15 files changed, 117 insertions, 25 deletions
diff --git a/puppet/extraconfig/pre_deploy/compute/neutron-ml2-bigswitch.yaml b/puppet/extraconfig/pre_deploy/compute/neutron-ml2-bigswitch.yaml
index 533c0ee9..e3f4cce6 100644
--- a/puppet/extraconfig/pre_deploy/compute/neutron-ml2-bigswitch.yaml
+++ b/puppet/extraconfig/pre_deploy/compute/neutron-ml2-bigswitch.yaml
@@ -27,6 +27,15 @@ resources:
             mapped_data:
               neutron::agents::bigswitch::agent_enabled: {get_input: neutron_enable_bigswitch_agent}
               neutron::agents::bigswitch::lldp_enabled: {get_input: neutron_enable_bigswitch_lldp}
+              # NOTE(aschultz): required for the puppet module but we don't
+              # actually want them defined on the compute nodes so we're
+              # relying on the puppet  module's handling of <SERVICE DEFAULT>
+              # to just not set these but still accept that they were defined.
+              # This will should be fixed in puppet-neutron and removed here,
+              # but for backportability, we need to define something.
+              neutron::plugins::ml2::bigswitch::restproxy::servers: '<SERVICE DEFAULT>'
+              neutron::plugins::ml2::bigswitch::restproxy::server_auth: '<SERVICE DEFAULT>'
+
 
   NeutronBigswitchDeployment:
     type: OS::Heat::StructuredDeployment
diff --git a/puppet/extraconfig/pre_deploy/controller/neutron-ml2-bigswitch.yaml b/puppet/extraconfig/pre_deploy/controller/neutron-ml2-bigswitch.yaml
index 1456337f..e7d0b830 100644
--- a/puppet/extraconfig/pre_deploy/controller/neutron-ml2-bigswitch.yaml
+++ b/puppet/extraconfig/pre_deploy/controller/neutron-ml2-bigswitch.yaml
@@ -6,6 +6,14 @@ parameters:
   server:
     description: ID of the controller node to apply this config to
     type: string
+  NeutronBigswitchAgentEnabled:
+    description: The state of the neutron-bsn-agent service.
+    type: boolean
+    default: true
+  NeutronBigswitchLLDPEnabled:
+    description: The state of the neutron-bsn-lldp service.
+    type: boolean
+    default: false
   NeutronBigswitchRestproxyServers:
     description: 'Big Switch controllers ("IP:port,IP:port")'
     type: string
@@ -43,6 +51,8 @@ resources:
         datafiles:
           neutron_bigswitch_data:
             mapped_data:
+              neutron::agents::bigswitch::agent_enabled: {get_input: neutron_enable_bigswitch_agent}
+              neutron::agents::bigswitch::lldp_enabled: {get_input: neutron_enable_bigswitch_lldp}
               neutron::plugins::ml2::bigswitch::restproxy::servers: {get_input: restproxy_servers}
               neutron::plugins::ml2::bigswitch::restproxy::server_auth: {get_input: restproxy_server_auth}
               neutron::plugins::ml2::bigswitch::restproxy::auto_sync_on_failure: {get_input: restproxy_auto_sync_on_failure}
@@ -58,6 +68,8 @@ resources:
       config: {get_resource: NeutronBigswitchConfig}
       server: {get_param: server}
       input_values:
+        neutron_enable_bigswitch_agent: {get_param: NeutronBigswitchAgentEnabled}
+        neutron_enable_bigswitch_lldp: {get_param: NeutronBigswitchLLDPEnabled}
         restproxy_servers: {get_param: NeutronBigswitchRestproxyServers}
         restproxy_server_auth: {get_param: NeutronBigswitchRestproxyServerAuth }
         restproxy_auto_sync_on_failure: {get_param: NeutronBigswitchRestproxyAutoSyncOnFailure}
diff --git a/puppet/major_upgrade_steps.j2.yaml b/puppet/major_upgrade_steps.j2.yaml
index 6f2dd684..5aba90e8 100644
--- a/puppet/major_upgrade_steps.j2.yaml
+++ b/puppet/major_upgrade_steps.j2.yaml
@@ -65,18 +65,21 @@ resources:
           - "  crudini --set /etc/nova/nova.conf placement project_domain_name Default\n\n"
           - "  crudini --set /etc/nova/nova.conf placement user_domain_name Default\n\n"
           - "  crudini --set /etc/nova/nova.conf placement project_name service\n\n"
-          - "  systemctl restart openstack-nova-compute\n\n"
-          - "fi\n\n"
           - str_replace:
               template: |
                 crudini --set /etc/nova/nova.conf placement password 'SERVICE_PASSWORD'
                 crudini --set /etc/nova/nova.conf placement region_name 'REGION_NAME'
                 crudini --set /etc/nova/nova.conf placement auth_url 'AUTH_URL'
-                ROLE='ROLE_NAME'
               params:
                 SERVICE_PASSWORD: { get_param: NovaPassword }
                 REGION_NAME: { get_param: KeystoneRegion }
                 AUTH_URL: { get_param: [EndpointMap, KeystoneAdmin, uri_no_suffix]}
+          - "  systemctl restart openstack-nova-compute\n\n"
+          - "fi\n\n"
+          - str_replace:
+              template: |
+                ROLE='ROLE_NAME'
+              params:
                 ROLE_NAME: {{role.name}}
           - get_file: ../extraconfig/tasks/pacemaker_common_functions.sh
           - get_file: ../extraconfig/tasks/run_puppet.sh
diff --git a/puppet/services/ceilometer-base.yaml b/puppet/services/ceilometer-base.yaml
index 874c6893..8cf1166a 100644
--- a/puppet/services/ceilometer-base.yaml
+++ b/puppet/services/ceilometer-base.yaml
@@ -37,7 +37,7 @@ parameters:
     constraints:
     - allowed_values: ['gnocchi', 'database']
   CeilometerEventDispatcher:
-    default: ['gnocchi']
+    default: ['panko', 'gnocchi']
     description: Comma-separated list of Dispatchers to process events data
     type: comma_delimited_list
     constraints:
diff --git a/puppet/services/cinder-volume.yaml b/puppet/services/cinder-volume.yaml
index b52955ef..26f1a96f 100644
--- a/puppet/services/cinder-volume.yaml
+++ b/puppet/services/cinder-volume.yaml
@@ -94,11 +94,7 @@ outputs:
             tripleo::profile::base::cinder::volume::cinder_enable_nfs_backend: {get_param: CinderEnableNfsBackend}
             tripleo::profile::base::cinder::volume::cinder_enable_rbd_backend: {get_param: CinderEnableRbdBackend}
             tripleo::profile::base::cinder::volume::nfs::cinder_nfs_mount_options: {get_param: CinderNfsMountOptions}
-            tripleo::profile::base::cinder::volume::nfs::cinder_nfs_servers:
-              str_replace:
-                template: SERVERS
-                params:
-                  SERVERS: {get_param: CinderNfsServers}
+            tripleo::profile::base::cinder::volume::nfs::cinder_nfs_servers: {get_param: CinderNfsServers}
             tripleo::profile::base::cinder::volume::iscsi::cinder_lvm_loop_device_size: {get_param: CinderLVMLoopDeviceSize}
             tripleo::profile::base::cinder::volume::iscsi::cinder_iscsi_helper: {get_param: CinderISCSIHelper}
             tripleo::profile::base::cinder::volume::iscsi::cinder_iscsi_protocol: {get_param: CinderISCSIProtocol}
diff --git a/puppet/services/database/mysql.yaml b/puppet/services/database/mysql.yaml
index 808f1353..7078b60f 100644
--- a/puppet/services/database/mysql.yaml
+++ b/puppet/services/database/mysql.yaml
@@ -23,6 +23,10 @@ parameters:
     description: Configures MySQL max_connections config setting
     type: number
     default: 4096
+  MysqlIncreaseFileLimit:
+    description: Flag to increase MySQL open-files-limit to 16384
+    type: boolean
+    default: true
   MysqlRootPassword:
     type: string
     hidden: true
@@ -96,6 +100,8 @@ outputs:
                   $NETWORK: {get_param: [ServiceNetMap, MysqlNetwork]}
             tripleo::profile::base::database::mysql::client_bind_address:
               {get_param: [ServiceNetMap, MysqlNetwork]}
+            tripleo::profile::base::database::mysql::generate_dropin_file_limit:
+              {get_param: MysqlIncreaseFileLimit}
       step_config: |
         include ::tripleo::profile::base::database::mysql
       metadata_settings:
diff --git a/puppet/services/neutron-base.yaml b/puppet/services/neutron-base.yaml
index 43657bd9..d0176781 100644
--- a/puppet/services/neutron-base.yaml
+++ b/puppet/services/neutron-base.yaml
@@ -44,10 +44,10 @@ parameters:
     description: Set to True to enable debugging on all services.
   EnableConfigPurge:
     type: boolean
-    default: true
+    default: false
     description: >
-        Remove configuration that is not generated by TripleO. Setting
-        to false may result in configuration remnants after updates/upgrades.
+        Remove configuration that is not generated by TripleO. Used to avoid
+        configuration remnants after upgrades.
   NeutronGlobalPhysnetMtu:
     type: number
     default: 1500
diff --git a/puppet/services/neutron-bigswitch-agent.yaml b/puppet/services/neutron-bigswitch-agent.yaml
new file mode 100644
index 00000000..845f0da0
--- /dev/null
+++ b/puppet/services/neutron-bigswitch-agent.yaml
@@ -0,0 +1,31 @@
+heat_template_version: ocata
+
+description: >
+  Installs bigswitch agent and enables the services
+
+parameters:
+  ServiceNetMap:
+    default: {}
+    description: Mapping of service_name -> network name. Typically set
+                 via parameter_defaults in the resource registry.  This
+                 mapping overrides those in ServiceNetMapDefaults.
+    type: json
+  DefaultPasswords:
+    default: {}
+    type: json
+  EndpointMap:
+    default: {}
+    description: Mapping of service endpoint -> protocol. Typically set
+                 via parameter_defaults in the resource registry.
+    type: json
+
+
+outputs:
+  role_data:
+    description: Configure the bigswitch agent services
+    value:
+      service_name: neutron_bigswitch_agent
+      step_config: |
+        if hiera('step') >= 4 {
+          include ::neutron::agents::bigswitch
+        }
diff --git a/puppet/services/neutron-ovs-dpdk-agent.yaml b/puppet/services/neutron-ovs-dpdk-agent.yaml
index e25bc495..2c7ab57c 100644
--- a/puppet/services/neutron-ovs-dpdk-agent.yaml
+++ b/puppet/services/neutron-ovs-dpdk-agent.yaml
@@ -69,7 +69,10 @@ outputs:
       service_name: neutron_ovs_dpdk_agent
       config_settings:
         map_merge:
-          - get_attr: [NeutronOvsAgent, role_data, config_settings]
+          - map_replace:
+            - get_attr: [NeutronOvsAgent, role_data, config_settings]
+            - keys:
+                tripleo.neutron_ovs_agent.firewall_rules: tripleo.neutron_ovs_dpdk_agent.firewall_rules
           - neutron::agents::ml2::ovs::enable_dpdk: true
             neutron::agents::ml2::ovs::datapath_type: {get_param: NeutronDatapathType}
             neutron::agents::ml2::ovs::vhostuser_socket_dir: {get_param: NeutronVhostuserSocketDir}
diff --git a/puppet/services/nova-api.yaml b/puppet/services/nova-api.yaml
index f27b53f2..678e09b6 100644
--- a/puppet/services/nova-api.yaml
+++ b/puppet/services/nova-api.yaml
@@ -225,7 +225,7 @@ outputs:
         - name: Setup cell_v2 (map cell0)
           tags: step5
           when: is_bootstrap_node
-          command: nova-manage cell_v2 map_cell0
+          shell: nova-manage cell_v2 map_cell0 --database_connection=$(hiera nova::cell0_database_connection)
         - name: Setup cell_v2 (create default cell)
           tags: step5
           when: is_bootstrap_node
@@ -241,15 +241,15 @@ outputs:
           command: nova-manage db sync
           async: {get_param: NovaDbSyncTimeout}
           poll: 10
-        - name: Setup cell_v2 (migrate hosts)
-          tags: step5
-          when: is_bootstrap_node
-          command: nova-manage cell_v2 map_cell_and_hosts
         - name: Setup cell_v2 (get cell uuid)
           tags: step5
           when: is_bootstrap_node
           shell: nova-manage cell_v2 list_cells | sed -e '1,3d' -e '$d' | awk -F ' *| *' '$2 == "default" {print $4}'
           register: nova_api_cell_uuid
+        - name: Setup cell_v2 (migrate hosts)
+          tags: step5
+          when: is_bootstrap_node
+          command: nova-manage cell_v2 discover_hosts --cell_uuid {{nova_api_cell_uuid.stdout}} --verbose
         - name: Setup cell_v2 (migrate instances)
           tags: step5
           when: is_bootstrap_node
diff --git a/puppet/services/nova-base.yaml b/puppet/services/nova-base.yaml
index ceacb0b2..7b568e9e 100644
--- a/puppet/services/nova-base.yaml
+++ b/puppet/services/nova-base.yaml
@@ -58,10 +58,10 @@ parameters:
     description: Set to True to enable debugging on all services.
   EnableConfigPurge:
     type: boolean
-    default: true
+    default: false
     description: >
-        Remove configuration that is not generated by TripleO. Setting
-        to false may result in configuration remnants after updates/upgrades.
+        Remove configuration that is not generated by TripleO. Used to avoid
+        configuration remnants after upgrades.
   NovaIPv6:
     default: false
     description: Enable IPv6 features in Nova
@@ -151,6 +151,16 @@ outputs:
                 - {get_param: [EndpointMap, MysqlInternal, host]}
                 - '/nova'
                 - '?read_default_file=/etc/my.cnf.d/tripleo.cnf&read_default_group=tripleo'
+          nova::cell0_database_connection:
+            list_join:
+              - ''
+              - - {get_param: [EndpointMap, MysqlInternal, protocol]}
+                - '://nova:'
+                - {get_param: NovaPassword}
+                - '@'
+                - {get_param: [EndpointMap, MysqlInternal, host]}
+                - '/nova_cell0'
+                - '?read_default_file=/etc/my.cnf.d/tripleo.cnf&read_default_group=tripleo'
           nova::api_database_connection:
             list_join:
               - ''
diff --git a/puppet/services/nova-ironic.yaml b/puppet/services/nova-ironic.yaml
index 5eb2170a..5fc77f07 100644
--- a/puppet/services/nova-ironic.yaml
+++ b/puppet/services/nova-ironic.yaml
@@ -51,3 +51,7 @@ outputs:
             nova::scheduler::filter::scheduler_host_manager: 'ironic_host_manager'
       step_config: |
         include tripleo::profile::base::nova::compute::ironic
+      upgrade_tasks:
+        - name: Stop openstack-nova-compute service
+          tags: step1
+          service: name=openstack-nova-compute state=stopped enabled=no
diff --git a/puppet/services/octavia-base.yaml b/puppet/services/octavia-base.yaml
index b537a2bc..f3aa1d64 100644
--- a/puppet/services/octavia-base.yaml
+++ b/puppet/services/octavia-base.yaml
@@ -24,10 +24,10 @@ parameters:
     description: Set to True to enable debugging on all services.
   EnableConfigPurge:
     type: boolean
-    default: true
+    default: false
     description: >
-        Remove configuration that is not generated by TripleO. Setting
-        to false may result in configuration remnants after updates/upgrades.
+        Remove configuration that is not generated by TripleO. Used to avoid
+        configuration remnants after upgrades.
   RabbitPassword:
     description: The password for RabbitMQ
     type: string
diff --git a/puppet/services/pacemaker.yaml b/puppet/services/pacemaker.yaml
index 762d0092..28fcbd6f 100644
--- a/puppet/services/pacemaker.yaml
+++ b/puppet/services/pacemaker.yaml
@@ -87,10 +87,16 @@ parameters:
         \[(?<pid>[^ ]*)\]
         (?<host>[^ ]*)
         (?<message>.*)$/
+
+  EnableLoadBalancer:
+    default: true
+    description: Whether to deploy a LoadBalancer on the Controller
+    type: boolean
+
   PacemakerResources:
     type: comma_delimited_list
     description: List of resources managed by pacemaker
-    default: ['rabbitmq','haproxy','galera']
+    default: ['rabbitmq', 'galera']
 
 outputs:
   role_data:
@@ -147,3 +153,9 @@ outputs:
             resource: "{{ item }}"
             max_wait: 500
           with_items: {get_param: PacemakerResources}
+        - name: Check pacemaker haproxy resource
+          tags: step4
+          pacemaker_is_active:
+            resource: haproxy
+            max_wait: 500
+          when: {get_param: EnableLoadBalancer}
diff --git a/puppet/services/tripleo-firewall.yaml b/puppet/services/tripleo-firewall.yaml
index 67e14d9c..ff2b067f 100644
--- a/puppet/services/tripleo-firewall.yaml
+++ b/puppet/services/tripleo-firewall.yaml
@@ -37,3 +37,9 @@ outputs:
         tripleo::firewall::purge_firewall_rules: {get_param: PurgeFirewallRules}
       step_config: |
         include ::tripleo::firewall
+      upgrade_tasks:
+        - name: blank ipv6 rule before activating ipv6 firewall.
+          tags: step3
+          shell: cat /etc/sysconfig/ip6tables > /etc/sysconfig/ip6tables.n-o-upgrade; cat</dev/null>/etc/sysconfig/ip6tables
+          args:
+            creates: /etc/sysconfig/ip6tables.n-o-upgrade