tripleo-heat-templates/deployment/designate/designate-mdns-container-puppet.yaml
Damien Ciabrini f2015da4b5 Simplify mysql users creation
Openstack users are configured with openstacklib, which in turns
drive puppet-mysql to create several DB user for each db service:
<service>@'%' <service>@<ip> and <service>@<mysql_vip>.

We create several users because we use two different parameters
host and allowed_hosts in openstacklib, which only has the effect
of creating a list of users per openstack service.

However since we always create a user '%', this wildcard host
will always allow connection to the DB, so the other users are
currently not useful as they don't get any additional grants or
restrictions.

Simplify the entire mysql user creation to only generate one
user per service, with a wildcard host.

Change-Id: I928b03f06c702a13f4bd957eaa79153aa711cee4
Closes-Bug: #1943440
Closes-Bug: #1943330
2021-09-15 12:23:30 +02:00

178 lines
6.1 KiB
YAML

heat_template_version: wallaby
description: >
OpenStack containerized Designate MiniDNS service
parameters:
ContainerDesignateMDNSImage:
description: image
type: string
ContainerDesignateConfigImage:
description: The container image to use for the designate config_volume
type: string
EndpointMap:
default: {}
description: Mapping of service endpoint -> protocol. Typically set
via parameter_defaults in the resource registry.
type: json
ServiceData:
default: {}
description: Dictionary packing service data
type: json
ServiceNetMap:
default: {}
description: Mapping of service_name -> network name. Typically set
via parameter_defaults in the resource registry. Use
parameter_merge_strategies to merge it with the defaults.
type: json
EnableSQLAlchemyCollectd:
type: boolean
description: >
Set to true to enable the SQLAlchemy-collectd server plugin
default: false
RoleName:
default: ''
description: Role name on which the service is applied
type: string
RoleParameters:
default: {}
description: Parameters specific to the role
type: json
MonitoringSubscriptionDesignateMiniDNS:
default: 'overcloud-designate-mdns'
type: string
DesignateWorkers:
default: 0
description: Number of workers for Designate services.
type: number
DesignatePassword:
description: The password for the Designate's database account.
type: string
hidden: true
conditions:
designate_workers_zero: {equals : [{get_param: DesignateWorkers}, 0]}
enable_sqlalchemy_collectd: {equals : [{get_param: EnableSQLAlchemyCollectd}, true]}
resources:
ContainersCommon:
type: ../containers-common.yaml
MySQLClient:
type: ../database/mysql-client.yaml
DesignateBase:
type: ./designate-base.yaml
properties:
EndpointMap: {get_param: EndpointMap}
ServiceData: {get_param: ServiceData}
ServiceNetMap: {get_param: ServiceNetMap}
RoleName: {get_param: RoleName}
RoleParameters: {get_param: RoleParameters}
outputs:
role_data:
description: Role data for the Designate MDNS role.
value:
service_name: designate_mdns
firewall_rules:
'142 designate_mdns udp':
proto: 'udp'
dport:
- 5354
'143 designate_mdns tcp':
proto: 'tcp'
dport:
- 5354
monitoring_subscription: {get_param: MonitoringSubscriptionDesignateMiniDNS}
config_settings:
map_merge:
- get_attr: [DesignateBase, role_data, config_settings]
- designate::db::database_connection:
make_url:
scheme: {get_param: [EndpointMap, MysqlInternal, protocol]}
username: designate
password: {get_param: DesignatePassword}
host: {get_param: [EndpointMap, MysqlInternal, host]}
path: /designate
query:
if:
- enable_sqlalchemy_collectd
-
read_default_file: /etc/my.cnf.d/tripleo.cnf
read_default_group: tripleo
plugin: collectd
collectd_program_name: designate_mdns
collectd_host: localhost
-
read_default_file: /etc/my.cnf.d/tripleo.cnf
read_default_group: tripleo
-
if:
- designate_workers_zero
- {}
- designate::mdns::workers: {get_param: DesignateWorkers}
- designate::mdns::listen:
- '0.0.0.0:5354'
- '[::]:5354'
service_config_settings:
mysql:
designate::db::mysql::password: {get_param: DesignatePassword}
designate::db::mysql::user: designate
designate::db::mysql::host: '%'
designate::db::mysql::dbname: designate
# BEGIN DOCKER SETTINGS
puppet_config:
config_volume: designate
puppet_tags: designate_config
step_config:
list_join:
- "\n"
- - {get_attr: [DesignateBase, role_data, step_config]}
- "include tripleo::profile::base::designate::mdns"
- {get_attr: [MySQLClient, role_data, step_config]}
config_image: {get_param: ContainerDesignateConfigImage}
kolla_config:
/var/lib/kolla/config_files/designate_mdns.json:
command: /usr/bin/designate-mdns --config-file=/etc/designate/designate.conf --log-file=/var/log/designate/mdns.log
config_files:
- source: "/var/lib/kolla/config_files/src/*"
dest: "/"
merge: true
preserve_properties: true
permissions:
- path: /var/log/designate
owner: designate:designate
recurse: true
docker_config:
step_4:
designate_mdns:
image: &designate_mdns_image {get_param: ContainerDesignateMDNSImage}
net: host
privileged: false
restart: always
stop_grace_period: 300
healthcheck:
test: /openstack/healthcheck
volumes:
list_concat:
- {get_attr: [ContainersCommon, volumes]}
-
- /run:/run
- /var/lib/kolla/config_files/designate_mdns.json:/var/lib/kolla/config_files/config.json:ro
- /var/lib/config-data/puppet-generated/designate:/var/lib/kolla/config_files/src:ro
- /var/log/containers/designate:/var/log/designate:z
environment:
KOLLA_CONFIG_STRATEGY: COPY_ALWAYS
host_prep_tasks:
- name: create persistent directories
file:
path: "{{ item.path }}"
state: directory
setype: "{{ item.setype }}"
mode: "{{ item.mode|default(omit) }}"
with_items:
- { 'path': /var/log/designate, 'setype': container_file_t }
- { 'path': /var/log/containers/designate, 'setype': container_file_t, 'mode': '0750' }