13 files changed, 87 insertions, 30 deletions
diff --git a/puppet/services/cinder-volume.yaml b/puppet/services/cinder-volume.yaml
index b52955ef..26f1a96f 100644
--- a/puppet/services/cinder-volume.yaml
+++ b/puppet/services/cinder-volume.yaml
@@ -94,11 +94,7 @@ outputs:
             tripleo::profile::base::cinder::volume::cinder_enable_nfs_backend: {get_param: CinderEnableNfsBackend}
             tripleo::profile::base::cinder::volume::cinder_enable_rbd_backend: {get_param: CinderEnableRbdBackend}
             tripleo::profile::base::cinder::volume::nfs::cinder_nfs_mount_options: {get_param: CinderNfsMountOptions}
-            tripleo::profile::base::cinder::volume::nfs::cinder_nfs_servers:
-              str_replace:
-                template: SERVERS
-                params:
-                  SERVERS: {get_param: CinderNfsServers}
+            tripleo::profile::base::cinder::volume::nfs::cinder_nfs_servers: {get_param: CinderNfsServers}
             tripleo::profile::base::cinder::volume::iscsi::cinder_lvm_loop_device_size: {get_param: CinderLVMLoopDeviceSize}
             tripleo::profile::base::cinder::volume::iscsi::cinder_iscsi_helper: {get_param: CinderISCSIHelper}
             tripleo::profile::base::cinder::volume::iscsi::cinder_iscsi_protocol: {get_param: CinderISCSIProtocol}
diff --git a/puppet/services/database/mysql.yaml b/puppet/services/database/mysql.yaml
index 808f1353..7078b60f 100644
--- a/puppet/services/database/mysql.yaml
+++ b/puppet/services/database/mysql.yaml
@@ -23,6 +23,10 @@ parameters:
     description: Configures MySQL max_connections config setting
     type: number
     default: 4096
+  MysqlIncreaseFileLimit:
+    description: Flag to increase MySQL open-files-limit to 16384
+    type: boolean
+    default: true
   MysqlRootPassword:
     type: string
     hidden: true
@@ -96,6 +100,8 @@ outputs:
                   $NETWORK: {get_param: [ServiceNetMap, MysqlNetwork]}
             tripleo::profile::base::database::mysql::client_bind_address:
               {get_param: [ServiceNetMap, MysqlNetwork]}
+            tripleo::profile::base::database::mysql::generate_dropin_file_limit:
+              {get_param: MysqlIncreaseFileLimit}
       step_config: |
         include ::tripleo::profile::base::database::mysql
       metadata_settings:
diff --git a/puppet/services/etcd.yaml b/puppet/services/etcd.yaml
index ec87a75a..d2a0e302 100644
--- a/puppet/services/etcd.yaml
+++ b/puppet/services/etcd.yaml
@@ -19,9 +19,9 @@ parameters:
                  via parameter_defaults in the resource registry.
     type: json
   EtcdInitialClusterToken:
-    default: 'etcd-tripleo'
     description: Initial cluster token for the etcd cluster during bootstrap.
     type: string
+    hidden: true
   MonitoringSubscriptionEtcd:
     default: 'overcloud-etcd'
     type: string
diff --git a/puppet/services/ironic-conductor.yaml b/puppet/services/ironic-conductor.yaml
index f9547bef..56e1a90b 100644
--- a/puppet/services/ironic-conductor.yaml
+++ b/puppet/services/ironic-conductor.yaml
@@ -44,6 +44,10 @@ parameters:
     default: 8088
     description: Port to use for serving images when iPXE is used.
     type: string
+  IronicPassword:
+    description: The password for the Ironic service and db account, used by the Ironic services
+    type: string
+    hidden: true
   MonitoringSubscriptionIronicConductor:
     default: 'overcloud-ironic-conductor'
     type: string
@@ -65,9 +69,7 @@ outputs:
       config_settings:
         map_merge:
           - get_attr: [IronicBase, role_data, config_settings]
-          # FIXME: I have no idea why neutron_url is in "api" manifest
-          - ironic::api::neutron_url: {get_param: [EndpointMap, NeutronInternal, uri]}
-            ironic::conductor::api_url: {get_param: [EndpointMap, IronicInternal, uri_no_suffix]}
+          - ironic::conductor::api_url: {get_param: [EndpointMap, IronicInternal, uri_no_suffix]}
             ironic::conductor::cleaning_disk_erase: {get_param: IronicCleaningDiskErase}
             ironic::conductor::cleaning_network: {get_param: IronicCleaningNetwork}
             ironic::conductor::enabled_drivers: {get_param: IronicEnabledDrivers}
@@ -104,7 +106,40 @@ outputs:
             # the VIP, but rather a real IP of the host.
             ironic::my_ip: {get_param: [ServiceNetMap, IronicNetwork]}
             ironic::pxe::common::http_port: {get_param: IronicIPXEPort}
-
+            # Credentials to access other services
+            ironic::glance::auth_url: {get_param: [EndpointMap, KeystoneInternal, uri_no_suffix]}
+            ironic::glance::username: 'ironic'
+            ironic::glance::password: {get_param: IronicPassword}
+            ironic::glance::project_name: 'service'
+            ironic::glance::user_domain_name: 'Default'
+            ironic::glance::project_domain_name: 'Default'
+            ironic::neutron::auth_url: {get_param: [EndpointMap, KeystoneInternal, uri_no_suffix]}
+            ironic::neutron::username: 'ironic'
+            ironic::neutron::password: {get_param: IronicPassword}
+            ironic::neutron::project_name: 'service'
+            ironic::neutron::user_domain_name: 'Default'
+            ironic::neutron::project_domain_name: 'Default'
+            ironic::service_catalog::auth_url: {get_param: [EndpointMap, KeystoneInternal, uri_no_suffix]}
+            ironic::service_catalog::username: 'ironic'
+            ironic::service_catalog::password: {get_param: IronicPassword}
+            ironic::service_catalog::project_name: 'service'
+            ironic::service_catalog::user_domain_name: 'Default'
+            ironic::service_catalog::project_domain_name: 'Default'
+            ironic::swift::auth_url: {get_param: [EndpointMap, KeystoneInternal, uri_no_suffix]}
+            ironic::swift::username: 'ironic'
+            ironic::swift::password: {get_param: IronicPassword}
+            ironic::swift::project_name: 'service'
+            ironic::swift::user_domain_name: 'Default'
+            ironic::swift::project_domain_name: 'Default'
+            # ironic-inspector support is not implemented, but let's configure
+            # the credentials for consistency.
+            ironic::drivers::inspector::enabled: false
+            ironic::drivers::inspector::auth_url: {get_param: [EndpointMap, KeystoneInternal, uri_no_suffix]}
+            ironic::drivers::inspector::username: 'ironic'
+            ironic::drivers::inspector::password: {get_param: IronicPassword}
+            ironic::drivers::inspector::project_name: 'service'
+            ironic::drivers::inspector::user_domain_name: 'Default'
+            ironic::drivers::inspector::project_domain_name: 'Default'
       step_config: |
         include ::tripleo::profile::base::ironic::conductor
       upgrade_tasks:
diff --git a/puppet/services/keystone.yaml b/puppet/services/keystone.yaml
index a85a9ed0..f40c8d99 100644
--- a/puppet/services/keystone.yaml
+++ b/puppet/services/keystone.yaml
@@ -226,6 +226,7 @@ outputs:
             keystone::endpoint::internal_url: {get_param: [EndpointMap, KeystoneInternal, uri_no_suffix]}
             keystone::endpoint::admin_url: {get_param: [EndpointMap, KeystoneAdmin, uri_no_suffix]}
             keystone::endpoint::region: {get_param: KeystoneRegion}
+            keystone::endpoint::version: ''
             keystone_enable_db_purge: {get_param: KeystoneEnableDBPurge}
             keystone::rabbit_heartbeat_timeout_threshold: 60
             keystone::cron::token_flush::maxdelay: 3600
diff --git a/puppet/services/neutron-base.yaml b/puppet/services/neutron-base.yaml
index 43657bd9..d0176781 100644
--- a/puppet/services/neutron-base.yaml
+++ b/puppet/services/neutron-base.yaml
@@ -44,10 +44,10 @@ parameters:
     description: Set to True to enable debugging on all services.
   EnableConfigPurge:
     type: boolean
-    default: true
+    default: false
     description: >
-        Remove configuration that is not generated by TripleO. Setting
-        to false may result in configuration remnants after updates/upgrades.
+        Remove configuration that is not generated by TripleO. Used to avoid
+        configuration remnants after upgrades.
   NeutronGlobalPhysnetMtu:
     type: number
     default: 1500
diff --git a/puppet/services/neutron-ovs-dpdk-agent.yaml b/puppet/services/neutron-ovs-dpdk-agent.yaml
index e25bc495..2c7ab57c 100644
--- a/puppet/services/neutron-ovs-dpdk-agent.yaml
+++ b/puppet/services/neutron-ovs-dpdk-agent.yaml
@@ -69,7 +69,10 @@ outputs:
       service_name: neutron_ovs_dpdk_agent
       config_settings:
         map_merge:
-          - get_attr: [NeutronOvsAgent, role_data, config_settings]
+          - map_replace:
+            - get_attr: [NeutronOvsAgent, role_data, config_settings]
+            - keys:
+                tripleo.neutron_ovs_agent.firewall_rules: tripleo.neutron_ovs_dpdk_agent.firewall_rules
           - neutron::agents::ml2::ovs::enable_dpdk: true
             neutron::agents::ml2::ovs::datapath_type: {get_param: NeutronDatapathType}
             neutron::agents::ml2::ovs::vhostuser_socket_dir: {get_param: NeutronVhostuserSocketDir}
diff --git a/puppet/services/nova-api.yaml b/puppet/services/nova-api.yaml
index f27b53f2..678e09b6 100644
--- a/puppet/services/nova-api.yaml
+++ b/puppet/services/nova-api.yaml
@@ -225,7 +225,7 @@ outputs:
         - name: Setup cell_v2 (map cell0)
           tags: step5
           when: is_bootstrap_node
-          command: nova-manage cell_v2 map_cell0
+          shell: nova-manage cell_v2 map_cell0 --database_connection=$(hiera nova::cell0_database_connection)
         - name: Setup cell_v2 (create default cell)
           tags: step5
           when: is_bootstrap_node
@@ -241,15 +241,15 @@ outputs:
           command: nova-manage db sync
           async: {get_param: NovaDbSyncTimeout}
           poll: 10
-        - name: Setup cell_v2 (migrate hosts)
-          tags: step5
-          when: is_bootstrap_node
-          command: nova-manage cell_v2 map_cell_and_hosts
         - name: Setup cell_v2 (get cell uuid)
           tags: step5
           when: is_bootstrap_node
           shell: nova-manage cell_v2 list_cells | sed -e '1,3d' -e '$d' | awk -F ' *| *' '$2 == "default" {print $4}'
           register: nova_api_cell_uuid
+        - name: Setup cell_v2 (migrate hosts)
+          tags: step5
+          when: is_bootstrap_node
+          command: nova-manage cell_v2 discover_hosts --cell_uuid {{nova_api_cell_uuid.stdout}} --verbose
         - name: Setup cell_v2 (migrate instances)
           tags: step5
           when: is_bootstrap_node
diff --git a/puppet/services/nova-base.yaml b/puppet/services/nova-base.yaml
index ceacb0b2..7b568e9e 100644
--- a/puppet/services/nova-base.yaml
+++ b/puppet/services/nova-base.yaml
@@ -58,10 +58,10 @@ parameters:
     description: Set to True to enable debugging on all services.
   EnableConfigPurge:
     type: boolean
-    default: true
+    default: false
     description: >
-        Remove configuration that is not generated by TripleO. Setting
-        to false may result in configuration remnants after updates/upgrades.
+        Remove configuration that is not generated by TripleO. Used to avoid
+        configuration remnants after upgrades.
   NovaIPv6:
     default: false
     description: Enable IPv6 features in Nova
@@ -151,6 +151,16 @@ outputs:
                 - {get_param: [EndpointMap, MysqlInternal, host]}
                 - '/nova'
                 - '?read_default_file=/etc/my.cnf.d/tripleo.cnf&read_default_group=tripleo'
+          nova::cell0_database_connection:
+            list_join:
+              - ''
+              - - {get_param: [EndpointMap, MysqlInternal, protocol]}
+                - '://nova:'
+                - {get_param: NovaPassword}
+                - '@'
+                - {get_param: [EndpointMap, MysqlInternal, host]}
+                - '/nova_cell0'
+                - '?read_default_file=/etc/my.cnf.d/tripleo.cnf&read_default_group=tripleo'
           nova::api_database_connection:
             list_join:
               - ''
diff --git a/puppet/services/nova-ironic.yaml b/puppet/services/nova-ironic.yaml
index 5eb2170a..5fc77f07 100644
--- a/puppet/services/nova-ironic.yaml
+++ b/puppet/services/nova-ironic.yaml
@@ -51,3 +51,7 @@ outputs:
             nova::scheduler::filter::scheduler_host_manager: 'ironic_host_manager'
       step_config: |
         include tripleo::profile::base::nova::compute::ironic
+      upgrade_tasks:
+        - name: Stop openstack-nova-compute service
+          tags: step1
+          service: name=openstack-nova-compute state=stopped enabled=no
diff --git a/puppet/services/octavia-base.yaml b/puppet/services/octavia-base.yaml
index b537a2bc..f3aa1d64 100644
--- a/puppet/services/octavia-base.yaml
+++ b/puppet/services/octavia-base.yaml
@@ -24,10 +24,10 @@ parameters:
     description: Set to True to enable debugging on all services.
   EnableConfigPurge:
     type: boolean
-    default: true
+    default: false
     description: >
-        Remove configuration that is not generated by TripleO. Setting
-        to false may result in configuration remnants after updates/upgrades.
+        Remove configuration that is not generated by TripleO. Used to avoid
+        configuration remnants after upgrades.
   RabbitPassword:
     description: The password for RabbitMQ
     type: string
diff --git a/puppet/services/opendaylight-ovs.yaml b/puppet/services/opendaylight-ovs.yaml
index 3db0848e..5cf416f3 100644
--- a/puppet/services/opendaylight-ovs.yaml
+++ b/puppet/services/opendaylight-ovs.yaml
@@ -60,11 +60,7 @@ outputs:
         opendaylight_check_url: {get_param: OpenDaylightCheckURL}
         opendaylight::nb_connection_protocol: {get_param: OpenDaylightConnectionProtocol}
         neutron::agents::ml2::ovs::local_ip: {get_param: [ServiceNetMap, NeutronTenantNetwork]}
-        neutron::plugins::ovs::opendaylight::provider_mappings:
-          str_replace:
-            template: MAPPINGS
-            params:
-              MAPPINGS: {get_param: OpenDaylightProviderMappings}
+        neutron::plugins::ovs::opendaylight::provider_mappings: {get_param: OpenDaylightProviderMappings}
         tripleo.opendaylight_ovs.firewall_rules:
           '118 neutron vxlan networks':
              proto: 'udp'
diff --git a/puppet/services/tripleo-firewall.yaml b/puppet/services/tripleo-firewall.yaml
index 67e14d9c..ff2b067f 100644
--- a/puppet/services/tripleo-firewall.yaml
+++ b/puppet/services/tripleo-firewall.yaml
@@ -37,3 +37,9 @@ outputs:
         tripleo::firewall::purge_firewall_rules: {get_param: PurgeFirewallRules}
       step_config: |
         include ::tripleo::firewall
+      upgrade_tasks:
+        - name: blank ipv6 rule before activating ipv6 firewall.
+          tags: step3
+          shell: cat /etc/sysconfig/ip6tables > /etc/sysconfig/ip6tables.n-o-upgrade; cat</dev/null>/etc/sysconfig/ip6tables
+          args:
+            creates: /etc/sysconfig/ip6tables.n-o-upgrade