tripleo-heat-templates/puppet/services/neutron-base.yaml
Tim Rozet 2adb2b6f57 Fixes missing SSL configuration for Neutron DHCP agent
Currently when deploying with TLS for internal API traffic, Neutron is
not configured to securely communicate with OVSDB.  In regular OVS agent
deployments OVS listens on ptcp and accepts any incoming connection.  In
ODL deployments OVS is configured to only listen for pssl connections.
To allow Neutron agents to communicate with OVSDB in pssl, Neutron needs
to be configured with SSL key/certificate in order to connect to OVS.

This patch adds key/certificate generation for NeutronBase service to be
consumed by any agent.  The only agent required with ODL is DHCP, so
this patch only addresses configuring SSL there.  However, a future
patch could enable SSL for default ML2/OVS agent deployments as well by
building off of this change.

Note, by default OVSDB listens on port 6640.  This does not work in ODL
deployments when ODL is on the control node because ODL also listens
on port 6640.  Therefore from the ODL service, the ovsdb_connection
setting for DHCP agent is modified when ODL is deployed.

Depends-On: I82281eefa1aa81207ccd8ea565cffc6ca0ec48de
Depends-On: I4bbaf00f0776cab0be34d814a541fb2fd1e64326

Closes-Bug: 1746762

Change-Id: I97352027d7f750d0820610fb9e06f82b47e77056
Signed-off-by: Tim Rozet <trozet@redhat.com>
2018-02-13 12:28:27 -05:00

184 lines
6.5 KiB
YAML

heat_template_version: queens
description: >
OpenStack Neutron base service. Shared for all Neutron agents.
parameters:
RabbitPassword:
description: The password for RabbitMQ
type: string
hidden: true
RabbitUserName:
default: guest
description: The username for RabbitMQ
type: string
RabbitClientUseSSL:
default: false
description: >
Rabbit client subscriber parameter to specify
an SSL connection to the RabbitMQ host.
type: string
RabbitClientPort:
default: 5672
description: Set rabbit subscriber port, change this if using SSL
type: number
DatabaseSyncTimeout:
default: 300
description: DB Sync Timeout default
type: number
NeutronDhcpAgentsPerNetwork:
type: number
default: 0
description: The number of neutron dhcp agents to schedule per network
DhcpAgentNotification:
default: true
description: Whether or not to enable DHCP agent notifications.
type: boolean
NeutronDnsDomain:
type: string
default: openstacklocal
description: Domain to use for building the hostnames.
NeutronCorePlugin:
default: 'ml2'
description: |
The core plugin for Neutron. The value should be the entrypoint to be loaded
from neutron.core_plugins namespace.
type: string
NeutronServicePlugins:
default: "router,qos,trunk"
description: |
Comma-separated list of service plugin entrypoints to be loaded from the
neutron.service_plugins namespace.
type: comma_delimited_list
Debug:
type: boolean
default: false
description: Set to True to enable debugging on all services.
NeutronDebug:
default: ''
description: Set to True to enable debugging Neutron services.
type: string
constraints:
- allowed_values: [ '', 'true', 'True', 'TRUE', 'false', 'False', 'FALSE']
EnableConfigPurge:
type: boolean
default: false
description: >
Remove configuration that is not generated by TripleO. Used to avoid
configuration remnants after upgrades.
NeutronGlobalPhysnetMtu:
type: number
default: 1500
description: |
MTU of the underlying physical network. Neutron uses this value to
calculate MTU for all virtual network components. For flat and VLAN
networks, neutron uses this value without modification. For overlay
networks such as VXLAN, neutron automatically subtracts the overlay
protocol overhead from this value.
NeutronDBSyncExtraParams:
default: ''
description: |
String of extra command line parameters to append to the neutron-db-manage
upgrade head command.
type: string
ServiceData:
default: {}
description: Dictionary packing service data
type: json
ServiceNetMap:
default: {}
description: Mapping of service_name -> network name. Typically set
via parameter_defaults in the resource registry. This
mapping overrides those in ServiceNetMapDefaults.
type: json
DefaultPasswords:
default: {}
type: json
RoleName:
default: ''
description: Role name on which the service is applied
type: string
RoleParameters:
default: {}
description: Parameters specific to the role
type: json
EndpointMap:
default: {}
description: Mapping of service endpoint -> protocol. Typically set
via parameter_defaults in the resource registry.
type: json
NotificationDriver:
type: string
default: 'messagingv2'
description: Driver or drivers to handle sending notifications.
constraints:
- allowed_values: [ 'messagingv2', 'noop' ]
EnableInternalTLS:
type: boolean
default: false
conditions:
dhcp_agents_zero: {equals : [{get_param: NeutronDhcpAgentsPerNetwork}, 0]}
service_debug_unset: {equals : [{get_param: NeutronDebug}, '']}
internal_tls_enabled: {equals: [{get_param: EnableInternalTLS}, true]}
outputs:
role_data:
description: Role data for the Neutron base service.
value:
service_name: neutron_base
config_settings:
map_merge:
- neutron::rabbit_password: {get_param: RabbitPassword}
neutron::rabbit_user: {get_param: RabbitUserName}
neutron::rabbit_use_ssl: {get_param: RabbitClientUseSSL}
neutron::rabbit_port: {get_param: RabbitClientPort}
neutron::notification_driver: {get_param: NotificationDriver}
neutron::core_plugin: {get_param: NeutronCorePlugin}
neutron::service_plugins: {get_param: NeutronServicePlugins}
neutron::debug:
if:
- service_debug_unset
- {get_param: Debug }
- {get_param: NeutronDebug }
neutron::purge_config: {get_param: EnableConfigPurge}
neutron::allow_overlapping_ips: true
neutron::dhcp_agent_notification: {get_param: DhcpAgentNotification}
neutron::dns_domain: {get_param: NeutronDnsDomain}
neutron::rabbit_heartbeat_timeout_threshold: 60
neutron::host: '%{::fqdn}'
neutron::db::database_db_max_retries: -1
neutron::db::database_max_retries: -1
neutron::db::sync::db_sync_timeout: {get_param: DatabaseSyncTimeout}
neutron::global_physnet_mtu: {get_param: NeutronGlobalPhysnetMtu}
neutron::db::sync::extra_params: {get_param: NeutronDBSyncExtraParams}
- if:
- dhcp_agents_zero
- {}
- tripleo::profile::base::neutron::dhcp_agents_per_network: {get_param: NeutronDhcpAgentsPerNetwork}
- if:
- internal_tls_enabled
- generate_service_certificates: true
tripleo::profile::base::neutron::certificate_specs:
service_certificate: '/etc/pki/tls/certs/neutron.crt'
service_key: '/etc/pki/tls/private/neutron.key'
hostname:
str_replace:
template: "%{hiera('fqdn_NETWORK')}"
params:
NETWORK: {get_param: [ServiceNetMap, NeutronApiNetwork]}
principal:
str_replace:
template: "neutron/%{hiera('fqdn_NETWORK')}"
params:
NETWORK: {get_param: [ServiceNetMap, NeutronApiNetwork]}
- null
metadata_settings:
if:
- internal_tls_enabled
-
- service: neutron
network: {get_param: [ServiceNetMap, NeutronApiNetwork]}
type: node
- null