apex-puppet-tripleo.git
8 years agoUse network entries for nova placement
Juan Antonio Osorio Robles [Wed, 18 Jan 2017 22:26:55 +0000 (00:26 +0200)]
Use network entries for nova placement

Having these available from t-h-t, we should be able to use these now.

Change-Id: I7272df25c4fdba152fe15d40444311bc35ace4d9
Depends-On: Id0d34c7c3939ee81126ffd26d0658c0a87805a44

8 years agoMerge "Remove legacy flag and use composable interface"
Jenkins [Wed, 18 Jan 2017 20:00:35 +0000 (20:00 +0000)]
Merge "Remove legacy flag and use composable interface"

8 years agoRemove legacy flag and use composable interface
Pradeep Kilambi [Fri, 13 Jan 2017 17:13:07 +0000 (12:13 -0500)]
Remove legacy flag and use composable interface

We dont need this flag anymore as we will disable api
using composable interface instead.

See I67900f7e6816212831aea8ed18f323652857fbd3

Closes-bug: #1656364

Change-Id: Ib6aea02bde6ad7e5223336579f0a99d6cd3ee98f

8 years agoDo not depend on bootstrap_nodeid for any pacemaker profile
Michele Baldessari [Tue, 17 Jan 2017 17:17:38 +0000 (18:17 +0100)]
Do not depend on bootstrap_nodeid for any pacemaker profile

When we create a pacemaker resource it must happen from a single node.
If it happens from multiple nodes an immediate error will be returned by
pcs.

For the pacemaker roles we enforce this by leveraging the recently
introduced <SERVICE_NAME_bootstrap_short_node_name> which gives us
the first hostname per-service, regardless of the role.
(introduced via I03e8685f939e8ae1fcd8b16883b559615042505d)

With this approach if a pacemaker service belongs to two different
roles (say role Controller on node A and role galera on node B), it
will only create the resource from one of the two and not both (which
would return an error).

Only setting Partial-Bug for this one, because it addresses the issue
from the pacemaker resource creation POV (which is always affected). But
the issue itself is a race that we're theoretically affected by since
the composable roles work landed. While I have tried to fix the more
general case in previous attempts, I think it is best if we start a
discussion on how to fix it, because each approach has a bunch of
potential drawbacks and is quite invasive on how we do things. A
discussion slot for this has been proposed for the Atlanta PTG.

Change-Id: I662398cab60d523d204b57a5674ca8f5c0f2e68a
Partial-Bug: #1615983

8 years agoMerge "Set ceph key when using manila ceph backend"
Jenkins [Wed, 18 Jan 2017 10:20:40 +0000 (10:20 +0000)]
Merge "Set ceph key when using manila ceph backend"

8 years agoMerge "Call VF configuration from udev rules"
Jenkins [Tue, 17 Jan 2017 00:07:15 +0000 (00:07 +0000)]
Merge "Call VF configuration from udev rules"

8 years agoMerge "Add missing Swift base class"
Jenkins [Tue, 17 Jan 2017 00:04:56 +0000 (00:04 +0000)]
Merge "Add missing Swift base class"

8 years agoMerge "Include swift::storage::loopbacks class"
Jenkins [Mon, 16 Jan 2017 23:59:52 +0000 (23:59 +0000)]
Merge "Include swift::storage::loopbacks class"

8 years agoMerge "Set memcache_servers in /etc/swift/object-expirer.conf"
Jenkins [Mon, 16 Jan 2017 23:59:46 +0000 (23:59 +0000)]
Merge "Set memcache_servers in /etc/swift/object-expirer.conf"

8 years agoMerge "Enable object-expirer on Swift proxy profile"
Jenkins [Mon, 16 Jan 2017 23:59:34 +0000 (23:59 +0000)]
Merge "Enable object-expirer on Swift proxy profile"

8 years agoMerge "Implement Nova Placement API profile"
Jenkins [Mon, 16 Jan 2017 18:16:38 +0000 (18:16 +0000)]
Merge "Implement Nova Placement API profile"

8 years agoMerge "Include ::heat at step 3"
Jenkins [Mon, 16 Jan 2017 17:08:35 +0000 (17:08 +0000)]
Merge "Include ::heat at step 3"

8 years agonova: disable ::nova::db::sync_cell_v2
Emilien Macchi [Sat, 14 Jan 2017 15:21:19 +0000 (10:21 -0500)]
nova: disable ::nova::db::sync_cell_v2

This feature is broken for us now and there is work in progress in Nova
to improve nova cell deployment.
Until it's fixed upstream, we need to disable cells deployment for now,
so we can promote our CI.

Change-Id: I379ba9e94a92ed225a03a67fc975b542447a9c8b
Related-Bug: #1649341

8 years agoInclude ::heat at step 3
James Slagle [Fri, 13 Jan 2017 20:41:59 +0000 (15:41 -0500)]
Include ::heat at step 3

Since we include ::heat::keystone::domain at step 3, and that class
requires heat.conf since it uses the heat_config resource, we need to
also include ::heat at step 3. The ::heat class will take care of
installing openstack-heat-common that provides heat.conf.

Closes-Bug: #165389
Partially-implements: blueprint split-stack-software-configuration
Change-Id: I5ba34ca96ca84d3f1cf3785ed8bbef6720f7bd42

8 years agoSet ceph key when using manila ceph backend
Jan Provaznik [Wed, 14 Dec 2016 12:04:17 +0000 (12:04 +0000)]
Set ceph key when using manila ceph backend

Manila ceph driver reads ceph's client configuration
(keyring is the most important) from ceph.conf file
(or any other file set by cephfs_conf_path). ceph.conf
should be updated with keyring location.

If ceph is deployed by tripleo then also manila ceph key
is added into ceph and ceph filesystem is created.

Depends-On: I18436a64fc991b9e697a1d79e369ac110cf8fe20
Change-Id: Iac4a260af6738ed6afd4bcb107221a736d07c1b5
Partial-Bug: #1644784
Closes-Bug: #1646147

8 years agoImplement Nova Placement API profile
Emilien Macchi [Fri, 2 Dec 2016 19:02:43 +0000 (14:02 -0500)]
Implement Nova Placement API profile

Allow TripleO to deploy Nova Placement API with a new profile.

Change-Id: I5e25a50f3d7a9b39f4146a61cb528963ee09e90c

8 years agoMerge "Rspec tests for nova profiles"
Jenkins [Tue, 10 Jan 2017 22:40:45 +0000 (22:40 +0000)]
Merge "Rspec tests for nova profiles"

8 years agoMerge "Add Docker Registry profile"
Jenkins [Tue, 10 Jan 2017 17:33:29 +0000 (17:33 +0000)]
Merge "Add Docker Registry profile"

8 years agoMerge "Move nova cells db sync into nova-api profile"
Jenkins [Tue, 10 Jan 2017 16:12:52 +0000 (16:12 +0000)]
Merge "Move nova cells db sync into nova-api profile"

8 years agoMerge "Add support for not using admin_token in Ceph/RGW"
Jenkins [Tue, 10 Jan 2017 04:14:03 +0000 (04:14 +0000)]
Merge "Add support for not using admin_token in Ceph/RGW"

8 years agoRspec tests for nova profiles
Alex Schultz [Mon, 9 Jan 2017 20:31:37 +0000 (13:31 -0700)]
Rspec tests for nova profiles

This change fixes the hiera calls in the base nova profile to use the
parameter rather than continue to call hiera. Additionally this change
includes basic test coverage for the various nova profiles.

Change-Id: If393606eeb3c39ed3a2655bd89c5c276a9cf106e

8 years agoMove nova cells db sync into nova-api profile
Dan Prince [Mon, 9 Jan 2017 15:17:35 +0000 (10:17 -0500)]
Move nova cells db sync into nova-api profile

Having the db_sync code live in the mysql profile causes
coupling that doesn't work unless your MySQL server has the
latest Nova packages installed. This may not work for some
baremetal setups (where an isolated database exists) or
with containers where the MySQL container definately doesn't
have nova packages installed.

Moving this code into the nova-api role also matches where we
were already db syncing the normal API database so it should be
fine and safe.

Change-Id: Ib625e2ac9c8d6bd1d335c58e291facc4ea5839ae
Co-Authored-By: Alex Schultz <aschultz@redhat.com>
8 years agoAdd support for not using admin_token in Ceph/RGW
Keith Schincke [Thu, 1 Dec 2016 18:37:12 +0000 (13:37 -0500)]
Add support for not using admin_token in Ceph/RGW

This patch add the option for using Keyston V3 authention with
the Ceph/RGW service instead of using the admin_token

Change-Id: I42861afcac221478dcb68be13b6dbc2533a7f158

8 years agoUse THT to define cell0 creation
Alex Schultz [Tue, 3 Jan 2017 21:19:45 +0000 (14:19 -0700)]
Use THT to define cell0 creation

As part of the initial implementation, we hard coded the cell0 setup in
puppet. This change switches it to leverage the defined value in the
tripleo-heat-templates

Change-Id: I896a124d91d06ca85b77c9fbe24fd252815a2d28
Depends-On: I08119d781ef60750cc19753bc03190e413159925
Related-Bug: #1649341

8 years agoAdd Docker Registry profile
Martin André [Fri, 6 Jan 2017 16:14:22 +0000 (17:14 +0100)]
Add Docker Registry profile

The profile was moved out of instack-undercloud puppet manifest and
changed to install a v2 Docker registry rather than the old, deprecated
v1 registry.

Change-Id: Iecf7a4c7e86349e6ecaa0a8ee6d37223e3af7862

8 years agoMerge "Ensure panko::db class is initialized"
Jenkins [Sat, 7 Jan 2017 04:02:55 +0000 (04:02 +0000)]
Merge "Ensure panko::db class is initialized"

8 years agoMerge "Fix puppet warning for empty value"
Jenkins [Sat, 7 Jan 2017 01:41:02 +0000 (01:41 +0000)]
Merge "Fix puppet warning for empty value"

8 years agoEnsure panko::db class is initialized
Pradeep Kilambi [Fri, 6 Jan 2017 17:51:43 +0000 (12:51 -0500)]
Ensure panko::db class is initialized

Change-Id: If2f6559a7d76b26fa9b0a3ecfa2e2101aae93e3c

8 years agoMerge "glance/api: cleanup on dbsync"
Jenkins [Fri, 6 Jan 2017 16:25:44 +0000 (16:25 +0000)]
Merge "glance/api: cleanup on dbsync"

8 years agoFix puppet warning for empty value
Emilien Macchi [Fri, 6 Jan 2017 15:06:39 +0000 (10:06 -0500)]
Fix puppet warning for empty value

Unknown variable: 'haproxy_ssl_firewall_rules' when public_ssl_port is
empty.
Fixing it by setting an empty hash in this case.

Change-Id: If864732262852ef79ebb91ee77902c86b847072a

8 years agofirewall: add IPv6 support
Emilien Macchi [Wed, 4 Jan 2017 18:56:59 +0000 (13:56 -0500)]
firewall: add IPv6 support

This patch adds support for ip6tables rules in TripleO, in a intuitive
and flexible fashion.

1) Default firewal rules 'source' parameter to undef.
   It was 0.0.0.0/0 before but now undef, so we don't need complex logic to
   support ipv6 rules. undef will create empty source, which is the same as
   0.0.0.0/0 or ::/0.

2) Automatically convert icmp rules to ipv6-icmp for ipv6 rules.

3) Automatically create IPv6 rules like it's for IPv4.

4) Only create rules that can be created, depending on
   source/destination ip version.

This patch should be backward compatible and adds a layer of security
for IPv6 deployments. If previous deployments were manually creating
Ipv6 rules, it's possible that this patch will override them. Our
framework is able to configure any rule, so it shouldn't be a problem
for upgrades.

Co-Authored-By: Ben Nemec <bnemec@redhat.com>
Closes-Bug: #1654050
Change-Id: I98a00a9ae265d3e5854632e749cc8c3a1647298c

8 years agoglance/api: cleanup on dbsync
Emilien Macchi [Thu, 5 Jan 2017 17:09:37 +0000 (12:09 -0500)]
glance/api: cleanup on dbsync

Cleanup some code that were useful in the effort of removing Glance
Registry service from TripleO.

Change-Id: I2a4bdc413e953b8b713d9a12bba74ca18487fe0d

8 years agoMerge "Adds a profile for the Ceph MDS service"
Jenkins [Thu, 5 Jan 2017 16:18:55 +0000 (16:18 +0000)]
Merge "Adds a profile for the Ceph MDS service"

8 years agonova-api: switch to new wsgi class
Emilien Macchi [Wed, 4 Jan 2017 20:09:27 +0000 (15:09 -0500)]
nova-api: switch to new wsgi class

nova::wsgi::apache was deprecated in ocata in favor of
nova::wsgi::apache_api.
Let's switch to it.

Change-Id: I59b3b36be33268fa6e261a7db3c4aa8e8e712ffb
Depends-On: I5fc99062d349597393e2248c66f2d863029c7730

8 years agoMerge "Fixes missing haproxy firewall rules for OpenDaylight"
Jenkins [Wed, 4 Jan 2017 19:13:01 +0000 (19:13 +0000)]
Merge "Fixes missing haproxy firewall rules for OpenDaylight"

8 years agoAdds a profile for the Ceph MDS service
Giulio Fidente [Fri, 25 Nov 2016 09:52:54 +0000 (10:52 +0100)]
Adds a profile for the Ceph MDS service

This change adds a profile to deploy the Ceph MDS service and some
basic unit tests for it.

Depends-On: I558b43deaa9b243c54f3d7ae945f11dd4925eb5d
Change-Id: Iaecc3ff7acb851776c5057c42a5a513a70425d2c
Partial-Bug: #1644784

8 years agoFixes missing haproxy firewall rules for OpenDaylight
Tim Rozet [Tue, 20 Dec 2016 20:45:00 +0000 (15:45 -0500)]
Fixes missing haproxy firewall rules for OpenDaylight

This migrates the haproxy config for ODL to use the
tripleo::haproxy::endpoint class.  This class automatically configures
firewall rules for each haproxy endpoint.  Also removes listening on
public network for IP and adds listening on ctlplane network for admin
access.

Partial-Bug: 1651476

Change-Id: I1f2af2793d040fda17bf73252afe59434d99f31f
Signed-off-by: Tim Rozet <trozet@redhat.com>
8 years agoSync the db as part of the glance-api install
Flavio Percoco [Wed, 7 Dec 2016 14:38:28 +0000 (15:38 +0100)]
Sync the db as part of the glance-api install

The glance database should be created as part of the glance-api service
installation and not the registry. Move the db_sync param to the
glance-api class call.

Change-Id: Ib9f511219e8cb9a7322745b6bd7c4f9c9cc0c198

8 years agoMerge "Adds ability to populate SSH Banner text"
Jenkins [Wed, 4 Jan 2017 02:37:57 +0000 (02:37 +0000)]
Merge "Adds ability to populate SSH Banner text"

8 years agoMerge "Add the ml2_odl section when using opendalight_v2"
Jenkins [Wed, 4 Jan 2017 02:37:52 +0000 (02:37 +0000)]
Merge "Add the ml2_odl section when using opendalight_v2"

8 years agoMerge "Don't include api/scheduler manifests on manila share service set up"
Jenkins [Wed, 4 Jan 2017 02:37:46 +0000 (02:37 +0000)]
Merge "Don't include api/scheduler manifests on manila share service set up"

8 years agoMerge "Add fossw of networking-fujitsu support to puppet-tripleo"
Jenkins [Tue, 3 Jan 2017 23:08:06 +0000 (23:08 +0000)]
Merge "Add fossw of networking-fujitsu support to puppet-tripleo"

8 years agoMerge "Add cell_v2 setup for nova"
Jenkins [Tue, 3 Jan 2017 21:17:20 +0000 (21:17 +0000)]
Merge "Add cell_v2 setup for nova"

8 years agoMerge "Avoid Yum/RPM prefetch in norpm provider"
Jenkins [Tue, 3 Jan 2017 19:40:57 +0000 (19:40 +0000)]
Merge "Avoid Yum/RPM prefetch in norpm provider"

8 years agoMerge "Include nova::compute::libvirt::qemu from the libvirt profile"
Jenkins [Tue, 3 Jan 2017 15:14:19 +0000 (15:14 +0000)]
Merge "Include nova::compute::libvirt::qemu from the libvirt profile"

8 years agoAvoid Yum/RPM prefetch in norpm provider
Dan Prince [Mon, 2 Jan 2017 21:46:48 +0000 (16:46 -0500)]
Avoid Yum/RPM prefetch in norpm provider

When package installation is disabled we still prefetch packages.
This disables the package prefetch by returning an empty array
which should be fine in the normal case and fixes issues when
running puppet in some docker containers.

Change-Id: Ia483c5f8500b804ba37a80e9ca1ec9c038f0a867

8 years agoDon't include api/scheduler manifests on manila share service set up
Jan Provaznik [Mon, 2 Jan 2017 11:32:20 +0000 (12:32 +0100)]
Don't include api/scheduler manifests on manila share service set up

Manila pacemaker manifest (which sets manila share service only)
includes also manila api and scheduler manifests. There is no
reason for this. Also it causes that on whichever node manila share
service runs also manila api and scheduler services are started.

Change-Id: Ia1b39ef36c5bc34813cd6430b69ad9b698acc3cf
Closes-Bug: #1653500

8 years agoAdd the ml2_odl section when using opendalight_v2
Itzik Brown [Thu, 29 Dec 2016 15:35:41 +0000 (17:35 +0200)]
Add the ml2_odl section when using opendalight_v2

Add the option to add the section of ml2_odl
to ml2_conf.ini when opendaylight_v2 mechanism driver is used

Change-Id: I2a1c5097614e47cc09e43bbc77305a0548d54baa

8 years agoMerge "Fix puppet version for requirements in metadata"
Jenkins [Fri, 23 Dec 2016 19:43:06 +0000 (19:43 +0000)]
Merge "Fix puppet version for requirements in metadata"

8 years agonova: use transport_url for rabbitmq
Emilien Macchi [Mon, 12 Dec 2016 20:23:47 +0000 (15:23 -0500)]
nova: use transport_url for rabbitmq

Configure Nova with new Oslo Messaging parameters for RabbitMQ.

Note: parameters are renamed to be standard, so it will help a future
transition to another backend in TripleO.

Change-Id: Ia67a4dbe5b2bd12c45308a5581f96d0457b8e018

8 years agoMerge "Add basic structure for ReNo"
Jenkins [Fri, 23 Dec 2016 11:29:21 +0000 (11:29 +0000)]
Merge "Add basic structure for ReNo"

8 years agoAdd cell_v2 setup for nova
Alex Schultz [Fri, 16 Dec 2016 23:22:54 +0000 (16:22 -0700)]
Add cell_v2 setup for nova

We need to run the basic cell v2 setup for nova as it is required for
Ocata.

Change-Id: I693239ff5026f58a65eb6278b1a8fcb97af4f561
Depends-On: I43ba77cd4c8da7c6dc117ab0bd53e5cd330dc3de
Depends-On: I9462ef16fd64a577c3f950bd121f0bd28670fabc
Closes-Bug: #1649341

8 years agoMerge "add support for collectd"
Jenkins [Thu, 22 Dec 2016 23:12:33 +0000 (23:12 +0000)]
Merge "add support for collectd"

8 years agoMerge "[CVE-2016-9599] Enforce Firewall TCP / UDP rules management"
Jenkins [Thu, 22 Dec 2016 22:34:41 +0000 (22:34 +0000)]
Merge "[CVE-2016-9599] Enforce Firewall TCP / UDP rules management"

8 years agoMerge "Ensure package updates don't happen unexpectedly"
Jenkins [Thu, 22 Dec 2016 22:34:26 +0000 (22:34 +0000)]
Merge "Ensure package updates don't happen unexpectedly"

8 years agoMerge "HPELeftHandISCSIDriver support for cinder"
Jenkins [Thu, 22 Dec 2016 22:14:38 +0000 (22:14 +0000)]
Merge "HPELeftHandISCSIDriver support for cinder"

8 years agoMerge "Add TLS proxy resource"
Jenkins [Thu, 22 Dec 2016 22:12:41 +0000 (22:12 +0000)]
Merge "Add TLS proxy resource"

8 years agoMerge "Split ovn plugin and northd configuration"
Jenkins [Thu, 22 Dec 2016 20:49:28 +0000 (20:49 +0000)]
Merge "Split ovn plugin and northd configuration"

8 years ago[CVE-2016-9599] Enforce Firewall TCP / UDP rules management
Emilien Macchi [Wed, 21 Dec 2016 20:10:52 +0000 (15:10 -0500)]
[CVE-2016-9599] Enforce Firewall TCP / UDP rules management

This closes CVE-2016-9599.

1) Sanitize dynamic HAproxy endpoints firewall rules

Build the hash of firewall rules only when a port is specified. The
HAproxy endpoints are using TCP protocol, which means we have to specify
a port to the IPtables rules.
Some services don't have public network exposure (e.g. Glance Registry),
which means they don't need haproxy_ssl rule.
The code prepare the hash depending on the service_port and
public_ssl_port parameters and create the actual firewall rules only if
one of those or both parameters are specified.
It will prevent new services without public exposure to open all traffic
because no port is specified.

2) Secure Firewall rules creations

The code won't allow to create TCP / UDP IPtables rules in INPUT
or OUTPUT chains without port or sport or dport, because doing it would
allow an IPtables rule opening all traffic for TCP or UDP.
If we try to do that, Puppet catalog will fail with an error explaining
why.
Example of use-cases:
- creating VRRP rules wouldn't require port parameters.
- creating TCP or UDP rules would require port parameters.

3) Allow to open all traffic for TCO / UDP (when desired)

Some use-cases require to open all traffic for all ports on TCP / UDP.
It will be possible if the user gives port = 'all' when creating the
firewall rule.

Backward compatibility:
- if our users created custom TCP / UDP firewall rules without port
  parameters, it won't work anymore, for security purpose.
- if you users want to open TCP / UDP for all ports, they need to pass
  port = 'all' and the rule will be created, though a warning will be
  displayed because this is insecure.
- if our users created custom VRRP rules without port parameters, it
  will still work correctly and rules will be created.
- TCP / UDP rules in FORWARD chain without port are still accepted.

Change-Id: I19396c8ab06b91fee3253cdfcb834482f4040a59
Closes-Bug: #1651831

8 years agoEnsure package updates don't happen unexpectedly
Steven Hardy [Thu, 22 Dec 2016 16:42:12 +0000 (16:42 +0000)]
Ensure package updates don't happen unexpectedly

I'm seeing this run yum update on deploy, even though hiera
tripleo::packages::enable_upgrade says false.

I assume these are needed because we're getting "false", but I'm
unclear if this is a recently introduced problem (I only noticed it
today as my image has outdated centos packages and it thus hung on
step2 of the deploy.

Change-Id: If09cdde9883f2674dbbc40944be5fe4445caa08e
Closes-Bug: #1652107

8 years agoAdd fossw of networking-fujitsu support to puppet-tripleo
Koki Sanagi [Wed, 21 Dec 2016 20:13:56 +0000 (15:13 -0500)]
Add fossw of networking-fujitsu support to puppet-tripleo

Enable ml2.pp to call networking-fujitsu manifest in puppet-neutron
for fossw ML2 plugin setting.

Change-Id: I044c5812bbc5cd3de4bc33556cffbe5bad8e64cf
Implements: blueprint integration-fossw-networking-fujitsu
Depends-On: I79df6b6a27d95f0c0e2c87207ab80235a4efccfc

8 years agoMerge "Decouple swift-proxy from ceilometer packages"
Jenkins [Thu, 22 Dec 2016 14:09:32 +0000 (14:09 +0000)]
Merge "Decouple swift-proxy from ceilometer packages"

8 years agoMerge "Add networking-fujitsu support to puppet-tripleo"
Jenkins [Thu, 22 Dec 2016 14:05:24 +0000 (14:05 +0000)]
Merge "Add networking-fujitsu support to puppet-tripleo"

8 years agoMerge "Do not use hardcoded controller_node_names when setting up the cluster"
Jenkins [Thu, 22 Dec 2016 07:58:15 +0000 (07:58 +0000)]
Merge "Do not use hardcoded controller_node_names when setting up the cluster"

8 years agoAdds ability to populate SSH Banner text
Luke Hinds [Thu, 8 Dec 2016 12:46:40 +0000 (12:46 +0000)]
Adds ability to populate SSH Banner text

A puppet manifest to allow the toggle of 'Banner' in sshd_config
and enable population of an SSH login banner needed for security
compliance such as DISA STIG

If `Bannertext` is set as a parameter, the `Banner` key within
sshd_config is toggled to `/etc/issue` and the content is copied
into the `/etc/issue` file

Change-Id: Ie9f8afdfa9930428f06c9669fedb460dc1064d5e
Closes-Bug: #1640306

8 years agoDecouples neutron services from OpenDaylight API service
Tim Rozet [Tue, 20 Dec 2016 18:40:57 +0000 (13:40 -0500)]
Decouples neutron services from OpenDaylight API service

Removes including Neutron services in the OpenDaylight API service.
This was breaking custom roles when splitting up OpenDaylight and Neutron
into different roles.  Also, references to "controller" are removed
because with custom roles OpenDaylight could be isolated to any role
type.  The 'bootstrap_nodeid' still works with any role, and only
resolves to the first node in the series of nodes for that role type.

Partial-Bug: 1651499

Change-Id: I418643810ee6b8a2c17a4754c83453140ebe39c7
Signed-off-by: Tim Rozet <trozet@redhat.com>
8 years agoAdd missing Swift base class
Christian Schwede [Tue, 20 Dec 2016 11:34:24 +0000 (12:34 +0100)]
Add missing Swift base class

The Swift base class is required if the SwiftStorageRole
is used without the SwiftRingBuilder role.

Change-Id: I496b65dc53c03c0711d21f98627cc21be653ca5d

8 years agoAdd TLS proxy resource
Juan Antonio Osorio Robles [Mon, 12 Dec 2016 13:00:58 +0000 (15:00 +0200)]
Add TLS proxy resource

some services need a terminating proxy to do TLS on their main
interfaces, to address this, we use httpd's mod_proxy and make it listen
in front of these services with an appropriate certificate.

bp tls-via-certmonger

Change-Id: I82243fd3acfe4f23aab373116b78e1daf9d08467

8 years agoMerge "Disable legacy ceilometer api by default"
Jenkins [Mon, 19 Dec 2016 22:39:40 +0000 (22:39 +0000)]
Merge "Disable legacy ceilometer api by default"

8 years agoMerge "Drop vip_hosts"
Jenkins [Mon, 19 Dec 2016 17:58:05 +0000 (17:58 +0000)]
Merge "Drop vip_hosts"

8 years agoMerge "Fix a typo in haproxy.pp"
Jenkins [Mon, 19 Dec 2016 10:49:12 +0000 (10:49 +0000)]
Merge "Fix a typo in haproxy.pp"

8 years agoMerge "Add tripleo::ui rspec tests"
Jenkins [Sat, 17 Dec 2016 01:34:07 +0000 (01:34 +0000)]
Merge "Add tripleo::ui rspec tests"

8 years agoInclude nova::compute::libvirt::qemu from the libvirt profile
Giulio Fidente [Fri, 16 Dec 2016 20:48:09 +0000 (21:48 +0100)]
Include nova::compute::libvirt::qemu from the libvirt profile

This is useful to customize the libvirt/qemu.conf limits when deploying
a large overcloud or one with many Ceph OSDs.

Change-Id: I258afd3ee6633e4b2ebc45aa8611be652476be0c
Depends-On: I5fa423a4b212d14f6e9ff6a270931b569558b54e

8 years agoadd support for collectd
Lars Kellogg-Stedman [Thu, 15 Dec 2016 03:07:26 +0000 (22:07 -0500)]
add support for collectd

This is the glue between the collectd composable service in
tripleo-heat-templates and the puppet-collectd module.

Change-Id: I7e899e3af870b04dcd45503bd322278997fa53d0

8 years agoAdd networking-fujitsu support to puppet-tripleo
Koki Sanagi [Wed, 30 Nov 2016 17:58:19 +0000 (12:58 -0500)]
Add networking-fujitsu support to puppet-tripleo

Enable ml2.pp to call networking-fujitsu manifest in puppet-neutron.
The implementation in puppet-neutron is in progress separately.

Change-Id: I5eb2c2a9c50b5991d62f4b6d74b83351c86b02de
Implements: blueprint integration-networking-fujitsu
Depends-On: I37a502b43eb7d91bfe20625248ed117eae3ca535

8 years agoDecouple swift-proxy from ceilometer packages
Dan Prince [Fri, 9 Dec 2016 08:37:41 +0000 (09:37 +0100)]
Decouple swift-proxy from ceilometer packages

This patch updates the swift proxy so that it only depends
on ceilometer if the ceilometer_api_enabled all-nodes-data hiera
setting has been set.

Also removes a parameter dependency where the
tripleo::profile::base::swift::proxy class was referencing
a puppet-ceilometer value from hiera (which can
also cause ceilometer dependencies).

Depends-On: Ief5399d7ea4d26e96ce54903a69d660fa4fe3ce9

Change-Id: I8d9f69f5e9160543b372bd9886800f16f625fdc6
Closes-bug: #1648736

8 years agoMerge "Changes default MidoNet API port on HAProxy"
Jenkins [Sun, 11 Dec 2016 00:19:33 +0000 (00:19 +0000)]
Merge "Changes default MidoNet API port on HAProxy"

8 years agoDisable legacy ceilometer api by default
Pradeep Kilambi [Fri, 9 Dec 2016 16:31:11 +0000 (11:31 -0500)]
Disable legacy ceilometer api by default

Ceilometer api is deprectaed in Ocata. Lets disable by default.
This can still be enabled by setting enable_legacy_ceilometer_api
param.

Change-Id: Iffb8c2cfed53d8b29e777c35cee44921194239e9

8 years agoRelease ocata-2
Emilien Macchi [Fri, 9 Dec 2016 11:15:55 +0000 (12:15 +0100)]
Release ocata-2

6.1.0 will be ocata-2.

Change-Id: Ic5c4e00135a1e876e755e6ada94abb42dd29f46a

8 years agoHPELeftHandISCSIDriver support for cinder
chinthagovardhan [Fri, 9 Dec 2016 11:00:55 +0000 (03:00 -0800)]
HPELeftHandISCSIDriver support for cinder

Cinder Backend configuration support for
HPELeftHandISCSIDriver for VSA storage

Change-Id: Ia7e5f3d436283f7949b0eb8f109b3dc0309af4f5

8 years agoMerge "Add cinder profile spec tests"
Jenkins [Fri, 9 Dec 2016 09:51:04 +0000 (09:51 +0000)]
Merge "Add cinder profile spec tests"

8 years agoMerge "Delete MidoNet deprecated classes and their tests"
Jenkins [Fri, 9 Dec 2016 08:38:42 +0000 (08:38 +0000)]
Merge "Delete MidoNet deprecated classes and their tests"

8 years agoDo not use hardcoded controller_node_names when setting up the cluster
Michele Baldessari [Wed, 7 Dec 2016 16:59:03 +0000 (17:59 +0100)]
Do not use hardcoded controller_node_names when setting up the cluster

Currently we chose the pacemaker cluster node by simply taking
hiera('controller_node_names'). We should instead use the
pacemaker_short_node_names array which is built dynamically
from all the nodes that include the pacemaker service.

Change-Id: I0a3e4acaab11e078da5eeb2ef2adde5387785927

8 years agoCreate Glance's database if glance-api is enabled
Flavio Percoco [Wed, 7 Dec 2016 14:16:41 +0000 (15:16 +0100)]
Create Glance's database if glance-api is enabled

Instead of checking for glance_registry_enabled, we should be checking
for glance_api_enabled. The glance-api v1 depends on the registry, which
means the database will be created but glance-api v2 doesn't which means
that not deploying the registry would result in the glance database not
being created. On the other hand, glance-registry is never deployed
without glance-api

Change-Id: Ief25dafb65f7a043fbb3d16f1d7ef834c9947a93

8 years agoDelete MidoNet deprecated classes and their tests
Alejandro Andreu [Mon, 21 Nov 2016 15:11:49 +0000 (16:11 +0100)]
Delete MidoNet deprecated classes and their tests

MidoNet no longer uses the API component. It has been renamed/refactored
to "cluster" as it can be seen on the docs at
https://blog.midonet.org/introducing-midonet-cluster-services/

Also there is no need to have a Cassandra and Zookeeper dedicated
classes, as we leverage this through the use of the midonet_openstack
puppet module.

Change-Id: I2f17aeeac2d1b121be0d445ff555320d5af5d270
Partial-Bug: #1647302

8 years agoAdd tripleo::ui rspec tests
Alex Schultz [Tue, 6 Dec 2016 23:52:02 +0000 (16:52 -0700)]
Add tripleo::ui rspec tests

Change-Id: I2eb5b84dbeedde58153bceb707fd15cce8f03d5e

8 years agoAdd cinder profile spec tests
Alex Schultz [Fri, 7 Oct 2016 21:43:37 +0000 (15:43 -0600)]
Add cinder profile spec tests

This change adds rspec testing for the cinder profiles with in
puppet-tripleo. Additionally while testing, it was found that the
backends may incorrectly have an extra , included in the settings
for cinder volume when running puppet 3.  This change includes a fix
the cinder volume backends to make sure we are not improperly
configuring it with a trailing comma.

Change-Id: Ibdfee330413b6f9aecdf42a5508c21126fc05973

8 years agoMerge "Remove unused pacemaker profiles"
Jenkins [Sun, 4 Dec 2016 01:49:09 +0000 (01:49 +0000)]
Merge "Remove unused pacemaker profiles"

8 years agoMerge "Add verify required and CA bundle to haproxy"
Jenkins [Sun, 4 Dec 2016 01:48:53 +0000 (01:48 +0000)]
Merge "Add verify required and CA bundle to haproxy"

8 years agoAdd basic structure for ReNo
Luke Hinds [Fri, 2 Dec 2016 11:12:03 +0000 (11:12 +0000)]
Add basic structure for ReNo

ReNo [1] is the release management tool in OpenStack.

This patch adds the basic structure to start using it for doc
builds in puppet-tripleo.

* Update .gitignore
* Add a basic note "use-reno"
* Add releasenotes/ dir and basic files
* Add python files: setup.cfg, setup.py, test-requirements.txt and
  tox.ini.

  [1] http://docs.openstack.org/developer/reno

Change-Id: Idc9a30ab632c8e2ca794fb10431cdefd5d861d14

8 years agoFixes typo in sriov_numvfs releasenotes
Luke Hinds [Fri, 2 Dec 2016 10:39:11 +0000 (10:39 +0000)]
Fixes typo in sriov_numvfs releasenotes

Change-Id: I729702a5326d74ad35485fa7276af45e2223ec5f

8 years agoMerge "Update ceilometer collector ipv6 handling"
Jenkins [Thu, 1 Dec 2016 14:30:04 +0000 (14:30 +0000)]
Merge "Update ceilometer collector ipv6 handling"

8 years agoMerge "Show team and repo badges on README"
Jenkins [Thu, 1 Dec 2016 14:29:07 +0000 (14:29 +0000)]
Merge "Show team and repo badges on README"

8 years agoInclude swift::storage::loopbacks class
Christian Schwede [Wed, 30 Nov 2016 21:03:25 +0000 (21:03 +0000)]
Include swift::storage::loopbacks class

This makes it possible to create loopback devices for Swift by using
additional Hieradata. For example, to create a 100M loopback device that
will be mounted on /srv/node/d1:

  parameter_defaults:
    ControllerExtraConfig:
      swift::storage::loopbacks::args: {"d1": {'seek': '100000'}}

Depends-On: I11a230b7cf08a4cc2a144d9af0e6c81bb3827348
Change-Id: I8741acc8afa1f1d23c5b25fa4bf27622f674a561

8 years agoMerge "Use FQDNs for RabbitMQ's cluster configuration"
Jenkins [Wed, 30 Nov 2016 17:06:10 +0000 (17:06 +0000)]
Merge "Use FQDNs for RabbitMQ's cluster configuration"

8 years agoMerge "Use FQDNs for the services' RabbitMQ configuration"
Jenkins [Wed, 30 Nov 2016 17:05:51 +0000 (17:05 +0000)]
Merge "Use FQDNs for the services' RabbitMQ configuration"

8 years agoAdd verify required and CA bundle to haproxy
Juan Antonio Osorio Robles [Fri, 18 Nov 2016 13:39:07 +0000 (15:39 +0200)]
Add verify required and CA bundle to haproxy

This only takes effect is internal-tls is used, and forces haproxy to
do proper verifications of the SSL certificates provided by the
servers.

bp tls-via-certmonger
Change-Id: Ibd98ec46dd6570887db29f55fe183deb1c9dc642

8 years agoSet memcache_servers in /etc/swift/object-expirer.conf
Christian Schwede [Wed, 30 Nov 2016 07:32:12 +0000 (07:32 +0000)]
Set memcache_servers in /etc/swift/object-expirer.conf

This defaults to 127.0.0.1:11211 without setting these explicitly. The
object-expirer is working without a correct memcache server, however it
is slower and warnings will be logged.

Related-Bug: 1627927
Depends-On: Ie139f018c4a742b014dd4d682970e154d66a8c6d
Change-Id: I89a879592a264d541cf42f007584e2e78058c867

8 years agopacemaker: create Mysql_user once Galera is ready (puppet4)
Emilien Macchi [Tue, 29 Nov 2016 21:57:20 +0000 (16:57 -0500)]
pacemaker: create Mysql_user once Galera is ready (puppet4)

Puppet 4 ordering make things more strict in catalog, which is good.
Resources have to be orchestrated or Puppet will take them in the order
they are found in catalog.

This patch makes sure we create MySQL users only when Galera is actually
ready.

Closes-Bug: #1645787
Change-Id: I536a1a128c3a7eca49bcc4f34a1307bcd60b029e

8 years agoMerge "Include local CA in haproxy PEM"
Jenkins [Tue, 29 Nov 2016 14:51:10 +0000 (14:51 +0000)]
Merge "Include local CA in haproxy PEM"