From 8322a32ea1be206e4e81b25b6a04cb9b62384875 Mon Sep 17 00:00:00 2001
From: Ivan Ponomarev <iponomarev@mirantis.com>
Date: Mon, 8 Aug 2016 14:26:33 +0300
Subject: [PATCH] Decomposition of neutron tasks

Implements: blueprint role-decomposition
Change-Id: Ib65fe6327c252c82a1cbb8e5196a90a40193acd4
(cherry picked from commit 2603220e4ca02c0828c87b370f6a73b8350a2409)
---
 .../examples/keystone/tasks.yaml              |  4 +-
 .../examples/openstack-network/tasks.yaml     | 82 +++++++++++--------
 .../openstack_tasks/examples/roles/tasks.yaml |  4 +-
 .../examples/sahara/tasks.yaml                | 13 ++-
 .../openstack_network/agents/dhcp.pp          |  4 +-
 .../manifests/openstack_network/agents/l3.pp  | 12 +--
 .../openstack_network/agents/metadata.pp      | 11 ++-
 .../openstack_network/plugins/ml2.pp          |  5 +-
 .../manifests/openstack_network/routers.pp    |  2 +-
 .../openstack_network/server_config.pp        |  5 +-
 .../manifests/firewall/firewall.pp            | 71 ++++++++--------
 .../manifests/globals/globals.pp              | 11 +--
 .../osnailyfacter/modular/cluster/tasks.yaml  |  3 +-
 .../osnailyfacter/modular/firewall/tasks.yaml |  2 +-
 .../modular/fuel_pkgs/tasks.yaml              |  2 +-
 .../osnailyfacter/modular/globals/tasks.yaml  |  3 +-
 .../osnailyfacter/modular/hiera/tasks.yaml    |  3 +-
 .../osnailyfacter/modular/hosts/tasks.yaml    |  2 +-
 .../osnailyfacter/modular/logging/tasks.yaml  |  2 +-
 .../modular/netconfig/tasks.yaml              |  2 +-
 .../osnailyfacter/modular/tools/tasks.yaml    |  2 +-
 .../osnailyfacter/templates/globals_yaml.erb  |  1 +
 .../hosts/openstack-network/agents/l3_spec.rb | 10 +--
 .../openstack-network/agents/metadata_spec.rb |  8 +-
 .../hosts/openstack-network/routers_spec.rb   |  8 +-
 .../openstack-network/server-config_spec.rb   |  8 +-
 26 files changed, 152 insertions(+), 128 deletions(-)

diff --git a/deployment/puppet/openstack_tasks/examples/keystone/tasks.yaml b/deployment/puppet/openstack_tasks/examples/keystone/tasks.yaml
index de478d4969..f6abf75b0a 100644
--- a/deployment/puppet/openstack_tasks/examples/keystone/tasks.yaml
+++ b/deployment/puppet/openstack_tasks/examples/keystone/tasks.yaml
@@ -2,7 +2,7 @@
   type: puppet
   version: 2.2.0
   tags: [primary-controller, controller,
-         primary-keystone, keystone]
+         primary-keystone, keystone, primary-neutron, neutron]
   requires: [deploy_start, openstack-haproxy]
   required_for: [primary-keystone, keystone]
   cross-depends:
@@ -38,7 +38,7 @@
 - id: keystone-openrc-generate
   type: puppet
   version: 2.2.0
-  tags: [primary-controller, controller]
+  tags: [primary-controller, controller, primary-neutron, neutron]
   requires: [openrc-delete, primary-keystone, keystone]
   cross-depends:
     - name: openrc-delete
diff --git a/deployment/puppet/openstack_tasks/examples/openstack-network/tasks.yaml b/deployment/puppet/openstack_tasks/examples/openstack-network/tasks.yaml
index 7a0093431e..9187b1bb3c 100644
--- a/deployment/puppet/openstack_tasks/examples/openstack-network/tasks.yaml
+++ b/deployment/puppet/openstack_tasks/examples/openstack-network/tasks.yaml
@@ -39,21 +39,30 @@
 # Anchor (empty task) for another tasks, say 'tenant network FW setup starting'
 - id: openstack-network-start
   type: skipped
-  version: 2.0.0
-  groups: [primary-controller,controller,compute]
+  version: 2.2.0
+  tags: [compute, primary-neutron, neutron]
   requires: [neutron-keystone, neutron-db, netconfig, primary-openstack-controller, openstack-controller, top-role-compute]
   required_for: [openstack-network-common-config]
+  version: 2.2.0
+  tags: [compute, primary-neutron, neutron]
   cross-depends:
+    - name: netconfig
+      role: self
+    - name: primary-openstack-controller
+    - name: openstack-controller
+    - name: top-role-compute
     - name: neutron-keystone
     - name: openstack-haproxy
-      role: primary-controller
     - name: neutron-db
     - name: /^(primary-)?rabbitmq$/
+  cross-depended-by:
+    - name: openstack-network-common-config
+      role: self
 
 - id: openstack-network-common-config
   type: puppet
-  version: 2.1.0
-  groups: [primary-controller,controller,compute]
+  version: 2.2.0
+  tags: [compute, primary-neutron, neutron]
   required_for: [openstack-network-end]
   requires: [openstack-network-start]
   condition:
@@ -73,8 +82,8 @@
 
 - id: openstack-network-server-config
   type: puppet
-  version: 2.1.0
-  groups: [primary-controller,controller]
+  version: 2.2.0
+  tags: [primary-neutron, neutron]
   required_for: [openstack-network-end]
   requires: [openstack-network-start, openstack-network-common-config]
   condition:
@@ -93,8 +102,8 @@
 
 - id: primary-openstack-network-plugins-l2
   type: puppet
-  version: 2.1.0
-  groups: [primary-controller]
+  version: 2.2.0
+  tags: [primary-neutron]
   required_for: [openstack-network-end]
   requires: [openstack-network-start, openstack-network-common-config, openstack-network-server-config]
   condition:
@@ -113,8 +122,8 @@
 
 - id: openstack-network-plugins-l2
   type: puppet
-  version: 2.1.0
-  groups: [controller,compute]
+  version: 2.2.0
+  tags: [compute, neutron]
   required_for: [openstack-network-end]
   requires: [openstack-network-start, openstack-network-common-config, openstack-network-server-config]
   condition:
@@ -130,7 +139,7 @@
 - id: openstack-network-networks
   type: puppet
   version: 2.2.0
-  tags: [primary-controller]
+  tags: [primary-neutron]
   required_for: [openstack-network-end]
   requires: [openstack-network-start, openstack-network-common-config, openstack-network-server-config, primary-openstack-network-plugins-l2]
   cross-depends:
@@ -155,7 +164,7 @@
 - id: openstack-network-routers
   type: puppet
   version: 2.2.0
-  tags: [primary-controller]
+  tags: [primary-neutron]
   required_for: [openstack-network-end]
   requires: [openstack-network-start, openstack-network-networks]
   cross-depends:
@@ -180,7 +189,7 @@
 - id: openstack-network-routers-ha
   type: puppet
   version: 2.2.0
-  tags: [primary-controller]
+  tags: [primary-neutron]
   condition:
     yaql_exp: >
       $.neutron_advanced_configuration.neutron_l3_ha and
@@ -196,7 +205,7 @@
 - id: primary-openstack-network-agents-l3
   type: puppet
   version: 2.2.0
-  tags: [primary-controller]
+  tags: [primary-neutron]
   required_for: [openstack-network-end]
   requires: [openstack-network-start, openstack-network-networks, openstack-network-routers, primary-openstack-network-plugins-l2, openstack-network-plugins-l2]
   cross-depends:
@@ -227,12 +236,12 @@
 - id: openstack-network-agents-l3
   type: puppet
   version: 2.2.0
-  tags: [controller,compute]
+  tags: [neutron, compute]
   required_for: [openstack-network-end]
   requires: [openstack-network-start, openstack-network-networks, openstack-network-routers, primary-openstack-network-plugins-l2, openstack-network-plugins-l2]
   cross-depends:
     - name: /^(primary-)?openstack-network-plugins-l2$/
-      role: ["/^(primary-)?controller$/"]
+      role: ["/^(primary-)?neutron$/"]
     - name: openstack-network-start
       role: self
     - name: openstack-network-networks
@@ -267,18 +276,21 @@
 
 - id: openstack-network-server-nova
   type: puppet
-  version: 2.1.0
-  groups: [primary-controller,controller]
-  required_for: [openstack-network-end]
-  requires: [openstack-network-start, openstack-network-common-config, openstack-network-server-config, openstack-network-agents-l3]
+  version: 2.2.0
+  tags: [primary-controller, controller]
   condition:
     yaql_exp: >
       changedAny($.quantum, $.quantum_settings,
       $.network_metadata.vips, $.get('use_ssl'))
   cross-depends:
-    - name: /^(primary-)?openstack-network-common-config$/
+    - name: openstack-network-start
       role: self
-    - name: /^(primary-)?openstack-network-server-config$/
+    - name: openstack-network-agents-l3
+      role: self
+    - name: /(primary-)?openstack-network-common-config/
+    - name: /(primary-)?openstack-network-server-config/
+  cross-depended-by:
+    - name: openstack-network-end
       role: self
   parameters:
     puppet_manifest: /etc/puppet/modules/openstack_tasks/examples/openstack-network/server-nova.pp
@@ -287,8 +299,8 @@
 
 - id: primary-openstack-network-agents-dhcp
   type: puppet
-  version: 2.1.0
-  groups: [primary-controller]
+  version: 2.2.0
+  tags: [primary-neutron]
   required_for: [openstack-network-end]
   requires: [openstack-network-start, openstack-network-common-config, openstack-network-server-config, openstack-network-server-nova, openstack-network-agents-l3]
   condition:
@@ -307,8 +319,8 @@
 
 - id: openstack-network-agents-dhcp
   type: puppet
-  version: 2.1.0
-  groups: [controller]
+  version: 2.2.0
+  tags: [neutron]
   required_for: [openstack-network-end]
   requires: [openstack-network-start, openstack-network-common-config, openstack-network-server-config, openstack-network-server-nova, openstack-network-agents-l3]
   condition:
@@ -325,8 +337,8 @@
 
 - id: primary-openstack-network-agents-metadata
   type: puppet
-  version: 2.1.0
-  groups: [primary-controller]
+  version: 2.2.0
+  tags: [primary-neutron]
   required_for: [openstack-network-end]
   requires: [openstack-network-start, openstack-network-common-config, openstack-network-server-config, openstack-network-server-nova, openstack-network-agents-l3]
   refresh_on: [neutron_metadata_agent_config]
@@ -353,8 +365,8 @@
 
 - id: openstack-network-agents-metadata
   type: puppet
-  version: 2.1.0
-  groups: [controller,compute]
+  version: 2.2.0
+  tags: [neutron,compute]
   required_for: [openstack-network-end]
   requires: [openstack-network-start, openstack-network-common-config, openstack-network-server-config, openstack-network-server-nova, openstack-network-agents-l3]
   condition:
@@ -362,8 +374,8 @@
   refresh_on: [neutron_metadata_agent_config]
   cross-depends:
     - name: primary-openstack-network-agents-metadata
-    - name: /^(primary-)?openstack-network-plugins-l2$/
-      role: ["/^(primary-)?controller$/"]
+    - name: /(primary-)?openstack-network-plugins-l2/
+      role: ["/(primary-)?neutron/"]
   parameters:
     puppet_manifest: /etc/puppet/modules/openstack_tasks/examples/openstack-network/agents/metadata.pp
     puppet_modules: /etc/puppet/modules
@@ -389,7 +401,7 @@
 # Anchor (empty task) for another tasks, say 'tenant network FW setup done'
 - id: openstack-network-end
   type: skipped
-  version: 2.0.0
-  groups: [primary-controller,controller,compute]
+  version: 2.2.0
+  tags: [compute, primary-neutron, neutron]
   required_for: [deploy_end]
   requires: []
diff --git a/deployment/puppet/openstack_tasks/examples/roles/tasks.yaml b/deployment/puppet/openstack_tasks/examples/roles/tasks.yaml
index 8f16d12e7d..3ede24b16e 100644
--- a/deployment/puppet/openstack_tasks/examples/roles/tasks.yaml
+++ b/deployment/puppet/openstack_tasks/examples/roles/tasks.yaml
@@ -176,9 +176,11 @@
   type: puppet
   version: 2.1.0
   groups: [compute, compute-vmware]
-  requires: [top-role-compute, top-role-compute-vmware, openstack-network-compute-nova]
+  requires: [top-role-compute, top-role-compute-vmware]
   required_for: [deploy_end]
   refresh_on: [nova_config, nova_paste_api_ini]
+  cross-depends:
+    - name: openstack-network-compute-nova
   condition:
     yaql_exp: *top_compute
   parameters:
diff --git a/deployment/puppet/openstack_tasks/examples/sahara/tasks.yaml b/deployment/puppet/openstack_tasks/examples/sahara/tasks.yaml
index 7b5c570391..d98ee5ee35 100644
--- a/deployment/puppet/openstack_tasks/examples/sahara/tasks.yaml
+++ b/deployment/puppet/openstack_tasks/examples/sahara/tasks.yaml
@@ -1,7 +1,7 @@
 - id: sahara
   type: puppet
-  version: 2.1.0
-  groups: [primary-controller, controller]
+  version: 2.2.0
+  tags: [primary-controller, controller]
   condition:
     yaql_exp: >
       $.sahara.enabled and changedAny($.access, $.sahara, $.rabbit,
@@ -15,11 +15,16 @@
         $.node_roles.any($.matches('controller'))).network_roles.select(
           $.get('mgmt/messaging')), $.get('amqp_hosts'),
       $.get('external_lb'), $.get('use_ssl'), $.get('kombu_compression'))
-  required_for: [deploy_end, controller_remaining_tasks]
-  requires: [openstack-network-end, horizon]
   cross-depends:
+    - name: openstack-network-end
+    - name: horizon
     - name: sahara-db
     - name: sahara-keystone
+  cross-depended-by:
+    - name: deploy_end
+      role: self
+    - name: controller_remaining_tasks
+      role: self
   parameters:
     puppet_manifest: /etc/puppet/modules/openstack_tasks/examples/sahara/sahara.pp
     puppet_modules: /etc/puppet/modules
diff --git a/deployment/puppet/openstack_tasks/manifests/openstack_network/agents/dhcp.pp b/deployment/puppet/openstack_tasks/manifests/openstack_network/agents/dhcp.pp
index 57c25d2ba5..b310afe6c8 100644
--- a/deployment/puppet/openstack_tasks/manifests/openstack_network/agents/dhcp.pp
+++ b/deployment/puppet/openstack_tasks/manifests/openstack_network/agents/dhcp.pp
@@ -22,9 +22,9 @@ class openstack_tasks::openstack_network::agents::dhcp {
     }
 
     if $ha_agent {
-      $primary_controller = hiera('primary_controller')
+      $primary_neutron = has_primary_role(intersection(hiera('neutron_roles'), hiera('roles')))
       class { '::cluster::neutron::dhcp' :
-        primary => $primary_controller,
+        primary => $primary_neutron,
       }
     }
 
diff --git a/deployment/puppet/openstack_tasks/manifests/openstack_network/agents/l3.pp b/deployment/puppet/openstack_tasks/manifests/openstack_network/agents/l3.pp
index 21769e5685..8b0f6851d5 100644
--- a/deployment/puppet/openstack_tasks/manifests/openstack_network/agents/l3.pp
+++ b/deployment/puppet/openstack_tasks/manifests/openstack_network/agents/l3.pp
@@ -6,17 +6,17 @@ class openstack_tasks::openstack_network::agents::l3 {
   $neutron_advanced_config = hiera_hash('neutron_advanced_configuration', { })
   $dvr = pick($neutron_advanced_config['neutron_dvr'], false)
 
-  $neutron_controller_roles = hiera('neutron_controller_roles', ['controller', 'primary-controller'])
+  $neutron_controller_roles = hiera('neutron_roles')
   $neutron_compute_roles    = hiera('neutron_compute_nodes', ['compute'])
-  $controller               = roles_include($neutron_controller_roles)
+  $neutron_controller       = roles_include($neutron_controller_roles)
   $compute                  = roles_include($neutron_compute_roles)
 
-  if $use_neutron and ($controller or ($dvr and $compute)) {
+  if $neutron_controller or ($dvr and $compute) {
     $debug                   = hiera('debug', true)
     $metadata_port           = '8775'
     $network_scheme          = hiera_hash('network_scheme', {})
 
-    if $controller {
+    if $neutron_controller {
       if $dvr {
         $agent_mode = 'dvr_snat'
       } else {
@@ -41,9 +41,9 @@ class openstack_tasks::openstack_network::agents::l3 {
     }
 
     if ($ha_agent) and !($compute) {
-      $primary_controller = hiera('primary_controller')
+      $primary_neutron = has_primary_role(intersection(hiera('neutron_roles'), hiera('roles')))
       cluster::neutron::l3 { 'default-l3' :
-        primary => $primary_controller,
+        primary => $primary_neutron,
       }
     }
 
diff --git a/deployment/puppet/openstack_tasks/manifests/openstack_network/agents/metadata.pp b/deployment/puppet/openstack_tasks/manifests/openstack_network/agents/metadata.pp
index 70810acf62..9a8ea7eefc 100644
--- a/deployment/puppet/openstack_tasks/manifests/openstack_network/agents/metadata.pp
+++ b/deployment/puppet/openstack_tasks/manifests/openstack_network/agents/metadata.pp
@@ -2,10 +2,9 @@ class openstack_tasks::openstack_network::agents::metadata {
 
   notice('MODULAR: openstack_network/agents/metadata.pp')
 
-  $use_neutron              = hiera('use_neutron', false)
-  $neutron_controller_roles = hiera('neutron_controller_roles', ['controller', 'primary-controller'])
+  $neutron_controller_roles = hiera('neutron_roles')
   $neutron_compute_roles    = hiera('neutron_compute_nodes', ['compute'])
-  $controller               = roles_include($neutron_controller_roles)
+  $neutron_controller       = roles_include($neutron_controller_roles)
   $compute                  = roles_include($neutron_compute_roles)
   $neutron_advanced_config  = hiera_hash('neutron_advanced_configuration', { })
   $neutron_config           = hiera_hash('neutron_config')
@@ -20,7 +19,7 @@ class openstack_tasks::openstack_network::agents::metadata {
                              min(max($::processorcount, 2), $workers_max))
   }
 
-  if $use_neutron and ($controller or ($dvr and $compute)) {
+  if $neutron_controller or ($dvr and $compute) {
     $debug                  = hiera('debug', true)
     $ha_agent               = try_get_value($neutron_advanced_config, 'metadata_agent_ha', true)
     $service_endpoint       = hiera('service_endpoint')
@@ -44,9 +43,9 @@ class openstack_tasks::openstack_network::agents::metadata {
     }
 
     if ($ha_agent) and !($compute) {
-      $primary_controller = hiera('primary_controller')
+      $primary_neutron = has_primary_role(intersection(hiera('neutron_roles'), hiera('roles')))
       class { '::cluster::neutron::metadata' :
-        primary => $primary_controller,
+        primary => $primary_neutron,
       }
     }
 
diff --git a/deployment/puppet/openstack_tasks/manifests/openstack_network/plugins/ml2.pp b/deployment/puppet/openstack_tasks/manifests/openstack_network/plugins/ml2.pp
index 5212f9bd19..0f2f0905b8 100644
--- a/deployment/puppet/openstack_tasks/manifests/openstack_network/plugins/ml2.pp
+++ b/deployment/puppet/openstack_tasks/manifests/openstack_network/plugins/ml2.pp
@@ -8,9 +8,8 @@ class openstack_tasks::openstack_network::plugins::ml2 {
     include ::neutron::params
 
     $node_name = hiera('node_name')
-    $neutron_primary_controller_roles = hiera('neutron_primary_controller_roles', ['primary-controller'])
     $neutron_compute_roles            = hiera('neutron_compute_nodes', ['compute'])
-    $primary_controller               = roles_include($neutron_primary_controller_roles)
+    $primary_neutron                  = has_primary_role(intersection(hiera('neutron_roles'), hiera('roles')))
     $compute                          = roles_include($neutron_compute_roles)
 
     $neutron_config = hiera_hash('neutron_config')
@@ -160,7 +159,7 @@ class openstack_tasks::openstack_network::plugins::ml2 {
       if $ha_agent {
         #Exec<| title == 'waiting-for-neutron-api' |> ->
         class { '::cluster::neutron::ovs' :
-          primary => $primary_controller,
+          primary => $primary_neutron,
         }
       }
     }
diff --git a/deployment/puppet/openstack_tasks/manifests/openstack_network/routers.pp b/deployment/puppet/openstack_tasks/manifests/openstack_network/routers.pp
index 74ff548f40..097b8bc1b3 100644
--- a/deployment/puppet/openstack_tasks/manifests/openstack_network/routers.pp
+++ b/deployment/puppet/openstack_tasks/manifests/openstack_network/routers.pp
@@ -8,7 +8,7 @@ class openstack_tasks::openstack_network::routers {
   # as HA routers can't be created when less then 2 L3 agents are available (Neutron limitation)
   $l3_ha                    = pick($neutron_advanced_config['neutron_l3_ha'], false)
   $dvr                      = pick($neutron_advanced_config['neutron_dvr'], false)
-  $neutron_controller_roles = hiera('neutron_controller_roles', ['controller', 'primary-controller'])
+  $neutron_controller_roles = hiera('neutron_roles')
   $controllers_num          = size(get_nodes_hash_by_roles(hiera_hash('network_metadata'), $neutron_controller_roles))
 
   if $use_neutron {
diff --git a/deployment/puppet/openstack_tasks/manifests/openstack_network/server_config.pp b/deployment/puppet/openstack_tasks/manifests/openstack_network/server_config.pp
index 83b3749ec3..ade1659633 100644
--- a/deployment/puppet/openstack_tasks/manifests/openstack_network/server_config.pp
+++ b/deployment/puppet/openstack_tasks/manifests/openstack_network/server_config.pp
@@ -15,9 +15,8 @@ class openstack_tasks::openstack_network::server_config {
     $nova_hash               = hiera_hash('nova', { })
     $pci_vendor_devs         = $neutron_config['supported_pci_vendor_devs']
 
-    $neutron_primary_controller_roles = hiera('neutron_primary_controller_roles', ['primary-controller'])
     $neutron_compute_roles            = hiera('neutron_compute_nodes', ['compute'])
-    $primary_controller               = roles_include($neutron_primary_controller_roles)
+    $primary_neutron                  = has_primary_role(intersection(hiera('neutron_roles'), hiera('roles')))
     $compute                          = roles_include($neutron_compute_roles)
 
     $db_type     = 'mysql'
@@ -179,7 +178,7 @@ class openstack_tasks::openstack_network::server_config {
     }
 
     class { '::neutron::server':
-      sync_db                          => $primary_controller,
+      sync_db                          => $primary_neutron,
 
       username                         => $username,
       password                         => $password,
diff --git a/deployment/puppet/osnailyfacter/manifests/firewall/firewall.pp b/deployment/puppet/osnailyfacter/manifests/firewall/firewall.pp
index 29e15ceaa3..a7926d2ee8 100644
--- a/deployment/puppet/osnailyfacter/manifests/firewall/firewall.pp
+++ b/deployment/puppet/osnailyfacter/manifests/firewall/firewall.pp
@@ -125,27 +125,6 @@ class osnailyfacter::firewall::firewall {
     source_nets => $management_nets,
   }
 
-  firewall { '333 notrack gre':
-    chain => 'PREROUTING',
-    table => 'raw',
-    proto => 'gre',
-    jump  => 'NOTRACK',
-  }
-
-  firewall { '334 accept gre':
-    chain  => 'INPUT',
-    table  => 'filter',
-    proto  => 'gre',
-    action => 'accept',
-  }
-
-  firewall {'340 vxlan_udp_port':
-    port   => $vxlan_udp_port,
-    proto  => 'udp',
-    action => 'accept',
-  }
-
-
   # Role-related rules
   $amqp_role = intersection($roles, hiera('amqp_roles'))
   if $amqp_role {
@@ -292,13 +271,6 @@ class osnailyfacter::firewall::firewall {
       source_nets => concat($management_nets, $storage_nets),
     }
 
-    openstack::firewall::multi_net {'110 neutron':
-      port        => $neutron_api_port,
-      proto       => 'tcp',
-      action      => 'accept',
-      source_nets => $neutron_networks,
-    }
-
     openstack::firewall::multi_net {'111 dns-server udp':
       port        => $dns_server_port,
       proto       => 'udp',
@@ -319,12 +291,6 @@ class osnailyfacter::firewall::firewall {
       action => 'accept',
     }
 
-    openstack::firewall::multi_net {'116 openvswitch db':
-      port        => $openvswitch_db_port,
-      proto       => 'udp',
-      action      => 'accept',
-      source_nets => $management_nets,
-    }
 
     firewall {'121 ceilometer':
       port   => $ceilometer_port,
@@ -364,6 +330,43 @@ class osnailyfacter::firewall::firewall {
 
   }
 
+  $neutron_role = intersection($roles, hiera('neutron_roles'))
+  if $neutron_role {
+    openstack::firewall::multi_net {'110 neutron':
+       port        => $neutron_api_port,
+       proto       => 'tcp',
+       action      => 'accept',
+       source_nets => $neutron_networks,
+    }
+
+    firewall { '333 notrack gre':
+      chain => 'PREROUTING',
+      table => 'raw',
+      proto => 'gre',
+      jump  => 'NOTRACK',
+    }
+
+    firewall { '334 accept gre':
+      chain  => 'INPUT',
+      table  => 'filter',
+      proto  => 'gre',
+      action => 'accept',
+    }
+
+    firewall {'340 vxlan_udp_port':
+      dport  => $vxlan_udp_port,
+      proto  => 'udp',
+      action => 'accept',
+    }
+
+    openstack::firewall::multi_net {'116 openvswitch db':
+      port        => $openvswitch_db_port,
+      proto       => 'udp',
+      action      => 'accept',
+      source_nets => $management_nets,
+    }
+  }
+
   if member($roles, 'compute') {
     openstack::firewall::multi_net {'105 nova vnc':
       port        => $nova_api_vnc_ports,
diff --git a/deployment/puppet/osnailyfacter/manifests/globals/globals.pp b/deployment/puppet/osnailyfacter/manifests/globals/globals.pp
index 2166d4fc46..dd306314e4 100644
--- a/deployment/puppet/osnailyfacter/manifests/globals/globals.pp
+++ b/deployment/puppet/osnailyfacter/manifests/globals/globals.pp
@@ -382,6 +382,10 @@ class osnailyfacter::globals::globals {
     $glance_known_stores = false
   }
 
+  # Define neutron-related variables:
+  $neutron_roles = ['primary-neutron', 'neutron']
+  $neutron_nodes = get_nodes_hash_by_roles($network_metadata, $neutron_roles)
+
   # Define keystone-related variables:
   $keystone_roles = ['primary-keystone', 'keystone']
   $keystone_nodes = get_nodes_hash_by_roles($network_metadata, $keystone_roles)
@@ -403,7 +407,8 @@ class osnailyfacter::globals::globals {
   # Define node roles, that will carry corosync/pacemaker
   $corosync_roles = hiera('corosync_roles', ['primary-controller', 'controller',
                                              'primary-rabbitmq', 'rabbitmq',
-                                             'primary-database', 'database'])
+                                             'primary-database', 'database',
+                                             'primary-neutron', 'neutron'])
 
   # Define cinder-related variables
   # todo: use special node-roles instead controllers in the future
@@ -469,10 +474,6 @@ class osnailyfacter::globals::globals {
   # Define mongo-related variables
   $mongo_roles = ['primary-mongo', 'mongo']
 
-  # Define neutron-related variables:
-  # todo: use special node-roles instead controllers in the future
-  $neutron_nodes = $controller_nodes
-
   #Define Ironic-related variables:
   $ironic_api_nodes = $controller_nodes
 
diff --git a/deployment/puppet/osnailyfacter/modular/cluster/tasks.yaml b/deployment/puppet/osnailyfacter/modular/cluster/tasks.yaml
index 04ed1a550b..9d10473c43 100644
--- a/deployment/puppet/osnailyfacter/modular/cluster/tasks.yaml
+++ b/deployment/puppet/osnailyfacter/modular/cluster/tasks.yaml
@@ -19,7 +19,8 @@
   type: puppet
   version: 2.2.0
   tags: [controller, primary-rabbitmq, rabbitmq,
-         primary-database, database]
+         primary-database, database,
+         primary-neutron, neutron]
   cross-depends:
     - name: primary-cluster
   required_for: [deploy_end]
diff --git a/deployment/puppet/osnailyfacter/modular/firewall/tasks.yaml b/deployment/puppet/osnailyfacter/modular/firewall/tasks.yaml
index 340a039c1c..59910b197e 100644
--- a/deployment/puppet/osnailyfacter/modular/firewall/tasks.yaml
+++ b/deployment/puppet/osnailyfacter/modular/firewall/tasks.yaml
@@ -3,7 +3,7 @@
   version: 2.2.0
   tags: [primary-controller, controller, cinder, cinder-block-device, cinder-vmware, compute, ceph-osd,
          primary-mongo, mongo, ironic, primary-rabbitmq, rabbitmq, primary-database, database,
-         primary-keystone, keystone]
+         primary-keystone, keystone, primary-neutron, neutron]
   required_for: [deploy_end]
   requires: [netconfig]
   reexecute_on: [deploy_changes]
diff --git a/deployment/puppet/osnailyfacter/modular/fuel_pkgs/tasks.yaml b/deployment/puppet/osnailyfacter/modular/fuel_pkgs/tasks.yaml
index 0cdf8fbf34..9c0ab92e84 100644
--- a/deployment/puppet/osnailyfacter/modular/fuel_pkgs/tasks.yaml
+++ b/deployment/puppet/osnailyfacter/modular/fuel_pkgs/tasks.yaml
@@ -16,7 +16,7 @@
   version: 2.2.0
   tags: [primary-controller, controller, cinder, cinder-block-device, cinder-vmware, compute, ceph-osd,
          primary-mongo, mongo, ironic, primary-rabbitmq, rabbitmq, primary-database, database,
-         primary-keystone, keystone]
+         primary-keystone, keystone, primary-neutron, neutron]
   requires: [setup_repositories]
   required_for: [globals]
   condition:
diff --git a/deployment/puppet/osnailyfacter/modular/globals/tasks.yaml b/deployment/puppet/osnailyfacter/modular/globals/tasks.yaml
index cbbe786c49..7b4969a61f 100644
--- a/deployment/puppet/osnailyfacter/modular/globals/tasks.yaml
+++ b/deployment/puppet/osnailyfacter/modular/globals/tasks.yaml
@@ -4,7 +4,8 @@
   tags: [primary-controller, controller,
          cinder, cinder-block-device, cinder-vmware, compute, compute-vmware,
          ceph-osd, primary-mongo, mongo, virt, ironic,
-         primary-rabbitmq, rabbitmq, primary-database, database, primary-keystone, keystone]
+         primary-rabbitmq, rabbitmq, primary-database, database, primary-keystone, keystone,
+         primary-neutron, neutron]
   required_for: [deploy_end]
   requires: [hiera]
   condition:
diff --git a/deployment/puppet/osnailyfacter/modular/hiera/tasks.yaml b/deployment/puppet/osnailyfacter/modular/hiera/tasks.yaml
index 2aa7d12cf6..29185c12e3 100644
--- a/deployment/puppet/osnailyfacter/modular/hiera/tasks.yaml
+++ b/deployment/puppet/osnailyfacter/modular/hiera/tasks.yaml
@@ -3,7 +3,8 @@
   version: 2.2.0
   tags: [primary-controller, controller, cinder, cinder-block-device, cinder-vmware,
          compute, compute-vmware, ceph-osd, primary-mongo, mongo, virt, ironic,
-         primary-rabbitmq, rabbitmq, primary-database, database, primary-keystone, keystone]
+         primary-rabbitmq, rabbitmq, primary-database, database, primary-keystone, keystone,
+         primary-neutron, neutron]
   requires: [deploy_start, rsync_core_puppet]
   required_for: [setup_repositories]
   condition:
diff --git a/deployment/puppet/osnailyfacter/modular/hosts/tasks.yaml b/deployment/puppet/osnailyfacter/modular/hosts/tasks.yaml
index b12864d78f..d7b4fafcb9 100644
--- a/deployment/puppet/osnailyfacter/modular/hosts/tasks.yaml
+++ b/deployment/puppet/osnailyfacter/modular/hosts/tasks.yaml
@@ -3,7 +3,7 @@
   version: 2.2.0
   tags: [primary-controller, controller, cinder, cinder-block-device, cinder-vmware, compute, ceph-osd,
          primary-mongo, mongo, ironic, primary-rabbitmq, rabbitmq, primary-database, database,
-         primary-keystone, keystone]
+         primary-keystone, keystone, primary-neutron, neutron]
   required_for: [deploy_end]
   requires: [netconfig]
   condition:
diff --git a/deployment/puppet/osnailyfacter/modular/logging/tasks.yaml b/deployment/puppet/osnailyfacter/modular/logging/tasks.yaml
index dbf1324558..53d6a514e5 100644
--- a/deployment/puppet/osnailyfacter/modular/logging/tasks.yaml
+++ b/deployment/puppet/osnailyfacter/modular/logging/tasks.yaml
@@ -3,7 +3,7 @@
   version: 2.2.0
   tags: [primary-controller, controller, cinder, cinder-block-device, cinder-vmware, compute, ceph-osd,
          primary-mongo, mongo, virt, ironic, primary-rabbitmq, rabbitmq, primary-database, database,
-         primary-keystone, keystone]
+         primary-keystone, keystone, primary-neutron, neutron]
   required_for: [deploy_end]
   requires: [globals,setup_repositories]
   condition:
diff --git a/deployment/puppet/osnailyfacter/modular/netconfig/tasks.yaml b/deployment/puppet/osnailyfacter/modular/netconfig/tasks.yaml
index 31bd9c7969..bbbd8e98c9 100644
--- a/deployment/puppet/osnailyfacter/modular/netconfig/tasks.yaml
+++ b/deployment/puppet/osnailyfacter/modular/netconfig/tasks.yaml
@@ -51,7 +51,7 @@
   version: 2.2.0
   tags: [primary-controller, controller, cinder, cinder-block-device, cinder-vmware, compute, ceph-osd,
          primary-mongo, mongo, virt, ironic, primary-rabbitmq, rabbitmq, primary-database, database,
-         primary-keystone, keystone]
+         primary-keystone, keystone, primary-neutron, neutron]
   required_for: [deploy_end]
   requires: [tools]
   reexecute_on: [deploy_changes]
diff --git a/deployment/puppet/osnailyfacter/modular/tools/tasks.yaml b/deployment/puppet/osnailyfacter/modular/tools/tasks.yaml
index 573eb92f43..bdf36d57eb 100644
--- a/deployment/puppet/osnailyfacter/modular/tools/tasks.yaml
+++ b/deployment/puppet/osnailyfacter/modular/tools/tasks.yaml
@@ -3,7 +3,7 @@
   version: 2.2.0
   tags: [primary-controller, controller, cinder, cinder-block-device, cinder-vmware, compute, ceph-osd,
          primary-mongo, mongo, virt, ironic, primary-rabbitmq, rabbitmq, primary-database, database,
-         primary-keystone, keystone]
+         primary-keystone, keystone, primary-neutron, neutron]
   required_for: [deploy_end]
   requires: [logging]
   condition:
diff --git a/deployment/puppet/osnailyfacter/templates/globals_yaml.erb b/deployment/puppet/osnailyfacter/templates/globals_yaml.erb
index 0a36572e7c..2f78943109 100644
--- a/deployment/puppet/osnailyfacter/templates/globals_yaml.erb
+++ b/deployment/puppet/osnailyfacter/templates/globals_yaml.erb
@@ -59,6 +59,7 @@
 <% globals.store "neutron_config", @real_neutron_config -%>
 <% globals.store "neutron_db_password", @neutron_db_password -%>
 <% globals.store "neutron_metadata_proxy_secret", @neutron_metadata_proxy_secret -%>
+<% globals.store "neutron_roles", @neutron_roles -%>
 <% globals.store "neutron_nodes", @neutron_nodes -%>
 <% globals.store "neutron_user_password", @neutron_user_password -%>
 <% globals.store "node", @node_hash -%>
diff --git a/tests/noop/spec/hosts/openstack-network/agents/l3_spec.rb b/tests/noop/spec/hosts/openstack-network/agents/l3_spec.rb
index e2d3b0008a..de0dc1d493 100644
--- a/tests/noop/spec/hosts/openstack-network/agents/l3_spec.rb
+++ b/tests/noop/spec/hosts/openstack-network/agents/l3_spec.rb
@@ -1,5 +1,5 @@
-# ROLE: primary-controller
-# ROLE: controller
+# ROLE: primary-neutron
+# ROLE: neutron
 # ROLE: compute
 
 require 'spec_helper'
@@ -67,8 +67,8 @@ describe manifest do
           end
         end
 
-      elsif Noop.hiera('role') =~ /controller/
-        context 'with Neutron-l3-agent on controller' do
+      elsif Noop.hiera('role') =~ /neutron/
+        context 'with Neutron-l3-agent on neutron' do
           na_config = Noop.hiera_hash('neutron_advanced_configuration')
           dvr = na_config.fetch('neutron_dvr', false)
           agent_mode = (dvr  ?  'dvr_snat'  :  'legacy')
@@ -97,7 +97,7 @@ describe manifest do
 
           if ha_agent
             it { should contain_cluster__neutron__l3('default-l3').with(
-              'primary' => (node_role == 'primary-controller')
+              'primary' => (node_role == 'primary-neutron')
             )}
           else
             it { should_not contain_cluster__neutron__l3('default-l3') }
diff --git a/tests/noop/spec/hosts/openstack-network/agents/metadata_spec.rb b/tests/noop/spec/hosts/openstack-network/agents/metadata_spec.rb
index 3d79d86a5c..cd1ed3075a 100644
--- a/tests/noop/spec/hosts/openstack-network/agents/metadata_spec.rb
+++ b/tests/noop/spec/hosts/openstack-network/agents/metadata_spec.rb
@@ -1,5 +1,5 @@
-# ROLE: primary-controller
-# ROLE: controller
+# ROLE: primary-neutron
+# ROLE: neutron
 # ROLE: compute
 
 require 'spec_helper'
@@ -24,7 +24,7 @@ describe manifest do
 
       na_config                = Noop.hiera_hash('neutron_advanced_configuration', {})
       neutron_config           = Noop.hiera_hash('neutron_config')
-      neutron_controller_roles = Noop.hiera('neutron_controller_nodes', ['controller', 'primary-controller'])
+      neutron_controller_roles = Noop.hiera('neutron_controller_nodes', ['neutron', 'primary-neutron'])
       neutron_compute_roles    = Noop.hiera('neutron_compute_nodes', ['compute'])
       workers_max              = Noop.hiera 'workers_max'
       isolated_metadata        = neutron_config.fetch('metadata',{}).fetch('isolated_metadata', true)
@@ -106,7 +106,7 @@ describe manifest do
           )}
           if ha_agent
             it { should contain_class('cluster::neutron::metadata').with(
-              'primary' => (node_role == 'primary-controller')
+              'primary' => (node_role == 'primary-neutron')
             )}
           else
             it { should_not contain_class('cluster::neutron::metadata') }
diff --git a/tests/noop/spec/hosts/openstack-network/routers_spec.rb b/tests/noop/spec/hosts/openstack-network/routers_spec.rb
index e60817d17e..2766bdf62d 100644
--- a/tests/noop/spec/hosts/openstack-network/routers_spec.rb
+++ b/tests/noop/spec/hosts/openstack-network/routers_spec.rb
@@ -1,4 +1,4 @@
-# ROLE: primary-controller
+# ROLE: primary-neutron
 
 require 'spec_helper'
 require 'shared-examples'
@@ -6,9 +6,9 @@ manifest = 'openstack-network/routers.pp'
 
 describe manifest do
   shared_examples 'catalog' do
-    if (Noop.hiera('use_neutron') and Noop.hiera('primary_controller'))
+    if (Noop.hiera('use_neutron') and Noop.hiera('primary_neutron'))
       context 'with Neutron' do
-        neutron_config = Noop.hiera('neutron_config')
+        neutron_config = Noop.puppet_function('has_primary_role', Noop.puppet_function('intersection', Noop.hiera('neutron_roles'), Noop.hiera('roles')))
         nets = neutron_config['predefined_networks']
 
         floating_net             = (neutron_config['default_floating_net'] or 'net04_ext')
@@ -18,7 +18,7 @@ describe manifest do
         l3_ha                    = Noop.hiera_hash('neutron_advanced_configuration', {}).fetch('neutron_l3_ha', false)
         dvr                      = Noop.hiera_hash('neutron_advanced_configuration', {}).fetch('neutron_dvr', false)
         network_metadata         = Noop.hiera_hash('network_metadata')
-        neutron_controller_roles = Noop.hiera('neutron_controller_nodes', ['controller', 'primary-controller'])
+        neutron_controller_roles = Noop.hiera('neutron_controller_nodes', ['neutron', 'primary-neutron'])
         neutron_controller_nodes = Noop.puppet_function 'get_nodes_hash_by_roles', network_metadata, neutron_controller_roles
         neutron_controllers_num  = neutron_controller_nodes.size
 
diff --git a/tests/noop/spec/hosts/openstack-network/server-config_spec.rb b/tests/noop/spec/hosts/openstack-network/server-config_spec.rb
index 0626640645..afd7859b39 100644
--- a/tests/noop/spec/hosts/openstack-network/server-config_spec.rb
+++ b/tests/noop/spec/hosts/openstack-network/server-config_spec.rb
@@ -1,5 +1,5 @@
-# ROLE: primary-controller
-# ROLE: controller
+# ROLE: primary-neutron
+# ROLE: neutron
 
 require 'spec_helper'
 require 'shared-examples'
@@ -15,7 +15,7 @@ describe manifest do
   end
 
   shared_examples 'catalog' do
-    if (Noop.hiera('use_neutron') == true and Noop.hiera('role') =~ /controller/)
+    if (Noop.hiera('use_neutron') == true and Noop.hiera('role') =~ /neutron/)
       let(:network_scheme) do
         Noop.hiera_hash('network_scheme', {})
       end
@@ -26,7 +26,7 @@ describe manifest do
         management_vip   = Noop.hiera('management_vip')
         service_endpoint = Noop.hiera('service_endpoint', management_vip)
         l3_ha            = Noop.hiera_hash('neutron_advanced_configuration', {}).fetch('neutron_l3_ha', false)
-        sync_db          = Noop.hiera('primary_controller')
+        sync_db          = Noop.puppet_function('has_primary_role', Noop.puppet_function('intersection', Noop.hiera('neutron_roles'), Noop.hiera('roles')))
         extension_drivers = ['port_security']
         segmentation_type = neutron_config.fetch('L2',{}).fetch('segmentation_type')
         pnets = neutron_config.fetch('L2',{}).fetch('phys_nets',{})