openstack/puppet-tripleo
Code Issues Proposed changes

Added new parameter for HAProxy configuration

Browse Source 
This allow to set the socket access level to admin instead of default
"user".
This "admin" access adds the capability to interact with HAproxy in
order to manage its configuration, at least temporarly.

This changes keeps the default "user" access level, as "admin" might
break things if misused.

Change-Id: I1a4612b9f8aacc410b48a04dac3bf300bbb0e08e
Closes-bug: #1716692
This commit is contained in:
Cédric Jeanneret 2017-09-12 17:01:29 +02:00
parent d5a23606ee
commit 33479418ee
1 changed files with 7 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
manifests/haproxy.pp
View File

@ -53,6 +53,11 @@
# Should haproxy run in daemon mode or not # Should haproxy run in daemon mode or not
# Defaults to true # Defaults to true
# #
# [*haproxy_socket_access_level*]
# Access level for HAProxy socket.
# Can be "user" or "admin"
# Defaults to "user"
#
# [*manage_firewall*] # [*manage_firewall*]
# (optional) Enable or disable firewall settings for ports exposed by HAProxy # (optional) Enable or disable firewall settings for ports exposed by HAProxy
# (false means disabled, and true means enabled) # (false means disabled, and true means enabled)
@ -569,6 +574,7 @@ class tripleo::haproxy (
$haproxy_member_options = [ 'check', 'inter 2000', 'rise 2', 'fall 5' ], $haproxy_member_options = [ 'check', 'inter 2000', 'rise 2', 'fall 5' ],
$haproxy_log_address = '/dev/log', $haproxy_log_address = '/dev/log',
$haproxy_daemon = true, $haproxy_daemon = true,
$haproxy_socket_access_level = 'user',
$haproxy_stats_user = 'admin', $haproxy_stats_user = 'admin',
$haproxy_stats_password = undef, $haproxy_stats_password = undef,
$manage_firewall = hiera('tripleo::firewall::manage_firewall', true), $manage_firewall = hiera('tripleo::firewall::manage_firewall', true),
@ -799,7 +805,7 @@ class tripleo::haproxy (
'ssl-default-bind-ciphers' => $ssl_cipher_suite, 'ssl-default-bind-ciphers' => $ssl_cipher_suite,
'ssl-default-bind-options' => $ssl_options, 'ssl-default-bind-options' => $ssl_options,
'stats' => [ 'stats' => [
'socket /var/lib/haproxy/stats mode 600 level user', "socket /var/lib/haproxy/stats mode 600 level ${haproxy_socket_access_level}",
'timeout 2m' 'timeout 2m'
], ],
} }