summaryrefslogtreecommitdiffstats
path: root/manifests
AgeCommit message (Collapse)AuthorFilesLines
2017-01-07Merge "Fix puppet warning for empty value"Jenkins1-0/+2
2017-01-06Merge "glance/api: cleanup on dbsync"Jenkins1-8/+1
2017-01-06Fix puppet warning for empty valueEmilien Macchi1-0/+2
Unknown variable: 'haproxy_ssl_firewall_rules' when public_ssl_port is empty. Fixing it by setting an empty hash in this case. Change-Id: If864732262852ef79ebb91ee77902c86b847072a
2017-01-05firewall: add IPv6 supportEmilien Macchi1-5/+27
This patch adds support for ip6tables rules in TripleO, in a intuitive and flexible fashion. 1) Default firewal rules 'source' parameter to undef. It was 0.0.0.0/0 before but now undef, so we don't need complex logic to support ipv6 rules. undef will create empty source, which is the same as 0.0.0.0/0 or ::/0. 2) Automatically convert icmp rules to ipv6-icmp for ipv6 rules. 3) Automatically create IPv6 rules like it's for IPv4. 4) Only create rules that can be created, depending on source/destination ip version. This patch should be backward compatible and adds a layer of security for IPv6 deployments. If previous deployments were manually creating Ipv6 rules, it's possible that this patch will override them. Our framework is able to configure any rule, so it shouldn't be a problem for upgrades. Co-Authored-By: Ben Nemec <bnemec@redhat.com> Closes-Bug: #1654050 Change-Id: I98a00a9ae265d3e5854632e749cc8c3a1647298c
2017-01-05glance/api: cleanup on dbsyncEmilien Macchi1-8/+1
Cleanup some code that were useful in the effort of removing Glance Registry service from TripleO. Change-Id: I2a4bdc413e953b8b713d9a12bba74ca18487fe0d
2017-01-05Merge "Adds a profile for the Ceph MDS service"Jenkins1-0/+35
2017-01-04nova-api: switch to new wsgi classEmilien Macchi1-1/+1
nova::wsgi::apache was deprecated in ocata in favor of nova::wsgi::apache_api. Let's switch to it. Change-Id: I59b3b36be33268fa6e261a7db3c4aa8e8e712ffb Depends-On: I5fc99062d349597393e2248c66f2d863029c7730
2017-01-04Merge "Fixes missing haproxy firewall rules for OpenDaylight"Jenkins1-17/+9
2017-01-04Adds a profile for the Ceph MDS serviceGiulio Fidente1-0/+35
This change adds a profile to deploy the Ceph MDS service and some basic unit tests for it. Depends-On: I558b43deaa9b243c54f3d7ae945f11dd4925eb5d Change-Id: Iaecc3ff7acb851776c5057c42a5a513a70425d2c Partial-Bug: #1644784
2017-01-04Fixes missing haproxy firewall rules for OpenDaylightTim Rozet1-17/+9
This migrates the haproxy config for ODL to use the tripleo::haproxy::endpoint class. This class automatically configures firewall rules for each haproxy endpoint. Also removes listening on public network for IP and adds listening on ctlplane network for admin access. Partial-Bug: 1651476 Change-Id: I1f2af2793d040fda17bf73252afe59434d99f31f Signed-off-by: Tim Rozet <trozet@redhat.com>
2017-01-04Sync the db as part of the glance-api installFlavio Percoco2-12/+25
The glance database should be created as part of the glance-api service installation and not the registry. Move the db_sync param to the glance-api class call. Change-Id: Ib9f511219e8cb9a7322745b6bd7c4f9c9cc0c198
2017-01-04Merge "Adds ability to populate SSH Banner text"Jenkins1-0/+61
2017-01-04Merge "Add the ml2_odl section when using opendalight_v2"Jenkins1-1/+1
2017-01-04Merge "Don't include api/scheduler manifests on manila share service set up"Jenkins1-2/+0
2017-01-03Merge "Add fossw of networking-fujitsu support to puppet-tripleo"Jenkins1-0/+5
2017-01-03Merge "Add cell_v2 setup for nova"Jenkins1-1/+70
2017-01-03Merge "Include nova::compute::libvirt::qemu from the libvirt profile"Jenkins1-0/+2
2017-01-02Don't include api/scheduler manifests on manila share service set upJan Provaznik1-2/+0
Manila pacemaker manifest (which sets manila share service only) includes also manila api and scheduler manifests. There is no reason for this. Also it causes that on whichever node manila share service runs also manila api and scheduler services are started. Change-Id: Ia1b39ef36c5bc34813cd6430b69ad9b698acc3cf Closes-Bug: #1653500
2016-12-29Add the ml2_odl section when using opendalight_v2Itzik Brown1-1/+1
Add the option to add the section of ml2_odl to ml2_conf.ini when opendaylight_v2 mechanism driver is used Change-Id: I2a1c5097614e47cc09e43bbc77305a0548d54baa
2016-12-23nova: use transport_url for rabbitmqEmilien Macchi1-12/+34
Configure Nova with new Oslo Messaging parameters for RabbitMQ. Note: parameters are renamed to be standard, so it will help a future transition to another backend in TripleO. Change-Id: Ia67a4dbe5b2bd12c45308a5581f96d0457b8e018
2016-12-22Add cell_v2 setup for novaAlex Schultz1-1/+70
We need to run the basic cell v2 setup for nova as it is required for Ocata. Change-Id: I693239ff5026f58a65eb6278b1a8fcb97af4f561 Depends-On: I43ba77cd4c8da7c6dc117ab0bd53e5cd330dc3de Depends-On: I9462ef16fd64a577c3f950bd121f0bd28670fabc Closes-Bug: #1649341
2016-12-22Merge "add support for collectd"Jenkins2-0/+94
2016-12-22Merge "[CVE-2016-9599] Enforce Firewall TCP / UDP rules management"Jenkins2-9/+39
2016-12-22Merge "Ensure package updates don't happen unexpectedly"Jenkins1-2/+2
2016-12-22Merge "HPELeftHandISCSIDriver support for cinder"Jenkins2-8/+92
2016-12-22Merge "Add TLS proxy resource"Jenkins1-0/+60
2016-12-22Merge "Split ovn plugin and northd configuration"Jenkins4-16/+110
2016-12-22[CVE-2016-9599] Enforce Firewall TCP / UDP rules managementEmilien Macchi2-9/+39
This closes CVE-2016-9599. 1) Sanitize dynamic HAproxy endpoints firewall rules Build the hash of firewall rules only when a port is specified. The HAproxy endpoints are using TCP protocol, which means we have to specify a port to the IPtables rules. Some services don't have public network exposure (e.g. Glance Registry), which means they don't need haproxy_ssl rule. The code prepare the hash depending on the service_port and public_ssl_port parameters and create the actual firewall rules only if one of those or both parameters are specified. It will prevent new services without public exposure to open all traffic because no port is specified. 2) Secure Firewall rules creations The code won't allow to create TCP / UDP IPtables rules in INPUT or OUTPUT chains without port or sport or dport, because doing it would allow an IPtables rule opening all traffic for TCP or UDP. If we try to do that, Puppet catalog will fail with an error explaining why. Example of use-cases: - creating VRRP rules wouldn't require port parameters. - creating TCP or UDP rules would require port parameters. 3) Allow to open all traffic for TCO / UDP (when desired) Some use-cases require to open all traffic for all ports on TCP / UDP. It will be possible if the user gives port = 'all' when creating the firewall rule. Backward compatibility: - if our users created custom TCP / UDP firewall rules without port parameters, it won't work anymore, for security purpose. - if you users want to open TCP / UDP for all ports, they need to pass port = 'all' and the rule will be created, though a warning will be displayed because this is insecure. - if our users created custom VRRP rules without port parameters, it will still work correctly and rules will be created. - TCP / UDP rules in FORWARD chain without port are still accepted. Change-Id: I19396c8ab06b91fee3253cdfcb834482f4040a59 Closes-Bug: #1651831
2016-12-22Ensure package updates don't happen unexpectedlySteven Hardy1-2/+2
I'm seeing this run yum update on deploy, even though hiera tripleo::packages::enable_upgrade says false. I assume these are needed because we're getting "false", but I'm unclear if this is a recently introduced problem (I only noticed it today as my image has outdated centos packages and it thus hung on step2 of the deploy. Change-Id: If09cdde9883f2674dbbc40944be5fe4445caa08e Closes-Bug: #1652107
2016-12-22Add fossw of networking-fujitsu support to puppet-tripleoKoki Sanagi1-0/+5
Enable ml2.pp to call networking-fujitsu manifest in puppet-neutron for fossw ML2 plugin setting. Change-Id: I044c5812bbc5cd3de4bc33556cffbe5bad8e64cf Implements: blueprint integration-fossw-networking-fujitsu Depends-On: I79df6b6a27d95f0c0e2c87207ab80235a4efccfc
2016-12-22Merge "Decouple swift-proxy from ceilometer packages"Jenkins1-8/+15
2016-12-22Merge "Add networking-fujitsu support to puppet-tripleo"Jenkins1-0/+5
2016-12-22Merge "Do not use hardcoded controller_node_names when setting up the cluster"Jenkins1-1/+2
2016-12-21Adds ability to populate SSH Banner textLuke Hinds1-0/+61
A puppet manifest to allow the toggle of 'Banner' in sshd_config and enable population of an SSH login banner needed for security compliance such as DISA STIG If `Bannertext` is set as a parameter, the `Banner` key within sshd_config is toggled to `/etc/issue` and the content is copied into the `/etc/issue` file Change-Id: Ie9f8afdfa9930428f06c9669fedb460dc1064d5e Closes-Bug: #1640306
2016-12-20Decouples neutron services from OpenDaylight API serviceTim Rozet1-12/+7
Removes including Neutron services in the OpenDaylight API service. This was breaking custom roles when splitting up OpenDaylight and Neutron into different roles. Also, references to "controller" are removed because with custom roles OpenDaylight could be isolated to any role type. The 'bootstrap_nodeid' still works with any role, and only resolves to the first node in the series of nodes for that role type. Partial-Bug: 1651499 Change-Id: I418643810ee6b8a2c17a4754c83453140ebe39c7 Signed-off-by: Tim Rozet <trozet@redhat.com>
2016-12-20Add TLS proxy resourceJuan Antonio Osorio Robles1-0/+60
some services need a terminating proxy to do TLS on their main interfaces, to address this, we use httpd's mod_proxy and make it listen in front of these services with an appropriate certificate. bp tls-via-certmonger Change-Id: I82243fd3acfe4f23aab373116b78e1daf9d08467
2016-12-19Merge "Disable legacy ceilometer api by default"Jenkins1-1/+6
2016-12-19Merge "Drop vip_hosts"Jenkins1-39/+0
2016-12-19Merge "Fix a typo in haproxy.pp"Jenkins1-1/+1
2016-12-16Include nova::compute::libvirt::qemu from the libvirt profileGiulio Fidente1-0/+2
This is useful to customize the libvirt/qemu.conf limits when deploying a large overcloud or one with many Ceph OSDs. Change-Id: I258afd3ee6633e4b2ebc45aa8611be652476be0c Depends-On: I5fa423a4b212d14f6e9ff6a270931b569558b54e
2016-12-16add support for collectdLars Kellogg-Stedman2-0/+94
This is the glue between the collectd composable service in tripleo-heat-templates and the puppet-collectd module. Change-Id: I7e899e3af870b04dcd45503bd322278997fa53d0
2016-12-12Add networking-fujitsu support to puppet-tripleoKoki Sanagi1-0/+5
Enable ml2.pp to call networking-fujitsu manifest in puppet-neutron. The implementation in puppet-neutron is in progress separately. Change-Id: I5eb2c2a9c50b5991d62f4b6d74b83351c86b02de Implements: blueprint integration-networking-fujitsu Depends-On: I37a502b43eb7d91bfe20625248ed117eae3ca535
2016-12-11Decouple swift-proxy from ceilometer packagesDan Prince1-8/+15
This patch updates the swift proxy so that it only depends on ceilometer if the ceilometer_api_enabled all-nodes-data hiera setting has been set. Also removes a parameter dependency where the tripleo::profile::base::swift::proxy class was referencing a puppet-ceilometer value from hiera (which can also cause ceilometer dependencies). Depends-On: Ief5399d7ea4d26e96ce54903a69d660fa4fe3ce9 Change-Id: I8d9f69f5e9160543b372bd9886800f16f625fdc6 Closes-bug: #1648736
2016-12-11Merge "Changes default MidoNet API port on HAProxy"Jenkins1-4/+5
2016-12-09Disable legacy ceilometer api by defaultPradeep Kilambi1-1/+6
Ceilometer api is deprectaed in Ocata. Lets disable by default. This can still be enabled by setting enable_legacy_ceilometer_api param. Change-Id: Iffb8c2cfed53d8b29e777c35cee44921194239e9
2016-12-09HPELeftHandISCSIDriver support for cinderchinthagovardhan2-8/+92
Cinder Backend configuration support for HPELeftHandISCSIDriver for VSA storage Change-Id: Ia7e5f3d436283f7949b0eb8f109b3dc0309af4f5
2016-12-09Merge "Add cinder profile spec tests"Jenkins1-7/+13
2016-12-09Merge "Delete MidoNet deprecated classes and their tests"Jenkins1-122/+0
2016-12-08Do not use hardcoded controller_node_names when setting up the clusterMichele Baldessari1-1/+2
Currently we chose the pacemaker cluster node by simply taking hiera('controller_node_names'). We should instead use the pacemaker_short_node_names array which is built dynamically from all the nodes that include the pacemaker service. Change-Id: I0a3e4acaab11e078da5eeb2ef2adde5387785927
2016-12-07Create Glance's database if glance-api is enabledFlavio Percoco1-1/+1
Instead of checking for glance_registry_enabled, we should be checking for glance_api_enabled. The glance-api v1 depends on the registry, which means the database will be created but glance-api v2 doesn't which means that not deploying the registry would result in the glance database not being created. On the other hand, glance-registry is never deployed without glance-api Change-Id: Ief25dafb65f7a043fbb3d16f1d7ef834c9947a93