1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
|
heat_template_version: pike
description: >
OpenStack containerized Tacker service
parameters:
DockerNamespace:
description: namespace
default: 'tripleoupstream'
type: string
DockerTackerImage:
description: image
default: 'centos-binary-tacker:latest'
type: string
DockerTackerConfigImage:
description: image
default: 'centos-binary-tacker:latest'
type: string
EndpointMap:
default: {}
description: Mapping of service endpoint -> protocol. Typically set
via parameter_defaults in the resource registry.
type: json
ServiceNetMap:
default: {}
description: Mapping of service_name -> network name. Typically set
via parameter_defaults in the resource registry. This
mapping overrides those in ServiceNetMapDefaults.
type: json
DefaultPasswords:
default: {}
type: json
RoleName:
default: ''
description: Role name on which the service is applied
type: string
RoleParameters:
default: {}
description: Parameters specific to the role
type: json
resources:
ContainersCommon:
type: ./containers-common.yaml
TackerBase:
type: ../../puppet/services/tacker.yaml
properties:
EndpointMap: {get_param: EndpointMap}
ServiceNetMap: {get_param: ServiceNetMap}
DefaultPasswords: {get_param: DefaultPasswords}
RoleName: {get_param: RoleName# Copyright 2016 Red Hat, Inc.
#
# Licensed under the Apache License, Version 2.0 (the "License"); you may
# not use this file except in compliance with the License. You may obtain
# a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
# License for the specific language governing permissions and limitations
# under the License.
#
# == Class: tripleo::profile::pacemaker::haproxy
#
# HAproxy with Pacemaker HA profile for tripleo
#
# === Parameters
#
# [*haproxy_docker_image*]
# (Optional) The docker image to use for creating the pacemaker bundle
# Defaults to hiera('tripleo::profile::pacemaker::haproxy::haproxy_docker_image', undef)
#
# [*bootstrap_node*]
# (Optional) The hostname of the node responsible for bootstrapping tasks
# Defaults to hiera('haproxy_short_bootstrap_node_name')
#
# [*enable_load_balancer*]
# (Optional) Whether load balancing is enabled for this cluster
# Defaults to hiera('enable_load_balancer', true)
#
# [*ca_bundle*]
# (Optional) The path to the CA file that will be used for the TLS
# configuration. It's only used if internal TLS is enabled.
# Defaults to hiera('tripleo::haproxy::ca_bundle', undef)
#
# [*crl_file*]
# (Optional) The path to the file that contains the certificate
# revocation list. It's only used if internal TLS is enabled.
# Defaults to hiera('tripleo::haproxy::crl_file', undef)
#
# [*deployed_ssl_cert_path*]
# (Optional) The filepath of the certificate as it will be stored in
# the controller.
# Defaults to hiera('tripleo::haproxy::service_certificate', undef)
#
# [*enable_internal_tls*]
# (Optional) Whether TLS in the internal network is enabled or not.
# Defaults to hiera('enable_internal_tls', false)
#
# [*internal_certs_directory*]
# (Optional) Directory the holds the certificates to be used when
# when TLS is enabled in the internal network
# Defaults to undef
#
# [*internal_keys_directory*]
# (Optional) Directory the holds the certificates to be used when
# when TLS is enabled in the internal network
# Defaults to undef
#
# [*step*]
# (Optional) The current step in deployment. See tripleo-heat-templates
# for more details.
# Defaults to hiera('step')
#
# [*pcs_tries*]
# (Optional) The number of times pcs commands should be retried.
# Defaults to hiera('pcs_tries', 20)
#
class tripleo::profile::pacemaker::haproxy_bundle (
$haproxy_docker_image = hiera('tripleo::profile::pacemaker::haproxy::haproxy_docker_image', undef),
$bootstrap_node = hiera('haproxy_short_bootstrap_node_name'),
$enable_load_balancer = hiera('enable_load_balancer', true),
$ca_bundle = hiera('tripleo::haproxy::ca_bundle', undef),
$crl_file = hiera('tripleo::haproxy::crl_file', undef),
$enable_internal_tls = hiera('enable_internal_tls', false),
$internal_certs_directory = undef,
$internal_keys_directory = undef,
$deployed_ssl_cert_path = hiera('tripleo::haproxy::service_certificate', undef),
$step = Integer(hiera('step')),
$pcs_tries = hiera('pcs_tries', 20),
) {
include ::tripleo::profile::base::haproxy
if $::hostname == downcase($bootstrap_node) {
$pacemaker_master = true
} else {
$pacemaker_master = false
}
if $step >= 1 and $pacemaker_master and hiera('stack_action') == 'UPDATE' and $enable_load_balancer {
tripleo::pacemaker::resource_restart_flag { 'haproxy-clone':
subscribe => Concat['/etc/haproxy/haproxy.cfg'],
}
}
if $step >= 2 and $enable_load_balancer {
if $pacemaker_master {
$haproxy_short_node_names = hiera('haproxy_short_node_names')
$haproxy_short_node_names.each |String $node_name| {
pacemaker::property { "haproxy-role-${node_name}":
property => 'haproxy-role',
value => true,
tries => $pcs_tries,
node => $node_name,
before => Pacemaker::Resource::Bundle['haproxy-bundle'],
}
}
$haproxy_location_rule = {
resource_discovery => 'exclusive',
score => 0,
expression => ['haproxy-role eq true'],
}
# FIXME: we should not have to access tripleo::haproxy class
# parameters here to configure pacemaker VIPs. The configuration
# of pacemaker VIPs could move into puppet-tripleo or we should
# make use of less specific hiera parameters he
|
