aboutsummaryrefslogtreecommitdiffstats
path: root/puppet/services
diff options
context:
space:
mode:
Diffstat (limited to 'puppet/services')
-rw-r--r--puppet/services/ceilometer-collector.yaml13
-rw-r--r--puppet/services/ec2-api.yaml15
-rw-r--r--puppet/services/gnocchi-base.yaml5
-rw-r--r--puppet/services/haproxy.yaml6
-rw-r--r--puppet/services/nova-libvirt.yaml25
-rw-r--r--puppet/services/snmp.yaml5
6 files changed, 63 insertions, 6 deletions
diff --git a/puppet/services/ceilometer-collector.yaml b/puppet/services/ceilometer-collector.yaml
index dfc844be..111b3e8b 100644
--- a/puppet/services/ceilometer-collector.yaml
+++ b/puppet/services/ceilometer-collector.yaml
@@ -51,7 +51,16 @@ parameters:
type: comma_delimited_list
constraints:
- allowed_values: ['panko', 'gnocchi', 'database']
-
+ CeilometerEventTTL:
+ default: '86400'
+ description: Number of seconds that events are kept in the database for
+ (<= 0 means forever)
+ type: string
+ CeilometerMeteringTTL:
+ default: '86400'
+ description: Number of seconds that samples are kept in the database for
+ (<= 0 means forever)
+ type: string
resources:
CeilometerServiceBase:
type: ./ceilometer-base.yaml
@@ -91,6 +100,8 @@ outputs:
- '/ceilometer'
- '?read_default_file=/etc/my.cnf.d/tripleo.cnf&read_default_group=tripleo'
ceilometer_backend: {get_param: CeilometerBackend}
+ ceilometer::event_time_to_live: {get_param: CeilometerEventTTL}
+ ceilometer::metering_time_to_live: {get_param: CeilometerMeteringTTL}
# we include db_sync class in puppet-tripleo
ceilometer::db::sync_db: false
ceilometer::db::database_db_max_retries: -1
diff --git a/puppet/services/ec2-api.yaml b/puppet/services/ec2-api.yaml
index d1adefe5..98d656a5 100644
--- a/puppet/services/ec2-api.yaml
+++ b/puppet/services/ec2-api.yaml
@@ -30,6 +30,15 @@ parameters:
type: string
default: 'regionOne'
description: Keystone region for endpoint
+ Ec2ApiExternalNetwork:
+ type: string
+ default: ''
+ description: Name of the external network, which is used to connect VPCs to
+ Internet and to allocate Elastic IPs
+ NovaDefaultFloatingPool:
+ default: 'public'
+ description: Default pool for floating IP addresses
+ type: string
MonitoringSubscriptionEc2Api:
default: 'overcloud-ec2-api'
type: string
@@ -52,6 +61,7 @@ parameters:
conditions:
nova_workers_zero: {equals : [{get_param: Ec2ApiWorkers}, 0]}
+ external_network_unset: {equals : [{get_param: Ec2ApiExternalNetwork}, '']}
outputs:
role_data:
@@ -109,6 +119,11 @@ outputs:
- {}
- ec2api::api::ec2api_workers: {get_param: Ec2ApiWorkers}
ec2api::metadata::metadata_workers: {get_param: Ec2ApiWorkers}
+ -
+ if:
+ - external_network_unset
+ - ec2api::api::external_network: {get_param: NovaDefaultFloatingPool}
+ - ec2api::api::external_network: {get_param: Ec2ApiExternalNetwork}
step_config: |
include tripleo::profile::base::nova::ec2api
service_config_settings:
diff --git a/puppet/services/gnocchi-base.yaml b/puppet/services/gnocchi-base.yaml
index dc6daece..24f4157b 100644
--- a/puppet/services/gnocchi-base.yaml
+++ b/puppet/services/gnocchi-base.yaml
@@ -22,6 +22,10 @@ parameters:
default: 'mysql'
description: The short name of the Gnocchi indexer backend to use.
type: string
+ MetricProcessingDelay:
+ default: 60
+ description: Delay between processing metrics.
+ type: number
GnocchiPassword:
description: The password for the gnocchi service and db account.
type: string
@@ -65,6 +69,7 @@ outputs:
- '/gnocchi'
- '?read_default_file=/etc/my.cnf.d/tripleo.cnf&read_default_group=tripleo'
gnocchi::db::sync::extra_opts: '--skip-storage'
+ gnocchi::storage::metric_processing_delay: {get_param: MetricProcessingDelay}
gnocchi::storage::swift::swift_user: 'service:gnocchi'
gnocchi::storage::swift::swift_auth_version: 3
gnocchi::storage::swift::swift_key: {get_param: GnocchiPassword}
diff --git a/puppet/services/haproxy.yaml b/puppet/services/haproxy.yaml
index c651bbe5..e32b44dd 100644
--- a/puppet/services/haproxy.yaml
+++ b/puppet/services/haproxy.yaml
@@ -37,6 +37,11 @@ parameters:
MonitoringSubscriptionHaproxy:
default: 'overcloud-haproxy'
type: string
+ InternalTLSCAFile:
+ default: '/etc/ipa/ca.crt'
+ type: string
+ description: Specifies the default CA cert to use if TLS is used for
+ services in the internal network.
resources:
@@ -71,6 +76,7 @@ outputs:
tripleo::haproxy::haproxy_stats_user: {get_param: HAProxyStatsUser}
tripleo::haproxy::haproxy_stats_password: {get_param: HAProxyStatsPassword}
tripleo::haproxy::redis_password: {get_param: RedisPassword}
+ tripleo::haproxy::ca_bundle: {get_param: InternalTLSCAFile}
tripleo::profile::base::haproxy::certificates_specs:
map_merge:
- get_attr: [HAProxyPublicTLS, role_data, certificates_specs]
diff --git a/puppet/services/nova-libvirt.yaml b/puppet/services/nova-libvirt.yaml
index 21a5e78a..c3e6f4e4 100644
--- a/puppet/services/nova-libvirt.yaml
+++ b/puppet/services/nova-libvirt.yaml
@@ -41,16 +41,23 @@ parameters:
description: If set to true and if EnableInternalTLS is enabled, it will
set the libvirt URI's transport to tls and configure the
relevant keys for libvirt.
+ InternalTLSCAFile:
+ default: '/etc/ipa/ca.crt'
+ type: string
+ description: Specifies the default CA cert to use if TLS is used for
+ services in the internal network.
LibvirtCACert:
type: string
- default: '/etc/ipa/ca.crt'
+ default: ''
description: This specifies the CA certificate to use for TLS in libvirt.
This file will be symlinked to the default CA path in libvirt,
which is /etc/pki/CA/cacert.pem. Note that due to limitations
GNU TLS, which is the TLS backend for libvirt, the file must
- be less than 65K (so we can't use the system's CA bundle). The
- current default reflects TripleO's default CA, which is
- FreeIPA. It will only be used if internal TLS is enabled.
+ be less than 65K (so we can't use the system's CA bundle).
+ This parameter should be used if the default (which comes from
+ the InternalTLSCAFile parameter) is not desired. The current
+ default reflects TripleO's default CA, which is FreeIPA.
+ It will only be used if internal TLS is enabled.
conditions:
@@ -63,6 +70,11 @@ conditions:
- {get_param: UseTLSTransportForLiveMigration}
- true
+ libvirt_specific_ca_unset:
+ equals:
+ - {get_param: LibvirtCACert}
+ - ''
+
resources:
NovaBase:
type: ./nova-base.yaml
@@ -113,7 +125,10 @@ outputs:
params:
$NETWORK: {get_param: [ServiceNetMap, NovaLibvirtNetwork]}
tripleo::certmonger::ca::libvirt::origin_ca_pem:
- get_param: LibvirtCACert
+ if:
+ - libvirt_specific_ca_unset
+ - get_param: InternalTLSCAFile
+ - get_param: LibvirtCACert
tripleo::certmonger::libvirt_dirs::certificate_dir: '/etc/pki/libvirt'
tripleo::certmonger::libvirt_dirs::key_dir: '/etc/pki/libvirt/private'
libvirt_certificates_specs:
diff --git a/puppet/services/snmp.yaml b/puppet/services/snmp.yaml
index 80c29f95..072ccc1a 100644
--- a/puppet/services/snmp.yaml
+++ b/puppet/services/snmp.yaml
@@ -28,6 +28,10 @@ parameters:
description: The user password for SNMPd with readonly rights running on all Overcloud nodes
type: string
hidden: true
+ SnmpdBindHost:
+ description: An array of bind host addresses on which SNMP daemon will listen.
+ type: comma_delimited_list
+ default: ['udp:161','udp6:[::1]:161']
outputs:
role_data:
@@ -37,6 +41,7 @@ outputs:
config_settings:
tripleo::profile::base::snmp::snmpd_user: {get_param: SnmpdReadonlyUserName}
tripleo::profile::base::snmp::snmpd_password: {get_param: SnmpdReadonlyUserPassword}
+ snmp::agentaddress: {get_param: SnmpdBindHost}
tripleo.snmp.firewall_rules:
'127 snmp':
dport: 161