4f373ea30f
If a certificate expires, the user will need to update it. However, because we only restart services at the end of a stack-update the new certificate doesn't take effect until after puppet has run. This is a problem because puppet makes OpenStack calls, which will fail if the certificate is expired. In that case we never get to the service restart so the stack is wedged until the user manually restart haproxy. This patch addresses the problem by reloading haproxy before puppet runs. This is done in a pre-puppet script for pacemaker after pacemaker is maintenance mode because we need to make sure it happens after all of the certs have been installed on the controllers, but before puppet runs. For non-pacemaker, haproxy is simply reloaded. Change-Id: Id5ed05b3a20d06af8ae7a3d6f859b03399b0d77d
26 lines
673 B
YAML
26 lines
673 B
YAML
heat_template_version: 2014-10-16
|
|
description: 'Pre-Puppet Config for Pacemaker deployments'
|
|
|
|
parameters:
|
|
servers:
|
|
type: json
|
|
input_values:
|
|
type: json
|
|
description: input values for the software deployments
|
|
|
|
resources:
|
|
|
|
ControllerPrePuppetMaintenanceModeConfig:
|
|
type: OS::Heat::SoftwareConfig
|
|
properties:
|
|
group: script
|
|
config:
|
|
get_file: pacemaker_maintenance_mode.sh
|
|
|
|
ControllerPrePuppetMaintenanceModeDeployment:
|
|
type: OS::Heat::SoftwareDeployments
|
|
properties:
|
|
servers: {get_param: servers}
|
|
config: {get_resource: ControllerPrePuppetMaintenanceModeConfig}
|
|
input_values: {get_param: input_values}
|