ODL was missing transparent binding mode, which causes HA deployments to
fail since HA Proxy will try to come up on every node (even without
VIP).
Closes-Bug: 1637833
Change-Id: I0bb7839cdcfeacb4ca1a9fc6f878e8b51330be92
Signed-off-by: Tim Rozet <trozet@redhat.com>
The upload and extraction for the plan tarball to swift can take
longer than the default one minute in slower environments. Doubling
the timeout to two minutes has proven to help.
This is only a partial fix, because the error reporting for this
issue also needs to be improved.
Change-Id: I06592d38fdfefacc8bdf76289a0bfa20eb33a89b
Partial-Bug: 1635269
The docker tooling has a preference for interacting with encrypted
endpoints. Terminating the docker-registry endpoint with HAProxy
allows the SSL VIP to be used for this purpose.
Change-Id: Ifebfa7256e0887d6f26a478ff8dc82b0ef5f65f6
This optionally enables TLS for aodh in the internal network.
If internal TLS is enabled, each node that is serving the aodh
service will use certmonger to request its certificate.
This, in turn should also configure a command that should be ran when
the certificate is refreshed (which requires the service to be
restarted).
bp tls-via-certmonger
Change-Id: I50ef0c8fbecb19d6597a28290daa61a91f3b13fc
This optionally enables TLS for aodh in the internal network.
If internal TLS is enabled, each node that is serving the ceilometer
service will use certmonger to request its certificate.
This, in turn should also configure a command that should be ran when
the certificate is refreshed (which requires the service to be
restarted).
bp tls-via-certmonger
Change-Id: Ib5609f77a31b17ed12baea419ecfab5d5f676496
This optionally enables TLS for keystone in the internal network.
If internal TLS is enabled, each node that is serving the keystone
service will use certmonger to request its certificate.
This, in turn should also configure a command that should be ran when
the certificate is refreshed (which requires the service to be
restarted).
bp tls-via-certmonger
Change-Id: I303f6cf47859284785c0cdc65284a7eb89a4e039
By enabling the statistics socket we allow the collection
of statistics over time for haproxy.
This socket is set to "user" level, so this socket is limited
to read-only. The "stats timeout" line is optional, but since the
default timeout of the stats socket is 10s, we set this higher.
Change-Id: I22d3ab771e981be0d2c74b60443d276973bc1639
The service profile in HAProxy has the capability of creating
certificates based on a map. The idea is to standardize this, as
some of those certificates should match certain networks the services
are listening on (with the exception of the external network which is
handled differently and the tenant network which doesn't need a
certificate). So, based on which network a certain service is
listening on, we fetch the appropriate certificate.
bp tls-via-certmonger
Change-Id: I89001ae32f46c9682aecc118753ef6cd647baa62
Right now we're hardcoding the server names for the services to be
the controllers. This is problematic if we start using custom roles
for services, which listen on nodes that are not controllers.
We already have the server names for each service, so using this
mapping instead fixes the issue.
Change-Id: Ic4b65edb3dc1b75abbc3421a87cab97425b058c4
Closes-Bug: #1629098
Note that there was a need to modify different timeouts due
to the nature of how websockets work. The source where the
reasoning and value came from is listed as a comment in the
code.
Related-Bug: #1625448
Co-Authored-By: Brad P. Crochet <brad@redhat.com>
Change-Id: I9de77d5f692c1c9d04e3c59c5de5312e63f81aed
The name was wrong, and so fixing it will actually enable VNC Proxy
when the service is enabled.
Change-Id: I65e90479fd33844b4dcd70c19cec3cd838aeff69
Closes-Bug: #1623796
This is necessary so the middleware in manila can set the protocol
correctly in case we're terminating SSL in HAProxy.
Depends-On: Ice78b0abceb6a956bb8c1dc6212ee1b56b62b43f
Change-Id: Iedaabaf1379466c22e3b9bb2307e940459d26de7
When enabling federated authentication with keystone, and then enabling websso
in horizon, the URL horizon constructs for the redirect is done internally, and
django needs to be able to know if it has to construct the url with http or
https. By setting this header at the haproxy level, horizon can make the correct
decision.
Change-Id: I0281fe1e5efa0d3f5983342dec70752246d9fca8
Partially-Implements: blueprint opendaylight-integration
Note this patch only adds support for a single ODL instance.
- neutron/opendaylight.pp handles installing ODL to control nodes
- ml2/opendaylight.pp handles configuring ML2 to work with ODL
- ovs/opendaylight.pp handles configuring OVS to connect to ODL
Change-Id: I666dc0874f1d11a72a62d796f4f6d41f7aa87a3f
Signed-off-by: Tim Rozet <trozet@redhat.com>
Some lint checks are returning:
WARNING: line has more than 140 characters in puppet-tripleo profiles
This patch will remove those warnings by adding \'s
Change-Id: I19b56c93db82948fb0498a4c9851b522c81946f8
If keystone sends a redirect and we have TLS enabled, we need to
modify the response in order to indicate https.
Change-Id: Icd61f527473bfe5153e058e94f9ed141cf13812d
Glance supports the http_proxy_to_wsgi middlware, and it was recently
enabled in the overcloud [1]. However, for it to work properly, we
need to add the X-Forwarded-Proto header which was missing from the
HAProxy configuration.
[1] I4a8f7fc079ca93c50aa0ef7b0548dc64f6c5cfa0
Change-Id: I82e2db1145b0476cec27676fdfbb97e86cbd8182
Add Mistral profiles for non-ha and ha scenarios
Change-Id: I1a072326091fd3b0c21d2f78041e3532b67c60eb
Implements: blueprint refactor-puppet-manifests
Depends-On: I6ce61054384c15876c498ba8cf582f88d9f7f54c
This is needed for the undercloud, as it's in HAProxy where we make
the SSL terminations.
Change-Id: Ie4d652b4e5a95849c2fa32a5ce5ecec09ccb6bd9
Related-Bug: #1595047
The split has been done on both undercloud & overcloud, they now use
tripleo::haproxy and tripleo::keepalived. We can move forward with
removing tripleo::loadbalancer and tripleo::loadbalancer::endpoint, not
used anymore.
Simplify tripleo::profile::base::loadbalancer to just include
tripleo::haproxy and rely on Hiera for parameters.
Change-Id: Ieeb1e94117ae9cb8b11320306de3a9b236bd989a
controller_host was deprecated and is not used anymore anywhere.
Let's drop it.
Also make controller_hosts really required, by not setting a default
paramter, so Puppet catalog will fail if no value is given.
Change-Id: Iad760115f925e848e4b72009db5177f88ceb4ad8
