Merge "Make various password descriptions consistent"

diff --combined puppet/services/database/mysql.yaml
index 8842a0c,f39c971..abbe7a2
--- 1/puppet/services/database/mysql.yaml
--- 2/puppet/services/database/mysql.yaml
+++ b/puppet/services/database/mysql.yaml
@@@ -51,7 -51,7 +51,7 @@@ parameters
      description: Whether to use Galera instead of regular MariaDB.
      type: boolean
    NovaPassword:
-     description: The password for the nova db account
+     description: The password for the nova service and db account
      type: string
      hidden: true
    EnableInternalTLS:
@@@ -96,6 -96,10 +96,6 @@@ outputs
                      - {get_param: [DefaultPasswords, mysql_root_password]}
              mysql_clustercheck_password: {get_param: MysqlClustercheckPassword}
              enable_galera: {get_param: EnableGalera}
 -            # for now, we don't want to manage these services which are enabled
 -            # by default with recent changes in puppet-systemd.
 -            systemd::manage_networkd: false
 -            systemd::manage_resolved: false
              # NOTE: bind IP is found in Heat replacing the network name with the
              # local node IP for the given network; replacement examples
              # (eg. for internal_api):

diff --combined puppet/services/network/contrail-base.yaml
index 5e04a25,542c3d7..77c30bd
--- 1/puppet/services/network/contrail-base.yaml
--- 2/puppet/services/network/contrail-base.yaml
+++ b/puppet/services/network/contrail-base.yaml
@@@ -30,16 -30,16 +30,16 @@@ parameters
      description: Mapping of service endpoint -> protocol. Typically set
                   via parameter_defaults in the resource registry.
      type: json
 -  ContrailAAAMode:
 +  AAAMode:
      description: AAAmode can be no-auth, cloud-admin or rbac
      type: string
      default: 'rbac'
 -  ContrailAAAModeAnalytics:
 +  AAAModeAnalytics:
      description: AAAmode for analytics can be no-auth, cloud-admin or rbac
      type: string
      default: 'no-auth'
    AdminPassword:
-     description: Keystone admin user password
+     description: The password for the keystone admin account, used for monitoring, querying neutron etc.
      type: string
      hidden: true
    AdminTenantName:
@@@ -47,33 -47,25 +47,33 @@@
      type: string
      default: 'admin'
    AdminToken:
-     description: Keystone admin token
+     description: The keystone auth secret and db password.
      type: string
      hidden: true
    AdminUser:
      description: Keystone admin user name
      type: string
      default: 'admin'
 -  AuthPortSSL:
 -    default: 13357
 -    description: Keystone SSL port
 -    type: number
 -  AuthPortSSLPublic:
 -    default: 13000
 -    description: Keystone Public SSL port
 -    type: number
    ContrailAuth:
      default: 'keystone'
      description: Keystone authentication method
      type: string
 +  ContrailAnalyticsVIP:
 +    default: ''
 +    description: Contrail Analytics Api Virtual IP address
 +    type: string
 +  ContrailConfigPort:
 +    default: 8082
 +    description: Contrail Config Api port
 +    type: number
 +  ContrailConfigVIP:
 +    default: ''
 +    description: Contrail Config Virtual IP address
 +    type: string
 +  ContrailDiscoveryPort:
 +    default: 5998
 +    description: Contrail Config Api  port
 +    type: number
    ContrailInsecure:
      default: false
      description: Keystone insecure mode
@@@ -82,14 -74,6 +82,14 @@@
      default: '127.0.0.1:12111'
      description: Memcached server
      type: string
 +  ContrailVIP:
 +    default: ''
 +    description: Contrail VIP
 +    type: string
 +  ContrailWebuiVIP:
 +    default: ''
 +    description: Contrail Webui Virtual IP address
 +    type: string
    RabbitPassword:
      description: The password for RabbitMQ
      type: string
@@@ -103,49 -87,29 +103,49 @@@
      description: Set rabbit subscriber port, change this if using SSL
      type: number
  
 +conditions:
 +  contrail_config_vip_unset: {equals : [{get_param: ContrailConfigVIP}, '']}
 +  contrail_analytics_vip_unset: {equals : [{get_param: ContrailAnalyticsVIP}, '']}
 +  contrail_webui_vip_unset: {equals : [{get_param: ContrailWebuiVIP}, '']}
 +
  outputs:
    role_data:
      description: Shared role data for the Contrail services.
      value:
        service_name: contrail_base
        config_settings:
 -        contrail::aaa_mode: {get_param: ContrailAAAMode}
 -        contrail::analytics_aaa_mode: {get_param: ContrailAAAModeAnalytics}
 -        contrail::admin_password: {get_param: AdminPassword}
 -        contrail::admin_tenant_name: {get_param: AdminTenantName}
 -        contrail::admin_token: {get_param: AdminToken}
 -        contrail::admin_user: {get_param: AdminUser}
 -        contrail::auth: {get_param: ContrailAuth}
 -        contrail::auth_host: {get_param: [EndpointMap, KeystonePublic, host] }
 -        contrail::auth_port: {get_param: [EndpointMap, KeystoneAdmin, port] }
 -        contrail::auth_port_ssl: {get_param: AuthPortSSL }
 -        contrail::auth_port_public: {get_param: [EndpointMap, KeystonePublic, port] }
 -        contrail::auth_port_ssl_public: {get_param: AuthPortSSLPublic }
 -        contrail::auth_protocol: {get_param: [EndpointMap, KeystoneInternal, protocol] }
 -        contrail::api_port: {get_param: [EndpointMap, ContrailConfigInternal, port] }
 -        contrail::disc_server_port: {get_param: [EndpointMap, ContrailDiscoveryInternal, port] }
 -        contrail::insecure: {get_param: ContrailInsecure}
 -        contrail::memcached_server: {get_param: ContrailMemcachedServer}
 -        contrail::rabbit_password: {get_param: RabbitPassword}
 -        contrail::rabbit_user: {get_param: RabbitUserName}
 -        contrail::rabbit_port: {get_param: RabbitClientPort}
 +        map_merge:
 +        - contrail::aaa_mode: {get_param: AAAMode}
 +          contrail::analytics_aaa_mode: {get_param: AAAModeAnalytics}
 +          contrail::admin_password: {get_param: AdminPassword}
 +          contrail::admin_tenant_name: {get_param: AdminTenantName}
 +          contrail::admin_token: {get_param: AdminToken}
 +          contrail::admin_user: {get_param: AdminUser}
 +          contrail::auth: {get_param: ContrailAuth}
 +          contrail::auth_host: {get_param: [EndpointMap, KeystoneAdmin, host] }
 +          contrail::auth_port: {get_param: [EndpointMap, KeystoneAdmin, port] }
 +          contrail::auth_port_public: {get_param: [EndpointMap, KeystonePublic, port] }
 +          contrail::auth_protocol: {get_param: [EndpointMap, KeystonePublic, protocol] }
 +          contrail::api_port: {get_param: ContrailConfigPort }
 +          contrail::disc_server_port: {get_param: ContrailDiscoveryPort }
 +          contrail::insecure: {get_param: ContrailInsecure}
 +          contrail::memcached_server: {get_param: ContrailMemcachedServer}
 +          contrail::rabbit_password: {get_param: RabbitPassword}
 +          contrail::rabbit_user: {get_param: RabbitUserName}
 +          contrail::rabbit_port: {get_param: RabbitClientPort}
 +          contrail::vip: {get_param: ContrailVIP}
 +        - 
 +          if:
 +          - contrail_config_vip_unset
 +          - {}
 +          - contrail_config_vip: {get_param: ContrailConfigVIP}
 +        - 
 +          if:
 +          - contrail_webui_vip_unset
 +          - {}
 +          - contrail_webui_vip: {get_param: ContrailWebuiVIP}
 +        - 
 +          if:
 +          - contrail_analytics_vip_unset
 +          - {}
 +          - contrail_analytics_vip: {get_param: ContrailAnalyticsVIP}

diff --combined tools/yaml-validate.py
index 33d12ee,5e7d79f..1554f9f
--- 1/tools/yaml-validate.py
--- 2/tools/yaml-validate.py
+++ b/tools/yaml-validate.py
@@@ -62,7 -62,6 +62,6 @@@ PARAMETER_DEFINITION_EXCLUSIONS = {'Man
                                     'NeutronMetadataProxySharedSecret': [
                                         'description', 'hidden'],
                                     'ServiceNetMap': ['description', 'default'],
-                                    'RedisPassword': ['description'],
                                     'EC2MetadataIp': ['default'],
                                     'network': ['default'],
                                     'ControlPlaneIP': ['default',
@@@ -74,7 -73,6 +73,6 @@@
                                     'NeutronWorkers': ['description'],
                                     'TenantIpSubnet': ['description'],
                                     'ExternalNetName': ['description'],
-                                    'AdminToken': ['description'],
                                     'ControlPlaneDefaultRoute': ['default'],
                                     'StorageMgmtNetName': ['description'],
                                     'ServerMetadata': ['description'],
@@@ -108,16 -106,13 +106,13 @@@
                                     'HostCpusList': ['default', 'constraints'],
                                     'InternalApiAllocationPools': ['default'],
                                     'NodeIndex': ['description'],
-                                    'SwiftPassword': ['description'],
                                     'name': ['description', 'default'],
                                     'StorageNetName': ['description'],
                                     'ManagementNetName': ['description'],
                                     'NeutronPublicInterface': ['description'],
                                     'RoleParameters': ['description'],
-                                    'AdminPassword': ['description', 'hidden'],
                                     'ManagementInterfaceDefaultRoute':
                                         ['default'],
-                                    'NovaPassword': ['description'],
                                     'image': ['description', 'default'],
                                     'NeutronBigswitchAgentEnabled': ['default'],
                                     'EndpointMap': ['description', 'default'],
@@@ -304,13 -299,11 +299,13 @@@ def validate_docker_service(filename, t
          if 'docker_config' in role_data:
              docker_config = role_data['docker_config']
              for _, step in docker_config.items():
 +                if not isinstance(step, dict):
 +                    # NOTE(mandre) this skips everything that is not a dict
 +                    # so we may ignore some containers definitions if they
 +                    # are in a map_merge for example
 +                    continue
                  for _, container in step.items():
                      if not isinstance(container, dict):
 -                        # NOTE(mandre) this skips everything that is not a dict
 -                        # so we may ignore some containers definitions if they
 -                        # are in a map_merge for example
                          continue
                      command = container.get('command', '')
                      if isinstance(command, list):