openstack
/
tripleo-heat-templates
Code Issues Proposed changes
RETIRED, Heat templates for deploying OpenStack
6,615 Commits 3 Branches 28 Tags 322 MiB
Go to file
Tim Rozet 2adb2b6f57 Fixes missing SSL configuration for Neutron DHCP agent 
Currently when deploying with TLS for internal API traffic, Neutron is
not configured to securely communicate with OVSDB.  In regular OVS agent
deployments OVS listens on ptcp and accepts any incoming connection.  In
ODL deployments OVS is configured to only listen for pssl connections.
To allow Neutron agents to communicate with OVSDB in pssl, Neutron needs
to be configured with SSL key/certificate in order to connect to OVS.

This patch adds key/certificate generation for NeutronBase service to be
consumed by any agent.  The only agent required with ODL is DHCP, so
this patch only addresses configuring SSL there.  However, a future
patch could enable SSL for default ML2/OVS agent deployments as well by
building off of this change.

Note, by default OVSDB listens on port 6640.  This does not work in ODL
deployments when ODL is on the control node because ODL also listens
on port 6640.  Therefore from the ODL service, the ovsdb_connection
setting for DHCP agent is modified when ODL is deployed.

Depends-On: I82281eefa1aa81207ccd8ea565cffc6ca0ec48de
Depends-On: I4bbaf00f0776cab0be34d814a541fb2fd1e64326

Closes-Bug: 1746762

Change-Id: I97352027d7f750d0820610fb9e06f82b47e77056
Signed-off-by: Tim Rozet <trozet@redhat.com>
 		2018-02-13 12:28:27 -05:00
ci Merge "Add bond-network-templates for OVB public bond CI" 2018-02-12 19:40:49 +00:00
common Merge "Fix hardcoded dependency for ExtraConfigPost." 2018-02-13 16:39:37 +00:00
deployed-server Merge "Add subnet property to ctlplane network for server resources" 2018-02-08 01:27:21 +00:00
docker Fixes missing SSL configuration for Neutron DHCP agent 2018-02-13 12:28:27 -05:00
environments Merge "Adding docker service for BGPVPN Service Plugin" 2018-02-13 12:57:46 +00:00
extraconfig Merge "OpenShift: Properly disable bare metal OVS" 2018-02-08 15:49:50 +00:00
firstboot Change template names to queens 2017-11-23 10:15:32 +01:00
network Merge "Pass storage nfs VIP to ceph-ansible" 2018-02-08 07:31:17 +00:00
plan-samples Update default value for derive params workflow inputs 2018-01-15 05:50:47 -05:00
puppet Fixes missing SSL configuration for Neutron DHCP agent 2018-02-13 12:28:27 -05:00
releasenotes Fixes missing SSL configuration for Neutron DHCP agent 2018-02-13 12:28:27 -05:00
roles Add PTP composable service 2018-02-08 15:20:17 +08:00
sample-env-generator Pass storage nfs VIP to ceph-ansible 2018-02-06 19:05:19 +00:00
scripts Avoid awk error in hosts-config.sh for large deployments 2017-04-07 10:50:39 +01:00
tools Ignore same file errors for templates processor 2018-02-12 11:11:30 +01:00
tripleo_heat_templates Do not generate apache/haproxy certs for invalid networks 2018-02-08 12:50:04 +00:00
validation-scripts Tolerate network errors in pingtest retry logic 2017-06-30 11:56:55 +01:00
zuul.d Include check of deployed server configs in multinode 2018-02-05 19:01:16 +00:00
.gitignore Sample environment generator 2017-06-12 15:02:50 -05:00
.gitreview Update stackforge references to openstack 2013-08-17 22:57:57 -04:00
.testr.conf Sample environment generator 2017-06-12 15:02:50 -05:00
LICENSE Add license file 2014-01-20 11:58:20 +01:00
README.rst Update CI coverage in README 2018-01-08 08:58:40 -08:00
all-nodes-validation.yaml Change template names to queens 2017-11-23 10:15:32 +01:00
babel.cfg Add release configuration. 2013-10-22 17:49:35 +01:00
bindep.txt Add in roles data validation 2017-07-07 09:51:40 -06:00
bootstrap-config.yaml Change template names to queens 2017-11-23 10:15:32 +01:00
capabilities-map.yaml Merge "Add support for Dell EMC VNX Cinder Backend" 2018-02-07 03:47:17 +00:00
config-download-software.yaml Change template names to queens 2017-11-23 10:15:32 +01:00
config-download-structured.yaml Change template names to queens 2017-11-23 10:15:32 +01:00
default_passwords.yaml Change template names to queens 2017-11-23 10:15:32 +01:00
hosts-config.yaml Change template names to queens 2017-11-23 10:15:32 +01:00
j2_excludes.yaml Remove ipv6 specific network templates 2017-08-31 13:12:17 -07:00
net-config-bond.yaml Change template names to queens 2017-11-23 10:15:32 +01:00
net-config-bridge.yaml Change template names to queens 2017-11-23 10:15:32 +01:00
net-config-linux-bridge.yaml Change template names to queens 2017-11-23 10:15:32 +01:00
net-config-noop.yaml Change template names to queens 2017-11-23 10:15:32 +01:00
net-config-static-bridge-with-external-dhcp.yaml Change template names to queens 2017-11-23 10:15:32 +01:00
net-config-static-bridge.yaml Change template names to queens 2017-11-23 10:15:32 +01:00
net-config-static.yaml Change template names to queens 2017-11-23 10:15:32 +01:00
net-config-undercloud.yaml Change template names to queens 2017-11-23 10:15:32 +01:00
network_data.yaml Fixes InternalApi Heat network resource 2017-10-16 15:41:39 -04:00
network_data_ganesha.yaml Add a StorageNFS network for use by Manila/Ganesha 2018-02-03 10:11:20 -05:00
overcloud-resource-registry-puppet.j2.yaml Add PTP composable service 2018-02-08 15:20:17 +08:00
overcloud.j2.yaml Add subnet property to ctlplane network for server resources 2018-02-02 09:53:03 +00:00
plan-environment.yaml Add name and description fields to plan-environment.yaml 2017-04-12 17:25:40 +02:00
requirements.txt Updated from global requirements 2017-11-16 11:30:33 +00:00
roles_data.yaml Add PTP composable service 2018-02-08 15:20:17 +08:00
roles_data_undercloud.yaml Implements AIDE Intrusion Detection System 2018-01-15 13:10:16 +00:00
setup.cfg Drop deprecated templates/Makefile/merge.py 2015-11-25 15:00:13 -05:00
setup.py Updated from global requirements 2017-03-28 13:03:01 +00:00
test-requirements.txt Merge "Introduce tests for yaql structures" 2018-01-31 09:24:26 +00:00
tox.ini Add "clean" tox target 2017-12-13 17:14:36 -06:00

README.rst

Team and repository tags

image

tripleo-heat-templates

Heat templates to deploy OpenStack using OpenStack.

Features

The ability to deploy a multi-node, role based OpenStack deployment using OpenStack Heat. Notable features include:

  • Choice of deployment/configuration tooling: puppet, (soon) docker
  • Role based deployment: roles for the controller, compute, ceph, swift, and cinder storage
  • physical network configuration: support for isolated networks, bonding, and standard ctlplane networking

Directories

A description of the directory layout in TripleO Heat Templates.

  • environments: contains heat environment files that can be used with -e

    on the command like to enable features, etc.

  • extraconfig: templates used to enable 'extra' functionality. Includes

    functionality for distro specific registration and upgrades.

  • firstboot: example first_boot scripts that can be used when initially

    creating instances.

  • network: heat templates to help create isolated networks and ports
  • puppet: templates mostly driven by configuration with puppet. To use these

    templates you can use the overcloud-resource-registry-puppet.yaml.

  • validation-scripts: validation scripts useful to all deployment

    configurations

  • roles: example roles that can be used with the tripleoclient to generate

    a roles_data.yaml for a deployment See the roles/README.rst for additional details.

Service testing matrix

The configuration for the CI scenarios will be defined in tripleo-heat-templates/ci/ and should be executed according to the following table:

- scn001 scn002 scn003 scn004 scn006 scn007 scn009 non-ha ovh-ha
openshift

X
keystone

X

X

X

X

X

X

X

X
glance

rbd

 swift

file

rgw

file

file

file

file
cinder

rbd

 iscsi
heat

X

X
ironic

X
mysql

X

X

X

X

X

X

X

X
neutron

ovs

ovs

ovs

ovs

ovs

ovn

ovs

ovs
neutron-bgpvpn

wip
ovn

X
neutron-l2gw

wip
rabbitmq

X

X

X

X

X

X

X

X
mongodb
redis

X

X
haproxy

X

X

X

X

X

X

X

X
memcached

X

X

X

X

X

X

X

X
pacemaker

X

X

X

X

X

X

X

X
nova

qemu

qemu

qemu

qemu

 ironic

qemu

qemu

qemu
ntp

X

X

X

X

X

X

X

X

X
snmp

X

X

X

X

X

X

X

X

X
timezone

X

X

X

X

X

X

X

X

X
sahara

X
mistral

X
swift

X
aodh

X

X
ceilometer

X

X
gnocchi

rbd

swift
panko

X

X
barbican

X
zaqar

X
ec2api

X
cephrgw

X
tacker

X
congress

X
cephmds

X
manila

X
collectd

X
fluentd

X
sensu-client

X