384 lines
14 KiB
Puppet
384 lines
14 KiB
Puppet
# Copyright 2016 Red Hat, Inc.
|
|
#
|
|
# Licensed under the Apache License, Version 2.0 (the "License"); you may
|
|
# not use this file except in compliance with the License. You may obtain
|
|
# a copy of the License at
|
|
#
|
|
# http://www.apache.org/licenses/LICENSE-2.0
|
|
#
|
|
# Unless required by applicable law or agreed to in writing, software
|
|
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
|
|
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
|
|
# License for the specific language governing permissions and limitations
|
|
# under the License.
|
|
#
|
|
# == Class: tripleo::profile::pacemaker::haproxy
|
|
#
|
|
# HAproxy with Pacemaker HA profile for tripleo
|
|
#
|
|
# === Parameters
|
|
#
|
|
# [*haproxy_docker_image*]
|
|
# (Optional) The docker image to use for creating the pacemaker bundle
|
|
# Defaults to hiera('tripleo::profile::pacemaker::haproxy::haproxy_docker_image', undef)
|
|
#
|
|
# [*bootstrap_node*]
|
|
# (Optional) The hostname of the node responsible for bootstrapping tasks
|
|
# Defaults to hiera('haproxy_short_bootstrap_node_name')
|
|
#
|
|
# [*enable_load_balancer*]
|
|
# (Optional) Whether load balancing is enabled for this cluster
|
|
# Defaults to hiera('enable_load_balancer', true)
|
|
#
|
|
# [*ca_bundle*]
|
|
# (Optional) The path to the CA file that will be used for the TLS
|
|
# configuration. It's only used if internal TLS is enabled.
|
|
# Defaults to hiera('tripleo::haproxy::ca_bundle', undef)
|
|
#
|
|
# [*crl_file*]
|
|
# (Optional) The path to the file that contains the certificate
|
|
# revocation list. It's only used if internal TLS is enabled.
|
|
# Defaults to hiera('tripleo::haproxy::crl_file', undef)
|
|
#
|
|
# [*deployed_ssl_cert_path*]
|
|
# (Optional) The filepath of the certificate as it will be stored in
|
|
# the controller.
|
|
# Defaults to hiera('tripleo::haproxy::service_certificate', undef)
|
|
#
|
|
# [*enable_internal_tls*]
|
|
# (Optional) Whether TLS in the internal network is enabled or not.
|
|
# Defaults to hiera('enable_internal_tls', false)
|
|
#
|
|
# [*internal_certs_directory*]
|
|
# (Optional) Directory the holds the certificates to be used when
|
|
# when TLS is enabled in the internal network
|
|
# Defaults to undef
|
|
#
|
|
# [*internal_keys_directory*]
|
|
# (Optional) Directory the holds the certificates to be used when
|
|
# when TLS is enabled in the internal network
|
|
# Defaults to undef
|
|
#
|
|
# [*meta_params*]
|
|
# (optional) Additional meta parameters to pass to "pcs resource create" for the VIP
|
|
# Defaults to ''
|
|
#
|
|
# [*op_params*]
|
|
# (optional) Additional op parameters to pass to "pcs resource create" for the VIP
|
|
# Defaults to ''
|
|
#
|
|
# [*container_backend*]
|
|
# (optional) Container backend to use when creating the bundle
|
|
# Defaults to 'docker'
|
|
#
|
|
# [*log_driver*]
|
|
# (optional) Container log driver to use. When set to undef it uses 'k8s-file'
|
|
# when container_cli is set to podman and 'journald' when it is set to docker.
|
|
# Defaults to undef
|
|
#
|
|
# [*log_file*]
|
|
# (optional) Container log file to use. Only relevant when log_driver is
|
|
# set to 'k8s-file'.
|
|
# Defaults to '/var/log/containers/stdouts/haproxy-bundle.log'
|
|
#
|
|
# [*tls_priorities*]
|
|
# (optional) Sets PCMK_tls_priorities in /etc/sysconfig/pacemaker when set
|
|
# Defaults to hiera('tripleo::pacemaker::tls_priorities', undef)
|
|
#
|
|
# [*step*]
|
|
# (Optional) The current step in deployment. See tripleo-heat-templates
|
|
# for more details.
|
|
# Defaults to hiera('step')
|
|
#
|
|
# [*pcs_tries*]
|
|
# (Optional) The number of times pcs commands should be retried.
|
|
# Defaults to hiera('pcs_tries', 20)
|
|
#
|
|
# [*bundle_user*]
|
|
# (optional) Set the --user= switch to be passed to pcmk
|
|
# Defaults to 'root'
|
|
#
|
|
# [*force_nic*]
|
|
# (optional) Force a specific nic interface name when creating all the VIPs
|
|
# The listening nic can be customized on a per-VIP basis by creating a hiera
|
|
# dict called: force_vip_nic_overrides[<vip/network name>] = 'dummy'
|
|
# Defaults to hiera('tripleo::pacemaker::force_nic', undef)
|
|
#
|
|
class tripleo::profile::pacemaker::haproxy_bundle (
|
|
$haproxy_docker_image = hiera('tripleo::profile::pacemaker::haproxy::haproxy_docker_image', undef),
|
|
$bootstrap_node = hiera('haproxy_short_bootstrap_node_name'),
|
|
$enable_load_balancer = hiera('enable_load_balancer', true),
|
|
$ca_bundle = hiera('tripleo::haproxy::ca_bundle', undef),
|
|
$crl_file = hiera('tripleo::haproxy::crl_file', undef),
|
|
$enable_internal_tls = hiera('enable_internal_tls', false),
|
|
$internal_certs_directory = undef,
|
|
$internal_keys_directory = undef,
|
|
$deployed_ssl_cert_path = hiera('tripleo::haproxy::service_certificate', undef),
|
|
$meta_params = '',
|
|
$op_params = '',
|
|
$container_backend = 'docker',
|
|
$tls_priorities = hiera('tripleo::pacemaker::tls_priorities', undef),
|
|
$bundle_user = 'root',
|
|
$force_nic = hiera('tripleo::pacemaker::force_nic', undef),
|
|
$log_driver = undef,
|
|
$log_file = '/var/log/containers/stdouts/haproxy-bundle.log',
|
|
$step = Integer(hiera('step')),
|
|
$pcs_tries = hiera('pcs_tries', 20),
|
|
) {
|
|
include tripleo::profile::base::haproxy
|
|
|
|
if $bootstrap_node and $::hostname == downcase($bootstrap_node) {
|
|
$pacemaker_master = true
|
|
} else {
|
|
$pacemaker_master = false
|
|
}
|
|
|
|
if $log_driver == undef {
|
|
if hiera('container_cli', 'docker') == 'podman' {
|
|
$log_driver_real = 'k8s-file'
|
|
} else {
|
|
$log_driver_real = 'journald'
|
|
}
|
|
} else {
|
|
$log_driver_real = $log_driver
|
|
}
|
|
if $log_driver_real == 'k8s-file' {
|
|
$log_file_real = " --log-opt path=${log_file}"
|
|
} else {
|
|
$log_file_real = ''
|
|
}
|
|
$force_vip_nic_overrides = hiera('force_vip_nic_overrides', {})
|
|
validate_legacy(Hash, 'validate_hash', $force_vip_nic_overrides)
|
|
|
|
if $step >= 2 and $enable_load_balancer {
|
|
if $pacemaker_master {
|
|
if (hiera('haproxy_short_node_names_override', undef)) {
|
|
$haproxy_short_node_names = hiera('haproxy_short_node_names_override')
|
|
} else {
|
|
$haproxy_short_node_names = hiera('haproxy_short_node_names')
|
|
}
|
|
|
|
$haproxy_short_node_names.each |String $node_name| {
|
|
pacemaker::property { "haproxy-role-${node_name}":
|
|
property => 'haproxy-role',
|
|
value => true,
|
|
tries => $pcs_tries,
|
|
node => downcase($node_name),
|
|
before => Pacemaker::Resource::Bundle['haproxy-bundle'],
|
|
}
|
|
}
|
|
$haproxy_location_rule = {
|
|
resource_discovery => 'exclusive',
|
|
score => 0,
|
|
expression => ['haproxy-role eq true'],
|
|
}
|
|
# FIXME: we should not have to access tripleo::haproxy class
|
|
# parameters here to configure pacemaker VIPs. The configuration
|
|
# of pacemaker VIPs could move into puppet-tripleo or we should
|
|
# make use of less specific hiera parameters here for the settings.
|
|
$haproxy_nodes = hiera('haproxy_short_node_names')
|
|
$haproxy_nodes_count = count($haproxy_nodes)
|
|
|
|
|
|
$storage_maps = {
|
|
'haproxy-cfg-files' => {
|
|
'source-dir' => '/var/lib/kolla/config_files/haproxy.json',
|
|
'target-dir' => '/var/lib/kolla/config_files/config.json',
|
|
'options' => 'ro',
|
|
},
|
|
'haproxy-cfg-data' => {
|
|
'source-dir' => '/var/lib/config-data/puppet-generated/haproxy/',
|
|
'target-dir' => '/var/lib/kolla/config_files/src',
|
|
'options' => 'ro',
|
|
},
|
|
'haproxy-hosts' => {
|
|
'source-dir' => '/etc/hosts',
|
|
'target-dir' => '/etc/hosts',
|
|
'options' => 'ro',
|
|
},
|
|
'haproxy-localtime' => {
|
|
'source-dir' => '/etc/localtime',
|
|
'target-dir' => '/etc/localtime',
|
|
'options' => 'ro',
|
|
},
|
|
'haproxy-var-lib' => {
|
|
'source-dir' => '/var/lib/haproxy',
|
|
'target-dir' => '/var/lib/haproxy',
|
|
'options' => 'rw',
|
|
},
|
|
'haproxy-pki-extracted' => {
|
|
'source-dir' => '/etc/pki/ca-trust/extracted',
|
|
'target-dir' => '/etc/pki/ca-trust/extracted',
|
|
'options' => 'ro',
|
|
},
|
|
'haproxy-pki-ca-bundle-crt' => {
|
|
'source-dir' => '/etc/pki/tls/certs/ca-bundle.crt',
|
|
'target-dir' => '/etc/pki/tls/certs/ca-bundle.crt',
|
|
'options' => 'ro',
|
|
},
|
|
'haproxy-pki-ca-bundle-trust-crt' => {
|
|
'source-dir' => '/etc/pki/tls/certs/ca-bundle.trust.crt',
|
|
'target-dir' => '/etc/pki/tls/certs/ca-bundle.trust.crt',
|
|
'options' => 'ro',
|
|
},
|
|
'haproxy-pki-cert' => {
|
|
'source-dir' => '/etc/pki/tls/cert.pem',
|
|
'target-dir' => '/etc/pki/tls/cert.pem',
|
|
'options' => 'ro',
|
|
},
|
|
'haproxy-dev-log' => {
|
|
'source-dir' => '/dev/log',
|
|
'target-dir' => '/dev/log',
|
|
'options' => 'rw',
|
|
},
|
|
};
|
|
|
|
if $deployed_ssl_cert_path {
|
|
$cert_storage_maps = {
|
|
'haproxy-cert' => {
|
|
'source-dir' => $deployed_ssl_cert_path,
|
|
'target-dir' => "/var/lib/kolla/config_files/src-tls${deployed_ssl_cert_path}",
|
|
'options' => 'ro',
|
|
},
|
|
}
|
|
} else {
|
|
$cert_storage_maps = {}
|
|
}
|
|
|
|
if $enable_internal_tls {
|
|
$haproxy_storage_maps = {
|
|
'haproxy-pki-certs' => {
|
|
'source-dir' => $internal_certs_directory,
|
|
'target-dir' => "/var/lib/kolla/config_files/src-tls${internal_certs_directory}",
|
|
'options' => 'ro',
|
|
},
|
|
'haproxy-pki-keys' => {
|
|
'source-dir' => $internal_keys_directory,
|
|
'target-dir' => "/var/lib/kolla/config_files/src-tls${internal_keys_directory}",
|
|
'options' => 'ro',
|
|
},
|
|
}
|
|
if $ca_bundle {
|
|
$ca_storage_maps = {
|
|
'haproxy-pki-ca-file' => {
|
|
'source-dir' => $ca_bundle,
|
|
'target-dir' => "/var/lib/kolla/config_files/src-tls${ca_bundle}",
|
|
'options' => 'ro',
|
|
},
|
|
}
|
|
} else {
|
|
$ca_storage_maps = {}
|
|
}
|
|
if $crl_file {
|
|
$crl_storage_maps = {
|
|
'haproxy-pki-crl-file' => {
|
|
'source-dir' => $crl_file,
|
|
'target-dir' => $crl_file,
|
|
'options' => 'ro',
|
|
},
|
|
}
|
|
} else {
|
|
$crl_storage_maps = {}
|
|
}
|
|
$storage_maps_internal_tls = merge($haproxy_storage_maps, $ca_storage_maps, $crl_storage_maps)
|
|
} else {
|
|
$storage_maps_internal_tls = {}
|
|
}
|
|
|
|
if $tls_priorities != undef {
|
|
$tls_priorities_real = " -e PCMK_tls_priorities=${tls_priorities}"
|
|
} else {
|
|
$tls_priorities_real = ''
|
|
}
|
|
|
|
pacemaker::resource::bundle { 'haproxy-bundle':
|
|
image => $haproxy_docker_image,
|
|
replicas => $haproxy_nodes_count,
|
|
location_rule => $haproxy_location_rule,
|
|
container_options => 'network=host',
|
|
# lint:ignore:140chars
|
|
options => "--user=${bundle_user} --log-driver=${log_driver_real}${log_file_real} -e KOLLA_CONFIG_STRATEGY=COPY_ALWAYS${tls_priorities_real}",
|
|
# lint:endignore
|
|
run_command => '/bin/bash /usr/local/bin/kolla_start',
|
|
storage_maps => merge($storage_maps, $cert_storage_maps, $storage_maps_internal_tls),
|
|
container_backend => $container_backend,
|
|
tries => $pcs_tries,
|
|
}
|
|
$control_vip = hiera('controller_virtual_ip')
|
|
if has_key($force_vip_nic_overrides, 'controller_virtual_ip') {
|
|
$control_vip_nic = $force_vip_nic_overrides['controller_virtual_ip']
|
|
} else {
|
|
$control_vip_nic = $force_nic
|
|
}
|
|
tripleo::pacemaker::haproxy_with_vip { 'haproxy_and_control_vip':
|
|
vip_name => 'control',
|
|
ip_address => $control_vip,
|
|
location_rule => $haproxy_location_rule,
|
|
meta_params => $meta_params,
|
|
op_params => $op_params,
|
|
nic => $control_vip_nic,
|
|
pcs_tries => $pcs_tries,
|
|
}
|
|
|
|
$public_vip = hiera('public_virtual_ip')
|
|
if has_key($force_vip_nic_overrides, 'public_virtual_ip') {
|
|
$public_vip_nic = $force_vip_nic_overrides['public_virtual_ip']
|
|
} else {
|
|
$public_vip_nic = $force_nic
|
|
}
|
|
tripleo::pacemaker::haproxy_with_vip { 'haproxy_and_public_vip':
|
|
ensure => $public_vip and $public_vip != $control_vip,
|
|
vip_name => 'public',
|
|
ip_address => $public_vip,
|
|
location_rule => $haproxy_location_rule,
|
|
meta_params => $meta_params,
|
|
op_params => $op_params,
|
|
nic => $public_vip_nic,
|
|
pcs_tries => $pcs_tries,
|
|
}
|
|
|
|
$redis = hiera('redis_enabled', false)
|
|
if $redis {
|
|
$redis_vip = hiera('redis_vip')
|
|
if has_key($force_vip_nic_overrides, 'redis_vip') {
|
|
$redis_vip_nic = $force_vip_nic_overrides['redis_vip']
|
|
} else {
|
|
$redis_vip_nic = $force_nic
|
|
}
|
|
tripleo::pacemaker::haproxy_with_vip { 'haproxy_and_redis_vip':
|
|
ensure => $redis_vip and $redis_vip != $control_vip,
|
|
vip_name => 'redis',
|
|
ip_address => $redis_vip,
|
|
location_rule => $haproxy_location_rule,
|
|
meta_params => $meta_params,
|
|
op_params => $op_params,
|
|
nic => $redis_vip_nic,
|
|
pcs_tries => $pcs_tries,
|
|
}
|
|
}
|
|
|
|
# Set up all vips for isolated networks
|
|
$network_vips = hiera('network_virtual_ips', {})
|
|
$network_vips.each |String $net_name, $vip_info| {
|
|
$virtual_ip = $vip_info[ip_address]
|
|
if has_key($force_vip_nic_overrides, $net_name) {
|
|
$vip_nic = $force_vip_nic_overrides[$net_name]
|
|
} else {
|
|
$vip_nic = $force_nic
|
|
}
|
|
tripleo::pacemaker::haproxy_with_vip {"haproxy_and_${net_name}_vip":
|
|
ensure => $virtual_ip and $virtual_ip != $control_vip,
|
|
vip_name => $net_name,
|
|
ip_address => $virtual_ip,
|
|
location_rule => $haproxy_location_rule,
|
|
meta_params => $meta_params,
|
|
op_params => $op_params,
|
|
nic => $vip_nic,
|
|
pcs_tries => $pcs_tries,
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
}
|