420 lines
13 KiB
Puppet
420 lines
13 KiB
Puppet
|
|
## This document serves as an example of how to deploy
|
|
# basic single and multi-node openstack environments.
|
|
#
|
|
|
|
####### shared variables ##################
|
|
|
|
#Exec {
|
|
# logoutput => true,
|
|
#}
|
|
|
|
# database config
|
|
$mysql_root_password = hiera('mysql_root_password', 'mysql_root_password')
|
|
$keystone_db_password = hiera('keystone_db_password', 'keystone_db_password')
|
|
$glance_db_password = hiera('glance_db_password', 'glance_db_password')
|
|
$nova_db_password = hiera('nova_db_password', 'nova_db_password')
|
|
$cinder_db_password = hiera('cinder_db_password', 'cinder_db_password')
|
|
$quantum_db_password = hiera('quantum_db_password', 'quantum_db_password')
|
|
|
|
$allowed_hosts = hiera('allowed_hosts', ['%'])
|
|
|
|
# keystone settings)
|
|
$admin_token = hiera('admin_token', 'service_token')
|
|
$admin_email = hiera('admin_email', 'keystone@localhost')
|
|
$admin_password = hiera('admin_password', 'ChangeMe')
|
|
$glance_user_password = hiera('glance_user_password', 'glance_user_password')
|
|
$nova_user_password = hiera('nova_user_password', 'nova_user_password')
|
|
$cinder_user_password = hiera('cinder_user_password', 'cinder_user_password')
|
|
$quantum_user_password = hiera('quantum_user_password', 'quantum_user_password')
|
|
|
|
$verbose = hiera('verbose', 'True')
|
|
|
|
$public_interface = hiera('public_interface', 'eth0')
|
|
$private_interface = hiera('private_interface', 'eth2')
|
|
|
|
$rabbit_password = hiera('rabbit_password', 'rabbit_password')
|
|
$rabbit_user = hiera('rabbit_user', 'nova')
|
|
|
|
$secret_key = hiera('secret_key', 'secret_key')
|
|
|
|
$libvirt_type = hiera('libvirt_type', 'qemu')
|
|
#$network_type = hiera('', 'quantum')
|
|
$network_type = hiera('network_type', 'nova')
|
|
if $network_type == 'nova' {
|
|
$use_quantum = false
|
|
$multi_host = true
|
|
$nova_network = true
|
|
} else {
|
|
$nova_network = false
|
|
$use_quantum = true
|
|
}
|
|
|
|
$fixed_network_range = hiera('fixed_network_range', '10.0.0.0/24')
|
|
$floating_network_range = hiera('floating_network_range', '172.16.0.128/25')
|
|
|
|
$auto_assign_floating_ip = hiera('auto_assign_floating_ip', false)
|
|
|
|
#### end shared variables #################
|
|
|
|
#### controller/compute mode settings ####
|
|
$openstack_controller = hiera('openstack_controller', '172.16.0.3')
|
|
#### controller/compute mode settings ####
|
|
$openstack_version = hiera('openstack_version', 'folsom')
|
|
|
|
# node declaration for all in one
|
|
import 'scenarios/all_in_one.pp'
|
|
# node declarations for a single server per role
|
|
import 'scenarios/multi_role.pp'
|
|
|
|
# import external swift definitions
|
|
import '/etc/puppet/modules-0/swift/examples/site.pp'
|
|
|
|
node /openstack-controller/ {
|
|
|
|
# deploy a script that can be used to test nova
|
|
class { 'openstack::test_file':
|
|
quantum => $use_quantum,
|
|
sleep_time => 120,
|
|
floating_ip => $nova_network,
|
|
}
|
|
|
|
if $::osfamily == 'Redhat' {
|
|
# redhat specific dashboard stuff
|
|
file_line { 'nova_sudoers':
|
|
line => 'nova ALL = (root) NOPASSWD: /usr/bin/nova-rootwrap /etc/nova/rootwrap.conf *',
|
|
path => '/etc/sudoers',
|
|
before => Package['nova-common'],
|
|
}
|
|
|
|
nova_config { 'DEFAULT/rpc_backend': value => 'nova.openstack.common.rpc.impl_kombu';}
|
|
cinder_config { 'DEFAULT/rpc_backend': value => 'cinder.openstack.common.rpc.impl_kombu';}
|
|
#selboolean{'httpd_can_network_connect':
|
|
# value => on,
|
|
# persistent => true,
|
|
#}
|
|
|
|
firewall { '001 horizon incomming':
|
|
proto => 'tcp',
|
|
dport => ['80'],
|
|
action => 'accept',
|
|
}
|
|
firewall { '001 glance incomming':
|
|
proto => 'tcp',
|
|
dport => ['9292'],
|
|
action => 'accept',
|
|
}
|
|
firewall { '001 keystone incomming':
|
|
proto => 'tcp',
|
|
dport => ['5000', '35357'],
|
|
action => 'accept',
|
|
}
|
|
|
|
firewall { '001 mysql incomming':
|
|
proto => 'tcp',
|
|
dport => ['3306'],
|
|
action => 'accept',
|
|
}
|
|
firewall { '001 novaapi incomming':
|
|
proto => 'tcp',
|
|
dport => ['8773', '8774', '8776'],
|
|
action => 'accept',
|
|
}
|
|
firewall { '001 qpid incomming':
|
|
proto => 'tcp',
|
|
dport => ['5672'],
|
|
action => 'accept',
|
|
}
|
|
firewall { '001 novncproxy incomming':
|
|
proto => 'tcp',
|
|
dport => ['6080'],
|
|
action => 'accept',
|
|
}
|
|
}
|
|
|
|
# we need to install conductor only for grizzly
|
|
# because this version of the manifests needs to support both
|
|
if $openstack_version == 'grizzly' {
|
|
class { 'nova::conductor':
|
|
enabled => true,
|
|
}
|
|
}
|
|
|
|
class { 'openstack::controller':
|
|
#floating_range => $floating_network_range,
|
|
# Required Network
|
|
public_address => $openstack_controller,
|
|
public_interface => $public_interface,
|
|
private_interface => $private_interface,
|
|
# Required Database
|
|
mysql_root_password => $mysql_root_password,
|
|
# Required Keystone
|
|
admin_email => $admin_email,
|
|
admin_password => $admin_password,
|
|
keystone_db_password => $keystone_db_password,
|
|
keystone_admin_token => $admin_token,
|
|
# Required Glance
|
|
glance_db_password => $glance_db_password,
|
|
glance_user_password => $glance_user_password,
|
|
# Required Nov a
|
|
nova_db_password => $nova_db_password,
|
|
nova_user_password => $nova_user_password,
|
|
# cinder
|
|
cinder_db_password => $cinder_db_password,
|
|
cinder_user_password => $cinder_user_password,
|
|
cinder => true,
|
|
# quantum
|
|
quantum => $use_quantum,
|
|
quantum_db_password => $quantum_db_password,
|
|
quantum_user_password => $quantum_user_password,
|
|
# horizon
|
|
secret_key => $secret_key,
|
|
# need to sort out networking...
|
|
network_manager => 'nova.network.manager.FlatDHCPManager',
|
|
fixed_range => $fixed_network_range,
|
|
floating_range => $floating_network_range,
|
|
create_networks => true,
|
|
multi_host => $multi_host,
|
|
db_host => '127.0.0.1',
|
|
db_type => 'mysql',
|
|
mysql_account_security => true,
|
|
# TODO - this should not allow all
|
|
allowed_hosts => '%',
|
|
# Keystone
|
|
# Glance
|
|
glance_api_servers => '127.0.0.1:9292',
|
|
rabbit_password => $rabbit_password,
|
|
rabbit_user => $rabbit_user,
|
|
# Horizon
|
|
cache_server_ip => '127.0.0.1',
|
|
cache_server_port => '11211',
|
|
swift => false,
|
|
horizon_app_links => undef,
|
|
# General
|
|
verbose => $verbose,
|
|
purge_nova_config => false,
|
|
}
|
|
|
|
package { 'python-cliff':
|
|
ensure => present,
|
|
}
|
|
|
|
class { 'openstack::auth_file':
|
|
admin_password => $admin_password,
|
|
keystone_admin_token => $admin_token,
|
|
controller_node => '127.0.0.1',
|
|
}
|
|
|
|
keystone_config {
|
|
'DEFAULT/log_config': ensure => absent,
|
|
}
|
|
}
|
|
|
|
node /compute/ {
|
|
|
|
|
|
# TODO not sure why this is required
|
|
# this has a bug, and is constantly added to the file
|
|
if $libvirt_type == 'qemu' {
|
|
if $::osfamily == 'Debian' {
|
|
Package['libvirt'] ->
|
|
file_line { 'quemu_hack':
|
|
line => 'cgroup_device_acl = [
|
|
"/dev/null", "/dev/full", "/dev/zero",
|
|
"/dev/random", "/dev/urandom",
|
|
"/dev/ptmx", "/dev/kvm", "/dev/kqemu",
|
|
"/dev/rtc", "/dev/hpet", "/dev/net/tun",]',
|
|
path => '/etc/libvirt/qemu.conf',
|
|
ensure => present,
|
|
} ~> Service['libvirt']
|
|
} elsif $::osfamily == 'RedHat' {
|
|
|
|
cinder_config { 'DEFAULT/rpc_backend': value => 'cinder.openstack.common.rpc.impl_kombu';}
|
|
|
|
file_line { 'nova_sudoers':
|
|
line => 'nova ALL = (root) NOPASSWD: /usr/bin/nova-rootwrap /etc/nova/rootwrap.conf *',
|
|
path => '/etc/sudoers',
|
|
before => Service['nova-network'],
|
|
}
|
|
file_line { 'cinder_sudoers':
|
|
line => 'cinder ALL = (root) NOPASSWD: /usr/bin/cinder-rootwrap /etc/cinder/rootwrap.conf *',
|
|
path => '/etc/sudoers',
|
|
before => Service['cinder-volume'],
|
|
}
|
|
|
|
nova_config { 'DEFAULT/rpc_backend': value => 'nova.openstack.common.rpc.impl_kombu';}
|
|
|
|
nova_config{
|
|
"DEFAULT/network_host": value => $openstack_controller;
|
|
"DEFAULT/libvirt_inject_partition": value => "-1";
|
|
}
|
|
if $libvirt_type == "qemu" {
|
|
file { "/usr/bin/qemu-system-x86_64":
|
|
ensure => link,
|
|
target => "/usr/libexec/qemu-kvm",
|
|
notify => Service["nova-compute"],
|
|
}
|
|
}
|
|
firewall { '001 vnc listen incomming':
|
|
proto => 'tcp',
|
|
dport => ['6080'],
|
|
action => 'accept',
|
|
}
|
|
firewall { '001 volume incomming':
|
|
proto => 'tcp',
|
|
dport => ['3260'],
|
|
action => 'accept',
|
|
}
|
|
}
|
|
}
|
|
|
|
class { 'cinder::setup_test_volume': } -> Service<||>
|
|
|
|
class { 'openstack::compute':
|
|
public_interface => $public_interface,
|
|
private_interface => $private_interface,
|
|
internal_address => $::ipaddress_eth1,
|
|
libvirt_type => $libvirt_type,
|
|
sql_connection => "mysql://nova:${nova_db_password}@${openstack_controller}/nova",
|
|
cinder_sql_connection => "mysql://cinder:${cinder_db_password}@${openstack_controller}/cinder",
|
|
multi_host => $multi_host,
|
|
fixed_range => $fixed_network_range,
|
|
nova_user_password => $nova_user_password,
|
|
quantum => $use_quantum,
|
|
quantum_host => $openstack_controller,
|
|
quantum_user_password => $quantum_user_password,
|
|
rabbit_password => $rabbit_password,
|
|
glance_api_servers => ["${openstack_controller}:9292"],
|
|
rabbit_host => $openstack_controller,
|
|
keystone_host => $openstack_controller,
|
|
vncproxy_host => $openstack_controller,
|
|
vnc_enabled => true,
|
|
verbose => $verbose,
|
|
}
|
|
|
|
}
|
|
|
|
|
|
node /tempest/ {
|
|
|
|
if $::openstack_version == 'folsom' {
|
|
# this assumes that tempest is being run on the same node
|
|
# as the openstack controller
|
|
|
|
if $osfamily == 'redhat' {
|
|
$nova_api_service_name = 'openstack-nova-api'
|
|
} else {
|
|
$nova_api_service_name = 'nova-api'
|
|
}
|
|
|
|
service { 'nova-api':
|
|
name => $nova_api_service_name
|
|
}
|
|
Nova_config<||> ~> Service['nova-api']
|
|
Nova_paste_api_ini<||> ~> Service['nova-api']
|
|
|
|
nova_config { 'DEFAULT/api_rate_limit': value => 'false' }
|
|
|
|
# remove rate limiting
|
|
# this may be folsom specific
|
|
nova_paste_api_ini {
|
|
'composite:openstack_compute_api_v2/noauth': value => 'faultwrap sizelimit noauth osapi_compute_app_v2';
|
|
'composite:openstack_compute_api_v2/keystone': value => 'faultwrap sizelimit authtoken keystonecontext osapi_compute_app_v2';
|
|
'composite:openstack_volume_api_v1/noauth': value => 'faultwrap sizelimit noauth osapi_volume_app_v1';
|
|
'composite:openstack_volume_api_v1/keystone': value => 'faultwrap sizelimit authtoken keystonecontext osapi_volume_app_v1';
|
|
}
|
|
}
|
|
|
|
if ($::openstack_version == 'grizzly') {
|
|
$revision = 'master'
|
|
} else {
|
|
$revision = $::openstack_version
|
|
}
|
|
|
|
class { 'tempest':
|
|
identity_host => $::openstack_controller,
|
|
identity_port => '35357',
|
|
identity_api_version => 'v2.0',
|
|
# non admin user
|
|
username => 'user1',
|
|
password => 'user1_password',
|
|
tenant_name => 'tenant1',
|
|
# another non-admin user
|
|
alt_username => 'user2',
|
|
alt_password => 'user2_password',
|
|
alt_tenant_name => 'tenant2',
|
|
# image information
|
|
image_id => 'XXXXXXX',#<%= image_id %>,
|
|
image_id_alt => 'XXXXXXX',#<%= image_id_alt %>,
|
|
flavor_ref => 1,
|
|
flavor_ref_alt => 2,
|
|
# the version of the openstack images api to use
|
|
image_api_version => '1',
|
|
image_host => $::openstack_controller,
|
|
image_port => '9292',
|
|
|
|
# this should be the username of a user with administrative privileges
|
|
admin_username => 'admin',
|
|
admin_password => $::admin_password,
|
|
admin_tenant_name => 'admin',
|
|
nova_db_uri => 'mysql://nova:nova_db_password@127.0.0.1/nova',
|
|
version_to_test => $revision,
|
|
}
|
|
|
|
class { 'openstack::auth_file':
|
|
admin_password => $::admin_password,
|
|
keystone_admin_token => $::admin_token,
|
|
controller_node => $::openstack_controller,
|
|
}
|
|
|
|
}
|
|
|
|
node /devstack/ {
|
|
|
|
class { 'devstack': }
|
|
|
|
}
|
|
|
|
node default {
|
|
notify { $clientcert: }
|
|
}
|
|
|
|
node puppetmaster {
|
|
|
|
$hostname = 'puppetmaster'
|
|
|
|
### Add the puppetlabs repo
|
|
apt::source { 'puppetlabs':
|
|
location => 'http://apt.puppetlabs.com',
|
|
repos => 'main',
|
|
key => '4BD6EC30',
|
|
key_server => 'pgp.mit.edu',
|
|
tag => ['puppet'],
|
|
}
|
|
|
|
Exec["apt_update"] -> Package <| |>
|
|
|
|
package { ['hiera', 'hiera-puppet']:
|
|
ensure => present,
|
|
provider => 'gem',
|
|
require => Package['puppetmaster'],
|
|
}
|
|
|
|
class { 'puppet::master':
|
|
autosign => true,
|
|
modulepath => '/etc/puppet/modules-0',
|
|
}
|
|
|
|
class { 'puppetdb':
|
|
require => Class['puppet::master'],
|
|
}
|
|
|
|
# Configure the puppet master to use puppetdb.
|
|
class { 'puppetdb::master::config':
|
|
restart_puppet => false,
|
|
puppetdb_startup_timeout => 240,
|
|
notify => Class['apache'],
|
|
}
|
|
|
|
}
|