21 files changed, 296 insertions, 50 deletions
diff --git a/puppet/services/ceilometer-base.yaml b/puppet/services/ceilometer-base.yaml
index 874c6893..3eb1d815 100644
--- a/puppet/services/ceilometer-base.yaml
+++ b/puppet/services/ceilometer-base.yaml
@@ -37,7 +37,7 @@ parameters:
     constraints:
     - allowed_values: ['gnocchi', 'database']
   CeilometerEventDispatcher:
-    default: ['gnocchi']
+    default: ['panko', 'gnocchi']
     description: Comma-separated list of Dispatchers to process events data
     type: comma_delimited_list
     constraints:
@@ -76,6 +76,11 @@ parameters:
     default: 5672
     description: Set rabbit subscriber port, change this if using SSL
     type: number
+  CeilometerApiEndpoint:
+    default: true
+    description: Whether to create or skip API endpoint. Set this to
+        false, if you choose to disable Ceilometer API service.
+    type: boolean
 
 outputs:
   role_data:
@@ -83,6 +88,7 @@ outputs:
     value:
       service_name: ceilometer_base
       config_settings:
+        ceilometer_auth_enabled: true
         ceilometer::debug: {get_param: Debug}
         ceilometer::db::database_connection:
           list_join:
@@ -129,6 +135,7 @@ outputs:
           ceilometer::keystone::auth::password: {get_param: CeilometerPassword}
           ceilometer::keystone::auth::region: {get_param: KeystoneRegion}
           ceilometer::keystone::auth::tenant: 'service'
+          ceilometer::keystone::auth::configure_endpoint: {get_param: CeilometerApiEndpoint}
         mysql:
           ceilometer::db::mysql::password: {get_param: CeilometerPassword}
           ceilometer::db::mysql::user: ceilometer
diff --git a/puppet/services/ceph-rgw.yaml b/puppet/services/ceph-rgw.yaml
index 01531971..49856115 100644
--- a/puppet/services/ceph-rgw.yaml
+++ b/puppet/services/ceph-rgw.yaml
@@ -73,7 +73,7 @@ outputs:
           ceph::rgw::keystone::auth::internal_url: {get_param: [EndpointMap, CephRgwInternal, uri]}
           ceph::rgw::keystone::auth::admin_url: {get_param: [EndpointMap, CephRgwAdmin, uri]}
           ceph::rgw::keystone::auth::region: {get_param: KeystoneRegion}
-          ceph::rgw::keystone::auth::roles: [ 'admin', 'member', '_member_' ]
+          ceph::rgw::keystone::auth::roles: [ 'admin', 'Member', '_member_' ]
           ceph::rgw::keystone::auth::tenant: service
           ceph::rgw::keystone::auth::user: swift
           ceph::rgw::keystone::auth::password: {get_param: SwiftPassword}
diff --git a/puppet/services/congress.yaml b/puppet/services/congress.yaml
index 8bc9f2e3..1b7d698d 100644
--- a/puppet/services/congress.yaml
+++ b/puppet/services/congress.yaml
@@ -88,6 +88,7 @@ outputs:
       service_config_settings:
         keystone:
           congress::keystone::auth::tenant: 'service'
+          congress::keystone::auth::region: {get_param: KeystoneRegion}
           congress::keystone::auth::password: {get_param: CongressPassword}
           congress::keystone::auth::public_url: {get_param: [EndpointMap, CongressPublic, uri]}
           congress::keystone::auth::internal_url: {get_param: [EndpointMap, CongressInternal, uri]}
diff --git a/puppet/services/database/mongodb.yaml b/puppet/services/database/mongodb.yaml
index 63ec4446..50597216 100644
--- a/puppet/services/database/mongodb.yaml
+++ b/puppet/services/database/mongodb.yaml
@@ -19,6 +19,10 @@ parameters:
     description: Mapping of service endpoint -> protocol. Typically set
                  via parameter_defaults in the resource registry.
     type: json
+  MongodbMemoryLimit:
+    default: '20G'
+    description: Limit the amount of memory mongodb uses with systemd.
+    type: string
   MongoDbLoggingSource:
     type: json
     description: Fluentd logging configuration for mongodb.
@@ -49,6 +53,7 @@ outputs:
         map_merge:
           - get_attr: [MongoDbBase, role_data, config_settings]
           - tripleo::profile::base::database::mongodb::mongodb_replset: {get_attr: [MongoDbBase, aux_parameters, rplset_name]}
+            tripleo::profile::base::database::mongodb::memory_limit: {get_param: MongodbMemoryLimit}
             mongodb::server::service_manage: True
             tripleo.mongodb.firewall_rules:
               '101 mongodb_config':
diff --git a/puppet/services/database/mysql.yaml b/puppet/services/database/mysql.yaml
index 808f1353..7078b60f 100644
--- a/puppet/services/database/mysql.yaml
+++ b/puppet/services/database/mysql.yaml
@@ -23,6 +23,10 @@ parameters:
     description: Configures MySQL max_connections config setting
     type: number
     default: 4096
+  MysqlIncreaseFileLimit:
+    description: Flag to increase MySQL open-files-limit to 16384
+    type: boolean
+    default: true
   MysqlRootPassword:
     type: string
     hidden: true
@@ -96,6 +100,8 @@ outputs:
                   $NETWORK: {get_param: [ServiceNetMap, MysqlNetwork]}
             tripleo::profile::base::database::mysql::client_bind_address:
               {get_param: [ServiceNetMap, MysqlNetwork]}
+            tripleo::profile::base::database::mysql::generate_dropin_file_limit:
+              {get_param: MysqlIncreaseFileLimit}
       step_config: |
         include ::tripleo::profile::base::database::mysql
       metadata_settings:
diff --git a/puppet/services/ec2-api.yaml b/puppet/services/ec2-api.yaml
index 70821396..f6cf13ff 100644
--- a/puppet/services/ec2-api.yaml
+++ b/puppet/services/ec2-api.yaml
@@ -91,6 +91,11 @@ outputs:
                 - {get_param: [EndpointMap, MysqlInternal, host]}
                 - '/ec2_api'
                 - '?read_default_file=/etc/my.cnf.d/tripleo.cnf&read_default_group=tripleo'
+          ec2api::api::keystone_ec2_tokens_url:
+            list_join:
+              - ''
+              - - {get_param: [EndpointMap, KeystoneV3Internal, uri]}
+                - '/ec2tokens'
         -
           if:
           - nova_workers_zero
diff --git a/puppet/services/keystone.yaml b/puppet/services/keystone.yaml
index f40c8d99..f69c087b 100644
--- a/puppet/services/keystone.yaml
+++ b/puppet/services/keystone.yaml
@@ -158,6 +158,16 @@ parameters:
     description: >
         Cron to purge expired tokens - User
     default: 'keystone'
+  KeystoneLDAPDomainEnable:
+    description: Trigger to call ldap_backend puppet keystone define.
+    type: boolean
+    default: False
+  KeystoneLDAPBackendConfigs:
+    description: Hash containing the configurations for the LDAP backends
+                 configured in keystone.
+    type: json
+    default: {}
+    hidden: true
 
 resources:
 
@@ -171,6 +181,7 @@ resources:
 
 conditions:
   keystone_fernet_tokens: {equals: [{get_param: KeystoneTokenProvider}, "fernet"]}
+  keystone_ldap_domain_enabled: {equals: [{get_param: KeystoneLDAPDomainEnable}, True]}
 
 outputs:
   role_data:
@@ -293,6 +304,15 @@ outputs:
             keystone::cron::token_flush::maxdelay: {get_param: KeystoneCronTokenFlushMaxDelay}
             keystone::cron::token_flush::destination: {get_param: KeystoneCronTokenFlushDestination}
             keystone::cron::token_flush::user: {get_param: KeystoneCronTokenFlushUser}
+          -
+            if:
+            - keystone_ldap_domain_enabled
+            -
+              tripleo::profile::base::keystone::ldap_backend_enable: True
+              keystone::using_domain_config: True
+              tripleo::profile::base::keystone::ldap_backends_config:
+                get_param: KeystoneLDAPBackendConfigs
+            - {}
 
       step_config: |
         include ::tripleo::profile::base::keystone
@@ -305,6 +325,13 @@ outputs:
           keystone::db::mysql::allowed_hosts:
             - '%'
             - "%{hiera('mysql_bind_host')}"
+        horizon:
+          if:
+          - keystone_ldap_domain_enabled
+          -
+            horizon::keystone_multidomain_support: true
+            horizon::keystone_default_domain: 'Default'
+          - {}
       # Ansible tasks to handle upgrade
       upgrade_tasks:
         - name: Stop keystone service (running under httpd)
diff --git a/puppet/services/neutron-base.yaml b/puppet/services/neutron-base.yaml
index d0176781..5ed54f31 100644
--- a/puppet/services/neutron-base.yaml
+++ b/puppet/services/neutron-base.yaml
@@ -24,7 +24,7 @@ parameters:
     type: number
   NeutronDhcpAgentsPerNetwork:
     type: number
-    default: 3
+    default: 0
     description: The number of neutron dhcp agents to schedule per network
   NeutronCorePlugin:
     default: 'ml2'
@@ -72,24 +72,31 @@ parameters:
                  via parameter_defaults in the resource registry.
     type: json
 
+conditions:
+  dhcp_agents_zero: {equals : [{get_param: NeutronDhcpAgentsPerNetwork}, 0]}
+
 outputs:
   role_data:
     description: Role data for the Neutron base service.
     value:
       service_name: neutron_base
       config_settings:
-        neutron::rabbit_password: {get_param: RabbitPassword}
-        neutron::rabbit_user: {get_param: RabbitUserName}
-        neutron::rabbit_use_ssl: {get_param: RabbitClientUseSSL}
-        neutron::rabbit_port: {get_param: RabbitClientPort}
-        neutron::dhcp_agents_per_network: {get_param: NeutronDhcpAgentsPerNetwork}
-        neutron::core_plugin: {get_param: NeutronCorePlugin}
-        neutron::service_plugins: {get_param: NeutronServicePlugins}
-        neutron::debug: {get_param: Debug}
-        neutron::purge_config: {get_param: EnableConfigPurge}
-        neutron::allow_overlapping_ips: true
-        neutron::rabbit_heartbeat_timeout_threshold: 60
-        neutron::host: '%{::fqdn}'
-        neutron::db::database_db_max_retries: -1
-        neutron::db::database_max_retries: -1
-        neutron::global_physnet_mtu: {get_param: NeutronGlobalPhysnetMtu}
+        map_merge:
+          - neutron::rabbit_password: {get_param: RabbitPassword}
+            neutron::rabbit_user: {get_param: RabbitUserName}
+            neutron::rabbit_use_ssl: {get_param: RabbitClientUseSSL}
+            neutron::rabbit_port: {get_param: RabbitClientPort}
+            neutron::core_plugin: {get_param: NeutronCorePlugin}
+            neutron::service_plugins: {get_param: NeutronServicePlugins}
+            neutron::debug: {get_param: Debug}
+            neutron::purge_config: {get_param: EnableConfigPurge}
+            neutron::allow_overlapping_ips: true
+            neutron::rabbit_heartbeat_timeout_threshold: 60
+            neutron::host: '%{::fqdn}'
+            neutron::db::database_db_max_retries: -1
+            neutron::db::database_max_retries: -1
+            neutron::global_physnet_mtu: {get_param: NeutronGlobalPhysnetMtu}
+          - if:
+            - dhcp_agents_zero
+            - {}
+            - tripleo::profile::base::neutron::dhcp_agents_per_network: {get_param: NeutronDhcpAgentsPerNetwork}
diff --git a/puppet/services/neutron-bigswitch-agent.yaml b/puppet/services/neutron-bigswitch-agent.yaml
new file mode 100644
index 00000000..845f0da0
--- /dev/null
+++ b/puppet/services/neutron-bigswitch-agent.yaml
@@ -0,0 +1,31 @@
+heat_template_version: ocata
+
+description: >
+  Installs bigswitch agent and enables the services
+
+parameters:
+  ServiceNetMap:
+    default: {}
+    description: Mapping of service_name -> network name. Typically set
+                 via parameter_defaults in the resource registry.  This
+                 mapping overrides those in ServiceNetMapDefaults.
+    type: json
+  DefaultPasswords:
+    default: {}
+    type: json
+  EndpointMap:
+    default: {}
+    description: Mapping of service endpoint -> protocol. Typically set
+                 via parameter_defaults in the resource registry.
+    type: json
+
+
+outputs:
+  role_data:
+    description: Configure the bigswitch agent services
+    value:
+      service_name: neutron_bigswitch_agent
+      step_config: |
+        if hiera('step') >= 4 {
+          include ::neutron::agents::bigswitch
+        }
diff --git a/puppet/services/neutron-ovs-agent.yaml b/puppet/services/neutron-ovs-agent.yaml
index 01471ba2..ef2485d4 100644
--- a/puppet/services/neutron-ovs-agent.yaml
+++ b/puppet/services/neutron-ovs-agent.yaml
@@ -82,6 +82,9 @@ resources:
       DefaultPasswords: {get_param: DefaultPasswords}
       EndpointMap: {get_param: EndpointMap}
 
+  OpenVswitchUpgrade:
+    type: ./openvswitch-upgrade.yaml
+
 outputs:
   role_data:
     description: Role data for the Neutron OVS agent service.
@@ -121,16 +124,22 @@ outputs:
       step_config: |
         include ::tripleo::profile::base::neutron::ovs
       upgrade_tasks:
-        - name: Check if neutron_ovs_agent is deployed
-          command: systemctl is-enabled neutron-openvswitch-agent
-          tags: common
-          ignore_errors: True
-          register: neutron_ovs_agent_enabled
-        - name: "PreUpgrade step0,validation: Check service neutron-openvswitch-agent is running"
-          shell: /usr/bin/systemctl show 'neutron-openvswitch-agent' --property ActiveState | grep '\bactive\b'
-          when: neutron_ovs_agent_enabled.rc == 0
-          tags: step0,validation
-        - name: Stop neutron_ovs_agent service
-          tags: step1
-          when: neutron_ovs_agent_enabled.rc == 0
-          service: name=neutron-openvswitch-agent state=stopped
+        yaql:
+          expression: $.data.ovs_upgrade + $.data.neutron_ovs_upgrade
+          data:
+            ovs_upgrade:
+              get_attr: [OpenVswitchUpgrade, role_data, upgrade_tasks]
+            neutron_ovs_upgrade:
+              - name: Check if neutron_ovs_agent is deployed
+                command: systemctl is-enabled neutron-openvswitch-agent
+                tags: common
+                ignore_errors: True
+                register: neutron_ovs_agent_enabled
+              - name: "PreUpgrade step0,validation: Check service neutron-openvswitch-agent is running"
+                shell: /usr/bin/systemctl show 'neutron-openvswitch-agent' --property ActiveState | grep '\bactive\b'
+                when: neutron_ovs_agent_enabled.rc == 0
+                tags: step0,validation
+              - name: Stop neutron_ovs_agent service
+                tags: step1
+                when: neutron_ovs_agent_enabled.rc == 0
+                service: name=neutron-openvswitch-agent state=stopped
diff --git a/puppet/services/neutron-ovs-dpdk-agent.yaml b/puppet/services/neutron-ovs-dpdk-agent.yaml
index 2c7ab57c..80516fe6 100644
--- a/puppet/services/neutron-ovs-dpdk-agent.yaml
+++ b/puppet/services/neutron-ovs-dpdk-agent.yaml
@@ -62,6 +62,9 @@ resources:
       DefaultPasswords: {get_param: DefaultPasswords}
       EndpointMap: {get_param: EndpointMap}
 
+  OpenVswitchUpgrade:
+    type: ./openvswitch-upgrade.yaml
+
 outputs:
   role_data:
     description: Role data for the Neutron OVS DPDK Agent service.
@@ -82,3 +85,5 @@ outputs:
             vswitch::dpdk::socket_mem: {get_param: NeutronDpdkSocketMemory}
             vswitch::dpdk::driver_type: {get_param: NeutronDpdkDriverType}
       step_config: {get_attr: [NeutronOvsAgent, role_data, step_config]}
+      upgrade_tasks:
+        get_attr: [OpenVswitchUpgrade, role_data, upgrade_tasks]
diff --git a/puppet/services/neutron-plugin-ml2-odl.yaml b/puppet/services/neutron-plugin-ml2-odl.yaml
new file mode 100644
index 00000000..acacadfa
--- /dev/null
+++ b/puppet/services/neutron-plugin-ml2-odl.yaml
@@ -0,0 +1,45 @@
+heat_template_version: ocata
+
+description: >
+  OpenStack Neutron ML2/OpenDaylight plugin configured with Puppet
+
+parameters:
+  ServiceNetMap:
+    default: {}
+    description: Mapping of service_name -> network name. Typically set
+                 via parameter_defaults in the resource registry.  This
+                 mapping overrides those in ServiceNetMapDefaults.
+    type: json
+  DefaultPasswords:
+    default: {}
+    type: json
+  EndpointMap:
+    default: {}
+    description: Mapping of service endpoint -> protocol. Typically set
+                 via parameter_defaults in the resource registry.
+    type: json
+  OpenDaylightPortBindingController:
+    description: OpenDaylight port binding controller
+    type: string
+    default: 'network-topology'
+
+resources:
+
+  NeutronMl2Base:
+    type: ./neutron-plugin-ml2.yaml
+    properties:
+      ServiceNetMap: {get_param: ServiceNetMap}
+      DefaultPasswords: {get_param: DefaultPasswords}
+      EndpointMap: {get_param: EndpointMap}
+
+outputs:
+  role_data:
+    description: Role data for the Neutron ML2/ODL plugin.
+    value:
+      service_name: neutron_plugin_ml2_odl
+      config_settings:
+        map_merge:
+          - get_attr: [NeutronMl2Base, role_data, config_settings]
+          - neutron::plugins::ml2::opendaylight::port_binding_controller: {get_param: OpenDaylightPortBindingController}
+      step_config: |
+        include ::tripleo::profile::base::neutron::plugins::ml2
diff --git a/puppet/services/nova-api.yaml b/puppet/services/nova-api.yaml
index f27b53f2..678e09b6 100644
--- a/puppet/services/nova-api.yaml
+++ b/puppet/services/nova-api.yaml
@@ -225,7 +225,7 @@ outputs:
         - name: Setup cell_v2 (map cell0)
           tags: step5
           when: is_bootstrap_node
-          command: nova-manage cell_v2 map_cell0
+          shell: nova-manage cell_v2 map_cell0 --database_connection=$(hiera nova::cell0_database_connection)
         - name: Setup cell_v2 (create default cell)
           tags: step5
           when: is_bootstrap_node
@@ -241,15 +241,15 @@ outputs:
           command: nova-manage db sync
           async: {get_param: NovaDbSyncTimeout}
           poll: 10
-        - name: Setup cell_v2 (migrate hosts)
-          tags: step5
-          when: is_bootstrap_node
-          command: nova-manage cell_v2 map_cell_and_hosts
         - name: Setup cell_v2 (get cell uuid)
           tags: step5
           when: is_bootstrap_node
           shell: nova-manage cell_v2 list_cells | sed -e '1,3d' -e '$d' | awk -F ' *| *' '$2 == "default" {print $4}'
           register: nova_api_cell_uuid
+        - name: Setup cell_v2 (migrate hosts)
+          tags: step5
+          when: is_bootstrap_node
+          command: nova-manage cell_v2 discover_hosts --cell_uuid {{nova_api_cell_uuid.stdout}} --verbose
         - name: Setup cell_v2 (migrate instances)
           tags: step5
           when: is_bootstrap_node
diff --git a/puppet/services/nova-base.yaml b/puppet/services/nova-base.yaml
index 8100c9b1..7b568e9e 100644
--- a/puppet/services/nova-base.yaml
+++ b/puppet/services/nova-base.yaml
@@ -151,6 +151,16 @@ outputs:
                 - {get_param: [EndpointMap, MysqlInternal, host]}
                 - '/nova'
                 - '?read_default_file=/etc/my.cnf.d/tripleo.cnf&read_default_group=tripleo'
+          nova::cell0_database_connection:
+            list_join:
+              - ''
+              - - {get_param: [EndpointMap, MysqlInternal, protocol]}
+                - '://nova:'
+                - {get_param: NovaPassword}
+                - '@'
+                - {get_param: [EndpointMap, MysqlInternal, host]}
+                - '/nova_cell0'
+                - '?read_default_file=/etc/my.cnf.d/tripleo.cnf&read_default_group=tripleo'
           nova::api_database_connection:
             list_join:
               - ''
diff --git a/puppet/services/nova-ironic.yaml b/puppet/services/nova-ironic.yaml
index 5eb2170a..5fc77f07 100644
--- a/puppet/services/nova-ironic.yaml
+++ b/puppet/services/nova-ironic.yaml
@@ -51,3 +51,7 @@ outputs:
             nova::scheduler::filter::scheduler_host_manager: 'ironic_host_manager'
       step_config: |
         include tripleo::profile::base::nova::compute::ironic
+      upgrade_tasks:
+        - name: Stop openstack-nova-compute service
+          tags: step1
+          service: name=openstack-nova-compute state=stopped enabled=no
diff --git a/puppet/services/opendaylight-api.yaml b/puppet/services/opendaylight-api.yaml
index 51a520cc..ceb56a81 100644
--- a/puppet/services/opendaylight-api.yaml
+++ b/puppet/services/opendaylight-api.yaml
@@ -17,6 +17,10 @@ parameters:
     type: string
     description: The password for the opendaylight server.
     hidden: true
+  OpenDaylightConnectionProtocol:
+    description: L7 protocol used for REST access
+    type: string
+    default: 'http'
   OpenDaylightEnableDHCP:
     description: Knob to enable/disable ODL DHCP Server
     type: boolean
@@ -55,6 +59,7 @@ outputs:
         opendaylight::extra_features: {get_param: OpenDaylightFeatures}
         opendaylight::enable_dhcp: {get_param: OpenDaylightEnableDHCP}
         opendaylight::odl_bind_ip: {get_param: [ServiceNetMap, OpendaylightApiNetwork]}
+        opendaylight::nb_connection_protocol: {get_param: OpenDayLightConnectionProtocol}
         tripleo.opendaylight_api.firewall_rules:
               '137 opendaylight api':
                 dport:
diff --git a/puppet/services/opendaylight-ovs.yaml b/puppet/services/opendaylight-ovs.yaml
index 5cf416f3..ed572b4d 100644
--- a/puppet/services/opendaylight-ovs.yaml
+++ b/puppet/services/opendaylight-ovs.yaml
@@ -48,6 +48,10 @@ parameters:
     default: {}
     type: json
 
+resources:
+  OpenVswitchUpgrade:
+    type: ./openvswitch-upgrade.yaml
+
 outputs:
   role_data:
     description: Role data for the OpenDaylight service.
@@ -70,16 +74,22 @@ outputs:
       step_config: |
         include tripleo::profile::base::neutron::plugins::ovs::opendaylight
       upgrade_tasks:
-        - name: Check if openvswitch is deployed
-          command: systemctl is-enabled openvswitch
-          tags: common
-          ignore_errors: True
-          register: openvswitch_enabled
-        - name: "PreUpgrade step0,validation: Check service openvswitch is running"
-          shell: /usr/bin/systemctl show 'openvswitch' --property ActiveState | grep '\bactive\b'
-          when: openvswitch_enabled.rc == 0
-          tags: step0,validation
-        - name: Stop openvswitch service
-          tags: step1
-          when: openvswitch_enabled.rc == 0
-          service: name=openvswitch state=stopped
+        yaql:
+          expression: $.data.ovs_upgrade + $.data.opendaylight_upgrade
+          data:
+            ovs_upgrade:
+              get_attr: [OpenVswitchUpgrade, role_data, upgrade_tasks]
+            opendaylight_upgrade:
+              - name: Check if openvswitch is deployed
+                command: systemctl is-enabled openvswitch
+                tags: common
+                ignore_errors: True
+                register: openvswitch_enabled
+              - name: "PreUpgrade step0,validation: Check service openvswitch is running"
+                shell: /usr/bin/systemctl show 'openvswitch' --property ActiveState | grep '\bactive\b'
+                when: openvswitch_enabled.rc == 0
+                tags: step0,validation
+              - name: Stop openvswitch service
+                tags: step1
+                when: openvswitch_enabled.rc == 0
+                service: name=openvswitch state=stopped
diff --git a/puppet/services/openvswitch-upgrade.yaml b/puppet/services/openvswitch-upgrade.yaml
new file mode 100644
index 00000000..fea1ba96
--- /dev/null
+++ b/puppet/services/openvswitch-upgrade.yaml
@@ -0,0 +1,50 @@
+heat_template_version: ocata
+
+description: >
+  Openvswitch package special handling for upgrade.
+
+outputs:
+  role_data:
+    description: Upgrade task for special handling of Openvswitch (OVS) upgrade.
+    value:
+      service_name: openvswitch_upgrade
+      upgrade_tasks:
+        - name: Check openvswitch version.
+          tags: step2
+          register: ovs_version
+          ignore_errors: true
+          shell: rpm -qa | awk -F- '/^openvswitch-2/{print $2 "-" $3}'
+        - name: Check openvswitch packaging.
+          tags: step2
+          shell: rpm -q --scripts openvswitch | awk '/postuninstall/,/*/' | grep -q "systemctl.*try-restart"
+          register: ovs_packaging_issue
+          ignore_errors: true
+        - block:
+            - name: "Ensure empty directory: emptying."
+              file:
+                state: absent
+                path: /root/OVS_UPGRADE
+            - name: "Ensure empty directory: creating."
+              file:
+                state: directory
+                path: /root/OVS_UPGRADE
+                owner: root
+                group: root
+                mode: 0750
+            - name: Download OVS packages.
+              command: yumdownloader --destdir /root/OVS_UPGRADE --resolve openvswitch
+            - name: Get rpm list for manual upgrade of OVS.
+              shell: ls -1 /root/OVS_UPGRADE/*.rpm
+              register: ovs_list_of_rpms
+            - name: Manual upgrade of OVS
+              shell: |
+                rpm -U --test {{item}} 2>&1 | grep "already installed" || \
+                rpm -U --replacepkgs --notriggerun --nopostun {{item}};
+              args:
+                chdir: /root/OVS_UPGRADE
+              with_items:
+                - "{{ovs_list_of_rpms.stdout_lines}}"
+          tags: step2
+          when: "'2.5.0-14' in '{{ovs_version.stdout}}'
+                or
+                ovs_packaging_issue|succeeded"
diff --git a/puppet/services/pacemaker.yaml b/puppet/services/pacemaker.yaml
index 762d0092..28fcbd6f 100644
--- a/puppet/services/pacemaker.yaml
+++ b/puppet/services/pacemaker.yaml
@@ -87,10 +87,16 @@ parameters:
         \[(?<pid>[^ ]*)\]
         (?<host>[^ ]*)
         (?<message>.*)$/
+
+  EnableLoadBalancer:
+    default: true
+    description: Whether to deploy a LoadBalancer on the Controller
+    type: boolean
+
   PacemakerResources:
     type: comma_delimited_list
     description: List of resources managed by pacemaker
-    default: ['rabbitmq','haproxy','galera']
+    default: ['rabbitmq', 'galera']
 
 outputs:
   role_data:
@@ -147,3 +153,9 @@ outputs:
             resource: "{{ item }}"
             max_wait: 500
           with_items: {get_param: PacemakerResources}
+        - name: Check pacemaker haproxy resource
+          tags: step4
+          pacemaker_is_active:
+            resource: haproxy
+            max_wait: 500
+          when: {get_param: EnableLoadBalancer}
diff --git a/puppet/services/tacker.yaml b/puppet/services/tacker.yaml
index 6f92066e..2f803b0b 100644
--- a/puppet/services/tacker.yaml
+++ b/puppet/services/tacker.yaml
@@ -89,6 +89,7 @@ outputs:
       service_config_settings:
         keystone:
           tacker::keystone::auth::tenant: 'service'
+          tacker::keystone::auth::region: {get_param: KeystoneRegion}
           tacker::keystone::auth::password: {get_param: TackerPassword}
           tacker::keystone::auth::public_url: {get_param: [EndpointMap, TackerPublic, uri]}
           tacker::keystone::auth::internal_url: {get_param: [EndpointMap, TackerInternal, uri]}
diff --git a/puppet/services/tripleo-firewall.yaml b/puppet/services/tripleo-firewall.yaml
index 67e14d9c..ff2b067f 100644
--- a/puppet/services/tripleo-firewall.yaml
+++ b/puppet/services/tripleo-firewall.yaml
@@ -37,3 +37,9 @@ outputs:
         tripleo::firewall::purge_firewall_rules: {get_param: PurgeFirewallRules}
       step_config: |
         include ::tripleo::firewall
+      upgrade_tasks:
+        - name: blank ipv6 rule before activating ipv6 firewall.
+          tags: step3
+          shell: cat /etc/sysconfig/ip6tables > /etc/sysconfig/ip6tables.n-o-upgrade; cat</dev/null>/etc/sysconfig/ip6tables
+          args:
+            creates: /etc/sysconfig/ip6tables.n-o-upgrade