puppet/services/ironic-api.yaml

   1 heat_template_version: pike
   2
   3 description: >
   4   OpenStack Ironic API configured with Puppet
   5
   6 parameters:
   7   ServiceData:
   8     default: {}
   9     description: Dictionary packing service data
  10     type: json
  11   ServiceNetMap:
  12     default: {}
  13     description: Mapping of service_name -> network name. Typically set
  14                  via parameter_defaults in the resource registry.  This
  15                  mapping overrides those in ServiceNetMapDefaults.
  16     type: json
  17   DefaultPasswords:
  18     default: {}
  19     type: json
  20   RoleName:
  21     default: ''
  22     description: Role name on which the service is applied
  23     type: string
  24   RoleParameters:
  25     default: {}
  26     description: Parameters specific to the role
  27     type: json
  28   EndpointMap:
  29     default: {}
  30     description: Mapping of service endpoint -> protocol. Typically set
  31                  via parameter_defaults in the resource registry.
  32     type: json
  33   IronicPassword:
  34     description: The password for the Ironic service and db account, used by the Ironic services
  35     type: string
  36     hidden: true
  37   MonitoringSubscriptionIronicApi:
  38     default: 'overcloud-ironic-api'
  39     type: string
  40   KeystoneRegion:
  41     type: string
  42     default: 'regionOne'
  43     description: Keystone region for endpoint
  44   IronicApiPolicies:
  45     description: |
  46       A hash of policies to configure for Ironic API.
  47       e.g. { ironic-context_is_admin: { key: context_is_admin, value: 'role:admin' } }
  48     default: {}
  49     type: json
  50   EnableInternalTLS:
  51     type: boolean
  52     default: false
  53
  54 resources:
  55   ApacheServiceBase:
  56     type: ./apache.yaml
  57     properties:
  58       ServiceData: {get_param: ServiceData}
  59       ServiceNetMap: {get_param: ServiceNetMap}
  60       DefaultPasswords: {get_param: DefaultPasswords}
  61       EndpointMap: {get_param: EndpointMap}
  62       RoleName: {get_param: RoleName}
  63       RoleParameters: {get_param: RoleParameters}
  64       EnableInternalTLS: {get_param: EnableInternalTLS}
  65
  66   IronicBase:
  67     type: ./ironic-base.yaml
  68     properties:
  69       ServiceData: {get_param: ServiceData}
  70       ServiceNetMap: {get_param: ServiceNetMap}
  71       DefaultPasswords: {get_param: DefaultPasswords}
  72       EndpointMap: {get_param: EndpointMap}
  73       RoleName: {get_param: RoleName}
  74       RoleParameters: {get_param: RoleParameters}
  75
  76 outputs:
  77   role_data:
  78     description: Role data for the Ironic API role.
  79     value:
  80       service_name: ironic_api
  81       monitoring_subscription: {get_param: MonitoringSubscriptionIronicApi}
  82       config_settings:
  83         map_merge:
  84           - get_attr: [IronicBase, role_data, config_settings]
  85           - get_attr: [ApacheServiceBase, role_data, config_settings]
  86           - ironic::api::authtoken::password: {get_param: IronicPassword}
  87             ironic::api::authtoken::project_name: 'service'
  88             ironic::api::authtoken::user_domain_name: 'Default'
  89             ironic::api::authtoken::project_domain_name: 'Default'
  90             ironic::api::authtoken::username: 'ironic'
  91             ironic::api::authtoken::auth_uri: {get_param: [EndpointMap, KeystoneInternal, uri_no_suffix] }
  92             ironic::api::authtoken::auth_url: {get_param: [EndpointMap, KeystoneInternal, uri_no_suffix]}
  93             # NOTE: bind IP is found in Heat replacing the network name with the
  94             # local node IP for the given network; replacement examples
  95             # (eg. for internal_api):
  96             # internal_api -> IP
  97             # internal_api_uri -> [IP]
  98             # internal_api_subnet - > IP/CIDR
  99             ironic::api::host_ip: {get_param: [ServiceNetMap, IronicApiNetwork]}
 100             ironic::api::port: {get_param: [EndpointMap, IronicInternal, port]}
 101             # This is used to build links in responses
 102             ironic::api::public_endpoint: {get_param: [EndpointMap, IronicPublic, uri_no_suffix]}
 103             ironic::api::service_name: 'httpd'
 104             ironic::policy::policies: {get_param: IronicApiPolicies}
 105             ironic::wsgi::apache::bind_host: {get_param: [ServiceNetMap, IronicApiNetwork]}
 106             ironic::wsgi::apache::port: {get_param: [EndpointMap, IronicInternal, port]}
 107             ironic::wsgi::apache::servername:
 108               str_replace:
 109                 template:
 110                   "%{hiera('fqdn_$NETWORK')}"
 111                 params:
 112                   $NETWORK: {get_param: [ServiceNetMap, IronicApiNetwork]}
 113             ironic::wsgi::apache::ssl: {get_param: EnableInternalTLS}
 114             tripleo.ironic_api.firewall_rules:
 115               '133 ironic api':
 116                 dport:
 117                   - 6385
 118                   - 13385
 119       step_config: |
 120         include ::tripleo::profile::base::ironic::api
 121       service_config_settings:
 122         keystone:
 123           ironic::keystone::auth::admin_url: {get_param: [EndpointMap, IronicAdmin, uri_no_suffix]}
 124           ironic::keystone::auth::internal_url: {get_param: [EndpointMap, IronicInternal, uri_no_suffix]}
 125           ironic::keystone::auth::public_url: {get_param: [EndpointMap, IronicPublic, uri_no_suffix]}
 126           ironic::keystone::auth::auth_name: 'ironic'
 127           ironic::keystone::auth::password: {get_param: IronicPassword }
 128           ironic::keystone::auth::tenant: 'service'
 129           ironic::keystone::auth::region: {get_param: KeystoneRegion}
 130         mysql:
 131           ironic::db::mysql::password: {get_param: IronicPassword}
 132           ironic::db::mysql::user: ironic
 133           ironic::db::mysql::host: {get_param: [EndpointMap, MysqlInternal, host_nobrackets]}
 134           ironic::db::mysql::dbname: ironic
 135           ironic::db::mysql::allowed_hosts:
 136             - '%'
 137             - "%{hiera('mysql_bind_host')}"
 138       upgrade_tasks:
 139         - name: Stop ironic_api service (before httpd support)
 140           tags: step1
 141           service: name=openstack-ironic-api state=stopped enabled=no
 142         - name: Stop ironic_api service (running under httpd)
 143           tags: step1
 144           service: name=httpd state=stopped