11 files changed, 215 insertions, 22 deletions
diff --git a/puppet/services/ceph-base.yaml b/puppet/services/ceph-base.yaml
index ce9f9b9d..f6573f6c 100644
--- a/puppet/services/ceph-base.yaml
+++ b/puppet/services/ceph-base.yaml
@@ -11,7 +11,7 @@ parameters:
     type: string
     hidden: true
   CephClientKey:
-    description: The Ceph client key. Can be created with ceph-authtool --gen-print-key. Currently only used for external Ceph deployments to create the openstack user keyring.
+    description: The Ceph client key. Can be created with ceph-authtool --gen-print-key.
     type: string
     hidden: true
   CephClientUserName:
@@ -61,6 +61,14 @@ parameters:
     description: Mapping of service endpoint -> protocol. Typically set
                  via parameter_defaults in the resource registry.
     type: json
+  ManilaCephFSNativeCephFSAuthId:
+    type: string
+    default: 'manila'
+  CephManilaClientKey:
+    default: ''
+    description: The Ceph client key. Can be created with ceph-authtool --gen-print-key.
+    type: string
+    hidden: true
   # DEPRECATED options for compatibility with overcloud.yaml
   # This should be removed and manipulation of the ControllerServices list
   # used instead, but we need client support for that first
@@ -133,6 +141,14 @@ outputs:
                       CINDERBACKUP_POOL: {get_param: CinderBackupRbdPoolName}
                       GLANCE_POOL: {get_param: GlanceRbdPoolName}
                       GNOCCHI_POOL: {get_param: GnocchiRbdPoolName}
+              MANILA_CLIENT_KEY:
+                mode: '0644'
+                secret: {get_param: CephManilaClientKey}
+                cap_mon: 'allow r, allow command \"auth del\", allow command \"auth caps\", allow command \"auth get\", allow command \"auth get-or-create\"'
+                cap_mds: 'allow *'
+                cap_osd: 'allow rw'
             - keys:
                 CEPH_CLIENT_KEY:
                   list_join: ['.', ['client', {get_param: CephClientUserName}]]
+                MANILA_CLIENT_KEY:
+                  list_join: ['.', ['client', {get_param: ManilaCephFSNativeCephFSAuthId}]]
diff --git a/puppet/services/ceph-external.yaml b/puppet/services/ceph-external.yaml
index 97e44159..1459b851 100644
--- a/puppet/services/ceph-external.yaml
+++ b/puppet/services/ceph-external.yaml
@@ -5,7 +5,7 @@ description: >
 
 parameters:
   CephClientKey:
-    description: The Ceph client key. Can be created with ceph-authtool --gen-print-key. Currently only used for external Ceph deployments to create the openstack user keyring.
+    description: The Ceph client key. Can be created with ceph-authtool --gen-print-key.
     type: string
     hidden: true
   CephClientUserName:
@@ -68,6 +68,14 @@ parameters:
                  image. Only applies to format 2 images. Set to '1' for Jewel
                  clients using older Ceph servers.
     type: string
+  ManilaCephFSNativeCephFSAuthId:
+    type: string
+    default: 'manila'
+  CephManilaClientKey:
+    default: ''
+    description: The Ceph client key. Can be created with ceph-authtool --gen-print-key.
+    type: string
+    hidden: true
 
 outputs:
   role_data:
@@ -94,9 +102,17 @@ outputs:
                       CINDERBACKUP_POOL: {get_param: CinderBackupRbdPoolName}
                       GLANCE_POOL: {get_param: GlanceRbdPoolName}
                       GNOCCHI_POOL: {get_param: GnocchiRbdPoolName}
+              MANILA_CLIENT_KEY:
+                mode: '0644'
+                secret: {get_param: CephManilaClientKey}
+                cap_mon: 'allow r, allow command \"auth del\", allow command \"auth caps\", allow command \"auth get\", allow command \"auth get-or-create\"'
+                cap_mds: 'allow *'
+                cap_osd: 'allow rw'
             - keys:
                 CEPH_CLIENT_KEY:
                   list_join: ['.', ['client', {get_param: CephClientUserName}]]
+                MANILA_CLIENT_KEY:
+                  list_join: ['.', ['client', {get_param: ManilaCephFSNativeCephFSAuthId}]]
         ceph::profile::params::manage_repo: false
         # FIXME(gfidente): we should not have to list the packages explicitly in
         # the templates, but this should stay until the following is fixed:
diff --git a/puppet/services/ceph-mds.yaml b/puppet/services/ceph-mds.yaml
index c561ea0e..ad799edb 100644
--- a/puppet/services/ceph-mds.yaml
+++ b/puppet/services/ceph-mds.yaml
@@ -35,6 +35,15 @@ parameters:
                  with ceph-authtool --gen-print-key.
     type: string
     hidden: true
+  ManilaCephFSDataPoolName:
+    default: manila_data
+    type: string
+  ManilaCephFSMetadataPoolName:
+    default: manila_metadata
+    type: string
+  ManilaCephFSNativeShareBackendName:
+    default: cephfs
+    type: string
 
 resources:
   CephBase:
@@ -60,5 +69,8 @@ outputs:
               '112 ceph_mds':
                 dport:
                   - '6800-7300'
+            ceph::profile::params::fs_data_pool: {get_param: ManilaCephFSDataPoolName}
+            ceph::profile::params::fs_metadata_pool: {get_param: ManilaCephFSMetadataPoolName}
+            ceph::profile::params::fs_name: {get_param: ManilaCephFSNativeShareBackendName}
       step_config: |
         include ::tripleo::profile::base::ceph::mds
diff --git a/puppet/services/cinder-backend-dellemc-unity.yaml b/puppet/services/cinder-backend-dellemc-unity.yaml
new file mode 100644
index 00000000..c8b8bd8f
--- /dev/null
+++ b/puppet/services/cinder-backend-dellemc-unity.yaml
@@ -0,0 +1,85 @@
+# Copyright (c) 2016-2017 Dell Inc, or its subsidiaries.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+heat_template_version: pike
+
+description: >
+  Openstack Cinder Dell EMC Unity backend
+
+parameters:
+  CinderEnableDellEMCUnityBackend:
+    type: boolean
+    default: true
+  CinderDellEMCUnityBackendName:
+    type: string
+    default: 'tripleo_dellemc_unity'
+  CinderDellEMCUnitySanIp:
+    type: string
+  CinderDellEMCUnitySanLogin:
+    type: string
+    default: 'Admin'
+  CinderDellEMCUnitySanPassword:
+    type: string
+    hidden: true
+  CinderDellEMCUnityStorageProtocol:
+    type: string
+    default: 'iSCSI'
+  CinderDellEMCUnityIoPorts:
+    type: string
+    default: ''
+  CinderDellEMCUnityStoragePoolNames:
+    type: string
+    default: ''
+  ServiceData:
+    default: {}
+    description: Dictionary packing service data
+    type: json
+  ServiceNetMap:
+    default: {}
+    description: Mapping of service_name -> network name. Typically set
+                 via parameter_defaults in the resource registry.  This
+                 mapping overrides those in ServiceNetMapDefaults.
+    type: json
+  DefaultPasswords:
+    default: {}
+    type: json
+  RoleName:
+    default: ''
+    description: Role name on which the service is applied
+    type: string
+  RoleParameters:
+    default: {}
+    description: Parameters specific to the role
+    type: json
+  EndpointMap:
+    default: {}
+    type: json
+    description: Mapping of service endpoint -> protocol. Typically set
+                 via parameter_defaults in the resource registry.
+
+outputs:
+  role_data:
+    description: Role data for the Cinder Dell EMC Storage Center backend.
+    value:
+      service_name: cinder_backend_dellemc_unity
+      config_settings:
+                tripleo::profile::base::cinder::volume::cinder_enable_dellemc_unity_backend: {get_param: CinderEnableDellEMCUnityBackend}
+                cinder::backend::dellemc_unity::volume_backend_name: {get_param: CinderDellEMCUnityBackendName}
+                cinder::backend::dellemc_unity::san_ip: {get_param: CinderDellEMCUnitySanIp}
+                cinder::backend::dellemc_unity::san_login: {get_param: CinderDellEMCUnitySanLogin}
+                cinder::backend::dellemc_unity::san_password: {get_param: CinderDellEMCUnitySanPassword}
+                cinder::backend::dellemc_unity::storage_protocol: {get_param: CinderDellEMCUnityStorageProtocol}
+                cinder::backend::dellemc_unity::unity_io_ports: {get_param: CinderDellEMCUnityIoPorts}
+                cinder::backend::dellemc_unity::unity_storage_pool_names: {get_param: CinderDellEMCUnityStoragePoolNames}
+      step_config: |
+        include ::tripleo::profile::base::cinder::volume
diff --git a/puppet/services/horizon.yaml b/puppet/services/horizon.yaml
index 63ab92eb..642a0f09 100644
--- a/puppet/services/horizon.yaml
+++ b/puppet/services/horizon.yaml
@@ -67,6 +67,14 @@ parameters:
   MonitoringSubscriptionHorizon:
     default: 'overcloud-horizon'
     type: string
+  EnableInternalTLS:
+    type: boolean
+    default: false
+  InternalTLSCAFile:
+    default: '/etc/ipa/ca.crt'
+    type: string
+    description: Specifies the default CA cert to use if TLS is used for
+                 services in the internal network.
 
 conditions:
 
@@ -109,6 +117,14 @@ outputs:
                   - {get_param: [DefaultPasswords, horizon_secret]}
           horizon::secure_cookies: {get_param: [HorizonSecureCookies]}
           memcached_ipv6: {get_param: MemcachedIPv6}
+          horizon::servername:
+            str_replace:
+              template:
+                "%{hiera('fqdn_$NETWORK')}"
+              params:
+                $NETWORK: {get_param: [ServiceNetMap, HorizonNetwork]}
+          horizon::listen_ssl: {get_param: EnableInternalTLS}
+          horizon::horizon_ca: {get_param: InternalTLSCAFile}
         -
           if:
           - debug_unset
diff --git a/puppet/services/manila-backend-cephfs.yaml b/puppet/services/manila-backend-cephfs.yaml
index 9d6b508b..9207d99f 100644
--- a/puppet/services/manila-backend-cephfs.yaml
+++ b/puppet/services/manila-backend-cephfs.yaml
@@ -52,12 +52,6 @@ parameters:
   ManilaCephFSNativeCephFSEnableSnapshots:
     type: boolean
     default: false
-  ManilaCephFSDataPoolName:
-    default: manila_data
-    type: string
-  ManilaCephFSMetadataPoolName:
-    default: manila_metadata
-    type: string
   # (jprovazn) default value is set to assure this templates works with an
   # external ceph too (user/key is created only when ceph is deployed by
   # TripleO)
@@ -81,7 +75,4 @@ outputs:
         manila::backend::cephfsnative::cephfs_cluster_name: {get_param: ManilaCephFSNativeCephFSClusterName}
         manila::backend::cephfsnative::cephfs_enable_snapshots: {get_param: ManilaCephFSNativeCephFSEnableSnapshots}
         manila::backend::cephfsnative::ceph_client_key: {get_param: CephManilaClientKey}
-        ceph::profile::params::fs_data_pool: {get_param: ManilaCephFSDataPoolName}
-        ceph::profile::params::fs_metadata_pool: {get_param: ManilaCephFSMetadataPoolName}
-        ceph::profile::params::fs_name: {get_param: ManilaCephFSNativeShareBackendName}
       step_config:
diff --git a/puppet/services/neutron-metadata.yaml b/puppet/services/neutron-metadata.yaml
index 81f12f01..30f34777 100644
--- a/puppet/services/neutron-metadata.yaml
+++ b/puppet/services/neutron-metadata.yaml
@@ -57,10 +57,15 @@ parameters:
     default:
       tag: openstack.neutron.agent.metadata
       path: /var/log/neutron/metadata-agent.log
+  EnableInternalTLS:
+    type: boolean
+    default: false
 
 conditions:
   neutron_workers_unset: {equals : [{get_param: NeutronWorkers}, '']}
 
+  internal_tls_enabled: {equals: [{get_param: EnableInternalTLS}, true]}
+
 resources:
 
   NeutronBase:
@@ -90,6 +95,17 @@ outputs:
             neutron::agents::metadata::auth_url: { get_param: [EndpointMap, KeystoneInternal, uri_no_suffix] }
             neutron::agents::metadata::auth_tenant: 'service'
             neutron::agents::metadata::metadata_ip: "%{hiera('nova_metadata_vip')}"
+            neutron::agents::metadata::metadata_host:
+              str_replace:
+                template:
+                  "%{hiera('cloud_name_$NETWORK')}"
+                params:
+                  $NETWORK: {get_param: [ServiceNetMap, NovaMetadataNetwork]}
+            neutron::agents::metadata::metadata_protocol:
+              if:
+              - internal_tls_enabled
+              - 'https'
+              - 'http'
           -
             if:
             - neutron_workers_unset
diff --git a/puppet/services/nova-compute.yaml b/puppet/services/nova-compute.yaml
index 36866a3a..22a743e0 100644
--- a/puppet/services/nova-compute.yaml
+++ b/puppet/services/nova-compute.yaml
@@ -37,7 +37,7 @@ parameters:
     default: openstack
     type: string
   CephClientKey:
-    description: The Ceph client key. Can be created with ceph-authtool --gen-print-key. Currently only used for external Ceph deployments to create the openstack user keyring.
+    description: The Ceph client key. Can be created with ceph-authtool --gen-print-key.
     type: string
     hidden: true
   CephClusterFSID:
diff --git a/puppet/services/nova-libvirt.yaml b/puppet/services/nova-libvirt.yaml
index 04936c33..df9e88fb 100644
--- a/puppet/services/nova-libvirt.yaml
+++ b/puppet/services/nova-libvirt.yaml
@@ -34,7 +34,7 @@ parameters:
     default: openstack
     type: string
   CephClientKey:
-    description: The Ceph client key. Can be created with ceph-authtool --gen-print-key. Currently only used for external Ceph deployments to create the openstack user keyring.
+    description: The Ceph client key. Can be created with ceph-authtool --gen-print-key.
     type: string
     hidden: true
   CephClusterFSID:
@@ -162,7 +162,7 @@ outputs:
                 dport:
                   - 16514
                   - '49152-49215'
-                  - '5900-5999'
+                  - '5900-6923'
 
           -
             if:
diff --git a/puppet/services/nova-metadata.yaml b/puppet/services/nova-metadata.yaml
index ca9eed09..3ac5f300 100644
--- a/puppet/services/nova-metadata.yaml
+++ b/puppet/services/nova-metadata.yaml
@@ -34,10 +34,26 @@ parameters:
     default: 0
     description: Number of workers for Nova services.
     type: number
+  EnableInternalTLS:
+    type: boolean
+    default: false
 
 conditions:
   nova_workers_zero: {equals : [{get_param: NovaWorkers}, 0]}
 
+  use_tls_proxy: {equals : [{get_param: EnableInternalTLS}, true]}
+
+resources:
+
+  TLSProxyBase:
+    type: OS::TripleO::Services::TLSProxyBase
+    properties:
+      ServiceData: {get_param: ServiceData}
+      ServiceNetMap: {get_param: ServiceNetMap}
+      DefaultPasswords: {get_param: DefaultPasswords}
+      EndpointMap: {get_param: EndpointMap}
+      EnableInternalTLS: {get_param: EnableInternalTLS}
+
 outputs:
   role_data:
     description: Role data for the Nova Metadata service.
@@ -45,10 +61,29 @@ outputs:
       service_name: nova_metadata
       config_settings:
         map_merge:
-        - nova::api::metadata_listen: {get_param: [ServiceNetMap, NovaMetadataNetwork]}
+        - get_attr: [TLSProxyBase, role_data, config_settings]
+        - nova::api::metadata_listen:
+            if:
+            - use_tls_proxy
+            - 'localhost'
+            - {get_param: [ServiceNetMap, NovaMetadataNetwork]}
         -
           if:
           - nova_workers_zero
           - {}
           - nova::api::metadata_workers: {get_param: NovaWorkers}
+        -
+          if:
+          - use_tls_proxy
+          - tripleo::profile::base::nova::api::metadata_tls_proxy_bind_ip:
+              get_param: [ServiceNetMap, NovaMetadataNetwork]
+            tripleo::profile::base::nova::api::metadata_tls_proxy_fqdn:
+              str_replace:
+                template:
+                  "%{hiera('fqdn_$NETWORK')}"
+                params:
+                  $NETWORK: {get_param: [ServiceNetMap, NovaMetadataNetwork]}
+          - {}
       step_config: ""
+      metadata_settings:
+        get_attr: [TLSProxyBase, role_data, metadata_settings]
diff --git a/puppet/services/pacemaker/cinder-volume.yaml b/puppet/services/pacemaker/cinder-volume.yaml
index a1134f3e..f4675875 100644
--- a/puppet/services/pacemaker/cinder-volume.yaml
+++ b/puppet/services/pacemaker/cinder-volume.yaml
@@ -66,11 +66,17 @@ outputs:
             resource: openstack-cinder-volume
             state: disable
             wait_for_resource: true
-        - name: Sync cinder DB
+        - name: get bootstrap nodeid
           tags: step5
-          command: cinder-manage db sync
-        - name: Start cinder_volume service (pacemaker)
-          tags: step5
-          pacemaker_resource:
-            resource: openstack-cinder-volume
-            state: enable
+          command: hiera bootstrap_nodeid
+          register: bootstrap_node
+        - block:
+          - name: Sync cinder DB
+            tags: step5
+            command: cinder-manage db sync
+          - name: Start cinder_volume service (pacemaker)
+            tags: step5
+            pacemaker_resource:
+              resource: openstack-cinder-volume
+              state: enable
+          when: bootstrap_node.stdout == ansible_hostname