opendev/system-config
Code Issues Proposed changes
d83a5cae14
system-config/modules/openstack_project/manifests/server.pp

55 lines
2.0 KiB
ObjectPascal
Raw Normal View History

Cleanup openstack_project manifest lint errors. Now with extra unwrap! Change-Id: I7c622ffa77821f33f911793fc6b6cdaaba37904a Reviewed-on: https://review.openstack.org/15052 Reviewed-by: Clark Boylan <clark.boylan@gmail.com> Approved: Jeremy Stanley <fungi@yuggoth.org> Reviewed-by: Jeremy Stanley <fungi@yuggoth.org> Tested-by: Jenkins
2012-11-15 14:25:13 -08:00
# == Class: openstack_project::server
#
Move OpenStack classes to openstack_project module Change-Id: Iafcd2e06c5b62e4cde5eccaab3173a20bb08a78d
2012-07-20 18:56:35 -07:00
# A server that we expect to run for some time
Use puppetmaster for slaves. Use puppet agent --test for puppet cron. We don't need the private ssh or gpg key on the slaves anymore. We do need the glance testing stuff, so stick that into hiera. Change-Id: If94fc3f150bf569efe9461f80d3565f9825eebce Reviewed-on: https://review.openstack.org/10851 Approved: Monty Taylor <mordred@inaugust.com> Reviewed-by: Monty Taylor <mordred@inaugust.com> Tested-by: Jenkins
2012-08-05 13:02:21 -05:00
class openstack_project::server (
$iptables_public_tcp_ports = [],
Allow specification of public UDP ports The iptables class allowed specifying a list of public UDP ports, just like it has support for TCP. However, a couple of places needed to be updated to pass through the UDP port list to make it usable. Change-Id: I00764bf1d7baff862fa51a6cd03211fe9a29ecdd
2013-07-17 15:25:56 +00:00
$iptables_public_udp_ports = [],
Make iptables additional rules a list. A list of iptables commands that come after the "-A OPENSTACK-INPUT" bit. Change-Id: Iee595d9267738365c208f8ecb6f0fd4941b357e3 Reviewed-on: https://review.openstack.org/17172 Reviewed-by: Clark Boylan <clark.boylan@gmail.com> Reviewed-by: Jeremy Stanley <fungi@yuggoth.org> Approved: Jeremy Stanley <fungi@yuggoth.org> Tested-by: Jenkins
2012-11-29 15:58:31 -08:00
$iptables_rules4 = [],
$iptables_rules6 = [],
Pass sysadmins list into node defs. Pass the sysadmins list into each node definition. This allows us to retrieve the data from hiera rather than hard coding it in the puppet manifests. Also, update test script to use bogus sysadmin data when testing. Change-Id: Ide3560f16bce4d66fb95cc5021fc879476e6a712 Reviewed-on: https://review.openstack.org/12512 Reviewed-by: James E. Blair <corvus@inaugust.com> Approved: Monty Taylor <mordred@inaugust.com> Reviewed-by: Monty Taylor <mordred@inaugust.com> Tested-by: Jenkins
2012-09-06 10:32:48 -07:00
$sysadmins = [],
Add node def for puppet3 master This change modifies install_puppet.sh to accept a --three option setting it to install the latest puppet available. It also creates a node definition for the puppetmaster.o.o node, the new 3 master, and the master of the future. Changes were made to various classes to allow the pinning to version 2.x to be turned off. Change-Id: I805d6dc50b9de0d8a99cf818d22d06c2dea6090a
2014-03-28 00:11:10 -07:00
$certname = $::fqdn,
Revert "Stop managing puppet apt pins" This reverts commit 5be2e2f18ac1f4489be760717519252ba20d4fba. Yay! We've sucessfully upgraded to puppet3 and the sun is shining! Start managing apt pins for puppet again, and also, set the default to be 3.x everywhere. Change-Id: I80db5b5e154a3849914aa348e1eabadd0a2ad936
2014-09-10 13:17:45 -07:00
$pin_puppet = '3.',
Allow site.pp to manage ca and ca_sever in puppet.conf This allows us to set ca = false and ca_server = <fqdn> on the new puppet 3 master. Change-Id: Iba189bdc4bfb22fd23052f2570f52133ea184126
2014-07-02 14:34:36 -07:00
$ca_server = undef,
Expose enable_unbound in openstack_project::server The openstack_project::template class has an $enable_unbound parameter that controls whether the unbound class is declared. Since openstack_project::server mostly just wraps the openstack_project::template class, we should be able to pass this parameter through openstack_project::server into openstack_project::template. The use case for allowing more control over unbound is that the InfraCloud baremetal nodes will use bifrost which sets up a dnsmasq during the install process. By default dnsmasq listens on localhost:53 which conflicts with unbound listening on the same interface and port. Currently bifrost doesn't allow us to configure the except-interface option in dnsmasq.conf, though adding that functionality is probably a valid alternative to this patch. Since we don't really need unbound when we control the dhcp server that assigns the domain-name-servers, it's easiest to just not include it. Change-Id: I6f7ea252950d78db55411133966eff3b18ef0ec9
2015-11-16 19:28:21 -08:00
$enable_unbound = true,
Add AFS I don't really think this needs any further explanation. Change-Id: I41378bd320c6c6fad2c981d5cc773486af075c41
2014-10-18 16:22:52 -07:00
$afs = false,
Configure puppetmaster server from manifest Currently the puppetmaster was hardcoded on a template. Add the matching vars to the manifests that use them, to make that setting configurable. Change-Id: I2b641ec11284f325c22c242fabba26d0433bf85b
2015-03-16 13:27:20 +01:00
$puppetmaster_server = 'puppetmaster.openstack.org',
Pass exim flag to template rather than exim class Now that the exim flag exists on template, use it in the server manifest. Change-Id: I07652ad88b77a9d551761dcae60208b571261bba
2015-05-14 16:48:10 -07:00
$manage_exim = true,
Don't hardcode pip.conf values In the same line as other changes, move settings of config file to template, and expose the settings on manifest, so it can be easily configurable. Depends-On: I78962555c9a9ec1a96ce19810a463a5d619b04f9 Change-Id: I673c9c177bf2fdb3e6428e3ad4252ee76b53309c
2015-06-10 07:47:11 +02:00
$pypi_index_url = 'https://pypi.python.org/simple',
$pypi_trusted_hosts = [
Update pypi_trusted_hosts This patch updates pypi trusted hosts for all nodes to add mirror.<region>.openstack.org. Change-Id: I64663b5b5c7063e840d6f2d11151766a5100af20
2015-12-04 06:01:12 -08:00
'pypi.bhs1.openstack.org',
'pypi.dfw.openstack.org',
'pypi.gra1.openstack.org',
'pypi.iad.openstack.org',
'pypi.nyj01.openstack.org',
'pypi.ord.openstack.org',
'pypi.region-b.geo-1.openstack.org',
'pypi.regionone.openstack.org',
'mirror.bhs1.ovh.openstack.org',
Fixed typo in mirrors We're using 'rax' rather than 'rackspace'. Change-Id: I444b43f7838e9b040c3401a8e3d49a713d29ae62
2016-01-22 10:17:29 -08:00
'mirror.dfw.rax.openstack.org',
Update pypi_trusted_hosts This patch updates pypi trusted hosts for all nodes to add mirror.<region>.openstack.org. Change-Id: I64663b5b5c7063e840d6f2d11151766a5100af20
2015-12-04 06:01:12 -08:00
'mirror.gra1.ovh.openstack.org',
'mirror.iad.rax.openstack.org',
'mirror.nyj01.internap.openstack.org',
'mirror.ord.rax.openstack.org',
'mirror.region-b.geo-1.hpcloud.openstack.org',
'mirror.regionone.bluebox-sjc1.openstack.org',
Don't hardcode pip.conf values In the same line as other changes, move settings of config file to template, and expose the settings on manifest, so it can be easily configurable. Depends-On: I78962555c9a9ec1a96ce19810a463a5d619b04f9 Change-Id: I673c9c177bf2fdb3e6428e3ad4252ee76b53309c
2015-06-10 07:47:11 +02:00
],
Pass sysadmins list into node defs. Pass the sysadmins list into each node definition. This allows us to retrieve the data from hiera rather than hard coding it in the puppet manifests. Also, update test script to use bogus sysadmin data when testing. Change-Id: Ide3560f16bce4d66fb95cc5021fc879476e6a712 Reviewed-on: https://review.openstack.org/12512 Reviewed-by: James E. Blair <corvus@inaugust.com> Approved: Monty Taylor <mordred@inaugust.com> Reviewed-by: Monty Taylor <mordred@inaugust.com> Tested-by: Jenkins
2012-09-06 10:32:48 -07:00
) {
Move OpenStack classes to openstack_project module Change-Id: Iafcd2e06c5b62e4cde5eccaab3173a20bb08a78d
2012-07-20 18:56:35 -07:00
class { 'openstack_project::template':
Use puppetmaster for slaves. Use puppet agent --test for puppet cron. We don't need the private ssh or gpg key on the slaves anymore. We do need the glance testing stuff, so stick that into hiera. Change-Id: If94fc3f150bf569efe9461f80d3565f9825eebce Reviewed-on: https://review.openstack.org/10851 Approved: Monty Taylor <mordred@inaugust.com> Reviewed-by: Monty Taylor <mordred@inaugust.com> Tested-by: Jenkins
2012-08-05 13:02:21 -05:00
iptables_public_tcp_ports => $iptables_public_tcp_ports,
Allow specification of public UDP ports The iptables class allowed specifying a list of public UDP ports, just like it has support for TCP. However, a couple of places needed to be updated to pass through the UDP port list to make it usable. Change-Id: I00764bf1d7baff862fa51a6cd03211fe9a29ecdd
2013-07-17 15:25:56 +00:00
iptables_public_udp_ports => $iptables_public_udp_ports,
Make iptables additional rules a list. A list of iptables commands that come after the "-A OPENSTACK-INPUT" bit. Change-Id: Iee595d9267738365c208f8ecb6f0fd4941b357e3 Reviewed-on: https://review.openstack.org/17172 Reviewed-by: Clark Boylan <clark.boylan@gmail.com> Reviewed-by: Jeremy Stanley <fungi@yuggoth.org> Approved: Jeremy Stanley <fungi@yuggoth.org> Tested-by: Jenkins
2012-11-29 15:58:31 -08:00
iptables_rules4 => $iptables_rules4,
iptables_rules6 => $iptables_rules6,
Cleanup openstack_project manifest lint errors. Now with extra unwrap! Change-Id: I7c622ffa77821f33f911793fc6b6cdaaba37904a Reviewed-on: https://review.openstack.org/15052 Reviewed-by: Clark Boylan <clark.boylan@gmail.com> Approved: Jeremy Stanley <fungi@yuggoth.org> Reviewed-by: Jeremy Stanley <fungi@yuggoth.org> Tested-by: Jenkins
2012-11-15 14:25:13 -08:00
certname => $certname,
Add node def for puppet3 master This change modifies install_puppet.sh to accept a --three option setting it to install the latest puppet available. It also creates a node definition for the puppetmaster.o.o node, the new 3 master, and the master of the future. Changes were made to various classes to allow the pinning to version 2.x to be turned off. Change-Id: I805d6dc50b9de0d8a99cf818d22d06c2dea6090a
2014-03-28 00:11:10 -07:00
pin_puppet => $pin_puppet,
Allow site.pp to manage ca and ca_sever in puppet.conf This allows us to set ca = false and ca_server = <fqdn> on the new puppet 3 master. Change-Id: Iba189bdc4bfb22fd23052f2570f52133ea184126
2014-07-02 14:34:36 -07:00
ca_server => $ca_server,
Configure puppetmaster server from manifest Currently the puppetmaster was hardcoded on a template. Add the matching vars to the manifests that use them, to make that setting configurable. Change-Id: I2b641ec11284f325c22c242fabba26d0433bf85b
2015-03-16 13:27:20 +01:00
puppetmaster_server => $puppetmaster_server,
Expose enable_unbound in openstack_project::server The openstack_project::template class has an $enable_unbound parameter that controls whether the unbound class is declared. Since openstack_project::server mostly just wraps the openstack_project::template class, we should be able to pass this parameter through openstack_project::server into openstack_project::template. The use case for allowing more control over unbound is that the InfraCloud baremetal nodes will use bifrost which sets up a dnsmasq during the install process. By default dnsmasq listens on localhost:53 which conflicts with unbound listening on the same interface and port. Currently bifrost doesn't allow us to configure the except-interface option in dnsmasq.conf, though adding that functionality is probably a valid alternative to this patch. Since we don't really need unbound when we control the dhcp server that assigns the domain-name-servers, it's easiest to just not include it. Change-Id: I6f7ea252950d78db55411133966eff3b18ef0ec9
2015-11-16 19:28:21 -08:00
enable_unbound => $enable_unbound,
Add AFS I don't really think this needs any further explanation. Change-Id: I41378bd320c6c6fad2c981d5cc773486af075c41
2014-10-18 16:22:52 -07:00
afs => $afs,
Pass exim flag to template rather than exim class Now that the exim flag exists on template, use it in the server manifest. Change-Id: I07652ad88b77a9d551761dcae60208b571261bba
2015-05-14 16:48:10 -07:00
manage_exim => $manage_exim,
sysadmins => $sysadmins,
Don't hardcode pip.conf values In the same line as other changes, move settings of config file to template, and expose the settings on manifest, so it can be easily configurable. Depends-On: I78962555c9a9ec1a96ce19810a463a5d619b04f9 Change-Id: I673c9c177bf2fdb3e6428e3ad4252ee76b53309c
2015-06-10 07:47:11 +02:00
pypi_index_url => $pypi_index_url,
pypi_trusted_hosts => $pypi_trusted_hosts,
Puppet the Ubuntu sources.list files on servers Because some of our virtual machine providers have perverse ideas about maintaining their own mirrors of security update package repositories, which is widely acknowledged[*] as an unsafe practice, it's easiest to just fix this with a consistent sources.list file across all our servers and not bother with package mirrors for now. Note this should not affect our single-use workers as they do not apply the openstack_project::server class. [*] http://askubuntu.com/questions/646853 Change-Id: I26c1ba0e0b6366249b9634f85bb54ed412ecb789
2016-01-14 18:56:24 +00:00
purge_apt_sources => true,
Move OpenStack classes to openstack_project module Change-Id: Iafcd2e06c5b62e4cde5eccaab3173a20bb08a78d
2012-07-20 18:56:35 -07:00
}
}
Copy Permalink