5 files changed, 36 insertions, 24 deletions
diff --git a/puppet/config.role.j2.yaml b/puppet/config.role.j2.yaml
index e59a0216..552c59b2 100644
--- a/puppet/config.role.j2.yaml
+++ b/puppet/config.role.j2.yaml
@@ -1,4 +1,4 @@
-heat_template_version: 2015-04-30
+heat_template_version: 2016-10-14
 
 description: >
   A software config which runs puppet on the {{role}} role
@@ -12,6 +12,14 @@ parameters:
      type: string
      description: Config manifests that will be used to step through the deployment.
      default: ''
+  PuppetTags:
+     type: string
+     description: List of comma-separated tags to limit puppet catalog to.
+     default: ''
+
+conditions:
+
+  puppet_tags_empty: {equals : [{get_param: PuppetTags}, '']}
 
 resources:
 
@@ -24,6 +32,13 @@ resources:
         enable_hiera: True
         enable_facter: False
         modulepath: /etc/puppet/modules:/opt/stack/puppet-modules:/usr/share/openstack-puppet/modules
+        tags:
+          if:
+          - puppet_tags_empty
+          - ''
+          - list_join:
+            - ','
+            - ['file,concat,file_line', {get_param: PuppetTags}]
       outputs:
       - name: result
       inputs:
diff --git a/puppet/services/aodh-api.yaml b/puppet/services/aodh-api.yaml
index 48cc4af6..daed1665 100644
--- a/puppet/services/aodh-api.yaml
+++ b/puppet/services/aodh-api.yaml
@@ -21,11 +21,6 @@ parameters:
   MonitoringSubscriptionAodhApi:
     default: 'overcloud-ceilometer-aodh-api'
     type: string
-  EnableCombinationAlarms:
-    default: false
-    description: Combination alarms are deprecated in Newton, hence disabled
-                 by default. To enable, set this parameter to true.
-    type: boolean
   EnableInternalTLS:
     type: boolean
     default: false
@@ -83,7 +78,6 @@ outputs:
             # internal_api_uri -> [IP]
             # internal_api_subnet - > IP/CIDR
             aodh::wsgi::apache::bind_host: {get_param: [ServiceNetMap, AodhApiNetwork]}
-            tripleo::profile::base::aodh::api::enable_combination_alarms: {get_param: EnableCombinationAlarms}
       service_config_settings:
         get_attr: [AodhBase, role_data, service_config_settings]
       step_config: |
diff --git a/puppet/services/haproxy.yaml b/puppet/services/haproxy.yaml
index 0813cb7e..c8edade5 100644
--- a/puppet/services/haproxy.yaml
+++ b/puppet/services/haproxy.yaml
@@ -34,16 +34,6 @@ parameters:
     description: The password for Redis
     type: string
     hidden: true
-  ControlVirtualInterface:
-    default: 'br-ex'
-    description: Interface where virtual ip will be assigned.
-    type: string
-  PublicVirtualInterface:
-    default: 'br-ex'
-    description: >
-        Specifies the interface where the public-facing virtual ip will be assigned.
-        This should be int_public when a VLAN is being used.
-    type: string
   MonitoringSubscriptionHaproxy:
     default: 'overcloud-haproxy'
     type: string
@@ -81,8 +71,6 @@ outputs:
             tripleo::haproxy::haproxy_stats_user: {get_param: HAProxyStatsUser}
             tripleo::haproxy::haproxy_stats_password: {get_param: HAProxyStatsPassword}
             tripleo::haproxy::redis_password: {get_param: RedisPassword}
-            tripleo::haproxy::control_virtual_interface: {get_param: ControlVirtualInterface}
-            tripleo::haproxy::public_virtual_interface: {get_param: PublicVirtualInterface}
             tripleo::profile::base::haproxy::certificates_specs:
               map_merge:
                 - get_attr: [HAProxyPublicTLS, role_data, certificates_specs]
diff --git a/puppet/services/keepalived.yaml b/puppet/services/keepalived.yaml
index 38cfbe22..fb0d32b6 100644
--- a/puppet/services/keepalived.yaml
+++ b/puppet/services/keepalived.yaml
@@ -19,14 +19,18 @@ parameters:
                  via parameter_defaults in the resource registry.
     type: json
   ControlVirtualInterface:
-    default: 'br-ex'
-    description: Interface where virtual ip will be assigned.
+    default: ''
+    description: >
+        Interface where virtual ip will be assigned.  This value will be
+        automatically set by the deployment tool.  Overriding here will
+        override automatic setting.
     type: string
   PublicVirtualInterface:
-    default: 'br-ex'
+    default: ''
     description: >
-        Specifies the interface where the public-facing virtual ip will be assigned.
-        This should be int_public when a VLAN is being used.
+        Interface where virtual ip will be assigned.  This value will be
+        automatically set by the deployment tool.  Overriding here will
+        override automatic setting.
     type: string
   MonitoringSubscriptionKeepalived:
     default: 'overcloud-keepalived'
diff --git a/puppet/services/keystone.yaml b/puppet/services/keystone.yaml
index d819e043..fe023a6a 100644
--- a/puppet/services/keystone.yaml
+++ b/puppet/services/keystone.yaml
@@ -99,6 +99,12 @@ parameters:
   KeystoneCredential1:
     type: string
     description: The second Keystone credential key. Must be a valid key.
+  KeystoneFernetKey0:
+    type: string
+    description: The first Keystone fernet key. Must be a valid key.
+  KeystoneFernetKey1:
+    type: string
+    description: The second Keystone fernet key. Must be a valid key.
   KeystoneLoggingSource:
     type: json
     default:
@@ -156,6 +162,11 @@ outputs:
                 content: {get_param: KeystoneCredential0}
               '/etc/keystone/credential-keys/1':
                 content: {get_param: KeystoneCredential1}
+            keystone::fernet_keys:
+              '/etc/keystone/fernet-keys/0':
+                content: {get_param: KeystoneFernetKey0}
+              '/etc/keystone/fernet-keys/1':
+                content: {get_param: KeystoneFernetKey1}
             keystone::debug: {get_param: Debug}
             keystone::rabbit_userid: {get_param: RabbitUserName}
             keystone::rabbit_password: {get_param: RabbitPassword}