docker/services/rabbitmq.yaml

   1 heat_template_version: pike
   2
   3 description: >
   4   OpenStack containerized Rabbitmq service
   5
   6 parameters:
   7   DockerRabbitmqImage:
   8     description: image
   9     type: string
  10   DockerRabbitmqConfigImage:
  11     description: The container image to use for the rabbitmq config_volume
  12     type: string
  13   EndpointMap:
  14     default: {}
  15     description: Mapping of service endpoint -> protocol. Typically set
  16                  via parameter_defaults in the resource registry.
  17     type: json
  18   ServiceData:
  19     default: {}
  20     description: Dictionary packing service data
  21     type: json
  22   ServiceNetMap:
  23     default: {}
  24     description: Mapping of service_name -> network name. Typically set
  25                  via parameter_defaults in the resource registry.  This
  26                  mapping overrides those in ServiceNetMapDefaults.
  27     type: json
  28   DefaultPasswords:
  29     default: {}
  30     type: json
  31   RoleName:
  32     default: ''
  33     description: Role name on which the service is applied
  34     type: string
  35   RoleParameters:
  36     default: {}
  37     description: Parameters specific to the role
  38     type: json
  39   RabbitCookie:
  40     type: string
  41     default: ''
  42     hidden: true
  43   EnableInternalTLS:
  44     type: boolean
  45     default: false
  46   InternalTLSCAFile:
  47     default: '/etc/ipa/ca.crt'
  48     type: string
  49     description: Specifies the default CA cert to use if TLS is used for
  50                  services in the internal network.
  51
  52 conditions:
  53
  54   internal_tls_enabled: {equals: [{get_param: EnableInternalTLS}, true]}
  55
  56 resources:
  57
  58   ContainersCommon:
  59     type: ./containers-common.yaml
  60
  61   RabbitmqBase:
  62     type: ../../puppet/services/rabbitmq.yaml
  63     properties:
  64       EndpointMap: {get_param: EndpointMap}
  65       ServiceData: {get_param: ServiceData}
  66       ServiceNetMap: {get_param: ServiceNetMap}
  67       DefaultPasswords: {get_param: DefaultPasswords}
  68       RoleName: {get_param: RoleName}
  69       RoleParameters: {get_param: RoleParameters}
  70
  71 outputs:
  72   role_data:
  73     description: Role data for the Rabbitmq API role.
  74     value:
  75       service_name: {get_attr: [RabbitmqBase, role_data, service_name]}
  76       # RabbitMQ plugins initialization occurs on every node
  77       config_settings:
  78         map_merge:
  79           - {get_attr: [RabbitmqBase, role_data, config_settings]}
  80           - rabbitmq::admin_enable: false
  81           - if:
  82             - internal_tls_enabled
  83             - tripleo::certmonger::rabbitmq::postsave_cmd: "true" # TODO: restart the rabbitmq container here
  84             - {}
  85       logging_source: {get_attr: [RabbitmqBase, role_data, logging_source]}
  86       logging_groups: {get_attr: [RabbitmqBase, role_data, logging_groups]}
  87       step_config: &step_config
  88         list_join:
  89           - "\n"
  90           - - "['Rabbitmq_policy', 'Rabbitmq_user'].each |String $val| { noop_resource($val) }"
  91             - get_attr: [RabbitmqBase, role_data, step_config]
  92       service_config_settings: {get_attr: [RabbitmqBase, role_data, service_config_settings]}
  93       # BEGIN DOCKER SETTINGS
  94       puppet_config:
  95         config_volume: rabbitmq
  96         step_config: *step_config
  97         config_image: &rabbitmq_config_image {get_param: DockerRabbitmqConfigImage}
  98       kolla_config:
  99         /var/lib/kolla/config_files/rabbitmq.json:
 100           command: /usr/lib/rabbitmq/bin/rabbitmq-server
 101           config_files:
 102             - source: "/var/lib/kolla/config_files/src/*"
 103               dest: "/"
 104               merge: true
 105               preserve_properties: true
 106             - source: "/var/lib/kolla/config_files/src-tls/*"
 107               dest: "/"
 108               merge: true
 109               preserve_properties: true
 110               optional: true
 111           permissions:
 112             - path: /var/lib/rabbitmq
 113               owner: rabbitmq:rabbitmq
 114               recurse: true
 115             - path: /etc/pki/tls/certs/rabbitmq.crt
 116               owner: rabbitmq:rabbitmq
 117               optional: true
 118             - path: /etc/pki/tls/private/rabbitmq.key
 119               owner: rabbitmq:rabbitmq
 120               optional: true
 121       docker_config:
 122         # Kolla_bootstrap runs before permissions set by kolla_config
 123         step_1:
 124           rabbitmq_init_logs:
 125             start_order: 0
 126             detach: false
 127             image: &rabbitmq_image {get_param: DockerRabbitmqImage}
 128             privileged: false
 129             user: root
 130             volumes:
 131               - /var/log/containers/rabbitmq:/var/log/rabbitmq
 132             command: ['/bin/bash', '-c', 'chown -R rabbitmq:rabbitmq /var/log/rabbitmq']
 133           rabbitmq_bootstrap:
 134             start_order: 1
 135             detach: false
 136             image: *rabbitmq_image
 137             net: host
 138             privileged: false
 139             volumes:
 140               list_concat:
 141                 - {get_attr: [ContainersCommon, volumes]}
 142                 -
 143                   - /var/lib/kolla/config_files/rabbitmq.json:/var/lib/kolla/config_files/config.json:ro
 144                   - /var/lib/config-data/puppet-generated/rabbitmq/:/var/lib/kolla/config_files/src:ro
 145                   - /var/lib/rabbitmq:/var/lib/rabbitmq
 146                   - /var/log/containers/rabbitmq:/var/log/rabbitmq
 147                 - if:
 148                   - internal_tls_enabled
 149                   -
 150                     - list_join:
 151                       - ':'
 152                       - - {get_param: InternalTLSCAFile}
 153                         - {get_param: InternalTLSCAFile}
 154                         - 'ro'
 155                     - /etc/pki/tls/certs/rabbitmq.crt:/var/lib/kolla/config_files/src-tls/etc/pki/tls/certs/rabbitmq.crt:ro
 156                     - /etc/pki/tls/private/rabbitmq.key:/var/lib/kolla/config_files/src-tls/etc/pki/tls/private/rabbitmq.key:ro
 157                   - null
 158             environment:
 159               - KOLLA_CONFIG_STRATEGY=COPY_ALWAYS
 160               - KOLLA_BOOTSTRAP=True
 161               -
 162                 list_join:
 163                   - '='
 164                   - - 'RABBITMQ_CLUSTER_COOKIE'
 165                     -
 166                       yaql:
 167                         expression: $.data.passwords.where($ != '').first()
 168                         data:
 169                           passwords:
 170                             - {get_param: RabbitCookie}
 171                             - {get_param: [DefaultPasswords, rabbit_cookie]}
 172           rabbitmq:
 173             start_order: 2
 174             image: *rabbitmq_image
 175             net: host
 176             privileged: false
 177             restart: always
 178             volumes:
 179               list_concat:
 180                 - {get_attr: [ContainersCommon, volumes]}
 181                 -
 182                   - /var/lib/kolla/config_files/rabbitmq.json:/var/lib/kolla/config_files/config.json:ro
 183                   - /var/lib/config-data/puppet-generated/rabbitmq/:/var/lib/kolla/config_files/src:ro
 184                   - /var/lib/rabbitmq:/var/lib/rabbitmq
 185                   - /var/log/containers/rabbitmq:/var/log/rabbitmq
 186                 - if:
 187                   - internal_tls_enabled
 188                   -
 189                     - list_join:
 190                       - ':'
 191                       - - {get_param: InternalTLSCAFile}
 192                         - {get_param: InternalTLSCAFile}
 193                         - 'ro'
 194                     - /etc/pki/tls/certs/rabbitmq.crt:/var/lib/kolla/config_files/src-tls/etc/pki/tls/certs/rabbitmq.crt:ro
 195                     - /etc/pki/tls/private/rabbitmq.key:/var/lib/kolla/config_files/src-tls/etc/pki/tls/private/rabbitmq.key:ro
 196                   - null
 197             environment:
 198               - KOLLA_CONFIG_STRATEGY=COPY_ALWAYS
 199       docker_puppet_tasks:
 200         # RabbitMQ users and policies initialization occurs only on single node
 201         step_1:
 202           config_volume: 'rabbit_init_tasks'
 203           puppet_tags: 'rabbitmq_policy,rabbitmq_user'
 204           step_config: 'include ::tripleo::profile::base::rabbitmq'
 205           config_image: *rabbitmq_config_image
 206           volumes:
 207             - /var/lib/config-data/rabbitmq/etc/rabbitmq/:/etc/rabbitmq/:ro
 208             - /var/lib/rabbitmq:/var/lib/rabbitmq:ro
 209       metadata_settings:
 210         get_attr: [RabbitmqBase, role_data, metadata_settings]
 211       host_prep_tasks:
 212         - name: create persistent directories
 213           file:
 214             path: "{{ item }}"
 215             state: directory
 216           with_items:
 217             - /var/log/containers/rabbitmq
 218             - /var/lib/rabbitmq
 219       upgrade_tasks:
 220         - name: Stop and disable rabbitmq service
 221           tags: step2
 222           service: name=rabbitmq-server state=stopped enabled=no