Basic support for deploying Ironic in overcloud

Note that this change is not enough yet to deploy bare metal instances,
it only deploys Ironic services themselves and makes sure they work.

Also it does not support HA for now.

Co-Authored-By: Dmitry Tantsur <dtansur@redhat.com>
Partially-implements: blueprint ironic-integration
Change-Id: I541be905022264e2d4828e7c46338f2e300df540

3 files changed, 143 insertions, 0 deletions

diff --git a/puppet/services/ironic-api.yaml b/puppet/services/ironic-api.yaml
new file mode 100644
index 00000000..e1626d5b
--- /dev/null
+++ b/puppet/services/ironic-api.yaml
@@ -0,0 +1,43 @@
+heat_template_version: 2016-04-08
+
+description: >
+  OpenStack Ironic API configured with Puppet
+
+parameters:
+  EndpointMap:
+    default: {}
+    description: Mapping of service endpoint -> protocol. Typically set
+                 via parameter_defaults in the resource registry.
+    type: json
+  IronicPassword:
+    description: The password for the Ironic service and db account, used by the Ironic services
+    type: string
+    hidden: true
+
+resources:
+  IronicBase:
+    type: ./ironic-base.yaml
+    properties:
+      EndpointMap: {get_param: EndpointMap}
+
+outputs:
+  role_data:
+    description: Role data for the Ironic API role.
+    value:
+      config_settings:
+        map_merge:
+          - get_attr: [IronicBase, role_data, config_settings]
+          # NOTE(dtantsur): the my_ip parameter is heavily overloaded in
+          # ironic. It's used as a default value for e.g. TFTP server IP,
+          # glance and neutron endpoints, virtual console IP. We override
+          # the TFTP server IP in ironic-conductor.yaml as it should not be
+          # the VIP, but rather a real IP of the controller.
+          - ironic::my_ip: {get_param: [EndpointMap, MysqlInternal, host]}
+            ironic::api::admin_password: {get_param: IronicPassword}
+            ironic::keystone::auth::public_url: {get_param: [EndpointMap, IronicPublic, uri]}
+            ironic::keystone::auth::internal_url: {get_param: [EndpointMap, IronicInternal, uri]}
+            ironic::keystone::auth::admin_url: {get_param: [EndpointMap, IronicAdmin, uri]}
+            ironic::keystone::auth::password: {get_param: IronicPassword }
+
+      step_config: |
+        include ::tripleo::profile::base::ironic::api
diff --git a/puppet/services/ironic-base.yaml b/puppet/services/ironic-base.yaml
new file mode 100644
index 00000000..0eaa53cb
--- /dev/null
+++ b/puppet/services/ironic-base.yaml
@@ -0,0 +1,64 @@
+heat_template_version: 2016-04-08
+
+description: >
+  OpenStack Ironic services configured with Puppet
+
+parameters:
+  EndpointMap:
+    default: {}
+    description: Mapping of service endpoint -> protocol. Typically set
+                 via parameter_defaults in the resource registry.
+    type: json
+  Debug:
+    default: ''
+    description: Set to True to enable debugging on all services.
+    type: string
+  IronicPassword:
+    description: The password for the Ironic service and db account, used by the Ironic services
+    type: string
+    hidden: true
+  RabbitUserName:
+    default: guest
+    description: The username for RabbitMQ
+    type: string
+  RabbitPassword:
+    description: The password for RabbitMQ
+    type: string
+    hidden: true
+  RabbitClientPort:
+    default: 5672
+    description: Set rabbit subscriber port, change this if using SSL
+    type: number
+  RabbitClientUseSSL:
+    default: false
+    description: >
+        Rabbit client subscriber parameter to specify
+        an SSL connection to the RabbitMQ host.
+    type: string
+
+outputs:
+  role_data:
+    description: Role data for the Ironic role.
+    value:
+      config_settings:
+        ironic_dsn: &ironic_dsn
+          list_join:
+            - ''
+            - - {get_param: [EndpointMap, MysqlInternal, protocol]}
+              - '://ironic:'
+              - {get_param: IronicPassword}
+              - '@'
+              - {get_param: [EndpointMap, MysqlInternal, host]}
+              - '/ironic'
+        ironic::admin_tenant_name: 'service'
+        ironic::database_connection: *ironic_dsn
+        ironic::debug: {get_param: Debug}
+        ironic::rabbit_userid: {get_param: RabbitUserName}
+        ironic::rabbit_password: {get_param: RabbitPassword}
+        ironic::rabbit_port: {get_param: RabbitClientPort}
+        ironic::rabbit_use_ssl: {get_param: RabbitClientUseSSL}
+        ironic::db::mysql::password: {get_param: IronicPassword}
+        ironic::keystone::auth::tenant: 'service'
+
+      step_config: |
+        include ::tripleo::profile::base::ironic
diff --git a/puppet/services/ironic-conductor.yaml b/puppet/services/ironic-conductor.yaml
new file mode 100644
index 00000000..3fb3d9fd
--- /dev/null
+++ b/puppet/services/ironic-conductor.yaml
@@ -0,0 +1,36 @@
+heat_template_version: 2016-04-08
+
+description: >
+  OpenStack Ironic conductor configured with Puppet
+
+parameters:
+  EndpointMap:
+    default: {}
+    description: Mapping of service endpoint -> protocol. Typically set
+                 via parameter_defaults in the resource registry.
+    type: json
+  IronicEnabledDrivers:
+    default: ['pxe_ipmitool', 'agent_ipmitool']
+    description: Enabled Ironic drivers
+    type: comma_delimited_list
+
+resources:
+  IronicBase:
+    type: ./ironic-base.yaml
+    properties:
+      EndpointMap: {get_param: EndpointMap}
+
+outputs:
+  role_data:
+    description: Role data for the Ironic conductor role.
+    value:
+      config_settings:
+        map_merge:
+          - get_attr: [IronicBase, role_data, config_settings]
+          - ironic::enabled_drivers: {get_param: IronicEnabledDrivers}
+            # Prevent tftp_server from defaulting to my_ip setting, which is
+            # controller VIP, not a real IP.
+            ironic::drivers::pxe::tftp_server: {get_input: ironic_api_network}
+
+      step_config: |
+        include ::tripleo::profile::base::ironic::conductor