Merge "Fix SSL with HAProxy."

diff --combined overcloud-source.yaml
index 068c853,4d24b08..ce86dfa
--- 1/overcloud-source.yaml
--- 2/overcloud-source.yaml
+++ b/overcloud-source.yaml
@@@ -252,23 -252,6 +252,23 @@@ Parameters
      Default: []
      Description: Should be used for arbitrary ips.
      Type: Json
 +  PublicVirtualFixedIPs:
 +    Default: []
 +    Description: |
 +        Control the IP allocation for the PublicVirtualInterface port. E.g.
 +        [{'ip_address':'1.2.3.4'}]
 +    Type: Json
 +  PublicVirtualInterface:
 +    Default: 'br-ex'
 +    Description: >
 +        Specifies the interface where the public-facing virtual ip will be assigned.
 +        This should be int_public when a VLAN is being used.
 +    Type: String
 +  PublicVirtualNetwork:
 +    Default: 'ctlplane'
 +    Type: String
 +    Description: >
 +        Neutron network to allocate public virtual IP port on.
    KeystoneCACertificate:
      Default: ''
      Description: Keystone self-signed certificate authority certificate.
@@@ -294,13 -277,6 +294,13 @@@ Resources
      Type: OS::Heat::RandomString
      Properties:
        length: 10
 +  PublicVirtualIP:
 +    Type: OS::Neutron::Port
 +    Properties:
 +      name: public_virtual_ip
 +      network: {Ref: PublicVirtualNetwork}
 +      fixed_ips:
 +        Ref: PublicVirtualFixedIPs
    RabbitCookie:
      Type: OS::Heat::RandomString
      Properties:
@@@ -437,7 -413,7 +437,7 @@@
          keystone:
            db: mysql://keystone:unset@localhost/keystone
            host:
 -            get_input: controller_host
 +            get_input: controller_virtual_ip
            ca_certificate: {Ref: KeystoneCACertificate}
            signing_key: {Ref: KeystoneSigningKey}
            signing_certificate: {Ref: KeystoneSigningCertificate}
@@@ -506,44 -482,15 +506,44 @@@
          ntp:
            servers:
                - {server: {Ref: NtpServer}, fudge: "stratum 0"}
 +        virtual_interfaces:
 +          instances:
 +            - vrrp_instance_name: VI_CONTROL
 +              virtual_router_id: 51
 +              keepalive_interface:
 +                Ref: ControlVirtualInterface
 +              priority: 101
 +              virtual_ips:
 +              - ip: {'Fn::Select': [ip_address, 'Fn::Select': [0, 'Fn::GetAtt': [ControlVirtualIP, fixed_ips]]]}
 +                interface:
 +                  Ref: ControlVirtualInterface
 +            - vrrp_instance_name: VI_PUBLIC
 +              virtual_router_id: 52
 +              keepalive_interface:
 +                Ref: PublicVirtualInterface
 +              priority: 101
 +              virtual_ips:
 +              - ip: {'Fn::Select': [ip_address, 'Fn::Select': [0, 'Fn::GetAtt': [PublicVirtualIP, fixed_ips]]]}
 +                interface:
 +                  Ref: PublicVirtualInterface
 +          vrrp_sync_groups:
 +            - name: VG1
 +              members:
 +                - VI_CONTROL
 +                - VI_PUBLIC
          keepalived:
            keepalive_interface:
 -            Ref: ControlVirtualInterface
 +            Ref: PublicVirtualInterface
            priority: 101
          virtual_ips:
              -
                ip: {'Fn::Select': [ip_address, 'Fn::Select': [0, 'Fn::GetAtt': [ControlVirtualIP, fixed_ips]]]}
                interface:
                  Ref: ControlVirtualInterface
 +            -
 +              ip: {'Fn::Select': [ip_address, 'Fn::Select': [0, 'Fn::GetAtt': [PublicVirtualIP, fixed_ips]]]}
 +              interface:
 +                Ref: PublicVirtualInterface
          haproxy:
            nodes:
              Merge::Map:
@@@ -555,50 -502,34 +555,50 @@@
            services:
              - name: keystone_admin
                port: 35357
 +              net_binds: &public_binds
 +                - ip: {'Fn::Select': [ip_address, 'Fn::Select': [0, 'Fn::GetAtt': [ControlVirtualIP, fixed_ips]]]}
 +                - ip: {'Fn::Select': [ip_address, 'Fn::Select': [0, 'Fn::GetAtt': [PublicVirtualIP, fixed_ips]]]}
              - name: keystone_public
                port: 5000
 +              net_binds: *public_binds
              - name: horizon
                port: 80
 +              net_binds: *public_binds
              - name: neutron
                port: 9696
 +              net_binds: *public_binds
              - name: cinder
                port: 8776
 +              net_binds: *public_binds
              - name: glance_api
                port: 9292
 +              net_binds: *public_binds
              - name: glance_registry
                port: 9191
 +              net_binds: *public_binds
              - name: heat_api
                port: 8004
 +              net_binds: *public_binds
              - name: heat_cloudwatch
                port: 8003
 +              net_binds: *public_binds
              - name: heat_cfn
                port: 8000
 +              net_binds: *public_binds
              - name: nova_ec2
                port: 8773
              - name: nova_osapi
                port: 8774
 +              net_binds: *public_binds
              - name: nova_metadata
                port: 8775
 +              net_binds: *public_binds
              - name: ceilometer
                port: 8777
 +              net_binds: *public_binds
              - name: swift_proxy_server
                port: 8080
 +              net_binds: *public_binds
    controllerPassthrough:
      Type: OS::Heat::StructuredConfig
      Properties:
@@@ -739,6 -670,14 +739,14 @@@
        server: {Ref: controller0}
        signal_transport: NO_SIGNAL
        input_values:
+         controller_host:
+           Fn::Select:
+             - 0
+             - Fn::Select:
+               - ctlplane
+               - Fn::GetAtt:
+                 - controller0
+                 - networks
          ssl_certificate: {Ref: SSLCertificate}
          ssl_key: {Ref: SSLKey}
          ssl_ca_certificate: {Ref: SSLCACertificate}