Add support for isolating block storage nets

This patch updates the cinder block storage role
for Puppet so that it supports network isolation.
This includes using the (optional) isolated networks
for MySQL, Glance API, and iscsi network traffic.

Change-Id: Icdfbf5fce7380e6049babca0cd50ca2e4008c1b0

4 files changed, 57 insertions, 5 deletions

diff --git a/cinder-storage.yaml b/cinder-storage.yaml
index 47a97081..2b59607e 100644
--- a/cinder-storage.yaml
+++ b/cinder-storage.yaml
@@ -71,6 +71,10 @@ parameters:
     default: "9292"
     description: Glance port.
     type: string
+  GlanceProtocol:
+    default: http
+    description: Protocol to use when connecting to glance, set to https for SSL.
+    type: string
   KeyName:
     default: default
     description: Name of an existing EC2 KeyPair to enable SSH access to the instances
@@ -109,6 +113,17 @@ parameters:
   Hostname:
     type: string
     default: '' # Defaults to Heat created hostname
+  ServiceNetMap:
+    default: {}
+    description: Mapping of service_name -> network name. Typically set
+                 via parameter_defaults in the resource registry.
+    type: json
+  GlanceApiVirtualIP:
+    type: string
+    default: ''
+  MysqlVirtualIP:
+    type: string
+    default: ''
 
 resources:
   BlockStorage:
diff --git a/overcloud-without-mergepy.yaml b/overcloud-without-mergepy.yaml
index ce79a52b..e13b9acb 100644
--- a/overcloud-without-mergepy.yaml
+++ b/overcloud-without-mergepy.yaml
@@ -782,9 +782,12 @@ resources:
           # Purpose of the dedicated BlockStorage nodes should be to use their local LVM
           CinderEnableIscsiBackend: {get_param: CinderEnableIscsiBackend}
           CinderPassword: {get_param: CinderPassword}
-          VirtualIP: {get_attr: [ControlVirtualIP, fixed_ips, 0, ip_address]}
           KeyName: {get_param: KeyName}
           Flavor: {get_param: OvercloudBlockStorageFlavor}
+          VirtualIP: {get_attr: [ControlVirtualIP, fixed_ips, 0, ip_address]}
+          GlancePort: {get_param: GlancePort}
+          GlanceProtocol: {get_param: GlanceProtocol}
+          GlanceApiVirtualIP: {get_attr: [VipMap, net_ip_map, {get_param: [ServiceNetMap, GlanceApiNetwork]}]}
           RabbitPassword: {get_param: RabbitPassword}
           RabbitUserName: {get_param: RabbitUserName}
           RabbitClientUseSSL: {get_param: RabbitClientUseSSL}
@@ -796,6 +799,8 @@ resources:
               template: {get_param: BlockStorageHostnameFormat}
               params:
                 '%stackname%': {get_param: 'OS::stack_name'}
+          ServiceNetMap: {get_param: ServiceNetMap}
+          MysqlVirtualIP: {get_attr: [VipMap, net_ip_map, {get_param: [ServiceNetMap, MysqlNetwork]}]}
 
   ObjectStorage:
     type: OS::Heat::ResourceGroup
diff --git a/puppet/cinder-storage-puppet.yaml b/puppet/cinder-storage-puppet.yaml
index 88618e53..a368ffd1 100644
--- a/puppet/cinder-storage-puppet.yaml
+++ b/puppet/cinder-storage-puppet.yaml
@@ -25,7 +25,7 @@ parameters:
     default: ''
     description: Set to True to enable debugging on all services.
     type: string
-  VirtualIP:
+  VirtualIP: # deprecated. Use per service VIPs instead.
     default: ''
     type: string
   ExtraConfig:
@@ -75,6 +75,10 @@ parameters:
     default: "9292"
     description: Glance port.
     type: string
+  GlanceProtocol:
+    default: http
+    description: Protocol to use when connecting to glance, set to https for SSL.
+    type: string
   KeyName:
     default: default
     description: Name of an existing EC2 KeyPair to enable SSH access to the instances
@@ -120,6 +124,17 @@ parameters:
   Hostname:
     type: string
     default: '' # Defaults to Heat created hostname
+  ServiceNetMap:
+    default: {}
+    description: Mapping of service_name -> network name. Typically set
+                 via parameter_defaults in the resource registry.
+    type: json
+  GlanceApiVirtualIP:
+    type: string
+    default: ''
+  MysqlVirtualIP:
+    type: string
+    default: ''
 
 resources:
   BlockStorage:
@@ -160,6 +175,13 @@ resources:
       StorageIpSubnet: {get_attr: [StoragePort, ip_subnet]}
       StorageMgmtIpSubnet: {get_attr: [StorageMgmtPort, ip_subnet]}
 
+  NetIpMap:
+    type: OS::TripleO::Network::Ports::NetIpMap
+    properties:
+      InternalApiIp: {get_attr: [InternalApiPort, ip_address]}
+      StorageIp: {get_attr: [StoragePort, ip_address]}
+      StorageMgmtIp: {get_attr: [StorageMgmtPort, ip_address]}
+
   NetworkDeployment:
     type: OS::TripleO::SoftwareDeployment
     properties:
@@ -174,7 +196,7 @@ resources:
       config: {get_resource: BlockStorageConfig}
       input_values:
         debug: {get_param: Debug}
-        cinder_dsn: {list_join: ['', ['mysql://cinder:', {get_param: CinderPassword}, '@', {get_param: VirtualIP} , '/cinder']]}
+        cinder_dsn: {list_join: ['', ['mysql://cinder:', {get_param: CinderPassword}, '@', {get_param: MysqlVirtualIP} , '/cinder']]}
         snmpd_readonly_user_name: {get_param: SnmpdReadonlyUserName}
         snmpd_readonly_user_password: {get_param: SnmpdReadonlyUserPassword}
         cinder_lvm_loop_device_size:
@@ -184,6 +206,15 @@ resources:
               size: {get_param: CinderLVMLoopDeviceSize}
         cinder_enable_iscsi_backend: {get_param: CinderEnableIscsiBackend}
         cinder_iscsi_helper: {get_param: CinderISCSIHelper}
+        cinder_iscsi_ip_address: {get_attr: [NetIpMap, net_ip_map, {get_param: [ServiceNetMap, CinderIscsiNetwork]}]}
+        glance_api_servers:
+          list_join:
+            - ''
+            - - {get_param: GlanceProtocol}
+              - '://'
+              - {get_param: GlanceApiVirtualIP}
+              - ':'
+              - {get_param: GlancePort}
         rabbit_username: {get_param: RabbitUserName}
         rabbit_password: {get_param: RabbitPassword}
         rabbit_client_use_ssl: {get_param: RabbitClientUseSSL}
@@ -213,8 +244,6 @@ resources:
               raw_data: {get_file: hieradata/common.yaml}
             volume:
               raw_data: {get_file: hieradata/volume.yaml}
-              oac_data:
-                cinder_iscsi_ip_address: local-ipv4
               mapped_data:
                 # Cinder
                 cinder::debug: {get_input: debug}
@@ -226,6 +255,8 @@ resources:
                 cinder::rabbit_use_ssl: {get_input: rabbit_client_use_ssl}
                 cinder::rabbit_port: {get_input: rabbit_client_port}
                 cinder_enable_iscsi_backend: {get_input: cinder_enable_iscsi_backend}
+                cinder_iscsi_ip_address: {get_input: cinder_iscsi_ip_address}
+                cinder::glance::glance_api_servers: {get_input: glance_api_servers}
                 ntp::servers: {get_input: ntp_servers}
                 enable_package_install: {get_input: enable_package_install}
                 snmpd_readonly_user_name: {get_input: snmpd_readonly_user_name}
diff --git a/puppet/manifests/overcloud_volume.pp b/puppet/manifests/overcloud_volume.pp
index 80cf6a21..edfeaeca 100644
--- a/puppet/manifests/overcloud_volume.pp
+++ b/puppet/manifests/overcloud_volume.pp
@@ -31,6 +31,7 @@ if count(hiera('ntp::servers')) > 0 {
 }
 
 include ::cinder
+include ::cinder::glance
 include ::cinder::volume
 include ::cinder::setup_test_volume