summaryrefslogtreecommitdiffstats
path: root/manifests
AgeCommit message (Collapse)AuthorFilesLines
2017-04-12Enable internal network TLS for etcdFeng Pan4-10/+130
bp secure-etcd Change-Id: I0759deef7cbcf13b9056350e92f01afd33e9c649 Signed-off-by: Feng Pan <fpan@redhat.com>
2017-04-10etcd: Make HAProxy terminate TLS connectionsJuan Antonio Osorio Robles1-17/+14
When TLS is enabled for the internal network, HAProxy needs to handle etcd's TLS termination. Else it will use plain text. bp secure-etcd Change-Id: I20651240edcff0953741d4e8e01fa9a7ab185863
2017-04-10Merge "Move etcd to step 2"Jenkins1-1/+1
2017-04-07Merge "Adding listen_options for Contrail Webui https in haproxy"Jenkins1-0/+4
2017-04-07Merge "TLS-everywhere: Add resources for libvirt's cert for live migration"Jenkins4-0/+192
2017-04-07Merge "Stop including ironic::drivers::ssh in the ironic-conductor profile"Jenkins1-1/+4
2017-04-07Merge "Enable creation of keystone domain when ldap backends are created"Jenkins1-1/+3
2017-04-07Merge "syntax error extra comma in rabbitmq.pp"Jenkins1-1/+1
2017-04-07Merge "Add networking-vpp ML2 mechanism driver support"Jenkins3-0/+102
2017-04-07Merge "Add missing octavia auth include to keystone manifest"Jenkins1-0/+3
2017-04-07Merge "Make galera-ready exec refreshonly"Jenkins1-2/+3
2017-04-07syntax error extra comma in rabbitmq.ppJon Schlueter1-1/+1
bundle rake syntax Could not parse for environment *root*: Syntax error at ')'; expected '}' Change-Id: Idfb254df068b3d7342a6ea3c71dabd1316a61bdf
2017-04-07Stop including ironic::drivers::ssh in the ironic-conductor profileDmitry Tantsur1-1/+4
The SSH drivers are deprecated, pxe_ipmitool + virtualbmc should be used instead. This is a follow-up to blueprint switch-to-virtualbmc. Change-Id: I4fd567dffa3992042eebcf495334b8130e1bdc9f
2017-04-07TLS-everywhere: Add resources for libvirt's cert for live migrationJuan Antonio Osorio Robles4-0/+192
This merely requests the certificates that will be used for libvirt's live migration if TLS-everywhere is enabled. bp tls-via-certmonger Change-Id: If18206d89460f6660a81aabc4ff8b97f1f99bba7
2017-04-07Merge "Don't try and create the my.cnf.d dir everytime"Jenkins1-0/+1
2017-04-07Enable creation of keystone domain when ldap backends are createdJuan Antonio Osorio Robles1-1/+3
This sets the flag create_domain_entry for the ldap_backend resource, which will create the domain for the ldap backend (this was previously not the case since only the configuration was created). Furtherly, this flag will also refresh the keystone server, so the changes come into effect. Note that this is only done in step 3, so the domains are created there and the refresh happens in that step. Also, this is only done for the bootstrap node, since when the other nodes start, they will already have the domains available in the keystone database and there won't be a need to restart. Related-Bug: #1677603 Depends-On: Ib6c633b6a975e4b760c10a2aef3c252885b05e28 Change-Id: Id879cf5c5ae39d37bf58b73c78733001d2b03d9c
2017-04-07Merge "Composable services support for Cinder Pure Storage FlashArray"Jenkins2-0/+78
2017-04-07Merge "Adjust UI manifest (language list)"Jenkins1-2/+0
2017-04-07Merge "Migrate Swift ring handling from tripleo-heat-templates to ↵Jenkins1-0/+36
puppet-tripleo"
2017-04-07Merge "Adding OVNDBs vip to keepalive"Jenkins1-0/+18
2017-04-07Merge "Make the cluster-check property configurable"Jenkins1-0/+25
2017-04-07Merge "Add httpchk for http services"Jenkins1-87/+26
2017-04-06Merge "Include ironic::drivers::interfaces in the ironic-conductor profile"Jenkins1-0/+1
2017-04-06Merge "Adding support for Bagpipe Agent as BGPVPN driver"Jenkins1-0/+37
2017-04-06Merge "Add a trigger to call ldap_backend define"Jenkins1-0/+16
2017-04-06Make galera-ready exec refreshonlyAlex Schultz1-2/+3
Previously we were always run the galera-ready exec every step. This change switches it to be refreshonly so we only wait when the service is setup or restarted. Change-Id: I5ff9d49c2590751913b96777bcd72c8a15627a01 Closes-Bug: #1680586
2017-04-06Add missing octavia auth include to keystone manifestBrent Eagles1-0/+3
This patch adds the appropriate include to make sure that appropriate keystone user, services, etc. are created when octavia is selected. Closes-bug: #1680588 Change-Id: I0b6d657a0300538292223923d8808c23f936c193
2017-04-06Don't try and create the my.cnf.d dir everytimeAlex Schultz1-0/+1
The creation of /etc/my.cnf.d is not idempotent and is run anytime the mysql client profile is included. This change adds an unless parameter to ensure it is only run if not used. Change-Id: I4a30eaccf72f5687dc22ba93c19136e55d36dcab Closes-Bug: #1680570
2017-04-06Adjust UI manifest (language list)Julie Pichon1-2/+0
tripleo-ui is removing en-GB from the locale list, adjust the manifest to reflect this change. Change-Id: If3f6603d703a1af07a7eaab56e47e8b0b90947af Related-Bug: #1680397
2017-04-06Merge "Clean up TLS-related bits from swift-proxy"Jenkins1-13/+4
2017-04-06Merge "Fix missing groups for fluentd user"Jenkins1-78/+82
2017-04-05Merge "Add TLS in the internal network for Swift Proxy"Jenkins2-1/+69
2017-04-05Merge "Introduce profile to configure l2 gateway Neutron agent."Jenkins1-0/+35
2017-04-05Add a trigger to call ldap_backend defineCyril Lopez1-0/+16
Ldap_backend is a define so we need a resource to talk it. If ldap_backend_enable set by tripleo-heat-templates, we call the ldap_backend as a resource. Given an environment such as the following: parameter_defaults: KeystoneLdapDomainEnable: true KeystoneLDAPBackendConfigs: tripleoldap: url: ldap://192.0.2.250 user: cn=openstack,ou=Users,dc=redhat,dc=example,dc=com password: Secrete suffix: dc=redhat,dc=example,dc=com user_tree_dn: ou=Users,dc=redhat,dc=example,dc=com user_filter: "(memberOf=cn=OSuser,ou=Groups,dc=redhat,dc=example,dc=com)" user_objectclass: person user_id_attribute: cn user_allow_create: false user_allow_update: false user_allow_delete: false ControllerExtraConfig: nova::keystone::authtoken::auth_version: v3 cinder::keystone::authtoken::auth_version: v3 It would then create a domain called tripleoldap with an LDAP configuration as defined by the hash. The parameters from the hash are defined by the keystone::ldap_backend resource in puppet-keystone. More backends can be added as more entries to that hash. Partial-Bug: 1677603 Co-Authored-By: Juan Antonio Osorio Robles <jaosorior@redhat.com> Co-Authored-By: Guillaume Coré <gucore@redhat.com> Signed-off-by: Cyril Lopez <cylopez@redhat.com> Change-Id: I1593c6a33ed1a0ea51feda9dfb6e1690eaeac5db
2017-04-05Migrate Swift ring handling from tripleo-heat-templates to puppet-tripleoChristian Schwede1-0/+36
This allows decoupling the Swift ringbuilding logic from the Controller and ObjectStorage roles. A follow up patch will modify tripleo-heat-templates and use this modified class. Actually this downloads the Swift rings even if ring building is disabled or if there is no need to rebalance. This is required, because operators can disable ring building, but use the same mechanism to distribute pre-built rings to the nodes. If ring building is disabled, these won't be uploaded at the end back to the undercloud. Related-Bug: 1665641 Change-Id: Ifd6fa5b398d98e8998630ea0c9a2ce9867ceba2b
2017-04-05Merge "Certmonger/rabbitmq: Remove parameter doc for unexisting parameter"Jenkins1-4/+0
2017-04-05Adding support for Bagpipe Agent as BGPVPN driverRicardo Noriega1-0/+37
Partially-Implements: blueprint bgpvpn-service-integration Change-Id: I54ef40f9d958e87d187a6d124995aa6951c0651a Signed-off-by: Ricardo Noriega <rnoriega@redhat.com>
2017-04-05Merge "SSHD Service extensions"Jenkins1-29/+27
2017-04-05Make the cluster-check property configurableMichele Baldessari1-0/+25
This change will make the global cluster-check property configurable and will pick a lower default (60s) in case a pacemaker remote node is deployed. The cluster-recheck-interval is set to default to 15minutes by pacemaker. This value is too high when a pacemaker remote service is deployed. With this default value a reboot of a pacemaker remote node will be reported as offline by pacemaker for up to 15minutes. With this change we do the following: 1) Do nothing in case pacemaker remote is not deployed 2) When pacemaker remote is deployed and the operator has not specified otherwise, we set the recheck interval to 60s. 3) When the operator specifies the recheck interval we set that. Change-Id: I900952b33317b7998a1f26a65f4d70c1726df19c Closes-Bug: #1679753
2017-04-05Certmonger/rabbitmq: Remove parameter doc for unexisting parameterJuan Antonio Osorio Robles1-4/+0
This parameter was used at some point in the implementation but ended up not being needed in favor of getting this information from the puppet manifest. So it's removed as the parameter doesn't actually exist. Change-Id: I09f4091ee7a2221b26249959ea2927090d36ba0f
2017-04-04Move etcd to step 2Feng Pan1-1/+1
Etcd should be configured and started in step 2 with other core services when required. Change-Id: If95a74d211a194f2bfbe9653a6e19e05b095a210 Signed-off-by: Feng Pan <fpan@redhat.com>
2017-04-04Merge "Configure migration SSH tunnel"Jenkins1-18/+69
2017-04-04Merge "Refactor enabled languages from an array to a hash"Jenkins1-3/+20
2017-04-04Merge "Use correct manage_firewall hieradata"Jenkins2-3/+3
2017-04-04Merge "Fixes missing neutron base in sriov"Jenkins1-0/+2
2017-04-04Merge "Remove cluster_enabled setting for etcd"Jenkins1-7/+0
2017-04-04Add httpchk for http servicesAlex Schultz1-87/+26
The httpchk health check option should help reduce the situtations where haproxy thinks the service is up but the service is only listening and not actively serving http requests. Change-Id: I13cc5dcf2eea53731e756d078586ab9a97340912 Closes-Bug: #1629052
2017-04-04SSHD Service extensionslhinds1-29/+27
This change adds an `include` statement to bring in the extra functionality available from the existing puppet-ssh module in already available in RDO. By using puppet-ssh it provides a framework to allow the passing in of server options using just hiera values under ssh::server_options. For example, sshd_config banner can now be passed a server option, as well as all the new parameters outlined in the launchpad issue that the patch references for Closing. For this reason, the former augeas setting for `Banner /etc/issue` is now managed by the main puppet-ssh module instead. The change also allows population of MOTD text to `/etc/motd` as well as `issue.net`. $bannertext is refactored in accordance with patch [1] [1] https://review.openstack.org/#/c/442406/ Change-Id: Id329538fb7b623526f1d91d8a513cf3440c86a7c Closes-Bug: 1668543
2017-04-04Clean up TLS-related bits from swift-proxyJuan Antonio Osorio Robles1-13/+4
bp tls-via-certmonger Change-Id: I8a66d3a067f934ea30b668308237cbca1d58fbb8 Depends-On: I3cb9d53d75f982068f1025729c1793efaee87380
2017-04-04Add TLS in the internal network for Swift ProxyJuan Antonio Osorio Robles2-1/+69
This adds the necessary bits for a TLS Proxy to be placed in front of swift proxy when TLS-everywhere is enabled. This will be furtherly cleaned up once the t-h-t bits are added. bp tls-via-certmonger Change-Id: I6e7193cc5b4bb7e56cc89e0a293c91b0d391c68e