Adding LBaaS tile for Ops Manager

* Includes BOSH-release containing needed dependencies
 * Includes script for automatic packing the tile
 * Manually tested
 * Tile deletion leads to deletion of Murano env containing LBaaS
   (it is implemented as a separate job)

Change-Id: If48ce2e0cbc0b7712a520c01cd8f52529ccc23b5

LBaaS/LBaaS-ops-manager-tile/.gitignore

@@ -0,0 +1 @@
+lbaas-tile.zip

LBaaS/LBaaS-ops-manager-tile/build_lbaas_tile.sh

@@ -0,0 +1,71 @@
+# Pack jobs and packages.
+cd releases/jobs;
+
+pushd lbaas-config
+  tar zcvf lbaas-config.tgz *;
+  mv lbaas-config.tgz ../
+popd
+
+pushd delete-lbaas
+  tar zcvf delete-lbaas.tgz *;
+  mv delete-lbaas.tgz ../
+popd
+
+cd ../packages;
+
+pushd python
+  tar zcvf python.tgz *;
+  mv python.tgz ../
+popd
+
+cd ../..
+
+mkdir tmp
+
+cp -r metadata tmp/
+
+mkdir tmp/releases
+mkdir tmp/releases/jobs
+mkdir tmp/releases/packages
+
+mv releases/jobs/lbaas-config.tgz tmp/releases/jobs/
+mv releases/jobs/delete-lbaas.tgz tmp/releases/jobs/
+mv releases/packages/python.tgz tmp/releases/packages/
+cp releases/* tmp/releases/
+
+# Put correct sha1 to release.MF
+if [ "$(uname -s)" == "Darwin" ]; then
+    # Mac OS X.
+    sha1_lbaas_job=$(openssl sha1 tmp/releases/jobs/lbaas-config.tgz | cut -d '=' -f 2)
+    sha1_delete_lbaas_job=$(openssl sha1 tmp/releases/jobs/delete-lbaas.tgz | cut -d '=' -f 2)
+    sha1_python_package=$(openssl sha1 tmp/releases/packages/python.tgz | cut -d '=' -f 2)
+else
+    # Works for Linux.
+    sha1_lbaas_job=$(sha1sum tmp/releases/jobs/lbaas-config.tgz | cut -d ' ' -f 1)
+    sha1_delete_lbaas_job=$(sha1sum tmp/releases/jobs/delete-lbaas.tgz | cut -d ' ' -f 1)
+    sha1_python_package=$(sha1sum tmp/releases/packages/python.tgz | cut -d ' ' -f 1)
+fi
+
+sed -i -e "s/%sha1_python_package%/${sha1_python_package}/g" tmp/releases/release.MF
+sed -i -e "s/%sha1_lbaas_job%/${sha1_lbaas_job}/g" tmp/releases/release.MF
+sed -i -e "s/%sha1_delete_lbaas_job%/${sha1_delete_lbaas_job}/g" tmp/releases/release.MF
+
+# Pack the release.
+cd tmp/releases;
+tar zcvf example-release-10.tgz *;
+cd ../..
+
+# Enable option 'extended globbing' for easy deletion.
+shopt -s extglob
+
+# Delete all files except the release archive.
+rm -rf tmp/releases/!(example-release-10.tgz)
+
+# Pack tile.
+cd tmp;
+zip -r lbaas-tile.zip *;
+cd ..
+mv tmp/lbaas-tile.zip .
+
+# Delete temp directory.
+rm -rf tmp

LBaaS/LBaaS-ops-manager-tile/releases/LICENSE

@@ -0,0 +1,201 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "{}"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright {yyyy} {name of copyright owner}
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

LBaaS/LBaaS-ops-manager-tile/releases/jobs/delete-lbaas/job.MF

@@ -0,0 +1,32 @@
+---
+name: delete-lbaas
+description: "Job which deletes LBaaS"
+
+packages: [python]
+
+templates:
+  run.erb: bin/run
+  delete_lbaas.py: config/delete_lbaas.py
+
+properties:
+  openstack.os_auth_url:
+    description: ''
+  openstack.os_username:
+    description: ''
+  openstack.os_tenant_name:
+    description: ''
+  openstack.os_password:
+    description: ''
+
+  lbaas.pcf_router_ips:
+    description: ''
+  lbaas.private_key_ssh:
+    description: ''
+  lbaas.public_key_ssh:
+    description: ''
+  lbaas.ssl_rsa_cert:
+    description: ''
+  lbaas.lbaas_impl:
+    description: ''
+  lbaas.image_name:
+    description: ''

LBaaS/LBaaS-ops-manager-tile/releases/jobs/delete-lbaas/templates/delete_lbaas.py

@@ -0,0 +1,59 @@
+import sys
+
+from keystoneclient.v3 import client as keystoneclient
+from muranoclient.v1 import client as muranoclient
+
+
+if len(sys.argv) < 5:
+    print(
+        "Usage: {0} <auth_url> <username> <tenant> <password>".format(
+            __file__
+        )
+    )
+    exit(1)
+
+
+def get_env_by_prefix(murano, prefix):
+    envs = list(
+        filter(
+            lambda e: e.name.startswith(prefix),
+            murano.environments.list()
+        )
+    )
+
+    if not envs:
+        return None
+
+    return envs[0]
+
+
+auth_url = sys.argv[1]
+username = sys.argv[2]
+tenant = sys.argv[3]
+password = sys.argv[4]
+
+keystone = keystoneclient.Client(
+    username=username,
+    tenant_name=tenant,
+    password=password,
+    auth_url=auth_url
+)
+
+murano_url = keystone.service_catalog.url_for(
+    service_type='application_catalog'
+)
+
+murano = muranoclient.Client(
+    murano_url,
+    auth_url=auth_url,
+    tenant=keystone.project_id,
+    token=keystone.auth_token
+)
+
+env = get_env_by_prefix(murano, "CF-LBaaS-")
+
+if not env:
+    print ("Env already deleted.")
+    exit(0)
+
+murano.environments.delete(env.id)

LBaaS/LBaaS-ops-manager-tile/releases/jobs/delete-lbaas/templates/run.erb

@@ -0,0 +1,14 @@
+#!/bin/bash
+set -e -x
+
+AUTH_URL=<%= p('openstack.os_auth_url') %>
+USERNAME=<%= p('openstack.os_username') %>
+TENANT=<%= p('openstack.os_tenant_name') %>
+PASSWORD=<%= p('openstack.os_password') %>
+
+JOB_DIR=/var/vcap/jobs/delete-lbaas
+BIN=/var/vcap/packages/python/bin
+
+echo "Deleting LBaaS..."
+${BIN}/python3 ${JOB_DIR}/config/delete_lbaas.py $AUTH_URL $USERNAME $TENANT $PASSWORD
+echo "Deleted."

LBaaS/LBaaS-ops-manager-tile/releases/jobs/lbaas-config/job.MF

@@ -0,0 +1,38 @@
+---
+name: lbaas-config
+description: "Job which installs LBaaS"
+
+packages: [python]
+
+templates:
+  ctl.erb: bin/ctl
+  create_lbaas.py: config/create_lbaas.py
+  create_keypair.py: config/create_keypair.py
+  configure_lbaas.py: config/configure_lbaas.py
+  put_pem.sh: config/put_pem.sh
+  config.json: config/config.json
+  cf.pem.erb: config/cf.pem
+  pkey.erb: config/pkey
+
+properties:
+  openstack.os_auth_url:
+    description: ''
+  openstack.os_username:
+    description: ''
+  openstack.os_tenant_name:
+    description: ''
+  openstack.os_password:
+    description: ''
+
+  lbaas.pcf_router_ips:
+    description: ''
+  lbaas.private_key_ssh:
+    description: ''
+  lbaas.public_key_ssh:
+    description: ''
+  lbaas.ssl_rsa_cert:
+    description: ''
+  lbaas.lbaas_impl:
+    description: ''
+  lbaas.image_name:
+    description: ''

LBaaS/LBaaS-ops-manager-tile/releases/jobs/lbaas-config/monit

@@ -0,0 +1,5 @@
+check process lbaas-config
+  with pidfile /var/vcap/sys/run/lbaas-config/pidfile
+  start program "/var/vcap/jobs/lbaas-config/bin/ctl start"
+  stop program "/var/vcap/jobs/lbaas-config/bin/ctl stop"
+  group vcap

LBaaS/LBaaS-ops-manager-tile/releases/jobs/lbaas-config/templates/cf.pem.erb

@@ -0,0 +1 @@
+<%= p('lbaas.ssl_rsa_cert') %>

LBaaS/LBaaS-ops-manager-tile/releases/jobs/lbaas-config/templates/config.json

@@ -0,0 +1,8 @@
+{
+  "auth_url": "<%= p('openstack.os_auth_url') %>",
+  "username": "<%= p('openstack.os_username') %>",
+  "password": "<%= p('openstack.os_password') %>",
+  "tenant_name": "<%= p('openstack.os_tenant_name') %>",
+  "keyname": "lbaas-generated",
+  "image_name": "<%= p('lbaas.image_name') %>"
+}

LBaaS/LBaaS-ops-manager-tile/releases/jobs/lbaas-config/templates/configure_lbaas.py

@@ -0,0 +1,123 @@
+import json
+import sys
+
+import requests
+
+
+if len(sys.argv) < 3:
+    print(
+        "Usage: {0} <LBaaS URL> <Router IP list>\nExample: {0} "
+        "http://192.168.10.5:8993/v1 '192.168.10.8,192.168.10.10'".format(
+            __file__
+        )
+    )
+    exit(1)
+
+url = sys.argv[1]
+pcf_router_ips = sys.argv[2].split(',')
+
+# Configure LBaaS.
+requests.post(
+    "%s/listeners" % url,
+    headers={"Content-Type": "application/json"},
+    data=json.dumps(
+        {
+            "name": "http-in",
+            "protocol": "http",
+            "protocol_port": 80,
+            "options": {
+                "option": "forwardfor",
+                "reqadd": "X-Forwarded-Proto:\\ http"
+            }
+        }
+    )
+)
+
+requests.post(
+    "%s/listeners" % url,
+    headers={"Content-Type": "application/json"},
+    data=json.dumps(
+        {
+            "name": "https-in",
+            "protocol": "http",
+            "protocol_port": 443,
+            "options": {
+                "option": "forwardfor",
+                "reqadd": "X-Forwarded-Proto:\\ https"
+            }
+        }
+    )
+)
+requests.post(
+    "%s/listeners" % url,
+    headers={"Content-Type": "application/json"},
+    data=json.dumps(
+        {
+            "name": "ssl-in",
+            "protocol": "tcp",
+            "protocol_port": 4443
+        }
+    )
+)
+
+requests.put(
+    '%s/listeners/https-in' % url,
+    headers={"Content-Type": "application/json"},
+    data=json.dumps(
+        {
+            'ssl_info': [
+                "ssl", "crt", "/etc/ssl/cf.pem", "no-sslv3", "ciphers",
+                "ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:"
+                "ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDH"
+                "E-RSA-AES128-CBC-SHA256:ECDHE-RSA-AES256-CBC-SHA384:ECDHE-RS"
+                "A-AES128-CBC-SHA:ECDHE-RSA-AES256-CBC-SHA:AES128-SHA256:AES1"
+                "28-SHA:RC4-SHA"
+            ]
+        }
+    )
+)
+
+
+def configure_member(name, address):
+    requests.post(
+        "%s/members" % url,
+        headers={"Content-Type": "application/json"},
+        data=json.dumps(
+            {
+                "name": "%s-ssl" % name,
+                "protocol_port": 80,
+                "listener_name": "ssl-in",
+                "address": address
+            }
+        )
+    )
+
+    requests.post(
+        "%s/members" % url,
+        headers={"Content-Type": "application/json"},
+        data=json.dumps(
+            {
+                "name": "%s-http" % name,
+                "protocol_port": 80,
+                "listener_name": "http-in",
+                "address": address
+            }
+        )
+    )
+
+    requests.post(
+        "%s/members" % url,
+        headers={"Content-Type": "application/json"},
+        data=json.dumps(
+            {
+                "name": "%s-https" % name,
+                "protocol_port": 80,
+                "listener_name": "https-in",
+                "address": address
+            }
+        )
+    )
+
+
+for index, address in enumerate(pcf_router_ips):
+    configure_member("%s%s" % ("router", index), address)

LBaaS/LBaaS-ops-manager-tile/releases/jobs/lbaas-config/templates/create_keypair.py

@@ -0,0 +1,52 @@
+import sys
+
+from keystoneclient.v3 import client as keystoneclient
+from novaclient import client as novaclient
+from novaclient import exceptions
+
+
+if len(sys.argv) < 7:
+    print(
+        "Usage: {0} <auth_url> <username> <tenant> <password> <keypair-name>"
+        "<public key str>".format(
+            __file__
+        )
+    )
+    exit(1)
+
+auth_url = sys.argv[1]
+username = sys.argv[2]
+tenant = sys.argv[3]
+password = sys.argv[4]
+key_name = sys.argv[5]
+public_key = sys.argv[6]
+
+keystone = keystoneclient.Client(
+    username=username,
+    tenant_name=tenant,
+    password=password,
+    auth_url=auth_url
+)
+
+nova_url = keystone.service_catalog.url_for(service_type='compute')
+
+nova = novaclient.Client(
+    2,
+    username=None,
+    api_key=None,
+    endpoint_type='publicURL',
+    service_type='compute',
+    auth_token=keystone.auth_token,
+    tenant_id=keystone.project_id,
+    auth_url=auth_url
+)
+nova.client.management_url = nova_url
+
+try:
+    nova.keypairs.get(key_name)
+except exceptions.NotFound:
+    pass
+else:
+    nova.keypairs.delete(key_name)
+
+nova.keypairs.create(key_name, public_key)

LBaaS/LBaaS-ops-manager-tile/releases/jobs/lbaas-config/templates/create_lbaas.py

@@ -0,0 +1,56 @@
+import json
+import time
+import uuid
+
+import requests
+
+BROKER_URL = 'http://localhost:8080/v2'
+
+instance_id = str(uuid.uuid4())
+
+# Create LBaaS.
+requests.put(
+    "%s/service_instances/%s" % (BROKER_URL, instance_id),
+    headers={'Content-Type': 'application/json'},
+    data=json.dumps({'service_id': 'io.murano.apps.lbaas.HAProxy'}),
+    auth=('user', 'password')
+)
+
+status = ''
+answer = None
+
+while status != 'succeeded':
+    time.sleep(20)
+
+    # Get status of provisioning.
+    resp = requests.get(
+        "%s/service_instances/%s/last_operation" % (BROKER_URL, instance_id),
+        auth=('user', 'password')
+    )
+
+    answer = resp.json()
+
+    status = answer['state']
+    print ("STATUS = %s" % status)
+
+    if status == 'failed':
+        print ("LBaaS deployment finished with errors.")
+        exit(1)
+
+
+# Get LBaaS URL.
+resp = requests.put(
+    "%s/service_instances/%s/service_bindings/%s" % (
+        BROKER_URL, instance_id, str(uuid.uuid4())
+    ),
+    headers={'Content-Type': 'application/json'},
+    data=json.dumps(
+        {'service_id': 'io.murano.apps.lbaas.HAProxy'}
+    ),
+    auth=('user', 'password')
+)
+
+url = resp.json()['credentials']['uri']
+
+print(url)
+print(instance_id)

LBaaS/LBaaS-ops-manager-tile/releases/jobs/lbaas-config/templates/ctl.erb

@@ -0,0 +1,64 @@
+#!/bin/bash
+set -e -x
+
+RUN_DIR=/var/vcap/sys/run/lbaas-config
+LOG_DIR=/var/vcap/sys/log/lbaas-config
+JOB_DIR=/var/vcap/jobs/lbaas-config
+PIDFILE=${RUN_DIR}/pidfile
+INSTANCE_ID_FILE=${RUN_DIR}/instance_id
+
+BIN=/var/vcap/packages/python/bin
+
+case $1 in
+  start)
+    mkdir -p $RUN_DIR
+    mkdir -p $LOG_DIR
+    chown vcap:vcap $LOG_DIR
+
+    $BIN/python3 ${JOB_DIR}/config/create_keypair.py "<%= p('openstack.os_auth_url') %>" \
+        "<%= p('openstack.os_username') %>" "<%= p('openstack.os_tenant_name') %>" "<%= p('openstack.os_password') %>" lbaas-generated "<%= p('lbaas.public_key_ssh') %>"
+
+    $BIN/lbaas-broker-server \
+      ${JOB_DIR}/config/config.json \
+      >> ${LOG_DIR}/stdout.log \
+      2>> ${LOG_DIR}/stderr.log &
+
+    echo $! > $PIDFILE
+
+    # Wait a moment while broker-server is starting.
+    sleep 5
+
+    # Create LBaaS instance.
+    $BIN/python3 ${JOB_DIR}/config/create_lbaas.py > ${LOG_DIR}/creating.log
+
+    lbaas_url=$(cat ${LOG_DIR}/creating.log | tail -2 | head -1)
+    instance_id=$(cat ${LOG_DIR}/creating.log | tail -1)
+
+    echo $instance_id > $INSTANCE_ID_FILE
+
+    # Put pem file to LBaaS instance.
+    lbaas_host=$(echo $lbaas_url | grep -Po '(?<=://)[\w\.]*')
+    chmod +x ${JOB_DIR}/config/put_pem.sh
+    chmod 0600 ${JOB_DIR}/config/pkey
+    ${JOB_DIR}/config/put_pem.sh $lbaas_host ${JOB_DIR}/config/cf.pem ${JOB_DIR}/config/pkey
+
+    # Configure LBaaS.
+    $BIN/python3 ${JOB_DIR}/config/configure_lbaas.py $lbaas_url "<%= p('lbaas.pcf_router_ips') %>"
+    ;;
+
+  stop)
+    curl -X DELETE http://localhost:8080/v2/service_instances/$(cat $INSTANCE_ID_FILE)
+
+    sleep 5
+
+    PID=$(head -1 ${PIDFILE})
+    kill ${PID}
+    while [ -e /proc/${PID} ]; do sleep 0.1; done
+    rm -f ${PIDFILE}
+    ;;
+
+  *)
+    echo "Usage: ctl {start|stop}"
+  ;;
+
+esac

LBaaS/LBaaS-ops-manager-tile/releases/jobs/lbaas-config/templates/pkey.erb

@@ -0,0 +1 @@
+<%= p('lbaas.private_key_ssh') %>

LBaaS/LBaaS-ops-manager-tile/releases/jobs/lbaas-config/templates/put_pem.sh

@@ -0,0 +1,11 @@
+host=$1
+pem_file=$2
+pkey_path=$3
+
+echo $host
+echo $pem_file
+echo $pkey_path
+
+scp -o StrictHostKeyChecking=no -i $pkey_path $pem_file ec2-user@$host:~/
+
+ssh -o StrictHostKeyChecking=no -i $pkey_path ec2-user@$host "sudo mv ~/cf.pem /etc/ssl/"

LBaaS/LBaaS-ops-manager-tile/releases/packages/python/packaging

@@ -0,0 +1,30 @@
+set -e -x
+
+echo "Installing dependencies..."
+dpkg -i python/*.deb
+
+echo "Extracting python..."
+tar xzvf python/Python-3.5.0.tgz
+
+echo "Building python..."
+pushd Python-3.5.0
+  ./configure \
+    --prefix=${BOSH_INSTALL_TARGET}
+
+  make
+  make install
+popd
+
+echo "Installing service-broker..."
+pushd service-broker
+  ${BOSH_INSTALL_TARGET}/bin/pip3 install .
+popd
+
+echo "Installing muranoclient..."
+${BOSH_INSTALL_TARGET}/bin/pip3 install -U python/python-muranoclient.tgz
+
+echo "Installing python-novaclient..."
+${BOSH_INSTALL_TARGET}/bin/pip3 install python-novaclient
+
+echo "Installing wrapt (dependency for novaclient)..."
+${BOSH_INSTALL_TARGET}/bin/pip3 install wrapt

LBaaS/LBaaS-ops-manager-tile/releases/packages/python/service-broker/manifest.yml

@@ -0,0 +1,6 @@
+applications:
+- name: lbaas-service-broker
+  mem: 128M
+  command: python service-broker/lbaas-service-broker.py config.json
+  disk: 512M
+  buildpack: python_buildpack

LBaaS/LBaaS-ops-manager-tile/releases/packages/python/service-broker/service_broker/lbaas_service_broker.py

@@ -0,0 +1,443 @@
+# Copyright 2015 - Mirantis, Inc.
+#
+#    Licensed under the Apache License, Version 2.0 (the "License");
+#    you may not use this file except in compliance with the License.
+#    You may obtain a copy of the License at
+#
+#        http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS,
+#    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+#    See the License for the specific language governing permissions and
+#    limitations under the License.
+
+import json
+import os
+import six
+import sys
+import uuid
+
+import bottle
+from keystoneclient.v3 import client as keystoneclient
+from muranoclient.v1 import client as muranoclient
+
+# Constant representing the API version supported by Cloud Controller.
+X_BROKER_API_VERSION = 2.7
+X_BROKER_API_VERSION_NAME = 'X-Broker-Api-Version'
+PORT_VAR_NAME = 'SERVICE_BROKER_PORT'
+
+
+if len(sys.argv) < 2:
+    print("Usage: %s <path-to-config.json>" % __file__)
+    sys.exit(1)
+
+config = json.load(open(sys.argv[1]))
+
+USER = config['username']
+PASSWORD = config['password']
+TENANT = config['tenant_name']
+AUTH_URL = config['auth_url']
+KEY_NAME = config['keyname']
+IMAGE_NAME = config['image_name']
+
+
+SERVICES = [
+    {
+        'id': 'io.murano.apps.lbaas.HAProxy',
+        'name': 'LBaaS-service',
+        'description': 'TBD',
+        'bindable': True,
+        'plans': [{
+            'id': 'standard_plan',
+            'name': 'm1.medium',
+            'description': 'Creates an instance with m1.medium flavor on OpenStack.'
+        }]
+    }
+]
+
+
+def keystone_client():
+    return keystoneclient.Client(
+        username=USER,
+        password=PASSWORD,
+        auth_url=AUTH_URL,
+        project_name=TENANT
+    )
+
+
+def murano_client():
+    ks_client = keystone_client()
+
+    murano_url = ks_client.service_catalog.url_for(
+        service_type='application_catalog'
+    )
+
+    return muranoclient.Client(
+        murano_url,
+        auth_url=AUTH_URL,
+        tenant=ks_client.project_id,
+        token=ks_client.auth_token
+    )
+
+
+def normalize_instance_id(instance_id):
+    prefix = "CF-LBaaS-"
+    instance_id = instance_id[:-len(prefix)]
+
+    return "%s%s" % (prefix, instance_id)
+
+
+def ensure_package_by_fqn(packages, fqn):
+    filtered = list(filter(
+        lambda p: p.fully_qualified_name == fqn,
+        packages
+    ))
+
+    if len(filtered) > 0:
+        return filtered[0]
+    else:
+        bottle.abort(400, 'Requested service does not exist: %s' % fqn)
+
+
+def get_env_by_name(murano, name):
+    envs = list(
+        filter(lambda e: e.name == name, murano.environments.list())
+    )
+
+    if not envs:
+        return None
+
+    return envs[0]
+
+
+def get_lbaas_object_model(instance_id, keyname, image_name, impl='haproxy'):
+    return {
+        "instance":
+        {
+            "assignFloatingIp": "true",
+            "keyname": keyname,
+            "image": image_name,
+            "name": instance_id,
+            "flavor": "m1.medium",
+            "?":
+            {
+                "type": "io.murano.resources.LinuxMuranoInstance",
+                "id": six.text_type(uuid.uuid4())
+            }
+        },
+        "name": "HAProxyBasedLBaaS",
+        "?": {
+            "_26411a1861294160833743e45d0eaad9": {
+                "name": "HAProxyBasedLBaaS"
+            },
+            "type": "io.murano.apps.lbaas.HAProxy",
+            "id": six.text_type(uuid.uuid4())
+        },
+        "implementation": impl
+    }
+
+
+@bottle.error(401)
+@bottle.error(404)
+@bottle.error(409)
+@bottle.error(410)
+def error(error):
+    bottle.response.content_type = 'application/json'
+
+    return '{"error": "%s"}' % error.body
+
+
+def authenticate(username, password):
+    return True
+
+
+@bottle.route('/v2/catalog', method='GET')
+@bottle.auth_basic(authenticate)
+def catalog():
+    """Return the catalog of services handled by this broker.
+
+    GET /v2/catalog:
+
+    HEADER:
+        X-Broker-Api-Version: <version>
+
+    return:
+        JSON document with details about the
+        services offered through this broker
+    """
+    api_version = bottle.request.headers.get('X-Broker-Api-Version')
+
+    if not api_version or float(api_version) < X_BROKER_API_VERSION:
+        bottle.abort(
+            409,
+            "Missing or incompatible %s. Expecting version %0.1f"
+            " or later" % (X_BROKER_API_VERSION_NAME, X_BROKER_API_VERSION)
+        )
+    return {"services": SERVICES}
+
+
+@bottle.route('/v2/service_instances/<instance_id>', method='PUT')
+@bottle.auth_basic(authenticate)
+def provision(instance_id):
+    """Provision an instance of this service for the given org and space.
+
+    PUT /v2/service_instances/<instance_id>:
+        <instance_id> is provided by the Cloud
+          Controller and will be used for future
+          requests to bind, unbind and deprovision
+
+    BODY:
+        {
+            "organization_guid": "org-guid-here",
+            "plan_id":           "plan-guid-here",
+            "service_id":        "service-guid-here",
+            "space_guid":        "space-guid-here",
+            "parameters":        {
+                "parameter1": 1,
+                "parameter2": "value"
+          }
+        }
+
+    returns:
+        JSON document with details about the
+        services offered through this broker
+
+    202 ACCEPTED in case if it is needed to trigger CF to poll progress.
+    """
+    instance_id = normalize_instance_id(instance_id)
+
+    if bottle.request.content_type != 'application/json':
+        bottle.abort(
+            415,
+            'Unsupported Content-Type: expecting application/json'
+        )
+
+    # Get the JSON document in the body.
+    provision_details = bottle.request.json
+
+    # Provision the service.
+    service_id = provision_details['service_id']
+
+    # Check that service is valid for current service broker.
+    assert any(service_id == s['id'] for s in SERVICES)
+
+    murano = murano_client()
+
+    ensure_package_by_fqn(
+        murano.packages.list(),
+        service_id
+    )
+
+    # TODO(nmakhotkin): It may make sense for the broker to associate the
+    # TODO(nmakhotkin): new instance with service/plan/org/space.
+    # Check for case of already provisioned service.
+    if get_env_by_name(murano, instance_id):
+        bottle.abort(
+            409,
+            'The requested service instance already exists: %s' % instance_id
+        )
+
+    env = murano.environments.create({'name': instance_id})
+    session_id = murano.sessions.configure(env.id).id
+    env = murano.environments.get(env.id, session_id)
+
+    object_model = get_lbaas_object_model(instance_id, KEY_NAME, IMAGE_NAME)
+
+    murano.services.post(
+        env.id,
+        session_id=session_id,
+        data=object_model,
+        path='/'
+    )
+
+    murano.sessions.deploy(env.id, session_id)
+
+    bottle.response.status = 202
+
+    return {"dashboard_url": AUTH_URL}
+
+
+@bottle.route('/v2/service_instances/<instance_id>/last_operation', method='GET')
+@bottle.auth_basic(authenticate)
+def last_operation(instance_id):
+    instance_id = normalize_instance_id(instance_id)
+
+    murano = murano_client()
+    env = get_env_by_name(murano, instance_id)
+
+    # First, try to find the appropriate service instance.
+    # if not (instance_id in SERVICE_INSTANCES and env):
+    #     bottle.abort(
+    #         410,
+    #         'The requested service instance not found: %s;'
+    #         ' env: %s' % (instance_id, env)
+    #     )
+
+    last_deployment = murano.deployments.list(env.id)[0]
+
+    reports = murano.deployments.reports(env.id, last_deployment.id)
+
+    state_map_to_cf = {
+        'running': 'in progress',
+        'success': 'succeeded',
+    }
+
+    status = state_map_to_cf.get(last_deployment.state, 'failed')
+    description = reports[-1].text if reports else "Not started yet."
+
+    print("Status of %s: %s - %s" % (instance_id, status, description))
+
+    return {
+        "state": status,
+        "description": description
+    }
+
+
+@bottle.route('/v2/service_instances/<instance_id>', method='DELETE')
+@bottle.auth_basic(authenticate)
+def deprovision(instance_id):
+    """Deprovision an existing instance of this service.
+
+    DELETE /v2/service_instances/<instance_id>:
+        <instance_id> is the Cloud Controller provided
+          value used to provision the instance
+
+    return:
+        As of API 2.7, an empty JSON document
+        is expected
+    """
+    instance_id = normalize_instance_id(instance_id)
+    murano = murano_client()
+
+    env = get_env_by_name(murano, instance_id)
+
+    # Check for case of no existing service.
+    if not env:
+        bottle.abort(
+            410,
+            'Given instance_id not found as environment name '
+            'in murano: %s' % instance_id
+        )
+
+    # Deprovision service.
+    murano.environments.delete(env.id)
+
+    # Send response.
+    bottle.response.status = 200
+
+    return {}
+
+
+@bottle.route(
+    '/v2/service_instances/<instance_id>/service_bindings/<binding_id>',
+    method='PUT'
+)
+@bottle.auth_basic(authenticate)
+def bind(instance_id, binding_id):
+    """Bind an existing instance with the for the given org and space.
+
+    PUT /v2/service_instances/<instance_id>/service_bindings/<binding_id>:
+        <instance_id> is the Cloud Controller provided
+          value used to provision the instance
+        <binding_id> is provided by the Cloud Controller
+          and will be used for future unbind requests
+
+    BODY:
+        {
+          "plan_id":           "<plan-guid>",
+          "service_id":        "<service-guid>",
+          "app_guid":          "<app-guid>"
+        }
+
+    return:
+        JSON document with credentails and access details
+        for the service based on this binding
+        http://docs.cloudfoundry.org/services/binding-credentials.html
+    """
+    instance_id = normalize_instance_id(instance_id)
+
+    if bottle.request.content_type != 'application/json':
+        bottle.abort(
+            415,
+            'Unsupported Content-Type: expecting application/json'
+        )
+    # Get the JSON document in the body.
+    binding_details = bottle.request.json
+
+    service_id = binding_details['service_id']
+
+    # Check that service is valid for current service broker.
+    assert any(service_id == s['id'] for s in SERVICES)
+
+    murano = murano_client()
+    env = get_env_by_name(murano, instance_id)
+
+    # Find the corresponding component for current service.
+    components = murano.services.list(env.id)
+
+    component = None
+    for c in components:
+        if c.to_dict()['?']['type'] == service_id:
+            component = c
+
+    if not component:
+        bottle.abort(
+            404,
+            'The requested component type not found in murano env '
+            '"%s": %s' % (instance_id, service_id)
+        )
+
+    ip = component.instance['floatingIpAddress']
+    # Return created status code.
+    bottle.response.status = 201
+
+    return {
+        "credentials": {
+            "uri": "http://%s:8993/v1" % ip
+        }
+    }
+
+
+@bottle.route(
+    '/v2/service_instances/<instance_id>/service_bindings/<binding_id>',
+    method='DELETE'
+)
+@bottle.auth_basic(authenticate)
+def unbind(instance_id, binding_id):
+    """Unbind an existing instance associated with the binding_id provided.
+
+    DELETE /v2/service_instances/<instance_id>/service_bindings/<binding_id>:
+        <instance_id> is the Cloud Controller provided
+          value used to provision the instance
+        <binding_id> is the Cloud Controller provided
+          value used to bind the instance
+
+    return:
+        As of API 2.7, an empty JSON document
+        is expected
+    """
+    instance_id = normalize_instance_id(instance_id)
+
+    murano = murano_client()
+    env = get_env_by_name(murano, instance_id)
+
+    # Check for case of no existing service.
+    if not env:
+        bottle.abort(
+            410,
+            'The requested service instance does not exist: %s' % instance_id
+        )
+
+    # Send response.
+    bottle.response.status = 200
+
+    return {}
+
+
+def main():
+    port = int(os.getenv(PORT_VAR_NAME, '8080'))
+    bottle.run(host='0.0.0.0', port=port, debug=True, reloader=False)
+
+if __name__ == '__main__':
+    main()

LBaaS/LBaaS-ops-manager-tile/releases/packages/python/service-broker/setup.py

@@ -0,0 +1,38 @@
+# Copyright (c) 2013 Hewlett-Packard Development Company, L.P.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+# implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+import setuptools
+
+try:
+    import multiprocessing  # noqa
+except ImportError:
+    pass
+
+setuptools.setup(
+    name='lbaas-service-broker',
+    version='0.1',
+    entry_points={
+        'console_scripts': [
+            'lbaas-broker-server='
+            'service_broker.lbaas_service_broker:main'
+        ],
+    },
+    packages=['service_broker'],
+    install_requires=[
+        'bottle',
+        'python-keystoneclient',
+        'python-muranoclient'
+    ],
+)

LBaaS/LBaaS-ops-manager-tile/releases/release.MF

@@ -0,0 +1,24 @@
+---
+packages:
+- name: python
+  version: 795a8f8acc5e1c4688e3823355e7681532ba85f9
+  fingerprint: 795a8f8acc5e1c4688e3823355e7681532ba85f9
+  sha1: %sha1_python_package%
+  dependencies: []
+jobs:
+- name: lbaas-config
+  version: b8e48895b6fa2a8224e5907f5ee983d99eab6086
+  fingerprint: b8e48895b6fa2a8224e5907f5ee983d99eab6086
+  sha1: %sha1_lbaas_job%
+- name: delete-lbaas
+  version: b8e48895b6fa2a8224e5907f5ee983d99eab6086
+  fingerprint: b8e48895b6fa2a8224e5907f5ee983d99eab6086
+  sha1: %sha1_delete_lbaas_job%
+license:
+  version: e6c4ccc65c76e75e2338d1edabdcf264d37ee663
+  fingerprint: e6c4ccc65c76e75e2338d1edabdcf264d37ee663
+  sha1: e9f73d92771324e6da16044b1d28d045e5eb71c3
+commit_hash: bedfbc4e
+uncommitted_changes: true
+name: example-release
+version: '10'