Merge "Enabling V3 identity for horizon" into stable/pike
diff --git a/classes/cluster/virtual-mcp11-aio-manila/.env b/classes/cluster/virtual-mcp11-aio-manila/.env
new file mode 100644
index 0000000..b63c1b9
--- /dev/null
+++ b/classes/cluster/virtual-mcp11-aio-manila/.env
@@ -0,0 +1 @@
+FORMULAS_SALT_MASTER+=(java openssh ntp nginx collectd sensu heka sphinx mysql galera grafana libvirt rsyslog glusterfs postfix xtrabackup freeipa prometheus telegraf elasticsearch kibana rundeck devops-portal libvirt rsyslog memcached rabbitmq apache keystone glance nova neutron cinder heat horizon ironic tftpd-hpa bind powerdns designate barbican iptables manila)
diff --git a/classes/cluster/virtual-mcp11-aio-manila/infra/config.yml b/classes/cluster/virtual-mcp11-aio-manila/infra/config.yml
new file mode 100644
index 0000000..7108728
--- /dev/null
+++ b/classes/cluster/virtual-mcp11-aio-manila/infra/config.yml
@@ -0,0 +1,3 @@
+classes:
+- cluster.virtual-mcp11-aio-manila
+- cluster.virtual-mcp11-aio.infra.config
diff --git a/classes/cluster/virtual-mcp11-aio-manila/infra/init.yml b/classes/cluster/virtual-mcp11-aio-manila/infra/init.yml
new file mode 100644
index 0000000..219ed8d
--- /dev/null
+++ b/classes/cluster/virtual-mcp11-aio-manila/infra/init.yml
@@ -0,0 +1,2 @@
+classes:
+ - cluster.virtual-mcp11-aio.infra
diff --git a/classes/cluster/virtual-mcp11-aio-manila/init.yml b/classes/cluster/virtual-mcp11-aio-manila/init.yml
new file mode 100755
index 0000000..0d382b8
--- /dev/null
+++ b/classes/cluster/virtual-mcp11-aio-manila/init.yml
@@ -0,0 +1,5 @@
+classes:
+- cluster.virtual-mcp11-aio-manila.infra
+- cluster.virtual-mcp11-aio-manila.openstack
+- cluster.virtual-mcp11-aio
+- cluster.overrides
diff --git a/classes/cluster/virtual-mcp11-aio-manila/openstack/init.yml b/classes/cluster/virtual-mcp11-aio-manila/openstack/init.yml
new file mode 100755
index 0000000..7bcf20c
--- /dev/null
+++ b/classes/cluster/virtual-mcp11-aio-manila/openstack/init.yml
@@ -0,0 +1,40 @@
+classes:
+- system.linux.storage.loopback_manila
+- system.galera.server.database.manila
+- system.apache.server.site.manila
+- system.keystone.client.service.manila
+- system.keystone.client.service.manila2
+- system.manila.common.single
+- system.manila.share.backend.lvm
+- cluster.virtual-mcp11-aio.openstack
+parameters:
+ _param:
+ keystone_manila_password: workshop
+ manila_service_host: ${_param:single_address}
+ mysql_manila_password: workshop
+ # loop0 is used by cinder lvm
+ manila_lvm_devices:
+ - /dev/loop1
+ loopback_device1_size: 20
+ manila:
+ common:
+ dhss: false
+ api:
+ version: ${_param:openstack_version}
+ enabled: true
+ data:
+ version: ${_param:openstack_version}
+ enabled: true
+ scheduler:
+ version: ${_param:openstack_version}
+ enabled: true
+ share:
+ version: ${_param:openstack_version}
+ enabled: true
+ enabled_share_backends:
+ lvm:
+ name: lvm
+ type: lvm
+ enabled: true
+ dhss: false
+ share_driver: manila.share.drivers.lvm.LVMShareDriver
diff --git a/classes/cluster/virtual-mcp11-aio-ssl/.env b/classes/cluster/virtual-mcp11-aio-ssl/.env
new file mode 100644
index 0000000..e138b42
--- /dev/null
+++ b/classes/cluster/virtual-mcp11-aio-ssl/.env
@@ -0,0 +1 @@
+FORMULAS_SALT_MASTER+=(java openssh ntp nginx collectd sensu heka sphinx mysql galera grafana libvirt rsyslog glusterfs postfix xtrabackup freeipa prometheus telegraf elasticsearch kibana rundeck devops-portal libvirt rsyslog memcached rabbitmq apache keystone glance nova neutron cinder heat horizon ironic tftpd-hpa bind powerdns designate barbican iptables)
diff --git a/classes/cluster/virtual-mcp11-aio-ssl/infra/config.yml b/classes/cluster/virtual-mcp11-aio-ssl/infra/config.yml
new file mode 100644
index 0000000..0927924
--- /dev/null
+++ b/classes/cluster/virtual-mcp11-aio-ssl/infra/config.yml
@@ -0,0 +1,3 @@
+classes:
+ - cluster.virtual-mcp11-aio-ssl
+ - cluster.virtual-mcp11-aio.infra.config
diff --git a/classes/cluster/virtual-mcp11-aio-ssl/infra/init.yml b/classes/cluster/virtual-mcp11-aio-ssl/infra/init.yml
new file mode 100644
index 0000000..325f046
--- /dev/null
+++ b/classes/cluster/virtual-mcp11-aio-ssl/infra/init.yml
@@ -0,0 +1,17 @@
+classes:
+ - cluster.virtual-mcp11-aio.infra
+parameters:
+ _param:
+ salt_minion_ca_host: cfg01.${linux:system:domain}
+ salt:
+ minion:
+ cert:
+ internal_proxy:
+ host: ${_param:salt_minion_ca_host}
+ authority: ${_param:salt_minion_ca_authority}
+ common_name: internal_proxy
+ signing_policy: cert_open
+ alternative_names: IP:127.0.0.1,IP:${_param:cluster_local_address},IP:${_param:cluster_public_host},DNS:${linux:system:name},DNS:${linux:network:fqdn},DNS:${_param:cluster_local_address},DNS:${_param:cluster_public_host}
+ key_file: "/etc/ssl/private/internal_proxy.key"
+ cert_file: "/etc/ssl/certs/internal_proxy.crt"
+ all_file: "/etc/ssl/certs/internal_proxy-with-chain.crt"
diff --git a/classes/cluster/virtual-mcp11-aio-ssl/init.yml b/classes/cluster/virtual-mcp11-aio-ssl/init.yml
new file mode 100755
index 0000000..4000410
--- /dev/null
+++ b/classes/cluster/virtual-mcp11-aio-ssl/init.yml
@@ -0,0 +1,5 @@
+classes:
+- cluster.virtual-mcp11-aio-ssl.infra
+- cluster.virtual-mcp11-aio-ssl.openstack
+- cluster.virtual-mcp11-aio
+- cluster.overrides
diff --git a/classes/cluster/virtual-mcp11-aio-ssl/openstack/init.yml b/classes/cluster/virtual-mcp11-aio-ssl/openstack/init.yml
new file mode 100755
index 0000000..78d1d3a
--- /dev/null
+++ b/classes/cluster/virtual-mcp11-aio-ssl/openstack/init.yml
@@ -0,0 +1,104 @@
+classes:
+- system.apache.server.site.cinder
+# Enable proxy for services that are not under apache and
+# do not use apache wsgi template
+- system.apache.server.proxy.openstack.designate
+- system.apache.server.proxy.openstack.glance
+- system.apache.server.proxy.openstack.heat
+- system.apache.server.proxy.openstack.neutron
+- system.apache.server.proxy.openstack.nova
+- system.apache.server.proxy.openstack.placement
+- cluster.virtual-mcp11-aio.openstack
+parameters:
+ _param:
+ cluster_public_protocol: https
+ cluster_internal_protocol: https
+ keystone_service_protocol: ${_param:cluster_internal_protocol}
+ glance_service_protocol: ${_param:cluster_internal_protocol}
+ nova_service_protocol: ${_param:cluster_internal_protocol}
+ neutron_service_protocol: ${_param:cluster_internal_protocol}
+ heat_service_protocol: ${_param:cluster_internal_protocol}
+ cinder_service_protocol: ${_param:cluster_internal_protocol}
+ barbican_service_protocol: ${_param:cluster_internal_protocol}
+ designate_service_protocol: ${_param:cluster_internal_protocol}
+ apache_proxy_ssl:
+ enabled: true
+ engine: salt
+ authority: "${_param:salt_minion_ca_authority}"
+ key_file: "/etc/ssl/private/internal_proxy.key"
+ cert_file: "/etc/ssl/certs/internal_proxy.crt"
+ chain_file: "/etc/ssl/certs/internal_proxy-with-chain.crt"
+ apache_cinder_ssl: ${_param:apache_proxy_ssl}
+ apache_keystone_ssl: ${_param:apache_proxy_ssl}
+ apache_proxy_openstack_api_address: ${_param:cluster_public_host}
+ apache_proxy_openstack_keystone_host: 127.0.0.1
+ apache_proxy_openstack_nova_host: 127.0.0.1
+ apache_proxy_openstack_glance_host: 127.0.0.1
+ apache_proxy_openstack_neutron_host: 127.0.0.1
+ apache_proxy_openstack_heat_host: 127.0.0.1
+ apache_proxy_openstack_designate_host: 127.0.0.1
+ apache_proxy_openstack_placement_host: 127.0.0.1
+ apache_keystone_api_host: ${_param:single_address}
+ barbican:
+ server:
+ bind:
+ address: 127.0.0.1
+ identity:
+ protocol: https
+ neutron:
+ server:
+ bind:
+ address: 127.0.0.1
+ identity:
+ protocol: https
+ nova:
+ controller:
+ bind:
+ private_address: 127.0.0.1
+ identity:
+ protocol: https
+ network:
+ protocol: https
+ glance:
+ protocol: https
+ metadata:
+ bind:
+ address: ${_param:nova_service_host}
+
+ cinder:
+ controller:
+ identity:
+ protocol: https
+ glance:
+ protocol: https
+ horizon:
+ server:
+ secure: False
+ identity:
+ encryption: ssl
+ designate:
+ server:
+ identity:
+ protocol: https
+ bind:
+ api:
+ address: 127.0.0.1
+ glance:
+ server:
+ bind:
+ address: 127.0.0.1
+ identity:
+ protocol: https
+ registry:
+ protocol: https
+ heat:
+ server:
+ bind:
+ api:
+ address: 127.0.0.1
+ api_cfn:
+ address: 127.0.0.1
+ api_cloudwatch:
+ address: 127.0.0.1
+ identity:
+ protocol: https