heat_template_version: rocky description: > OpenStack Octavia service configured with Puppet parameters: DockerOctaviaApiImage: description: image type: string DockerOctaviaConfigImage: description: The container image to use for the octavia config_volume type: string OctaviaApiLoggingSource: type: json default: tag: openstack.octavia.api path: /var/log/containers/octavia/api.log EndpointMap: default: {} description: Mapping of service endpoint -> protocol. Typically set via parameter_defaults in the resource registry. type: json ServiceData: default: {} description: Dictionary packing service data type: json ServiceNetMap: default: {} description: Mapping of service_name -> network name. Typically set via parameter_defaults in the resource registry. This mapping overrides those in ServiceNetMapDefaults. type: json DefaultPasswords: default: {} type: json RoleName: default: '' description: Role name on which the service is applied type: string RoleParameters: default: {} description: Parameters specific to the role type: json EnableInternalTLS: type: boolean default: false OctaviaUserName: description: The username for the Octavia database and keystone accounts. type: string default: 'octavia' OctaviaPassword: description: The password for the Octavia database and keystone accounts. type: string hidden: true OctaviaProjectName: description: The project name for the keystone Octavia account. type: string default: 'service' KeystoneRegion: type: string default: 'regionOne' description: Keystone region for endpoint MonitoringSubscriptionOctaviaApi: default: 'overcloud-octavia-api' type: string OctaviaApiPolicies: description: | A hash of policies to configure for Octavia API. e.g. { octavia-context_is_admin: { key: context_is_admin, value: 'role:admin' } } default: {} type: json OctaviaFlavorProperties: default: ram : '1024' disk : '3' vcpus: '1' description: Dictionary describing the nova flavor for amphora. type: json OctaviaManageNovaFlavor: default: true description: Configure the nova flavor for the amphora. type: boolean conditions: internal_tls_enabled: {equals: [{get_param: EnableInternalTLS}, true]} use_tls_proxy: {equals : [{get_param: EnableInternalTLS}, true]} resources: ContainersCommon: type: ../containers-common.yaml MySQLClient: type: ../database/mysql-client.yaml OctaviaBase: type: ./octavia-base.yaml properties: EndpointMap: {get_param: EndpointMap} ServiceData: {get_param: ServiceData} ServiceNetMap: {get_param: ServiceNetMap} DefaultPasswords: {get_param: DefaultPasswords} RoleName: {get_param: RoleName} RoleParameters: {get_param: RoleParameters} OctaviaWorker: # provides Nova flavor type: ./octavia-worker-container-puppet.yaml properties: EndpointMap: {get_param: EndpointMap} ServiceData: {get_param: ServiceData} ServiceNetMap: {get_param: ServiceNetMap} DefaultPasswords: {get_param: DefaultPasswords} RoleName: {get_param: RoleName} RoleParameters: {get_param: RoleParameters} outputs: role_data: description: Role data for the Octavia API role. value: service_name: octavia_api monitoring_subscription: {get_param: MonitoringSubscriptionOctaviaApi} config_settings: map_merge: - {get_attr: [OctaviaBase, role_data, config_settings]} - {get_attr: [OctaviaWorker, role_data, config_settings]} - octavia::keystone::authtoken::www_authenticate_uri: {get_param: [EndpointMap, KeystoneInternal, uri] } octavia::keystone::authtoken::auth_uri: {get_param: [EndpointMap, KeystoneInternal, uri] } octavia::policy::policies: {get_param: OctaviaApiPolicies} octavia::keystone::authtoken::auth_url: {get_param: [EndpointMap, KeystoneInternal, uri_no_suffix]} octavia::keystone::authtoken::project_name: {get_param: OctaviaProjectName} octavia::keystone::authtoken::password: {get_param: OctaviaPassword} octavia::worker::manage_nova_flavor: {get_param: OctaviaManageNovaFlavor} octavia::worker::nova_flavor_config: {get_param: OctaviaFlavorProperties} octavia::api::sync_db: true octavia::api::service_name: 'httpd' octavia::wsgi::apache::ssl: {get_param: EnableInternalTLS} tripleo::octavia_api::firewall_rules: '120 octavia api': dport: - 9876 - 13876 # NOTE: bind IP is found in hiera replacing the network name with the local node IP # for the given network; replacement examples (eg. for internal_api): # internal_api -> IP # internal_api_uri -> [IP] # internal_api_subnet - > IP/CIDR octavia::wsgi::apache::bind_host: str_replace: template: "%{hiera('$NETWORK')}" params: $NETWORK: {get_param: [ServiceNetMap, OctaviaApiNetwork]} octavia::wsgi::apache::server_name: str_replace: template: "%{hiera('fqdn_$NETWORK')}" params: $NETWORK: {get_param: [ServiceNetMap, OctaviaApiNetwork]} tripleo::profile::base::octavia::api::tls_proxy_port: get_param: [EndpointMap, OctaviaInternal, port] # Bind to localhost if internal TLS is enabled, since we put a TLS # proxy in front. octavia::api::host: str_replace: template: "%{hiera('$NETWORK')}" params: $NETWORK: {get_param: [ServiceNetMap, OctaviaApiNetwork]} service_config_settings: fluentd: tripleo_fluentd_groups_octavia_api: - octavia tripleo_fluentd_sources_octavia_api: - {get_param: OctaviaApiLoggingSource} keystone: octavia::keystone::auth::tenant: {get_param: OctaviaProjectName} octavia::keystone::auth::public_url: {get_param: [EndpointMap, OctaviaPublic, uri]} octavia::keystone::auth::internal_url: { get_param: [ EndpointMap, OctaviaInternal, uri ] } octavia::keystone::auth::admin_url: { get_param: [ EndpointMap, OctaviaAdmin, uri ] } octavia::keystone::auth::password: {get_param: OctaviaPassword} octavia::keystone::auth::region: {get_param: KeystoneRegion} mysql: octavia::db::mysql::password: {get_param: OctaviaPassword} octavia::db::mysql::user: {get_param: OctaviaUserName} octavia::db::mysql::host: {get_param: [EndpointMap, MysqlInternal, host_nobrackets]} octavia::db::mysql::dbname: octavia octavia::db::mysql::allowed_hosts: - '%' - "%{hiera('mysql_bind_host')}" # BEGIN DOCKER SETTINGS # puppet_config: config_volume: octavia puppet_tags: octavia_config step_config: list_join: - "\n" - - "include tripleo::profile::base::octavia::api" - {get_attr: [MySQLClient, role_data, step_config]} config_image: {get_param: DockerOctaviaConfigImage} kolla_config: /var/lib/kolla/config_files/octavia_api.json: command: /usr/sbin/httpd -DFOREGROUND config_files: - source: "/var/lib/kolla/config_files/src/etc/httpd/conf.d" dest: "/etc/httpd/conf.d" merge: false preserve_properties: true - source: "/var/lib/kolla/config_files/src/*" dest: "/" merge: true preserve_properties: true permissions: - path: /var/log/octavia owner: octavia:octavia recurse: true container_puppet_tasks: step_5: config_volume: octavia puppet_tags: nova_flavor step_config: | include ::octavia::worker config_image: {get_param: DockerOctaviaConfigImage} volumes: - /var/lib/config-data/puppet-generated/nova/etc/nova:/etc/nova:ro docker_config: # Kolla_bootstrap/db_sync runs before permissions set by kolla_config step_2: octavia_api_init_dirs: start_order: 0 image: &octavia_api_image {get_param: DockerOctaviaApiImage} net: none user: root volumes: # NOTE(mandre) we need extra dir for the service in /etc/octavia/conf.d # It is normally created as part of the RPM install, but it is # missing here because we use the same config_volume for all # octavia services, hence the same container image to generate # configuration. - /var/lib/config-data/puppet-generated/octavia/etc/octavia:/etc/octavia/ - /var/log/containers/octavia:/var/log/octavia:z - /var/log/containers/httpd/octavia-api:/var/log/httpd:z command: ['/bin/bash', '-c', 'mkdir -p /etc/octavia/conf.d/octavia-api; chown -R octavia:octavia /etc/octavia/conf.d/octavia-api; chown -R octavia:octavia /var/log/octavia'] step_3: octavia_db_sync: start_order: 0 image: *octavia_api_image net: host privileged: false detach: false user: root volumes: list_concat: - {get_attr: [ContainersCommon, volumes]} - - /var/lib/config-data/octavia/etc/octavia/:/etc/octavia/:ro - /var/lib/config-data/octavia/etc/my.cnf.d/:/etc/my.cnf.d/:ro - /var/log/containers/octavia:/var/log/octavia:z - /var/log/containers/httpd/octavia-api:/var/log/httpd:z command: "/usr/bin/bootstrap_host_exec octavia_api su octavia -s /bin/bash -c '/usr/bin/octavia-db-manage upgrade head'" step_4: map_merge: - octavia_api: start_order: 2 image: *octavia_api_image net: host user: root privileged: false restart: always healthcheck: test: /openstack/healthcheck volumes: list_concat: - {get_attr: [ContainersCommon, volumes]} - - /var/lib/kolla/config_files/octavia_api.json:/var/lib/kolla/config_files/config.json:ro - /var/lib/config-data/puppet-generated/octavia/:/var/lib/kolla/config_files/src:ro - /var/log/containers/octavia:/var/log/octavia:z - /var/log/containers/httpd/octavia-api:/var/log/httpd:z - if: - internal_tls_enabled - /etc/pki/tls/certs/httpd:/etc/pki/tls/certs/httpd:ro - '' - if: - internal_tls_enabled - /etc/pki/tls/private/httpd:/etc/pki/tls/private/httpd:ro - '' environment: - KOLLA_CONFIG_STRATEGY=COPY_ALWAYS host_prep_tasks: - name: create persistent directories file: path: "{{ item.path }}" state: directory setype: "{{ item.setype }}" with_items: - { 'path': /var/log/containers/octavia, 'setype': svirt_sandbox_file_t } - { 'path': /var/log/containers/httpd/octavia-api, 'setype': svirt_sandbox_file_t } - { 'path': /var/log/octavia, 'setype': svirt_sandbox_file_t } - name: octavia logs readme copy: dest: /var/log/octavia/readme.txt content: | Log files from octavia containers can be found under /var/log/containers/octavia and /var/log/containers/httpd/octavia-api. ignore_errors: true update_tasks: - name: remove TLS proxy if configured and running when: - step|int == 2 - internal_tls_enabled|bool block: &remove_octavia_tls_proxy_tasks - name: stop and remove octavia_api_tls_proxy container if docker docker: name: octavia_api_tls_proxy state: absent when: container_cli == 'docker' - name: stop and disable octavia_api_tls_proxy container if podman service: name: tripleo_octavia_api_tls_proxy state: stopped enabled: no when: container_cli == 'podman' - name: clean up tripleo service file for octavia_api_tls_proxy file: state: absent path: "/etc/systemd/system/tripleo_octavia_api_tls_proxy" when: container_cli == 'podman' upgrade_tasks: - name: remove TLS proxy if configured and running when: - step|int == 2 - internal_tls_enabled|bool block: *remove_octavia_tls_proxy_tasks post_upgrade_tasks: - when: step|int == 1 import_role: name: tripleo-docker-rm vars: containers_to_rm: with_items: list_concat: - - octavia_api - - if: - internal_tls_enabled - - octavia_api_tls_proxy - null