aboutsummaryrefslogtreecommitdiffstats
path: root/puppet
AgeCommit message (Collapse)AuthorFilesLines
2016-11-01Enable internal TLS for Nova APIJuan Antonio Osorio Robles1-4/+13
This adds the necessary hieradata for enabling TLS in the internal network for Nova API. bp tls-via-certmonger Depends-On: I88380a1ed8fd597a1a80488cbc6ce357f133bd70 Change-Id: I45197f98e5b65d6b2ec364676870db4ce582ffe9
2016-10-31Merge "Enable internal TLS for aodh"Jenkins1-2/+11
2016-10-31Merge "Fix Swift proxy pipeline ordering"Jenkins1-1/+1
2016-10-31Merge "Enable internal TLS for ceilometer"Jenkins1-3/+11
2016-10-28Fix Swift proxy pipeline orderingChristian Schwede1-1/+1
The Ceilometer middleware is in the wrong place; actually any middleware should be deployed after catch_errors to catch any errors that would otherwise crash the proxy service. Additionally the ceilometer middleware should be deployed after any authentication middleware. Closes-Bug: 1637471 Co-Authored-By: Thiago da Silva <thiago@redhat.com> Change-Id: I710ff2f51271a78582fa502e7eecfa687800c664
2016-10-28Add option to disable "d1" Swift deviceChristian Schwede1-2/+5
A default TripleO installation uses a local directory named "d1" to be used by Swift. With SwiftRawDisks set it is highly unlikely that that an operator wants to use this any longer, because it affects system perforamce and might result in an overfilled the system disk. In this case d1 should be no longer when building rings. This patch makes it possible to disable the d1 device usage in the ring building process by using a new option "SwiftUseLocalDir". This is set by default to true, not changing the default behavior. If set to false, the d1 device won't be used when building rings. Closes-Bug: 1634051 Change-Id: Ia9ad38e3ffa533e170f4cedd0518d830e9b2fa69
2016-10-27Set cinder's service name to httpd via t-h-tJuan Antonio Osorio Robles1-0/+1
With this, we can clean it from puppet-tripleo. Change-Id: I13638cd1af52537bef8540f0d5fa5f5f7decd392 Depends-On: Ic1967a6f4f60a273965811516f33121115d518b4
2016-10-26Merge "Remove double tcp_listen_options entries for rabbit"Jenkins1-1/+1
2016-10-26Merge "Remove duplicate bind_host from nova-api profile"Jenkins1-1/+0
2016-10-26Fix usage of SwiftRawDisksChristian Schwede1-1/+1
Using the SwiftRawDisks parameter neither created the XFS filesystem nor mounted the device, requiring manual intervention by an operaror. Partial-Bug: 1634051 Change-Id: I2da0f12635a37c1f339a3be59a7d00f352adf283
2016-10-24Enables auto-detection for VIP interfacesTim Rozet2-17/+9
Previously the ctrl plane VIP would default to 'br-ex' which in non-vlan deployments ends up being the wrong interface. The public VIP interface was also defaulted to 'br-ex' which would be incorrect for vlan based deployments. Since a user has already given the nic template (and in most cases the subnet that corresponds to the nic) the installer should be able to figure out which interface the public/control vip should be on. These changes enable that type of auto-detection, unless a user explicitly overrides the heat parameters for ControlVirtualInterface and PublicVirtualInterface. Also, incorrect parameters from haproxy service are removed. Depends-On: I05105fce85be8ace986db351cdca2916f405ed04 Closes-Bug: 1606632 Change-Id: I3c1c39824ec32ced304a782edc6ef49c0769c108 Signed-off-by: Tim Rozet <trozet@redhat.com>
2016-10-21Merge "Composable Mistral services"Jenkins4-0/+221
2016-10-21Merge "Prefill Sensu client custom config"Jenkins1-1/+16
2016-10-21Merge "Clarify horizon allowed hosts setting"Jenkins1-1/+2
2016-10-21Merge "Use correct password for keystone bootstrap"Jenkins1-0/+1
2016-10-21Clarify horizon allowed hosts settingMatthias Runge1-1/+2
Horizon allowed hosts should name the IP addresses/ DNS names (short/long) the Horizon node is listening to. Allowed hosts is used for header checks and is a security mechanism. Change-Id: I81c96357f969a1a436eecd35eb178579159bc719
2016-10-21Merge "Use ::os_workers fact instead of ::processorcount"Jenkins2-2/+2
2016-10-21Merge "Add parameters to run cinder over httpd"Jenkins1-1/+29
2016-10-21Re-add NFS backend for GlanceJiri Stransky1-0/+18
We lost ability to store Glance images in NFS mounts as we moved to NG HA architecture. This patch re-adds that ability, but the parameter interface changes because the semantics change as well. (Pacemaker allowed for different mounts than just NFS so the parameters were more generic, although we only ever tested and documented NFS usage.) Change-Id: Ic5197e09846bbf75d780dcc74da1717dcf8301d0 Related-Bug: #1635606
2016-10-21Merge "Include ceilometer in swift proxy pipeline"Jenkins1-0/+12
2016-10-21Merge "Removes EnableODL heat parameter and fixes missing local_ip param"Jenkins2-5/+1
2016-10-21Use ::os_workers fact instead of ::processorcountJuan Antonio Osorio Robles2-2/+2
Change-Id: Ib25849565c617f32357ef545957f58454b2a53f8
2016-10-21Composable Mistral servicesBrad P. Crochet4-0/+221
Adds new puppet specific services for Mistral API and Mistral Engine. This submission enables the mistral service by default in the overcloud, a following submission will disable it and make it optional by enabling it on demand based in an environment file. Depends-On: Iae42ffa37c4c9b1e070b7c3753e04c45bb97703f Depends-On: I942d419be951651e305d01460f394870c30a9878 Depends-On: I6cb2cbf4a2abf494668d24b8c36b0d525643f0af Implements: blueprint composable-services-within-roles Co-Authored-By: Carlos Camacho <ccamacho@redhat.com> Change-Id: Id5ff9cb498b5a47af38413d211ff0ed6ccd0015b
2016-10-21Merge "Generate internal TLS hieradata for apache services"Jenkins3-20/+99
2016-10-21Remove double tcp_listen_options entries for rabbitMichele Baldessari1-1/+1
After a brand new deployment we have the following in rabbitmq.config: ... {rabbit, [ {tcp_listen_options, [binary, {packet, raw}, {reuseaddr, true}, {backlog, 128}, {nodelay, true}, {exit_on_close, false}] }, {tcp_listen_options, [binary, {packet, raw}, {reuseaddr, true}, {backlog, 128}, {nodelay, true}, {exit_on_close, false}, {keepalive, true}]}, ... Let's remove these duplicate entries and make sure that we use the parameters for the puppet module to set the following values explicitely (it's the only parameter where we do not use the default setting from the puppet module): keepalive = true -> rabbitmq::tcp_keepalive: true All the other options that we set are the default in the puppet module: {packet, raw} {reuseaddr, true} {backlog, 128}{nodelay, true} {exit_on_close, false} Depends-On: I608477d5714a5081b3b4ab3b9fc2932bdd598301 Change-Id: I35921652bd84d1d6be0727051294983d4a0dde10
2016-10-20Open port 16509 for libvirt for live migrationJames Slagle1-0/+4
Port 16509 should be opened for tcp traffic to enable live migration. See Also: http://docs.openstack.org/admin-guide/compute-configuring-migrations.html Previously, we were not enabling any iptables rules on the Compute Roles, so this is a regression. Change-Id: Ie4abf53dc2a8171af48d02e34a1a3ad43f27cfb3 Closes-Bug: #1635427
2016-10-20Include ceilometer in swift proxy pipelinePradeep Kilambi1-0/+12
new ceilometermiddleware is available and integrated into puppet-swift. Lets leverage it and include it in the swift proxy pipeline. The correcponding puppet triple change for this is Ie49f4a750368ff174b23b8d6baa743d0956d727e Closes-Bug: #1631108 Change-Id: I82da0240d60d1eed54f1c0927e6157bb63025a19
2016-10-20Enable internal TLS for gnocchiJuan Antonio Osorio Robles1-2/+11
This adds the necessary hieradata for enabling TLS in the internal network for gnocchi. bp tls-via-certmonger Depends-On: Ie983933e062ac6a7f0af4d88b32634e6ce17838b Change-Id: Iad8d4949ada8b8fd52e0d0bd345b6fb1ca65827b
2016-10-20Enable internal TLS for aodhJuan Antonio Osorio Robles1-2/+11
This adds the necessary hieradata for enabling TLS in the internal network for aodh. bp tls-via-certmonger Change-Id: I2ea160e3ac0775404d6ed302f475268d3a3031ef Depends-On: I50ef0c8fbecb19d6597a28290daa61a91f3b13fc
2016-10-20Enable internal TLS for ceilometerJuan Antonio Osorio Robles1-3/+11
This adds the necessary hieradata for enabling TLS in the internal network for ceilometer. bp tls-via-certmonger Depends-On: Ib5609f77a31b17ed12baea419ecfab5d5f676496 Change-Id: I3eb34efbc8489b23269f97f762d4a3d0fa69f666
2016-10-20Generate internal TLS hieradata for apache servicesJuan Antonio Osorio Robles3-20/+99
This adds an environment file that can be used to enable TLS in the internal endpoints via certmonger if used. This will include a nested stack that will create the hash that will be used to create the certmonger certificates. When setting up a service over apache via puppet, we used to disable explicitly ssl (which sets modd_ssl-related fields for that vhost). We now make this depend on the EnableInternalTLS flag. This has only been done for keystone, but more services will be added as the puppet code lands bp tls-via-certmonger Depends-On: I303f6cf47859284785c0cdc65284a7eb89a4e039 Change-Id: I12e794f2d4076be9505dabfe456c1ca6cfbd359c
2016-10-20Remove duplicate bind_host from nova-api profileJuan Antonio Osorio Robles1-1/+0
Change-Id: I3c5c7753237ebaf16fb40806df0d195cb2b9aaa0
2016-10-19Add Barbican to the overcloudAde Lee1-0/+127
Co-Authored-By: Juan Antonio Osorio Robles <jaosorior@redhat.com> Depends-On: If2804b469eb3ee08f3f194c7dd3290d23a245a7a Depends-On: I091ecfbcb2e38fe77203244ac7a597aedcb558fb Change-Id: Iacc504fc4fa2d06893917024ce2340d3fb80b626
2016-10-18Merge "Set nova service_name via t-h-t"Jenkins1-0/+1
2016-10-18Merge "Fix api_extensions_path in neutron-opencontrail environment"Jenkins1-1/+1
2016-10-18Merge "Enable proxy headers parsing for Neutron"Jenkins1-0/+1
2016-10-18Merge "Add apache workers to nova-api conditional"Jenkins1-1/+1
2016-10-18Add parameters to run cinder over httpdJuan Antonio Osorio Robles1-1/+29
This adds the necessary hieradata to run cinder over httpd instead of eventlet. Change-Id: Ic1967a6f4f60a273965811516f33121115d518b4
2016-10-18Fix api_extensions_path in neutron-opencontrail environmentCyril Lopez1-1/+1
There is a missing repositiry for LBaaS in api_extensions_path in neutron-opencontrail. This patch is working in my lab : tripleo liberty and opencontrail 3.0.2 Closes-Bug: #1634120 Change-Id: Ie06612faf226d0e5e75f3f8a9b560118cba5ff4c Signed-off-by: Cyril Lopez <cylopez@redhat.com>
2016-10-17Add apache workers to nova-api conditionalSteven Hardy1-1/+1
Without this httpd fails to start on deployments where the worker count isn't explicitly overridden via a parameter. Change-Id: Ie7b31bc6e022a0166af126c866994bdd019718df Closes-Bug: #1634213
2016-10-17Removes EnableODL heat parameter and fixes missing local_ip paramTim Rozet2-5/+1
EnableOpenDaylightOnController was not very composable. Removing this parameter to make the service truly composable. Also fixes missing local_ip setting for OVS, required for VXLAN or GRE tenant networks. Closes-Bug: 1633625 Depends-On: Ia55c05e12d5d434111a13e1ed795da530e3ff4a5 Change-Id: I0e07e1631793311334d1436ee8fdf9af2802ba70 Signed-off-by: Tim Rozet <trozet@redhat.com>
2016-10-17Set nova service_name via t-h-tJuan Antonio Osorio Robles1-0/+1
with the move to use httpd instead of eventlet, We now add this parameter in t-h-t to be able to clean it up from the puppet-tripleo manifest. Change-Id: Ic229182cc5c887b57f6182c3db1bac8bed330f7c Depends-On: I4603b81d30a704b07eef461b3cdbfe164614b04f
2016-10-17Enable proxy headers parsing for NeutronJuan Antonio Osorio Robles1-0/+1
http_proxy_to_wsgi middleware was recently added to Neutron [1] and in order to take it into use, we need to enable it via hiera. [1] Ice9ee8f4e04050271d59858f92034c230325718b Depends-On: I99bc9486fdd85857ce73c413e17400320bd6ec5b Related-Bug: #1590608 Change-Id: I10c065e726f2708e09acfc04dac3cae34a534d23
2016-10-17glance_multiple_locations when NovaEnableRbdBackend=trueAttila Fazekas1-1/+1
glance_multiple_locations does not needed when the NovaEnableRbdBackend=false, but it is neede when both the image and the instance storage is rbd and the show_image_direct_url is enabled. The condition introduced in Ia7e0558e4f318640981abb44d188e3479b5eae69 Change-Id: Ia8a8cd9aeda69e9a7db6f95dcf418f56e29cae00 Closes-Bug: 1632285
2016-10-14Merge "Modify the constraint to allow single quote for DPDK core list param"Jenkins1-1/+1
2016-10-14Merge "Move trunk service plugin to the proper list"Jenkins2-2/+2
2016-10-14Merge "Pass heat domain admin password to keystone"Jenkins1-0/+3
2016-10-14Merge "Fixes missing provider mappings for OpenDaylight"Jenkins1-0/+10
2016-10-14heat-api-cfn endpoint is created to RegionOne instead of regionOneLuca Lorenzetto1-1/+1
When deploying, heat-api-cfn is assigned to RegionOne. This leads to a bad user experience when logging into horizon, because if RegionOne is selected by default, the users finds all menus empty (no computing, or anything else). Thanks to trown for finding out the issue. Closes-Bug: 1633524 Change-Id: Ic108280f6b0875ffec10be6f696669962fb82e6b
2016-10-14Fixes missing provider mappings for OpenDaylightTim Rozet1-0/+10
Provider mappings were not parameterized, and this is traditionally required for VLAN provider networks. In ODL Boron with new netvirt, this value is required to be set in order to use external networks. Closes-Bug: #1627898 Change-Id: I8001a4077fc7c4af458033043ea438c32c9772b0 Signed-off-by: Tim Rozet <trozet@redhat.com>