tripleo-heat-templates/deployment/glance/glance-api-container-puppet.yaml

heat_template_version: rocky

description: >
  OpenStack Glance service configured with Puppet  

parameters:
  ServiceData:
    default: {}
    description: Dictionary packing service data
    type: json
  ServiceNetMap:
    default: {}
    description: Mapping of service_name -> network name. Typically set
                 via parameter_defaults in the resource registry.  This
                 mapping overrides those in ServiceNetMapDefaults.
    type: json
  DefaultPasswords:
    default: {}
    type: json
  RoleName:
    default: ''
    description: Role name on which the service is applied
    type: string
  RoleParameters:
    default: {}
    description: Parameters specific to the role
    type: json
  EndpointMap:
    default: {}
    description: Mapping of service endpoint -> protocol. Typically set
                 via parameter_defaults in the resource registry.
    type: json
  Debug:
    default: false
    description: Set to True to enable debugging on all services.
    type: boolean
  GlanceDebug:
    default: ''
    description: Set to True to enable debugging Glance service.
    type: string
    constraints:
      - allowed_values: [ '', 'true', 'True', 'TRUE', 'false', 'False', 'FALSE']
  GlancePassword:
    description: The password for the glance service and db account, used by the glance services.
    type: string
    hidden: true
  GlanceWorkers:
    default: ''
    description: |
      Number of API worker processes for Glance. If left unset (empty string), the
      default value will result in the configuration being left unset and a
      system-dependent default value will be chosen (e.g.: number of
      processors). Please note that this will create a large number of
      processes on systems with a large number of CPUs resulting in excess
      memory consumption. It is recommended that a suitable non-default value
      be selected on such systems.      
    type: string
  MonitoringSubscriptionGlanceApi:
    default: 'overcloud-glance-api'
    type: string
  GlanceApiLoggingSource:
    type: json
    default:
      tag: openstack.glance.api
      path: /var/log/containers/glance/api.log
      setype: svirt_sandbox_file_t
  GlanceImageMemberQuota:
    default: 128
    description: |
      Maximum number of image members per image.
      Negative values evaluate to unlimited.      
    type: number
  GlanceNfsEnabled:
    default: false
    description: >
      When using GlanceBackend 'file', mount NFS share for image storage.      
    type: boolean
  GlanceCacheEnabled:
    description: Enable Glance Image Cache
    type: boolean
    default: False
  GlanceNfsShare:
    default: ''
    description: >
      NFS share to mount for image storage (when GlanceNfsEnabled is true)      
    type: string
  GlanceNetappNfsEnabled:
    default: false
    description: >
      When using GlanceBackend 'file', Netapp mount NFS share for image storage.      
    type: boolean
  NetappShareLocation:
    default: ''
    description: >
      Netapp share to mount for image storage (when GlanceNetappNfsEnabled is true)      
    type: string
  GlanceNfsOptions:
    default: '_netdev,bg,intr,context=system_u:object_r:glance_var_lib_t:s0'
    description: >
      NFS mount options for image storage (when GlanceNfsEnabled is true)      
    type: string
  GlanceRbdPoolName:
    default: images
    type: string
  NovaEnableRbdBackend:
    default: false
    description: Whether to enable or not the Rbd backend for Nova
    type: boolean
  GlanceImageImportPlugins:
    default: []
    description: >
      List of enabled Image Import Plugins. Valid values in the list are
      'image_conversion', 'inject_metadata', 'no_op'.      
    type: comma_delimited_list
  GlanceImageConversionOutputFormat:
    default: 'raw'
    description: Desired output format for image conversion plugin.
    type: string
  GlanceInjectMetadataProperties:
    default: ''
    description: Metadata properties to be injected in image.
    type: comma_delimited_list
  GlanceIgnoreUserRoles:
    default: 'admin'
    description: List of user roles to be ignored for injecting image metadata properties.
    type: comma_delimited_list
  GlanceEnabledImportMethods:
    default: 'web-download'
    description: >
      List of enabled Image Import Methods. Valid values in the list are
      'glance-direct' and 'web-download'      
    type: comma_delimited_list
  GlanceStagingNfsShare:
    default: ''
    description: >
      NFS share to mount for image import staging      
    type: string
  GlanceNodeStagingUri:
    default: 'file:///var/lib/glance/staging'
    description: >
      URI that specifies the staging location to use when importing images      
    type: string
  GlanceStagingNfsOptions:
    default: '_netdev,bg,intr,context=system_u:object_r:glance_var_lib_t:s0'
    description: >
      NFS mount options for NFS image import staging      
    type: string
  KeystoneRegion:
    type: string
    default: 'regionOne'
    description: Keystone region for endpoint
  GlanceApiPolicies:
    description: |
      A hash of policies to configure for Glance API.
      e.g. { glance-context_is_admin: { key: context_is_admin, value: 'role:admin' } }      
    default: {}
    type: json
  NotificationDriver:
    type: string
    default: 'messagingv2'
    description: Driver or drivers to handle sending notifications.
  RpcPort:
    default: 5672
    description: The network port for messaging backend
    type: number
  RpcUserName:
    default: guest
    description: The username for messaging backend
    type: string
  RpcPassword:
    description: The password for messaging backend
    type: string
    hidden: true
  RpcUseSSL:
    default: false
    description: >
        Messaging client subscriber parameter to specify
        an SSL connection to the messaging host.        
    type: string

  EnableInternalTLS:
    type: boolean
    default: false
  GlanceNotifierStrategy:
    description: Strategy to use for Glance notification queue
    type: string
    default: noop
  GlanceLogFile:
    description: The filepath of the file to use for logging messages from Glance.
    type: string
    default: ''
  GlanceBackend:
    default: swift
    description: The short name of the Glance backend to use. Should be one
      of swift, rbd, cinder, or file
    type: string
    constraints:
    - allowed_values: ['swift', 'file', 'rbd', 'cinder']
  CephClientUserName:
    default: openstack
    type: string
  CephClusterName:
    type: string
    default: ceph
    description: The Ceph cluster name.
    constraints:
    - allowed_pattern: "[a-zA-Z0-9]+"
      description: >
        The Ceph cluster name must be at least 1 character and contain only
        letters and numbers.        
  GlanceApiOptVolumes:
    default: []
    description: list of optional volumes to be mounted
    type: comma_delimited_list
  DockerGlanceApiImage:
    description: image
    type: string
  DockerGlanceApiConfigImage:
    description: The container image to use for the glance_api config_volume
    type: string

parameter_groups:
- label: deprecated
  description: |
   The following parameters are deprecated and will be removed. They should not
   be relied on for new deployments. If you have concerns regarding deprecated
   parameters, please contact the TripleO development team on IRC or the
   OpenStack mailing list.   
  parameters:
  - RpcPort
  - RpcUserName
  - RpcPassword
  - RpcUseSSL

conditions:

  internal_tls_enabled: {equals: [{get_param: EnableInternalTLS}, true]}
  cinder_backend_enabled: {equals: [{get_param: GlanceBackend}, cinder]}
  rbd_backend_enabled: {equals: [{get_param: GlanceBackend}, rbd]}
  use_tls_proxy: {equals : [{get_param: EnableInternalTLS}, true]}
  glance_workers_unset: {equals : [{get_param: GlanceWorkers}, '']}
  service_debug_unset: {equals : [{get_param: GlanceDebug}, '']}
  glance_netapp_nfs_enabled: {equals : [{get_param: GlanceNetappNfsEnabled}, true]}
  glance_cache_enabled: {equals : [{get_param: GlanceCacheEnabled}, true]}
  glance_multiple_locations:
    or:
    - glance_netapp_nfs_enabled
    - and:
      - equals:
        - get_param: GlanceBackend
        - rbd
      - equals:
        - get_param: NovaEnableRbdBackend
        - true


resources:

  ContainersCommon:
    type: ../../docker/services/containers-common.yaml

  MySQLClient:
    type: ../database/mysql-client.yaml

  GlanceLogging:
    type: OS::TripleO::Services::Logging::GlanceApi

  TLSProxyBase:
    type: OS::TripleO::Services::TLSProxyBase
    properties:
      ServiceData: {get_param: ServiceData}
      ServiceNetMap: {get_param: ServiceNetMap}
      DefaultPasswords: {get_param: DefaultPasswords}
      EndpointMap: {get_param: EndpointMap}
      RoleName: {get_param: RoleName}
      RoleParameters: {get_param: RoleParameters}
      EnableInternalTLS: {get_param: EnableInternalTLS}

outputs:
  role_data:
    description: Role data for the Glance API role.
    value:
      service_name: glance_api
      monitoring_subscription: {get_param: MonitoringSubscriptionGlanceApi}
      config_settings:
        map_merge:
          - get_attr: [TLSProxyBase, role_data, config_settings]
          - glance::api::database_connection:
              make_url:
                scheme: {get_param: [EndpointMap, MysqlInternal, protocol]}
                username: glance
                password: {get_param: GlancePassword}
                host: {get_param: [EndpointMap, MysqlInternal, host]}
                path: /glance
                query:
                  read_default_file: /etc/my.cnf.d/tripleo.cnf
                  read_default_group: tripleo
            glance::api::bind_port: {get_param: [EndpointMap, GlanceInternal, port]}
            glance::api::authtoken::auth_uri: {get_param: [EndpointMap, KeystoneInternal, uri_no_suffix] }
            glance::api::authtoken::auth_url: { get_param: [EndpointMap, KeystoneInternal, uri_no_suffix] }
            glance::api::enable_v1_api: false
            glance::api::enable_v2_api: true
            glance::api::authtoken::password: {get_param: GlancePassword}
            glance::api::enable_proxy_headers_parsing: true
            glance::api::logging::debug:
              if:
              - service_debug_unset
              - {get_param: Debug }
              - {get_param: GlanceDebug }
            glance::policy::policies: {get_param: GlanceApiPolicies}
            tripleo::glance_api::firewall_rules:
              '112 glance_api':
                dport:
                  - 9292
                  - 13292
            glance::api::authtoken::project_name: 'service'
            glance::keystone::authtoken::user_domain_name: 'Default'
            glance::keystone::authtoken::project_domain_name: 'Default'
            glance::api::pipeline:
              if:
              - glance_cache_enabled
              - 'keystone+cachemanagement'
              - 'keystone'
            glance::api::show_image_direct_url: true
            glance::api::show_multiple_locations: {if: [glance_multiple_locations, true, false]}
            glance::api::os_region_name: {get_param: KeystoneRegion}
            glance::api::image_member_quota: {get_param: GlanceImageMemberQuota}
            glance::api::enabled_import_methods: {get_param: GlanceEnabledImportMethods}
            glance::api::node_staging_uri: {get_param: GlanceNodeStagingUri}
            glance::api::image_import_plugins:
              if:
              - rbd_backend_enabled
              - list_concat_unique:
                - {get_param: GlanceImageImportPlugins}
                - ['image_conversion']
              - {get_param: GlanceImageImportPlugins}
            glance::api::image_conversion_output_format: {get_param: GlanceImageConversionOutputFormat}
            glance::api::inject_metadata_properties: {get_param: GlanceInjectMetadataProperties}
            glance::api::ignore_user_roles: {get_param: GlanceIgnoreUserRoles}
            # NOTE: bind IP is found in hiera replacing the network name with the
            # local node IP for the given network; replacement examples
            # (eg. for internal_api):
            # internal_api -> IP
            # internal_api_uri -> [IP]
            # internal_api_subnet - > IP/CIDR
            tripleo::profile::base::glance::api::tls_proxy_bind_ip:
              str_replace:
                template:
                  "%{hiera('$NETWORK')}"
                params:
                  $NETWORK: {get_param: [ServiceNetMap, GlanceApiNetwork]}
            tripleo::profile::base::glance::api::tls_proxy_fqdn:
              str_replace:
                template:
                  "%{hiera('fqdn_$NETWORK')}"
                params:
                  $NETWORK: {get_param: [ServiceNetMap, GlanceApiNetwork]}
            tripleo::profile::base::glance::api::tls_proxy_port:
              get_param: [EndpointMap, GlanceInternal, port]
            # Bind to localhost if internal TLS is enabled, since we put a TLs
            # proxy in front.
            glance::api::bind_host:
              if:
              - use_tls_proxy
              - 'localhost'
              - str_replace:
                  template:
                    "%{hiera('$NETWORK')}"
                  params:
                    $NETWORK: {get_param: [ServiceNetMap, GlanceApiNetwork]}
            glance_notifier_strategy: {get_param: GlanceNotifierStrategy}
            glance_log_file: {get_param: GlanceLogFile}
            glance::backend::swift::swift_store_auth_address: {get_param: [EndpointMap, KeystoneV3Internal, uri] }
            glance::backend::swift::swift_store_user: service:glance
            glance::backend::swift::swift_store_key: {get_param: GlancePassword}
            glance::backend::swift::swift_store_create_container_on_put: true
            glance::backend::swift::swift_store_auth_version: 3
            glance::backend::rbd::rbd_store_ceph_conf:
              list_join:
              - ''
              - - '/etc/ceph/'
                - {get_param: CephClusterName}
                - '.conf'
            glance::backend::rbd::rbd_store_pool: {get_param: GlanceRbdPoolName}
            glance::backend::rbd::rbd_store_user: {get_param: CephClientUserName}
            glance_backend: {get_param: GlanceBackend}
            glance::notify::rabbitmq::notification_driver: {get_param: NotificationDriver}
          -
            if:
            - glance_workers_unset
            - {}
            - glance::api::workers: {get_param: GlanceWorkers}
          -
            if:
            - cinder_backend_enabled
            - glance::backend::cinder::cinder_store_auth_address: {get_param: [EndpointMap, KeystoneV3Internal, uri]}
              glance::backend::cinder::cinder_store_project_name: 'service'
              glance::backend::cinder::cinder_store_user_name: service:glance
              glance::backend::cinder::cinder_store_password: {get_param: GlancePassword}
            - {}
          -
            if:
            - glance_netapp_nfs_enabled
            - tripleo::profile::base::glance::netapp::netapp_share: {get_param: NetappShareLocation}
              glance::api::filesystem_store_metadata_file: '/etc/glance/glance-metadata-file.json'
              glance::api::filesystem_store_file_perm: '0644'
            - {}
          - glance::api::sync_db: false
      service_config_settings:
        keystone:
          glance::keystone::auth::public_url: {get_param: [EndpointMap, GlancePublic, uri]}
          glance::keystone::auth::internal_url: {get_param: [EndpointMap, GlanceInternal, uri]}
          glance::keystone::auth::admin_url: {get_param: [EndpointMap, GlanceAdmin, uri]}
          glance::keystone::auth::password: {get_param: GlancePassword }
          glance::keystone::auth::region: {get_param: KeystoneRegion}
          glance::keystone::auth::tenant: 'service'
        mysql:
          glance::db::mysql::password: {get_param: GlancePassword}
          glance::db::mysql::user: glance
          glance::db::mysql::host: {get_param: [EndpointMap, MysqlInternal, host_nobrackets]}
          glance::db::mysql::dbname: glance
          glance::db::mysql::allowed_hosts:
            - '%'
            - "%{hiera('mysql_bind_host')}"
        fluentd:
          tripleo_fluentd_groups_glance_api:
            - glance
          tripleo_fluentd_sources_glance_api:
            - {get_param: GlanceApiLoggingSource}
      # BEGIN DOCKER SETTINGS #
      puppet_config:
        config_volume: glance_api
        puppet_tags: glance_api_config,glance_api_paste_ini,glance_swift_config,glance_cache_config,glance_image_import_config
        step_config:
          list_join:
            - "\n"
            - - include ::tripleo::profile::base::glance::api
              - if:
                - glance_netapp_nfs_enabled
                - include ::tripleo::profile::base::glance::netapp
                - ''
              - if:
                - glance_cache_enabled
                - |
                  include ::glance::cache::cleaner
                  include ::glance::cache::pruner                  
                - ''
              - {get_attr: [MySQLClient, role_data, step_config]}
        config_image: {get_param: DockerGlanceApiConfigImage}
      kolla_config:
        /var/lib/kolla/config_files/glance_api.json:
          command: /usr/bin/glance-api --config-file /usr/share/glance/glance-api-dist.conf --config-file /etc/glance/glance-api.conf --config-file /etc/glance/glance-image-import.conf
          config_files:
            - source: "/var/lib/kolla/config_files/src/*"
              dest: "/"
              merge: true
              preserve_properties: true
            - source: "/var/lib/kolla/config_files/src-ceph/"
              dest: "/etc/ceph/"
              merge: true
              preserve_properties: true
          permissions:
            - path: /var/lib/glance
              owner: glance:glance
              recurse: true
            - path:
                str_replace:
                  template: /etc/ceph/CLUSTER.client.USER.keyring
                  params:
                    CLUSTER: {get_param: CephClusterName}
                    USER: {get_param: CephClientUserName}
              owner: glance:glance
              perm: '0600'
        /var/lib/kolla/config_files/glance_api_tls_proxy.json:
          command: /usr/sbin/httpd -DFOREGROUND
          config_files:
            - source: "/var/lib/kolla/config_files/src/etc/httpd/conf.d"
              dest: "/etc/httpd/conf.d"
              merge: false
              preserve_properties: true
            - source: "/var/lib/kolla/config_files/src/*"
              dest: "/"
              merge: true
              preserve_properties: true
      docker_config:
        step_2:
          get_attr: [GlanceLogging, docker_config, step_2]
        step_3:
          glance_api_db_sync:
            image: &glance_api_image {get_param: DockerGlanceApiImage}
            net: host
            privileged: false
            detach: false
            user: root
            volumes: &glance_volumes
              list_concat:
                - {get_attr: [ContainersCommon, volumes]}
                - {get_attr: [GlanceLogging, volumes]}
                - {get_param: GlanceApiOptVolumes}
                -
                  - /var/lib/kolla/config_files/glance_api.json:/var/lib/kolla/config_files/config.json
                  - /var/lib/config-data/puppet-generated/glance_api/:/var/lib/kolla/config_files/src:ro
                  - /etc/ceph:/var/lib/kolla/config_files/src-ceph:ro
                  - /var/lib/glance:/var/lib/glance:slave,z
                -
                  if:
                    - cinder_backend_enabled
                    - - /dev:/dev
                      - /etc/iscsi:/etc/iscsi
                      - /var/lib/iscsi:/var/lib/iscsi:z
                    - []
            environment:
              - KOLLA_BOOTSTRAP=True
              - KOLLA_CONFIG_STRATEGY=COPY_ALWAYS
            command: "/usr/bin/bootstrap_host_exec glance_api su glance -s /bin/bash -c '/usr/local/bin/kolla_start'"
        step_4:
          map_merge:
            - glance_api:
                start_order: 2
                image: *glance_api_image
                net: host
                privileged: {if: [cinder_backend_enabled, true, false]}
                restart: always
                healthcheck:
                  test: /openstack/healthcheck
                volumes: *glance_volumes
                environment:
                  - KOLLA_CONFIG_STRATEGY=COPY_ALWAYS
            - if:
                - internal_tls_enabled
                - glance_api_tls_proxy:
                    start_order: 2
                    image: *glance_api_image
                    net: host
                    user: root
                    restart: always
                    volumes:
                      list_concat:
                        - {get_attr: [ContainersCommon, volumes]}
                        -
                          - /var/lib/kolla/config_files/glance_api_tls_proxy.json:/var/lib/kolla/config_files/config.json:ro
                          - /var/lib/config-data/puppet-generated/glance_api/:/var/lib/kolla/config_files/src:ro
                          - /etc/pki/tls/certs/httpd:/etc/pki/tls/certs/httpd:ro
                          - /etc/pki/tls/private/httpd:/etc/pki/tls/private/httpd:ro
                    environment:
                      - KOLLA_CONFIG_STRATEGY=COPY_ALWAYS
                - {}
      host_prep_tasks:
        list_concat:
        - {get_attr: [GlanceLogging, host_prep_tasks]}
        - - name: Mount NFS on host
            vars:
              nfs_backend_enabled: {get_param: GlanceNfsEnabled}
              glance_netapp_nfs_enabled: {get_param: GlanceNetappNfsEnabled}
              glance_nfs_share: {get_param: GlanceNfsShare}
              netapp_share_location: {get_param: NetappShareLocation}
              nfs_share: "{{ glance_nfs_share if (glance_nfs_share) else netapp_share_location }}"
              nfs_options: {get_param: GlanceNfsOptions}
            mount: name=/var/lib/glance/images src="{{nfs_share}}" fstype=nfs opts="{{nfs_options}}" state=mounted
            when: nfs_backend_enabled or glance_netapp_nfs_enabled
          - name: Mount Node Staging Location
            vars:
              glance_node_staging_uri: {get_param: GlanceNodeStagingUri}
              glance_staging_nfs_share: {get_param: GlanceStagingNfsShare}
              glance_nfs_options: {get_param: GlanceStagingNfsOptions}
            # Gleaning mount point by stripping "file://" prefix from staging uri
            mount: name="{{glance_node_staging_uri[7:]}}" src="{{glance_staging_nfs_share}}" fstype=nfs opts="{{glance_nfs_options}}" state=mounted
            when: glance_staging_nfs_share != ''
          - name: ensure ceph configurations exist
            file:
              path: /etc/ceph
              state: directory
          - name: ensure /var/lib/glance exists
            file:
              path: /var/lib/glance
              state: directory
              setype: svirt_sandbox_file_t
      metadata_settings:
        get_attr: [TLSProxyBase, role_data, metadata_settings]
      post_upgrade_tasks:
        - when: step|int == 1
          import_role:
            name: tripleo-docker-rm
          vars:
            containers_to_rm:
              with_items:
                list_concat:
                  - - glance_api
                  - - if:
                        - internal_tls_enabled
                        - - glance_api_tls_proxy
                        - null
      fast_forward_upgrade_tasks:
        - when:
            - step|int == 0
            - release == 'ocata'
          block:
            - name: Check if glance_api is deployed
              command: systemctl is-enabled --quiet openstack-glance-api
              ignore_errors: True
              register: glance_api_enabled_result
            - name: Set fact glance_api_enabled
              set_fact:
                glance_api_enabled: "{{ glance_api_enabled_result.rc == 0 }}"
        - name: Stop openstack-glance-api
          service: name=openstack-glance-api state=stopped enabled=no
          when:
            - step|int == 1
            - release == 'ocata'
            - glance_api_enabled|bool
        - name: glance package update
          package: name=openstack-glance state=latest
          when:
            - step|int == 6
            - is_bootstrap_node|bool
        - name: glance db sync
          command: glance-manage db_sync
          when:
            - step|int == 8
            - is_bootstrap_node|bool