Add parameters for setting up keystone keys/certs in undercloud
[apex-tripleo-heat-templates.git] / undercloud-source.yaml
index 2bf927f..a78e069 100644 (file)
@@ -11,10 +11,71 @@ Parameters:
     Description: The keystone auth secret.
     Type: String
     NoEcho: true
+  CinderLVMLoopDeviceSize:
+    Default: 5000
+    Description: The size of the loopback file used by the cinder LVM driver.
+    Type: Number
   BaremetalArch:
     Default: i386
     Description: The architecture to use in Nova-BM - i386 or amd64.
     Type: String
+  CeilometerMeteringSecret:
+    Default: unset
+    Description: Secret shared by the ceilometer services.
+    Type: String
+    NoEcho: true
+  CeilometerPassword:
+    Default: unset
+    Description: The password for the ceilometer service account.
+    Type: String
+    NoEcho: true
+  SnmpdReadonlyUserName:
+    Default: ro_snmp_user
+    Description: The user name for SNMPd with readonly rights running on all Overcloud nodes
+    Type: String
+  SnmpdReadonlyUserPassword:
+    Default: unset
+    Description: The user password for SNMPd with readonly rights running on all Overcloud nodes
+    Type: String
+    NoEcho: true
+  ExtraConfig:
+    Default: {}
+    Description: |
+      Additional configuration to inject into the cluster. The JSON should have
+      the following structure:
+        {"FILEKEY":
+          {"config:
+            [{"section": "SECTIONNAME",
+              "values":
+               [{"option": "OPTIONNAME",
+                  "value": "VALUENAME"
+                }
+               ]
+             }
+            ]
+          }
+        }
+      For instance:
+        {"nova":
+          {"config":
+            [{"section": "default",
+              "values":
+                [{"option": "compute_manager",
+                  "value": "ironic.nova.compute.manager.ClusterComputeManager"
+                 }
+                ]
+             },
+             {"section": "cells",
+              "values":
+                [{"option": "driver",
+                  "value": "nova.cells.rpc_driver.CellsRPCDriver"
+                 }
+                ]
+             }
+            ]
+          }
+        }
+    Type: Json
   Flavor:
     Default: baremetal
     Description: Flavor to request when deploying.
@@ -42,7 +103,7 @@ Parameters:
     Type: String
     NoEcho: true
   ImageUpdatePolicy:
-    Default: REPLACE
+    Default: REBUILD_PRESERVE_EPHEMERAL
     Description: What policy to use when reconstructing instances. REBUILD for rebuilds,
       REBUILD_PRESERVE_EPHEMERAL to preserve /mnt.
     Type: String
@@ -59,6 +120,21 @@ Parameters:
     Description: The password for the nova service account, used by nova-api.
     Type: String
     NoEcho: true
+  NeutronPublicInterfaceDefaultRoute:
+    Default: ''
+    Description: A custom default route for the NeutronPublicInterface.
+    Type: String
+  NeutronPublicInterfaceIP:
+    Default: ''
+    Description: A custom IP address to put onto the NeutronPublicInterface.
+    Type: String
+  NeutronPublicInterfaceRawDevice:
+    Default: ''
+    Description: If set, the public interface is a vlan with this device as the raw device.
+    Type: String
+  NtpServer:
+    Type: String
+    Default: ''
   RabbitUserName:
     Default: guest
     Description: The username for RabbitMQ
@@ -78,9 +154,25 @@ Parameters:
     Default: ''
     NoEcho: true
   MysqlInnodbBufferPoolSize:
-    Description: Specifies the size of the buffer pool in megabytes.
+    Description: >
+        Specifies the size of the buffer pool in megabytes. Setting to
+        zero should be interpreted as "no value" and will defer to the
+        lower level default.
     Type: Number
-    Default: 100
+    Default: 0
+  KeystoneCACertificate:
+    Default: ''
+    Description: Keystone self-signed certificate authority certificate.
+    Type: String
+  KeystoneSigningCertificate:
+    Default: ''
+    Description: Keystone certificate for verifying token validity.
+    Type: String
+  KeystoneSigningKey:
+    Default: ''
+    Description: Keystone key for signing tokens.
+    Type: String
+    NoEcho: true
 Resources:
   RabbitCookie:
     Type: OS::Heat::RandomString
@@ -88,151 +180,108 @@ Resources:
       length: 20
       salt:
         Ref: RabbitCookieSalt
-  AccessPolicy:
-    Properties:
-      AllowedResources:
-      - undercloudConfig
-    Type: OS::Heat::AccessPolicy
-  notCompute0Key:
-    Properties:
-      UserName:
-        Ref: User
-    Type: AWS::IAM::AccessKey
-  notCompute0CompletionCondition:
-    Type: AWS::CloudFormation::WaitCondition
-    DependsOn: undercloud
-    Properties:
-      Handle: {Ref: notCompute0CompletionHandle}
-      Count: '1'
-      Timeout: '1800'
-  notCompute0CompletionHandle:
-    Type: AWS::CloudFormation::WaitConditionHandle
-  User:
-    Properties:
-      Policies:
-      - Ref: AccessPolicy
-    Type: AWS::IAM::User
   undercloudConfig:
-    Type: AWS::AutoScaling::LaunchConfiguration
+    Type: OS::Heat::StructuredConfig
     Properties:
-      ImageId: '0'
-      InstanceType: foo
-    Metadata:
-      OpenStack::Role: undercloudConfig
-      OpenStack::Heat::Stack: {}
-      OpenStack::ImageBuilder::Elements: [ boot-stack, heat-cfntools, neutron-network-node ]
-      admin-password:
-        Ref: AdminPassword
-      admin-token: 
-        Ref: AdminToken
-      controller-address:
-        Fn::Select:
-          - 0
-          - Fn::Select:
-            - "ctlplane"
-            - Fn::GetAtt:
-              - undercloud
-              - networks
-      cinder:
-        db: mysql://cinder:unset@localhost/cinder
-        volume_size_mb: '5000'
-      completion-handle:
-        Ref: notCompute0CompletionHandle
-      db-password: unset
-      glance:
-        backend: file
-        db: mysql://glance:unset@localhost/glance
-        host: 127.0.0.1
-        service-password:
-          Ref: GlancePassword
-        notifier-strategy:
-          Ref: GlanceNotifierStrategy
-        log-file:
-          Ref: GlanceLogFile
-      heat:
-        admin_password:
-          Ref: HeatPassword
-        admin_tenant_name: service
-        admin_user: heat
-        auth_encryption_key: unset___________
-        db: mysql://heat:unset@localhost/heat
-        stack_domain_admin_password: {Ref: HeatStackDomainAdminPassword}
-        watch_server_url:
-          Fn::Join:
-            - ''
-            - - http://
-              - Fn::Select:
-                  - 0
-                  - Fn::Select:
-                    - "ctlplane"
-                    - Fn::GetAtt:
-                      - undercloud
-                      - networks
-              - ":8003"
-        metadata_server_url:
-          Fn::Join:
-            - ''
-            - - http://
-              - Fn::Select:
-                  - 0
-                  - Fn::Select:
-                    - "ctlplane"
-                    - Fn::GetAtt:
-                      - undercloud
-                      - networks
-              - ":8000"
-        waitcondition_server_url:
-          Fn::Join:
-            - ''
-            - - http://
-              - Fn::Select:
-                  - 0
+      config:
+        completion-signal: {get_input: deploy_signal_id}
+        admin-password:
+          Ref: AdminPassword
+        admin-token:
+          Ref: AdminToken
+        bootstrap_host:
+          bootstrap_nodeid:
+            Fn::Select:
+            - 0
+            - Fn::Select:
+              - 0
+              - Merge::Map:
+                  undercloud:
                   - Fn::Select:
-                    - "ctlplane"
+                    - name
                     - Fn::GetAtt:
                       - undercloud
-                      - networks
-              - ":8000/v1/waitcondition"
-      os-collect-config:
-        cfn:
-          access_key_id:
-            Ref: notCompute0Key
-          path: undercloudConfig.Metadata
-          secret_access_key:
+                      - show
+          nodeid: {get_input: bootstack_nodeid}
+        bootstack:
+          public_interface_ip:
+            Ref: NeutronPublicInterfaceIP
+        controller-address:
+          get_input: controller_host
+        ceilometer:
+          db: mysql://ceilometer:unset@localhost/ceilometer
+          metering_secret: {Ref: CeilometerMeteringSecret}
+          snmpd_readonly_user_name:
+            Ref: SnmpdReadonlyUserName
+          snmpd_readonly_user_password:
+            Ref: SnmpdReadonlyUserPassword
+          service-password:
+            Ref: CeilometerPassword
+        db-password: unset
+        glance:
+          backend: file
+          db: mysql://glance:unset@localhost/glance
+          host: 127.0.0.1
+          service-password:
+            Ref: GlancePassword
+          notifier-strategy:
+            Ref: GlanceNotifierStrategy
+          log-file:
+            Ref: GlanceLogFile
+        heat:
+          admin_password:
+            Ref: HeatPassword
+          admin_tenant_name: service
+          admin_user: heat
+          auth_encryption_key: unset___________
+          db: mysql://heat:unset@localhost/heat
+          stack_domain_admin_password: {Ref: HeatStackDomainAdminPassword}
+          watch_server_url: {get_input: heat.watch_server_url}
+          metadata_server_url: {get_input: heat.metadata_server_url}
+          waitcondition_server_url: {get_input: heat.waitcondition_server_url}
+        keystone:
+          db: mysql://keystone:unset@localhost/keystone
+          host: 127.0.0.1
+          ca_certificate: {Ref: KeystoneCACertificate}
+          signing_key: {Ref: KeystoneSigningKey}
+          signing_certificate: {Ref: KeystoneSigningCertificate}
+        mysql:
+          innodb_buffer_pool_size: {Ref: MysqlInnodbBufferPoolSize}
+        neutron:
+          host: 127.0.0.1
+          ovs_db: mysql://neutron:unset@localhost/ovs_neutron?charset=utf8
+          ovs:
+            public_interface:
+              Ref: NeutronPublicInterface
+            public_interface_raw_device:
+              Ref: NeutronPublicInterfaceRawDevice
+            public_interface_route:
+              Ref: NeutronPublicInterfaceDefaultRoute
+            physical_bridge: br-ctlplane
+            physical_network: ctlplane
+            network_vlan_ranges: ctlplane
+            bridge_mappings: ctlplane:br-ctlplane
+            tenant_network_type: vlan
+            enable_tunneling: 'False'
+          service-password:
+            Ref: NeutronPassword
+        rabbit:
+          host: 127.0.0.1
+          username:
+            Ref: RabbitUserName
+          password:
+            Ref: RabbitPassword
+          cookie:
             Fn::GetAtt:
-            - notCompute0Key
-            - SecretAccessKey
-          stack_name:
-            Ref: AWS::StackName
-      keystone:
-        db: mysql://keystone:unset@localhost/keystone
-        host: 127.0.0.1
-      mysql:
-        innodb_buffer_pool_size: {Ref: MysqlInnodbBufferPoolSize}
-      neutron:
-        host: 127.0.0.1
-        ovs_db: mysql://neutron:unset@localhost/ovs_neutron?charset=utf8
-        ovs:
-          public_interface:
-            Ref: NeutronPublicInterface
-          physical_bridge: br-ctlplane
-          physical_network: ctlplane
-          network_vlan_ranges: ctlplane
-          bridge_mappings: ctlplane:br-ctlplane
-          tenant_network_type: vlan
-          enable_tunneling: 'False'
-        service-password:
-          Ref: NeutronPassword
-      rabbit:
-        host: 127.0.0.1
-        username:
-          Ref: RabbitUserName
-        password:
-          Ref: RabbitPassword
-        cookie:
-          Fn::GetAtt:
-          - RabbitCookie
-          - value
+            - RabbitCookie
+            - value
+        ntp:
+          servers:
+            - {server: {Ref: NtpServer}, fudge: "stratum 0"}
+  undercloudPassthroughConfig:
+    Type: OS::Heat::StructuredConfig
+    Properties:
+      config: {get_input: passthrough_config}
   undercloud:
     Type: OS::Nova::Server
     Properties:
@@ -244,15 +293,50 @@ Resources:
         Ref: KeyName
       image_update_policy:
         Ref: ImageUpdatePolicy
-    Metadata:
-      os-collect-config:
-        cfn:
-          access_key_id:
-            Ref: notCompute0Key
-          path: undercloudConfig.Metadata
-          secret_access_key:
-            Fn::GetAtt:
-            - notCompute0Key
-            - SecretAccessKey
-          stack_name:
-            Ref: AWS::StackName
+      user_data_format: SOFTWARE_CONFIG
+  99_undercloudDeployment:
+    Type: OS::Heat::StructuredDeployment
+    Properties:
+      config: {Ref: undercloudConfig}
+      server: {Ref: undercloud}
+      input_values:
+        bootstack_nodeid:
+          Fn::Select:
+            - name
+            - Fn::GetAtt:
+              - undercloud
+              - show
+        controller_host:
+          Fn::Select:
+            - 0
+            - Fn::Select:
+              - ctlplane
+              - Fn::GetAtt:
+                - undercloud
+                - networks
+        heat.watch_server_url:
+          Fn::Join:
+            - ''
+            - - 'http://'
+              - {"Fn::Select": [ 0, "Fn::Select": [ ctlplane, { "Fn::GetAtt": [ undercloud, networks ]}]]}
+              - ':8003'
+        heat.metadata_server_url:
+          Fn::Join:
+            - ''
+            - - 'http://'
+              - {"Fn::Select": [ 0, "Fn::Select": [ ctlplane, { "Fn::GetAtt": [ undercloud, networks ]}]]}
+              - ':8000'
+        heat.waitcondition_server_url:
+          Fn::Join:
+            - ''
+            - - 'http://'
+              - {"Fn::Select": [ 0, "Fn::Select": [ ctlplane, { "Fn::GetAtt": [ undercloud, networks ]}]]}
+              - ':8000/v1/waitcondition'
+  00_undercloudPassthroughDeployment:
+    Type: OS::Heat::StructuredDeployment
+    Properties:
+      config: {Ref: undercloudPassthroughConfig}
+      server: {Ref: undercloud}
+      signal_transport: NO_SIGNAL
+      input_values:
+        passthrough_config: {Ref: ExtraConfig}