15 files changed, 209 insertions, 33 deletions
diff --git a/puppet/cephstorage-role.yaml b/puppet/cephstorage-role.yaml
index 55b26336..f7e29b70 100644
--- a/puppet/cephstorage-role.yaml
+++ b/puppet/cephstorage-role.yaml
@@ -253,6 +253,7 @@ resources:
             - extraconfig
             - service_names
             - service_configs
+            - ceph
             - bootstrap_node # provided by allNodesConfig
             - all_nodes # provided by allNodesConfig
             - vip_data # provided by allNodesConfig
diff --git a/puppet/role.role.j2.yaml b/puppet/role.role.j2.yaml
index e4307001..5b419f80 100644
--- a/puppet/role.role.j2.yaml
+++ b/puppet/role.role.j2.yaml
@@ -259,6 +259,7 @@ resources:
             - extraconfig
             - service_names
             - service_configs
+            - {{role.lower()}}
             - bootstrap_node # provided by allNodesConfig
             - all_nodes # provided by allNodesConfig
             - vip_data # provided by allNodesConfig
diff --git a/puppet/services/barbican-api.yaml b/puppet/services/barbican-api.yaml
new file mode 100644
index 00000000..cf57680c
--- /dev/null
+++ b/puppet/services/barbican-api.yaml
@@ -0,0 +1,127 @@
+heat_template_version: 2016-04-08
+
+description: >
+  OpenStack Barbican API service configured with Puppet
+
+parameters:
+  ServiceNetMap:
+    default: {}
+    description: Mapping of service_name -> network name. Typically set
+                 via parameter_defaults in the resource registry.  This
+                 mapping overrides those in ServiceNetMapDefaults.
+    type: json
+  DefaultPasswords:
+    default: {}
+    type: json
+  EndpointMap:
+    default: {}
+    description: Mapping of service endpoint -> protocol. Typically set
+                 via parameter_defaults in the resource registry.
+    type: json
+  BarbicanPassword:
+    description: The password for the barbican service account.
+    type: string
+    hidden: true
+  BarbicanWorkers:
+    description: Set the number of workers for barbican::wsgi::apache
+    default: '"%{::processorcount}"'
+    type: string
+  Debug:
+    default: ''
+    description: Set to True to enable debugging on all services.
+    type: string
+  KeystoneRegion:
+    type: string
+    default: 'regionOne'
+    description: Keystone region for endpoint
+  RabbitClientPort:
+    default: 5672
+    description: Set rabbit subscriber port, change this if using SSL
+    type: number
+  RabbitClientUseSSL:
+    default: false
+    description: >
+        Rabbit client subscriber parameter to specify
+        an SSL connection to the RabbitMQ host.
+    type: string
+  RabbitPassword:
+    description: The password for RabbitMQ
+    type: string
+    hidden: true
+  RabbitUserName:
+    default: guest
+    description: The username for RabbitMQ
+    type: string
+
+resources:
+
+  ApacheServiceBase:
+    type: ./apache.yaml
+    properties:
+      ServiceNetMap: {get_param: ServiceNetMap}
+      DefaultPasswords: {get_param: DefaultPasswords}
+      EndpointMap: {get_param: EndpointMap}
+
+outputs:
+  role_data:
+    description: Role data for the Barbican API role.
+    value:
+      service_name: barbican_api
+      config_settings:
+        map_merge:
+          - get_attr: [ApacheServiceBase, role_data, config_settings]
+          - barbican::keystone::authtoken::password: {get_param: BarbicanPassword}
+            barbican::keystone::authtoken::auth_uri: {get_param: [EndpointMap, KeystoneInternal, uri]}
+            barbican::keystone::authtoken::auth_url: { get_param: [EndpointMap, KeystoneAdmin, uri_no_suffix]}
+            barbican::keystone::authtoken::project_name: 'service'
+            barbican::api::host_href: {get_param: [EndpointMap, BarbicanPublic, uri]}
+            barbican::api::db_auto_create: false
+            barbican::api::enabled_certificate_plugins: ['simple_certificate']
+            barbican::api::logging::debug: {get_param: Debug}
+            barbican::api::rabbit_use_ssl: {get_param: RabbitClientUseSSL}
+            barbican::api::rabbit_userid: {get_param: RabbitUserName}
+            barbican::api::rabbit_password: {get_param: RabbitPassword}
+            barbican::api::rabbit_port: {get_param: RabbitClientPort}
+            barbican::api::rabbit_heartbeat_timeout_threshold: 60
+            barbican::api::service_name: 'httpd'
+            barbican::wsgi::apache::bind_host: {get_param: [ServiceNetMap, BarbicanApiNetwork]}
+            barbican::wsgi::apache::ssl: false
+            barbican::wsgi::apache::workers: {get_param: BarbicanWorkers}
+            barbican::wsgi::apache::servername:
+              str_replace:
+                template:
+                  '"%{::fqdn_$NETWORK}"'
+                params:
+                  $NETWORK: {get_param: [ServiceNetMap, BarbicanApiNetwork]}
+            barbican::db::database_connection:
+              list_join:
+                - ''
+                - - {get_param: [EndpointMap, MysqlInternal, protocol]}
+                  - '://barbican:'
+                  - {get_param: BarbicanPassword}
+                  - '@'
+                  - {get_param: [EndpointMap, MysqlInternal, host]}
+                  - '/barbican'
+            tripleo.barbican_api.firewall_rules:
+              '117 barbican':
+                dport:
+                  - 9311
+                  - 13311
+      step_config: |
+        include ::tripleo::profile::base::barbican::api
+      service_config_settings:
+        mysql:
+          barbican::db::mysql::password: {get_param: BarbicanPassword}
+          barbican::db::mysql::user: barbican
+          barbican::db::mysql::host: {get_param: [EndpointMap, MysqlInternal, host_nobrackets]}
+          barbican::db::mysql::dbname: barbican
+          barbican::db::mysql::allowed_hosts:
+            - '%'
+            - "%{hiera('mysql_bind_host')}"
+        keystone:
+          barbican::keystone::auth::public_url: {get_param: [EndpointMap, BarbicanPublic, uri]}
+          barbican::keystone::auth::internal_url: {get_param: [EndpointMap, BarbicanInternal, uri]}
+          barbican::keystone::auth::admin_url: {get_param: [EndpointMap, BarbicanAdmin, uri]}
+          barbican::keystone::auth::password: {get_param: BarbicanPassword}
+          barbican::keystone::auth::region: {get_param: KeystoneRegion}
+          barbican::keystone::auth::tenant: 'service'
diff --git a/puppet/services/glance-base.yaml b/puppet/services/glance-base.yaml
index 3294fc0f..cc979af9 100644
--- a/puppet/services/glance-base.yaml
+++ b/puppet/services/glance-base.yaml
@@ -44,6 +44,21 @@ parameters:
     type: string
     constraints:
     - allowed_values: ['swift', 'file', 'rbd']
+  GlanceNfsEnabled:
+    default: false
+    description: >
+      When using GlanceBackend 'file', mount NFS share for image storage.
+    type: boolean
+  GlanceNfsShare:
+    default: ''
+    description: >
+      NFS share to mount for image storage (when GlanceNfsEnabled is true)
+    type: string
+  GlanceNfsOptions:
+    default: 'intr,context=system_u:object_r:glance_var_lib_t:s0'
+    description: >
+      NFS mount options for image storage (when GlanceNfsEnabled is true)
+    type: string
   GlanceRbdPoolName:
     default: images
     type: string
@@ -92,6 +107,9 @@ outputs:
         glance::notify::rabbitmq::notification_driver: messagingv2
         glance::registry::db::database_db_max_retries: -1
         glance::registry::db::database_max_retries: -1
+        tripleo::profile::base::glance::api::glance_nfs_enabled: {get_param: GlanceNfsEnabled}
+        tripleo::glance::nfs_mount::share: {get_param: GlanceNfsShare}
+        tripleo::glance::nfs_mount::options: {get_param: GlanceNfsOptions}
       service_config_settings:
         keystone:
           glance::keystone::auth::public_url: {get_param: [EndpointMap, GlancePublic, uri]}
diff --git a/puppet/services/gnocchi-statsd.yaml b/puppet/services/gnocchi-statsd.yaml
index 04339f46..983d6c91 100644
--- a/puppet/services/gnocchi-statsd.yaml
+++ b/puppet/services/gnocchi-statsd.yaml
@@ -39,5 +39,9 @@ outputs:
       config_settings:
         map_merge:
           - get_attr: [GnocchiServiceBase, role_data, config_settings]
+          - tripleo.gnocchi_statsd.firewall_rules:
+              '140 gnocchi-statsd':
+                dport: 8125
+                proto: 'udp'
       step_config: |
         include ::tripleo::profile::base::gnocchi::statsd
diff --git a/puppet/services/manila-api.yaml b/puppet/services/manila-api.yaml
index 4d3fd47c..5f4ab6ba 100644
--- a/puppet/services/manila-api.yaml
+++ b/puppet/services/manila-api.yaml
@@ -62,21 +62,15 @@ outputs:
       step_config: |
         include ::tripleo::profile::base::manila::api
       service_config_settings:
-        keystone:
-          manila::keystone::auth::tenant: 'service'
-          manila::keystone::auth::public_url: {get_param: [EndpointMap, ManilaV1Public, uri]}
-          manila::keystone::auth::internal_url: {get_param: [EndpointMap, ManilaV1Internal, uri]}
-          manila::keystone::auth::admin_url: {get_param: [EndpointMap, ManilaV1Admin, uri]}
-          manila::keystone::auth::public_url_v2: {get_param: [EndpointMap, ManilaPublic, uri]}
-          manila::keystone::auth::internal_url_v2: {get_param: [EndpointMap, ManilaInternal, uri]}
-          manila::keystone::auth::admin_url_v2: {get_param: [EndpointMap, ManilaAdmin, uri]}
-          manila::keystone::auth::password: {get_param: ManilaPassword}
-          manila::keystone::auth::region: {get_param: KeystoneRegion}
-        mysql:
-          manila::db::mysql::password: {get_param: ManilaPassword}
-          manila::db::mysql::user: manila
-          manila::db::mysql::host: {get_param: [EndpointMap, MysqlInternal, host_nobrackets]}
-          manila::db::mysql::dbname: manila
-          manila::db::mysql::allowed_hosts:
-            - '%'
-            - "%{hiera('mysql_bind_host')}"
+        map_merge:
+          - get_attr: [ManilaBase, role_data, service_config_settings]
+          - keystone:
+              manila::keystone::auth::tenant: 'service'
+              manila::keystone::auth::public_url: {get_param: [EndpointMap, ManilaV1Public, uri]}
+              manila::keystone::auth::internal_url: {get_param: [EndpointMap, ManilaV1Internal, uri]}
+              manila::keystone::auth::admin_url: {get_param: [EndpointMap, ManilaV1Admin, uri]}
+              manila::keystone::auth::public_url_v2: {get_param: [EndpointMap, ManilaPublic, uri]}
+              manila::keystone::auth::internal_url_v2: {get_param: [EndpointMap, ManilaInternal, uri]}
+              manila::keystone::auth::admin_url_v2: {get_param: [EndpointMap, ManilaAdmin, uri]}
+              manila::keystone::auth::password: {get_param: ManilaPassword}
+              manila::keystone::auth::region: {get_param: KeystoneRegion}
diff --git a/puppet/services/manila-base.yaml b/puppet/services/manila-base.yaml
index d228577a..844bd3a3 100644
--- a/puppet/services/manila-base.yaml
+++ b/puppet/services/manila-base.yaml
@@ -40,6 +40,10 @@ parameters:
     default: 5672
     description: Set rabbit subscriber port, change this if using SSL
     type: number
+  ManilaPassword:
+    description: The password for the manila service account.
+    type: string
+    hidden: true
 
 outputs:
   role_data:
@@ -54,3 +58,21 @@ outputs:
         manila::debug: {get_param: Debug}
         manila::db::database_db_max_retries: -1
         manila::db::database_max_retries: -1
+        manila::sql_connection:
+          list_join:
+          - ''
+          - - {get_param: [EndpointMap, MysqlInternal, protocol]}
+            - '://manila:'
+            - {get_param: ManilaPassword}
+            - '@'
+            - {get_param: [EndpointMap, MysqlInternal, host]}
+            - '/manila'
+      service_config_settings:
+        mysql:
+          manila::db::mysql::password: {get_param: ManilaPassword}
+          manila::db::mysql::user: manila
+          manila::db::mysql::host: {get_param: [EndpointMap, MysqlInternal, host_nobrackets]}
+          manila::db::mysql::dbname: manila
+          manila::db::mysql::allowed_hosts:
+            - '%'
+            - "%{hiera('mysql_bind_host')}"
diff --git a/puppet/services/manila-scheduler.yaml b/puppet/services/manila-scheduler.yaml
index 474cc24f..d96b677b 100644
--- a/puppet/services/manila-scheduler.yaml
+++ b/puppet/services/manila-scheduler.yaml
@@ -57,14 +57,5 @@ outputs:
             manila::network::neutron::neutron_url: {get_param: [EndpointMap, NeutronInternal, uri]}
             manila::network::neutron::neutron_admin_auth_url: {get_param: [EndpointMap, NeutronAdmin, uri]}
             manila::network::neutron::neutron_admin_password: {get_param: NeutronPassword}
-            manila::sql_connection:
-                list_join:
-                - ''
-                - - {get_param: [EndpointMap, MysqlInternal, protocol]}
-                  - '://manila:'
-                  - {get_param: ManilaPassword}
-                  - '@'
-                  - {get_param: [EndpointMap, MysqlInternal, host]}
-                  - '/manila'
       step_config: |
         include ::tripleo::profile::base::manila::scheduler
diff --git a/puppet/services/manila-share.yaml b/puppet/services/manila-share.yaml
index e42d2fae..49c69fc1 100644
--- a/puppet/services/manila-share.yaml
+++ b/puppet/services/manila-share.yaml
@@ -21,6 +21,10 @@ parameters:
   MonitoringSubscriptionManilaShare:
     default: 'overcloud-manila-share'
     type: string
+  ManilaPassword:
+    description: The password for the manila service account.
+    type: string
+    hidden: true
 
 resources:
   ManilaBase:
@@ -40,5 +44,11 @@ outputs:
         map_merge:
           - get_attr: [ManilaBase, role_data, config_settings]
           - manila::volume::cinder::cinder_admin_tenant_name: 'service'
+            manila::keystone::authtoken::password: {get_param: ManilaPassword}
+            manila::keystone::authtoken::auth_uri: {get_param: [EndpointMap, KeystoneInternal, uri]}
+            manila::keystone::authtoken::auth_url: { get_param: [EndpointMap, KeystoneAdmin, uri_no_suffix] }
+            manila::keystone::authtoken::project_name: 'service'
+      service_config_settings:
+        get_attr: [ManilaBase, role_data, service_config_settings]
       step_config: |
         include ::tripleo::profile::base::manila::share
diff --git a/puppet/services/nova-api.yaml b/puppet/services/nova-api.yaml
index bf479437..3cc238c1 100644
--- a/puppet/services/nova-api.yaml
+++ b/puppet/services/nova-api.yaml
@@ -88,8 +88,6 @@ outputs:
           tripleo.nova_api.firewall_rules:
             '113 nova_api':
               dport:
-                - 6080
-                - 13080
                 - 8773
                 - 3773
                 - 8774
diff --git a/puppet/services/nova-libvirt.yaml b/puppet/services/nova-libvirt.yaml
index 31732580..70774bac 100644
--- a/puppet/services/nova-libvirt.yaml
+++ b/puppet/services/nova-libvirt.yaml
@@ -54,6 +54,9 @@ outputs:
               '200 nova_libvirt':
                 dport:
                   - 16509
+                  - 16514
+                  - '49152-49215'
+                  - '5900-5999'
 
       step_config: |
         include tripleo::profile::base::nova::libvirt
diff --git a/puppet/services/nova-scheduler.yaml b/puppet/services/nova-scheduler.yaml
index d89e3e11..d4e5fff6 100644
--- a/puppet/services/nova-scheduler.yaml
+++ b/puppet/services/nova-scheduler.yaml
@@ -58,7 +58,7 @@ outputs:
       config_settings:
         map_merge:
           - get_attr: [NovaBase, role_data, config_settings]
-          - nova::scheduler::filter::ram_allocation_ratio: '1.0'
+          - nova::ram_allocation_ratio: '1.0'
             nova::scheduler::filter::scheduler_available_filters: {get_param: NovaSchedulerAvailableFilters}
             nova::scheduler::filter::scheduler_default_filters: {get_param: NovaSchedulerDefaultFilters}
       step_config: |
diff --git a/puppet/services/nova-vnc-proxy.yaml b/puppet/services/nova-vnc-proxy.yaml
index 85d59ae6..e6b0703f 100644
--- a/puppet/services/nova-vnc-proxy.yaml
+++ b/puppet/services/nova-vnc-proxy.yaml
@@ -57,5 +57,10 @@ outputs:
             # internal_api_uri -> [IP]
             # internal_api_subnet - > IP/CIDR
             nova::vncproxy::host: {get_param: [ServiceNetMap, NovaApiNetwork]}
+            tripleo.nova_vnc_proxy.firewall_rules:
+              '137 nova_vnc_proxy':
+                dport:
+                  - 6080
+                  - 13080
       step_config: |
         include tripleo::profile::base::nova::vncproxy
diff --git a/puppet/services/swift-proxy.yaml b/puppet/services/swift-proxy.yaml
index 35e21181..ae265448 100644
--- a/puppet/services/swift-proxy.yaml
+++ b/puppet/services/swift-proxy.yaml
@@ -74,7 +74,6 @@ outputs:
             swift::proxy::authtoken::project_name: 'service'
             swift::proxy::node_timeout: {get_param: SwiftProxyNodeTimeout}
             swift::proxy::workers: {get_param: SwiftWorkers}
-            swift::proxy::ceilometer::rabbit_host: {get_param: [ServiceNetMap, RabbitmqNetwork]}
             swift::proxy::ceilometer::rabbit_user: {get_param: RabbitUserName}
             swift::proxy::ceilometer::rabbit_password: {get_param: RabbitPassword}
             tripleo.swift_proxy.firewall_rules:
diff --git a/puppet/services/swift-ringbuilder.yaml b/puppet/services/swift-ringbuilder.yaml
index 8ed4e9f4..5c70b6ab 100644
--- a/puppet/services/swift-ringbuilder.yaml
+++ b/puppet/services/swift-ringbuilder.yaml
@@ -38,7 +38,10 @@ parameters:
     default: {}
     description: 'A hash of additional raw devices to use as Swift backend (eg. {sdb: {}})'
     type: json
-
+  SwiftUseLocalDir:
+    default: true
+    description: 'Use a local directory for Swift storage services when building rings'
+    type: boolean
 
 outputs:
   role_data:
@@ -56,7 +59,7 @@ outputs:
             expression: $.data.raw_disk_lists.flatten()
             data:
               raw_disk_lists:
-              - [':%PORT%/d1']
+              - {if: [{get_param: SwiftUseLocalDir}, [':%PORT%/d1'], []]}
               - repeat:
                   template: ':%PORT%/DEVICE'
                   for_each: