puppet/manifests/overcloud_controller_pacemaker.pp

   1 # Copyright 2015 Red Hat, Inc.
   2 # All Rights Reserved.
   3 #
   4 # Licensed under the Apache License, Version 2.0 (the "License"); you may
   5 # not use this file except in compliance with the License. You may obtain
   6 # a copy of the License at
   7 #
   8 #     http://www.apache.org/licenses/LICENSE-2.0
   9 #
  10 # Unless required by applicable law or agreed to in writing, software
  11 # distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
  12 # WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
  13 # License for the specific language governing permissions and limitations
  14 # under the License.
  15
  16 Pcmk_resource <| |> {
  17   tries     => 10,
  18   try_sleep => 3,
  19 }
  20
  21 # TODO(jistr): use pcs resource provider instead of just no-ops
  22 Service <|
  23   tag == 'aodh-service' or
  24   tag == 'cinder-service' or
  25   tag == 'ceilometer-service' or
  26   tag == 'glance-service' or
  27   tag == 'heat-service' or
  28   tag == 'keystone-service' or
  29   tag == 'neutron-service' or
  30   tag == 'nova-service' or
  31   tag == 'sahara-service'
  32 |> {
  33   hasrestart => true,
  34   restart    => '/bin/true',
  35   start      => '/bin/true',
  36   stop       => '/bin/true',
  37 }
  38
  39 include ::tripleo::packages
  40 include ::tripleo::firewall
  41
  42 if $::hostname == downcase(hiera('bootstrap_nodeid')) {
  43   $pacemaker_master = true
  44   $sync_db = true
  45 } else {
  46   $pacemaker_master = false
  47   $sync_db = false
  48 }
  49
  50 $enable_fencing = str2bool(hiera('enable_fencing', false)) and hiera('step') >= 5
  51 $enable_load_balancer = hiera('enable_load_balancer', true)
  52
  53 # When to start and enable services which haven't been Pacemakerized
  54 # FIXME: remove when we start all OpenStack services using Pacemaker
  55 # (occurrences of this variable will be gradually replaced with false)
  56 $non_pcmk_start = hiera('step') >= 4
  57
  58 if hiera('step') >= 1 {
  59
  60   create_resources(kmod::load, hiera('kernel_modules'), {})
  61   create_resources(sysctl::value, hiera('sysctl_settings'), {})
  62   Exec <| tag == 'kmod::load' |>  -> Sysctl <| |>
  63
  64   include ::timezone
  65
  66   if count(hiera('ntp::servers')) > 0 {
  67     include ::ntp
  68   }
  69
  70   $controller_node_ips = split(hiera('controller_node_ips'), ',')
  71   $controller_node_names = split(downcase(hiera('controller_node_names')), ',')
  72   if $enable_load_balancer {
  73     class { '::tripleo::loadbalancer' :
  74       controller_hosts       => $controller_node_ips,
  75       controller_hosts_names => $controller_node_names,
  76       manage_vip             => false,
  77       mysql_clustercheck     => true,
  78       haproxy_service_manage => false,
  79     }
  80   }
  81
  82   $pacemaker_cluster_members = downcase(regsubst(hiera('controller_node_names'), ',', ' ', 'G'))
  83   $corosync_ipv6 = str2bool(hiera('corosync_ipv6', false))
  84   if $corosync_ipv6 {
  85     $cluster_setup_extras = { '--ipv6' => '' }
  86   } else {
  87     $cluster_setup_extras = {}
  88   }
  89   class { '::pacemaker':
  90     hacluster_pwd => hiera('hacluster_pwd'),
  91   } ->
  92   class { '::pacemaker::corosync':
  93     cluster_members      => $pacemaker_cluster_members,
  94     setup_cluster        => $pacemaker_master,
  95     cluster_setup_extras => $cluster_setup_extras,
  96   }
  97   class { '::pacemaker::stonith':
  98     disable => !$enable_fencing,
  99   }
 100   if $enable_fencing {
 101     include ::tripleo::fencing
 102
 103     # enable stonith after all fencing devices have been created
 104     Class['tripleo::fencing'] -> Class['pacemaker::stonith']
 105   }
 106
 107   # FIXME(gfidente): sets 200secs as default start timeout op
 108   # param; until we can use pcmk global defaults we'll still
 109   # need to add it to every resource which redefines op params
 110   Pacemaker::Resource::Service {
 111     op_params => 'start timeout=200s stop timeout=200s',
 112   }
 113
 114   # Only configure RabbitMQ in this step, don't start it yet to
 115   # avoid races where non-master nodes attempt to start without
 116   # config (eg. binding on 0.0.0.0)
 117   # The module ignores erlang_cookie if cluster_config is false
 118   $rabbit_ipv6 = str2bool(hiera('rabbit_ipv6', false))
 119   if $rabbit_ipv6 {
 120       $rabbit_env = merge(hiera('rabbitmq_environment'), {
 121         'RABBITMQ_SERVER_START_ARGS' => '"-proto_dist inet6_tcp"'
 122       })
 123   } else {
 124     $rabbit_env = hiera('rabbitmq_environment')
 125   }
 126
 127   class { '::rabbitmq':
 128     service_manage          => false,
 129     tcp_keepalive           => false,
 130     config_kernel_variables => hiera('rabbitmq_kernel_variables'),
 131     config_variables        => hiera('rabbitmq_config_variables'),
 132     environment_variables   => $rabbit_env,
 133   } ->
 134   file { '/var/lib/rabbitmq/.erlang.cookie':
 135     ensure  => file,
 136     owner   => 'rabbitmq',
 137     group   => 'rabbitmq',
 138     mode    => '0400',
 139     content => hiera('rabbitmq::erlang_cookie'),
 140     replace => true,
 141   }
 142
 143   if downcase(hiera('ceilometer_backend')) == 'mongodb' {
 144     include ::mongodb::globals
 145     include ::mongodb::client
 146     class { '::mongodb::server' :
 147       service_manage => false,
 148     }
 149   }
 150
 151   # Memcached
 152   class {'::memcached' :
 153     service_manage => false,
 154   }
 155
 156   # Redis
 157   class { '::redis' :
 158     service_manage => false,
 159     notify_service => false,
 160   }
 161
 162   # Galera
 163   if str2bool(hiera('enable_galera', true)) {
 164     $mysql_config_file = '/etc/my.cnf.d/galera.cnf'
 165   } else {
 166     $mysql_config_file = '/etc/my.cnf.d/server.cnf'
 167   }
 168   $galera_nodes = downcase(hiera('galera_node_names', $::hostname))
 169   $galera_nodes_count = count(split($galera_nodes, ','))
 170
 171   # FIXME: due to https://bugzilla.redhat.com/show_bug.cgi?id=1298671 we
 172   # set bind-address to a hostname instead of an ip address; to move Mysql
 173   # from internal_api on another network we'll have to customize both
 174   # MysqlNetwork and ControllerHostnameResolveNetwork in ServiceNetMap
 175   $mysql_bind_host = hiera('mysql_bind_host')
 176   $mysqld_options = {
 177     'mysqld' => {
 178       'skip-name-resolve'             => '1',
 179       'binlog_format'                 => 'ROW',
 180       'default-storage-engine'        => 'innodb',
 181       'innodb_autoinc_lock_mode'      => '2',
 182       'innodb_locks_unsafe_for_binlog'=> '1',
 183       'query_cache_size'              => '0',
 184       'query_cache_type'              => '0',
 185       'bind-address'                  => $::hostname,
 186       'max_connections'               => hiera('mysql_max_connections'),
 187       'open_files_limit'              => '-1',
 188       'wsrep_provider'                => '/usr/lib64/galera/libgalera_smm.so',
 189       'wsrep_cluster_name'            => 'galera_cluster',
 190       'wsrep_slave_threads'           => '1',
 191       'wsrep_certify_nonPK'           => '1',
 192       'wsrep_max_ws_rows'             => '131072',
 193       'wsrep_max_ws_size'             => '1073741824',
 194       'wsrep_debug'                   => '0',
 195       'wsrep_convert_LOCK_to_trx'     => '0',
 196       'wsrep_retry_autocommit'        => '1',
 197       'wsrep_auto_increment_control'  => '1',
 198       'wsrep_drupal_282555_workaround'=> '0',
 199       'wsrep_causal_reads'            => '0',
 200       'wsrep_sst_method'              => 'rsync',
 201       'wsrep_provider_options'        => "gmcast.listen_addr=tcp://[${mysql_bind_host}]:4567;",
 202     },
 203   }
 204
 205   class { '::mysql::server':
 206     create_root_user        => false,
 207     create_root_my_cnf      => false,
 208     config_file             => $mysql_config_file,
 209     override_options        => $mysqld_options,
 210     remove_default_accounts => $pacemaker_master,
 211     service_manage          => false,
 212     service_enabled         => false,
 213   }
 214
 215 }
 216
 217 if hiera('step') >= 2 {
 218
 219   # NOTE(gfidente): the following vars are needed on all nodes so they
 220   # need to stay out of pacemaker_master conditional.
 221   # The addresses mangling will hopefully go away when we'll be able to
 222   # configure the connection string via hostnames, until then, we need to pass
 223   # the list of IPv6 addresses *with* port and without the brackets as 'members'
 224   # argument for the 'mongodb_replset' resource.
 225   if str2bool(hiera('mongodb::server::ipv6', false)) {
 226     $mongo_node_ips_with_port_prefixed = prefix(hiera('mongo_node_ips'), '[')
 227     $mongo_node_ips_with_port = suffix($mongo_node_ips_with_port_prefixed, ']:27017')
 228     $mongo_node_ips_with_port_nobr = suffix(hiera('mongo_node_ips'), ':27017')
 229   } else {
 230     $mongo_node_ips_with_port = suffix(hiera('mongo_node_ips'), ':27017')
 231     $mongo_node_ips_with_port_nobr = suffix(hiera('mongo_node_ips'), ':27017')
 232   }
 233   $mongodb_replset = hiera('mongodb::server::replset')
 234
 235   if $pacemaker_master {
 236
 237     if $enable_load_balancer {
 238
 239       include ::pacemaker::resource_defaults
 240
 241       # Create an openstack-core dummy resource. See RHBZ 1290121
 242       pacemaker::resource::ocf { 'openstack-core':
 243         ocf_agent_name => 'heartbeat:Dummy',
 244         clone_params   => true,
 245       }
 246       # FIXME: we should not have to access tripleo::loadbalancer class
 247       # parameters here to configure pacemaker VIPs. The configuration
 248       # of pacemaker VIPs could move into puppet-tripleo or we should
 249       # make use of less specific hiera parameters here for the settings.
 250       pacemaker::resource::service { 'haproxy':
 251         clone_params => true,
 252       }
 253
 254       $control_vip = hiera('tripleo::loadbalancer::controller_virtual_ip')
 255       if is_ipv6_address($control_vip) {
 256         $control_vip_netmask = '64'
 257       } else {
 258         $control_vip_netmask = '32'
 259       }
 260       pacemaker::resource::ip { 'control_vip':
 261         ip_address   => $control_vip,
 262         cidr_netmask => $control_vip_netmask,
 263       }
 264       pacemaker::constraint::base { 'control_vip-then-haproxy':
 265         constraint_type   => 'order',
 266         first_resource    => "ip-${control_vip}",
 267         second_resource   => 'haproxy-clone',
 268         first_action      => 'start',
 269         second_action     => 'start',
 270         constraint_params => 'kind=Optional',
 271         require           => [Pacemaker::Resource::Service['haproxy'],
 272                               Pacemaker::Resource::Ip['control_vip']],
 273       }
 274       pacemaker::constraint::colocation { 'control_vip-with-haproxy':
 275         source  => "ip-${control_vip}",
 276         target  => 'haproxy-clone',
 277         score   => 'INFINITY',
 278         require => [Pacemaker::Resource::Service['haproxy'],
 279                     Pacemaker::Resource::Ip['control_vip']],
 280       }
 281
 282       $public_vip = hiera('tripleo::loadbalancer::public_virtual_ip')
 283       if is_ipv6_address($public_vip) {
 284         $public_vip_netmask = '64'
 285       } else {
 286         $public_vip_netmask = '32'
 287       }
 288       if $public_vip and $public_vip != $control_vip {
 289         pacemaker::resource::ip { 'public_vip':
 290           ip_address   => $public_vip,
 291           cidr_netmask => $public_vip_netmask,
 292         }
 293         pacemaker::constraint::base { 'public_vip-then-haproxy':
 294           constraint_type   => 'order',
 295           first_resource    => "ip-${public_vip}",
 296           second_resource   => 'haproxy-clone',
 297           first_action      => 'start',
 298           second_action     => 'start',
 299           constraint_params => 'kind=Optional',
 300           require           => [Pacemaker::Resource::Service['haproxy'],
 301                                 Pacemaker::Resource::Ip['public_vip']],
 302         }
 303         pacemaker::constraint::colocation { 'public_vip-with-haproxy':
 304           source  => "ip-${public_vip}",
 305           target  => 'haproxy-clone',
 306           score   => 'INFINITY',
 307           require => [Pacemaker::Resource::Service['haproxy'],
 308                       Pacemaker::Resource::Ip['public_vip']],
 309         }
 310       }
 311
 312       $redis_vip = hiera('redis_vip')
 313       if is_ipv6_address($redis_vip) {
 314         $redis_vip_netmask = '64'
 315       } else {
 316         $redis_vip_netmask = '32'
 317       }
 318       if $redis_vip and $redis_vip != $control_vip {
 319         pacemaker::resource::ip { 'redis_vip':
 320           ip_address   => $redis_vip,
 321           cidr_netmask => $redis_vip_netmask,
 322         }
 323         pacemaker::constraint::base { 'redis_vip-then-haproxy':
 324           constraint_type   => 'order',
 325           first_resource    => "ip-${redis_vip}",
 326           second_resource   => 'haproxy-clone',
 327           first_action      => 'start',
 328           second_action     => 'start',
 329           constraint_params => 'kind=Optional',
 330           require           => [Pacemaker::Resource::Service['haproxy'],
 331                                 Pacemaker::Resource::Ip['redis_vip']],
 332         }
 333         pacemaker::constraint::colocation { 'redis_vip-with-haproxy':
 334           source  => "ip-${redis_vip}",
 335           target  => 'haproxy-clone',
 336           score   => 'INFINITY',
 337           require => [Pacemaker::Resource::Service['haproxy'],
 338                       Pacemaker::Resource::Ip['redis_vip']],
 339         }
 340       }
 341
 342       $internal_api_vip = hiera('tripleo::loadbalancer::internal_api_virtual_ip')
 343       if is_ipv6_address($internal_api_vip) {
 344         $internal_api_vip_netmask = '64'
 345       } else {
 346         $internal_api_vip_netmask = '32'
 347       }
 348       if $internal_api_vip and $internal_api_vip != $control_vip {
 349         pacemaker::resource::ip { 'internal_api_vip':
 350           ip_address   => $internal_api_vip,
 351           cidr_netmask => $internal_api_vip_netmask,
 352         }
 353         pacemaker::constraint::base { 'internal_api_vip-then-haproxy':
 354           constraint_type   => 'order',
 355           first_resource    => "ip-${internal_api_vip}",
 356           second_resource   => 'haproxy-clone',
 357           first_action      => 'start',
 358           second_action     => 'start',
 359           constraint_params => 'kind=Optional',
 360           require           => [Pacemaker::Resource::Service['haproxy'],
 361                                 Pacemaker::Resource::Ip['internal_api_vip']],
 362         }
 363         pacemaker::constraint::colocation { 'internal_api_vip-with-haproxy':
 364           source  => "ip-${internal_api_vip}",
 365           target  => 'haproxy-clone',
 366           score   => 'INFINITY',
 367           require => [Pacemaker::Resource::Service['haproxy'],
 368                       Pacemaker::Resource::Ip['internal_api_vip']],
 369         }
 370       }
 371
 372       $storage_vip = hiera('tripleo::loadbalancer::storage_virtual_ip')
 373       if is_ipv6_address($storage_vip) {
 374         $storage_vip_netmask = '64'
 375       } else {
 376         $storage_vip_netmask = '32'
 377       }
 378       if $storage_vip and $storage_vip != $control_vip {
 379         pacemaker::resource::ip { 'storage_vip':
 380           ip_address   => $storage_vip,
 381           cidr_netmask => $storage_vip_netmask,
 382         }
 383         pacemaker::constraint::base { 'storage_vip-then-haproxy':
 384           constraint_type   => 'order',
 385           first_resource    => "ip-${storage_vip}",
 386           second_resource   => 'haproxy-clone',
 387           first_action      => 'start',
 388           second_action     => 'start',
 389           constraint_params => 'kind=Optional',
 390           require           => [Pacemaker::Resource::Service['haproxy'],
 391                                 Pacemaker::Resource::Ip['storage_vip']],
 392         }
 393         pacemaker::constraint::colocation { 'storage_vip-with-haproxy':
 394           source  => "ip-${storage_vip}",
 395           target  => 'haproxy-clone',
 396           score   => 'INFINITY',
 397           require => [Pacemaker::Resource::Service['haproxy'],
 398                       Pacemaker::Resource::Ip['storage_vip']],
 399         }
 400       }
 401
 402       $storage_mgmt_vip = hiera('tripleo::loadbalancer::storage_mgmt_virtual_ip')
 403       if is_ipv6_address($storage_mgmt_vip) {
 404         $storage_mgmt_vip_netmask = '64'
 405       } else {
 406         $storage_mgmt_vip_netmask = '32'
 407       }
 408       if $storage_mgmt_vip and $storage_mgmt_vip != $control_vip {
 409         pacemaker::resource::ip { 'storage_mgmt_vip':
 410           ip_address   => $storage_mgmt_vip,
 411           cidr_netmask => $storage_mgmt_vip_netmask,
 412         }
 413         pacemaker::constraint::base { 'storage_mgmt_vip-then-haproxy':
 414           constraint_type   => 'order',
 415           first_resource    => "ip-${storage_mgmt_vip}",
 416           second_resource   => 'haproxy-clone',
 417           first_action      => 'start',
 418           second_action     => 'start',
 419           constraint_params => 'kind=Optional',
 420           require           => [Pacemaker::Resource::Service['haproxy'],
 421                                 Pacemaker::Resource::Ip['storage_mgmt_vip']],
 422         }
 423         pacemaker::constraint::colocation { 'storage_mgmt_vip-with-haproxy':
 424           source  => "ip-${storage_mgmt_vip}",
 425           target  => 'haproxy-clone',
 426           score   => 'INFINITY',
 427           require => [Pacemaker::Resource::Service['haproxy'],
 428                       Pacemaker::Resource::Ip['storage_mgmt_vip']],
 429         }
 430       }
 431
 432     }
 433
 434     pacemaker::resource::service { $::memcached::params::service_name :
 435       clone_params => 'interleave=true',
 436       require      => Class['::memcached'],
 437     }
 438
 439     pacemaker::resource::ocf { 'rabbitmq':
 440       ocf_agent_name  => 'heartbeat:rabbitmq-cluster',
 441       resource_params => 'set_policy=\'ha-all ^(?!amq\.).* {"ha-mode":"all"}\'',
 442       clone_params    => 'ordered=true interleave=true',
 443       meta_params     => 'notify=true',
 444       require         => Class['::rabbitmq'],
 445     }
 446
 447     if downcase(hiera('ceilometer_backend')) == 'mongodb' {
 448       pacemaker::resource::service { $::mongodb::params::service_name :
 449         op_params    => 'start timeout=370s stop timeout=200s',
 450         clone_params => true,
 451         require      => Class['::mongodb::server'],
 452       }
 453       # NOTE (spredzy) : The replset can only be run
 454       # once all the nodes have joined the cluster.
 455       mongodb_conn_validator { $mongo_node_ips_with_port :
 456         timeout => '600',
 457         require => Pacemaker::Resource::Service[$::mongodb::params::service_name],
 458         before  => Mongodb_replset[$mongodb_replset],
 459       }
 460       mongodb_replset { $mongodb_replset :
 461         members => $mongo_node_ips_with_port_nobr,
 462       }
 463     }
 464
 465     pacemaker::resource::ocf { 'galera' :
 466       ocf_agent_name  => 'heartbeat:galera',
 467       op_params       => 'promote timeout=300s on-fail=block',
 468       master_params   => '',
 469       meta_params     => "master-max=${galera_nodes_count} ordered=true",
 470       resource_params => "additional_parameters='--open-files-limit=16384' enable_creation=true wsrep_cluster_address='gcomm://${galera_nodes}'",
 471       require         => Class['::mysql::server'],
 472       before          => Exec['galera-ready'],
 473     }
 474
 475     pacemaker::resource::ocf { 'redis':
 476       ocf_agent_name  => 'heartbeat:redis',
 477       master_params   => '',
 478       meta_params     => 'notify=true ordered=true interleave=true',
 479       resource_params => 'wait_last_known_master=true',
 480       require         => Class['::redis'],
 481     }
 482
 483   }
 484
 485   exec { 'galera-ready' :
 486     command     => '/usr/bin/clustercheck >/dev/null',
 487     timeout     => 30,
 488     tries       => 180,
 489     try_sleep   => 10,
 490     environment => ['AVAILABLE_WHEN_READONLY=0'],
 491     require     => File['/etc/sysconfig/clustercheck'],
 492   }
 493
 494   file { '/etc/sysconfig/clustercheck' :
 495     ensure  => file,
 496     content => "MYSQL_USERNAME=root\n
 497 MYSQL_PASSWORD=''\n
 498 MYSQL_HOST=localhost\n",
 499   }
 500
 501   xinetd::service { 'galera-monitor' :
 502     port           => '9200',
 503     server         => '/usr/bin/clustercheck',
 504     per_source     => 'UNLIMITED',
 505     log_on_success => '',
 506     log_on_failure => 'HOST',
 507     flags          => 'REUSE',
 508     service_type   => 'UNLISTED',
 509     user           => 'root',
 510     group          => 'root',
 511     require        => File['/etc/sysconfig/clustercheck'],
 512   }
 513
 514   # Create all the database schemas
 515   if $sync_db {
 516     class { '::keystone::db::mysql':
 517       require => Exec['galera-ready'],
 518     }
 519     class { '::glance::db::mysql':
 520       require => Exec['galera-ready'],
 521     }
 522     class { '::nova::db::mysql':
 523       require => Exec['galera-ready'],
 524     }
 525     class { '::nova::db::mysql_api':
 526       require => Exec['galera-ready'],
 527     }
 528     class { '::neutron::db::mysql':
 529       require => Exec['galera-ready'],
 530     }
 531     class { '::cinder::db::mysql':
 532       require => Exec['galera-ready'],
 533     }
 534     class { '::heat::db::mysql':
 535       require => Exec['galera-ready'],
 536     }
 537
 538     if downcase(hiera('ceilometer_backend')) == 'mysql' {
 539       class { '::ceilometer::db::mysql':
 540         require => Exec['galera-ready'],
 541       }
 542     }
 543
 544     class { '::sahara::db::mysql':
 545       require       => Exec['galera-ready'],
 546     }
 547   }
 548
 549   # pre-install swift here so we can build rings
 550   include ::swift
 551
 552   # Ceph
 553   $enable_ceph = hiera('ceph_storage_count', 0) > 0 or hiera('enable_ceph_storage', false)
 554
 555   if $enable_ceph {
 556     $mon_initial_members = downcase(hiera('ceph_mon_initial_members'))
 557     if str2bool(hiera('ceph_ipv6', false)) {
 558       $mon_host = hiera('ceph_mon_host_v6')
 559     } else {
 560       $mon_host = hiera('ceph_mon_host')
 561     }
 562     class { '::ceph::profile::params':
 563       mon_initial_members => $mon_initial_members,
 564       mon_host            => $mon_host,
 565     }
 566     include ::ceph::conf
 567     include ::ceph::profile::mon
 568   }
 569
 570   if str2bool(hiera('enable_ceph_storage', false)) {
 571     if str2bool(hiera('ceph_osd_selinux_permissive', true)) {
 572       exec { 'set selinux to permissive on boot':
 573         command => "sed -ie 's/^SELINUX=.*/SELINUX=permissive/' /etc/selinux/config",
 574         onlyif  => "test -f /etc/selinux/config && ! grep '^SELINUX=permissive' /etc/selinux/config",
 575         path    => ['/usr/bin', '/usr/sbin'],
 576       }
 577
 578       exec { 'set selinux to permissive':
 579         command => 'setenforce 0',
 580         onlyif  => "which setenforce && getenforce | grep -i 'enforcing'",
 581         path    => ['/usr/bin', '/usr/sbin'],
 582       } -> Class['ceph::profile::osd']
 583     }
 584
 585     include ::ceph::conf
 586     include ::ceph::profile::osd
 587   }
 588
 589   if str2bool(hiera('enable_external_ceph', false)) {
 590     if str2bool(hiera('ceph_ipv6', false)) {
 591       $mon_host = hiera('ceph_mon_host_v6')
 592     } else {
 593       $mon_host = hiera('ceph_mon_host')
 594     }
 595     class { '::ceph::profile::params':
 596       mon_host            => $mon_host,
 597     }
 598     include ::ceph::conf
 599     include ::ceph::profile::client
 600   }
 601
 602
 603 } #END STEP 2
 604
 605 if hiera('step') >= 3 {
 606
 607   class { '::keystone':
 608     sync_db          => $sync_db,
 609     manage_service   => false,
 610     enabled          => false,
 611     enable_bootstrap => $pacemaker_master,
 612   }
 613   include ::keystone::config
 614
 615   #TODO: need a cleanup-keystone-tokens.sh solution here
 616
 617   file { [ '/etc/keystone/ssl', '/etc/keystone/ssl/certs', '/etc/keystone/ssl/private' ]:
 618     ensure  => 'directory',
 619     owner   => 'keystone',
 620     group   => 'keystone',
 621     require => Package['keystone'],
 622   }
 623   file { '/etc/keystone/ssl/certs/signing_cert.pem':
 624     content => hiera('keystone_signing_certificate'),
 625     owner   => 'keystone',
 626     group   => 'keystone',
 627     notify  => Service['keystone'],
 628     require => File['/etc/keystone/ssl/certs'],
 629   }
 630   file { '/etc/keystone/ssl/private/signing_key.pem':
 631     content => hiera('keystone_signing_key'),
 632     owner   => 'keystone',
 633     group   => 'keystone',
 634     notify  => Service['keystone'],
 635     require => File['/etc/keystone/ssl/private'],
 636   }
 637   file { '/etc/keystone/ssl/certs/ca.pem':
 638     content => hiera('keystone_ca_certificate'),
 639     owner   => 'keystone',
 640     group   => 'keystone',
 641     notify  => Service['keystone'],
 642     require => File['/etc/keystone/ssl/certs'],
 643   }
 644
 645   $glance_backend = downcase(hiera('glance_backend', 'swift'))
 646   case $glance_backend {
 647       'swift': { $backend_store = 'glance.store.swift.Store' }
 648       'file': { $backend_store = 'glance.store.filesystem.Store' }
 649       'rbd': { $backend_store = 'glance.store.rbd.Store' }
 650       default: { fail('Unrecognized glance_backend parameter.') }
 651   }
 652   $http_store = ['glance.store.http.Store']
 653   $glance_store = concat($http_store, $backend_store)
 654
 655   if $glance_backend == 'file' and hiera('glance_file_pcmk_manage', false) {
 656     $secontext = 'context="system_u:object_r:glance_var_lib_t:s0"'
 657     pacemaker::resource::filesystem { 'glance-fs':
 658       device       => hiera('glance_file_pcmk_device'),
 659       directory    => hiera('glance_file_pcmk_directory'),
 660       fstype       => hiera('glance_file_pcmk_fstype'),
 661       fsoptions    => join([$secontext, hiera('glance_file_pcmk_options', '')],','),
 662       clone_params => '',
 663     }
 664   }
 665
 666   # TODO: notifications, scrubber, etc.
 667   include ::glance
 668   include ::glance::config
 669   class { '::glance::api':
 670     known_stores   => $glance_store,
 671     manage_service => false,
 672     enabled        => false,
 673   }
 674   class { '::glance::registry' :
 675     sync_db        => $sync_db,
 676     manage_service => false,
 677     enabled        => false,
 678   }
 679   include ::glance::notify::rabbitmq
 680   include join(['::glance::backend::', $glance_backend])
 681
 682   $nova_ipv6 = hiera('nova::use_ipv6', false)
 683   if $nova_ipv6 {
 684     $memcached_servers = suffix(hiera('memcache_node_ips_v6'), ':11211')
 685   } else {
 686     $memcached_servers = suffix(hiera('memcache_node_ips'), ':11211')
 687   }
 688
 689   class { '::nova' :
 690     memcached_servers => $memcached_servers
 691   }
 692
 693   include ::nova::config
 694
 695   class { '::nova::api' :
 696     sync_db        => $sync_db,
 697     sync_db_api    => $sync_db,
 698     manage_service => false,
 699     enabled        => false,
 700   }
 701   class { '::nova::cert' :
 702     manage_service => false,
 703     enabled        => false,
 704   }
 705   class { '::nova::conductor' :
 706     manage_service => false,
 707     enabled        => false,
 708   }
 709   class { '::nova::consoleauth' :
 710     manage_service => false,
 711     enabled        => false,
 712   }
 713   class { '::nova::vncproxy' :
 714     manage_service => false,
 715     enabled        => false,
 716   }
 717   include ::nova::scheduler::filter
 718   class { '::nova::scheduler' :
 719     manage_service => false,
 720     enabled        => false,
 721   }
 722   include ::nova::network::neutron
 723
 724   if hiera('neutron::core_plugin') == 'midonet.neutron.plugin_v1.MidonetPluginV2' {
 725
 726     # TODO(devvesa) provide non-controller ips for these services
 727     $zookeeper_node_ips = hiera('neutron_api_node_ips')
 728     $cassandra_node_ips = hiera('neutron_api_node_ips')
 729
 730     # Run zookeeper in the controller if configured
 731     if hiera('enable_zookeeper_on_controller') {
 732       class {'::tripleo::cluster::zookeeper':
 733         zookeeper_server_ips => $zookeeper_node_ips,
 734         # TODO: create a 'bind' hiera key for zookeeper
 735         zookeeper_client_ip  => hiera('neutron::bind_host'),
 736         zookeeper_hostnames  => split(hiera('controller_node_names'), ',')
 737       }
 738     }
 739
 740     # Run cassandra in the controller if configured
 741     if hiera('enable_cassandra_on_controller') {
 742       class {'::tripleo::cluster::cassandra':
 743         cassandra_servers => $cassandra_node_ips,
 744         # TODO: create a 'bind' hiera key for cassandra
 745         cassandra_ip      => hiera('neutron::bind_host'),
 746       }
 747     }
 748
 749     class {'::tripleo::network::midonet::agent':
 750       zookeeper_servers => $zookeeper_node_ips,
 751       cassandra_seeds   => $cassandra_node_ips
 752     }
 753
 754     class {'::tripleo::network::midonet::api':
 755       zookeeper_servers    => $zookeeper_node_ips,
 756       vip                  => hiera('tripleo::loadbalancer::public_virtual_ip'),
 757       keystone_ip          => hiera('tripleo::loadbalancer::public_virtual_ip'),
 758       keystone_admin_token => hiera('keystone::admin_token'),
 759       # TODO: create a 'bind' hiera key for api
 760       bind_address         => hiera('neutron::bind_host'),
 761       admin_password       => hiera('admin_password')
 762     }
 763
 764     # Configure Neutron
 765     class {'::neutron':
 766       service_plugins => []
 767     }
 768
 769   }
 770   else {
 771     # Neutron class definitions
 772     include ::neutron
 773   }
 774
 775   include ::neutron::config
 776   class { '::neutron::server' :
 777     sync_db        => $sync_db,
 778     manage_service => false,
 779     enabled        => false,
 780   }
 781   include ::neutron::server::notifications
 782   if  hiera('neutron::core_plugin') == 'neutron.plugins.nuage.plugin.NuagePlugin' {
 783     include ::neutron::plugins::nuage
 784   }
 785   if  hiera('neutron::core_plugin') == 'neutron_plugin_contrail.plugins.opencontrail.contrail_plugin.NeutronPluginContrailCoreV2' {
 786     include ::neutron::plugins::opencontrail
 787   }
 788   if hiera('neutron::core_plugin') == 'midonet.neutron.plugin_v1.MidonetPluginV2' {
 789     class {'::neutron::plugins::midonet':
 790       midonet_api_ip    => hiera('tripleo::loadbalancer::public_virtual_ip'),
 791       keystone_tenant   => hiera('neutron::server::auth_tenant'),
 792       keystone_password => hiera('neutron::server::auth_password')
 793     }
 794   }
 795   if hiera('neutron::enable_dhcp_agent',true) {
 796     class { '::neutron::agents::dhcp' :
 797       manage_service => false,
 798       enabled        => false,
 799     }
 800     file { '/etc/neutron/dnsmasq-neutron.conf':
 801       content => hiera('neutron_dnsmasq_options'),
 802       owner   => 'neutron',
 803       group   => 'neutron',
 804       notify  => Service['neutron-dhcp-service'],
 805       require => Package['neutron'],
 806     }
 807   }
 808   if hiera('neutron::enable_l3_agent',true) {
 809     class { '::neutron::agents::l3' :
 810       manage_service => false,
 811       enabled        => false,
 812     }
 813   }
 814   if hiera('neutron::enable_metadata_agent',true) {
 815     class { '::neutron::agents::metadata':
 816       manage_service => false,
 817       enabled        => false,
 818     }
 819   }
 820   include ::neutron::plugins::ml2
 821   class { '::neutron::agents::ml2::ovs':
 822     manage_service => false,
 823     enabled        => false,
 824   }
 825
 826   if 'cisco_ucsm' in hiera('neutron::plugins::ml2::mechanism_drivers') {
 827     include ::neutron::plugins::ml2::cisco::ucsm
 828   }
 829   if 'cisco_nexus' in hiera('neutron::plugins::ml2::mechanism_drivers') {
 830     include ::neutron::plugins::ml2::cisco::nexus
 831     include ::neutron::plugins::ml2::cisco::type_nexus_vxlan
 832   }
 833   if 'cisco_n1kv' in hiera('neutron::plugins::ml2::mechanism_drivers') {
 834     include ::neutron::plugins::ml2::cisco::nexus1000v
 835
 836     class { '::neutron::agents::n1kv_vem':
 837       n1kv_source  => hiera('n1kv_vem_source', undef),
 838       n1kv_version => hiera('n1kv_vem_version', undef),
 839     }
 840
 841     class { '::n1k_vsm':
 842       n1kv_source  => hiera('n1kv_vsm_source', undef),
 843       n1kv_version => hiera('n1kv_vsm_version', undef),
 844     }
 845   }
 846
 847   if 'bsn_ml2' in hiera('neutron::plugins::ml2::mechanism_drivers') {
 848     include ::neutron::plugins::ml2::bigswitch::restproxy
 849     include ::neutron::agents::bigswitch
 850   }
 851   neutron_l3_agent_config {
 852     'DEFAULT/ovs_use_veth': value => hiera('neutron_ovs_use_veth', false);
 853   }
 854   neutron_dhcp_agent_config {
 855     'DEFAULT/ovs_use_veth': value => hiera('neutron_ovs_use_veth', false);
 856   }
 857   neutron_config {
 858     'DEFAULT/notification_driver': value => 'messaging';
 859   }
 860
 861   include ::cinder
 862   include ::cinder::config
 863   include ::tripleo::ssl::cinder_config
 864   class { '::cinder::api':
 865     sync_db        => $sync_db,
 866     manage_service => false,
 867     enabled        => false,
 868   }
 869   class { '::cinder::scheduler' :
 870     manage_service => false,
 871     enabled        => false,
 872   }
 873   class { '::cinder::volume' :
 874     manage_service => false,
 875     enabled        => false,
 876   }
 877   include ::cinder::glance
 878   include ::cinder::ceilometer
 879   class { '::cinder::setup_test_volume':
 880     size => join([hiera('cinder_lvm_loop_device_size'), 'M']),
 881   }
 882
 883   $cinder_enable_iscsi = hiera('cinder_enable_iscsi_backend', true)
 884   if $cinder_enable_iscsi {
 885     $cinder_iscsi_backend = 'tripleo_iscsi'
 886
 887     cinder::backend::iscsi { $cinder_iscsi_backend :
 888       iscsi_ip_address => hiera('cinder_iscsi_ip_address'),
 889       iscsi_helper     => hiera('cinder_iscsi_helper'),
 890     }
 891   }
 892
 893   if $enable_ceph {
 894
 895     $ceph_pools = hiera('ceph_pools')
 896     ceph::pool { $ceph_pools :
 897       pg_num  => hiera('ceph::profile::params::osd_pool_default_pg_num'),
 898       pgp_num => hiera('ceph::profile::params::osd_pool_default_pgp_num'),
 899       size    => hiera('ceph::profile::params::osd_pool_default_size'),
 900     }
 901
 902     $cinder_pool_requires = [Ceph::Pool[hiera('cinder_rbd_pool_name')]]
 903
 904   } else {
 905     $cinder_pool_requires = []
 906   }
 907
 908   if hiera('cinder_enable_rbd_backend', false) {
 909     $cinder_rbd_backend = 'tripleo_ceph'
 910
 911     cinder::backend::rbd { $cinder_rbd_backend :
 912       rbd_pool        => hiera('cinder_rbd_pool_name'),
 913       rbd_user        => hiera('ceph_client_user_name'),
 914       rbd_secret_uuid => hiera('ceph::profile::params::fsid'),
 915       require         => $cinder_pool_requires,
 916     }
 917   }
 918
 919   if hiera('cinder_enable_eqlx_backend', false) {
 920     $cinder_eqlx_backend = hiera('cinder::backend::eqlx::volume_backend_name')
 921
 922     cinder::backend::eqlx { $cinder_eqlx_backend :
 923       volume_backend_name => hiera('cinder::backend::eqlx::volume_backend_name', undef),
 924       san_ip              => hiera('cinder::backend::eqlx::san_ip', undef),
 925       san_login           => hiera('cinder::backend::eqlx::san_login', undef),
 926       san_password        => hiera('cinder::backend::eqlx::san_password', undef),
 927       san_thin_provision  => hiera('cinder::backend::eqlx::san_thin_provision', undef),
 928       eqlx_group_name     => hiera('cinder::backend::eqlx::eqlx_group_name', undef),
 929       eqlx_pool           => hiera('cinder::backend::eqlx::eqlx_pool', undef),
 930       eqlx_use_chap       => hiera('cinder::backend::eqlx::eqlx_use_chap', undef),
 931       eqlx_chap_login     => hiera('cinder::backend::eqlx::eqlx_chap_login', undef),
 932       eqlx_chap_password  => hiera('cinder::backend::eqlx::eqlx_san_password', undef),
 933     }
 934   }
 935
 936   if hiera('cinder_enable_dellsc_backend', false) {
 937     $cinder_dellsc_backend = hiera('cinder::backend::dellsc_iscsi::volume_backend_name')
 938
 939     cinder::backend::dellsc_iscsi{ $cinder_dellsc_backend :
 940       volume_backend_name   => hiera('cinder::backend::dellsc_iscsi::volume_backend_name', undef),
 941       san_ip                => hiera('cinder::backend::dellsc_iscsi::san_ip', undef),
 942       san_login             => hiera('cinder::backend::dellsc_iscsi::san_login', undef),
 943       san_password          => hiera('cinder::backend::dellsc_iscsi::san_password', undef),
 944       dell_sc_ssn           => hiera('cinder::backend::dellsc_iscsi::dell_sc_ssn', undef),
 945       iscsi_ip_address      => hiera('cinder::backend::dellsc_iscsi::iscsi_ip_address', undef),
 946       iscsi_port            => hiera('cinder::backend::dellsc_iscsi::iscsi_port', undef),
 947       dell_sc_api_port      => hiera('cinder::backend::dellsc_iscsi::dell_sc_api_port', undef),
 948       dell_sc_server_folder => hiera('cinder::backend::dellsc_iscsi::dell_sc_server_folder', undef),
 949       dell_sc_volume_folder => hiera('cinder::backend::dellsc_iscsi::dell_sc_volume_folder', undef),
 950     }
 951   }
 952
 953   if hiera('cinder_enable_netapp_backend', false) {
 954     $cinder_netapp_backend = hiera('cinder::backend::netapp::title')
 955
 956     if hiera('cinder::backend::netapp::nfs_shares', undef) {
 957       $cinder_netapp_nfs_shares = split(hiera('cinder::backend::netapp::nfs_shares', undef), ',')
 958     }
 959
 960     cinder::backend::netapp { $cinder_netapp_backend :
 961       netapp_login                 => hiera('cinder::backend::netapp::netapp_login', undef),
 962       netapp_password              => hiera('cinder::backend::netapp::netapp_password', undef),
 963       netapp_server_hostname       => hiera('cinder::backend::netapp::netapp_server_hostname', undef),
 964       netapp_server_port           => hiera('cinder::backend::netapp::netapp_server_port', undef),
 965       netapp_size_multiplier       => hiera('cinder::backend::netapp::netapp_size_multiplier', undef),
 966       netapp_storage_family        => hiera('cinder::backend::netapp::netapp_storage_family', undef),
 967       netapp_storage_protocol      => hiera('cinder::backend::netapp::netapp_storage_protocol', undef),
 968       netapp_transport_type        => hiera('cinder::backend::netapp::netapp_transport_type', undef),
 969       netapp_vfiler                => hiera('cinder::backend::netapp::netapp_vfiler', undef),
 970       netapp_volume_list           => hiera('cinder::backend::netapp::netapp_volume_list', undef),
 971       netapp_vserver               => hiera('cinder::backend::netapp::netapp_vserver', undef),
 972       netapp_partner_backend_name  => hiera('cinder::backend::netapp::netapp_partner_backend_name', undef),
 973       nfs_shares                   => $cinder_netapp_nfs_shares,
 974       nfs_shares_config            => hiera('cinder::backend::netapp::nfs_shares_config', undef),
 975       netapp_copyoffload_tool_path => hiera('cinder::backend::netapp::netapp_copyoffload_tool_path', undef),
 976       netapp_controller_ips        => hiera('cinder::backend::netapp::netapp_controller_ips', undef),
 977       netapp_sa_password           => hiera('cinder::backend::netapp::netapp_sa_password', undef),
 978       netapp_storage_pools         => hiera('cinder::backend::netapp::netapp_storage_pools', undef),
 979       netapp_eseries_host_type     => hiera('cinder::backend::netapp::netapp_eseries_host_type', undef),
 980       netapp_webservice_path       => hiera('cinder::backend::netapp::netapp_webservice_path', undef),
 981     }
 982   }
 983
 984   if hiera('cinder_enable_nfs_backend', false) {
 985     $cinder_nfs_backend = 'tripleo_nfs'
 986
 987     if str2bool($::selinux) {
 988       selboolean { 'virt_use_nfs':
 989         value      => on,
 990         persistent => true,
 991       } -> Package['nfs-utils']
 992     }
 993
 994     package { 'nfs-utils': } ->
 995     cinder::backend::nfs { $cinder_nfs_backend:
 996       nfs_servers       => hiera('cinder_nfs_servers'),
 997       nfs_mount_options => hiera('cinder_nfs_mount_options',''),
 998       nfs_shares_config => '/etc/cinder/shares-nfs.conf',
 999     }
1000   }
1001
1002   $cinder_enabled_backends = delete_undef_values([$cinder_iscsi_backend, $cinder_rbd_backend, $cinder_eqlx_backend, $cinder_dellsc_backend, $cinder_netapp_backend, $cinder_nfs_backend])
1003   class { '::cinder::backends' :
1004     enabled_backends => union($cinder_enabled_backends, hiera('cinder_user_enabled_backends')),
1005   }
1006
1007   class { '::sahara':
1008     sync_db => $sync_db,
1009   }
1010   class { '::sahara::service::api':
1011     manage_service => false,
1012     enabled        => false,
1013   }
1014   class { '::sahara::service::engine':
1015     manage_service => false,
1016     enabled        => false,
1017   }
1018
1019   # swift proxy
1020   class { '::swift::proxy' :
1021     manage_service => $non_pcmk_start,
1022     enabled        => $non_pcmk_start,
1023   }
1024   include ::swift::proxy::proxy_logging
1025   include ::swift::proxy::healthcheck
1026   include ::swift::proxy::cache
1027   include ::swift::proxy::keystone
1028   include ::swift::proxy::authtoken
1029   include ::swift::proxy::staticweb
1030   include ::swift::proxy::ratelimit
1031   include ::swift::proxy::catch_errors
1032   include ::swift::proxy::tempurl
1033   include ::swift::proxy::formpost
1034
1035   # swift storage
1036   if str2bool(hiera('enable_swift_storage', true)) {
1037     class {'::swift::storage::all':
1038       mount_check => str2bool(hiera('swift_mount_check')),
1039     }
1040     class {'::swift::storage::account':
1041       manage_service => $non_pcmk_start,
1042       enabled        => $non_pcmk_start,
1043     }
1044     class {'::swift::storage::container':
1045       manage_service => $non_pcmk_start,
1046       enabled        => $non_pcmk_start,
1047     }
1048     class {'::swift::storage::object':
1049       manage_service => $non_pcmk_start,
1050       enabled        => $non_pcmk_start,
1051     }
1052     if(!defined(File['/srv/node'])) {
1053       file { '/srv/node':
1054         ensure  => directory,
1055         owner   => 'swift',
1056         group   => 'swift',
1057         require => Package['openstack-swift'],
1058       }
1059     }
1060     $swift_components = ['account', 'container', 'object']
1061     swift::storage::filter::recon { $swift_components : }
1062     swift::storage::filter::healthcheck { $swift_components : }
1063   }
1064
1065   # Ceilometer
1066   case downcase(hiera('ceilometer_backend')) {
1067     /mysql/: {
1068       $ceilometer_database_connection = hiera('ceilometer_mysql_conn_string')
1069     }
1070     default: {
1071       $mongo_node_string = join($mongo_node_ips_with_port, ',')
1072       $ceilometer_database_connection = "mongodb://${mongo_node_string}/ceilometer?replicaSet=${mongodb_replset}"
1073     }
1074   }
1075   include ::ceilometer
1076   include ::ceilometer::config
1077   class { '::ceilometer::api' :
1078     manage_service => false,
1079     enabled        => false,
1080   }
1081   class { '::ceilometer::agent::notification' :
1082     manage_service => false,
1083     enabled        => false,
1084   }
1085   class { '::ceilometer::agent::central' :
1086     manage_service => false,
1087     enabled        => false,
1088   }
1089   class { '::ceilometer::collector' :
1090     manage_service => false,
1091     enabled        => false,
1092   }
1093   include ::ceilometer::expirer
1094   class { '::ceilometer::db' :
1095     database_connection => $ceilometer_database_connection,
1096     sync_db             => $sync_db,
1097   }
1098   include ::ceilometer::agent::auth
1099
1100   Cron <| title == 'ceilometer-expirer' |> { command => "sleep $((\$(od -A n -t d -N 3 /dev/urandom) % 86400)) && ${::ceilometer::params::expirer_command}" }
1101
1102   # Heat
1103   include ::heat::config
1104   class { '::heat' :
1105     sync_db             => $sync_db,
1106     notification_driver => 'messaging',
1107   }
1108   class { '::heat::api' :
1109     manage_service => false,
1110     enabled        => false,
1111   }
1112   class { '::heat::api_cfn' :
1113     manage_service => false,
1114     enabled        => false,
1115   }
1116   class { '::heat::api_cloudwatch' :
1117     manage_service => false,
1118     enabled        => false,
1119   }
1120   class { '::heat::engine' :
1121     manage_service => false,
1122     enabled        => false,
1123   }
1124
1125   # httpd/apache and horizon
1126   # NOTE(gfidente): server-status can be consumed by the pacemaker resource agent
1127   class { '::apache' :
1128     service_enable => false,
1129     # service_manage => false, # <-- not supported with horizon&apache mod_wsgi?
1130   }
1131   include ::keystone::wsgi::apache
1132   include ::apache::mod::status
1133   if 'cisco_n1kv' in hiera('neutron::plugins::ml2::mechanism_drivers') {
1134     $_profile_support = 'cisco'
1135   } else {
1136     $_profile_support = 'None'
1137   }
1138   $neutron_options   = {'profile_support' => $_profile_support }
1139
1140   $memcached_ipv6 = hiera('memcached_ipv6', false)
1141   if $memcached_ipv6 {
1142     $horizon_memcached_servers = hiera('memcache_node_ips_v6', '[::1]')
1143   } else {
1144     $horizon_memcached_servers = hiera('memcache_node_ips', '127.0.0.1')
1145   }
1146
1147   class { '::horizon':
1148     cache_server_ip => $horizon_memcached_servers,
1149     neutron_options => $neutron_options,
1150   }
1151
1152   # Aodh
1153   class { '::aodh' :
1154     database_connection => $ceilometer_database_connection,
1155   }
1156   include ::aodh::config
1157   include ::aodh::auth
1158   include ::aodh::client
1159   include ::aodh::wsgi::apache
1160   class { '::aodh::api':
1161     manage_service => false,
1162     enabled        => false,
1163     service_name   => 'httpd',
1164   }
1165   class { '::aodh::evaluator':
1166     manage_service => false,
1167     enabled        => false,
1168   }
1169   class { '::aodh::notifier':
1170     manage_service => false,
1171     enabled        => false,
1172   }
1173   class { '::aodh::listener':
1174     manage_service => false,
1175     enabled        => false,
1176   }
1177
1178   $snmpd_user = hiera('snmpd_readonly_user_name')
1179   snmp::snmpv3_user { $snmpd_user:
1180     authtype => 'MD5',
1181     authpass => hiera('snmpd_readonly_user_password'),
1182   }
1183   class { '::snmp':
1184     agentaddress => ['udp:161','udp6:[::1]:161'],
1185     snmpd_config => [ join(['createUser ', hiera('snmpd_readonly_user_name'), ' MD5 "', hiera('snmpd_readonly_user_password'), '"']), join(['rouser ', hiera('snmpd_readonly_user_name')]), 'proc  cron', 'includeAllDisks  10%', 'master agentx', 'trapsink localhost public', 'iquerySecName internalUser', 'rouser internalUser', 'defaultMonitors yes', 'linkUpDownNotifications yes' ],
1186   }
1187
1188   hiera_include('controller_classes')
1189
1190 } #END STEP 3
1191
1192 if hiera('step') >= 4 {
1193   $keystone_enable_db_purge = hiera('keystone_enable_db_purge', true)
1194   $nova_enable_db_purge = hiera('nova_enable_db_purge', true)
1195   $cinder_enable_db_purge = hiera('cinder_enable_db_purge', true)
1196   $heat_enable_db_purge = hiera('heat_enable_db_purge', true)
1197
1198   if $keystone_enable_db_purge {
1199     include ::keystone::cron::token_flush
1200   }
1201   if $nova_enable_db_purge {
1202     include ::nova::cron::archive_deleted_rows
1203   }
1204   if $cinder_enable_db_purge {
1205     include ::cinder::cron::db_purge
1206   }
1207   if $heat_enable_db_purge {
1208     include ::heat::cron::purge_deleted
1209   }
1210
1211   if $pacemaker_master {
1212
1213     if $enable_load_balancer {
1214       pacemaker::constraint::base { 'haproxy-then-keystone-constraint':
1215         constraint_type => 'order',
1216         first_resource  => 'haproxy-clone',
1217         second_resource => 'openstack-core-clone',
1218         first_action    => 'start',
1219         second_action   => 'start',
1220         require         => [Pacemaker::Resource::Service['haproxy'],
1221                             Pacemaker::Resource::Ocf['openstack-core']],
1222       }
1223     }
1224
1225     pacemaker::constraint::base { 'openstack-core-then-httpd-constraint':
1226       constraint_type => 'order',
1227       first_resource  => 'openstack-core-clone',
1228       second_resource => "${::apache::params::service_name}-clone",
1229       first_action    => 'start',
1230       second_action   => 'start',
1231       require         => [Pacemaker::Resource::Service[$::apache::params::service_name],
1232                           Pacemaker::Resource::Ocf['openstack-core']],
1233     }
1234     pacemaker::constraint::base { 'rabbitmq-then-keystone-constraint':
1235       constraint_type => 'order',
1236       first_resource  => 'rabbitmq-clone',
1237       second_resource => 'openstack-core-clone',
1238       first_action    => 'start',
1239       second_action   => 'start',
1240       require         => [Pacemaker::Resource::Ocf['rabbitmq'],
1241                           Pacemaker::Resource::Ocf['openstack-core']],
1242     }
1243     pacemaker::constraint::base { 'memcached-then-openstack-core-constraint':
1244       constraint_type => 'order',
1245       first_resource  => 'memcached-clone',
1246       second_resource => 'openstack-core-clone',
1247       first_action    => 'start',
1248       second_action   => 'start',
1249       require         => [Pacemaker::Resource::Service['memcached'],
1250                           Pacemaker::Resource::Ocf['openstack-core']],
1251     }
1252     pacemaker::constraint::base { 'galera-then-openstack-core-constraint':
1253       constraint_type => 'order',
1254       first_resource  => 'galera-master',
1255       second_resource => 'openstack-core-clone',
1256       first_action    => 'promote',
1257       second_action   => 'start',
1258       require         => [Pacemaker::Resource::Ocf['galera'],
1259                           Pacemaker::Resource::Ocf['openstack-core']],
1260     }
1261
1262     # Cinder
1263     pacemaker::resource::service { $::cinder::params::api_service :
1264       clone_params => 'interleave=true',
1265       require      => Pacemaker::Resource::Ocf['openstack-core'],
1266     }
1267     pacemaker::resource::service { $::cinder::params::scheduler_service :
1268       clone_params => 'interleave=true',
1269     }
1270     pacemaker::resource::service { $::cinder::params::volume_service : }
1271
1272     pacemaker::constraint::base { 'keystone-then-cinder-api-constraint':
1273       constraint_type => 'order',
1274       first_resource  => 'openstack-core-clone',
1275       second_resource => "${::cinder::params::api_service}-clone",
1276       first_action    => 'start',
1277       second_action   => 'start',
1278       require         => [Pacemaker::Resource::Ocf['openstack-core'],
1279                           Pacemaker::Resource::Service[$::cinder::params::api_service]],
1280     }
1281     pacemaker::constraint::base { 'cinder-api-then-cinder-scheduler-constraint':
1282       constraint_type => 'order',
1283       first_resource  => "${::cinder::params::api_service}-clone",
1284       second_resource => "${::cinder::params::scheduler_service}-clone",
1285       first_action    => 'start',
1286       second_action   => 'start',
1287       require         => [Pacemaker::Resource::Service[$::cinder::params::api_service],
1288                           Pacemaker::Resource::Service[$::cinder::params::scheduler_service]],
1289     }
1290     pacemaker::constraint::colocation { 'cinder-scheduler-with-cinder-api-colocation':
1291       source  => "${::cinder::params::scheduler_service}-clone",
1292       target  => "${::cinder::params::api_service}-clone",
1293       score   => 'INFINITY',
1294       require => [Pacemaker::Resource::Service[$::cinder::params::api_service],
1295                   Pacemaker::Resource::Service[$::cinder::params::scheduler_service]],
1296     }
1297     pacemaker::constraint::base { 'cinder-scheduler-then-cinder-volume-constraint':
1298       constraint_type => 'order',
1299       first_resource  => "${::cinder::params::scheduler_service}-clone",
1300       second_resource => $::cinder::params::volume_service,
1301       first_action    => 'start',
1302       second_action   => 'start',
1303       require         => [Pacemaker::Resource::Service[$::cinder::params::scheduler_service],
1304                           Pacemaker::Resource::Service[$::cinder::params::volume_service]],
1305     }
1306     pacemaker::constraint::colocation { 'cinder-volume-with-cinder-scheduler-colocation':
1307       source  => $::cinder::params::volume_service,
1308       target  => "${::cinder::params::scheduler_service}-clone",
1309       score   => 'INFINITY',
1310       require => [Pacemaker::Resource::Service[$::cinder::params::scheduler_service],
1311                   Pacemaker::Resource::Service[$::cinder::params::volume_service]],
1312     }
1313
1314     # Sahara
1315     pacemaker::resource::service { $::sahara::params::api_service_name :
1316       clone_params => 'interleave=true',
1317       require      => Pacemaker::Resource::Ocf['openstack-core'],
1318     }
1319     pacemaker::resource::service { $::sahara::params::engine_service_name :
1320       clone_params => 'interleave=true',
1321     }
1322     pacemaker::constraint::base { 'keystone-then-sahara-api-constraint':
1323       constraint_type => 'order',
1324       first_resource  => 'openstack-core-clone',
1325       second_resource => "${::sahara::params::api_service_name}-clone",
1326       first_action    => 'start',
1327       second_action   => 'start',
1328       require         => [Pacemaker::Resource::Service[$::sahara::params::api_service_name],
1329                           Pacemaker::Resource::Ocf['openstack-core']],
1330     }
1331
1332     # Glance
1333     pacemaker::resource::service { $::glance::params::registry_service_name :
1334       clone_params => 'interleave=true',
1335       require      => Pacemaker::Resource::Ocf['openstack-core'],
1336     }
1337     pacemaker::resource::service { $::glance::params::api_service_name :
1338       clone_params => 'interleave=true',
1339     }
1340
1341     pacemaker::constraint::base { 'keystone-then-glance-registry-constraint':
1342       constraint_type => 'order',
1343       first_resource  => 'openstack-core-clone',
1344       second_resource => "${::glance::params::registry_service_name}-clone",
1345       first_action    => 'start',
1346       second_action   => 'start',
1347       require         => [Pacemaker::Resource::Service[$::glance::params::registry_service_name],
1348                           Pacemaker::Resource::Ocf['openstack-core']],
1349     }
1350     pacemaker::constraint::base { 'glance-registry-then-glance-api-constraint':
1351       constraint_type => 'order',
1352       first_resource  => "${::glance::params::registry_service_name}-clone",
1353       second_resource => "${::glance::params::api_service_name}-clone",
1354       first_action    => 'start',
1355       second_action   => 'start',
1356       require         => [Pacemaker::Resource::Service[$::glance::params::registry_service_name],
1357                           Pacemaker::Resource::Service[$::glance::params::api_service_name]],
1358     }
1359     pacemaker::constraint::colocation { 'glance-api-with-glance-registry-colocation':
1360       source  => "${::glance::params::api_service_name}-clone",
1361       target  => "${::glance::params::registry_service_name}-clone",
1362       score   => 'INFINITY',
1363       require => [Pacemaker::Resource::Service[$::glance::params::registry_service_name],
1364                   Pacemaker::Resource::Service[$::glance::params::api_service_name]],
1365     }
1366
1367     if hiera('step') == 4 {
1368       # Neutron
1369       # NOTE(gfidente): Neutron will try to populate the database with some data
1370       # as soon as neutron-server is started; to avoid races we want to make this
1371       # happen only on one node, before normal Pacemaker initialization
1372       # https://bugzilla.redhat.com/show_bug.cgi?id=1233061
1373       # NOTE(emilien): we need to run this Exec only at Step 4 otherwise this exec
1374       # will try to start the service while it's already started by Pacemaker
1375       # It would result to a deployment failure since systemd would return 1 to Puppet
1376       # and the overcloud would fail to deploy (6 would be returned).
1377       # This conditional prevents from a race condition during the deployment.
1378       # https://bugzilla.redhat.com/show_bug.cgi?id=1290582
1379       exec { 'neutron-server-systemd-start-sleep' :
1380         command => 'systemctl start neutron-server && /usr/bin/sleep 5',
1381         path    => '/usr/bin',
1382         unless  => '/sbin/pcs resource show neutron-server',
1383       } ->
1384       pacemaker::resource::service { $::neutron::params::server_service:
1385         clone_params => 'interleave=true',
1386         require      => Pacemaker::Resource::Ocf['openstack-core']
1387       }
1388     } else {
1389       pacemaker::resource::service { $::neutron::params::server_service:
1390         clone_params => 'interleave=true',
1391         require      => Pacemaker::Resource::Ocf['openstack-core']
1392       }
1393     }
1394     if hiera('neutron::enable_l3_agent', true) {
1395       pacemaker::resource::service { $::neutron::params::l3_agent_service:
1396         clone_params => 'interleave=true',
1397       }
1398     }
1399     if hiera('neutron::enable_dhcp_agent', true) {
1400       pacemaker::resource::service { $::neutron::params::dhcp_agent_service:
1401         clone_params => 'interleave=true',
1402       }
1403     }
1404     if hiera('neutron::enable_ovs_agent', true) {
1405       pacemaker::resource::service { $::neutron::params::ovs_agent_service:
1406         clone_params => 'interleave=true',
1407       }
1408     }
1409     if hiera('neutron::core_plugin') == 'midonet.neutron.plugin_v1.MidonetPluginV2' {
1410       pacemaker::resource::service {'tomcat':
1411         clone_params => 'interleave=true',
1412       }
1413     }
1414     if hiera('neutron::enable_metadata_agent', true) {
1415       pacemaker::resource::service { $::neutron::params::metadata_agent_service:
1416         clone_params => 'interleave=true',
1417       }
1418     }
1419     if hiera('neutron::enable_ovs_agent', true) {
1420       pacemaker::resource::ocf { $::neutron::params::ovs_cleanup_service:
1421         ocf_agent_name => 'neutron:OVSCleanup',
1422         clone_params   => 'interleave=true',
1423       }
1424       pacemaker::resource::ocf { 'neutron-netns-cleanup':
1425         ocf_agent_name => 'neutron:NetnsCleanup',
1426         clone_params   => 'interleave=true',
1427       }
1428
1429       # neutron - one chain ovs-cleanup-->netns-cleanup-->ovs-agent
1430       pacemaker::constraint::base { 'neutron-ovs-cleanup-to-netns-cleanup-constraint':
1431         constraint_type => 'order',
1432         first_resource  => "${::neutron::params::ovs_cleanup_service}-clone",
1433         second_resource => 'neutron-netns-cleanup-clone',
1434         first_action    => 'start',
1435         second_action   => 'start',
1436         require         => [Pacemaker::Resource::Ocf[$::neutron::params::ovs_cleanup_service],
1437                             Pacemaker::Resource::Ocf['neutron-netns-cleanup']],
1438       }
1439       pacemaker::constraint::colocation { 'neutron-ovs-cleanup-to-netns-cleanup-colocation':
1440         source  => 'neutron-netns-cleanup-clone',
1441         target  => "${::neutron::params::ovs_cleanup_service}-clone",
1442         score   => 'INFINITY',
1443         require => [Pacemaker::Resource::Ocf[$::neutron::params::ovs_cleanup_service],
1444                     Pacemaker::Resource::Ocf['neutron-netns-cleanup']],
1445       }
1446       pacemaker::constraint::base { 'neutron-netns-cleanup-to-openvswitch-agent-constraint':
1447         constraint_type => 'order',
1448         first_resource  => 'neutron-netns-cleanup-clone',
1449         second_resource => "${::neutron::params::ovs_agent_service}-clone",
1450         first_action    => 'start',
1451         second_action   => 'start',
1452         require         => [Pacemaker::Resource::Ocf['neutron-netns-cleanup'],
1453                             Pacemaker::Resource::Service[$::neutron::params::ovs_agent_service]],
1454       }
1455       pacemaker::constraint::colocation { 'neutron-netns-cleanup-to-openvswitch-agent-colocation':
1456         source  => "${::neutron::params::ovs_agent_service}-clone",
1457         target  => 'neutron-netns-cleanup-clone',
1458         score   => 'INFINITY',
1459         require => [Pacemaker::Resource::Ocf['neutron-netns-cleanup'],
1460                     Pacemaker::Resource::Service[$::neutron::params::ovs_agent_service]],
1461       }
1462     }
1463     pacemaker::constraint::base { 'keystone-to-neutron-server-constraint':
1464       constraint_type => 'order',
1465       first_resource  => 'openstack-core-clone',
1466       second_resource => "${::neutron::params::server_service}-clone",
1467       first_action    => 'start',
1468       second_action   => 'start',
1469       require         => [Pacemaker::Resource::Ocf['openstack-core'],
1470                           Pacemaker::Resource::Service[$::neutron::params::server_service]],
1471     }
1472     if hiera('neutron::enable_ovs_agent',true) {
1473       pacemaker::constraint::base { 'neutron-openvswitch-agent-to-dhcp-agent-constraint':
1474         constraint_type => 'order',
1475         first_resource  => "${::neutron::params::ovs_agent_service}-clone",
1476         second_resource => "${::neutron::params::dhcp_agent_service}-clone",
1477         first_action    => 'start',
1478         second_action   => 'start',
1479         require         => [Pacemaker::Resource::Service[$::neutron::params::ovs_agent_service],
1480                             Pacemaker::Resource::Service[$::neutron::params::dhcp_agent_service]],
1481       }
1482     }
1483     if hiera('neutron::enable_dhcp_agent',true) and hiera('neutron::enable_ovs_agent',true) {
1484       pacemaker::constraint::base { 'neutron-server-to-openvswitch-agent-constraint':
1485         constraint_type => 'order',
1486         first_resource  => "${::neutron::params::server_service}-clone",
1487         second_resource => "${::neutron::params::ovs_agent_service}-clone",
1488         first_action    => 'start',
1489         second_action   => 'start',
1490         require         => [Pacemaker::Resource::Service[$::neutron::params::server_service],
1491                             Pacemaker::Resource::Service[$::neutron::params::ovs_agent_service]],
1492     }
1493
1494       pacemaker::constraint::colocation { 'neutron-openvswitch-agent-to-dhcp-agent-colocation':
1495         source  => "${::neutron::params::dhcp_agent_service}-clone",
1496         target  => "${::neutron::params::ovs_agent_service}-clone",
1497         score   => 'INFINITY',
1498         require => [Pacemaker::Resource::Service[$::neutron::params::ovs_agent_service],
1499                     Pacemaker::Resource::Service[$::neutron::params::dhcp_agent_service]],
1500       }
1501     }
1502     if hiera('neutron::enable_dhcp_agent',true) and hiera('l3_agent_service',true) {
1503       pacemaker::constraint::base { 'neutron-dhcp-agent-to-l3-agent-constraint':
1504         constraint_type => 'order',
1505         first_resource  => "${::neutron::params::dhcp_agent_service}-clone",
1506         second_resource => "${::neutron::params::l3_agent_service}-clone",
1507         first_action    => 'start',
1508         second_action   => 'start',
1509         require         => [Pacemaker::Resource::Service[$::neutron::params::dhcp_agent_service],
1510                             Pacemaker::Resource::Service[$::neutron::params::l3_agent_service]]
1511       }
1512       pacemaker::constraint::colocation { 'neutron-dhcp-agent-to-l3-agent-colocation':
1513         source  => "${::neutron::params::l3_agent_service}-clone",
1514         target  => "${::neutron::params::dhcp_agent_service}-clone",
1515         score   => 'INFINITY',
1516         require => [Pacemaker::Resource::Service[$::neutron::params::dhcp_agent_service],
1517                     Pacemaker::Resource::Service[$::neutron::params::l3_agent_service]]
1518       }
1519     }
1520     if hiera('neutron::enable_l3_agent',true) and hiera('neutron::enable_metadata_agent',true) {
1521       pacemaker::constraint::base { 'neutron-l3-agent-to-metadata-agent-constraint':
1522         constraint_type => 'order',
1523         first_resource  => "${::neutron::params::l3_agent_service}-clone",
1524         second_resource => "${::neutron::params::metadata_agent_service}-clone",
1525         first_action    => 'start',
1526         second_action   => 'start',
1527         require         => [Pacemaker::Resource::Service[$::neutron::params::l3_agent_service],
1528                             Pacemaker::Resource::Service[$::neutron::params::metadata_agent_service]]
1529       }
1530       pacemaker::constraint::colocation { 'neutron-l3-agent-to-metadata-agent-colocation':
1531         source  => "${::neutron::params::metadata_agent_service}-clone",
1532         target  => "${::neutron::params::l3_agent_service}-clone",
1533         score   => 'INFINITY',
1534         require => [Pacemaker::Resource::Service[$::neutron::params::l3_agent_service],
1535                     Pacemaker::Resource::Service[$::neutron::params::metadata_agent_service]]
1536       }
1537     }
1538     if hiera('neutron::core_plugin') == 'midonet.neutron.plugin_v1.MidonetPluginV2' {
1539       #midonet-chain chain keystone-->neutron-server-->dhcp-->metadata->tomcat
1540       pacemaker::constraint::base { 'neutron-server-to-dhcp-agent-constraint':
1541         constraint_type => 'order',
1542         first_resource  => "${::neutron::params::server_service}-clone",
1543         second_resource => "${::neutron::params::dhcp_agent_service}-clone",
1544         first_action    => 'start',
1545         second_action   => 'start',
1546         require         => [Pacemaker::Resource::Service[$::neutron::params::server_service],
1547                             Pacemaker::Resource::Service[$::neutron::params::dhcp_agent_service]],
1548       }
1549       pacemaker::constraint::base { 'neutron-dhcp-agent-to-metadata-agent-constraint':
1550         constraint_type => 'order',
1551         first_resource  => "${::neutron::params::dhcp_agent_service}-clone",
1552         second_resource => "${::neutron::params::metadata_agent_service}-clone",
1553         first_action    => 'start',
1554         second_action   => 'start',
1555         require         => [Pacemaker::Resource::Service[$::neutron::params::dhcp_agent_service],
1556                             Pacemaker::Resource::Service[$::neutron::params::metadata_agent_service]],
1557       }
1558       pacemaker::constraint::base { 'neutron-metadata-agent-to-tomcat-constraint':
1559         constraint_type => 'order',
1560         first_resource  => "${::neutron::params::metadata_agent_service}-clone",
1561         second_resource => 'tomcat-clone',
1562         first_action    => 'start',
1563         second_action   => 'start',
1564         require         => [Pacemaker::Resource::Service[$::neutron::params::metadata_agent_service],
1565                             Pacemaker::Resource::Service['tomcat']],
1566       }
1567       pacemaker::constraint::colocation { 'neutron-dhcp-agent-to-metadata-agent-colocation':
1568         source  => "${::neutron::params::metadata_agent_service}-clone",
1569         target  => "${::neutron::params::dhcp_agent_service}-clone",
1570         score   => 'INFINITY',
1571         require => [Pacemaker::Resource::Service[$::neutron::params::dhcp_agent_service],
1572                     Pacemaker::Resource::Service[$::neutron::params::metadata_agent_service]],
1573       }
1574     }
1575
1576     # Nova
1577     pacemaker::resource::service { $::nova::params::api_service_name :
1578       clone_params => 'interleave=true',
1579     }
1580     pacemaker::resource::service { $::nova::params::conductor_service_name :
1581       clone_params => 'interleave=true',
1582     }
1583     pacemaker::resource::service { $::nova::params::consoleauth_service_name :
1584       clone_params => 'interleave=true',
1585       require      => Pacemaker::Resource::Ocf['openstack-core'],
1586     }
1587     pacemaker::resource::service { $::nova::params::vncproxy_service_name :
1588       clone_params => 'interleave=true',
1589     }
1590     pacemaker::resource::service { $::nova::params::scheduler_service_name :
1591       clone_params => 'interleave=true',
1592     }
1593
1594     pacemaker::constraint::base { 'keystone-then-nova-consoleauth-constraint':
1595       constraint_type => 'order',
1596       first_resource  => 'openstack-core-clone',
1597       second_resource => "${::nova::params::consoleauth_service_name}-clone",
1598       first_action    => 'start',
1599       second_action   => 'start',
1600       require         => [Pacemaker::Resource::Service[$::nova::params::consoleauth_service_name],
1601                           Pacemaker::Resource::Ocf['openstack-core']],
1602     }
1603     pacemaker::constraint::base { 'nova-consoleauth-then-nova-vncproxy-constraint':
1604       constraint_type => 'order',
1605       first_resource  => "${::nova::params::consoleauth_service_name}-clone",
1606       second_resource => "${::nova::params::vncproxy_service_name}-clone",
1607       first_action    => 'start',
1608       second_action   => 'start',
1609       require         => [Pacemaker::Resource::Service[$::nova::params::consoleauth_service_name],
1610                           Pacemaker::Resource::Service[$::nova::params::vncproxy_service_name]],
1611     }
1612     pacemaker::constraint::colocation { 'nova-vncproxy-with-nova-consoleauth-colocation':
1613       source  => "${::nova::params::vncproxy_service_name}-clone",
1614       target  => "${::nova::params::consoleauth_service_name}-clone",
1615       score   => 'INFINITY',
1616       require => [Pacemaker::Resource::Service[$::nova::params::consoleauth_service_name],
1617                   Pacemaker::Resource::Service[$::nova::params::vncproxy_service_name]],
1618     }
1619     pacemaker::constraint::base { 'nova-vncproxy-then-nova-api-constraint':
1620       constraint_type => 'order',
1621       first_resource  => "${::nova::params::vncproxy_service_name}-clone",
1622       second_resource => "${::nova::params::api_service_name}-clone",
1623       first_action    => 'start',
1624       second_action   => 'start',
1625       require         => [Pacemaker::Resource::Service[$::nova::params::vncproxy_service_name],
1626                           Pacemaker::Resource::Service[$::nova::params::api_service_name]],
1627     }
1628     pacemaker::constraint::colocation { 'nova-api-with-nova-vncproxy-colocation':
1629       source  => "${::nova::params::api_service_name}-clone",
1630       target  => "${::nova::params::vncproxy_service_name}-clone",
1631       score   => 'INFINITY',
1632       require => [Pacemaker::Resource::Service[$::nova::params::vncproxy_service_name],
1633                   Pacemaker::Resource::Service[$::nova::params::api_service_name]],
1634     }
1635     pacemaker::constraint::base { 'nova-api-then-nova-scheduler-constraint':
1636       constraint_type => 'order',
1637       first_resource  => "${::nova::params::api_service_name}-clone",
1638       second_resource => "${::nova::params::scheduler_service_name}-clone",
1639       first_action    => 'start',
1640       second_action   => 'start',
1641       require         => [Pacemaker::Resource::Service[$::nova::params::api_service_name],
1642                           Pacemaker::Resource::Service[$::nova::params::scheduler_service_name]],
1643     }
1644     pacemaker::constraint::colocation { 'nova-scheduler-with-nova-api-colocation':
1645       source  => "${::nova::params::scheduler_service_name}-clone",
1646       target  => "${::nova::params::api_service_name}-clone",
1647       score   => 'INFINITY',
1648       require => [Pacemaker::Resource::Service[$::nova::params::api_service_name],
1649                   Pacemaker::Resource::Service[$::nova::params::scheduler_service_name]],
1650     }
1651     pacemaker::constraint::base { 'nova-scheduler-then-nova-conductor-constraint':
1652       constraint_type => 'order',
1653       first_resource  => "${::nova::params::scheduler_service_name}-clone",
1654       second_resource => "${::nova::params::conductor_service_name}-clone",
1655       first_action    => 'start',
1656       second_action   => 'start',
1657       require         => [Pacemaker::Resource::Service[$::nova::params::scheduler_service_name],
1658                           Pacemaker::Resource::Service[$::nova::params::conductor_service_name]],
1659     }
1660     pacemaker::constraint::colocation { 'nova-conductor-with-nova-scheduler-colocation':
1661       source  => "${::nova::params::conductor_service_name}-clone",
1662       target  => "${::nova::params::scheduler_service_name}-clone",
1663       score   => 'INFINITY',
1664       require => [Pacemaker::Resource::Service[$::nova::params::scheduler_service_name],
1665                   Pacemaker::Resource::Service[$::nova::params::conductor_service_name]],
1666     }
1667
1668     # Ceilometer and Aodh
1669     case downcase(hiera('ceilometer_backend')) {
1670       /mysql/: {
1671         pacemaker::resource::service { $::ceilometer::params::agent_central_service_name:
1672           clone_params => 'interleave=true',
1673           require      => Pacemaker::Resource::Ocf['openstack-core'],
1674         }
1675       }
1676       default: {
1677         pacemaker::resource::service { $::ceilometer::params::agent_central_service_name:
1678           clone_params => 'interleave=true',
1679           require      => [Pacemaker::Resource::Ocf['openstack-core'],
1680                           Pacemaker::Resource::Service[$::mongodb::params::service_name]],
1681         }
1682       }
1683     }
1684     pacemaker::resource::service { $::ceilometer::params::collector_service_name :
1685       clone_params => 'interleave=true',
1686     }
1687     pacemaker::resource::service { $::ceilometer::params::api_service_name :
1688       clone_params => 'interleave=true',
1689     }
1690     pacemaker::resource::service { $::ceilometer::params::agent_notification_service_name :
1691       clone_params => 'interleave=true',
1692     }
1693     pacemaker::resource::ocf { 'delay' :
1694       ocf_agent_name  => 'heartbeat:Delay',
1695       clone_params    => 'interleave=true',
1696       resource_params => 'startdelay=10',
1697     }
1698     # Fedora doesn't know `require-all` parameter for constraints yet
1699     if $::operatingsystem == 'Fedora' {
1700       $redis_ceilometer_constraint_params = undef
1701       $redis_aodh_constraint_params = undef
1702     } else {
1703       $redis_ceilometer_constraint_params = 'require-all=false'
1704       $redis_aodh_constraint_params = 'require-all=false'
1705     }
1706     pacemaker::constraint::base { 'redis-then-ceilometer-central-constraint':
1707       constraint_type   => 'order',
1708       first_resource    => 'redis-master',
1709       second_resource   => "${::ceilometer::params::agent_central_service_name}-clone",
1710       first_action      => 'promote',
1711       second_action     => 'start',
1712       constraint_params => $redis_ceilometer_constraint_params,
1713       require           => [Pacemaker::Resource::Ocf['redis'],
1714                             Pacemaker::Resource::Service[$::ceilometer::params::agent_central_service_name]],
1715     }
1716     pacemaker::constraint::base { 'redis-then-aodh-evaluator-constraint':
1717       constraint_type   => 'order',
1718       first_resource    => 'redis-master',
1719       second_resource   => "${::aodh::params::evaluator_service_name}-clone",
1720       first_action      => 'promote',
1721       second_action     => 'start',
1722       constraint_params => $redis_aodh_constraint_params,
1723       require           => [Pacemaker::Resource::Ocf['redis'],
1724                             Pacemaker::Resource::Service[$::aodh::params::evaluator_service_name]],
1725     }
1726     pacemaker::constraint::base { 'keystone-then-ceilometer-central-constraint':
1727       constraint_type => 'order',
1728       first_resource  => 'openstack-core-clone',
1729       second_resource => "${::ceilometer::params::agent_central_service_name}-clone",
1730       first_action    => 'start',
1731       second_action   => 'start',
1732       require         => [Pacemaker::Resource::Service[$::ceilometer::params::agent_central_service_name],
1733                           Pacemaker::Resource::Ocf['openstack-core']],
1734     }
1735     pacemaker::constraint::base { 'ceilometer-central-then-ceilometer-collector-constraint':
1736       constraint_type => 'order',
1737       first_resource  => "${::ceilometer::params::agent_central_service_name}-clone",
1738       second_resource => "${::ceilometer::params::collector_service_name}-clone",
1739       first_action    => 'start',
1740       second_action   => 'start',
1741       require         => [Pacemaker::Resource::Service[$::ceilometer::params::agent_central_service_name],
1742                           Pacemaker::Resource::Service[$::ceilometer::params::collector_service_name]],
1743     }
1744     pacemaker::constraint::base { 'ceilometer-collector-then-ceilometer-api-constraint':
1745       constraint_type => 'order',
1746       first_resource  => "${::ceilometer::params::collector_service_name}-clone",
1747       second_resource => "${::ceilometer::params::api_service_name}-clone",
1748       first_action    => 'start',
1749       second_action   => 'start',
1750       require         => [Pacemaker::Resource::Service[$::ceilometer::params::collector_service_name],
1751                           Pacemaker::Resource::Service[$::ceilometer::params::api_service_name]],
1752     }
1753     pacemaker::constraint::colocation { 'ceilometer-api-with-ceilometer-collector-colocation':
1754       source  => "${::ceilometer::params::api_service_name}-clone",
1755       target  => "${::ceilometer::params::collector_service_name}-clone",
1756       score   => 'INFINITY',
1757       require => [Pacemaker::Resource::Service[$::ceilometer::params::api_service_name],
1758                   Pacemaker::Resource::Service[$::ceilometer::params::collector_service_name]],
1759     }
1760     pacemaker::constraint::base { 'ceilometer-api-then-ceilometer-delay-constraint':
1761       constraint_type => 'order',
1762       first_resource  => "${::ceilometer::params::api_service_name}-clone",
1763       second_resource => 'delay-clone',
1764       first_action    => 'start',
1765       second_action   => 'start',
1766       require         => [Pacemaker::Resource::Service[$::ceilometer::params::api_service_name],
1767                           Pacemaker::Resource::Ocf['delay']],
1768     }
1769     pacemaker::constraint::colocation { 'ceilometer-delay-with-ceilometer-api-colocation':
1770       source  => 'delay-clone',
1771       target  => "${::ceilometer::params::api_service_name}-clone",
1772       score   => 'INFINITY',
1773       require => [Pacemaker::Resource::Service[$::ceilometer::params::api_service_name],
1774                   Pacemaker::Resource::Ocf['delay']],
1775     }
1776     # Aodh
1777     pacemaker::resource::service { $::aodh::params::evaluator_service_name :
1778       clone_params => 'interleave=true',
1779     }
1780     pacemaker::resource::service { $::aodh::params::notifier_service_name :
1781       clone_params => 'interleave=true',
1782     }
1783     pacemaker::resource::service { $::aodh::params::listener_service_name :
1784       clone_params => 'interleave=true',
1785     }
1786     pacemaker::constraint::base { 'aodh-delay-then-aodh-evaluator-constraint':
1787       constraint_type => 'order',
1788       first_resource  => 'delay-clone',
1789       second_resource => "${::aodh::params::evaluator_service_name}-clone",
1790       first_action    => 'start',
1791       second_action   => 'start',
1792       require         => [Pacemaker::Resource::Service[$::aodh::params::evaluator_service_name],
1793                           Pacemaker::Resource::Ocf['delay']],
1794     }
1795     pacemaker::constraint::colocation { 'aodh-evaluator-with-aodh-delay-colocation':
1796       source  => "${::aodh::params::evaluator_service_name}-clone",
1797       target  => 'delay-clone',
1798       score   => 'INFINITY',
1799       require => [Pacemaker::Resource::Service[$::aodh::params::evaluator_service_name],
1800                   Pacemaker::Resource::Ocf['delay']],
1801     }
1802     pacemaker::constraint::base { 'aodh-evaluator-then-aodh-notifier-constraint':
1803       constraint_type => 'order',
1804       first_resource  => "${::aodh::params::evaluator_service_name}-clone",
1805       second_resource => "${::aodh::params::notifier_service_name}-clone",
1806       first_action    => 'start',
1807       second_action   => 'start',
1808       require         => [Pacemaker::Resource::Service[$::aodh::params::evaluator_service_name],
1809                           Pacemaker::Resource::Service[$::aodh::params::notifier_service_name]],
1810     }
1811     pacemaker::constraint::colocation { 'aodh-notifier-with-aodh-evaluator-colocation':
1812       source  => "${::aodh::params::notifier_service_name}-clone",
1813       target  => "${::aodh::params::evaluator_service_name}-clone",
1814       score   => 'INFINITY',
1815       require => [Pacemaker::Resource::Service[$::aodh::params::evaluator_service_name],
1816                   Pacemaker::Resource::Service[$::aodh::params::notifier_service_name]],
1817     }
1818     pacemaker::constraint::colocation { 'aodh-listener-with-aodh-evaluator-colocation':
1819       source  => "${::aodh::params::listener_service_name}-clone",
1820       target  => "${::aodh::params::evaluator_service_name}-clone",
1821       score   => 'INFINITY',
1822       require => [Pacemaker::Resource::Service[$::aodh::params::evaluator_service_name],
1823                   Pacemaker::Resource::Service[$::aodh::params::listener_service_name]],
1824     }
1825     if downcase(hiera('ceilometer_backend')) == 'mongodb' {
1826       pacemaker::constraint::base { 'mongodb-then-ceilometer-central-constraint':
1827         constraint_type => 'order',
1828         first_resource  => "${::mongodb::params::service_name}-clone",
1829         second_resource => "${::ceilometer::params::agent_central_service_name}-clone",
1830         first_action    => 'start',
1831         second_action   => 'start',
1832         require         => [Pacemaker::Resource::Service[$::ceilometer::params::agent_central_service_name],
1833                             Pacemaker::Resource::Service[$::mongodb::params::service_name]],
1834       }
1835     }
1836
1837     # Heat
1838     pacemaker::resource::service { $::heat::params::api_service_name :
1839       clone_params => 'interleave=true',
1840     }
1841     pacemaker::resource::service { $::heat::params::api_cloudwatch_service_name :
1842       clone_params => 'interleave=true',
1843     }
1844     pacemaker::resource::service { $::heat::params::api_cfn_service_name :
1845       clone_params => 'interleave=true',
1846     }
1847     pacemaker::resource::service { $::heat::params::engine_service_name :
1848       clone_params => 'interleave=true',
1849     }
1850     pacemaker::constraint::base { 'keystone-then-heat-api-constraint':
1851       constraint_type => 'order',
1852       first_resource  => 'openstack-core-clone',
1853       second_resource => "${::heat::params::api_service_name}-clone",
1854       first_action    => 'start',
1855       second_action   => 'start',
1856       require         => [Pacemaker::Resource::Service[$::heat::params::api_service_name],
1857                           Pacemaker::Resource::Ocf['openstack-core']],
1858     }
1859     pacemaker::constraint::base { 'heat-api-then-heat-api-cfn-constraint':
1860       constraint_type => 'order',
1861       first_resource  => "${::heat::params::api_service_name}-clone",
1862       second_resource => "${::heat::params::api_cfn_service_name}-clone",
1863       first_action    => 'start',
1864       second_action   => 'start',
1865       require         => [Pacemaker::Resource::Service[$::heat::params::api_service_name],
1866                           Pacemaker::Resource::Service[$::heat::params::api_cfn_service_name]],
1867     }
1868     pacemaker::constraint::colocation { 'heat-api-cfn-with-heat-api-colocation':
1869       source  => "${::heat::params::api_cfn_service_name}-clone",
1870       target  => "${::heat::params::api_service_name}-clone",
1871       score   => 'INFINITY',
1872       require => [Pacemaker::Resource::Service[$::heat::params::api_cfn_service_name],
1873                   Pacemaker::Resource::Service[$::heat::params::api_service_name]],
1874     }
1875     pacemaker::constraint::base { 'heat-api-cfn-then-heat-api-cloudwatch-constraint':
1876       constraint_type => 'order',
1877       first_resource  => "${::heat::params::api_cfn_service_name}-clone",
1878       second_resource => "${::heat::params::api_cloudwatch_service_name}-clone",
1879       first_action    => 'start',
1880       second_action   => 'start',
1881       require         => [Pacemaker::Resource::Service[$::heat::params::api_cloudwatch_service_name],
1882                           Pacemaker::Resource::Service[$::heat::params::api_cfn_service_name]],
1883     }
1884     pacemaker::constraint::colocation { 'heat-api-cloudwatch-with-heat-api-cfn-colocation':
1885       source  => "${::heat::params::api_cloudwatch_service_name}-clone",
1886       target  => "${::heat::params::api_cfn_service_name}-clone",
1887       score   => 'INFINITY',
1888       require => [Pacemaker::Resource::Service[$::heat::params::api_cfn_service_name],
1889                   Pacemaker::Resource::Service[$::heat::params::api_cloudwatch_service_name]],
1890     }
1891     pacemaker::constraint::base { 'heat-api-cloudwatch-then-heat-engine-constraint':
1892       constraint_type => 'order',
1893       first_resource  => "${::heat::params::api_cloudwatch_service_name}-clone",
1894       second_resource => "${::heat::params::engine_service_name}-clone",
1895       first_action    => 'start',
1896       second_action   => 'start',
1897       require         => [Pacemaker::Resource::Service[$::heat::params::api_cloudwatch_service_name],
1898                           Pacemaker::Resource::Service[$::heat::params::engine_service_name]],
1899     }
1900     pacemaker::constraint::colocation { 'heat-engine-with-heat-api-cloudwatch-colocation':
1901       source  => "${::heat::params::engine_service_name}-clone",
1902       target  => "${::heat::params::api_cloudwatch_service_name}-clone",
1903       score   => 'INFINITY',
1904       require => [Pacemaker::Resource::Service[$::heat::params::api_cloudwatch_service_name],
1905                   Pacemaker::Resource::Service[$::heat::params::engine_service_name]],
1906     }
1907     pacemaker::constraint::base { 'ceilometer-notification-then-heat-api-constraint':
1908       constraint_type => 'order',
1909       first_resource  => "${::ceilometer::params::agent_notification_service_name}-clone",
1910       second_resource => "${::heat::params::api_service_name}-clone",
1911       first_action    => 'start',
1912       second_action   => 'start',
1913       require         => [Pacemaker::Resource::Service[$::heat::params::api_service_name],
1914                           Pacemaker::Resource::Service[$::ceilometer::params::agent_notification_service_name]],
1915     }
1916
1917     # Horizon and Keystone
1918     pacemaker::resource::service { $::apache::params::service_name:
1919       clone_params     => 'interleave=true',
1920       verify_on_create => true,
1921       require          => [File['/etc/keystone/ssl/certs/ca.pem'],
1922       File['/etc/keystone/ssl/private/signing_key.pem'],
1923       File['/etc/keystone/ssl/certs/signing_cert.pem']],
1924     }
1925
1926     #VSM
1927     if 'cisco_n1kv' in hiera('neutron::plugins::ml2::mechanism_drivers') {
1928       pacemaker::resource::ocf { 'vsm-p' :
1929         ocf_agent_name  => 'heartbeat:VirtualDomain',
1930         resource_params => 'force_stop=true config=/var/spool/cisco/vsm/vsm_primary_deploy.xml',
1931         require         => Class['n1k_vsm'],
1932         meta_params     => 'resource-stickiness=INFINITY',
1933       }
1934       if str2bool(hiera('n1k_vsm::pacemaker_control', true)) {
1935         pacemaker::resource::ocf { 'vsm-s' :
1936           ocf_agent_name  => 'heartbeat:VirtualDomain',
1937           resource_params => 'force_stop=true config=/var/spool/cisco/vsm/vsm_secondary_deploy.xml',
1938           require         => Class['n1k_vsm'],
1939           meta_params     => 'resource-stickiness=INFINITY',
1940         }
1941         pacemaker::constraint::colocation { 'vsm-colocation-contraint':
1942           source  => 'vsm-p',
1943           target  => 'vsm-s',
1944           score   => '-INFINITY',
1945           require => [Pacemaker::Resource::Ocf['vsm-p'],
1946                       Pacemaker::Resource::Ocf['vsm-s']],
1947         }
1948       }
1949     }
1950
1951   }
1952
1953 } #END STEP 4
1954
1955 if hiera('step') >= 5 {
1956
1957   if $pacemaker_master {
1958
1959     class {'::keystone::roles::admin' :
1960       require => Pacemaker::Resource::Service[$::apache::params::service_name],
1961     } ->
1962     class {'::keystone::endpoint' :
1963       require => Pacemaker::Resource::Service[$::apache::params::service_name],
1964     }
1965     include ::heat::keystone::domain
1966     Class['::keystone::roles::admin'] -> Class['::heat::keystone::domain']
1967
1968   } else {
1969     # On non-master controller we don't need to create Keystone resources again
1970     class { '::heat::keystone::domain':
1971       manage_domain => false,
1972       manage_user   => false,
1973       manage_role   => false,
1974     }
1975   }
1976
1977 } #END STEP 5
1978
1979 $package_manifest_name = join(['/var/lib/tripleo/installed-packages/overcloud_controller_pacemaker', hiera('step')])
1980 package_manifest{$package_manifest_name: ensure => present}