4 files changed, 69 insertions, 16 deletions
diff --git a/puppet/services/horizon.yaml b/puppet/services/horizon.yaml
index c8ec2b2b..6ea5ec4e 100644
--- a/puppet/services/horizon.yaml
+++ b/puppet/services/horizon.yaml
@@ -68,19 +68,6 @@ outputs:
           add_listen: false
           priority: 10
           access_log_format: '%a %l %u %t \"%r\" %>s %b \"%%{}{Referer}i\" \"%%{}{User-Agent}i\"'
-        # NOTE: bind IP is found in Heat replacing the network name with the local node IP
-        # for the given network; replacement examples (eg. for internal_api):
-        # internal_api -> IP
-        # internal_api_uri -> [IP]
-        # internal_api_subnet - > IP/CIDR
-        apache::ip: {get_param: [ServiceNetMap, HorizonNetwork]}
-        apache_remote_proxy_ips_network:
-          str_replace:
-            template: "NETWORK_subnet"
-            params:
-              NETWORK: {get_param: [ServiceNetMap, HorizonNetwork]}
-        apache::mod::remoteip::proxy_ips:
-          - "%{hiera('apache_remote_proxy_ips_network')}"
         horizon::bind_address: {get_param: [ServiceNetMap, HorizonNetwork]}
         horizon::django_debug: {get_param: Debug}
         horizon::keystone_url: {get_param: [EndpointMap, KeystoneInternal, uri]}
diff --git a/puppet/services/pacemaker.yaml b/puppet/services/pacemaker.yaml
index 31016761..5d1d666a 100644
--- a/puppet/services/pacemaker.yaml
+++ b/puppet/services/pacemaker.yaml
@@ -1,4 +1,4 @@
-heat_template_version: 2016-04-08
+heat_template_version: 2016-10-14
 
 description: >
   Pacemaker service configured with Puppet
@@ -21,6 +21,51 @@ parameters:
   MonitoringSubscriptionPacemaker:
     default: 'overcloud-pacemaker'
     type: string
+  CorosyncIPv6:
+    default: false
+    description: Enable IPv6 in Corosync
+    type: boolean
+  EnableFencing:
+    default: false
+    description: Whether to enable fencing in Pacemaker or not.
+    type: boolean
+  PcsdPassword:
+    type: string
+    description: The password for the 'pcsd' user for pacemaker.
+    hidden: true
+    default: ''
+  FencingConfig:
+    default: {}
+    description: |
+      Pacemaker fencing configuration. The JSON should have
+      the following structure:
+        {
+          "devices": [
+            {
+              "agent": "AGENT_NAME",
+              "host_mac": "HOST_MAC_ADDRESS",
+              "params": {"PARAM_NAME": "PARAM_VALUE"}
+            }
+          ]
+        }
+      For instance:
+        {
+          "devices": [
+            {
+              "agent": "fence_xvm",
+              "host_mac": "52:54:00:aa:bb:cc",
+              "params": {
+                "multicast_address": "225.0.0.12",
+                "port": "baremetal_0",
+                "manage_fw": true,
+                "manage_key_file": true,
+                "key_file": "/etc/fence_xvm.key",
+                "key_file_password": "abcdef"
+              }
+            }
+          ]
+        }
+    type: json
 
 outputs:
   role_data:
@@ -44,5 +89,15 @@ outputs:
           '131 pacemaker udp':
             proto: 'udp'
             dport: 5405
+        corosync_ipv6: {get_param: CorosyncIPv6}
+        tripleo::fencing::config: {get_param: FencingConfig}
+        enable_fencing: {get_param: EnableFencing}
+        hacluster_pwd:
+          yaql:
+            expression: $.data.passwords.where($ != '').first()
+            data:
+              passwords:
+                - {get_param: PcsdPassword}
+                - {get_param: [DefaultPasswords, pcsd_password]}
       step_config: |
         include ::tripleo::profile::base::pacemaker
diff --git a/puppet/services/snmp.yaml b/puppet/services/snmp.yaml
index e38ccf42..4d01632d 100644
--- a/puppet/services/snmp.yaml
+++ b/puppet/services/snmp.yaml
@@ -35,8 +35,8 @@ outputs:
     value:
       service_name: snmp
       config_settings:
-        snmpd_readonly_user_name: {get_param: SnmpdReadonlyUserName}
-        snmpd_readonly_user_password: {get_param: SnmpdReadonlyUserPassword}
+        tripleo::profile::base::snmp::snmpd_user: {get_param: SnmpdReadonlyUserName}
+        tripleo::profile::base::snmp::snmpd_password: {get_param: SnmpdReadonlyUserPassword}
         tripleo.snmp.firewall_rules:
           '127 snmp':
             dport: 161
diff --git a/puppet/services/tripleo-firewall.yaml b/puppet/services/tripleo-firewall.yaml
index 14965b4f..f6ec458f 100644
--- a/puppet/services/tripleo-firewall.yaml
+++ b/puppet/services/tripleo-firewall.yaml
@@ -18,11 +18,22 @@ parameters:
     description: Mapping of service endpoint -> protocol. Typically set
                  via parameter_defaults in the resource registry.
     type: json
+  ManageFirewall:
+    default: false
+    description: Whether to manage IPtables rules.
+    type: boolean
+  PurgeFirewallRules:
+    default: false
+    description: Whether IPtables rules should be purged before setting up the new ones.
+    type: boolean
 
 outputs:
   role_data:
     description: Role data for the TripleO firewall settings
     value:
       service_name: tripleo_firewall
+      config_settings:
+        tripleo::firewall::manage_firewall: {get_param: ManageFirewall}
+        tripleo::firewall::purge_firewall_rules: {get_param: PurgeFirewallRules}
       step_config: |
         include ::tripleo::firewall