heat_template_version: wallaby description: > OpenStack containerized novajoin service parameters: ContainerNovajoinServerImage: description: image type: string ContainerNovajoinNotifierImage: description: image type: string ContainerNovajoinConfigImage: description: image type: string EndpointMap: default: {} description: Mapping of service endpoint -> protocol. Typically set via parameter_defaults in the resource registry. type: json ServiceNetMap: default: {} description: Mapping of service_name -> network name. Typically set via parameter_defaults in the resource registry. Use parameter_merge_strategies to merge it with the defaults. type: json ServiceData: default: {} description: Dictionary packing service data type: json RoleName: default: '' description: Role name on which the service is applied type: string RoleParameters: default: {} description: Parameters specific to the role type: json NovajoinPassword: description: The password for the Novajoin service account. type: string hidden: true NovaPassword: description: The password for the nova service and db account type: string hidden: true KeystoneRegion: type: string default: 'regionOne' description: Keystone region for endpoint RabbitClientPort: default: 5672 description: Set rabbit subscriber port, change this if using SSL type: number RabbitClientUseSSL: default: false description: > Rabbit client subscriber parameter to specify an SSL connection to the RabbitMQ host. type: string RpcPassword: description: The password for messaging backend type: string hidden: true RabbitUserName: default: guest description: The username for RabbitMQ type: string NovajoinIpaOtp: default: '' description: The OTP to use to enroll to FreeIPA type: string NovajoinVendordataTimeout: default: 30 description: The timeout for both the vendordata dynamic connect and read values. type: number NovajoinPolicies: description: | A hash of policies to configure for Novajoin. default: {} type: json MemcacheUseAdvancedPool: type: boolean description: | Use the advanced (eventlet safe) memcached client pool. default: true resources: ContainersCommon: type: ../../containers-common.yaml outputs: role_data: description: Role data for the novajoin API role. value: service_name: novajoin firewall_rules: '119 novajoin': dport: - 9090 keystone_resources: novajoin: endpoints: public: {get_param: [EndpointMap, NovajoinPublic, uri]} internal: {get_param: [EndpointMap, NovajoinInternal, uri]} admin: {get_param: [EndpointMap, NovajoinAdmin, uri]} users: novajoin: password: {get_param: NovajoinPassword} region: {get_param: KeystoneRegion} service: 'compute-vendordata-plugin' config_settings: tripleo::profile::base::novajoin::oslomsg_rpc_password: {get_param: RpcPassword} tripleo::profile::base::novajoin::oslomsg_rpc_port: {get_param: RabbitClientPort} tripleo::profile::base::novajoin::oslomsg_rpc_username: {get_param: RabbitUserName} tripleo::profile::base::novajoin::oslomsg_use_ssl: {get_param: RabbitClientUseSSL} tripleo::profile::base::novajoin::service_password: {get_param: NovajoinPassword} nova::metadata::novajoin::api::bind_address: &novajoin_address str_replace: template: "%{hiera('novajoin_network')}" params: novajoin_network: {get_param: [ServiceNetMap, NovajoinNetwork]} nova::metadata::novajoin::api::join_listen_port: 9090 nova::metadata::novajoin::api::project_name: service nova::metadata::novajoin::api::keystone_auth_url: {get_param: [EndpointMap, KeystoneInternal, uri_no_suffix]} # We will rely on the host being enrolled for this nova::metadata::novajoin::api::enable_ipa_client_install: false # Since we rely on the host to be enrolled, we need to configure # kerberos via puppet. nova::metadata::novajoin::api::configure_kerberos: true nova::metadata::novajoin::authtoken::auth_url: {get_param: [EndpointMap, KeystoneInternal, uri_no_suffix]} nova::metadata::novajoin::authtoken::www_authenticate_uri: {get_param: [EndpointMap, KeystoneInternal, uri_no_suffix]} nova::metadata::novajoin::authtoken::password: {get_param: NovajoinPassword} nova::metadata::novajoin::authtoken::project_name: 'service' nova::metadata::novajoin::authtoken::region_name: {get_param: KeystoneRegion} nova::metadata::novajoin::authtoken::interface: 'internal' nova::metadata::novajoin::authtoken::memcache_use_advanced_pool: {get_param: MemcacheUseAdvancedPool} nova::metadata::novajoin::policy::policies: {get_param: NovajoinPolicies} service_config_settings: nova_metadata: &nova_vendordata novajoin_address: *novajoin_address nova::vendordata::vendordata_jsonfile_path: '/etc/novajoin/cloud-config-novajoin.json' nova::vendordata::vendordata_providers: ['StaticJSON', 'DynamicJSON'] # TODO(jaosorior): Add TLS support here. Novajoin is currently not # accessed behind haproxy, but is accessed directly instead. For this # reason, we don't use the make_url function. Also note that for now # this is only meant to be used in a single node containerized # undercloud. Multinode support will come later. nova::vendordata::vendordata_dynamic_targets: - str_replace: template: "join@http://%{hiera('novajoin_network')}:9090/v1/" params: novajoin_network: {get_param: [ServiceNetMap, NovajoinNetwork]} nova::vendordata::vendordata_dynamic_failure_fatal: true nova::vendordata::vendordata_dynamic_auth_auth_type: 'password' nova::vendordata::vendordata_dynamic_auth_auth_url: get_param: [EndpointMap, KeystoneInternal, uri_no_suffix] nova::vendordata::vendordata_dynamic_auth_os_region_name: get_param: KeystoneRegion nova::vendordata::vendordata_dynamic_auth_username: 'nova' nova::vendordata::vendordata_dynamic_auth_project_name: 'service' nova::vendordata::vendordata_dynamic_auth_project_domain_name: 'Default' nova::vendordata::vendordata_dynamic_auth_user_domain_name: 'Default' nova::vendordata::vendordata_dynamic_auth_password: {get_param: NovaPassword} nova::vendordata::vendordata_dynamic_connect_timeout: {get_param: NovajoinVendordataTimeout} nova::vendordata::vendordata_dynamic_read_timeout: {get_param: NovajoinVendordataTimeout} # novajoin requires that the notification driver be set which could # be disabled if telemetry is off. nova::notification_driver: messagingv2 nova::notification_topics: ['notifications', 'novajoin_notifications'] nova::notify_on_state_change: 'vm_state' nova_api: *nova_vendordata nova_compute: *nova_vendordata nova_ironic: *nova_vendordata # BEGIN DOCKER SETTINGS puppet_config: config_volume: novajoin puppet_tags: novajoin_config step_config: include tripleo::profile::base::novajoin config_image: {get_param: ContainerNovajoinConfigImage} kolla_config: /var/lib/kolla/config_files/novajoin_server.json: command: novajoin-server --config-file /etc/novajoin/join.conf config_files: - source: "/var/lib/kolla/config_files/src/etc/novajoin/join.conf" dest: "/etc/novajoin/" merge: false preserve_properties: true /var/lib/kolla/config_files/novajoin_notifier.json: command: novajoin-notify --config-file /etc/novajoin/join.conf config_files: - source: "/var/lib/kolla/config_files/src/etc/novajoin/join.conf" dest: "/etc/novajoin/" merge: false preserve_properties: true docker_config: step_4: novajoin_server: start_order: 0 image: {get_param: ContainerNovajoinServerImage} net: host privileged: false restart: always volumes: list_concat: - {get_attr: [ContainersCommon, volumes]} - - /var/lib/kolla/config_files/novajoin_server.json:/var/lib/kolla/config_files/config.json:ro - /var/lib/config-data/puppet-generated/novajoin:/var/lib/kolla/config_files/src:ro - /etc/ipa/:/etc/ipa/:ro - /etc/novajoin/krb5.keytab:/etc/novajoin/krb5.keytab:ro - /var/log/containers/novajoin:/var/log/novajoin environment: KOLLA_CONFIG_STRATEGY: COPY_ALWAYS KRB5_CONFIG: /etc/novajoin/krb5.conf novajoin_notifier: start_order: 1 image: {get_param: ContainerNovajoinNotifierImage} net: host privileged: false restart: always volumes: list_concat: - {get_attr: [ContainersCommon, volumes]} - - /var/lib/kolla/config_files/novajoin_notifier.json:/var/lib/kolla/config_files/config.json:ro - /var/lib/config-data/puppet-generated/novajoin:/var/lib/kolla/config_files/src:ro - /etc/ipa/:/etc/ipa/:ro - /etc/novajoin/krb5.keytab:/etc/novajoin/krb5.keytab:ro - /var/log/containers/novajoin:/var/log/novajoin environment: KOLLA_CONFIG_STRATEGY: COPY_ALWAYS KRB5_CONFIG: /etc/novajoin/krb5.conf host_prep_tasks: # https://bugs.launchpad.net/tripleo/+bug/1821139 # This is here only for split stack environments to make sure # openssl-perl is installed which provides /etc/pki/CA on RHEL8 - name: Ensure openssl-perl package is present on RHEL8 when: - ansible_facts['os_family'] == 'RedHat' - ansible_facts['distribution_major_version'] is version('8', '==') package: name: openssl-perl state: present - name: Ensure FreeIPA Client package is present package: name: ipa-client state: present - name: Set FreeIPA OTP fact set_fact: ipa_otp: {get_param: NovajoinIpaOtp} no_log: "{{ hide_sensitive_logs | bool }}" - name: create persistent directories file: path: "{{ item.path }}" state: directory setype: "{{ item.setype }}" mode: "{{ item.mode }}" with_items: - { 'path': /var/log/containers/novajoin, 'setype': container_file_t, 'mode': '0750' } - name: Enroll to FreeIPA command: ipa-client-install -U --password={{ ipa_otp }} args: creates: /etc/ipa/default.conf when: ipa_otp != '' - name: Request kerberos keytab shell: "/usr/bin/kinit -kt /etc/krb5.keytab && ipa-getkeytab -s $(grep xmlrpc_uri /etc/ipa/default.conf | cut -d/ -f3) -p nova/{{ ansible_facts['nodename'] }} -k /etc/novajoin/krb5.keytab" args: creates: /etc/novajoin/krb5.keytab