Merge "Mv Nova, Neutron, Horizon out of controller.yaml"

11 files changed, 230 insertions, 73 deletions

diff --git a/puppet/services/aodh-api.yaml b/puppet/services/aodh-api.yaml
index 4308052b..cc1f4b09 100644
--- a/puppet/services/aodh-api.yaml
+++ b/puppet/services/aodh-api.yaml
@@ -27,6 +27,13 @@ resources:
       DefaultPasswords: {get_param: DefaultPasswords}
       EndpointMap: {get_param: EndpointMap}
 
+  ApacheServiceBase:
+    type: ./apache.yaml
+    properties:
+      ServiceNetMap: {get_param: ServiceNetMap}
+      DefaultPasswords: {get_param: DefaultPasswords}
+      EndpointMap: {get_param: EndpointMap}
+
 outputs:
   role_data:
     description: Role data for the Aodh API service.
@@ -35,6 +42,7 @@ outputs:
       config_settings:
         map_merge:
           - get_attr: [AodhBase, role_data, config_settings]
+          - get_attr: [ApacheServiceBase, role_data, config_settings]
           - aodh::wsgi::apache::ssl: false
             aodh::api::service_name: 'httpd'
             tripleo.aodh_api.firewall_rules:
diff --git a/puppet/services/apache.yaml b/puppet/services/apache.yaml
new file mode 100644
index 00000000..758d9510
--- /dev/null
+++ b/puppet/services/apache.yaml
@@ -0,0 +1,40 @@
+heat_template_version: 2016-10-14
+
+description: >
+  Apache service configured with Puppet. Note this is typically included
+  automatically via other services which run via Apache.
+
+parameters:
+  ServiceNetMap:
+    default: {}
+    description: Mapping of service_name -> network name. Typically set
+                 via parameter_defaults in the resource registry.  This
+                 mapping overrides those in ServiceNetMapDefaults.
+    type: json
+  DefaultPasswords:
+    default: {}
+    type: json
+  EndpointMap:
+    default: {}
+    description: Mapping of service endpoint -> protocol. Typically set
+                 via parameter_defaults in the resource registry.
+    type: json
+
+outputs:
+  role_data:
+    description: Role data for the Apache role.
+    value:
+      service_name: apache
+      config_settings:
+        # for the given network; replacement examples (eg. for internal_api):
+        # internal_api -> IP
+        # internal_api_uri -> [IP]
+        # internal_api_subnet - > IP/CIDR
+        apache::ip: {get_param: [ServiceNetMap, ApacheNetwork]}
+        apache_remote_proxy_ips_network:
+          str_replace:
+            template: "NETWORK_subnet"
+            params:
+              NETWORK: {get_param: [ServiceNetMap, ApacheNetwork]}
+        apache::mod::remoteip::proxy_ips:
+          - "%{hiera('apache_remote_proxy_ips_network')}"
diff --git a/puppet/services/ceilometer-api.yaml b/puppet/services/ceilometer-api.yaml
index 201a2b7b..2baac511 100644
--- a/puppet/services/ceilometer-api.yaml
+++ b/puppet/services/ceilometer-api.yaml
@@ -28,6 +28,13 @@ resources:
       DefaultPasswords: {get_param: DefaultPasswords}
       EndpointMap: {get_param: EndpointMap}
 
+  ApacheServiceBase:
+    type: ./apache.yaml
+    properties:
+      ServiceNetMap: {get_param: ServiceNetMap}
+      DefaultPasswords: {get_param: DefaultPasswords}
+      EndpointMap: {get_param: EndpointMap}
+
 outputs:
   role_data:
     description: Role data for the Ceilometer API role.
@@ -35,6 +42,7 @@ outputs:
       service_name: ceilometer_api
       config_settings:
         map_merge:
+          - get_attr: [ApacheServiceBase, role_data, config_settings]
           - get_attr: [CeilometerServiceBase, role_data, config_settings]
           - tripleo.ceilometer_api.firewall_rules:
               '124 ceilometer':
diff --git a/puppet/services/gnocchi-api.yaml b/puppet/services/gnocchi-api.yaml
index ec42f3f5..dc6e7de7 100644
--- a/puppet/services/gnocchi-api.yaml
+++ b/puppet/services/gnocchi-api.yaml
@@ -35,6 +35,7 @@ parameters:
     description: Keystone region for endpoint
 
 resources:
+
   GnocchiServiceBase:
     type: ./gnocchi-base.yaml
     properties:
@@ -42,6 +43,13 @@ resources:
       DefaultPasswords: {get_param: DefaultPasswords}
       EndpointMap: {get_param: EndpointMap}
 
+  ApacheServiceBase:
+    type: ./apache.yaml
+    properties:
+      ServiceNetMap: {get_param: ServiceNetMap}
+      DefaultPasswords: {get_param: DefaultPasswords}
+      EndpointMap: {get_param: EndpointMap}
+
 outputs:
   role_data:
     description: Role data for the Gnocchi role.
@@ -49,6 +57,7 @@ outputs:
       service_name: gnocchi_api
       config_settings:
         map_merge:
+          - get_attr: [ApacheServiceBase, role_data, config_settings]
           - get_attr: [GnocchiServiceBase, role_data, config_settings]
           - tripleo.gnocchi_api.firewall_rules:
               '129 gnocchi-api':
diff --git a/puppet/services/horizon.yaml b/puppet/services/horizon.yaml
index c5d96819..1ea686b9 100644
--- a/puppet/services/horizon.yaml
+++ b/puppet/services/horizon.yaml
@@ -1,4 +1,4 @@
-heat_template_version: 2016-04-08
+heat_template_version: 2016-10-14
 
 description: >
   Horizon service configured with Puppet
@@ -10,6 +10,10 @@ parameters:
                  via parameter_defaults in the resource registry.  This
                  mapping overrides those in ServiceNetMapDefaults.
     type: json
+  Debug:
+    default: ''
+    description: Set to True to enable debugging on all services.
+    type: string
   DefaultPasswords:
     default: {}
     type: json
@@ -22,11 +26,20 @@ parameters:
     default: '*'
     description: A list of IP/Hostname allowed to connect to horizon
     type: comma_delimited_list
+  HorizonSecret:
+    description: Secret key for Django
+    type: string
+    hidden: true
+    default: ''
   NeutronMechanismDrivers:
     default: 'openvswitch'
     description: |
         The mechanism drivers for the Neutron tenant network.
     type: comma_delimited_list
+  MemcachedIPv6:
+    default: false
+    description: Enable IPv6 features in Memcached.
+    type: boolean
 
 outputs:
   role_data:
@@ -51,5 +64,29 @@ outputs:
           add_listen: false
           priority: 10
           access_log_format: '%a %l %u %t \"%r\" %>s %b \"%%{}{Referer}i\" \"%%{}{User-Agent}i\"'
+        # NOTE: bind IP is found in Heat replacing the network name with the local node IP
+        # for the given network; replacement examples (eg. for internal_api):
+        # internal_api -> IP
+        # internal_api_uri -> [IP]
+        # internal_api_subnet - > IP/CIDR
+        apache::ip: {get_param: [ServiceNetMap, HorizonNetwork]}
+        apache_remote_proxy_ips_network:
+          str_replace:
+            template: "NETWORK_subnet"
+            params:
+              NETWORK: {get_param: [ServiceNetMap, HorizonNetwork]}
+        apache::mod::remoteip::proxy_ips:
+          - "%{hiera('apache_remote_proxy_ips_network')}"
+        horizon::bind_address: {get_param: [ServiceNetMap, HorizonNetwork]}
+        horizon::django_debug: {get_param: Debug}
+        horizon::keystone_url: {get_param: [EndpointMap, KeystoneInternal, uri]}
+        horizon::secret_key:
+          yaql:
+            expression: $.data.passwords.where($ != '').first()
+            data:
+              passwords:
+                - {get_param: HorizonSecret}
+                - {get_param: [DefaultPasswords, horizon_secret]}
+        memcached_ipv6: {get_param: MemcachedIPv6}
       step_config: |
         include ::tripleo::profile::base::horizon
diff --git a/puppet/services/keystone.yaml b/puppet/services/keystone.yaml
index c763c391..45531abc 100644
--- a/puppet/services/keystone.yaml
+++ b/puppet/services/keystone.yaml
@@ -84,81 +84,94 @@ parameters:
     type: string
     description: Set the number of workers for keystone::wsgi::apache
     default: '"%{::processorcount}"'
+
+resources:
+
+  ApacheServiceBase:
+    type: ./apache.yaml
+    properties:
+      ServiceNetMap: {get_param: ServiceNetMap}
+      DefaultPasswords: {get_param: DefaultPasswords}
+      EndpointMap: {get_param: EndpointMap}
+
 outputs:
   role_data:
     description: Role data for the Keystone role.
     value:
       service_name: keystone
       config_settings:
-        keystone::database_connection:
-          list_join:
-            - ''
-            - - {get_param: [EndpointMap, MysqlInternal, protocol]}
-              - '://keystone:'
-              - {get_param: AdminToken}
-              - '@'
-              - {get_param: [EndpointMap, MysqlInternal, host]}
-              - '/keystone'
-        keystone::admin_token: {get_param: AdminToken}
-        keystone::roles::admin::password: {get_param: AdminPassword}
-        keystone_ssl_certificate: {get_param: KeystoneSSLCertificate}
-        keystone_ssl_certificate_key: {get_param: KeystoneSSLCertificateKey}
-        keystone::enable_proxy_headers_parsing: true
-        keystone::debug: {get_param: Debug}
-        keystone::db::mysql::password: {get_param: AdminToken}
-        keystone::rabbit_userid: {get_param: RabbitUserName}
-        keystone::rabbit_password: {get_param: RabbitPassword}
-        keystone::rabbit_use_ssl: {get_param: RabbitClientUseSSL}
-        keystone::rabbit_port: {get_param: RabbitClientPort}
-        keystone::notification_driver: {get_param: KeystoneNotificationDriver}
-        keystone::notification_format: {get_param: KeystoneNotificationFormat}
-        keystone::roles::admin::email: {get_param: AdminEmail}
-        keystone::roles::admin::password: {get_param: AdminPassword}
-        keystone::endpoint::public_url: {get_param: [EndpointMap, KeystonePublic, uri_no_suffix]}
-        keystone::endpoint::internal_url: {get_param: [EndpointMap, KeystoneInternal, uri_no_suffix]}
-        keystone::endpoint::admin_url: {get_param: [EndpointMap, KeystoneAdmin, uri_no_suffix]}
-        keystone::endpoint::region: {get_param: KeystoneRegion}
-        keystone_enable_db_purge: {get_param: KeystoneEnableDBPurge}
-        keystone::public_endpoint: {get_param: [EndpointMap, KeystonePublic, uri_no_suffix]}
-        keystone::db::mysql::user: keystone
-        keystone::db::mysql::host: {get_param: [EndpointMap, MysqlInternal, host_nobrackets]}
-        keystone::db::mysql::dbname: keystone
-        keystone::db::mysql::allowed_hosts:
-          - '%'
-          - "%{hiera('mysql_bind_host')}"
-        keystone::rabbit_heartbeat_timeout_threshold: 60
-        keystone::cron::token_flush::maxdelay: 3600
-        keystone::roles::admin::service_tenant: 'service'
-        keystone::roles::admin::admin_tenant: 'admin'
-        keystone::cron::token_flush::destination: '/dev/null'
-        keystone::config::keystone_config:
-          ec2/driver:
-            value: 'keystone.contrib.ec2.backends.sql.Ec2'
-        keystone::service_name: 'httpd'
-        keystone::wsgi::apache::ssl: false
-
-        keystone::wsgi::apache::workers: {get_param: KeystoneWorkers}
-        # override via extraconfig:
-        keystone::wsgi::apache::threads: 1
-        keystone::db::database_db_max_retries: -1
-        keystone::db::database_max_retries: -1
-        tripleo.keystone.firewall_rules:
-          '111 keystone':
-            dport:
-              - 5000
-              - 13000
-              - 35357
-              - 13357
-        # NOTE: bind IP is found in Heat replacing the network name with the
-        # local node IP for the given network; replacement examples
-        # (eg. for internal_api):
-        # internal_api -> IP
-        # internal_api_uri -> [IP]
-        # internal_api_subnet - > IP/CIDR
-        # NOTE: this applies to all 4 bind IP settings below...
-        keystone::admin_bind_host: {get_param: [ServiceNetMap, KeystoneAdminApiNetwork]}
-        keystone::public_bind_host: {get_param: [ServiceNetMap, KeystonePublicApiNetwork]}
-        keystone::wsgi::apache::bind_host: {get_param: [ServiceNetMap, KeystonePublicApiNetwork]}
-        keystone::wsgi::apache::admin_bind_host: {get_param: [ServiceNetMap, KeystoneAdminApiNetwork]}
+      config_settings:
+        map_merge:
+          - get_attr: [ApacheServiceBase, role_data, config_settings]
+          - keystone::database_connection:
+              list_join:
+                - ''
+                - - {get_param: [EndpointMap, MysqlInternal, protocol]}
+                  - '://keystone:'
+                  - {get_param: AdminToken}
+                  - '@'
+                  - {get_param: [EndpointMap, MysqlInternal, host]}
+                  - '/keystone'
+            keystone::admin_token: {get_param: AdminToken}
+            keystone::roles::admin::password: {get_param: AdminPassword}
+            keystone_ssl_certificate: {get_param: KeystoneSSLCertificate}
+            keystone_ssl_certificate_key: {get_param: KeystoneSSLCertificateKey}
+            keystone::enable_proxy_headers_parsing: true
+            keystone::debug: {get_param: Debug}
+            keystone::db::mysql::password: {get_param: AdminToken}
+            keystone::rabbit_userid: {get_param: RabbitUserName}
+            keystone::rabbit_password: {get_param: RabbitPassword}
+            keystone::rabbit_use_ssl: {get_param: RabbitClientUseSSL}
+            keystone::rabbit_port: {get_param: RabbitClientPort}
+            keystone::notification_driver: {get_param: KeystoneNotificationDriver}
+            keystone::notification_format: {get_param: KeystoneNotificationFormat}
+            keystone::roles::admin::email: {get_param: AdminEmail}
+            keystone::roles::admin::password: {get_param: AdminPassword}
+            keystone::endpoint::public_url: {get_param: [EndpointMap, KeystonePublic, uri_no_suffix]}
+            keystone::endpoint::internal_url: {get_param: [EndpointMap, KeystoneInternal, uri_no_suffix]}
+            keystone::endpoint::admin_url: {get_param: [EndpointMap, KeystoneAdmin, uri_no_suffix]}
+            keystone::endpoint::region: {get_param: KeystoneRegion}
+            keystone_enable_db_purge: {get_param: KeystoneEnableDBPurge}
+            keystone::public_endpoint: {get_param: [EndpointMap, KeystonePublic, uri_no_suffix]}
+            keystone::db::mysql::user: keystone
+            keystone::db::mysql::host: {get_param: [EndpointMap, MysqlInternal, host_nobrackets]}
+            keystone::db::mysql::dbname: keystone
+            keystone::db::mysql::allowed_hosts:
+              - '%'
+              - "%{hiera('mysql_bind_host')}"
+            keystone::rabbit_heartbeat_timeout_threshold: 60
+            keystone::cron::token_flush::maxdelay: 3600
+            keystone::roles::admin::service_tenant: 'service'
+            keystone::roles::admin::admin_tenant: 'admin'
+            keystone::cron::token_flush::destination: '/dev/null'
+            keystone::config::keystone_config:
+              ec2/driver:
+                value: 'keystone.contrib.ec2.backends.sql.Ec2'
+            keystone::service_name: 'httpd'
+            keystone::wsgi::apache::ssl: false
+    
+            keystone::wsgi::apache::workers: {get_param: KeystoneWorkers}
+            # override via extraconfig:
+            keystone::wsgi::apache::threads: 1
+            keystone::db::database_db_max_retries: -1
+            keystone::db::database_max_retries: -1
+            tripleo.keystone.firewall_rules:
+              '111 keystone':
+                dport:
+                  - 5000
+                  - 13000
+                  - 35357
+                  - 13357
+            # NOTE: bind IP is found in Heat replacing the network name with the
+            # local node IP for the given network; replacement examples
+            # (eg. for internal_api):
+            # internal_api -> IP
+            # internal_api_uri -> [IP]
+            # internal_api_subnet - > IP/CIDR
+            # NOTE: this applies to all 4 bind IP settings below...
+            keystone::admin_bind_host: {get_param: [ServiceNetMap, KeystoneAdminApiNetwork]}
+            keystone::public_bind_host: {get_param: [ServiceNetMap, KeystonePublicApiNetwork]}
+            keystone::wsgi::apache::bind_host: {get_param: [ServiceNetMap, KeystonePublicApiNetwork]}
+            keystone::wsgi::apache::admin_bind_host: {get_param: [ServiceNetMap, KeystoneAdminApiNetwork]}
       step_config: |
         include ::tripleo::profile::base::keystone
diff --git a/puppet/services/neutron-api.yaml b/puppet/services/neutron-api.yaml
index 35ac32db..cd8a20a1 100644
--- a/puppet/services/neutron-api.yaml
+++ b/puppet/services/neutron-api.yaml
@@ -111,5 +111,11 @@ outputs:
               '106 vrrp':
                 proto: vrrp
             neutron::server::router_distributed: {get_param: NeutronEnableDVR}
+            # NOTE: bind IP is found in Heat replacing the network name with the local node IP
+            # for the given network; replacement examples (eg. for internal_api):
+            # internal_api -> IP
+            # internal_api_uri -> [IP]
+            # internal_api_subnet - > IP/CIDR
+            neutron::bind_host: {get_param: [ServiceNetMap, NeutronApiNetwork]}
       step_config: |
         include tripleo::profile::base::neutron::server
diff --git a/puppet/services/neutron-metadata.yaml b/puppet/services/neutron-metadata.yaml
index b9ec277a..6bb931b1 100644
--- a/puppet/services/neutron-metadata.yaml
+++ b/puppet/services/neutron-metadata.yaml
@@ -53,5 +53,11 @@ outputs:
             neutron::agents::metadata::auth_password: {get_param: NeutronPassword}
             neutron::agents::metadata::auth_url: { get_param: [EndpointMap, KeystoneAdmin, uri_no_suffix] }
             neutron::agents::metadata::auth_tenant: 'service'
+            # NOTE: bind IP is found in Heat replacing the network name with the local node IP
+            # for the given network; replacement examples (eg. for internal_api):
+            # internal_api -> IP
+            # internal_api_uri -> [IP]
+            # internal_api_subnet - > IP/CIDR
+            neutron::agents::metadata::metadata_ip: {get_param: [ServiceNetMap, NeutronApiNetwork]}
       step_config: |
         include tripleo::profile::base::neutron::metadata
diff --git a/puppet/services/nova-api.yaml b/puppet/services/nova-api.yaml
index c2bd395e..b5c3815e 100644
--- a/puppet/services/nova-api.yaml
+++ b/puppet/services/nova-api.yaml
@@ -30,6 +30,19 @@ parameters:
     type: string
     default: 'regionOne'
     description: Keystone region for endpoint
+  NeutronMetadataProxySharedSecret:
+    description: Shared secret to prevent spoofing
+    type: string
+    hidden: true
+  InstanceNameTemplate:
+    default: 'instance-%08x'
+    description: Template string to be used to generate instance names
+    type: string
+  NovaEnableDBPurge:
+    default: true
+    description: |
+        Whether to create cron job for purging soft deleted rows in Nova database.
+    type: boolean
 
 resources:
   NovaBase:
@@ -75,5 +88,16 @@ outputs:
             nova::keystone::auth::admin_url: {get_param: [EndpointMap, NovaAdmin, uri]}
             nova::keystone::auth::password: {get_param: NovaPassword}
             nova::keystone::auth::region: {get_param: KeystoneRegion}
+            # NOTE: bind IP is found in Heat replacing the network name with the local node IP
+            # for the given network; replacement examples (eg. for internal_api):
+            # internal_api -> IP
+            # internal_api_uri -> [IP]
+            # internal_api_subnet - > IP/CIDR
+            nova::api::api_bind_address: {get_param: [ServiceNetMap, NovaApiNetwork]}
+            nova::api::metadata_listen: {get_param: [ServiceNetMap, NovaMetadataNetwork]}
+            nova::api::neutron_metadata_proxy_shared_secret: {get_param: NeutronMetadataProxySharedSecret}
+            nova::api::instance_name_template: {get_param: InstanceNameTemplate}
+            nova_enable_db_purge: {get_param: NovaEnableDBPurge}
+
       step_config: |
         include tripleo::profile::base::nova::api
diff --git a/puppet/services/nova-base.yaml b/puppet/services/nova-base.yaml
index 471ece34..24a63bb4 100644
--- a/puppet/services/nova-base.yaml
+++ b/puppet/services/nova-base.yaml
@@ -95,14 +95,14 @@ outputs:
               - '@'
               - {get_param: [EndpointMap, MysqlInternal, host]}
               - '/nova_api'
-        nova::db::mysql::password: {get_input: nova_password}
+        nova::db::mysql::password: {get_param: NovaPassword}
         nova::db::mysql::user: nova
         nova::db::mysql::host: {get_param: [EndpointMap, MysqlInternal, host_nobrackets]}
         nova::db::mysql::dbname: nova
         nova::db::mysql::allowed_hosts:
           - '%'
           - "%{hiera('mysql_bind_host')}"
-        nova::db::mysql_api::password: {get_input: nova_password}
+        nova::db::mysql_api::password: {get_param: NovaPassword}
         nova::db::mysql_api::user: nova_api
         nova::db::mysql_api::host: {get_param: [EndpointMap, MysqlInternal, host_nobrackets]}
         nova::db::mysql_api::dbname: nova_api
diff --git a/puppet/services/nova-vncproxy.yaml b/puppet/services/nova-vncproxy.yaml
index 0a1785d8..7444d7d8 100644
--- a/puppet/services/nova-vncproxy.yaml
+++ b/puppet/services/nova-vncproxy.yaml
@@ -46,5 +46,11 @@ outputs:
                   '[': ''
                   ']': ''
             nova::vncproxy::common::vncproxy_port: {get_param: [EndpointMap, NovaVNCProxyPublic, port]}
+            # NOTE: bind IP is found in Heat replacing the network name with the local node IP
+            # for the given network; replacement examples (eg. for internal_api):
+            # internal_api -> IP
+            # internal_api_uri -> [IP]
+            # internal_api_subnet - > IP/CIDR
+            nova::vncproxy::host: {get_param: [ServiceNetMap, NovaApiNetwork]}
       step_config: |
         include tripleo::profile::base::nova::vncproxy