be restarted). bp tls-via-certmonger Change-Id: I303f6cf47859284785c0cdc65284a7eb89a4e039
2016-10-19Merge "Add port to rabbitmq node ip list"Jenkins12-14/+74
2016-10-19Merge "Include ::swift::config in Swift API and Storage roles"Jenkins2-0/+2
2016-10-19Add barbican profileAde Lee3-0/+95
Co-Authored-By: Juan Antonio Osorio Robles <jaosorior@redhat.com> Change-Id: If2804b469eb3ee08f3f194c7dd3290d23a245a7a
2016-10-19Merge "Fix broken rabbitmqctl commands when using ipv6"Jenkins1-1/+2
2016-10-18Merge "Set memcached_servers for nova API"Jenkins1-0/+10
2016-10-18Fixes missing ODL ML2 Authentication infoTim Rozet1-4/+16
Without this, neutron-server fails to start and communication will not work to ODL REST. Parital-Bug: 1633630 Change-Id: Ifd906db4e6062ac271c2147fe1149b1009d06ae2 Signed-off-by: Tim Rozet <trozet@redhat.com>
2016-10-18Merge "Remove explicit service_name setting from nova manifest"Jenkins1-3/+2