puppet/services/cinder-api.yaml

   1 heat_template_version: pike
   2
   3 description: >
   4   OpenStack Cinder API service configured with Puppet
   5
   6 parameters:
   7   CinderEnableDBPurge:
   8     default: true
   9     description: |
  10       Whether to create cron job for purging soft deleted rows in Cinder database.
  11     type: boolean
  12   CinderPassword:
  13     description: The password for the cinder service account, used by cinder-api.
  14     type: string
  15     hidden: true
  16   ServiceNetMap:
  17     default: {}
  18     description: Mapping of service_name -> network name. Typically set
  19                  via parameter_defaults in the resource registry.  This
  20                  mapping overrides those in ServiceNetMapDefaults.
  21     type: json
  22   DefaultPasswords:
  23     default: {}
  24     type: json
  25   RoleName:
  26     default: ''
  27     description: Role name on which the service is applied
  28     type: string
  29   RoleParameters:
  30     default: {}
  31     description: Parameters specific to the role
  32     type: json
  33   EndpointMap:
  34     default: {}
  35     description: Mapping of service endpoint -> protocol. Typically set
  36                  via parameter_defaults in the resource registry.
  37     type: json
  38   KeystoneRegion:
  39     type: string
  40     default: 'regionOne'
  41     description: Keystone region for endpoint
  42   MonitoringSubscriptionCinderApi:
  43     default: 'overcloud-cinder-api'
  44     type: string
  45   CinderApiLoggingSource:
  46     type: json
  47     default:
  48       tag: openstack.cinder.api
  49       path: /var/log/cinder/cinder-api.log
  50   CinderWorkers:
  51     type: string
  52     description: Set the number of workers for cinder::wsgi::apache
  53     default: '%{::os_workers}'
  54   EnableInternalTLS:
  55     type: boolean
  56     default: false
  57   CinderApiPolicies:
  58     description: |
  59       A hash of policies to configure for Cinder API.
  60       e.g. { cinder-context_is_admin: { key: context_is_admin, value: 'role:admin' } }
  61     default: {}
  62     type: json
  63
  64 conditions:
  65   cinder_workers_zero: {equals : [{get_param: CinderWorkers}, 0]}
  66
  67 resources:
  68
  69   ApacheServiceBase:
  70     type: ./apache.yaml
  71     properties:
  72       ServiceNetMap: {get_param: ServiceNetMap}
  73       DefaultPasswords: {get_param: DefaultPasswords}
  74       EndpointMap: {get_param: EndpointMap}
  75       RoleName: {get_param: RoleName}
  76       RoleParameters: {get_param: RoleParameters}
  77       EnableInternalTLS: {get_param: EnableInternalTLS}
  78
  79   CinderBase:
  80     type: ./cinder-base.yaml
  81     properties:
  82       ServiceNetMap: {get_param: ServiceNetMap}
  83       DefaultPasswords: {get_param: DefaultPasswords}
  84       EndpointMap: {get_param: EndpointMap}
  85       RoleName: {get_param: RoleName}
  86       RoleParameters: {get_param: RoleParameters}
  87
  88 outputs:
  89   role_data:
  90     description: Role data for the Cinder API role.
  91     value:
  92       service_name: cinder_api
  93       monitoring_subscription: {get_param: MonitoringSubscriptionCinderApi}
  94       logging_source: {get_param: CinderApiLoggingSource}
  95       logging_groups:
  96         - cinder
  97       config_settings:
  98         map_merge:
  99           - get_attr: [CinderBase, role_data, config_settings]
 100           - get_attr: [ApacheServiceBase, role_data, config_settings]
 101           - cinder::keystone::authtoken::auth_uri: {get_param: [EndpointMap, KeystoneInternal, uri_no_suffix]}
 102             cinder::keystone::authtoken::auth_url: {get_param: [EndpointMap, KeystoneInternal, uri_no_suffix]}
 103             cinder::keystone::authtoken::password: {get_param: CinderPassword}
 104             cinder::keystone::authtoken::project_name: 'service'
 105             cinder::keystone::authtoken::user_domain_name: 'Default'
 106             cinder::keystone::authtoken::project_domain_name: 'Default'
 107             cinder::policy::policies: {get_param: CinderApiPolicies}
 108             cinder::api::enable_proxy_headers_parsing: true
 109
 110             cinder::api::nova_catalog_info: 'compute:nova:internalURL'
 111             cinder::api::nova_catalog_admin_info: 'compute:nova:adminURL'
 112             # TODO(emilien) move it to puppet-cinder
 113             cinder::config:
 114               DEFAULT/swift_catalog_info:
 115                 value: 'object-store:swift:internalURL'
 116             tripleo::profile::base::cinder::cinder_enable_db_purge: {get_param: CinderEnableDBPurge}
 117             tripleo.cinder_api.firewall_rules:
 118               '119 cinder':
 119                 dport:
 120                   - 8776
 121                   - 13776
 122             cinder::api::bind_host:
 123               str_replace:
 124                 template:
 125                   "%{hiera('fqdn_$NETWORK')}"
 126                 params:
 127                   $NETWORK: {get_param: [ServiceNetMap, CinderApiNetwork]}
 128             cinder::wsgi::apache::ssl: {get_param: EnableInternalTLS}
 129             cinder::api::service_name: 'httpd'
 130             # NOTE: bind IP is found in Heat replacing the network name with the local node IP
 131             # for the given network; replacement examples (eg. for internal_api):
 132             # internal_api -> IP
 133             # internal_api_uri -> [IP]
 134             # internal_api_subnet - > IP/CIDR
 135             cinder::wsgi::apache::bind_host: {get_param: [ServiceNetMap, CinderApiNetwork]}
 136             cinder::wsgi::apache::servername:
 137               str_replace:
 138                 template:
 139                   "%{hiera('fqdn_$NETWORK')}"
 140                 params:
 141                   $NETWORK: {get_param: [ServiceNetMap, CinderApiNetwork]}
 142           -
 143             if:
 144             - cinder_workers_zero
 145             - {}
 146             - cinder::wsgi::apache::workers: {get_param: CinderWorkers}
 147       step_config: |
 148         include ::tripleo::profile::base::cinder::api
 149       service_config_settings:
 150         keystone:
 151           cinder::keystone::auth::tenant: 'service'
 152           cinder::keystone::auth::public_url: {get_param: [EndpointMap, CinderPublic, uri]}
 153           cinder::keystone::auth::internal_url: {get_param: [EndpointMap, CinderInternal, uri]}
 154           cinder::keystone::auth::admin_url: {get_param: [EndpointMap, CinderAdmin, uri]}
 155           cinder::keystone::auth::public_url_v2: {get_param: [EndpointMap, CinderV2Public, uri]}
 156           cinder::keystone::auth::internal_url_v2: {get_param: [EndpointMap, CinderV2Internal, uri]}
 157           cinder::keystone::auth::admin_url_v2: {get_param: [EndpointMap, CinderV2Admin, uri]}
 158           cinder::keystone::auth::public_url_v3: {get_param: [EndpointMap, CinderV3Public, uri]}
 159           cinder::keystone::auth::internal_url_v3: {get_param: [EndpointMap, CinderV3Internal, uri]}
 160           cinder::keystone::auth::admin_url_v3: {get_param: [EndpointMap, CinderV3Admin, uri]}
 161           cinder::keystone::auth::password: {get_param: CinderPassword}
 162           cinder::keystone::auth::region: {get_param: KeystoneRegion}
 163         mysql:
 164           cinder::db::mysql::password: {get_param: CinderPassword}
 165           cinder::db::mysql::user: cinder
 166           cinder::db::mysql::host: {get_param: [EndpointMap, MysqlInternal, host_nobrackets]}
 167           cinder::db::mysql::dbname: cinder
 168           cinder::db::mysql::allowed_hosts:
 169             - '%'
 170             - "%{hiera('mysql_bind_host')}"
 171       metadata_settings:
 172         get_attr: [ApacheServiceBase, role_data, metadata_settings]
 173       upgrade_tasks:
 174         yaql:
 175           expression: $.data.apache_upgrade + $.data.cinder_api_upgrade
 176           data:
 177             apache_upgrade:
 178               get_attr: [ApacheServiceBase, role_data, upgrade_tasks]
 179             cinder_api_upgrade:
 180               - name: Check if cinder_api is deployed
 181                 command: systemctl is-enabled openstack-cinder-api
 182                 tags: common
 183                 ignore_errors: True
 184                 register: cinder_api_enabled
 185               - name: "PreUpgrade step0,validation: Check service openstack-cinder-api is running"
 186                 shell: /usr/bin/systemctl show 'openstack-cinder-api' --property ActiveState | grep '\bactive\b'
 187                 when: cinder_api_enabled.rc == 0
 188                 tags: step0,validation
 189               - name: check for cinder running under apache (post upgrade)
 190                 tags: step1
 191                 shell: "httpd -t -D DUMP_VHOSTS | grep -q cinder"
 192                 register: cinder_apache
 193                 ignore_errors: true
 194               - name: Stop cinder_api service (running under httpd)
 195                 tags: step1
 196                 service: name=httpd state=stopped
 197                 when: cinder_apache.rc == 0
 198               - name: Stop and disable cinder_api service (pre-upgrade not under httpd)
 199                 tags: step1
 200                 when: cinder_api_enabled.rc == 0
 201                 service: name=openstack-cinder-api state=stopped enabled=no