Replace hiera by lookup

The hiera function is deprecated and does not work with the latest
hieradata version 5. It should be replaced by the new lookup
function[1].

[1] https://puppet.com/docs/puppet/7/hiera_automatic.html

With the lookup function, we can define value type and merge behavior,
but these are kept default at this moment to limit scope of this change
to just simple replacement. Adding value type might be useful to make
sure the value is in expected type (especially when a boolean value is
expected), but we will revisit that later.

example:
lookup(<NAME>, [<VALUE TYPE>], [<MERGE BEHAVIOR>], [<DEFAULT VALUE>])

This also replaces the hiera_array function which is also deprecated,
according to the guideline[2].

[2] https://puppet.com/docs/puppet/7/hiera_migrate.html#updated_classic_hiera_function_calls

Change-Id: Ic9930107fbc68cba3432f4424f113071325efcb7

packstack/puppet/modules/packstack/manifests/amqp.pp

@@ -1,6 +1,6 @@
 class packstack::amqp ()
 {
-  $amqp = hiera('CONFIG_AMQP_BACKEND')
+  $amqp = lookup('CONFIG_AMQP_BACKEND')
 
   case $amqp  {
     'rabbitmq': {

packstack/puppet/modules/packstack/manifests/amqp/enable_rabbitmq.pp

@@ -1,9 +1,9 @@
 define packstack::amqp::enable_rabbitmq {
-  create_resources(packstack::firewall, hiera('FIREWALL_AMQP_RULES', {}))
+  create_resources(packstack::firewall, lookup('FIREWALL_AMQP_RULES', undef, undef, {}))
-  $amqp_enable_ssl = hiera('CONFIG_AMQP_SSL_ENABLED')
+  $amqp_enable_ssl = lookup('CONFIG_AMQP_SSL_ENABLED')
 
   if $amqp_enable_ssl {
-    $kombu_ssl_ca_certs = hiera('CONFIG_AMQP_SSL_CACERT_FILE', undef)
+    $kombu_ssl_ca_certs = lookup('CONFIG_AMQP_SSL_CACERT_FILE', undef, undef, undef)
     $kombu_ssl_keyfile = '/etc/pki/tls/private/ssl_amqp.key'
     $kombu_ssl_certfile = '/etc/pki/tls/certs/ssl_amqp.crt'
 
@@ -23,14 +23,14 @@ define packstack::amqp::enable_rabbitmq {
 
     class { 'rabbitmq':
       port                     => undef,
-      ssl_port                 => 0 + hiera('CONFIG_AMQP_CLIENTS_PORT'),
+      ssl_port                 => 0 + lookup('CONFIG_AMQP_CLIENTS_PORT'),
       ssl_only                 => true,
       ssl                      => true,
       ssl_cacert               => $kombu_ssl_ca_certs,
       ssl_cert                 => $kombu_ssl_certfile,
       ssl_key                  => $kombu_ssl_keyfile,
-      default_user             => hiera('CONFIG_AMQP_AUTH_USER'),
+      default_user             => lookup('CONFIG_AMQP_AUTH_USER'),
-      default_pass             => hiera('CONFIG_AMQP_AUTH_PASSWORD'),
+      default_pass             => lookup('CONFIG_AMQP_AUTH_PASSWORD'),
       package_provider         => 'yum',
       repos_ensure             => false,
       admin_enable             => false,
@@ -43,10 +43,10 @@ define packstack::amqp::enable_rabbitmq {
     }
   } else {
     class { 'rabbitmq':
-      port             => 0 + hiera('CONFIG_AMQP_CLIENTS_PORT'),
+      port             => 0 + lookup('CONFIG_AMQP_CLIENTS_PORT'),
       ssl              => false,
-      default_user     => hiera('CONFIG_AMQP_AUTH_USER'),
+      default_user     => lookup('CONFIG_AMQP_AUTH_USER'),
-      default_pass     => hiera('CONFIG_AMQP_AUTH_PASSWORD'),
+      default_pass     => lookup('CONFIG_AMQP_AUTH_PASSWORD'),
       package_provider => 'yum',
       repos_ensure     => false,
       admin_enable     => false,

packstack/puppet/modules/packstack/manifests/aodh.pp

@@ -1,20 +1,20 @@
 class packstack::aodh ()
 {
-    create_resources(packstack::firewall, hiera('FIREWALL_AODH_RULES', {}))
+    create_resources(packstack::firewall, lookup('FIREWALL_AODH_RULES', undef, undef, {}))
 
-    $config_aodh_coordination_backend = hiera('CONFIG_CEILOMETER_COORDINATION_BACKEND')
+    $config_aodh_coordination_backend = lookup('CONFIG_CEILOMETER_COORDINATION_BACKEND')
 
     if $config_aodh_coordination_backend == 'redis' {
-      $redis_host = hiera('CONFIG_REDIS_HOST_URL')
+      $redis_host = lookup('CONFIG_REDIS_HOST_URL')
-      $redis_port = hiera('CONFIG_REDIS_PORT')
+      $redis_port = lookup('CONFIG_REDIS_PORT')
       $coordination_url = "redis://${redis_host}:${redis_port}"
     } else {
       $coordination_url = ''
     }
 
     class { 'aodh::keystone::authtoken':
-      password => hiera('CONFIG_AODH_KS_PW'),
+      password => lookup('CONFIG_AODH_KS_PW'),
-      auth_url => hiera('CONFIG_KEYSTONE_ADMIN_URL'),
+      auth_url => lookup('CONFIG_KEYSTONE_ADMIN_URL'),
     }
 
     class { 'aodh::api':
@@ -24,14 +24,14 @@ class packstack::aodh ()
     }
 
     class { 'aodh::wsgi::apache':
-      workers => hiera('CONFIG_SERVICE_WORKERS'),
+      workers => lookup('CONFIG_SERVICE_WORKERS'),
       ssl     => false
     }
 
     class { 'aodh::service_credentials':
-      password    => hiera('CONFIG_AODH_KS_PW'),
+      password    => lookup('CONFIG_AODH_KS_PW'),
-      auth_url    => hiera('CONFIG_KEYSTONE_PUBLIC_URL_VERSIONLESS'),
+      auth_url    => lookup('CONFIG_KEYSTONE_PUBLIC_URL_VERSIONLESS'),
-      region_name => hiera('CONFIG_KEYSTONE_REGION'),
+      region_name => lookup('CONFIG_KEYSTONE_REGION'),
     }
     class { 'aodh::coordination':
       backend_url => $coordination_url,

packstack/puppet/modules/packstack/manifests/aodh/rabbitmq.pp

@@ -1,16 +1,16 @@
 class packstack::aodh::rabbitmq ()
 {
-    $kombu_ssl_ca_certs = hiera('CONFIG_AMQP_SSL_CACERT_FILE', undef)
+    $kombu_ssl_ca_certs = lookup('CONFIG_AMQP_SSL_CACERT_FILE', undef, undef, undef)
-    $kombu_ssl_keyfile = hiera('CONFIG_AODH_SSL_KEY', undef)
+    $kombu_ssl_keyfile = lookup('CONFIG_AODH_SSL_KEY', undef, undef, undef)
-    $kombu_ssl_certfile = hiera('CONFIG_AODH_SSL_CERT', undef)
+    $kombu_ssl_certfile = lookup('CONFIG_AODH_SSL_CERT', undef, undef, undef)
 
-    $aodh_db_pw = hiera('CONFIG_AODH_DB_PW')
+    $aodh_db_pw = lookup('CONFIG_AODH_DB_PW')
-    $aodh_mariadb_host = hiera('CONFIG_MARIADB_HOST_URL')
+    $aodh_mariadb_host = lookup('CONFIG_MARIADB_HOST_URL')
 
-    $rabbit_host = hiera('CONFIG_AMQP_HOST_URL')
+    $rabbit_host = lookup('CONFIG_AMQP_HOST_URL')
-    $rabbit_port = hiera('CONFIG_AMQP_CLIENTS_PORT')
+    $rabbit_port = lookup('CONFIG_AMQP_CLIENTS_PORT')
-    $rabbit_userid = hiera('CONFIG_AMQP_AUTH_USER')
+    $rabbit_userid = lookup('CONFIG_AMQP_AUTH_USER')
-    $rabbit_password = hiera('CONFIG_AMQP_AUTH_PASSWORD')
+    $rabbit_password = lookup('CONFIG_AMQP_AUTH_PASSWORD')
 
 
     if $kombu_ssl_keyfile {
@@ -25,7 +25,7 @@ class packstack::aodh::rabbitmq ()
     Service<| name == 'rabbitmq-server' |> -> Service<| tag == 'aodh-service' |>
 
     class { 'aodh::logging':
-      debug => hiera('CONFIG_DEBUG_MODE'),
+      debug => lookup('CONFIG_DEBUG_MODE'),
     }
 
     class { 'aodh::db':
@@ -33,7 +33,7 @@ class packstack::aodh::rabbitmq ()
     }
 
     class { 'aodh':
-      rabbit_use_ssl        => hiera('CONFIG_AMQP_SSL_ENABLED'),
+      rabbit_use_ssl        => lookup('CONFIG_AMQP_SSL_ENABLED'),
       default_transport_url => "rabbit://${rabbit_userid}:${rabbit_password}@${rabbit_host}:${rabbit_port}/",
       kombu_ssl_ca_certs    => $kombu_ssl_ca_certs,
       kombu_ssl_keyfile     => $kombu_ssl_keyfile,

packstack/puppet/modules/packstack/manifests/apache.pp

@@ -15,7 +15,7 @@ class packstack::apache ()
       }
     }
 
-    if hiera('CONFIG_HORIZON_SSL')  == 'y' {
+    if lookup('CONFIG_HORIZON_SSL') == 'y' {
       ensure_packages(['mod_ssl'], {'ensure' => 'present'})
       Package['mod_ssl'] -> Class['apache']
     }

packstack/puppet/modules/packstack/manifests/ceilometer.pp

@@ -1,10 +1,10 @@
 class packstack::ceilometer ()
 {
-    create_resources(packstack::firewall, hiera('FIREWALL_CEILOMETER_RULES', {}))
+    create_resources(packstack::firewall, lookup('FIREWALL_CEILOMETER_RULES', undef, undef, {}))
 
-    $config_ceilometer_coordination_backend = hiera('CONFIG_CEILOMETER_COORDINATION_BACKEND')
+    $config_ceilometer_coordination_backend = lookup('CONFIG_CEILOMETER_COORDINATION_BACKEND')
 
-    $config_gnocchi_host = hiera('CONFIG_KEYSTONE_HOST_URL')
+    $config_gnocchi_host = lookup('CONFIG_KEYSTONE_HOST_URL')
 
     if ($::operatingsystem == 'Fedora') or
       ($::osfamily == 'RedHat' and Integer.new($::operatingsystemmajrelease) > 7) {
@@ -14,8 +14,8 @@ class packstack::ceilometer ()
     }
 
     if $config_ceilometer_coordination_backend == 'redis' {
-      $redis_host = hiera('CONFIG_REDIS_HOST_URL')
+      $redis_host = lookup('CONFIG_REDIS_HOST_URL')
-      $redis_port = hiera('CONFIG_REDIS_PORT')
+      $redis_port = lookup('CONFIG_REDIS_PORT')
       $coordination_url = "redis://${redis_host}:${redis_port}"
 
       ensure_packages('python-redis', {
@@ -44,9 +44,9 @@ class packstack::ceilometer ()
     }
 
     class { 'ceilometer::agent::service_credentials':
-      auth_url    => hiera('CONFIG_KEYSTONE_PUBLIC_URL_VERSIONLESS'),
+      auth_url    => lookup('CONFIG_KEYSTONE_PUBLIC_URL_VERSIONLESS'),
-      password    => hiera('CONFIG_CEILOMETER_KS_PW'),
+      password    => lookup('CONFIG_CEILOMETER_KS_PW'),
-      region_name => hiera('CONFIG_KEYSTONE_REGION'),
+      region_name => lookup('CONFIG_KEYSTONE_REGION'),
     }
 
     class { 'ceilometer::coordination':

packstack/puppet/modules/packstack/manifests/ceilometer/rabbitmq.pp

@@ -1,13 +1,13 @@
 class packstack::ceilometer::rabbitmq ()
 {
-    $kombu_ssl_ca_certs = hiera('CONFIG_AMQP_SSL_CACERT_FILE', undef)
+    $kombu_ssl_ca_certs = lookup('CONFIG_AMQP_SSL_CACERT_FILE', undef, undef, undef)
-    $kombu_ssl_keyfile = hiera('CONFIG_CEILOMETER_SSL_KEY', undef)
+    $kombu_ssl_keyfile = lookup('CONFIG_CEILOMETER_SSL_KEY', undef, undef, undef)
-    $kombu_ssl_certfile = hiera('CONFIG_CEILOMETER_SSL_CERT', undef)
+    $kombu_ssl_certfile = lookup('CONFIG_CEILOMETER_SSL_CERT', undef, undef, undef)
 
-    $rabbit_host = hiera('CONFIG_AMQP_HOST_URL')
+    $rabbit_host = lookup('CONFIG_AMQP_HOST_URL')
-    $rabbit_port = hiera('CONFIG_AMQP_CLIENTS_PORT')
+    $rabbit_port = lookup('CONFIG_AMQP_CLIENTS_PORT')
-    $rabbit_userid = hiera('CONFIG_AMQP_AUTH_USER')
+    $rabbit_userid = lookup('CONFIG_AMQP_AUTH_USER')
-    $rabbit_password = hiera('CONFIG_AMQP_AUTH_PASSWORD')
+    $rabbit_password = lookup('CONFIG_AMQP_AUTH_PASSWORD')
 
     if $kombu_ssl_keyfile {
       $files_to_set_owner = [ $kombu_ssl_keyfile, $kombu_ssl_certfile ]
@@ -21,12 +21,12 @@ class packstack::ceilometer::rabbitmq ()
     Service<| name == 'rabbitmq-server' |> -> Service<| tag == 'ceilometer-service' |>
 
     class { 'ceilometer::logging':
-      debug => hiera('CONFIG_DEBUG_MODE'),
+      debug => lookup('CONFIG_DEBUG_MODE'),
     }
 
     class { 'ceilometer':
-      telemetry_secret      => hiera('CONFIG_CEILOMETER_SECRET'),
+      telemetry_secret      => lookup('CONFIG_CEILOMETER_SECRET'),
-      rabbit_use_ssl        => hiera('CONFIG_AMQP_SSL_ENABLED'),
+      rabbit_use_ssl        => lookup('CONFIG_AMQP_SSL_ENABLED'),
       default_transport_url => "rabbit://${rabbit_userid}:${rabbit_password}@${rabbit_host}:${rabbit_port}/",
       kombu_ssl_ca_certs    => $kombu_ssl_ca_certs,
       kombu_ssl_keyfile     => $kombu_ssl_keyfile,

packstack/puppet/modules/packstack/manifests/chrony.pp

@@ -1,7 +1,7 @@
 class packstack::chrony ()
 {
-    $cfg_ntp_server_def = hiera('CONFIG_NTP_SERVER_DEF')
+    $cfg_ntp_server_def = lookup('CONFIG_NTP_SERVER_DEF')
-    $cfg_ntp_servers    = hiera('CONFIG_NTP_SERVERS')
+    $cfg_ntp_servers    = lookup('CONFIG_NTP_SERVERS')
 
     $config_content = "
     # Use public servers from the pool.ntp.org project.

packstack/puppet/modules/packstack/manifests/cinder.pp

@@ -1,9 +1,9 @@
 class packstack::cinder ()
 {
-    create_resources(packstack::firewall, hiera('FIREWALL_CINDER_RULES', {}))
+    create_resources(packstack::firewall, lookup('FIREWALL_CINDER_RULES', undef, undef, {}))
-    create_resources(packstack::firewall, hiera('FIREWALL_CINDER_API_RULES', {}))
+    create_resources(packstack::firewall, lookup('FIREWALL_CINDER_API_RULES', undef, undef, {}))
 
-    $cinder_backends = hiera_array('CONFIG_CINDER_BACKEND')
+    $cinder_backends = lookup('CONFIG_CINDER_BACKEND', { merge => 'unique' })
 
     case $cinder_backends[0] {
       'lvm':       { $default_volume_type = 'iscsi' }
@@ -15,24 +15,24 @@ class packstack::cinder ()
     }
 
     cinder_config {
-      'DEFAULT/glance_host': value => hiera('CONFIG_STORAGE_HOST_URL');
+      'DEFAULT/glance_host': value => lookup('CONFIG_STORAGE_HOST_URL');
     }
 
-    $bind_host = hiera('CONFIG_IP_VERSION') ? {
+    $bind_host = lookup('CONFIG_IP_VERSION') ? {
       'ipv6'  => '::0',
       default => '0.0.0.0',
       # TO-DO(mmagr): Add IPv6 support when hostnames are used
     }
 
     class { 'cinder::keystone::authtoken':
-      www_authenticate_uri => hiera('CONFIG_KEYSTONE_PUBLIC_URL_VERSIONLESS'),
+      www_authenticate_uri => lookup('CONFIG_KEYSTONE_PUBLIC_URL_VERSIONLESS'),
-      auth_url             => hiera('CONFIG_KEYSTONE_ADMIN_URL'),
+      auth_url             => lookup('CONFIG_KEYSTONE_ADMIN_URL'),
-      password             => hiera('CONFIG_CINDER_KS_PW'),
+      password             => lookup('CONFIG_CINDER_KS_PW'),
     }
 
     class { 'cinder::api':
       bind_host           => $bind_host,
-      service_workers     => hiera('CONFIG_SERVICE_WORKERS'),
+      service_workers     => lookup('CONFIG_SERVICE_WORKERS'),
       default_volume_type => $default_volume_type,
     }
 
@@ -42,16 +42,16 @@ class packstack::cinder ()
 
     class { 'cinder::client': }
 
-    $cinder_keystone_admin_username = hiera('CONFIG_KEYSTONE_ADMIN_USERNAME')
+    $cinder_keystone_admin_username = lookup('CONFIG_KEYSTONE_ADMIN_USERNAME')
-    $cinder_keystone_admin_password = hiera('CONFIG_KEYSTONE_ADMIN_PW')
+    $cinder_keystone_admin_password = lookup('CONFIG_KEYSTONE_ADMIN_PW')
-    $cinder_keystone_auth_url = hiera('CONFIG_KEYSTONE_PUBLIC_URL')
+    $cinder_keystone_auth_url = lookup('CONFIG_KEYSTONE_PUBLIC_URL')
-    $cinder_keystone_api = hiera('CONFIG_KEYSTONE_API_VERSION')
+    $cinder_keystone_api = lookup('CONFIG_KEYSTONE_API_VERSION')
 
     class { 'cinder::backends':
-      enabled_backends => hiera_array('CONFIG_CINDER_BACKEND'),
+      enabled_backends => lookup('CONFIG_CINDER_BACKEND', { merge => 'unique' }),
     }
 
-    $db_purge = hiera('CONFIG_CINDER_DB_PURGE_ENABLE')
+    $db_purge = lookup('CONFIG_CINDER_DB_PURGE_ENABLE')
     if $db_purge {
       class { 'cinder::cron::db_purge':
         hour        => '*/24',

packstack/puppet/modules/packstack/manifests/cinder/backend/lvm.pp

@@ -1,14 +1,14 @@
 class packstack::cinder::backend::lvm ()
 {
-    $create_cinder_volume = hiera('CONFIG_CINDER_VOLUMES_CREATE')
+    $create_cinder_volume = lookup('CONFIG_CINDER_VOLUMES_CREATE')
-    $cinder_volume_name = hiera('CONFIG_CINDER_VOLUME_NAME')
+    $cinder_volume_name = lookup('CONFIG_CINDER_VOLUME_NAME')
 
     if $create_cinder_volume == 'y' {
         # Find an available loop device
         $loop_dev = chomp(generate('/usr/sbin/losetup', '-f'))
 
         class { 'cinder::setup_test_volume':
-          size            => hiera('CONFIG_CINDER_VOLUMES_SIZE'),
+          size            => lookup('CONFIG_CINDER_VOLUMES_SIZE'),
           loopback_device => $loop_dev,
           volume_path     => '/var/lib/cinder',
           volume_name     => $cinder_volume_name,
@@ -85,7 +85,7 @@ class packstack::cinder::backend::lvm ()
     }
 
     cinder::backend::iscsi { 'lvm':
-      target_ip_address => hiera('CONFIG_STORAGE_HOST_URL'),
+      target_ip_address => lookup('CONFIG_STORAGE_HOST_URL'),
       require           => Package['lvm2'],
       volume_group      => $cinder_volume_name,
     }

packstack/puppet/modules/packstack/manifests/cinder/backend/netapp.pp

@@ -1,40 +1,40 @@
 # Copyright (c) – 2014, Ryan Hefner.  All rights reserved.
 class packstack::cinder::backend::netapp ()
 {
-    $netapp_storage_family = hiera('CONFIG_CINDER_NETAPP_STORAGE_FAMILY')
+    $netapp_storage_family = lookup('CONFIG_CINDER_NETAPP_STORAGE_FAMILY')
-    $netapp_storage_protocol = hiera('CONFIG_CINDER_NETAPP_STORAGE_PROTOCOL')
+    $netapp_storage_protocol = lookup('CONFIG_CINDER_NETAPP_STORAGE_PROTOCOL')
     $netapp_backend_name = 'netapp'
 
     if $netapp_storage_family == 'ontap_cluster' {
       if $netapp_storage_protocol == 'nfs' {
         cinder::backend::netapp { $netapp_backend_name:
-          netapp_login              => hiera('CONFIG_CINDER_NETAPP_LOGIN'),
+          netapp_login              => lookup('CONFIG_CINDER_NETAPP_LOGIN'),
-          netapp_password           => hiera('CONFIG_CINDER_NETAPP_PASSWORD'),
+          netapp_password           => lookup('CONFIG_CINDER_NETAPP_PASSWORD'),
-          netapp_server_hostname    => hiera('CONFIG_CINDER_NETAPP_HOSTNAME'),
+          netapp_server_hostname    => lookup('CONFIG_CINDER_NETAPP_HOSTNAME'),
-          netapp_server_port        => hiera('CONFIG_CINDER_NETAPP_SERVER_PORT'),
+          netapp_server_port        => lookup('CONFIG_CINDER_NETAPP_SERVER_PORT'),
-          netapp_storage_family     => hiera('CONFIG_CINDER_NETAPP_STORAGE_FAMILY'),
+          netapp_storage_family     => lookup('CONFIG_CINDER_NETAPP_STORAGE_FAMILY'),
-          netapp_storage_protocol   => hiera('CONFIG_CINDER_NETAPP_STORAGE_PROTOCOL'),
+          netapp_storage_protocol   => lookup('CONFIG_CINDER_NETAPP_STORAGE_PROTOCOL'),
-          netapp_transport_type     => hiera('CONFIG_CINDER_NETAPP_TRANSPORT_TYPE'),
+          netapp_transport_type     => lookup('CONFIG_CINDER_NETAPP_TRANSPORT_TYPE'),
-          netapp_vserver            => hiera('CONFIG_CINDER_NETAPP_VSERVER'),
+          netapp_vserver            => lookup('CONFIG_CINDER_NETAPP_VSERVER'),
-          expiry_thres_minutes      => hiera('CONFIG_CINDER_NETAPP_EXPIRY_THRES_MINUTES'),
+          expiry_thres_minutes      => lookup('CONFIG_CINDER_NETAPP_EXPIRY_THRES_MINUTES'),
-          thres_avl_size_perc_start => hiera('CONFIG_CINDER_NETAPP_THRES_AVL_SIZE_PERC_START'),
+          thres_avl_size_perc_start => lookup('CONFIG_CINDER_NETAPP_THRES_AVL_SIZE_PERC_START'),
-          thres_avl_size_perc_stop  => hiera('CONFIG_CINDER_NETAPP_THRES_AVL_SIZE_PERC_STOP'),
+          thres_avl_size_perc_stop  => lookup('CONFIG_CINDER_NETAPP_THRES_AVL_SIZE_PERC_STOP'),
-          nfs_shares                => hiera_array('CONFIG_CINDER_NETAPP_NFS_SHARES'),
+          nfs_shares                => lookup('CONFIG_CINDER_NETAPP_NFS_SHARES', { merge => 'unique' }),
-          nfs_shares_config         => hiera('CONFIG_CINDER_NETAPP_NFS_SHARES_CONFIG'),
+          nfs_shares_config         => lookup('CONFIG_CINDER_NETAPP_NFS_SHARES_CONFIG'),
         }
         ensure_packages(['nfs-utils'], {'ensure' => 'present'})
       }
       elsif $netapp_storage_protocol == 'iscsi' {
         cinder::backend::netapp { $netapp_backend_name:
-          netapp_login            => hiera('CONFIG_CINDER_NETAPP_LOGIN'),
+          netapp_login            => lookup('CONFIG_CINDER_NETAPP_LOGIN'),
-          netapp_password         => hiera('CONFIG_CINDER_NETAPP_PASSWORD'),
+          netapp_password         => lookup('CONFIG_CINDER_NETAPP_PASSWORD'),
-          netapp_server_hostname  => hiera('CONFIG_CINDER_NETAPP_HOSTNAME'),
+          netapp_server_hostname  => lookup('CONFIG_CINDER_NETAPP_HOSTNAME'),
-          netapp_server_port      => hiera('CONFIG_CINDER_NETAPP_SERVER_PORT'),
+          netapp_server_port      => lookup('CONFIG_CINDER_NETAPP_SERVER_PORT'),
-          netapp_size_multiplier  => hiera('CONFIG_CINDER_NETAPP_SIZE_MULTIPLIER'),
+          netapp_size_multiplier  => lookup('CONFIG_CINDER_NETAPP_SIZE_MULTIPLIER'),
-          netapp_storage_family   => hiera('CONFIG_CINDER_NETAPP_STORAGE_FAMILY'),
+          netapp_storage_family   => lookup('CONFIG_CINDER_NETAPP_STORAGE_FAMILY'),
-          netapp_storage_protocol => hiera('CONFIG_CINDER_NETAPP_STORAGE_PROTOCOL'),
+          netapp_storage_protocol => lookup('CONFIG_CINDER_NETAPP_STORAGE_PROTOCOL'),
-          netapp_transport_type   => hiera('CONFIG_CINDER_NETAPP_TRANSPORT_TYPE'),
+          netapp_transport_type   => lookup('CONFIG_CINDER_NETAPP_TRANSPORT_TYPE'),
-          netapp_vserver          => hiera('CONFIG_CINDER_NETAPP_VSERVER'),
+          netapp_vserver          => lookup('CONFIG_CINDER_NETAPP_VSERVER'),
         }
 
         ensure_packages(['iscsi-initiator-utils'], {'ensure' => 'present'})
@@ -42,49 +42,49 @@ class packstack::cinder::backend::netapp ()
 
       elsif $netapp_storage_protocol == 'fc' {
         cinder::backend::netapp { $netapp_backend_name:
-          netapp_login            => hiera('CONFIG_CINDER_NETAPP_LOGIN'),
+          netapp_login            => lookup('CONFIG_CINDER_NETAPP_LOGIN'),
-          netapp_password         => hiera('CONFIG_CINDER_NETAPP_PASSWORD'),
+          netapp_password         => lookup('CONFIG_CINDER_NETAPP_PASSWORD'),
-          netapp_server_hostname  => hiera('CONFIG_CINDER_NETAPP_HOSTNAME'),
+          netapp_server_hostname  => lookup('CONFIG_CINDER_NETAPP_HOSTNAME'),
-          netapp_server_port      => hiera('CONFIG_CINDER_NETAPP_SERVER_PORT'),
+          netapp_server_port      => lookup('CONFIG_CINDER_NETAPP_SERVER_PORT'),
-          netapp_size_multiplier  => hiera('CONFIG_CINDER_NETAPP_SIZE_MULTIPLIER'),
+          netapp_size_multiplier  => lookup('CONFIG_CINDER_NETAPP_SIZE_MULTIPLIER'),
-          netapp_storage_family   => hiera('CONFIG_CINDER_NETAPP_STORAGE_FAMILY'),
+          netapp_storage_family   => lookup('CONFIG_CINDER_NETAPP_STORAGE_FAMILY'),
-          netapp_storage_protocol => hiera('CONFIG_CINDER_NETAPP_STORAGE_PROTOCOL'),
+          netapp_storage_protocol => lookup('CONFIG_CINDER_NETAPP_STORAGE_PROTOCOL'),
-          netapp_transport_type   => hiera('CONFIG_CINDER_NETAPP_TRANSPORT_TYPE'),
+          netapp_transport_type   => lookup('CONFIG_CINDER_NETAPP_TRANSPORT_TYPE'),
-          netapp_vserver          => hiera('CONFIG_CINDER_NETAPP_VSERVER'),
+          netapp_vserver          => lookup('CONFIG_CINDER_NETAPP_VSERVER'),
         }
       }
     }
     elsif $netapp_storage_family == 'ontap_7mode' {
       if $netapp_storage_protocol == 'nfs' {
         cinder::backend::netapp { $netapp_backend_name:
-          netapp_login              => hiera('CONFIG_CINDER_NETAPP_LOGIN'),
+          netapp_login              => lookup('CONFIG_CINDER_NETAPP_LOGIN'),
-          netapp_password           => hiera('CONFIG_CINDER_NETAPP_PASSWORD'),
+          netapp_password           => lookup('CONFIG_CINDER_NETAPP_PASSWORD'),
-          netapp_server_hostname    => hiera('CONFIG_CINDER_NETAPP_HOSTNAME'),
+          netapp_server_hostname    => lookup('CONFIG_CINDER_NETAPP_HOSTNAME'),
-          netapp_server_port        => hiera('CONFIG_CINDER_NETAPP_SERVER_PORT'),
+          netapp_server_port        => lookup('CONFIG_CINDER_NETAPP_SERVER_PORT'),
-          netapp_storage_family     => hiera('CONFIG_CINDER_NETAPP_STORAGE_FAMILY'),
+          netapp_storage_family     => lookup('CONFIG_CINDER_NETAPP_STORAGE_FAMILY'),
-          netapp_storage_protocol   => hiera('CONFIG_CINDER_NETAPP_STORAGE_PROTOCOL'),
+          netapp_storage_protocol   => lookup('CONFIG_CINDER_NETAPP_STORAGE_PROTOCOL'),
-          netapp_transport_type     => hiera('CONFIG_CINDER_NETAPP_TRANSPORT_TYPE'),
+          netapp_transport_type     => lookup('CONFIG_CINDER_NETAPP_TRANSPORT_TYPE'),
-          expiry_thres_minutes      => hiera('CONFIG_CINDER_NETAPP_EXPIRY_THRES_MINUTES'),
+          expiry_thres_minutes      => lookup('CONFIG_CINDER_NETAPP_EXPIRY_THRES_MINUTES'),
-          thres_avl_size_perc_start => hiera('CONFIG_CINDER_NETAPP_THRES_AVL_SIZE_PERC_START'),
+          thres_avl_size_perc_start => lookup('CONFIG_CINDER_NETAPP_THRES_AVL_SIZE_PERC_START'),
-          thres_avl_size_perc_stop  => hiera('CONFIG_CINDER_NETAPP_THRES_AVL_SIZE_PERC_STOP'),
+          thres_avl_size_perc_stop  => lookup('CONFIG_CINDER_NETAPP_THRES_AVL_SIZE_PERC_STOP'),
-          nfs_shares                => hiera_array('CONFIG_CINDER_NETAPP_NFS_SHARES'),
+          nfs_shares                => lookup('CONFIG_CINDER_NETAPP_NFS_SHARES', { merge => 'unique' }),
-          nfs_shares_config         => hiera('CONFIG_CINDER_NETAPP_NFS_SHARES_CONFIG'),
+          nfs_shares_config         => lookup('CONFIG_CINDER_NETAPP_NFS_SHARES_CONFIG'),
         }
 
         ensure_packages(['nfs-utils'], {'ensure' => 'present'})
       }
       elsif $netapp_storage_protocol == 'iscsi' {
         cinder::backend::netapp { $netapp_backend_name:
-          netapp_login            => hiera('CONFIG_CINDER_NETAPP_LOGIN'),
+          netapp_login            => lookup('CONFIG_CINDER_NETAPP_LOGIN'),
-          netapp_password         => hiera('CONFIG_CINDER_NETAPP_PASSWORD'),
+          netapp_password         => lookup('CONFIG_CINDER_NETAPP_PASSWORD'),
-          netapp_server_hostname  => hiera('CONFIG_CINDER_NETAPP_HOSTNAME'),
+          netapp_server_hostname  => lookup('CONFIG_CINDER_NETAPP_HOSTNAME'),
-          netapp_server_port      => hiera('CONFIG_CINDER_NETAPP_SERVER_PORT'),
+          netapp_server_port      => lookup('CONFIG_CINDER_NETAPP_SERVER_PORT'),
-          netapp_size_multiplier  => hiera('CONFIG_CINDER_NETAPP_SIZE_MULTIPLIER'),
+          netapp_size_multiplier  => lookup('CONFIG_CINDER_NETAPP_SIZE_MULTIPLIER'),
-          netapp_storage_family   => hiera('CONFIG_CINDER_NETAPP_STORAGE_FAMILY'),
+          netapp_storage_family   => lookup('CONFIG_CINDER_NETAPP_STORAGE_FAMILY'),
-          netapp_storage_protocol => hiera('CONFIG_CINDER_NETAPP_STORAGE_PROTOCOL'),
+          netapp_storage_protocol => lookup('CONFIG_CINDER_NETAPP_STORAGE_PROTOCOL'),
-          netapp_transport_type   => hiera('CONFIG_CINDER_NETAPP_TRANSPORT_TYPE'),
+          netapp_transport_type   => lookup('CONFIG_CINDER_NETAPP_TRANSPORT_TYPE'),
-          netapp_vfiler           => hiera('CONFIG_CINDER_NETAPP_VFILER'),
+          netapp_vfiler           => lookup('CONFIG_CINDER_NETAPP_VFILER'),
-          netapp_volume_list      => hiera('CONFIG_CINDER_NETAPP_VOLUME_LIST'),
+          netapp_volume_list      => lookup('CONFIG_CINDER_NETAPP_VOLUME_LIST'),
         }
 
         ensure_packages(['iscsi-initiator-utils'], {'ensure' => 'present'})
@@ -92,34 +92,34 @@ class packstack::cinder::backend::netapp ()
 
       elsif $netapp_storage_protocol == 'fc' {
         cinder::backend::netapp { $netapp_backend_name:
-          netapp_login                => hiera('CONFIG_CINDER_NETAPP_LOGIN'),
+          netapp_login                => lookup('CONFIG_CINDER_NETAPP_LOGIN'),
-          netapp_password             => hiera('CONFIG_CINDER_NETAPP_PASSWORD'),
+          netapp_password             => lookup('CONFIG_CINDER_NETAPP_PASSWORD'),
-          netapp_server_hostname      => hiera('CONFIG_CINDER_NETAPP_HOSTNAME'),
+          netapp_server_hostname      => lookup('CONFIG_CINDER_NETAPP_HOSTNAME'),
-          netapp_server_port          => hiera('CONFIG_CINDER_NETAPP_SERVER_PORT'),
+          netapp_server_port          => lookup('CONFIG_CINDER_NETAPP_SERVER_PORT'),
-          netapp_size_multiplier      => hiera('CONFIG_CINDER_NETAPP_SIZE_MULTIPLIER'),
+          netapp_size_multiplier      => lookup('CONFIG_CINDER_NETAPP_SIZE_MULTIPLIER'),
-          netapp_storage_family       => hiera('CONFIG_CINDER_NETAPP_STORAGE_FAMILY'),
+          netapp_storage_family       => lookup('CONFIG_CINDER_NETAPP_STORAGE_FAMILY'),
-          netapp_storage_protocol     => hiera('CONFIG_CINDER_NETAPP_STORAGE_PROTOCOL'),
+          netapp_storage_protocol     => lookup('CONFIG_CINDER_NETAPP_STORAGE_PROTOCOL'),
-          netapp_transport_type       => hiera('CONFIG_CINDER_NETAPP_TRANSPORT_TYPE'),
+          netapp_transport_type       => lookup('CONFIG_CINDER_NETAPP_TRANSPORT_TYPE'),
-          netapp_vfiler               => hiera('CONFIG_CINDER_NETAPP_VFILER'),
+          netapp_vfiler               => lookup('CONFIG_CINDER_NETAPP_VFILER'),
-          netapp_partner_backend_name => hiera('CONFIG_CINDER_NETAPP_PARTNER_BACKEND_NAME'),
+          netapp_partner_backend_name => lookup('CONFIG_CINDER_NETAPP_PARTNER_BACKEND_NAME'),
-          netapp_volume_list          => hiera('CONFIG_CINDER_NETAPP_VOLUME_LIST'),
+          netapp_volume_list          => lookup('CONFIG_CINDER_NETAPP_VOLUME_LIST'),
         }
       }
     }
     elsif $netapp_storage_family == 'eseries' {
       cinder::backend::netapp { $netapp_backend_name:
-        netapp_login             => hiera('CONFIG_CINDER_NETAPP_LOGIN'),
+        netapp_login             => lookup('CONFIG_CINDER_NETAPP_LOGIN'),
-        netapp_password          => hiera('CONFIG_CINDER_NETAPP_PASSWORD'),
+        netapp_password          => lookup('CONFIG_CINDER_NETAPP_PASSWORD'),
-        netapp_server_hostname   => hiera('CONFIG_CINDER_NETAPP_HOSTNAME'),
+        netapp_server_hostname   => lookup('CONFIG_CINDER_NETAPP_HOSTNAME'),
-        netapp_server_port       => hiera('CONFIG_CINDER_NETAPP_SERVER_PORT'),
+        netapp_server_port       => lookup('CONFIG_CINDER_NETAPP_SERVER_PORT'),
-        netapp_storage_family    => hiera('CONFIG_CINDER_NETAPP_STORAGE_FAMILY'),
+        netapp_storage_family    => lookup('CONFIG_CINDER_NETAPP_STORAGE_FAMILY'),
-        netapp_storage_protocol  => hiera('CONFIG_CINDER_NETAPP_STORAGE_PROTOCOL'),
+        netapp_storage_protocol  => lookup('CONFIG_CINDER_NETAPP_STORAGE_PROTOCOL'),
-        netapp_transport_type    => hiera('CONFIG_CINDER_NETAPP_TRANSPORT_TYPE'),
+        netapp_transport_type    => lookup('CONFIG_CINDER_NETAPP_TRANSPORT_TYPE'),
-        netapp_controller_ips    => hiera('CONFIG_CINDER_NETAPP_CONTROLLER_IPS'),
+        netapp_controller_ips    => lookup('CONFIG_CINDER_NETAPP_CONTROLLER_IPS'),
-        netapp_sa_password       => hiera('CONFIG_CINDER_NETAPP_SA_PASSWORD'),
+        netapp_sa_password       => lookup('CONFIG_CINDER_NETAPP_SA_PASSWORD'),
-        netapp_storage_pools     => hiera('CONFIG_CINDER_NETAPP_STORAGE_POOLS'),
+        netapp_storage_pools     => lookup('CONFIG_CINDER_NETAPP_STORAGE_POOLS'),
-        netapp_eseries_host_type => hiera('CONFIG_CINDER_NETAPP_ESERIES_HOST_TYPE'),
+        netapp_eseries_host_type => lookup('CONFIG_CINDER_NETAPP_ESERIES_HOST_TYPE'),
-        netapp_webservice_path   => hiera('CONFIG_CINDER_NETAPP_WEBSERVICE_PATH'),
+        netapp_webservice_path   => lookup('CONFIG_CINDER_NETAPP_WEBSERVICE_PATH'),
       }
 
         ensure_packages(['iscsi-initiator-utils'], {'ensure' => 'present'})

packstack/puppet/modules/packstack/manifests/cinder/backend/nfs.pp

@@ -3,7 +3,7 @@ class packstack::cinder::backend::nfs ()
     ensure_packages(['nfs-utils'], {'ensure' => 'present'})
 
     cinder::backend::nfs { 'nfs':
-      nfs_servers       => hiera_array('CONFIG_CINDER_NFS_MOUNTS'),
+      nfs_servers       => lookup('CONFIG_CINDER_NFS_MOUNTS', { merge => 'unique' }),
       require           => Package['nfs-utils'],
       nfs_shares_config => '/etc/cinder/nfs_shares.conf',
     }

packstack/puppet/modules/packstack/manifests/cinder/backend/solidfire.pp

@@ -4,9 +4,9 @@ class packstack::cinder::backend::solidfire ()
     $solidfire_backend_name = 'solidfire'
 
     cinder::backend::solidfire { $solidfire_backend_name :
-        san_ip              => hiera('CONFIG_CINDER_SOLIDFIRE_LOGIN'),
+        san_ip              => lookup('CONFIG_CINDER_SOLIDFIRE_LOGIN'),
-        san_login           => hiera('CONFIG_CINDER_SOLIDFIRE_PASSWORD'),
+        san_login           => lookup('CONFIG_CINDER_SOLIDFIRE_PASSWORD'),
-        san_password        => hiera('CONFIG_CINDER_SOLIDFIRE_HOSTNAME'),
+        san_password        => lookup('CONFIG_CINDER_SOLIDFIRE_HOSTNAME'),
         volume_backend_name => $solidfire_backend_name,
     }
 

packstack/puppet/modules/packstack/manifests/cinder/backend/vmdk.pp

@@ -1,9 +1,9 @@
 class packstack::cinder::backend::vmdk ()
 {
     cinder::backend::vmdk { 'vmdk':
-      host_ip       => hiera('CONFIG_VCENTER_HOST'),
+      host_ip       => lookup('CONFIG_VCENTER_HOST'),
-      host_username => hiera('CONFIG_VCENTER_USER'),
+      host_username => lookup('CONFIG_VCENTER_USER'),
-      host_password => hiera('CONFIG_VCENTER_PASSWORD'),
+      host_password => lookup('CONFIG_VCENTER_PASSWORD'),
     }
 
     cinder_type { 'vmdk':

packstack/puppet/modules/packstack/manifests/cinder/backup.pp

@@ -2,7 +2,7 @@ class packstack::cinder::backup ()
 {
     class { 'cinder::backup': }
 
-    $cinder_backup_conf_ctrl_host = hiera('CONFIG_KEYSTONE_HOST_URL')
+    $cinder_backup_conf_ctrl_host = lookup('CONFIG_KEYSTONE_HOST_URL')
 
     class { 'cinder::backup::swift':
       backup_swift_url => "http://${cinder_backup_conf_ctrl_host}:8080/v1/AUTH_",

packstack/puppet/modules/packstack/manifests/cinder/rabbitmq.pp

@@ -1,16 +1,16 @@
 class packstack::cinder::rabbitmq ()
 {
-    $cinder_rab_cfg_cinder_db_pw = hiera('CONFIG_CINDER_DB_PW')
+    $cinder_rab_cfg_cinder_db_pw = lookup('CONFIG_CINDER_DB_PW')
-    $cinder_rab_cfg_mariadb_host = hiera('CONFIG_MARIADB_HOST_URL')
+    $cinder_rab_cfg_mariadb_host = lookup('CONFIG_MARIADB_HOST_URL')
 
-    $kombu_ssl_ca_certs = hiera('CONFIG_AMQP_SSL_CACERT_FILE', undef)
+    $kombu_ssl_ca_certs = lookup('CONFIG_AMQP_SSL_CACERT_FILE', undef, undef, undef)
-    $kombu_ssl_keyfile = hiera('CONFIG_CINDER_SSL_KEY', undef)
+    $kombu_ssl_keyfile = lookup('CONFIG_CINDER_SSL_KEY', undef, undef, undef)
-    $kombu_ssl_certfile = hiera('CONFIG_CINDER_SSL_CERT', undef)
+    $kombu_ssl_certfile = lookup('CONFIG_CINDER_SSL_CERT', undef, undef, undef)
 
-    $rabbit_host = hiera('CONFIG_AMQP_HOST_URL')
+    $rabbit_host = lookup('CONFIG_AMQP_HOST_URL')
-    $rabbit_port = hiera('CONFIG_AMQP_CLIENTS_PORT')
+    $rabbit_port = lookup('CONFIG_AMQP_CLIENTS_PORT')
-    $rabbit_userid = hiera('CONFIG_AMQP_AUTH_USER')
+    $rabbit_userid = lookup('CONFIG_AMQP_AUTH_USER')
-    $rabbit_password = hiera('CONFIG_AMQP_AUTH_PASSWORD')
+    $rabbit_password = lookup('CONFIG_AMQP_AUTH_PASSWORD')
 
     if $kombu_ssl_keyfile {
       $files_to_set_owner = [ $kombu_ssl_keyfile, $kombu_ssl_certfile ]
@@ -24,7 +24,7 @@ class packstack::cinder::rabbitmq ()
     Service<| name == 'rabbitmq-server' |> -> Service<| tag == 'cinder-service' |>
 
     class { 'cinder::logging':
-      debug => hiera('CONFIG_DEBUG_MODE'),
+      debug => lookup('CONFIG_DEBUG_MODE'),
     }
 
     class { 'cinder::db':
@@ -32,7 +32,7 @@ class packstack::cinder::rabbitmq ()
     }
 
     class { 'cinder':
-      rabbit_use_ssl        => hiera('CONFIG_AMQP_SSL_ENABLED'),
+      rabbit_use_ssl        => lookup('CONFIG_AMQP_SSL_ENABLED'),
       default_transport_url => "rabbit://${rabbit_userid}:${rabbit_password}@${rabbit_host}:${rabbit_port}/",
       kombu_ssl_ca_certs    => $kombu_ssl_ca_certs,
       kombu_ssl_keyfile     => $kombu_ssl_keyfile,

packstack/puppet/modules/packstack/manifests/firewall.pp

@@ -9,7 +9,7 @@ define packstack::firewall (
   $ports = undef,
   $proto = 'tcp'
 ) {
-  $ip_version = hiera('CONFIG_IP_VERSION')
+  $ip_version = lookup('CONFIG_IP_VERSION')
 
   $provider = $ip_version ? {
     'ipv6'  => 'ip6tables',

packstack/puppet/modules/packstack/manifests/glance.pp

@@ -1,31 +1,31 @@
 class packstack::glance ()
 {
-    create_resources(packstack::firewall, hiera('FIREWALL_GLANCE_RULES', {}))
+    create_resources(packstack::firewall, lookup('FIREWALL_GLANCE_RULES', undef, undef, {}))
 
-    $glance_ks_pw = hiera('CONFIG_GLANCE_DB_PW')
+    $glance_ks_pw = lookup('CONFIG_GLANCE_DB_PW')
-    $glance_mariadb_host = hiera('CONFIG_MARIADB_HOST_URL')
+    $glance_mariadb_host = lookup('CONFIG_MARIADB_HOST_URL')
-    $glance_cfg_ctrl_host = hiera('CONFIG_KEYSTONE_HOST_URL')
+    $glance_cfg_ctrl_host = lookup('CONFIG_KEYSTONE_HOST_URL')
 
     # glance option bind_host requires address without brackets
-    $bind_host = hiera('CONFIG_IP_VERSION') ? {
+    $bind_host = lookup('CONFIG_IP_VERSION') ? {
       'ipv6'  => '::0',
       default => '0.0.0.0',
       # TO-DO(mmagr): Add IPv6 support when hostnames are used
     }
 
-    $default_store = hiera('CONFIG_GLANCE_BACKEND') ? {
+    $default_store = lookup('CONFIG_GLANCE_BACKEND') ? {
       'swift' => 'swift',
       default => 'file',
     }
 
     class { 'glance::api::authtoken':
-      www_authenticate_uri => hiera('CONFIG_KEYSTONE_PUBLIC_URL'),
+      www_authenticate_uri => lookup('CONFIG_KEYSTONE_PUBLIC_URL'),
-      auth_url             => hiera('CONFIG_KEYSTONE_ADMIN_URL'),
+      auth_url             => lookup('CONFIG_KEYSTONE_ADMIN_URL'),
-      password             => hiera('CONFIG_GLANCE_KS_PW'),
+      password             => lookup('CONFIG_GLANCE_KS_PW'),
     }
 
     class { 'glance::api::logging':
-      debug => hiera('CONFIG_DEBUG_MODE'),
+      debug => lookup('CONFIG_DEBUG_MODE'),
     }
 
     class { 'glance::api::db':
@@ -35,7 +35,7 @@ class packstack::glance ()
     class { 'glance::api':
       bind_host           => $bind_host,
       pipeline            => 'keystone',
-      workers             => hiera('CONFIG_SERVICE_WORKERS'),
+      workers             => lookup('CONFIG_SERVICE_WORKERS'),
       enabled_backends    => ["${default_store}:${default_store}", "http:http"],
       default_backend     => $default_store,
     }

packstack/puppet/modules/packstack/manifests/glance/backend/swift.pp

@@ -2,15 +2,15 @@ class packstack::glance::backend::swift ()
 {
     Service<| tag == 'swift-service' |> -> Service['glance-api']
 
-    $swift_auth_version = hiera('CONFIG_KEYSTONE_API_VERSION') ? {
+    $swift_auth_version = lookup('CONFIG_KEYSTONE_API_VERSION') ? {
       'v2.0'  => '2',
       default => '3',
     }
 
     glance::backend::multistore::swift { 'swift':
       swift_store_user                    => 'services:glance',
-      swift_store_key                     => hiera('CONFIG_GLANCE_KS_PW'),
+      swift_store_key                     => lookup('CONFIG_GLANCE_KS_PW'),
-      swift_store_auth_address            => hiera('CONFIG_KEYSTONE_PUBLIC_URL'),
+      swift_store_auth_address            => lookup('CONFIG_KEYSTONE_PUBLIC_URL'),
       swift_store_container               => 'glance',
       swift_store_auth_version            => $swift_auth_version,
       swift_store_large_object_size       => '5120',

packstack/puppet/modules/packstack/manifests/glance/ceilometer.pp

@@ -1,13 +1,13 @@
 class packstack::glance::ceilometer ()
 {
-    $kombu_ssl_ca_certs = hiera('CONFIG_AMQP_SSL_CACERT_FILE', undef)
+    $kombu_ssl_ca_certs = lookup('CONFIG_AMQP_SSL_CACERT_FILE', undef, undef, undef)
-    $kombu_ssl_keyfile = hiera('CONFIG_GLANCE_SSL_KEY', undef)
+    $kombu_ssl_keyfile = lookup('CONFIG_GLANCE_SSL_KEY', undef, undef, undef)
-    $kombu_ssl_certfile = hiera('CONFIG_GLANCE_SSL_CERT', undef)
+    $kombu_ssl_certfile = lookup('CONFIG_GLANCE_SSL_CERT', undef, undef, undef)
 
-    $rabbit_host = hiera('CONFIG_AMQP_HOST_URL')
+    $rabbit_host = lookup('CONFIG_AMQP_HOST_URL')
-    $rabbit_port = hiera('CONFIG_AMQP_CLIENTS_PORT')
+    $rabbit_port = lookup('CONFIG_AMQP_CLIENTS_PORT')
-    $rabbit_userid = hiera('CONFIG_AMQP_AUTH_USER')
+    $rabbit_userid = lookup('CONFIG_AMQP_AUTH_USER')
-    $rabbit_password = hiera('CONFIG_AMQP_AUTH_PASSWORD')
+    $rabbit_password = lookup('CONFIG_AMQP_AUTH_PASSWORD')
 
     if $kombu_ssl_keyfile {
       $files_to_set_owner = [ $kombu_ssl_keyfile, $kombu_ssl_certfile ]
@@ -22,7 +22,7 @@ class packstack::glance::ceilometer ()
 
     class { 'glance::notify::rabbitmq':
       rabbit_notification_topic => 'notifications',
-      rabbit_use_ssl            => hiera('CONFIG_AMQP_SSL_ENABLED'),
+      rabbit_use_ssl            => lookup('CONFIG_AMQP_SSL_ENABLED'),
       default_transport_url     => "rabbit://${rabbit_userid}:${rabbit_password}@${rabbit_host}:${rabbit_port}/",
       kombu_ssl_ca_certs        => $kombu_ssl_ca_certs,
       kombu_ssl_keyfile         => $kombu_ssl_keyfile,

packstack/puppet/modules/packstack/manifests/gnocchi.pp

@@ -1,12 +1,12 @@
 class packstack::gnocchi ()
 {
-    create_resources(packstack::firewall, hiera('FIREWALL_GNOCCHI_RULES', {}))
+    create_resources(packstack::firewall, lookup('FIREWALL_GNOCCHI_RULES', undef, undef, {}))
 
-    $gnocchi_cfg_db_pw = hiera('CONFIG_GNOCCHI_DB_PW')
+    $gnocchi_cfg_db_pw = lookup('CONFIG_GNOCCHI_DB_PW')
-    $gnocchi_cfg_mariadb_host = hiera('CONFIG_MARIADB_HOST_URL')
+    $gnocchi_cfg_mariadb_host = lookup('CONFIG_MARIADB_HOST_URL')
 
     class { 'gnocchi::wsgi::apache':
-      workers => hiera('CONFIG_SERVICE_WORKERS'),
+      workers => lookup('CONFIG_SERVICE_WORKERS'),
       ssl     => false
     }
 
@@ -14,10 +14,10 @@ class packstack::gnocchi ()
     }
 
     class { 'gnocchi::keystone::authtoken':
-      www_authenticate_uri => hiera('CONFIG_KEYSTONE_PUBLIC_URL'),
+      www_authenticate_uri => lookup('CONFIG_KEYSTONE_PUBLIC_URL'),
-      auth_url             => hiera('CONFIG_KEYSTONE_ADMIN_URL'),
+      auth_url             => lookup('CONFIG_KEYSTONE_ADMIN_URL'),
-      auth_version         => hiera('CONFIG_KEYSTONE_API_VERSION'),
+      auth_version         => lookup('CONFIG_KEYSTONE_API_VERSION'),
-      password             => hiera('CONFIG_GNOCCHI_KS_PW')
+      password             => lookup('CONFIG_GNOCCHI_KS_PW')
     }
 
     class { 'gnocchi::db':

packstack/puppet/modules/packstack/manifests/heat.pp

@@ -1,24 +1,24 @@
 class packstack::heat ()
 {
-    create_resources(packstack::firewall, hiera('FIREWALL_HEAT_RULES', {}))
+    create_resources(packstack::firewall, lookup('FIREWALL_HEAT_RULES', undef, undef, {}))
 
     class { 'heat::api':
-      workers => hiera('CONFIG_SERVICE_WORKERS'),
+      workers => lookup('CONFIG_SERVICE_WORKERS'),
     }
 
-    $keystone_admin = hiera('CONFIG_KEYSTONE_ADMIN_USERNAME')
+    $keystone_admin = lookup('CONFIG_KEYSTONE_ADMIN_USERNAME')
-    $heat_cfg_ctrl_host = hiera('CONFIG_KEYSTONE_HOST_URL')
+    $heat_cfg_ctrl_host = lookup('CONFIG_KEYSTONE_HOST_URL')
 
     class { 'heat::engine':
       heat_metadata_server_url      => "http://${heat_cfg_ctrl_host}:8000",
       heat_waitcondition_server_url => "http://${heat_cfg_ctrl_host}:8000/v1/waitcondition",
-      auth_encryption_key           => hiera('CONFIG_HEAT_AUTH_ENC_KEY'),
+      auth_encryption_key           => lookup('CONFIG_HEAT_AUTH_ENC_KEY'),
-      num_engine_workers            => hiera('CONFIG_SERVICE_WORKERS'),
+      num_engine_workers            => lookup('CONFIG_SERVICE_WORKERS'),
     }
 
     class { 'heat::keystone::domain':
-      domain_name     => hiera('CONFIG_HEAT_DOMAIN'),
+      domain_name     => lookup('CONFIG_HEAT_DOMAIN'),
-      domain_admin    => hiera('CONFIG_HEAT_DOMAIN_ADMIN'),
+      domain_admin    => lookup('CONFIG_HEAT_DOMAIN_ADMIN'),
-      domain_password => hiera('CONFIG_HEAT_DOMAIN_PASSWORD'),
+      domain_password => lookup('CONFIG_HEAT_DOMAIN_PASSWORD'),
     }
 }

packstack/puppet/modules/packstack/manifests/heat/cfn.pp

@@ -1,17 +1,17 @@
 class packstack::heat::cfn ()
 {
-    create_resources(packstack::firewall, hiera('FIREWALL_HEAT_CFN_RULES', {}))
+    create_resources(packstack::firewall, lookup('FIREWALL_HEAT_CFN_RULES', undef, undef, {}))
 
     class { 'heat::api_cfn':
-      workers => hiera('CONFIG_SERVICE_WORKERS'),
+      workers => lookup('CONFIG_SERVICE_WORKERS'),
     }
 
-    $heat_cfn_cfg_ctrl_host = hiera('CONFIG_KEYSTONE_HOST_URL')
+    $heat_cfn_cfg_ctrl_host = lookup('CONFIG_KEYSTONE_HOST_URL')
 
     class { 'heat::keystone::auth_cfn':
       admin_url    => "http://${heat_cfn_cfg_ctrl_host}:8000/v1",
       public_url   => "http://${heat_cfn_cfg_ctrl_host}:8000/v1",
       internal_url => "http://${heat_cfn_cfg_ctrl_host}:8000/v1",
-      password     => hiera('CONFIG_HEAT_KS_PW'),
+      password     => lookup('CONFIG_HEAT_KS_PW'),
     }
 }

packstack/puppet/modules/packstack/manifests/heat/rabbitmq.pp

@@ -1,16 +1,16 @@
 class packstack::heat::rabbitmq ()
 {
-    $heat_rabbitmq_cfg_heat_db_pw = hiera('CONFIG_HEAT_DB_PW')
+    $heat_rabbitmq_cfg_heat_db_pw = lookup('CONFIG_HEAT_DB_PW')
-    $heat_rabbitmq_cfg_mariadb_host = hiera('CONFIG_MARIADB_HOST_URL')
+    $heat_rabbitmq_cfg_mariadb_host = lookup('CONFIG_MARIADB_HOST_URL')
 
-    $kombu_ssl_ca_certs = hiera('CONFIG_AMQP_SSL_CACERT_FILE', $::os_service_default)
+    $kombu_ssl_ca_certs = lookup('CONFIG_AMQP_SSL_CACERT_FILE', undef, undef, $::os_service_default)
-    $kombu_ssl_keyfile = hiera('CONFIG_HEAT_SSL_KEY', $::os_service_default)
+    $kombu_ssl_keyfile = lookup('CONFIG_HEAT_SSL_KEY', undef, undef, $::os_service_default)
-    $kombu_ssl_certfile = hiera('CONFIG_HEAT_SSL_CERT', $::os_service_default)
+    $kombu_ssl_certfile = lookup('CONFIG_HEAT_SSL_CERT', undef, undef, $::os_service_default)
 
-    $rabbit_host = hiera('CONFIG_AMQP_HOST_URL')
+    $rabbit_host = lookup('CONFIG_AMQP_HOST_URL')
-    $rabbit_port = hiera('CONFIG_AMQP_CLIENTS_PORT')
+    $rabbit_port = lookup('CONFIG_AMQP_CLIENTS_PORT')
-    $rabbit_userid = hiera('CONFIG_AMQP_AUTH_USER')
+    $rabbit_userid = lookup('CONFIG_AMQP_AUTH_USER')
-    $rabbit_password = hiera('CONFIG_AMQP_AUTH_PASSWORD')
+    $rabbit_password = lookup('CONFIG_AMQP_AUTH_PASSWORD')
 
     if ! is_service_default($kombu_ssl_keyfile) {
       $files_to_set_owner = [ $kombu_ssl_keyfile, $kombu_ssl_certfile ]
@@ -23,20 +23,20 @@ class packstack::heat::rabbitmq ()
     }
     Service<| name == 'rabbitmq-server' |> -> Service<| tag == 'heat-service' |>
 
-    if hiera('CONFIG_CEILOMETER_INSTALL') == 'y' {
+    if lookup('CONFIG_CEILOMETER_INSTALL') == 'y' {
       $heat_notification_driver = 'messagingv2'
     } else {
       $heat_notification_driver = $::os_service_default
     }
 
     class { 'heat::keystone::authtoken':
-      password             => hiera('CONFIG_HEAT_KS_PW'),
+      password             => lookup('CONFIG_HEAT_KS_PW'),
-      www_authenticate_uri => hiera('CONFIG_KEYSTONE_PUBLIC_URL'),
+      www_authenticate_uri => lookup('CONFIG_KEYSTONE_PUBLIC_URL'),
-      auth_url             => hiera('CONFIG_KEYSTONE_ADMIN_URL'),
+      auth_url             => lookup('CONFIG_KEYSTONE_ADMIN_URL'),
     }
 
     class { 'heat::logging':
-      debug => hiera('CONFIG_DEBUG_MODE'),
+      debug => lookup('CONFIG_DEBUG_MODE'),
     }
 
     class { 'heat::db':
@@ -44,8 +44,8 @@ class packstack::heat::rabbitmq ()
     }
 
     class { 'heat':
-      keystone_ec2_uri      => hiera('CONFIG_KEYSTONE_PUBLIC_URL'),
+      keystone_ec2_uri      => lookup('CONFIG_KEYSTONE_PUBLIC_URL'),
-      rabbit_use_ssl        => hiera('CONFIG_AMQP_SSL_ENABLED'),
+      rabbit_use_ssl        => lookup('CONFIG_AMQP_SSL_ENABLED'),
       default_transport_url => "rabbit://${rabbit_userid}:${rabbit_password}@${rabbit_host}:${rabbit_port}/",
       kombu_ssl_ca_certs    => $kombu_ssl_ca_certs,
       kombu_ssl_keyfile     => $kombu_ssl_keyfile,

packstack/puppet/modules/packstack/manifests/horizon.pp

@@ -1,26 +1,26 @@
 class packstack::horizon ()
 {
-    $is_django_debug = hiera('CONFIG_DEBUG_MODE') ? {
+    $is_django_debug = lookup('CONFIG_DEBUG_MODE') ? {
       true  => 'True',
       false => 'False',
     }
 
-    $bind_host = hiera('CONFIG_IP_VERSION') ? {
+    $bind_host = lookup('CONFIG_IP_VERSION') ? {
       'ipv6'  => '::0',
       default => '0.0.0.0',
       # TO-DO(mmagr): Add IPv6 support when hostnames are used
     }
 
-    $horizon_ssl = hiera('CONFIG_HORIZON_SSL') ? {
+    $horizon_ssl = lookup('CONFIG_HORIZON_SSL') ? {
       'y' => true,
       'n' => false,
     }
 
     class { 'horizon':
-      secret_key            => hiera('CONFIG_HORIZON_SECRET_KEY'),
+      secret_key            => lookup('CONFIG_HORIZON_SECRET_KEY'),
-      keystone_url          => hiera('CONFIG_KEYSTONE_PUBLIC_URL'),
+      keystone_url          => lookup('CONFIG_KEYSTONE_PUBLIC_URL'),
       keystone_default_role => '_member_',
-      server_aliases        => [hiera('CONFIG_CONTROLLER_HOST'), $::fqdn, 'localhost'],
+      server_aliases        => [lookup('CONFIG_CONTROLLER_HOST'), $::fqdn, 'localhost'],
       allowed_hosts         => '*',
       hypervisor_options    => {'can_set_mount_point' => false, },
       django_debug          => $is_django_debug,
@@ -30,39 +30,39 @@ class packstack::horizon ()
       cache_server_port     => '11211',
       file_upload_temp_dir  => '/var/tmp',
       listen_ssl            => $horizon_ssl,
-      ssl_cert              => hiera('CONFIG_HORIZON_SSL_CERT', undef),
+      ssl_cert              => lookup('CONFIG_HORIZON_SSL_CERT', undef, undef, undef),
-      ssl_key               => hiera('CONFIG_HORIZON_SSL_KEY', undef),
+      ssl_key               => lookup('CONFIG_HORIZON_SSL_KEY', undef, undef, undef),
-      ssl_ca                => hiera('CONFIG_HORIZON_SSL_CACERT', undef),
+      ssl_ca                => lookup('CONFIG_HORIZON_SSL_CACERT', undef, undef, undef),
       ssl_verify_client     => 'optional',
       neutron_options       => {
-        'enable_vpn'      => hiera('CONFIG_HORIZON_NEUTRON_VPN'),
+        'enable_vpn'      => lookup('CONFIG_HORIZON_NEUTRON_VPN'),
-        'enable_lb'       => hiera('CONFIG_HORIZON_NEUTRON_LB'),
+        'enable_lb'       => lookup('CONFIG_HORIZON_NEUTRON_LB'),
       },
     }
 
-    if hiera('CONFIG_MAGNUM_INSTALL') == 'y' {
+    if lookup('CONFIG_MAGNUM_INSTALL') == 'y' {
       ensure_packages(['openstack-magnum-ui'], {'ensure' => 'present'})
     }
 
-    if hiera('CONFIG_IRONIC_INSTALL') == 'y' {
+    if lookup('CONFIG_IRONIC_INSTALL') == 'y' {
       ensure_packages(['openstack-ironic-ui'], {'ensure' => 'present'})
     }
 
-    if hiera('CONFIG_TROVE_INSTALL') == 'y' {
+    if lookup('CONFIG_TROVE_INSTALL') == 'y' {
       ensure_packages(['openstack-trove-ui'], {'ensure' => 'present'})
     }
 
-    if hiera('CONFIG_SAHARA_INSTALL') == 'y' {
+    if lookup('CONFIG_SAHARA_INSTALL') == 'y' {
       ensure_packages(['openstack-sahara-ui'], {'ensure' => 'present'})
     }
 
-    if hiera('CONFIG_HEAT_INSTALL') == 'y' {
+    if lookup('CONFIG_HEAT_INSTALL') == 'y' {
       ensure_packages(['openstack-heat-ui'], {'ensure' => 'present'})
     }
 
     include packstack::memcached
 
-    $firewall_port = hiera('CONFIG_HORIZON_PORT')
+    $firewall_port = lookup('CONFIG_HORIZON_PORT')
 
     firewall { "001 horizon ${firewall_port} incoming":
       proto  => 'tcp',

packstack/puppet/modules/packstack/manifests/ironic.pp

@@ -1,14 +1,14 @@
 class packstack::ironic ()
 {
-    create_resources(packstack::firewall, hiera('FIREWALL_IRONIC_API_RULES', {}))
+    create_resources(packstack::firewall, lookup('FIREWALL_IRONIC_API_RULES', undef, undef, {}))
 
     ironic_config {
-      'glance/glance_host': value => hiera('CONFIG_STORAGE_HOST_URL');
+      'glance/glance_host': value => lookup('CONFIG_STORAGE_HOST_URL');
     }
 
     class { 'ironic::api::authtoken':
-      www_authenticate_uri => hiera('CONFIG_KEYSTONE_PUBLIC_URL'),
+      www_authenticate_uri => lookup('CONFIG_KEYSTONE_PUBLIC_URL'),
-      password             => hiera('CONFIG_IRONIC_KS_PW'),
+      password             => lookup('CONFIG_IRONIC_KS_PW'),
     }
 
     class { 'ironic::api': }

packstack/puppet/modules/packstack/manifests/ironic/rabbitmq.pp

@@ -1,16 +1,16 @@
 class packstack::ironic::rabbitmq ()
 {
-    $ironic_rabbitmq_cfg_ironic_db_pw = hiera('CONFIG_IRONIC_DB_PW')
+    $ironic_rabbitmq_cfg_ironic_db_pw = lookup('CONFIG_IRONIC_DB_PW')
-    $ironic_rabbitmq_cfg_mariadb_host = hiera('CONFIG_MARIADB_HOST_URL')
+    $ironic_rabbitmq_cfg_mariadb_host = lookup('CONFIG_MARIADB_HOST_URL')
 
-    $kombu_ssl_ca_certs = hiera('CONFIG_AMQP_SSL_CACERT_FILE', undef)
+    $kombu_ssl_ca_certs = lookup('CONFIG_AMQP_SSL_CACERT_FILE', undef, undef, undef)
-    $kombu_ssl_keyfile = hiera('CONFIG_IRONIC_SSL_KEY', undef)
+    $kombu_ssl_keyfile = lookup('CONFIG_IRONIC_SSL_KEY', undef, undef, undef)
-    $kombu_ssl_certfile = hiera('CONFIG_IRONIC_SSL_CERT', undef)
+    $kombu_ssl_certfile = lookup('CONFIG_IRONIC_SSL_CERT', undef, undef, undef)
 
-    $rabbit_host = hiera('CONFIG_AMQP_HOST_URL')
+    $rabbit_host = lookup('CONFIG_AMQP_HOST_URL')
-    $rabbit_port = hiera('CONFIG_AMQP_CLIENTS_PORT')
+    $rabbit_port = lookup('CONFIG_AMQP_CLIENTS_PORT')
-    $rabbit_userid = hiera('CONFIG_AMQP_AUTH_USER')
+    $rabbit_userid = lookup('CONFIG_AMQP_AUTH_USER')
-    $rabbit_password = hiera('CONFIG_AMQP_AUTH_PASSWORD')
+    $rabbit_password = lookup('CONFIG_AMQP_AUTH_PASSWORD')
 
     if $kombu_ssl_keyfile {
       $files_to_set_owner = [ $kombu_ssl_keyfile, $kombu_ssl_certfile ]
@@ -32,7 +32,7 @@ class packstack::ironic::rabbitmq ()
     }
 
     class { 'ironic':
-      rabbit_use_ssl        => hiera('CONFIG_AMQP_SSL_ENABLED'),
+      rabbit_use_ssl        => lookup('CONFIG_AMQP_SSL_ENABLED'),
       default_transport_url => "rabbit://${rabbit_userid}:${rabbit_password}@${rabbit_host}:${rabbit_port}/",
       kombu_ssl_ca_certs    => $kombu_ssl_ca_certs,
       kombu_ssl_keyfile     => $kombu_ssl_keyfile,

packstack/puppet/modules/packstack/manifests/keystone.pp

@@ -1,17 +1,17 @@
 class packstack::keystone ()
 {
-    create_resources(packstack::firewall, hiera('FIREWALL_KEYSTONE_RULES', {}))
+    create_resources(packstack::firewall, lookup('FIREWALL_KEYSTONE_RULES', undef, undef, {}))
 
     $keystone_use_ssl = false
-    $keystone_cfg_ks_db_pw = hiera('CONFIG_KEYSTONE_DB_PW')
+    $keystone_cfg_ks_db_pw = lookup('CONFIG_KEYSTONE_DB_PW')
-    $keystone_cfg_mariadb_host = hiera('CONFIG_MARIADB_HOST_URL')
+    $keystone_cfg_mariadb_host = lookup('CONFIG_MARIADB_HOST_URL')
-    $keystone_token_provider_str = downcase(hiera('CONFIG_KEYSTONE_TOKEN_FORMAT'))
+    $keystone_token_provider_str = downcase(lookup('CONFIG_KEYSTONE_TOKEN_FORMAT'))
-    $keystone_url = regsubst(regsubst(hiera('CONFIG_KEYSTONE_PUBLIC_URL'),'/v2.0',''),'/v3','')
+    $keystone_url = regsubst(regsubst(lookup('CONFIG_KEYSTONE_PUBLIC_URL'),'/v2.0',''),'/v3','')
-    $keystone_admin_url = hiera('CONFIG_KEYSTONE_ADMIN_URL')
+    $keystone_admin_url = lookup('CONFIG_KEYSTONE_ADMIN_URL')
 
     class { 'keystone::client': }
 
-    if hiera('CONFIG_KEYSTONE_FERNET_TOKEN_ROTATE_ENABLE',false) {
+    if lookup('CONFIG_KEYSTONE_FERNET_TOKEN_ROTATE_ENABLE', undef, undef, false) {
       class { 'keystone::cron::fernet_rotate':
         require     => Service['crond'],
       }
@@ -27,7 +27,7 @@ class packstack::keystone ()
     }
 
     class { 'keystone::logging':
-      debug => hiera('CONFIG_DEBUG_MODE'),
+      debug => lookup('CONFIG_DEBUG_MODE'),
     }
 
     class { 'keystone::db':
@@ -43,11 +43,11 @@ class packstack::keystone ()
     }
 
     class { 'keystone::wsgi::apache':
-      workers => hiera('CONFIG_SERVICE_WORKERS'),
+      workers => lookup('CONFIG_SERVICE_WORKERS'),
       ssl     => $keystone_use_ssl
     }
 
-    $username = hiera('CONFIG_KEYSTONE_ADMIN_USERNAME')
+    $username = lookup('CONFIG_KEYSTONE_ADMIN_USERNAME')
 
     # Ensure the default _member_ role is present
     keystone_role { '_member_':
@@ -55,21 +55,21 @@ class packstack::keystone ()
     }
 
     class { 'keystone::bootstrap':
-      password     => hiera('CONFIG_KEYSTONE_ADMIN_PW'),
+      password     => lookup('CONFIG_KEYSTONE_ADMIN_PW'),
       username     => $username,
-      email        => hiera('CONFIG_KEYSTONE_ADMIN_EMAIL'),
+      email        => lookup('CONFIG_KEYSTONE_ADMIN_EMAIL'),
       project_name => 'admin',
       role_name    => 'admin',
       admin_url    => $keystone_admin_url,
       public_url   => $keystone_url,
       internal_url => $keystone_url,
-      region       => hiera('CONFIG_KEYSTONE_REGION'),
+      region       => lookup('CONFIG_KEYSTONE_REGION'),
     }
 
     # default assignment driver is SQL
     $assignment_driver = 'keystone.assignment.backends.sql.Assignment'
 
-    if hiera('CONFIG_KEYSTONE_IDENTITY_BACKEND') == 'ldap' {
+    if lookup('CONFIG_KEYSTONE_IDENTITY_BACKEND') == 'ldap' {
 
       if hiera_undef('CONFIG_KEYSTONE_LDAP_USER_ENABLED_EMULATION_DN', undef) {
         $user_enabled_emulation = true

packstack/puppet/modules/packstack/manifests/keystone/aodh.pp

@@ -1,10 +1,10 @@
 class packstack::keystone::aodh ()
 {
-    $keystone_host_url = hiera('CONFIG_KEYSTONE_HOST_URL')
+    $keystone_host_url = lookup('CONFIG_KEYSTONE_HOST_URL')
 
     class { 'aodh::keystone::auth':
-      region       => hiera('CONFIG_KEYSTONE_REGION'),
+      region       => lookup('CONFIG_KEYSTONE_REGION'),
-      password     => hiera('CONFIG_AODH_KS_PW'),
+      password     => lookup('CONFIG_AODH_KS_PW'),
       public_url   => "http://${keystone_host_url}:8042",
       admin_url    => "http://${keystone_host_url}:8042",
       internal_url => "http://${keystone_host_url}:8042",

packstack/puppet/modules/packstack/manifests/keystone/ceilometer.pp

@@ -1,7 +1,7 @@
 class packstack::keystone::ceilometer ()
 {
     class { 'ceilometer::keystone::auth':
-      region       => hiera('CONFIG_KEYSTONE_REGION'),
+      region       => lookup('CONFIG_KEYSTONE_REGION'),
-      password     => hiera('CONFIG_CEILOMETER_KS_PW'),
+      password     => lookup('CONFIG_CEILOMETER_KS_PW'),
     }
 }

packstack/puppet/modules/packstack/manifests/keystone/cinder.pp

@@ -1,13 +1,13 @@
 class packstack::keystone::cinder ()
 {
     $cinder_protocol = 'http'
-    $cinder_host = hiera('CONFIG_STORAGE_HOST_URL')
+    $cinder_host = lookup('CONFIG_STORAGE_HOST_URL')
     $cinder_port = '8776'
     $cinder_url = "${cinder_protocol}://${cinder_host}:${cinder_port}"
 
     class { 'cinder::keystone::auth':
-      region          => hiera('CONFIG_KEYSTONE_REGION'),
+      region          => lookup('CONFIG_KEYSTONE_REGION'),
-      password        => hiera('CONFIG_CINDER_KS_PW'),
+      password        => lookup('CONFIG_CINDER_KS_PW'),
       public_url_v3   => "${cinder_url}/v3",
       internal_url_v3 => "${cinder_url}/v3",
       admin_url_v3    => "${cinder_url}/v3",

packstack/puppet/modules/packstack/manifests/keystone/glance.pp

@@ -2,12 +2,12 @@ class packstack::keystone::glance ()
 {
     $glance_protocol = 'http'
     $glance_port = '9292'
-    $glance_api_host = hiera('CONFIG_STORAGE_HOST_URL')
+    $glance_api_host = lookup('CONFIG_STORAGE_HOST_URL')
     $glance_url = "${glance_protocol}://${glance_api_host}:${glance_port}"
 
     class { 'glance::keystone::auth':
-      region       => hiera('CONFIG_KEYSTONE_REGION'),
+      region       => lookup('CONFIG_KEYSTONE_REGION'),
-      password     => hiera('CONFIG_GLANCE_KS_PW'),
+      password     => lookup('CONFIG_GLANCE_KS_PW'),
       public_url   => $glance_url,
       admin_url    => $glance_url,
       internal_url => $glance_url,

packstack/puppet/modules/packstack/manifests/keystone/gnocchi.pp

@@ -1,10 +1,10 @@
 class packstack::keystone::gnocchi ()
 {
-    $gnocchi_keystone_host_url = hiera('CONFIG_KEYSTONE_HOST_URL')
+    $gnocchi_keystone_host_url = lookup('CONFIG_KEYSTONE_HOST_URL')
 
     class { 'gnocchi::keystone::auth':
-      region       => hiera('CONFIG_KEYSTONE_REGION'),
+      region       => lookup('CONFIG_KEYSTONE_REGION'),
-      password     => hiera('CONFIG_GNOCCHI_KS_PW'),
+      password     => lookup('CONFIG_GNOCCHI_KS_PW'),
       public_url   => "http://${gnocchi_keystone_host_url}:8041",
       admin_url    => "http://${gnocchi_keystone_host_url}:8041",
       internal_url => "http://${gnocchi_keystone_host_url}:8041",

packstack/puppet/modules/packstack/manifests/keystone/heat.pp

@@ -2,13 +2,13 @@ class packstack::keystone::heat ()
 {
     $heat_protocol = 'http'
     $heat_port = '8004'
-    $heat_api_host = hiera('CONFIG_KEYSTONE_HOST_URL')
+    $heat_api_host = lookup('CONFIG_KEYSTONE_HOST_URL')
     $heat_url = "${heat_protocol}://${heat_api_host}:${heat_port}/v1/%(tenant_id)s"
 
     # heat::keystone::auth
     class { 'heat::keystone::auth':
-      region                    => hiera('CONFIG_KEYSTONE_REGION'),
+      region                    => lookup('CONFIG_KEYSTONE_REGION'),
-      password                  => hiera('CONFIG_HEAT_KS_PW'),
+      password                  => lookup('CONFIG_HEAT_KS_PW'),
       public_url                => $heat_url,
       admin_url                 => $heat_url,
       internal_url              => $heat_url,

packstack/puppet/modules/packstack/manifests/keystone/ironic.pp

@@ -1,13 +1,13 @@
 class packstack::keystone::ironic ()
 {
     $ironic_protocol = 'http'
-    $ironic_host = hiera('CONFIG_KEYSTONE_HOST_URL')
+    $ironic_host = lookup('CONFIG_KEYSTONE_HOST_URL')
     $ironic_port = '6385'
     $ironic_url = "${ironic_protocol}://${ironic_host}:${ironic_port}"
 
     class { 'ironic::keystone::auth':
-        region       => hiera('CONFIG_KEYSTONE_REGION'),
+        region       => lookup('CONFIG_KEYSTONE_REGION'),
-        password     => hiera('CONFIG_IRONIC_KS_PW'),
+        password     => lookup('CONFIG_IRONIC_KS_PW'),
         public_url   => $ironic_url,
         admin_url    => $ironic_url,
         internal_url => $ironic_url,

packstack/puppet/modules/packstack/manifests/keystone/magnum.pp

@@ -1,19 +1,19 @@
 class packstack::keystone::magnum ()
 {
     $magnum_protocol = 'http'
-    $magnum_host = hiera('CONFIG_KEYSTONE_HOST_URL')
+    $magnum_host = lookup('CONFIG_KEYSTONE_HOST_URL')
     $magnum_port = '9511'
     $magnum_url = "${magnum_protocol}://${magnum_host}:${magnum_port}/v1"
 
     class { 'magnum::keystone::auth':
-      region       => hiera('CONFIG_KEYSTONE_REGION'),
+      region       => lookup('CONFIG_KEYSTONE_REGION'),
-      password     => hiera('CONFIG_MAGNUM_KS_PW'),
+      password     => lookup('CONFIG_MAGNUM_KS_PW'),
       public_url   => $magnum_url,
       admin_url    => $magnum_url,
       internal_url => $magnum_url
     }
 
     class { 'magnum::keystone::domain':
-      domain_password => hiera('CONFIG_MAGNUM_KS_PW'),
+      domain_password => lookup('CONFIG_MAGNUM_KS_PW'),
     }
 }

packstack/puppet/modules/packstack/manifests/keystone/manila.pp

@@ -1,13 +1,13 @@
 class packstack::keystone::manila ()
 {
     $manila_protocol = 'http'
-    $manila_host = hiera('CONFIG_STORAGE_HOST_URL')
+    $manila_host = lookup('CONFIG_STORAGE_HOST_URL')
     $manila_port = '8786'
     $manila_url = "${manila_protocol}://${manila_host}:${manila_port}/v1/%(tenant_id)s"
     $manila_url_v2 = "${manila_protocol}://${manila_host}:${manila_port}/v2/"
 
     class { 'manila::keystone::auth':
-      password        => hiera('CONFIG_MANILA_KS_PW'),
+      password        => lookup('CONFIG_MANILA_KS_PW'),
       public_url      => $manila_url,
       admin_url       => $manila_url,
       internal_url    => $manila_url,

packstack/puppet/modules/packstack/manifests/keystone/neutron.pp

@@ -1,13 +1,13 @@
 class packstack::keystone::neutron ()
 {
     $neutron_protocol = 'http'
-    $neutron_host = hiera('CONFIG_KEYSTONE_HOST_URL')
+    $neutron_host = lookup('CONFIG_KEYSTONE_HOST_URL')
     $neutron_port = '9696'
     $neutron_url = "${neutron_protocol}://${neutron_host}:${neutron_port}"
 
     class { 'neutron::keystone::auth':
-      region       => hiera('CONFIG_KEYSTONE_REGION'),
+      region       => lookup('CONFIG_KEYSTONE_REGION'),
-      password     => hiera('CONFIG_NEUTRON_KS_PW'),
+      password     => lookup('CONFIG_NEUTRON_KS_PW'),
       public_url   => $neutron_url,
       admin_url    => $neutron_url,
       internal_url => $neutron_url,

packstack/puppet/modules/packstack/manifests/keystone/nova.pp

@@ -1,14 +1,14 @@
 class packstack::keystone::nova ()
 {
     $nova_protocol = 'http'
-    $nova_host = hiera('CONFIG_KEYSTONE_HOST_URL')
+    $nova_host = lookup('CONFIG_KEYSTONE_HOST_URL')
     $nova_port = '8774'
     $nova_url = "${nova_protocol}://${nova_host}:${nova_port}/v2.1"
 
 
     class { 'nova::keystone::auth':
-      region       => hiera('CONFIG_KEYSTONE_REGION'),
+      region       => lookup('CONFIG_KEYSTONE_REGION'),
-      password     => hiera('CONFIG_NOVA_KS_PW'),
+      password     => lookup('CONFIG_NOVA_KS_PW'),
       public_url   => $nova_url,
       admin_url    => $nova_url,
       internal_url => $nova_url,

packstack/puppet/modules/packstack/manifests/keystone/placement.pp

@@ -1,22 +1,22 @@
 class packstack::keystone::placement ()
 {
     $placement_protocol = 'http'
-    $placement_host = hiera('CONFIG_KEYSTONE_HOST_URL')
+    $placement_host = lookup('CONFIG_KEYSTONE_HOST_URL')
     $placement_port = '8778'
     $placement_url = "${placement_protocol}://${placement_host}:${placement_port}"
 
     class { 'placement::keystone::authtoken':
-      password             => hiera('CONFIG_NOVA_KS_PW'),
+      password             => lookup('CONFIG_NOVA_KS_PW'),
       user_domain_name     => 'Default',
       project_domain_name  => 'Default',
-      auth_url             => hiera('CONFIG_KEYSTONE_ADMIN_URL'),
+      auth_url             => lookup('CONFIG_KEYSTONE_ADMIN_URL'),
-      www_authenticate_uri => hiera('CONFIG_KEYSTONE_PUBLIC_URL_VERSIONLESS'),
+      www_authenticate_uri => lookup('CONFIG_KEYSTONE_PUBLIC_URL_VERSIONLESS'),
     }
 
     class { 'placement::keystone::auth':
       public_url   => $placement_url,
       internal_url => $placement_url,
       admin_url    => $placement_url,
-      password     => hiera('CONFIG_NOVA_KS_PW'),
+      password     => lookup('CONFIG_NOVA_KS_PW'),
     }
 }

packstack/puppet/modules/packstack/manifests/keystone/sahara.pp

@@ -1,12 +1,12 @@
 class packstack::keystone::sahara ()
 {
     $sahara_protocol = 'http'
-    $sahara_host = hiera('CONFIG_KEYSTONE_HOST_URL')
+    $sahara_host = lookup('CONFIG_KEYSTONE_HOST_URL')
     $sahara_port = '8386'
     $sahara_url = "${sahara_protocol}://${sahara_host}:${sahara_port}"
 
     class { 'sahara::keystone::auth':
-      password     => hiera('CONFIG_SAHARA_KS_PW'),
+      password     => lookup('CONFIG_SAHARA_KS_PW'),
       public_url   => $sahara_url,
       admin_url    => $sahara_url,
       internal_url => $sahara_url,

packstack/puppet/modules/packstack/manifests/keystone/swift.pp

@@ -1,13 +1,13 @@
 class packstack::keystone::swift ()
 {
     $swift_protocol = 'http'
-    $swift_host = hiera('CONFIG_STORAGE_HOST_URL')
+    $swift_host = lookup('CONFIG_STORAGE_HOST_URL')
     $swift_port = '8080'
     $swift_url = "${swift_protocol}://${swift_host}:${swift_port}/v1/AUTH_%(tenant_id)s"
 
     class { 'swift::keystone::auth':
-      region                => hiera('CONFIG_KEYSTONE_REGION'),
+      region                => lookup('CONFIG_KEYSTONE_REGION'),
-      password              => hiera('CONFIG_SWIFT_KS_PW'),
+      password              => lookup('CONFIG_SWIFT_KS_PW'),
       operator_roles        => ['admin', 'SwiftOperator', 'ResellerAdmin'],
       public_url            => $swift_url,
       internal_url          => $swift_url,

packstack/puppet/modules/packstack/manifests/keystone/trove.pp

@@ -1,13 +1,13 @@
 class packstack::keystone::trove ()
 {
     $trove_protocol = 'http'
-    $trove_host = hiera('CONFIG_KEYSTONE_HOST_URL')
+    $trove_host = lookup('CONFIG_KEYSTONE_HOST_URL')
     $trove_port = '8779'
     $trove_url = "${trove_protocol}://${trove_host}:${trove_port}/v1.0/%(tenant_id)s"
 
     class { 'trove::keystone::auth':
-      region       => hiera('CONFIG_KEYSTONE_REGION'),
+      region       => lookup('CONFIG_KEYSTONE_REGION'),
-      password     => hiera('CONFIG_TROVE_KS_PW'),
+      password     => lookup('CONFIG_TROVE_KS_PW'),
       public_url   => $trove_url,
       admin_url    => $trove_url,
       internal_url => $trove_url,

packstack/puppet/modules/packstack/manifests/magnum.pp

@@ -1,20 +1,20 @@
 class packstack::magnum ()
 {
-    create_resources(packstack::firewall, hiera('FIREWALL_MAGNUM_API_RULES', {}))
+    create_resources(packstack::firewall, lookup('FIREWALL_MAGNUM_API_RULES', undef, undef, {}))
 
-    $magnum_cfg_magnum_db_pw = hiera('CONFIG_MAGNUM_DB_PW')
+    $magnum_cfg_magnum_db_pw = lookup('CONFIG_MAGNUM_DB_PW')
-    $magnum_cfg_magnum_mariadb_host = hiera('CONFIG_MARIADB_HOST_URL')
+    $magnum_cfg_magnum_mariadb_host = lookup('CONFIG_MARIADB_HOST_URL')
     class { 'magnum::db':
       database_connection => "mysql+pymysql://magnum:${magnum_cfg_magnum_db_pw}@${magnum_cfg_magnum_mariadb_host}/magnum",
     }
 
-    $magnum_host = hiera('CONFIG_KEYSTONE_HOST_URL')
+    $magnum_host = lookup('CONFIG_KEYSTONE_HOST_URL')
     class { 'magnum::keystone::authtoken':
-      www_authenticate_uri => hiera('CONFIG_KEYSTONE_PUBLIC_URL_VERSIONLESS'),
+      www_authenticate_uri => lookup('CONFIG_KEYSTONE_PUBLIC_URL_VERSIONLESS'),
-      auth_url             => hiera('CONFIG_KEYSTONE_ADMIN_URL'),
+      auth_url             => lookup('CONFIG_KEYSTONE_ADMIN_URL'),
       auth_version         => 'v3',
       username             => 'magnum',
-      password             => hiera('CONFIG_MAGNUM_KS_PW'),
+      password             => lookup('CONFIG_MAGNUM_KS_PW'),
       auth_type            => 'password',
       memcached_servers    => "${magnum_host}:11211",
       project_name         => 'services'
@@ -22,8 +22,8 @@ class packstack::magnum ()
 
     class { 'magnum::keystone::keystone_auth':
       username            => 'magnum',
-      password            => hiera('CONFIG_MAGNUM_KS_PW'),
+      password            => lookup('CONFIG_MAGNUM_KS_PW'),
-      auth_url            => hiera('CONFIG_KEYSTONE_ADMIN_URL'),
+      auth_url            => lookup('CONFIG_KEYSTONE_ADMIN_URL'),
       project_name        => 'services',
       user_domain_name    => 'Default',
       project_domain_name => 'Default',
@@ -41,7 +41,7 @@ class packstack::magnum ()
     }
 
     class { 'magnum::clients':
-      region_name => hiera('CONFIG_KEYSTONE_REGION')
+      region_name => lookup('CONFIG_KEYSTONE_REGION')
     }
 
     class { 'magnum::certificates':

packstack/puppet/modules/packstack/manifests/magnum/rabbitmq.pp

@@ -1,13 +1,13 @@
 class packstack::magnum::rabbitmq ()
 {
-    $kombu_ssl_ca_certs = hiera('CONFIG_AMQP_SSL_CACERT_FILE', undef)
+    $kombu_ssl_ca_certs = lookup('CONFIG_AMQP_SSL_CACERT_FILE', undef, undef, undef)
-    $kombu_ssl_keyfile = hiera('CONFIG_MAGNUM_SSL_KEY', undef)
+    $kombu_ssl_keyfile = lookup('CONFIG_MAGNUM_SSL_KEY', undef, undef, undef)
-    $kombu_ssl_certfile = hiera('CONFIG_MAGNUM_SSL_CERT', undef)
+    $kombu_ssl_certfile = lookup('CONFIG_MAGNUM_SSL_CERT', undef, undef, undef)
 
-    $rabbit_host = hiera('CONFIG_AMQP_HOST_URL')
+    $rabbit_host = lookup('CONFIG_AMQP_HOST_URL')
-    $rabbit_port = hiera('CONFIG_AMQP_CLIENTS_PORT')
+    $rabbit_port = lookup('CONFIG_AMQP_CLIENTS_PORT')
-    $rabbit_userid = hiera('CONFIG_AMQP_AUTH_USER')
+    $rabbit_userid = lookup('CONFIG_AMQP_AUTH_USER')
-    $rabbit_password = hiera('CONFIG_AMQP_AUTH_PASSWORD')
+    $rabbit_password = lookup('CONFIG_AMQP_AUTH_PASSWORD')
 
     if $kombu_ssl_keyfile {
       $files_to_set_owner = [ $kombu_ssl_keyfile, $kombu_ssl_certfile ]
@@ -21,7 +21,7 @@ class packstack::magnum::rabbitmq ()
     Service<| name == 'rabbitmq-server' |> -> Service<| tag == 'magnum-service' |>
 
     class { 'magnum':
-      rabbit_use_ssl        => hiera('CONFIG_AMQP_SSL_ENABLED'),
+      rabbit_use_ssl        => lookup('CONFIG_AMQP_SSL_ENABLED'),
       default_transport_url => "rabbit://${rabbit_userid}:${rabbit_password}@${rabbit_host}:${rabbit_port}/",
       kombu_ssl_ca_certs    => $kombu_ssl_ca_certs,
       kombu_ssl_keyfile     => $kombu_ssl_keyfile,

packstack/puppet/modules/packstack/manifests/manila.pp

@@ -1,20 +1,20 @@
 class packstack::manila ()
 {
-    create_resources(packstack::firewall, hiera('FIREWALL_MANILA_API_RULES', {}))
+    create_resources(packstack::firewall, lookup('FIREWALL_MANILA_API_RULES', undef, undef, {}))
 
     manila_config {
-      'DEFAULT/glance_host': value => hiera('CONFIG_STORAGE_HOST_URL');
+      'DEFAULT/glance_host': value => lookup('CONFIG_STORAGE_HOST_URL');
     }
 
-    $bind_host = hiera('CONFIG_IP_VERSION') ? {
+    $bind_host = lookup('CONFIG_IP_VERSION') ? {
       'ipv6'  => '::0',
       default => '0.0.0.0',
       # TO-DO(mmagr): Add IPv6 support when hostnames are used
     }
 
     class { 'manila::keystone::authtoken':
-      password             => hiera('CONFIG_MANILA_KS_PW'),
+      password             => lookup('CONFIG_MANILA_KS_PW'),
-      www_authenticate_uri => hiera('CONFIG_KEYSTONE_PUBLIC_URL'),
+      www_authenticate_uri => lookup('CONFIG_KEYSTONE_PUBLIC_URL'),
     }
 
     class { 'manila::api':
@@ -28,6 +28,6 @@ class packstack::manila ()
     }
 
     class { 'manila::backends':
-      enabled_share_backends => hiera('CONFIG_MANILA_BACKEND'),
+      enabled_share_backends => lookup('CONFIG_MANILA_BACKEND'),
     }
 }

packstack/puppet/modules/packstack/manifests/manila/backend/generic.pp

@@ -3,17 +3,17 @@ class packstack::manila::backend::generic ()
     ensure_packages(['nfs-utils'], {'ensure' => 'present'})
 
     manila::backend::generic{ 'generic':
-      driver_handles_share_servers => hiera('CONFIG_MANILA_GENERIC_DRV_HANDLES_SHARE_SERVERS'),
+      driver_handles_share_servers => lookup('CONFIG_MANILA_GENERIC_DRV_HANDLES_SHARE_SERVERS'),
-      volume_name_template         => hiera('CONFIG_MANILA_GENERIC_VOLUME_NAME_TEMPLATE'),
+      volume_name_template         => lookup('CONFIG_MANILA_GENERIC_VOLUME_NAME_TEMPLATE'),
-      share_mount_path             => hiera('CONFIG_MANILA_GENERIC_SHARE_MOUNT_PATH'),
+      share_mount_path             => lookup('CONFIG_MANILA_GENERIC_SHARE_MOUNT_PATH'),
     }
 
     packstack::manila::network{ 'generic': }
 
-    $admin_username = hiera('CONFIG_KEYSTONE_ADMIN_USERNAME')
+    $admin_username = lookup('CONFIG_KEYSTONE_ADMIN_USERNAME')
-    $admin_password = hiera('CONFIG_KEYSTONE_ADMIN_PW')
+    $admin_password = lookup('CONFIG_KEYSTONE_ADMIN_PW')
     $admin_tenant   = 'admin'
-    $keystone_url   = hiera('CONFIG_KEYSTONE_PUBLIC_URL')
+    $keystone_url   = lookup('CONFIG_KEYSTONE_PUBLIC_URL')
 
     nova_flavor { 'm1.manila':
       ensure  => present,
@@ -24,21 +24,21 @@ class packstack::manila::backend::generic ()
       require => [ Class['::nova::api'], Class['::nova::keystone::auth'] ],
     }
     -> manila::service_instance{ 'generic':
-      service_image_location     => hiera('CONFIG_MANILA_SERVICE_IMAGE_LOCATION'),
+      service_image_location     => lookup('CONFIG_MANILA_SERVICE_IMAGE_LOCATION'),
-      service_instance_user      => hiera('CONFIG_MANILA_SERVICE_INSTANCE_USER'),
+      service_instance_user      => lookup('CONFIG_MANILA_SERVICE_INSTANCE_USER'),
-      service_instance_password  => hiera('CONFIG_MANILA_SERVICE_INSTANCE_PASSWORD'),
+      service_instance_password  => lookup('CONFIG_MANILA_SERVICE_INSTANCE_PASSWORD'),
       service_instance_flavor_id => 66,
     }
 
     class { 'manila::compute::nova':
       auth_type => 'password',
-      auth_url  => hiera('CONFIG_KEYSTONE_PUBLIC_URL_VERSIONLESS'),
+      auth_url  => lookup('CONFIG_KEYSTONE_PUBLIC_URL_VERSIONLESS'),
-      password  => hiera('CONFIG_NOVA_KS_PW'),
+      password  => lookup('CONFIG_NOVA_KS_PW'),
     }
 
     class { 'manila::volume::cinder':
       auth_type => 'password',
-      auth_url  => hiera('CONFIG_KEYSTONE_PUBLIC_URL_VERSIONLESS'),
+      auth_url  => lookup('CONFIG_KEYSTONE_PUBLIC_URL_VERSIONLESS'),
-      password  => hiera('CONFIG_CINDER_KS_PW'),
+      password  => lookup('CONFIG_CINDER_KS_PW'),
     }
 }

packstack/puppet/modules/packstack/manifests/manila/backend/glusternative.pp

@@ -1,9 +1,9 @@
 class packstack::manila::backend::glusternative ()
 {
     manila::backend::glusternative{ 'glusternative':
-      glusterfs_servers                    => hiera('CONFIG_MANILA_GLUSTERFS_SERVERS'),
+      glusterfs_servers                    => lookup('CONFIG_MANILA_GLUSTERFS_SERVERS'),
-      glusterfs_path_to_private_key        => hiera('CONFIG_MANILA_GLUSTERFS_NATIVE_PATH_TO_PRIVATE_KEY'),
+      glusterfs_path_to_private_key        => lookup('CONFIG_MANILA_GLUSTERFS_NATIVE_PATH_TO_PRIVATE_KEY'),
-      glusterfs_volume_pattern             => hiera('CONFIG_MANILA_GLUSTERFS_VOLUME_PATTERN'),
+      glusterfs_volume_pattern             => lookup('CONFIG_MANILA_GLUSTERFS_VOLUME_PATTERN'),
     }
 
     packstack::manila::network{ 'glusternative': }

packstack/puppet/modules/packstack/manifests/manila/backend/glusternfs.pp

@@ -1,11 +1,11 @@
 class packstack::manila::backend::glusternfs ()
 {
     manila::backend::glusternfs{ 'glusternfs':
-      glusterfs_target              => hiera('CONFIG_MANILA_GLUSTERFS_TARGET'),
+      glusterfs_target              => lookup('CONFIG_MANILA_GLUSTERFS_TARGET'),
-      glusterfs_mount_point_base    => hiera('CONFIG_MANILA_GLUSTERFS_MOUNT_POINT_BASE'),
+      glusterfs_mount_point_base    => lookup('CONFIG_MANILA_GLUSTERFS_MOUNT_POINT_BASE'),
-      glusterfs_nfs_server_type     => hiera('CONFIG_MANILA_GLUSTERFS_NFS_SERVER_TYPE'),
+      glusterfs_nfs_server_type     => lookup('CONFIG_MANILA_GLUSTERFS_NFS_SERVER_TYPE'),
-      glusterfs_path_to_private_key => hiera('CONFIG_MANILA_GLUSTERFS_PATH_TO_PRIVATE_KEY'),
+      glusterfs_path_to_private_key => lookup('CONFIG_MANILA_GLUSTERFS_PATH_TO_PRIVATE_KEY'),
-      glusterfs_ganesha_server_ip   => hiera('CONFIG_MANILA_GLUSTERFS_GANESHA_SERVER_IP'),
+      glusterfs_ganesha_server_ip   => lookup('CONFIG_MANILA_GLUSTERFS_GANESHA_SERVER_IP'),
     }
 
     packstack::manila::network{ 'glusternfs': }

packstack/puppet/modules/packstack/manifests/manila/backend/netapp.pp

@@ -1,17 +1,17 @@
 class packstack::manila::backend::netapp ()
 {
     manila::backend::netapp{ 'netapp':
-      driver_handles_share_servers         => hiera('CONFIG_MANILA_NETAPP_DRV_HANDLES_SHARE_SERVERS'),
+      driver_handles_share_servers         => lookup('CONFIG_MANILA_NETAPP_DRV_HANDLES_SHARE_SERVERS'),
-      netapp_transport_type                => hiera('CONFIG_MANILA_NETAPP_TRANSPORT_TYPE'),
+      netapp_transport_type                => lookup('CONFIG_MANILA_NETAPP_TRANSPORT_TYPE'),
-      netapp_login                         => hiera('CONFIG_MANILA_NETAPP_LOGIN'),
+      netapp_login                         => lookup('CONFIG_MANILA_NETAPP_LOGIN'),
-      netapp_password                      => hiera('CONFIG_MANILA_NETAPP_PASSWORD'),
+      netapp_password                      => lookup('CONFIG_MANILA_NETAPP_PASSWORD'),
-      netapp_server_hostname               => hiera('CONFIG_MANILA_NETAPP_SERVER_HOSTNAME'),
+      netapp_server_hostname               => lookup('CONFIG_MANILA_NETAPP_SERVER_HOSTNAME'),
-      netapp_storage_family                => hiera('CONFIG_MANILA_NETAPP_STORAGE_FAMILY'),
+      netapp_storage_family                => lookup('CONFIG_MANILA_NETAPP_STORAGE_FAMILY'),
-      netapp_server_port                   => hiera('CONFIG_MANILA_NETAPP_SERVER_PORT'),
+      netapp_server_port                   => lookup('CONFIG_MANILA_NETAPP_SERVER_PORT'),
-      netapp_vserver                       => hiera('CONFIG_MANILA_NETAPP_VSERVER', undef),
+      netapp_vserver                       => lookup('CONFIG_MANILA_NETAPP_VSERVER', undef, undef, undef),
-      netapp_aggregate_name_search_pattern => hiera('CONFIG_MANILA_NETAPP_AGGREGATE_NAME_SEARCH_PATTERN'),
+      netapp_aggregate_name_search_pattern => lookup('CONFIG_MANILA_NETAPP_AGGREGATE_NAME_SEARCH_PATTERN'),
-      netapp_root_volume_aggregate         => hiera('CONFIG_MANILA_NETAPP_ROOT_VOLUME_AGGREGATE', undef),
+      netapp_root_volume_aggregate         => lookup('CONFIG_MANILA_NETAPP_ROOT_VOLUME_AGGREGATE', undef, undef, undef),
-      netapp_root_volume_name              => hiera('CONFIG_MANILA_NETAPP_ROOT_VOLUME_NAME', undef),
+      netapp_root_volume_name              => lookup('CONFIG_MANILA_NETAPP_ROOT_VOLUME_NAME', undef, undef, undef),
     }
 
     packstack::manila::network{ 'netapp': }

packstack/puppet/modules/packstack/manifests/manila/network.pp

@@ -1,12 +1,12 @@
 
 define packstack::manila::network ($backend_name = $name) {
-  $manila_network_type = hiera('CONFIG_MANILA_NETWORK_TYPE')
+  $manila_network_type = lookup('CONFIG_MANILA_NETWORK_TYPE')
 
   if ($manila_network_type == 'neutron'){
     class { 'manila::network::neutron':
       auth_type => 'password',
-      auth_url  => hiera('CONFIG_KEYSTONE_PUBLIC_URL_VERSIONLESS'),
+      auth_url  => lookup('CONFIG_KEYSTONE_PUBLIC_URL_VERSIONLESS'),
-      password  => hiera('CONFIG_NEUTRON_KS_PW'),
+      password  => lookup('CONFIG_NEUTRON_KS_PW'),
     }
   }
   elsif ($manila_network_type == 'nova-network'){
@@ -14,11 +14,11 @@ define packstack::manila::network ($backend_name = $name) {
   }
   elsif ($manila_network_type == 'standalone'){
     manila::network::standalone{ $backend_name:
-      standalone_network_plugin_gateway           => hiera('CONFIG_MANILA_NETWORK_STANDALONE_GATEWAY'),
+      standalone_network_plugin_gateway           => lookup('CONFIG_MANILA_NETWORK_STANDALONE_GATEWAY'),
-      standalone_network_plugin_mask              => hiera('CONFIG_MANILA_NETWORK_STANDALONE_NETMASK'),
+      standalone_network_plugin_mask              => lookup('CONFIG_MANILA_NETWORK_STANDALONE_NETMASK'),
-      standalone_network_plugin_segmentation_id   => hiera('CONFIG_MANILA_NETWORK_STANDALONE_SEG_ID'),
+      standalone_network_plugin_segmentation_id   => lookup('CONFIG_MANILA_NETWORK_STANDALONE_SEG_ID'),
-      standalone_network_plugin_allowed_ip_ranges => hiera('CONFIG_MANILA_NETWORK_STANDALONE_IP_RANGE'),
+      standalone_network_plugin_allowed_ip_ranges => lookup('CONFIG_MANILA_NETWORK_STANDALONE_IP_RANGE'),
-      standalone_network_plugin_ip_version        => hiera('CONFIG_MANILA_NETWORK_STANDALONE_IP_VERSION'),
+      standalone_network_plugin_ip_version        => lookup('CONFIG_MANILA_NETWORK_STANDALONE_IP_VERSION'),
     }
   }
   else {

packstack/puppet/modules/packstack/manifests/manila/rabbitmq.pp

@@ -1,13 +1,13 @@
 class packstack::manila::rabbitmq ()
 {
-    $kombu_ssl_ca_certs = hiera('CONFIG_AMQP_SSL_CACERT_FILE', undef)
+    $kombu_ssl_ca_certs = lookup('CONFIG_AMQP_SSL_CACERT_FILE', undef, undef, undef)
-    $kombu_ssl_keyfile = hiera('CONFIG_MANILA_SSL_KEY', undef)
+    $kombu_ssl_keyfile = lookup('CONFIG_MANILA_SSL_KEY', undef, undef, undef)
-    $kombu_ssl_certfile = hiera('CONFIG_MANILA_SSL_CERT', undef)
+    $kombu_ssl_certfile = lookup('CONFIG_MANILA_SSL_CERT', undef, undef, undef)
 
-    $rabbit_host = hiera('CONFIG_AMQP_HOST_URL')
+    $rabbit_host = lookup('CONFIG_AMQP_HOST_URL')
-    $rabbit_port = hiera('CONFIG_AMQP_CLIENTS_PORT')
+    $rabbit_port = lookup('CONFIG_AMQP_CLIENTS_PORT')
-    $rabbit_userid = hiera('CONFIG_AMQP_AUTH_USER')
+    $rabbit_userid = lookup('CONFIG_AMQP_AUTH_USER')
-    $rabbit_password = hiera('CONFIG_AMQP_AUTH_PASSWORD')
+    $rabbit_password = lookup('CONFIG_AMQP_AUTH_PASSWORD')
 
     if $kombu_ssl_keyfile {
       $files_to_set_owner = [ $kombu_ssl_keyfile, $kombu_ssl_certfile ]
@@ -21,11 +21,11 @@ class packstack::manila::rabbitmq ()
     }
     Service<| name == 'rabbitmq-server' |> -> Service<| tag == 'manila-service' |>
 
-    $db_pw = hiera('CONFIG_MANILA_DB_PW')
+    $db_pw = lookup('CONFIG_MANILA_DB_PW')
-    $mariadb_host = hiera('CONFIG_MARIADB_HOST_URL')
+    $mariadb_host = lookup('CONFIG_MARIADB_HOST_URL')
 
     class { 'manila::logging':
-      debug => hiera('CONFIG_DEBUG_MODE'),
+      debug => lookup('CONFIG_DEBUG_MODE'),
     }
 
     class { 'manila::db':
@@ -33,7 +33,7 @@ class packstack::manila::rabbitmq ()
     }
 
     class { 'manila':
-      rabbit_use_ssl        => hiera('CONFIG_AMQP_SSL_ENABLED'),
+      rabbit_use_ssl        => lookup('CONFIG_AMQP_SSL_ENABLED'),
       default_transport_url => "rabbit://${rabbit_userid}:${rabbit_password}@${rabbit_host}:${rabbit_port}/",
     }
 }

packstack/puppet/modules/packstack/manifests/mariadb.pp

@@ -1,8 +1,8 @@
 class packstack::mariadb ()
 {
-  if hiera('CONFIG_MARIADB_INSTALL') == 'y' {
+  if lookup('CONFIG_MARIADB_INSTALL') == 'y' {
-    create_resources(packstack::firewall, hiera('FIREWALL_MARIADB_RULES', {}))
+    create_resources(packstack::firewall, lookup('FIREWALL_MARIADB_RULES', undef, undef, {}))
-    $max_connections = hiera('CONFIG_SERVICE_WORKERS') * 128
+    $max_connections = lookup('CONFIG_SERVICE_WORKERS') * 128
 
     if ($::mariadb_provides_galera) {
       # Since mariadb 10.1 galera is included in main mariadb
@@ -15,13 +15,13 @@ class packstack::mariadb ()
     }
     ensure_packages(['mariadb-server'], {'ensure' => $mariadb_present})
 
-    $bind_address = hiera('CONFIG_IP_VERSION') ? {
+    $bind_address = lookup('CONFIG_IP_VERSION') ? {
       'ipv6'  => '::0',
       default => '0.0.0.0',
       # TO-DO(mmagr): Add IPv6 support when hostnames are used
     }
 
-    $mysql_root_password = hiera('CONFIG_MARIADB_PW')
+    $mysql_root_password = lookup('CONFIG_MARIADB_PW')
 
     class { 'mysql::server':
       package_name     => $mariadb_package_name,

packstack/puppet/modules/packstack/manifests/mariadb/services.pp

@@ -2,124 +2,124 @@ class packstack::mariadb::services ()
 {
     class { 'keystone::db::mysql':
       user          => 'keystone_admin',
-      password      => hiera('CONFIG_KEYSTONE_DB_PW'),
+      password      => lookup('CONFIG_KEYSTONE_DB_PW'),
       allowed_hosts => '%',
       charset       => 'utf8',
     }
 
-    if hiera('CONFIG_CINDER_INSTALL') == 'y' {
+    if lookup('CONFIG_CINDER_INSTALL') == 'y' {
       class { 'cinder::db::mysql':
-        password      => hiera('CONFIG_CINDER_DB_PW'),
+        password      => lookup('CONFIG_CINDER_DB_PW'),
         host          => '%',
         allowed_hosts => '%',
         charset       => 'utf8',
       }
     }
 
-    if hiera('CONFIG_GLANCE_INSTALL') == 'y' {
+    if lookup('CONFIG_GLANCE_INSTALL') == 'y' {
         class { 'glance::db::mysql':
-          password      => hiera('CONFIG_GLANCE_DB_PW'),
+          password      => lookup('CONFIG_GLANCE_DB_PW'),
           host          => '%',
           allowed_hosts => '%',
           charset       => 'utf8',
         }
     }
 
-    if hiera('CONFIG_CEILOMETER_INSTALL') == 'y' {
+    if lookup('CONFIG_CEILOMETER_INSTALL') == 'y' {
         class { 'gnocchi::db::mysql':
-          password      => hiera('CONFIG_GNOCCHI_DB_PW'),
+          password      => lookup('CONFIG_GNOCCHI_DB_PW'),
           host          => '%',
           allowed_hosts => '%',
         }
     }
 
-    if hiera('CONFIG_AODH_INSTALL') == 'y' and
+    if lookup('CONFIG_AODH_INSTALL') == 'y' and
-      hiera('CONFIG_CEILOMETER_INSTALL') == 'y' {
+      lookup('CONFIG_CEILOMETER_INSTALL') == 'y' {
         class { 'aodh::db::mysql':
-          password      => hiera('CONFIG_AODH_DB_PW'),
+          password      => lookup('CONFIG_AODH_DB_PW'),
           host          => '%',
           allowed_hosts => '%',
         }
     }
 
-    if hiera('CONFIG_HEAT_INSTALL') == 'y' {
+    if lookup('CONFIG_HEAT_INSTALL') == 'y' {
       class { 'heat::db::mysql':
-        password      => hiera('CONFIG_HEAT_DB_PW'),
+        password      => lookup('CONFIG_HEAT_DB_PW'),
         host          => '%',
         allowed_hosts => '%',
         charset       => 'utf8',
       }
     }
 
-    if hiera('CONFIG_MAGNUM_INSTALL') == 'y' {
+    if lookup('CONFIG_MAGNUM_INSTALL') == 'y' {
       class { 'magnum::db::mysql':
-        password      => hiera('CONFIG_MAGNUM_DB_PW'),
+        password      => lookup('CONFIG_MAGNUM_DB_PW'),
         host          => '%',
         allowed_hosts => '%',
         charset       => 'utf8',
       }
     }
 
-    if hiera('CONFIG_IRONIC_INSTALL') == 'y' {
+    if lookup('CONFIG_IRONIC_INSTALL') == 'y' {
       class { 'ironic::db::mysql':
-        password      => hiera('CONFIG_IRONIC_DB_PW'),
+        password      => lookup('CONFIG_IRONIC_DB_PW'),
         host          => '%',
         allowed_hosts => '%',
         charset       => 'utf8',
       }
     }
 
-    if hiera('CONFIG_MANILA_INSTALL') == 'y' {
+    if lookup('CONFIG_MANILA_INSTALL') == 'y' {
         class { 'manila::db::mysql':
-          password      => hiera('CONFIG_MANILA_DB_PW'),
+          password      => lookup('CONFIG_MANILA_DB_PW'),
           allowed_hosts => '%',
           charset       => 'utf8',
         }
     }
 
-    if hiera('CONFIG_NEUTRON_INSTALL') == 'y' {
+    if lookup('CONFIG_NEUTRON_INSTALL') == 'y' {
         class { 'neutron::db::mysql':
-          password      => hiera('CONFIG_NEUTRON_DB_PW'),
+          password      => lookup('CONFIG_NEUTRON_DB_PW'),
           host          => '%',
           allowed_hosts => '%',
-          dbname        => hiera('CONFIG_NEUTRON_L2_DBNAME'),
+          dbname        => lookup('CONFIG_NEUTRON_L2_DBNAME'),
           charset       => 'utf8',
         }
     }
 
-    if hiera('CONFIG_NOVA_INSTALL') == 'y' {
+    if lookup('CONFIG_NOVA_INSTALL') == 'y' {
         class { 'nova::db::mysql':
-          password      => hiera('CONFIG_NOVA_DB_PW'),
+          password      => lookup('CONFIG_NOVA_DB_PW'),
           host          => '%',
           allowed_hosts => '%',
           charset       => 'utf8',
         }
         class { 'nova::db::mysql_api':
-          password      => hiera('CONFIG_NOVA_DB_PW'),
+          password      => lookup('CONFIG_NOVA_DB_PW'),
           host          => '%',
           allowed_hosts => '%',
           charset       => 'utf8',
         }
         class { 'placement::db::mysql':
-          password      => hiera('CONFIG_NOVA_DB_PW'),
+          password      => lookup('CONFIG_NOVA_DB_PW'),
           host          => '%',
           allowed_hosts => '%',
           charset       => 'utf8',
         }
     }
 
-    if hiera('CONFIG_SAHARA_INSTALL') == 'y' {
+    if lookup('CONFIG_SAHARA_INSTALL') == 'y' {
         class { 'sahara::db::mysql':
-          password      => hiera('CONFIG_SAHARA_DB_PW'),
+          password      => lookup('CONFIG_SAHARA_DB_PW'),
           host          => '%',
           allowed_hosts => '%',
         }
 
     }
 
-    if hiera('CONFIG_TROVE_INSTALL') == 'y' {
+    if lookup('CONFIG_TROVE_INSTALL') == 'y' {
         class { 'trove::db::mysql':
-            password      => hiera('CONFIG_TROVE_DB_PW'),
+            password      => lookup('CONFIG_TROVE_DB_PW'),
             host          => '%',
             allowed_hosts => '%',
             charset       => 'utf8',

packstack/puppet/modules/packstack/manifests/mariadb/services_remote.pp

@@ -2,338 +2,338 @@ class packstack::mariadb::services_remote () {
     remote_database { 'keystone':
       ensure      => 'present',
       charset     => 'utf8',
-      db_host     => hiera('CONFIG_MARIADB_HOST'),
+      db_host     => lookup('CONFIG_MARIADB_HOST'),
-      db_user     => hiera('CONFIG_MARIADB_USER'),
+      db_user     => lookup('CONFIG_MARIADB_USER'),
-      db_password => hiera('CONFIG_MARIADB_PW'),
+      db_password => lookup('CONFIG_MARIADB_PW'),
       provider    => 'mysql',
     }
 
-    $mariadb_keystone_noinstall_db_pw = hiera('CONFIG_KEYSTONE_DB_PW')
+    $mariadb_keystone_noinstall_db_pw = lookup('CONFIG_KEYSTONE_DB_PW')
 
     remote_database_user { 'keystone_admin@%':
       password_hash => mysql_password($mariadb_keystone_noinstall_db_pw),
-      db_host       => hiera('CONFIG_MARIADB_HOST'),
+      db_host       => lookup('CONFIG_MARIADB_HOST'),
-      db_user       => hiera('CONFIG_MARIADB_USER'),
+      db_user       => lookup('CONFIG_MARIADB_USER'),
-      db_password   => hiera('CONFIG_MARIADB_PW'),
+      db_password   => lookup('CONFIG_MARIADB_PW'),
       provider      => 'mysql',
       require       => Remote_database['keystone'],
     }
 
     remote_database_grant { 'keystone_admin@%/keystone':
       privileges  => 'all',
-      db_host     => hiera('CONFIG_MARIADB_HOST'),
+      db_host     => lookup('CONFIG_MARIADB_HOST'),
-      db_user     => hiera('CONFIG_MARIADB_USER'),
+      db_user     => lookup('CONFIG_MARIADB_USER'),
-      db_password => hiera('CONFIG_MARIADB_PW'),
+      db_password => lookup('CONFIG_MARIADB_PW'),
       provider    => 'mysql',
       require     => Remote_database_user['keystone_admin@%'],
     }
 
-    if hiera('CONFIG_CINDER_INSTALL') == 'y' {
+    if lookup('CONFIG_CINDER_INSTALL') == 'y' {
       remote_database { 'cinder':
         ensure      => 'present',
         charset     => 'utf8',
-        db_host     => hiera('CONFIG_MARIADB_HOST'),
+        db_host     => lookup('CONFIG_MARIADB_HOST'),
-        db_user     => hiera('CONFIG_MARIADB_USER'),
+        db_user     => lookup('CONFIG_MARIADB_USER'),
-        db_password => hiera('CONFIG_MARIADB_PW'),
+        db_password => lookup('CONFIG_MARIADB_PW'),
         provider    => 'mysql',
       }
 
-      $mariadb_cinder_noinstall_db_pw = hiera('CONFIG_CINDER_DB_PW')
+      $mariadb_cinder_noinstall_db_pw = lookup('CONFIG_CINDER_DB_PW')
 
       remote_database_user { 'cinder@%':
         password_hash => mysql_password($mariadb_cinder_noinstall_db_pw),
-        db_host       => hiera('CONFIG_MARIADB_HOST'),
+        db_host       => lookup('CONFIG_MARIADB_HOST'),
-        db_user       => hiera('CONFIG_MARIADB_USER'),
+        db_user       => lookup('CONFIG_MARIADB_USER'),
-        db_password   => hiera('CONFIG_MARIADB_PW'),
+        db_password   => lookup('CONFIG_MARIADB_PW'),
         provider      => 'mysql',
         require       => Remote_database['cinder'],
       }
 
       remote_database_grant { 'cinder@%/cinder':
         privileges  => 'all',
-        db_host     => hiera('CONFIG_MARIADB_HOST'),
+        db_host     => lookup('CONFIG_MARIADB_HOST'),
-        db_user     => hiera('CONFIG_MARIADB_USER'),
+        db_user     => lookup('CONFIG_MARIADB_USER'),
-        db_password => hiera('CONFIG_MARIADB_PW'),
+        db_password => lookup('CONFIG_MARIADB_PW'),
         provider    => 'mysql',
         require     => Remote_database_user['cinder@%'],
       }
     }
 
-    if hiera('CONFIG_GLANCE_INSTALL') == 'y' {
+    if lookup('CONFIG_GLANCE_INSTALL') == 'y' {
         remote_database { 'glance':
           ensure      => 'present',
           charset     => 'utf8',
-          db_host     => hiera('CONFIG_MARIADB_HOST'),
+          db_host     => lookup('CONFIG_MARIADB_HOST'),
-          db_user     => hiera('CONFIG_MARIADB_USER'),
+          db_user     => lookup('CONFIG_MARIADB_USER'),
-          db_password => hiera('CONFIG_MARIADB_PW'),
+          db_password => lookup('CONFIG_MARIADB_PW'),
           provider    => 'mysql',
         }
 
-        $mariadb_glance_noinstall_db_pw = hiera('CONFIG_GLANCE_DB_PW')
+        $mariadb_glance_noinstall_db_pw = lookup('CONFIG_GLANCE_DB_PW')
 
         remote_database_user { 'glance@%':
           password_hash => mysql_password($mariadb_glance_noinstall_db_pw),
-          db_host       => hiera('CONFIG_MARIADB_HOST'),
+          db_host       => lookup('CONFIG_MARIADB_HOST'),
-          db_user       => hiera('CONFIG_MARIADB_USER'),
+          db_user       => lookup('CONFIG_MARIADB_USER'),
-          db_password   => hiera('CONFIG_MARIADB_PW'),
+          db_password   => lookup('CONFIG_MARIADB_PW'),
           provider      => 'mysql',
           require       => Remote_database['glance'],
         }
 
         remote_database_grant { 'glance@%/glance':
           privileges  => 'all',
-          db_host     => hiera('CONFIG_MARIADB_HOST'),
+          db_host     => lookup('CONFIG_MARIADB_HOST'),
-          db_user     => hiera('CONFIG_MARIADB_USER'),
+          db_user     => lookup('CONFIG_MARIADB_USER'),
-          db_password => hiera('CONFIG_MARIADB_PW'),
+          db_password => lookup('CONFIG_MARIADB_PW'),
           provider    => 'mysql',
           require     => Remote_database_user['glance@%'],
         }
     }
 
-    if hiera('CONFIG_CEILOMETER_INSTALL') == 'y' {
+    if lookup('CONFIG_CEILOMETER_INSTALL') == 'y' {
         remote_database { 'gnocchi':
           ensure      => 'present',
           charset     => 'utf8',
-          db_host     => hiera('CONFIG_MARIADB_HOST'),
+          db_host     => lookup('CONFIG_MARIADB_HOST'),
-          db_user     => hiera('CONFIG_MARIADB_USER'),
+          db_user     => lookup('CONFIG_MARIADB_USER'),
-          db_password => hiera('CONFIG_MARIADB_PW'),
+          db_password => lookup('CONFIG_MARIADB_PW'),
           provider    => 'mysql',
         }
 
-        $gnocchi_cfg_db_pw = hiera('CONFIG_GNOCCHI_DB_PW')
+        $gnocchi_cfg_db_pw = lookup('CONFIG_GNOCCHI_DB_PW')
 
         remote_database_user { 'gnocchi@%':
           password_hash => mysql_password($gnocchi_cfg_db_pw),
-          db_host       => hiera('CONFIG_MARIADB_HOST'),
+          db_host       => lookup('CONFIG_MARIADB_HOST'),
-          db_user       => hiera('CONFIG_MARIADB_USER'),
+          db_user       => lookup('CONFIG_MARIADB_USER'),
-          db_password   => hiera('CONFIG_MARIADB_PW'),
+          db_password   => lookup('CONFIG_MARIADB_PW'),
           provider      => 'mysql',
           require       => Remote_database['gnocchi'],
         }
 
         remote_database_grant { 'gnocchi@%/gnocchi':
           privileges  => 'all',
-          db_host     => hiera('CONFIG_MARIADB_HOST'),
+          db_host     => lookup('CONFIG_MARIADB_HOST'),
-          db_user     => hiera('CONFIG_MARIADB_USER'),
+          db_user     => lookup('CONFIG_MARIADB_USER'),
-          db_password => hiera('CONFIG_MARIADB_PW'),
+          db_password => lookup('CONFIG_MARIADB_PW'),
           provider    => 'mysql',
           require     => Remote_database_user['gnocchi@%'],
         }
     }
 
-    if hiera('CONFIG_AODH_INSTALL') == 'y' {
+    if lookup('CONFIG_AODH_INSTALL') == 'y' {
         remote_database { 'aodh':
           ensure      => 'present',
           charset     => 'utf8',
-          db_host     => hiera('CONFIG_MARIADB_HOST'),
+          db_host     => lookup('CONFIG_MARIADB_HOST'),
-          db_user     => hiera('CONFIG_MARIADB_USER'),
+          db_user     => lookup('CONFIG_MARIADB_USER'),
-          db_password => hiera('CONFIG_MARIADB_PW'),
+          db_password => lookup('CONFIG_MARIADB_PW'),
           provider    => 'mysql',
         }
 
-        $aodh_cfg_db_pw = hiera('CONFIG_AODH_DB_PW')
+        $aodh_cfg_db_pw = lookup('CONFIG_AODH_DB_PW')
 
         remote_database_user { 'aodh@%':
           password_hash => mysql_password($aodh_cfg_db_pw),
-          db_host       => hiera('CONFIG_MARIADB_HOST'),
+          db_host       => lookup('CONFIG_MARIADB_HOST'),
-          db_user       => hiera('CONFIG_MARIADB_USER'),
+          db_user       => lookup('CONFIG_MARIADB_USER'),
-          db_password   => hiera('CONFIG_MARIADB_PW'),
+          db_password   => lookup('CONFIG_MARIADB_PW'),
           provider      => 'mysql',
           require       => Remote_database['aodh'],
         }
 
         remote_database_grant { 'aodh@%/aodh':
           privileges  => 'all',
-          db_host     => hiera('CONFIG_MARIADB_HOST'),
+          db_host     => lookup('CONFIG_MARIADB_HOST'),
-          db_user     => hiera('CONFIG_MARIADB_USER'),
+          db_user     => lookup('CONFIG_MARIADB_USER'),
-          db_password => hiera('CONFIG_MARIADB_PW'),
+          db_password => lookup('CONFIG_MARIADB_PW'),
           provider    => 'mysql',
           require     => Remote_database_user['aodh@%'],
         }
     }
 
-    if hiera('CONFIG_HEAT_INSTALL') == 'y' {
+    if lookup('CONFIG_HEAT_INSTALL') == 'y' {
         remote_database { 'heat':
           ensure      => 'present',
           charset     => 'utf8',
-          db_host     => hiera('CONFIG_MARIADB_HOST'),
+          db_host     => lookup('CONFIG_MARIADB_HOST'),
-          db_user     => hiera('CONFIG_MARIADB_USER'),
+          db_user     => lookup('CONFIG_MARIADB_USER'),
-          db_password => hiera('CONFIG_MARIADB_PW'),
+          db_password => lookup('CONFIG_MARIADB_PW'),
           provider    => 'mysql',
         }
 
-        $mariadb_heat_noinstall_db_pw = hiera('CONFIG_HEAT_DB_PW')
+        $mariadb_heat_noinstall_db_pw = lookup('CONFIG_HEAT_DB_PW')
 
         remote_database_user { 'heat@%':
           password_hash => mysql_password($mariadb_heat_noinstall_db_pw),
-          db_host       => hiera('CONFIG_MARIADB_HOST'),
+          db_host       => lookup('CONFIG_MARIADB_HOST'),
-          db_user       => hiera('CONFIG_MARIADB_USER'),
+          db_user       => lookup('CONFIG_MARIADB_USER'),
-          db_password   => hiera('CONFIG_MARIADB_PW'),
+          db_password   => lookup('CONFIG_MARIADB_PW'),
           provider      => 'mysql',
           require       => Remote_database['heat'],
         }
 
         remote_database_grant { 'heat@%/heat':
           privileges  => 'all',
-          db_host     => hiera('CONFIG_MARIADB_HOST'),
+          db_host     => lookup('CONFIG_MARIADB_HOST'),
-          db_user     => hiera('CONFIG_MARIADB_USER'),
+          db_user     => lookup('CONFIG_MARIADB_USER'),
-          db_password => hiera('CONFIG_MARIADB_PW'),
+          db_password => lookup('CONFIG_MARIADB_PW'),
           provider    => 'mysql',
           require     => Remote_database_user['heat@%'],
         }
     }
 
-    if hiera('CONFIG_MAGNUM_INSTALL') == 'y' {
+    if lookup('CONFIG_MAGNUM_INSTALL') == 'y' {
         remote_database { 'magnum':
           ensure      => 'present',
           charset     => 'utf8',
-          db_host     => hiera('CONFIG_MARIADB_HOST'),
+          db_host     => lookup('CONFIG_MARIADB_HOST'),
-          db_user     => hiera('CONFIG_MARIADB_USER'),
+          db_user     => lookup('CONFIG_MARIADB_USER'),
-          db_password => hiera('CONFIG_MARIADB_PW'),
+          db_password => lookup('CONFIG_MARIADB_PW'),
           provider    => 'mysql',
         }
 
-        $mariadb_magnum_noinstall_db_pw = hiera('CONFIG_MAGNUM_DB_PW')
+        $mariadb_magnum_noinstall_db_pw = lookup('CONFIG_MAGNUM_DB_PW')
 
         remote_database_user { 'magnum@%':
           password_hash => mysql_password($mariadb_magnum_noinstall_db_pw),
-          db_host       => hiera('CONFIG_MARIADB_HOST'),
+          db_host       => lookup('CONFIG_MARIADB_HOST'),
-          db_user       => hiera('CONFIG_MARIADB_USER'),
+          db_user       => lookup('CONFIG_MARIADB_USER'),
-          db_password   => hiera('CONFIG_MARIADB_PW'),
+          db_password   => lookup('CONFIG_MARIADB_PW'),
           provider      => 'mysql',
           require       => Remote_database['magnum'],
         }
 
         remote_database_grant { 'magnum@%/magnum':
           privileges  => 'all',
-          db_host     => hiera('CONFIG_MARIADB_HOST'),
+          db_host     => lookup('CONFIG_MARIADB_HOST'),
-          db_user     => hiera('CONFIG_MARIADB_USER'),
+          db_user     => lookup('CONFIG_MARIADB_USER'),
-          db_password => hiera('CONFIG_MARIADB_PW'),
+          db_password => lookup('CONFIG_MARIADB_PW'),
           provider    => 'mysql',
           require     => Remote_database_user['magnum@%'],
         }
     }
 
-    if hiera('CONFIG_IRONIC_INSTALL') == 'y' {
+    if lookup('CONFIG_IRONIC_INSTALL') == 'y' {
         remote_database { 'ironic':
           ensure      => 'present',
           charset     => 'utf8',
-          db_host     => hiera('CONFIG_MARIADB_HOST'),
+          db_host     => lookup('CONFIG_MARIADB_HOST'),
-          db_user     => hiera('CONFIG_MARIADB_USER'),
+          db_user     => lookup('CONFIG_MARIADB_USER'),
-          db_password => hiera('CONFIG_MARIADB_PW'),
+          db_password => lookup('CONFIG_MARIADB_PW'),
           provider    => 'mysql',
         }
 
-        $mariadb_ironic_noinstall_db_pw = hiera('CONFIG_IRONIC_DB_PW')
+        $mariadb_ironic_noinstall_db_pw = lookup('CONFIG_IRONIC_DB_PW')
 
         remote_database_user { 'ironic@%':
           password_hash => mysql_password($mariadb_ironic_noinstall_db_pw),
-          db_host       => hiera('CONFIG_MARIADB_HOST'),
+          db_host       => lookup('CONFIG_MARIADB_HOST'),
-          db_user       => hiera('CONFIG_MARIADB_USER'),
+          db_user       => lookup('CONFIG_MARIADB_USER'),
-          db_password   => hiera('CONFIG_MARIADB_PW'),
+          db_password   => lookup('CONFIG_MARIADB_PW'),
           provider      => 'mysql',
           require       => Remote_database['ironic'],
         }
 
         remote_database_grant { 'ironic@%/ironic':
           privileges  => 'all',
-          db_host     => hiera('CONFIG_MARIADB_HOST'),
+          db_host     => lookup('CONFIG_MARIADB_HOST'),
-          db_user     => hiera('CONFIG_MARIADB_USER'),
+          db_user     => lookup('CONFIG_MARIADB_USER'),
-          db_password => hiera('CONFIG_MARIADB_PW'),
+          db_password => lookup('CONFIG_MARIADB_PW'),
           provider    => 'mysql',
           require     => Remote_database_user['ironic@%'],
         }
     }
 
-    if hiera('CONFIG_MANILA_INSTALL') == 'y' {
+    if lookup('CONFIG_MANILA_INSTALL') == 'y' {
         remote_database { 'manila':
           ensure      => 'present',
           charset     => 'utf8',
-          db_host     => hiera('CONFIG_MARIADB_HOST'),
+          db_host     => lookup('CONFIG_MARIADB_HOST'),
-          db_user     => hiera('CONFIG_MARIADB_USER'),
+          db_user     => lookup('CONFIG_MARIADB_USER'),
-          db_password => hiera('CONFIG_MARIADB_PW'),
+          db_password => lookup('CONFIG_MARIADB_PW'),
           provider    => 'mysql',
         }
 
-        $mariadb_manila_noinstall_db_pw = hiera('CONFIG_MANILA_DB_PW')
+        $mariadb_manila_noinstall_db_pw = lookup('CONFIG_MANILA_DB_PW')
 
         remote_database_user { 'manila@%':
           password_hash => mysql_password($mariadb_manila_noinstall_db_pw),
-          db_host       => hiera('CONFIG_MARIADB_HOST'),
+          db_host       => lookup('CONFIG_MARIADB_HOST'),
-          db_user       => hiera('CONFIG_MARIADB_USER'),
+          db_user       => lookup('CONFIG_MARIADB_USER'),
-          db_password   => hiera('CONFIG_MARIADB_PW'),
+          db_password   => lookup('CONFIG_MARIADB_PW'),
           provider      => 'mysql',
           require       => Remote_database['manila'],
         }
 
         remote_database_grant { 'manila@%/manila':
           privileges  => 'all',
-          db_host     => hiera('CONFIG_MARIADB_HOST'),
+          db_host     => lookup('CONFIG_MARIADB_HOST'),
-          db_user     => hiera('CONFIG_MARIADB_USER'),
+          db_user     => lookup('CONFIG_MARIADB_USER'),
-          db_password => hiera('CONFIG_MARIADB_PW'),
+          db_password => lookup('CONFIG_MARIADB_PW'),
           provider    => 'mysql',
           require     => Remote_database_user['manila@%'],
         }
     }
 
-    if hiera('CONFIG_NEUTRON_INSTALL') == 'y' {
+    if lookup('CONFIG_NEUTRON_INSTALL') == 'y' {
-        $mariadb_neutron_noinstall_db_pw     = hiera('CONFIG_NEUTRON_DB_PW')
+        $mariadb_neutron_noinstall_db_pw     = lookup('CONFIG_NEUTRON_DB_PW')
-        $mariadb_neutron_noinstall_l2_dbname = hiera('CONFIG_NEUTRON_L2_DBNAME')
+        $mariadb_neutron_noinstall_l2_dbname = lookup('CONFIG_NEUTRON_L2_DBNAME')
 
         remote_database { $mariadb_neutron_noinstall_l2_dbname:
           ensure      => present,
           charset     => 'utf8',
-          db_host     => hiera('CONFIG_MARIADB_HOST'),
+          db_host     => lookup('CONFIG_MARIADB_HOST'),
-          db_user     => hiera('CONFIG_MARIADB_USER'),
+          db_user     => lookup('CONFIG_MARIADB_USER'),
-          db_password => hiera('CONFIG_MARIADB_PW'),
+          db_password => lookup('CONFIG_MARIADB_PW'),
           provider    => 'mysql',
         }
 
         remote_database_user { 'neutron@%':
           password_hash => mysql_password($mariadb_neutron_noinstall_db_pw),
-          db_host       => hiera('CONFIG_MARIADB_HOST'),
+          db_host       => lookup('CONFIG_MARIADB_HOST'),
-          db_user       => hiera('CONFIG_MARIADB_USER'),
+          db_user       => lookup('CONFIG_MARIADB_USER'),
-          db_password   => hiera('CONFIG_MARIADB_PW'),
+          db_password   => lookup('CONFIG_MARIADB_PW'),
           provider      => 'mysql',
           require       => Remote_database[$mariadb_neutron_noinstall_l2_dbname],
         }
 
         remote_database_grant { "neutron@%/${mariadb_neutron_noinstall_l2_dbname}":
           privileges  => 'all',
-          db_host     => hiera('CONFIG_MARIADB_HOST'),
+          db_host     => lookup('CONFIG_MARIADB_HOST'),
-          db_user     => hiera('CONFIG_MARIADB_USER'),
+          db_user     => lookup('CONFIG_MARIADB_USER'),
-          db_password => hiera('CONFIG_MARIADB_PW'),
+          db_password => lookup('CONFIG_MARIADB_PW'),
           provider    => 'mysql',
           require     => Remote_database_user['neutron@%'],
         }
     }
 
-    if hiera('CONFIG_NOVA_INSTALL') == 'y' {
+    if lookup('CONFIG_NOVA_INSTALL') == 'y' {
         remote_database { 'nova':
           ensure      => 'present',
           charset     => 'utf8',
-          db_host     => hiera('CONFIG_MARIADB_HOST'),
+          db_host     => lookup('CONFIG_MARIADB_HOST'),
-          db_user     => hiera('CONFIG_MARIADB_USER'),
+          db_user     => lookup('CONFIG_MARIADB_USER'),
-          db_password => hiera('CONFIG_MARIADB_PW'),
+          db_password => lookup('CONFIG_MARIADB_PW'),
           provider    => 'mysql',
         }
 
-        $mariadb_nova_noinstall_db_pw = hiera('CONFIG_NOVA_DB_PW')
+        $mariadb_nova_noinstall_db_pw = lookup('CONFIG_NOVA_DB_PW')
 
         remote_database_user { 'nova@%':
           password_hash => mysql_password($mariadb_nova_noinstall_db_pw),
-          db_host       => hiera('CONFIG_MARIADB_HOST'),
+          db_host       => lookup('CONFIG_MARIADB_HOST'),
-          db_user       => hiera('CONFIG_MARIADB_USER'),
+          db_user       => lookup('CONFIG_MARIADB_USER'),
-          db_password   => hiera('CONFIG_MARIADB_PW'),
+          db_password   => lookup('CONFIG_MARIADB_PW'),
           provider      => 'mysql',
           require       => Remote_database['nova'],
         }
 
         remote_database_grant { 'nova@%/nova':
           privileges  => 'all',
-          db_host     => hiera('CONFIG_MARIADB_HOST'),
+          db_host     => lookup('CONFIG_MARIADB_HOST'),
-          db_user     => hiera('CONFIG_MARIADB_USER'),
+          db_user     => lookup('CONFIG_MARIADB_USER'),
-          db_password => hiera('CONFIG_MARIADB_PW'),
+          db_password => lookup('CONFIG_MARIADB_PW'),
           provider    => 'mysql',
           require     => Remote_database_user['nova@%'],
         }
@@ -341,26 +341,26 @@ class packstack::mariadb::services_remote () {
         remote_database { 'nova_api':
           ensure      => 'present',
           charset     => 'utf8',
-          db_host     => hiera('CONFIG_MARIADB_HOST'),
+          db_host     => lookup('CONFIG_MARIADB_HOST'),
-          db_user     => hiera('CONFIG_MARIADB_USER'),
+          db_user     => lookup('CONFIG_MARIADB_USER'),
-          db_password => hiera('CONFIG_MARIADB_PW'),
+          db_password => lookup('CONFIG_MARIADB_PW'),
           provider    => 'mysql',
         }
 
         remote_database_user { 'nova_api@%':
           password_hash => mysql_password($mariadb_nova_noinstall_db_pw),
-          db_host       => hiera('CONFIG_MARIADB_HOST'),
+          db_host       => lookup('CONFIG_MARIADB_HOST'),
-          db_user       => hiera('CONFIG_MARIADB_USER'),
+          db_user       => lookup('CONFIG_MARIADB_USER'),
-          db_password   => hiera('CONFIG_MARIADB_PW'),
+          db_password   => lookup('CONFIG_MARIADB_PW'),
           provider      => 'mysql',
           require       => Remote_database['nova_api'],
         }
 
         remote_database_grant { 'nova_api@%/nova_api':
           privileges  => 'all',
-          db_host     => hiera('CONFIG_MARIADB_HOST'),
+          db_host     => lookup('CONFIG_MARIADB_HOST'),
-          db_user     => hiera('CONFIG_MARIADB_USER'),
+          db_user     => lookup('CONFIG_MARIADB_USER'),
-          db_password => hiera('CONFIG_MARIADB_PW'),
+          db_password => lookup('CONFIG_MARIADB_PW'),
           provider    => 'mysql',
           require     => Remote_database_user['nova_api@%'],
         }
@@ -368,26 +368,26 @@ class packstack::mariadb::services_remote () {
         remote_database { 'placement':
           ensure      => 'present',
           charset     => 'utf8',
-          db_host     => hiera('CONFIG_MARIADB_HOST'),
+          db_host     => lookup('CONFIG_MARIADB_HOST'),
-          db_user     => hiera('CONFIG_MARIADB_USER'),
+          db_user     => lookup('CONFIG_MARIADB_USER'),
-          db_password => hiera('CONFIG_MARIADB_PW'),
+          db_password => lookup('CONFIG_MARIADB_PW'),
           provider    => 'mysql',
         }
 
         remote_database_user { 'placement@%':
           password_hash => mysql_password($mariadb_nova_noinstall_db_pw),
-          db_host       => hiera('CONFIG_MARIADB_HOST'),
+          db_host       => lookup('CONFIG_MARIADB_HOST'),
-          db_user       => hiera('CONFIG_MARIADB_USER'),
+          db_user       => lookup('CONFIG_MARIADB_USER'),
-          db_password   => hiera('CONFIG_MARIADB_PW'),
+          db_password   => lookup('CONFIG_MARIADB_PW'),
           provider      => 'mysql',
           require       => Remote_database['placement'],
         }
 
         remote_database_grant { 'placement@%/placement':
           privileges  => 'all',
-          db_host     => hiera('CONFIG_MARIADB_HOST'),
+          db_host     => lookup('CONFIG_MARIADB_HOST'),
-          db_user     => hiera('CONFIG_MARIADB_USER'),
+          db_user     => lookup('CONFIG_MARIADB_USER'),
-          db_password => hiera('CONFIG_MARIADB_PW'),
+          db_password => lookup('CONFIG_MARIADB_PW'),
           provider    => 'mysql',
           require     => Remote_database_user['placement@%'],
         }
@@ -395,17 +395,17 @@ class packstack::mariadb::services_remote () {
         remote_database { 'nova_cell0':
           ensure      => 'present',
           charset     => 'utf8',
-          db_host     => hiera('CONFIG_MARIADB_HOST'),
+          db_host     => lookup('CONFIG_MARIADB_HOST'),
-          db_user     => hiera('CONFIG_MARIADB_USER'),
+          db_user     => lookup('CONFIG_MARIADB_USER'),
-          db_password => hiera('CONFIG_MARIADB_PW'),
+          db_password => lookup('CONFIG_MARIADB_PW'),
           provider    => 'mysql',
         }
 
         remote_database_grant { 'nova@%/nova_cell0':
           privileges  => 'all',
-          db_host     => hiera('CONFIG_MARIADB_HOST'),
+          db_host     => lookup('CONFIG_MARIADB_HOST'),
-          db_user     => hiera('CONFIG_MARIADB_USER'),
+          db_user     => lookup('CONFIG_MARIADB_USER'),
-          db_password => hiera('CONFIG_MARIADB_PW'),
+          db_password => lookup('CONFIG_MARIADB_PW'),
           provider    => 'mysql',
           require     => [ Remote_database_user['nova@%'],
                           Remote_database['nova_cell0'] ],
@@ -413,63 +413,63 @@ class packstack::mariadb::services_remote () {
 
     }
 
-    if hiera('CONFIG_SAHARA_INSTALL') == 'y' {
+    if lookup('CONFIG_SAHARA_INSTALL') == 'y' {
         remote_database { 'sahara':
           ensure      => 'present',
           charset     => 'utf8',
-          db_host     => hiera('CONFIG_MARIADB_HOST'),
+          db_host     => lookup('CONFIG_MARIADB_HOST'),
-          db_user     => hiera('CONFIG_MARIADB_USER'),
+          db_user     => lookup('CONFIG_MARIADB_USER'),
-          db_password => hiera('CONFIG_MARIADB_PW'),
+          db_password => lookup('CONFIG_MARIADB_PW'),
           provider    => 'mysql',
         }
 
-        $sahara_cfg_sahara_db_pw = hiera('CONFIG_SAHARA_DB_PW')
+        $sahara_cfg_sahara_db_pw = lookup('CONFIG_SAHARA_DB_PW')
 
         remote_database_user { 'sahara@%':
           password_hash => mysql_password($sahara_cfg_sahara_db_pw),
-          db_host       => hiera('CONFIG_MARIADB_HOST'),
+          db_host       => lookup('CONFIG_MARIADB_HOST'),
-          db_user       => hiera('CONFIG_MARIADB_USER'),
+          db_user       => lookup('CONFIG_MARIADB_USER'),
-          db_password   => hiera('CONFIG_MARIADB_PW'),
+          db_password   => lookup('CONFIG_MARIADB_PW'),
           provider      => 'mysql',
           require       => Remote_database['sahara'],
         }
 
         remote_database_grant { 'sahara@%/sahara':
           privileges  => 'all',
-          db_host     => hiera('CONFIG_MARIADB_HOST'),
+          db_host     => lookup('CONFIG_MARIADB_HOST'),
-          db_user     => hiera('CONFIG_MARIADB_USER'),
+          db_user     => lookup('CONFIG_MARIADB_USER'),
-          db_password => hiera('CONFIG_MARIADB_PW'),
+          db_password => lookup('CONFIG_MARIADB_PW'),
           provider    => 'mysql',
           require     => Remote_database_user['sahara@%'],
         }
     }
 
-    if hiera('CONFIG_TROVE_INSTALL') == 'y' {
+    if lookup('CONFIG_TROVE_INSTALL') == 'y' {
         remote_database { 'trove':
           ensure      => 'present',
           charset     => 'utf8',
-          db_host     => hiera('CONFIG_MARIADB_HOST'),
+          db_host     => lookup('CONFIG_MARIADB_HOST'),
-          db_user     => hiera('CONFIG_MARIADB_USER'),
+          db_user     => lookup('CONFIG_MARIADB_USER'),
-          db_password => hiera('CONFIG_MARIADB_PW'),
+          db_password => lookup('CONFIG_MARIADB_PW'),
           provider    => 'mysql',
         }
 
-        $trove_cfg_trove_db_pw = hiera('CONFIG_TROVE_DB_PW')
+        $trove_cfg_trove_db_pw = lookup('CONFIG_TROVE_DB_PW')
 
         remote_database_user { 'trove@%':
           password_hash => mysql_password($trove_cfg_trove_db_pw),
-          db_host       => hiera('CONFIG_MARIADB_HOST'),
+          db_host       => lookup('CONFIG_MARIADB_HOST'),
-          db_user       => hiera('CONFIG_MARIADB_USER'),
+          db_user       => lookup('CONFIG_MARIADB_USER'),
-          db_password   => hiera('CONFIG_MARIADB_PW'),
+          db_password   => lookup('CONFIG_MARIADB_PW'),
           provider      => 'mysql',
           require       => Remote_database['trove'],
         }
 
         remote_database_grant { 'trove@%/trove':
           privileges  => 'all',
-          db_host     => hiera('CONFIG_MARIADB_HOST'),
+          db_host     => lookup('CONFIG_MARIADB_HOST'),
-          db_user     => hiera('CONFIG_MARIADB_USER'),
+          db_user     => lookup('CONFIG_MARIADB_USER'),
-          db_password => hiera('CONFIG_MARIADB_PW'),
+          db_password => lookup('CONFIG_MARIADB_PW'),
           provider    => 'mysql',
           require     => Remote_database_user['trove@%'],
         }

packstack/puppet/modules/packstack/manifests/memcached.pp

@@ -1,6 +1,6 @@
 class packstack::memcached ()
 {
-    $memcached_bind_host = hiera('CONFIG_IP_VERSION') ? {
+    $memcached_bind_host = lookup('CONFIG_IP_VERSION') ? {
       'ipv6'  => '::',
       default => '0.0.0.0',
       # TO-DO(mmagr): Add IPv6 support when hostnames are used

packstack/puppet/modules/packstack/manifests/neutron.pp

@@ -1,9 +1,9 @@
 class packstack::neutron ()
 {
-    $neutron_db_host         = hiera('CONFIG_MARIADB_HOST_URL')
+    $neutron_db_host         = lookup('CONFIG_MARIADB_HOST_URL')
-    $neutron_db_name         = hiera('CONFIG_NEUTRON_L2_DBNAME')
+    $neutron_db_name         = lookup('CONFIG_NEUTRON_L2_DBNAME')
     $neutron_db_user         = 'neutron'
-    $neutron_db_password     = hiera('CONFIG_NEUTRON_DB_PW')
+    $neutron_db_password     = lookup('CONFIG_NEUTRON_DB_PW')
     $neutron_sql_connection  = "mysql+pymysql://${neutron_db_user}:${neutron_db_password}@${neutron_db_host}/${neutron_db_name}"
-    $neutron_user_password   = hiera('CONFIG_NEUTRON_KS_PW')
+    $neutron_user_password   = lookup('CONFIG_NEUTRON_KS_PW')
 }

packstack/puppet/modules/packstack/manifests/neutron/api.pp

@@ -1,20 +1,20 @@
 class packstack::neutron::api ()
 {
-    create_resources(packstack::firewall, hiera('FIREWALL_NEUTRON_SERVER_RULES', {}))
+    create_resources(packstack::firewall, lookup('FIREWALL_NEUTRON_SERVER_RULES', undef, undef, {}))
 
-    $neutron_db_host         = hiera('CONFIG_MARIADB_HOST_URL')
+    $neutron_db_host         = lookup('CONFIG_MARIADB_HOST_URL')
-    $neutron_db_name         = hiera('CONFIG_NEUTRON_L2_DBNAME')
+    $neutron_db_name         = lookup('CONFIG_NEUTRON_L2_DBNAME')
     $neutron_db_user         = 'neutron'
-    $neutron_db_password     = hiera('CONFIG_NEUTRON_DB_PW')
+    $neutron_db_password     = lookup('CONFIG_NEUTRON_DB_PW')
     $neutron_sql_connection  = "mysql+pymysql://${neutron_db_user}:${neutron_db_password}@${neutron_db_host}/${neutron_db_name}"
-    $neutron_user_password   = hiera('CONFIG_NEUTRON_KS_PW')
+    $neutron_user_password   = lookup('CONFIG_NEUTRON_KS_PW')
-    $neutron_vpnaas_enabled  = str2bool(hiera('CONFIG_NEUTRON_VPNAAS'))
+    $neutron_vpnaas_enabled  = str2bool(lookup('CONFIG_NEUTRON_VPNAAS'))
 
     class { 'neutron::keystone::authtoken':
       username             => 'neutron',
       password             => $neutron_user_password,
-      www_authenticate_uri => hiera('CONFIG_KEYSTONE_PUBLIC_URL_VERSIONLESS'),
+      www_authenticate_uri => lookup('CONFIG_KEYSTONE_PUBLIC_URL_VERSIONLESS'),
-      auth_url             => hiera('CONFIG_KEYSTONE_ADMIN_URL'),
+      auth_url             => lookup('CONFIG_KEYSTONE_ADMIN_URL'),
       project_name         => 'services',
     }
 
@@ -25,9 +25,9 @@ class packstack::neutron::api ()
     class { 'neutron::server':
       sync_db               => true,
       enabled               => true,
-      api_workers           => hiera('CONFIG_SERVICE_WORKERS'),
+      api_workers           => lookup('CONFIG_SERVICE_WORKERS'),
-      rpc_workers           => hiera('CONFIG_SERVICE_WORKERS'),
+      rpc_workers           => lookup('CONFIG_SERVICE_WORKERS'),
-      service_providers     => hiera_array('SERVICE_PROVIDERS'),
+      service_providers     => lookup('SERVICE_PROVIDERS', { merge => 'unique' }),
       ensure_vpnaas_package => $neutron_vpnaas_enabled,
     }
 

packstack/puppet/modules/packstack/manifests/neutron/dhcp.pp

@@ -1,10 +1,10 @@
 class packstack::neutron::dhcp ()
 {
-    create_resources(packstack::firewall, hiera('FIREWALL_NEUTRON_DHCPIN_RULES', {}))
+    create_resources(packstack::firewall, lookup('FIREWALL_NEUTRON_DHCPIN_RULES', undef, undef, {}))
-    create_resources(packstack::firewall, hiera('FIREWALL_NEUTRON_DHCPOUT_RULES', {}))
+    create_resources(packstack::firewall, lookup('FIREWALL_NEUTRON_DHCPOUT_RULES', undef, undef, {}))
 
     class { 'neutron::agents::dhcp':
-      interface_driver => hiera('CONFIG_NEUTRON_DHCP_INTERFACE_DRIVER'),
+      interface_driver => lookup('CONFIG_NEUTRON_DHCP_INTERFACE_DRIVER'),
-      debug            => hiera('CONFIG_DEBUG_MODE'),
+      debug            => lookup('CONFIG_DEBUG_MODE'),
     }
 }

packstack/puppet/modules/packstack/manifests/neutron/l3.pp

@@ -1,15 +1,15 @@
 class packstack::neutron::l3 ()
 {
-    $start_l3_agent = hiera('CONFIG_NEUTRON_VPNAAS') ? {
+    $start_l3_agent = lookup('CONFIG_NEUTRON_VPNAAS') ? {
         'y'     => false,
         default => true
     }
 
     class { 'neutron::agents::l3':
-      interface_driver => hiera('CONFIG_NEUTRON_L3_INTERFACE_DRIVER'),
+      interface_driver => lookup('CONFIG_NEUTRON_L3_INTERFACE_DRIVER'),
       manage_service   => $start_l3_agent,
       enabled          => $start_l3_agent,
-      debug            => hiera('CONFIG_DEBUG_MODE'),
+      debug            => lookup('CONFIG_DEBUG_MODE'),
     }
 
     sysctl::value { 'net.ipv4.ip_forward':

packstack/puppet/modules/packstack/manifests/neutron/lb_agent.pp

@@ -1,21 +1,21 @@
 class packstack::neutron::lb_agent ()
 {
 
-    $bind_host = hiera('CONFIG_IP_VERSION') ? {
+    $bind_host = lookup('CONFIG_IP_VERSION') ? {
       'ipv6'  => '::0',
       default => '0.0.0.0',
       # TO-DO(mmagr): Add IPv6 support when hostnames are used
     }
 
-    $neutron_lb_interface_mappings = hiera_array('CONFIG_NEUTRON_LB_INTERFACE_MAPPINGS')
+    $neutron_lb_interface_mappings = lookup('CONFIG_NEUTRON_LB_INTERFACE_MAPPINGS', { merge => 'unique' })
 
-    $use_subnets_value = hiera('CONFIG_USE_SUBNETS')
+    $use_subnets_value = lookup('CONFIG_USE_SUBNETS')
     $use_subnets = $use_subnets_value ? {
       'y'     => true,
       default => false,
     }
 
-    if ( 'vxlan' in hiera_array('CONFIG_NEUTRON_ML2_TYPE_DRIVERS') ){
+    if ( 'vxlan' in lookup('CONFIG_NEUTRON_ML2_TYPE_DRIVERS', { merge => 'unique' }) ){
       class { 'neutron::agents::ml2::linuxbridge':
         physical_interface_mappings => force_interface($neutron_lb_interface_mappings, $use_subnets),
         tunnel_types                => ['vxlan'],

packstack/puppet/modules/packstack/manifests/neutron/metadata.pp

@@ -1,9 +1,9 @@
 class packstack::neutron::metadata ()
 {
     class { 'neutron::agents::metadata':
-      shared_secret    => hiera('CONFIG_NEUTRON_METADATA_PW'),
+      shared_secret    => lookup('CONFIG_NEUTRON_METADATA_PW'),
-      metadata_host    => force_ip(hiera('CONFIG_KEYSTONE_HOST_URL')),
+      metadata_host    => force_ip(lookup('CONFIG_KEYSTONE_HOST_URL')),
-      debug            => hiera('CONFIG_DEBUG_MODE'),
+      debug            => lookup('CONFIG_DEBUG_MODE'),
-      metadata_workers => hiera('CONFIG_SERVICE_WORKERS'),
+      metadata_workers => lookup('CONFIG_SERVICE_WORKERS'),
     }
 }

packstack/puppet/modules/packstack/manifests/neutron/metering.pp

@@ -1,7 +1,7 @@
 class packstack::neutron::metering ()
 {
     class { 'neutron::agents::metering':
-      interface_driver => hiera('CONFIG_NEUTRON_METERING_IFCE_DRIVER'),
+      interface_driver => lookup('CONFIG_NEUTRON_METERING_IFCE_DRIVER'),
-      debug            => hiera('CONFIG_DEBUG_MODE'),
+      debug            => lookup('CONFIG_DEBUG_MODE'),
     }
 }

packstack/puppet/modules/packstack/manifests/neutron/ml2.pp

@@ -1,29 +1,29 @@
 class packstack::neutron::ml2 ()
 {
-    if hiera('CONFIG_NEUTRON_ML2_VXLAN_GROUP') == '' {
+    if lookup('CONFIG_NEUTRON_ML2_VXLAN_GROUP') == '' {
       $vxlan_group_value = undef
     } else {
-      $vxlan_group_value = hiera('CONFIG_NEUTRON_ML2_VXLAN_GROUP')
+      $vxlan_group_value = lookup('CONFIG_NEUTRON_ML2_VXLAN_GROUP')
     }
 
     class { 'neutron::plugins::ml2':
-      type_drivers          => hiera_array('CONFIG_NEUTRON_ML2_TYPE_DRIVERS'),
+      type_drivers          => lookup('CONFIG_NEUTRON_ML2_TYPE_DRIVERS', { merge => 'unique' }),
-      tenant_network_types  => hiera_array('CONFIG_NEUTRON_ML2_TENANT_NETWORK_TYPES'),
+      tenant_network_types  => lookup('CONFIG_NEUTRON_ML2_TENANT_NETWORK_TYPES', { merge => 'unique' }),
-      mechanism_drivers     => hiera_array('CONFIG_NEUTRON_ML2_MECHANISM_DRIVERS'),
+      mechanism_drivers     => lookup('CONFIG_NEUTRON_ML2_MECHANISM_DRIVERS', { merge => 'unique' }),
-      flat_networks         => hiera_array('CONFIG_NEUTRON_ML2_FLAT_NETWORKS'),
+      flat_networks         => lookup('CONFIG_NEUTRON_ML2_FLAT_NETWORKS', { merge => 'unique' }),
-      network_vlan_ranges   => hiera_array('CONFIG_NEUTRON_ML2_VLAN_RANGES'),
+      network_vlan_ranges   => lookup('CONFIG_NEUTRON_ML2_VLAN_RANGES', { merge => 'unique' }),
-      tunnel_id_ranges      => hiera_array('CONFIG_NEUTRON_ML2_TUNNEL_ID_RANGES'),
+      tunnel_id_ranges      => lookup('CONFIG_NEUTRON_ML2_TUNNEL_ID_RANGES', { merge => 'unique' }),
       vxlan_group           => $vxlan_group_value,
-      vni_ranges            => hiera_array('CONFIG_NEUTRON_ML2_VNI_RANGES'),
+      vni_ranges            => lookup('CONFIG_NEUTRON_ML2_VNI_RANGES', { merge => 'unique' }),
       enable_security_group => true,
       extension_drivers     => 'port_security,qos',
       max_header_size       => 38,
     }
 
-    if hiera('CONFIG_NEUTRON_L2_AGENT') == 'ovn' {
+    if lookup('CONFIG_NEUTRON_L2_AGENT') == 'ovn' {
       class { 'neutron::plugins::ml2::ovn':
-        ovn_nb_connection    => "tcp:${hiera('CONFIG_CONTROLLER_HOST')}:6641",
+        ovn_nb_connection    => "tcp:${lookup('CONFIG_CONTROLLER_HOST')}:6641",
-        ovn_sb_connection    => "tcp:${hiera('CONFIG_CONTROLLER_HOST')}:6642",
+        ovn_sb_connection    => "tcp:${lookup('CONFIG_CONTROLLER_HOST')}:6642",
         ovn_metadata_enabled => true,
       }
     }

packstack/puppet/modules/packstack/manifests/neutron/notifications.pp

@@ -1,6 +1,6 @@
 class packstack::neutron::notifications ()
 {
-    $neutron_notif_cfg_ctrl_host = hiera('CONFIG_KEYSTONE_HOST_URL')
+    $neutron_notif_cfg_ctrl_host = lookup('CONFIG_KEYSTONE_HOST_URL')
 
     # Configure nova notifications system
     class { 'neutron::server::notifications':
@@ -8,9 +8,9 @@ class packstack::neutron::notifications ()
 
     class { 'neutron::server::notifications::nova':
       username     => 'nova',
-      password     => hiera('CONFIG_NOVA_KS_PW'),
+      password     => lookup('CONFIG_NOVA_KS_PW'),
       project_name => 'services',
-      auth_url     => hiera('CONFIG_KEYSTONE_ADMIN_URL'),
+      auth_url     => lookup('CONFIG_KEYSTONE_ADMIN_URL'),
-      region_name  => hiera('CONFIG_KEYSTONE_REGION'),
+      region_name  => lookup('CONFIG_KEYSTONE_REGION'),
     }
 }

packstack/puppet/modules/packstack/manifests/neutron/ovn_agent.pp

@@ -1,13 +1,13 @@
 class packstack::neutron::ovn_agent ()
 {
-    $my_ip = choose_my_ip(hiera('HOST_LIST'))
+    $my_ip = choose_my_ip(lookup('HOST_LIST'))
     $my_ip_without_dot = regsubst($my_ip, '[\.\:]', '_', 'G')
     $neutron_tunnel_rule_name = "FIREWALL_NEUTRON_TUNNEL_RULES_${my_ip_without_dot}"
-    create_resources(packstack::firewall, hiera($neutron_tunnel_rule_name, {}))
+    create_resources(packstack::firewall, lookup($neutron_tunnel_rule_name, undef, undef, {}))
 
-    $neutron_ovn_tunnel_if = hiera('CONFIG_NEUTRON_OVN_TUNNEL_IF', undef)
+    $neutron_ovn_tunnel_if = lookup('CONFIG_NEUTRON_OVN_TUNNEL_IF', undef, undef, undef)
 
-    $use_subnets_value = hiera('CONFIG_USE_SUBNETS')
+    $use_subnets_value = lookup('CONFIG_USE_SUBNETS')
     $use_subnets = $use_subnets_value ? {
       'y'     => true,
       default => false,
@@ -23,11 +23,11 @@ class packstack::neutron::ovn_agent ()
       $iface = regsubst($ovn_agent_tunnel_cfg_neut_ovs_tun_if, '[\.\-\:]', '_', 'G')
       $localip = inline_template("<%= scope.lookupvar('::ipaddress_${iface}') %>")
     } else {
-      $localip = choose_my_ip(hiera('HOST_LIST'))
+      $localip = choose_my_ip(lookup('HOST_LIST'))
     }
 
-    $network_hosts =  split(hiera('CONFIG_NETWORK_HOSTS'),',')
+    $network_hosts =  split(lookup('CONFIG_NETWORK_HOSTS'),',')
-    if member($network_hosts, choose_my_ip(hiera('HOST_LIST'))) {
+    if member($network_hosts, choose_my_ip(lookup('HOST_LIST'))) {
       $bridge_ifaces_param = 'CONFIG_NEUTRON_OVS_BRIDGE_IFACES'
       $bridge_mappings_param = 'CONFIG_NEUTRON_OVS_BRIDGE_MAPPINGS'
     } else {
@@ -35,15 +35,15 @@ class packstack::neutron::ovn_agent ()
       $bridge_mappings_param = 'CONFIG_NEUTRON_OVS_BRIDGE_MAPPINGS_COMPUTE'
     }
 
-    if hiera('CREATE_BRIDGES') == 'y' {
+    if lookup('CREATE_BRIDGES') == 'y' {
-      $bridge_uplinks  = hiera_array($bridge_ifaces_param)
+      $bridge_uplinks  = lookup($bridge_ifaces_param, { merge => 'unique' })
-      $bridge_mappings = hiera_array($bridge_mappings_param)
+      $bridge_mappings = lookup($bridge_mappings_param, { merge => 'unique' })
     } else {
       $bridge_uplinks  = []
       $bridge_mappings = []
     }
 
-    $ovn_southd = "tcp:${hiera('CONFIG_CONTROLLER_HOST')}:6642"
+    $ovn_southd = "tcp:${lookup('CONFIG_CONTROLLER_HOST')}:6642"
 
     class { 'ovn::controller':
       ovn_remote                => $ovn_southd,

packstack/puppet/modules/packstack/manifests/neutron/ovn_metadata.pp

@@ -1,13 +1,13 @@
 class packstack::neutron::ovn_metadata ()
 {
-    $ovn_southd = "tcp:${hiera('CONFIG_CONTROLLER_HOST')}:6642"
+    $ovn_southd = "tcp:${lookup('CONFIG_CONTROLLER_HOST')}:6642"
 
     class { 'neutron::agents::ovn_metadata':
       ovn_sb_connection => $ovn_southd,
-      shared_secret     => hiera('CONFIG_NEUTRON_METADATA_PW'),
+      shared_secret     => lookup('CONFIG_NEUTRON_METADATA_PW'),
-      metadata_host     => force_ip(hiera('CONFIG_KEYSTONE_HOST_URL')),
+      metadata_host     => force_ip(lookup('CONFIG_KEYSTONE_HOST_URL')),
-      debug             => hiera('CONFIG_DEBUG_MODE'),
+      debug             => lookup('CONFIG_DEBUG_MODE'),
-      metadata_workers  => hiera('CONFIG_SERVICE_WORKERS'),
+      metadata_workers  => lookup('CONFIG_SERVICE_WORKERS'),
     }
     Service<| title == 'controller' |> -> Service<| title == 'ovn-metadata' |>
 }

packstack/puppet/modules/packstack/manifests/neutron/ovs_agent.pp

@@ -1,13 +1,13 @@
 class packstack::neutron::ovs_agent ()
 {
-    $my_ip = choose_my_ip(hiera('HOST_LIST'))
+    $my_ip = choose_my_ip(lookup('HOST_LIST'))
     $my_ip_without_dot = regsubst($my_ip, '[\.\:]', '_', 'G')
     $neutron_tunnel_rule_name = "FIREWALL_NEUTRON_TUNNEL_RULES_${my_ip_without_dot}"
-    create_resources(packstack::firewall, hiera($neutron_tunnel_rule_name, {}))
+    create_resources(packstack::firewall, lookup($neutron_tunnel_rule_name, undef, undef, {}))
 
-    $neutron_ovs_tunnel_if = hiera('CONFIG_NEUTRON_OVS_TUNNEL_IF', undef)
+    $neutron_ovs_tunnel_if = lookup('CONFIG_NEUTRON_OVS_TUNNEL_IF', undef, undef, undef)
 
-    $use_subnets_value = hiera('CONFIG_USE_SUBNETS')
+    $use_subnets_value = lookup('CONFIG_USE_SUBNETS')
     $use_subnets = $use_subnets_value ? {
       'y'     => true,
       default => false,
@@ -23,11 +23,11 @@ class packstack::neutron::ovs_agent ()
       $iface = regsubst($ovs_agent_vxlan_cfg_neut_ovs_tun_if, '[\.\-\:]', '_', 'G')
       $localip = inline_template("<%= scope.lookupvar('::ipaddress_${iface}') %>")
     } else {
-      $localip = choose_my_ip(hiera('HOST_LIST'))
+      $localip = choose_my_ip(lookup('HOST_LIST'))
     }
 
-    $network_hosts =  split(hiera('CONFIG_NETWORK_HOSTS'),',')
+    $network_hosts =  split(lookup('CONFIG_NETWORK_HOSTS'),',')
-    if member($network_hosts, choose_my_ip(hiera('HOST_LIST'))) {
+    if member($network_hosts, choose_my_ip(lookup('HOST_LIST'))) {
       $bridge_ifaces_param = 'CONFIG_NEUTRON_OVS_BRIDGE_IFACES'
       $bridge_mappings_param = 'CONFIG_NEUTRON_OVS_BRIDGE_MAPPINGS'
     } else {
@@ -35,9 +35,9 @@ class packstack::neutron::ovs_agent ()
       $bridge_mappings_param = 'CONFIG_NEUTRON_OVS_BRIDGE_MAPPINGS_COMPUTE'
     }
 
-    if hiera('CREATE_BRIDGES') == 'y' {
+    if lookup('CREATE_BRIDGES') == 'y' {
-      $bridge_uplinks  = hiera_array($bridge_ifaces_param)
+      $bridge_uplinks  = lookup($bridge_ifaces_param, { merge => 'unique' })
-      $bridge_mappings = hiera_array($bridge_mappings_param)
+      $bridge_mappings = lookup($bridge_mappings_param, { merge => 'unique' })
     } else {
       $bridge_uplinks  = []
       $bridge_mappings = []
@@ -46,10 +46,10 @@ class packstack::neutron::ovs_agent ()
     class { 'neutron::agents::ml2::ovs':
       bridge_uplinks  => $bridge_uplinks,
       bridge_mappings => $bridge_mappings,
-      tunnel_types    => hiera_array('CONFIG_NEUTRON_OVS_TUNNEL_TYPES'),
+      tunnel_types    => lookup('CONFIG_NEUTRON_OVS_TUNNEL_TYPES', { merge => 'unique' }),
       local_ip        => force_ip($localip),
-      vxlan_udp_port  => hiera('CONFIG_NEUTRON_OVS_VXLAN_UDP_PORT',undef),
+      vxlan_udp_port  => lookup('CONFIG_NEUTRON_OVS_VXLAN_UDP_PORT', undef, undef, undef),
-      l2_population   => hiera('CONFIG_NEUTRON_USE_L2POPULATION'),
+      l2_population   => lookup('CONFIG_NEUTRON_USE_L2POPULATION'),
-      firewall_driver => hiera('FIREWALL_DRIVER'),
+      firewall_driver => lookup('FIREWALL_DRIVER'),
     }
 }

packstack/puppet/modules/packstack/manifests/neutron/ovs_bridge.pp

@@ -2,7 +2,7 @@ class packstack::neutron::ovs_bridge ()
 {
   $agent_service = 'neutron-ovs-agent-service'
 
-  $config_neutron_ovs_bridge = hiera('CONFIG_NEUTRON_OVS_BRIDGE')
+  $config_neutron_ovs_bridge = lookup('CONFIG_NEUTRON_OVS_BRIDGE')
 
   vs_bridge { $config_neutron_ovs_bridge:
     ensure  => present,

packstack/puppet/modules/packstack/manifests/neutron/rabbitmq.pp

@@ -1,19 +1,19 @@
 class packstack::neutron::rabbitmq ()
 {
-    $bind_host = hiera('CONFIG_IP_VERSION') ? {
+    $bind_host = lookup('CONFIG_IP_VERSION') ? {
       'ipv6'  => '::0',
       default => '0.0.0.0',
       # TO-DO(mmagr): Add IPv6 support when hostnames are used
     }
 
-    $kombu_ssl_ca_certs = hiera('CONFIG_AMQP_SSL_CACERT_FILE', undef)
+    $kombu_ssl_ca_certs = lookup('CONFIG_AMQP_SSL_CACERT_FILE', undef, undef, undef)
-    $kombu_ssl_keyfile = hiera('CONFIG_NEUTRON_SSL_KEY', undef)
+    $kombu_ssl_keyfile = lookup('CONFIG_NEUTRON_SSL_KEY', undef, undef, undef)
-    $kombu_ssl_certfile = hiera('CONFIG_NEUTRON_SSL_CERT', undef)
+    $kombu_ssl_certfile = lookup('CONFIG_NEUTRON_SSL_CERT', undef, undef, undef)
 
-    $rabbit_host = hiera('CONFIG_AMQP_HOST_URL')
+    $rabbit_host = lookup('CONFIG_AMQP_HOST_URL')
-    $rabbit_port = hiera('CONFIG_AMQP_CLIENTS_PORT')
+    $rabbit_port = lookup('CONFIG_AMQP_CLIENTS_PORT')
-    $rabbit_userid = hiera('CONFIG_AMQP_AUTH_USER')
+    $rabbit_userid = lookup('CONFIG_AMQP_AUTH_USER')
-    $rabbit_password = hiera('CONFIG_AMQP_AUTH_PASSWORD')
+    $rabbit_password = lookup('CONFIG_AMQP_AUTH_PASSWORD')
 
     if $kombu_ssl_keyfile {
       $files_to_set_owner = [ $kombu_ssl_keyfile, $kombu_ssl_certfile ]
@@ -27,15 +27,15 @@ class packstack::neutron::rabbitmq ()
     Service<| name == 'rabbitmq-server' |> -> Service<| tag == 'neutron-service' |>
 
     class { 'neutron::logging':
-      debug => hiera('CONFIG_DEBUG_MODE'),
+      debug => lookup('CONFIG_DEBUG_MODE'),
     }
 
     class { 'neutron':
       bind_host             => $bind_host,
-      rabbit_use_ssl        => hiera('CONFIG_AMQP_SSL_ENABLED'),
+      rabbit_use_ssl        => lookup('CONFIG_AMQP_SSL_ENABLED'),
       default_transport_url => "rabbit://${rabbit_userid}:${rabbit_password}@${rabbit_host}:${rabbit_port}/",
-      core_plugin           => hiera('CONFIG_NEUTRON_CORE_PLUGIN'),
+      core_plugin           => lookup('CONFIG_NEUTRON_CORE_PLUGIN'),
-      service_plugins       => hiera_array('SERVICE_PLUGINS'),
+      service_plugins       => lookup('SERVICE_PLUGINS', { merge => 'unique' }),
       kombu_ssl_ca_certs    => $kombu_ssl_ca_certs,
       kombu_ssl_keyfile     => $kombu_ssl_keyfile,
       kombu_ssl_certfile    => $kombu_ssl_certfile,

packstack/puppet/modules/packstack/manifests/neutron/sriov.pp

@@ -1,6 +1,6 @@
 class packstack::neutron::sriov ()
 {
     class { 'neutron::agents::ml2::sriov' :
-      physical_device_mappings   => hiera_array('CONFIG_NEUTRON_ML2_SRIOV_INTERFACE_MAPPINGS'),
+      physical_device_mappings => lookup('CONFIG_NEUTRON_ML2_SRIOV_INTERFACE_MAPPINGS', { merge => 'unique' }),
     }
 }

packstack/puppet/modules/packstack/manifests/nova.pp

@@ -1,26 +1,26 @@
 class packstack::nova ()
 {
-    $nova_db_pw = hiera('CONFIG_NOVA_DB_PW')
+    $nova_db_pw = lookup('CONFIG_NOVA_DB_PW')
-    $nova_mariadb_host = hiera('CONFIG_MARIADB_HOST_URL')
+    $nova_mariadb_host = lookup('CONFIG_MARIADB_HOST_URL')
 
-    $rabbit_host = hiera('CONFIG_AMQP_HOST_URL')
+    $rabbit_host = lookup('CONFIG_AMQP_HOST_URL')
-    $rabbit_port = hiera('CONFIG_AMQP_CLIENTS_PORT')
+    $rabbit_port = lookup('CONFIG_AMQP_CLIENTS_PORT')
-    $rabbit_userid = hiera('CONFIG_AMQP_AUTH_USER')
+    $rabbit_userid = lookup('CONFIG_AMQP_AUTH_USER')
-    $rabbit_password = hiera('CONFIG_AMQP_AUTH_PASSWORD')
+    $rabbit_password = lookup('CONFIG_AMQP_AUTH_PASSWORD')
 
     $private_key = {
-      'type' => hiera('NOVA_MIGRATION_KEY_TYPE'),
+      'type' => lookup('NOVA_MIGRATION_KEY_TYPE'),
-      key  => hiera('NOVA_MIGRATION_KEY_SECRET'),
+      key  => lookup('NOVA_MIGRATION_KEY_SECRET'),
     }
     $public_key = {
-      'type' => hiera('NOVA_MIGRATION_KEY_TYPE'),
+      'type' => lookup('NOVA_MIGRATION_KEY_TYPE'),
-      key  => hiera('NOVA_MIGRATION_KEY_PUBLIC'),
+      key  => lookup('NOVA_MIGRATION_KEY_PUBLIC'),
     }
 
 
-    $kombu_ssl_ca_certs = hiera('CONFIG_AMQP_SSL_CACERT_FILE', undef)
+    $kombu_ssl_ca_certs = lookup('CONFIG_AMQP_SSL_CACERT_FILE', undef, undef, undef)
-    $kombu_ssl_keyfile = hiera('CONFIG_NOVA_SSL_KEY', undef)
+    $kombu_ssl_keyfile = lookup('CONFIG_NOVA_SSL_KEY', undef, undef, undef)
-    $kombu_ssl_certfile = hiera('CONFIG_NOVA_SSL_CERT', undef)
+    $kombu_ssl_certfile = lookup('CONFIG_NOVA_SSL_CERT', undef, undef, undef)
 
     if $kombu_ssl_keyfile {
       $files_to_set_owner = [ $kombu_ssl_keyfile, $kombu_ssl_certfile ]
@@ -33,7 +33,7 @@ class packstack::nova ()
     }
     Service<| name == 'rabbitmq-server' |> -> Service<| tag == 'nova-service' |>
 
-    if hiera('CONFIG_CEILOMETER_INSTALL') == 'y' {
+    if lookup('CONFIG_CEILOMETER_INSTALL') == 'y' {
       $nova_common_notification_driver = 'messagingv2'
       $notify_on_state_change = 'vm_and_task_state'
     } else {
@@ -41,16 +41,16 @@ class packstack::nova ()
       $notify_on_state_change = undef
     }
 
-    if hiera('CONFIG_NEUTRON_L2_AGENT') == 'ovn' {
+    if lookup('CONFIG_NEUTRON_L2_AGENT') == 'ovn' {
       $novahost = $::fqdn
     } else {
       $novahost = undef
     }
 
-    if hiera('CONFIG_HORIZON_SSL') == 'y' {
+    if lookup('CONFIG_HORIZON_SSL') == 'y' {
       $ssl_only = true
-      $cert = hiera('CONFIG_VNC_SSL_CERT')
+      $cert = lookup('CONFIG_VNC_SSL_CERT')
-      $key = hiera('CONFIG_VNC_SSL_KEY')
+      $key = lookup('CONFIG_VNC_SSL_KEY')
     } else {
       $ssl_only = false
       $cert = undef
@@ -58,7 +58,7 @@ class packstack::nova ()
     }
 
     class { 'nova::logging':
-      debug => hiera('CONFIG_DEBUG_MODE'),
+      debug => lookup('CONFIG_DEBUG_MODE'),
     }
 
     class { 'nova::db':
@@ -68,7 +68,7 @@ class packstack::nova ()
 
     class { 'nova':
       default_transport_url   => "rabbit://${rabbit_userid}:${rabbit_password}@${rabbit_host}:${rabbit_port}/",
-      rabbit_use_ssl          => hiera('CONFIG_AMQP_SSL_ENABLED'),
+      rabbit_use_ssl          => lookup('CONFIG_AMQP_SSL_ENABLED'),
       nova_public_key         => $public_key,
       nova_private_key        => $private_key,
       kombu_ssl_ca_certs      => $kombu_ssl_ca_certs,
@@ -76,8 +76,8 @@ class packstack::nova ()
       kombu_ssl_certfile      => $kombu_ssl_certfile,
       notification_driver     => $nova_common_notification_driver,
       notify_on_state_change  => $notify_on_state_change,
-      cpu_allocation_ratio    => hiera('CONFIG_NOVA_SCHED_CPU_ALLOC_RATIO'),
+      cpu_allocation_ratio    => lookup('CONFIG_NOVA_SCHED_CPU_ALLOC_RATIO'),
-      ram_allocation_ratio    => hiera('CONFIG_NOVA_SCHED_RAM_ALLOC_RATIO'),
+      ram_allocation_ratio    => lookup('CONFIG_NOVA_SCHED_RAM_ALLOC_RATIO'),
       host                    => $novahost,
       ssl_only                => $ssl_only,
       cert                    => $cert,

packstack/puppet/modules/packstack/manifests/nova/api.pp

@@ -1,26 +1,26 @@
 class packstack::nova::api ()
 {
-    create_resources(packstack::firewall, hiera('FIREWALL_NOVA_API_RULES', {}))
+    create_resources(packstack::firewall, lookup('FIREWALL_NOVA_API_RULES', undef, undef, {}))
 
-    $bind_host = hiera('CONFIG_IP_VERSION') ? {
+    $bind_host = lookup('CONFIG_IP_VERSION') ? {
       'ipv6'  => '::0',
       default => '0.0.0.0',
       # TO-DO(mmagr): Add IPv6 support when hostnames are used
     }
 
-    $www_authenticate_uri = hiera('CONFIG_KEYSTONE_PUBLIC_URL_VERSIONLESS')
+    $www_authenticate_uri = lookup('CONFIG_KEYSTONE_PUBLIC_URL_VERSIONLESS')
-    $admin_password = hiera('CONFIG_NOVA_KS_PW')
+    $admin_password = lookup('CONFIG_NOVA_KS_PW')
 
     class { 'nova::keystone::authtoken':
       password             => $admin_password,
       www_authenticate_uri => $www_authenticate_uri,
-      auth_url             => hiera('CONFIG_KEYSTONE_ADMIN_URL'),
+      auth_url             => lookup('CONFIG_KEYSTONE_ADMIN_URL'),
     }
 
-    if hiera('CONFIG_NOVA_PCI_ALIAS') == '' {
+    if lookup('CONFIG_NOVA_PCI_ALIAS') == '' {
       $pci_alias = $::os_service_default
     } else {
-      $pci_alias = hiera('CONFIG_NOVA_PCI_ALIAS')
+      $pci_alias = lookup('CONFIG_NOVA_PCI_ALIAS')
     }
 
     class { 'nova::pci':
@@ -32,26 +32,26 @@ class packstack::nova::api ()
       enabled                    => true,
       sync_db                    => false,
       sync_db_api                => false,
-      osapi_compute_workers      => hiera('CONFIG_SERVICE_WORKERS'),
+      osapi_compute_workers      => lookup('CONFIG_SERVICE_WORKERS'),
-      allow_resize_to_same_host  => hiera('CONFIG_NOVA_ALLOW_RESIZE_TO_SAME'),
+      allow_resize_to_same_host  => lookup('CONFIG_NOVA_ALLOW_RESIZE_TO_SAME'),
       nova_metadata_wsgi_enabled => true,
       service_name               => 'httpd',
     }
 
     class { 'nova::metadata':
-      neutron_metadata_proxy_shared_secret => hiera('CONFIG_NEUTRON_METADATA_PW_UNQUOTED', undef),
+      neutron_metadata_proxy_shared_secret => lookup('CONFIG_NEUTRON_METADATA_PW_UNQUOTED', undef, undef, undef),
     }
 
     class { 'nova::wsgi::apache_api':
       bind_host => $bind_host,
       ssl       => false,
-      workers   => hiera('CONFIG_SERVICE_WORKERS'),
+      workers   => lookup('CONFIG_SERVICE_WORKERS'),
     }
 
     class { 'nova::wsgi::apache_metadata':
       bind_host => $bind_host,
       ssl       => false,
-      workers   => hiera('CONFIG_SERVICE_WORKERS'),
+      workers   => lookup('CONFIG_SERVICE_WORKERS'),
     }
 
     class { 'nova::db::sync':
@@ -65,10 +65,10 @@ class packstack::nova::api ()
     class { 'nova::placement':
       auth_url    => $www_authenticate_uri,
       password    => $admin_password,
-      region_name => hiera('CONFIG_KEYSTONE_REGION'),
+      region_name => lookup('CONFIG_KEYSTONE_REGION'),
     }
 
-    $db_purge = hiera('CONFIG_NOVA_DB_PURGE_ENABLE')
+    $db_purge = lookup('CONFIG_NOVA_DB_PURGE_ENABLE')
     if $db_purge {
       class { 'nova::cron::archive_deleted_rows':
         hour        => '*/12',
@@ -78,7 +78,7 @@ class packstack::nova::api ()
 
     include nova::cell_v2::simple_setup
 
-    $manage_flavors = str2bool(hiera('CONFIG_NOVA_MANAGE_FLAVORS'))
+    $manage_flavors = str2bool(lookup('CONFIG_NOVA_MANAGE_FLAVORS'))
     if $manage_flavors {
       Class['::nova::api'] -> Nova_flavor<||>
       Class['::keystone'] -> Nova_flavor<||>

packstack/puppet/modules/packstack/manifests/nova/ceilometer.pp

@@ -1,9 +1,9 @@
 class packstack::nova::ceilometer ()
 {
     class { 'ceilometer::agent::service_credentials':
-      auth_url     => hiera('CONFIG_KEYSTONE_PUBLIC_URL_VERSIONLESS'),
+      auth_url     => lookup('CONFIG_KEYSTONE_PUBLIC_URL_VERSIONLESS'),
-      password     => hiera('CONFIG_CEILOMETER_KS_PW'),
+      password     => lookup('CONFIG_CEILOMETER_KS_PW'),
-      region_name  => hiera('CONFIG_KEYSTONE_REGION'),
+      region_name  => lookup('CONFIG_KEYSTONE_REGION'),
     }
 
     ensure_packages(['openstack-ceilometer-ipmi'], {'ensure' => 'present'})

packstack/puppet/modules/packstack/manifests/nova/ceilometer/rabbitmq.pp

@@ -1,13 +1,13 @@
 class packstack::nova::ceilometer::rabbitmq ()
 {
-    $ceilometer_kombu_ssl_ca_certs = hiera('CONFIG_AMQP_SSL_CACERT_FILE', undef)
+    $ceilometer_kombu_ssl_ca_certs = lookup('CONFIG_AMQP_SSL_CACERT_FILE', undef, undef, undef)
-    $ceilometer_kombu_ssl_keyfile = hiera('CONFIG_CEILOMETER_SSL_KEY', undef)
+    $ceilometer_kombu_ssl_keyfile = lookup('CONFIG_CEILOMETER_SSL_KEY', undef, undef, undef)
-    $ceilometer_kombu_ssl_certfile = hiera('CONFIG_CEILOMETER_SSL_CERT', undef)
+    $ceilometer_kombu_ssl_certfile = lookup('CONFIG_CEILOMETER_SSL_CERT', undef, undef, undef)
 
-    $rabbit_host = hiera('CONFIG_AMQP_HOST_URL')
+    $rabbit_host = lookup('CONFIG_AMQP_HOST_URL')
-    $rabbit_port = hiera('CONFIG_AMQP_CLIENTS_PORT')
+    $rabbit_port = lookup('CONFIG_AMQP_CLIENTS_PORT')
-    $rabbit_userid = hiera('CONFIG_AMQP_AUTH_USER')
+    $rabbit_userid = lookup('CONFIG_AMQP_AUTH_USER')
-    $rabbit_password = hiera('CONFIG_AMQP_AUTH_PASSWORD')
+    $rabbit_password = lookup('CONFIG_AMQP_AUTH_PASSWORD')
 
     if $ceilometer_kombu_ssl_keyfile {
       $ceilometer_files_to_set_owner = [ $ceilometer_kombu_ssl_keyfile, $ceilometer_kombu_ssl_certfile ]
@@ -21,12 +21,12 @@ class packstack::nova::ceilometer::rabbitmq ()
     Service<| name == 'rabbitmq-server' |> -> Service<| tag == 'ceilometer-service' |>
 
     class { 'ceilometer::logging':
-        debug => hiera('CONFIG_DEBUG_MODE'),
+        debug => lookup('CONFIG_DEBUG_MODE'),
     }
 
     class { 'ceilometer':
-        telemetry_secret      => hiera('CONFIG_CEILOMETER_SECRET'),
+        telemetry_secret      => lookup('CONFIG_CEILOMETER_SECRET'),
-        rabbit_use_ssl        => hiera('CONFIG_AMQP_SSL_ENABLED'),
+        rabbit_use_ssl        => lookup('CONFIG_AMQP_SSL_ENABLED'),
         default_transport_url => "rabbit://${rabbit_userid}:${rabbit_password}@${rabbit_host}:${rabbit_port}/",
         # for some strange reason ceilometer needs to be in nova group
         require               => Package['nova-common'],

packstack/puppet/modules/packstack/manifests/nova/common.pp

@@ -6,6 +6,6 @@ class packstack::nova::common ()
 
     nova_config{
       # metadata_host has to be IP
-      'DEFAULT/metadata_host':         value => force_ip(hiera('CONFIG_CONTROLLER_HOST'));
+      'DEFAULT/metadata_host': value => force_ip(lookup('CONFIG_CONTROLLER_HOST'));
     }
 }

packstack/puppet/modules/packstack/manifests/nova/compute.pp

@@ -1,30 +1,30 @@
 class packstack::nova::compute ()
 {
-    $my_ip = choose_my_ip(hiera('HOST_LIST'))
+    $my_ip = choose_my_ip(lookup('HOST_LIST'))
     $my_ip_without_dot = regsubst($my_ip, '\.', '_', 'G')
     $qemu_rule_name = "FIREWALL_NOVA_QEMU_MIG_RULES_${my_ip_without_dot}"
-    create_resources(packstack::firewall, hiera($qemu_rule_name, {}))
+    create_resources(packstack::firewall, lookup($qemu_rule_name, undef, undef, {}))
-    create_resources(packstack::firewall, hiera('FIREWALL_NOVA_COMPUTE_RULES', {}))
+    create_resources(packstack::firewall, lookup('FIREWALL_NOVA_COMPUTE_RULES', undef, undef, {}))
 
     ensure_packages(['/usr/bin/cinder'], {'ensure' => 'present'})
     Package['/usr/bin/cinder'] -> Class['nova']
 
     # Install the private key to be used for live migration.  This needs to be
     # configured into libvirt/live_migration_uri in nova.conf.
-    $migrate_transport = hiera('CONFIG_NOVA_COMPUTE_MIGRATE_PROTOCOL')
+    $migrate_transport = lookup('CONFIG_NOVA_COMPUTE_MIGRATE_PROTOCOL')
     if $migrate_transport == 'ssh' {
       ensure_packages(['openstack-nova-migration'], {'ensure' => 'present'})
 
       file { '/etc/nova/migration/identity':
-        content => hiera('NOVA_MIGRATION_KEY_SECRET'),
+        content => lookup('NOVA_MIGRATION_KEY_SECRET'),
         mode    => '0600',
         owner   => nova,
         group   => nova,
         require => Package['openstack-nova-migration'],
       }
 
-      $key_type = hiera('NOVA_MIGRATION_KEY_TYPE')
+      $key_type = lookup('NOVA_MIGRATION_KEY_TYPE')
-      $key_content = hiera('NOVA_MIGRATION_KEY_PUBLIC')
+      $key_content = lookup('NOVA_MIGRATION_KEY_PUBLIC')
 
       file { '/etc/nova/migration/authorized_keys':
         content => "${key_type} ${key_content}",
@@ -60,12 +60,12 @@ class packstack::nova::compute ()
 
     if ($::fqdn == '' or $::fqdn =~ /localhost/) {
       # For cases where FQDNs have not been correctly set
-      $vncproxy_server = choose_my_ip(hiera('HOST_LIST'))
+      $vncproxy_server = choose_my_ip(lookup('HOST_LIST'))
     } else {
       $vncproxy_server = $::fqdn
     }
 
-    if hiera('CONFIG_CEILOMETER_INSTALL') == 'y' {
+    if lookup('CONFIG_CEILOMETER_INSTALL') == 'y' {
       $instance_usage_audit = true
       $instance_usage_audit_period = 'hour'
     } else {
@@ -74,13 +74,13 @@ class packstack::nova::compute ()
     }
 
     class { 'nova::compute::pci':
-      passthrough => hiera('CONFIG_NOVA_PCI_PASSTHROUGH_WHITELIST')
+      passthrough => lookup('CONFIG_NOVA_PCI_PASSTHROUGH_WHITELIST')
     }
 
     class { 'nova::compute':
       enabled                       => true,
-      vncproxy_host                 => hiera('CONFIG_KEYSTONE_HOST_URL'),
+      vncproxy_host                 => lookup('CONFIG_KEYSTONE_HOST_URL'),
-      vncproxy_protocol             => hiera('CONFIG_VNCPROXY_PROTOCOL'),
+      vncproxy_protocol             => lookup('CONFIG_VNCPROXY_PROTOCOL'),
       vncserver_proxyclient_address => $vncproxy_server,
       instance_usage_audit          => $instance_usage_audit,
       instance_usage_audit_period   => $instance_usage_audit_period,
@@ -89,9 +89,9 @@ class packstack::nova::compute ()
     }
 
     class { 'nova::placement':
-      auth_url    => hiera('CONFIG_KEYSTONE_PUBLIC_URL'),
+      auth_url    => lookup('CONFIG_KEYSTONE_PUBLIC_URL'),
-      password    => hiera('CONFIG_NOVA_KS_PW'),
+      password    => lookup('CONFIG_NOVA_KS_PW'),
-      region_name => hiera('CONFIG_KEYSTONE_REGION'),
+      region_name => lookup('CONFIG_KEYSTONE_REGION'),
     }
 
     # Tune the host with a virtual hosts profile

packstack/puppet/modules/packstack/manifests/nova/compute/ironic.pp

@@ -1,11 +1,11 @@
 class packstack::nova::compute::ironic ()
 {
-  $ironic_config_controller_host = hiera('CONFIG_KEYSTONE_HOST_URL')
+  $ironic_config_controller_host = lookup('CONFIG_KEYSTONE_HOST_URL')
-  $ironic_config_keystone_admin = hiera('CONFIG_KEYSTONE_ADMIN_URL')
+  $ironic_config_keystone_admin = lookup('CONFIG_KEYSTONE_ADMIN_URL')
 
   class { 'nova::ironic::common':
       username     => 'ironic',
-      password     => hiera('CONFIG_IRONIC_KS_PW'),
+      password     => lookup('CONFIG_IRONIC_KS_PW'),
       auth_url     => $ironic_config_keystone_admin,
       project_name => 'services',
       api_endpoint => "http://${ironic_config_controller_host}:6385/v1",

packstack/puppet/modules/packstack/manifests/nova/compute/libvirt.pp

@@ -4,13 +4,13 @@ class packstack::nova::compute::libvirt ()
     # preventing a clash with rules being set by libvirt
     Firewall <| |> -> Class['::nova::compute::libvirt']
 
-    $libvirt_vnc_bind_host = hiera('CONFIG_IP_VERSION') ? {
+    $libvirt_vnc_bind_host = lookup('CONFIG_IP_VERSION') ? {
       'ipv6'  => '::0',
       default => '0.0.0.0',
       # TO-DO(mmagr): Add IPv6 support when hostnames are used
     }
 
-    $libvirt_virt_type = hiera('CONFIG_NOVA_LIBVIRT_VIRT_TYPE')
+    $libvirt_virt_type = lookup('CONFIG_NOVA_LIBVIRT_VIRT_TYPE')
     if $libvirt_virt_type == 'kvm' {
         # Workaround for bad /dev/kvm permissions
         # https://bugzilla.redhat.com/show_bug.cgi?id=950436
@@ -27,7 +27,7 @@ class packstack::nova::compute::libvirt ()
         -> Service <| title == 'libvirt' |>
     }
 
-    $migrate_transport = hiera('CONFIG_NOVA_COMPUTE_MIGRATE_PROTOCOL')
+    $migrate_transport = lookup('CONFIG_NOVA_COMPUTE_MIGRATE_PROTOCOL')
     if $migrate_transport == 'ssh' {
       $client_extraparams = {
         keyfile   => '/etc/nova/migration/identity',
@@ -63,7 +63,7 @@ class packstack::nova::compute::libvirt ()
       require => Exec['virsh-net-destroy-default'],
     }
 
-    $libvirt_debug = hiera('CONFIG_DEBUG_MODE')
+    $libvirt_debug = lookup('CONFIG_DEBUG_MODE')
     if $libvirt_debug {
       file_line { '/etc/libvirt/libvirt.conf log_filters':
         path   => '/etc/libvirt/libvirtd.conf',

packstack/puppet/modules/packstack/manifests/nova/compute/vmware.pp

@@ -1,13 +1,13 @@
 class packstack::nova::compute::vmware ()
 {
-    $cluster_list = hiera('CONFIG_VCENTER_CLUSTERS')
+    $cluster_list = lookup('CONFIG_VCENTER_CLUSTERS')
-    $my_ip = choose_my_ip(hiera('HOST_LIST'))
+    $my_ip = choose_my_ip(lookup('HOST_LIST'))
     $nova_vcenter_cluster_name = $cluster_list[$my_ip]
 
     class { 'nova::compute::vmware':
-      host_ip       => hiera('CONFIG_VCENTER_HOST'),
+      host_ip       => lookup('CONFIG_VCENTER_HOST'),
-      host_username => hiera('CONFIG_VCENTER_USER'),
+      host_username => lookup('CONFIG_VCENTER_USER'),
-      host_password => hiera('CONFIG_VCENTER_PASSWORD'),
+      host_password => lookup('CONFIG_VCENTER_PASSWORD'),
       cluster_name  => $nova_vcenter_cluster_name,
     }
 }

packstack/puppet/modules/packstack/manifests/nova/conductor.pp

@@ -2,7 +2,7 @@ class packstack::nova::conductor ()
 {
     class { 'nova::conductor':
       enabled => true,
-      workers => hiera('CONFIG_SERVICE_WORKERS'),
+      workers => lookup('CONFIG_SERVICE_WORKERS'),
     }
 
     Keystone_endpoint <||> -> Service['nova-conductor']

packstack/puppet/modules/packstack/manifests/nova/neutron.pp

@@ -1,14 +1,14 @@
 class packstack::nova::neutron ()
 {
-    $nova_neutron_cfg_ctrl_host = hiera('CONFIG_KEYSTONE_HOST_URL')
+    $nova_neutron_cfg_ctrl_host = lookup('CONFIG_KEYSTONE_HOST_URL')
-    $neutron_auth_url = hiera('CONFIG_KEYSTONE_ADMIN_URL')
+    $neutron_auth_url = lookup('CONFIG_KEYSTONE_ADMIN_URL')
 
     class { 'nova::network::neutron':
       default_floating_pool => 'public',
-      password              => hiera('CONFIG_NEUTRON_KS_PW'),
+      password              => lookup('CONFIG_NEUTRON_KS_PW'),
       auth_type             => 'v3password',
       project_name          => 'services',
       auth_url              => "${neutron_auth_url}/v3",
-      region_name           => hiera('CONFIG_KEYSTONE_REGION'),
+      region_name           => lookup('CONFIG_KEYSTONE_REGION'),
     }
 }

packstack/puppet/modules/packstack/manifests/nova/vncproxy.pp

@@ -1,6 +1,6 @@
 class packstack::nova::vncproxy ()
 {
-    $vnc_bind_host = hiera('CONFIG_IP_VERSION') ? {
+    $vnc_bind_host = lookup('CONFIG_IP_VERSION') ? {
       'ipv6'  => '::0',
       default => '0.0.0.0',
       # TO-DO(mmagr): Add IPv6 support when hostnames are used

packstack/puppet/modules/packstack/manifests/openstackclient.pp

@@ -6,17 +6,17 @@ class packstack::openstackclient ()
 
     ensure_packages($clientlibs, {'ensure' => 'present'})
 
-    if hiera('CONFIG_MANILA_INSTALL') == 'y' {
+    if lookup('CONFIG_MANILA_INSTALL') == 'y' {
       ensure_packages(['/usr/bin/manila'], {'ensure' => 'present'})
     }
 
-    $ost_cl_keystone_admin_username = hiera('CONFIG_KEYSTONE_ADMIN_USERNAME')
+    $ost_cl_keystone_admin_username = lookup('CONFIG_KEYSTONE_ADMIN_USERNAME')
-    $ost_cl_keystone_admin_pw       = hiera('CONFIG_KEYSTONE_ADMIN_PW')
+    $ost_cl_keystone_admin_pw       = lookup('CONFIG_KEYSTONE_ADMIN_PW')
-    $ost_cl_ctrl_keystone_url       = hiera('CONFIG_KEYSTONE_PUBLIC_URL')
+    $ost_cl_ctrl_keystone_url       = lookup('CONFIG_KEYSTONE_PUBLIC_URL')
-    $ost_cl_keystone_region         = hiera('CONFIG_KEYSTONE_REGION')
+    $ost_cl_keystone_region         = lookup('CONFIG_KEYSTONE_REGION')
-    $ost_cl_keystone_demo_pw        = hiera('CONFIG_KEYSTONE_DEMO_PW')
+    $ost_cl_keystone_demo_pw        = lookup('CONFIG_KEYSTONE_DEMO_PW')
 
-    $config_keystone_api_version = hiera('CONFIG_KEYSTONE_API_VERSION')
+    $config_keystone_api_version = lookup('CONFIG_KEYSTONE_API_VERSION')
     if $config_keystone_api_version =~ /^v(\d+).*$/ {
       # we need to force integer here
       $int_api_version = 0 + $1
@@ -52,7 +52,7 @@ export OS_IDENTITY_API_VERSION=${int_api_version}
       content => $rcadmin_content,
     }
 
-    if hiera('CONFIG_PROVISION_DEMO') == 'y' {
+    if lookup('CONFIG_PROVISION_DEMO') == 'y' {
       $demo_common_content = "unset OS_SERVICE_TOKEN
 export OS_USERNAME=demo
 export OS_PASSWORD='${ost_cl_keystone_demo_pw}'
@@ -81,12 +81,12 @@ export OS_IDENTITY_API_VERSION=${int_api_version}
       }
     }
 
-    if hiera('NO_ROOT_USER_ALLINONE') == true {
+    if lookup('NO_ROOT_USER_ALLINONE') == true {
-      $ost_cl_home_dir = hiera('HOME_DIR')
+      $ost_cl_home_dir = lookup('HOME_DIR')
       file { "${ost_cl_home_dir}/keystonerc_admin":
         ensure  => file,
-        owner   => hiera('NO_ROOT_USER'),
+        owner   => lookup('NO_ROOT_USER'),
-        group   => hiera('NO_ROOT_GROUP'),
+        group   => lookup('NO_ROOT_GROUP'),
         mode    => '0600',
         content => $rcadmin_content,
       }

packstack/puppet/modules/packstack/manifests/placement.pp

@@ -1,8 +1,8 @@
 class packstack::placement ()
 {
-    $placement_db_pw = hiera('CONFIG_NOVA_DB_PW')
+    $placement_db_pw = lookup('CONFIG_NOVA_DB_PW')
-    $placement_mariadb_host = hiera('CONFIG_MARIADB_HOST_URL')
+    $placement_mariadb_host = lookup('CONFIG_MARIADB_HOST_URL')
-    $bind_host = hiera('CONFIG_IP_VERSION') ? {
+    $bind_host = lookup('CONFIG_IP_VERSION') ? {
       'ipv6'  => '::0',
       default => '0.0.0.0',
       # TO-DO(mmagr): Add IPv6 support when hostnames are used
@@ -12,7 +12,7 @@ class packstack::placement ()
     include placement
 
     class { 'placement::logging':
-      debug => hiera('CONFIG_DEBUG_MODE'),
+      debug => lookup('CONFIG_DEBUG_MODE'),
     }
 
     class { 'placement::db':
@@ -26,6 +26,6 @@ class packstack::placement ()
       bind_host => $bind_host,
       api_port  => '8778',
       ssl       => false,
-      workers   => hiera('CONFIG_SERVICE_WORKERS'),
+      workers   => lookup('CONFIG_SERVICE_WORKERS'),
     }
 }

packstack/puppet/modules/packstack/manifests/provision.pp

@@ -1,21 +1,21 @@
 class packstack::provision ()
 {
-    $provision_demo            = str2bool(hiera('CONFIG_PROVISION_DEMO'))
+    $provision_demo            = str2bool(lookup('CONFIG_PROVISION_DEMO'))
-    $provision_tempest         = str2bool(hiera('CONFIG_PROVISION_TEMPEST'))
+    $provision_tempest         = str2bool(lookup('CONFIG_PROVISION_TEMPEST'))
-    $provision_neutron         = str2bool(hiera('CONFIG_NEUTRON_INSTALL'))
+    $provision_neutron         = str2bool(lookup('CONFIG_NEUTRON_INSTALL'))
-    $heat_available            = str2bool(hiera('CONFIG_HEAT_INSTALL'))
+    $heat_available            = str2bool(lookup('CONFIG_HEAT_INSTALL'))
 
     if $provision_demo {
       $username             = 'demo'
-      $password             = hiera('CONFIG_KEYSTONE_DEMO_PW')
+      $password             = lookup('CONFIG_KEYSTONE_DEMO_PW')
       $tenant_name          = 'demo'
-      $floating_range       = hiera('CONFIG_PROVISION_DEMO_FLOATRANGE')
+      $floating_range       = lookup('CONFIG_PROVISION_DEMO_FLOATRANGE')
-      $allocation_pools     = hiera('CONFIG_PROVISION_DEMO_ALLOCATION_POOLS')
+      $allocation_pools     = lookup('CONFIG_PROVISION_DEMO_ALLOCATION_POOLS')
     } elsif $provision_tempest {
-      $username             = hiera('CONFIG_PROVISION_TEMPEST_USER')
+      $username             = lookup('CONFIG_PROVISION_TEMPEST_USER')
-      $password             = hiera('CONFIG_PROVISION_TEMPEST_USER_PW')
+      $password             = lookup('CONFIG_PROVISION_TEMPEST_USER_PW')
       $tenant_name          = 'tempest'
-      $floating_range       = hiera('CONFIG_PROVISION_TEMPEST_FLOATRANGE')
+      $floating_range       = lookup('CONFIG_PROVISION_TEMPEST_FLOATRANGE')
       $allocation_pools     = []
       if (empty($username) or empty($password)) {
         fail("Both CONFIG_PROVISION_TEMPEST_USER and
@@ -59,7 +59,7 @@ class packstack::provision ()
         $private_subnet_name  = 'private_subnet'
         $fixed_range          = '10.0.0.0/24'
         $router_name          = 'router1'
-        $public_physnet       = hiera('CONFIG_NEUTRON_OVS_EXTERNAL_PHYSNET')
+        $public_physnet       = lookup('CONFIG_NEUTRON_OVS_EXTERNAL_PHYSNET')
 
         $neutron_deps = [Neutron_network[$public_network_name]]
 

packstack/puppet/modules/packstack/manifests/provision/bridge.pp

@@ -1,24 +1,24 @@
 class packstack::provision::bridge ()
 {
-    $provision_neutron_br    = str2bool(hiera('CONFIG_NEUTRON_INSTALL'))
+    $provision_neutron_br    = str2bool(lookup('CONFIG_NEUTRON_INSTALL'))
-    $setup_ovs_bridge        = str2bool(hiera('CONFIG_PROVISION_OVS_BRIDGE'))
+    $setup_ovs_bridge        = str2bool(lookup('CONFIG_PROVISION_OVS_BRIDGE'))
-    $public_bridge_name      = hiera('CONFIG_NEUTRON_L3_EXT_BRIDGE', 'br-ex')
+    $public_bridge_name      = lookup('CONFIG_NEUTRON_L3_EXT_BRIDGE', undef, undef, 'br-ex')
-    $provision_tempest_br    = str2bool(hiera('CONFIG_PROVISION_TEMPEST'))
+    $provision_tempest_br    = str2bool(lookup('CONFIG_PROVISION_TEMPEST'))
-    $provision_demo_br       = str2bool(hiera('CONFIG_PROVISION_DEMO'))
+    $provision_demo_br       = str2bool(lookup('CONFIG_PROVISION_DEMO'))
 
-    $neutron_user_password   = hiera('CONFIG_NEUTRON_KS_PW')
+    $neutron_user_password   = lookup('CONFIG_NEUTRON_KS_PW')
 
     if $provision_demo_br {
-      $floating_range_br = hiera('CONFIG_PROVISION_DEMO_FLOATRANGE')
+      $floating_range_br = lookup('CONFIG_PROVISION_DEMO_FLOATRANGE')
     } elsif $provision_tempest_br {
-      $floating_range_br = hiera('CONFIG_PROVISION_TEMPEST_FLOATRANGE')
+      $floating_range_br = lookup('CONFIG_PROVISION_TEMPEST_FLOATRANGE')
     }
 
     class { 'neutron::keystone::authtoken':
       username             => 'neutron',
       password             => $neutron_user_password,
-      www_authenticate_uri => hiera('CONFIG_KEYSTONE_PUBLIC_URL_VERSIONLESS'),
+      www_authenticate_uri => lookup('CONFIG_KEYSTONE_PUBLIC_URL_VERSIONLESS'),
-      auth_url             => hiera('CONFIG_KEYSTONE_ADMIN_URL'),
+      auth_url             => lookup('CONFIG_KEYSTONE_ADMIN_URL'),
       project_name         => 'services',
     }
 

packstack/puppet/modules/packstack/manifests/provision/glance.pp

@@ -1,9 +1,9 @@
 class packstack::provision::glance ()
 {
-    $image_name               = hiera('CONFIG_PROVISION_IMAGE_NAME')
+    $image_name               = lookup('CONFIG_PROVISION_IMAGE_NAME')
-    $image_source             = hiera('CONFIG_PROVISION_IMAGE_URL')
+    $image_source             = lookup('CONFIG_PROVISION_IMAGE_URL')
-    $image_format             = hiera('CONFIG_PROVISION_IMAGE_FORMAT')
+    $image_format             = lookup('CONFIG_PROVISION_IMAGE_FORMAT')
-    $image_properties         = hiera('CONFIG_PROVISION_IMAGE_PROPERTIES')
+    $image_properties         = lookup('CONFIG_PROVISION_IMAGE_PROPERTIES')
 
     glance_image { $image_name:
       ensure           => present,

packstack/puppet/modules/packstack/manifests/provision/tempest.pp

@@ -1,24 +1,24 @@
 class packstack::provision::tempest ()
 {
-    $provision_demo         = str2bool(hiera('CONFIG_PROVISION_DEMO'))
+    $provision_demo         = str2bool(lookup('CONFIG_PROVISION_DEMO'))
     if $provision_demo {
       $username             = 'demo'
-      $password             = hiera('CONFIG_KEYSTONE_DEMO_PW')
+      $password             = lookup('CONFIG_KEYSTONE_DEMO_PW')
       $project_name         = 'demo'
-      $floating_range       = hiera('CONFIG_PROVISION_DEMO_FLOATRANGE')
+      $floating_range       = lookup('CONFIG_PROVISION_DEMO_FLOATRANGE')
     } else {
-      $username             = hiera('CONFIG_PROVISION_TEMPEST_USER')
+      $username             = lookup('CONFIG_PROVISION_TEMPEST_USER')
-      $password             = hiera('CONFIG_PROVISION_TEMPEST_USER_PW')
+      $password             = lookup('CONFIG_PROVISION_TEMPEST_USER_PW')
       $project_name         = 'tempest'
-      $floating_range       = hiera('CONFIG_PROVISION_TEMPEST_FLOATRANGE')
+      $floating_range       = lookup('CONFIG_PROVISION_TEMPEST_FLOATRANGE')
     }
 
     # Authentication/Keystone
-    $identity_uri          = regsubst(hiera('CONFIG_KEYSTONE_PUBLIC_URL'), 'v3', 'v2.0')
+    $identity_uri          = regsubst(lookup('CONFIG_KEYSTONE_PUBLIC_URL'), 'v3', 'v2.0')
-    $identity_uri_v3       = regsubst(hiera('CONFIG_KEYSTONE_PUBLIC_URL'), 'v2.0', 'v3')
+    $identity_uri_v3       = regsubst(lookup('CONFIG_KEYSTONE_PUBLIC_URL'), 'v2.0', 'v3')
-    $auth_version          = regsubst(hiera('CONFIG_KEYSTONE_API_VERSION'), '.0', '')
+    $auth_version          = regsubst(lookup('CONFIG_KEYSTONE_API_VERSION'), '.0', '')
-    $admin_username        = hiera('CONFIG_KEYSTONE_ADMIN_USERNAME')
+    $admin_username        = lookup('CONFIG_KEYSTONE_ADMIN_USERNAME')
-    $admin_password        = hiera('CONFIG_KEYSTONE_ADMIN_PW')
+    $admin_password        = lookup('CONFIG_KEYSTONE_ADMIN_PW')
     $admin_project_name    = 'admin'
     $admin_domain_name     = 'Default'
 
@@ -27,11 +27,11 @@ class packstack::provision::tempest ()
     $configure_networks        = true
 
     # Image
-    $image_ssh_user     = hiera('CONFIG_PROVISION_IMAGE_SSH_USER')
+    $image_ssh_user     = lookup('CONFIG_PROVISION_IMAGE_SSH_USER')
-    $image_name         = hiera('CONFIG_PROVISION_IMAGE_NAME')
+    $image_name         = lookup('CONFIG_PROVISION_IMAGE_NAME')
-    $image_alt_ssh_user = hiera('CONFIG_PROVISION_IMAGE_SSH_USER')
+    $image_alt_ssh_user = lookup('CONFIG_PROVISION_IMAGE_SSH_USER')
-    $image_source       = hiera('CONFIG_PROVISION_IMAGE_URL')
+    $image_source       = lookup('CONFIG_PROVISION_IMAGE_URL')
-    $image_format       = hiera('CONFIG_PROVISION_IMAGE_FORMAT')
+    $image_format       = lookup('CONFIG_PROVISION_IMAGE_FORMAT')
 
     # network name
     $public_network_name = 'public'
@@ -40,7 +40,7 @@ class packstack::provision::tempest ()
     $resize_available          = true
 
     $use_dynamic_credentials   = true
-    $dir_log                   = hiera('DIR_LOG')
+    $dir_log                   = lookup('DIR_LOG')
     $log_file                  = "${dir_log}/tempest.log"
     $use_stderr                = false
     $debug                     = true
@@ -48,20 +48,20 @@ class packstack::provision::tempest ()
 
     # Tempest
     $tempest_workspace    = '/var/lib/tempest'
-    $tempest_user          = hiera('CONFIG_PROVISION_TEMPEST_USER')
+    $tempest_user          = lookup('CONFIG_PROVISION_TEMPEST_USER')
-    $tempest_password      = hiera('CONFIG_PROVISION_TEMPEST_USER_PW')
+    $tempest_password      = lookup('CONFIG_PROVISION_TEMPEST_USER_PW')
 
-    $tempest_flavor_name = hiera('CONFIG_PROVISION_TEMPEST_FLAVOR_NAME')
+    $tempest_flavor_name = lookup('CONFIG_PROVISION_TEMPEST_FLAVOR_NAME')
     $tempest_flavor_ref  = '42'
-    $tempest_flavor_ram  = hiera('CONFIG_PROVISION_TEMPEST_FLAVOR_RAM')
+    $tempest_flavor_ram  = lookup('CONFIG_PROVISION_TEMPEST_FLAVOR_RAM')
-    $tempest_flavor_disk = hiera('CONFIG_PROVISION_TEMPEST_FLAVOR_DISK')
+    $tempest_flavor_disk = lookup('CONFIG_PROVISION_TEMPEST_FLAVOR_DISK')
-    $tempest_flavor_vcpus= hiera('CONFIG_PROVISION_TEMPEST_FLAVOR_VCPUS')
+    $tempest_flavor_vcpus= lookup('CONFIG_PROVISION_TEMPEST_FLAVOR_VCPUS')
 
-    $tempest_flavor_alt_name = hiera('CONFIG_PROVISION_TEMPEST_FLAVOR_ALT_NAME')
+    $tempest_flavor_alt_name = lookup('CONFIG_PROVISION_TEMPEST_FLAVOR_ALT_NAME')
     $tempest_flavor_alt_ref  = '84'
-    $tempest_flavor_alt_ram  = hiera('CONFIG_PROVISION_TEMPEST_FLAVOR_ALT_RAM')
+    $tempest_flavor_alt_ram  = lookup('CONFIG_PROVISION_TEMPEST_FLAVOR_ALT_RAM')
-    $tempest_flavor_alt_disk = hiera('CONFIG_PROVISION_TEMPEST_FLAVOR_ALT_DISK')
+    $tempest_flavor_alt_disk = lookup('CONFIG_PROVISION_TEMPEST_FLAVOR_ALT_DISK')
-    $tempest_flavor_alt_vcpus= hiera('CONFIG_PROVISION_TEMPEST_FLAVOR_ALT_VCPUS')
+    $tempest_flavor_alt_vcpus= lookup('CONFIG_PROVISION_TEMPEST_FLAVOR_ALT_VCPUS')
 
     nova_flavor { $tempest_flavor_name :
       ensure  => present,
@@ -81,21 +81,21 @@ class packstack::provision::tempest ()
     }
 
     # Service availability for testing based on configuration
-    $cinder_available     = str2bool(hiera('CONFIG_CINDER_INSTALL'))
+    $cinder_available     = str2bool(lookup('CONFIG_CINDER_INSTALL'))
-    $glance_available     = str2bool(hiera('CONFIG_GLANCE_INSTALL'))
+    $glance_available     = str2bool(lookup('CONFIG_GLANCE_INSTALL'))
-    $horizon_available    = str2bool(hiera('CONFIG_HORIZON_INSTALL'))
+    $horizon_available    = str2bool(lookup('CONFIG_HORIZON_INSTALL'))
-    $nova_available       = str2bool(hiera('CONFIG_NOVA_INSTALL'))
+    $nova_available       = str2bool(lookup('CONFIG_NOVA_INSTALL'))
-    $neutron_available    = str2bool(hiera('CONFIG_NEUTRON_INSTALL'))
+    $neutron_available    = str2bool(lookup('CONFIG_NEUTRON_INSTALL'))
-    $ceilometer_available = str2bool(hiera('CONFIG_CEILOMETER_INSTALL'))
+    $ceilometer_available = str2bool(lookup('CONFIG_CEILOMETER_INSTALL'))
-    $aodh_available       = str2bool(hiera('CONFIG_AODH_INSTALL'))
+    $aodh_available       = str2bool(lookup('CONFIG_AODH_INSTALL'))
-    $trove_available      = str2bool(hiera('CONFIG_TROVE_INSTALL'))
+    $trove_available      = str2bool(lookup('CONFIG_TROVE_INSTALL'))
-    $sahara_available     = str2bool(hiera('CONFIG_SAHARA_INSTALL'))
+    $sahara_available     = str2bool(lookup('CONFIG_SAHARA_INSTALL'))
-    $heat_available       = str2bool(hiera('CONFIG_HEAT_INSTALL'))
+    $heat_available       = str2bool(lookup('CONFIG_HEAT_INSTALL'))
-    $swift_available      = str2bool(hiera('CONFIG_SWIFT_INSTALL'))
+    $swift_available      = str2bool(lookup('CONFIG_SWIFT_INSTALL'))
-    $configure_tempest    = str2bool(hiera('CONFIG_PROVISION_TEMPEST'))
+    $configure_tempest    = str2bool(lookup('CONFIG_PROVISION_TEMPEST'))
 
     # Some API extensions as l3_agent_scheduler are not enabled by OVN plugin
-    $l2_agent  = hiera('CONFIG_NEUTRON_L2_AGENT')
+    $l2_agent  = lookup('CONFIG_NEUTRON_L2_AGENT')
     if $l2_agent == 'ovn' {
       $neutron_api_extensions = 'ext-gw-mode,binding,agent,external-net,quotas,provider,extraroute,router,extra_dhcp_opt,allowed-address-pairs,security-group,trunk'
     } else {

packstack/puppet/modules/packstack/manifests/redis.pp

@@ -1,9 +1,9 @@
 class packstack::redis ()
 {
-    create_resources(packstack::firewall, hiera('FIREWALL_REDIS_RULES', {}))
+    create_resources(packstack::firewall, lookup('FIREWALL_REDIS_RULES', undef, undef, {}))
 
-    $redis_port = Integer(hiera('CONFIG_REDIS_PORT'))
+    $redis_port = Integer(lookup('CONFIG_REDIS_PORT'))
-    $redis_host = hiera('CONFIG_REDIS_HOST')
+    $redis_host = lookup('CONFIG_REDIS_HOST')
 
     class { 'redis':
       bind           => $redis_host,

packstack/puppet/modules/packstack/manifests/sahara.pp

@@ -1,9 +1,9 @@
 class packstack::sahara ()
 {
-    create_resources(packstack::firewall, hiera('FIREWALL_SAHARA_CFN_RULES', {}))
+    create_resources(packstack::firewall, lookup('FIREWALL_SAHARA_CFN_RULES', undef, undef, {}))
 
     class { 'sahara::service::api':
-      api_workers => hiera('CONFIG_SERVICE_WORKERS')
+      api_workers => lookup('CONFIG_SERVICE_WORKERS')
     }
 
     class { 'sahara::service::engine': }

packstack/puppet/modules/packstack/manifests/sahara/rabbitmq.pp

@@ -1,16 +1,16 @@
 class packstack::sahara::rabbitmq ()
 {
-    $sahara_cfg_sahara_db_pw = hiera('CONFIG_SAHARA_DB_PW')
+    $sahara_cfg_sahara_db_pw = lookup('CONFIG_SAHARA_DB_PW')
-    $sahara_cfg_sahara_mariadb_host = hiera('CONFIG_MARIADB_HOST_URL')
+    $sahara_cfg_sahara_mariadb_host = lookup('CONFIG_MARIADB_HOST_URL')
 
-    $kombu_ssl_ca_certs = hiera('CONFIG_AMQP_SSL_CACERT_FILE', $::os_service_default)
+    $kombu_ssl_ca_certs = lookup('CONFIG_AMQP_SSL_CACERT_FILE', undef, undef, $::os_service_default)
-    $kombu_ssl_keyfile = hiera('CONFIG_SAHARA_SSL_KEY', $::os_service_default)
+    $kombu_ssl_keyfile = lookup('CONFIG_SAHARA_SSL_KEY', undef, undef, $::os_service_default)
-    $kombu_ssl_certfile = hiera('CONFIG_SAHARA_SSL_CERT', $::os_service_default)
+    $kombu_ssl_certfile = lookup('CONFIG_SAHARA_SSL_CERT', undef, undef, $::os_service_default)
 
-    $rabbit_host = hiera('CONFIG_AMQP_HOST_URL')
+    $rabbit_host = lookup('CONFIG_AMQP_HOST_URL')
-    $rabbit_port = hiera('CONFIG_AMQP_CLIENTS_PORT')
+    $rabbit_port = lookup('CONFIG_AMQP_CLIENTS_PORT')
-    $rabbit_userid = hiera('CONFIG_AMQP_AUTH_USER')
+    $rabbit_userid = lookup('CONFIG_AMQP_AUTH_USER')
-    $rabbit_password = hiera('CONFIG_AMQP_AUTH_PASSWORD')
+    $rabbit_password = lookup('CONFIG_AMQP_AUTH_PASSWORD')
 
     if ! is_service_default($kombu_ssl_keyfile) {
       $files_to_set_owner = [ $kombu_ssl_keyfile, $kombu_ssl_certfile ]
@@ -25,14 +25,14 @@ class packstack::sahara::rabbitmq ()
 
     class { 'sahara::keystone::authtoken':
       username             => 'sahara',
-      password             => hiera('CONFIG_SAHARA_KS_PW'),
+      password             => lookup('CONFIG_SAHARA_KS_PW'),
       project_name         => 'services',
-      www_authenticate_uri => hiera('CONFIG_KEYSTONE_PUBLIC_URL'),
+      www_authenticate_uri => lookup('CONFIG_KEYSTONE_PUBLIC_URL'),
-      auth_url             => hiera('CONFIG_KEYSTONE_ADMIN_URL'),
+      auth_url             => lookup('CONFIG_KEYSTONE_ADMIN_URL'),
     }
 
     class { 'sahara::logging':
-      debug => hiera('CONFIG_DEBUG_MODE'),
+      debug => lookup('CONFIG_DEBUG_MODE'),
     }
 
     class { 'sahara::db':
@@ -40,8 +40,8 @@ class packstack::sahara::rabbitmq ()
     }
 
     class { 'sahara':
-      host                  => hiera('CONFIG_SAHARA_HOST'),
+      host                  => lookup('CONFIG_SAHARA_HOST'),
-      rabbit_use_ssl        => hiera('CONFIG_AMQP_SSL_ENABLED'),
+      rabbit_use_ssl        => lookup('CONFIG_AMQP_SSL_ENABLED'),
       default_transport_url => "rabbit://${rabbit_userid}:${rabbit_password}@${rabbit_host}:${rabbit_port}/",
       kombu_ssl_ca_certs    => $kombu_ssl_ca_certs,
       kombu_ssl_keyfile     => $kombu_ssl_keyfile,

packstack/puppet/modules/packstack/manifests/swift.pp

@@ -4,7 +4,7 @@ class packstack::swift ()
 
     class { 'swift':
       # not sure how I want to deal with this shared secret
-      swift_hash_path_suffix => hiera('CONFIG_SWIFT_HASH'),
+      swift_hash_path_suffix => lookup('CONFIG_SWIFT_HASH'),
       package_ensure         => latest,
     }
 }

packstack/puppet/modules/packstack/manifests/swift/ceilometer.pp

@@ -1,9 +1,9 @@
 class packstack::swift::ceilometer ()
 {
-    $rabbit_host = hiera('CONFIG_AMQP_HOST_URL')
+    $rabbit_host = lookup('CONFIG_AMQP_HOST_URL')
-    $rabbit_port = hiera('CONFIG_AMQP_CLIENTS_PORT')
+    $rabbit_port = lookup('CONFIG_AMQP_CLIENTS_PORT')
-    $rabbit_userid = hiera('CONFIG_AMQP_AUTH_USER')
+    $rabbit_userid = lookup('CONFIG_AMQP_AUTH_USER')
-    $rabbit_password = hiera('CONFIG_AMQP_AUTH_PASSWORD')
+    $rabbit_password = lookup('CONFIG_AMQP_AUTH_PASSWORD')
 
     Service<| name == 'rabbitmq-server' |> -> Service['swift-proxy-server']
 
@@ -13,7 +13,7 @@ class packstack::swift::ceilometer ()
       control_exchange      => 'swift',
       driver                => 'messaging',
       ignore_projects       => ['service'],
-      auth_url              => hiera('CONFIG_KEYSTONE_ADMIN_URL'),
+      auth_url              => lookup('CONFIG_KEYSTONE_ADMIN_URL'),
-      password              => hiera('CONFIG_SWIFT_KS_PW'),
+      password              => lookup('CONFIG_SWIFT_KS_PW'),
     }
 }

packstack/puppet/modules/packstack/manifests/swift/proxy.pp

@@ -1,9 +1,9 @@
 class packstack::swift::proxy ()
 {
-    create_resources(packstack::firewall, hiera('FIREWALL_SWIFT_PROXY_RULES', {}))
+    create_resources(packstack::firewall, lookup('FIREWALL_SWIFT_PROXY_RULES', undef, undef, {}))
     ensure_packages(['curl'], {'ensure' => 'present'})
 
-    $bind_host = hiera('CONFIG_IP_VERSION') ? {
+    $bind_host = lookup('CONFIG_IP_VERSION') ? {
       'ipv6'  => '::0',
       default => '0.0.0.0',
       # TO-DO(mmagr): Add IPv6 support when hostnames are used
@@ -11,8 +11,8 @@ class packstack::swift::proxy ()
 
     include packstack::memcached
 
-    if hiera('CONFIG_CEILOMETER_INSTALL') == 'y' and
+    if lookup('CONFIG_CEILOMETER_INSTALL') == 'y' and
-      hiera('CONFIG_ENABLE_CEILOMETER_MIDDLEWARE') == 'y' {
+      lookup('CONFIG_ENABLE_CEILOMETER_MIDDLEWARE') == 'y' {
       $swift_pipeline = [
         'catch_errors',
         'gatekeeper',
@@ -65,10 +65,10 @@ class packstack::swift::proxy ()
 
     class { 'swift::proxy':
       # swift seems to require ipv6 address without brackets
-      proxy_local_net_ip => hiera('CONFIG_STORAGE_HOST'),
+      proxy_local_net_ip => lookup('CONFIG_STORAGE_HOST'),
       pipeline           => $swift_pipeline,
       account_autocreate => true,
-      workers            => hiera('CONFIG_SERVICE_WORKERS'),
+      workers            => lookup('CONFIG_SERVICE_WORKERS'),
     }
 
     # configure all of the middlewares
@@ -112,10 +112,10 @@ class packstack::swift::proxy ()
     class { 'swift::proxy::authtoken':
       username             => 'swift',
       project_name         => 'services',
-      password             => hiera('CONFIG_SWIFT_KS_PW'),
+      password             => lookup('CONFIG_SWIFT_KS_PW'),
       # assume that the controller host is the swift api server
-      www_authenticate_uri => hiera('CONFIG_KEYSTONE_PUBLIC_URL'),
+      www_authenticate_uri => lookup('CONFIG_KEYSTONE_PUBLIC_URL'),
-      auth_url             => hiera('CONFIG_KEYSTONE_ADMIN_URL'),
+      auth_url             => lookup('CONFIG_KEYSTONE_ADMIN_URL'),
     }
 
     class { 'swift::proxy::versioned_writes':

packstack/puppet/modules/packstack/manifests/swift/ringbuilder.pp

@@ -2,7 +2,7 @@ class packstack::swift::ringbuilder ()
 {
     class { 'swift::ringbuilder':
       part_power     => '18',
-      replicas       => hiera('CONFIG_SWIFT_STORAGE_REPLICAS'),
+      replicas       => lookup('CONFIG_SWIFT_STORAGE_REPLICAS'),
       min_part_hours => 1,
       require        => Class['swift'],
     }
@@ -10,13 +10,13 @@ class packstack::swift::ringbuilder ()
     if ($::operatingsystem == 'CentOS') and (versioncmp($::operatingsystemmajrelease, '9') == 0) {
       # sets up an rsync db that can be used to sync the ring DB
       class { 'swift::ringserver':
-        local_net_ip => hiera('CONFIG_STORAGE_HOST_URL'),
+        local_net_ip => lookup('CONFIG_STORAGE_HOST_URL'),
         rsync_use_xinetd => false,
       }
     } else {
       # sets up an rsync db that can be used to sync the ring DB
       class { 'swift::ringserver':
-        local_net_ip => hiera('CONFIG_STORAGE_HOST_URL'),
+        local_net_ip => lookup('CONFIG_STORAGE_HOST_URL'),
       }
     }
 
@@ -27,7 +27,7 @@ class packstack::swift::ringbuilder ()
       }
     }
 
-    create_resources(ring_account_device, hiera('SWIFT_RING_ACCOUNT_DEVICES', {}))
+    create_resources(ring_account_device, lookup('SWIFT_RING_ACCOUNT_DEVICES', undef, undef, {}))
-    create_resources(ring_object_device, hiera('SWIFT_RING_OBJECT_DEVICES', {}))
+    create_resources(ring_object_device, lookup('SWIFT_RING_OBJECT_DEVICES', undef, undef, {}))
-    create_resources(ring_container_device, hiera('SWIFT_RING_CONTAINER_DEVICES', {}))
+    create_resources(ring_container_device, lookup('SWIFT_RING_CONTAINER_DEVICES', undef, undef, {}))
 }

packstack/puppet/modules/packstack/manifests/swift/storage.pp

@@ -1,11 +1,11 @@
 class packstack::swift::storage ()
 {
-    create_resources(packstack::firewall, hiera('FIREWALL_SWIFT_STORAGE_RULES', {}))
+    create_resources(packstack::firewall, lookup('FIREWALL_SWIFT_STORAGE_RULES', undef, undef, {}))
 
     # install all swift storage servers together
     class { 'swift::storage::all':
       # looks like ipv6 address without brackets is required here
-      storage_local_net_ip => hiera('CONFIG_STORAGE_HOST'),
+      storage_local_net_ip => lookup('CONFIG_STORAGE_HOST'),
       require              => Class['swift'],
     }
 
@@ -19,21 +19,21 @@ class packstack::swift::storage ()
     }
 
     swift::ringsync{ ['account', 'container', 'object']:
-      ring_server => hiera('CONFIG_STORAGE_HOST_URL'),
+      ring_server => lookup('CONFIG_STORAGE_HOST_URL'),
       before      => Class['swift::storage::all'],
       require     => Class['swift'],
     }
 
-    if hiera('CONFIG_SWIFT_LOOPBACK') == 'y' {
+    if lookup('CONFIG_SWIFT_LOOPBACK') == 'y' {
       swift::storage::loopback { 'swiftloopback':
         base_dir     => '/srv/loopback-device',
         mnt_base_dir => '/srv/node',
         require      => Class['swift'],
-        fstype       => hiera('CONFIG_SWIFT_STORAGE_FSTYPE'),
+        fstype       => lookup('CONFIG_SWIFT_STORAGE_FSTYPE'),
-        seek         => hiera('CONFIG_SWIFT_STORAGE_SEEK'),
+        seek         => lookup('CONFIG_SWIFT_STORAGE_SEEK'),
       }
     }
     else {
-        create_resources(packstack::swift::fs, hiera('CONFIG_SWIFT_STORAGE_DEVICES', {}))
+        create_resources(packstack::swift::fs, lookup('CONFIG_SWIFT_STORAGE_DEVICES', undef, undef, {}))
     }
 }

packstack/puppet/modules/packstack/manifests/trove.pp

@@ -1,25 +1,25 @@
 class packstack::trove ()
 {
-    create_resources(packstack::firewall, hiera('FIREWALL_TROVE_API_RULES', {}))
+    create_resources(packstack::firewall, lookup('FIREWALL_TROVE_API_RULES', undef, undef, {}))
 
-    $bind_host = hiera('CONFIG_IP_VERSION') ? {
+    $bind_host = lookup('CONFIG_IP_VERSION') ? {
       'ipv6'  => '::0',
       default => '0.0.0.0',
       # TO-DO(mmagr): Add IPv6 support when hostnames are used
     }
 
     class { 'trove::keystone::authtoken':
-      password => hiera('CONFIG_TROVE_KS_PW'),
+      password => lookup('CONFIG_TROVE_KS_PW'),
-      auth_url => hiera('CONFIG_KEYSTONE_PUBLIC_URL_VERSIONLESS'),
+      auth_url => lookup('CONFIG_KEYSTONE_PUBLIC_URL_VERSIONLESS'),
     }
 
     class { 'trove::logging':
-      debug => hiera('CONFIG_DEBUG_MODE'),
+      debug => lookup('CONFIG_DEBUG_MODE'),
     }
 
     class { 'trove::api::service_credentials':
-      password => hiera('CONFIG_TROVE_KS_PW'),
+      password => lookup('CONFIG_TROVE_KS_PW'),
-      auth_url => hiera('CONFIG_KEYSTONE_PUBLIC_URL_VERSIONLESS'),
+      auth_url => lookup('CONFIG_KEYSTONE_PUBLIC_URL_VERSIONLESS'),
     }
 
     class { 'trove::api':
@@ -28,16 +28,16 @@ class packstack::trove ()
       cert_file => false,
       key_file  => false,
       ca_file   => false,
-      workers   => hiera('CONFIG_SERVICE_WORKERS'),
+      workers   => lookup('CONFIG_SERVICE_WORKERS'),
     }
 
     class { 'trove::conductor':
-      workers => hiera('CONFIG_SERVICE_WORKERS'),
+      workers => lookup('CONFIG_SERVICE_WORKERS'),
     }
 
     class { 'trove::guestagent::service_credentials':
-      password => hiera('CONFIG_TROVE_KS_PW'),
+      password => lookup('CONFIG_TROVE_KS_PW'),
-      auth_url => hiera('CONFIG_KEYSTONE_PUBLIC_URL_VERSIONLESS'),
+      auth_url => lookup('CONFIG_KEYSTONE_PUBLIC_URL_VERSIONLESS'),
     }
     class { 'trove::taskmanager':
       use_guestagent_template => false,

packstack/puppet/modules/packstack/manifests/trove/rabbitmq.pp

@@ -1,17 +1,17 @@
 class packstack::trove::rabbitmq ()
 {
-    $trove_rabmq_cfg_trove_db_pw = hiera('CONFIG_TROVE_DB_PW')
+    $trove_rabmq_cfg_trove_db_pw = lookup('CONFIG_TROVE_DB_PW')
-    $trove_rabmq_cfg_mariadb_host = hiera('CONFIG_MARIADB_HOST_URL')
+    $trove_rabmq_cfg_mariadb_host = lookup('CONFIG_MARIADB_HOST_URL')
-    $trove_rabmq_cfg_controller_host = hiera('CONFIG_KEYSTONE_HOST_URL')
+    $trove_rabmq_cfg_controller_host = lookup('CONFIG_KEYSTONE_HOST_URL')
 
-    $kombu_ssl_ca_certs = hiera('CONFIG_AMQP_SSL_CACERT_FILE', undef)
+    $kombu_ssl_ca_certs = lookup('CONFIG_AMQP_SSL_CACERT_FILE', undef, undef, undef)
-    $kombu_ssl_keyfile = hiera('CONFIG_TROVE_SSL_KEY', undef)
+    $kombu_ssl_keyfile = lookup('CONFIG_TROVE_SSL_KEY', undef, undef, undef)
-    $kombu_ssl_certfile = hiera('CONFIG_TROVE_SSL_CERT', undef)
+    $kombu_ssl_certfile = lookup('CONFIG_TROVE_SSL_CERT', undef, undef, undef)
 
-    $rabbit_host = hiera('CONFIG_AMQP_HOST_URL')
+    $rabbit_host = lookup('CONFIG_AMQP_HOST_URL')
-    $rabbit_port = hiera('CONFIG_AMQP_CLIENTS_PORT')
+    $rabbit_port = lookup('CONFIG_AMQP_CLIENTS_PORT')
-    $rabbit_userid = hiera('CONFIG_AMQP_AUTH_USER')
+    $rabbit_userid = lookup('CONFIG_AMQP_AUTH_USER')
-    $rabbit_password = hiera('CONFIG_AMQP_AUTH_PASSWORD')
+    $rabbit_password = lookup('CONFIG_AMQP_AUTH_PASSWORD')
 
     if $kombu_ssl_keyfile {
       $files_to_set_owner = [ $kombu_ssl_keyfile, $kombu_ssl_certfile ]
@@ -29,7 +29,7 @@ class packstack::trove::rabbitmq ()
     }
 
     class { 'trove':
-      rabbit_use_ssl        => hiera('CONFIG_AMQP_SSL_ENABLED'),
+      rabbit_use_ssl        => lookup('CONFIG_AMQP_SSL_ENABLED'),
       default_transport_url => "rabbit://${rabbit_userid}:${rabbit_password}@${rabbit_host}:${rabbit_port}/",
       kombu_ssl_ca_certs    => $kombu_ssl_ca_certs,
       kombu_ssl_keyfile     => $kombu_ssl_keyfile,

packstack/puppet/templates/compute.pp

@@ -1,6 +1,6 @@
 stage { "init": before  => Stage["main"] }
 
-Exec { timeout => hiera('DEFAULT_EXEC_TIMEOUT') }
+Exec { timeout => lookup('DEFAULT_EXEC_TIMEOUT') }
 Package { allow_virtual => true }
 
 class { 'packstack::prereqs':
@@ -9,13 +9,13 @@ class { 'packstack::prereqs':
 
 include firewall
 
-create_resources(sshkey, hiera('SSH_KEYS', {}))
+create_resources(sshkey, lookup('SSH_KEYS', undef, undef, {}))
 
-if hiera('CONFIG_NTP_SERVERS', '') != '' {
+if lookup('CONFIG_NTP_SERVERS', undef, undef, '') != '' {
   include 'packstack::chrony'
 }
 
-if hiera('CONFIG_CEILOMETER_INSTALL') == 'y' {
+if lookup('CONFIG_CEILOMETER_INSTALL') == 'y' {
   include 'packstack::nova::ceilometer::rabbitmq'
   include 'packstack::nova::ceilometer'
 }
@@ -24,29 +24,29 @@ include 'packstack::nova'
 include 'packstack::nova::common'
 include 'packstack::nova::compute'
 
-if hiera('CONFIG_VMWARE_BACKEND') == 'y' {
+if lookup('CONFIG_VMWARE_BACKEND') == 'y' {
   include 'packstack::nova::compute::vmware'
-} elsif hiera('CONFIG_IRONIC_INSTALL') == 'y' {
+} elsif lookup('CONFIG_IRONIC_INSTALL') == 'y' {
   include 'packstack::nova::compute::ironic'
 } else {
   include 'packstack::nova::compute::libvirt'
 }
 
-if hiera('CONFIG_CINDER_INSTALL') == 'y' {
+if lookup('CONFIG_CINDER_INSTALL') == 'y' {
   include 'openstacklib::iscsid'
 }
 
-if hiera('CONFIG_CINDER_INSTALL') == 'y' and
+if lookup('CONFIG_CINDER_INSTALL') == 'y' and
-   hiera('CONFIG_VMWARE_BACKEND') != 'y' {
+   lookup('CONFIG_VMWARE_BACKEND') != 'y' {
-   if 'nfs' in hiera_array('CONFIG_CINDER_BACKEND') {
+   if 'nfs' in lookup('CONFIG_CINDER_BACKEND', { merge => 'unique' }) {
     include 'packstack::nova::nfs'
    }
 }
 
-if hiera('CONFIG_NEUTRON_INSTALL') == 'y' {
+if lookup('CONFIG_NEUTRON_INSTALL') == 'y' {
   include 'packstack::nova::neutron'
   include 'packstack::neutron::rabbitmq'
-  case hiera('CONFIG_NEUTRON_L2_AGENT') {
+  case lookup('CONFIG_NEUTRON_L2_AGENT') {
     'openvswitch': { include 'packstack::neutron::ovs_agent' }
     'linuxbridge': { include 'packstack::neutron::lb_agent' }
     'ovn':         { include 'packstack::neutron::ovn_agent'
@@ -56,8 +56,8 @@ if hiera('CONFIG_NEUTRON_INSTALL') == 'y' {
   }
   include 'packstack::neutron::bridge'
 
-  if 'sriovnicswitch' in hiera_array('CONFIG_NEUTRON_ML2_MECHANISM_DRIVERS') and
+  if 'sriovnicswitch' in lookup('CONFIG_NEUTRON_ML2_MECHANISM_DRIVERS', { merge => 'unique' }) and
-     hiera ('CONFIG_NEUTRON_L2_AGENT') == 'openvswitch' {
+     lookup('CONFIG_NEUTRON_L2_AGENT') == 'openvswitch' {
     include 'packstack::neutron::sriov'
   }
 }