X-Git-Url: https://gerrit.opnfv.org/gerrit/gitweb?a=blobdiff_plain;f=puppet%2Fservices%2Fkeystone.yaml;h=e48d70374dd8501c2d8eab736739fce23c03ec60;hb=22ba81cf9dd8b2690c3e8c0eee5a70dcb37e10c4;hp=d819e0430ad962ed90d22087fc16e70c9dfa6e0e;hpb=521779edd4dbeb65e0c62c48567dd478b3fab5a5;p=apex-tripleo-heat-templates.git

diff --git a/puppet/services/keystone.yaml b/puppet/services/keystone.yaml
index d819e043..e48d7037 100644
--- a/puppet/services/keystone.yaml
+++ b/puppet/services/keystone.yaml
@@ -89,7 +89,7 @@ parameters:
   KeystoneWorkers:
     type: string
     description: Set the number of workers for keystone::wsgi::apache
-    default: '"%{::os_workers}"'
+    default: '%{::os_workers}'
   MonitoringSubscriptionKeystone:
     default: 'overcloud-keystone'
     type: string
@@ -99,6 +99,12 @@ parameters:
   KeystoneCredential1:
     type: string
     description: The second Keystone credential key. Must be a valid key.
+  KeystoneFernetKey0:
+    type: string
+    description: The first Keystone fernet key. Must be a valid key.
+  KeystoneFernetKey1:
+    type: string
+    description: The second Keystone fernet key. Must be a valid key.
   KeystoneLoggingSource:
     type: json
     default:
@@ -156,6 +162,11 @@ outputs:
                 content: {get_param: KeystoneCredential0}
               '/etc/keystone/credential-keys/1':
                 content: {get_param: KeystoneCredential1}
+            keystone::fernet_keys:
+              '/etc/keystone/fernet-keys/0':
+                content: {get_param: KeystoneFernetKey0}
+              '/etc/keystone/fernet-keys/1':
+                content: {get_param: KeystoneFernetKey1}
             keystone::debug: {get_param: Debug}
             keystone::rabbit_userid: {get_param: RabbitUserName}
             keystone::rabbit_password: {get_param: RabbitPassword}
@@ -184,13 +195,13 @@ outputs:
             keystone::wsgi::apache::servername:
               str_replace:
                 template:
-                  '"%{::fqdn_$NETWORK}"'
+                  "%{hiera('fqdn_$NETWORK')}"
                 params:
                   $NETWORK: {get_param: [ServiceNetMap, KeystonePublicApiNetwork]}
             keystone::wsgi::apache::servername_admin:
               str_replace:
                 template:
-                  '"%{::fqdn_$NETWORK}"'
+                  "%{hiera('fqdn_$NETWORK')}"
                 params:
                   $NETWORK: {get_param: [ServiceNetMap, KeystoneAdminApiNetwork]}
             keystone::wsgi::apache::workers: {get_param: KeystoneWorkers}
@@ -208,13 +219,13 @@ outputs:
             keystone::admin_bind_host:
               str_replace:
                 template:
-                  '"%{::fqdn_$NETWORK}"'
+                  "%{hiera('fqdn_$NETWORK')}"
                 params:
                   $NETWORK: {get_param: [ServiceNetMap, KeystoneAdminApiNetwork]}
             keystone::public_bind_host:
               str_replace:
                 template:
-                  '"%{::fqdn_$NETWORK}"'
+                  "%{hiera('fqdn_$NETWORK')}"
                 params:
                   $NETWORK: {get_param: [ServiceNetMap, KeystonePublicApiNetwork]}
             # NOTE: bind IP is found in Heat replacing the network name with the
@@ -237,3 +248,14 @@ outputs:
           keystone::db::mysql::allowed_hosts:
             - '%'
             - "%{hiera('mysql_bind_host')}"
+      # Ansible tasks to handle upgrade
+      upgrade_tasks:
+        - name: Stop keystone service (running under httpd)
+          tags: step2
+          service: name=httpd state=stopped
+        - name: Sync keystone DB
+          tags: step5
+          command: keystone-manage db_sync
+        - name: Start keystone service (running under httpd)
+          tags: step6
+          service: name=httpd state=started