Merge "Ensure access to Redis is password protected"
[apex-tripleo-heat-templates.git] / puppet / manifests / overcloud_controller_pacemaker.pp
index 4959528..402a3bc 100644 (file)
@@ -62,6 +62,12 @@ if hiera('step') >= 1 {
   }
 
   $pacemaker_cluster_members = downcase(regsubst(hiera('controller_node_names'), ',', ' ', 'G'))
+  $corosync_ipv6 = str2bool(hiera('corosync_ipv6', false))
+  if $corosync_ipv6 {
+    $cluster_setup_extras = { '--ipv6' => '' }
+  } else {
+    $cluster_setup_extras = {}
+  }
   user { 'hacluster':
     ensure => present,
   } ->
@@ -69,8 +75,9 @@ if hiera('step') >= 1 {
     hacluster_pwd => hiera('hacluster_pwd'),
   } ->
   class { '::pacemaker::corosync':
-    cluster_members => $pacemaker_cluster_members,
-    setup_cluster   => $pacemaker_master,
+    cluster_members      => $pacemaker_cluster_members,
+    setup_cluster        => $pacemaker_master,
+    cluster_setup_extras => $cluster_setup_extras,
   }
   class { '::pacemaker::stonith':
     disable => !$enable_fencing,
@@ -93,12 +100,21 @@ if hiera('step') >= 1 {
   # avoid races where non-master nodes attempt to start without
   # config (eg. binding on 0.0.0.0)
   # The module ignores erlang_cookie if cluster_config is false
+  $rabbit_ipv6 = str2bool(hiera('rabbit_ipv6', false))
+  if $rabbit_ipv6 {
+      $rabbit_env = merge(hiera('rabbitmq_environment'), {
+        'RABBITMQ_SERVER_START_ARGS' => '"-proto_dist inet6_tcp"'
+      })
+  } else {
+    $rabbit_env = hiera('rabbitmq_environment')
+  }
+
   class { '::rabbitmq':
     service_manage          => false,
     tcp_keepalive           => false,
     config_kernel_variables => hiera('rabbitmq_kernel_variables'),
     config_variables        => hiera('rabbitmq_config_variables'),
-    environment_variables   => hiera('rabbitmq_environment'),
+    environment_variables   => $rabbit_env,
   } ->
   file { '/var/lib/rabbitmq/.erlang.cookie':
     ensure  => file,
@@ -185,8 +201,19 @@ if hiera('step') >= 1 {
 if hiera('step') >= 2 {
 
   # NOTE(gfidente): the following vars are needed on all nodes so they
-  # need to stay out of pacemaker_master conditional
-  $mongo_node_ips_with_port = suffix(hiera('mongo_node_ips'), ':27017')
+  # need to stay out of pacemaker_master conditional.
+  # The addresses mangling will hopefully go away when we'll be able to
+  # configure the connection string via hostnames, until then, we need to pass
+  # the list of IPv6 addresses *with* port and without the brackets as 'members'
+  # argument for the 'mongodb_replset' resource.
+  if str2bool(hiera('mongodb::server::ipv6', false)) {
+    $mongo_node_ips_with_port_prefixed = prefix(hiera('mongo_node_ips'), '[')
+    $mongo_node_ips_with_port = suffix($mongo_node_ips_with_port_prefixed, ']:27017')
+    $mongo_node_ips_with_port_nobr = suffix(hiera('mongo_node_ips'), ':27017')
+  } else {
+    $mongo_node_ips_with_port = suffix(hiera('mongo_node_ips'), ':27017')
+    $mongo_node_ips_with_port_nobr = suffix(hiera('mongo_node_ips'), ':27017')
+  }
   $mongodb_replset = hiera('mongodb::server::replset')
 
   if $pacemaker_master {
@@ -195,6 +222,11 @@ if hiera('step') >= 2 {
 
       include ::pacemaker::resource_defaults
 
+      # Create an openstack-core dummy resource. See RHBZ 1290121
+      pacemaker::resource::ocf { 'openstack-core':
+        ocf_agent_name => 'heartbeat:Dummy',
+        clone_params   => true,
+      }
       # FIXME: we should not have to access tripleo::loadbalancer class
       # parameters here to configure pacemaker VIPs. The configuration
       # of pacemaker VIPs could move into puppet-tripleo or we should
@@ -204,8 +236,14 @@ if hiera('step') >= 2 {
       }
 
       $control_vip = hiera('tripleo::loadbalancer::controller_virtual_ip')
+      if is_ipv6_address($control_vip) {
+        $control_vip_netmask = '64'
+      } else {
+        $control_vip_netmask = '32'
+      }
       pacemaker::resource::ip { 'control_vip':
-        ip_address => $control_vip,
+        ip_address   => $control_vip,
+        cidr_netmask => $control_vip_netmask,
       }
       pacemaker::constraint::base { 'control_vip-then-haproxy':
         constraint_type   => 'order',
@@ -226,9 +264,15 @@ if hiera('step') >= 2 {
       }
 
       $public_vip = hiera('tripleo::loadbalancer::public_virtual_ip')
+      if is_ipv6_address($public_vip) {
+        $public_vip_netmask = '64'
+      } else {
+        $public_vip_netmask = '32'
+      }
       if $public_vip and $public_vip != $control_vip {
         pacemaker::resource::ip { 'public_vip':
-          ip_address => $public_vip,
+          ip_address   => $public_vip,
+          cidr_netmask => $public_vip_netmask,
         }
         pacemaker::constraint::base { 'public_vip-then-haproxy':
           constraint_type   => 'order',
@@ -250,9 +294,15 @@ if hiera('step') >= 2 {
       }
 
       $redis_vip = hiera('redis_vip')
+      if is_ipv6_address($redis_vip) {
+        $redis_vip_netmask = '64'
+      } else {
+        $redis_vip_netmask = '32'
+      }
       if $redis_vip and $redis_vip != $control_vip {
         pacemaker::resource::ip { 'redis_vip':
-          ip_address => $redis_vip,
+          ip_address   => $redis_vip,
+          cidr_netmask => $redis_vip_netmask,
         }
         pacemaker::constraint::base { 'redis_vip-then-haproxy':
           constraint_type   => 'order',
@@ -274,9 +324,15 @@ if hiera('step') >= 2 {
       }
 
       $internal_api_vip = hiera('tripleo::loadbalancer::internal_api_virtual_ip')
+      if is_ipv6_address($internal_api_vip) {
+        $internal_api_vip_netmask = '64'
+      } else {
+        $internal_api_vip_netmask = '32'
+      }
       if $internal_api_vip and $internal_api_vip != $control_vip {
         pacemaker::resource::ip { 'internal_api_vip':
-          ip_address => $internal_api_vip,
+          ip_address   => $internal_api_vip,
+          cidr_netmask => $internal_api_vip_netmask,
         }
         pacemaker::constraint::base { 'internal_api_vip-then-haproxy':
           constraint_type   => 'order',
@@ -298,9 +354,15 @@ if hiera('step') >= 2 {
       }
 
       $storage_vip = hiera('tripleo::loadbalancer::storage_virtual_ip')
+      if is_ipv6_address($storage_vip) {
+        $storage_vip_netmask = '64'
+      } else {
+        $storage_vip_netmask = '32'
+      }
       if $storage_vip and $storage_vip != $control_vip {
         pacemaker::resource::ip { 'storage_vip':
-          ip_address => $storage_vip,
+          ip_address   => $storage_vip,
+          cidr_netmask => $storage_vip_netmask,
         }
         pacemaker::constraint::base { 'storage_vip-then-haproxy':
           constraint_type   => 'order',
@@ -322,9 +384,15 @@ if hiera('step') >= 2 {
       }
 
       $storage_mgmt_vip = hiera('tripleo::loadbalancer::storage_mgmt_virtual_ip')
+      if is_ipv6_address($storage_mgmt_vip) {
+        $storage_mgmt_vip_netmask = '64'
+      } else {
+        $storage_mgmt_vip_netmask = '32'
+      }
       if $storage_mgmt_vip and $storage_mgmt_vip != $control_vip {
         pacemaker::resource::ip { 'storage_mgmt_vip':
-          ip_address => $storage_mgmt_vip,
+          ip_address   => $storage_mgmt_vip,
+          cidr_netmask => $storage_mgmt_vip_netmask,
         }
         pacemaker::constraint::base { 'storage_mgmt_vip-then-haproxy':
           constraint_type   => 'order',
@@ -374,7 +442,7 @@ if hiera('step') >= 2 {
         before  => Mongodb_replset[$mongodb_replset],
       }
       mongodb_replset { $mongodb_replset :
-        members => $mongo_node_ips_with_port,
+        members => $mongo_node_ips_with_port_nobr,
       }
     }
 
@@ -469,8 +537,15 @@ MYSQL_HOST=localhost\n",
   $enable_ceph = hiera('ceph_storage_count', 0) > 0 or hiera('enable_ceph_storage', false)
 
   if $enable_ceph {
+    $mon_initial_members = downcase(hiera('ceph_mon_initial_members'))
+    if str2bool(hiera('ceph_ipv6', false)) {
+      $mon_host = hiera('ceph_mon_host_v6')
+    } else {
+      $mon_host = hiera('ceph_mon_host')
+    }
     class { '::ceph::profile::params':
-      mon_initial_members => downcase(hiera('ceph_mon_initial_members')),
+      mon_initial_members => $mon_initial_members,
+      mon_host            => $mon_host,
     }
     include ::ceph::conf
     include ::ceph::profile::mon
@@ -496,6 +571,14 @@ MYSQL_HOST=localhost\n",
   }
 
   if str2bool(hiera('enable_external_ceph', false)) {
+    if str2bool(hiera('ceph_ipv6', false)) {
+      $mon_host = hiera('ceph_mon_host_v6')
+    } else {
+      $mon_host = hiera('ceph_mon_host')
+    }
+    class { '::ceph::profile::params':
+      mon_host            => $mon_host,
+    }
     include ::ceph::conf
     include ::ceph::profile::client
   }
@@ -577,11 +660,8 @@ if hiera('step') >= 3 {
     manage_service => false,
     enabled        => false,
   }
+  include ::glance::notify::rabbitmq
   include join(['::glance::backend::', $glance_backend])
-  $rabbit_port = hiera('rabbitmq::port')
-  class { '::glance::notify::rabbitmq':
-    rabbit_hosts => suffix(hiera('rabbit_node_ips'), ":${rabbit_port}"),
-  }
 
   $nova_ipv6 = hiera('nova::use_ipv6', false)
   if $nova_ipv6 {
@@ -905,7 +985,7 @@ if hiera('step') >= 3 {
 
   $cinder_enabled_backends = delete_undef_values([$cinder_iscsi_backend, $cinder_rbd_backend, $cinder_eqlx_backend, $cinder_dellsc_backend, $cinder_netapp_backend, $cinder_nfs_backend])
   class { '::cinder::backends' :
-    enabled_backends => $cinder_enabled_backends,
+    enabled_backends => union($cinder_enabled_backends, hiera('cinder_user_enabled_backends')),
   }
 
   class { '::sahara':
@@ -1045,32 +1125,6 @@ if hiera('step') >= 3 {
     neutron_options => $neutron_options,
   }
 
-  # Aodh
-  class { '::aodh' :
-    database_connection => $ceilometer_database_connection,
-  }
-  include ::aodh::config
-  include ::aodh::auth
-  include ::aodh::client
-  include ::aodh::wsgi::apache
-  class { '::aodh::api':
-    manage_service => false,
-    enabled        => false,
-    service_name   => 'httpd',
-  }
-  class { '::aodh::evaluator':
-    manage_service => false,
-    enabled        => false,
-  }
-  class { '::aodh::notifier':
-    manage_service => false,
-    enabled        => false,
-  }
-  class { '::aodh::listener':
-    manage_service => false,
-    enabled        => false,
-  }
-
   $snmpd_user = hiera('snmpd_readonly_user_name')
   snmp::snmpv3_user { $snmpd_user:
     authtype => 'MD5',
@@ -1078,7 +1132,7 @@ if hiera('step') >= 3 {
   }
   class { '::snmp':
     agentaddress => ['udp:161','udp6:[::1]:161'],
-    snmpd_config => [ join(['rouser ', hiera('snmpd_readonly_user_name')]), 'proc  cron', 'includeAllDisks  10%', 'master agentx', 'trapsink localhost public', 'iquerySecName internalUser', 'rouser internalUser', 'defaultMonitors yes', 'linkUpDownNotifications yes' ],
+    snmpd_config => [ join(['createUser ', hiera('snmpd_readonly_user_name'), ' MD5 "', hiera('snmpd_readonly_user_password'), '"']), join(['rouser ', hiera('snmpd_readonly_user_name')]), 'proc  cron', 'includeAllDisks  10%', 'master agentx', 'trapsink localhost public', 'iquerySecName internalUser', 'rouser internalUser', 'defaultMonitors yes', 'linkUpDownNotifications yes' ],
   }
 
   hiera_include('controller_classes')
@@ -1110,45 +1164,55 @@ if hiera('step') >= 4 {
       pacemaker::constraint::base { 'haproxy-then-keystone-constraint':
         constraint_type => 'order',
         first_resource  => 'haproxy-clone',
-        second_resource => "${::apache::params::service_name}-clone",
+        second_resource => 'openstack-core-clone',
         first_action    => 'start',
         second_action   => 'start',
         require         => [Pacemaker::Resource::Service['haproxy'],
-                            Pacemaker::Resource::Service[$::apache::params::service_name]],
+                            Pacemaker::Resource::Ocf['openstack-core']],
       }
     }
+
+    pacemaker::constraint::base { 'openstack-core-then-httpd-constraint':
+      constraint_type => 'order',
+      first_resource  => 'openstack-core-clone',
+      second_resource => "${::apache::params::service_name}-clone",
+      first_action    => 'start',
+      second_action   => 'start',
+      require         => [Pacemaker::Resource::Service[$::apache::params::service_name],
+                          Pacemaker::Resource::Ocf['openstack-core']],
+    }
     pacemaker::constraint::base { 'rabbitmq-then-keystone-constraint':
       constraint_type => 'order',
       first_resource  => 'rabbitmq-clone',
-      second_resource => "${::apache::params::service_name}-clone",
+      second_resource => 'openstack-core-clone',
       first_action    => 'start',
       second_action   => 'start',
       require         => [Pacemaker::Resource::Ocf['rabbitmq'],
-                          Pacemaker::Resource::Service[$::apache::params::service_name]],
+                          Pacemaker::Resource::Ocf['openstack-core']],
     }
-    pacemaker::constraint::base { 'memcached-then-keystone-constraint':
+    pacemaker::constraint::base { 'memcached-then-openstack-core-constraint':
       constraint_type => 'order',
       first_resource  => 'memcached-clone',
-      second_resource => "${::apache::params::service_name}-clone",
+      second_resource => 'openstack-core-clone',
       first_action    => 'start',
       second_action   => 'start',
       require         => [Pacemaker::Resource::Service['memcached'],
-                          Pacemaker::Resource::Service[$::apache::params::service_name]],
+                          Pacemaker::Resource::Ocf['openstack-core']],
     }
-    pacemaker::constraint::base { 'galera-then-keystone-constraint':
+    pacemaker::constraint::base { 'galera-then-openstack-core-constraint':
       constraint_type => 'order',
       first_resource  => 'galera-master',
-      second_resource => "${::apache::params::service_name}-clone",
+      second_resource => 'openstack-core-clone',
       first_action    => 'promote',
       second_action   => 'start',
       require         => [Pacemaker::Resource::Ocf['galera'],
-                          Pacemaker::Resource::Service[$::apache::params::service_name]],
+                          Pacemaker::Resource::Ocf['openstack-core']],
     }
 
     # Cinder
     pacemaker::resource::service { $::cinder::params::api_service :
       clone_params => 'interleave=true',
-      require      => Pacemaker::Resource::Service[$::apache::params::service_name],
+      require      => Pacemaker::Resource::Ocf['openstack-core'],
     }
     pacemaker::resource::service { $::cinder::params::scheduler_service :
       clone_params => 'interleave=true',
@@ -1157,12 +1221,12 @@ if hiera('step') >= 4 {
 
     pacemaker::constraint::base { 'keystone-then-cinder-api-constraint':
       constraint_type => 'order',
-      first_resource  => "${::apache::params::service_name}-clone",
+      first_resource  => 'openstack-core-clone',
       second_resource => "${::cinder::params::api_service}-clone",
       first_action    => 'start',
       second_action   => 'start',
-      require         => [Pacemaker::Resource::Service[$::cinder::params::api_service],
-                          Pacemaker::Resource::Service[$::apache::params::service_name]],
+      require         => [Pacemaker::Resource::Ocf['openstack-core'],
+                          Pacemaker::Resource::Service[$::cinder::params::api_service]],
     }
     pacemaker::constraint::base { 'cinder-api-then-cinder-scheduler-constraint':
       constraint_type => 'order',
@@ -1200,25 +1264,25 @@ if hiera('step') >= 4 {
     # Sahara
     pacemaker::resource::service { $::sahara::params::api_service_name :
       clone_params => 'interleave=true',
-      require      => Pacemaker::Resource::Service[$::apache::params::service_name],
+      require      => Pacemaker::Resource::Ocf['openstack-core'],
     }
     pacemaker::resource::service { $::sahara::params::engine_service_name :
       clone_params => 'interleave=true',
     }
     pacemaker::constraint::base { 'keystone-then-sahara-api-constraint':
       constraint_type => 'order',
-      first_resource  => "${::apache::params::service_name}-clone",
+      first_resource  => 'openstack-core-clone',
       second_resource => "${::sahara::params::api_service_name}-clone",
       first_action    => 'start',
       second_action   => 'start',
       require         => [Pacemaker::Resource::Service[$::sahara::params::api_service_name],
-                          Pacemaker::Resource::Service[$::apache::params::service_name]],
+                          Pacemaker::Resource::Ocf['openstack-core']],
     }
 
     # Glance
     pacemaker::resource::service { $::glance::params::registry_service_name :
       clone_params => 'interleave=true',
-      require      => Pacemaker::Resource::Service[$::apache::params::service_name],
+      require      => Pacemaker::Resource::Ocf['openstack-core'],
     }
     pacemaker::resource::service { $::glance::params::api_service_name :
       clone_params => 'interleave=true',
@@ -1226,12 +1290,12 @@ if hiera('step') >= 4 {
 
     pacemaker::constraint::base { 'keystone-then-glance-registry-constraint':
       constraint_type => 'order',
-      first_resource  => "${::apache::params::service_name}-clone",
+      first_resource  => 'openstack-core-clone',
       second_resource => "${::glance::params::registry_service_name}-clone",
       first_action    => 'start',
       second_action   => 'start',
       require         => [Pacemaker::Resource::Service[$::glance::params::registry_service_name],
-                          Pacemaker::Resource::Service[$::apache::params::service_name]],
+                          Pacemaker::Resource::Ocf['openstack-core']],
     }
     pacemaker::constraint::base { 'glance-registry-then-glance-api-constraint':
       constraint_type => 'order',
@@ -1269,12 +1333,12 @@ if hiera('step') >= 4 {
       } ->
       pacemaker::resource::service { $::neutron::params::server_service:
         clone_params => 'interleave=true',
-        require      => Pacemaker::Resource::Service[$::apache::params::service_name]
+        require      => Pacemaker::Resource::Ocf['openstack-core']
       }
     } else {
       pacemaker::resource::service { $::neutron::params::server_service:
         clone_params => 'interleave=true',
-        require      => Pacemaker::Resource::Service[$::apache::params::service_name]
+        require      => Pacemaker::Resource::Ocf['openstack-core']
       }
     }
     if hiera('neutron::enable_l3_agent', true) {
@@ -1347,14 +1411,14 @@ if hiera('step') >= 4 {
       }
     }
     pacemaker::constraint::base { 'keystone-to-neutron-server-constraint':
-      constraint_type   => 'order',
-      first_resource    => "${::apache::params::service_name}-clone",
-        second_resource => "${::neutron::params::server_service}-clone",
-        first_action    => 'start',
-        second_action   => 'start',
-        require         => [Pacemaker::Resource::Service[$::apache::params::service_name],
-                            Pacemaker::Resource::Service[$::neutron::params::server_service]],
-      }
+      constraint_type => 'order',
+      first_resource  => 'openstack-core-clone',
+      second_resource => "${::neutron::params::server_service}-clone",
+      first_action    => 'start',
+      second_action   => 'start',
+      require         => [Pacemaker::Resource::Ocf['openstack-core'],
+                          Pacemaker::Resource::Service[$::neutron::params::server_service]],
+    }
     if hiera('neutron::enable_ovs_agent',true) {
       pacemaker::constraint::base { 'neutron-openvswitch-agent-to-dhcp-agent-constraint':
         constraint_type => 'order',
@@ -1468,7 +1532,7 @@ if hiera('step') >= 4 {
     }
     pacemaker::resource::service { $::nova::params::consoleauth_service_name :
       clone_params => 'interleave=true',
-      require      => Pacemaker::Resource::Service[$::apache::params::service_name],
+      require      => Pacemaker::Resource::Ocf['openstack-core'],
     }
     pacemaker::resource::service { $::nova::params::vncproxy_service_name :
       clone_params => 'interleave=true',
@@ -1479,12 +1543,12 @@ if hiera('step') >= 4 {
 
     pacemaker::constraint::base { 'keystone-then-nova-consoleauth-constraint':
       constraint_type => 'order',
-      first_resource  => "${::apache::params::service_name}-clone",
+      first_resource  => 'openstack-core-clone',
       second_resource => "${::nova::params::consoleauth_service_name}-clone",
       first_action    => 'start',
       second_action   => 'start',
       require         => [Pacemaker::Resource::Service[$::nova::params::consoleauth_service_name],
-                          Pacemaker::Resource::Service[$::apache::params::service_name]],
+                          Pacemaker::Resource::Ocf['openstack-core']],
     }
     pacemaker::constraint::base { 'nova-consoleauth-then-nova-vncproxy-constraint':
       constraint_type => 'order',
@@ -1551,19 +1615,19 @@ if hiera('step') >= 4 {
                   Pacemaker::Resource::Service[$::nova::params::conductor_service_name]],
     }
 
-    # Ceilometer and Aodh
+    # Ceilometer
     case downcase(hiera('ceilometer_backend')) {
       /mysql/: {
-        pacemaker::resource::service { $::ceilometer::params::agent_central_service_name :
+        pacemaker::resource::service { $::ceilometer::params::agent_central_service_name:
           clone_params => 'interleave=true',
-          require      => Pacemaker::Resource::Service[$::apache::params::service_name],
+          require      => Pacemaker::Resource::Ocf['openstack-core'],
         }
       }
       default: {
-        pacemaker::resource::service { $::ceilometer::params::agent_central_service_name :
+        pacemaker::resource::service { $::ceilometer::params::agent_central_service_name:
           clone_params => 'interleave=true',
-          require      => [Pacemaker::Resource::Service[$::apache::params::service_name],
-          Pacemaker::Resource::Service[$::mongodb::params::service_name]],
+          require      => [Pacemaker::Resource::Ocf['openstack-core'],
+                          Pacemaker::Resource::Service[$::mongodb::params::service_name]],
         }
       }
     }
@@ -1584,10 +1648,8 @@ if hiera('step') >= 4 {
     # Fedora doesn't know `require-all` parameter for constraints yet
     if $::operatingsystem == 'Fedora' {
       $redis_ceilometer_constraint_params = undef
-      $redis_aodh_constraint_params = undef
     } else {
       $redis_ceilometer_constraint_params = 'require-all=false'
-      $redis_aodh_constraint_params = 'require-all=false'
     }
     pacemaker::constraint::base { 'redis-then-ceilometer-central-constraint':
       constraint_type   => 'order',
@@ -1599,24 +1661,14 @@ if hiera('step') >= 4 {
       require           => [Pacemaker::Resource::Ocf['redis'],
                             Pacemaker::Resource::Service[$::ceilometer::params::agent_central_service_name]],
     }
-    pacemaker::constraint::base { 'redis-then-aodh-evaluator-constraint':
-      constraint_type   => 'order',
-      first_resource    => 'redis-master',
-      second_resource   => "${::aodh::params::evaluator_service_name}-clone",
-      first_action      => 'promote',
-      second_action     => 'start',
-      constraint_params => $redis_aodh_constraint_params,
-      require           => [Pacemaker::Resource::Ocf['redis'],
-                            Pacemaker::Resource::Service[$::aodh::params::evaluator_service_name]],
-    }
     pacemaker::constraint::base { 'keystone-then-ceilometer-central-constraint':
       constraint_type => 'order',
-      first_resource  => "${::apache::params::service_name}-clone",
+      first_resource  => 'openstack-core-clone',
       second_resource => "${::ceilometer::params::agent_central_service_name}-clone",
       first_action    => 'start',
       second_action   => 'start',
       require         => [Pacemaker::Resource::Service[$::ceilometer::params::agent_central_service_name],
-                          Pacemaker::Resource::Service[$::apache::params::service_name]],
+                          Pacemaker::Resource::Ocf['openstack-core']],
     }
     pacemaker::constraint::base { 'ceilometer-central-then-ceilometer-collector-constraint':
       constraint_type => 'order',
@@ -1659,60 +1711,6 @@ if hiera('step') >= 4 {
       require => [Pacemaker::Resource::Service[$::ceilometer::params::api_service_name],
                   Pacemaker::Resource::Ocf['delay']],
     }
-    # Aodh
-    pacemaker::resource::service { $::aodh::params::api_service_name :
-      clone_params => 'interleave=true',
-    }
-    pacemaker::resource::service { $::aodh::params::evaluator_service_name :
-      clone_params => 'interleave=true',
-    }
-    pacemaker::resource::service { $::aodh::params::notifier_service_name :
-      clone_params => 'interleave=true',
-    }
-    pacemaker::resource::service { $::aodh::params::listener_service_name :
-      clone_params => 'interleave=true',
-    }
-    pacemaker::constraint::base { 'keystone-then-aodh-api-constraint':
-      constraint_type => 'order',
-      first_resource  => "${::apache::params::service_name}-clone",
-      second_resource => "${::aodh::params::api_service_name}-clone",
-      first_action    => 'start',
-      second_action   => 'start',
-      require         => [Pacemaker::Resource::Service[$::aodh::params::api_service_name],
-                          Pacemaker::Resource::Service[$::apache::params::service_name]],
-    }
-    pacemaker::constraint::base { 'aodh-delay-then-aodh-evaluator-constraint':
-      constraint_type => 'order',
-      first_resource  => 'delay-clone',
-      second_resource => "${::aodh::params::evaluator_service_name}-clone",
-      first_action    => 'start',
-      second_action   => 'start',
-      require         => [Pacemaker::Resource::Service[$::aodh::params::evaluator_service_name],
-                          Pacemaker::Resource::Ocf['delay']],
-    }
-    pacemaker::constraint::colocation { 'aodh-evaluator-with-aodh-delay-colocation':
-      source  => "${::aodh::params::evaluator_service_name}-clone",
-      target  => 'delay-clone',
-      score   => 'INFINITY',
-      require => [Pacemaker::Resource::Service[$::horizon::params::http_service],
-                  Pacemaker::Resource::Ocf['delay']],
-    }
-    pacemaker::constraint::base { 'aodh-evaluator-then-aodh-notifier-constraint':
-      constraint_type => 'order',
-      first_resource  => "${::aodh::params::evaluator_service_name}-clone",
-      second_resource => "${::aodh::params::notifier_service_name}-clone",
-      first_action    => 'start',
-      second_action   => 'start',
-      require         => [Pacemaker::Resource::Service[$::aodh::params::evaluator_service_name],
-                          Pacemaker::Resource::Service[$::aodh::params::notifier_service_name]],
-    }
-    pacemaker::constraint::colocation { 'aodh-notifier-with-aodh-evaluator-colocation':
-      source  => "${::aodh::params::notifier_service_name}-clone",
-      target  => "${::aodh::params::evaluator_service_name}-clone",
-      score   => 'INFINITY',
-      require => [Pacemaker::Resource::Service[$::aodh::params::evaluator_service_name],
-                  Pacemaker::Resource::Service[$::aodh::params::notifier_service_name]],
-    }
     if downcase(hiera('ceilometer_backend')) == 'mongodb' {
       pacemaker::constraint::base { 'mongodb-then-ceilometer-central-constraint':
         constraint_type => 'order',
@@ -1740,12 +1738,12 @@ if hiera('step') >= 4 {
     }
     pacemaker::constraint::base { 'keystone-then-heat-api-constraint':
       constraint_type => 'order',
-      first_resource  => "${::apache::params::service_name}-clone",
+      first_resource  => 'openstack-core-clone',
       second_resource => "${::heat::params::api_service_name}-clone",
       first_action    => 'start',
       second_action   => 'start',
       require         => [Pacemaker::Resource::Service[$::heat::params::api_service_name],
-                          Pacemaker::Resource::Service[$::apache::params::service_name]],
+                          Pacemaker::Resource::Ocf['openstack-core']],
     }
     pacemaker::constraint::base { 'heat-api-then-heat-api-cfn-constraint':
       constraint_type => 'order',
@@ -1853,6 +1851,16 @@ if hiera('step') >= 5 {
     class {'::keystone::endpoint' :
       require => Pacemaker::Resource::Service[$::apache::params::service_name],
     }
+    include ::heat::keystone::domain
+    Class['::keystone::roles::admin'] -> Class['::heat::keystone::domain']
+
+  } else {
+    # On non-master controller we don't need to create Keystone resources again
+    class { '::heat::keystone::domain':
+      manage_domain => false,
+      manage_user   => false,
+      manage_role   => false,
+    }
   }
 
 } #END STEP 5