puppet/services/apache.yaml

   1 heat_template_version: ocata
   2
   3 description: >
   4   Apache service configured with Puppet. Note this is typically included
   5   automatically via other services which run via Apache.
   6
   7 parameters:
   8   ApacheMaxRequestWorkers:
   9     default: 256
  10     description: Maximum number of simultaneously processed requests.
  11     type: number
  12   ApacheServerLimit:
  13     default: 256
  14     description: Maximum number of Apache processes.
  15     type: number
  16   ServiceNetMap:
  17     default: {}
  18     description: Mapping of service_name -> network name. Typically set
  19                  via parameter_defaults in the resource registry.  This
  20                  mapping overrides those in ServiceNetMapDefaults.
  21     type: json
  22   DefaultPasswords:
  23     default: {}
  24     type: json
  25   EndpointMap:
  26     default: {}
  27     description: Mapping of service endpoint -> protocol. Typically set
  28                  via parameter_defaults in the resource registry.
  29     type: json
  30   EnableInternalTLS:
  31     type: boolean
  32     default: false
  33
  34 conditions:
  35
  36   internal_tls_enabled: {equals: [{get_param: EnableInternalTLS}, true]}
  37
  38 resources:
  39
  40   ApacheNetworks:
  41     type: OS::Heat::Value
  42     properties:
  43       value:
  44         # NOTE(jaosorior) Get unique network names to create
  45         # certificates for those. We skip the tenant network since
  46         # we don't need a certificate for that, and the external
  47         # is for HAProxy so it isn't used for apache either.
  48         yaql:
  49           expression: list($.data.map.items().map($1[1])).distinct().where($ != external and $ != tenant)
  50           data:
  51             map:
  52               get_param: ServiceNetMap
  53
  54 outputs:
  55   role_data:
  56     description: Role data for the Apache role.
  57     value:
  58       service_name: apache
  59       config_settings:
  60         map_merge:
  61           -
  62             # for the given network; replacement examples (eg. for internal_api):
  63             # internal_api -> IP
  64             # internal_api_uri -> [IP]
  65             # internal_api_subnet - > IP/CIDR
  66             apache::ip: {get_param: [ServiceNetMap, ApacheNetwork]}
  67             apache::server_signature: 'Off'
  68             apache::server_tokens: 'Prod'
  69             apache_remote_proxy_ips_network:
  70               str_replace:
  71                 template: "NETWORK_subnet"
  72                 params:
  73                   NETWORK: {get_param: [ServiceNetMap, ApacheNetwork]}
  74             apache::mod::prefork::maxclients: { get_param: ApacheMaxRequestWorkers }
  75             apache::mod::prefork::serverlimit: { get_param: ApacheServerLimit }
  76             apache::mod::remoteip::proxy_ips:
  77               - "%{hiera('apache_remote_proxy_ips_network')}"
  78           -
  79             generate_service_certificates: true
  80             tripleo::certmonger::apache_dirs::certificate_dir: '/etc/pki/tls/certs/httpd'
  81             tripleo::certmonger::apache_dirs::key_dir: '/etc/pki/tls/private/httpd'
  82             apache_certificates_specs:
  83               map_merge:
  84                 repeat:
  85                   template:
  86                     httpd-NETWORK:
  87                       service_certificate: '/etc/pki/tls/certs/httpd/httpd-NETWORK.crt'
  88                       service_key: '/etc/pki/tls/private/httpd/httpd-NETWORK.key'
  89                       hostname: "%{hiera('fqdn_NETWORK')}"
  90                       principal: "HTTP/%{hiera('fqdn_NETWORK')}"
  91                   for_each:
  92                     NETWORK: {get_attr: [ApacheNetworks, value]}
  93       metadata_settings:
  94         if:
  95           - internal_tls_enabled
  96           -
  97             repeat:
  98               template:
  99                 - service: HTTP
 100                   network: $NETWORK
 101                   type: node
 102               for_each:
 103                 $NETWORK: {get_attr: [ApacheNetworks, value]}
 104           - null
 105       upgrade_tasks:
 106         - name: Check if httpd is deployed
 107           command: systemctl is-enabled httpd
 108           tags: common
 109           ignore_errors: True
 110           register: httpd_enabled
 111         - name: "PreUpgrade step0,validation: Check service httpd is running"
 112           shell: /usr/bin/systemctl show 'httpd' --property ActiveState | grep '\bactive\b'
 113           when: httpd_enabled.rc == 0
 114           tags: step0,validation