blob: 98bdc23ab6fba7661c9295ec13da66aecfaf5f8d [file] [log] [blame]
Vasyl Saienko060481c2018-03-23 14:29:13 +02001classes:
2- system.salt.minion.cert.proxy
Vasyl Saienkoe43865c2018-03-30 22:00:39 +03003- system.salt.minion.cert.mysql.server
4- system.salt.minion.cert.rabbitmq_server
Vasyl Saienko060481c2018-03-23 14:29:13 +02005- system.linux.system.lowmem
6- system.linux.system.repo.mcp.apt_mirantis.glusterfs
7- system.linux.system.repo.mcp.apt_mirantis.openstack
8- system.linux.system.repo.mcp.extra
9- system.linux.system.repo.mcp.apt_mirantis.saltstack_2016_3
10- system.memcached.server.single
11- system.rabbitmq.server.cluster
Vasyl Saienkoe43865c2018-03-30 22:00:39 +030012- service.rabbitmq.server.ssl
Vasyl Saienko060481c2018-03-23 14:29:13 +020013- system.rabbitmq.server.vhost.openstack
14- system.apache.server.site.manila
15- system.apache.server.site.barbican
Vasyl Saienko5883a7c2018-04-02 18:21:42 +030016- system.apache.server.site.nova-placement
17- system.apache.server.site.cinder
Vasyl Saienko060481c2018-03-23 14:29:13 +020018- system.nginx.server.single
19- system.nginx.server.proxy.openstack_api
20- system.nginx.server.proxy.openstack.designate
Vasyl Saienko060481c2018-03-23 14:29:13 +020021- system.keystone.server.wsgi
22- system.keystone.server.cluster
23- system.glusterfs.client.cluster
24- system.glusterfs.client.volume.glance
25- system.glusterfs.client.volume.keystone
26- system.glusterfs.server.volume.glance
27- system.glusterfs.server.volume.keystone
28- system.glusterfs.server.cluster
29- system.glance.control.cluster
30- system.nova.control.cluster
31- system.neutron.control.openvswitch.cluster
32- system.cinder.control.cluster
Oleksii Butenkof93170c2018-05-16 16:29:10 +030033- system.cinder.control.backend.lvm
Vasyl Saienko060481c2018-03-23 14:29:13 +020034- system.heat.server.cluster
35- system.designate.server.cluster
36- system.galera.server.cluster
Vasyl Saienkoe43865c2018-03-30 22:00:39 +030037- service.galera.ssl
Vasyl Saienko060481c2018-03-23 14:29:13 +020038- system.galera.server.database.cinder
39- system.galera.server.database.glance
40- system.galera.server.database.heat
41- system.galera.server.database.keystone
42- system.galera.server.database.nova
43- system.galera.server.database.designate
44- system.galera.server.database.manila
45- system.galera.server.database.aodh
46- system.galera.server.database.panko
47- system.galera.server.database.gnocchi
48- system.galera.server.database.barbican
49- system.dogtag.server.cluster
50- system.barbican.server.cluster
51- service.barbican.server.plugin.dogtag
52- system.ceilometer.client
53- system.ceilometer.client.cinder_volume
54- system.ceilometer.client.neutron
Vasyl Saienko060481c2018-03-23 14:29:13 +020055- system.haproxy.proxy.listen.openstack.placement
56- system.haproxy.proxy.listen.openstack.manila
57- system.manila.control.cluster
58- cluster.virtual-mcp-pike-dvr-ssl-barbican
59parameters:
60 _param:
61 keepalived_vip_interface: ens4
62 salt_minion_ca_authority: salt_master_ca
63 ### nginx ssl sites settings
64 nginx_proxy_ssl:
65 enabled: true
66 engine: salt
67 authority: "${_param:salt_minion_ca_authority}"
68 key_file: "/etc/ssl/private/internal_proxy.key"
69 cert_file: "/etc/ssl/certs/internal_proxy.crt"
70 chain_file: "/etc/ssl/certs/internal_proxy-with-chain.crt"
71 nginx_proxy_openstack_api_address: ${_param:cluster_local_address}
72 nginx_proxy_openstack_keystone_host: 127.0.0.1
73 nginx_proxy_openstack_nova_host: 127.0.0.1
Vasyl Saienko060481c2018-03-23 14:29:13 +020074 nginx_proxy_openstack_glance_host: 127.0.0.1
75 nginx_proxy_openstack_neutron_host: 127.0.0.1
76 nginx_proxy_openstack_heat_host: 127.0.0.1
77 nginx_proxy_openstack_designate_host: 127.0.0.1
Vasyl Saienko060481c2018-03-23 14:29:13 +020078 apache_manila_api_address: ${_param:single_address}
79 apache_manila_ssl: ${_param:nginx_proxy_ssl}
80 apache_keystone_api_host: ${_param:single_address}
81 apache_keystone_ssl: ${_param:nginx_proxy_ssl}
82 apache_barbican_api_address: ${_param:cluster_local_address}
83 apache_barbican_api_host: ${_param:single_address}
84 apache_barbican_ssl: ${_param:nginx_proxy_ssl}
Vasyl Saienko5883a7c2018-04-02 18:21:42 +030085 apache_nova_placement_api_address: ${_param:cluster_local_address}
86 apache_nova_placement_ssl: ${_param:nginx_proxy_ssl}
Vasyl Saienko060481c2018-03-23 14:29:13 +020087 barbican_dogtag_nss_password: workshop
88 barbican_dogtag_host: ${_param:cluster_vip_address}
Vasyl Saienko5883a7c2018-04-02 18:21:42 +030089 apache_cinder_api_address: ${_param:cluster_local_address}
90 apache_cinder_ssl: ${_param:nginx_proxy_ssl}
Vasyl Saienko060481c2018-03-23 14:29:13 +020091 # dogtag listens on 8443 but there is no way to bind it to
92 # Specific IP, as on this setup dogtag installed on ctl nodes
93 # Change port on haproxy side to avoid binding conflict.
94 haproxy_dogtag_bind_port: 8444
95 cluster_dogtag_port: 8443
96 dogtag_master_host: ctl01.${linux:system:domain}
97 dogtag_pki_admin_password: workshop
98 dogtag_pki_client_database_password: workshop
99 dogtag_pki_client_pkcs12_password: workshop
100 dogtag_pki_ds_password: workshop
101 dogtag_pki_token_password: workshop
102 dogtag_pki_security_domain_password: workshop
103 dogtag_pki_clone_pkcs12_password: workshop
Vasyl Saienkoe43865c2018-03-30 22:00:39 +0300104 rabbitmq:
105 server:
106 ssl:
107 enabled: ${_param:rabbitmq_ssl_enabled}
Vasyl Saienko060481c2018-03-23 14:29:13 +0200108 nginx:
109 server:
110 site:
111 nginx_proxy_openstack_api_keystone:
112 enabled: false
113 nginx_proxy_openstack_api_keystone_private:
114 enabled: false
Vasyl Saienko5883a7c2018-04-02 18:21:42 +0300115 nginx_proxy_openstack_api_cinder:
116 enabled: false
Vasyl Saienko060481c2018-03-23 14:29:13 +0200117 linux:
118 system:
119 package:
120 python-msgpack:
121 version: latest
122 network:
123 interface:
124 ens4:
125 enabled: true
126 type: eth
127 proto: static
128 address: ${_param:single_address}
129 netmask: 255.255.255.0
130 keepalived:
131 cluster:
132 instance:
133 VIP:
134 virtual_router_id: 150
135 dogtag:
136 server:
137 ldap_hostname: ${linux:network:fqdn}
138 ldap_dn_password: workshop
139 ldap_admin_password: workshop
140 export_pem_file_path: /etc/dogtag/kra_admin_cert.pem
141 # TODO drop this once reclass bumped, missing part in current version
142 apache:
143 server:
144 site:
145 barbican_admin:
146 host:
147 address: ${_param:apache_barbican_api_address}
148 name: ${_param:apache_barbican_api_host}
149 port: 9312
150 log:
151 custom:
152 format: 'combined'
153 file: '/var/log/barbican/barbican-api.log'
154 error:
155 enabled: true
156 file: '/var/log/barbican/barbican-api.log'
157 barbican:
158 server:
159 enabled: true
160 dogtag_admin_cert:
161 engine: mine
162 minion: ${_param:dogtag_master_host}
163 ks_notifications_enable: True
164 store:
165 software:
166 store_plugin: dogtag_crypto
167 global_default: True
168 plugin:
169 dogtag:
170 port: ${_param:haproxy_dogtag_bind_port}
Vasyl Saienkoe43865c2018-03-30 22:00:39 +0300171 database:
172 ssl:
173 enabled: ${_param:galera_ssl_enabled}
174 message_queue:
175 port: ${_param:rabbitmq_port}
176 ssl:
177 enabled: ${_param:rabbitmq_ssl_enabled}
Vasyl Saienko060481c2018-03-23 14:29:13 +0200178 keystone:
179 server:
180 admin_email: ${_param:admin_email}
Vasyl Saienkoe43865c2018-03-30 22:00:39 +0300181 database:
182 ssl:
183 enabled: ${_param:galera_ssl_enabled}
184 message_queue:
185 port: ${_param:rabbitmq_port}
186 ssl:
187 enabled: ${_param:rabbitmq_ssl_enabled}
Vasyl Saienko060481c2018-03-23 14:29:13 +0200188 designate:
189 pool_manager:
190 enabled: ${_param:designate_pool_manager_enabled}
191 periodic_sync_interval: ${_param:designate_pool_manager_periodic_sync_interval}
192 server:
193 identity:
194 protocol: https
195 bind:
196 api:
197 address: 127.0.0.1
Vasyl Saienkoe43865c2018-03-30 22:00:39 +0300198 database:
199 ssl:
200 enabled: ${_param:galera_ssl_enabled}
201 message_queue:
202 port: ${_param:rabbitmq_port}
203 ssl:
204 enabled: ${_param:rabbitmq_ssl_enabled}
Vasyl Saienko060481c2018-03-23 14:29:13 +0200205 backend:
206 pdns4:
207 api_token: ${_param:designate_pdns_api_key}
208 api_endpoint: ${_param:designate_pdns_api_endpoint}
209 mdns:
210 address: ${_param:designate_mdns_address}
211 port: ${_param:designate_mdns_port}
212 pools:
213 default:
214 description: 'test pool'
215 targets:
216 default:
217 description: 'test target1'
218 default1:
219 type: ${_param:designate_pool_target_type}
220 description: 'test target2'
221 masters: ${_param:designate_pool_target_masters}
222 options:
223 host: ${_param:openstack_dns_node02_address}
224 port: 53
225 api_endpoint: "http://${_param:openstack_dns_node02_address}:${_param:powerdns_webserver_port}"
226 api_token: ${_param:designate_pdns_api_key}
227 quota:
228 zones: ${_param:designate_quota_zones}
229 glance:
230 server:
231 barbican:
232 enabled: ${_param:barbican_integration_enabled}
233 storage:
234 engine: file
235 images: []
236 workers: 1
237 bind:
238 address: 127.0.0.1
239 identity:
240 protocol: https
241 registry:
242 protocol: https
Vasyl Saienkoe43865c2018-03-30 22:00:39 +0300243 database:
244 ssl:
245 enabled: ${_param:galera_ssl_enabled}
246 message_queue:
247 port: ${_param:rabbitmq_port}
248 ssl:
249 enabled: ${_param:rabbitmq_ssl_enabled}
Vasyl Saienko060481c2018-03-23 14:29:13 +0200250 heat:
251 server:
252 bind:
253 api:
254 address: 127.0.0.1
255 api_cfn:
256 address: 127.0.0.1
257 api_cloudwatch:
258 address: 127.0.0.1
259 identity:
260 protocol: https
Vasyl Saienkoe43865c2018-03-30 22:00:39 +0300261 database:
262 ssl:
263 enabled: ${_param:galera_ssl_enabled}
264 message_queue:
265 port: ${_param:rabbitmq_port}
266 ssl:
267 enabled: ${_param:rabbitmq_ssl_enabled}
Vasyl Saienko060481c2018-03-23 14:29:13 +0200268 neutron:
269 server:
270 bind:
271 address: 127.0.0.1
272 identity:
273 protocol: https
Vasyl Saienkoe43865c2018-03-30 22:00:39 +0300274 database:
275 ssl:
276 enabled: ${_param:galera_ssl_enabled}
277 message_queue:
278 port: ${_param:rabbitmq_port}
279 ssl:
280 enabled: ${_param:rabbitmq_ssl_enabled}
Vasyl Saienko060481c2018-03-23 14:29:13 +0200281 nova:
282 controller:
283 networking: dvr
284 cpu_allocation: 54
285 barbican:
286 enabled: ${_param:barbican_integration_enabled}
287 metadata:
288 password: ${_param:metadata_password}
Oleksii Butenko0c6a75b2018-04-03 20:33:37 +0300289 bind:
290 address: ${_param:cluster_local_address}
Vasyl Saienko060481c2018-03-23 14:29:13 +0200291 bind:
292 public_address: ${_param:cluster_vip_address}
293 novncproxy_port: 6080
294 private_address: 127.0.0.1
295 identity:
296 protocol: https
297 network:
298 protocol: https
299 glance:
300 protocol: https
301 vncproxy_url: http://${_param:cluster_vip_address}:6080
302 workers: 1
Vasyl Saienkoe43865c2018-03-30 22:00:39 +0300303 database:
304 ssl:
305 enabled: ${_param:galera_ssl_enabled}
306 message_queue:
307 port: ${_param:rabbitmq_port}
308 ssl:
309 enabled: ${_param:rabbitmq_ssl_enabled}
Mykyta Karpin6b2ed052018-04-20 13:42:57 +0300310 notification:
311 notify_on:
312 state_change: vm_and_task_state
Vasyl Saienko060481c2018-03-23 14:29:13 +0200313 cinder:
314 controller:
315 controller:
316 barbican:
317 enabled: ${_param:barbican_integration_enabled}
318 identity:
319 protocol: https
320 osapi:
321 host: 127.0.0.1
322 glance:
323 protocol: https
Vasyl Saienkoe43865c2018-03-30 22:00:39 +0300324 database:
325 ssl:
326 enabled: ${_param:galera_ssl_enabled}
327 message_queue:
328 port: ${_param:rabbitmq_port}
329 ssl:
330 enabled: ${_param:rabbitmq_ssl_enabled}
Vasyl Saienko060481c2018-03-23 14:29:13 +0200331 manila:
332 common:
333 identity:
334 protocol: https
Vasyl Saienko827d29d2018-03-29 13:13:27 +0300335 default_share_type: default
Vasyl Saienkoe43865c2018-03-30 22:00:39 +0300336 database:
337 ssl:
338 enabled: ${_param:galera_ssl_enabled}
339 message_queue:
340 port: ${_param:rabbitmq_port}
341 ssl:
342 enabled: ${_param:rabbitmq_ssl_enabled}
Vasyl Saienko060481c2018-03-23 14:29:13 +0200343 salt:
344 minion:
345 cert:
346 internal_proxy:
347 host: ${_param:salt_minion_ca_host}
348 authority: ${_param:salt_minion_ca_authority}
349 common_name: internal_proxy
350 signing_policy: cert_open
351 alternative_names: IP:127.0.0.1,IP:${_param:cluster_local_address},IP:${_param:cluster_public_host},DNS:${linux:system:name},DNS:${linux:network:fqdn},DNS:${_param:cluster_local_address},DNS:${_param:cluster_public_host}
352 key_file: "/etc/ssl/private/internal_proxy.key"
353 cert_file: "/etc/ssl/certs/internal_proxy.crt"
354 all_file: "/etc/ssl/certs/internal_proxy-with-chain.crt"
355 haproxy:
356 proxy:
357 listen:
358 barbican-api:
359 type: ~
360 barbican-admin-api:
361 type: ~
362 designate_api:
363 type: ~
364 keystone_public_api:
365 type: ~
366 keystone_admin_api:
367 type: ~
368 manila_api:
369 type: ~
370 nova_api:
371 type: ~
372 nova_metadata_api:
373 type: ~
374 cinder_api:
375 type: ~
376 glance_api:
377 type: ~
378 glance_registry_api:
379 type: ~
380 heat_cloudwatch_api:
381 type: ~
382 heat_api:
383 type: ~
384 heat_cfn_api:
385 type: ~
386 neutron_api:
387 type: ~
388 placement_api:
389 type: ~