aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
-rw-r--r--docker/README-containers.md3
-rw-r--r--docker/compute-post.yaml349
-rw-r--r--docker/copy-json.py72
-rw-r--r--docker/post.j2.yaml308
-rw-r--r--docker/services/README.rst60
-rw-r--r--docker/services/neutron-ovs-agent.yaml75
-rw-r--r--docker/services/nova-compute.yaml69
-rw-r--r--docker/services/nova-libvirt.yaml69
-rw-r--r--docker/services/services.yaml73
-rw-r--r--environments/docker.yaml31
-rw-r--r--environments/enable-internal-tls.yaml2
-rw-r--r--environments/puppet-pacemaker.yaml3
-rw-r--r--environments/services/panko.yaml2
-rw-r--r--environments/tls-endpoints-public-dns.yaml3
-rw-r--r--environments/tls-endpoints-public-ip.yaml3
-rw-r--r--environments/tls-everywhere-endpoints-dns.yaml3
-rw-r--r--extraconfig/tasks/mitaka_to_newton_ceilometer_wsgi_upgrade.pp8
-rwxr-xr-xextraconfig/tasks/yum_update.sh38
-rw-r--r--network/endpoints/endpoint_data.yaml9
-rw-r--r--network/endpoints/endpoint_map.yaml246
-rw-r--r--network/service_net_map.j2.yaml1
-rw-r--r--overcloud-resource-registry-puppet.j2.yaml2
-rw-r--r--overcloud.j2.yaml2
-rw-r--r--puppet/blockstorage-role.yaml1
-rw-r--r--puppet/cephstorage-role.yaml1
-rw-r--r--puppet/compute-role.yaml1
-rw-r--r--puppet/config.role.j2.yaml17
-rw-r--r--puppet/controller-role.yaml1
-rw-r--r--puppet/objectstorage-role.yaml1
-rw-r--r--puppet/role.role.j2.yaml1
-rw-r--r--puppet/services/aodh-api.yaml6
-rw-r--r--puppet/services/barbican-api.yaml14
-rw-r--r--puppet/services/ceilometer-base.yaml7
-rw-r--r--puppet/services/haproxy.yaml12
-rw-r--r--puppet/services/horizon.yaml2
-rw-r--r--puppet/services/keepalived.yaml14
-rw-r--r--puppet/services/keystone.yaml11
-rw-r--r--puppet/services/neutron-api.yaml38
-rw-r--r--puppet/services/pacemaker/haproxy.yaml2
-rw-r--r--puppet/services/panko-api.yaml84
-rw-r--r--puppet/services/panko-base.yaml74
-rw-r--r--roles_data.yaml1
42 files changed, 1290 insertions, 429 deletions
diff --git a/docker/README-containers.md b/docker/README-containers.md
index ff062a93..5a9f6f3c 100644
--- a/docker/README-containers.md
+++ b/docker/README-containers.md
@@ -20,6 +20,9 @@ glance image-create --name atomic-image --file Fedora-Cloud-Atomic-22-20150521.x
You can use the tripleo.sh script up until the point of running the Overcloud.
https://github.com/openstack/tripleo-common/blob/master/scripts/tripleo.sh
+You will want to set up the runtime puppet script delivery system described here:
+http://hardysteven.blogspot.ca/2016/08/tripleo-deploy-artifacts-and-puppet.html
+
Create the Overcloud:
```
$ openstack overcloud deploy --templates=tripleo-heat-templates -e tripleo-heat-templates/environments/docker.yaml -e tripleo-heat-templates/environments/docker-network.yaml --libvirt-type=qemu
diff --git a/docker/compute-post.yaml b/docker/compute-post.yaml
deleted file mode 100644
index 60b831be..00000000
--- a/docker/compute-post.yaml
+++ /dev/null
@@ -1,349 +0,0 @@
-heat_template_version: 2015-10-15
-description: >
- OpenStack compute node post deployment for Docker.
-
-parameters:
- servers:
- type: json
- DeployIdentifier:
- type: string
- description: Value which changes if the node configuration may need to be re-applied
- DockerNamespace:
- type: string
- default: tripleoupstream
- DockerComputeImage:
- type: string
- DockerComputeDataImage:
- type: string
- DockerLibvirtImage:
- type: string
- DockerOpenvswitchImage:
- type: string
- DockerOvsVswitchdImage:
- type: string
- DockerOpenvswitchDBImage:
- type: string
- LibvirtConfig:
- type: string
- default: "/etc/libvirt/libvirtd.conf"
- NovaConfig:
- type: string
- default: "/etc/nova/nova.conf,/etc/nova/rootwrap.conf"
- NeutronOpenvswitchAgentConfig:
- type: string
- default: "/etc/neutron/neutron.conf,/etc/neutron/plugins/openvswitch/ovs_neutron_plugin.ini"
- NeutronOpenvswitchAgentPluginVolume:
- type: string
- default: "/var/lib/etc-data/neutron/plugins/ml2/openvswitch_agent.ini:/var/lib/kolla/config_files/ovs_neutron_plugin.ini:ro"
- NeutronOpenvswitchAgentOvsVolume:
- type: string
- default: " "
- StepConfig:
- type: string
- description: Config manifests that will be used to step through the deployment.
- default: ''
- RoleData:
- type: json
- default: {}
-
-
-resources:
-
- ComputePuppetConfig:
- type: OS::Heat::SoftwareConfig
- properties:
- group: puppet
- options:
- enable_hiera: True
- enable_facter: False
- tags: package,file,concat,file_line,nova_config,neutron_config,neutron_agent_ovs,neutron_plugin_ml2
- inputs:
- - name: tripleo::packages::enable_install
- type: Boolean
- default: True
- outputs:
- - name: result
- config:
- list_join:
- - ''
- - - get_file: ../puppet/manifests/overcloud_compute.pp
- - {get_param: StepConfig}
-
-
- ComputePuppetDeployment:
- type: OS::Heat::SoftwareDeployments
- properties:
- name: ComputePuppetDeployment
- servers: {get_param: servers}
- config: {get_resource: ComputePuppetConfig}
- input_values:
- update_identifier: {get_param: DeployIdentifier}
- tripleo::packages::enable_install: True
-
- CopyEtcConfig:
- type: OS::Heat::SoftwareConfig
- properties:
- group: script
- outputs:
- - name: result
- config: {get_file: ./copy-etc.sh}
-
- CopyEtcDeployment:
- type: OS::Heat::SoftwareDeployments
- depends_on: ComputePuppetDeployment
- properties:
- name: CopyEtcDeployment
- config: {get_resource: CopyEtcConfig}
- servers: {get_param: servers}
-
- CopyJsonConfig:
- type: OS::Heat::SoftwareConfig
- properties:
- group: script
- inputs:
- - name: libvirt_config
- - name: nova_config
- - name: neutron_openvswitch_agent_config
- config: |
- #!/bin/python
- import json
- import os
-
- data = {}
- file_perms = '600'
- libvirt_perms = '644'
-
- libvirt_config = os.getenv('libvirt_config').split(',')
- nova_config = os.getenv('nova_config').split(',')
- neutron_openvswitch_agent_config = os.getenv('neutron_openvswitch_agent_config').split(',')
-
- # Command, Config_files, Owner, Perms
- services = {'nova-libvirt': ['/usr/sbin/libvirtd', libvirt_config, 'root', libvirt_perms],
- 'nova-compute': ['/usr/bin/nova-compute', nova_config, 'nova', file_perms],
- 'neutron-openvswitch-agent': ['/usr/bin/neutron-openvswitch-agent', neutron_openvswitch_agent_config, 'neutron', file_perms],
- 'ovs-vswitchd': ['/usr/sbin/ovs-vswitchd unix:/run/openvswitch/db.sock -vconsole:emer -vsyslog:err -vfile:info --mlockall --log-file=/var/log/openvswitch/ovs-vswitchd.log'],
- 'ovsdb-server': ['/usr/sbin/ovsdb-server /etc/openvswitch/conf.db -vconsole:emer -vsyslog:err -vfile:info --remote=punix:/run/openvswitch/db.sock --log-file=/var/log/openvswitch/ovsdb-server.log']
- }
-
-
- def build_config_files(config, owner, perms):
- config_source = '/var/lib/kolla/config_files/'
- config_files_dict = {}
- source = os.path.basename(config)
- dest = config
- config_files_dict.update({'source': config_source + source,
- 'dest': dest,
- 'owner': owner,
- 'perm': perms})
- return config_files_dict
-
-
- for service in services:
- if service != 'ovs-vswitchd' and service != 'ovsdb-server':
- command = services.get(service)[0]
- config_files = services.get(service)[1]
- owner = services.get(service)[2]
- perms = services.get(service)[3]
- config_files_list = []
- for config_file in config_files:
- if service == 'nova-libvirt':
- command = command + ' --config ' + config_file
- else:
- command = command + ' --config-file ' + config_file
- data['command'] = command
- config_files_dict = build_config_files(config_file, owner, perms)
- config_files_list.append(config_files_dict)
- data['config_files'] = config_files_list
- else:
- data['command'] = services.get(service)[0]
- data['config_files'] = []
-
- json_config_dir = '/var/lib/etc-data/json-config/'
- with open(json_config_dir + service + '.json', 'w') as json_file:
- json.dump(data, json_file, sort_keys=True, indent=4, separators=(',', ': '))
-
- CopyJsonDeployment:
- type: OS::Heat::SoftwareDeployments
- depends_on: CopyEtcDeployment
- properties:
- name: CopyJsonDeployment
- config: {get_resource: CopyJsonConfig}
- servers: {get_param: servers}
- input_values:
- libvirt_config: {get_param: LibvirtConfig}
- nova_config: {get_param: NovaConfig}
- neutron_openvswitch_agent_config: {get_param: NeutronOpenvswitchAgentConfig}
-
- NovaComputeContainersDeploymentOVS:
- type: OS::Heat::StructuredDeployments
- depends_on: CopyJsonDeployment
- properties:
- name: NovaComputeContainersDeploymentOVS
- config: {get_resource: NovaComputeContainersConfigOVS}
- servers: {get_param: servers}
-
- NovaComputeContainersConfigOVS:
- type: OS::Heat::StructuredConfig
- properties:
- group: docker-cmd
- config:
- ovsvswitchd:
- image:
- list_join:
- - '/'
- - [ {get_param: DockerNamespace}, {get_param: DockerOvsVswitchdImage} ]
- net: host
- privileged: true
- restart: always
- volumes:
- - /run:/run
- - /lib/modules:/lib/modules:ro
- - /var/lib/etc-data/json-config/ovs-vswitchd.json:/var/lib/kolla/config_files/config.json
- environment:
- - KOLLA_CONFIG_STRATEGY=COPY_ALWAYS
-
- openvswitchdb:
- image:
- list_join:
- - '/'
- - [ {get_param: DockerNamespace}, {get_param: DockerOpenvswitchDBImage} ]
- net: host
- restart: always
- volumes:
- - /run:/run
- - /var/lib/etc-data/json-config/ovsdb-server.json:/var/lib/kolla/config_files/config.json
- - /etc/openvswitchd:/etc/openvswitchd
- environment:
- - KOLLA_CONFIG_STRATEGY=COPY_ALWAYS
-
- NovaComputeContainersDeploymentNetconfig:
- type: OS::Heat::SoftwareDeployments
- depends_on: NovaComputeContainersDeploymentOVS
- properties:
- name: NovaComputeContainersDeploymentNetconfig
- config: {get_resource: NovaComputeContainersConfigNetconfig}
- servers: {get_param: servers}
-
- # We run os-net-config here because we depend on the ovs containers to be up
- # and running before we configure the network. This allows explicit timing
- # of the network configuration.
- NovaComputeContainersConfigNetconfig:
- type: OS::Heat::SoftwareConfig
- properties:
- group: script
- outputs:
- - name: result
- config: |
- #!/bin/bash
- /usr/local/bin/run-os-net-config
-
- LibvirtContainersDeployment:
- type: OS::Heat::StructuredDeployments
- depends_on: [CopyJsonDeployment, CopyEtcDeployment, ComputePuppetDeployment, NovaComputeContainersDeploymentNetconfig]
- properties:
- name: LibvirtContainersDeployment
- config: {get_resource: LibvirtContainersConfig}
- servers: {get_param: servers}
-
- LibvirtContainersConfig:
- type: OS::Heat::StructuredConfig
- properties:
- group: docker-cmd
- config:
- computedata:
- image:
- list_join:
- - '/'
- - [ {get_param: DockerNamespace}, {get_param: DockerComputeDataImage} ]
- container_name: computedata
- volumes:
- - /var/lib/nova/instances
- - /var/lib/libvirt
-
- libvirt:
- image:
- list_join:
- - '/'
- - [ {get_param: DockerNamespace}, {get_param: DockerLibvirtImage} ]
- net: host
- pid: host
- privileged: true
- restart: always
- volumes:
- - /run:/run
- - /lib/modules:/lib/modules:ro
- - /dev:/dev
- - /lib/udev:/lib/udev
- - /sys/fs/cgroup:/sys/fs/cgroup
- - /var/lib/etc-data/json-config/nova-libvirt.json:/var/lib/kolla/config_files/config.json
- - /var/lib/etc-data/libvirt/libvirtd.conf:/var/lib/kolla/config_files/libvirtd.conf
- environment:
- - KOLLA_CONFIG_STRATEGY=COPY_ALWAYS
- volumes_from:
- - computedata
-
- NovaComputeContainersDeployment:
- type: OS::Heat::StructuredDeployments
- depends_on: [CopyJsonDeployment, CopyEtcDeployment, ComputePuppetDeployment, NovaComputeContainersDeploymentNetconfig, LibvirtContainersDeployment]
- properties:
- name: NovaComputeContainersDeployment
- config: {get_resource: NovaComputeContainersConfig}
- servers: {get_param: servers}
-
- NovaComputeContainersConfig:
- type: OS::Heat::StructuredConfig
- properties:
- group: docker-cmd
- config:
- neutronovsagent:
- image:
- list_join:
- - '/'
- - [ {get_param: DockerNamespace}, {get_param: DockerOpenvswitchImage} ]
- net: host
- pid: host
- privileged: true
- restart: always
- volumes:
- str_split:
- - ","
- - list_join:
- - ","
- - [ "/run:/run", "/lib/modules:/lib/modules:ro",
- "/var/lib/etc-data/json-config/neutron-openvswitch-agent.json:/var/lib/kolla/config_files/config.json",
- "/var/lib/etc-data/neutron/neutron.conf:/var/lib/kolla/config_files/neutron.conf:ro",
- "/var/lib/etc-data/neutron/plugins/ml2/ml2_conf.ini:/var/lib/kolla/config_files/ml2_conf.ini:ro",
- {get_param: NeutronOpenvswitchAgentPluginVolume},
- {get_param: NeutronOpenvswitchAgentOvsVolume} ]
- environment:
- - KOLLA_CONFIG_STRATEGY=COPY_ALWAYS
- volumes_from:
- - computedata
-
- novacompute:
- image:
- list_join:
- - '/'
- - [ {get_param: DockerNamespace}, {get_param: DockerComputeImage} ]
- net: host
- privileged: true
- restart: always
- volumes:
- - /run:/run
- - /lib/modules:/lib/modules:ro
- - /dev:/dev
- - /lib/udev:/lib/udev
- - /etc/iscsi:/etc/iscsi
- - /var/lib/etc-data/json-config/nova-compute.json:/var/lib/kolla/config_files/config.json
- - /var/lib/etc-data/nova/nova.conf:/var/lib/kolla/config_files/nova.conf:ro
- - /var/lib/etc-data/nova/rootwrap.conf:/var/lib/kolla/config_files/rootwrap.conf:ro
- environment:
- - KOLLA_CONFIG_STRATEGY=COPY_ALWAYS
- volumes_from:
- - computedata
-
- ExtraConfig:
- depends_on: NovaComputeContainersDeployment
- type: OS::TripleO::NodeExtraConfigPost
- properties:
- servers: {get_param: servers}
diff --git a/docker/copy-json.py b/docker/copy-json.py
new file mode 100644
index 00000000..e85ff11e
--- /dev/null
+++ b/docker/copy-json.py
@@ -0,0 +1,72 @@
+#!/bin/python
+import json
+import os
+
+data = {}
+file_perms = '0600'
+libvirt_perms = '0644'
+
+libvirt_config = os.getenv('libvirt_config').split(',')
+nova_config = os.getenv('nova_config').split(',')
+neutron_openvswitch_agent_config = os.getenv('neutron_openvswitch_agent_config').split(',')
+
+# Command, Config_files, Owner, Perms
+services = {
+ 'nova-libvirt': [
+ '/usr/sbin/libvirtd',
+ libvirt_config,
+ 'root',
+ libvirt_perms],
+ 'nova-compute': [
+ '/usr/bin/nova-compute',
+ nova_config,
+ 'nova',
+ file_perms],
+ 'neutron-openvswitch-agent': [
+ '/usr/bin/neutron-openvswitch-agent',
+ neutron_openvswitch_agent_config,
+ 'neutron',
+ file_perms],
+ 'ovs-vswitchd': [
+ '/usr/sbin/ovs-vswitchd unix:/run/openvswitch/db.sock -vconsole:emer -vsyslog:err -vfile:info --mlockall --log-file=/var/log/kolla/openvswitch/ovs-vswitchd.log'],
+ 'ovsdb-server': [
+ '/usr/sbin/ovsdb-server /etc/openvswitch/conf.db -vconsole:emer -vsyslog:err -vfile:info --remote=punix:/run/openvswitch/db.sock --remote=ptcp:6640:127.0.0.1 --log-file=/var/log/kolla/openvswitch/ovsdb-server.log']
+}
+
+
+def build_config_files(config, owner, perms):
+ config_source = '/var/lib/kolla/config_files/'
+ config_files_dict = {}
+ source = os.path.basename(config)
+ dest = config
+ config_files_dict.update({'source': config_source + source,
+ 'dest': dest,
+ 'owner': owner,
+ 'perm': perms})
+ return config_files_dict
+
+
+for service in services:
+ if service != 'ovs-vswitchd' and service != 'ovsdb-server':
+ command = services.get(service)[0]
+ config_files = services.get(service)[1]
+ owner = services.get(service)[2]
+ perms = services.get(service)[3]
+ config_files_list = []
+ for config_file in config_files:
+ if service == 'nova-libvirt':
+ command = command + ' --config ' + config_file
+ else:
+ command = command + ' --config-file ' + config_file
+ data['command'] = command
+ config_files_dict = build_config_files(config_file, owner, perms)
+ config_files_list.append(config_files_dict)
+ data['config_files'] = config_files_list
+ else:
+ data['command'] = services.get(service)[0]
+ data['config_files'] = []
+
+ json_config_dir = '/var/lib/etc-data/json-config/'
+ with open(json_config_dir + service + '.json', 'w') as json_file:
+ json.dump(data, json_file, sort_keys=True, indent=4,
+ separators=(',', ': '))
diff --git a/docker/post.j2.yaml b/docker/post.j2.yaml
new file mode 100644
index 00000000..de17cffe
--- /dev/null
+++ b/docker/post.j2.yaml
@@ -0,0 +1,308 @@
+heat_template_version: 2016-10-14
+
+description: >
+ Post-deploy configuration steps via puppet for all roles,
+ as defined in ../roles_data.yaml
+
+parameters:
+ servers:
+ type: json
+ description: Mapping of Role name e.g Controller to a list of servers
+
+ role_data:
+ type: json
+ description: Mapping of Role name e.g Controller to the per-role data
+
+ DeployIdentifier:
+ default: ''
+ type: string
+ description: >
+ Setting this to a unique value will re-run any deployment tasks which
+ perform configuration on a Heat stack-update.
+
+ DockerNamespace:
+ description: namespace
+ default: 'tripleoupstream'
+ type: string
+
+ DockerOpenvswitchDBImage:
+ description: image
+ default: 'centos-binary-openvswitch-db-server'
+ type: string
+
+ DockerOvsVswitchdImage:
+ description: image
+ default: 'centos-binary-openvswitch-vswitchd'
+ type: string
+
+ LibvirtConfig:
+ type: string
+ default: "/etc/libvirt/libvirtd.conf"
+
+ NovaConfig:
+ type: string
+ default: "/etc/nova/nova.conf,/etc/nova/rootwrap.conf"
+
+ NeutronOpenvswitchAgentConfig:
+ type: string
+ default: "/etc/neutron/neutron.conf,/etc/neutron/plugins/openvswitch/ovs_neutron_plugin.ini"
+
+resources:
+
+{% for role in roles %}
+ # Post deployment steps for all roles
+ # A single config is re-applied with an incrementing step number
+ # {{role.name}} Role steps
+ {{role.name}}ArtifactsConfig:
+ type: ../puppet/deploy-artifacts.yaml
+
+ {{role.name}}ArtifactsDeploy:
+ type: OS::Heat::StructuredDeploymentGroup
+ properties:
+ servers: {get_param: [servers, {{role.name}}]}
+ config: {get_resource: {{role.name}}ArtifactsConfig}
+
+ {{role.name}}PreConfig:
+ type: OS::TripleO::Tasks::{{role.name}}PreConfig
+ properties:
+ servers: {get_param: [servers, {{role.name}}]}
+ input_values:
+ update_identifier: {get_param: DeployIdentifier}
+
+ {{role.name}}Config:
+ type: OS::TripleO::{{role.name}}Config
+ properties:
+ StepConfig: {get_param: [role_data, {{role.name}}, step_config]}
+ {% if role.name.lower() == 'compute' %}
+ PuppetTags: {get_param: [role_data, {{role.name}}, puppet_tags]}
+ {% endif %}
+
+ # Step through a series of configuration steps
+ {{role.name}}Deployment_Step1:
+ type: OS::Heat::StructuredDeploymentGroup
+ depends_on: [{{role.name}}PreConfig, {{role.name}}ArtifactsDeploy]
+ properties:
+ name: {{role.name}}Deployment_Step1
+ servers: {get_param: [servers, {{role.name}}]}
+ config: {get_resource: {{role.name}}Config}
+ input_values:
+ step: 1
+ update_identifier: {get_param: DeployIdentifier}
+
+ {{role.name}}Deployment_Step2:
+ type: OS::Heat::StructuredDeploymentGroup
+ depends_on:
+ {% for dep in roles %}
+ - {{dep.name}}Deployment_Step1
+ {% endfor %}
+ properties:
+ name: {{role.name}}Deployment_Step2
+ servers: {get_param: [servers, {{role.name}}]}
+ config: {get_resource: {{role.name}}Config}
+ input_values:
+ step: 2
+ update_identifier: {get_param: DeployIdentifier}
+
+ {{role.name}}Deployment_Step3:
+ type: OS::Heat::StructuredDeploymentGroup
+ depends_on:
+ {% for dep in roles %}
+ - {{dep.name}}Deployment_Step2
+ {% endfor %}
+ properties:
+ name: {{role.name}}Deployment_Step3
+ servers: {get_param: [servers, {{role.name}}]}
+ config: {get_resource: {{role.name}}Config}
+ input_values:
+ step: 3
+ update_identifier: {get_param: DeployIdentifier}
+
+ {{role.name}}Deployment_Step4:
+ type: OS::Heat::StructuredDeploymentGroup
+ depends_on:
+ {% for dep in roles %}
+ - {{dep.name}}Deployment_Step3
+ {% endfor %}
+ properties:
+ name: {{role.name}}Deployment_Step4
+ servers: {get_param: [servers, {{role.name}}]}
+ config: {get_resource: {{role.name}}Config}
+ input_values:
+ step: 4
+ update_identifier: {get_param: DeployIdentifier}
+
+ {{role.name}}Deployment_Step5:
+ type: OS::Heat::StructuredDeploymentGroup
+ depends_on:
+ {% for dep in roles %}
+ - {{dep.name}}Deployment_Step4
+ {% endfor %}
+ properties:
+ name: {{role.name}}Deployment_Step5
+ servers: {get_param: [servers, {{role.name}}]}
+ config: {get_resource: {{role.name}}Config}
+ input_values:
+ step: 5
+ update_identifier: {get_param: DeployIdentifier}
+
+ {{role.name}}PostConfig:
+ type: OS::TripleO::Tasks::{{role.name}}PostConfig
+ depends_on:
+ {% for dep in roles %}
+ - {{dep.name}}Deployment_Step5
+ {% endfor %}
+ properties:
+ servers: {get_param: servers}
+ input_values:
+ update_identifier: {get_param: DeployIdentifier}
+
+ # Note, this should come last, so use depends_on to ensure
+ # this is created after any other resources.
+ {{role.name}}ExtraConfigPost:
+ depends_on:
+ {% for dep in roles %}
+ - {{dep.name}}PostConfig
+ {% endfor %}
+ type: OS::TripleO::NodeExtraConfigPost
+ properties:
+ servers: {get_param: [servers, {{role.name}}]}
+
+ {% if role.name.lower() == 'compute' %}
+ CopyEtcConfig:
+ type: OS::Heat::SoftwareConfig
+ depends_on: {{role.name}}PostConfig
+ properties:
+ group: script
+ outputs:
+ - name: result
+ config: {get_file: ../docker/copy-etc.sh}
+
+ CopyEtcDeployment:
+ type: OS::Heat::SoftwareDeploymentGroup
+ properties:
+ name: CopyEtcDeployment
+ servers: {get_param: [servers, {{role.name}}]}
+ config: {get_resource: CopyEtcConfig}
+
+ CopyJsonConfig:
+ type: OS::Heat::SoftwareConfig
+ properties:
+ group: script
+ inputs:
+ - name: libvirt_config
+ - name: nova_config
+ - name: neutron_openvswitch_agent_config
+ config: {get_file: ../docker/copy-json.py}
+
+ CopyJsonDeployment:
+ type: OS::Heat::SoftwareDeploymentGroup
+ depends_on: CopyEtcDeployment
+ properties:
+ name: CopyJsonDeployment
+ config: {get_resource: CopyJsonConfig}
+ servers: {get_param: [servers, {{role.name}}]}
+ input_values:
+ libvirt_config: {get_param: LibvirtConfig}
+ nova_config: {get_param: NovaConfig}
+ neutron_openvswitch_agent_config: {get_param: NeutronOpenvswitchAgentConfig}
+
+ NovaComputeContainersDeploymentOVS:
+ type: OS::Heat::StructuredDeploymentGroup
+ depends_on: CopyJsonDeployment
+ properties:
+ name: NovaComputeContainersDeploymentOVS
+ config: {get_resource: NovaComputeContainersConfigOVS}
+ servers: {get_param: [servers, {{role.name}}]}
+
+ NovaComputeContainersConfigOVS:
+ type: OS::Heat::StructuredConfig
+ properties:
+ group: docker-cmd
+ config:
+ openvswitchdb:
+ image:
+ list_join:
+ - '/'
+ - [ {get_param: DockerNamespace}, {get_param: DockerOpenvswitchDBImage} ]
+ net: host
+ restart: always
+ volumes:
+ - /var/lib/etc-data/json-config/ovsdb-server.json:/var/lib/kolla/config_files/config.json
+ - /etc/localtime:/etc/localtime:ro
+ - /run:/run
+ - logs:/var/log/kolla/
+ - openvswitch_db:/var/lib/openvswitch/
+ environment:
+ - KOLLA_CONFIG_STRATEGY=COPY_ALWAYS
+
+ ovsvswitchd:
+ image:
+ list_join:
+ - '/'
+ - [ {get_param: DockerNamespace}, {get_param: DockerOvsVswitchdImage} ]
+ net: host
+ privileged: true
+ restart: always
+ volumes:
+ - /var/lib/etc-data/json-config/ovs-vswitchd.json:/var/lib/kolla/config_files/config.json
+ - /etc/localtime:/etc/localtime:ro
+ - /lib/modules:/lib/modules:ro
+ - /run:/run
+ - logs:/var/log/kolla/
+ environment:
+ - KOLLA_CONFIG_STRATEGY=COPY_ALWAYS
+
+ NovaComputeContainersDeploymentNetconfig:
+ type: OS::Heat::SoftwareDeploymentGroup
+ depends_on: NovaComputeContainersDeploymentOVS
+ properties:
+ name: NovaComputeContainersDeploymentNetconfig
+ config: {get_resource: NovaComputeContainersConfigNetconfig}
+ servers: {get_param: [servers, {{role.name}}]}
+
+ # We run os-net-config here because we depend on the ovs containers to be up
+ # and running before we configure the network. This allows explicit timing
+ # of the network configuration.
+ NovaComputeContainersConfigNetconfig:
+ type: OS::Heat::SoftwareConfig
+ properties:
+ group: script
+ outputs:
+ - name: result
+ config: |
+ #!/bin/bash
+ /usr/local/bin/run-os-net-config
+
+ {{role.name}}ContainersConfig_Step1:
+ type: OS::Heat::StructuredConfig
+ depends_on: CopyJsonDeployment
+ properties:
+ group: docker-cmd
+ config:
+ {get_param: [role_data, {{role.name}}, docker_config, step_1]}
+
+ {{role.name}}ContainersConfig_Step2:
+ type: OS::Heat::StructuredConfig
+ depends_on: CopyJsonDeployment
+ properties:
+ group: docker-cmd
+ config:
+ {get_param: [role_data, {{role.name}}, docker_config, step_2]}
+
+ {{role.name}}ContainersDeployment_Step1:
+ type: OS::Heat::StructuredDeploymentGroup
+ depends_on: [{{role.name}}PreConfig, {{role.name}}ArtifactsDeploy, NovaComputeContainersDeploymentNetconfig]
+ properties:
+ name: {{role.name}}ContainersDeployment_Step1
+ servers: {get_param: [servers, {{role.name}}]}
+ config: {get_resource: {{role.name}}ContainersConfig_Step1}
+
+ {{role.name}}ContainersDeployment_Step2:
+ type: OS::Heat::StructuredDeploymentGroup
+ depends_on: {{role.name}}ContainersDeployment_Step1
+ properties:
+ name: {{role.name}}ContainersDeployment_Step2
+ servers: {get_param: [servers, {{role.name}}]}
+ config: {get_resource: {{role.name}}ContainersConfig_Step2}
+ {% endif %}
+{% endfor %}
diff --git a/docker/services/README.rst b/docker/services/README.rst
new file mode 100644
index 00000000..8d1f9e86
--- /dev/null
+++ b/docker/services/README.rst
@@ -0,0 +1,60 @@
+========
+services
+========
+
+A TripleO nested stack Heat template that encapsulates generic configuration
+data to configure a specific service. This generally includes everything
+needed to configure the service excluding the local bind ports which
+are still managed in the per-node role templates directly (controller.yaml,
+compute.yaml, etc.). All other (global) service settings go into
+the puppet/service templates.
+
+Input Parameters
+----------------
+
+Each service may define its own input parameters and defaults.
+Operators will use the parameter_defaults section of any Heat
+environment to set per service parameters.
+
+Config Settings
+---------------
+
+Each service may define a config_settings output variable which returns
+Hiera settings to be configured.
+
+Steps
+-----
+
+Each service may define an output variable which returns a puppet manifest
+snippet that will run at each of the following steps. Earlier manifests
+are re-asserted when applying latter ones.
+
+ * config_settings: Custom hiera settings for this service. These are
+ used to generate configs.
+
+ * step_config: A puppet manifest that is used to step through the deployment
+ sequence. Each sequence is given a "step" (via hiera('step') that provides
+ information for when puppet classes should activate themselves.
+
+ * docker_compose:
+
+ * container_name:
+
+ * volumes:
+
+Steps correlate to the following:
+
+ 1) Service configuration generation with puppet.
+
+ 2) Early Openstack Service setup (database init?)
+
+ 3) Early containerized networking services startup (OVS)
+
+ 4) Network configuration
+
+ 5) General OpenStack Services
+
+ 6) Service activation (Pacemaker)
+
+ 7) Fencing (Pacemaker)
+
diff --git a/docker/services/neutron-ovs-agent.yaml b/docker/services/neutron-ovs-agent.yaml
new file mode 100644
index 00000000..8d092a34
--- /dev/null
+++ b/docker/services/neutron-ovs-agent.yaml
@@ -0,0 +1,75 @@
+heat_template_version: 2015-04-30
+
+description: >
+ OpenStack Neutron openvswitch service
+
+parameters:
+ DockerNamespace:
+ description: namespace
+ default: 'tripleoupstream'
+ type: string
+ DockerOpenvswitchImage:
+ description: image
+ default: 'centos-binary-neutron-openvswitch-agent'
+ type: string
+ NeutronOpenvswitchAgentPluginVolume:
+ type: string
+ default: "/var/lib/etc-data/neutron/plugins/ml2/openvswitch_agent.ini:/var/lib/kolla/config_files/ovs_neutron_plugin.ini:ro"
+ NeutronOpenvswitchAgentOvsVolume:
+ type: string
+ default: " "
+ ServiceNetMap:
+ default: {}
+ description: Mapping of service_name -> network name. Typically set
+ via parameter_defaults in the resource registry. This
+ mapping overrides those in ServiceNetMapDefaults.
+ type: json
+ DefaultPasswords:
+ default: {}
+ type: json
+ EndpointMap:
+ default: {}
+ description: Mapping of service endpoint -> protocol. Typically set
+ via parameter_defaults in the resource registry.
+ type: json
+
+resources:
+
+ NeutronOvsAgentBase:
+ type: ../../puppet/services/neutron-ovs-agent.yaml
+ properties:
+ ServiceNetMap: {get_param: ServiceNetMap}
+ DefaultPasswords: {get_param: DefaultPasswords}
+ EndpointMap: {get_param: EndpointMap}
+
+outputs:
+ role_data:
+ description: Role data for Neutron openvswitch service
+ value:
+ config_settings: {get_attr: [NeutronOvsAgentBase, role_data, config_settings]}
+ step_config: {get_attr: [NeutronOvsAgentBase, role_data, step_config]}
+ puppet_tags: neutron_config,neutron_agent_ovs,neutron_plugin_ml2
+ docker_config:
+ step_1:
+ neutronovsagent:
+ image:
+ list_join:
+ - '/'
+ - [ {get_param: DockerNamespace}, {get_param: DockerOpenvswitchImage} ]
+ net: host
+ pid: host
+ privileged: true
+ restart: always
+ volumes:
+ - /var/lib/etc-data/json-config/neutron-openvswitch-agent.json:/var/lib/kolla/config_files/config.json
+ - /var/lib/etc-data/neutron/neutron.conf:/var/lib/kolla/config_files/neutron.conf:ro
+ - /var/lib/etc-data/neutron/plugins/ml2/ml2_conf.ini:/var/lib/kolla/config_files/ml2_conf.ini:ro
+ - {get_param: NeutronOpenvswitchAgentPluginVolume}
+ - {get_param: NeutronOpenvswitchAgentOvsVolume}
+ - /etc/localtime:/etc/localtime:ro
+ - /lib/modules:/lib/modules:ro
+ - /run:/run
+ - logs:/var/log/kolla/
+ environment:
+ - KOLLA_CONFIG_STRATEGY=COPY_ALWAYS
+ step_2: {}
diff --git a/docker/services/nova-compute.yaml b/docker/services/nova-compute.yaml
new file mode 100644
index 00000000..5c56aeee
--- /dev/null
+++ b/docker/services/nova-compute.yaml
@@ -0,0 +1,69 @@
+heat_template_version: 2015-04-30
+
+description: >
+ OpenStack containerized Nova Compute service
+
+parameters:
+ DockerNamespace:
+ description: namespace
+ default: 'tripleoupstream'
+ type: string
+ DockerNovaComputeImage:
+ description: image
+ default: 'centos-binary-nova-compute'
+ type: string
+ ServiceNetMap:
+ default: {}
+ description: Mapping of service_name -> network name. Typically set
+ via parameter_defaults in the resource registry. This
+ mapping overrides those in ServiceNetMapDefaults.
+ type: json
+ DefaultPasswords:
+ default: {}
+ type: json
+ EndpointMap:
+ default: {}
+ description: Mapping of service endpoint -> protocol. Typically set
+ via parameter_defaults in the resource registry.
+ type: json
+
+resources:
+
+ NovaComputeBase:
+ type: ../../puppet/services/nova-compute.yaml
+ properties:
+ EndpointMap: {get_param: EndpointMap}
+
+outputs:
+ role_data:
+ description: Role data for the Nova Compute service.
+ value:
+ config_settings: {get_attr: [NovaComputeBase, role_data, config_settings]}
+ step_config: {get_attr: [NovaComputeBase, role_data, step_config]}
+ puppet_tags: nova_config,nova_paste_api_ini
+ docker_config:
+ step_1:
+ novacompute:
+ image:
+ list_join:
+ - '/'
+ - [ {get_param: DockerNamespace}, {get_param: DockerNovaComputeImage} ]
+ net: host
+ privileged: true
+ user: root
+ restart: always
+ volumes:
+ - /var/lib/etc-data/json-config/nova-compute.json:/var/lib/kolla/config_files/config.json
+ - /var/lib/etc-data/nova/nova.conf:/var/lib/kolla/config_files/nova.conf:ro
+ - /var/lib/etc-data/nova/rootwrap.conf:/var/lib/kolla/config_files/rootwrap.conf:ro
+ - /etc/localtime:/etc/localtime:ro
+ - /lib/modules:/lib/modules:ro
+ - /run:/run
+ - /dev:/dev
+ - logs:/var/log/kolla/
+ - /etc/iscsi:/etc/iscsi
+ - libvirtd:/var/lib/libvirt
+ - nova_compute:/var/lib/nova/
+ environment:
+ - KOLLA_CONFIG_STRATEGY=COPY_ALWAYS
+ step_2: {}
diff --git a/docker/services/nova-libvirt.yaml b/docker/services/nova-libvirt.yaml
new file mode 100644
index 00000000..36511557
--- /dev/null
+++ b/docker/services/nova-libvirt.yaml
@@ -0,0 +1,69 @@
+heat_template_version: 2015-04-30
+
+description: >
+ OpenStack Libvirt Service
+
+parameters:
+ DockerNamespace:
+ description: namespace
+ default: 'tripleoupstream'
+ type: string
+ DockerLibvirtImage:
+ description: image
+ default: 'centos-binary-libvirt'
+ type: string
+ ServiceNetMap:
+ default: {}
+ description: Mapping of service_name -> network name. Typically set
+ via parameter_defaults in the resource registry. This
+ mapping overrides those in ServiceNetMapDefaults.
+ type: json
+ DefaultPasswords:
+ default: {}
+ type: json
+ EndpointMap:
+ default: {}
+ description: Mapping of service endpoint -> protocol. Typically set
+ via parameter_defaults in the resource registry.
+ type: json
+
+resources:
+
+ NovaLibvirtBase:
+ type: ../../puppet/services/nova-libvirt.yaml
+ properties:
+ EndpointMap: {get_param: EndpointMap}
+
+outputs:
+ role_data:
+ description: Role data for the Libvirt service.
+ value:
+ config_settings: {get_attr: [NovaLibvirtBase, role_data, config_settings]}
+ step_config: {get_attr: [NovaLibvirtBase, role_data, step_config]}
+ puppet_tags: nova_config
+ docker_config:
+ step_1:
+ nova_libvirt:
+ image:
+ list_join:
+ - '/'
+ - [ {get_param: DockerNamespace}, {get_param: DockerLibvirtImage} ]
+ net: host
+ pid: host
+ privileged: true
+ restart: always
+ volumes:
+ - /var/lib/etc-data/json-config/nova-libvirt.json:/var/lib/kolla/config_files/config.json
+ - /var/lib/etc-data/libvirt/libvirtd.conf:/var/lib/kolla/config_files/libvirtd.conf
+ - /etc/localtime:/etc/localtime:ro
+ - /lib/modules:/lib/modules:ro
+ - /run:/run
+ - /dev:/dev
+ - /sys/fs/cgroup:/sys/fs/cgroup
+ - logs:/var/log/kolla/
+ - libvirtd:/var/lib/libvirt
+ - nova_compute:/var/lib/nova/
+ - nova_libvirt_qemu:/etc/libvirt/qemu
+ environment:
+ - KOLLA_CONFIG_STRATEGY=COPY_ALWAYS
+ step_2: {}
diff --git a/docker/services/services.yaml b/docker/services/services.yaml
new file mode 100644
index 00000000..37e7b655
--- /dev/null
+++ b/docker/services/services.yaml
@@ -0,0 +1,73 @@
+heat_template_version: 2016-10-14
+
+description: >
+ Utility stack to convert an array of services into a set of combined
+ role configs.
+
+parameters:
+ Services:
+ default: []
+ description: |
+ List nested stack service templates.
+ type: comma_delimited_list
+ ServiceNetMap:
+ default: {}
+ description: Mapping of service_name -> network name. Typically set
+ via parameter_defaults in the resource registry. This
+ mapping overrides those in ServiceNetMapDefaults.
+ type: json
+ EndpointMap:
+ default: {}
+ description: Mapping of service endpoint -> protocol. Typically set
+ via parameter_defaults in the resource registry.
+ type: json
+ DefaultPasswords:
+ default: {}
+ description: Mapping of service -> default password. Used to help
+ pass top level passwords managed by Heat into services.
+ type: json
+
+resources:
+
+ PuppetServices:
+ type: ../../puppet/services/services.yaml
+ properties:
+ Services: {get_param: Services}
+ ServiceNetMap: {get_param: ServiceNetMap}
+ EndpointMap: {get_param: EndpointMap}
+ DefaultPasswords: {get_param: DefaultPasswords}
+
+ ServiceChain:
+ type: OS::Heat::ResourceChain
+ properties:
+ resources: {get_param: Services}
+ concurrent: true
+ resource_properties:
+ ServiceNetMap: {get_param: ServiceNetMap}
+ EndpointMap: {get_param: EndpointMap}
+ DefaultPasswords: {get_param: DefaultPasswords}
+
+outputs:
+ role_data:
+ description: Combined Role data for this set of services.
+ value:
+ service_names:
+ {get_attr: [PuppetServices, role_data, service_names]}
+ monitoring_subscriptions:
+ {get_attr: [PuppetServices, role_data, monitoring_subscriptions]}
+ logging_sources:
+ {get_attr: [PuppetServices, role_data, logging_sources]}
+ logging_groups:
+ {get_attr: [PuppetServices, role_data, logging_groups]}
+ service_config_settings:
+ {get_attr: [PuppetServices, role_data, service_config_settings]}
+ config_settings:
+ {get_attr: [PuppetServices, role_data, config_settings]}
+ global_config_settings:
+ {get_attr: [PuppetServices, role_data, global_config_settings]}
+ step_config:
+ {get_attr: [PuppetServices, role_data, step_config]}
+ puppet_tags: {list_join: [",", {get_attr: [ServiceChain, role_data, puppet_tags]}]}
+ docker_config:
+ step_1: {map_merge: {get_attr: [ServiceChain, role_data, docker_config, step_1]}}
+ step_2: {map_merge: {get_attr: [ServiceChain, role_data, docker_config, step_2]}}
diff --git a/environments/docker.yaml b/environments/docker.yaml
index c03d8511..0755c61f 100644
--- a/environments/docker.yaml
+++ b/environments/docker.yaml
@@ -1,7 +1,16 @@
resource_registry:
# Docker container with heat agents for containerized compute node.
- OS::TripleO::ComputePostDeployment: ../docker/compute-post.yaml
OS::TripleO::NodeUserData: ../docker/firstboot/install_docker_agents.yaml
+ OS::TripleO::Services::NovaLibvirt: ../docker/services/nova-libvirt.yaml
+ OS::TripleO::Services::ComputeNeutronOvsAgent: ../docker/services/neutron-ovs-agent.yaml
+ OS::TripleO::Services::NovaCompute: ../docker/services/nova-compute.yaml
+ # NOTE (dprince) here we set new roles to be docker enabled as we add support
+ #OS::TripleO::ComputePostDeploySteps: ../docker/post.yaml
+ # NOTE (mandre) Defining per role post deploy steps doesn't work yet
+ # Set a global PostDeploySteps that works for both containerized and
+ # non-containerized roles
+ OS::TripleO::PostDeploySteps: ../docker/post.yaml
+ OS::TripleO::Services: ../docker/services/services.yaml
parameter_defaults:
NovaImage: atomic-image
@@ -10,11 +19,15 @@ parameter_defaults:
DockerNamespace: tripleoupstream
# Enable local Docker registry
DockerNamespaceIsRegistry: false
- # Compute Node Images
- DockerComputeImage: centos-binary-nova-compute:latest
- DockerAgentImage: heat-docker-agents:latest
- DockerComputeDataImage: centos-binary-data:latest
- DockerLibvirtImage: centos-binary-nova-libvirt:latest
- DockerOpenvswitchImage: centos-binary-neutron-openvswitch-agent:latest
- DockerOvsVswitchdImage: centos-binary-openvswitch-vswitchd:latest
- DockerOpenvswitchDBImage: centos-binary-openvswitch-db-server:latest
+ DockerAgentImage: heat-docker-agents:newton
+ # Docker containers
+ DockerNovaComputeImage: centos-binary-nova-compute:newton
+ DockerLibvirtImage: centos-binary-nova-libvirt:newton
+ DockerOpenvswitchImage: centos-binary-neutron-openvswitch-agent:newton
+ DockerOvsVswitchdImage: centos-binary-openvswitch-vswitchd:newton
+ DockerOpenvswitchDBImage: centos-binary-openvswitch-db-server:newton
+
+ ComputeServices:
+ - OS::TripleO::Services::NovaCompute
+ - OS::TripleO::Services::NovaLibvirt
+ - OS::TripleO::Services::ComputeNeutronOvsAgent
diff --git a/environments/enable-internal-tls.yaml b/environments/enable-internal-tls.yaml
index 5116c6da..7116da37 100644
--- a/environments/enable-internal-tls.yaml
+++ b/environments/enable-internal-tls.yaml
@@ -3,4 +3,4 @@
parameter_defaults:
EnableInternalTLS: true
resource_registry:
- OS::TripleO::Services::ApacheTLS: ../../puppet/services/apache-internal-tls-certmonger.yaml
+ OS::TripleO::Services::ApacheTLS: ../puppet/services/apache-internal-tls-certmonger.yaml
diff --git a/environments/puppet-pacemaker.yaml b/environments/puppet-pacemaker.yaml
index 8cfbab6d..b8e93f20 100644
--- a/environments/puppet-pacemaker.yaml
+++ b/environments/puppet-pacemaker.yaml
@@ -16,3 +16,6 @@ resource_registry:
OS::TripleO::Services::Redis: ../puppet/services/pacemaker/database/redis.yaml
OS::TripleO::Services::MySQL: ../puppet/services/pacemaker/database/mysql.yaml
# Services that are disabled by default (use relevant environment files):
+
+ # Services that are disabled for HA deployments with pacemaker
+ OS::TripleO::Services::Keepalived: OS::Heat::None
diff --git a/environments/services/panko.yaml b/environments/services/panko.yaml
new file mode 100644
index 00000000..28bf99f6
--- /dev/null
+++ b/environments/services/panko.yaml
@@ -0,0 +1,2 @@
+resource_registry:
+ OS::TripleO::Services::PankoApi: ../../puppet/services/panko-api.yaml
diff --git a/environments/tls-endpoints-public-dns.yaml b/environments/tls-endpoints-public-dns.yaml
index 79c7599f..70a0d31f 100644
--- a/environments/tls-endpoints-public-dns.yaml
+++ b/environments/tls-endpoints-public-dns.yaml
@@ -53,6 +53,9 @@ parameter_defaults:
NovaVNCProxyAdmin: {protocol: 'http', port: '6080', host: 'IP_ADDRESS'}
NovaVNCProxyInternal: {protocol: 'http', port: '6080', host: 'IP_ADDRESS'}
NovaVNCProxyPublic: {protocol: 'https', port: '13080', host: 'CLOUDNAME'}
+ PankoAdmin: {protocol: 'http', port: '8779', host: 'IP_ADDRESS'}
+ PankoInternal: {protocol: 'http', port: '8779', host: 'IP_ADDRESS'}
+ PankoPublic: {protocol: 'https', port: '13779', host: 'CLOUDNAME'}
SaharaAdmin: {protocol: 'http', port: '8386', host: 'IP_ADDRESS'}
SaharaInternal: {protocol: 'http', port: '8386', host: 'IP_ADDRESS'}
SaharaPublic: {protocol: 'https', port: '13386', host: 'CLOUDNAME'}
diff --git a/environments/tls-endpoints-public-ip.yaml b/environments/tls-endpoints-public-ip.yaml
index a49ca343..21f8876a 100644
--- a/environments/tls-endpoints-public-ip.yaml
+++ b/environments/tls-endpoints-public-ip.yaml
@@ -53,6 +53,9 @@ parameter_defaults:
NovaVNCProxyAdmin: {protocol: 'http', port: '6080', host: 'IP_ADDRESS'}
NovaVNCProxyInternal: {protocol: 'http', port: '6080', host: 'IP_ADDRESS'}
NovaVNCProxyPublic: {protocol: 'https', port: '13080', host: 'IP_ADDRESS'}
+ PankoAdmin: {protocol: 'http', port: '8779', host: 'IP_ADDRESS'}
+ PankoInternal: {protocol: 'http', port: '8779', host: 'IP_ADDRESS'}
+ PankoPublic: {protocol: 'https', port: '13779', host: 'IP_ADDRESS'}
SaharaAdmin: {protocol: 'http', port: '8386', host: 'IP_ADDRESS'}
SaharaInternal: {protocol: 'http', port: '8386', host: 'IP_ADDRESS'}
SaharaPublic: {protocol: 'https', port: '13386', host: 'IP_ADDRESS'}
diff --git a/environments/tls-everywhere-endpoints-dns.yaml b/environments/tls-everywhere-endpoints-dns.yaml
index cc1915fe..6afb3a63 100644
--- a/environments/tls-everywhere-endpoints-dns.yaml
+++ b/environments/tls-everywhere-endpoints-dns.yaml
@@ -53,6 +53,9 @@ parameter_defaults:
NovaVNCProxyAdmin: {protocol: 'https', port: '6080', host: 'CLOUDNAME'}
NovaVNCProxyInternal: {protocol: 'https', port: '6080', host: 'CLOUDNAME'}
NovaVNCProxyPublic: {protocol: 'https', port: '13080', host: 'CLOUDNAME'}
+ PankoAdmin: {protocol: 'https', port: '8779', host: 'CLOUDNAME'}
+ PankoInternal: {protocol: 'https', port: '8779', host: 'CLOUDNAME'}
+ PankoPublic: {protocol: 'https', port: '13779', host: 'CLOUDNAME'}
SaharaAdmin: {protocol: 'https', port: '8386', host: 'CLOUDNAME'}
SaharaInternal: {protocol: 'https', port: '8386', host: 'CLOUDNAME'}
SaharaPublic: {protocol: 'https', port: '13386', host: 'CLOUDNAME'}
diff --git a/extraconfig/tasks/mitaka_to_newton_ceilometer_wsgi_upgrade.pp b/extraconfig/tasks/mitaka_to_newton_ceilometer_wsgi_upgrade.pp
index 1c376285..a8d43663 100644
--- a/extraconfig/tasks/mitaka_to_newton_ceilometer_wsgi_upgrade.pp
+++ b/extraconfig/tasks/mitaka_to_newton_ceilometer_wsgi_upgrade.pp
@@ -48,7 +48,13 @@ $mongodb_replset = hiera('mongodb::server::replset')
$mongo_node_string = join($mongo_node_ips_with_port, ',')
$database_connection = "mongodb://${mongo_node_string}/ceilometer?replicaSet=${mongodb_replset}"
-include ::ceilometer
+$rabbit_hosts = hiera('rabbitmq_node_ips', undef)
+$rabbit_port = hiera('ceilometer::rabbit_port', 5672)
+$rabbit_endpoints = suffix(any2array(normalize_ip_for_uri($rabbit_hosts)), ":${rabbit_port}")
+
+class { '::ceilometer' :
+ rabbit_hosts => $rabbit_endpoints,
+}
class {'::ceilometer::db':
database_connection => $database_connection,
diff --git a/extraconfig/tasks/yum_update.sh b/extraconfig/tasks/yum_update.sh
index 4612f197..8a88ee64 100755
--- a/extraconfig/tasks/yum_update.sh
+++ b/extraconfig/tasks/yum_update.sh
@@ -62,6 +62,19 @@ if [[ "$pacemaker_status" == "active" && \
fi
fi
+# Special-case OVS for https://bugs.launchpad.net/tripleo/+bug/1635205
+if [[ -n $(rpm -q --scripts openvswitch | awk '/postuninstall/,/*/' | grep "systemctl.*try-restart") ]]; then
+ echo "Manual upgrade of openvswitch - restart in postun detected"
+ mkdir OVS_UPGRADE || true
+ pushd OVS_UPGRADE
+ echo "Attempting to downloading latest openvswitch with yumdownloader"
+ yumdownloader --resolve openvswitch
+ echo "Updating openvswitch with nopostun option"
+ rpm -U --replacepkgs --nopostun ./*.rpm
+ popd
+else
+ echo "Skipping manual upgrade of openvswitch - no restart in postun detected"
+fi
if [[ "$pacemaker_status" == "active" ]] ; then
echo "Pacemaker running, stopping cluster node and doing full package update"
@@ -81,20 +94,6 @@ else
exit 0
fi
-# Special-case OVS for https://bugs.launchpad.net/tripleo/+bug/1635205
-if [[ -n $(rpm -q --scripts openvswitch | awk '/postuninstall/,/*/' | grep "systemctl.*try-restart") ]]; then
- echo "Manual upgrade of openvswitch - restart in postun detected"
- mkdir OVS_UPGRADE || true
- pushd OVS_UPGRADE
- echo "Attempting to downloading latest openvswitch with yumdownloader"
- yumdownloader --resolve openvswitch
- echo "Updating openvswitch with nopostun option"
- rpm -U --replacepkgs --nopostun ./*.rpm
- popd
-else
- echo "Skipping manual upgrade of openvswitch - no restart in postun detected"
-fi
-
command=${command:-update}
full_command="yum -q -y $command $command_arguments"
echo "Running: $full_command"
@@ -104,6 +103,17 @@ return_code=$?
echo "$result"
echo "yum return code: $return_code"
+# Writes any changes caused by alterations to os-net-config and bounces the
+# interfaces *before* restarting the cluster.
+os-net-config -c /etc/os-net-config/config.json -v --detailed-exit-codes
+RETVAL=$?
+if [[ $RETVAL == 2 ]]; then
+ echo "os-net-config: interface configuration files updated successfully"
+elif [[ $RETVAL != 0 ]]; then
+ echo "ERROR: os-net-config configuration failed"
+ exit $RETVAL
+fi
+
if [[ "$pacemaker_status" == "active" ]] ; then
echo "Starting cluster node"
pcs cluster start
diff --git a/network/endpoints/endpoint_data.yaml b/network/endpoints/endpoint_data.yaml
index 1df3b665..aeda0a9f 100644
--- a/network/endpoints/endpoint_data.yaml
+++ b/network/endpoints/endpoint_data.yaml
@@ -37,6 +37,15 @@ Gnocchi:
net_param: GnocchiApi
port: 8041
+Panko:
+ Internal:
+ net_param: PankoApi
+ Public:
+ net_param: Public
+ Admin:
+ net_param: PankoApi
+ port: 8779
+
Cinder:
Internal:
net_param: CinderApi
diff --git a/network/endpoints/endpoint_map.yaml b/network/endpoints/endpoint_map.yaml
index 43fb20cc..5e582d41 100644
--- a/network/endpoints/endpoint_map.yaml
+++ b/network/endpoints/endpoint_map.yaml
@@ -70,6 +70,9 @@ parameters:
NovaVNCProxyAdmin: {protocol: http, port: '6080', host: IP_ADDRESS}
NovaVNCProxyInternal: {protocol: http, port: '6080', host: IP_ADDRESS}
NovaVNCProxyPublic: {protocol: http, port: '6080', host: IP_ADDRESS}
+ PankoAdmin: {protocol: http, port: '8779', host: IP_ADDRESS}
+ PankoInternal: {protocol: http, port: '8779', host: IP_ADDRESS}
+ PankoPublic: {protocol: http, port: '8779', host: IP_ADDRESS}
SaharaAdmin: {protocol: http, port: '8386', host: IP_ADDRESS}
SaharaInternal: {protocol: http, port: '8386', host: IP_ADDRESS}
SaharaPublic: {protocol: http, port: '8386', host: IP_ADDRESS}
@@ -5311,6 +5314,249 @@ outputs:
template: NETWORK_uri
- ':'
- get_param: [EndpointMap, NovaVNCProxyPublic, port]
+ PankoAdmin:
+ host:
+ str_replace:
+ template:
+ get_param: [EndpointMap, PankoAdmin, host]
+ params:
+ CLOUDNAME:
+ get_param:
+ - CloudEndpoints
+ - get_param: [ServiceNetMap, PankoApiNetwork]
+ IP_ADDRESS:
+ get_param:
+ - NetIpMap
+ - str_replace:
+ params:
+ NETWORK:
+ get_param: [ServiceNetMap, PankoApiNetwork]
+ template: NETWORK_uri
+ host_nobrackets:
+ str_replace:
+ template:
+ get_param: [EndpointMap, PankoAdmin, host]
+ params:
+ CLOUDNAME:
+ get_param:
+ - CloudEndpoints
+ - get_param: [ServiceNetMap, PankoApiNetwork]
+ IP_ADDRESS:
+ get_param:
+ - NetIpMap
+ - get_param: [ServiceNetMap, PankoApiNetwork]
+ port:
+ get_param: [EndpointMap, PankoAdmin, port]
+ protocol:
+ get_param: [EndpointMap, PankoAdmin, protocol]
+ uri:
+ list_join:
+ - ''
+ - - get_param: [EndpointMap, PankoAdmin, protocol]
+ - ://
+ - str_replace:
+ template:
+ get_param: [EndpointMap, PankoAdmin, host]
+ params:
+ CLOUDNAME:
+ get_param:
+ - CloudEndpoints
+ - get_param: [ServiceNetMap, PankoApiNetwork]
+ IP_ADDRESS:
+ get_param:
+ - NetIpMap
+ - str_replace:
+ params:
+ NETWORK:
+ get_param: [ServiceNetMap, PankoApiNetwork]
+ template: NETWORK_uri
+ - ':'
+ - get_param: [EndpointMap, PankoAdmin, port]
+ uri_no_suffix:
+ list_join:
+ - ''
+ - - get_param: [EndpointMap, PankoAdmin, protocol]
+ - ://
+ - str_replace:
+ template:
+ get_param: [EndpointMap, PankoAdmin, host]
+ params:
+ CLOUDNAME:
+ get_param:
+ - CloudEndpoints
+ - get_param: [ServiceNetMap, PankoApiNetwork]
+ IP_ADDRESS:
+ get_param:
+ - NetIpMap
+ - str_replace:
+ params:
+ NETWORK:
+ get_param: [ServiceNetMap, PankoApiNetwork]
+ template: NETWORK_uri
+ - ':'
+ - get_param: [EndpointMap, PankoAdmin, port]
+ PankoInternal:
+ host:
+ str_replace:
+ template:
+ get_param: [EndpointMap, PankoInternal, host]
+ params:
+ CLOUDNAME:
+ get_param:
+ - CloudEndpoints
+ - get_param: [ServiceNetMap, PankoApiNetwork]
+ IP_ADDRESS:
+ get_param:
+ - NetIpMap
+ - str_replace:
+ params:
+ NETWORK:
+ get_param: [ServiceNetMap, PankoApiNetwork]
+ template: NETWORK_uri
+ host_nobrackets:
+ str_replace:
+ template:
+ get_param: [EndpointMap, PankoInternal, host]
+ params:
+ CLOUDNAME:
+ get_param:
+ - CloudEndpoints
+ - get_param: [ServiceNetMap, PankoApiNetwork]
+ IP_ADDRESS:
+ get_param:
+ - NetIpMap
+ - get_param: [ServiceNetMap, PankoApiNetwork]
+ port:
+ get_param: [EndpointMap, PankoInternal, port]
+ protocol:
+ get_param: [EndpointMap, PankoInternal, protocol]
+ uri:
+ list_join:
+ - ''
+ - - get_param: [EndpointMap, PankoInternal, protocol]
+ - ://
+ - str_replace:
+ template:
+ get_param: [EndpointMap, PankoInternal, host]
+ params:
+ CLOUDNAME:
+ get_param:
+ - CloudEndpoints
+ - get_param: [ServiceNetMap, PankoApiNetwork]
+ IP_ADDRESS:
+ get_param:
+ - NetIpMap
+ - str_replace:
+ params:
+ NETWORK:
+ get_param: [ServiceNetMap, PankoApiNetwork]
+ template: NETWORK_uri
+ - ':'
+ - get_param: [EndpointMap, PankoInternal, port]
+ uri_no_suffix:
+ list_join:
+ - ''
+ - - get_param: [EndpointMap, PankoInternal, protocol]
+ - ://
+ - str_replace:
+ template:
+ get_param: [EndpointMap, PankoInternal, host]
+ params:
+ CLOUDNAME:
+ get_param:
+ - CloudEndpoints
+ - get_param: [ServiceNetMap, PankoApiNetwork]
+ IP_ADDRESS:
+ get_param:
+ - NetIpMap
+ - str_replace:
+ params:
+ NETWORK:
+ get_param: [ServiceNetMap, PankoApiNetwork]
+ template: NETWORK_uri
+ - ':'
+ - get_param: [EndpointMap, PankoInternal, port]
+ PankoPublic:
+ host:
+ str_replace:
+ template:
+ get_param: [EndpointMap, PankoPublic, host]
+ params:
+ CLOUDNAME:
+ get_param:
+ - CloudEndpoints
+ - get_param: [ServiceNetMap, PublicNetwork]
+ IP_ADDRESS:
+ get_param:
+ - NetIpMap
+ - str_replace:
+ params:
+ NETWORK:
+ get_param: [ServiceNetMap, PublicNetwork]
+ template: NETWORK_uri
+ host_nobrackets:
+ str_replace:
+ template:
+ get_param: [EndpointMap, PankoPublic, host]
+ params:
+ CLOUDNAME:
+ get_param:
+ - CloudEndpoints
+ - get_param: [ServiceNetMap, PublicNetwork]
+ IP_ADDRESS:
+ get_param:
+ - NetIpMap
+ - get_param: [ServiceNetMap, PublicNetwork]
+ port:
+ get_param: [EndpointMap, PankoPublic, port]
+ protocol:
+ get_param: [EndpointMap, PankoPublic, protocol]
+ uri:
+ list_join:
+ - ''
+ - - get_param: [EndpointMap, PankoPublic, protocol]
+ - ://
+ - str_replace:
+ template:
+ get_param: [EndpointMap, PankoPublic, host]
+ params:
+ CLOUDNAME:
+ get_param:
+ - CloudEndpoints
+ - get_param: [ServiceNetMap, PublicNetwork]
+ IP_ADDRESS:
+ get_param:
+ - NetIpMap
+ - str_replace:
+ params:
+ NETWORK:
+ get_param: [ServiceNetMap, PublicNetwork]
+ template: NETWORK_uri
+ - ':'
+ - get_param: [EndpointMap, PankoPublic, port]
+ uri_no_suffix:
+ list_join:
+ - ''
+ - - get_param: [EndpointMap, PankoPublic, protocol]
+ - ://
+ - str_replace:
+ template:
+ get_param: [EndpointMap, PankoPublic, host]
+ params:
+ CLOUDNAME:
+ get_param:
+ - CloudEndpoints
+ - get_param: [ServiceNetMap, PublicNetwork]
+ IP_ADDRESS:
+ get_param:
+ - NetIpMap
+ - str_replace:
+ params:
+ NETWORK:
+ get_param: [ServiceNetMap, PublicNetwork]
+ template: NETWORK_uri
+ - ':'
+ - get_param: [EndpointMap, PankoPublic, port]
SaharaAdmin:
host:
str_replace:
diff --git a/network/service_net_map.j2.yaml b/network/service_net_map.j2.yaml
index 61c97f13..0cb6571f 100644
--- a/network/service_net_map.j2.yaml
+++ b/network/service_net_map.j2.yaml
@@ -25,6 +25,7 @@ parameters:
NeutronTenantNetwork: tenant
CeilometerApiNetwork: internal_api
AodhApiNetwork: internal_api
+ PankoApiNetwork: internal_api
BarbicanApiNetwork: internal_api
GnocchiApiNetwork: internal_api
MongodbNetwork: internal_api
diff --git a/overcloud-resource-registry-puppet.j2.yaml b/overcloud-resource-registry-puppet.j2.yaml
index 3e201175..19766ad8 100644
--- a/overcloud-resource-registry-puppet.j2.yaml
+++ b/overcloud-resource-registry-puppet.j2.yaml
@@ -11,6 +11,7 @@ resource_registry:
OS::TripleO::Tasks::PackageUpdate: extraconfig/tasks/yum_update.yaml
{% for role in roles %}
+ OS::TripleO::{{role.name}}PostDeploySteps: puppet/post.yaml
OS::TripleO::{{role.name}}: puppet/{{role.name.lower()}}-role.yaml
OS::TripleO::{{role.name}}Config: puppet/{{role.name.lower()}}-config.yaml
OS::TripleO::Tasks::{{role.name}}PreConfig: OS::Heat::None
@@ -197,6 +198,7 @@ resource_registry:
OS::TripleO::Services::AodhEvaluator: puppet/services/aodh-evaluator.yaml
OS::TripleO::Services::AodhNotifier: puppet/services/aodh-notifier.yaml
OS::TripleO::Services::AodhListener: puppet/services/aodh-listener.yaml
+ OS::TripleO::Services::PankoApi: OS::Heat::None
OS::TripleO::Services::MistralEngine: OS::Heat::None
OS::TripleO::Services::MistralApi: OS::Heat::None
OS::TripleO::Services::MistralExecutor: OS::Heat::None
diff --git a/overcloud.j2.yaml b/overcloud.j2.yaml
index 42339ead..f3a71262 100644
--- a/overcloud.j2.yaml
+++ b/overcloud.j2.yaml
@@ -310,7 +310,7 @@ resources:
# - The outer one filters the map based on the services enabled for the role
# then merges the result into one map.
- yaql:
- expression: let(root => $) -> $.data.map.items().where($[0] in $root.data.services).select($[1]).reduce($1.mergeWith($2), {})
+ expression: let(root => $) -> $.data.map.items().where($[0] in coalesce($root.data.services, [])).select($[1]).reduce($1.mergeWith($2), {})
data:
map:
yaql:
diff --git a/puppet/blockstorage-role.yaml b/puppet/blockstorage-role.yaml
index 8b695fff..34f10a21 100644
--- a/puppet/blockstorage-role.yaml
+++ b/puppet/blockstorage-role.yaml
@@ -66,6 +66,7 @@ parameters:
constraints:
- allowed_values: [POLL_SERVER_CFN, POLL_SERVER_HEAT, POLL_TEMP_URL, ZAQAR_MESSAGE]
CloudDomain:
+ default: 'localdomain'
type: string
description: >
The DNS domain used for the hosts. This should match the dhcp_domain
diff --git a/puppet/cephstorage-role.yaml b/puppet/cephstorage-role.yaml
index f7e29b70..0854330e 100644
--- a/puppet/cephstorage-role.yaml
+++ b/puppet/cephstorage-role.yaml
@@ -72,6 +72,7 @@ parameters:
constraints:
- allowed_values: [POLL_SERVER_CFN, POLL_SERVER_HEAT, POLL_TEMP_URL, ZAQAR_MESSAGE]
CloudDomain:
+ default: 'localdomain'
type: string
description: >
The DNS domain used for the hosts. This should match the dhcp_domain
diff --git a/puppet/compute-role.yaml b/puppet/compute-role.yaml
index 4d77d6d3..070f19c5 100644
--- a/puppet/compute-role.yaml
+++ b/puppet/compute-role.yaml
@@ -87,6 +87,7 @@ parameters:
constraints:
- allowed_values: [POLL_SERVER_CFN, POLL_SERVER_HEAT, POLL_TEMP_URL, ZAQAR_MESSAGE]
CloudDomain:
+ default: 'localdomain'
type: string
description: >
The DNS domain used for the hosts. This should match the dhcp_domain
diff --git a/puppet/config.role.j2.yaml b/puppet/config.role.j2.yaml
index e59a0216..552c59b2 100644
--- a/puppet/config.role.j2.yaml
+++ b/puppet/config.role.j2.yaml
@@ -1,4 +1,4 @@
-heat_template_version: 2015-04-30
+heat_template_version: 2016-10-14
description: >
A software config which runs puppet on the {{role}} role
@@ -12,6 +12,14 @@ parameters:
type: string
description: Config manifests that will be used to step through the deployment.
default: ''
+ PuppetTags:
+ type: string
+ description: List of comma-separated tags to limit puppet catalog to.
+ default: ''
+
+conditions:
+
+ puppet_tags_empty: {equals : [{get_param: PuppetTags}, '']}
resources:
@@ -24,6 +32,13 @@ resources:
enable_hiera: True
enable_facter: False
modulepath: /etc/puppet/modules:/opt/stack/puppet-modules:/usr/share/openstack-puppet/modules
+ tags:
+ if:
+ - puppet_tags_empty
+ - ''
+ - list_join:
+ - ','
+ - ['file,concat,file_line', {get_param: PuppetTags}]
outputs:
- name: result
inputs:
diff --git a/puppet/controller-role.yaml b/puppet/controller-role.yaml
index b1433b04..3fc691a0 100644
--- a/puppet/controller-role.yaml
+++ b/puppet/controller-role.yaml
@@ -101,6 +101,7 @@ parameters:
constraints:
- allowed_values: [POLL_SERVER_CFN, POLL_SERVER_HEAT, POLL_TEMP_URL, ZAQAR_MESSAGE]
CloudDomain:
+ default: 'localdomain'
type: string
description: >
The DNS domain used for the hosts. This should match the dhcp_domain
diff --git a/puppet/objectstorage-role.yaml b/puppet/objectstorage-role.yaml
index d7681d10..be638c56 100644
--- a/puppet/objectstorage-role.yaml
+++ b/puppet/objectstorage-role.yaml
@@ -66,6 +66,7 @@ parameters:
constraints:
- allowed_values: [POLL_SERVER_CFN, POLL_SERVER_HEAT, POLL_TEMP_URL, ZAQAR_MESSAGE]
CloudDomain:
+ default: 'localdomain'
type: string
description: >
The DNS domain used for the hosts. This should match the dhcp_domain
diff --git a/puppet/role.role.j2.yaml b/puppet/role.role.j2.yaml
index 5b419f80..ad5e4794 100644
--- a/puppet/role.role.j2.yaml
+++ b/puppet/role.role.j2.yaml
@@ -72,6 +72,7 @@ parameters:
constraints:
- allowed_values: [POLL_SERVER_CFN, POLL_SERVER_HEAT, POLL_TEMP_URL, ZAQAR_MESSAGE]
CloudDomain:
+ default: 'localdomain'
type: string
description: >
The DNS domain used for the hosts. This should match the dhcp_domain
diff --git a/puppet/services/aodh-api.yaml b/puppet/services/aodh-api.yaml
index 48cc4af6..daed1665 100644
--- a/puppet/services/aodh-api.yaml
+++ b/puppet/services/aodh-api.yaml
@@ -21,11 +21,6 @@ parameters:
MonitoringSubscriptionAodhApi:
default: 'overcloud-ceilometer-aodh-api'
type: string
- EnableCombinationAlarms:
- default: false
- description: Combination alarms are deprecated in Newton, hence disabled
- by default. To enable, set this parameter to true.
- type: boolean
EnableInternalTLS:
type: boolean
default: false
@@ -83,7 +78,6 @@ outputs:
# internal_api_uri -> [IP]
# internal_api_subnet - > IP/CIDR
aodh::wsgi::apache::bind_host: {get_param: [ServiceNetMap, AodhApiNetwork]}
- tripleo::profile::base::aodh::api::enable_combination_alarms: {get_param: EnableCombinationAlarms}
service_config_settings:
get_attr: [AodhBase, role_data, service_config_settings]
step_config: |
diff --git a/puppet/services/barbican-api.yaml b/puppet/services/barbican-api.yaml
index ab6b0ec7..b266674f 100644
--- a/puppet/services/barbican-api.yaml
+++ b/puppet/services/barbican-api.yaml
@@ -128,3 +128,17 @@ outputs:
barbican::keystone::auth::password: {get_param: BarbicanPassword}
barbican::keystone::auth::region: {get_param: KeystoneRegion}
barbican::keystone::auth::tenant: 'service'
+ nova_compute:
+ nova::compute::keymgr_api_class: >
+ castellan.key_manager.barbican_key_manager.BarbicanKeyManager
+ nova::compute::barbican_endpoint:
+ get_param: [EndpointMap, BarbicanInternal, uri]
+ nova::compute::barbican_auth_endpoint:
+ get_param: [EndpointMap, KeystoneV3Internal, uri]
+ cinder_api:
+ cinder::api::keymgr_api_class: >
+ castellan.key_manager.barbican_key_manager.BarbicanKeyManager
+ cinder::api::keymgr_encryption_api_url:
+ get_param: [EndpointMap, BarbicanInternal, uri]
+ cinder::api::keymgr_encryption_auth_url:
+ get_param: [EndpointMap, KeystoneV3Internal, uri]
diff --git a/puppet/services/ceilometer-base.yaml b/puppet/services/ceilometer-base.yaml
index 4ace7526..ded1bc03 100644
--- a/puppet/services/ceilometer-base.yaml
+++ b/puppet/services/ceilometer-base.yaml
@@ -36,6 +36,12 @@ parameters:
type: string
constraints:
- allowed_values: ['gnocchi', 'database']
+ CeilometerEventDispatcher:
+ default: ['gnocchi']
+ description: Comma-separated list of Dispatchers to process events data
+ type: comma_delimited_list
+ constraints:
+ - allowed_values: ['panko', 'gnocchi', 'database']
CeilometerWorkers:
default: 0
description: Number of workers for Ceilometer service.
@@ -102,6 +108,7 @@ outputs:
ceilometer::agent::auth::auth_tenant_name: 'service'
ceilometer::agent::auth::auth_endpoint_type: 'internalURL'
ceilometer::collector::meter_dispatcher: {get_param: CeilometerMeterDispatcher}
+ ceilometer::collector::event_dispatcher: {get_param: CeilometerEventDispatcher}
ceilometer::dispatcher::gnocchi::url: {get_param: [EndpointMap, GnocchiInternal, uri]}
ceilometer::dispatcher::gnocchi::filter_project: 'service'
ceilometer::dispatcher::gnocchi::archive_policy: 'low'
diff --git a/puppet/services/haproxy.yaml b/puppet/services/haproxy.yaml
index 0813cb7e..c8edade5 100644
--- a/puppet/services/haproxy.yaml
+++ b/puppet/services/haproxy.yaml
@@ -34,16 +34,6 @@ parameters:
description: The password for Redis
type: string
hidden: true
- ControlVirtualInterface:
- default: 'br-ex'
- description: Interface where virtual ip will be assigned.
- type: string
- PublicVirtualInterface:
- default: 'br-ex'
- description: >
- Specifies the interface where the public-facing virtual ip will be assigned.
- This should be int_public when a VLAN is being used.
- type: string
MonitoringSubscriptionHaproxy:
default: 'overcloud-haproxy'
type: string
@@ -81,8 +71,6 @@ outputs:
tripleo::haproxy::haproxy_stats_user: {get_param: HAProxyStatsUser}
tripleo::haproxy::haproxy_stats_password: {get_param: HAProxyStatsPassword}
tripleo::haproxy::redis_password: {get_param: RedisPassword}
- tripleo::haproxy::control_virtual_interface: {get_param: ControlVirtualInterface}
- tripleo::haproxy::public_virtual_interface: {get_param: PublicVirtualInterface}
tripleo::profile::base::haproxy::certificates_specs:
map_merge:
- get_attr: [HAProxyPublicTLS, role_data, certificates_specs]
diff --git a/puppet/services/horizon.yaml b/puppet/services/horizon.yaml
index 017bb76f..8eaf4044 100644
--- a/puppet/services/horizon.yaml
+++ b/puppet/services/horizon.yaml
@@ -59,12 +59,14 @@ outputs:
- 80
- 443
horizon::disable_password_reveal: true
+ horizon::enforce_password_check: true
horizon::cache_backend: django.core.cache.backends.memcached.MemcachedCache
horizon::django_session_engine: 'django.contrib.sessions.backends.cache'
horizon::vhost_extra_params:
add_listen: false
priority: 10
access_log_format: '%a %l %u %t \"%r\" %>s %b \"%%{}{Referer}i\" \"%%{}{User-Agent}i\"'
+ options: ['FollowSymLinks','MultiViews']
horizon::bind_address: {get_param: [ServiceNetMap, HorizonNetwork]}
horizon::keystone_url: {get_param: [EndpointMap, KeystoneInternal, uri]}
horizon::secret_key:
diff --git a/puppet/services/keepalived.yaml b/puppet/services/keepalived.yaml
index 38cfbe22..fb0d32b6 100644
--- a/puppet/services/keepalived.yaml
+++ b/puppet/services/keepalived.yaml
@@ -19,14 +19,18 @@ parameters:
via parameter_defaults in the resource registry.
type: json
ControlVirtualInterface:
- default: 'br-ex'
- description: Interface where virtual ip will be assigned.
+ default: ''
+ description: >
+ Interface where virtual ip will be assigned. This value will be
+ automatically set by the deployment tool. Overriding here will
+ override automatic setting.
type: string
PublicVirtualInterface:
- default: 'br-ex'
+ default: ''
description: >
- Specifies the interface where the public-facing virtual ip will be assigned.
- This should be int_public when a VLAN is being used.
+ Interface where virtual ip will be assigned. This value will be
+ automatically set by the deployment tool. Overriding here will
+ override automatic setting.
type: string
MonitoringSubscriptionKeepalived:
default: 'overcloud-keepalived'
diff --git a/puppet/services/keystone.yaml b/puppet/services/keystone.yaml
index d819e043..fe023a6a 100644
--- a/puppet/services/keystone.yaml
+++ b/puppet/services/keystone.yaml
@@ -99,6 +99,12 @@ parameters:
KeystoneCredential1:
type: string
description: The second Keystone credential key. Must be a valid key.
+ KeystoneFernetKey0:
+ type: string
+ description: The first Keystone fernet key. Must be a valid key.
+ KeystoneFernetKey1:
+ type: string
+ description: The second Keystone fernet key. Must be a valid key.
KeystoneLoggingSource:
type: json
default:
@@ -156,6 +162,11 @@ outputs:
content: {get_param: KeystoneCredential0}
'/etc/keystone/credential-keys/1':
content: {get_param: KeystoneCredential1}
+ keystone::fernet_keys:
+ '/etc/keystone/fernet-keys/0':
+ content: {get_param: KeystoneFernetKey0}
+ '/etc/keystone/fernet-keys/1':
+ content: {get_param: KeystoneFernetKey1}
keystone::debug: {get_param: Debug}
keystone::rabbit_userid: {get_param: RabbitUserName}
keystone::rabbit_password: {get_param: RabbitPassword}
diff --git a/puppet/services/neutron-api.yaml b/puppet/services/neutron-api.yaml
index 408eb795..5fd9d7a2 100644
--- a/puppet/services/neutron-api.yaml
+++ b/puppet/services/neutron-api.yaml
@@ -57,26 +57,20 @@ parameters:
default:
tag: openstack.neutron.api
path: /var/log/neutron/server.log
- ControllerCount:
- description: |
- Under normal conditions, this should not be overridden manually and is
- set at deployment time. The default value is present to allow the
- template to be used in environments that do not override it.
- default: 1
- type: number
# DEPRECATED: the following options are deprecated and are currently maintained
# for backwards compatibility. They will be removed in the Ocata cycle.
NeutronL3HA:
- default: false
+ default: ''
+ type: string
description: |
- Whether to enable HA for virtual routers. While the default value is
- 'false', L3 HA will be automatically enabled if the number of nodes
- hosting controller configurations and DVR is disabled. This parameter is
- being deprecated in Newton and is scheduled to be removed in Ocata.
- Future releases will enable L3 HA by default if it is appropriate for the
- deployment type. Alternate mechanisms will be available to override.
- type: boolean
+ Whether to enable HA for virtual routers. When not set, L3 HA will be
+ automatically enabled if the number of nodes hosting controller
+ configurations and DVR is disabled. Valid values are 'true' or 'false'
+ This parameter is being deprecated in Newton and is scheduled to be
+ removed in Ocata. Future releases will enable L3 HA by default if it is
+ appropriate for the deployment type. Alternate mechanisms will be
+ available to override.
parameter_groups:
- label: deprecated
@@ -97,18 +91,6 @@ resources:
DefaultPasswords: {get_param: DefaultPasswords}
EndpointMap: {get_param: EndpointMap}
-conditions:
-
- auto_enable_l3_ha:
- and:
- - not:
- equals:
- - get_param: ControllerCount
- - 1
- - equals:
- - get_param: NeutronEnableDVR
- - false
-
outputs:
role_data:
description: Role data for the Neutron Server agent service.
@@ -135,7 +117,6 @@ outputs:
neutron::server::api_workers: {get_param: NeutronWorkers}
neutron::server::rpc_workers: {get_param: NeutronWorkers}
neutron::server::allow_automatic_l3agent_failover: {get_param: NeutronAllowL3AgentFailover}
- neutron::server::l3_ha: {if: ["auto_enable_l3_ha", true, {get_param: NeutronL3HA}]}
neutron::server::enable_proxy_headers_parsing: true
neutron::keystone::authtoken::password: {get_param: NeutronPassword}
@@ -158,6 +139,7 @@ outputs:
# internal_api_uri -> [IP]
# internal_api_subnet - > IP/CIDR
neutron::bind_host: {get_param: [ServiceNetMap, NeutronApiNetwork]}
+ tripleo::profile::base::neutron::server::l3_ha_override: {get_param: NeutronL3HA}
step_config: |
include tripleo::profile::base::neutron::server
service_config_settings:
diff --git a/puppet/services/pacemaker/haproxy.yaml b/puppet/services/pacemaker/haproxy.yaml
index 52104a71..e4115d64 100644
--- a/puppet/services/pacemaker/haproxy.yaml
+++ b/puppet/services/pacemaker/haproxy.yaml
@@ -38,7 +38,5 @@ outputs:
- get_attr: [LoadbalancerServiceBase, role_data, config_settings]
- tripleo::haproxy::haproxy_service_manage: false
tripleo::haproxy::mysql_clustercheck: true
- enable_keepalived: false
- tripleo::haproxy::keepalived: false
step_config: |
include ::tripleo::profile::pacemaker::haproxy
diff --git a/puppet/services/panko-api.yaml b/puppet/services/panko-api.yaml
new file mode 100644
index 00000000..63f631a0
--- /dev/null
+++ b/puppet/services/panko-api.yaml
@@ -0,0 +1,84 @@
+heat_template_version: 2016-04-08
+
+description: >
+ OpenStack Panko API service configured with Puppet
+
+parameters:
+ ServiceNetMap:
+ default: {}
+ description: Mapping of service_name -> network name. Typically set
+ via parameter_defaults in the resource registry. This
+ mapping overrides those in ServiceNetMapDefaults.
+ type: json
+ DefaultPasswords:
+ default: {}
+ type: json
+ EndpointMap:
+ default: {}
+ description: Mapping of service endpoint -> protocol. Typically set
+ via parameter_defaults in the resource registry.
+ type: json
+ MonitoringSubscriptionPankoApi:
+ default: 'overcloud-ceilometer-panko-api'
+ type: string
+ EnableInternalTLS:
+ type: boolean
+ default: false
+
+resources:
+ PankoBase:
+ type: ./panko-base.yaml
+ properties:
+ ServiceNetMap: {get_param: ServiceNetMap}
+ DefaultPasswords: {get_param: DefaultPasswords}
+ EndpointMap: {get_param: EndpointMap}
+
+ ApacheServiceBase:
+ type: ./apache.yaml
+ properties:
+ ServiceNetMap: {get_param: ServiceNetMap}
+ DefaultPasswords: {get_param: DefaultPasswords}
+ EndpointMap: {get_param: EndpointMap}
+ EnableInternalTLS: {get_param: EnableInternalTLS}
+
+outputs:
+ role_data:
+ description: Role data for the Panko API service.
+ value:
+ service_name: panko_api
+ monitoring_subscription: {get_param: MonitoringSubscriptionPankoApi}
+ config_settings:
+ map_merge:
+ - get_attr: [PankoBase, role_data, config_settings]
+ - get_attr: [ApacheServiceBase, role_data, config_settings]
+ - panko::wsgi::apache::ssl: {get_param: EnableInternalTLS}
+ panko::wsgi::apache::servername:
+ str_replace:
+ template:
+ '"%{::fqdn_$NETWORK}"'
+ params:
+ $NETWORK: {get_param: [ServiceNetMap, PankoApiNetwork]}
+ panko::api::service_name: 'httpd'
+ panko::api::enable_proxy_headers_parsing: true
+ tripleo.panko_api.firewall_rules:
+ '140 panko-api':
+ dport:
+ - 8779
+ - 13779
+ panko::api::host:
+ str_replace:
+ template:
+ '"%{::fqdn_$NETWORK}"'
+ params:
+ $NETWORK: {get_param: [ServiceNetMap, PankoApiNetwork]}
+ # NOTE: bind IP is found in Heat replacing the network name with the
+ # local node IP for the given network; replacement examples
+ # (eg. for internal_api):
+ # internal_api -> IP
+ # internal_api_uri -> [IP]
+ # internal_api_subnet - > IP/CIDR
+ panko::wsgi::apache::bind_host: {get_param: [ServiceNetMap, PankoApiNetwork]}
+ service_config_settings:
+ get_attr: [PankoBase, role_data, service_config_settings]
+ step_config: |
+ include tripleo::profile::base::panko::api
diff --git a/puppet/services/panko-base.yaml b/puppet/services/panko-base.yaml
new file mode 100644
index 00000000..32754a55
--- /dev/null
+++ b/puppet/services/panko-base.yaml
@@ -0,0 +1,74 @@
+heat_template_version: 2016-04-08
+
+description: >
+ OpenStack Panko service configured with Puppet
+
+parameters:
+ ServiceNetMap:
+ default: {}
+ description: Mapping of service_name -> network name. Typically set
+ via parameter_defaults in the resource registry. This
+ mapping overrides those in ServiceNetMapDefaults.
+ type: json
+ DefaultPasswords:
+ default: {}
+ type: json
+ EndpointMap:
+ default: {}
+ description: Mapping of service endpoint -> protocol. Typically set
+ via parameter_defaults in the resource registry.
+ type: json
+ PankoPassword:
+ description: The password for the panko services.
+ type: string
+ hidden: true
+ Debug:
+ default: ''
+ description: Set to True to enable debugging on all services.
+ type: string
+ KeystoneRegion:
+ type: string
+ default: 'regionOne'
+ description: Keystone region for endpoint
+
+outputs:
+ role_data:
+ description: Role data for the Panko role.
+ value:
+ service_name: panko_base
+ config_settings:
+ panko_redis_password: {get_param: RedisPassword}
+ panko::db::database_connection:
+ list_join:
+ - ''
+ - - {get_param: [EndpointMap, MysqlInternal, protocol]}
+ - '://panko:'
+ - {get_param: PankoPassword}
+ - '@'
+ - {get_param: [EndpointMap, MysqlInternal, host]}
+ - '/panko'
+ panko::debug: {get_param: Debug}
+ panko::auth::auth_url: {get_param: [EndpointMap, KeystoneInternal, uri_no_suffix] }
+ panko::keystone::authtoken::project_name: 'service'
+ panko::keystone::authtoken::password: {get_param: PankoPassword}
+ panko::keystone::authtoken::auth_uri: {get_param: [EndpointMap, KeystoneInternal, uri] }
+ panko::keystone::authtoken::auth_url: { get_param: [EndpointMap, KeystoneAdmin, uri_no_suffix] }
+ panko::auth::auth_password: {get_param: PankoPassword}
+ panko::auth::auth_region: 'regionOne'
+ panko::auth::auth_tenant_name: 'service'
+ service_config_settings:
+ keystone:
+ panko::keystone::auth::public_url: {get_param: [EndpointMap, PankoPublic, uri]}
+ panko::keystone::auth::internal_url: {get_param: [EndpointMap, PankoInternal, uri]}
+ panko::keystone::auth::admin_url: {get_param: [EndpointMap, PankoAdmin, uri]}
+ panko::keystone::auth::password: {get_param: PankoPassword}
+ panko::keystone::auth::region: {get_param: KeystoneRegion}
+ panko::keystone::auth::tenant: 'service'
+ mysql:
+ panko::db::mysql::user: panko
+ panko::db::mysql::password: {get_param: PankoPassword}
+ panko::db::mysql::host: {get_param: [EndpointMap, MysqlInternal, host_nobrackets]}
+ panko::db::mysql::dbname: panko
+ panko::db::mysql::allowed_hosts:
+ - '%'
+ - "%{hiera('mysql_bind_host')}"
diff --git a/roles_data.yaml b/roles_data.yaml
index dad62f85..0317e1b6 100644
--- a/roles_data.yaml
+++ b/roles_data.yaml
@@ -96,6 +96,7 @@
- OS::TripleO::Services::FluentdClient
- OS::TripleO::Services::VipHosts
- OS::TripleO::Services::BarbicanApi
+ - OS::TripleO::Services::PankoApi
- name: Compute
CountDefault: 1