Merge "Deprecate snmp service"

deployment/deprecated/snmp/snmp-baremetal-puppet.yaml

@@ -89,6 +89,11 @@ outputs:
         tripleo::profile::base::snmp::snmpd_password: {get_param: SnmpdReadonlyUserPassword}
         snmp::agentaddress: {get_param: SnmpdBindHost}
         snmp::snmpd_options: {get_param: SnmpdOptions}
+      host_prep_tasks:
+        - name: Make sure the net-snmp package is installed
+          package:
+            name: net-snmp
+            state: present
       step_config: |
         include tripleo::profile::base::snmp
       upgrade_tasks:

deployment/snmp/snmpd-disabled-puppet.yaml

@@ -0,0 +1,83 @@
+heat_template_version: wallaby
+
+description: >
+  Disable and purge snmpd installed in overcloud nodes.
+
+parameters:
+  ServiceData:
+    default: {}
+    description: Dictionary packing service data
+    type: json
+  ServiceNetMap:
+    default: {}
+    description: Mapping of service_name -> network name. Typically set
+                 via parameter_defaults in the resource registry. Use
+                 parameter_merge_strategies to merge it with the defaults.
+    type: json
+  RoleName:
+    default: ''
+    description: Role name on which the service is applied
+    type: string
+  RoleParameters:
+    default: {}
+    description: Parameters specific to the role
+    type: json
+  EndpointMap:
+    default: {}
+    description: Mapping of service endpoint -> protocol. Typically set
+                 via parameter_defaults in the resource registry.
+    type: json
+  SnmpdIpSubnet:
+    default: ''
+    description: IP address/subnet on the snmpd network. If empty (default), SnmpdNetwork
+                 will be taken.
+    type: string
+
+conditions:
+  snmpd_network_set:
+    not: {equals : [{get_param: SnmpdIpSubnet}, '']}
+
+outputs:
+  role_data:
+    description: Role data for the SNMP services
+    value:
+      service_name: snmp_disabled
+      firewall_rules:
+        # NOTE(tkajinam): Make sure the existing rules are removed.
+        map_merge:
+          - '124 snmp':
+              extras:
+                ensure: absent
+          - map_merge:
+              repeat:
+                for_each:
+                  <%net_cidr%>:
+                    get_param:
+                      - ServiceData
+                      - net_cidr_map
+                      - {get_param: [ServiceNetMap, SnmpdNetwork]}
+                template:
+                  '124 snmp <%net_cidr%>':
+                    extras:
+                      ensure: absent
+      upgrade_tasks:
+        - when: step|int == 0
+          block:
+            - name: Check if snmpd is enabled
+              command: systemctl is-enabled --quiet snmpd
+              failed_when: false
+              register: snmpd_enabled_result
+            - name: Set fact snmpd_enabled
+              set_fact:
+                snmpd_enabled: "{{ snmpd_enabled_result.rc == 0 }}"
+        - name: Stop snmp service
+          when:
+            - step|int == 1
+            - snmpd_enabled|bool
+          service:
+            name: snmpd
+            state: stopped
+        - name: Uninstall net-snmp
+          package:
+            name: net-snmp
+            state: absent

deployment/tripleo-packages/tripleo-packages-baremetal-puppet.yaml

@@ -298,7 +298,6 @@ outputs:
                 name:
                   - jq
                   - lvm2
-                  - net-snmp
                   - openstack-selinux
                   - os-net-config
                   - puppet-tripleo

overcloud-resource-registry-puppet.j2.yaml

@@ -188,7 +188,7 @@ resource_registry:
   OS::TripleO::Services::ExternalSwiftProxy: OS::Heat::None
   OS::TripleO::Services::SwiftStorage: deployment/swift/swift-storage-container-puppet.yaml
   OS::TripleO::Services::SwiftRingBuilder: deployment/swift/swift-ringbuilder-container-puppet.yaml
-  OS::TripleO::Services::Snmp: deployment/snmp/snmp-baremetal-puppet.yaml
+  OS::TripleO::Services::Snmp: deployment/snmp/snmpd-disabled-puppet.yaml
   OS::TripleO::Services::Timezone: deployment/time/timezone-baremetal-ansible.yaml
   OS::TripleO::Services::UndercloudRemoveNovajoin: OS::Heat::None
   OS::TripleO::Services::UndercloudTLS: OS::Heat::None

releasenotes/notes/deprecate-snmp-084d9e625f4f4e56.yaml

@@ -0,0 +1,5 @@
+---
+deprecations:
+  - |
+    The ``OS::TripleO::Services::Snmp`` service has been deprecated and is no
+    longer enabled by default. The service will be removed in a future release.