11 files changed, 87 insertions, 22 deletions
diff --git a/puppet/all-nodes-config.yaml b/puppet/all-nodes-config.yaml
index baafe03d..081ebb4c 100644
--- a/puppet/all-nodes-config.yaml
+++ b/puppet/all-nodes-config.yaml
@@ -12,10 +12,8 @@ parameters:
     type: string
   cloud_name_ctlplane:
     type: string
-  # FIXME(shardy) this can be comma_delimited_list when
-  # https://bugs.launchpad.net/heat/+bug/1617019 is fixed
   enabled_services:
-    type: string
+    type: comma_delimited_list
   controller_ips:
     type: comma_delimited_list
   logging_groups:
@@ -129,8 +127,7 @@ resources:
                       # https://bugs.launchpad.net/heat/+bug/1617203
                       SERVICE_enabled: 'true'
                     for_each:
-                      SERVICE:
-                        str_split: [',', {get_param: enabled_services}]
+                      SERVICE: {get_param: enabled_services}
               # Dynamically generate per-service network data
               # This works as follows (outer->inner functions)
               # yaql - filters services where no mapping exists in ServiceNetMap
@@ -150,8 +147,7 @@ resources:
                               template:
                                 SERVICE_network: SERVICE_network
                               for_each:
-                                SERVICE:
-                                  str_split: [',', {get_param: enabled_services}]
+                                SERVICE: {get_param: enabled_services}
                         - values: {get_param: ServiceNetMap}
               # Keystone doesn't provide separate entries for the public
               # and admin endpoints, so we need to add them here manually
@@ -203,8 +199,7 @@ resources:
                                   template:
                                     SERVICE_vip: SERVICE_network
                                   for_each:
-                                    SERVICE:
-                                      str_split: [',', {get_param: enabled_services}]
+                                    SERVICE: {get_param: enabled_services}
                             - values: {get_param: ServiceNetMap}
                         - values: {get_param: NetVipMap}
               - keystone_admin_api_vip:
diff --git a/puppet/blockstorage-role.yaml b/puppet/blockstorage-role.yaml
index 25e509b5..08bc03a5 100644
--- a/puppet/blockstorage-role.yaml
+++ b/puppet/blockstorage-role.yaml
@@ -139,6 +139,10 @@ parameters:
       Map of server hostnames to blacklist from any triggered
       deployments. If the value is 1, the server will be blacklisted. This
       parameter is generated from the parent template.
+  RoleParameters:
+    type: json
+    description: Role Specific Parameters
+    default: {}
 
 conditions:
   server_not_blacklisted:
@@ -372,6 +376,7 @@ resources:
     type: OS::TripleO::BlockStorage::PreNetworkConfig
     properties:
       server: {get_resource: BlockStorage}
+      RoleParameters: {get_param: RoleParameters}
 
   NetworkDeployment:
     type: OS::TripleO::SoftwareDeployment
diff --git a/puppet/cephstorage-role.yaml b/puppet/cephstorage-role.yaml
index ca89be8a..3f596423 100644
--- a/puppet/cephstorage-role.yaml
+++ b/puppet/cephstorage-role.yaml
@@ -145,6 +145,10 @@ parameters:
       Map of server hostnames to blacklist from any triggered
       deployments. If the value is 1, the server will be blacklisted. This
       parameter is generated from the parent template.
+  RoleParameters:
+    type: json
+    description: Role Specific Parameters
+    default: {}
 
 conditions:
   server_not_blacklisted:
@@ -378,6 +382,7 @@ resources:
     type: OS::TripleO::CephStorage::PreNetworkConfig
     properties:
       server: {get_resource: CephStorage}
+      RoleParameters: {get_param: RoleParameters}
 
   NetworkDeployment:
     type: OS::TripleO::SoftwareDeployment
diff --git a/puppet/compute-role.yaml b/puppet/compute-role.yaml
index abfacd36..8a3c487a 100644
--- a/puppet/compute-role.yaml
+++ b/puppet/compute-role.yaml
@@ -157,6 +157,10 @@ parameters:
       Map of server hostnames to blacklist from any triggered
       deployments. If the value is 1, the server will be blacklisted. This
       parameter is generated from the parent template.
+  RoleParameters:
+    type: json
+    description: Role Specific Parameters
+    default: {}
 
 conditions:
   server_not_blacklisted:
@@ -381,6 +385,7 @@ resources:
     type: OS::TripleO::Compute::PreNetworkConfig
     properties:
       server: {get_resource: NovaCompute}
+      RoleParameters: {get_param: RoleParameters}
 
   NetworkConfig:
     type: OS::TripleO::Compute::Net::SoftwareConfig
diff --git a/puppet/controller-role.yaml b/puppet/controller-role.yaml
index 396eda8d..6bc23669 100644
--- a/puppet/controller-role.yaml
+++ b/puppet/controller-role.yaml
@@ -171,6 +171,10 @@ parameters:
       Map of server hostnames to blacklist from any triggered
       deployments. If the value is 1, the server will be blacklisted. This
       parameter is generated from the parent template.
+  RoleParameters:
+    type: json
+    description: Role Specific Parameters
+    default: {}
 
 parameter_groups:
 - label: deprecated
@@ -401,6 +405,7 @@ resources:
     type: OS::TripleO::Controller::PreNetworkConfig
     properties:
       server: {get_resource: Controller}
+      RoleParameters: {get_param: RoleParameters}
 
   NetworkConfig:
     type: OS::TripleO::Controller::Net::SoftwareConfig
diff --git a/puppet/objectstorage-role.yaml b/puppet/objectstorage-role.yaml
index 42b1a78a..c35bb250 100644
--- a/puppet/objectstorage-role.yaml
+++ b/puppet/objectstorage-role.yaml
@@ -139,6 +139,10 @@ parameters:
       Map of server hostnames to blacklist from any triggered
       deployments. If the value is 1, the server will be blacklisted. This
       parameter is generated from the parent template.
+  RoleParameters:
+    type: json
+    description: Role Specific Parameters
+    default: {}
 
 conditions:
   server_not_blacklisted:
@@ -372,6 +376,7 @@ resources:
     type: OS::TripleO::ObjectStorage::PreNetworkConfig
     properties:
       server: {get_resource: SwiftStorage}
+      RoleParameters: {get_param: RoleParameters}
 
   NetworkDeployment:
     type: OS::TripleO::SoftwareDeployment
diff --git a/puppet/role.role.j2.yaml b/puppet/role.role.j2.yaml
index 409b0a33..b7f47594 100644
--- a/puppet/role.role.j2.yaml
+++ b/puppet/role.role.j2.yaml
@@ -161,6 +161,10 @@ parameters:
       Map of server hostnames to blacklist from any triggered
       deployments. If the value is 1, the server will be blacklisted. This
       parameter is generated from the parent template.
+  RoleParameters:
+    type: json
+    description: Role Specific Parameters
+    default: {}
 
 conditions:
   server_not_blacklisted:
@@ -394,6 +398,7 @@ resources:
     type: OS::TripleO::{{role}}::PreNetworkConfig
     properties:
       server: {get_resource: {{role}}}
+      RoleParameters: {get_param: RoleParameters}
 
   NetworkDeployment:
     type: OS::TripleO::SoftwareDeployment
diff --git a/puppet/services/cinder-backend-dellsc.yaml b/puppet/services/cinder-backend-dellsc.yaml
index a201134c..c0bffb18 100644
--- a/puppet/services/cinder-backend-dellsc.yaml
+++ b/puppet/services/cinder-backend-dellsc.yaml
@@ -61,6 +61,9 @@ parameters:
   CinderDellScSecondaryScApiPort:
     type: number
     default: 3033
+  CinderDellScExcludedDomainIp:
+    type: string
+    default: ''
   ServiceNetMap:
     default: {}
     description: Mapping of service_name -> network name. Typically set
@@ -105,5 +108,6 @@ outputs:
                 cinder::backend::dellsc_iscsi::secondary_san_login: {get_param: CinderDellScSecondarySanLogin}
                 cinder::backend::dellsc_iscsi::secondary_san_password: {get_param: CinderDellScSecondarySanPassword}
                 cinder::backend::dellsc_iscsi::secondary_sc_api_port: {get_param: CinderDellScSecondaryScApiPort}
+                cinder::backend::dellsc_iscsi::excluded_domain_ip: {get_param: CinderDellScExcludedDomainIp}
       step_config: |
         include ::tripleo::profile::base::cinder::volume
diff --git a/puppet/services/keystone.yaml b/puppet/services/keystone.yaml
index f3a9cbc4..af494016 100644
--- a/puppet/services/keystone.yaml
+++ b/puppet/services/keystone.yaml
@@ -113,10 +113,23 @@ parameters:
     description: The second Keystone credential key. Must be a valid key.
   KeystoneFernetKey0:
     type: string
-    description: The first Keystone fernet key. Must be a valid key.
+    default: ''
+    description: (DEPRECATED) The first Keystone fernet key. Must be a valid key.
   KeystoneFernetKey1:
     type: string
-    description: The second Keystone fernet key. Must be a valid key.
+    default: ''
+    description: (DEPRECATED) The second Keystone fernet key. Must be a valid key.
+  KeystoneFernetKeys:
+    type: json
+    description: Mapping containing keystone's fernet keys and their paths.
+  ManageKeystoneFernetKeys:
+    type: boolean
+    default: true
+    description: Whether TripleO should manage the keystone fernet keys or not.
+                 If set to true, the fernet keys will get the values from the
+                 saved keys repository in mistral (the KeystoneFernetKeys
+                 variable). If set to false, only the stack creation
+                 initializes the keys, but subsequent updates won't touch them.
   KeystoneLoggingSource:
     type: json
     default:
@@ -187,6 +200,17 @@ parameters:
     default: {}
     hidden: true
 
+parameter_groups:
+- label: deprecated
+  description: |
+   The following parameters are deprecated and will be removed. They should not
+   be relied on for new deployments. If you have concerns regarding deprecated
+   parameters, please contact the TripleO development team on IRC or the
+   OpenStack mailing list.
+  parameters:
+  - KeystoneFernetKey0
+  - KeystoneFernetKey1
+
 resources:
 
   ApacheServiceBase:
@@ -241,12 +265,8 @@ outputs:
                 content: {get_param: KeystoneCredential0}
               '/etc/keystone/credential-keys/1':
                 content: {get_param: KeystoneCredential1}
-            keystone::fernet_keys:
-              '/etc/keystone/fernet-keys/0':
-                content: {get_param: KeystoneFernetKey0}
-              '/etc/keystone/fernet-keys/1':
-                content: {get_param: KeystoneFernetKey1}
-            keystone::fernet_replace_keys: false
+            keystone::fernet_keys: {get_param: KeystoneFernetKeys}
+            keystone::fernet_replace_keys: {get_param: ManageKeystoneFernetKeys}
             keystone::debug:
               if:
               - service_debug_unset
diff --git a/puppet/services/neutron-sriov-agent.yaml b/puppet/services/neutron-sriov-agent.yaml
index c124d1e6..090640ed 100644
--- a/puppet/services/neutron-sriov-agent.yaml
+++ b/puppet/services/neutron-sriov-agent.yaml
@@ -65,6 +65,24 @@ resources:
       RoleName: {get_param: RoleName}
       RoleParameters: {get_param: RoleParameters}
 
+  # Merging role-specific parameters (RoleParameters) with the default parameters.
+  # RoleParameters will have the precedence over the default parameters.
+  RoleParametersValue:
+    type: OS::Heat::Value
+    properties:
+      type: json
+      value:
+        map_replace:
+          - map_replace:
+            - neutron::agents::ml2::sriov::physical_device_mappings: NeutronPhysicalDevMappings
+              neutron::agents::ml2::sriov::exclude_devices: NeutronExcludeDevices
+              tripleo::host::sriov::number_of_vfs: NeutronSriovNumVFs
+            - values: {get_param: [RoleParameters]}
+          - values:
+              NeutronPhysicalDevMappings: {get_param: NeutronPhysicalDevMappings}
+              NeutronExcludeDevices: {get_param: NeutronExcludeDevices}
+              NeutronSriovNumVFs: {get_param: NeutronSriovNumVFs}
+
 outputs:
   role_data:
     description: Role data for the Neutron SR-IOV nic agent service.
@@ -73,8 +91,6 @@ outputs:
       config_settings:
         map_merge:
           - get_attr: [NeutronBase, role_data, config_settings]
-          - neutron::agents::ml2::sriov::physical_device_mappings: {get_param: NeutronPhysicalDevMappings}
-            neutron::agents::ml2::sriov::exclude_devices: {get_param: NeutronExcludeDevices}
-            tripleo::host::sriov::number_of_vfs: {get_param: NeutronSriovNumVFs}
+          - get_attr: [RoleParametersValue, value]
       step_config: |
         include ::tripleo::profile::base::neutron::sriov
diff --git a/puppet/services/panko-api.yaml b/puppet/services/panko-api.yaml
index a41e34f7..0289b7a7 100644
--- a/puppet/services/panko-api.yaml
+++ b/puppet/services/panko-api.yaml
@@ -84,8 +84,8 @@ outputs:
             tripleo.panko_api.firewall_rules:
               '140 panko-api':
                 dport:
-                  - 8779
-                  - 13779
+                  - 8977
+                  - 13977
             panko::api::host:
               str_replace:
                 template: