20 files changed, 231 insertions, 33 deletions
diff --git a/puppet/services/ceilometer-base.yaml b/puppet/services/ceilometer-base.yaml
index 874c6893..3eb1d815 100644
--- a/puppet/services/ceilometer-base.yaml
+++ b/puppet/services/ceilometer-base.yaml
@@ -37,7 +37,7 @@ parameters:
     constraints:
     - allowed_values: ['gnocchi', 'database']
   CeilometerEventDispatcher:
-    default: ['gnocchi']
+    default: ['panko', 'gnocchi']
     description: Comma-separated list of Dispatchers to process events data
     type: comma_delimited_list
     constraints:
@@ -76,6 +76,11 @@ parameters:
     default: 5672
     description: Set rabbit subscriber port, change this if using SSL
     type: number
+  CeilometerApiEndpoint:
+    default: true
+    description: Whether to create or skip API endpoint. Set this to
+        false, if you choose to disable Ceilometer API service.
+    type: boolean
 
 outputs:
   role_data:
@@ -83,6 +88,7 @@ outputs:
     value:
       service_name: ceilometer_base
       config_settings:
+        ceilometer_auth_enabled: true
         ceilometer::debug: {get_param: Debug}
         ceilometer::db::database_connection:
           list_join:
@@ -129,6 +135,7 @@ outputs:
           ceilometer::keystone::auth::password: {get_param: CeilometerPassword}
           ceilometer::keystone::auth::region: {get_param: KeystoneRegion}
           ceilometer::keystone::auth::tenant: 'service'
+          ceilometer::keystone::auth::configure_endpoint: {get_param: CeilometerApiEndpoint}
         mysql:
           ceilometer::db::mysql::password: {get_param: CeilometerPassword}
           ceilometer::db::mysql::user: ceilometer
diff --git a/puppet/services/cinder-volume.yaml b/puppet/services/cinder-volume.yaml
index b52955ef..26f1a96f 100644
--- a/puppet/services/cinder-volume.yaml
+++ b/puppet/services/cinder-volume.yaml
@@ -94,11 +94,7 @@ outputs:
             tripleo::profile::base::cinder::volume::cinder_enable_nfs_backend: {get_param: CinderEnableNfsBackend}
             tripleo::profile::base::cinder::volume::cinder_enable_rbd_backend: {get_param: CinderEnableRbdBackend}
             tripleo::profile::base::cinder::volume::nfs::cinder_nfs_mount_options: {get_param: CinderNfsMountOptions}
-            tripleo::profile::base::cinder::volume::nfs::cinder_nfs_servers:
-              str_replace:
-                template: SERVERS
-                params:
-                  SERVERS: {get_param: CinderNfsServers}
+            tripleo::profile::base::cinder::volume::nfs::cinder_nfs_servers: {get_param: CinderNfsServers}
             tripleo::profile::base::cinder::volume::iscsi::cinder_lvm_loop_device_size: {get_param: CinderLVMLoopDeviceSize}
             tripleo::profile::base::cinder::volume::iscsi::cinder_iscsi_helper: {get_param: CinderISCSIHelper}
             tripleo::profile::base::cinder::volume::iscsi::cinder_iscsi_protocol: {get_param: CinderISCSIProtocol}
diff --git a/puppet/services/congress.yaml b/puppet/services/congress.yaml
index 8bc9f2e3..1b7d698d 100644
--- a/puppet/services/congress.yaml
+++ b/puppet/services/congress.yaml
@@ -88,6 +88,7 @@ outputs:
       service_config_settings:
         keystone:
           congress::keystone::auth::tenant: 'service'
+          congress::keystone::auth::region: {get_param: KeystoneRegion}
           congress::keystone::auth::password: {get_param: CongressPassword}
           congress::keystone::auth::public_url: {get_param: [EndpointMap, CongressPublic, uri]}
           congress::keystone::auth::internal_url: {get_param: [EndpointMap, CongressInternal, uri]}
diff --git a/puppet/services/database/mysql.yaml b/puppet/services/database/mysql.yaml
index 808f1353..7078b60f 100644
--- a/puppet/services/database/mysql.yaml
+++ b/puppet/services/database/mysql.yaml
@@ -23,6 +23,10 @@ parameters:
     description: Configures MySQL max_connections config setting
     type: number
     default: 4096
+  MysqlIncreaseFileLimit:
+    description: Flag to increase MySQL open-files-limit to 16384
+    type: boolean
+    default: true
   MysqlRootPassword:
     type: string
     hidden: true
@@ -96,6 +100,8 @@ outputs:
                   $NETWORK: {get_param: [ServiceNetMap, MysqlNetwork]}
             tripleo::profile::base::database::mysql::client_bind_address:
               {get_param: [ServiceNetMap, MysqlNetwork]}
+            tripleo::profile::base::database::mysql::generate_dropin_file_limit:
+              {get_param: MysqlIncreaseFileLimit}
       step_config: |
         include ::tripleo::profile::base::database::mysql
       metadata_settings:
diff --git a/puppet/services/etcd.yaml b/puppet/services/etcd.yaml
index ec87a75a..d2a0e302 100644
--- a/puppet/services/etcd.yaml
+++ b/puppet/services/etcd.yaml
@@ -19,9 +19,9 @@ parameters:
                  via parameter_defaults in the resource registry.
     type: json
   EtcdInitialClusterToken:
-    default: 'etcd-tripleo'
     description: Initial cluster token for the etcd cluster during bootstrap.
     type: string
+    hidden: true
   MonitoringSubscriptionEtcd:
     default: 'overcloud-etcd'
     type: string
diff --git a/puppet/services/ironic-conductor.yaml b/puppet/services/ironic-conductor.yaml
index f9547bef..56e1a90b 100644
--- a/puppet/services/ironic-conductor.yaml
+++ b/puppet/services/ironic-conductor.yaml
@@ -44,6 +44,10 @@ parameters:
     default: 8088
     description: Port to use for serving images when iPXE is used.
     type: string
+  IronicPassword:
+    description: The password for the Ironic service and db account, used by the Ironic services
+    type: string
+    hidden: true
   MonitoringSubscriptionIronicConductor:
     default: 'overcloud-ironic-conductor'
     type: string
@@ -65,9 +69,7 @@ outputs:
       config_settings:
         map_merge:
           - get_attr: [IronicBase, role_data, config_settings]
-          # FIXME: I have no idea why neutron_url is in "api" manifest
-          - ironic::api::neutron_url: {get_param: [EndpointMap, NeutronInternal, uri]}
-            ironic::conductor::api_url: {get_param: [EndpointMap, IronicInternal, uri_no_suffix]}
+          - ironic::conductor::api_url: {get_param: [EndpointMap, IronicInternal, uri_no_suffix]}
             ironic::conductor::cleaning_disk_erase: {get_param: IronicCleaningDiskErase}
             ironic::conductor::cleaning_network: {get_param: IronicCleaningNetwork}
             ironic::conductor::enabled_drivers: {get_param: IronicEnabledDrivers}
@@ -104,7 +106,40 @@ outputs:
             # the VIP, but rather a real IP of the host.
             ironic::my_ip: {get_param: [ServiceNetMap, IronicNetwork]}
             ironic::pxe::common::http_port: {get_param: IronicIPXEPort}
-
+            # Credentials to access other services
+            ironic::glance::auth_url: {get_param: [EndpointMap, KeystoneInternal, uri_no_suffix]}
+            ironic::glance::username: 'ironic'
+            ironic::glance::password: {get_param: IronicPassword}
+            ironic::glance::project_name: 'service'
+            ironic::glance::user_domain_name: 'Default'
+            ironic::glance::project_domain_name: 'Default'
+            ironic::neutron::auth_url: {get_param: [EndpointMap, KeystoneInternal, uri_no_suffix]}
+            ironic::neutron::username: 'ironic'
+            ironic::neutron::password: {get_param: IronicPassword}
+            ironic::neutron::project_name: 'service'
+            ironic::neutron::user_domain_name: 'Default'
+            ironic::neutron::project_domain_name: 'Default'
+            ironic::service_catalog::auth_url: {get_param: [EndpointMap, KeystoneInternal, uri_no_suffix]}
+            ironic::service_catalog::username: 'ironic'
+            ironic::service_catalog::password: {get_param: IronicPassword}
+            ironic::service_catalog::project_name: 'service'
+            ironic::service_catalog::user_domain_name: 'Default'
+            ironic::service_catalog::project_domain_name: 'Default'
+            ironic::swift::auth_url: {get_param: [EndpointMap, KeystoneInternal, uri_no_suffix]}
+            ironic::swift::username: 'ironic'
+            ironic::swift::password: {get_param: IronicPassword}
+            ironic::swift::project_name: 'service'
+            ironic::swift::user_domain_name: 'Default'
+            ironic::swift::project_domain_name: 'Default'
+            # ironic-inspector support is not implemented, but let's configure
+            # the credentials for consistency.
+            ironic::drivers::inspector::enabled: false
+            ironic::drivers::inspector::auth_url: {get_param: [EndpointMap, KeystoneInternal, uri_no_suffix]}
+            ironic::drivers::inspector::username: 'ironic'
+            ironic::drivers::inspector::password: {get_param: IronicPassword}
+            ironic::drivers::inspector::project_name: 'service'
+            ironic::drivers::inspector::user_domain_name: 'Default'
+            ironic::drivers::inspector::project_domain_name: 'Default'
       step_config: |
         include ::tripleo::profile::base::ironic::conductor
       upgrade_tasks:
diff --git a/puppet/services/keystone.yaml b/puppet/services/keystone.yaml
index a85a9ed0..f40c8d99 100644
--- a/puppet/services/keystone.yaml
+++ b/puppet/services/keystone.yaml
@@ -226,6 +226,7 @@ outputs:
             keystone::endpoint::internal_url: {get_param: [EndpointMap, KeystoneInternal, uri_no_suffix]}
             keystone::endpoint::admin_url: {get_param: [EndpointMap, KeystoneAdmin, uri_no_suffix]}
             keystone::endpoint::region: {get_param: KeystoneRegion}
+            keystone::endpoint::version: ''
             keystone_enable_db_purge: {get_param: KeystoneEnableDBPurge}
             keystone::rabbit_heartbeat_timeout_threshold: 60
             keystone::cron::token_flush::maxdelay: 3600
diff --git a/puppet/services/neutron-base.yaml b/puppet/services/neutron-base.yaml
index 55361939..5ed54f31 100644
--- a/puppet/services/neutron-base.yaml
+++ b/puppet/services/neutron-base.yaml
@@ -44,10 +44,10 @@ parameters:
     description: Set to True to enable debugging on all services.
   EnableConfigPurge:
     type: boolean
-    default: true
+    default: false
     description: >
-        Remove configuration that is not generated by TripleO. Setting
-        to false may result in configuration remnants after updates/upgrades.
+        Remove configuration that is not generated by TripleO. Used to avoid
+        configuration remnants after upgrades.
   NeutronGlobalPhysnetMtu:
     type: number
     default: 1500
diff --git a/puppet/services/neutron-bigswitch-agent.yaml b/puppet/services/neutron-bigswitch-agent.yaml
new file mode 100644
index 00000000..845f0da0
--- /dev/null
+++ b/puppet/services/neutron-bigswitch-agent.yaml
@@ -0,0 +1,31 @@
+heat_template_version: ocata
+
+description: >
+  Installs bigswitch agent and enables the services
+
+parameters:
+  ServiceNetMap:
+    default: {}
+    description: Mapping of service_name -> network name. Typically set
+                 via parameter_defaults in the resource registry.  This
+                 mapping overrides those in ServiceNetMapDefaults.
+    type: json
+  DefaultPasswords:
+    default: {}
+    type: json
+  EndpointMap:
+    default: {}
+    description: Mapping of service endpoint -> protocol. Typically set
+                 via parameter_defaults in the resource registry.
+    type: json
+
+
+outputs:
+  role_data:
+    description: Configure the bigswitch agent services
+    value:
+      service_name: neutron_bigswitch_agent
+      step_config: |
+        if hiera('step') >= 4 {
+          include ::neutron::agents::bigswitch
+        }
diff --git a/puppet/services/neutron-ovs-dpdk-agent.yaml b/puppet/services/neutron-ovs-dpdk-agent.yaml
index e25bc495..2c7ab57c 100644
--- a/puppet/services/neutron-ovs-dpdk-agent.yaml
+++ b/puppet/services/neutron-ovs-dpdk-agent.yaml
@@ -69,7 +69,10 @@ outputs:
       service_name: neutron_ovs_dpdk_agent
       config_settings:
         map_merge:
-          - get_attr: [NeutronOvsAgent, role_data, config_settings]
+          - map_replace:
+            - get_attr: [NeutronOvsAgent, role_data, config_settings]
+            - keys:
+                tripleo.neutron_ovs_agent.firewall_rules: tripleo.neutron_ovs_dpdk_agent.firewall_rules
           - neutron::agents::ml2::ovs::enable_dpdk: true
             neutron::agents::ml2::ovs::datapath_type: {get_param: NeutronDatapathType}
             neutron::agents::ml2::ovs::vhostuser_socket_dir: {get_param: NeutronVhostuserSocketDir}
diff --git a/puppet/services/neutron-plugin-ml2-odl.yaml b/puppet/services/neutron-plugin-ml2-odl.yaml
new file mode 100644
index 00000000..acacadfa
--- /dev/null
+++ b/puppet/services/neutron-plugin-ml2-odl.yaml
@@ -0,0 +1,45 @@
+heat_template_version: ocata
+
+description: >
+  OpenStack Neutron ML2/OpenDaylight plugin configured with Puppet
+
+parameters:
+  ServiceNetMap:
+    default: {}
+    description: Mapping of service_name -> network name. Typically set
+                 via parameter_defaults in the resource registry.  This
+                 mapping overrides those in ServiceNetMapDefaults.
+    type: json
+  DefaultPasswords:
+    default: {}
+    type: json
+  EndpointMap:
+    default: {}
+    description: Mapping of service endpoint -> protocol. Typically set
+                 via parameter_defaults in the resource registry.
+    type: json
+  OpenDaylightPortBindingController:
+    description: OpenDaylight port binding controller
+    type: string
+    default: 'network-topology'
+
+resources:
+
+  NeutronMl2Base:
+    type: ./neutron-plugin-ml2.yaml
+    properties:
+      ServiceNetMap: {get_param: ServiceNetMap}
+      DefaultPasswords: {get_param: DefaultPasswords}
+      EndpointMap: {get_param: EndpointMap}
+
+outputs:
+  role_data:
+    description: Role data for the Neutron ML2/ODL plugin.
+    value:
+      service_name: neutron_plugin_ml2_odl
+      config_settings:
+        map_merge:
+          - get_attr: [NeutronMl2Base, role_data, config_settings]
+          - neutron::plugins::ml2::opendaylight::port_binding_controller: {get_param: OpenDaylightPortBindingController}
+      step_config: |
+        include ::tripleo::profile::base::neutron::plugins::ml2
diff --git a/puppet/services/nova-api.yaml b/puppet/services/nova-api.yaml
index f27b53f2..678e09b6 100644
--- a/puppet/services/nova-api.yaml
+++ b/puppet/services/nova-api.yaml
@@ -225,7 +225,7 @@ outputs:
         - name: Setup cell_v2 (map cell0)
           tags: step5
           when: is_bootstrap_node
-          command: nova-manage cell_v2 map_cell0
+          shell: nova-manage cell_v2 map_cell0 --database_connection=$(hiera nova::cell0_database_connection)
         - name: Setup cell_v2 (create default cell)
           tags: step5
           when: is_bootstrap_node
@@ -241,15 +241,15 @@ outputs:
           command: nova-manage db sync
           async: {get_param: NovaDbSyncTimeout}
           poll: 10
-        - name: Setup cell_v2 (migrate hosts)
-          tags: step5
-          when: is_bootstrap_node
-          command: nova-manage cell_v2 map_cell_and_hosts
         - name: Setup cell_v2 (get cell uuid)
           tags: step5
           when: is_bootstrap_node
           shell: nova-manage cell_v2 list_cells | sed -e '1,3d' -e '$d' | awk -F ' *| *' '$2 == "default" {print $4}'
           register: nova_api_cell_uuid
+        - name: Setup cell_v2 (migrate hosts)
+          tags: step5
+          when: is_bootstrap_node
+          command: nova-manage cell_v2 discover_hosts --cell_uuid {{nova_api_cell_uuid.stdout}} --verbose
         - name: Setup cell_v2 (migrate instances)
           tags: step5
           when: is_bootstrap_node
diff --git a/puppet/services/nova-base.yaml b/puppet/services/nova-base.yaml
index ceacb0b2..7b568e9e 100644
--- a/puppet/services/nova-base.yaml
+++ b/puppet/services/nova-base.yaml
@@ -58,10 +58,10 @@ parameters:
     description: Set to True to enable debugging on all services.
   EnableConfigPurge:
     type: boolean
-    default: true
+    default: false
     description: >
-        Remove configuration that is not generated by TripleO. Setting
-        to false may result in configuration remnants after updates/upgrades.
+        Remove configuration that is not generated by TripleO. Used to avoid
+        configuration remnants after upgrades.
   NovaIPv6:
     default: false
     description: Enable IPv6 features in Nova
@@ -151,6 +151,16 @@ outputs:
                 - {get_param: [EndpointMap, MysqlInternal, host]}
                 - '/nova'
                 - '?read_default_file=/etc/my.cnf.d/tripleo.cnf&read_default_group=tripleo'
+          nova::cell0_database_connection:
+            list_join:
+              - ''
+              - - {get_param: [EndpointMap, MysqlInternal, protocol]}
+                - '://nova:'
+                - {get_param: NovaPassword}
+                - '@'
+                - {get_param: [EndpointMap, MysqlInternal, host]}
+                - '/nova_cell0'
+                - '?read_default_file=/etc/my.cnf.d/tripleo.cnf&read_default_group=tripleo'
           nova::api_database_connection:
             list_join:
               - ''
diff --git a/puppet/services/nova-ironic.yaml b/puppet/services/nova-ironic.yaml
index 5eb2170a..5fc77f07 100644
--- a/puppet/services/nova-ironic.yaml
+++ b/puppet/services/nova-ironic.yaml
@@ -51,3 +51,7 @@ outputs:
             nova::scheduler::filter::scheduler_host_manager: 'ironic_host_manager'
       step_config: |
         include tripleo::profile::base::nova::compute::ironic
+      upgrade_tasks:
+        - name: Stop openstack-nova-compute service
+          tags: step1
+          service: name=openstack-nova-compute state=stopped enabled=no
diff --git a/puppet/services/octavia-base.yaml b/puppet/services/octavia-base.yaml
index b537a2bc..f3aa1d64 100644
--- a/puppet/services/octavia-base.yaml
+++ b/puppet/services/octavia-base.yaml
@@ -24,10 +24,10 @@ parameters:
     description: Set to True to enable debugging on all services.
   EnableConfigPurge:
     type: boolean
-    default: true
+    default: false
     description: >
-        Remove configuration that is not generated by TripleO. Setting
-        to false may result in configuration remnants after updates/upgrades.
+        Remove configuration that is not generated by TripleO. Used to avoid
+        configuration remnants after upgrades.
   RabbitPassword:
     description: The password for RabbitMQ
     type: string
diff --git a/puppet/services/opendaylight-api.yaml b/puppet/services/opendaylight-api.yaml
index 0ed9d206..ceb56a81 100644
--- a/puppet/services/opendaylight-api.yaml
+++ b/puppet/services/opendaylight-api.yaml
@@ -17,6 +17,10 @@ parameters:
     type: string
     description: The password for the opendaylight server.
     hidden: true
+  OpenDaylightConnectionProtocol:
+    description: L7 protocol used for REST access
+    type: string
+    default: 'http'
   OpenDaylightEnableDHCP:
     description: Knob to enable/disable ODL DHCP Server
     type: boolean
@@ -55,6 +59,7 @@ outputs:
         opendaylight::extra_features: {get_param: OpenDaylightFeatures}
         opendaylight::enable_dhcp: {get_param: OpenDaylightEnableDHCP}
         opendaylight::odl_bind_ip: {get_param: [ServiceNetMap, OpendaylightApiNetwork]}
+        opendaylight::nb_connection_protocol: {get_param: OpenDayLightConnectionProtocol}
         tripleo.opendaylight_api.firewall_rules:
               '137 opendaylight api':
                 dport:
@@ -63,3 +68,26 @@ outputs:
                   - 6653
       step_config: |
         include tripleo::profile::base::neutron::opendaylight
+      upgrade_tasks:
+        - name: Check if opendaylight is deployed
+          command: systemctl is-enabled opendaylight
+          tags: common
+          ignore_errors: True
+          register: opendaylight_enabled
+        - name: "PreUpgrade step0,validation: Check service opendaylight is running"
+          shell: /usr/bin/systemctl show 'opendaylight' --property ActiveState | grep '\bactive\b'
+          when: opendaylight_enabled.rc == 0
+          tags: step0,validation
+        - name: Stop opendaylight service
+          tags: step1
+          when: opendaylight_enabled.rc == 0
+          service: name=opendaylight state=stopped
+        - name: Removes ODL snapshots, data, journal directories
+          file:
+            state: absent
+            path: /opt/opendaylight/{{item}}
+          tags: step2
+          with_items:
+            - snapshots
+            - data
+            - journal
diff --git a/puppet/services/opendaylight-ovs.yaml b/puppet/services/opendaylight-ovs.yaml
index cfec3c48..5cf416f3 100644
--- a/puppet/services/opendaylight-ovs.yaml
+++ b/puppet/services/opendaylight-ovs.yaml
@@ -60,11 +60,7 @@ outputs:
         opendaylight_check_url: {get_param: OpenDaylightCheckURL}
         opendaylight::nb_connection_protocol: {get_param: OpenDaylightConnectionProtocol}
         neutron::agents::ml2::ovs::local_ip: {get_param: [ServiceNetMap, NeutronTenantNetwork]}
-        neutron::plugins::ovs::opendaylight::provider_mappings:
-          str_replace:
-            template: MAPPINGS
-            params:
-              MAPPINGS: {get_param: OpenDaylightProviderMappings}
+        neutron::plugins::ovs::opendaylight::provider_mappings: {get_param: OpenDaylightProviderMappings}
         tripleo.opendaylight_ovs.firewall_rules:
           '118 neutron vxlan networks':
              proto: 'udp'
@@ -73,3 +69,17 @@ outputs:
              proto: 'gre'
       step_config: |
         include tripleo::profile::base::neutron::plugins::ovs::opendaylight
+      upgrade_tasks:
+        - name: Check if openvswitch is deployed
+          command: systemctl is-enabled openvswitch
+          tags: common
+          ignore_errors: True
+          register: openvswitch_enabled
+        - name: "PreUpgrade step0,validation: Check service openvswitch is running"
+          shell: /usr/bin/systemctl show 'openvswitch' --property ActiveState | grep '\bactive\b'
+          when: openvswitch_enabled.rc == 0
+          tags: step0,validation
+        - name: Stop openvswitch service
+          tags: step1
+          when: openvswitch_enabled.rc == 0
+          service: name=openvswitch state=stopped
diff --git a/puppet/services/pacemaker.yaml b/puppet/services/pacemaker.yaml
index 5be58c18..28fcbd6f 100644
--- a/puppet/services/pacemaker.yaml
+++ b/puppet/services/pacemaker.yaml
@@ -87,10 +87,16 @@ parameters:
         \[(?<pid>[^ ]*)\]
         (?<host>[^ ]*)
         (?<message>.*)$/
+
+  EnableLoadBalancer:
+    default: true
+    description: Whether to deploy a LoadBalancer on the Controller
+    type: boolean
+
   PacemakerResources:
     type: comma_delimited_list
     description: List of resources managed by pacemaker
-    default: ['rabbitmq','haproxy']
+    default: ['rabbitmq', 'galera']
 
 outputs:
   role_data:
@@ -143,5 +149,13 @@ outputs:
           pacemaker_cluster: state=online
         - name: Check pacemaker resource
           tags: step4
-          pacemaker_resource: state=started resource={{item}} check_mode=true wait_for_resource=true timeout=500
+          pacemaker_is_active:
+            resource: "{{ item }}"
+            max_wait: 500
           with_items: {get_param: PacemakerResources}
+        - name: Check pacemaker haproxy resource
+          tags: step4
+          pacemaker_is_active:
+            resource: haproxy
+            max_wait: 500
+          when: {get_param: EnableLoadBalancer}
diff --git a/puppet/services/tacker.yaml b/puppet/services/tacker.yaml
index 6f92066e..2f803b0b 100644
--- a/puppet/services/tacker.yaml
+++ b/puppet/services/tacker.yaml
@@ -89,6 +89,7 @@ outputs:
       service_config_settings:
         keystone:
           tacker::keystone::auth::tenant: 'service'
+          tacker::keystone::auth::region: {get_param: KeystoneRegion}
           tacker::keystone::auth::password: {get_param: TackerPassword}
           tacker::keystone::auth::public_url: {get_param: [EndpointMap, TackerPublic, uri]}
           tacker::keystone::auth::internal_url: {get_param: [EndpointMap, TackerInternal, uri]}
diff --git a/puppet/services/tripleo-firewall.yaml b/puppet/services/tripleo-firewall.yaml
index 67e14d9c..ff2b067f 100644
--- a/puppet/services/tripleo-firewall.yaml
+++ b/puppet/services/tripleo-firewall.yaml
@@ -37,3 +37,9 @@ outputs:
         tripleo::firewall::purge_firewall_rules: {get_param: PurgeFirewallRules}
       step_config: |
         include ::tripleo::firewall
+      upgrade_tasks:
+        - name: blank ipv6 rule before activating ipv6 firewall.
+          tags: step3
+          shell: cat /etc/sysconfig/ip6tables > /etc/sysconfig/ip6tables.n-o-upgrade; cat</dev/null>/etc/sysconfig/ip6tables
+          args:
+            creates: /etc/sysconfig/ip6tables.n-o-upgrade