Merge "Update Calico to v2.6.10"
diff --git a/ceilometer/agent/telemetry/cluster.yml b/ceilometer/agent/telemetry/cluster.yml
new file mode 100644
index 0000000..bc67493
--- /dev/null
+++ b/ceilometer/agent/telemetry/cluster.yml
@@ -0,0 +1,31 @@
+classes:
+- service.ceilometer.agent.cluster.common
+parameters:
+ ceilometer:
+ agent:
+ region: ${_param:openstack_region}
+ enabled: true
+ version: ${_param:ceilometer_version}
+ secret: ${_param:ceilometer_secret_key}
+ identity:
+ engine: keystone
+ host: ${_param:keystone_service_host}
+ port: 35357
+ tenant: service
+ user: ceilometer
+ password: ${_param:keystone_ceilometer_password}
+ region: ${_param:openstack_region}
+ message_queue:
+ engine: rabbitmq
+ members:
+ - host: ${_param:openstack_message_queue_node01_address}
+ - host: ${_param:openstack_message_queue_node02_address}
+ - host: ${_param:openstack_message_queue_node03_address}
+ user: openstack
+ password: ${_param:rabbitmq_openstack_password}
+ virtual_host: '/openstack'
+ ha_queues: true
+ nova:
+ compute:
+ notification:
+ driver: messagingv2
diff --git a/ceilometer/agent/telemetry/single.yml b/ceilometer/agent/telemetry/single.yml
new file mode 100644
index 0000000..6b42537
--- /dev/null
+++ b/ceilometer/agent/telemetry/single.yml
@@ -0,0 +1,2 @@
+classes:
+- service.ceilometer.agent.single.common
diff --git a/ceilometer/server/cluster.yml b/ceilometer/server/cluster.yml
index 19336b0..f965451 100644
--- a/ceilometer/server/cluster.yml
+++ b/ceilometer/server/cluster.yml
@@ -1,3 +1,4 @@
+# This class is deprecated since Openstack Pike
classes:
- service.ceilometer.server.cluster
- service.haproxy.proxy.single
diff --git a/ceilometer/server/telemetry/cluster.yml b/ceilometer/server/telemetry/cluster.yml
new file mode 100644
index 0000000..d1c28ef
--- /dev/null
+++ b/ceilometer/server/telemetry/cluster.yml
@@ -0,0 +1,36 @@
+# This class intended to be used since Openstack Pike release
+classes:
+- service.ceilometer.server.cluster.common
+- system.keepalived.cluster.instance.openstack_telemetry_vip
+parameters:
+ ceilometer:
+ server:
+ enabled: true
+ version: ${_param:ceilometer_version}
+ region: ${_param:openstack_region}
+ cluster: true
+ secret: ${_param:ceilometer_secret_key}
+ ttl: 86400
+ notification:
+ workload_partitioning: true
+ batch_timeout: 30
+ bind:
+ host: ${_param:cluster_local_address}
+ port: 8777
+ identity:
+ engine: keystone
+ host: ${_param:openstack_control_address}
+ port: 35357
+ tenant: service
+ user: ceilometer
+ password: ${_param:keystone_ceilometer_password}
+ region: ${_param:openstack_region}
+ message_queue:
+ engine: rabbitmq
+ members:
+ - host: ${_param:openstack_message_queue_node01_address}
+ - host: ${_param:openstack_message_queue_node02_address}
+ - host: ${_param:openstack_message_queue_node03_address}
+ user: openstack
+ password: ${_param:rabbitmq_openstack_password}
+ virtual_host: '/openstack'
diff --git a/ceilometer/server/telemetry/single.yml b/ceilometer/server/telemetry/single.yml
new file mode 100644
index 0000000..7a98b73
--- /dev/null
+++ b/ceilometer/server/telemetry/single.yml
@@ -0,0 +1,2 @@
+classes:
+- service.ceilometer.server.single.common
diff --git a/jenkins/client/init.yml b/jenkins/client/init.yml
index 633288c..409b3f3 100644
--- a/jenkins/client/init.yml
+++ b/jenkins/client/init.yml
@@ -22,6 +22,7 @@
username: ${_param:jenkins_client_user}
password: ${_param:jenkins_client_password}
plugin:
+ antisamy-markup-formatter: {}
artifactory: {}
blueocean: {}
build-blocker-plugin: {}
diff --git a/jenkins/client/job/deploy/lab/deploy.yml b/jenkins/client/job/deploy/lab/deploy.yml
index a1df125..624e553 100644
--- a/jenkins/client/job/deploy/lab/deploy.yml
+++ b/jenkins/client/job/deploy/lab/deploy.yml
@@ -106,8 +106,8 @@
description: "YAML with overrides for Salt deployment"
SALT_VERSION:
type: text
- default: ""
- description: "Version of Salt which is going to be installed i.e. 'stable 2016.3' or 'stable 2017.7' etc."
+ default: "stable 2017.7"
+ description: "Version of Salt which is going to be installed i.e. 'stable 2016.3' or 'stable 2017.7' etc. Warning: This value doesn't override salt_version parameter set in the pillar."
BOOTSTRAP_EXTRA_REPO_PARAMS:
type: string
default: ""
diff --git a/linux/system/repo/glusterfs.yml b/linux/system/repo/glusterfs.yml
index 71d3cb9..d6f09da 100644
--- a/linux/system/repo/glusterfs.yml
+++ b/linux/system/repo/glusterfs.yml
@@ -2,4 +2,4 @@
- system.linux.system.repo.mcp.apt_mirantis.glusterfs
parameters:
_param:
- linux_system_repo_mcp_glusterfs_version_number: "3.8"
+ linux_system_repo_mcp_glusterfs_version_number: "3.10"
diff --git a/linux/system/repo_local/mcp/apt_mirantis/glusterfs.yml b/linux/system/repo_local/mcp/apt_mirantis/glusterfs.yml
index cb3444b..57625a3 100644
--- a/linux/system/repo_local/mcp/apt_mirantis/glusterfs.yml
+++ b/linux/system/repo_local/mcp/apt_mirantis/glusterfs.yml
@@ -1,3 +1,5 @@
+# DEPRECATED since 2018.7+ release.
+# Please use system/repo/mcp/apt_mirantis
parameters:
_param:
apt_mk_version: stable
diff --git a/linux/system/repo_local/mcp/apt_mirantis/maas.yml b/linux/system/repo_local/mcp/apt_mirantis/maas.yml
index 63f82c2..f8bc651 100644
--- a/linux/system/repo_local/mcp/apt_mirantis/maas.yml
+++ b/linux/system/repo_local/mcp/apt_mirantis/maas.yml
@@ -1,3 +1,5 @@
+# DEPRECATED since 2018.7+ release.
+# Please use system/repo/mcp/apt_mirantis
parameters:
_param:
apt_mk_version: stable
diff --git a/nova/compute/libvirt/ssl/vnc.yml b/nova/compute/libvirt/ssl/vnc.yml
new file mode 100644
index 0000000..f2c0ad4
--- /dev/null
+++ b/nova/compute/libvirt/ssl/vnc.yml
@@ -0,0 +1,12 @@
+classes:
+- system.salt.minion.cert.libvirtd.vnc_server
+parameters:
+ nova:
+ compute:
+ qemu:
+ vnc:
+ tls:
+ enabled: True
+ key_file: ${_param:qemu_vnc_server_ssl_key_file}
+ cert_file: ${_param:qemu_vnc_server_ssl_cert_file}
+ ca_file: ${_param:qemu_vnc_ssl_ca_file}
diff --git a/nova/control/novncproxy/init.yml b/nova/control/novncproxy/init.yml
new file mode 100644
index 0000000..3cd04b8
--- /dev/null
+++ b/nova/control/novncproxy/init.yml
@@ -0,0 +1,13 @@
+classes:
+- system.salt.minion.cert.vnc.novncproxy_client
+parameters:
+ nova:
+ controller:
+ novncproxy:
+ tls:
+ enabled: True
+ key_file: ${_param:novncproxy_client_ssl_key_file}
+ cert_file: ${_param:novncproxy_client_ssl_cert_file}
+ ca_file: ${_param:novncproxy_ssl_ca_file}
+ all_file: ${_param:nova_websocketproxy_ssl_all_file}
+
diff --git a/salt/master/pkg.yml b/salt/master/pkg.yml
index ac839f8..33c60d9 100644
--- a/salt/master/pkg.yml
+++ b/salt/master/pkg.yml
@@ -1,5 +1,6 @@
classes:
- system.salt.master.single
+- system.salt.master.formula.pkg.auditd
- system.salt.master.formula.pkg.ccp
- system.salt.master.formula.pkg.foundation
- system.salt.master.formula.pkg.kubernetes
@@ -9,4 +10,4 @@
- system.salt.master.formula.pkg.stacklight
- system.salt.master.formula.pkg.monitoring
- system.salt.master.formula.pkg.helm
-- system.salt.master.formula.pkg.ceph
\ No newline at end of file
+- system.salt.master.formula.pkg.ceph
diff --git a/salt/minion/ca/qemu-vnc_ca.yml b/salt/minion/ca/qemu-vnc_ca.yml
new file mode 100644
index 0000000..53778f1
--- /dev/null
+++ b/salt/minion/ca/qemu-vnc_ca.yml
@@ -0,0 +1,30 @@
+parameters:
+ _param:
+ qemu_vnc_ca_common_name: QEMU VNC CA
+ qemu_vnc_ca_country: cz
+ qemu_vnc_ca_locality: Prague
+ qemu_vnc_ca_organization: Mirantis
+ qemu_vnc_ca_days_valid_authority: 3650
+ qemu_vnc_ca_days_valid_certificate: 365
+ salt:
+ minion:
+ ca:
+ qemu_vnc_ca:
+ # We recommend using a dedicated certificate authority solely for the VNC service.
+ # This authority may be a child of the master certificate authority used for the OpenStack deployment.
+ # This is because libvirt does not currently have a mechanism to restrict what certificates can be presented by the proxy server.
+ # https://docs.openstack.org/nova/queens/admin/remote-console-access.html
+ common_name: ${_param:qemu_vnc_ca_common_name}
+ country: ${_param:qemu_vnc_ca_country}
+ locality: ${_param:qemu_vnc_ca_locality}
+ organization: ${_param:qemu_vnc_ca_organization}
+ signing_policy:
+ cert_server:
+ type: v3_edge_cert_server
+ minions: 'cmp*'
+ cert_client:
+ type: v3_edge_cert_client
+ minions: 'ctl*'
+ days_valid:
+ authority: ${_param:qemu_vnc_ca_days_valid_authority}
+ certificate: ${_param:qemu_vnc_ca_days_valid_certificate}
diff --git a/salt/minion/cert/libvirtd/vnc_server.yml b/salt/minion/cert/libvirtd/vnc_server.yml
new file mode 100644
index 0000000..c49852e
--- /dev/null
+++ b/salt/minion/cert/libvirtd/vnc_server.yml
@@ -0,0 +1,27 @@
+parameters:
+ _param:
+ qemu_vnc_server_ssl_key_file: /etc/pki/libvirt-vnc/server-key.pem
+ qemu_vnc_server_ssl_cert_file: /etc/pki/libvirt-vnc/server-cert.pem
+ qemu_vnc_ssl_ca_file: /etc/pki/libvirt-vnc/ca-cert.pem
+ salt_minion_ca_host: cfg01.${_param:cluster_domain}
+ qemu_vnc_ca_authority: qemu_vnc_ca
+ salt:
+ minion:
+ cert:
+ qemu_vnc_server:
+ host: ${_param:salt_minion_ca_host}
+ authority: ${_param:qemu_vnc_ca_authority}
+ common_name: ${linux:system:name}.${_param:cluster_domain}
+ signing_policy: cert_server
+ alternative_names: >
+ IP:${_param:cluster_local_address},
+ DNS:${_param:cluster_local_address},
+ DNS:${linux:system:name},
+ DNS:${linux:network:fqdn}
+ key_usage: "digitalSignature,nonRepudiation,keyEncipherment"
+ key_file: ${_param:qemu_vnc_server_ssl_key_file}
+ cert_file: ${_param:qemu_vnc_server_ssl_cert_file}
+ ca_file: ${_param:qemu_vnc_ssl_ca_file}
+ user: libvirt-qemu
+ group: libvirt-qemu
+ mode: 640
diff --git a/salt/minion/cert/vnc/init.yml b/salt/minion/cert/vnc/init.yml
new file mode 100644
index 0000000..6f7f6ee
--- /dev/null
+++ b/salt/minion/cert/vnc/init.yml
@@ -0,0 +1,4 @@
+parameters:
+ _param:
+ salt_minion_ca_host: cfg01.${_param:cluster_domain}
+ qemu_vnc_ca_authority: qemu_vnc_ca
diff --git a/salt/minion/cert/vnc/novncproxy_client.yml b/salt/minion/cert/vnc/novncproxy_client.yml
new file mode 100644
index 0000000..7f695eb
--- /dev/null
+++ b/salt/minion/cert/vnc/novncproxy_client.yml
@@ -0,0 +1,29 @@
+classes:
+- system.salt.minion.cert.vnc
+parameters:
+ _param:
+ novncproxy_client_ssl_key_file: /etc/pki/nova-novncproxy/client-key.pem
+ novncproxy_client_ssl_cert_file: /etc/pki/nova-novncproxy/client-cert.pem
+ novncproxy_ssl_ca_file: /etc/pki/nova-novncproxy/ca-cert.pem
+ nova_websocketproxy_ssl_all_file: /var/lib/nova/self.pem
+ salt:
+ minion:
+ cert:
+ libvirt_novnc_client:
+ host: ${_param:salt_minion_ca_host}
+ authority: ${_param:qemu_vnc_ca_authority}
+ common_name: ${linux:system:name}.${_param:cluster_domain}
+ signing_policy: cert_client
+ alternative_names: >
+ IP:${_param:cluster_local_address},
+ DNS:${_param:cluster_local_address},
+ DNS:${linux:system:name},
+ DNS:${linux:network:fqdn}
+ key_usage: "digitalSignature,nonRepudiation,keyEncipherment"
+ key_file: ${_param:novncproxy_client_ssl_key_file}
+ cert_file: ${_param:novncproxy_client_ssl_cert_file}
+ ca_file: ${_param:novncproxy_ssl_ca_file}
+ all_file: ${_param:nova_websocketproxy_ssl_all_file}
+ user: nova
+ group: nova
+ mode: 640