Make Heat service password configurable.
[apex-tripleo-heat-templates.git] / overcloud-source.yaml
index f8916ea..cf32fe5 100644 (file)
@@ -2,23 +2,54 @@ Description: Nova API,Keystone,Heat Engine and API,Glance,Neutron,Dedicated MySQ
   server,Dedicated RabbitMQ Server,Group of Nova Computes
 HeatTemplateFormatVersion: '2012-12-12'
 Parameters:
-  InstanceType:
+  AdminPassword:
+    Default: unset
+    Description: The password for the keystone admin account, used for monitoring, querying neutron etc.
+    Type: String
+  AdminToken:
+    Default: unset
+    Description: The keystone auth secret.
+    Type: String
+  CinderPassword:
+    Default: unset
+    Description: The password for the cinder service account, used by cinder-api.
+    Type: String
+  Flavor:
     Default: baremetal
     Description: Flavor to request when deploying.
     Type: String
+  GlancePassword:
+    Default: unset
+    Description: The password for the glance service account, used by the glance services.
+    Type: String
+  HeatPassword:
+    Default: unset
+    Description: The password for the Heat service account, used by the Heat services.
+    Type: String
   KeyName:
     Default: default
     Description: Name of an existing EC2 KeyPair to enable SSH access to the instances
     Type: String
+  NeutronPassword:
+    Default: unset
+    Description: The password for the neutron service account, used by neutron agents.
+    Type: String
   NovaComputeDriver:
     Default: libvirt.LibvirtDriver
     Type: String
+  NovaComputeLibvirtType:
+    Default: ''
+    Type: String
   NovaImage:
     Type: String
     Default: overcloud-compute
   NovaInterfaces:
     Default: eth0
     Type: String
+  NovaPassword:
+    Default: unset
+    Description: The password for the nova service account, used by nova-api.
+    Type: String
   PowerUserName:
     Default: stack
     Description: What username to ssh to the virtual power host with.
@@ -31,16 +62,33 @@ Resources:
     Properties:
       AllowedResources:
       - notcompute
+      - notcomputeConfig
+    Type: OS::Heat::AccessPolicy
+  ComputeAccessPolicy:
+    Properties:
+      AllowedResources:
+      - NovaCompute0
+      - NovaCompute0Config
     Type: OS::Heat::AccessPolicy
   Key:
     Properties:
       UserName:
         Ref: User
     Type: AWS::IAM::AccessKey
-  NovaCompute0:
+  ComputeKey:
+    Properties:
+      UserName:
+        Ref: ComputeUser
+    Type: AWS::IAM::AccessKey
+  ComputeUser:
+    Properties:
+      Policies:
+      - Ref: ComputeAccessPolicy
+    Type: AWS::IAM::User
+  NovaCompute0Config:
     Type: FileInclude
     Path: nova-compute-instance.yaml
-    SubKey: Resources.NovaCompute
+    SubKey: Resources.NovaCompute0Config
     Parameters:
         NovaApiHost: {"Fn::GetAtt": [notcompute, PrivateIp]}
         KeystoneHost: {"Fn::GetAtt": [notcompute, PrivateIp]}
@@ -54,13 +102,20 @@ Resources:
         NeutronNetworkVLANRanges: ""
         NeutronBridgeMappings: ""
         RabbitPassword: "guest"
-        ServicePassword: "unset"
+  NovaCompute0:
+    Type: FileInclude
+    Path: nova-compute-instance.yaml
+    SubKey: Resources.NovaCompute0
   User:
     Properties:
       Policies:
       - Ref: AccessPolicy
     Type: AWS::IAM::User
-  notcompute:
+  notcomputeConfig:
+    Type: AWS::AutoScaling::LaunchConfiguration
+    Properties:
+      ImageId: '0'
+      InstanceType: '0'
     Metadata:
       OpenStack::Heat::Stack: {}
       Openstack::ImageBuilder::Elements:
@@ -68,66 +123,130 @@ Resources:
       - heat-cfntools
       - heat-localip
       - neutron-network-node
-      admin-password: unset
-      admin-token: unset
+      admin-password:
+        Ref: AdminPassword
+      admin-token:
+        Ref: AdminToken
       cinder:
         db: mysql://cinder:unset@localhost/cinder
         volume_size_mb: '5000'
-      controller-address: 0.0.0.0
+        service-password:
+          Ref: CinderPassword
+      controller-address:
+        Fn::GetAtt:
+          - notcompute
+          - PrivateIp
       db-password: unset
       glance:
         db: mysql://glance:unset@localhost/glance
-        host: 0.0.0.0
+        host:
+          Fn::GetAtt:
+            - notcompute
+            - PrivateIp
+        service-password:
+          Ref: GlancePassword
+      os-collect-config:
+        cfn:
+          access_key_id:
+            Ref: Key
+          path: notcomputeConfig.Metadata
+          secret_access_key:
+            Fn::GetAtt:
+            - Key
+            - SecretAccessKey
+          stack_name:
+            Ref: AWS::StackName
       heat:
-        access_key_id:
-          Ref: Key
-        admin_password: unset
+        admin_password:
+          Ref: HeatPassword
         admin_tenant_name: service
         admin_user: heat
         auth_encryption_key: unset___________
         db: mysql://heat:unset@localhost/heat
-        heat_watch_server_url: http://0.0.0.0:8003
-        metadata_server_url: http://0.0.0.0:8000
-        refresh:
-        - resource: notcompute
-        secret_key:
-          Fn::GetAtt:
-          - Key
-          - SecretAccessKey
-        stack:
-          name:
-            Ref: AWS::StackName
-          region:
-            Ref: AWS::Region
-        waitcondition_server_url: http://0.0.0.0:8000/v1/waitcondition
+        heat_watch_server_url:
+          Fn::Join:
+            - ''
+            - - 'http://'
+              - Fn::GetAtt:
+                  - notcompute
+                  - PrivateIp
+              - ':8003'
+        metadata_server_url:
+          Fn::Join:
+            - ''
+            - - 'http://'
+              - Fn::GetAtt:
+                  - notcompute
+                  - PrivateIp
+              - ':8000'
+        waitcondition_server_url:
+          Fn::Join:
+            - ''
+            - - 'http://'
+              - Fn::GetAtt:
+                  - notcompute
+                  - PrivateIp
+              - ':8000/v1/waitcondition'
       interfaces:
         control: eth0
       keystone:
         db: mysql://keystone:unset@localhost/keystone
-        host: 0.0.0.0
+        host:
+          Fn::GetAtt:
+            - notcompute
+            - PrivateIp
       nova:
         compute_driver: libvirt.LibvirtDriver
         db: mysql://nova:unset@localhost/nova
-        host: 0.0.0.0
+        host:
+          Fn::GetAtt:
+            - notcompute
+            - PrivateIp
         metadata-proxy: true
+        service-password:
+          Ref: NovaPassword
       neutron:
-        host: 0.0.0.0
+        host:
+          Fn::GetAtt:
+            - notcompute
+            - PrivateIp
         metadata_proxy_shared_secret: unset
         ovs:
           enable_tunneling: 'True'
-          local_ip: 0.0.0.0
+          local_ip:
+            Fn::GetAtt:
+              - notcompute
+              - PrivateIp
           public_interface: eth0
+          physical_bridge: br-ex
           tenant_network_type: gre
         ovs_db: mysql://neutron:unset@localhost/ovs_neutron?charset=utf8
+        service-password:
+          Ref: NeutronPassword
       rabbit:
-        host: 0.0.0.0
+        host:
+          Fn::GetAtt:
+            - notcompute
+            - PrivateIp
         password: guest
-      service-password: unset
+  notcompute:
+    Type: OS::Nova::Server
     Properties:
-      ImageId:
+      image:
         Ref: notcomputeImage
-      InstanceType:
-        Ref: InstanceType
-      KeyName:
+      flavor:
+        Ref: Flavor
+      key_name:
         Ref: KeyName
-    Type: AWS::EC2::Instance
+    Metadata:
+      os-collect-config:
+        cfn:
+          access_key_id:
+            Ref: Key
+          path: notcomputeConfig.Metadata
+          secret_access_key:
+            Fn::GetAtt:
+            - Key
+            - SecretAccessKey
+          stack_name:
+            Ref: AWS::StackName