Age | Commit message (Collapse) | Author | Files | Lines |
|
|
|
Now that cinder enables http_proxy_to_wsgi by default[1], we no
longer need to add it ourselves. So this is now safe to remove.
[1] If5aab9cc25a2e7c66a0bb13b5f7488a667b30309
Depends-On: I6141b6caf9b04ee73fae3ae2b94b3001b21b9999
Change-Id: I3581d11519b664863f47c5aeeec6efcc4182a5fc
|
|
Add Sahara profiles for non-ha & ha scenarios.
Implements: blueprint refactor-puppet-manifests
Change-Id: I0c8bd68f9a98626e9d67ef713c72c9dd05b7cc12
|
|
Split loadbalancer role into 2 sub-roles:
- HAproxy
- Keepalived
Change-Id: I84dfa9d409d390c6f549d62cb3634931e4cb432c
|
|
Make sure controller_hosts_real and controller_hosts_names_real become
array-types anyway, so we don't need to add brackets in Hiera lookups
(example on both undercloud & overcloud where we do [hiera('controller_host')]).
Change-Id: I2fe899482acfd51919262bc7a6a1c9f450e173f4
|
|
|
|
The current default of 13800 is a bit out of line with the other Heat
SSL ports. This makes it a more sane default of 13005.
Change-Id: Ic9aa71bfc80ca5fdb3b3c48dc55be7b98cf22ada
|
|
|
|
|
|
Add Heat profiles for non-ha & ha scenarios.
Implements: blueprint refactor-puppet-manifests
Change-Id: I194cbb6aa307c2331597147545cf10299cab132f
|
|
Implements: blueprint refactor-puppet-manifests
This is the puppet-tripleo side for the memcached as a composable
service. The related tht review that uses this is at
I8802c2a0cf1e5fa1a6d1fab5e87f6014bea2f517
Change-Id: Icd504aef7dda144582c286c56c925a78566af72c
|
|
The profile contains Puppet classes to deploy loadbalancer services
(HAproxy & Keepalived) for ha & non-ha scenarios.
A future iteration will split HAproxy & keepalived, but for now, we just
want to move out the code from THT to puppet-tripleo.
Change-Id: I9b106dcc1a4d446ab5dea8430ed295e6ec209cbd
Implements: blueprint refactor-puppet-manifests
|
|
|
|
|
|
Add RabbitMQ composable role, and keep the same logic that we had in
THT.
Implements: blueprint refactor-puppet-manifests
Change-Id: I961bdbe1cc6dd1d4a315de616439f9fc77d793ae
|
|
THT does not deploy Nova EC2 anymore, so we don't need the HAproxy
endpoint anymore.
Change-Id: Ia888fe7e14c736ef3678d9a7cf69a2deb9233342
Depends-On: Ief2d0e5c77b5ac58560606fee930fbd66c40ffc3
|
|
Since keystone is being run under apache, the signing keys should notify
apache and not the keystone service. The keystone service is actually
disabled, so if the keys get updated nothing happens.
Change-Id: Idfebeabf03d010956569c32b24437245e2b93c2a
Related-Bug: #1581591
|
|
|
|
This was in the initial neutron profile patches but got removed
mid-way (see patch 16 comments here:
Ida781badbcd63bbcb481a2170638aefe262b717b). The file is in fact
required in order to get the ping test properly passing with TripleO.
Change-Id: Ibbfd79421f871e41f870745a593cca65e8c0e58a
|
|
* Manage roles & endpoints at step 5
* Set correct orchestration for Pacemaker resources within a single
step.
Change-Id: I079e65f535af069312b602e8ff58be80ab2f2226
|
|
|
|
These can be controlled via the specific Pacemaker role template.
Depends-On: I91a4267f0fc230f63df3333747d28463c7ae55fe
Change-Id: I8ef7bb94e048b998712b3534ceb51a7d10d016e9
|
|
|
|
|
|
Adds a class to configure SELinux. The code is taken from
puppet-openstack-cloud:
https://github.com/redhat-cip/puppet-openstack-cloud
This allows to share the same code for usage by both the Undercloud and
Overcloud.
Co-Authored By: Emilien Macchi <emilien@redhat.com>
Co-Authored By: Yanis Guenane <yguenane@redhat.com>
blueprint undercloud-elements
Change-Id: If214005df733d41c2fa4e197df247d8a14baaa14
|
|
The port parameter to puppetlabs-firewall is actually deprecated[1].
This adds support for using the new parameter names dport and sport. The
port parameter is still retained in puppet-tripleo for backwards
compatibily for anyone using that interface. It is marked deprecated in
the documentation, however no deprecation warning is needed because
there is already a warning from from puppetlabs-firewall.
blueprint undercloud-elements
Change-Id: I0598007f90018f80a3266193bb24dbf112de49b7
|
|
Implements: blueprint refactor-puppet-manifests
Add neutron profiles for both pacemaker and non-ha.
HA profiles are designed such that they include the base
profiles, disabling features as needed, while the base
profile can be used independently.
Co-Authored-By: Dan Prince <dprince@redhat.com>
Change-Id: Ida781badbcd63bbcb481a2170638aefe262b717b
|
|
Before the roles we could make the create db operation depend on a
'galera-ready' resource [1]. We can't do it anymore from the role so
we need to do create in step 3, when we do sync as well.
1. https://github.com/openstack/tripleo-heat-templates/blob/master/puppet/manifests/overcloud_controller_pacemaker.pp#L382
Change-Id: Id065a9180f1f1a41ab225ec5f755498ec7d9a827
|
|
Change-Id: I1d95746cb990292462106c191987147eba30ee61
|
|
This change moves the database creation and sync with the role
profile, so that it's only executed when the role is enabled and
by the role itself.
It also calls the non-pacemaker profiles out of the 'step'
conditional because the non-pacemaker profiles know how to deal with
'step' already.
Change-Id: I6c752cb53090e7ef8e0319bade462f2453ed7660
Related-Bug: 1572952
|
|
Change-Id: Ifb0cc7769ef99e4c7142c8f955f0ca721d61e9b5
|
|
|
|
|
|
|
|
|
|
Specifying a destination cidr is already supported by
puppetlabs-firewall, we just need to pass through the parameter in
rule.pp in puppet-tripleo.
This will allow creating iptables rules that forward network traffic for
a given cidr via puppet-tripleo.
Change-Id: I23582a55cd97248be52f45e14de7e813ff499ff7
|
|
Database schema profiles were missing step information, causing
schemas to be created too early.
Change-Id: Ic381804ce5f1aa257ece75d2e079f4b02f446344
|
|
TL;DR:
If keystone_public_api_vip and/or public_virtual_ip is an array of IPs,
HAproxy will be configured to listen on all IPs that are given in the
arrays.
It allows to specify an array for keystone_public_api_vip and/or
public_virtual_ip where one IP is v4 and another one is v6.
HAproxy will configured to listen on both and redirect the traffic to
the IPv6 network (Dual-Stack).
Implementation & background:
HAproxy requires binding options as an hash where each IP contains an
array of binding options.
TripleO does not support Puppet Parser [1] (yet) so we can't manipulate
data iterations inside the manifests.
This patch creates a custom function, called list_to_hash.
Example:
keystone_vips = ['192.168.0.1:5000', '192.168.0.2:5000']
$keystone_bind_opts = ['transparent']
Using this function:
$keystone_vips_hash = list_to_hash($keystone_vips,
$keystone_bind_opts)
Would return:
$keystone_vips_hash = {
'192.168.0.1:5000' => ['transparent'],
'192.168.0.2:5000' => ['transparent'],
}
This function will help us in loadbalancer.pp to construct binding
options in dynamic way.
It's backward compatible, so you don't have to give an array.
But if you do, multiple binding will be configured in HAproxy and you'll
also be able to deploy IPv6 Dual-Stack.
[1] https://docs.puppetlabs.com/puppet/latest/reference/lang_iteration.html
Change-Id: I003b6d7d171652654745861d4231882f9e0d373e
|
|
|
|
Horizon's backends (httpd) see IP address of the haproxy in the logs instead
of the client address.
Adding forwardfor option allows to add the client address to the
X-Forwarded-For HTTP header and can be replace in the logs by configured the
backend servers with this header.
Change-Id: I54f0f5549d64768dacca71539c71a28cc99d9d95
|
|
|
|
|
|
In tripleo heat template, overcloud_controller_pacemaker.pp has a lot of
duplicate code to define haproxy and vip creation. This is an attempt
to refactor this.
Change-Id: I4cc6711911c1bfa1bc6063979e2b2a7ab5b8d37b
|
|
|
|
Add Glance profiles for non-ha & ha scenarios.
Change-Id: Ifc388f7058ccfff2818f531bcbc00c7179874bbc
Implements: blueprint refactor-puppet-manifests
|
|
This commits adds the option to pass an internal certificate.
The aforementioned certificate will be used to terminate TLS
connections for the internal and admin endpoints.
Change-Id: I9d781b42c63cf34bd1f5ba2c71014c6b9de0f990
|
|
In order to reduce repeated code in the loadbalancer manifest, the
repeated parts were moved into one manifest that contains the
endpoint resource.
Change-Id: Ib72abe9de7ab073dcbd780298385b0c519f363aa
|
|
There were two issues with the SSL port for sahara.
* It was conflicting with Manila's port
* It was documented incorrectly
This has been fixed
Change-Id: I9f710e014890b6daa6b3e511fd811c1e25bd0de3
|
|
Change-Id: I7d2eb9405e0171fc54fa0b616122f69db5f51ce2
|
|
|