puppet/services/nova-libvirt.yaml

   1 heat_template_version: pike
   2
   3 description: >
   4   Libvirt service configured with Puppet
   5
   6 parameters:
   7   ServiceData:
   8     default: {}
   9     description: Dictionary packing service data
  10     type: json
  11   ServiceNetMap:
  12     default: {}
  13     description: Mapping of service_name -> network name. Typically set
  14                  via parameter_defaults in the resource registry.  This
  15                  mapping overrides those in ServiceNetMapDefaults.
  16     type: json
  17   DefaultPasswords:
  18     default: {}
  19     type: json
  20   RoleName:
  21     default: ''
  22     description: Role name on which the service is applied
  23     type: string
  24   RoleParameters:
  25     default: {}
  26     description: Parameters specific to the role
  27     type: json
  28   EndpointMap:
  29     default: {}
  30     description: Mapping of service endpoint -> protocol. Typically set
  31                  via parameter_defaults in the resource registry.
  32     type: json
  33   NovaComputeLibvirtType:
  34     type: string
  35     default: kvm
  36   LibvirtEnabledPerfEvents:
  37     type: comma_delimited_list
  38     default: []
  39     description: This is a performance event list which could be used as monitor.
  40                  For example - ``enabled_perf_events = cmt, mbml, mbmt``
  41                  The supported events list can be found in
  42                  https://libvirt.org/html/libvirt-libvirt-domain.html ,
  43                  which you may need to search key words ``VIR_PERF_PARAM_*``
  44   MonitoringSubscriptionNovaLibvirt:
  45     default: 'overcloud-nova-libvirt'
  46     type: string
  47   EnableInternalTLS:
  48     type: boolean
  49     default: false
  50   UseTLSTransportForLiveMigration:
  51     type: boolean
  52     default: true
  53     description: If set to true and if EnableInternalTLS is enabled, it will
  54                  set the libvirt URI's transport to tls and configure the
  55                  relevant keys for libvirt.
  56   InternalTLSCAFile:
  57     default: '/etc/ipa/ca.crt'
  58     type: string
  59     description: Specifies the default CA cert to use if TLS is used for
  60                  services in the internal network.
  61   LibvirtCACert:
  62     type: string
  63     default: ''
  64     description: This specifies the CA certificate to use for TLS in libvirt.
  65                  This file will be symlinked to the default CA path in libvirt,
  66                  which is /etc/pki/CA/cacert.pem. Note that due to limitations
  67                  GNU TLS, which is the TLS backend for libvirt, the file must
  68                  be less than 65K (so we can't use the system's CA bundle).
  69                  This parameter should be used if the default (which comes from
  70                  the InternalTLSCAFile parameter) is not desired. The current
  71                  default reflects TripleO's default CA, which is FreeIPA.
  72                  It will only be used if internal TLS is enabled.
  73
  74 conditions:
  75
  76   use_tls_for_live_migration:
  77     and:
  78     - equals:
  79       - {get_param: EnableInternalTLS}
  80       - true
  81     - equals:
  82       - {get_param: UseTLSTransportForLiveMigration}
  83       - true
  84
  85   libvirt_specific_ca_unset:
  86     equals:
  87       - {get_param: LibvirtCACert}
  88       - ''
  89
  90 resources:
  91   NovaBase:
  92     type: ./nova-base.yaml
  93     properties:
  94       ServiceData: {get_param: ServiceData}
  95       ServiceNetMap: {get_param: ServiceNetMap}
  96       DefaultPasswords: {get_param: DefaultPasswords}
  97       EndpointMap: {get_param: EndpointMap}
  98       RoleName: {get_param: RoleName}
  99       RoleParameters: {get_param: RoleParameters}
 100
 101 outputs:
 102   role_data:
 103     description: Role data for the Libvirt service.
 104     value:
 105       service_name: nova_libvirt
 106       monitoring_subscription: {get_param: MonitoringSubscriptionNovaLibvirt}
 107       config_settings:
 108         map_merge:
 109           - get_attr: [NovaBase, role_data, config_settings]
 110           # we include ::nova::compute::libvirt::services in nova/libvirt profile
 111           - nova::compute::libvirt::manage_libvirt_services: false
 112           # we manage migration in nova common puppet profile
 113             nova::compute::libvirt::migration_support: false
 114             tripleo::profile::base::nova::manage_migration: true
 115             tripleo::profile::base::nova::libvirt_enabled: true
 116             nova::compute::libvirt::services::libvirt_virt_type: {get_param: NovaComputeLibvirtType}
 117             nova::compute::libvirt::libvirt_virt_type: {get_param: NovaComputeLibvirtType}
 118             nova::compute::libvirt::libvirt_enabled_perf_events: {get_param: LibvirtEnabledPerfEvents}
 119             nova::compute::libvirt::qemu::configure_qemu: true
 120             nova::compute::libvirt::qemu::max_files: 32768
 121             nova::compute::libvirt::qemu::max_processes: 131072
 122             nova::compute::libvirt::vncserver_listen: {get_param: [ServiceNetMap, NovaLibvirtNetwork]}
 123             tripleo.nova_libvirt.firewall_rules:
 124               '200 nova_libvirt':
 125                 dport:
 126                   - 16514
 127                   - '49152-49215'
 128                   - '5900-5999'
 129
 130           -
 131             if:
 132               - use_tls_for_live_migration
 133               -
 134                 generate_service_certificates: true
 135                 tripleo::profile::base::nova::libvirt_tls: true
 136                 nova::migration::libvirt::live_migration_inbound_addr:
 137                   str_replace:
 138                     template:
 139                       "%{hiera('fqdn_$NETWORK')}"
 140                     params:
 141                       $NETWORK: {get_param: [ServiceNetMap, NovaLibvirtNetwork]}
 142                 tripleo::certmonger::ca::libvirt::origin_ca_pem:
 143                   if:
 144                     - libvirt_specific_ca_unset
 145                     - get_param: InternalTLSCAFile
 146                     - get_param: LibvirtCACert
 147                 tripleo::certmonger::libvirt_dirs::certificate_dir: '/etc/pki/libvirt'
 148                 tripleo::certmonger::libvirt_dirs::key_dir: '/etc/pki/libvirt/private'
 149                 libvirt_certificates_specs:
 150                   libvirt-server-cert:
 151                     service_certificate: '/etc/pki/libvirt/servercert.pem'
 152                     service_key: '/etc/pki/libvirt/private/serverkey.pem'
 153                     hostname:
 154                       str_replace:
 155                         template: "%{hiera('fqdn_NETWORK')}"
 156                         params:
 157                           NETWORK: {get_param: [ServiceNetMap, NovaLibvirtNetwork]}
 158                     principal:
 159                       str_replace:
 160                         template: "libvirt/%{hiera('fqdn_NETWORK')}"
 161                         params:
 162                           NETWORK: {get_param: [ServiceNetMap, NovaLibvirtNetwork]}
 163                   libvirt-client-cert:
 164                     service_certificate: '/etc/pki/libvirt/clientcert.pem'
 165                     service_key: '/etc/pki/libvirt/private/clientkey.pem'
 166                     hostname:
 167                       str_replace:
 168                         template: "%{hiera('fqdn_NETWORK')}"
 169                         params:
 170                           NETWORK: {get_param: [ServiceNetMap, NovaLibvirtNetwork]}
 171                     principal:
 172                       str_replace:
 173                         template: "libvirt/%{hiera('fqdn_NETWORK')}"
 174                         params:
 175                           NETWORK: {get_param: [ServiceNetMap, NovaLibvirtNetwork]}
 176               - {}
 177       step_config: |
 178         include tripleo::profile::base::nova::libvirt
 179       metadata_settings:
 180         if:
 181           - use_tls_for_live_migration
 182           -
 183             - service: libvirt
 184               network: {get_param: [ServiceNetMap, NovaLibvirtNetwork]}
 185               type: node
 186           - null