Merge "Add network sysctl tweaks for security"
[apex-tripleo-heat-templates.git] / puppet / services / ceilometer-api.yaml
1 heat_template_version: ocata
2
3 description: >
4   OpenStack Ceilometer API service configured with Puppet
5
6 parameters:
7   ServiceNetMap:
8     default: {}
9     description: Mapping of service_name -> network name. Typically set
10                  via parameter_defaults in the resource registry.  This
11                  mapping overrides those in ServiceNetMapDefaults.
12     type: json
13   DefaultPasswords:
14     default: {}
15     type: json
16   EndpointMap:
17     default: {}
18     description: Mapping of service endpoint -> protocol. Typically set
19                  via parameter_defaults in the resource registry.
20     type: json
21   MonitoringSubscriptionCeilometerApi:
22     default: 'overcloud-ceilometer-api'
23     type: string
24   CeilometerApiLoggingSource:
25     type: json
26     default:
27       tag: openstack.ceilometer.api
28       path: /var/log/ceilometer/api.log
29   EnableInternalTLS:
30     type: boolean
31     default: false
32   CeilometerApiPolicies:
33     description: |
34       A hash of policies to configure for Ceilometer API.
35       e.g. { ceilometer-context_is_admin: { key: context_is_admin, value: 'role:admin' } }
36     default: {}
37     type: json
38
39 resources:
40   CeilometerServiceBase:
41     type: ./ceilometer-base.yaml
42     properties:
43       ServiceNetMap: {get_param: ServiceNetMap}
44       DefaultPasswords: {get_param: DefaultPasswords}
45       EndpointMap: {get_param: EndpointMap}
46
47   ApacheServiceBase:
48     type: ./apache.yaml
49     properties:
50       ServiceNetMap: {get_param: ServiceNetMap}
51       DefaultPasswords: {get_param: DefaultPasswords}
52       EndpointMap: {get_param: EndpointMap}
53       EnableInternalTLS: {get_param: EnableInternalTLS}
54
55 outputs:
56   role_data:
57     description: Role data for the Ceilometer API role.
58     value:
59       service_name: ceilometer_api
60       monitoring_subscription: {get_param: MonitoringSubscriptionCeilometerApi}
61       logging_source: {get_param: CeilometerApiLoggingSource}
62       logging_groups:
63         - ceilometer
64       config_settings:
65         map_merge:
66           - get_attr: [ApacheServiceBase, role_data, config_settings]
67           - get_attr: [CeilometerServiceBase, role_data, config_settings]
68           - tripleo.ceilometer_api.firewall_rules:
69               '124 ceilometer':
70                 dport:
71                   - 8777
72                   - 13777
73             # NOTE: bind IP is found in Heat replacing the network name with the
74             # local node IP for the given network; replacement examples
75             # (eg. for internal_api):
76             # internal_api -> IP
77             # internal_api_uri -> [IP]
78             # internal_api_subnet - > IP/CIDR
79           - ceilometer::api::service_name: 'httpd'
80             ceilometer::api::enable_proxy_headers_parsing: true
81             ceilometer::api::host:
82               str_replace:
83                 template:
84                   "%{hiera('fqdn_$NETWORK')}"
85                 params:
86                   $NETWORK: {get_param: [ServiceNetMap, CeilometerApiNetwork]}
87             ceilometer::policy::policies: {get_param: CeilometerApiPolicies}
88             ceilometer::wsgi::apache::bind_host: {get_param: [ServiceNetMap, CeilometerApiNetwork]}
89             ceilometer::wsgi::apache::ssl: {get_param: EnableInternalTLS}
90             ceilometer::wsgi::apache::servername:
91               str_replace:
92                 template:
93                   "%{hiera('fqdn_$NETWORK')}"
94                 params:
95                   $NETWORK: {get_param: [ServiceNetMap, CeilometerApiNetwork]}
96       service_config_settings:
97         get_attr: [CeilometerServiceBase, role_data, service_config_settings]
98       step_config: |
99         include ::tripleo::profile::base::ceilometer::api
100       metadata_settings:
101         get_attr: [ApacheServiceBase, role_data, metadata_settings]
102       upgrade_tasks:
103         - name: Stop ceilometer_api service (running under httpd)
104           tags: step1
105           service: name=httpd state=stopped