13 files changed, 97 insertions, 37 deletions
diff --git a/puppet/services/ceph-external.yaml b/puppet/services/ceph-external.yaml
index 7d75074c..9120687b 100644
--- a/puppet/services/ceph-external.yaml
+++ b/puppet/services/ceph-external.yaml
@@ -1,4 +1,4 @@
-heat_template_version: 2016-04-08
+heat_template_version: 2016-10-14
 
 description: >
   Ceph External service.
@@ -27,9 +27,20 @@ parameters:
   GlanceRbdPoolName:
     default: images
     type: string
+  GlanceBackend:
+    default: swift
+    description: The short name of the Glance backend to use. Should be one
+      of swift, rbd, or file
+    type: string
+    constraints:
+    - allowed_values: ['swift', 'file', 'rbd']
   GnocchiRbdPoolName:
     default: metrics
     type: string
+  NovaEnableRbdBackend:
+    default: false
+    description: Whether to enable or not the Rbd backend for Nova
+    type: boolean
   NovaRbdPoolName:
     default: vms
     type: string
@@ -51,6 +62,16 @@ parameters:
     default: 'overcloud-ceph-external'
     type: string
 
+conditions:
+  glance_multiple_locations:
+    and:
+    - equals:
+      - get_param: GlanceBackend
+      - rbd
+    - equals:
+      - get_param: NovaEnableRbdBackend
+      - true
+
 outputs:
   role_data:
     description: Role data for the Ceph External service.
@@ -79,6 +100,7 @@ outputs:
               GLANCE_POOL: {get_param: GlanceRbdPoolName}
               GNOCCHI_POOL: {get_param: GnocchiRbdPoolName}
       service_config_settings:
-        get_attr: [CephBase, role_data, service_config_settings]
+        glance_api:
+          glance::api::show_multiple_locations: {if: [glance_multiple_locations, true, false]}
       step_config: |
         include ::tripleo::profile::base::ceph::client
diff --git a/puppet/services/gnocchi-api.yaml b/puppet/services/gnocchi-api.yaml
index e3397769..ac15de4f 100644
--- a/puppet/services/gnocchi-api.yaml
+++ b/puppet/services/gnocchi-api.yaml
@@ -41,6 +41,9 @@ parameters:
     default:
       tag: openstack.gnocchi.api
       path: /var/log/gnocchi/app.log
+  EnableInternalTLS:
+    type: boolean
+    default: false
 
 resources:
 
@@ -57,6 +60,7 @@ resources:
       ServiceNetMap: {get_param: ServiceNetMap}
       DefaultPasswords: {get_param: DefaultPasswords}
       EndpointMap: {get_param: EndpointMap}
+      EnableInternalTLS: {get_param: EnableInternalTLS}
 
 outputs:
   role_data:
@@ -83,7 +87,7 @@ outputs:
             gnocchi::keystone::authtoken::auth_url: {get_param: [EndpointMap, KeystoneAdmin, uri_no_suffix]}
             gnocchi::keystone::authtoken::password: {get_param: GnocchiPassword}
             gnocchi::keystone::authtoken::project_name: 'service'
-            gnocchi::wsgi::apache::ssl: false
+            gnocchi::wsgi::apache::ssl: {get_param: EnableInternalTLS}
             gnocchi::wsgi::apache::servername:
               str_replace:
                 template:
@@ -98,7 +102,12 @@ outputs:
             # internal_api_uri -> [IP]
             # internal_api_subnet - > IP/CIDR
             gnocchi::wsgi::apache::bind_host: {get_param: [ServiceNetMap, GnocchiApiNetwork]}
-            gnocchi::api::host: {get_param: [ServiceNetMap, GnocchiApiNetwork]}
+            gnocchi::api::host:
+              str_replace:
+                template:
+                  '"%{::fqdn_$NETWORK}"'
+                params:
+                  $NETWORK: {get_param: [ServiceNetMap, GnocchiApiNetwork]}
 
             gnocchi::api::keystone_auth_uri: {get_param: [EndpointMap, KeystoneInternal, uri]}
             gnocchi::api::keystone_identity_uri: {get_param: [EndpointMap, KeystoneAdmin, uri_no_suffix]}
diff --git a/puppet/services/gnocchi-statsd.yaml b/puppet/services/gnocchi-statsd.yaml
index 04339f46..983d6c91 100644
--- a/puppet/services/gnocchi-statsd.yaml
+++ b/puppet/services/gnocchi-statsd.yaml
@@ -39,5 +39,9 @@ outputs:
       config_settings:
         map_merge:
           - get_attr: [GnocchiServiceBase, role_data, config_settings]
+          - tripleo.gnocchi_statsd.firewall_rules:
+              '140 gnocchi-statsd':
+                dport: 8125
+                proto: 'udp'
       step_config: |
         include ::tripleo::profile::base::gnocchi::statsd
diff --git a/puppet/services/manila-api.yaml b/puppet/services/manila-api.yaml
index 4d3fd47c..5f4ab6ba 100644
--- a/puppet/services/manila-api.yaml
+++ b/puppet/services/manila-api.yaml
@@ -62,21 +62,15 @@ outputs:
       step_config: |
         include ::tripleo::profile::base::manila::api
       service_config_settings:
-        keystone:
-          manila::keystone::auth::tenant: 'service'
-          manila::keystone::auth::public_url: {get_param: [EndpointMap, ManilaV1Public, uri]}
-          manila::keystone::auth::internal_url: {get_param: [EndpointMap, ManilaV1Internal, uri]}
-          manila::keystone::auth::admin_url: {get_param: [EndpointMap, ManilaV1Admin, uri]}
-          manila::keystone::auth::public_url_v2: {get_param: [EndpointMap, ManilaPublic, uri]}
-          manila::keystone::auth::internal_url_v2: {get_param: [EndpointMap, ManilaInternal, uri]}
-          manila::keystone::auth::admin_url_v2: {get_param: [EndpointMap, ManilaAdmin, uri]}
-          manila::keystone::auth::password: {get_param: ManilaPassword}
-          manila::keystone::auth::region: {get_param: KeystoneRegion}
-        mysql:
-          manila::db::mysql::password: {get_param: ManilaPassword}
-          manila::db::mysql::user: manila
-          manila::db::mysql::host: {get_param: [EndpointMap, MysqlInternal, host_nobrackets]}
-          manila::db::mysql::dbname: manila
-          manila::db::mysql::allowed_hosts:
-            - '%'
-            - "%{hiera('mysql_bind_host')}"
+        map_merge:
+          - get_attr: [ManilaBase, role_data, service_config_settings]
+          - keystone:
+              manila::keystone::auth::tenant: 'service'
+              manila::keystone::auth::public_url: {get_param: [EndpointMap, ManilaV1Public, uri]}
+              manila::keystone::auth::internal_url: {get_param: [EndpointMap, ManilaV1Internal, uri]}
+              manila::keystone::auth::admin_url: {get_param: [EndpointMap, ManilaV1Admin, uri]}
+              manila::keystone::auth::public_url_v2: {get_param: [EndpointMap, ManilaPublic, uri]}
+              manila::keystone::auth::internal_url_v2: {get_param: [EndpointMap, ManilaInternal, uri]}
+              manila::keystone::auth::admin_url_v2: {get_param: [EndpointMap, ManilaAdmin, uri]}
+              manila::keystone::auth::password: {get_param: ManilaPassword}
+              manila::keystone::auth::region: {get_param: KeystoneRegion}
diff --git a/puppet/services/manila-base.yaml b/puppet/services/manila-base.yaml
index d228577a..844bd3a3 100644
--- a/puppet/services/manila-base.yaml
+++ b/puppet/services/manila-base.yaml
@@ -40,6 +40,10 @@ parameters:
     default: 5672
     description: Set rabbit subscriber port, change this if using SSL
     type: number
+  ManilaPassword:
+    description: The password for the manila service account.
+    type: string
+    hidden: true
 
 outputs:
   role_data:
@@ -54,3 +58,21 @@ outputs:
         manila::debug: {get_param: Debug}
         manila::db::database_db_max_retries: -1
         manila::db::database_max_retries: -1
+        manila::sql_connection:
+          list_join:
+          - ''
+          - - {get_param: [EndpointMap, MysqlInternal, protocol]}
+            - '://manila:'
+            - {get_param: ManilaPassword}
+            - '@'
+            - {get_param: [EndpointMap, MysqlInternal, host]}
+            - '/manila'
+      service_config_settings:
+        mysql:
+          manila::db::mysql::password: {get_param: ManilaPassword}
+          manila::db::mysql::user: manila
+          manila::db::mysql::host: {get_param: [EndpointMap, MysqlInternal, host_nobrackets]}
+          manila::db::mysql::dbname: manila
+          manila::db::mysql::allowed_hosts:
+            - '%'
+            - "%{hiera('mysql_bind_host')}"
diff --git a/puppet/services/manila-scheduler.yaml b/puppet/services/manila-scheduler.yaml
index 474cc24f..d96b677b 100644
--- a/puppet/services/manila-scheduler.yaml
+++ b/puppet/services/manila-scheduler.yaml
@@ -57,14 +57,5 @@ outputs:
             manila::network::neutron::neutron_url: {get_param: [EndpointMap, NeutronInternal, uri]}
             manila::network::neutron::neutron_admin_auth_url: {get_param: [EndpointMap, NeutronAdmin, uri]}
             manila::network::neutron::neutron_admin_password: {get_param: NeutronPassword}
-            manila::sql_connection:
-                list_join:
-                - ''
-                - - {get_param: [EndpointMap, MysqlInternal, protocol]}
-                  - '://manila:'
-                  - {get_param: ManilaPassword}
-                  - '@'
-                  - {get_param: [EndpointMap, MysqlInternal, host]}
-                  - '/manila'
       step_config: |
         include ::tripleo::profile::base::manila::scheduler
diff --git a/puppet/services/manila-share.yaml b/puppet/services/manila-share.yaml
index e42d2fae..49c69fc1 100644
--- a/puppet/services/manila-share.yaml
+++ b/puppet/services/manila-share.yaml
@@ -21,6 +21,10 @@ parameters:
   MonitoringSubscriptionManilaShare:
     default: 'overcloud-manila-share'
     type: string
+  ManilaPassword:
+    description: The password for the manila service account.
+    type: string
+    hidden: true
 
 resources:
   ManilaBase:
@@ -40,5 +44,11 @@ outputs:
         map_merge:
           - get_attr: [ManilaBase, role_data, config_settings]
           - manila::volume::cinder::cinder_admin_tenant_name: 'service'
+            manila::keystone::authtoken::password: {get_param: ManilaPassword}
+            manila::keystone::authtoken::auth_uri: {get_param: [EndpointMap, KeystoneInternal, uri]}
+            manila::keystone::authtoken::auth_url: { get_param: [EndpointMap, KeystoneAdmin, uri_no_suffix] }
+            manila::keystone::authtoken::project_name: 'service'
+      service_config_settings:
+        get_attr: [ManilaBase, role_data, service_config_settings]
       step_config: |
         include ::tripleo::profile::base::manila::share
diff --git a/puppet/services/nova-api.yaml b/puppet/services/nova-api.yaml
index bf479437..3cc238c1 100644
--- a/puppet/services/nova-api.yaml
+++ b/puppet/services/nova-api.yaml
@@ -88,8 +88,6 @@ outputs:
           tripleo.nova_api.firewall_rules:
             '113 nova_api':
               dport:
-                - 6080
-                - 13080
                 - 8773
                 - 3773
                 - 8774
diff --git a/puppet/services/nova-libvirt.yaml b/puppet/services/nova-libvirt.yaml
index 31732580..70774bac 100644
--- a/puppet/services/nova-libvirt.yaml
+++ b/puppet/services/nova-libvirt.yaml
@@ -54,6 +54,9 @@ outputs:
               '200 nova_libvirt':
                 dport:
                   - 16509
+                  - 16514
+                  - '49152-49215'
+                  - '5900-5999'
 
       step_config: |
         include tripleo::profile::base::nova::libvirt
diff --git a/puppet/services/nova-scheduler.yaml b/puppet/services/nova-scheduler.yaml
index d89e3e11..d4e5fff6 100644
--- a/puppet/services/nova-scheduler.yaml
+++ b/puppet/services/nova-scheduler.yaml
@@ -58,7 +58,7 @@ outputs:
       config_settings:
         map_merge:
           - get_attr: [NovaBase, role_data, config_settings]
-          - nova::scheduler::filter::ram_allocation_ratio: '1.0'
+          - nova::ram_allocation_ratio: '1.0'
             nova::scheduler::filter::scheduler_available_filters: {get_param: NovaSchedulerAvailableFilters}
             nova::scheduler::filter::scheduler_default_filters: {get_param: NovaSchedulerDefaultFilters}
       step_config: |
diff --git a/puppet/services/nova-vnc-proxy.yaml b/puppet/services/nova-vnc-proxy.yaml
index 85d59ae6..e6b0703f 100644
--- a/puppet/services/nova-vnc-proxy.yaml
+++ b/puppet/services/nova-vnc-proxy.yaml
@@ -57,5 +57,10 @@ outputs:
             # internal_api_uri -> [IP]
             # internal_api_subnet - > IP/CIDR
             nova::vncproxy::host: {get_param: [ServiceNetMap, NovaApiNetwork]}
+            tripleo.nova_vnc_proxy.firewall_rules:
+              '137 nova_vnc_proxy':
+                dport:
+                  - 6080
+                  - 13080
       step_config: |
         include tripleo::profile::base::nova::vncproxy
diff --git a/puppet/services/swift-proxy.yaml b/puppet/services/swift-proxy.yaml
index 35e21181..ae265448 100644
--- a/puppet/services/swift-proxy.yaml
+++ b/puppet/services/swift-proxy.yaml
@@ -74,7 +74,6 @@ outputs:
             swift::proxy::authtoken::project_name: 'service'
             swift::proxy::node_timeout: {get_param: SwiftProxyNodeTimeout}
             swift::proxy::workers: {get_param: SwiftWorkers}
-            swift::proxy::ceilometer::rabbit_host: {get_param: [ServiceNetMap, RabbitmqNetwork]}
             swift::proxy::ceilometer::rabbit_user: {get_param: RabbitUserName}
             swift::proxy::ceilometer::rabbit_password: {get_param: RabbitPassword}
             tripleo.swift_proxy.firewall_rules:
diff --git a/puppet/services/swift-ringbuilder.yaml b/puppet/services/swift-ringbuilder.yaml
index 8ed4e9f4..5c70b6ab 100644
--- a/puppet/services/swift-ringbuilder.yaml
+++ b/puppet/services/swift-ringbuilder.yaml
@@ -38,7 +38,10 @@ parameters:
     default: {}
     description: 'A hash of additional raw devices to use as Swift backend (eg. {sdb: {}})'
     type: json
-
+  SwiftUseLocalDir:
+    default: true
+    description: 'Use a local directory for Swift storage services when building rings'
+    type: boolean
 
 outputs:
   role_data:
@@ -56,7 +59,7 @@ outputs:
             expression: $.data.raw_disk_lists.flatten()
             data:
               raw_disk_lists:
-              - [':%PORT%/d1']
+              - {if: [{get_param: SwiftUseLocalDir}, [':%PORT%/d1'], []]}
               - repeat:
                   template: ':%PORT%/DEVICE'
                   for_each: