11 files changed, 121 insertions, 22 deletions

diff --git a/puppet/services/barbican-api.yaml b/puppet/services/barbican-api.yaml
index 1f220e6b..4e420750 100644
--- a/puppet/services/barbican-api.yaml
+++ b/puppet/services/barbican-api.yaml
@@ -136,13 +136,13 @@ outputs:
           nova::compute::barbican_endpoint:
             get_param: [EndpointMap, BarbicanInternal, uri]
           nova::compute::barbican_auth_endpoint:
-            get_param: [EndpointMap, KeystoneV3Internal, uri]
+            get_param: [EndpointMap, KeystoneV3Internal, uri_no_suffix]
         cinder_api:
           cinder::api::keymgr_api_class: >
             castellan.key_manager.barbican_key_manager.BarbicanKeyManager
           cinder::api::keymgr_encryption_api_url:
             get_param: [EndpointMap, BarbicanInternal, uri]
           cinder::api::keymgr_encryption_auth_url:
-            get_param: [EndpointMap, KeystoneV3Internal, uri]
+            get_param: [EndpointMap, KeystoneV3Internal, uri_no_suffix]
       metadata_settings:
         get_attr: [ApacheServiceBase, role_data, metadata_settings]
diff --git a/puppet/services/ceph-external.yaml b/puppet/services/ceph-external.yaml
index aaa9b039..134f47c4 100644
--- a/puppet/services/ceph-external.yaml
+++ b/puppet/services/ceph-external.yaml
@@ -89,23 +89,23 @@ outputs:
         ceph::profile::params::fsid: {get_param: CephClusterFSID}
         ceph::profile::params::rbd_default_features: {get_param: RbdDefaultFeatures}
         ceph::profile::params::client_keys:
-          str_replace:
-            template: "{
-              client.CLIENT_USER: {
-                secret: 'CLIENT_KEY',
-                mode: '0644',
-                cap_mon: 'allow r',
-                cap_osd: 'allow class-read object_prefix rbd_children, allow rwx pool=CINDER_POOL, allow rwx pool=CINDERBACKUP_POOL, allow rwx pool=NOVA_POOL, allow rwx pool=GLANCE_POOL, allow rwx pool=GNOCCHI_POOL'
-              }
-            }"
-            params:
-              CLIENT_USER: {get_param: CephClientUserName}
-              CLIENT_KEY: {get_param: CephClientKey}
-              NOVA_POOL: {get_param: NovaRbdPoolName}
-              CINDER_POOL: {get_param: CinderRbdPoolName}
-              CINDERBACKUP_POOL: {get_param: CinderBackupRbdPoolName}
-              GLANCE_POOL: {get_param: GlanceRbdPoolName}
-              GNOCCHI_POOL: {get_param: GnocchiRbdPoolName}
+          map_replace:
+            - CEPH_CLIENT_KEY:
+                secret: {get_param: CephClientKey}
+                mode: '0644'
+                cap_mon: 'allow r'
+                cap_osd:
+                  str_replace:
+                    template: 'allow class-read object_prefix rbd_children, allow rwx pool=CINDER_POOL, allow rwx pool=CINDERBACKUP_POOL, allow rwx pool=NOVA_POOL, allow rwx pool=GLANCE_POOL, allow rwx pool=GNOCCHI_POOL'
+                    params:
+                      NOVA_POOL: {get_param: NovaRbdPoolName}
+                      CINDER_POOL: {get_param: CinderRbdPoolName}
+                      CINDERBACKUP_POOL: {get_param: CinderBackupRbdPoolName}
+                      GLANCE_POOL: {get_param: GlanceRbdPoolName}
+                      GNOCCHI_POOL: {get_param: GnocchiRbdPoolName}
+            - keys:
+                CEPH_CLIENT_KEY:
+                  list_join: ['.', ['client', {get_param: CephClientUserName}]]
         ceph::profile::params::manage_repo: false
         # FIXME(gfidente): we should not have to list the packages explicitly in
         # the templates, but this should stay until the following is fixed:
diff --git a/puppet/services/cinder-api.yaml b/puppet/services/cinder-api.yaml
index a5c912ed..e3c96325 100644
--- a/puppet/services/cinder-api.yaml
+++ b/puppet/services/cinder-api.yaml
@@ -149,6 +149,9 @@ outputs:
       metadata_settings:
         get_attr: [ApacheServiceBase, role_data, metadata_settings]
       upgrade_tasks:
+        - name: "PreUpgrade step0: Check service openstack-cinder-api is running"
+          shell: /usr/bin/systemctl show 'openstack-cinder-api' --property ActiveState | grep '\bactive\b'
+          tags: step0,validation
         - name: check for cinder running under apache (post upgrade)
           tags: step2
           shell: "apachectl -t -D DUMP_VHOSTS | grep -q cinder"
diff --git a/puppet/services/gnocchi-metricd.yaml b/puppet/services/gnocchi-metricd.yaml
index e5f9a8e7..27700606 100644
--- a/puppet/services/gnocchi-metricd.yaml
+++ b/puppet/services/gnocchi-metricd.yaml
@@ -22,7 +22,7 @@ parameters:
     default: 'overcloud-gnocchi-metricd'
     type: string
   GnocchiMetricdWorkers:
-    default: ''
+    default: '%{::os_workers}'
     description: Number of workers for Gnocchi MetricD
     type: string
 
diff --git a/puppet/services/horizon.yaml b/puppet/services/horizon.yaml
index cf35d202..2111021b 100644
--- a/puppet/services/horizon.yaml
+++ b/puppet/services/horizon.yaml
@@ -27,6 +27,14 @@ parameters:
     description: A list of IP/Hostname for the server Horizon is running on.
                  Used for header checks.
     type: comma_delimited_list
+  HorizonPasswordValidator:
+    description: Regex for password validation
+    type: string
+    default: ''
+  HorizonPasswordValidatorHelp:
+    description: Help text for password validation
+    type: string
+    default: ''
   HorizonSecret:
     description: Secret key for Django
     type: string
@@ -71,6 +79,8 @@ outputs:
             options: ['FollowSymLinks','MultiViews']
           horizon::bind_address: {get_param: [ServiceNetMap, HorizonNetwork]}
           horizon::keystone_url: {get_param: [EndpointMap, KeystoneInternal, uri]}
+          horizon::password_validator: {get_param: [HorizonPasswordValidator]}
+          horizon::password_validator_help: {get_param: [HorizonPasswordValidatorHelp]}
           horizon::secret_key:
             yaql:
               expression: $.data.passwords.where($ != '').first()
diff --git a/puppet/services/neutron-dhcp.yaml b/puppet/services/neutron-dhcp.yaml
index 5e7de18e..bb4742c9 100644
--- a/puppet/services/neutron-dhcp.yaml
+++ b/puppet/services/neutron-dhcp.yaml
@@ -39,6 +39,10 @@ parameters:
     default:
       tag: openstack.neutron.agent.dhcp
       path: /var/log/neutron/dhcp-agent.log
+  NeutronDhcpAgentDnsmasqDnsServers:
+    default: []
+    description: List of servers to use as dnsmasq forwarders
+    type: comma_delimited_list
 
 resources:
 
@@ -64,6 +68,7 @@ outputs:
           - neutron::agents::dhcp::enable_isolated_metadata: {get_param: NeutronEnableIsolatedMetadata}
             neutron::agents::dhcp::enable_force_metadata: {get_param: NeutronEnableForceMetadata}
             neutron::agents::dhcp::enable_metadata_network: {get_param: NeutronEnableMetadataNetwork}
+            neutron::agents::dhcp::dnsmasq_dns_servers: {get_param: NeutronDhcpAgentDnsmasqDnsServers}
             tripleo.neutron_dhcp.firewall_rules:
               '115 neutron dhcp input':
                 proto: 'udp'
diff --git a/puppet/services/pacemaker/ceph-rbdmirror.yaml b/puppet/services/pacemaker/ceph-rbdmirror.yaml
new file mode 100644
index 00000000..7686028d
--- /dev/null
+++ b/puppet/services/pacemaker/ceph-rbdmirror.yaml
@@ -0,0 +1,47 @@
+heat_template_version: ocata
+
+description: >
+  Ceph RBD mirror service.
+
+parameters:
+  ServiceNetMap:
+    default: {}
+    description: Mapping of service_name -> network name. Typically set
+                 via parameter_defaults in the resource registry.  This
+                 mapping overrides those in ServiceNetMapDefaults.
+    type: json
+  DefaultPasswords:
+    default: {}
+    type: json
+  EndpointMap:
+    default: {}
+    description: Mapping of service endpoint -> protocol. Typically set
+                 via parameter_defaults in the resource registry.
+    type: json
+  CephClientUserName:
+    default: openstack
+    type: string
+
+resources:
+  CephBase:
+    type: ../ceph-base.yaml
+    properties:
+      ServiceNetMap: {get_param: ServiceNetMap}
+      DefaultPasswords: {get_param: DefaultPasswords}
+      EndpointMap: {get_param: EndpointMap}
+
+outputs:
+  role_data:
+    description: Role data for the Ceph RBD mirrror service.
+    value:
+      service_name: ceph_rbdmirror
+      config_settings:
+        map_merge:
+          - get_attr: [CephBase, role_data, config_settings]
+          - tripleo::profile::pacemaker::ceph::rbdmirror::client_name: {get_param: CephClientUserName}
+            tripleo.ceph_rbdmirror.firewall_rules:
+              '113 ceph_rbdmirror':
+                dport:
+                  - '6800-7300'
+      step_config: |
+        include ::tripleo::profile::pacemaker::ceph::rbdmirror
\ No newline at end of file
diff --git a/puppet/services/snmp.yaml b/puppet/services/snmp.yaml
index be9d143e..fd6ed818 100644
--- a/puppet/services/snmp.yaml
+++ b/puppet/services/snmp.yaml
@@ -43,3 +43,7 @@ outputs:
             proto: 'udp'
       step_config: |
         include ::tripleo::profile::base::snmp
+      upgrade_tasks:
+        - name: Stop snmp service
+          tags: step2
+          service: name=snmpd state=stopped
diff --git a/puppet/services/swift-ringbuilder.yaml b/puppet/services/swift-ringbuilder.yaml
index a7ba7bad..2e3c818f 100644
--- a/puppet/services/swift-ringbuilder.yaml
+++ b/puppet/services/swift-ringbuilder.yaml
@@ -43,6 +43,16 @@ parameters:
     description: 'Use a local directory for Swift storage services when building rings'
     type: boolean
 
+conditions:
+  swift_use_local_dir:
+    and:
+    - equals:
+      - get_param: SwiftUseLocalDir
+      - true
+    - equals:
+      - get_param: SwiftRawDisks
+      - {}
+
 outputs:
   role_data:
     description: Role data for Swift Ringbuilder configuration.
@@ -59,7 +69,7 @@ outputs:
             expression: $.data.raw_disk_lists.flatten()
             data:
               raw_disk_lists:
-              - {if: [{get_param: SwiftUseLocalDir}, [':%PORT%/d1'], []]}
+              - {if: [swift_use_local_dir, [':%PORT%/d1'], []]}
               - repeat:
                   template: ':%PORT%/DEVICE'
                   for_each:
diff --git a/puppet/services/swift-storage.yaml b/puppet/services/swift-storage.yaml
index 08df928d..247b23ff 100644
--- a/puppet/services/swift-storage.yaml
+++ b/puppet/services/swift-storage.yaml
@@ -56,6 +56,17 @@ resources:
       DefaultPasswords: {get_param: DefaultPasswords}
       EndpointMap: {get_param: EndpointMap}
 
+conditions:
+  swift_mount_check:
+    or:
+    - equals:
+      - get_param: SwiftMountCheck
+      - true
+    - not:
+        equals:
+        - get_param: SwiftRawDisks
+        - {}
+
 outputs:
   role_data:
     description: Role data for the Swift Proxy role.
@@ -65,7 +76,7 @@ outputs:
       config_settings:
         map_merge:
           - get_attr: [SwiftBase, role_data, config_settings]
-          - swift::storage::all::mount_check: {get_param: SwiftMountCheck}
+          - swift::storage::all::mount_check: {if: [swift_mount_check, true, false]}
             tripleo::profile::base::swift::storage::enable_swift_storage: {get_param: ControllerEnableSwiftStorage}
             tripleo.swift_storage.firewall_rules:
               '123 swift storage':
diff --git a/puppet/upgrade_config.yaml b/puppet/upgrade_config.yaml
index e892d813..c37cc033 100644
--- a/puppet/upgrade_config.yaml
+++ b/puppet/upgrade_config.yaml
@@ -11,6 +11,11 @@ parameters:
     type: string
     description: Step number of the upgrade
 
+  SkipUpgradeConfigTags:
+    type: comma_delimited_list
+    description: Ansible tags to skip during upgrade, e.g validation skips pre-upgrade validations
+    default: []
+
 resources:
 
   AnsibleConfig:
@@ -30,6 +35,10 @@ resources:
     properties:
       group: ansible
       options:
+        skip_tags:
+          list_join:
+            - ","
+            - {get_param: SkipUpgradeConfigTags}
         tags:
           str_replace:
             template: "stepSTEP"