From 86d6c1ddc76bad423194e789ffb5474e4e12960e Mon Sep 17 00:00:00 2001 From: Yanis Guenane Date: Fri, 2 Oct 2015 12:18:08 +0200 Subject: Manage keystone initialization directly in t-h-t manifests This is the second change of a servies of two, it creates the user, user_role, service and endpoint for: * glance * nova * neutron * cinder * horizon * swift * ceilometer * heat Change-Id: I50e792d98a2ba516ff498c58ad402f463c5f7e76 --- puppet/controller.yaml | 249 ++++++++++++++++++++- puppet/hieradata/controller.yaml | 12 + puppet/manifests/overcloud_controller.pp | 9 + puppet/manifests/overcloud_controller_pacemaker.pp | 21 ++ 4 files changed, 289 insertions(+), 2 deletions(-) diff --git a/puppet/controller.yaml b/puppet/controller.yaml index 4504428d..009199d4 100644 --- a/puppet/controller.yaml +++ b/puppet/controller.yaml @@ -727,6 +727,24 @@ resources: - - 'http://' - {get_param: HeatApiVirtualIP} - ':8000/v1/waitcondition' + heat_public_url: + list_join: + - '' + - - 'http://' + - {get_param: PublicVirtualIP} + - ':8004/v1/%(tenant_id)s' + heat_internal_url: + list_join: + - '' + - - 'http://' + - {get_param: HeatApiVirtualIP} + - ':8004/v1/%(tenant_id)s' + heat_admin_url: + list_join: + - '' + - - 'http://' + - {get_param: HeatApiVirtualIP} + - ':8004/v1/%(tenant_id)s' heat_auth_encryption_key: {get_param: HeatAuthEncryptionKey} horizon_allowed_hosts: {get_param: HorizonAllowedHosts} horizon_secret: {get_param: HorizonSecret} @@ -759,6 +777,42 @@ resources: - '@' - {get_param: MysqlVirtualIP} - '/cinder' + cinder_public_url: + list_join: + - '' + - - 'http://' + - {get_param: PublicVirtualIP} + - ':8776/v1/%(tenant_id)s' + cinder_internal_url: + list_join: + - '' + - - 'http://' + - {get_param: CinderApiVirtualIP} + - ':8776/v1/%(tenant_id)s' + cinder_admin_url: + list_join: + - '' + - - 'http://' + - {get_param: CinderApiVirtualIP} + - ':8776/v1/%(tenant_id)s' + cinder_public_url_v2: + list_join: + - '' + - - 'http://' + - {get_param: PublicVirtualIP} + - ':8776/v2/%(tenant_id)s' + cinder_internal_url_v2: + list_join: + - '' + - - 'http://' + - {get_param: CinderApiVirtualIP} + - ':8776/v2/%(tenant_id)s' + cinder_admin_url_v2: + list_join: + - '' + - - 'http://' + - {get_param: CinderApiVirtualIP} + - ':8776/v2/%(tenant_id)s' glance_port: {get_param: GlancePort} glance_password: {get_param: GlancePassword} glance_backend: {get_param: GlanceBackend} @@ -911,7 +965,19 @@ resources: - '@' - {get_param: MysqlVirtualIP} - '/ovs_neutron?charset=utf8' - neutron_url: + neutron_internal_url: + list_join: + - '' + - - 'http://' + - {get_param: NeutronApiVirtualIP} + - ':9696' + neutron_public_url: + list_join: + - '' + - - 'http://' + - {get_param: PublicVirtualIP} + - ':9696' + neutron_admin_url: list_join: - '' - - 'http://' @@ -940,6 +1006,24 @@ resources: - '@' - {get_param: MysqlVirtualIP} - '/ceilometer' + ceilometer_public_url: + list_join: + - '' + - - 'http://' + - {get_param: PublicVirtualIP} + - ':8777' + ceilometer_internal_url: + list_join: + - '' + - - 'http://' + - {get_param: CeilometerApiVirtualIP} + - ':8777' + ceilometer_admin_url: + list_join: + - '' + - - 'http://' + - {get_param: CeilometerApiVirtualIP} + - ':8777' snmpd_readonly_user_name: {get_param: SnmpdReadonlyUserName} snmpd_readonly_user_password: {get_param: SnmpdReadonlyUserPassword} nova_password: {get_param: NovaPassword} @@ -951,6 +1035,60 @@ resources: - '@' - {get_param: MysqlVirtualIP} - '/nova' + nova_public_url: + list_join: + - '' + - - 'http://' + - {get_param: PublicVirtualIP} + - ':8774/v2/%(tenant_id)s' + nova_internal_url: + list_join: + - '' + - - 'http://' + - {get_param: NovaApiVirtualIP} + - ':8774/v2/%(tenant_id)s' + nova_admin_url: + list_join: + - '' + - - 'http://' + - {get_param: NovaApiVirtualIP} + - ':8774/v2/%(tenant_id)s' + nova_v3_public_url: + list_join: + - '' + - - 'http://' + - {get_param: PublicVirtualIP} + - ':8774/v3' + nova_v3_internal_url: + list_join: + - '' + - - 'http://' + - {get_param: NovaApiVirtualIP} + - ':8774/v3' + nova_v3_admin_url: + list_join: + - '' + - - 'http://' + - {get_param: NovaApiVirtualIP} + - ':8774/v3' + nova_ec2_public_url: + list_join: + - '' + - - 'http://' + - {get_param: PublicVirtualIP} + - ':8773/services/Cloud' + nova_ec2_internal_url: + list_join: + - '' + - - 'http://' + - {get_param: NovaApiVirtualIP} + - ':8773/services/Cloud' + nova_ec2_admin_url: + list_join: + - '' + - - 'http://' + - {get_param: NovaApiVirtualIP} + - ':8773/services/Admin' fencing_config: {get_param: FencingConfig} pcsd_password: {get_param: PcsdPassword} rabbit_username: {get_param: RabbitUserName} @@ -980,6 +1118,42 @@ resources: swift_replicas: {get_param: SwiftReplicas} swift_min_part_hours: {get_param: SwiftMinPartHours} swift_mount_check: {get_param: SwiftMountCheck} + swift_public_url: + list_join: + - '' + - - 'http://' + - {get_param: PublicVirtualIP} + - ':8080/v1/AUTH_%(tenant_id)s' + swift_internal_url: + list_join: + - '' + - - 'http://' + - {get_param: SwiftProxyVirtualIP} + - ':8080/v1/AUTH_%(tenant_id)s' + swift_admin_url: + list_join: + - '' + - - 'http://' + - {get_param: SwiftProxyVirtualIP} + - ':8080' + swift_public_url_s3: + list_join: + - '' + - - 'http://' + - {get_param: PublicVirtualIP} + - ':8080' + swift_internal_url_s3: + list_join: + - '' + - - 'http://' + - {get_param: SwiftProxyVirtualIP} + - ':8080' + swift_admin_url_s3: + list_join: + - '' + - - 'http://' + - {get_param: SwiftProxyVirtualIP} + - ':8080' enable_package_install: {get_param: EnablePackageInstall} enable_package_upgrade: {get_attr: [UpdateDeployment, update_managed_packages]} swift_proxy_network: {get_attr: [NetIpMap, net_ip_map, {get_param: [ServiceNetMap, SwiftProxyNetwork]}]} @@ -997,6 +1171,30 @@ resources: - ':' - {get_param: GlancePort} glance_registry_host: {get_param: GlanceRegistryVirtualIP} + glance_public_url: + list_join: + - '' + - - {get_param: GlanceProtocol} + - '://' + - {get_param: PublicVirtualIP} + - ':' + - {get_param: GlancePort} + glance_internal_url: + list_join: + - '' + - - {get_param: GlanceProtocol} + - '://' + - {get_param: GlanceApiVirtualIP} + - ':' + - {get_param: GlancePort} + glance_admin_url: + list_join: + - '' + - - {get_param: GlanceProtocol} + - '://' + - {get_param: GlanceApiVirtualIP} + - ':' + - {get_param: GlancePort} heat_api_network: {get_attr: [NetIpMap, net_ip_map, {get_param: [ServiceNetMap, HeatApiNetwork]}]} keystone_public_api_network: {get_attr: [NetIpMap, net_ip_map, {get_param: [ServiceNetMap, KeystonePublicApiNetwork]}]} keystone_admin_api_network: {get_attr: [NetIpMap, net_ip_map, {get_param: [ServiceNetMap, KeystoneAdminApiNetwork]}]} @@ -1083,6 +1281,14 @@ resources: tripleo::ringbuilder::replicas: {get_input: swift_replicas} tripleo::ringbuilder::min_part_hours: {get_input: swift_min_part_hours} swift_mount_check: {get_input: swift_mount_check} + swift::keystone::auth::public_url: {get_input: swift_public_url } + swift::keystone::auth::internal_url: {get_input: swift_internal_url } + swift::keystone::auth::admin_url: {get_input: swift_admin_url } + swift::keystone::auth::public_url_s3: {get_input: swift_public_url_v3 } + swift::keystone::auth::internal_url_s3: {get_input: swift_internal_url_v3 } + swift::keystone::auth::admin_url_s3: {get_input: swift_admin_url_v3 } + swift::keystone::auth::password: {get_input: swift_password } + swift::keystone::auth::region: {get_input: keystone_region} # NOTE(dprince): build_ring support is currently not wired in. # See: https://review.openstack.org/#/c/109225/ @@ -1110,6 +1316,14 @@ resources: cinder::glance::glance_api_servers: {get_input: glance_api_servers} cinder_backend_config: {get_input: CinderBackendConfig} cinder::db::mysql::password: {get_input: cinder_password} + cinder::keystone::auth::public_url: {get_input: cinder_public_url } + cinder::keystone::auth::internal_url: {get_input: cinder_internal_url } + cinder::keystone::auth::admin_url: {get_input: cinder_admin_url } + cinder::keystone::auth::public_url_v2: {get_input: cinder_public_url_v2 } + cinder::keystone::auth::internal_url_v2: {get_input: cinder_internal_url_v2 } + cinder::keystone::auth::admin_url_v2: {get_input: cinder_admin_url_v2 } + cinder::keystone::auth::password: {get_input: cinder_password } + cinder::keystone::auth::region: {get_input: keystone_region} # Glance glance::api::bind_port: {get_input: glance_port} @@ -1134,6 +1348,11 @@ resources: glance::backend::swift::swift_store_key: {get_input: glance_password} glance_backend: {get_input: glance_backend} glance::db::mysql::password: {get_input: glance_password} + glance::keystone::auth::public_url: {get_input: glance_public_url } + glance::keystone::auth::internal_url: {get_input: glance_internal_url } + glance::keystone::auth::admin_url: {get_input: glance_admin_url } + glance::keystone::auth::password: {get_input: glance_password } + glance::keystone::auth::region: {get_input: keystone_region} glance_file_pcmk_device: {get_input: glance_file_pcmk_device} glance_file_pcmk_fstype: {get_input: glance_file_pcmk_fstype} glance_file_pcmk_manage: {get_input: glance_file_pcmk_manage} @@ -1159,6 +1378,11 @@ resources: heat::database_connection: {get_input: heat_dsn} heat::debug: {get_input: debug} heat::db::mysql::password: {get_input: heat_password} + heat::keystone::auth::public_url: {get_input: heat_public_url } + heat::keystone::auth::internal_url: {get_input: heat_internal_url } + heat::keystone::auth::admin_url: {get_input: heat_admin_url } + heat::keystone::auth::password: {get_input: heat_password } + heat::keystone::auth::region: {get_input: keystone_region} # Keystone keystone::admin_token: {get_input: admin_token} @@ -1240,6 +1464,11 @@ resources: neutron_dsn: {get_input: neutron_dsn} neutron::agents::metadata::auth_url: {get_input: keystone_identity_uri} neutron::db::mysql::password: {get_input: neutron_password} + neutron::keystone::auth::public_url: {get_input: neutron_public_url } + neutron::keystone::auth::internal_url: {get_input: neutron_internal_url } + neutron::keystone::auth::admin_url: {get_input: neutron_admin_url } + neutron::keystone::auth::password: {get_input: neutron_password } + neutron::keystone::auth::region: {get_input: keystone_region} # Ceilometer ceilometer_backend: {get_input: ceilometer_backend} @@ -1258,6 +1487,11 @@ resources: ceilometer::agent::auth::auth_url: {get_input: keystone_auth_address} ceilometer::agent::central::coordination_url: {get_input: ceilometer_coordination_url} ceilometer::db::mysql::password: {get_input: ceilometer_password} + ceilometer::keystone::auth::public_url: {get_input: ceilometer_public_url } + ceilometer::keystone::auth::internal_url: {get_input: ceilometer_internal_url } + ceilometer::keystone::auth::admin_url: {get_input: ceilometer_admin_url } + ceilometer::keystone::auth::password: {get_input: ceilometer_password } + ceilometer::keystone::auth::region: {get_input: keystone_region} snmpd_readonly_user_name: {get_input: snmpd_readonly_user_name} snmpd_readonly_user_password: {get_input: snmpd_readonly_user_password} @@ -1276,10 +1510,21 @@ resources: nova::glance_api_servers: {get_input: glance_api_servers} nova::api::neutron_metadata_proxy_shared_secret: {get_input: neutron_metadata_proxy_shared_secret} nova::network::neutron::neutron_admin_password: {get_input: neutron_password} - nova::network::neutron::neutron_url: {get_input: neutron_url} + nova::network::neutron::neutron_url: {get_input: neutron_internal_url} nova::network::neutron::neutron_admin_auth_url: {get_input: neutron_admin_auth_url} nova::vncproxy::host: {get_input: nova_api_network} nova::db::mysql::password: {get_input: nova_password} + nova::keystone::auth::public_url: {get_input: nova_public_url} + nova::keystone::auth::internal_url: {get_input: nova_internal_url} + nova::keystone::auth::admin_url: {get_input: nova_admin_url} + nova::keystone::auth::public_url_v3: {get_input: nova_v3_public_url} + nova::keystone::auth::internal_url_v3: {get_input: nova_v3_internal_url} + nova::keystone::auth::admin_url_v3: {get_input: nova_v3_admin_url} + nova::keystone::auth::ec2_public_url: {get_input: nova_ec2_public_url} + nova::keystone::auth::ec2_internal_url: {get_input: nova_ec2_internal_url} + nova::keystone::auth::ec2_admin_url: {get_input: nova_ec2_admin_url} + nova::keystone::auth::password: {get_input: nova_password } + nova::keystone::auth::region: {get_input: keystone_region} # Horizon apache::ip: {get_input: horizon_network} diff --git a/puppet/hieradata/controller.yaml b/puppet/hieradata/controller.yaml index 81ee7cfb..07bfe543 100644 --- a/puppet/hieradata/controller.yaml +++ b/puppet/hieradata/controller.yaml @@ -39,6 +39,13 @@ cinder::api::keystone_tenant: 'service' swift::proxy::authtoken::admin_tenant_name: 'service' ceilometer::api::keystone_tenant: 'service' heat::keystone_tenant: 'service' +glance::keystone::auth::tenant: 'service' +nova::keystone::auth::tenant: 'service' +neutron::keystone::auth::tenant: 'service' +cinder::keystone::auth::tenant: 'service' +swift::keystone::auth::tenant: 'service' +ceilometer::keystone::auth::tenant: 'service' +heat::keystone::auth::tenant: 'service' # keystone keystone::cron::token_flush::maxdelay: 3600 @@ -60,6 +67,10 @@ swift::proxy::pipeline: - 'proxy-server' swift::proxy::account_autocreate: true +swift::keystone::auth::configure_s3_endpoint: false +swift::keystone::auth::operator_roles: + - admin + - swiftoperator # glance glance::api::pipeline: 'keystone' @@ -77,6 +88,7 @@ nova::notify_on_state_change: 'vm_and_task_state' nova::api::default_floating_pool: 'public' nova::api::osapi_v3: true nova::scheduler::filter::ram_allocation_ratio: '1.0' +nova::keystone::auth::configure_ec2_endpoint: false # ceilometer ceilometer::agent::auth::auth_endpoint_type: 'internalURL' diff --git a/puppet/manifests/overcloud_controller.pp b/puppet/manifests/overcloud_controller.pp index 813309e4..96302f2e 100644 --- a/puppet/manifests/overcloud_controller.pp +++ b/puppet/manifests/overcloud_controller.pp @@ -484,6 +484,15 @@ if hiera('step') >= 3 { if hiera('step') >= 4 { include ::keystone::cron::token_flush + + include ::ceilometer::keystone::auth + include ::cinder::keystone::auth + include ::glance::keystone::auth + include ::heat::keystone::auth + include ::neutron::keystone::auth + include ::nova::keystone::auth + include ::swift::keystone::auth + } #END STEP 4 $package_manifest_name = join(['/var/lib/tripleo/installed-packages/overcloud_controller', hiera('step')]) diff --git a/puppet/manifests/overcloud_controller_pacemaker.pp b/puppet/manifests/overcloud_controller_pacemaker.pp index 71811563..462530e9 100644 --- a/puppet/manifests/overcloud_controller_pacemaker.pp +++ b/puppet/manifests/overcloud_controller_pacemaker.pp @@ -1557,6 +1557,27 @@ if hiera('step') >= 5 { } -> class {'::keystone::endpoint' : require => Pacemaker::Resource::Service[$::keystone::params::service_name], + } -> + class { '::ceilometer::keystone::auth' : + require => Pacemaker::Resource::Service[$::keystone::params::service_name], + } -> + class { '::cinder::keystone::auth' : + require => Pacemaker::Resource::Service[$::keystone::params::service_name], + } -> + class { '::glance::keystone::auth' : + require => Pacemaker::Resource::Service[$::keystone::params::service_name], + } -> + class { '::heat::keystone::auth' : + require => Pacemaker::Resource::Service[$::keystone::params::service_name], + } -> + class { '::neutron::keystone::auth' : + require => Pacemaker::Resource::Service[$::keystone::params::service_name], + } -> + class { '::nova::keystone::auth' : + require => Pacemaker::Resource::Service[$::keystone::params::service_name], + } -> + class { '::swift::keystone::auth' : + require => Pacemaker::Resource::Service[$::keystone::params::service_name], } } -- cgit 1.2.3-korg