puppet/services/cinder-api.yaml

   1 heat_template_version: pike
   2
   3 description: >
   4   OpenStack Cinder API service configured with Puppet
   5
   6 parameters:
   7   CinderEnableDBPurge:
   8     default: true
   9     description: |
  10       Whether to create cron job for purging soft deleted rows in Cinder database.
  11     type: boolean
  12   CinderPassword:
  13     description: The password for the cinder service account, used by cinder-api.
  14     type: string
  15     hidden: true
  16   ServiceNetMap:
  17     default: {}
  18     description: Mapping of service_name -> network name. Typically set
  19                  via parameter_defaults in the resource registry.  This
  20                  mapping overrides those in ServiceNetMapDefaults.
  21     type: json
  22   DefaultPasswords:
  23     default: {}
  24     type: json
  25   RoleName:
  26     default: ''
  27     description: Role name on which the service is applied
  28     type: string
  29   RoleParameters:
  30     default: {}
  31     description: Parameters specific to the role
  32     type: json
  33   EndpointMap:
  34     default: {}
  35     description: Mapping of service endpoint -> protocol. Typically set
  36                  via parameter_defaults in the resource registry.
  37     type: json
  38   KeystoneRegion:
  39     type: string
  40     default: 'regionOne'
  41     description: Keystone region for endpoint
  42   MonitoringSubscriptionCinderApi:
  43     default: 'overcloud-cinder-api'
  44     type: string
  45   CinderApiLoggingSource:
  46     type: json
  47     default:
  48       tag: openstack.cinder.api
  49       path: /var/log/cinder/cinder-api.log
  50   CinderWorkers:
  51     type: string
  52     description: Set the number of workers for cinder::wsgi::apache
  53     default: '%{::os_workers}'
  54   EnableInternalTLS:
  55     type: boolean
  56     default: false
  57   CinderApiPolicies:
  58     description: |
  59       A hash of policies to configure for Cinder API.
  60       e.g. { cinder-context_is_admin: { key: context_is_admin, value: 'role:admin' } }
  61     default: {}
  62     type: json
  63   NotificationDriver:
  64     type: string
  65     default: 'messagingv2'
  66     description: Driver or drivers to handle sending notifications.
  67     constraints:
  68       - allowed_values: [ 'messagingv2', 'noop' ]
  69
  70 conditions:
  71   cinder_workers_zero: {equals : [{get_param: CinderWorkers}, 0]}
  72
  73 resources:
  74
  75   ApacheServiceBase:
  76     type: ./apache.yaml
  77     properties:
  78       ServiceNetMap: {get_param: ServiceNetMap}
  79       DefaultPasswords: {get_param: DefaultPasswords}
  80       EndpointMap: {get_param: EndpointMap}
  81       RoleName: {get_param: RoleName}
  82       RoleParameters: {get_param: RoleParameters}
  83       EnableInternalTLS: {get_param: EnableInternalTLS}
  84
  85   CinderBase:
  86     type: ./cinder-base.yaml
  87     properties:
  88       ServiceNetMap: {get_param: ServiceNetMap}
  89       DefaultPasswords: {get_param: DefaultPasswords}
  90       EndpointMap: {get_param: EndpointMap}
  91       RoleName: {get_param: RoleName}
  92       RoleParameters: {get_param: RoleParameters}
  93
  94 outputs:
  95   role_data:
  96     description: Role data for the Cinder API role.
  97     value:
  98       service_name: cinder_api
  99       monitoring_subscription: {get_param: MonitoringSubscriptionCinderApi}
 100       logging_source: {get_param: CinderApiLoggingSource}
 101       logging_groups:
 102         - cinder
 103       config_settings:
 104         map_merge:
 105           - get_attr: [CinderBase, role_data, config_settings]
 106           - get_attr: [ApacheServiceBase, role_data, config_settings]
 107           - cinder::keystone::authtoken::auth_uri: {get_param: [EndpointMap, KeystoneInternal, uri_no_suffix]}
 108             cinder::keystone::authtoken::auth_url: {get_param: [EndpointMap, KeystoneInternal, uri_no_suffix]}
 109             cinder::keystone::authtoken::password: {get_param: CinderPassword}
 110             cinder::keystone::authtoken::project_name: 'service'
 111             cinder::keystone::authtoken::user_domain_name: 'Default'
 112             cinder::keystone::authtoken::project_domain_name: 'Default'
 113             cinder::policy::policies: {get_param: CinderApiPolicies}
 114             cinder::ceilometer::notification_driver: {get_param: NotificationDriver}
 115             cinder::api::enable_proxy_headers_parsing: true
 116
 117             cinder::api::nova_catalog_info: 'compute:nova:internalURL'
 118             cinder::api::nova_catalog_admin_info: 'compute:nova:adminURL'
 119             # TODO(emilien) move it to puppet-cinder
 120             cinder::config:
 121               DEFAULT/swift_catalog_info:
 122                 value: 'object-store:swift:internalURL'
 123             tripleo::profile::base::cinder::cinder_enable_db_purge: {get_param: CinderEnableDBPurge}
 124             tripleo.cinder_api.firewall_rules:
 125               '119 cinder':
 126                 dport:
 127                   - 8776
 128                   - 13776
 129             cinder::api::bind_host:
 130               str_replace:
 131                 template:
 132                   "%{hiera('fqdn_$NETWORK')}"
 133                 params:
 134                   $NETWORK: {get_param: [ServiceNetMap, CinderApiNetwork]}
 135             cinder::wsgi::apache::ssl: {get_param: EnableInternalTLS}
 136             cinder::api::service_name: 'httpd'
 137             # NOTE: bind IP is found in Heat replacing the network name with the local node IP
 138             # for the given network; replacement examples (eg. for internal_api):
 139             # internal_api -> IP
 140             # internal_api_uri -> [IP]
 141             # internal_api_subnet - > IP/CIDR
 142             cinder::wsgi::apache::bind_host: {get_param: [ServiceNetMap, CinderApiNetwork]}
 143             cinder::wsgi::apache::servername:
 144               str_replace:
 145                 template:
 146                   "%{hiera('fqdn_$NETWORK')}"
 147                 params:
 148                   $NETWORK: {get_param: [ServiceNetMap, CinderApiNetwork]}
 149           -
 150             if:
 151             - cinder_workers_zero
 152             - {}
 153             - cinder::wsgi::apache::workers: {get_param: CinderWorkers}
 154       step_config: |
 155         include ::tripleo::profile::base::cinder::api
 156       service_config_settings:
 157         keystone:
 158           cinder::keystone::auth::tenant: 'service'
 159           cinder::keystone::auth::public_url: {get_param: [EndpointMap, CinderPublic, uri]}
 160           cinder::keystone::auth::internal_url: {get_param: [EndpointMap, CinderInternal, uri]}
 161           cinder::keystone::auth::admin_url: {get_param: [EndpointMap, CinderAdmin, uri]}
 162           cinder::keystone::auth::public_url_v2: {get_param: [EndpointMap, CinderV2Public, uri]}
 163           cinder::keystone::auth::internal_url_v2: {get_param: [EndpointMap, CinderV2Internal, uri]}
 164           cinder::keystone::auth::admin_url_v2: {get_param: [EndpointMap, CinderV2Admin, uri]}
 165           cinder::keystone::auth::public_url_v3: {get_param: [EndpointMap, CinderV3Public, uri]}
 166           cinder::keystone::auth::internal_url_v3: {get_param: [EndpointMap, CinderV3Internal, uri]}
 167           cinder::keystone::auth::admin_url_v3: {get_param: [EndpointMap, CinderV3Admin, uri]}
 168           cinder::keystone::auth::password: {get_param: CinderPassword}
 169           cinder::keystone::auth::region: {get_param: KeystoneRegion}
 170         mysql:
 171           cinder::db::mysql::password: {get_param: CinderPassword}
 172           cinder::db::mysql::user: cinder
 173           cinder::db::mysql::host: {get_param: [EndpointMap, MysqlInternal, host_nobrackets]}
 174           cinder::db::mysql::dbname: cinder
 175           cinder::db::mysql::allowed_hosts:
 176             - '%'
 177             - "%{hiera('mysql_bind_host')}"
 178       metadata_settings:
 179         get_attr: [ApacheServiceBase, role_data, metadata_settings]
 180       upgrade_tasks:
 181         yaql:
 182           expression: $.data.apache_upgrade + $.data.cinder_api_upgrade
 183           data:
 184             apache_upgrade:
 185               get_attr: [ApacheServiceBase, role_data, upgrade_tasks]
 186             cinder_api_upgrade:
 187               - name: Check if cinder_api is deployed
 188                 command: systemctl is-enabled openstack-cinder-api
 189                 tags: common
 190                 ignore_errors: True
 191                 register: cinder_api_enabled
 192               - name: "PreUpgrade step0,validation: Check service openstack-cinder-api is running"
 193                 shell: /usr/bin/systemctl show 'openstack-cinder-api' --property ActiveState | grep '\bactive\b'
 194                 when: cinder_api_enabled.rc == 0
 195                 tags: step0,validation
 196               - name: check for cinder running under apache (post upgrade)
 197                 tags: step1
 198                 shell: "httpd -t -D DUMP_VHOSTS | grep -q cinder"
 199                 register: cinder_apache
 200                 ignore_errors: true
 201               - name: Stop cinder_api service (running under httpd)
 202                 tags: step1
 203                 service: name=httpd state=stopped
 204                 when: cinder_apache.rc == 0
 205               - name: Stop and disable cinder_api service (pre-upgrade not under httpd)
 206                 tags: step1
 207                 when: cinder_api_enabled.rc == 0
 208                 service: name=openstack-cinder-api state=stopped enabled=no