diff options
Diffstat (limited to 'puppet')
| -rw-r--r-- | puppet/major_upgrade_steps.j2.yaml | 78 | ||||
| -rw-r--r-- | puppet/services/ceilometer-base.yaml | 10 | ||||
| -rw-r--r-- | puppet/services/ceilometer-collector.yaml | 13 | ||||
| -rw-r--r-- | puppet/services/database/mysql-client.yaml | 6 | ||||
| -rw-r--r-- | puppet/services/gnocchi-base.yaml | 5 | ||||
| -rw-r--r-- | puppet/services/nova-compute.yaml | 5 | ||||
| -rw-r--r-- | puppet/services/nova-libvirt.yaml | 25 | ||||
| -rw-r--r-- | puppet/services/snmp.yaml | 5 |
8 files changed, 113 insertions, 34 deletions
diff --git a/puppet/major_upgrade_steps.j2.yaml b/puppet/major_upgrade_steps.j2.yaml index 28092773..d07da568 100644 --- a/puppet/major_upgrade_steps.j2.yaml +++ b/puppet/major_upgrade_steps.j2.yaml @@ -32,6 +32,20 @@ parameters: type: string hidden: true +conditions: + # Conditions to disable any steps where the task list is empty + {%- for role in roles %} + {{role.name}}UpgradeBatchConfigEnabled: + not: + equals: + - {get_param: [role_data, {{role.name}}, upgrade_batch_tasks]} + - [] + {{role.name}}UpgradeConfigEnabled: + not: + equals: + - {get_param: [role_data, {{role.name}}, upgrade_tasks]} + - [] + {%- endfor %} resources: @@ -89,22 +103,23 @@ resources: {%- for role in roles %} {{role.name}}UpgradeBatchConfig_Step{{step}}: type: OS::TripleO::UpgradeConfig - {%- if step > 0 %} - {%- if role in enabled_roles %} + condition: {{role.name}}UpgradeBatchConfigEnabled + {%- if step > 0 %} depends_on: - - {{role.name}}UpgradeBatch_Step{{step -1}} - {%- endif %} - {%- else %} + {%- for role_inside in enabled_roles %} + - {{role_inside.name}}UpgradeBatch_Step{{step -1}} + {%- endfor %} + {% else %} {% for role in roles if role.disable_upgrade_deployment|default(false) %} {% if deliver_script.update({'deliver': True}) %} {% endif %} {% endfor %} {% if deliver_script.deliver %} depends_on: - {% endif %} {% for dep in roles if dep.disable_upgrade_deployment|default(false) %} - {{dep.name}}DeliverUpgradeScriptDeployment {% endfor %} - {% endif %} + {% endif %} + {% endif %} properties: UpgradeStepConfig: {get_param: [role_data, {{role.name}}, upgrade_batch_tasks]} step: {{step}} @@ -114,19 +129,29 @@ resources: {%- for role in enabled_roles %} {{role.name}}UpgradeBatch_Step{{step}}: type: OS::Heat::SoftwareDeploymentGroup + condition: {{role.name}}UpgradeBatchConfigEnabled {%- if step > 0 %} depends_on: {%- for role_inside in enabled_roles %} - {{role_inside.name}}UpgradeBatch_Step{{step -1}} {%- endfor %} - {%- endif %} + {% else %} + {% for role in roles if role.disable_upgrade_deployment|default(false) %} + {% if deliver_script.update({'deliver': True}) %} {% endif %} + {% endfor %} + {% if deliver_script.deliver %} + depends_on: + {% for dep in roles if dep.disable_upgrade_deployment|default(false) %} + - {{dep.name}}DeliverUpgradeScriptDeployment + {% endfor %} + {% endif %} + {% endif %} update_policy: batch_create: max_batch_size: {{role.upgrade_batch_size|default(1)}} rolling_update: max_batch_size: {{role.upgrade_batch_size|default(1)}} properties: - name: {{role.name}}UpgradeBatch_Step{{step}} servers: {get_param: [servers, {{role.name}}]} config: {get_resource: {{role.name}}UpgradeBatchConfig_Step{{step}}} input_values: @@ -167,16 +192,19 @@ resources: {%- for role in roles %} {{role.name}}UpgradeConfig_Step{{step}}: type: OS::TripleO::UpgradeConfig - # The UpgradeConfig resources could actually be created without - # serialization, but the event output is easier to follow if we - # do, and there should be minimal performance hit (creating the - # config is cheap compared to the time to apply the deployment). - {%- if step > 0 %} - {%- if role in enabled_roles %} + condition: {{role.name}}UpgradeConfigEnabled + # The UpgradeConfig resources could actually be created without + # serialization, but the event output is easier to follow if we + # do, and there should be minimal performance hit (creating the + # config is cheap compared to the time to apply the deployment). depends_on: - - {{role.name}}Upgrade_Step{{step -1}} - {%- endif %} - {%- endif %} + {%- for role_inside in enabled_roles %} + {%- if step > 0 %} + - {{role_inside.name}}Upgrade_Step{{step -1}} + {%- else %} + - {{role_inside.name}}UpgradeBatch_Step{{batch_upgrade_steps_max -1}} + {%- endif %} + {%- endfor %} properties: UpgradeStepConfig: {get_param: [role_data, {{role.name}}, upgrade_tasks]} step: {{step}} @@ -186,22 +214,16 @@ resources: {%- for role in enabled_roles %} {{role.name}}Upgrade_Step{{step}}: type: OS::Heat::SoftwareDeploymentGroup - {%- if step > 0 %} - # Make sure we wait that all roles have finished their own - # previous step before going to the next, so we can guarantee - # state for each steps. + condition: {{role.name}}UpgradeConfigEnabled depends_on: {%- for role_inside in enabled_roles %} + {%- if step > 0 %} - {{role_inside.name}}Upgrade_Step{{step -1}} - {%- endfor %} - {%- else %} - depends_on: - {%- for role_inside in enabled_roles %} + {%- else %} - {{role_inside.name}}UpgradeBatch_Step{{batch_upgrade_steps_max -1}} + {%- endif %} {%- endfor %} - {%- endif %} properties: - name: {{role.name}}Upgrade_Step{{step}} servers: {get_param: [servers, {{role.name}}]} config: {get_resource: {{role.name}}UpgradeConfig_Step{{step}}} input_values: diff --git a/puppet/services/ceilometer-base.yaml b/puppet/services/ceilometer-base.yaml index 761e6bd6..6e909097 100644 --- a/puppet/services/ceilometer-base.yaml +++ b/puppet/services/ceilometer-base.yaml @@ -65,6 +65,14 @@ parameters: description: Whether to create or skip API endpoint. Set this to false, if you choose to disable Ceilometer API service. type: boolean + SnmpdReadonlyUserName: + default: ro_snmp_user + description: The user name for SNMPd with readonly rights running on all Overcloud nodes + type: string + SnmpdReadonlyUserPassword: + description: The user password for SNMPd with readonly rights running on all Overcloud nodes + type: string + hidden: true outputs: role_data: @@ -97,6 +105,8 @@ outputs: ceilometer::rabbit_port: {get_param: RabbitClientPort} ceilometer::rabbit_heartbeat_timeout_threshold: 60 ceilometer::telemetry_secret: {get_param: CeilometerMeteringSecret} + ceilometer::snmpd_readonly_username: {get_param: SnmpdReadonlyUserName} + ceilometer::snmpd_readonly_user_password: {get_param: SnmpdReadonlyUserPassword} service_config_settings: keystone: ceilometer_auth_enabled: true diff --git a/puppet/services/ceilometer-collector.yaml b/puppet/services/ceilometer-collector.yaml index dfc844be..111b3e8b 100644 --- a/puppet/services/ceilometer-collector.yaml +++ b/puppet/services/ceilometer-collector.yaml @@ -51,7 +51,16 @@ parameters: type: comma_delimited_list constraints: - allowed_values: ['panko', 'gnocchi', 'database'] - + CeilometerEventTTL: + default: '86400' + description: Number of seconds that events are kept in the database for + (<= 0 means forever) + type: string + CeilometerMeteringTTL: + default: '86400' + description: Number of seconds that samples are kept in the database for + (<= 0 means forever) + type: string resources: CeilometerServiceBase: type: ./ceilometer-base.yaml @@ -91,6 +100,8 @@ outputs: - '/ceilometer' - '?read_default_file=/etc/my.cnf.d/tripleo.cnf&read_default_group=tripleo' ceilometer_backend: {get_param: CeilometerBackend} + ceilometer::event_time_to_live: {get_param: CeilometerEventTTL} + ceilometer::metering_time_to_live: {get_param: CeilometerMeteringTTL} # we include db_sync class in puppet-tripleo ceilometer::db::sync_db: false ceilometer::db::database_db_max_retries: -1 diff --git a/puppet/services/database/mysql-client.yaml b/puppet/services/database/mysql-client.yaml index 78456e28..b6bd060e 100644 --- a/puppet/services/database/mysql-client.yaml +++ b/puppet/services/database/mysql-client.yaml @@ -21,6 +21,11 @@ parameters: EnableInternalTLS: type: boolean default: false + InternalTLSCAFile: + default: '/etc/ipa/ca.crt' + type: string + description: Specifies the default CA cert to use if TLS is used for + services in the internal network. outputs: role_data: @@ -30,5 +35,6 @@ outputs: config_settings: tripleo::profile::base::database::mysql::client::mysql_client_bind_address: {get_param: [ServiceNetMap, MysqlNetwork]} tripleo::profile::base::database::mysql::client::enable_ssl: {get_param: EnableInternalTLS} + tripleo::profile::base::database::mysql::client::ssl_ca: {get_param: InternalTLSCAFile} step_config: | include ::tripleo::profile::base::database::mysql::client diff --git a/puppet/services/gnocchi-base.yaml b/puppet/services/gnocchi-base.yaml index dc6daece..24f4157b 100644 --- a/puppet/services/gnocchi-base.yaml +++ b/puppet/services/gnocchi-base.yaml @@ -22,6 +22,10 @@ parameters: default: 'mysql' description: The short name of the Gnocchi indexer backend to use. type: string + MetricProcessingDelay: + default: 60 + description: Delay between processing metrics. + type: number GnocchiPassword: description: The password for the gnocchi service and db account. type: string @@ -65,6 +69,7 @@ outputs: - '/gnocchi' - '?read_default_file=/etc/my.cnf.d/tripleo.cnf&read_default_group=tripleo' gnocchi::db::sync::extra_opts: '--skip-storage' + gnocchi::storage::metric_processing_delay: {get_param: MetricProcessingDelay} gnocchi::storage::swift::swift_user: 'service:gnocchi' gnocchi::storage::swift::swift_auth_version: 3 gnocchi::storage::swift::swift_key: {get_param: GnocchiPassword} diff --git a/puppet/services/nova-compute.yaml b/puppet/services/nova-compute.yaml index fc80da72..52f48696 100644 --- a/puppet/services/nova-compute.yaml +++ b/puppet/services/nova-compute.yaml @@ -119,6 +119,11 @@ outputs: nova::compute::libvirt::migration_support: false tripleo::profile::base::nova::manage_migration: true tripleo::profile::base::nova::migration_ssh_key: {get_param: MigrationSshKey} + tripleo::profile::base::nova::migration_ssh_localaddrs: + - "%{hiera('cold_migration_ssh_inbound_addr')}" + - "%{hiera('live_migration_ssh_inbound_addr')}" + live_migration_ssh_inbound_addr: {get_param: [ServiceNetMap, NovaLibvirtNetwork]} + cold_migration_ssh_inbound_addr: {get_param: [ServiceNetMap, NovaColdMigrationNetwork]} tripleo::profile::base::nova::nova_compute_enabled: true nova::compute::rbd::libvirt_images_rbd_pool: {get_param: NovaRbdPoolName} nova::compute::rbd::libvirt_rbd_user: {get_param: CephClientUserName} diff --git a/puppet/services/nova-libvirt.yaml b/puppet/services/nova-libvirt.yaml index 21a5e78a..c3e6f4e4 100644 --- a/puppet/services/nova-libvirt.yaml +++ b/puppet/services/nova-libvirt.yaml @@ -41,16 +41,23 @@ parameters: description: If set to true and if EnableInternalTLS is enabled, it will set the libvirt URI's transport to tls and configure the relevant keys for libvirt. + InternalTLSCAFile: + default: '/etc/ipa/ca.crt' + type: string + description: Specifies the default CA cert to use if TLS is used for + services in the internal network. LibvirtCACert: type: string - default: '/etc/ipa/ca.crt' + default: '' description: This specifies the CA certificate to use for TLS in libvirt. This file will be symlinked to the default CA path in libvirt, which is /etc/pki/CA/cacert.pem. Note that due to limitations GNU TLS, which is the TLS backend for libvirt, the file must - be less than 65K (so we can't use the system's CA bundle). The - current default reflects TripleO's default CA, which is - FreeIPA. It will only be used if internal TLS is enabled. + be less than 65K (so we can't use the system's CA bundle). + This parameter should be used if the default (which comes from + the InternalTLSCAFile parameter) is not desired. The current + default reflects TripleO's default CA, which is FreeIPA. + It will only be used if internal TLS is enabled. conditions: @@ -63,6 +70,11 @@ conditions: - {get_param: UseTLSTransportForLiveMigration} - true + libvirt_specific_ca_unset: + equals: + - {get_param: LibvirtCACert} + - '' + resources: NovaBase: type: ./nova-base.yaml @@ -113,7 +125,10 @@ outputs: params: $NETWORK: {get_param: [ServiceNetMap, NovaLibvirtNetwork]} tripleo::certmonger::ca::libvirt::origin_ca_pem: - get_param: LibvirtCACert + if: + - libvirt_specific_ca_unset + - get_param: InternalTLSCAFile + - get_param: LibvirtCACert tripleo::certmonger::libvirt_dirs::certificate_dir: '/etc/pki/libvirt' tripleo::certmonger::libvirt_dirs::key_dir: '/etc/pki/libvirt/private' libvirt_certificates_specs: diff --git a/puppet/services/snmp.yaml b/puppet/services/snmp.yaml index 80c29f95..072ccc1a 100644 --- a/puppet/services/snmp.yaml +++ b/puppet/services/snmp.yaml @@ -28,6 +28,10 @@ parameters: description: The user password for SNMPd with readonly rights running on all Overcloud nodes type: string hidden: true + SnmpdBindHost: + description: An array of bind host addresses on which SNMP daemon will listen. + type: comma_delimited_list + default: ['udp:161','udp6:[::1]:161'] outputs: role_data: @@ -37,6 +41,7 @@ outputs: config_settings: tripleo::profile::base::snmp::snmpd_user: {get_param: SnmpdReadonlyUserName} tripleo::profile::base::snmp::snmpd_password: {get_param: SnmpdReadonlyUserPassword} + snmp::agentaddress: {get_param: SnmpdBindHost} tripleo.snmp.firewall_rules: '127 snmp': dport: 161 |