puppet/services/swift-proxy.yaml

   1 heat_template_version: ocata
   2
   3 description: >
   4   OpenStack Swift Proxy service configured with Puppet
   5
   6 parameters:
   7   ServiceNetMap:
   8     default: {}
   9     description: Mapping of service_name -> network name. Typically set
  10                  via parameter_defaults in the resource registry.  This
  11                  mapping overrides those in ServiceNetMapDefaults.
  12     type: json
  13   DefaultPasswords:
  14     default: {}
  15     type: json
  16   EndpointMap:
  17     default: {}
  18     description: Mapping of service endpoint -> protocol. Typically set
  19                  via parameter_defaults in the resource registry.
  20     type: json
  21   Debug:
  22     default: ''
  23     description: Set to True to enable debugging on all services.
  24     type: string
  25   SwiftPassword:
  26     description: The password for the swift service account, used by the swift proxy services.
  27     type: string
  28     hidden: true
  29   SwiftProxyNodeTimeout:
  30     default: 60
  31     description: Timeout for requests going from swift-proxy to swift a/c/o services.
  32     type: number
  33   SwiftWorkers:
  34     default: auto
  35     description: Number of workers for Swift service.
  36     type: string
  37   KeystoneRegion:
  38     type: string
  39     default: 'regionOne'
  40     description: Keystone region for endpoint
  41   MonitoringSubscriptionSwiftProxy:
  42     default: 'overcloud-swift-proxy'
  43     type: string
  44   RabbitPassword:
  45     description: The password for RabbitMQ
  46     type: string
  47     hidden: true
  48   RabbitUserName:
  49     default: guest
  50     description: The username for RabbitMQ
  51     type: string
  52   SwiftCeilometerPipelineEnabled:
  53     description: Set to False to disable the swift proxy ceilometer pipeline.
  54     default: True
  55     type: boolean
  56   RabbitClientPort:
  57     default: 5672
  58     description: Set rabbit subscriber port, change this if using SSL
  59     type: number
  60   RabbitClientUseSSL:
  61     default: false
  62     description: >
  63         Rabbit client subscriber parameter to specify
  64         an SSL connection to the RabbitMQ host.
  65     type: string
  66   EnableInternalTLS:
  67     type: boolean
  68     default: false
  69
  70 conditions:
  71
  72   ceilometer_pipeline_enabled: {equals : [{get_param: SwiftCeilometerPipelineEnabled}, True]}
  73   use_tls_proxy: {equals : [{get_param: EnableInternalTLS}, true]}
  74
  75 resources:
  76   SwiftBase:
  77     type: ./swift-base.yaml
  78     properties:
  79       ServiceNetMap: {get_param: ServiceNetMap}
  80       DefaultPasswords: {get_param: DefaultPasswords}
  81       EndpointMap: {get_param: EndpointMap}
  82
  83   TLSProxyBase:
  84     type: OS::TripleO::Services::TLSProxyBase
  85     properties:
  86       ServiceNetMap: {get_param: ServiceNetMap}
  87       DefaultPasswords: {get_param: DefaultPasswords}
  88       EndpointMap: {get_param: EndpointMap}
  89       EnableInternalTLS: {get_param: EnableInternalTLS}
  90
  91 outputs:
  92   role_data:
  93     description: Role data for the Swift proxy service.
  94     value:
  95       service_name: swift_proxy
  96       monitoring_subscription: {get_param: MonitoringSubscriptionSwiftProxy}
  97       config_settings:
  98         map_merge:
  99           - get_attr: [SwiftBase, role_data, config_settings]
 100           - get_attr: [TLSProxyBase, role_data, config_settings]
 101           - swift::proxy::authtoken::auth_uri: {get_param: [EndpointMap, KeystoneInternal, uri]}
 102             swift::proxy::authtoken::auth_url: {get_param: [EndpointMap, KeystoneInternal, uri_no_suffix]}
 103             swift::proxy::authtoken::password: {get_param: SwiftPassword}
 104             swift::proxy::authtoken::project_name: 'service'
 105             swift::proxy::node_timeout: {get_param: SwiftProxyNodeTimeout}
 106             swift::proxy::workers: {get_param: SwiftWorkers}
 107             swift::proxy::ceilometer::rabbit_user: {get_param: RabbitUserName}
 108             swift::proxy::ceilometer::rabbit_password: {get_param: RabbitPassword}
 109             swift::proxy::staticweb::url_base: {get_param: [EndpointMap, SwiftPublic, uri_no_suffix]}
 110             swift::proxy::ceilometer::nonblocking_notify: true
 111             tripleo::profile::base::swift::proxy::rabbit_port: {get_param: RabbitClientPort}
 112             tripleo::profile::base::swift::proxy::ceilometer_messaging_use_ssl: {get_param: RabbitClientUseSSL}
 113             tripleo::profile::base::swift::proxy::ceilometer_enabled: {get_param: SwiftCeilometerPipelineEnabled}
 114             tripleo.swift_proxy.firewall_rules:
 115               '122 swift proxy':
 116                 dport:
 117                   - 8080
 118                   - 13808
 119             swift::proxy::keystone::operator_roles:
 120               - admin
 121               - swiftoperator
 122               - ResellerAdmin
 123             swift::proxy::versioned_writes::allow_versioned_writes: true
 124             swift::proxy::pipeline:
 125               yaql:
 126                 expression: $.data.pipeline.where($ != '')
 127                 data:
 128                   pipeline:
 129                   - 'catch_errors'
 130                   - 'healthcheck'
 131                   - 'proxy-logging'
 132                   - 'cache'
 133                   - 'ratelimit'
 134                   - 'bulk'
 135                   - 'tempurl'
 136                   - 'formpost'
 137                   - 'authtoken'
 138                   - 'keystone'
 139                   - 'staticweb'
 140                   - 'copy'
 141                   - 'container_quotas'
 142                   - 'account_quotas'
 143                   - 'slo'
 144                   - 'dlo'
 145                   - 'versioned_writes'
 146                   -
 147                     if:
 148                     - ceilometer_pipeline_enabled
 149                     - 'ceilometer'
 150                     - ''
 151                   - 'proxy-logging'
 152                   - 'proxy-server'
 153             swift::proxy::ceilometer::rabbit_use_ssl: {get_param: RabbitClientUseSSL}
 154             swift::proxy::account_autocreate: true
 155             # NOTE: bind IP is found in Heat replacing the network name with the
 156             # local node IP for the given network; replacement examples
 157             # (eg. for internal_api):
 158             # internal_api -> IP
 159             # internal_api_uri -> [IP]
 160             # internal_api_subnet - > IP/CIDR
 161             tripleo::profile::base::swift::proxy::tls_proxy_bind_ip:
 162               get_param: [ServiceNetMap, SwiftProxyNetwork]
 163             tripleo::profile::base::swift::proxy::tls_proxy_fqdn:
 164               str_replace:
 165                 template:
 166                   "%{hiera('fqdn_$NETWORK')}"
 167                 params:
 168                   $NETWORK: {get_param: [ServiceNetMap, SwiftProxyNetwork]}
 169             tripleo::profile::base::swift::proxy::tls_proxy_port:
 170               get_param: [EndpointMap, SwiftInternal, port]
 171             swift::proxy::port: {get_param: [EndpointMap, SwiftInternal, port]}
 172             swift::proxy::proxy_local_net_ip:
 173               if:
 174               - use_tls_proxy
 175               - 'localhost'
 176               - {get_param: [ServiceNetMap, SwiftProxyNetwork]}
 177       step_config: |
 178         include ::tripleo::profile::base::swift::proxy
 179       service_config_settings:
 180         keystone:
 181           swift::keystone::auth::public_url: {get_param: [EndpointMap, SwiftPublic, uri]}
 182           swift::keystone::auth::internal_url: {get_param: [EndpointMap, SwiftInternal, uri]}
 183           swift::keystone::auth::admin_url: {get_param: [EndpointMap, SwiftAdmin, uri]}
 184           swift::keystone::auth::public_url_s3: {get_param: [EndpointMap, SwiftS3Public, uri]}
 185           swift::keystone::auth::internal_url_s3: {get_param: [EndpointMap, SwiftS3Internal, uri]}
 186           swift::keystone::auth::admin_url_s3: {get_param: [EndpointMap, SwiftS3Admin, uri]}
 187           swift::keystone::auth::password: {get_param: SwiftPassword}
 188           swift::keystone::auth::region: {get_param: KeystoneRegion}
 189           swift::keystone::auth::tenant: 'service'
 190           swift::keystone::auth::configure_s3_endpoint: false
 191           swift::keystone::auth::operator_roles:
 192             - admin
 193             - swiftoperator
 194             - ResellerAdmin
 195       upgrade_tasks:
 196         - name: Stop swift_proxy service
 197           tags: step1
 198           service: name=openstack-swift-proxy state=stopped
 199       metadata_settings:
 200         get_attr: [TLSProxyBase, role_data, metadata_settings]