Merge "set url_base option in static web middleware"

diff --git a/environments/neutron-nuage-config.yaml b/environments/neutron-nuage-config.yaml
index e157ae3..7489924 100644 (file)
--- a/environments/neutron-nuage-config.yaml
+++ b/environments/neutron-nuage-config.yaml
@@ -19,7 +19,7 @@ parameter_defaults:
   NeutronNuageBaseURIVersion: 'default_uri_version'
   NeutronNuageCMSId: ''
   UseForwardedFor: true
-  NeutronCorePlugin: 'neutron.plugins.nuage.plugin.NuagePlugin'
+  NeutronCorePlugin: 'nuage_neutron.plugins.nuage.plugin.NuagePlugin'
   NeutronEnableDHCPAgent: false
   NeutronServicePlugins: []
   NovaOVSBridge: 'alubr0'

diff --git a/extraconfig/tasks/major_upgrade_controller_pacemaker_2.sh b/extraconfig/tasks/major_upgrade_controller_pacemaker_2.sh
index b3a0098..3706151 100755 (executable)
--- a/extraconfig/tasks/major_upgrade_controller_pacemaker_2.sh
+++ b/extraconfig/tasks/major_upgrade_controller_pacemaker_2.sh
@@ -64,6 +64,5 @@ if [[ -n $(is_bootstrap_node) ]]; then
     nova-manage db sync
     nova-manage api_db sync
     nova-manage db online_data_migrations
-    gnocchi-upgrade
     sahara-db-manage --config-file /etc/sahara/sahara.conf upgrade head
 fi

diff --git a/extraconfig/tasks/major_upgrade_controller_pacemaker_3.sh b/extraconfig/tasks/major_upgrade_controller_pacemaker_3.sh
index b653c7c..d2cb955 100755 (executable)
--- a/extraconfig/tasks/major_upgrade_controller_pacemaker_3.sh
+++ b/extraconfig/tasks/major_upgrade_controller_pacemaker_3.sh
@@ -9,18 +9,9 @@ check_resource redis started 600
 start_or_enable_service openstack-cinder-volume
 check_resource openstack-cinder-volume started 600
 
+# start httpd so keystone is available for gnocchi
+# upgrade to run.
+systemctl start httpd
 
 # Swift isn't controled by pacemaker
 systemctl_swift start
-
-# We need to start the systemd services we explicitely stopped at step _1.sh
-# FIXME: Should we let puppet during the convergence step do the service enabling or
-# should we add it here?
-services=$(services_to_migrate)
-if [[ ${keep_sahara_services_on_upgrade} =~ [Ff]alse ]] ; then
-    services=${services%%openstack-sahara*}
-fi
-for service in $services; do
-    manage_systemd_service start "${service%%-clone}"
-    check_resource_systemd "${service%%-clone}" started 600
-done

diff --git a/extraconfig/tasks/major_upgrade_controller_pacemaker_4.sh b/extraconfig/tasks/major_upgrade_controller_pacemaker_4.sh
new file mode 100755 (executable)
index 0000000..fa95f1f
--- /dev/null
+++ b/extraconfig/tasks/major_upgrade_controller_pacemaker_4.sh
@@ -0,0 +1,8 @@
+#!/bin/bash
+
+set -eu
+
+if [[ -n $(is_bootstrap_node) ]]; then
+  # run gnocchi upgrade
+  gnocchi-upgrade
+fi

diff --git a/extraconfig/tasks/major_upgrade_controller_pacemaker_5.sh b/extraconfig/tasks/major_upgrade_controller_pacemaker_5.sh
new file mode 100755 (executable)
index 0000000..d569084
--- /dev/null
+++ b/extraconfig/tasks/major_upgrade_controller_pacemaker_5.sh
@@ -0,0 +1,15 @@
+#!/bin/bash
+
+set -eu
+
+# We need to start the systemd services we explicitely stopped at step _1.sh
+# FIXME: Should we let puppet during the convergence step do the service enabling or
+# should we add it here?
+services=$(services_to_migrate)
+if [[ ${keep_sahara_services_on_upgrade} =~ [Ff]alse ]] ; then
+    services=${services%%openstack-sahara*}
+fi
+for service in $services; do
+    manage_systemd_service start "${service%%-clone}"
+    check_resource_systemd "${service%%-clone}" started 600
+done

diff --git a/extraconfig/tasks/major_upgrade_pacemaker.yaml b/extraconfig/tasks/major_upgrade_pacemaker.yaml
index 7c78d5a..e13aada 100644 (file)
--- a/extraconfig/tasks/major_upgrade_pacemaker.yaml
+++ b/extraconfig/tasks/major_upgrade_pacemaker.yaml
@@ -126,6 +126,44 @@ resources:
       input_values: {get_param: input_values}
 
   ControllerPacemakerUpgradeConfig_Step3:
+    type: OS::Heat::SoftwareConfig
+    properties:
+      group: script
+      config:
+        list_join:
+        - ''
+        - - get_file: pacemaker_common_functions.sh
+          - get_file: major_upgrade_pacemaker_migrations.sh
+          - get_file: major_upgrade_controller_pacemaker_3.sh
+
+  ControllerPacemakerUpgradeDeployment_Step3:
+    type: OS::Heat::SoftwareDeploymentGroup
+    depends_on: ControllerPacemakerUpgradeDeployment_Step2
+    properties:
+      servers:  {get_param: [servers, Controller]}
+      config: {get_resource: ControllerPacemakerUpgradeConfig_Step3}
+      input_values: {get_param: input_values}
+
+  ControllerPacemakerUpgradeConfig_Step4:
+    type: OS::Heat::SoftwareConfig
+    properties:
+      group: script
+      config:
+        list_join:
+        - ''
+        - - get_file: pacemaker_common_functions.sh
+          - get_file: major_upgrade_pacemaker_migrations.sh
+          - get_file: major_upgrade_controller_pacemaker_4.sh
+
+  ControllerPacemakerUpgradeDeployment_Step4:
+    type: OS::Heat::SoftwareDeploymentGroup
+    depends_on: ControllerPacemakerUpgradeDeployment_Step3
+    properties:
+      servers:  {get_param: [servers, Controller]}
+      config: {get_resource: ControllerPacemakerUpgradeConfig_Step4}
+      input_values: {get_param: input_values}
+
+  ControllerPacemakerUpgradeConfig_Step5:
     type: OS::Heat::SoftwareConfig
     properties:
       group: script
@@ -140,13 +178,12 @@ resources:
                 KEEP_SAHARA_SERVICES_ON_UPGRADE: {get_param: KeepSaharaServicesOnUpgrade}
           - get_file: pacemaker_common_functions.sh
           - get_file: major_upgrade_pacemaker_migrations.sh
-          - get_file: major_upgrade_controller_pacemaker_3.sh
+          - get_file: major_upgrade_controller_pacemaker_5.sh
 
-  ControllerPacemakerUpgradeDeployment_Step3:
+  ControllerPacemakerUpgradeDeployment_Step5:
     type: OS::Heat::SoftwareDeploymentGroup
-    depends_on: ControllerPacemakerUpgradeDeployment_Step2
+    depends_on: ControllerPacemakerUpgradeDeployment_Step4
     properties:
       servers:  {get_param: [servers, Controller]}
-      config: {get_resource: ControllerPacemakerUpgradeConfig_Step3}
+      config: {get_resource: ControllerPacemakerUpgradeConfig_Step5}
       input_values: {get_param: input_values}
-

diff --git a/extraconfig/tasks/pacemaker_common_functions.sh b/extraconfig/tasks/pacemaker_common_functions.sh
index 4f17b69..2c7dfc3 100755 (executable)
--- a/extraconfig/tasks/pacemaker_common_functions.sh
+++ b/extraconfig/tasks/pacemaker_common_functions.sh
@@ -284,7 +284,7 @@ function systemctl_swift {
             services=$(systemctl | grep openstack-swift- | grep running | awk '{print $1}')
             ;;
         start)
-            enable_swift_storage=$(hiera -c /etc/puppet/hiera.yaml 'enable_swift_storage')
+            enable_swift_storage=$(hiera -c /etc/puppet/hiera.yaml tripleo::profile::base::swift::storage::enable_swift_storage)
             if [[ $enable_swift_storage != "true" ]]; then
                 services=( openstack-swift-proxy )
             fi

diff --git a/extraconfig/tasks/yum_update.sh b/extraconfig/tasks/yum_update.sh
index c2d7d58..4612f19 100755 (executable)
--- a/extraconfig/tasks/yum_update.sh
+++ b/extraconfig/tasks/yum_update.sh
@@ -73,8 +73,9 @@ if [[ "$pacemaker_status" == "active" ]] ; then
         pcs cluster stop
     fi
 else
-    echo "Upgrading openstack-puppet-modules"
+    echo "Upgrading openstack-puppet-modules and its dependencies"
     yum -q -y update openstack-puppet-modules
+    yum deplist openstack-puppet-modules | awk '/dependency/{print $2}' | xargs yum -q -y update
     echo "Upgrading other packages is handled by config management tooling"
     echo -n "true" > $heat_outputs_path.update_managed_packages
     exit 0

diff --git a/firstboot/userdata_heat_admin.yaml b/firstboot/userdata_heat_admin.yaml
index f8891b2..63d5bbf 100644 (file)
--- a/firstboot/userdata_heat_admin.yaml
+++ b/firstboot/userdata_heat_admin.yaml
@@ -1,4 +1,4 @@
-heat_template_version: 2014-10-16
+heat_template_version: 2016-10-14
 
 parameters:
   # Can be overridden via parameter_defaults in the environment
@@ -6,6 +6,10 @@ parameters:
     type: string
     default: heat-admin
 
+  node_admin_extra_ssh_keys:
+    type: comma_delimited_list
+    default: []
+
 description: >
   Uses cloud-init to create an additional user with a known name, in addition
   to the distro-default user created by the cloud-init default.
@@ -23,6 +27,8 @@ resources:
     properties:
       cloud_config:
         user: {get_param: node_admin_username}
+        ssh_authorized_keys: {get_param: node_admin_extra_ssh_keys}
+
 
 outputs:
   OS::stack_id:

diff --git a/overcloud-resource-registry-puppet.j2.yaml b/overcloud-resource-registry-puppet.j2.yaml
index 980a718..f06f51e 100644 (file)
--- a/overcloud-resource-registry-puppet.j2.yaml
+++ b/overcloud-resource-registry-puppet.j2.yaml
@@ -214,3 +214,8 @@ resource_registry:
 parameter_defaults:
   EnablePackageInstall: false
   SoftwareConfigTransport: POLL_TEMP_URL
+
+{% for role in roles %}
+  # Parameters generated for {{role.name}} Role
+  {{role.name}}Services: {{role.ServicesDefault|default([])}}
+{% endfor %}

diff --git a/overcloud.j2.yaml b/overcloud.j2.yaml
index 3e4dae8..47c73f8 100644 (file)
--- a/overcloud.j2.yaml
+++ b/overcloud.j2.yaml
@@ -121,7 +121,6 @@ parameters:
                  resource_registry) which represent nested stacks
                  for each service that should get installed on the {{role.name}} role.
     type: comma_delimited_list
-    default: {{role.ServicesDefault|default([])}}
 
   {{role.name}}Count:
     description: Number of {{role.name}} nodes to deploy

diff --git a/puppet/cephstorage-role.yaml b/puppet/cephstorage-role.yaml
index 55b2633..f7e29b7 100644 (file)
--- a/puppet/cephstorage-role.yaml
+++ b/puppet/cephstorage-role.yaml
@@ -253,6 +253,7 @@ resources:
             - extraconfig
             - service_names
             - service_configs
+            - ceph
             - bootstrap_node # provided by allNodesConfig
             - all_nodes # provided by allNodesConfig
             - vip_data # provided by allNodesConfig

diff --git a/puppet/deploy-artifacts.sh b/puppet/deploy-artifacts.sh
index 22fde9a..8bcbbf4 100644 (file)
--- a/puppet/deploy-artifacts.sh
+++ b/puppet/deploy-artifacts.sh
@@ -8,7 +8,7 @@ trap cleanup EXIT
 
 if [ -n "$artifact_urls" ]; then
   for URL in $(echo $artifact_urls | sed -e "s| |\n|g" | sort -u); do
-    curl -o $TMP_DATA/file_data "$artifact_urls"
+    curl --globoff -o $TMP_DATA/file_data "$artifact_urls"
     if file -b $TMP_DATA/file_data | grep RPM &>/dev/null; then
       yum install -y $TMP_DATA/file_data
     elif file -b $TMP_DATA/file_data | grep 'gzip compressed data' &>/dev/null; then

diff --git a/puppet/role.role.j2.yaml b/puppet/role.role.j2.yaml
index e430700..5b419f8 100644 (file)
--- a/puppet/role.role.j2.yaml
+++ b/puppet/role.role.j2.yaml
@@ -259,6 +259,7 @@ resources:
             - extraconfig
             - service_names
             - service_configs
+            - {{role.lower()}}
             - bootstrap_node # provided by allNodesConfig
             - all_nodes # provided by allNodesConfig
             - vip_data # provided by allNodesConfig

diff --git a/puppet/services/ceph-external.yaml b/puppet/services/ceph-external.yaml
index 7d75074..9120687 100644 (file)
--- a/puppet/services/ceph-external.yaml
+++ b/puppet/services/ceph-external.yaml
@@ -1,4 +1,4 @@
-heat_template_version: 2016-04-08
+heat_template_version: 2016-10-14
 
 description: >
   Ceph External service.
@@ -27,9 +27,20 @@ parameters:
   GlanceRbdPoolName:
     default: images
     type: string
+  GlanceBackend:
+    default: swift
+    description: The short name of the Glance backend to use. Should be one
+      of swift, rbd, or file
+    type: string
+    constraints:
+    - allowed_values: ['swift', 'file', 'rbd']
   GnocchiRbdPoolName:
     default: metrics
     type: string
+  NovaEnableRbdBackend:
+    default: false
+    description: Whether to enable or not the Rbd backend for Nova
+    type: boolean
   NovaRbdPoolName:
     default: vms
     type: string
@@ -51,6 +62,16 @@ parameters:
     default: 'overcloud-ceph-external'
     type: string
 
+conditions:
+  glance_multiple_locations:
+    and:
+    - equals:
+      - get_param: GlanceBackend
+      - rbd
+    - equals:
+      - get_param: NovaEnableRbdBackend
+      - true
+
 outputs:
   role_data:
     description: Role data for the Ceph External service.
@@ -79,6 +100,7 @@ outputs:
               GLANCE_POOL: {get_param: GlanceRbdPoolName}
               GNOCCHI_POOL: {get_param: GnocchiRbdPoolName}
       service_config_settings:
-        get_attr: [CephBase, role_data, service_config_settings]
+        glance_api:
+          glance::api::show_multiple_locations: {if: [glance_multiple_locations, true, false]}
       step_config: |
         include ::tripleo::profile::base::ceph::client

diff --git a/puppet/services/gnocchi-api.yaml b/puppet/services/gnocchi-api.yaml
index e339776..ac15de4 100644 (file)
--- a/puppet/services/gnocchi-api.yaml
+++ b/puppet/services/gnocchi-api.yaml
@@ -41,6 +41,9 @@ parameters:
     default:
       tag: openstack.gnocchi.api
       path: /var/log/gnocchi/app.log
+  EnableInternalTLS:
+    type: boolean
+    default: false
 
 resources:
 
@@ -57,6 +60,7 @@ resources:
       ServiceNetMap: {get_param: ServiceNetMap}
       DefaultPasswords: {get_param: DefaultPasswords}
       EndpointMap: {get_param: EndpointMap}
+      EnableInternalTLS: {get_param: EnableInternalTLS}
 
 outputs:
   role_data:
@@ -83,7 +87,7 @@ outputs:
             gnocchi::keystone::authtoken::auth_url: {get_param: [EndpointMap, KeystoneAdmin, uri_no_suffix]}
             gnocchi::keystone::authtoken::password: {get_param: GnocchiPassword}
             gnocchi::keystone::authtoken::project_name: 'service'
-            gnocchi::wsgi::apache::ssl: false
+            gnocchi::wsgi::apache::ssl: {get_param: EnableInternalTLS}
             gnocchi::wsgi::apache::servername:
               str_replace:
                 template:
@@ -98,7 +102,12 @@ outputs:
             # internal_api_uri -> [IP]
             # internal_api_subnet - > IP/CIDR
             gnocchi::wsgi::apache::bind_host: {get_param: [ServiceNetMap, GnocchiApiNetwork]}
-            gnocchi::api::host: {get_param: [ServiceNetMap, GnocchiApiNetwork]}
+            gnocchi::api::host:
+              str_replace:
+                template:
+                  '"%{::fqdn_$NETWORK}"'
+                params:
+                  $NETWORK: {get_param: [ServiceNetMap, GnocchiApiNetwork]}
 
             gnocchi::api::keystone_auth_uri: {get_param: [EndpointMap, KeystoneInternal, uri]}
             gnocchi::api::keystone_identity_uri: {get_param: [EndpointMap, KeystoneAdmin, uri_no_suffix]}

diff --git a/puppet/services/gnocchi-statsd.yaml b/puppet/services/gnocchi-statsd.yaml
index 04339f4..983d6c9 100644 (file)
--- a/puppet/services/gnocchi-statsd.yaml
+++ b/puppet/services/gnocchi-statsd.yaml
@@ -39,5 +39,9 @@ outputs:
       config_settings:
         map_merge:
           - get_attr: [GnocchiServiceBase, role_data, config_settings]
+          - tripleo.gnocchi_statsd.firewall_rules:
+              '140 gnocchi-statsd':
+                dport: 8125
+                proto: 'udp'
       step_config: |
         include ::tripleo::profile::base::gnocchi::statsd

diff --git a/puppet/services/kernel.yaml b/puppet/services/kernel.yaml
index 1fc88bf..6989871 100644 (file)
--- a/puppet/services/kernel.yaml
+++ b/puppet/services/kernel.yaml
@@ -18,6 +18,10 @@ parameters:
     description: Mapping of service endpoint -> protocol. Typically set
                  via parameter_defaults in the resource registry.
     type: json
+  KernelPidMax:
+    default: 1048576
+    description: Configures sysctl kernel.pid_max key
+    type: number
 
 outputs:
   role_data:
@@ -49,5 +53,7 @@ outputs:
             value: 0
           net.core.netdev_max_backlog:
             value: 10000
+          kernel.pid_max:
+            value: {get_param: KernelPidMax}
       step_config: |
         include ::tripleo::profile::base::kernel

diff --git a/puppet/services/manila-api.yaml b/puppet/services/manila-api.yaml
index 4d3fd47..5f4ab6b 100644 (file)
--- a/puppet/services/manila-api.yaml
+++ b/puppet/services/manila-api.yaml
@@ -62,21 +62,15 @@ outputs:
       step_config: |
         include ::tripleo::profile::base::manila::api
       service_config_settings:
-        keystone:
-          manila::keystone::auth::tenant: 'service'
-          manila::keystone::auth::public_url: {get_param: [EndpointMap, ManilaV1Public, uri]}
-          manila::keystone::auth::internal_url: {get_param: [EndpointMap, ManilaV1Internal, uri]}
-          manila::keystone::auth::admin_url: {get_param: [EndpointMap, ManilaV1Admin, uri]}
-          manila::keystone::auth::public_url_v2: {get_param: [EndpointMap, ManilaPublic, uri]}
-          manila::keystone::auth::internal_url_v2: {get_param: [EndpointMap, ManilaInternal, uri]}
-          manila::keystone::auth::admin_url_v2: {get_param: [EndpointMap, ManilaAdmin, uri]}
-          manila::keystone::auth::password: {get_param: ManilaPassword}
-          manila::keystone::auth::region: {get_param: KeystoneRegion}
-        mysql:
-          manila::db::mysql::password: {get_param: ManilaPassword}
-          manila::db::mysql::user: manila
-          manila::db::mysql::host: {get_param: [EndpointMap, MysqlInternal, host_nobrackets]}
-          manila::db::mysql::dbname: manila
-          manila::db::mysql::allowed_hosts:
-            - '%'
-            - "%{hiera('mysql_bind_host')}"
+        map_merge:
+          - get_attr: [ManilaBase, role_data, service_config_settings]
+          - keystone:
+              manila::keystone::auth::tenant: 'service'
+              manila::keystone::auth::public_url: {get_param: [EndpointMap, ManilaV1Public, uri]}
+              manila::keystone::auth::internal_url: {get_param: [EndpointMap, ManilaV1Internal, uri]}
+              manila::keystone::auth::admin_url: {get_param: [EndpointMap, ManilaV1Admin, uri]}
+              manila::keystone::auth::public_url_v2: {get_param: [EndpointMap, ManilaPublic, uri]}
+              manila::keystone::auth::internal_url_v2: {get_param: [EndpointMap, ManilaInternal, uri]}
+              manila::keystone::auth::admin_url_v2: {get_param: [EndpointMap, ManilaAdmin, uri]}
+              manila::keystone::auth::password: {get_param: ManilaPassword}
+              manila::keystone::auth::region: {get_param: KeystoneRegion}

diff --git a/puppet/services/manila-base.yaml b/puppet/services/manila-base.yaml
index d228577..844bd3a 100644 (file)
--- a/puppet/services/manila-base.yaml
+++ b/puppet/services/manila-base.yaml
@@ -40,6 +40,10 @@ parameters:
     default: 5672
     description: Set rabbit subscriber port, change this if using SSL
     type: number
+  ManilaPassword:
+    description: The password for the manila service account.
+    type: string
+    hidden: true
 
 outputs:
   role_data:
@@ -54,3 +58,21 @@ outputs:
         manila::debug: {get_param: Debug}
         manila::db::database_db_max_retries: -1
         manila::db::database_max_retries: -1
+        manila::sql_connection:
+          list_join:
+          - ''
+          - - {get_param: [EndpointMap, MysqlInternal, protocol]}
+            - '://manila:'
+            - {get_param: ManilaPassword}
+            - '@'
+            - {get_param: [EndpointMap, MysqlInternal, host]}
+            - '/manila'
+      service_config_settings:
+        mysql:
+          manila::db::mysql::password: {get_param: ManilaPassword}
+          manila::db::mysql::user: manila
+          manila::db::mysql::host: {get_param: [EndpointMap, MysqlInternal, host_nobrackets]}
+          manila::db::mysql::dbname: manila
+          manila::db::mysql::allowed_hosts:
+            - '%'
+            - "%{hiera('mysql_bind_host')}"

diff --git a/puppet/services/manila-scheduler.yaml b/puppet/services/manila-scheduler.yaml
index 474cc24..d96b677 100644 (file)
--- a/puppet/services/manila-scheduler.yaml
+++ b/puppet/services/manila-scheduler.yaml
@@ -57,14 +57,5 @@ outputs:
             manila::network::neutron::neutron_url: {get_param: [EndpointMap, NeutronInternal, uri]}
             manila::network::neutron::neutron_admin_auth_url: {get_param: [EndpointMap, NeutronAdmin, uri]}
             manila::network::neutron::neutron_admin_password: {get_param: NeutronPassword}
-            manila::sql_connection:
-                list_join:
-                - ''
-                - - {get_param: [EndpointMap, MysqlInternal, protocol]}
-                  - '://manila:'
-                  - {get_param: ManilaPassword}
-                  - '@'
-                  - {get_param: [EndpointMap, MysqlInternal, host]}
-                  - '/manila'
       step_config: |
         include ::tripleo::profile::base::manila::scheduler

diff --git a/puppet/services/manila-share.yaml b/puppet/services/manila-share.yaml
index e42d2fa..49c69fc 100644 (file)
--- a/puppet/services/manila-share.yaml
+++ b/puppet/services/manila-share.yaml
@@ -21,6 +21,10 @@ parameters:
   MonitoringSubscriptionManilaShare:
     default: 'overcloud-manila-share'
     type: string
+  ManilaPassword:
+    description: The password for the manila service account.
+    type: string
+    hidden: true
 
 resources:
   ManilaBase:
@@ -40,5 +44,11 @@ outputs:
         map_merge:
           - get_attr: [ManilaBase, role_data, config_settings]
           - manila::volume::cinder::cinder_admin_tenant_name: 'service'
+            manila::keystone::authtoken::password: {get_param: ManilaPassword}
+            manila::keystone::authtoken::auth_uri: {get_param: [EndpointMap, KeystoneInternal, uri]}
+            manila::keystone::authtoken::auth_url: { get_param: [EndpointMap, KeystoneAdmin, uri_no_suffix] }
+            manila::keystone::authtoken::project_name: 'service'
+      service_config_settings:
+        get_attr: [ManilaBase, role_data, service_config_settings]
       step_config: |
         include ::tripleo::profile::base::manila::share

diff --git a/puppet/services/nova-api.yaml b/puppet/services/nova-api.yaml
index bf47943..49bd84b 100644 (file)
--- a/puppet/services/nova-api.yaml
+++ b/puppet/services/nova-api.yaml
@@ -51,6 +51,9 @@ parameters:
     default:
       tag: openstack.nova.api
       path: /var/log/nova/nova-api.log
+  EnableInternalTLS:
+    type: boolean
+    default: false
 
 conditions:
   nova_workers_zero: {equals : [{get_param: NovaWorkers}, 0]}
@@ -62,6 +65,7 @@ resources:
       ServiceNetMap: {get_param: ServiceNetMap}
       DefaultPasswords: {get_param: DefaultPasswords}
       EndpointMap: {get_param: EndpointMap}
+      EnableInternalTLS: {get_param: EnableInternalTLS}
 
   NovaBase:
     type: ./nova-base.yaml
@@ -88,8 +92,6 @@ outputs:
           tripleo.nova_api.firewall_rules:
             '113 nova_api':
               dport:
-                - 6080
-                - 13080
                 - 8773
                 - 3773
                 - 8774
@@ -103,21 +105,26 @@ outputs:
           nova::api::default_floating_pool: 'public'
           nova::api::sync_db_api: true
           nova::api::enable_proxy_headers_parsing: true
+          nova::api::api_bind_address:
+            str_replace:
+              template:
+                '"%{::fqdn_$NETWORK}"'
+              params:
+                $NETWORK: {get_param: [ServiceNetMap, NovaApiNetwork]}
+          nova::api::service_name: 'httpd'
+          nova::wsgi::apache::ssl: {get_param: EnableInternalTLS}
           # NOTE: bind IP is found in Heat replacing the network name with the local node IP
           # for the given network; replacement examples (eg. for internal_api):
           # internal_api -> IP
           # internal_api_uri -> [IP]
           # internal_api_subnet - > IP/CIDR
-          nova::api::api_bind_address: {get_param: [ServiceNetMap, NovaApiNetwork]}
-          nova::api::service_name: 'httpd'
-          nova::wsgi::apache::ssl: false
           nova::wsgi::apache::bind_host: {get_param: [ServiceNetMap, NovaApiNetwork]}
           nova::wsgi::apache::servername:
             str_replace:
               template:
                 '"%{::fqdn_$NETWORK}"'
               params:
-                $NETWORK: {get_param: [ServiceNetMap, MysqlNetwork]}
+                $NETWORK: {get_param: [ServiceNetMap, NovaApiNetwork]}
           nova::api::neutron_metadata_proxy_shared_secret: {get_param: NeutronMetadataProxySharedSecret}
           nova::api::instance_name_template: {get_param: InstanceNameTemplate}
           nova_enable_db_purge: {get_param: NovaEnableDBPurge}

diff --git a/puppet/services/nova-libvirt.yaml b/puppet/services/nova-libvirt.yaml
index 3173258..70774ba 100644 (file)
--- a/puppet/services/nova-libvirt.yaml
+++ b/puppet/services/nova-libvirt.yaml
@@ -54,6 +54,9 @@ outputs:
               '200 nova_libvirt':
                 dport:
                   - 16509
+                  - 16514
+                  - '49152-49215'
+                  - '5900-5999'
 
       step_config: |
         include tripleo::profile::base::nova::libvirt

diff --git a/puppet/services/nova-scheduler.yaml b/puppet/services/nova-scheduler.yaml
index d89e3e1..d4e5fff 100644 (file)
--- a/puppet/services/nova-scheduler.yaml
+++ b/puppet/services/nova-scheduler.yaml
@@ -58,7 +58,7 @@ outputs:
       config_settings:
         map_merge:
           - get_attr: [NovaBase, role_data, config_settings]
-          - nova::scheduler::filter::ram_allocation_ratio: '1.0'
+          - nova::ram_allocation_ratio: '1.0'
             nova::scheduler::filter::scheduler_available_filters: {get_param: NovaSchedulerAvailableFilters}
             nova::scheduler::filter::scheduler_default_filters: {get_param: NovaSchedulerDefaultFilters}
       step_config: |

diff --git a/puppet/services/nova-vnc-proxy.yaml b/puppet/services/nova-vnc-proxy.yaml
index 85d59ae..e6b0703 100644 (file)
--- a/puppet/services/nova-vnc-proxy.yaml
+++ b/puppet/services/nova-vnc-proxy.yaml
@@ -57,5 +57,10 @@ outputs:
             # internal_api_uri -> [IP]
             # internal_api_subnet - > IP/CIDR
             nova::vncproxy::host: {get_param: [ServiceNetMap, NovaApiNetwork]}
+            tripleo.nova_vnc_proxy.firewall_rules:
+              '137 nova_vnc_proxy':
+                dport:
+                  - 6080
+                  - 13080
       step_config: |
         include tripleo::profile::base::nova::vncproxy

diff --git a/puppet/services/sahara-base.yaml b/puppet/services/sahara-base.yaml
index 5fc8ed6..4072a15 100644 (file)
--- a/puppet/services/sahara-base.yaml
+++ b/puppet/services/sahara-base.yaml
@@ -44,6 +44,10 @@ parameters:
     type: string
     default: ''
     description: Set to True to enable debugging on all services.
+  SaharaPlugins:
+    default: ["ambari","cdh","mapr","vanilla","spark","storm"]
+    description: Sahara enabled plugin list
+    type: comma_delimited_list
 
 outputs:
   role_data:
@@ -69,13 +73,7 @@ outputs:
         sahara::auth_uri: {get_param: [EndpointMap, KeystoneInternal, uri] }
         sahara::identity_uri: { get_param: [EndpointMap, KeystoneAdmin, uri_no_suffix] }
         sahara::use_neutron: true
-        sahara::plugins:
-          - ambari
-          - cdh
-          - mapr
-          - vanilla
-          - spark
-          - storm
+        sahara::plugins: {get_param: SaharaPlugins}
         sahara::rpc_backend: rabbit
         sahara::admin_tenant_name: 'service'
         sahara::db::database_db_max_retries: -1

diff --git a/puppet/services/swift-proxy.yaml b/puppet/services/swift-proxy.yaml
index fa5fecb..ba1d99f 100644 (file)
--- a/puppet/services/swift-proxy.yaml
+++ b/puppet/services/swift-proxy.yaml
@@ -74,7 +74,6 @@ outputs:
             swift::proxy::authtoken::project_name: 'service'
             swift::proxy::node_timeout: {get_param: SwiftProxyNodeTimeout}
             swift::proxy::workers: {get_param: SwiftWorkers}
-            swift::proxy::ceilometer::rabbit_host: {get_param: [ServiceNetMap, RabbitmqNetwork]}
             swift::proxy::ceilometer::rabbit_user: {get_param: RabbitUserName}
             swift::proxy::ceilometer::rabbit_password: {get_param: RabbitPassword}
             swift::proxy::staticweb::url_base: {get_param: [EndpointMap, SwiftPublic, uri_no_suffix]}

diff --git a/puppet/services/swift-ringbuilder.yaml b/puppet/services/swift-ringbuilder.yaml
index 8ed4e9f..5c70b6a 100644 (file)
--- a/puppet/services/swift-ringbuilder.yaml
+++ b/puppet/services/swift-ringbuilder.yaml
@@ -38,7 +38,10 @@ parameters:
     default: {}
     description: 'A hash of additional raw devices to use as Swift backend (eg. {sdb: {}})'
     type: json
-
+  SwiftUseLocalDir:
+    default: true
+    description: 'Use a local directory for Swift storage services when building rings'
+    type: boolean
 
 outputs:
   role_data:
@@ -56,7 +59,7 @@ outputs:
             expression: $.data.raw_disk_lists.flatten()
             data:
               raw_disk_lists:
-              - [':%PORT%/d1']
+              - {if: [{get_param: SwiftUseLocalDir}, [':%PORT%/d1'], []]}
               - repeat:
                   template: ':%PORT%/DEVICE'
                   for_each:

diff --git a/roles_data.yaml b/roles_data.yaml
index 320bb70..cc9ee14 100644 (file)
--- a/roles_data.yaml
+++ b/roles_data.yaml
@@ -158,6 +158,7 @@
     - OS::TripleO::Services::CephOSD
     - OS::TripleO::Services::Kernel
     - OS::TripleO::Services::Ntp
+    - OS::TripleO::Services::Snmp
     - OS::TripleO::Services::Timezone
     - OS::TripleO::Services::TripleoPackages
     - OS::TripleO::Services::TripleoFirewall