Mv pacemaker and firewall out of controller

This patch moves settings for pacemaker and the tripleo firewall
out of controller.yaml.

Related bug: #1604414

Change-Id: I0164717bfd79cdea3de8eb7a64771028bea201ac

2 files changed, 67 insertions, 1 deletions

diff --git a/puppet/services/pacemaker.yaml b/puppet/services/pacemaker.yaml
index 31016761..5d1d666a 100644
--- a/puppet/services/pacemaker.yaml
+++ b/puppet/services/pacemaker.yaml
@@ -1,4 +1,4 @@
-heat_template_version: 2016-04-08
+heat_template_version: 2016-10-14
 
 description: >
   Pacemaker service configured with Puppet
@@ -21,6 +21,51 @@ parameters:
   MonitoringSubscriptionPacemaker:
     default: 'overcloud-pacemaker'
     type: string
+  CorosyncIPv6:
+    default: false
+    description: Enable IPv6 in Corosync
+    type: boolean
+  EnableFencing:
+    default: false
+    description: Whether to enable fencing in Pacemaker or not.
+    type: boolean
+  PcsdPassword:
+    type: string
+    description: The password for the 'pcsd' user for pacemaker.
+    hidden: true
+    default: ''
+  FencingConfig:
+    default: {}
+    description: |
+      Pacemaker fencing configuration. The JSON should have
+      the following structure:
+        {
+          "devices": [
+            {
+              "agent": "AGENT_NAME",
+              "host_mac": "HOST_MAC_ADDRESS",
+              "params": {"PARAM_NAME": "PARAM_VALUE"}
+            }
+          ]
+        }
+      For instance:
+        {
+          "devices": [
+            {
+              "agent": "fence_xvm",
+              "host_mac": "52:54:00:aa:bb:cc",
+              "params": {
+                "multicast_address": "225.0.0.12",
+                "port": "baremetal_0",
+                "manage_fw": true,
+                "manage_key_file": true,
+                "key_file": "/etc/fence_xvm.key",
+                "key_file_password": "abcdef"
+              }
+            }
+          ]
+        }
+    type: json
 
 outputs:
   role_data:
@@ -44,5 +89,15 @@ outputs:
           '131 pacemaker udp':
             proto: 'udp'
             dport: 5405
+        corosync_ipv6: {get_param: CorosyncIPv6}
+        tripleo::fencing::config: {get_param: FencingConfig}
+        enable_fencing: {get_param: EnableFencing}
+        hacluster_pwd:
+          yaql:
+            expression: $.data.passwords.where($ != '').first()
+            data:
+              passwords:
+                - {get_param: PcsdPassword}
+                - {get_param: [DefaultPasswords, pcsd_password]}
       step_config: |
         include ::tripleo::profile::base::pacemaker
diff --git a/puppet/services/tripleo-firewall.yaml b/puppet/services/tripleo-firewall.yaml
index 14965b4f..f6ec458f 100644
--- a/puppet/services/tripleo-firewall.yaml
+++ b/puppet/services/tripleo-firewall.yaml
@@ -18,11 +18,22 @@ parameters:
     description: Mapping of service endpoint -> protocol. Typically set
                  via parameter_defaults in the resource registry.
     type: json
+  ManageFirewall:
+    default: false
+    description: Whether to manage IPtables rules.
+    type: boolean
+  PurgeFirewallRules:
+    default: false
+    description: Whether IPtables rules should be purged before setting up the new ones.
+    type: boolean
 
 outputs:
   role_data:
     description: Role data for the TripleO firewall settings
     value:
       service_name: tripleo_firewall
+      config_settings:
+        tripleo::firewall::manage_firewall: {get_param: ManageFirewall}
+        tripleo::firewall::purge_firewall_rules: {get_param: PurgeFirewallRules}
       step_config: |
         include ::tripleo::firewall