21 files changed, 249 insertions, 11 deletions
diff --git a/puppet/blockstorage-role.yaml b/puppet/blockstorage-role.yaml
index e92de45f..a5218dbe 100644
--- a/puppet/blockstorage-role.yaml
+++ b/puppet/blockstorage-role.yaml
@@ -115,6 +115,14 @@ parameters:
       Command or script snippet to run on all overcloud nodes to
       initialize the upgrade process. E.g. a repository switch.
     default: ''
+  UpgradeInitCommonCommand:
+    type: string
+    description: |
+      Common commands required by the upgrades process. This should not
+      normally be modified by the operator and is set and unset in the
+      major-upgrade-composable-steps.yaml and major-upgrade-converge.yaml
+      environment files.
+    default: ''
 
 resources:
   BlockStorage:
@@ -360,6 +368,7 @@ resources:
         - - "#!/bin/bash\n\n"
           - "if [[ -f /etc/resolv.conf.save ]] ; then rm /etc/resolv.conf.save; fi\n\n"
           - get_param: UpgradeInitCommand
+          - get_param: UpgradeInitCommonCommand
 
   # Note we may be able to make this conditional on UpgradeInitCommandNotEmpty
   # but https://bugs.launchpad.net/heat/+bug/1649900 needs fixing first
diff --git a/puppet/cephstorage-role.yaml b/puppet/cephstorage-role.yaml
index 892f91ef..0867e17f 100644
--- a/puppet/cephstorage-role.yaml
+++ b/puppet/cephstorage-role.yaml
@@ -121,6 +121,14 @@ parameters:
       Command or script snippet to run on all overcloud nodes to
       initialize the upgrade process. E.g. a repository switch.
     default: ''
+  UpgradeInitCommonCommand:
+    type: string
+    description: |
+      Common commands required by the upgrades process. This should not
+      normally be modified by the operator and is set and unset in the
+      major-upgrade-composable-steps.yaml and major-upgrade-converge.yaml
+      environment files.
+    default: ''
 
 resources:
   CephStorage:
@@ -366,6 +374,7 @@ resources:
         - - "#!/bin/bash\n\n"
           - "if [[ -f /etc/resolv.conf.save ]] ; then rm /etc/resolv.conf.save; fi\n\n"
           - get_param: UpgradeInitCommand
+          - get_param: UpgradeInitCommonCommand
 
   # Note we may be able to make this conditional on UpgradeInitCommandNotEmpty
   # but https://bugs.launchpad.net/heat/+bug/1649900 needs fixing first
diff --git a/puppet/compute-role.yaml b/puppet/compute-role.yaml
index 62adcd33..1a0294af 100644
--- a/puppet/compute-role.yaml
+++ b/puppet/compute-role.yaml
@@ -133,6 +133,14 @@ parameters:
       Command or script snippet to run on all overcloud nodes to
       initialize the upgrade process. E.g. a repository switch.
     default: ''
+  UpgradeInitCommonCommand:
+    type: string
+    description: |
+      Common commands required by the upgrades process. This should not
+      normally be modified by the operator and is set and unset in the
+      major-upgrade-composable-steps.yaml and major-upgrade-converge.yaml
+      environment files.
+    default: ''
 
 resources:
 
@@ -383,6 +391,7 @@ resources:
         - - "#!/bin/bash\n\n"
           - "if [[ -f /etc/resolv.conf.save ]] ; then rm /etc/resolv.conf.save; fi\n\n"
           - get_param: UpgradeInitCommand
+          - get_param: UpgradeInitCommonCommand
 
   # Note we may be able to make this conditional on UpgradeInitCommandNotEmpty
   # but https://bugs.launchpad.net/heat/+bug/1649900 needs fixing first
diff --git a/puppet/controller-role.yaml b/puppet/controller-role.yaml
index d3268ee2..825006ba 100644
--- a/puppet/controller-role.yaml
+++ b/puppet/controller-role.yaml
@@ -147,6 +147,14 @@ parameters:
       Command or script snippet to run on all overcloud nodes to
       initialize the upgrade process. E.g. a repository switch.
     default: ''
+  UpgradeInitCommonCommand:
+    type: string
+    description: |
+      Common commands required by the upgrades process. This should not
+      normally be modified by the operator and is set and unset in the
+      major-upgrade-composable-steps.yaml and major-upgrade-converge.yaml
+      environment files.
+    default: ''
 
 parameter_groups:
 - label: deprecated
@@ -417,6 +425,7 @@ resources:
         - - "#!/bin/bash\n\n"
           - "if [[ -f /etc/resolv.conf.save ]] ; then rm /etc/resolv.conf.save; fi\n\n"
           - get_param: UpgradeInitCommand
+          - get_param: UpgradeInitCommonCommand
 
   # Note we may be able to make this conditional on UpgradeInitCommandNotEmpty
   # but https://bugs.launchpad.net/heat/+bug/1649900 needs fixing first
diff --git a/puppet/major_upgrade_steps.j2.yaml b/puppet/major_upgrade_steps.j2.yaml
index 3362a01f..6f2dd684 100644
--- a/puppet/major_upgrade_steps.j2.yaml
+++ b/puppet/major_upgrade_steps.j2.yaml
@@ -79,6 +79,7 @@ resources:
                 AUTH_URL: { get_param: [EndpointMap, KeystoneAdmin, uri_no_suffix]}
                 ROLE_NAME: {{role.name}}
           - get_file: ../extraconfig/tasks/pacemaker_common_functions.sh
+          - get_file: ../extraconfig/tasks/run_puppet.sh
           - get_file: ../extraconfig/tasks/tripleo_upgrade_node.sh
 
   {{role.name}}DeliverUpgradeScriptDeployment:
diff --git a/puppet/objectstorage-role.yaml b/puppet/objectstorage-role.yaml
index 1633134d..172484dc 100644
--- a/puppet/objectstorage-role.yaml
+++ b/puppet/objectstorage-role.yaml
@@ -115,6 +115,14 @@ parameters:
       Command or script snippet to run on all overcloud nodes to
       initialize the upgrade process. E.g. a repository switch.
     default: ''
+  UpgradeInitCommonCommand:
+    type: string
+    description: |
+      Common commands required by the upgrades process. This should not
+      normally be modified by the operator and is set and unset in the
+      major-upgrade-composable-steps.yaml and major-upgrade-converge.yaml
+      environment files.
+    default: ''
 
 resources:
 
@@ -360,6 +368,7 @@ resources:
         - - "#!/bin/bash\n\n"
           - "if [[ -f /etc/resolv.conf.save ]] ; then rm /etc/resolv.conf.save; fi\n\n"
           - get_param: UpgradeInitCommand
+          - get_param: UpgradeInitCommonCommand
 
   # Note we may be able to make this conditional on UpgradeInitCommandNotEmpty
   # but https://bugs.launchpad.net/heat/+bug/1649900 needs fixing first
diff --git a/puppet/puppet-steps.j2 b/puppet/puppet-steps.j2
index cb08f872..b517db6e 100644
--- a/puppet/puppet-steps.j2
+++ b/puppet/puppet-steps.j2
@@ -32,6 +32,13 @@
         update_identifier: {get_param: DeployIdentifier}
   {% endif %}
 
+  {% if role.name in ['Controller', 'ObjectStorage'] %}
+  {{role.name}}SwiftRingDeploy:
+    type: OS::TripleO::Tasks::SwiftRingDeploy
+    properties:
+      servers: {get_param: [servers, {{role.name}}]}
+  {% endif %}
+
   # Step through a series of configuration steps
 {% for step in range(1, 6) %}
   {{role.name}}Deployment_Step{{step}}:
@@ -85,4 +92,15 @@
       input_values:
         update_identifier: {get_param: DeployIdentifier}
   {% endif %}
+
+  {% if role.name in ['Controller', 'ObjectStorage'] %}
+  {{role.name}}SwiftRingUpdate:
+    type: OS::TripleO::Tasks::SwiftRingUpdate
+    depends_on:
+  {% for dep in roles %}
+      - {{dep.name}}Deployment_Step5
+  {% endfor %}
+    properties:
+      servers: {get_param: [servers, {{role.name}}]}
+  {% endif %}
 {% endfor %}
diff --git a/puppet/role.role.j2.yaml b/puppet/role.role.j2.yaml
index 2f070da2..2e1bd6f1 100644
--- a/puppet/role.role.j2.yaml
+++ b/puppet/role.role.j2.yaml
@@ -137,7 +137,14 @@ parameters:
       Command or script snippet to run on all overcloud nodes to
       initialize the upgrade process. E.g. a repository switch.
     default: ''
-
+  UpgradeInitCommonCommand:
+    type: string
+    description: |
+      Common commands required by the upgrades process. This should not
+      normally be modified by the operator and is set and unset in the
+      major-upgrade-composable-steps.yaml and major-upgrade-converge.yaml
+      environment files.
+    default: ''
 
 resources:
   {{role}}:
@@ -386,6 +393,7 @@ resources:
         - - "#!/bin/bash\n\n"
           - "if [[ -f /etc/resolv.conf.save ]] ; then rm /etc/resolv.conf.save; fi\n\n"
           - get_param: UpgradeInitCommand
+          - get_param: UpgradeInitCommonCommand
 
   # Note we may be able to make this conditional on UpgradeInitCommandNotEmpty
   # but https://bugs.launchpad.net/heat/+bug/1649900 needs fixing first
diff --git a/puppet/services/ceilometer-base.yaml b/puppet/services/ceilometer-base.yaml
index 17588dc6..5658e416 100644
--- a/puppet/services/ceilometer-base.yaml
+++ b/puppet/services/ceilometer-base.yaml
@@ -96,7 +96,6 @@ outputs:
               - '?bind_address='
               - "%{hiera('tripleo::profile::base::database::mysql::client_bind_address')}"
         ceilometer_backend: {get_param: CeilometerBackend}
-        ceilometer::metering_secret: {get_param: CeilometerMeteringSecret}
         # we include db_sync class in puppet-tripleo
         ceilometer::db::sync_db: false
         ceilometer::keystone::authtoken::project_name: 'service'
diff --git a/puppet/services/database/mysql.yaml b/puppet/services/database/mysql.yaml
index 8c4042d9..808f1353 100644
--- a/puppet/services/database/mysql.yaml
+++ b/puppet/services/database/mysql.yaml
@@ -34,6 +34,10 @@ parameters:
     default: true
     description: Whether to use Galera instead of regular MariaDB.
     type: boolean
+  NovaPassword:
+    description: The password for the nova db account
+    type: string
+    hidden: true
 
 resources:
 
@@ -94,6 +98,8 @@ outputs:
               {get_param: [ServiceNetMap, MysqlNetwork]}
       step_config: |
         include ::tripleo::profile::base::database::mysql
+      metadata_settings:
+        get_attr: [MySQLTLS, role_data, metadata_settings]
       upgrade_tasks:
         - name: Check for galera root password
           tags: step0
@@ -104,6 +110,15 @@ outputs:
         - name: Start service
           tags: step4
           service: name=mariadb state=started
-      metadata_settings:
-        get_attr: [MySQLTLS, role_data, metadata_settings]
-
+        - name: Setup cell_v2 (create cell0 database)
+          tags: step4
+          mysql_db:
+            name: nova_cell0
+            state: present
+        - name: Setup cell_v2 (grant access to the nova DB user)
+          tags: step4
+          mysql_user:
+            str_replace:
+              template: "name=nova password=PASSWORD host=\"%\" priv=\"nova.*:ALL/nova_cell0.*:ALL,GRANT\" state=present"
+              params:
+                PASSWORD: {get_param: NovaPassword}
diff --git a/puppet/services/neutron-api.yaml b/puppet/services/neutron-api.yaml
index 48e53f4c..b3a07fb0 100644
--- a/puppet/services/neutron-api.yaml
+++ b/puppet/services/neutron-api.yaml
@@ -136,8 +136,6 @@ outputs:
             neutron::server::allow_automatic_l3agent_failover: {get_param: NeutronAllowL3AgentFailover}
             neutron::server::enable_proxy_headers_parsing: true
             neutron::keystone::authtoken::password: {get_param: NeutronPassword}
-
-            neutron::server::notifications::nova_url: { get_param: [ EndpointMap, NovaInternal, uri ] }
             neutron::server::notifications::auth_url: { get_param: [ EndpointMap, KeystoneV3Admin, uri ] }
             neutron::server::notifications::tenant_name: 'service'
             neutron::server::notifications::project_name: 'service'
diff --git a/puppet/services/neutron-compute-plugin-ovn.yaml b/puppet/services/neutron-compute-plugin-ovn.yaml
index 868b2bc6..e3a4da99 100644
--- a/puppet/services/neutron-compute-plugin-ovn.yaml
+++ b/puppet/services/neutron-compute-plugin-ovn.yaml
@@ -26,6 +26,16 @@ parameters:
     description: Tunnel encapsulation type
     type: string
     default: geneve
+  NeutronBridgeMappings:
+    description: >
+      The OVS logical->physical bridge mappings to use. See the Neutron
+      documentation for details. Defaults to mapping br-ex - the external
+      bridge on hosts - to a physical name 'datacentre' which can be used
+      to create provider networks (and we use this for the default floating
+      network) - if changing this either use different post-install network
+      scripts or be sure to keep 'datacentre' as a mapping network name
+    type: comma_delimited_list
+    default: "datacentre:br-ex"
 
 
 outputs:
@@ -37,6 +47,7 @@ outputs:
         ovn::southbound::port: {get_param: OVNSouthboundServerPort}
         ovn::controller::ovn_encap_type: {get_param: OVNTunnelEncapType}
         ovn::controller::ovn_encap_ip: {get_param: [ServiceNetMap, NeutronApiNetwork]}
+        ovn::controller::ovn_bridge_mappings: {get_param: NeutronBridgeMappings}
         tripleo.neutron_compute_plugin_ovn.firewall_rules:
           '118 neutron vxlan networks':
                 proto: 'udp'
diff --git a/puppet/services/nova-api.yaml b/puppet/services/nova-api.yaml
index 18c790e6..d18b5b48 100644
--- a/puppet/services/nova-api.yaml
+++ b/puppet/services/nova-api.yaml
@@ -58,6 +58,10 @@ parameters:
     default: 'public'
     description: Default pool for floating IP addresses
     type: string
+  NovaDbSyncTimeout:
+    default: 300
+    description: Timeout for Nova db sync
+    type: number
 
 conditions:
   nova_workers_zero: {equals : [{get_param: NovaWorkers}, 0]}
@@ -178,3 +182,86 @@ outputs:
       # https://bugs.launchpad.net/nova/+bug/1661360
       # metadata_settings:
       #   get_attr: [ApacheServiceBase, role_data, metadata_settings]
+      upgrade_tasks:
+        - name: get bootstrap nodeid
+          tags: common
+          command: hiera bootstrap_nodeid
+          register: bootstrap_node
+        - name: set is_bootstrap_node fact
+          tags: common
+          set_fact: is_bootstrap_node={{bootstrap_node.stdout == ansible_hostname}}
+        - name: Extra migration for nova tripleo/+bug/1656791
+          tags: step0,pre-upgrade
+          when: is_bootstrap_node
+          command: nova-manage db online_data_migrations
+        - name: update nova api
+          tags: step2
+          yum: name=openstack-nova-api state=latest
+        - name: Stop and disable nova_api service (pre-upgrade not under httpd)
+          tags: step2
+          service: name=openstack-nova-api state=stopped enabled=no
+        - name: Create puppet manifest to set transport_url in nova.conf
+          tags: step5
+          when: is_bootstrap_node
+          copy:
+            dest: /root/nova-api_upgrade_manifest.pp
+            mode: 0600
+            content: >
+              $transport_url = os_transport_url({
+                'transport' => hiera('messaging_service_name', 'rabbit'),
+                'hosts'     => any2array(hiera('rabbitmq_node_names', undef)),
+                'port'      => sprintf('%s',hiera('nova::rabbit_port', '5672') ),
+                'username'  => hiera('nova::rabbit_userid', 'guest'),
+                'password'  => hiera('nova::rabbit_password'),
+                'ssl'       => sprintf('%s', bool2num(str2bool(hiera('nova::rabbit_use_ssl', '0'))))
+              })
+              oslo::messaging::default { 'nova_config':
+                transport_url => $transport_url
+              }
+        - name: Run puppet apply to set tranport_url in nova.conf
+          tags: step5
+          when: is_bootstrap_node
+          command: puppet apply --detailed-exitcodes /root/nova-api_upgrade_manifest.pp
+          register: puppet_apply_nova_api_upgrade
+          failed_when: puppet_apply_nova_api_upgrade.rc not in [0,2]
+          changed_when: puppet_apply_nova_api_upgrade.rc == 2
+        - name: Setup cell_v2 (map cell0)
+          tags: step5
+          when: is_bootstrap_node
+          command: nova-manage cell_v2 map_cell0
+        - name: Setup cell_v2 (create default cell)
+          tags: step5
+          when: is_bootstrap_node
+          # (owalsh) puppet-nova expects the cell name 'default'
+          # (owalsh) pass the db uri explicitly to avoid https://bugs.launchpad.net/tripleo/+bug/1662344
+          shell: nova-manage cell_v2 create_cell --name='default' --database_connection=$(hiera nova::database_connection)
+          register: nova_api_create_cell
+          failed_when: nova_api_create_cell.rc not in [0,2]
+          changed_when: nova_api_create_cell.rc == 0
+        - name: Setup cell_v2 (sync nova/cell DB)
+          tags: step5
+          when: is_bootstrap_node
+          command: nova-manage db sync
+          async: {get_param: NovaDbSyncTimeout}
+          poll: 10
+        - name: Setup cell_v2 (migrate hosts)
+          tags: step5
+          when: is_bootstrap_node
+          command: nova-manage cell_v2 map_cell_and_hosts
+        - name: Setup cell_v2 (get cell uuid)
+          tags: step5
+          when: is_bootstrap_node
+          shell: nova-manage cell_v2 list_cells | sed -e '1,3d' -e '$d' | awk -F ' *| *' '$2 == "default" {print $4}'
+          register: nova_api_cell_uuid
+        - name: Setup cell_v2 (migrate instances)
+          tags: step5
+          when: is_bootstrap_node
+          command: nova-manage cell_v2 map_instances --cell_uuid {{nova_api_cell_uuid.stdout}}
+        - name: Sync nova_api DB
+          tags: step5
+          command: nova-manage api_db sync
+          when: is_bootstrap_node
+        - name: Online data migration for nova
+          tags: step5
+          when: is_bootstrap_node
+          command: nova-manage db online_data_migrations
diff --git a/puppet/services/nova-base.yaml b/puppet/services/nova-base.yaml
index 26d05cc9..d892c36d 100644
--- a/puppet/services/nova-base.yaml
+++ b/puppet/services/nova-base.yaml
@@ -121,7 +121,6 @@ parameters:
         Endpoint interface to be used for the placement API.
     default: 'internal'
 
-
 conditions:
 
   compute_upgrade_level_empty: {equals : [{get_param: UpgradeLevelNovaCompute}, '']}
diff --git a/puppet/services/nova-compute.yaml b/puppet/services/nova-compute.yaml
index f7484da2..9923e833 100644
--- a/puppet/services/nova-compute.yaml
+++ b/puppet/services/nova-compute.yaml
@@ -75,6 +75,10 @@ parameters:
     default:
       tag: openstack.nova.compute
       path: /var/log/nova/nova-compute.log
+  UpgradeLevelNovaCompute:
+    type: string
+    description: Nova Compute upgrade level
+    default: auto
 
 resources:
   NovaBase:
@@ -146,3 +150,19 @@ outputs:
           tripleo.collectd.plugins.nova_compute:
             - virt
           collectd::plugins::virt::connection: "qemu:///system"
+      upgrade_tasks:
+        - name: Stop nova-compute service
+          tags: step2
+          service: name=openstack-nova-compute state=stopped
+        # If not already set by puppet (e.g a pre-ocata version), set the
+        # upgrade_level for compute to "auto"
+        - name: Set compute upgrade level to auto
+          tags: step3
+          ini_file:
+            str_replace:
+              template: "dest=/etc/nova/nova.conf section=upgrade_levels option=compute value=LEVEL"
+              params:
+                LEVEL: {get_param: UpgradeLevelNovaCompute}
+        - name: Start nova-compute service
+          tags: step6
+          service: name=openstack-nova-compute state=started
diff --git a/puppet/services/nova-conductor.yaml b/puppet/services/nova-conductor.yaml
index b96bf6e6..7b086536 100644
--- a/puppet/services/nova-conductor.yaml
+++ b/puppet/services/nova-conductor.yaml
@@ -30,6 +30,10 @@ parameters:
     default:
       tag: openstack.nova.scheduler
       path: /var/log/nova/nova-scheduler.log
+  UpgradeLevelNovaCompute:
+    type: string
+    description: Nova Compute upgrade level
+    default: auto
 
 conditions:
   nova_workers_zero: {equals : [{get_param: NovaWorkers}, 0]}
@@ -61,3 +65,19 @@ outputs:
           - nova::conductor::workers: {get_param: NovaWorkers}
       step_config: |
         include tripleo::profile::base::nova::conductor
+      upgrade_tasks:
+        - name: Stop nova_conductor service
+          tags: step2
+          service: name=openstack-nova-conductor state=stopped
+        - name: update nova conductor
+          tags: step2
+          yum: name=openstack-nova-conductor state=latest
+        # If not already set by puppet (e.g a pre-ocata version), set the
+        # upgrade_level for compute to "auto"
+        - name: Set compute upgrade level to auto
+          tags: step3
+          ini_file:
+            str_replace:
+              template: "dest=/etc/nova/nova.conf section=upgrade_levels option=compute value=LEVEL"
+              params:
+                LEVEL: {get_param: UpgradeLevelNovaCompute}
diff --git a/puppet/services/nova-consoleauth.yaml b/puppet/services/nova-consoleauth.yaml
index 79969ded..b5a1312a 100644
--- a/puppet/services/nova-consoleauth.yaml
+++ b/puppet/services/nova-consoleauth.yaml
@@ -48,3 +48,7 @@ outputs:
         get_attr: [NovaBase, role_data, config_settings]
       step_config: |
         include tripleo::profile::base::nova::consoleauth
+      upgrade_tasks:
+        - name: Stop nova_consoleauth service
+          tags: step2
+          service: name=openstack-nova-consoleauth state=stopped
diff --git a/puppet/services/nova-scheduler.yaml b/puppet/services/nova-scheduler.yaml
index 353a75ac..0e0b9d1e 100644
--- a/puppet/services/nova-scheduler.yaml
+++ b/puppet/services/nova-scheduler.yaml
@@ -63,3 +63,10 @@ outputs:
             nova::scheduler::filter::scheduler_default_filters: {get_param: NovaSchedulerDefaultFilters}
       step_config: |
         include tripleo::profile::base::nova::scheduler
+      upgrade_tasks:
+        - name: Stop nova_scheduler service
+          tags: step2
+          service: name=openstack-nova-scheduler state=stopped
+        - name: update nova scheduler
+          tags: step2
+          yum: name=openstack-nova-scheduler state=latest
diff --git a/puppet/services/nova-vnc-proxy.yaml b/puppet/services/nova-vnc-proxy.yaml
index bf244943..f6cf9649 100644
--- a/puppet/services/nova-vnc-proxy.yaml
+++ b/puppet/services/nova-vnc-proxy.yaml
@@ -64,3 +64,7 @@ outputs:
                   - 13080
       step_config: |
         include tripleo::profile::base::nova::vncproxy
+      upgrade_tasks:
+        - name: Stop nova_vnc_proxy service
+          tags: step2
+          service: name=openstack-nova-consoleauth state=stopped
diff --git a/puppet/services/time/ntp.yaml b/puppet/services/time/ntp.yaml
index 88ab90cb..b14d7bcc 100644
--- a/puppet/services/time/ntp.yaml
+++ b/puppet/services/time/ntp.yaml
@@ -22,8 +22,10 @@ parameters:
                  via parameter_defaults in the resource registry.
     type: json
   NtpServer:
-    default: []
-    description: NTP servers
+    default: ['pool.ntp.org']
+    description: NTP servers list. Defaulted to pool.ntp.org in order to
+                 have a sane default for Pacemaker deployments when
+                 not configuring this parameter by default.
     type: comma_delimited_list
 
 outputs:
diff --git a/puppet/upgrade_config.yaml b/puppet/upgrade_config.yaml
index c37cc033..2cfd43f4 100644
--- a/puppet/upgrade_config.yaml
+++ b/puppet/upgrade_config.yaml
@@ -41,7 +41,7 @@ resources:
             - {get_param: SkipUpgradeConfigTags}
         tags:
           str_replace:
-            template: "stepSTEP"
+            template: "common,stepSTEP"
             params:
               STEP: {get_param: step}
         modulepath: /usr/share/ansible-modules