Merge "Add services to ServiceNetMap to select hostnames resolution network"
[apex-tripleo-heat-templates.git] / puppet / controller-puppet.yaml
index 3437c29..9f531ef 100644 (file)
@@ -49,6 +49,11 @@ parameters:
     description: The password for the cinder service and db account, used by cinder-api.
     type: string
     hidden: true
+  CinderBackendConfig:
+    default: {}
+    description: Contains parameters to configure Cinder backends. Typically
+                 set via parameter_defaults in the resource registry.
+    type: json
   CloudName:
     default: ''
     description: The DNS name of this cloud. E.g. ci-overcloud.tripleo.org
@@ -67,15 +72,14 @@ parameters:
     default: ''
     description: Set to True to enable debugging on all services.
     type: string
+  EnableFencing:
+    default: false
+    description: Whether to enable fencing in Pacemaker or not.
+    type: boolean
   EnableGalera:
     default: true
     description: Whether to use Galera instead of regular MariaDB.
     type: boolean
-  EnablePacemaker:
-    default: false
-    description: If enabled services will be monitored by Pacemaker; it
-      will manage VIPs as well, in place of Keepalived.
-    type: boolean
   EnableCephStorage:
     default: false
     description: Whether to deploy Ceph Storage (OSD) on the Controller
@@ -122,6 +126,38 @@ parameters:
           }
         }
     type: json
+  FencingConfig:
+    default: {}
+    description: |
+      Pacemaker fencing configuration. The JSON should have
+      the following structure:
+        {
+          "devices": [
+            {
+              "agent": "AGENT_NAME",
+              "host_mac": "HOST_MAC_ADDRESS",
+              "params": {"PARAM_NAME": "PARAM_VALUE"}
+            }
+          ]
+        }
+      For instance:
+        {
+          "devices": [
+            {
+              "agent": "fence_xvm",
+              "host_mac": "52:54:00:aa:bb:cc",
+              "params": {
+                "multicast_address": "225.0.0.12",
+                "port": "baremetal_0",
+                "manage_fw": true,
+                "manage_key_file": true,
+                "key_file": "/etc/fence_xvm.key",
+                "key_file_password": "abcdef"
+              }
+            }
+          ]
+        }
+    type: json
   Flavor:
     description: Flavor for control nodes to request when deploying.
     type: string
@@ -226,6 +262,10 @@ parameters:
     type: string
     hidden: true
     default: ''  # Has to be here because of the ignored empty value bug
+  NeutronExternalNetworkBridge:
+    description: Name of bridge used for external network traffic.
+    type: string
+    default: 'br-ex'
   NeutronBridgeMappings:
     description: >
       The OVS logical->physical bridge mappings to use. See the Neutron
@@ -244,10 +284,14 @@ parameters:
     default: 'dvr_snat'
     description: Agent mode for the neutron-l3-agent on the controller hosts
     type: string
-  NeutronL3HA: #FIXME this isn't wired in
+  NeutronL3HA:
     default: 'False'
     description: Whether to enable l3-agent HA
     type: string
+  NeutronDhcpAgentsPerNetwork:
+    type: number
+    default: 3
+    description: The number of neutron dhcp agents to schedule per network
   NeutronDVR:
     default: 'False'
     description: Whether to configure Neutron Distributed Virtual Routers
@@ -287,7 +331,7 @@ parameters:
       The Neutron ML2 and OpenVSwitch vlan mapping range to support. See the
       Neutron documentation for permitted values. Defaults to permitting any
       VLAN on the 'datacentre' physical network (See NeutronBridgeMappings).
-    type: string
+    type: comma_delimited_list
   NeutronPassword:
     default: unset
     description: The password for the neutron service and db account, used by neutron agents.
@@ -342,7 +386,7 @@ parameters:
         Specifies the interface where the public-facing virtual ip will be assigned.
         This should be int_public when a VLAN is being used.
     type: string
-  PublicVirtualIP:
+  PublicVirtualIP: # DEPRECATED: use per service settings instead
     type: string
     default: ''  # Has to be here because of the ignored empty value bug
   RabbitCookie:
@@ -368,6 +412,9 @@ parameters:
     default: 5672
     description: Set rabbit subscriber port, change this if using SSL
     type: number
+  RedisVirtualIP:
+    type: string
+    default: ''  # Has to be here because of the ignored empty value bug
   SnmpdReadonlyUserName:
     default: ro_snmp_user
     description: The user name for SNMPd with readonly rights running on all Overcloud nodes
@@ -419,9 +466,24 @@ parameters:
     type: number
     default: 3
     description: How many replicas to use in the swift rings.
-  VirtualIP:
+  VirtualIP: # DEPRECATED: use per service settings instead
     type: string
     default: ''  # Has to be here because of the ignored empty value bug
+  HeatApiVirtualIP:
+    type: string
+    default: ''
+  GlanceApiVirtualIP:
+    type: string
+    default: ''
+  MysqlVirtualIP:
+    type: string
+    default: ''
+  KeystonePublicApiVirtualIP:
+    type: string
+    default: ''
+  NeutronApiVirtualIP:
+    type: string
+    default: ''
   EnablePackageInstall:
     default: 'false'
     description: Set to true to enable package installation via Puppet
@@ -431,6 +493,15 @@ parameters:
     description: Mapping of service_name -> network name. Typically set
                  via parameter_defaults in the resource registry.
     type: json
+  UpdateIdentifier:
+    default: ''
+    type: string
+    description: >
+      Setting to a previously unused value during stack-update will trigger
+      package update on all nodes
+  Hostname:
+    type: string
+    default: '' # Defaults to Heat created hostname
 
 resources:
 
@@ -445,6 +516,7 @@ resources:
         - network: ctlplane
       user_data_format: SOFTWARE_CONFIG
       user_data: {get_resource: NodeUserData}
+      name: {get_param: Hostname}
 
   NodeUserData:
     type: OS::TripleO::NodeUserData
@@ -483,6 +555,15 @@ resources:
       StorageMgmtIp: {get_attr: [StorageMgmtPort, ip_address]}
       TenantIp: {get_attr: [TenantPort, ip_address]}
 
+  NetIpSubnetMap:
+    type: OS::TripleO::Network::Ports::NetIpMap
+    properties:
+      ExternalIp: {get_attr: [ExternalPort, ip_subnet]}
+      InternalApiIp: {get_attr: [InternalApiPort, ip_subnet]}
+      StorageIp: {get_attr: [StoragePort, ip_subnet]}
+      StorageMgmtIp: {get_attr: [StorageMgmtPort, ip_subnet]}
+      TenantIp: {get_attr: [TenantPort, ip_subnet]}
+
   NetworkConfig:
     type: OS::TripleO::Controller::Net::SoftwareConfig
     properties:
@@ -495,7 +576,6 @@ resources:
   NetworkDeployment:
     type: OS::TripleO::SoftwareDeployment
     properties:
-      signal_transport: NO_SIGNAL
       config: {get_resource: NetworkConfig}
       server: {get_resource: Controller}
       input_values:
@@ -504,32 +584,30 @@ resources:
 
   ControllerDeployment:
     type: OS::TripleO::SoftwareDeployment
+    depends_on: NetworkDeployment
     properties:
-      signal_transport: NO_SIGNAL
       config: {get_resource: ControllerConfig}
       server: {get_resource: Controller}
       input_values:
         bootstack_nodeid: {get_attr: [Controller, name]}
-        controller_host: {get_attr: [Controller, networks, ctlplane, 0]}
-        controller_virtual_ip: {get_param: VirtualIP}
         neutron_enable_tunneling: {get_param: NeutronEnableTunnelling}
         heat.watch_server_url:
           list_join:
             - ''
             - - 'http://'
-              - {get_param: VirtualIP}
+              - {get_param: HeatApiVirtualIP}
               - ':8003'
         heat.metadata_server_url:
           list_join:
             - ''
             - - 'http://'
-              - {get_param: VirtualIP}
+              - {get_param: HeatApiVirtualIP}
               - ':8000'
         heat.waitcondition_server_url:
           list_join:
             - ''
             - - 'http://'
-              - {get_param: VirtualIP}
+              - {get_param: HeatApiVirtualIP}
               - ':8000/v1/waitcondition'
         heat_auth_encryption_key: {get_param: HeatAuthEncryptionKey}
         horizon_secret: {get_param: HorizonSecret}
@@ -542,19 +620,18 @@ resources:
         cinder_password: {get_param: CinderPassword}
         cinder_enable_iscsi_backend: {get_param: CinderEnableIscsiBackend}
         cinder_iscsi_helper: {get_param: CinderISCSIHelper}
+        cinder_backend_config: {get_param: CinderBackendConfig}
         cinder_dsn:
           list_join:
             - ''
             - - 'mysql://cinder:'
               - {get_param: CinderPassword}
               - '@'
-              - {get_param: VirtualIP}
+              - {get_param: MysqlVirtualIP}
               - '/cinder'
         glance_port: {get_param: GlancePort}
-        glance_protocol: {get_param: GlanceProtocol}
         glance_password: {get_param: GlancePassword}
         glance_backend: {get_param: GlanceBackend}
-        glance_swift_store_auth_address: {list_join: ['', ['http://', {get_param: VirtualIP} , ':5000/v2.0']]}
         glance_notifier_strategy: {get_param: GlanceNotifierStrategy}
         glance_log_file: {get_param: GlanceLogFile}
         glance_dsn:
@@ -563,7 +640,7 @@ resources:
             - - 'mysql://glance:'
               - {get_param: GlancePassword}
               - '@'
-              - {get_param: VirtualIP}
+              - {get_param: MysqlVirtualIP}
               - '/glance'
         heat_password: {get_param: HeatPassword}
         heat_stack_domain_admin_password: {get_param: HeatStackDomainAdminPassword}
@@ -573,8 +650,9 @@ resources:
             - - 'mysql://heat:'
               - {get_param: HeatPassword}
               - '@'
-              - {get_param: VirtualIP}
+              - {get_param: MysqlVirtualIP}
               - '/heat'
+        keystone_auth_address: {list_join: ['', ['http://', {get_param: KeystonePublicApiVirtualIP} , ':5000/v2.0']]}
         keystone_ca_certificate: {get_param: KeystoneCACertificate}
         keystone_signing_key: {get_param: KeystoneSigningKey}
         keystone_signing_certificate: {get_param: KeystoneSigningCertificate}
@@ -586,20 +664,21 @@ resources:
             - - 'mysql://keystone:'
               - {get_param: AdminToken}
               - '@'
-              - {get_param: VirtualIP}
+              - {get_param: MysqlVirtualIP}
               - '/keystone'
         keystone_identity_uri:
           list_join:
             - ''
             - - 'http://'
-              - {get_param: VirtualIP}
+              - {get_param: KeystonePublicApiVirtualIP}
               - ':35357/'
         keystone_auth_uri:
           list_join:
             - ''
             - - 'http://'
-              - {get_param: VirtualIP}
+              - {get_param: KeystonePublicApiVirtualIP}
               - ':5000/v2.0/'
+        enable_fencing: {get_param: EnableFencing}
         enable_galera: {get_param: EnableGalera}
         enable_ceph_storage: {get_param: EnableCephStorage}
         enable_swift_storage: {get_param: EnableSwiftStorage}
@@ -617,8 +696,17 @@ resources:
         neutron_mechanism_drivers: {get_param: NeutronMechanismDrivers}
         neutron_allow_l3agent_failover: {get_param: NeutronAllowL3AgentFailover}
         neutron_l3_ha: {get_param: NeutronL3HA}
-        neutron_network_vlan_ranges: {get_param: NeutronNetworkVLANRanges}
+        neutron_dhcp_agents_per_network: {get_param: NeutronDhcpAgentsPerNetwork}
+        neutron_network_vlan_ranges:
+          str_replace:
+            template: "['RANGES']"
+            params:
+              RANGES:
+                list_join:
+                - "','"
+                - {get_param: NeutronNetworkVLANRanges}
         neutron_bridge_mappings: {get_param: NeutronBridgeMappings}
+        neutron_external_network_bridge: {get_param: NeutronExternalNetworkBridge}
         neutron_public_interface: {get_param: NeutronPublicInterface}
         neutron_public_interface_raw_device: {get_param: NeutronPublicInterfaceRawDevice}
         neutron_public_interface_default_route: {get_param: NeutronPublicInterfaceDefaultRoute}
@@ -633,28 +721,34 @@ resources:
             - - 'mysql://neutron:'
               - {get_param: NeutronPassword}
               - '@'
-              - {get_param: VirtualIP}
+              - {get_param: MysqlVirtualIP}
               - '/ovs_neutron?charset=utf8'
         neutron_url:
           list_join:
             - ''
             - - 'http://'
-              - {get_param: VirtualIP}
+              - {get_param: NeutronApiVirtualIP}
               - ':9696'
         neutron_admin_auth_url:
           list_join:
             - ''
             - - 'http://'
-              - {get_param: VirtualIP}
+              - {get_param: KeystonePublicApiVirtualIP}
               - ':35357/v2.0'
         ceilometer_backend: {get_param: CeilometerBackend}
         ceilometer_metering_secret: {get_param: CeilometerMeteringSecret}
         ceilometer_password: {get_param: CeilometerPassword}
+        ceilometer_coordination_url:
+          list_join:
+            - ''
+            - - 'redis://'
+              - {get_param: RedisVirtualIP}
+              - ':6379'
         ceilometer_dsn:
           list_join:
             - ''
             - - 'mysql://ceilometer:unset@'
-              - {get_param: VirtualIP}
+              - {get_param: MysqlVirtualIP}
               - '/ceilometer'
         snmpd_readonly_user_name: {get_param: SnmpdReadonlyUserName}
         snmpd_readonly_user_password: {get_param: SnmpdReadonlyUserPassword}
@@ -665,8 +759,9 @@ resources:
             - - 'mysql://nova:'
               - {get_param: NovaPassword}
               - '@'
-              - {get_param: VirtualIP}
+              - {get_param: MysqlVirtualIP}
               - '/nova'
+        fencing_config: {get_param: FencingConfig}
         pcsd_password: {get_param: PcsdPassword}
         rabbit_username: {get_param: RabbitUserName}
         rabbit_password: {get_param: RabbitPassword}
@@ -680,7 +775,6 @@ resources:
               server: {get_param: NtpServer}
         control_virtual_interface: {get_param: ControlVirtualInterface}
         public_virtual_interface: {get_param: PublicVirtualInterface}
-        public_virtual_ip: {get_param: PublicVirtualIP}
         swift_hash_suffix: {get_param: SwiftHashSuffix}
         swift_password: {get_param: SwiftPassword}
         swift_part_power: {get_param: SwiftPartPower}
@@ -688,6 +782,38 @@ resources:
         swift_min_part_hours: {get_param: SwiftMinPartHours}
         swift_mount_check: {get_param: SwiftMountCheck}
         enable_package_install: {get_param: EnablePackageInstall}
+        swift_proxy_network: {get_attr: [NetIpMap, net_ip_map, {get_param: [ServiceNetMap, SwiftProxyNetwork]}]}
+        swift_management_network: {get_attr: [NetIpMap, net_ip_map, {get_param: [ServiceNetMap, SwiftMgmtNetwork]}]}
+        cinder_iscsi_network: {get_attr: [NetIpMap, net_ip_map, {get_param: [ServiceNetMap, CinderIscsiNetwork]}]}
+        cinder_api_network: {get_attr: [NetIpMap, net_ip_map, {get_param: [ServiceNetMap, CinderApiNetwork]}]}
+        glance_api_network: {get_attr: [NetIpMap, net_ip_map, {get_param: [ServiceNetMap, GlanceApiNetwork]}]}
+        glance_registry_network: {get_attr: [NetIpMap, net_ip_map, {get_param: [ServiceNetMap, GlanceRegistryNetwork]}]}
+        glance_api_servers:
+          list_join:
+            - ''
+            - - {get_param: GlanceProtocol}
+              - '://'
+              - {get_param: GlanceApiVirtualIP}
+              - ':'
+              - {get_param: GlancePort}
+        heat_api_network: {get_attr: [NetIpMap, net_ip_map, {get_param: [ServiceNetMap, HeatApiNetwork]}]}
+        keystone_public_api_network: {get_attr: [NetIpMap, net_ip_map, {get_param: [ServiceNetMap, KeystonePublicApiNetwork]}]}
+        keystone_admin_api_network: {get_attr: [NetIpMap, net_ip_map, {get_param: [ServiceNetMap, KeystoneAdminApiNetwork]}]}
+        mongo_db_network: {get_attr: [NetIpMap, net_ip_map, {get_param: [ServiceNetMap, MongoDbNetwork]}]}
+        neutron_api_network: {get_attr: [NetIpMap, net_ip_map, {get_param: [ServiceNetMap, NeutronApiNetwork]}]}
+        neutron_local_ip: {get_attr: [NetIpMap, net_ip_map, {get_param: [ServiceNetMap, NeutronTenantNetwork]}]}
+        ceilometer_api_network: {get_attr: [NetIpMap, net_ip_map, {get_param: [ServiceNetMap, CeilometerApiNetwork]}]}
+        nova_api_network: {get_attr: [NetIpMap, net_ip_map, {get_param: [ServiceNetMap, NovaApiNetwork]}]}
+        nova_metadata_network: {get_attr: [NetIpMap, net_ip_map, {get_param: [ServiceNetMap, NovaMetadataNetwork]}]}
+        horizon_network: {get_attr: [NetIpMap, net_ip_map, {get_param: [ServiceNetMap, HorizonNetwork]}]}
+        rabbitmq_network: {get_attr: [NetIpMap, net_ip_map, {get_param: [ServiceNetMap, RabbitMqNetwork]}]}
+        redis_network: {get_attr: [NetIpMap, net_ip_map, {get_param: [ServiceNetMap, RedisNetwork]}]}
+        redis_vip: {get_param: RedisVirtualIP}
+        memcached_network: {get_attr: [NetIpMap, net_ip_map, {get_param: [ServiceNetMap, MemcachedNetwork]}]}
+        mysql_network: {get_attr: [NetIpMap, net_ip_map, {get_param: [ServiceNetMap, MysqlNetwork]}]}
+        ceph_cluster_network: {get_attr: [NetIpSubnetMap, net_ip_map, {get_param: [ServiceNetMap, CephClusterNetwork]}]}
+        ceph_public_network: {get_attr: [NetIpSubnetMap, net_ip_map, {get_param: [ServiceNetMap, CephPublicNetwork]}]}
+        ceph_public_ip: {get_attr: [NetIpMap, net_ip_map, {get_param: [ServiceNetMap, CephPublicNetwork]}]}
 
   # Map heat metadata into hiera datafiles
   ControllerConfig:
@@ -705,29 +831,36 @@ resources:
             - ceph
             - bootstrap_node # provided by BootstrapNodeConfig
             - all_nodes # provided by allNodesConfig
+            - vip_data # provided by vip-config
             - '"%{::osfamily}"'
             - common
+            - cinder_netapp_data # Optionally provided by ControllerExtraConfigPre
           datafiles:
             common:
               raw_data: {get_file: hieradata/common.yaml}
             ceph:
               raw_data: {get_file: hieradata/ceph.yaml}
+              mapped_data:
+                ceph::profile::params::cluster_network: {get_input: ceph_cluster_network}
+                ceph::profile::params::public_network: {get_input: ceph_public_network}
+                ceph::mon::public_addr: {get_input: ceph_public_ip}
             object:
               raw_data: {get_file: hieradata/object.yaml}
             controller:
               raw_data: {get_file: hieradata/controller.yaml}
               mapped_data: # data supplied directly to this deployment configuration, etc
                 bootstack_nodeid: {get_input: bootstack_nodeid}
-                controller_host: {get_input: controller_host} #local-ipv4
 
                 # Pacemaker
+                enable_fencing: {get_input: enable_fencing}
                 hacluster_pwd: {get_input: pcsd_password}
+                tripleo::fencing::config: {get_input: fencing_config}
 
                 # Swift
-                swift::proxy::proxy_local_net_ip: {get_input: controller_host}
+                swift::proxy::proxy_local_net_ip: {get_input: swift_proxy_network}
                 swift::proxy::authtoken::auth_uri: {get_input: keystone_auth_uri}
                 swift::proxy::authtoken::identity_uri: {get_input: keystone_identity_uri}
-                swift::storage::all::storage_local_net_ip: {get_input: controller_host}
+                swift::storage::all::storage_local_net_ip: {get_input: swift_management_network}
                 swift::swift_hash_suffix: {get_input: swift_hash_suffix}
                 swift::proxy::authtoken::admin_password: {get_input: swift_password}
                 tripleo::ringbuilder::part_power: {get_input: swift_part_power}
@@ -743,30 +876,29 @@ resources:
                 cinder_enable_rbd_backend: {get_input: cinder_enable_rbd_backend}
                 cinder_lvm_loop_device_size: {get_input: cinder_lvm_loop_device_size}
                 cinder_iscsi_helper: {get_input: cinder_iscsi_helper}
-                cinder_iscsi_ip_address: {get_attr: [NetIpMap, net_ip_map, {get_param: [ServiceNetMap, CinderIscsiNetwork]}]}
+                cinder_iscsi_ip_address: {get_input: cinder_iscsi_network}
                 cinder::database_connection: {get_input: cinder_dsn}
                 cinder::api::keystone_password: {get_input: cinder_password}
                 cinder::api::auth_uri: {get_input: keystone_auth_uri}
                 cinder::api::identity_uri: {get_input: keystone_identity_uri}
-                cinder::api::bind_host: {get_attr: [NetIpMap, net_ip_map, {get_param: [ServiceNetMap, CinderApiNetwork]}]}
+                cinder::api::bind_host: {get_input: cinder_api_network}
                 cinder::rabbit_userid: {get_input: rabbit_username}
                 cinder::rabbit_password: {get_input: rabbit_password}
                 cinder::rabbit_use_ssl: {get_input: rabbit_client_use_ssl}
                 cinder::rabbit_port: {get_input: rabbit_client_port}
                 cinder::debug: {get_input: debug}
                 cinder_enable_iscsi_backend: {get_input: cinder_enable_iscsi_backend}
+                cinder::glance::glance_api_servers: {get_input: glance_api_servers}
+                cinder_backend_config: {get_input: CinderBackendConfig}
 
                 # Glance
                 glance::api::bind_port: {get_input: glance_port}
-                glance::api::bind_host: {get_attr: [NetIpMap, net_ip_map, {get_param: [ServiceNetMap, GlanceApiNetwork]}]}
+                glance::api::bind_host: {get_input: glance_api_network}
                 glance::api::auth_uri: {get_input: keystone_auth_uri}
                 glance::api::identity_uri: {get_input: keystone_identity_uri}
-                glance::api::registry_host: {get_attr: [NetIpMap, net_ip_map, {get_param: [ServiceNetMap, GlanceRegistryNetwork]}]}
+                glance::api::registry_host: {get_input: glance_registry_network}
                 glance::api::keystone_password: {get_input: glance_password}
                 glance::api::debug: {get_input: debug}
-                # used to construct glance_api_servers
-                glance_port: {get_input: glance_port}
-                glance_protocol: {get_input: glance_protocol}
                 glance_notifier_strategy: {get_input: glance_notifier_strategy}
                 glance_log_file: {get_input: glance_log_file}
                 glance_log_file: {get_input: glance_log_file}
@@ -777,7 +909,7 @@ resources:
                 glance::registry::auth_uri: {get_input: keystone_auth_uri}
                 glance::registry::identity_uri: {get_input: keystone_identity_uri}
                 glance::registry::debug: {get_input: debug}
-                glance::backend::swift::swift_store_auth_address: {get_input: glance_swift_store_auth_address}
+                glance::backend::swift::swift_store_auth_address: {get_input: keystone_auth_address}
                 glance::backend::swift::swift_store_user: service:glance
                 glance::backend::swift::swift_store_key: {get_input: glance_password}
                 glance_backend: {get_input: glance_backend}
@@ -795,9 +927,9 @@ resources:
                 heat::auth_uri: {get_input: keystone_auth_uri}
                 heat::identity_uri: {get_input: keystone_identity_uri}
                 heat::keystone_password: {get_input: heat_password}
-                heat::api::bind_host: {get_input: controller_host}
-                heat::api_cloudwatch::bind_host: {get_input: controller_host}
-                heat::api_cfn::bind_host: {get_input: controller_host}
+                heat::api::bind_host: {get_input: heat_api_network}
+                heat::api_cloudwatch::bind_host: {get_input: heat_api_network}
+                heat::api_cfn::bind_host: {get_input: heat_api_network}
                 heat::database_connection: {get_input: heat_dsn}
                 heat::instance_user: heat-admin
                 heat::debug: {get_input: debug}
@@ -810,11 +942,11 @@ resources:
                 keystone_ssl_certificate: {get_input: keystone_ssl_certificate}
                 keystone_ssl_certificate_key: {get_input: keystone_ssl_certificate_key}
                 keystone::database_connection: {get_input: keystone_dsn}
-                keystone::public_bind_host: {get_attr: [NetIpMap, net_ip_map, {get_param: [ServiceNetMap, KeystonePublicApiNetwork]}]}
-                keystone::admin_bind_host: {get_attr: [NetIpMap, net_ip_map, {get_param: [ServiceNetMap, KeystoneAdminApiNetwork]}]}
+                keystone::public_bind_host: {get_input: keystone_public_api_network}
+                keystone::admin_bind_host: {get_input: keystone_admin_api_network}
                 keystone::debug: {get_input: debug}
                 # MongoDB
-                mongodb::server::bind_ip: {get_attr: [NetIpMap, net_ip_map, {get_param: [ServiceNetMap, MongoDbNetwork]}]}
+                mongodb::server::bind_ip: {get_input: mongo_db_network}
                 # MySQL
                 admin_password: {get_input: admin_password}
                 enable_galera: {get_input: enable_galera}
@@ -823,9 +955,10 @@ resources:
                 mysql_innodb_buffer_pool_size: {get_input: mysql_innodb_buffer_pool_size}
                 mysql::server::root_password: {get_input: mysql_root_password}
                 mysql_cluster_name: {get_input: mysql_cluster_name}
+                mysql_bind_host: {get_input: mysql_network}
 
                 # Neutron
-                neutron::bind_host: {get_input: controller_host}
+                neutron::bind_host: {get_input: neutron_api_network}
                 neutron::rabbit_password: {get_input: rabbit_password}
                 neutron::rabbit_user: {get_input: rabbit_user}
                 neutron::rabbit_use_ssl: {get_input: rabbit_client_use_ssl}
@@ -834,16 +967,18 @@ resources:
                 neutron::server::auth_uri: {get_input: keystone_auth_uri}
                 neutron::server::identity_uri: {get_input: keystone_identity_uri}
                 neutron::server::database_connection: {get_input: neutron_dsn}
+                neutron::agents::l3::external_network_bridge: {get_input: neutron_external_network_bridge}
                 neutron::agents::ml2::ovs::enable_tunneling: {get_input: neutron_enable_tunneling}
-                neutron::agents::ml2::ovs::local_ip: {get_attr: [NetIpMap, net_ip_map, {get_param: [ServiceNetMap, NeutronLocalIp]}]}
+                neutron::agents::ml2::ovs::local_ip: {get_input: neutron_local_ip}
                 neutron_flat_networks: {get_input: neutron_flat_networks}
                 neutron::agents::metadata::shared_secret: {get_input: neutron_metadata_proxy_shared_secret}
-                neutron::agents::metadata::metadata_ip: {get_input: controller_virtual_ip}
+                neutron::agents::metadata::metadata_ip: {get_input: neutron_api_network}
                 neutron_agent_mode: {get_input: neutron_agent_mode}
                 neutron_router_distributed: {get_input: neutron_router_distributed}
                 neutron_mechanism_drivers: {get_input: neutron_mechanism_drivers}
-                neutron_allow_l3agent_failover: {get_input: neutron_allow_l3agent_failover}
+                neutron::server::allow_automatic_l3agent_failover: {get_input: neutron_allow_l3agent_failover}
                 neutron::server::l3_ha: {get_input: neutron_l3_ha}
+                neutron::dhcp_agents_per_network: {get_input: neutron_dhcp_agents_per_network}
                 neutron::plugins::ml2::network_vlan_ranges: {get_input: neutron_network_vlan_ranges}
                 neutron_bridge_mappings: {get_input: neutron_bridge_mappings}
                 neutron_public_interface: {get_input: neutron_public_interface}
@@ -856,6 +991,7 @@ resources:
                 neutron::agents::metadata::auth_password: {get_input: neutron_password}
                 neutron_dnsmasq_options: {get_input: neutron_dnsmasq_options}
                 neutron_dsn: {get_input: neutron_dsn}
+                neutron::agents::metadata::auth_url: {get_input: keystone_identity_uri}
 
                 # Ceilometer
                 ceilometer_backend: {get_input: ceilometer_backend}
@@ -866,11 +1002,13 @@ resources:
                 ceilometer::rabbit_use_ssl: {get_input: rabbit_client_use_ssl}
                 ceilometer::rabbit_port: {get_input: rabbit_client_port}
                 ceilometer::debug: {get_input: debug}
-                ceilometer::api::host: {get_attr: [NetIpMap, net_ip_map, {get_param: [ServiceNetMap, CeilometerApiNetwork]}]}
+                ceilometer::api::host: {get_input: ceilometer_api_network}
                 ceilometer::api::keystone_password: {get_input: ceilometer_password}
                 ceilometer::api::keystone_auth_uri: {get_input: keystone_auth_uri}
                 ceilometer::api::keystone_identity_uri: {get_input: keystone_identity_uri}
                 ceilometer::agent::auth::auth_password: {get_input: ceilometer_password}
+                ceilometer::agent::auth::auth_url: {get_input: keystone_auth_address}
+                ceilometer::agent::central::coordination_url: {get_input: ceilometer_coordination_url}
                 snmpd_readonly_user_name: {get_input: snmpd_readonly_user_name}
                 snmpd_readonly_user_password: {get_input: snmpd_readonly_user_password}
 
@@ -882,40 +1020,59 @@ resources:
                 nova::debug: {get_input: debug}
                 nova::api::auth_uri: {get_input: keystone_auth_uri}
                 nova::api::identity_uri: {get_input: keystone_identity_uri}
-                nova::api::api_bind_address: {get_input: controller_host}
-                nova::api::metadata_listen: {get_input: controller_host}
+                nova::api::api_bind_address: {get_input: nova_api_network}
+                nova::api::metadata_listen: {get_input: nova_metadata_network}
                 nova::api::admin_password: {get_input: nova_password}
                 nova::database_connection: {get_input: nova_dsn}
+                nova::glance_api_servers: {get_input: glance_api_servers}
                 nova::api::neutron_metadata_proxy_shared_secret: {get_input: neutron_metadata_proxy_shared_secret}
                 nova::network::neutron::neutron_admin_password: {get_input: neutron_password}
                 nova::network::neutron::neutron_url: {get_input: neutron_url}
                 nova::network::neutron::neutron_admin_auth_url: {get_input: neutron_admin_auth_url}
+                nova::vncproxy::host: {get_input: nova_api_network}
 
                 # Horizon
+                apache::ip: {get_input: horizon_network}
                 horizon::django_debug: {get_input: debug}
                 horizon::secret_key: {get_input: horizon_secret}
-                horizon::bind_address: {get_input: controller_host}
+                horizon::bind_address: {get_input: horizon_network}
                 horizon::keystone_url: {get_input: keystone_auth_uri}
 
                 # Rabbit
-                rabbitmq::node_ip_address: {get_input: controller_host}
+                rabbitmq::node_ip_address: {get_input: rabbitmq_network}
                 rabbitmq::erlang_cookie: {get_input: rabbit_cookie}
                 # Redis
-                redis::bind: {get_input: controller_host}
+                redis::bind: {get_input: redis_network}
+                redis_vip: {get_input: redis_vip}
                 # Misc
-                memcached::listen_ip: {get_input: controller_host}
+                memcached::listen_ip: {get_input: memcached_network}
                 neutron_public_interface_ip: {get_input: neutron_public_interface_ip}
                 ntp::servers: {get_input: ntp_servers}
                 control_virtual_interface: {get_input: control_virtual_interface}
-                controller_virtual_ip: {get_input: controller_virtual_ip}
                 public_virtual_interface: {get_input: public_virtual_interface}
-                public_virtual_ip: {get_input: public_virtual_ip}
                 tripleo::loadbalancer::control_virtual_interface: {get_input: control_virtual_interface}
-                tripleo::loadbalancer::controller_virtual_ip: {get_input: controller_virtual_ip}
                 tripleo::loadbalancer::public_virtual_interface: {get_input: public_virtual_interface}
-                tripleo::loadbalancer::public_virtual_ip: {get_input: public_virtual_ip}
                 enable_package_install: {get_input: enable_package_install}
 
+  # Hook for site-specific additional pre-deployment config, e.g extra hieradata
+  ControllerExtraConfigPre:
+    depends_on: ControllerDeployment
+    type: OS::TripleO::ControllerExtraConfigPre
+    properties:
+        server: {get_resource: Controller}
+
+  UpdateConfig:
+    type: OS::TripleO::Tasks::PackageUpdate
+
+  UpdateDeployment:
+    type: OS::Heat::SoftwareDeployment
+    properties:
+      config: {get_resource: UpdateConfig}
+      server: {get_resource: Controller}
+      input_values:
+        update_identifier:
+          get_param: UpdateIdentifier
+
 outputs:
   ip_address:
     description: IP address of the server in the ctlplane network
@@ -950,9 +1107,9 @@ outputs:
       Server's IP address and hostname in the /etc/hosts format
     value:
       str_replace:
-        template: IP HOST CLOUDNAME
+        template: IP HOST.localdomain HOST CLOUDNAME
         params:
-          IP: {get_attr: [Controller, networks, ctlplane, 0]}
+          IP: {get_attr: [NetIpMap, net_ip_map, {get_param: [ServiceNetMap, ControllerHostnameResolveNetwork]}]}
           HOST: {get_attr: [Controller, name]}
           CLOUDNAME: {get_param: CloudName}
   nova_server_resource:
@@ -965,11 +1122,18 @@ outputs:
       str_replace:
         template: 'r1z1-IP:%PORT%/d1'
         params:
-          IP: {get_attr: [Controller, networks, ctlplane, 0]}
+          IP: {get_attr: [NetIpMap, net_ip_map, {get_param: [ServiceNetMap, SwiftMgmtNetwork]}]}
   swift_proxy_memcache:
     description: Swift proxy-memcache value
     value:
       str_replace:
         template: "IP:11211"
         params:
-          IP: {get_attr: [Controller, networks, ctlplane, 0]}
+          IP: {get_attr: [NetIpMap, net_ip_map, {get_param: [ServiceNetMap, MemcachedNetwork]}]}
+  config_identifier:
+    description: identifier which changes if the controller configuration may need re-applying
+    value:
+      list_join:
+      - ','
+      - - {get_attr: [ControllerDeployment, deploy_stdout]}
+        - {get_attr: [ControllerExtraConfigPre, deploy_stdout]}