Merge "Add support for isolating block storage nets"
[apex-tripleo-heat-templates.git] / puppet / controller-puppet.yaml
index e9a7d48..3d7ecd5 100644 (file)
@@ -11,7 +11,7 @@ parameters:
     hidden: true
   AdminToken:
     default: unset
-    description: The keystone auth secret.
+    description: The keystone auth secret and db password.
     type: string
     hidden: true
   CeilometerBackend:
@@ -25,7 +25,7 @@ parameters:
     hidden: true
   CeilometerPassword:
     default: unset
-    description: The password for the ceilometer service account.
+    description: The password for the ceilometer service  and db account.
     type: string
     hidden: true
   CinderEnableIscsiBackend:
@@ -46,9 +46,14 @@ parameters:
     type: number
   CinderPassword:
     default: unset
-    description: The password for the cinder service account, used by cinder-api.
+    description: The password for the cinder service and db account, used by cinder-api.
     type: string
     hidden: true
+  CinderBackendConfig:
+    default: {}
+    description: Contains parameters to configure Cinder backends. Typically
+                 set via parameter_defaults in the resource registry.
+    type: json
   CloudName:
     default: ''
     description: The DNS name of this cloud. E.g. ci-overcloud.tripleo.org
@@ -71,11 +76,6 @@ parameters:
     default: true
     description: Whether to use Galera instead of regular MariaDB.
     type: boolean
-  EnablePacemaker:
-    default: false
-    description: If enabled services will be monitored by Pacemaker; it
-      will manage VIPs as well, in place of Keepalived.
-    type: boolean
   EnableCephStorage:
     default: false
     description: Whether to deploy Ceph Storage (OSD) on the Controller
@@ -137,7 +137,7 @@ parameters:
     default: ''
   GlancePassword:
     default: unset
-    description: The password for the glance service account, used by the glance services.
+    description: The password for the glance service and db account, used by the glance services.
     type: string
     hidden: true
   GlancePort:
@@ -157,7 +157,7 @@ parameters:
     - allowed_values: ['swift', 'file', 'rbd']
   HeatPassword:
     default: unset
-    description: The password for the Heat service account, used by the Heat services.
+    description: The password for the Heat service and db account, used by the Heat services.
     type: string
     hidden: true
   HeatStackDomainAdminPassword:
@@ -244,7 +244,7 @@ parameters:
     default: 'dvr_snat'
     description: Agent mode for the neutron-l3-agent on the controller hosts
     type: string
-  NeutronL3HA: #FIXME this isn't wired in
+  NeutronL3HA:
     default: 'False'
     description: Whether to enable l3-agent HA
     type: string
@@ -287,10 +287,10 @@ parameters:
       The Neutron ML2 and OpenVSwitch vlan mapping range to support. See the
       Neutron documentation for permitted values. Defaults to permitting any
       VLAN on the 'datacentre' physical network (See NeutronBridgeMappings).
-    type: string
+    type: comma_delimited_list
   NeutronPassword:
     default: unset
-    description: The password for the neutron service account, used by neutron agents.
+    description: The password for the neutron service and db account, used by neutron agents.
     type: string
     hidden: true
   NeutronPublicInterface:
@@ -327,7 +327,7 @@ parameters:
     type: string
   NovaPassword:
     default: unset
-    description: The password for the nova service account, used by nova-api.
+    description: The password for the nova service and db account, used by nova-api.
     type: string
     hidden: true
   NtpServer:
@@ -342,7 +342,7 @@ parameters:
         Specifies the interface where the public-facing virtual ip will be assigned.
         This should be int_public when a VLAN is being used.
     type: string
-  PublicVirtualIP:
+  PublicVirtualIP: # DEPRECATED: use per service settings instead
     type: string
     default: ''  # Has to be here because of the ignored empty value bug
   RabbitCookie:
@@ -368,6 +368,9 @@ parameters:
     default: 5672
     description: Set rabbit subscriber port, change this if using SSL
     type: number
+  RedisVirtualIP:
+    type: string
+    default: ''  # Has to be here because of the ignored empty value bug
   SnmpdReadonlyUserName:
     default: ro_snmp_user
     description: The user name for SNMPd with readonly rights running on all Overcloud nodes
@@ -419,9 +422,24 @@ parameters:
     type: number
     default: 3
     description: How many replicas to use in the swift rings.
-  VirtualIP:
+  VirtualIP: # DEPRECATED: use per service settings instead
     type: string
     default: ''  # Has to be here because of the ignored empty value bug
+  HeatApiVirtualIP:
+    type: string
+    default: ''
+  GlanceApiVirtualIP:
+    type: string
+    default: ''
+  MysqlVirtualIP:
+    type: string
+    default: ''
+  KeystonePublicApiVirtualIP:
+    type: string
+    default: ''
+  NeutronApiVirtualIP:
+    type: string
+    default: ''
   EnablePackageInstall:
     default: 'false'
     description: Set to true to enable package installation via Puppet
@@ -431,6 +449,15 @@ parameters:
     description: Mapping of service_name -> network name. Typically set
                  via parameter_defaults in the resource registry.
     type: json
+  UpdateIdentifier:
+    default: ''
+    type: string
+    description: >
+      Setting to a previously unused value during stack-update will trigger
+      package update on all nodes
+  Hostname:
+    type: string
+    default: '' # Defaults to Heat created hostname
 
 resources:
 
@@ -445,6 +472,7 @@ resources:
         - network: ctlplane
       user_data_format: SOFTWARE_CONFIG
       user_data: {get_resource: NodeUserData}
+      name: {get_param: Hostname}
 
   NodeUserData:
     type: OS::TripleO::NodeUserData
@@ -483,6 +511,15 @@ resources:
       StorageMgmtIp: {get_attr: [StorageMgmtPort, ip_address]}
       TenantIp: {get_attr: [TenantPort, ip_address]}
 
+  NetIpSubnetMap:
+    type: OS::TripleO::Network::Ports::NetIpMap
+    properties:
+      ExternalIp: {get_attr: [ExternalPort, ip_subnet]}
+      InternalApiIp: {get_attr: [InternalApiPort, ip_subnet]}
+      StorageIp: {get_attr: [StoragePort, ip_subnet]}
+      StorageMgmtIp: {get_attr: [StorageMgmtPort, ip_subnet]}
+      TenantIp: {get_attr: [TenantPort, ip_subnet]}
+
   NetworkConfig:
     type: OS::TripleO::Controller::Net::SoftwareConfig
     properties:
@@ -495,7 +532,6 @@ resources:
   NetworkDeployment:
     type: OS::TripleO::SoftwareDeployment
     properties:
-      signal_transport: NO_SIGNAL
       config: {get_resource: NetworkConfig}
       server: {get_resource: Controller}
       input_values:
@@ -504,32 +540,30 @@ resources:
 
   ControllerDeployment:
     type: OS::TripleO::SoftwareDeployment
+    depends_on: NetworkDeployment
     properties:
-      signal_transport: NO_SIGNAL
       config: {get_resource: ControllerConfig}
       server: {get_resource: Controller}
       input_values:
         bootstack_nodeid: {get_attr: [Controller, name]}
-        controller_host: {get_attr: [Controller, networks, ctlplane, 0]}
-        controller_virtual_ip: {get_param: VirtualIP}
         neutron_enable_tunneling: {get_param: NeutronEnableTunnelling}
         heat.watch_server_url:
           list_join:
             - ''
             - - 'http://'
-              - {get_param: VirtualIP}
+              - {get_param: HeatApiVirtualIP}
               - ':8003'
         heat.metadata_server_url:
           list_join:
             - ''
             - - 'http://'
-              - {get_param: VirtualIP}
+              - {get_param: HeatApiVirtualIP}
               - ':8000'
         heat.waitcondition_server_url:
           list_join:
             - ''
             - - 'http://'
-              - {get_param: VirtualIP}
+              - {get_param: HeatApiVirtualIP}
               - ':8000/v1/waitcondition'
         heat_auth_encryption_key: {get_param: HeatAuthEncryptionKey}
         horizon_secret: {get_param: HorizonSecret}
@@ -542,33 +576,39 @@ resources:
         cinder_password: {get_param: CinderPassword}
         cinder_enable_iscsi_backend: {get_param: CinderEnableIscsiBackend}
         cinder_iscsi_helper: {get_param: CinderISCSIHelper}
+        cinder_backend_config: {get_param: CinderBackendConfig}
         cinder_dsn:
           list_join:
             - ''
-            - - 'mysql://cinder:unset@'
-              - {get_param: VirtualIP}
+            - - 'mysql://cinder:'
+              - {get_param: CinderPassword}
+              - '@'
+              - {get_param: MysqlVirtualIP}
               - '/cinder'
         glance_port: {get_param: GlancePort}
-        glance_protocol: {get_param: GlanceProtocol}
         glance_password: {get_param: GlancePassword}
         glance_backend: {get_param: GlanceBackend}
-        glance_swift_store_auth_address: {list_join: ['', ['http://', {get_param: VirtualIP} , ':5000/v2.0']]}
         glance_notifier_strategy: {get_param: GlanceNotifierStrategy}
         glance_log_file: {get_param: GlanceLogFile}
         glance_dsn:
           list_join:
             - ''
-            - - 'mysql://glance:unset@'
-              - {get_param: VirtualIP}
+            - - 'mysql://glance:'
+              - {get_param: GlancePassword}
+              - '@'
+              - {get_param: MysqlVirtualIP}
               - '/glance'
         heat_password: {get_param: HeatPassword}
         heat_stack_domain_admin_password: {get_param: HeatStackDomainAdminPassword}
         heat_dsn:
           list_join:
             - ''
-            - - 'mysql://heat:unset@'
-              - {get_param: VirtualIP}
+            - - 'mysql://heat:'
+              - {get_param: HeatPassword}
+              - '@'
+              - {get_param: MysqlVirtualIP}
               - '/heat'
+        keystone_auth_address: {list_join: ['', ['http://', {get_param: KeystonePublicApiVirtualIP} , ':5000/v2.0']]}
         keystone_ca_certificate: {get_param: KeystoneCACertificate}
         keystone_signing_key: {get_param: KeystoneSigningKey}
         keystone_signing_certificate: {get_param: KeystoneSigningCertificate}
@@ -577,20 +617,22 @@ resources:
         keystone_dsn:
           list_join:
             - ''
-            - - 'mysql://keystone:unset@'
-              - {get_param: VirtualIP}
+            - - 'mysql://keystone:'
+              - {get_param: AdminToken}
+              - '@'
+              - {get_param: MysqlVirtualIP}
               - '/keystone'
         keystone_identity_uri:
           list_join:
             - ''
             - - 'http://'
-              - {get_param: VirtualIP}
+              - {get_param: KeystonePublicApiVirtualIP}
               - ':35357/'
         keystone_auth_uri:
           list_join:
             - ''
             - - 'http://'
-              - {get_param: VirtualIP}
+              - {get_param: KeystonePublicApiVirtualIP}
               - ':5000/v2.0/'
         enable_galera: {get_param: EnableGalera}
         enable_ceph_storage: {get_param: EnableCephStorage}
@@ -609,7 +651,14 @@ resources:
         neutron_mechanism_drivers: {get_param: NeutronMechanismDrivers}
         neutron_allow_l3agent_failover: {get_param: NeutronAllowL3AgentFailover}
         neutron_l3_ha: {get_param: NeutronL3HA}
-        neutron_network_vlan_ranges: {get_param: NeutronNetworkVLANRanges}
+        neutron_network_vlan_ranges:
+          str_replace:
+            template: "['RANGES']"
+            params:
+              RANGES:
+                list_join:
+                - "','"
+                - {get_param: NeutronNetworkVLANRanges}
         neutron_bridge_mappings: {get_param: NeutronBridgeMappings}
         neutron_public_interface: {get_param: NeutronPublicInterface}
         neutron_public_interface_raw_device: {get_param: NeutronPublicInterfaceRawDevice}
@@ -622,29 +671,37 @@ resources:
         neutron_dsn:
           list_join:
             - ''
-            - - 'mysql://neutron:unset@'
-              - {get_param: VirtualIP}
+            - - 'mysql://neutron:'
+              - {get_param: NeutronPassword}
+              - '@'
+              - {get_param: MysqlVirtualIP}
               - '/ovs_neutron?charset=utf8'
         neutron_url:
           list_join:
             - ''
             - - 'http://'
-              - {get_param: VirtualIP}
+              - {get_param: NeutronApiVirtualIP}
               - ':9696'
         neutron_admin_auth_url:
           list_join:
             - ''
             - - 'http://'
-              - {get_param: VirtualIP}
+              - {get_param: KeystonePublicApiVirtualIP}
               - ':35357/v2.0'
         ceilometer_backend: {get_param: CeilometerBackend}
         ceilometer_metering_secret: {get_param: CeilometerMeteringSecret}
         ceilometer_password: {get_param: CeilometerPassword}
+        ceilometer_coordination_url:
+          list_join:
+            - ''
+            - - 'redis://'
+              - {get_param: RedisVirtualIP}
+              - ':6379'
         ceilometer_dsn:
           list_join:
             - ''
             - - 'mysql://ceilometer:unset@'
-              - {get_param: VirtualIP}
+              - {get_param: MysqlVirtualIP}
               - '/ceilometer'
         snmpd_readonly_user_name: {get_param: SnmpdReadonlyUserName}
         snmpd_readonly_user_password: {get_param: SnmpdReadonlyUserPassword}
@@ -652,8 +709,10 @@ resources:
         nova_dsn:
           list_join:
             - ''
-            - - 'mysql://nova:unset@'
-              - {get_param: VirtualIP}
+            - - 'mysql://nova:'
+              - {get_param: NovaPassword}
+              - '@'
+              - {get_param: MysqlVirtualIP}
               - '/nova'
         pcsd_password: {get_param: PcsdPassword}
         rabbit_username: {get_param: RabbitUserName}
@@ -668,7 +727,6 @@ resources:
               server: {get_param: NtpServer}
         control_virtual_interface: {get_param: ControlVirtualInterface}
         public_virtual_interface: {get_param: PublicVirtualInterface}
-        public_virtual_ip: {get_param: PublicVirtualIP}
         swift_hash_suffix: {get_param: SwiftHashSuffix}
         swift_password: {get_param: SwiftPassword}
         swift_part_power: {get_param: SwiftPartPower}
@@ -676,6 +734,38 @@ resources:
         swift_min_part_hours: {get_param: SwiftMinPartHours}
         swift_mount_check: {get_param: SwiftMountCheck}
         enable_package_install: {get_param: EnablePackageInstall}
+        swift_proxy_network: {get_attr: [NetIpMap, net_ip_map, {get_param: [ServiceNetMap, SwiftProxyNetwork]}]}
+        swift_management_network: {get_attr: [NetIpMap, net_ip_map, {get_param: [ServiceNetMap, SwiftMgmtNetwork]}]}
+        cinder_iscsi_network: {get_attr: [NetIpMap, net_ip_map, {get_param: [ServiceNetMap, CinderIscsiNetwork]}]}
+        cinder_api_network: {get_attr: [NetIpMap, net_ip_map, {get_param: [ServiceNetMap, CinderApiNetwork]}]}
+        glance_api_network: {get_attr: [NetIpMap, net_ip_map, {get_param: [ServiceNetMap, GlanceApiNetwork]}]}
+        glance_registry_network: {get_attr: [NetIpMap, net_ip_map, {get_param: [ServiceNetMap, GlanceRegistryNetwork]}]}
+        glance_api_servers:
+          list_join:
+            - ''
+            - - {get_param: GlanceProtocol}
+              - '://'
+              - {get_param: GlanceApiVirtualIP}
+              - ':'
+              - {get_param: GlancePort}
+        heat_api_network: {get_attr: [NetIpMap, net_ip_map, {get_param: [ServiceNetMap, HeatApiNetwork]}]}
+        keystone_public_api_network: {get_attr: [NetIpMap, net_ip_map, {get_param: [ServiceNetMap, KeystonePublicApiNetwork]}]}
+        keystone_admin_api_network: {get_attr: [NetIpMap, net_ip_map, {get_param: [ServiceNetMap, KeystoneAdminApiNetwork]}]}
+        mongo_db_network: {get_attr: [NetIpMap, net_ip_map, {get_param: [ServiceNetMap, MongoDbNetwork]}]}
+        neutron_api_network: {get_attr: [NetIpMap, net_ip_map, {get_param: [ServiceNetMap, NeutronApiNetwork]}]}
+        neutron_local_ip: {get_attr: [NetIpMap, net_ip_map, {get_param: [ServiceNetMap, NeutronTenantNetwork]}]}
+        ceilometer_api_network: {get_attr: [NetIpMap, net_ip_map, {get_param: [ServiceNetMap, CeilometerApiNetwork]}]}
+        nova_api_network: {get_attr: [NetIpMap, net_ip_map, {get_param: [ServiceNetMap, NovaApiNetwork]}]}
+        nova_metadata_network: {get_attr: [NetIpMap, net_ip_map, {get_param: [ServiceNetMap, NovaMetadataNetwork]}]}
+        horizon_network: {get_attr: [NetIpMap, net_ip_map, {get_param: [ServiceNetMap, HorizonNetwork]}]}
+        rabbitmq_network: {get_attr: [NetIpMap, net_ip_map, {get_param: [ServiceNetMap, RabbitMqNetwork]}]}
+        redis_network: {get_attr: [NetIpMap, net_ip_map, {get_param: [ServiceNetMap, RedisNetwork]}]}
+        redis_vip: {get_param: RedisVirtualIP}
+        memcached_network: {get_attr: [NetIpMap, net_ip_map, {get_param: [ServiceNetMap, MemcachedNetwork]}]}
+        mysql_network: {get_attr: [NetIpMap, net_ip_map, {get_param: [ServiceNetMap, MysqlNetwork]}]}
+        ceph_cluster_network: {get_attr: [NetIpSubnetMap, net_ip_map, {get_param: [ServiceNetMap, CephClusterNetwork]}]}
+        ceph_public_network: {get_attr: [NetIpSubnetMap, net_ip_map, {get_param: [ServiceNetMap, CephPublicNetwork]}]}
+        ceph_public_ip: {get_attr: [NetIpMap, net_ip_map, {get_param: [ServiceNetMap, CephPublicNetwork]}]}
 
   # Map heat metadata into hiera datafiles
   ControllerConfig:
@@ -693,6 +783,7 @@ resources:
             - ceph
             - bootstrap_node # provided by BootstrapNodeConfig
             - all_nodes # provided by allNodesConfig
+            - vip_data # provided by vip-config
             - '"%{::osfamily}"'
             - common
           datafiles:
@@ -700,22 +791,25 @@ resources:
               raw_data: {get_file: hieradata/common.yaml}
             ceph:
               raw_data: {get_file: hieradata/ceph.yaml}
+              mapped_data:
+                ceph::profile::params::cluster_network: {get_input: ceph_cluster_network}
+                ceph::profile::params::public_network: {get_input: ceph_public_network}
+                ceph::mon::public_addr: {get_input: ceph_public_ip}
             object:
               raw_data: {get_file: hieradata/object.yaml}
             controller:
               raw_data: {get_file: hieradata/controller.yaml}
               mapped_data: # data supplied directly to this deployment configuration, etc
                 bootstack_nodeid: {get_input: bootstack_nodeid}
-                controller_host: {get_input: controller_host} #local-ipv4
 
                 # Pacemaker
                 hacluster_pwd: {get_input: pcsd_password}
 
                 # Swift
-                swift::proxy::proxy_local_net_ip: {get_input: controller_host}
+                swift::proxy::proxy_local_net_ip: {get_input: swift_proxy_network}
                 swift::proxy::authtoken::auth_uri: {get_input: keystone_auth_uri}
                 swift::proxy::authtoken::identity_uri: {get_input: keystone_identity_uri}
-                swift::storage::all::storage_local_net_ip: {get_input: controller_host}
+                swift::storage::all::storage_local_net_ip: {get_input: swift_management_network}
                 swift::swift_hash_suffix: {get_input: swift_hash_suffix}
                 swift::proxy::authtoken::admin_password: {get_input: swift_password}
                 tripleo::ringbuilder::part_power: {get_input: swift_part_power}
@@ -731,30 +825,29 @@ resources:
                 cinder_enable_rbd_backend: {get_input: cinder_enable_rbd_backend}
                 cinder_lvm_loop_device_size: {get_input: cinder_lvm_loop_device_size}
                 cinder_iscsi_helper: {get_input: cinder_iscsi_helper}
-                cinder_iscsi_ip_address: {get_attr: [NetIpMap, net_ip_map, {get_param: [ServiceNetMap, CinderIscsiNetwork]}]}
+                cinder_iscsi_ip_address: {get_input: cinder_iscsi_network}
                 cinder::database_connection: {get_input: cinder_dsn}
                 cinder::api::keystone_password: {get_input: cinder_password}
                 cinder::api::auth_uri: {get_input: keystone_auth_uri}
                 cinder::api::identity_uri: {get_input: keystone_identity_uri}
-                cinder::api::bind_host: {get_attr: [NetIpMap, net_ip_map, {get_param: [ServiceNetMap, CinderApiNetwork]}]}
+                cinder::api::bind_host: {get_input: cinder_api_network}
                 cinder::rabbit_userid: {get_input: rabbit_username}
                 cinder::rabbit_password: {get_input: rabbit_password}
                 cinder::rabbit_use_ssl: {get_input: rabbit_client_use_ssl}
                 cinder::rabbit_port: {get_input: rabbit_client_port}
                 cinder::debug: {get_input: debug}
                 cinder_enable_iscsi_backend: {get_input: cinder_enable_iscsi_backend}
+                cinder::glance::glance_api_servers: {get_input: glance_api_servers}
+                cinder_backend_config: {get_input: CinderBackendConfig}
 
                 # Glance
                 glance::api::bind_port: {get_input: glance_port}
-                glance::api::bind_host: {get_attr: [NetIpMap, net_ip_map, {get_param: [ServiceNetMap, GlanceApiNetwork]}]}
+                glance::api::bind_host: {get_input: glance_api_network}
                 glance::api::auth_uri: {get_input: keystone_auth_uri}
                 glance::api::identity_uri: {get_input: keystone_identity_uri}
-                glance::api::registry_host: {get_attr: [NetIpMap, net_ip_map, {get_param: [ServiceNetMap, GlanceRegistryNetwork]}]}
+                glance::api::registry_host: {get_input: glance_registry_network}
                 glance::api::keystone_password: {get_input: glance_password}
                 glance::api::debug: {get_input: debug}
-                # used to construct glance_api_servers
-                glance_port: {get_input: glance_port}
-                glance_protocol: {get_input: glance_protocol}
                 glance_notifier_strategy: {get_input: glance_notifier_strategy}
                 glance_log_file: {get_input: glance_log_file}
                 glance_log_file: {get_input: glance_log_file}
@@ -765,7 +858,7 @@ resources:
                 glance::registry::auth_uri: {get_input: keystone_auth_uri}
                 glance::registry::identity_uri: {get_input: keystone_identity_uri}
                 glance::registry::debug: {get_input: debug}
-                glance::backend::swift::swift_store_auth_address: {get_input: glance_swift_store_auth_address}
+                glance::backend::swift::swift_store_auth_address: {get_input: keystone_auth_address}
                 glance::backend::swift::swift_store_user: service:glance
                 glance::backend::swift::swift_store_key: {get_input: glance_password}
                 glance_backend: {get_input: glance_backend}
@@ -783,9 +876,9 @@ resources:
                 heat::auth_uri: {get_input: keystone_auth_uri}
                 heat::identity_uri: {get_input: keystone_identity_uri}
                 heat::keystone_password: {get_input: heat_password}
-                heat::api::bind_host: {get_input: controller_host}
-                heat::api_cloudwatch::bind_host: {get_input: controller_host}
-                heat::api_cfn::bind_host: {get_input: controller_host}
+                heat::api::bind_host: {get_input: heat_api_network}
+                heat::api_cloudwatch::bind_host: {get_input: heat_api_network}
+                heat::api_cfn::bind_host: {get_input: heat_api_network}
                 heat::database_connection: {get_input: heat_dsn}
                 heat::instance_user: heat-admin
                 heat::debug: {get_input: debug}
@@ -798,11 +891,11 @@ resources:
                 keystone_ssl_certificate: {get_input: keystone_ssl_certificate}
                 keystone_ssl_certificate_key: {get_input: keystone_ssl_certificate_key}
                 keystone::database_connection: {get_input: keystone_dsn}
-                keystone::public_bind_host: {get_attr: [NetIpMap, net_ip_map, {get_param: [ServiceNetMap, KeystonePublicApiNetwork]}]}
-                keystone::admin_bind_host: {get_attr: [NetIpMap, net_ip_map, {get_param: [ServiceNetMap, KeystoneAdminApiNetwork]}]}
+                keystone::public_bind_host: {get_input: keystone_public_api_network}
+                keystone::admin_bind_host: {get_input: keystone_admin_api_network}
                 keystone::debug: {get_input: debug}
                 # MongoDB
-                mongodb::server::bind_ip: {get_attr: [NetIpMap, net_ip_map, {get_param: [ServiceNetMap, MongoDbNetwork]}]}
+                mongodb::server::bind_ip: {get_input: mongo_db_network}
                 # MySQL
                 admin_password: {get_input: admin_password}
                 enable_galera: {get_input: enable_galera}
@@ -811,9 +904,10 @@ resources:
                 mysql_innodb_buffer_pool_size: {get_input: mysql_innodb_buffer_pool_size}
                 mysql::server::root_password: {get_input: mysql_root_password}
                 mysql_cluster_name: {get_input: mysql_cluster_name}
+                mysql_bind_host: {get_input: mysql_network}
 
                 # Neutron
-                neutron::bind_host: {get_attr: [NetIpMap, net_ip_map, {get_param: [ServiceNetMap, NeutronApiNetwork]}]}
+                neutron::bind_host: {get_input: neutron_api_network}
                 neutron::rabbit_password: {get_input: rabbit_password}
                 neutron::rabbit_user: {get_input: rabbit_user}
                 neutron::rabbit_use_ssl: {get_input: rabbit_client_use_ssl}
@@ -823,14 +917,14 @@ resources:
                 neutron::server::identity_uri: {get_input: keystone_identity_uri}
                 neutron::server::database_connection: {get_input: neutron_dsn}
                 neutron::agents::ml2::ovs::enable_tunneling: {get_input: neutron_enable_tunneling}
-                neutron::agents::ml2::ovs::local_ip: {get_attr: [NetIpMap, net_ip_map, {get_param: [ServiceNetMap, NeutronLocalIp]}]}
+                neutron::agents::ml2::ovs::local_ip: {get_input: neutron_local_ip}
                 neutron_flat_networks: {get_input: neutron_flat_networks}
                 neutron::agents::metadata::shared_secret: {get_input: neutron_metadata_proxy_shared_secret}
-                neutron::agents::metadata::metadata_ip: {get_input: controller_virtual_ip}
+                neutron::agents::metadata::metadata_ip: {get_input: neutron_api_network}
                 neutron_agent_mode: {get_input: neutron_agent_mode}
                 neutron_router_distributed: {get_input: neutron_router_distributed}
                 neutron_mechanism_drivers: {get_input: neutron_mechanism_drivers}
-                neutron_allow_l3agent_failover: {get_input: neutron_allow_l3agent_failover}
+                neutron::server::allow_automatic_l3agent_failover: {get_input: neutron_allow_l3agent_failover}
                 neutron::server::l3_ha: {get_input: neutron_l3_ha}
                 neutron::plugins::ml2::network_vlan_ranges: {get_input: neutron_network_vlan_ranges}
                 neutron_bridge_mappings: {get_input: neutron_bridge_mappings}
@@ -844,6 +938,7 @@ resources:
                 neutron::agents::metadata::auth_password: {get_input: neutron_password}
                 neutron_dnsmasq_options: {get_input: neutron_dnsmasq_options}
                 neutron_dsn: {get_input: neutron_dsn}
+                neutron::agents::metadata::auth_url: {get_input: keystone_identity_uri}
 
                 # Ceilometer
                 ceilometer_backend: {get_input: ceilometer_backend}
@@ -854,11 +949,13 @@ resources:
                 ceilometer::rabbit_use_ssl: {get_input: rabbit_client_use_ssl}
                 ceilometer::rabbit_port: {get_input: rabbit_client_port}
                 ceilometer::debug: {get_input: debug}
-                ceilometer::api::host: {get_attr: [NetIpMap, net_ip_map, {get_param: [ServiceNetMap, CeilometerApiNetwork]}]}
+                ceilometer::api::host: {get_input: ceilometer_api_network}
                 ceilometer::api::keystone_password: {get_input: ceilometer_password}
                 ceilometer::api::keystone_auth_uri: {get_input: keystone_auth_uri}
                 ceilometer::api::keystone_identity_uri: {get_input: keystone_identity_uri}
                 ceilometer::agent::auth::auth_password: {get_input: ceilometer_password}
+                ceilometer::agent::auth::auth_url: {get_input: keystone_auth_address}
+                ceilometer::agent::central::coordination_url: {get_input: ceilometer_coordination_url}
                 snmpd_readonly_user_name: {get_input: snmpd_readonly_user_name}
                 snmpd_readonly_user_password: {get_input: snmpd_readonly_user_password}
 
@@ -870,40 +967,52 @@ resources:
                 nova::debug: {get_input: debug}
                 nova::api::auth_uri: {get_input: keystone_auth_uri}
                 nova::api::identity_uri: {get_input: keystone_identity_uri}
-                nova::api::api_bind_address: {get_input: controller_host}
-                nova::api::metadata_listen: {get_input: controller_host}
+                nova::api::api_bind_address: {get_input: nova_api_network}
+                nova::api::metadata_listen: {get_input: nova_metadata_network}
                 nova::api::admin_password: {get_input: nova_password}
                 nova::database_connection: {get_input: nova_dsn}
+                nova::glance_api_servers: {get_input: glance_api_servers}
                 nova::api::neutron_metadata_proxy_shared_secret: {get_input: neutron_metadata_proxy_shared_secret}
                 nova::network::neutron::neutron_admin_password: {get_input: neutron_password}
                 nova::network::neutron::neutron_url: {get_input: neutron_url}
                 nova::network::neutron::neutron_admin_auth_url: {get_input: neutron_admin_auth_url}
+                nova::vncproxy::host: {get_input: nova_api_network}
 
                 # Horizon
+                apache::ip: {get_input: horizon_network}
                 horizon::django_debug: {get_input: debug}
                 horizon::secret_key: {get_input: horizon_secret}
-                horizon::bind_address: {get_input: controller_host}
+                horizon::bind_address: {get_input: horizon_network}
                 horizon::keystone_url: {get_input: keystone_auth_uri}
 
                 # Rabbit
-                rabbitmq::node_ip_address: {get_input: controller_host}
+                rabbitmq::node_ip_address: {get_input: rabbitmq_network}
                 rabbitmq::erlang_cookie: {get_input: rabbit_cookie}
                 # Redis
-                redis::bind: {get_input: controller_host}
+                redis::bind: {get_input: redis_network}
+                redis_vip: {get_input: redis_vip}
                 # Misc
-                memcached::listen_ip: {get_input: controller_host}
+                memcached::listen_ip: {get_input: memcached_network}
                 neutron_public_interface_ip: {get_input: neutron_public_interface_ip}
                 ntp::servers: {get_input: ntp_servers}
                 control_virtual_interface: {get_input: control_virtual_interface}
-                controller_virtual_ip: {get_input: controller_virtual_ip}
                 public_virtual_interface: {get_input: public_virtual_interface}
-                public_virtual_ip: {get_input: public_virtual_ip}
                 tripleo::loadbalancer::control_virtual_interface: {get_input: control_virtual_interface}
-                tripleo::loadbalancer::controller_virtual_ip: {get_input: controller_virtual_ip}
                 tripleo::loadbalancer::public_virtual_interface: {get_input: public_virtual_interface}
-                tripleo::loadbalancer::public_virtual_ip: {get_input: public_virtual_ip}
                 enable_package_install: {get_input: enable_package_install}
 
+  UpdateConfig:
+    type: OS::TripleO::Tasks::PackageUpdate
+
+  UpdateDeployment:
+    type: OS::Heat::SoftwareDeployment
+    properties:
+      config: {get_resource: UpdateConfig}
+      server: {get_resource: Controller}
+      input_values:
+        update_identifier:
+          get_param: UpdateIdentifier
+
 outputs:
   ip_address:
     description: IP address of the server in the ctlplane network
@@ -938,7 +1047,7 @@ outputs:
       Server's IP address and hostname in the /etc/hosts format
     value:
       str_replace:
-        template: IP HOST CLOUDNAME
+        template: IP HOST.localdomain HOST CLOUDNAME
         params:
           IP: {get_attr: [Controller, networks, ctlplane, 0]}
           HOST: {get_attr: [Controller, name]}
@@ -953,11 +1062,11 @@ outputs:
       str_replace:
         template: 'r1z1-IP:%PORT%/d1'
         params:
-          IP: {get_attr: [Controller, networks, ctlplane, 0]}
+          IP: {get_attr: [NetIpMap, net_ip_map, {get_param: [ServiceNetMap, SwiftMgmtNetwork]}]}
   swift_proxy_memcache:
     description: Swift proxy-memcache value
     value:
       str_replace:
         template: "IP:11211"
         params:
-          IP: {get_attr: [Controller, networks, ctlplane, 0]}
+          IP: {get_attr: [NetIpMap, net_ip_map, {get_param: [ServiceNetMap, MemcachedNetwork]}]}