diff options
| -rw-r--r-- | overcloud-resource-registry-puppet.yaml | 1 | ||||
| -rw-r--r-- | overcloud.yaml | 5 | ||||
| -rw-r--r-- | puppet/manifests/overcloud_cephstorage.pp | 2 | ||||
| -rw-r--r-- | puppet/manifests/overcloud_compute.pp | 2 | ||||
| -rw-r--r-- | puppet/manifests/overcloud_controller.pp | 2 | ||||
| -rw-r--r-- | puppet/manifests/overcloud_controller_pacemaker.pp | 2 | ||||
| -rw-r--r-- | puppet/manifests/overcloud_object.pp | 2 | ||||
| -rw-r--r-- | puppet/manifests/overcloud_volume.pp | 2 | ||||
| -rw-r--r-- | puppet/services/tripleo-firewall.yaml | 19 |
9 files changed, 25 insertions, 12 deletions
diff --git a/overcloud-resource-registry-puppet.yaml b/overcloud-resource-registry-puppet.yaml index 4219db58..4d31b69c 100644 --- a/overcloud-resource-registry-puppet.yaml +++ b/overcloud-resource-registry-puppet.yaml @@ -215,6 +215,7 @@ resource_registry: OS::TripleO::Services::IronicConductor: OS::Heat::None OS::TripleO::Services::NovaIronic: OS::Heat::None OS::TripleO::Services::TripleoPackages: puppet/services/tripleo-packages.yaml + OS::TripleO::Services::TripleoFirewall: puppet/services/tripleo-firewall.yaml parameter_defaults: EnablePackageInstall: false diff --git a/overcloud.yaml b/overcloud.yaml index 2c0076e3..89f32cff 100644 --- a/overcloud.yaml +++ b/overcloud.yaml @@ -171,6 +171,7 @@ parameters: - OS::TripleO::Services::IronicConductor - OS::TripleO::Services::NovaIronic - OS::TripleO::Services::TripleoPackages + - OS::TripleO::Services::TripleoFirewall description: A list of service resources (configured in the Heat resource_registry) which represent nested stacks for each service that should get installed on the Controllers. @@ -192,6 +193,7 @@ parameters: - OS::TripleO::Services::ComputeNeutronL3Agent - OS::TripleO::Services::ComputeNeutronMetadataAgent - OS::TripleO::Services::TripleoPackages + - OS::TripleO::Services::TripleoFirewall description: A list of service resources (configured in the Heat resource_registry) which represent nested stacks for each service that should get installed on the Compute Nodes. @@ -215,6 +217,7 @@ parameters: - OS::TripleO::Services::Timezone - OS::TripleO::Services::Snmp - OS::TripleO::Services::TripleoPackages + - OS::TripleO::Services::TripleoFirewall description: A list of service resources (configured in the Heat resource_registry) which represent nested stacks for each service that should get installed on the BlockStorage nodes. @@ -239,6 +242,7 @@ parameters: - OS::TripleO::Services::Snmp - OS::TripleO::Services::Timezone - OS::TripleO::Services::TripleoPackages + - OS::TripleO::Services::TripleoFirewall description: A list of service resources (configured in the Heat resource_registry) which represent nested stacks for each service that should get installed on the ObjectStorage nodes. @@ -263,6 +267,7 @@ parameters: - OS::TripleO::Services::Ntp - OS::TripleO::Services::Timezone - OS::TripleO::Services::TripleoPackages + - OS::TripleO::Services::TripleoFirewall description: A list of service resources (configured in the Heat resource_registry) which represent nested stacks for each service that should get installed on the CephStorage nodes. diff --git a/puppet/manifests/overcloud_cephstorage.pp b/puppet/manifests/overcloud_cephstorage.pp index 39b7aca2..2653badf 100644 --- a/puppet/manifests/overcloud_cephstorage.pp +++ b/puppet/manifests/overcloud_cephstorage.pp @@ -13,8 +13,6 @@ # License for the specific language governing permissions and limitations # under the License. -include ::tripleo::firewall - if hiera('step') >= 4 { hiera_include('ceph_classes', []) } diff --git a/puppet/manifests/overcloud_compute.pp b/puppet/manifests/overcloud_compute.pp index b8f75c9c..f96c193c 100644 --- a/puppet/manifests/overcloud_compute.pp +++ b/puppet/manifests/overcloud_compute.pp @@ -13,8 +13,6 @@ # License for the specific language governing permissions and limitations # under the License. -include ::tripleo::firewall - if hiera('step') >= 4 { hiera_include('compute_classes', []) } diff --git a/puppet/manifests/overcloud_controller.pp b/puppet/manifests/overcloud_controller.pp index 6290cac3..25bdbfb2 100644 --- a/puppet/manifests/overcloud_controller.pp +++ b/puppet/manifests/overcloud_controller.pp @@ -13,8 +13,6 @@ # License for the specific language governing permissions and limitations # under the License. -include ::tripleo::firewall - if hiera('step') >= 4 { hiera_include('controller_classes', []) } diff --git a/puppet/manifests/overcloud_controller_pacemaker.pp b/puppet/manifests/overcloud_controller_pacemaker.pp index ea6130c2..d329d5fc 100644 --- a/puppet/manifests/overcloud_controller_pacemaker.pp +++ b/puppet/manifests/overcloud_controller_pacemaker.pp @@ -13,8 +13,6 @@ # License for the specific language governing permissions and limitations # under the License. -include ::tripleo::firewall - if hiera('step') >= 4 { hiera_include('controller_classes', []) } diff --git a/puppet/manifests/overcloud_object.pp b/puppet/manifests/overcloud_object.pp index 428ba0f2..414a06ba 100644 --- a/puppet/manifests/overcloud_object.pp +++ b/puppet/manifests/overcloud_object.pp @@ -13,8 +13,6 @@ # License for the specific language governing permissions and limitations # under the License. -include ::tripleo::firewall - if hiera('step') >= 4 { hiera_include('object_classes', []) } diff --git a/puppet/manifests/overcloud_volume.pp b/puppet/manifests/overcloud_volume.pp index 821474dc..e1cdadd5 100644 --- a/puppet/manifests/overcloud_volume.pp +++ b/puppet/manifests/overcloud_volume.pp @@ -13,8 +13,6 @@ # License for the specific language governing permissions and limitations # under the License. -include ::tripleo::firewall - if hiera('step') >= 4 { hiera_include('volume_classes', []) } diff --git a/puppet/services/tripleo-firewall.yaml b/puppet/services/tripleo-firewall.yaml new file mode 100644 index 00000000..bd87eee8 --- /dev/null +++ b/puppet/services/tripleo-firewall.yaml @@ -0,0 +1,19 @@ +heat_template_version: 2016-04-08 + +description: > + TripleO Firewall settings + +parameters: + EndpointMap: + default: {} + description: Mapping of service endpoint -> protocol. Typically set + via parameter_defaults in the resource registry. + type: json + +outputs: + role_data: + description: Role data for the TripleO firewall settings + value: + service_name: tripleo_firewall + step_config: | + include ::tripleo::firewall |