puppet/services/cinder-api.yaml

   1 heat_template_version: ocata
   2
   3 description: >
   4   OpenStack Cinder API service configured with Puppet
   5
   6 parameters:
   7   CinderEnableDBPurge:
   8     default: true
   9     description: |
  10       Whether to create cron job for purging soft deleted rows in Cinder database.
  11     type: boolean
  12   CinderPassword:
  13     description: The password for the cinder service account, used by cinder-api.
  14     type: string
  15     hidden: true
  16   ServiceNetMap:
  17     default: {}
  18     description: Mapping of service_name -> network name. Typically set
  19                  via parameter_defaults in the resource registry.  This
  20                  mapping overrides those in ServiceNetMapDefaults.
  21     type: json
  22   DefaultPasswords:
  23     default: {}
  24     type: json
  25   EndpointMap:
  26     default: {}
  27     description: Mapping of service endpoint -> protocol. Typically set
  28                  via parameter_defaults in the resource registry.
  29     type: json
  30   KeystoneRegion:
  31     type: string
  32     default: 'regionOne'
  33     description: Keystone region for endpoint
  34   MonitoringSubscriptionCinderApi:
  35     default: 'overcloud-cinder-api'
  36     type: string
  37   CinderApiLoggingSource:
  38     type: json
  39     default:
  40       tag: openstack.cinder.api
  41       path: /var/log/cinder/cinder-api.log
  42   CinderWorkers:
  43     type: string
  44     description: Set the number of workers for cinder::wsgi::apache
  45     default: '%{::os_workers}'
  46   EnableInternalTLS:
  47     type: boolean
  48     default: false
  49   CinderApiPolicies:
  50     description: |
  51       A hash of policies to configure for Cinder API.
  52       e.g. { cinder-context_is_admin: { key: context_is_admin, value: 'role:admin' } }
  53     default: {}
  54     type: json
  55
  56 conditions:
  57   cinder_workers_zero: {equals : [{get_param: CinderWorkers}, 0]}
  58
  59 resources:
  60
  61   ApacheServiceBase:
  62     type: ./apache.yaml
  63     properties:
  64       ServiceNetMap: {get_param: ServiceNetMap}
  65       DefaultPasswords: {get_param: DefaultPasswords}
  66       EndpointMap: {get_param: EndpointMap}
  67       EnableInternalTLS: {get_param: EnableInternalTLS}
  68
  69   CinderBase:
  70     type: ./cinder-base.yaml
  71     properties:
  72       ServiceNetMap: {get_param: ServiceNetMap}
  73       DefaultPasswords: {get_param: DefaultPasswords}
  74       EndpointMap: {get_param: EndpointMap}
  75
  76 outputs:
  77   role_data:
  78     description: Role data for the Cinder API role.
  79     value:
  80       service_name: cinder_api
  81       monitoring_subscription: {get_param: MonitoringSubscriptionCinderApi}
  82       logging_source: {get_param: CinderApiLoggingSource}
  83       logging_groups:
  84         - cinder
  85       config_settings:
  86         map_merge:
  87           - get_attr: [CinderBase, role_data, config_settings]
  88           - get_attr: [ApacheServiceBase, role_data, config_settings]
  89           - cinder::keystone::authtoken::auth_uri: {get_param: [EndpointMap, KeystoneInternal, uri_no_suffix]}
  90             cinder::keystone::authtoken::auth_url: {get_param: [EndpointMap, KeystoneInternal, uri_no_suffix]}
  91             cinder::keystone::authtoken::password: {get_param: CinderPassword}
  92             cinder::keystone::authtoken::project_name: 'service'
  93             cinder::keystone::authtoken::user_domain_name: 'Default'
  94             cinder::keystone::authtoken::project_domain_name: 'Default'
  95             cinder::policy::policies: {get_param: CinderApiPolicies}
  96             cinder::api::enable_proxy_headers_parsing: true
  97
  98             cinder::api::nova_catalog_info: 'compute:nova:internalURL'
  99             cinder::api::nova_catalog_admin_info: 'compute:nova:adminURL'
 100             # TODO(emilien) move it to puppet-cinder
 101             cinder::config:
 102               DEFAULT/swift_catalog_info:
 103                 value: 'object-store:swift:internalURL'
 104             tripleo::profile::base::cinder::cinder_enable_db_purge: {get_param: CinderEnableDBPurge}
 105             tripleo.cinder_api.firewall_rules:
 106               '119 cinder':
 107                 dport:
 108                   - 8776
 109                   - 13776
 110             cinder::api::bind_host:
 111               str_replace:
 112                 template:
 113                   "%{hiera('fqdn_$NETWORK')}"
 114                 params:
 115                   $NETWORK: {get_param: [ServiceNetMap, CinderApiNetwork]}
 116             cinder::wsgi::apache::ssl: {get_param: EnableInternalTLS}
 117             cinder::api::service_name: 'httpd'
 118             # NOTE: bind IP is found in Heat replacing the network name with the local node IP
 119             # for the given network; replacement examples (eg. for internal_api):
 120             # internal_api -> IP
 121             # internal_api_uri -> [IP]
 122             # internal_api_subnet - > IP/CIDR
 123             cinder::wsgi::apache::bind_host: {get_param: [ServiceNetMap, CinderApiNetwork]}
 124             cinder::wsgi::apache::servername:
 125               str_replace:
 126                 template:
 127                   "%{hiera('fqdn_$NETWORK')}"
 128                 params:
 129                   $NETWORK: {get_param: [ServiceNetMap, CinderApiNetwork]}
 130           -
 131             if:
 132             - cinder_workers_zero
 133             - {}
 134             - cinder::wsgi::apache::workers: {get_param: CinderWorkers}
 135       step_config: |
 136         include ::tripleo::profile::base::cinder::api
 137       service_config_settings:
 138         keystone:
 139           cinder::keystone::auth::tenant: 'service'
 140           cinder::keystone::auth::public_url: {get_param: [EndpointMap, CinderPublic, uri]}
 141           cinder::keystone::auth::internal_url: {get_param: [EndpointMap, CinderInternal, uri]}
 142           cinder::keystone::auth::admin_url: {get_param: [EndpointMap, CinderAdmin, uri]}
 143           cinder::keystone::auth::public_url_v2: {get_param: [EndpointMap, CinderV2Public, uri]}
 144           cinder::keystone::auth::internal_url_v2: {get_param: [EndpointMap, CinderV2Internal, uri]}
 145           cinder::keystone::auth::admin_url_v2: {get_param: [EndpointMap, CinderV2Admin, uri]}
 146           cinder::keystone::auth::public_url_v3: {get_param: [EndpointMap, CinderV3Public, uri]}
 147           cinder::keystone::auth::internal_url_v3: {get_param: [EndpointMap, CinderV3Internal, uri]}
 148           cinder::keystone::auth::admin_url_v3: {get_param: [EndpointMap, CinderV3Admin, uri]}
 149           cinder::keystone::auth::password: {get_param: CinderPassword}
 150           cinder::keystone::auth::region: {get_param: KeystoneRegion}
 151         mysql:
 152           cinder::db::mysql::password: {get_param: CinderPassword}
 153           cinder::db::mysql::user: cinder
 154           cinder::db::mysql::host: {get_param: [EndpointMap, MysqlInternal, host_nobrackets]}
 155           cinder::db::mysql::dbname: cinder
 156           cinder::db::mysql::allowed_hosts:
 157             - '%'
 158             - "%{hiera('mysql_bind_host')}"
 159       metadata_settings:
 160         get_attr: [ApacheServiceBase, role_data, metadata_settings]
 161       upgrade_tasks:
 162         yaql:
 163           expression: $.data.apache_upgrade + $.data.cinder_api_upgrade
 164           data:
 165             apache_upgrade:
 166               get_attr: [ApacheServiceBase, role_data, upgrade_tasks]
 167             cinder_api_upgrade:
 168               - name: Check if cinder_api is deployed
 169                 command: systemctl is-enabled openstack-cinder-api
 170                 tags: common
 171                 ignore_errors: True
 172                 register: cinder_api_enabled
 173               - name: "PreUpgrade step0,validation: Check service openstack-cinder-api is running"
 174                 shell: /usr/bin/systemctl show 'openstack-cinder-api' --property ActiveState | grep '\bactive\b'
 175                 when: cinder_api_enabled.rc == 0
 176                 tags: step0,validation
 177               - name: check for cinder running under apache (post upgrade)
 178                 tags: step1
 179                 shell: "httpd -t -D DUMP_VHOSTS | grep -q cinder"
 180                 register: cinder_apache
 181                 ignore_errors: true
 182               - name: Stop cinder_api service (running under httpd)
 183                 tags: step1
 184                 service: name=httpd state=stopped
 185                 when: cinder_apache.rc == 0
 186               - name: Stop and disable cinder_api service (pre-upgrade not under httpd)
 187                 tags: step1
 188                 when: cinder_api_enabled.rc == 0
 189                 service: name=openstack-cinder-api state=stopped enabled=no