summaryrefslogtreecommitdiffstats
path: root/puppet
AgeCommit message (Collapse)AuthorFilesLines
2017-03-22Restrict Access to Kernel Message Bufferzshi1-0/+2
Unprivileged access to the kernel syslog can expose sensitive kernel address information. Change-Id: If40f1b883dfde6c7870bf9c463753d037867c9e2 Signed-off-by: zshi <zshi@redhat.com>
2017-03-20Merge "Bind redis-sentinel to its network"Jenkins1-0/+1
2017-03-18Merge "Make sure PrePuppet runs before any Deployment_Step"Jenkins1-1/+1
2017-03-18Merge "Add certmonger-user profile"Jenkins1-0/+28
2017-03-17Make sure PrePuppet runs before any Deployment_StepMichele Baldessari1-1/+1
We used to have this in mitaka: https://github.com/openstack/tripleo-heat-templates/blob/stable/mitaka/puppet/controller-post.yaml#L45 but we lost it along the way. The problem without this change is that we are open to the following race: 1) ControllerDeployment_Step1 is started and manages to do a successful "systemctl start pacemaker" 2) PrePuppet gets called and in the HA deployment calls pacemaker_maintenance_mode.sh 3) pacemaker_maintenance_mode.sh will set the maintenance-mode=true property because the pacemaker service is already up: https://github.com/openstack/tripleo-heat-templates/blob/master/extraconfig/tasks/pacemaker_maintenance_mode.sh#L8-L9 4) If the maintenance property is set to true at this stage, the creation of any resource will take place but they won't really start. Change-Id: Icb7495edd00385b2975dd42f63085d20292ef9a9 Closes-Bug: #1673795 Co-Authored-By: Jiri Stransky <jstransk@redhat.com>
2017-03-17Merge "Explicitly configure credentials used by ironic to access other services"Jenkins1-4/+39
2017-03-17Bind redis-sentinel to its networkMichele Baldessari1-0/+1
We currently do not bind redis-sentinel to any IP: redis 21144 0.0 0.0 142908 5908 ? Ssl 07:43 0:11 /usr/bin/redis-sentinel *:26379 [sentinel] Let's bind it to the same network as redis. Change-Id: I8a782ae1db84eb614aa3995a1638a2f370e70d06 Partial-Bug: #1673715
2017-03-16Explicitly configure credentials used by ironic to access other servicesDmitry Tantsur1-4/+39
Using keystone_authtoken credentials for this purpose is deprecated, and also prevents ironic-conductor from being used as a separate role. Also remove neutron_url, it can be fetched from the catalog instead. Change-Id: I12822568cb4db31808aec5fd407d71fe4b7b09e0 Depends-On: I21180678bec911f1be36e3b174bae81af042938c Partial-Bug: #1661250
2017-03-15etcd: secure EtcdInitialClusterToken parameterEmilien Macchi1-1/+1
Secure EtcdInitialClusterToken parameter by: * removing the default value. * make it hidden. Change-Id: I938af697f9faaadb9c9aeb950e9410db24b1b961 Depends-On: I6e30cce469736e84a3c483fafa29d542b8347ba9 Closes-Bug: #1673266
2017-03-14Switch keystone default provider to fernetJuan Antonio Osorio Robles1-1/+1
UUID is to be deprecated, and we should be using fernet. Change-Id: I61b999e65ba5eb771776344d38eb90fc52d49d56
2017-03-14Merge "Update properties being set for octavia rabbit properties"Jenkins1-3/+3
2017-03-14Merge "congress/tacker: switch auth_uri to use uri_no_suffix"Jenkins2-4/+8
2017-03-13Merge "cinder: switch auth_uri to uri_no_suffix"Jenkins1-1/+3
2017-03-13Merge "neutron: switch auth_uri to uri_no_suffix"Jenkins1-2/+4
2017-03-13Merge "gnocchi: deploy services with Keystone v3 endpoints"Jenkins2-6/+5
2017-03-13Merge "manila: switch auth_uri to use uri_no_suffix"Jenkins1-1/+3
2017-03-13Merge "heat: switch auth_uri to use uri_no_suffix"Jenkins1-1/+3
2017-03-13Merge "ironic: switch auth_uri to uri_no_suffix"Jenkins1-1/+3
2017-03-13Merge "telemetry: switch auth_uri to uri_no_suffix"Jenkins3-3/+11
2017-03-13Merge "nova: switch auth_uri to keystone versionless endpoint"Jenkins2-2/+4
2017-03-13Merge "horizon: switch keystone_url to use uri_no_suffix"Jenkins1-1/+1
2017-03-13Merge "Improve SSL support for Sensu"Jenkins1-1/+14
2017-03-13Merge "Fix bogus parameters in get_param"Jenkins2-2/+2
2017-03-13Add certmonger-user profileJuan Antonio Osorio Robles1-0/+28
This profile will request the certificates for the services on the node. So with this, we will remove the requesting of these certs on the services' profiles themselves. The reasoning for this is that for a containerized environment, the containers won't have credentials to the CA while the baremetal node does. So, with this, we will have this profile that still gets executed in the baremetal nodes, and we can subsequently pass the requested certificates by bind-mounting them on the containers. On the other hand, this approach still works well for the TLS-everywhere case when the services are running on baremetal. Change-Id: Ibf58dfd7d783090e927de6629e487f968f7e05b6 Depends-On: I4d2e62b5c1b893551f9478cf5f69173c334ac81f
2017-03-13congress/tacker: switch auth_uri to use uri_no_suffixEmilien Macchi2-4/+8
Switch Congress and Tacker to use auth_uri with keystone versionless endpoint. Change-Id: I7e17d061344849b0421f3a6c9571f1609e8861fb Partial-Implement: blueprint keystone-v3
2017-03-13gnocchi: deploy services with Keystone v3 endpointsEmilien Macchi2-6/+5
* Move swift_authurl to gnocchi-base hieradata, where other swift auth credentials live and switch it to versionless keystone endpoint. * Force swift_auth_version to 3 for Keystone v3. * Switch auth_uri to use versionless Keystone endpoint. * Switch auth_url to use Keystone admin endpoint (instead of internal). * Remove old parameters from gnocchi::api, not used anymore. Partial-blueprint: keystone-v3 Change-Id: I2feed8b1219069128faa1a1e8dcd2ddfbae7e40a
2017-03-13telemetry: switch auth_uri to uri_no_suffixEmilien Macchi3-3/+11
Switch Aodh, Ceilometer and Panko to use auth_uri parameter with keystone versionless endpoint. Change-Id: I5800f4161d0406d3717e1f539d23411b11378fbc Partial-implement: blueprint keystone-v3
2017-03-13cinder: switch auth_uri to uri_no_suffixEmilien Macchi1-1/+3
Switch Cinder to use auth_uri with keystone versionless endpoint. Change-Id: Iccc6e3df6a8bb1aca3667b1783bc7f6eebf262e5 Partial-implement: blueprint keystone-v3
2017-03-13heat: switch auth_uri to use uri_no_suffixEmilien Macchi1-1/+3
Switch Heat to use auth_uri with keystone versionless endpoint. Change-Id: Iddd091a659d37d965b216db9f536d30245cd3c3a Partial-implement: blueprint keystone-v3
2017-03-13ironic: switch auth_uri to uri_no_suffixEmilien Macchi1-1/+3
Switch Ironic to use auth_uri with keystone versionless endpoint. Change-Id: Ia8061a1e08bd31425f8d4192cd45b64b9f8e1f74 Partial-implement: blueprint keystone-v3
2017-03-13manila: switch auth_uri to use uri_no_suffixEmilien Macchi1-1/+3
Switch Manila to use auth_uri with keystone versionless endpoint. Change-Id: If05032a5c7d93b5787d3f18c0aa374bac3cbd478 Partial-implement: blueprint keystone-v3
2017-03-13neutron: switch auth_uri to uri_no_suffixEmilien Macchi1-2/+4
Switch Neutron to use auth_uri with keystone versionless endpoint, also for notifications with Nova. Change-Id: I530e3dcdfe6961e14755a63767c1fb5c0e1cfa22 Partial-implement: blueprint keystone-v3
2017-03-13nova: switch auth_uri to keystone versionless endpointEmilien Macchi2-2/+4
Switch nova authtoken auth_uri to use keystone endpoint without version. Also switch ironic config in nova.conf to use it. Change-Id: I8046f2eed0b9a7da76d6d7c3507a92bf5054b000 Partial-Implement: blueprint keystone-v3
2017-03-13Upgrades: wait for galera to be settledMichele Baldessari1-2/+4
We also need to wait for the galera resource to settle down before we proceed starting up with the other services. Note that before merging this, we need to land the following change in ansible-pacemaker: https://review.gerrithub.io/#/c/351387/ Change-Id: Id71c9cb41cfd4c17685c922db2683e28ab7588fd Closes-Bug: #1668372
2017-03-11Merge "Add BGPVPN composable service"Jenkins1-0/+34
2017-03-11Remove double quotes in the "when" Ansible conditional.Carlos Camacho4-4/+4
Change-Id: I677075012a948c7c32959680608255eff919b8d4
2017-03-10Add upgrade tasks for heat over httpdJuan Antonio Osorio Robles3-7/+34
Change-Id: Ia7b8c41d4d8135f58661a74a4298f60abb251fbe
2017-03-10Merge "Pass hieradata relevant for httpd in the Heat APIs"Jenkins3-18/+104
2017-03-10horizon: switch keystone_url to use uri_no_suffixEmilien Macchi1-1/+1
Switch Horizon to use keystone_url with keystone versionless endpoint. Change-Id: I7a22136937d414b2c3713894e04b0f093247ad33 Partial-implement: blueprint keystone-v3
2017-03-10Merge "Remove glance-base service"Jenkins2-136/+95
2017-03-10Add BGPVPN composable serviceRicardo Noriega1-0/+34
This project aims at supporting inter-connection between L3VPNs and Neutron resources, i.e. Networks, Routers and Ports. Partially-Implements: blueprint bgpvpn-service-integration Depends-On:I7c1686693a29cc1985f009bd7a3c268c0e211876 Change-Id: I576c9ac2b443dbb6886824b3da457dcc4f87b442 Signed-off-by: Ricardo Noriega <rnoriega@redhat.com>
2017-03-09Merge "Pass hieradata for internal TLS for RabbitMQ"Jenkins3-46/+119
2017-03-09Merge "Keystone token flush cron job should log to a file"Jenkins1-1/+1
2017-03-09Pass hieradata relevant for httpd in the Heat APIsJuan Antonio Osorio Robles3-18/+104
The patch this depends on passes through the classes some parameters that are meant to be passed via t-h-t. This patch addresses these and other things required for deploying these services over httpd: * Set the number of workers taking care not to set this value to 0. * Add the apache base hieradata to the service profiles. * Set the servernames and other httpd-specific values. bp tls-via-certmonger Change-Id: I88e5ea7b9bbf35ae03f84fdc3ec76ae09f11a1b6 Depends-On: I23971b0164468e67c9b3577772af84bd947e16f1
2017-03-09Improve SSL support for SensuMartin Mágr1-1/+14
This patch allows operator to create SSL certificates for SSL auth to RabbitMQ. Change-Id: I250aedcfdbe3b7a7e8c611c0e6122cf8fe0edda4
2017-03-09Merge "Add validation for VPP upgrade tasks"Jenkins1-1/+11
2017-03-09Merge "Set number of Swift proxy server workers to auto"Jenkins1-2/+2
2017-03-09Pass hieradata for internal TLS for RabbitMQJuan Antonio Osorio Robles3-46/+119
As with other services, this passes the necessary hieradata to enable TLS for RabbitMQ. This will mean (once we set it via puppet-tripleo) that there will only be TLS connections, as the ssl_only option is being used. bp tls-via-certmonger Change-Id: I960bf747cd5e3040f99b28e2fc5873ca3a7472b5 Depends-On: Ic2a7f877745a0a490ddc9315123bd1180b03c514
2017-03-09Merge "sahara: configure keystone_authtoken parameters"Jenkins1-3/+5
2017-03-08sahara: configure keystone_authtoken parametersEmilien Macchi1-3/+5
Configure keystone_authtoken for Sahara service. Change-Id: I045b7d1d52851ab0d532a8524fcea95705e3db78 Partial-implement: blueprint keystone-v3