Merge "Remove Ceilometer Alarm from the overcloud"
[apex-tripleo-heat-templates.git] / puppet / controller.yaml
index e07ac8e..97b5456 100644 (file)
@@ -106,6 +106,10 @@ parameters:
     default: true
     description: Whether to use Galera instead of regular MariaDB.
     type: boolean
+  EnableLoadBalancer:
+    default: true
+    description: Whether to deploy a LoadBalancer on the Controller
+    type: boolean
   EnableCephStorage:
     default: false
     description: Whether to deploy Ceph Storage (OSD) on the Controller
@@ -236,6 +240,10 @@ parameters:
     default: 'REBUILD_PRESERVE_EPHEMERAL'
     description: What policy to use when reconstructing instances. REBUILD for rebuilds, REBUILD_PRESERVE_EPHEMERAL to preserve /mnt.
     type: string
+  InstanceNameTemplate:
+    default: 'instance-%08x'
+    description: Template string to be used to generate instance names
+    type: string
   KeyName:
     default: default
     description: Name of an existing EC2 KeyPair to enable SSH access to the instances
@@ -278,6 +286,14 @@ parameters:
     type: string
     default: 'regionOne'
     description: Keystone region for endpoint
+  ManageFirewall:
+    default: false
+    description: Whether to manage IPtables rules.
+    type: boolean
+  PurgeFirewallRules:
+    default: false
+    description: Whether IPtables rules should be purged before setting up the new ones.
+    type: boolean
   MysqlClusterUniquePart:
     description: A unique identifier of the MySQL cluster the controller is in.
     type: string
@@ -318,6 +334,22 @@ parameters:
     default: 'dhcp-option-force=26,1400'
     description: Dnsmasq options for neutron-dhcp-agent. The default value here forces MTU to be set to 1400 to account for the gre tunnel overhead.
     type: string
+  NeutronEnableDHCPAgent:
+    description: Knob to enable/disable DHCP Agent
+    type: boolean
+    default: true
+  NeutronEnableL3Agent:
+    description: Knob to enable/disable L3 agent
+    type: boolean
+    default: true
+  NeutronEnableMetadataAgent:
+    description: Knob to enable/disable Metadata agent
+    type: boolean
+    default: true
+  NeutronEnableOVSAgent:
+    description: Knob to enable/disable OVS Agent
+    type: boolean
+    default: true
   NeutronAgentMode:
     default: 'dvr_snat'
     description: Agent mode for the neutron-l3-agent on the controller hosts
@@ -514,20 +546,6 @@ parameters:
     description: The user password for SNMPd with readonly rights running on all Overcloud nodes
     type: string
     hidden: true
-  SSLCACertificate:
-    default: ''
-    description: If set, the contents of an SSL certificate authority file.
-    type: string
-  SSLCertificate:
-    default: ''
-    description: If set, the contents of an SSL certificate .crt file for encrypting SSL endpoints.
-    type: string
-    hidden: true
-  SSLKey:
-    default: ''
-    description: If set, the contents of an SSL certificate .key file for encrypting SSL endpoints.
-    type: string
-    hidden: true
   SwiftHashSuffix:
     default: unset
     description: A random string to be used as a salt when hashing to determine mappings
@@ -606,6 +624,26 @@ parameters:
   Hostname:
     type: string
     default: '' # Defaults to Heat created hostname
+  NetworkDeploymentActions:
+    type: comma_delimited_list
+    description: >
+      Heat action when to apply network configuration changes
+    default: ['CREATE']
+  NodeIndex:
+    type: number
+    default: 0
+  CloudDomain:
+    default: ''
+    type: string
+    description: >
+      The DNS domain used for the hosts. This should match the dhcp_domain
+      configured in the Undercloud neutron. Defaults to localdomain.
+  ServerMetadata:
+    default: {}
+    description: >
+      Extra properties or metadata passed to Nova for the created nodes in
+      the overcloud. It's accessible via the Nova metadata API.
+    type: json
 
 resources:
 
@@ -621,6 +659,7 @@ resources:
       user_data_format: SOFTWARE_CONFIG
       user_data: {get_resource: UserData}
       name: {get_param: Hostname}
+      metadata: {get_param: ServerMetadata}
 
   # Combine the NodeAdminUserData and NodeUserData mime archives
   UserData:
@@ -702,10 +741,26 @@ resources:
     properties:
       config: {get_resource: NetworkConfig}
       server: {get_resource: Controller}
+      actions: {get_param: NetworkDeploymentActions}
       input_values:
         bridge_name: br-ex
         interface_name: {get_param: NeutronPublicInterface}
 
+  # Resource for site-specific injection of root certificate
+  NodeTLSCAData:
+    depends_on: NetworkDeployment
+    type: OS::TripleO::NodeTLSCAData
+    properties:
+      server: {get_resource: Controller}
+
+  # Resource for site-specific passing of private keys/certificates
+  NodeTLSData:
+    depends_on: NodeTLSCAData
+    type: OS::TripleO::NodeTLSData
+    properties:
+      server: {get_resource: Controller}
+      NodeIndex: {get_param: NodeIndex}
+
   ControllerDeployment:
     type: OS::TripleO::SoftwareDeployment
     depends_on: NetworkDeployment
@@ -817,8 +872,11 @@ resources:
         keystone_ec2_uri: { get_param: [EndpointMap, KeystoneEC2, uri] }
         enable_fencing: {get_param: EnableFencing}
         enable_galera: {get_param: EnableGalera}
+        enable_load_balancer: {get_param: EnableLoadBalancer}
         enable_ceph_storage: {get_param: EnableCephStorage}
         enable_swift_storage: {get_param: EnableSwiftStorage}
+        manage_firewall: {get_param: ManageFirewall}
+        purge_firewall_rules: {get_param: PurgeFirewallRules}
         mysql_innodb_buffer_pool_size: {get_param: MysqlInnodbBufferPoolSize}
         mysql_max_connections: {get_param: MysqlMaxConnections}
         mysql_root_password: {get_param: MysqlRootPassword}
@@ -848,6 +906,10 @@ resources:
                 list_join:
                 - "','"
                 - {get_param: NeutronTypeDrivers}
+        neutron_enable_dhcp_agent: {get_param: NeutronEnableDHCPAgent}
+        neutron_enable_l3_agent: {get_param: NeutronEnableL3Agent}
+        neutron_enable_metadata_agent: {get_param: NeutronEnableMetadataAgent}
+        neutron_enable_ovs_agent: {get_param: NeutronEnableOVSAgent}
         neutron_mechanism_drivers: {get_param: NeutronMechanismDrivers}
         neutron_allow_l3agent_failover: {get_param: NeutronAllowL3AgentFailover}
         neutron_l3_ha: {get_param: NeutronL3HA}
@@ -898,6 +960,7 @@ resources:
         neutron_public_url: { get_param: [ EndpointMap, NeutronPublic, uri ] }
         neutron_admin_url: { get_param: [ EndpointMap, NeutronAdmin, uri ] }
         neutron_admin_auth_url: { get_param: [ EndpointMap, KeystoneAdmin, uri ] }
+        nova_internal_url: { get_param: [ EndpointMap, NovaInternal, uri ] }
         ceilometer_backend: {get_param: CeilometerBackend}
         ceilometer_metering_secret: {get_param: CeilometerMeteringSecret}
         ceilometer_password: {get_param: CeilometerPassword}
@@ -926,6 +989,7 @@ resources:
               - '@'
               - {get_param: MysqlVirtualIP}
               - '/nova'
+        instance_name_template: {get_param: InstanceNameTemplate}
         fencing_config: {get_param: FencingConfig}
         pcsd_password: {get_param: PcsdPassword}
         rabbit_username: {get_param: RabbitUserName}
@@ -1009,6 +1073,7 @@ resources:
             - neutron_bigswitch_data # Optionally provided by ControllerExtraConfigPre
             - neutron_cisco_data # Optionally provided by ControllerExtraConfigPre
             - cisco_n1kv_data # Optionally provided by ControllerExtraConfigPre
+            - neutron_nuage_data # Optionally provided by ControllerExtraConfigPre
           datafiles:
             controller_extraconfig:
               mapped_data: {get_param: ControllerExtraConfig}
@@ -1033,6 +1098,7 @@ resources:
 
                 # Pacemaker
                 enable_fencing: {get_input: enable_fencing}
+                enable_load_balancer: {get_input: enable_load_balancer}
                 hacluster_pwd: {get_input: pcsd_password}
                 tripleo::fencing::config: {get_input: fencing_config}
 
@@ -1185,6 +1251,10 @@ resources:
                 neutron_router_distributed: {get_input: neutron_router_distributed}
                 neutron::core_plugin: {get_input: neutron_core_plugin}
                 neutron::service_plugins: {get_input: neutron_service_plugins}
+                neutron::enable_dhcp_agent: {get_input: neutron_enable_dhcp_agent}
+                neutron::enable_l3_agent: {get_input: neutron_enable_l3_agent}
+                neutron::enable_metadata_agent: {get_input: neutron_enable_metadata_agent}
+                neutron::enable_ovs_agent: {get_input: neutron_enable_ovs_agent}
                 neutron::plugins::ml2::type_drivers: {get_input: neutron_type_drivers}
                 neutron_mechanism_drivers: {get_input: neutron_mechanism_drivers}
                 neutron::server::allow_automatic_l3agent_failover: {get_input: neutron_allow_l3agent_failover}
@@ -1206,6 +1276,15 @@ resources:
                 neutron_dsn: {get_input: neutron_dsn}
                 neutron::agents::metadata::auth_url: {get_input: keystone_identity_uri}
                 neutron::db::mysql::password: {get_input: neutron_password}
+                neutron::keystone::auth::public_url: {get_input: neutron_public_url }
+                neutron::keystone::auth::internal_url: {get_input: neutron_internal_url }
+                neutron::keystone::auth::admin_url: {get_input: neutron_admin_url }
+                neutron::keystone::auth::password: {get_input: neutron_password }
+                neutron::keystone::auth::region: {get_input: keystone_region}
+                neutron::server::notifications::nova_url: {get_input: nova_internal_url}
+                neutron::server::notifications::auth_url: {get_input: neutron_admin_auth_url}
+                neutron::server::notifications::tenant_name: 'service'
+                neutron::server::notifications::password: {get_input: nova_password}
 
                 # Ceilometer
                 ceilometer_backend: {get_input: ceilometer_backend}
@@ -1241,6 +1320,7 @@ resources:
                 nova::database_connection: {get_input: nova_dsn}
                 nova::glance_api_servers: {get_input: glance_api_servers}
                 nova::api::neutron_metadata_proxy_shared_secret: {get_input: neutron_metadata_proxy_shared_secret}
+                nova::api::instance_name_template: {get_input: instance_name_template}
                 nova::network::neutron::neutron_admin_password: {get_input: neutron_password}
                 nova::network::neutron::neutron_url: {get_input: neutron_internal_url}
                 nova::network::neutron::neutron_admin_auth_url: {get_input: neutron_admin_auth_url}
@@ -1264,6 +1344,9 @@ resources:
                 # Redis
                 redis::bind: {get_input: redis_network}
                 redis_vip: {get_input: redis_vip}
+                # Firewall
+                tripleo::firewall::manage_firewall: {get_input: manage_firewall}
+                tripleo::firewall::purge_firewall_rules: {get_input: purge_firewall_rules}
                 # Misc
                 memcached::listen_ip: {get_input: memcached_network}
                 neutron_public_interface_ip: {get_input: neutron_public_interface_ip}
@@ -1273,6 +1356,12 @@ resources:
                 tripleo::loadbalancer::control_virtual_interface: {get_input: control_virtual_interface}
                 tripleo::loadbalancer::public_virtual_interface: {get_input: public_virtual_interface}
                 tripleo::loadbalancer::haproxy_log_address: {get_input: haproxy_log_address}
+                # NOTE(jaosorior): The service certificate configuration for
+                # HAProxy was left commented because to properly use this, we
+                # need to be able to set up the keystone endpoints. And
+                # currently that is not possible, but is being addressed by
+                # other commits.  A subsequent commit will uncomment this.
+                #tripleo::loadbalancer::service_certificate: {get_attr: [NodeTLSData, deployed_ssl_certificate_path]}
                 tripleo::packages::enable_install: {get_input: enable_package_install}
                 tripleo::packages::enable_upgrade: {get_input: enable_package_upgrade}
 
@@ -1286,7 +1375,7 @@ resources:
   # Hook for site-specific additional pre-deployment config,
   # applying to all nodes, e.g node registration/unregistration
   NodeExtraConfig:
-    depends_on: ControllerExtraConfigPre
+    depends_on: [ControllerExtraConfigPre, NodeTLSData]
     type: OS::TripleO::NodeExtraConfig
     properties:
         server: {get_resource: Controller}
@@ -1337,9 +1426,10 @@ outputs:
       Server's IP address and hostname in the /etc/hosts format
     value:
       str_replace:
-        template: IP HOST.localdomain HOST CLOUDNAME
+        template: IP HOST.DOMAIN HOST CLOUDNAME
         params:
           IP: {get_attr: [NetIpMap, net_ip_map, {get_param: [ServiceNetMap, ControllerHostnameResolveNetwork]}]}
+          DOMAIN: {get_param: CloudDomain}
           HOST: {get_attr: [Controller, name]}
           CLOUDNAME: {get_param: CloudName}
   nova_server_resource:
@@ -1366,5 +1456,13 @@ outputs:
       list_join:
         - ','
         - - {get_attr: [ControllerDeployment, deploy_stdout]}
+          - {get_attr: [NodeTLSCAData, deploy_stdout]}
+          - {get_attr: [NodeTLSData, deploy_stdout]}
           - {get_attr: [ControllerExtraConfigPre, deploy_stdout]}
           - {get_param: UpdateIdentifier}
+  tls_key_modulus_md5:
+    description: MD5 checksum of the TLS Key Modulus
+    value: {get_attr: [NodeTLSData, key_modulus_md5]}
+  tls_cert_modulus_md5:
+    description: MD5 checksum of the TLS Certificate Modulus
+    value: {get_attr: [NodeTLSData, cert_modulus_md5]}