tripleo-heat-templates/deployment/etcd/etcd-container-puppet.yaml

heat_template_version: rocky

description: >
  Containerized etcd services

parameters:
  ContainerEtcdImage:
    description: image
    type: string
  ContainerEtcdConfigImage:
    description: The container image to use for the etcd config_volume
    type: string
  EndpointMap:
    default: {}
    description: Mapping of service endpoint -> protocol. Typically set
                 via parameter_defaults in the resource registry.
    type: json
  ServiceData:
    default: {}
    description: Dictionary packing service data
    type: json
  ServiceNetMap:
    default: {}
    description: Mapping of service_name -> network name. Typically set
                 via parameter_defaults in the resource registry.  This
                 mapping overrides those in ServiceNetMapDefaults.
    type: json
  DefaultPasswords:
    default: {}
    type: json
  RoleName:
    default: ''
    description: Role name on which the service is applied
    type: string
  RoleParameters:
    default: {}
    description: Parameters specific to the role
    type: json
  EtcdInitialClusterToken:
    description: Initial cluster token for the etcd cluster during bootstrap.
    type: string
    hidden: true
  MonitoringSubscriptionEtcd:
    default: 'overcloud-etcd'
    type: string
  EnableInternalTLS:
    type: boolean
    default: false
  EnableEtcdInternalTLS:
    description: Controls whether etcd and the cinder-volume service use TLS
                 for cinder's lock manager, even when the rest of the internal
                 API network is using TLS.
    type: boolean
    default: false
  InternalTLSCAFile:
    default: '/etc/ipa/ca.crt'
    type: string
    description: Specifies the default CA cert to use if TLS is used for
                 services in the internal network.
  Debug:
    default: false
    description: Set to True to enable debugging on all services.
    type: boolean

conditions:
  internal_tls_enabled:
    and:
      - {equals: [{get_param: EnableInternalTLS}, true]}
      - {equals: [{get_param: EnableEtcdInternalTLS}, true]}

resources:
  ContainersCommon:
    type: ../containers-common.yaml

outputs:
  role_data:
    description: Role data for the etcd role.
    value:
      service_name: etcd
      firewall_rules:
        '141 etcd':
          dport:
            - 2379
            - 2380
      monitoring_subscription: {get_param: MonitoringSubscriptionEtcd}
      config_settings:
        map_merge:
        -
          etcd::etcd_name:
            str_replace:
              template:
                "%{hiera('fqdn_$NETWORK')}"
              params:
                $NETWORK: {get_param: [ServiceNetMap, EtcdNetwork]}
          tripleo::profile::base::etcd::bind_ip:
            str_replace:
              template:
                "%{hiera('$NETWORK')}"
              params:
                $NETWORK: {get_param: [ServiceNetMap, EtcdNetwork]}
          tripleo::profile::base::etcd::client_port: '2379'
          tripleo::profile::base::etcd::peer_port: '2380'
          etcd::debug: {get_param: Debug}
          etcd::initial_cluster_token: {get_param: EtcdInitialClusterToken}
          etcd::manage_package: false
          etcd::manage_service: false
        -
          if:
          - internal_tls_enabled
          - generate_service_certificates: true
            tripleo::profile::base::etcd::certificate_specs:
              service_certificate: '/etc/pki/tls/certs/etcd.crt'
              service_key: '/etc/pki/tls/private/etcd.key'
              hostname:
                str_replace:
                  template: "%{hiera('fqdn_NETWORK')}"
                  params:
                    NETWORK: {get_param: [ServiceNetMap, EtcdNetwork]}
              principal:
                str_replace:
                  template: "etcd/%{hiera('fqdn_NETWORK')}"
                  params:
                    NETWORK: {get_param: [ServiceNetMap, EtcdNetwork]}
              dnsnames:
                - str_replace:
                    template: "%{hiera('fqdn_NETWORK')}"
                    params:
                      NETWORK: {get_param: [ServiceNetMap, EtcdNetwork]}
                - str_replace:
                    template:
                      "%{hiera('NETWORK')}"
                    params:
                      NETWORK: {get_param: [ServiceNetMap, EtcdNetwork]}
            etcd::trusted_ca_file: {get_param: InternalTLSCAFile}
            etcd::peer_trusted_ca_file: {get_param: InternalTLSCAFile}
          -
            # Ensure etcd and cinder-volume aren't configured to use TLS
            tripleo::profile::base::etcd::enable_internal_tls: false
            tripleo::profile::base::cinder::volume::enable_internal_tls: false
      # BEGIN DOCKER SETTINGS
      puppet_config:
        config_volume: etcd
        config_image: &etcd_config_image {get_param: ContainerEtcdConfigImage}
        step_config:
          list_join:
            - "\n"
            - - "['Etcd_key'].each |String $val| { noop_resource($val) }"
              - "include tripleo::profile::base::etcd"
      kolla_config:
        /var/lib/kolla/config_files/etcd.json:
          command: /usr/bin/etcd --config-file /etc/etcd/etcd.yml
          config_files:
            - source: "/var/lib/kolla/config_files/src/*"
              dest: "/"
              merge: true
              preserve_properties: true
          permissions:
            - path: /var/lib/etcd
              owner: etcd:etcd
              recurse: true
      docker_config:
        step_2:
          etcd:
            image: {get_param: ContainerEtcdImage}
            net: host
            privileged: false
            restart: always
            healthcheck:
              test: /openstack/healthcheck
            volumes:
              list_concat:
                - {get_attr: [ContainersCommon, volumes]}
                -
                  - /var/lib/etcd:/var/lib/etcd
                  - /var/lib/kolla/config_files/etcd.json:/var/lib/kolla/config_files/config.json:ro
                  - /var/lib/config-data/puppet-generated/etcd/:/var/lib/kolla/config_files/src:ro
                -
                  if:
                    - internal_tls_enabled
                    -
                      - /etc/pki/tls/certs/etcd.crt:/etc/pki/tls/certs/etcd.crt:ro
                      - /etc/pki/tls/private/etcd.key:/etc/pki/tls/private/etcd.key:ro
                    - null
            environment:
              KOLLA_CONFIG_STRATEGY: COPY_ALWAYS
      container_puppet_tasks:
        # Etcd keys initialization occurs only on single node
        step_2:
          config_volume: 'etcd_init_tasks'
          puppet_tags: 'etcd_key'
          step_config: |
              include tripleo::profile::base::etcd
          config_image: *etcd_config_image
          volumes:
            - /var/lib/config-data/etcd/etc/etcd/:/etc/etcd:ro
            - /var/lib/etcd:/var/lib/etcd:ro
      host_prep_tasks:
        - name: create /var/lib/etcd
          file:
            path: /var/lib/etcd
            state: directory
            setype: container_file_t
      deploy_steps_tasks:
        - name: ensure etcd can access its tls cert and key
          become: true
          acl:
            path: "{{ item }}"
            entity: "{{ 42413 | string }}"
            etype: user
            permissions: r
            state: present
          with_items:
            - /etc/pki/tls/certs/etcd.crt
            - /etc/pki/tls/private/etcd.key
          vars:
            internal_tls_enabled: {if: [internal_tls_enabled, true, false]}
          when:
            - internal_tls_enabled|bool
            - step|int == 2
      upgrade_tasks: []
      metadata_settings:
        if:
          - internal_tls_enabled
          -
            - service: etcd
              network: {get_param: [ServiceNetMap, EtcdNetwork]}
              type: node
          - null