Add initial offline barbican model
Change-Id: I433a4112958928b70ef6c77da62871be67bf75b9
diff --git a/classes/cluster/virtual-offline-ssl/.env b/classes/cluster/virtual-offline-ssl/.env
new file mode 100644
index 0000000..11849f2
--- /dev/null
+++ b/classes/cluster/virtual-offline-ssl/.env
@@ -0,0 +1 @@
+FORMULAS_SALT_MASTER+=(java openssh ntp nginx collectd sensu heka sphinx mysql galera grafana libvirt rsyslog glusterfs postfix xtrabackup freeipa prometheus telegraf elasticsearch kibana rundeck devops-portal libvirt rsyslog memcached rabbitmq apache keystone glance nova neutron cinder heat horizon ironic tftpd-hpa bind powerdns designate barbican iptables fluentd dogtag barbican)
diff --git a/classes/cluster/virtual-offline-ssl/infra/backup/client_common.yml b/classes/cluster/virtual-offline-ssl/infra/backup/client_common.yml
new file mode 100644
index 0000000..79b8f6b
--- /dev/null
+++ b/classes/cluster/virtual-offline-ssl/infra/backup/client_common.yml
@@ -0,0 +1,40 @@
+classes:
+- system.backupninja.client.single
+- system.openssh.client.root
+parameters:
+ _param:
+ backupninja_backup_host: ${_param:openstack_control_node03_address}
+ root_private_key: |
+ -----BEGIN RSA PRIVATE KEY-----
+ MIIEowIBAAKCAQEAxL6/rVgCetsETpZaUmXmkj8cZ1WN0eubH1FvMDOi/La9ZJyT
+ k0C6AYpJnIyEm93pMj5cLm08qRqMW+2pdOhYjcH69yg5MrX5SkRk8jCmIHIYoIbh
+ Qnwbnj3dd3I39ZdfU2FO7u2vlbglVou6ZoQxlJDItuLNtzq6EG+w9eF19e7+OsC6
+ 6iUItp618zfw1l3J/8nKvCGe2RYDf7mJW6XwCl/DwryJmwwzvPgYJ3QMuDD8/HFj
+ lrJ3xjFTXj4b4Ws1XIoy78fFbtiLr4OwqCYkho03u2E5rOOP1qZxZB63sivHMLMO
+ MM5bOAQKbulFNoyALADGYfc7sf0bZ4u9XXDXxQIDAQABAoIBAQCfmc2MJRT97KW1
+ yqpCpX9BrAiymuiNHf+cjEcSZxEUyHkjIRFmJt+9WB0W7ba1anM92vCUiPDojSzH
+ dig9Oi578JxR20NrK8uqv4jUHzrknynzLveVI3CUEcOSnglfJQijbxDFKfOCFPvV
+ FUyE1UATMNBh6+LNfMprgu+exuMWOPnDyUiYQ+WZ0JfuZY8fuaZte4woJJOb9LUu
+ 5rsMG/smIzjpgZ0Z9ZVDMurfq565qhpaXRAqKeIuyht8pacTo31iMQdHB78AvY/3
+ g0z21Gk8k3z0Kr/YFKr2r4FmXY5m/gAUvZly2ZrVQM5XsbTVCzq/JpI5fssNvSbU
+ AKmXzf4RAoGBAOO3d4/cstxERzW6hyOTjZIN1ppR52CsnZTsVPbfd0pCtmzmVZce
+ CtHKdcXSbTwZvvkK09QSWAp3MoSpd0gIOiLU8Wx/R/RIZsu9BlhTS3r3EQLnk72d
+ H/1TTA+j4T/LIYLSojQ1RxvIrHetAD44j732aTwKAHj/SybEAVqNkOB/AoGBAN0u
+ gLcrgqIHGrk4VjWSvlCGymfF40equcx+ud7XhfZDGETUOSahW4dPZ52cjPAkrCBQ
+ MMfcDwSVGsOAjd+mNt11BHUKobnhXwFaWWuyqyn9NmWFbjMbICVh7E3Of5aVN38o
+ lrmo/7LuKMVG7XRwphCv5NkaJmQG4njDyUQWlaW7AoGADCd8wDb9bPhP/LQqBmIX
+ ylXmwHHisaxE9O/wUQT4bwREjGd25gv6c9wkkRx8LBsLsGs9hzI7dMOL9Ly+2x9l
+ SvqmsC3S/1zl77X1Ir2/Z57MT6Vgo1xBmtnZU3Rhz2/eKAdqFPNLClaZrgGT475N
+ HcyLLWMzR0IJFtabY+Puea0CgYA8Zb5wRkldxWLewSuJZZDinGwY+kieAVjLJq/K
+ 0j+ah6fQ48LXcah0wpIgz+cMjHcUO9GWQdk3/x9X03rqX5EL2DBnZYfUIl63F9zj
+ M97ZkHOSNWVqPzX//0Vv2butewG0j3jZKfTo/2/SrxOYgEpYtC9huWpSVi7xm0US
+ erhSkQKBgFIf9JEsfgE57ANhvITZ3ZI0uZXNxZkXQaVg8jvScDi79IIhy9iPzhKC
+ aIIQoDNIlWv1ftCRZ5AlBvVXgvQ/QNrwy48JiQTzWZlb9Ezg8w+olQmSbG6fq7Y+
+ 7r3i+QUZ7RBdOb24QcQ618q54ozNTCB7OywY78ptFzeoBeptiNr1
+ -----END RSA PRIVATE KEY-----
+ # for salt-master backup
+ backupninja:
+ client:
+ target:
+ home_dir: /srv/volumes/backup/backupninja
+ engine_opts: "-av --delete --recursive --safe-links"
diff --git a/classes/cluster/virtual-offline-ssl/infra/backup/client_mysql.yml b/classes/cluster/virtual-offline-ssl/infra/backup/client_mysql.yml
new file mode 100644
index 0000000..18cabd8
--- /dev/null
+++ b/classes/cluster/virtual-offline-ssl/infra/backup/client_mysql.yml
@@ -0,0 +1,38 @@
+classes:
+- system.xtrabackup.client.single
+parameters:
+ _param:
+ xtrabackup_remote_server: ${_param:openstack_control_node03_address}
+ xtrabackup_qpress_source_name: http://${_param:aptly_server_address}:8078/qpress-11-linux-x64.tar
+ root_private_key: |
+ -----BEGIN RSA PRIVATE KEY-----
+ MIIEowIBAAKCAQEAxL6/rVgCetsETpZaUmXmkj8cZ1WN0eubH1FvMDOi/La9ZJyT
+ k0C6AYpJnIyEm93pMj5cLm08qRqMW+2pdOhYjcH69yg5MrX5SkRk8jCmIHIYoIbh
+ Qnwbnj3dd3I39ZdfU2FO7u2vlbglVou6ZoQxlJDItuLNtzq6EG+w9eF19e7+OsC6
+ 6iUItp618zfw1l3J/8nKvCGe2RYDf7mJW6XwCl/DwryJmwwzvPgYJ3QMuDD8/HFj
+ lrJ3xjFTXj4b4Ws1XIoy78fFbtiLr4OwqCYkho03u2E5rOOP1qZxZB63sivHMLMO
+ MM5bOAQKbulFNoyALADGYfc7sf0bZ4u9XXDXxQIDAQABAoIBAQCfmc2MJRT97KW1
+ yqpCpX9BrAiymuiNHf+cjEcSZxEUyHkjIRFmJt+9WB0W7ba1anM92vCUiPDojSzH
+ dig9Oi578JxR20NrK8uqv4jUHzrknynzLveVI3CUEcOSnglfJQijbxDFKfOCFPvV
+ FUyE1UATMNBh6+LNfMprgu+exuMWOPnDyUiYQ+WZ0JfuZY8fuaZte4woJJOb9LUu
+ 5rsMG/smIzjpgZ0Z9ZVDMurfq565qhpaXRAqKeIuyht8pacTo31iMQdHB78AvY/3
+ g0z21Gk8k3z0Kr/YFKr2r4FmXY5m/gAUvZly2ZrVQM5XsbTVCzq/JpI5fssNvSbU
+ AKmXzf4RAoGBAOO3d4/cstxERzW6hyOTjZIN1ppR52CsnZTsVPbfd0pCtmzmVZce
+ CtHKdcXSbTwZvvkK09QSWAp3MoSpd0gIOiLU8Wx/R/RIZsu9BlhTS3r3EQLnk72d
+ H/1TTA+j4T/LIYLSojQ1RxvIrHetAD44j732aTwKAHj/SybEAVqNkOB/AoGBAN0u
+ gLcrgqIHGrk4VjWSvlCGymfF40equcx+ud7XhfZDGETUOSahW4dPZ52cjPAkrCBQ
+ MMfcDwSVGsOAjd+mNt11BHUKobnhXwFaWWuyqyn9NmWFbjMbICVh7E3Of5aVN38o
+ lrmo/7LuKMVG7XRwphCv5NkaJmQG4njDyUQWlaW7AoGADCd8wDb9bPhP/LQqBmIX
+ ylXmwHHisaxE9O/wUQT4bwREjGd25gv6c9wkkRx8LBsLsGs9hzI7dMOL9Ly+2x9l
+ SvqmsC3S/1zl77X1Ir2/Z57MT6Vgo1xBmtnZU3Rhz2/eKAdqFPNLClaZrgGT475N
+ HcyLLWMzR0IJFtabY+Puea0CgYA8Zb5wRkldxWLewSuJZZDinGwY+kieAVjLJq/K
+ 0j+ah6fQ48LXcah0wpIgz+cMjHcUO9GWQdk3/x9X03rqX5EL2DBnZYfUIl63F9zj
+ M97ZkHOSNWVqPzX//0Vv2butewG0j3jZKfTo/2/SrxOYgEpYtC9huWpSVi7xm0US
+ erhSkQKBgFIf9JEsfgE57ANhvITZ3ZI0uZXNxZkXQaVg8jvScDi79IIhy9iPzhKC
+ aIIQoDNIlWv1ftCRZ5AlBvVXgvQ/QNrwy48JiQTzWZlb9Ezg8w+olQmSbG6fq7Y+
+ 7r3i+QUZ7RBdOb24QcQ618q54ozNTCB7OywY78ptFzeoBeptiNr1
+ -----END RSA PRIVATE KEY-----
+ xtrabackup:
+ server:
+ enabled: false
+ backup_dir: /srv/volumes/backup/xtrabackup
diff --git a/classes/cluster/virtual-offline-ssl/infra/backup/server.yml b/classes/cluster/virtual-offline-ssl/infra/backup/server.yml
new file mode 100644
index 0000000..8f84903
--- /dev/null
+++ b/classes/cluster/virtual-offline-ssl/infra/backup/server.yml
@@ -0,0 +1,15 @@
+classes:
+- system.backupninja.server.single
+- system.xtrabackup.server.single
+- system.glusterfs.client.cluster
+- system.glusterfs.client.volume.backup
+parameters:
+ _param:
+ backupninja_public_key: ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDEvr+tWAJ62wROllpSZeaSPxxnVY3R65sfUW8wM6L8tr1knJOTQLoBikmcjISb3ekyPlwubTypGoxb7al06FiNwfr3KDkytflKRGTyMKYgchighuFCfBuePd13cjf1l19TYU7u7a+VuCVWi7pmhDGUkMi24s23OroQb7D14XX17v46wLrqJQi2nrXzN/DWXcn/ycq8IZ7ZFgN/uYlbpfAKX8PCvImbDDO8+BgndAy4MPz8cWOWsnfGMVNePhvhazVcijLvx8Vu2Iuvg7CoJiSGjTe7YTms44/WpnFkHreyK8cwsw4wzls4BApu6UU2jIAsAMZh9zux/Rtni71dcNfF
+ xtrabackup_public_key: ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDEvr+tWAJ62wROllpSZeaSPxxnVY3R65sfUW8wM6L8tr1knJOTQLoBikmcjISb3ekyPlwubTypGoxb7al06FiNwfr3KDkytflKRGTyMKYgchighuFCfBuePd13cjf1l19TYU7u7a+VuCVWi7pmhDGUkMi24s23OroQb7D14XX17v46wLrqJQi2nrXzN/DWXcn/ycq8IZ7ZFgN/uYlbpfAKX8PCvImbDDO8+BgndAy4MPz8cWOWsnfGMVNePhvhazVcijLvx8Vu2Iuvg7CoJiSGjTe7YTms44/WpnFkHreyK8cwsw4wzls4BApu6UU2jIAsAMZh9zux/Rtni71dcNfF
+ backupninja:
+ server:
+ home_dir: /srv/volumes/backup/backupninja
+ xtrabackup:
+ server:
+ backup_dir: /srv/volumes/backup/xtrabackup
\ No newline at end of file
diff --git a/classes/cluster/virtual-offline-ssl/infra/config.yml b/classes/cluster/virtual-offline-ssl/infra/config.yml
new file mode 100644
index 0000000..31d00aa
--- /dev/null
+++ b/classes/cluster/virtual-offline-ssl/infra/config.yml
@@ -0,0 +1,214 @@
+classes:
+- service.git.client
+- system.linux.system.single
+- system.linux.system.single.debian
+- system.linux.system.repo_local.mcp.salt
+- system.linux.system.repo_local.mcp.apt_mirantis.openstack
+- system.openssh.client.lab
+- system.salt.master.pkg
+- system.salt.master.api
+- system.salt.master.formula.pkg.manila
+- system.salt.master.formula.pkg.gnocchi
+- system.salt.master.formula.pkg.panko
+# Add when reclass bumped
+#-salt/master/formula/pkg/dogtag.yml
+- system.reclass.storage.salt
+- system.salt.minion.ca.salt_master
+- system.sphinx.server.doc.reclass
+- system.keystone.client.single
+- system.keystone.client.service.nova21
+- system.keystone.client.service.nova-placement
+- system.keystone.client.service.cinder3
+- system.keystone.client.service.designate
+- system.keystone.client.service.manila
+- system.keystone.client.service.manila2
+- system.keystone.client.service.aodh
+- system.keystone.client.service.ceilometer
+- system.keystone.client.service.panko
+- system.keystone.client.service.gnocchi
+- system.keystone.client.service.barbican
+- system.reclass.storage.system.openstack_dns_cluster
+- system.reclass.storage.system.openstack_control_cluster
+- system.reclass.storage.system.openstack_compute_multi
+- system.reclass.storage.system.openstack_gateway_single
+- system.reclass.storage.system.openstack_dashboard_single
+- system.reclass.storage.system.openstack_share_single
+- system.reclass.storage.system.openstack_telemetry_cluster
+- cluster.virtual-offline-ssl
+parameters:
+ _param:
+ reclass_data_repository: https://gerrit.mcp.mirantis.net/salt-models/mcp-virtual-lab
+ reclass_data_revision: master
+ salt_master_environment_repository: "https://github.com/tcpcloud"
+ salt_master_environment_revision: master
+ salt_api_password_hash: "$6$sGnRlxGf$al5jMCetLP.vfI/fTl3Z0N7Za1aeiexL487jAtyRABVfT3NlwZxQGVhO7S1N8OwS/34VHYwZQA8lkXwKMN/GS1"
+ reclass_config_master: 192.168.10.90
+ single_address: 172.16.10.100
+ salt_master_host: 127.0.0.1
+ salt_master_base_environment: prd
+ linux:
+ network:
+ interface:
+ ens4:
+ enabled: true
+ type: eth
+ proto: static
+ address: ${_param:single_address}
+ netmask: 255.255.255.0
+ salt:
+ master:
+ reactor:
+ reclass/minion/classify:
+ - salt://reclass/reactor/node_register.sls
+ environment:
+ prd:
+ formula:
+ dogtag:
+ source: pkg
+ name: salt-formula-dogtag
+ reclass:
+ storage:
+ class_mapping:
+ common_node:
+ expression: all
+ node_param:
+ single_address:
+ value_template: <<node_control_ip>>
+ linux_system_codename:
+ value_template: <<node_os>>
+ salt_master_host:
+ value_template: <<node_master_ip>>
+ infra_config:
+ expression: <<node_hostname>>__startswith__cfg
+ cluster_param:
+ infra_config_address:
+ value_template: <<node_control_ip>>
+ infra_config_deploy_address:
+ value_template: <<node_deploy_ip>>
+ cluster_domain:
+ value_template: <<node_domain>>
+ openstack_control01:
+ expression: <<node_hostname>>__equals__ctl01
+ cluster_param:
+ openstack_control_node01_address:
+ value_template: <<node_control_ip>>
+ openstack_control02:
+ expression: <<node_hostname>>__equals__ctl02
+ cluster_param:
+ openstack_control_node02_address:
+ value_template: <<node_control_ip>>
+ openstack_control03:
+ expression: <<node_hostname>>__equals__ctl03
+ cluster_param:
+ openstack_control_node03_address:
+ value_template: <<node_control_ip>>
+ openstack_compute:
+ expression: <<node_hostname>>__startswith__cmp
+ node_class:
+ value_template:
+ - cluster.<<node_cluster>>.openstack.compute
+ node_param:
+ tenant_address:
+ value_template: <<node_tenant_ip>>
+ external_address:
+ value_template: <<node_external_ip>>
+ openstack_gateway:
+ expression: <<node_hostname>>__startswith__gtw
+ node_class:
+ value_template:
+ - cluster.<<node_cluster>>.openstack.gateway
+ node_param:
+ tenant_address:
+ value_template: <<node_tenant_ip>>
+ external_address:
+ value_template: <<node_external_ip>>
+ cluster_param:
+ openstack_gateway_node01_address:
+ value_template: <<node_control_ip>>
+ openstack_dashboard:
+ expression: <<node_hostname>>__startswith__prx
+ node_class:
+ value_template:
+ - cluster.<<node_cluster>>.openstack.dashboard
+ - cluster.<<node_cluster>>.openstack.proxy
+ cluster_param:
+ openstack_proxy_node01_address:
+ value_template: <<node_control_ip>>
+ openstack_share:
+ expression: <<node_hostname>>__startswith__share
+ node_class:
+ value_template:
+ - cluster.<<node_cluster>>.openstack.share
+ cluster_param:
+ openstack_share_node01_address:
+ value_template: <<node_control_ip>>
+ openstack_share_node01_share_address:
+ value_template: <<node_tenant_ip>>
+ openstack_telemetry01:
+ expression: <<node_hostname>>__equals__mdb01
+ cluster_param:
+ openstack_telemetry_node01_address:
+ value_template: <<node_control_ip>>
+ openstack_telemetry02:
+ expression: <<node_hostname>>__equals__mdb02
+ cluster_param:
+ openstack_telemetry_node02_address:
+ value_template: <<node_control_ip>>
+ openstack_telemetry03:
+ expression: <<node_hostname>>__equals__mdb03
+ cluster_param:
+ openstack_telemetry_node03_address:
+ value_template: <<node_control_ip>>
+ node:
+ openstack_control_node01:
+ classes:
+ - service.galera.master.cluster
+ - service.dogtag.server.cluster.master
+ params:
+ mysql_cluster_role: master
+ linux_system_codename: xenial
+ openstack_control_node02:
+ classes:
+ - service.galera.slave.cluster
+ - service.dogtag.server.cluster.slave
+ params:
+ mysql_cluster_role: slave
+ linux_system_codename: xenial
+ openstack_control_node03:
+ classes:
+ - service.galera.slave.cluster
+ - service.dogtag.server.cluster.slave
+ params:
+ mysql_cluster_role: slave
+ linux_system_codename: xenial
+ openstack_compute_node01:
+ params:
+ single_address: 172.16.10.105
+ tenant_address: 10.1.0.105
+ external_address: 10.16.0.105
+ openstack_compute_node02:
+ params:
+ single_address: 172.16.10.106
+ tenant_address: 10.1.0.106
+ external_address: 10.16.0.106
+ openstack_gateway_node01:
+ params:
+ tenant_address: 10.1.0.110
+ external_address: 10.16.0.110
+ openstack_proxy_node01:
+ classes:
+ - cluster.virtual-offline-ssl.openstack.proxy
+ params:
+ linux_system_codename: xenial
+ openstack_telemetry_node01:
+ params:
+ # create resources only from 1 controller
+ # to prevent race conditions
+ ceilometer_create_gnocchi_resources: true
+ redis_cluster_role: 'master'
+ openstack_telemetry_node02:
+ params:
+ redis_cluster_role: 'slave'
+ openstack_telemetry_node03:
+ params:
+ redis_cluster_role: 'slave'
diff --git a/classes/cluster/virtual-offline-ssl/infra/init.yml b/classes/cluster/virtual-offline-ssl/infra/init.yml
new file mode 100644
index 0000000..b01723d
--- /dev/null
+++ b/classes/cluster/virtual-offline-ssl/infra/init.yml
@@ -0,0 +1,14 @@
+parameters:
+ linux:
+ network:
+ host:
+ cfg01:
+ address: ${_param:infra_config_address}
+ names:
+ - ${_param:infra_config_hostname}
+ - ${_param:infra_config_hostname}.${_param:cluster_domain}
+ cfg:
+ address: ${_param:infra_config_address}
+ names:
+ - cfg
+ - cfg.${_param:cluster_domain}
diff --git a/classes/cluster/virtual-offline-ssl/init.yml b/classes/cluster/virtual-offline-ssl/init.yml
new file mode 100644
index 0000000..fb3c853
--- /dev/null
+++ b/classes/cluster/virtual-offline-ssl/init.yml
@@ -0,0 +1,78 @@
+classes:
+- system.linux.network.dynamic_hosts
+- system.linux.system.repo_local.mcp.extra
+- system.linux.system.repo_local.mcp.apt_mirantis.saltstack_2016_3
+- system.linux.system.repo_local.mcp.apt_mirantis.ubuntu
+- system.linux.system.single
+- system.linux.system.single.debian
+- system.rsyslog.client.single
+- system.openssh.server.team.lab
+- system.openssh.server.team.tcpcloud
+- system.openssh.server.team.mcp_qa
+- cluster.virtual-offline-ssl.infra
+- cluster.virtual-offline-ssl.openstack
+parameters:
+ _param:
+ cluster_domain: virtual-offline-ssl.local
+ cluster_name: virtual-offline-ssl
+ salt_minion_ca_host: cfg01.${linux:system:domain}
+ # infra service addresses
+ infra_config_hostname: cfg01
+ infra_config_address: 172.16.10.100
+ local_repos: true
+ local_repo_url: mirror.mcp.mirantis.local.test
+ linux_repo_refresh_db: true
+ aptly_server_address: 10.170.0.226
+ remote_rsyslog_host: 127.0.0.3
+ remote_rsyslog_port: 10514
+ salt:
+ minion:
+ trusted_ca_minions:
+ - cfg01.${linux:system:domain}
+ rsyslog:
+ client:
+ run_user: syslog
+ run_group: adm
+ enabled: true
+ rainerscript:
+ module:
+ imfile: {}
+ input:
+ imfile:
+ nginx:
+ File: "/var/log/nginx/*.log"
+ Tag: "nginx__"
+ Severity: "notice"
+ Facility: "local0"
+ PersistStateInterval: "0"
+ Ruleset: "myapp_logs"
+ apache2:
+ File: "/var/log/apache2/*.log"
+ Tag: "apache2__"
+ Severity: "notice"
+ Facility: "local0"
+ Ruleset: "myapp_logs"
+ PersistStateInterval: "0"
+ rabbitmq:
+ File: "/var/log/rabbitmq/*.log"
+ Tag: "rabbitmq__"
+ Severity: "notice"
+ Facility: "local0"
+ PersistStateInterval: "0"
+ Ruleset: "myapp_logs"
+ template:
+ ImfileFilePath:
+ parameter:
+ type: string
+ string: "<%PRI%>%TIMESTAMP:::date-rfc3339% %HOSTNAME% %syslogtag:1:32%%$.suffix%%msg:::sp-if-no-1st-sp%%msg%\n"
+ ruleset:
+ remote_logs:
+ description: 'action(type="omfwd" Target="${_param:remote_rsyslog_host}" Port="${_param:remote_rsyslog_port}" Protocol="udp" Template="ImfileFilePath")'
+ myapp_logs:
+ description: 'set $.suffix=re_extract($!metadata!filename, "(.*)/([^/]*[^/.log])", 0, 2, "all.log"); call remote_logs'
+ output:
+ remote:
+ somehost.domain:
+ action: "@${_param:remote_rsyslog_host}:${_param:remote_rsyslog_port}"
+ filter: "*.*"
+ enabled: true
diff --git a/classes/cluster/virtual-offline-ssl/openstack/compute.yml b/classes/cluster/virtual-offline-ssl/openstack/compute.yml
new file mode 100644
index 0000000..5a5710a
--- /dev/null
+++ b/classes/cluster/virtual-offline-ssl/openstack/compute.yml
@@ -0,0 +1,99 @@
+classes:
+- system.linux.system.repo_local.mcp.apt_mirantis.openstack
+- system.linux.system.repo_local.mcp.extra
+- system.linux.system.repo_local.mcp.apt_mirantis.saltstack_2016_3
+- system.linux.system.repo_local.mcp.apt_mirantis.ceph
+- system.linux.network.hosts
+- system.linux.storage.loopback
+- system.nova.compute.cluster
+- system.neutron.compute.cluster
+- system.ceilometer.client.nova_compute
+- system.ceilometer.agent.cluster
+- system.ceilometer.agent.polling.default
+- service.cinder.volume.single
+- system.cinder.volume.backend.lvm
+- system.nova.compute.nfv.cpu_pinning
+- system.nova.compute.nfv.sriov
+- system.neutron.compute.nfv.dpdk
+- system.neutron.compute.nfv.sriov
+- cluster.virtual-offline-ssl
+parameters:
+ _param:
+ primary_interface: ens4
+ tenant_interface: ens5
+ external_interface: ens6
+ interface_mtu: 1500
+ linux_system_codename: xenial
+ sriov_nic01_device_name: enp5s0f1
+ sriov_nic01_numvfs: 16
+ sriov_nic01_physical_network: physnet3
+ sriov_unsafe_interrupts: False
+ dpdk0_pci: '"0000:04:00"'
+ nova_cpu_pinning: 0,1,2
+ compute_dpdk_driver: uio
+ compute_kernel_isolcpu: ${_param:nova_cpu_pinning}
+ compute_ovs_pmd_cpu_mask: "0x6"
+ compute_ovs_dpdk_socket_mem: "1024"
+ compute_ovs_dpdk_lcore_mask: "0x400"
+ compute_ovs_memory_channels: "2"
+ loopback_device_size: 20
+ nova:
+ compute:
+ vncproxy_url: http://${_param:cluster_vip_address}:6080
+ barbican:
+ enabled: ${_param:barbican_integration_enabled}
+ identity:
+ protocol: https
+ network:
+ protocol: https
+ glance:
+ protocol: https
+ image:
+ protocol: https
+ neutron:
+ compute:
+ notification:
+ driver: messagingv2
+ topics: "notifications"
+ cinder:
+ volume:
+ barbican:
+ enabled: ${_param:barbican_integration_enabled}
+ linux:
+ network:
+ bridge: openvswitch
+ interface:
+ dhcp_int:
+ enabled: true
+ name: ens3
+ proto: dhcp
+ type: eth
+ mtu: ${_param:interface_mtu}
+ primary_interface:
+ enabled: true
+ name: ${_param:primary_interface}
+ mtu: ${_param:interface_mtu}
+ proto: manual
+ type: eth
+ tenant_interface:
+ enabled: true
+ name: ${_param:tenant_interface}
+ mtu: ${_param:interface_mtu}
+ proto: manual
+ type: eth
+ br-mgmt:
+ enabled: true
+ type: bridge
+ proto: static
+ address: ${_param:single_address}
+ netmask: 255.255.255.0
+ use_interfaces:
+ - ${_param:primary_interface}
+ br-mesh:
+ enabled: true
+ type: bridge
+ proto: static
+ address: ${_param:tenant_address}
+ netmask: 255.255.255.0
+ use_interfaces:
+ - ${_param:tenant_interface}
diff --git a/classes/cluster/virtual-offline-ssl/openstack/control.yml b/classes/cluster/virtual-offline-ssl/openstack/control.yml
new file mode 100644
index 0000000..9eb601a
--- /dev/null
+++ b/classes/cluster/virtual-offline-ssl/openstack/control.yml
@@ -0,0 +1,316 @@
+classes:
+- system.salt.minion.cert.proxy
+- system.linux.system.lowmem
+- system.linux.system.repo_local.mcp.apt_mirantis.glusterfs
+- system.linux.system.repo_local.mcp.apt_mirantis.openstack
+- system.linux.system.repo_local.mcp.extra
+- system.linux.system.repo_local.mcp.apt_mirantis.saltstack_2016_3
+- system.linux.system.repo_local.mcp.apt_mirantis.ceph
+- system.memcached.server.single
+- system.rabbitmq.server.cluster
+- system.rabbitmq.server.vhost.openstack
+- system.apache.server.site.manila
+- system.apache.server.site.barbican
+- system.apache.server.site.nova-placement
+- system.apache.server.site.cinder
+- system.nginx.server.single
+- system.nginx.server.proxy.openstack_api
+- system.nginx.server.proxy.openstack.designate
+- system.keystone.server.wsgi
+- system.keystone.server.cluster
+- system.glusterfs.client.cluster
+- system.glusterfs.client.volume.glance
+- system.glusterfs.client.volume.keystone
+- system.glusterfs.server.volume.glance
+- system.glusterfs.server.volume.keystone
+- system.glusterfs.server.cluster
+- system.glance.control.cluster
+- system.nova.control.cluster
+- system.neutron.control.openvswitch.cluster
+- system.cinder.control.cluster
+- system.heat.server.cluster
+- system.designate.server.cluster
+- system.galera.server.cluster
+- system.galera.server.database.cinder
+- system.galera.server.database.glance
+- system.galera.server.database.heat
+- system.galera.server.database.keystone
+- system.galera.server.database.nova
+- system.galera.server.database.designate
+- system.galera.server.database.manila
+- system.galera.server.database.aodh
+- system.galera.server.database.panko
+- system.galera.server.database.gnocchi
+- system.galera.server.database.barbican
+- system.dogtag.server.cluster
+- system.barbican.server.cluster
+- service.barbican.server.plugin.dogtag
+- system.ceilometer.client
+- system.ceilometer.client.cinder_volume
+- system.ceilometer.client.neutron
+- system.haproxy.proxy.listen.openstack.placement
+- system.haproxy.proxy.listen.openstack.manila
+- system.manila.control.cluster
+- cluster.virtual-offline-ssl.openstack.dns
+- cluster.virtual-offline-ssl
+parameters:
+ _param:
+ keepalived_vip_interface: ens4
+ salt_minion_ca_authority: salt_master_ca
+ ### nginx ssl sites settings
+ nginx_proxy_ssl:
+ enabled: true
+ engine: salt
+ authority: "${_param:salt_minion_ca_authority}"
+ key_file: "/etc/ssl/private/internal_proxy.key"
+ cert_file: "/etc/ssl/certs/internal_proxy.crt"
+ chain_file: "/etc/ssl/certs/internal_proxy-with-chain.crt"
+ nginx_proxy_openstack_api_address: ${_param:cluster_local_address}
+ nginx_proxy_openstack_keystone_host: 127.0.0.1
+ nginx_proxy_openstack_nova_host: 127.0.0.1
+ nginx_proxy_openstack_glance_host: 127.0.0.1
+ nginx_proxy_openstack_neutron_host: 127.0.0.1
+ nginx_proxy_openstack_heat_host: 127.0.0.1
+ nginx_proxy_openstack_designate_host: 127.0.0.1
+ apache_manila_api_address: ${_param:single_address}
+ apache_manila_ssl: ${_param:nginx_proxy_ssl}
+ apache_keystone_api_host: ${_param:single_address}
+ apache_keystone_ssl: ${_param:nginx_proxy_ssl}
+ apache_barbican_api_address: ${_param:cluster_local_address}
+ apache_barbican_api_host: ${_param:single_address}
+ apache_barbican_ssl: ${_param:nginx_proxy_ssl}
+ apache_nova_placement_api_address: ${_param:cluster_local_address}
+ apache_nova_placement_ssl: ${_param:nginx_proxy_ssl}
+ barbican_dogtag_nss_password: workshop
+ barbican_dogtag_host: ${_param:cluster_vip_address}
+ apache_cinder_api_address: ${_param:cluster_local_address}
+ apache_cinder_ssl: ${_param:nginx_proxy_ssl}
+ # dogtag listens on 8443 but there is no way to bind it to
+ # Specific IP, as on this setup dogtag installed on ctl nodes
+ # Change port on haproxy side to avoid binding conflict.
+ haproxy_dogtag_bind_port: 8444
+ cluster_dogtag_port: 8443
+ dogtag_master_host: ctl01.${linux:system:domain}
+ dogtag_pki_admin_password: workshop
+ dogtag_pki_client_database_password: workshop
+ dogtag_pki_client_pkcs12_password: workshop
+ dogtag_pki_ds_password: workshop
+ dogtag_pki_token_password: workshop
+ dogtag_pki_security_domain_password: workshop
+ dogtag_pki_clone_pkcs12_password: workshop
+ nginx:
+ server:
+ site:
+ nginx_proxy_openstack_api_keystone:
+ enabled: false
+ nginx_proxy_openstack_api_keystone_private:
+ enabled: false
+ nginx_proxy_openstack_api_cinder:
+ enabled: false
+ linux:
+ system:
+ package:
+ python-msgpack:
+ version: latest
+ network:
+ interface:
+ ens4:
+ enabled: true
+ type: eth
+ proto: static
+ address: ${_param:single_address}
+ netmask: 255.255.255.0
+ keepalived:
+ cluster:
+ instance:
+ VIP:
+ virtual_router_id: 150
+ dogtag:
+ server:
+ ldap_hostname: ${linux:network:fqdn}
+ ldap_dn_password: workshop
+ ldap_admin_password: workshop
+ export_pem_file_path: /etc/dogtag/kra_admin_cert.pem
+ # TODO drop this once reclass bumped, missing part in current version
+ apache:
+ server:
+ site:
+ barbican_admin:
+ host:
+ address: ${_param:apache_barbican_api_address}
+ name: ${_param:apache_barbican_api_host}
+ port: 9312
+ log:
+ custom:
+ format: 'combined'
+ file: '/var/log/barbican/barbican-api.log'
+ error:
+ enabled: true
+ file: '/var/log/barbican/barbican-api.log'
+ barbican:
+ server:
+ enabled: true
+ dogtag_admin_cert:
+ engine: mine
+ minion: ${_param:dogtag_master_host}
+ ks_notifications_enable: True
+ store:
+ software:
+ store_plugin: dogtag_crypto
+ global_default: True
+ plugin:
+ dogtag:
+ port: ${_param:haproxy_dogtag_bind_port}
+ keystone:
+ server:
+ admin_email: ${_param:admin_email}
+ designate:
+ pool_manager:
+ enabled: ${_param:designate_pool_manager_enabled}
+ periodic_sync_interval: ${_param:designate_pool_manager_periodic_sync_interval}
+ server:
+ identity:
+ protocol: https
+ bind:
+ api:
+ address: 127.0.0.1
+ backend:
+ pdns4:
+ api_token: ${_param:designate_pdns_api_key}
+ api_endpoint: ${_param:designate_pdns_api_endpoint}
+ mdns:
+ address: ${_param:designate_mdns_address}
+ port: ${_param:designate_mdns_port}
+ pools:
+ default:
+ description: 'test pool'
+ targets:
+ default:
+ description: 'test target1'
+ default1:
+ type: ${_param:designate_pool_target_type}
+ description: 'test target2'
+ masters: ${_param:designate_pool_target_masters}
+ options:
+ host: ${_param:openstack_dns_node02_address}
+ port: 53
+ api_endpoint: "http://${_param:openstack_dns_node02_address}:${_param:powerdns_webserver_port}"
+ api_token: ${_param:designate_pdns_api_key}
+ quota:
+ zones: ${_param:designate_quota_zones}
+ glance:
+ server:
+ barbican:
+ enabled: ${_param:barbican_integration_enabled}
+ storage:
+ engine: file
+ images: []
+ workers: 1
+ bind:
+ address: 127.0.0.1
+ identity:
+ protocol: https
+ registry:
+ protocol: https
+ heat:
+ server:
+ bind:
+ api:
+ address: 127.0.0.1
+ api_cfn:
+ address: 127.0.0.1
+ api_cloudwatch:
+ address: 127.0.0.1
+ identity:
+ protocol: https
+ neutron:
+ server:
+ bind:
+ address: 127.0.0.1
+ identity:
+ protocol: https
+ nova:
+ controller:
+ networking: dvr
+ cpu_allocation: 54
+ barbican:
+ enabled: ${_param:barbican_integration_enabled}
+ metadata:
+ password: ${_param:metadata_password}
+ bind:
+ address: ${_param:cluster_local_address}
+ bind:
+ public_address: ${_param:cluster_vip_address}
+ novncproxy_port: 6080
+ private_address: 127.0.0.1
+ identity:
+ protocol: https
+ network:
+ protocol: https
+ glance:
+ protocol: https
+ vncproxy_url: http://${_param:cluster_vip_address}:6080
+ workers: 1
+ cinder:
+ controller:
+ controller:
+ barbican:
+ enabled: ${_param:barbican_integration_enabled}
+ identity:
+ protocol: https
+ osapi:
+ host: 127.0.0.1
+ glance:
+ protocol: https
+ manila:
+ common:
+ identity:
+ protocol: https
+ default_share_type: default
+ salt:
+ minion:
+ cert:
+ internal_proxy:
+ host: ${_param:salt_minion_ca_host}
+ authority: ${_param:salt_minion_ca_authority}
+ common_name: internal_proxy
+ signing_policy: cert_open
+ alternative_names: IP:127.0.0.1,IP:${_param:cluster_local_address},IP:${_param:cluster_public_host},DNS:${linux:system:name},DNS:${linux:network:fqdn},DNS:${_param:cluster_local_address},DNS:${_param:cluster_public_host}
+ key_file: "/etc/ssl/private/internal_proxy.key"
+ cert_file: "/etc/ssl/certs/internal_proxy.crt"
+ all_file: "/etc/ssl/certs/internal_proxy-with-chain.crt"
+ haproxy:
+ proxy:
+ listen:
+ barbican-api:
+ type: ~
+ barbican-admin-api:
+ type: ~
+ designate_api:
+ type: ~
+ keystone_public_api:
+ type: ~
+ keystone_admin_api:
+ type: ~
+ manila_api:
+ type: ~
+ nova_api:
+ type: ~
+ nova_metadata_api:
+ type: ~
+ cinder_api:
+ type: ~
+ glance_api:
+ type: ~
+ glance_registry_api:
+ type: ~
+ heat_cloudwatch_api:
+ type: ~
+ heat_api:
+ type: ~
+ heat_cfn_api:
+ type: ~
+ neutron_api:
+ type: ~
+ placement_api:
+ type: ~
diff --git a/classes/cluster/virtual-offline-ssl/openstack/dashboard.yml b/classes/cluster/virtual-offline-ssl/openstack/dashboard.yml
new file mode 100644
index 0000000..24fbe16
--- /dev/null
+++ b/classes/cluster/virtual-offline-ssl/openstack/dashboard.yml
@@ -0,0 +1,19 @@
+classes:
+- system.linux.system.repo_local.mcp.apt_mirantis.ubuntu
+- system.linux.system.repo_local.mcp.apt_mirantis.openstack
+- system.linux.system.repo_local.mcp.extra
+- system.linux.system.repo_local.mcp.apt_mirantis.saltstack_2016_3
+- system.horizon.server.single
+- cluster.virtual-offline-ssl
+parameters:
+ _param:
+ horizon_site_branding: OpenStack Dashboard
+ linux:
+ network:
+ interface:
+ ens4:
+ enabled: true
+ type: eth
+ proto: static
+ address: ${_param:single_address}
+ netmask: 255.255.255.0
diff --git a/classes/cluster/virtual-offline-ssl/openstack/dns.yml b/classes/cluster/virtual-offline-ssl/openstack/dns.yml
new file mode 100644
index 0000000..fbb7291
--- /dev/null
+++ b/classes/cluster/virtual-offline-ssl/openstack/dns.yml
@@ -0,0 +1,35 @@
+classes:
+- system.powerdns.server.single
+- cluster.virtual-offline-ssl
+
+parameters:
+ powerdns:
+ server:
+ api:
+ enabled: True
+ key: ${_param:designate_pdns_api_key}
+ axfr_ips:
+ ${_param:powerdns_axfr_ips}
+ bind:
+ address: ${_param:single_address}
+ overwrite_supermasters: True
+ supermasters:
+ ${_param:powerdns_supermasters}
+ webserver:
+ enabled: True
+ address: ${_param:single_address}
+ password: ${_param:powerdns_webserver_password}
+ port: ${_param:powerdns_webserver_port}
+ linux:
+ system:
+ package:
+ python-msgpack:
+ version: latest
+ network:
+ interface:
+ ens4:
+ enabled: true
+ type: eth
+ proto: static
+ address: ${_param:single_address}
+ netmask: 255.255.255.0
diff --git a/classes/cluster/virtual-offline-ssl/openstack/dogtag.yml b/classes/cluster/virtual-offline-ssl/openstack/dogtag.yml
new file mode 100644
index 0000000..a5b376e
--- /dev/null
+++ b/classes/cluster/virtual-offline-ssl/openstack/dogtag.yml
@@ -0,0 +1,67 @@
+classes:
+#- system.apache.server.site.barbican
+- system.dogtag.server.cluster
+- system.barbican.server.cluster
+- cluster.virtual-offline-ssl
+parameters:
+ _param:
+ apache_barbican_api_address: ${_param:cluster_local_address}
+ apache_barbican_ssl: ${_param:nginx_proxy_ssl}
+ apache_manila_ssl: ${_param:nginx_proxy_ssl}
+ barbican_dogtag_nss_password: workshop
+ barbican_dogtag_host: ${_param:cluster_vip_address}
+ # dogtag listens on 8443 but there is no way to bind it to
+ # Specific IP, as on this setup dogtag installed on ctl nodes
+ # Change port on haproxy side to avoid binding conflict.
+ haproxy_dogtag_bind_port: 8444
+ cluster_dogtag_port: 8443
+ dogtag_master_host: ctl01.${linux:system:domain}
+ dogtag:
+ server:
+ ldap_hostname: ${linux:network:fqdn}
+ ldap_dn_password: workshop
+ export_pem_file_path: /etc/dogtag/kra_admin_cert.pem
+ default_config_options:
+ pki_ds_hostname: ${linux:network:fqdn}
+ pki_admin_password: workshop
+ pki_backup_password: workshop
+ pki_client_database_password: workshop
+ pki_client_pkcs12_password: workshop
+ pki_clone_pkcs12_password: workshop
+ pki_ds_password: workshop
+ pki_token_password: workshop
+ pki_security_domain_name: EXAMPLE
+ pki_security_domain_password: workshop
+ barbican:
+ server:
+ enabled: true
+ dogtag_admin_cert:
+ engine: mine
+ minion: ${_param:dogtag_master_host}
+ ks_notifications_enable: True
+ store:
+ software:
+ store_plugin: dogtag_crypto
+ global_default: True
+ plugin:
+ dogtag:
+ port: ${_param:haproxy_dogtag_bind_port}
+ glance:
+ server:
+ barbican:
+ enabled: ${_param:barbican_integration_enabled}
+ nova:
+ controller:
+ barbican:
+ enabled: ${_param:barbican_integration_enabled}
+ cinder:
+ controller:
+ barbican:
+ enabled: ${_param:barbican_integration_enabled}
+ haproxy:
+ proxy:
+ listen:
+ barbican-api:
+ type: ~
+ barbican-admin-api:
+ type: ~
diff --git a/classes/cluster/virtual-offline-ssl/openstack/gateway.yml b/classes/cluster/virtual-offline-ssl/openstack/gateway.yml
new file mode 100644
index 0000000..831cc6a
--- /dev/null
+++ b/classes/cluster/virtual-offline-ssl/openstack/gateway.yml
@@ -0,0 +1,88 @@
+classes:
+- system.linux.system.repo_local.mcp.apt_mirantis.openstack
+- system.linux.system.repo_local.mcp.extra
+- system.linux.system.repo_local.mcp.apt_mirantis.saltstack_2016_3
+- system.neutron.gateway.cluster
+- cluster.virtual-offline-ssl
+parameters:
+ _param:
+ primary_interface: ens4
+ tenant_interface: ens5
+ external_interface: ens6
+ interface_mtu: 9000
+ neutron_gateway_dvr: True
+ neutron_gateway_agent_mode: dvr_snat
+ linux_system_codename: xenial
+ neutron:
+ gateway:
+ notification:
+ driver: messagingv2
+ topics: "notifications"
+ linux:
+ network:
+ bridge: openvswitch
+ interface:
+ dhcp_int:
+ enabled: true
+ name: ens3
+ proto: dhcp
+ type: eth
+ mtu: ${_param:interface_mtu}
+ primary_interface:
+ enabled: true
+ ipflush_onchange: true
+ name: ${_param:primary_interface}
+ mtu: ${_param:interface_mtu}
+ proto: manual
+ type: eth
+ tenant_interface:
+ enabled: true
+ ipflush_onchange: true
+ name: ${_param:tenant_interface}
+ mtu: ${_param:interface_mtu}
+ proto: manual
+ type: eth
+ external_interface:
+ enabled: true
+ ipflush_onchange: true
+ name: ${_param:external_interface}
+ mtu: ${_param:interface_mtu}
+ proto: manual
+ type: eth
+ br-floating:
+ enabled: true
+ type: ovs_bridge
+ mtu: ${_param:interface_mtu}
+ br-mgmt:
+ enabled: true
+ type: bridge
+ proto: static
+ address: ${_param:single_address}
+ netmask: 255.255.255.0
+ mtu: ${_param:interface_mtu}
+ use_interfaces:
+ - ${_param:primary_interface}
+ br-mesh:
+ enabled: true
+ type: bridge
+ mtu: ${_param:interface_mtu}
+ proto: static
+ address: ${_param:tenant_address}
+ netmask: 255.255.255.0
+ use_interfaces:
+ - ${_param:tenant_interface}
+ float-to-ex:
+ enabled: true
+ type: ovs_port
+ mtu: ${_param:interface_mtu}
+ bridge: br-floating
+ br-ex:
+ enabled: true
+ type: bridge
+ mtu: ${_param:interface_mtu}
+ address: ${_param:external_address}
+ netmask: 255.255.255.0
+ use_interfaces:
+ - ${_param:external_interface}
+ use_ovs_ports:
+ - float-to-ex
\ No newline at end of file
diff --git a/classes/cluster/virtual-offline-ssl/openstack/init.yml b/classes/cluster/virtual-offline-ssl/openstack/init.yml
new file mode 100644
index 0000000..77c4add
--- /dev/null
+++ b/classes/cluster/virtual-offline-ssl/openstack/init.yml
@@ -0,0 +1,282 @@
+parameters:
+ _param:
+ # openstack service addresses
+ openstack_database_address: 172.16.10.254
+ openstack_proxy_address: 172.16.10.121
+ openstack_proxy_node01_address: 172.16.10.121
+ openstack_control_address: 172.16.10.254
+ openstack_control_node01_hostname: ctl01
+ openstack_control_node02_hostname: ctl02
+ openstack_control_node03_hostname: ctl03
+ openstack_share_node01_hostname: share01
+ openstack_control_node01_address: 172.16.10.101
+ openstack_control_node02_address: 172.16.10.102
+ openstack_control_node03_address: 172.16.10.103
+ openstack_database_address: ${_param:openstack_control_address}
+ openstack_database_node01_address: ${_param:openstack_control_node01_address}
+ openstack_database_node02_address: ${_param:openstack_control_node02_address}
+ openstack_database_node03_address: ${_param:openstack_control_node03_address}
+ openstack_message_queue_address: ${_param:openstack_control_address}
+ openstack_message_queue_node01_address: ${_param:openstack_control_node01_address}
+ openstack_message_queue_node02_address: ${_param:openstack_control_node02_address}
+ openstack_message_queue_node03_address: ${_param:openstack_control_node03_address}
+ openstack_gateway_address: 172.16.10.110
+ openstack_gateway_node01_address: ${_param:openstack_gateway_address}
+ openstack_dns_node01_address: 172.16.10.111
+ openstack_dns_node02_address: 172.16.10.112
+ openstack_share_node01_address: 172.16.10.97
+ openstack_share_node01_share_address: ${_param:openstack_share_node01_address}
+ openstack_telemetry_address: 172.16.10.250
+ openstack_telemetry_node01_address: 172.16.10.45
+ openstack_telemetry_node02_address: 172.16.10.46
+ openstack_telemetry_node03_address: 172.16.10.47
+ openstack_telemetry_system_codename: xenial
+ openstack_telemetry_hostname: mdb
+ openstack_telemetry_node01_hostname: mdb01
+ openstack_telemetry_node02_hostname: mdb02
+ openstack_telemetry_node03_hostname: mdb03
+ openstack_telemetry_keepalived_password: hf9GQOjG2uPhkJ2Q
+
+ openstack_version: pike
+ apt_mk_version: nightly
+ cinder_version: ${_param:openstack_version}
+ mcp_repo_version: 1.1
+ openstack_region: RegionOne
+ admin_email: root@localhost
+ cluster_public_host: 172.16.10.254
+ telemetry_public_host: ${_param:openstack_telemetry_address}
+ cluster_public_protocol: https
+ cluster_internal_protocol: https
+ keystone_service_protocol: ${_param:cluster_internal_protocol}
+ glance_service_protocol: ${_param:cluster_internal_protocol}
+ nova_service_protocol: ${_param:cluster_internal_protocol}
+ neutron_service_protocol: ${_param:cluster_internal_protocol}
+ heat_service_protocol: ${_param:cluster_internal_protocol}
+ cinder_service_protocol: ${_param:cluster_internal_protocol}
+ designate_service_protocol: ${_param:cluster_internal_protocol}
+ manila_service_protocol: ${_param:cluster_internal_protocol}
+ ceilometer_service_protocol: ${_param:cluster_internal_protocol}
+ panko_service_protocol: ${_param:cluster_internal_protocol}
+ aodh_service_protocol: ${_param:cluster_internal_protocol}
+ gnocchi_service_protocol: ${_param:cluster_internal_protocol}
+ barbican_service_protocol: ${_param:cluster_internal_protocol}
+ neutron_control_dvr: True
+ neutron_tenant_network_types: "flat,vxlan"
+ neutron_l3_ha: False
+ neutron_global_physnet_mtu: 1500
+ neutron_external_mtu: 1500
+ neutron_gateway_dvr: True
+ neutron_gateway_agent_mode: dvr_snat
+ neutron_compute_dvr: True
+ neutron_compute_agent_mode: dvr
+ neutron_compute_external_access: True
+ galera_server_cluster_name: openstack_cluster
+ galera_server_maintenance_password: workshop
+ galera_server_admin_password: workshop
+ galera_innodb_read_io_threads: 2
+ galera_innodb_write_io_threads: 2
+ galera_wsrep_slave_threads: 2
+ galera_xtrabackup_parallel: 1
+ galera_error_log_enabled: true
+ cluster_vip_address: ${_param:openstack_control_address}
+ cluster_local_address: ${_param:single_address}
+ cluster_node01_hostname: ${_param:openstack_control_node01_hostname}
+ cluster_node01_address: ${_param:openstack_control_node01_address}
+ cluster_node02_hostname: ${_param:openstack_control_node02_hostname}
+ cluster_node02_address: ${_param:openstack_control_node02_address}
+ cluster_node03_hostname: ${_param:openstack_control_node03_hostname}
+ cluster_node03_address: ${_param:openstack_control_node03_address}
+ rabbitmq_secret_key: workshop
+ rabbitmq_admin_password: workshop
+ rabbitmq_openstack_password: workshop
+ rabbitmq_cold_password: workshop
+ powerdns_axfr_ips:
+ - ${_param:openstack_control_node01_address}
+ - ${_param:openstack_control_node02_address}
+ - ${_param:openstack_control_node03_address}
+ - 127.0.0.1
+ powerdns_supermasters:
+ - ip: ${_param:openstack_control_node01_address}
+ nameserver: ns1.example.org
+ account: master
+ - ip: ${_param:openstack_control_node02_address}
+ nameserver: ns2.example.org
+ account: master
+ - ip: ${_param:openstack_control_node03_address}
+ nameserver: ns3.example.org
+ account: master
+ powerdns_overwrite_supermasters: True
+ powerdns_webserver_password: gJ6n3gVaYP8eS
+ powerdns_webserver_port: 8081
+ designate_admin_api_enabled: true
+ designate_domain_id: 5186883b-91fb-4891-bd49-e6769234a8fc
+ designate_mdns_address: 0.0.0.0
+ designate_mdns_port: 53
+ designate_pdns_api_key: VxK9cMlFL5Ae
+ designate_pdns_api_endpoint: "http://${_param:openstack_dns_node01_address}:${_param:powerdns_webserver_port}"
+ designate_pool_manager_enabled: True
+ designate_pool_manager_periodic_sync_interval: '120'
+ designate_pool_ns_records:
+ - hostname: 'ns1.example.org.'
+ priority: 10
+ - hostname: 'ns2.example.org.'
+ priority: 20
+ - hostname: 'ns3.example.org.'
+ priority: 30
+ designate_pool_nameservers:
+ - host: ${_param:openstack_dns_node01_address}
+ port: 53
+ - host: ${_param:openstack_dns_node02_address}
+ port: 53
+ designate_pool_target_type: pdns4
+ designate_pool_target_masters:
+ - host: ${_param:openstack_control_node01_address}
+ port: 53
+ - host: ${_param:openstack_control_node02_address}
+ port: 53
+ - host: ${_param:openstack_control_node03_address}
+ port: 53
+ designate_pool_target_options:
+ host: ${_param:openstack_dns_node01_address}
+ port: 53
+ api_token: ${_param:designate_pdns_api_key}
+ api_endpoint: ${_param:designate_pdns_api_endpoint}
+ designate_quota_zones: 40
+ designate_version: ${_param:openstack_version}
+ glance_version: ${_param:openstack_version}
+ glance_service_host: ${_param:cluster_vip_address}
+ keystone_version: ${_param:openstack_version}
+ keystone_service_host: ${_param:cluster_vip_address}
+ heat_version: ${_param:openstack_version}
+ heat_service_host: ${_param:cluster_vip_address}
+ heat_domain_admin_password: workshop
+ cinder_version: ${_param:openstack_version}
+ cinder_service_host: ${_param:cluster_vip_address}
+ manila_version: ${_param:openstack_version}
+ manila_service_host: ${_param:cluster_vip_address}
+ panko_version: ${_param:openstack_version}
+ panko_service_host: ${_param:openstack_telemetry_address}
+ ceilometer_version: ${_param:openstack_version}
+ ceilometer_service_host: ${_param:openstack_telemetry_address}
+ barbican_service_host: ${_param:cluster_vip_address}
+ barbican_version: ${_param:openstack_version}
+ aodh_version: ${_param:openstack_version}
+ aodh_service_host: ${_param:openstack_telemetry_address}
+ gnocchi_version: 4.0
+ gnocchi_service_host: ${_param:openstack_telemetry_address}
+ gnocchi_public_host: ${_param:telemetry_public_host}
+ aodh_public_host: ${_param:telemetry_public_host}
+ ceilometer_public_host: ${_param:telemetry_public_host}
+ panko_public_host: ${_param:telemetry_public_host}
+ nova_version: ${_param:openstack_version}
+ nova_service_host: ${_param:cluster_vip_address}
+ nova_vncproxy_url: http://${_param:cluster_vip_address}:8060
+ neutron_version: ${_param:openstack_version}
+ neutron_service_host: ${_param:cluster_vip_address}
+ glusterfs_service_host: ${_param:cluster_vip_address}
+ designate_service_host: ${_param:cluster_vip_address}
+ metadata_password: password
+ mysql_admin_user: root
+ mysql_admin_password: workshop
+ mysql_cinder_password: workshop
+ mysql_glance_password: workshop
+ mysql_heat_password: workshop
+ mysql_keystone_password: workshop
+ mysql_neutron_password: workshop
+ mysql_nova_password: workshop
+ mysql_designate_password: workshop
+ mysql_manila_password: workshop
+ mysql_ceilometer_password: workshop
+ mysql_panko_password: workshop
+ mysql_aodh_password: workshop
+ mysql_gnocchi_password: workshop
+ mysql_barbican_password: workshop
+ keystone_service_token: workshop
+ keystone_admin_password: workshop
+ keystone_cinder_password: workshop
+ keystone_glance_password: workshop
+ keystone_heat_password: workshop
+ keystone_keystone_password: workshop
+ keystone_neutron_password: workshop
+ keystone_nova_password: workshop
+ keystone_designate_password: workshop
+ keystone_manila_password: workshop
+ keystone_aodh_password: workshop
+ keystone_panko_password: workshop
+ keystone_ceilometer_password: workshop
+ keystone_gnocchi_password: workshop
+ keystone_barbican_password: workshop
+ horizon_version: ${_param:openstack_version}
+ horizon_secret_key: opaesee8Que2yahJoh9fo0eefo1Aeyo6ahyei8zeiboh3aeth5loth7ieNa5xi5e
+ horizon_identity_host: ${_param:cluster_vip_address}
+ horizon_identity_encryption: ssl
+ horizon_identity_version: 2
+ ceilometer_secret_key: workshop
+ ceilometer_agent_default_polling_interval: 15
+ ceilometer_agent_default_polling_meters:
+ - "*"
+ barbican_integration_enabled: true
+ linux:
+ network:
+ purge_hosts: true
+ host:
+ prx:
+ address: ${_param:openstack_proxy_address}
+ names:
+ - prx
+ - prx.${_param:cluster_domain}
+ prx01:
+ address: ${_param:openstack_proxy_node01_address}
+ names:
+ - prx01
+ - prx01.${_param:cluster_domain}
+ ctl:
+ address: ${_param:openstack_control_address}
+ names:
+ - ctl
+ - ctl.${_param:cluster_domain}
+ ctl01:
+ address: ${_param:openstack_control_node01_address}
+ names:
+ - ctl01
+ - ctl01.${_param:cluster_domain}
+ ctl02:
+ address: ${_param:openstack_control_node02_address}
+ names:
+ - ctl02
+ - ctl02.${_param:cluster_domain}
+ ctl03:
+ address: ${_param:openstack_control_node03_address}
+ names:
+ - ctl03
+ - ctl03.${_param:cluster_domain}
+ gtw01:
+ address: ${_param:openstack_gateway_address}
+ names:
+ - gtw01
+ - gtw01.${_param:cluster_domain}
+ cmp01:
+ address: 172.16.10.105
+ names:
+ - cmp01
+ - cmp01.${_param:cluster_domain}
+ cmp02:
+ address: 172.16.10.106
+ names:
+ - cmp02
+ - cmp02.${_param:cluster_domain}
+ dns01:
+ address: ${_param:openstack_dns_node01_address}
+ names:
+ - dns01
+ - dns01.${_param:cluster_domain}
+ dns02:
+ address: ${_param:openstack_dns_node02_address}
+ names:
+ - dns02
+ - dns02.${_param:cluster_domain}
+ system:
+ user:
+ root:
+ name: root
+ password: false
diff --git a/classes/cluster/virtual-offline-ssl/openstack/proxy.yml b/classes/cluster/virtual-offline-ssl/openstack/proxy.yml
new file mode 100644
index 0000000..b1c9686
--- /dev/null
+++ b/classes/cluster/virtual-offline-ssl/openstack/proxy.yml
@@ -0,0 +1,15 @@
+classes:
+- system.nginx.server.single
+- system.nginx.server.proxy.openstack_api
+- system.nginx.server.proxy.openstack_vnc
+- system.nginx.server.proxy.openstack_web
+- system.salt.minion.cert.proxy
+- cluster.virtual-offline-ssl
+parameters:
+ _param:
+ nginx_proxy_ssl:
+ enabled: true
+ authority: ${_param:salt_minion_ca_authority}
+ engine: salt
+ mode: secure
+ salt_minion_ca_host: cfg01.${linux:system:domain}
diff --git a/classes/cluster/virtual-offline-ssl/openstack/share.yml b/classes/cluster/virtual-offline-ssl/openstack/share.yml
new file mode 100644
index 0000000..dc8eaaf
--- /dev/null
+++ b/classes/cluster/virtual-offline-ssl/openstack/share.yml
@@ -0,0 +1,20 @@
+classes:
+- system.linux.system.lowmem
+- system.linux.system.repo_local.mcp.apt_mirantis.ubuntu
+- system.linux.system.repo_local.mcp.apt_mirantis.openstack
+- system.linux.system.repo_local.mcp.extra
+- system.linux.system.repo_local.mcp.apt_mirantis.saltstack_2016_3
+- system.linux.storage.loopback_manila
+- system.manila.share
+- system.manila.share.backend.lvm
+- cluster.virtual-offline-ssl
+parameters:
+ _param:
+ manila_lvm_devices:
+ - /dev/loop0
+ loopback_device1_size: 20
+ manila:
+ common:
+ identity:
+ protocol: https
+ default_share_type: default
\ No newline at end of file
diff --git a/classes/cluster/virtual-offline-ssl/openstack/telemetry.yml b/classes/cluster/virtual-offline-ssl/openstack/telemetry.yml
new file mode 100644
index 0000000..9649872
--- /dev/null
+++ b/classes/cluster/virtual-offline-ssl/openstack/telemetry.yml
@@ -0,0 +1,160 @@
+classes:
+- system.salt.minion.cert.proxy
+- system.linux.system.repo_local.mcp.apt_mirantis.openstack
+- system.linux.system.repo_local.mcp.extra
+- system.linux.system.repo_local.mcp.apt_mirantis.saltstack_2016_3
+- system.linux.system.repo_local.mcp.apt_mirantis.glusterfs
+- system.linux.system.repo_local.mcp.apt_mirantis.ceph
+- system.memcached.server.single
+- system.apache.server.single
+- system.apache.server.site.gnocchi
+- system.apache.server.site.panko
+- system.glusterfs.server.cluster
+- system.glusterfs.client.cluster
+- system.glusterfs.client.volume.gnocchi
+- system.glusterfs.server.volume.gnocchi
+- service.redis.server.single
+- system.nginx.server.single
+- system.nginx.server.proxy.openstack.aodh
+- system.nginx.server.proxy.openstack.ceilometer
+- system.gnocchi.server.cluster
+- system.gnocchi.common.storage.incoming.redis
+- system.gnocchi.common.storage.file
+- system.gnocchi.common.coordination.redis
+- system.ceilometer.server.cluster
+- system.ceilometer.server.coordination.redis
+- system.aodh.server.cluster
+- system.aodh.server.coordination.redis
+- system.panko.server.cluster
+- system.ceilometer.server.backend.default
+- cluster.virtual-offline-ssl
+parameters:
+ _param:
+ salt_minion_ca_authority: salt_master_ca
+ keepalived_openstack_telemetry_vip_address: ${_param:openstack_telemetry_address}
+ keepalived_openstack_telemetry_vip_password: ${_param:openstack_telemetry_keepalived_password}
+ keepalived_openstack_telemetry_vip_interface: ens4
+ cluster_vip_address: ${_param:openstack_telemetry_address}
+ cluster_local_address: ${_param:single_address}
+ nginx_proxy_openstack_api_host: ${_param:openstack_telemetry_address}
+ nginx_proxy_openstack_api_address: ${_param:cluster_local_address}
+ nginx_proxy_openstack_ceilometer_host: 127.0.0.1
+ nginx_proxy_openstack_aodh_host: 127.0.0.1
+ nginx_proxy_ssl:
+ enabled: true
+ engine: salt
+ authority: "${_param:salt_minion_ca_authority}"
+ key_file: "/etc/ssl/private/internal_proxy.key"
+ cert_file: "/etc/ssl/certs/internal_proxy.crt"
+ chain_file: "/etc/ssl/certs/internal_proxy-with-chain.crt"
+ apache_gnocchi_api_address: ${_param:single_address}
+ apache_panko_api_address: ${_param:single_address}
+ apache_gnocchi_ssl: ${_param:nginx_proxy_ssl}
+ apache_panko_ssl: ${_param:nginx_proxy_ssl}
+ cluster_node01_hostname: ${_param:openstack_telemetry_node01_hostname}
+ cluster_node01_address: ${_param:openstack_telemetry_node01_address}
+ cluster_node02_hostname: ${_param:openstack_telemetry_node02_hostname}
+ cluster_node02_address: ${_param:openstack_telemetry_node02_address}
+ cluster_node03_hostname: ${_param:openstack_telemetry_node03_hostname}
+ cluster_node03_address: ${_param:openstack_telemetry_node03_address}
+ glusterfs_service_host: ${_param:openstack_telemetry_address}
+ gnocchi_glusterfs_service_host: ${_param:glusterfs_service_host}
+ redis_sentinel_node01_address: ${_param:openstack_telemetry_node01_address}
+ redis_sentinel_node02_address: ${_param:openstack_telemetry_node02_address}
+ redis_sentinel_node03_address: ${_param:openstack_telemetry_node03_address}
+ openstack_telemetry_redis_url: redis://${_param:redis_sentinel_node01_address}:26379?sentinel=master_1&sentinel_fallback=${_param:redis_sentinel_node02_address}:26379&sentinel_fallback=${_param:redis_sentinel_node03_address}:26379
+ gnocchi_coordination_url: ${_param:openstack_telemetry_redis_url}
+ gnocchi_storage_incoming_redis_url: ${_param:openstack_telemetry_redis_url}
+ glusterfs_node01_address: ${_param:cluster_node01_address}
+ glusterfs_node02_address: ${_param:cluster_node02_address}
+ glusterfs_node03_address: ${_param:cluster_node03_address}
+ linux:
+ network:
+ interface:
+ ens4:
+ enabled: true
+ type: eth
+ proto: static
+ address: ${_param:single_address}
+ netmask: 255.255.255.0
+ salt:
+ minion:
+ cert:
+ internal_proxy:
+ host: ${_param:salt_minion_ca_host}
+ authority: ${_param:salt_minion_ca_authority}
+ common_name: internal_proxy
+ signing_policy: cert_open
+ alternative_names: IP:127.0.0.1,IP:${_param:cluster_local_address},IP:${_param:openstack_telemetry_address},DNS:${linux:system:name},DNS:${linux:network:fqdn},DNS:${_param:cluster_local_address},DNS:${_param:openstack_telemetry_address}
+ key_file: "/etc/ssl/private/internal_proxy.key"
+ cert_file: "/etc/ssl/certs/internal_proxy.crt"
+ all_file: "/etc/ssl/certs/internal_proxy-with-chain.crt"
+ keepalived:
+ cluster:
+ instance:
+ VIP:
+ virtual_router_id: 160
+ redis:
+ server:
+ version: 3.0
+ bind:
+ address: ${_param:single_address}
+ cluster:
+ enabled: True
+ mode: sentinel
+ role: ${_param:redis_cluster_role}
+ quorum: 2
+ master:
+ host: ${_param:cluster_node01_address}
+ port: 6379
+ sentinel:
+ address: ${_param:single_address}
+ apache:
+ server:
+ modules:
+ - wsgi
+ gnocchi:
+ common:
+ database:
+ host: ${_param:openstack_database_address}
+ server:
+ identity:
+ protocol: https
+ pkgs:
+ # TODO: move python-memcache installation to formula
+ - gnocchi-api
+ - gnocchi-metricd
+ - python-memcache
+ panko:
+ server:
+ identity:
+ protocol: https
+ aodh:
+ server:
+ bind:
+ host: 127.0.0.1
+ coordination_backend:
+ url: ${_param:openstack_telemetry_redis_url}
+ identity:
+ protocol: https
+ host: ${_param:openstack_control_address}
+ ceilometer:
+ server:
+ bind:
+ host: 127.0.0.1
+ coordination_backend:
+ url: ${_param:openstack_telemetry_redis_url}
+ identity:
+ protocol: https
+ host: ${_param:openstack_control_address}
+ haproxy:
+ proxy:
+ listen:
+ panko_api:
+ type: ~
+ ceilometer_api:
+ type: ~
+ gnocchi_api:
+ type: ~
+ aodh-api:
+ type: ~