# # Top-level variables # # There must not be any whitespace between this comment and the variables or # in between any two variables in order for them to be correctly parsed and # passed around in test.sh # $elasticsearch_nodes = hiera_array('elasticsearch_nodes') # # Default: should at least behave like an openstack server # node default { class { 'openstack_project::server': sysadmins => hiera('sysadmins', []), } } # # Long lived servers: # # Node-OS: trusty node 'review.openstack.org' { $iptables_rules = ['-p tcp --syn --dport 29418 -m connlimit --connlimit-above 100 -j REJECT'] class { 'openstack_project::server': iptables_public_tcp_ports => [80, 443, 29418], iptables_rules6 => $iptables_rules, iptables_rules4 => $iptables_rules, sysadmins => hiera('sysadmins', []), extra_aliases => { 'gerrit2' => 'root' }, } class { 'openstack_project::review': project_config_repo => 'https://git.openstack.org/openstack-infra/project-config', github_oauth_token => hiera('gerrit_github_token'), github_project_username => hiera('github_project_username', 'username'), github_project_password => hiera('github_project_password'), mysql_host => hiera('gerrit_mysql_host', 'localhost'), mysql_password => hiera('gerrit_mysql_password'), email_private_key => hiera('gerrit_email_private_key'), token_private_key => hiera('gerrit_rest_token_private_key'), gerritbot_password => hiera('gerrit_gerritbot_password'), gerritbot_ssh_rsa_key_contents => hiera('gerritbot_ssh_rsa_key_contents'), gerritbot_ssh_rsa_pubkey_contents => hiera('gerritbot_ssh_rsa_pubkey_contents'), ssl_cert_file_contents => hiera('gerrit_ssl_cert_file_contents'), ssl_key_file_contents => hiera('gerrit_ssl_key_file_contents'), ssl_chain_file_contents => hiera('gerrit_ssl_chain_file_contents'), ssh_dsa_key_contents => hiera('gerrit_ssh_dsa_key_contents'), ssh_dsa_pubkey_contents => hiera('gerrit_ssh_dsa_pubkey_contents'), ssh_rsa_key_contents => hiera('gerrit_ssh_rsa_key_contents'), ssh_rsa_pubkey_contents => hiera('gerrit_ssh_rsa_pubkey_contents'), ssh_project_rsa_key_contents => hiera('gerrit_project_ssh_rsa_key_contents'), ssh_project_rsa_pubkey_contents => hiera('gerrit_project_ssh_rsa_pubkey_contents'), ssh_welcome_rsa_key_contents => hiera('welcome_message_gerrit_ssh_private_key'), ssh_welcome_rsa_pubkey_contents => hiera('welcome_message_gerrit_ssh_public_key'), ssh_replication_rsa_key_contents => hiera('gerrit_replication_ssh_rsa_key_contents'), ssh_replication_rsa_pubkey_contents => hiera('gerrit_replication_ssh_rsa_pubkey_contents'), lp_access_token => hiera('gerrit_lp_access_token'), lp_access_secret => hiera('gerrit_lp_access_secret'), lp_consumer_key => hiera('gerrit_lp_consumer_key'), swift_username => hiera('swift_store_user', 'username'), swift_password => hiera('swift_store_key'), storyboard_password => hiera('gerrit_storyboard_token'), } } # Node-OS: xenial node 'review01.openstack.org' { $iptables_rules = ['-p tcp --syn --dport 29418 -m connlimit --connlimit-above 100 -j REJECT'] class { 'openstack_project::server': iptables_public_tcp_ports => [80, 443, 29418], iptables_rules6 => $iptables_rules, iptables_rules4 => $iptables_rules, sysadmins => hiera('sysadmins', []), extra_aliases => { 'gerrit2' => 'root' }, } class { 'openstack_project::review': gerrit_configure => false, project_config_repo => 'https://git.openstack.org/openstack-infra/project-config', github_oauth_token => hiera('gerrit_github_token'), github_project_username => hiera('github_project_username', 'username'), github_project_password => hiera('github_project_password'), mysql_host => hiera('gerrit_mysql_host', 'localhost'), mysql_password => hiera('gerrit_mysql_password'), email_private_key => hiera('gerrit_email_private_key'), token_private_key => hiera('gerrit_rest_token_private_key'), gerritbot_password => hiera('gerrit_gerritbot_password'), gerritbot_ssh_rsa_key_contents => hiera('gerritbot_ssh_rsa_key_contents'), gerritbot_ssh_rsa_pubkey_contents => hiera('gerritbot_ssh_rsa_pubkey_contents'), ssl_cert_file_contents => hiera('gerrit_ssl_cert_file_contents'), ssl_key_file_contents => hiera('gerrit_ssl_key_file_contents'), ssl_chain_file_contents => hiera('gerrit_ssl_chain_file_contents'), ssh_dsa_key_contents => hiera('gerrit_ssh_dsa_key_contents'), ssh_dsa_pubkey_contents => hiera('gerrit_ssh_dsa_pubkey_contents'), ssh_rsa_key_contents => hiera('gerrit_ssh_rsa_key_contents'), ssh_rsa_pubkey_contents => hiera('gerrit_ssh_rsa_pubkey_contents'), ssh_project_rsa_key_contents => hiera('gerrit_project_ssh_rsa_key_contents'), ssh_project_rsa_pubkey_contents => hiera('gerrit_project_ssh_rsa_pubkey_contents'), ssh_welcome_rsa_key_contents => hiera('welcome_message_gerrit_ssh_private_key'), ssh_welcome_rsa_pubkey_contents => hiera('welcome_message_gerrit_ssh_public_key'), ssh_replication_rsa_key_contents => hiera('gerrit_replication_ssh_rsa_key_contents'), ssh_replication_rsa_pubkey_contents => hiera('gerrit_replication_ssh_rsa_pubkey_contents'), lp_access_token => hiera('gerrit_lp_access_token'), lp_access_secret => hiera('gerrit_lp_access_secret'), lp_consumer_key => hiera('gerrit_lp_consumer_key'), swift_username => hiera('swift_store_user', 'username'), swift_password => hiera('swift_store_key'), storyboard_password => hiera('gerrit_storyboard_token'), } } # Node-OS: xenial node /^review-dev\d*\.openstack\.org$/ { $group = "review-dev" $iptables_rules = ['-p tcp --syn --dport 29418 -m connlimit --connlimit-above 100 -j REJECT'] class { 'openstack_project::server': iptables_public_tcp_ports => [80, 443, 29418], iptables_rules6 => $iptables_rules, iptables_rules4 => $iptables_rules, sysadmins => hiera('sysadmins', []), extra_aliases => { 'gerrit2' => 'root' }, afs => true, } class { 'openstack_project::review_dev': project_config_repo => 'https://git.openstack.org/openstack-infra/project-config', github_oauth_token => hiera('gerrit_dev_github_token'), github_project_username => hiera('github_dev_project_username', 'username'), github_project_password => hiera('github_dev_project_password'), mysql_host => hiera('gerrit_dev_mysql_host', 'localhost'), mysql_password => hiera('gerrit_dev_mysql_password'), email_private_key => hiera('gerrit_dev_email_private_key'), ssh_dsa_key_contents => hiera('gerrit_dev_ssh_dsa_key_contents'), ssh_dsa_pubkey_contents => hiera('gerrit_dev_ssh_dsa_pubkey_contents'), ssh_rsa_key_contents => hiera('gerrit_dev_ssh_rsa_key_contents'), ssh_rsa_pubkey_contents => hiera('gerrit_dev_ssh_rsa_pubkey_contents'), ssh_project_rsa_key_contents => hiera('gerrit_dev_project_ssh_rsa_key_contents'), ssh_project_rsa_pubkey_contents => hiera('gerrit_dev_project_ssh_rsa_pubkey_contents'), ssh_replication_rsa_key_contents => hiera('gerrit_dev_replication_ssh_rsa_key_contents'), ssh_replication_rsa_pubkey_contents => hiera('gerrit_dev_replication_ssh_rsa_pubkey_contents'), lp_access_token => hiera('gerrit_dev_lp_access_token'), lp_access_secret => hiera('gerrit_dev_lp_access_secret'), lp_consumer_key => hiera('gerrit_dev_lp_consumer_key'), storyboard_password => hiera('gerrit_dev_storyboard_token'), storyboard_ssl_cert => hiera('gerrit_dev_storyboard_ssl_crt'), } } # Node-OS: trusty # Node-OS: xenial node /^grafana\d*\.openstack\.org$/ { $group = "grafana" class { 'openstack_project::server': iptables_public_tcp_ports => [80], sysadmins => hiera('sysadmins', []), } class { 'openstack_project::grafana': admin_password => hiera('grafana_admin_password'), admin_user => hiera('grafana_admin_user', 'username'), mysql_host => hiera('grafana_mysql_host', 'localhost'), mysql_name => hiera('grafana_mysql_name'), mysql_password => hiera('grafana_mysql_password'), mysql_user => hiera('grafana_mysql_user', 'username'), project_config_repo => 'https://git.openstack.org/openstack-infra/project-config', secret_key => hiera('grafana_secret_key'), } } # Node-OS: trusty # Node-OS: xenial node /^health\d*\.openstack\.org$/ { class { 'openstack_project::server': iptables_public_tcp_ports => [80, 443], sysadmins => hiera('sysadmins', []), } class { 'openstack_project::openstack_health_api': subunit2sql_db_host => hiera('subunit2sql_db_host', 'localhost'), } } # Node-OS: trusty # Node-OS: xenial node /^stackalytics\d*\.openstack\.org$/ { class { 'openstack_project::server': iptables_public_tcp_ports => [80], sysadmins => hiera('sysadmins', []), } class { 'openstack_project::stackalytics': gerrit_ssh_user => hiera('stackalytics_gerrit_ssh_user'), stackalytics_ssh_private_key => hiera('stackalytics_ssh_private_key_contents'), } } # Node-OS: xenial node /^cacti\d+\.openstack\.org$/ { $group = "cacti" include openstack_project::ssl_cert_check class { 'openstack_project::cacti': sysadmins => hiera('sysadmins', []), cacti_hosts => hiera_array('cacti_hosts'), vhost_name => 'cacti.openstack.org', } } # Node-OS: trusty node 'puppetmaster.openstack.org' { class { 'openstack_project::server': iptables_public_tcp_ports => [8140], sysadmins => hiera('sysadmins', []), pin_puppet => '3.6.', } class { 'openstack_project::puppetmaster': root_rsa_key => hiera('puppetmaster_root_rsa_key'), puppetmaster_clouds => hiera('puppetmaster_clouds'), enable_mqtt => true, mqtt_password => hiera('mqtt_service_user_password'), mqtt_ca_cert_contents => hiera('mosquitto_tls_ca_file'), } file { '/etc/openstack/infracloud_vanilla_cacert.pem': ensure => present, owner => 'root', group => 'root', mode => '0444', content => hiera('infracloud_vanilla_ssl_cert_file_contents'), require => Class['::openstack_project::puppetmaster'], } file { '/etc/openstack/infracloud_chocolate_cacert.pem': ensure => present, owner => 'root', group => 'root', mode => '0444', content => hiera('infracloud_chocolate_ssl_cert_file_contents'), require => Class['::openstack_project::puppetmaster'], } file { '/etc/openstack/limestone_cacert.pem': ensure => present, owner => 'root', group => 'root', mode => '0444', content => hiera('limestone_ssl_cert_file_contents'), require => Class['::openstack_project::puppetmaster'], } } # Node-OS: trusty # Node-OS: xenial node /^graphite\d*\.openstack\.org$/ { class { 'openstack_project::server': iptables_public_tcp_ports => [80, 443], iptables_allowed_hosts => [ {protocol => 'udp', port => '8125', hostname => 'git.openstack.org'}, {protocol => 'udp', port => '8125', hostname => 'firehose01.openstack.org'}, {protocol => 'udp', port => '8125', hostname => 'logstash.openstack.org'}, {protocol => 'udp', port => '8125', hostname => 'nodepool.openstack.org'}, {protocol => 'udp', port => '8125', hostname => 'nl01.openstack.org'}, {protocol => 'udp', port => '8125', hostname => 'nl02.openstack.org'}, {protocol => 'udp', port => '8125', hostname => 'nl03.openstack.org'}, {protocol => 'udp', port => '8125', hostname => 'nl04.openstack.org'}, {protocol => 'udp', port => '8125', hostname => 'zuul01.openstack.org'}, {protocol => 'udp', port => '8125', hostname => 'zm01.openstack.org'}, {protocol => 'udp', port => '8125', hostname => 'zm02.openstack.org'}, {protocol => 'udp', port => '8125', hostname => 'zm03.openstack.org'}, {protocol => 'udp', port => '8125', hostname => 'zm04.openstack.org'}, {protocol => 'udp', port => '8125', hostname => 'zm05.openstack.org'}, {protocol => 'udp', port => '8125', hostname => 'zm06.openstack.org'}, {protocol => 'udp', port => '8125', hostname => 'zm07.openstack.org'}, {protocol => 'udp', port => '8125', hostname => 'zm08.openstack.org'}, {protocol => 'udp', port => '8125', hostname => 'ze01.openstack.org'}, {protocol => 'udp', port => '8125', hostname => 'ze02.openstack.org'}, {protocol => 'udp', port => '8125', hostname => 'ze03.openstack.org'}, {protocol => 'udp', port => '8125', hostname => 'ze04.openstack.org'}, {protocol => 'udp', port => '8125', hostname => 'ze05.openstack.org'}, {protocol => 'udp', port => '8125', hostname => 'ze06.openstack.org'}, {protocol => 'udp', port => '8125', hostname => 'ze07.openstack.org'}, {protocol => 'udp', port => '8125', hostname => 'ze08.openstack.org'}, {protocol => 'udp', port => '8125', hostname => 'ze09.openstack.org'}, {protocol => 'udp', port => '8125', hostname => 'ze10.openstack.org'}, ], sysadmins => hiera('sysadmins', []) } class { '::graphite': graphite_admin_user => hiera('graphite_admin_user', 'username'), graphite_admin_email => hiera('graphite_admin_email', 'email@example.com'), graphite_admin_password => hiera('graphite_admin_password'), } } # Node-OS: trusty # Node-OS: xenial node /^groups\d*\.openstack\.org$/ { class { 'openstack_project::server': iptables_public_tcp_ports => [22, 80, 443], sysadmins => hiera('sysadmins', []), } class { 'openstack_project::groups': site_admin_password => hiera('groups_site_admin_password'), site_mysql_host => hiera('groups_site_mysql_host', 'localhost'), site_mysql_password => hiera('groups_site_mysql_password'), conf_cron_key => hiera('groups_conf_cron_key'), site_ssl_cert_file_contents => hiera('groups_site_ssl_cert_file_contents', undef), site_ssl_key_file_contents => hiera('groups_site_ssl_key_file_contents', undef), site_ssl_chain_file_contents => hiera('groups_site_ssl_chain_file_contents', undef), } } # Node-OS: trusty # Node-OS: xenial node /^groups-dev\d*\.openstack\.org$/ { class { 'openstack_project::server': iptables_public_tcp_ports => [22, 80, 443], sysadmins => hiera('sysadmins', []), } class { 'openstack_project::groups_dev': site_admin_password => hiera('groups_dev_site_admin_password'), site_mysql_host => hiera('groups_dev_site_mysql_host', 'localhost'), site_mysql_password => hiera('groups_dev_site_mysql_password'), conf_cron_key => hiera('groups_dev_conf_cron_key'), site_ssl_cert_file_contents => hiera('groups_dev_site_ssl_cert_file_contents', undef), site_ssl_key_file_contents => hiera('groups_dev_site_ssl_key_file_contents', undef), site_ssl_cert_file => '/etc/ssl/certs/groups-dev.openstack.org.pem', site_ssl_key_file => '/etc/ssl/private/groups-dev.openstack.org.key', } } # Node-OS: trusty # Node-OS: xenial node /^lists\d*\.openstack\.org$/ { class { 'openstack_project::server': iptables_public_tcp_ports => [25, 80, 465], manage_exim => false, purge_apt_sources => false, } class { 'openstack_project::lists': listadmins => hiera('listadmins', []), listpassword => hiera('listpassword'), } } # Node-OS: trusty # Node-OS: xenial node /^lists\d*\.katacontainers\.io$/ { class { 'openstack_project::server': iptables_public_tcp_ports => [25, 80, 465], manage_exim => false, purge_apt_sources => false, } class { 'openstack_project::kata_lists': listadmins => hiera('listadmins', []), listpassword => hiera('listpassword'), } } # Node-OS: trusty # Node-OS: xenial node /^paste\d*\.openstack\.org$/ { $group = "paste" class { 'openstack_project::server': iptables_public_tcp_ports => [80], sysadmins => hiera('sysadmins', []), } class { 'openstack_project::paste': db_password => hiera('paste_db_password'), db_host => hiera('paste_db_host'), vhost_name => 'paste.openstack.org', } } # Node-OS: trusty # Node-OS: xenial node /planet\d*\.openstack\.org$/ { class { 'openstack_project::planet': sysadmins => hiera('sysadmins', []), } } # Node-OS: trusty # Node-OS: xenial node /^eavesdrop\d*\.openstack\.org$/ { $group = "eavesdrop" class { 'openstack_project::server': iptables_public_tcp_ports => [80], sysadmins => hiera('sysadmins', []), } class { 'openstack_project::eavesdrop': project_config_repo => 'https://git.openstack.org/openstack-infra/project-config', nickpass => hiera('openstack_meetbot_password'), statusbot_nick => hiera('statusbot_nick', 'username'), statusbot_password => hiera('statusbot_nick_password'), statusbot_server => 'chat.freenode.net', statusbot_channels => hiera_array('statusbot_channels', ['openstack_infra']), statusbot_auth_nicks => hiera_array('statusbot_auth_nicks'), statusbot_wiki_user => hiera('statusbot_wiki_username', 'username'), statusbot_wiki_password => hiera('statusbot_wiki_password'), statusbot_wiki_url => 'https://wiki.openstack.org/w/api.php', # https://wiki.openstack.org/wiki/Infrastructure_Status statusbot_wiki_pageid => '1781', statusbot_wiki_successpageid => '7717', statusbot_wiki_successpageurl => 'https://wiki.openstack.org/wiki/Successes', statusbot_wiki_thankspageid => '37700', statusbot_wiki_thankspageurl => 'https://wiki.openstack.org/wiki/Thanks', statusbot_irclogs_url => 'http://eavesdrop.openstack.org/irclogs/%(chan)s/%(chan)s.%(date)s.log.html', statusbot_twitter => true, statusbot_twitter_key => hiera('statusbot_twitter_key'), statusbot_twitter_secret => hiera('statusbot_twitter_secret'), statusbot_twitter_token_key => hiera('statusbot_twitter_token_key'), statusbot_twitter_token_secret => hiera('statusbot_twitter_token_secret'), accessbot_nick => hiera('accessbot_nick', 'username'), accessbot_password => hiera('accessbot_nick_password'), meetbot_channels => hiera('meetbot_channels', ['openstack-infra']), ptgbot_nick => hiera('ptgbot_nick', 'username'), ptgbot_password => hiera('ptgbot_password'), } } # Node-OS: trusty # Node-OS: xenial node /^ethercalc\d+\.openstack\.org$/ { $group = "ethercalc" class { 'openstack_project::server': iptables_public_tcp_ports => [22, 80, 443], sysadmins => hiera('sysadmins', []), } class { 'openstack_project::ethercalc': vhost_name => 'ethercalc.openstack.org', ssl_cert_file_contents => hiera('ssl_cert_file_contents'), ssl_key_file_contents => hiera('ssl_key_file_contents'), ssl_chain_file_contents => hiera('ssl_chain_file_contents'), } } # Node-OS: trusty # Node-OS: xenial node /^etherpad\d*\.openstack\.org$/ { class { 'openstack_project::server': iptables_public_tcp_ports => [22, 80, 443], sysadmins => hiera('sysadmins', []), } class { 'openstack_project::etherpad': ssl_cert_file_contents => hiera('etherpad_ssl_cert_file_contents'), ssl_key_file_contents => hiera('etherpad_ssl_key_file_contents'), ssl_chain_file_contents => hiera('etherpad_ssl_chain_file_contents'), mysql_host => hiera('etherpad_db_host', 'localhost'), mysql_user => hiera('etherpad_db_user', 'username'), mysql_password => hiera('etherpad_db_password'), } } # Node-OS: trusty # Node-OS: xenial node /^etherpad-dev\d*\.openstack\.org$/ { class { 'openstack_project::server': iptables_public_tcp_ports => [22, 80, 443], sysadmins => hiera('sysadmins', []), } class { 'openstack_project::etherpad_dev': mysql_host => hiera('etherpad-dev_db_host', 'localhost'), mysql_user => hiera('etherpad-dev_db_user', 'username'), mysql_password => hiera('etherpad-dev_db_password'), } } # Node-OS: trusty node /^wiki\d+\.openstack\.org$/ { $group = "wiki" class { 'openstack_project::wiki': sysadmins => hiera('sysadmins', []), bup_user => 'bup-wiki', serveradmin => hiera('infra_apache_serveradmin'), site_hostname => 'wiki.openstack.org', ssl_cert_file_contents => hiera('ssl_cert_file_contents'), ssl_key_file_contents => hiera('ssl_key_file_contents'), ssl_chain_file_contents => hiera('ssl_chain_file_contents'), wg_dbserver => hiera('wg_dbserver'), wg_dbname => 'openstack_wiki', wg_dbuser => 'wikiuser', wg_dbpassword => hiera('wg_dbpassword'), wg_secretkey => hiera('wg_secretkey'), wg_upgradekey => hiera('wg_upgradekey'), wg_recaptchasitekey => hiera('wg_recaptchasitekey'), wg_recaptchasecretkey => hiera('wg_recaptchasecretkey'), wg_googleanalyticsaccount => hiera('wg_googleanalyticsaccount'), } } # Node-OS: trusty node /^wiki-dev\d+\.openstack\.org$/ { $group = "wiki-dev" class { 'openstack_project::wiki': sysadmins => hiera('sysadmins', []), serveradmin => hiera('infra_apache_serveradmin'), site_hostname => 'wiki-dev.openstack.org', wg_dbserver => hiera('wg_dbserver'), wg_dbname => 'openstack_wiki', wg_dbuser => 'wikiuser', wg_dbpassword => hiera('wg_dbpassword'), wg_secretkey => hiera('wg_secretkey'), wg_upgradekey => hiera('wg_upgradekey'), wg_recaptchasitekey => hiera('wg_recaptchasitekey'), wg_recaptchasecretkey => hiera('wg_recaptchasecretkey'), disallow_robots => true, } } # Node-OS: trusty # Node-OS: xenial node /^logstash\d*\.openstack\.org$/ { class { 'openstack_project::server': iptables_public_tcp_ports => [22, 80, 3306], iptables_allowed_hosts => hiera_array('logstash_iptables_rule_data'), sysadmins => hiera('sysadmins', []), } class { 'openstack_project::logstash': discover_nodes => [ 'elasticsearch03.openstack.org:9200', 'elasticsearch04.openstack.org:9200', 'elasticsearch05.openstack.org:9200', 'elasticsearch06.openstack.org:9200', 'elasticsearch07.openstack.org:9200', 'elasticsearch02.openstack.org:9200', ], subunit2sql_db_host => hiera('subunit2sql_db_host', ''), subunit2sql_db_pass => hiera('subunit2sql_db_password', ''), } } # Node-OS: trusty # Node-OS: xenial node /^logstash-worker\d+\.openstack\.org$/ { $group = 'logstash-worker' class { 'openstack_project::server': iptables_public_tcp_ports => [22], sysadmins => hiera('sysadmins', []), } class { 'openstack_project::logstash_worker': discover_node => 'elasticsearch03.openstack.org', enable_mqtt => false, mqtt_password => hiera('mqtt_service_user_password'), mqtt_ca_cert_contents => hiera('mosquitto_tls_ca_file'), } } # Node-OS: trusty # Node-OS: xenial node /^subunit-worker\d+\.openstack\.org$/ { $group = "subunit-worker" class { 'openstack_project::server': iptables_public_tcp_ports => [22], sysadmins => hiera('sysadmins', []), } class { 'openstack_project::subunit_worker': subunit2sql_db_host => hiera('subunit2sql_db_host', ''), subunit2sql_db_pass => hiera('subunit2sql_db_password', ''), mqtt_pass => hiera('mqtt_service_user_password'), mqtt_ca_cert_contents => hiera('mosquitto_tls_ca_file'), } } # Node-OS: trusty # Node-OS: xenial node /^elasticsearch0[1-7]\.openstack\.org$/ { $group = "elasticsearch" class { 'openstack_project::server': iptables_public_tcp_ports => [22], iptables_allowed_hosts => hiera_array('elasticsearch_iptables_rule_data'), sysadmins => hiera('sysadmins', []), } class { 'openstack_project::elasticsearch_node': discover_nodes => $elasticsearch_nodes, } } # Node-OS: xenial node /^firehose\d+\.openstack\.org$/ { class { 'openstack_project::server': # NOTE(mtreinish) Port 80 and 8080 are disabled because websocket # connections seem to crash mosquitto. Once this is fixed we should add # them back iptables_public_tcp_ports => [22, 25, 80, 1883, 8883], sysadmins => hiera('sysadmins', []), manage_exim => false, } class { 'openstack_project::firehose': sysadmins => hiera('sysadmins', []), gerrit_ssh_host_key => hiera('gerrit_ssh_rsa_pubkey_contents'), gerrit_public_key => hiera('germqtt_gerrit_ssh_public_key'), gerrit_private_key => hiera('germqtt_gerrit_ssh_private_key'), mqtt_password => hiera('mqtt_service_user_password'), ca_file => hiera('mosquitto_tls_ca_file'), cert_file => hiera('mosquitto_tls_server_cert_file'), key_file => hiera('mosquitto_tls_server_key_file'), imap_hostname => hiera('lpmqtt_imap_server'), imap_username => hiera('lpmqtt_imap_username'), imap_password => hiera('lpmqtt_imap_password'), statsd_host => 'graphite.openstack.org', } } # CentOS machines to load balance git access. # Node-OS: centos7 node /^git(-fe\d+)?\.openstack\.org$/ { $group = "git-loadbalancer" class { 'openstack_project::git': sysadmins => hiera('sysadmins', []), balancer_member_names => [ 'git01.openstack.org', 'git02.openstack.org', 'git03.openstack.org', 'git04.openstack.org', 'git05.openstack.org', 'git06.openstack.org', 'git07.openstack.org', 'git08.openstack.org', ], balancer_member_ips => [ '104.130.243.237', '104.130.243.109', '67.192.247.197', '67.192.247.180', '23.253.69.135', '104.239.132.223', '23.253.94.84', '104.239.146.131', ], } } # CentOS machines to run cgit and git daemon. Will be # load balanced by git.openstack.org. # Node-OS: centos7 node /^git\d+\.openstack\.org$/ { $group = "git-server" include openstack_project class { 'openstack_project::server': iptables_public_tcp_ports => [4443, 8080, 29418], sysadmins => hiera('sysadmins', []), } class { 'openstack_project::git_backend': project_config_repo => 'https://git.openstack.org/openstack-infra/project-config', vhost_name => 'git.openstack.org', git_gerrit_ssh_key => hiera('gerrit_replication_ssh_rsa_pubkey_contents'), ssl_cert_file_contents => hiera('git_ssl_cert_file_contents'), ssl_key_file_contents => hiera('git_ssl_key_file_contents'), ssl_chain_file_contents => hiera('git_ssl_chain_file_contents'), git_zuul_ci_org_ssl_cert_file_contents => hiera('git_zuul_ci_org_ssl_cert_file_contents'), git_zuul_ci_org_ssl_key_file_contents => hiera('git_zuul_ci_org_ssl_key_file_contents'), git_zuul_ci_org_ssl_chain_file_contents => hiera('git_zuul_ci_org_ssl_chain_file_contents'), behind_proxy => true, selinux_mode => 'enforcing' } } # A machine to drive AFS mirror updates. # Node-OS: trusty # Node-OS: xenial node /^mirror-update\d*\.openstack\.org$/ { $group = "afsadmin" class { 'openstack_project::mirror_update': bandersnatch_keytab => hiera('bandersnatch_keytab'), admin_keytab => hiera('afsadmin_keytab'), fedora_keytab => hiera('fedora_keytab'), opensuse_keytab => hiera('opensuse_keytab'), reprepro_keytab => hiera('reprepro_keytab'), gem_keytab => hiera('gem_keytab'), centos_keytab => hiera('centos_keytab'), epel_keytab => hiera('epel_keytab'), yum_puppetlabs_keytab => hiera('yum_puppetlabs_keytab'), sysadmins => hiera('sysadmins', []), } } # Machines in each region to serve AFS mirrors. # Node-OS: xenial node /^mirror\d*\..*\.openstack\.org$/ { $group = "mirror" class { 'openstack_project::server': iptables_public_tcp_ports => [22, 80, 8080, 8081, 8082], sysadmins => hiera('sysadmins', []), afs => true, afs_cache_size => 50000000, # 50GB } class { 'openstack_project::mirror': vhost_name => $::fqdn, require => Class['Openstack_project::Server'], } } # Serve static AFS content for docs and other sites. # Node-OS: trusty # Node-OS: xenial node /^files\d*\.openstack\.org$/ { $group = "files" class { 'openstack_project::server': iptables_public_tcp_ports => [80, 443], sysadmins => hiera('sysadmins', []), afs => true, afs_cache_size => 10000000, # 10GB } class { 'openstack_project::files': vhost_name => 'files.openstack.org', developer_cert_file_contents => hiera('developer_cert_file_contents'), developer_key_file_contents => hiera('developer_key_file_contents'), developer_chain_file_contents => hiera('developer_chain_file_contents'), docs_cert_file_contents => hiera('docs_cert_file_contents'), docs_key_file_contents => hiera('docs_key_file_contents'), docs_chain_file_contents => hiera('docs_chain_file_contents'), require => Class['Openstack_project::Server'], } openstack_project::website { 'zuul-ci.org': aliases => ['www.zuul-ci.org'], ssl_cert => hiera('zuul-ci_org_ssl_cert'), ssl_key => hiera('zuul-ci_org_ssl_key'), ssl_intermediate => hiera('zuul-ci_org_ssl_intermediate'), require => Class['openstack_project::files'], } } # Node-OS: trusty # Node-OS: xenial node /^refstack\d*\.openstack\.org$/ { class { 'openstack_project::server': iptables_public_tcp_ports => [80, 443], sysadmins => hiera('sysadmins', []), } class { 'refstack': mysql_host => hiera('refstack_mysql_host', 'localhost'), mysql_database => hiera('refstack_mysql_db_name', 'refstack'), mysql_user => hiera('refstack_mysql_user', 'refstack'), mysql_user_password => hiera('refstack_mysql_password'), ssl_cert_content => hiera('refstack_ssl_cert_file_contents'), ssl_key_content => hiera('refstack_ssl_key_file_contents'), ssl_ca_content => hiera('refstack_ssl_chain_file_contents'), protocol => 'https', } mysql_backup::backup_remote { 'refstack': database_host => hiera('refstack_mysql_host', 'localhost'), database_user => hiera('refstack_mysql_user', 'refstack'), database_password => hiera('refstack_mysql_password'), require => Class['::refstack'], } } # A machine to run Storyboard # Node-OS: trusty # Node-OS: xenial node /^storyboard\d*\.openstack\.org$/ { class { 'openstack_project::storyboard': project_config_repo => 'https://git.openstack.org/openstack-infra/project-config', sysadmins => hiera('sysadmins', []), mysql_host => hiera('storyboard_db_host', 'localhost'), mysql_user => hiera('storyboard_db_user', 'username'), mysql_password => hiera('storyboard_db_password'), rabbitmq_user => hiera('storyboard_rabbit_user', 'username'), rabbitmq_password => hiera('storyboard_rabbit_password'), ssl_cert => '/etc/ssl/certs/storyboard.openstack.org.pem', ssl_cert_file_contents => hiera('storyboard_ssl_cert_file_contents'), ssl_key => '/etc/ssl/private/storyboard.openstack.org.key', ssl_key_file_contents => hiera('storyboard_ssl_key_file_contents'), ssl_chain_file_contents => hiera('storyboard_ssl_chain_file_contents'), hostname => $::fqdn, valid_oauth_clients => [ $::fqdn, 'logs.openstack.org', ], cors_allowed_origins => [ "https://${::fqdn}", 'http://logs.openstack.org', ], sender_email_address => 'storyboard@storyboard.openstack.org', } } # A machine to run Storyboard devel # Node-OS: trusty # Node-OS: xenial node /^storyboard-dev\d*\.openstack\.org$/ { class { 'openstack_project::storyboard::dev': project_config_repo => 'https://git.openstack.org/openstack-infra/project-config', sysadmins => hiera('sysadmins', []), mysql_host => hiera('storyboard_db_host', 'localhost'), mysql_user => hiera('storyboard_db_user', 'username'), mysql_password => hiera('storyboard_db_password'), rabbitmq_user => hiera('storyboard_rabbit_user', 'username'), rabbitmq_password => hiera('storyboard_rabbit_password'), hostname => $::fqdn, valid_oauth_clients => [ $::fqdn, 'logs.openstack.org', ], cors_allowed_origins => [ "https://${::fqdn}", 'http://logs.openstack.org', ], sender_email_address => 'storyboard-dev@storyboard-dev.openstack.org', } } # A machine to serve static content. # Node-OS: trusty # Node-OS: xenial node /^static\d*\.openstack\.org$/ { class { 'openstack_project::server': iptables_public_tcp_ports => [22, 80, 443], sysadmins => hiera('sysadmins', []), } class { 'openstack_project::static': project_config_repo => 'https://git.openstack.org/openstack-infra/project-config', swift_authurl => 'https://identity.api.rackspacecloud.com/v2.0/', swift_user => 'infra-files-ro', swift_key => hiera('infra_files_ro_password'), swift_tenant_name => hiera('infra_files_tenant_name', 'tenantname'), swift_region_name => 'DFW', swift_default_container => 'infra-files', ssl_cert_file_contents => hiera('static_ssl_cert_file_contents'), ssl_key_file_contents => hiera('static_ssl_key_file_contents'), ssl_chain_file_contents => hiera('static_ssl_chain_file_contents'), } } # Node-OS: xenial node /^zk\d+\.openstack\.org$/ { class { 'openstack_project::server': iptables_allowed_hosts => [ # Zookeeper clients {protocol => 'tcp', port => '2181', hostname => 'nb01.openstack.org'}, {protocol => 'tcp', port => '2181', hostname => 'nb02.openstack.org'}, {protocol => 'tcp', port => '2181', hostname => 'nb03.openstack.org'}, {protocol => 'tcp', port => '2181', hostname => 'nl01.openstack.org'}, {protocol => 'tcp', port => '2181', hostname => 'nl02.openstack.org'}, {protocol => 'tcp', port => '2181', hostname => 'nl03.openstack.org'}, {protocol => 'tcp', port => '2181', hostname => 'nl04.openstack.org'}, {protocol => 'tcp', port => '2181', hostname => 'zuul01.openstack.org'}, # Zookeeper election {protocol => 'tcp', port => '2888', hostname => 'zk01.openstack.org'}, {protocol => 'tcp', port => '2888', hostname => 'zk02.openstack.org'}, {protocol => 'tcp', port => '2888', hostname => 'zk03.openstack.org'}, # Zookeeper leader {protocol => 'tcp', port => '3888', hostname => 'zk01.openstack.org'}, {protocol => 'tcp', port => '3888', hostname => 'zk02.openstack.org'}, {protocol => 'tcp', port => '3888', hostname => 'zk03.openstack.org'}, ], sysadmins => hiera('sysadmins', []), } class { '::zookeeper': # ID needs to be numeric, so we use regex to extra numbers from fqdn. id => regsubst($::fqdn, '^zk(\d+)\.openstack\.org$', '\1'), # The frequency in hours to look for and purge old snapshots, # defaults to 0 (disabled). The number of retained snapshots can # be separately controlled through snap_retain_count and # defaults to the minimum value of 3. This will quickly fill the # disk in production if not enabled. Works on ZK >=3.4. purge_interval => 6, servers => $zk_cluster_members, } } # A machine to serve various project status updates. # Node-OS: trusty # Node-OS: xenial node /^status\d*\.openstack\.org$/ { $group = 'status' class { 'openstack_project::server': iptables_public_tcp_ports => [22, 80, 443], sysadmins => hiera('sysadmins', []), } class { 'openstack_project::status': gerrit_host => 'review.openstack.org', gerrit_ssh_host_key => hiera('gerrit_ssh_rsa_pubkey_contents'), reviewday_ssh_public_key => hiera('reviewday_rsa_pubkey_contents'), reviewday_ssh_private_key => hiera('reviewday_rsa_key_contents'), recheck_ssh_public_key => hiera('elastic-recheck_gerrit_ssh_public_key'), recheck_ssh_private_key => hiera('elastic-recheck_gerrit_ssh_private_key'), recheck_bot_nick => 'openstackrecheck', recheck_bot_passwd => hiera('elastic-recheck_ircbot_password'), } } # This is a hidden authoritative master nameserver, not publicly # accessible. # Node-OS: xenial node /^adns\d+\.openstack\.org$/ { $group = 'adns' class { 'openstack_project::server': sysadmins => hiera('sysadmins', []), iptables_allowed_hosts => [ {protocol => 'tcp', port => '53', hostname => 'ns1.openstack.org'}, {protocol => 'tcp', port => '53', hostname => 'ns2.openstack.org'}, ], } class { 'openstack_project::master_nameserver': tsig_key => hiera('tsig_key', {}), dnssec_keys => hiera_hash('dnssec_keys', {}), notifies => concat(dns_a('ns1.openstack.org'), dns_a('ns2.openstack.org')), } } # These are publicly accessible authoritative slave nameservers. # Node-OS: xenial node /^ns\d+\.openstack\.org$/ { $group = 'ns' class { 'openstack_project::server': sysadmins => hiera('sysadmins', []), iptables_public_udp_ports => [53], iptables_public_tcp_ports => [53], } $tsig_key = hiera('tsig_key', {}) if $tsig_key != {} { $tsig_name = 'tsig' nsd::tsig { 'tsig': algo => $tsig_key[algorithm], data => $tsig_key[secret], } } else { $tsig_name = undef } class { '::nsd': ip_addresses => [ $::ipaddress, $::ipaddress6 ], zones => { 'adns1_zones' => { allow_notify => dns_a('adns1.openstack.org'), masters => dns_a('adns1.openstack.org'), zones => ['zuul-ci.org'], tsig_name => $tsig_name, } } } } # Node-OS: trusty node 'nodepool.openstack.org' { $group = 'nodepool' # TODO(pabelanger): Move all of this back into nodepool manifest, it has # grown too big. $rackspace_username = hiera('nodepool_rackspace_username', 'username') $rackspace_password = hiera('nodepool_rackspace_password') $rackspace_project = hiera('nodepool_rackspace_project', 'project') $hpcloud_username = hiera('nodepool_hpcloud_username', 'username') $hpcloud_password = hiera('nodepool_hpcloud_password') $hpcloud_project = hiera('nodepool_hpcloud_project', 'project') $internap_username = hiera('nodepool_internap_username', 'username') $internap_password = hiera('nodepool_internap_password') $internap_project = hiera('nodepool_internap_project', 'project') $ovh_username = hiera('nodepool_ovh_username', 'username') $ovh_password = hiera('nodepool_ovh_password') $ovh_project = hiera('nodepool_ovh_project', 'project') $tripleo_username = hiera('nodepool_tripleo_username', 'username') $tripleo_password = hiera('nodepool_tripleo_password') $tripleo_project = hiera('nodepool_tripleo_project', 'project') $infracloud_vanilla_username = hiera('nodepool_infracloud_vanilla_username', 'username') $infracloud_vanilla_password = hiera('nodepool_infracloud_vanilla_password') $infracloud_vanilla_project = hiera('nodepool_infracloud_vanilla_project', 'project') $infracloud_chocolate_username = hiera('nodepool_infracloud_chocolate_username', 'username') $infracloud_chocolate_password = hiera('nodepool_infracloud_chocolate_password') $infracloud_chocolate_project = hiera('nodepool_infracloud_chocolate_project', 'project') $vexxhost_username = hiera('nodepool_vexxhost_username', 'username') $vexxhost_password = hiera('nodepool_vexxhost_password') $vexxhost_project = hiera('nodepool_vexxhost_project', 'project') $citycloud_username = hiera('nodepool_citycloud_username', 'username') $citycloud_password = hiera('nodepool_citycloud_password') $linaro_username = hiera('nodepool_linaro_username', 'username') $linaro_password = hiera('nodepool_linaro_password') $linaro_project = hiera('nodepool_linaro_project', 'project') $limestone_username = hiera('nodepool_limestone_username', 'username') $limestone_password = hiera('nodepool_limestone_password') $limestone_project = hiera('nodepool_limestone_project', 'project') $clouds_yaml = template("openstack_project/nodepool/clouds.yaml.erb") class { 'openstack_project::server': iptables_allowed_hosts => [ {protocol => 'tcp', port => '2181', hostname => 'nb01.openstack.org'}, {protocol => 'tcp', port => '2181', hostname => 'nb02.openstack.org'}, {protocol => 'tcp', port => '2181', hostname => 'nb03.openstack.org'}, {protocol => 'tcp', port => '2181', hostname => 'nl01.openstack.org'}, {protocol => 'tcp', port => '2181', hostname => 'nl02.openstack.org'}, {protocol => 'tcp', port => '2181', hostname => 'nl03.openstack.org'}, {protocol => 'tcp', port => '2181', hostname => 'nl04.openstack.org'}, {protocol => 'tcp', port => '2181', hostname => 'zuul01.openstack.org'}, ], sysadmins => hiera('sysadmins', []), iptables_public_tcp_ports => [80], } class { '::zookeeper': # The frequency in hours to look for and purge old snapshots, # defaults to 0 (disabled). The number of retained snapshots can # be separately controlled through snap_retain_count and # defaults to the minimum value of 3. This will quickly fill the # disk in production if not enabled. Works on ZK >=3.4. purge_interval => 6, } include openstack_project class { '::openstackci::nodepool': vhost_name => 'nodepool.openstack.org', project_config_repo => 'https://git.openstack.org/openstack-infra/project-config', mysql_password => hiera('nodepool_mysql_password'), mysql_root_password => hiera('nodepool_mysql_root_password'), nodepool_ssh_public_key => hiera('zuul_worker_ssh_public_key_contents'), # TODO(pabelanger): Switch out private key with zuul_worker once we are # ready. nodepool_ssh_private_key => hiera('jenkins_ssh_private_key_contents'), oscc_file_contents => $clouds_yaml, image_log_document_root => '/var/log/nodepool/image', statsd_host => 'graphite.openstack.org', logging_conf_template => 'openstack_project/nodepool/nodepool.logging.conf.erb', builder_logging_conf_template => 'openstack_project/nodepool/nodepool-builder.logging.conf.erb', upload_workers => '16', jenkins_masters => [], split_daemon => true, } file { '/home/nodepool/.config/openstack/infracloud_vanilla_cacert.pem': ensure => present, owner => 'nodepool', group => 'nodepool', mode => '0600', content => hiera('infracloud_vanilla_ssl_cert_file_contents'), require => Class['::openstackci::nodepool'], } file { '/home/nodepool/.config/openstack/infracloud_chocolate_cacert.pem': ensure => present, owner => 'nodepool', group => 'nodepool', mode => '0600', content => hiera('infracloud_chocolate_ssl_cert_file_contents'), require => Class['::openstackci::nodepool'], } file { '/home/nodepool/.config/openstack/limestone_cacert.pem': ensure => present, owner => 'nodepool', group => 'nodepool', mode => '0600', content => hiera('limestone_ssl_cert_file_contents'), require => Class['::openstackci::nodepool'], } cron { 'mirror_gitgc': user => 'nodepool', hour => '20', minute => '0', command => 'find /opt/dib_cache/source-repositories/ -maxdepth 1 -type d -name "*.git" -exec git --git-dir="{}" gc \; >/dev/null', environment => 'PATH=/usr/bin:/bin:/usr/sbin:/sbin', require => Class['::openstackci::nodepool'], } } # Node-OS: trusty # Node-OS: xenial node /^nl\d+\.openstack\.org$/ { $group = 'nodepool' # TODO(pabelanger): Move all of this back into nodepool manifest, it has # grown too big. $rackspace_username = hiera('nodepool_rackspace_username', 'username') $rackspace_password = hiera('nodepool_rackspace_password') $rackspace_project = hiera('nodepool_rackspace_project', 'project') $hpcloud_username = hiera('nodepool_hpcloud_username', 'username') $hpcloud_password = hiera('nodepool_hpcloud_password') $hpcloud_project = hiera('nodepool_hpcloud_project', 'project') $internap_username = hiera('nodepool_internap_username', 'username') $internap_password = hiera('nodepool_internap_password') $internap_project = hiera('nodepool_internap_project', 'project') $ovh_username = hiera('nodepool_ovh_username', 'username') $ovh_password = hiera('nodepool_ovh_password') $ovh_project = hiera('nodepool_ovh_project', 'project') $tripleo_username = hiera('nodepool_tripleo_username', 'username') $tripleo_password = hiera('nodepool_tripleo_password') $tripleo_project = hiera('nodepool_tripleo_project', 'project') $infracloud_vanilla_username = hiera('nodepool_infracloud_vanilla_username', 'username') $infracloud_vanilla_password = hiera('nodepool_infracloud_vanilla_password') $infracloud_vanilla_project = hiera('nodepool_infracloud_vanilla_project', 'project') $infracloud_chocolate_username = hiera('nodepool_infracloud_chocolate_username', 'username') $infracloud_chocolate_password = hiera('nodepool_infracloud_chocolate_password') $infracloud_chocolate_project = hiera('nodepool_infracloud_chocolate_project', 'project') $vexxhost_username = hiera('nodepool_vexxhost_username', 'username') $vexxhost_password = hiera('nodepool_vexxhost_password') $vexxhost_project = hiera('nodepool_vexxhost_project', 'project') $citycloud_username = hiera('nodepool_citycloud_username', 'username') $citycloud_password = hiera('nodepool_citycloud_password') $linaro_username = hiera('nodepool_linaro_username', 'username') $linaro_password = hiera('nodepool_linaro_password') $linaro_project = hiera('nodepool_linaro_project', 'project') $limestone_username = hiera('nodepool_limestone_username', 'username') $limestone_password = hiera('nodepool_limestone_password') $limestone_project = hiera('nodepool_limestone_project', 'project') $clouds_yaml = template("openstack_project/nodepool/clouds.yaml.erb") class { 'openstack_project::server': sysadmins => hiera('sysadmins', []), iptables_public_tcp_ports => [80], } include openstack_project class { '::openstackci::nodepool_launcher': nodepool_ssh_private_key => hiera('zuul_worker_ssh_private_key_contents'), project_config_repo => 'https://git.openstack.org/openstack-infra/project-config', oscc_file_contents => $clouds_yaml, statsd_host => 'graphite.openstack.org', revision => 'master', python_version => 3, enable_webapp => true, } file { '/home/nodepool/.config/openstack/infracloud_vanilla_cacert.pem': ensure => present, owner => 'nodepool', group => 'nodepool', mode => '0600', content => hiera('infracloud_vanilla_ssl_cert_file_contents'), require => Class['::openstackci::nodepool_launcher'], } file { '/home/nodepool/.config/openstack/infracloud_chocolate_cacert.pem': ensure => present, owner => 'nodepool', group => 'nodepool', mode => '0600', content => hiera('infracloud_chocolate_ssl_cert_file_contents'), require => Class['::openstackci::nodepool_launcher'], } file { '/home/nodepool/.config/openstack/limestone_cacert.pem': ensure => present, owner => 'nodepool', group => 'nodepool', mode => '0600', content => hiera('limestone_ssl_cert_file_contents'), require => Class['::openstackci::nodepool_launcher'], } } # Node-OS: xenial node /^nb\d+\.openstack\.org$/ { $group = 'nodepool' # TODO(pabelanger): Move all of this back into nodepool manifest, it has # grown too big. $rackspace_username = hiera('nodepool_rackspace_username', 'username') $rackspace_password = hiera('nodepool_rackspace_password') $rackspace_project = hiera('nodepool_rackspace_project', 'project') $hpcloud_username = hiera('nodepool_hpcloud_username', 'username') $hpcloud_password = hiera('nodepool_hpcloud_password') $hpcloud_project = hiera('nodepool_hpcloud_project', 'project') $internap_username = hiera('nodepool_internap_username', 'username') $internap_password = hiera('nodepool_internap_password') $internap_project = hiera('nodepool_internap_project', 'project') $ovh_username = hiera('nodepool_ovh_username', 'username') $ovh_password = hiera('nodepool_ovh_password') $ovh_project = hiera('nodepool_ovh_project', 'project') $tripleo_username = hiera('nodepool_tripleo_username', 'username') $tripleo_password = hiera('nodepool_tripleo_password') $tripleo_project = hiera('nodepool_tripleo_project', 'project') $infracloud_vanilla_username = hiera('nodepool_infracloud_vanilla_username', 'username') $infracloud_vanilla_password = hiera('nodepool_infracloud_vanilla_password') $infracloud_vanilla_project = hiera('nodepool_infracloud_vanilla_project', 'project') $infracloud_chocolate_username = hiera('nodepool_infracloud_chocolate_username', 'username') $infracloud_chocolate_password = hiera('nodepool_infracloud_chocolate_password') $infracloud_chocolate_project = hiera('nodepool_infracloud_chocolate_project', 'project') $vexxhost_username = hiera('nodepool_vexxhost_username', 'username') $vexxhost_password = hiera('nodepool_vexxhost_password') $vexxhost_project = hiera('nodepool_vexxhost_project', 'project') $citycloud_username = hiera('nodepool_citycloud_username', 'username') $citycloud_password = hiera('nodepool_citycloud_password') $linaro_username = hiera('nodepool_linaro_username', 'username') $linaro_password = hiera('nodepool_linaro_password') $linaro_project = hiera('nodepool_linaro_project', 'project') $limestone_username = hiera('nodepool_limestone_username', 'username') $limestone_password = hiera('nodepool_limestone_password') $limestone_project = hiera('nodepool_limestone_project', 'project') $clouds_yaml = template("openstack_project/nodepool/clouds.yaml.erb") class { 'openstack_project::server': sysadmins => hiera('sysadmins', []), iptables_public_tcp_ports => [80], } include openstack_project class { '::openstackci::nodepool_builder': nodepool_ssh_public_key => hiera('zuul_worker_ssh_public_key_contents'), vhost_name => $::fqdn, enable_build_log_via_http => true, project_config_repo => 'https://git.openstack.org/openstack-infra/project-config', oscc_file_contents => $clouds_yaml, statsd_host => 'graphite.openstack.org', builder_logging_conf_template => 'openstack_project/nodepool/nodepool-builder.logging.conf.erb', upload_workers => '16', revision => 'master', python_version => 3, zuulv3 => true, } file { '/home/nodepool/.config/openstack/infracloud_vanilla_cacert.pem': ensure => present, owner => 'nodepool', group => 'nodepool', mode => '0600', content => hiera('infracloud_vanilla_ssl_cert_file_contents'), require => Class['::openstackci::nodepool_builder'], } file { '/home/nodepool/.config/openstack/infracloud_chocolate_cacert.pem': ensure => present, owner => 'nodepool', group => 'nodepool', mode => '0600', content => hiera('infracloud_chocolate_ssl_cert_file_contents'), require => Class['::openstackci::nodepool_builder'], } file { '/home/nodepool/.config/openstack/limestone_cacert.pem': ensure => present, owner => 'nodepool', group => 'nodepool', mode => '0600', content => hiera('limestone_ssl_cert_file_contents'), require => Class['::openstackci::nodepool_builder'], } cron { 'mirror_gitgc': user => 'nodepool', hour => '20', minute => '0', command => 'find /opt/dib_cache/source-repositories/ -type d -name "*.git" -exec git --git-dir="{}" gc \; >/dev/null', environment => 'PATH=/usr/bin:/bin:/usr/sbin:/sbin', require => Class['::openstackci::nodepool_builder'], } } # Node-OS: xenial node /^ze\d+\.openstack\.org$/ { $group = "zuul-executor" $gerrit_server = 'review.openstack.org' $gerrit_user = 'zuul' $gerrit_ssh_host_key = hiera('gerrit_ssh_rsa_pubkey_contents') $gerrit_ssh_private_key = hiera('gerrit_ssh_private_key_contents') $zuul_ssh_private_key = hiera('zuul_ssh_private_key_contents') $zuul_static_private_key = hiera('jenkins_ssh_private_key_contents') $git_email = 'zuul@openstack.org' $git_name = 'OpenStack Zuul' $revision = 'master' class { 'openstack_project::server': iptables_public_tcp_ports => [79, 7900], sysadmins => hiera('sysadmins', []), afs => true, } class { '::project_config': url => 'https://git.openstack.org/openstack-infra/project-config', } # We use later HWE kernels for better memory managment, requiring an # updated AFS version which we install from our custom ppa. include ::apt apt::ppa { 'ppa:openstack-ci-core/openafs-amd64-hwe': } package { 'linux-generic-hwe-16.04': ensure => present, require => [ Apt::Ppa['ppa:openstack-ci-core/openafs-amd64-hwe'], Class['apt::update'], ], } # NOTE(pabelanger): We call ::zuul directly, so we can override all in one # settings. class { '::zuul': gearman_server => 'zuul01.openstack.org', gerrit_server => $gerrit_server, gerrit_user => $gerrit_user, zuul_ssh_private_key => $gerrit_ssh_private_key, git_email => $git_email, git_name => $git_name, worker_private_key_file => '/var/lib/zuul/ssh/nodepool_id_rsa', revision => $revision, python_version => 3, zookeeper_hosts => 'nodepool.openstack.org:2181', zuulv3 => true, connections => hiera('zuul_connections', []), gearman_client_ssl_cert => hiera('gearman_client_ssl_cert'), gearman_client_ssl_key => hiera('gearman_client_ssl_key'), gearman_ssl_ca => hiera('gearman_ssl_ca'), #TODO(pabelanger): Add openafs role for zuul-jobs to setup /etc/openafs # properly. We need to revisting this post Queens PTG. trusted_ro_paths => ['/etc/openafs', '/etc/ssl/certs', '/var/lib/zuul/ssh'], trusted_rw_paths => ['/afs'], untrusted_ro_paths => ['/etc/ssl/certs'], disk_limit_per_job => 5000, # Megabytes site_variables_yaml_file => $::project_config::zuul_site_variables_yaml, require => $::project_config::config_dir, statsd_host => 'graphite.openstack.org', } class { '::zuul::executor': } # This is used by the log job submission playbook which runs under # python2 package { 'gear': ensure => latest, provider => openstack_pip, require => Class['pip'], } file { '/var/lib/zuul/ssh/nodepool_id_rsa': owner => 'zuul', group => 'zuul', mode => '0400', require => File['/var/lib/zuul/ssh'], content => $zuul_ssh_private_key, } file { '/var/lib/zuul/ssh/static_id_rsa': owner => 'zuul', group => 'zuul', mode => '0400', require => File['/var/lib/zuul/ssh'], content => $zuul_static_private_key, } class { '::zuul::known_hosts': known_hosts_content => "review.openstack.org,104.130.246.91,2001:4800:7819:103:be76:4eff:fe05:8525 ${gerrit_ssh_host_key}", } } # Node-OS: xenial node /^zuul\d+\.openstack\.org$/ { $group = "zuul-scheduler" $gerrit_server = 'review.openstack.org' $gerrit_user = 'zuul' $gerrit_ssh_host_key = hiera('gerrit_zuul_user_ssh_key_contents') $zuul_ssh_private_key = hiera('zuul_ssh_private_key_contents') $zuul_url = "http://zuul.openstack.org/p" $git_email = 'zuul@openstack.org' $git_name = 'OpenStack Zuul' $revision = 'master' class { 'openstack_project::server': iptables_public_tcp_ports => [79, 80, 443], iptables_allowed_hosts => [ {protocol => 'tcp', port => '4730', hostname => 'ze01.openstack.org'}, {protocol => 'tcp', port => '4730', hostname => 'ze02.openstack.org'}, {protocol => 'tcp', port => '4730', hostname => 'ze03.openstack.org'}, {protocol => 'tcp', port => '4730', hostname => 'ze04.openstack.org'}, {protocol => 'tcp', port => '4730', hostname => 'ze05.openstack.org'}, {protocol => 'tcp', port => '4730', hostname => 'ze06.openstack.org'}, {protocol => 'tcp', port => '4730', hostname => 'ze07.openstack.org'}, {protocol => 'tcp', port => '4730', hostname => 'ze08.openstack.org'}, {protocol => 'tcp', port => '4730', hostname => 'ze09.openstack.org'}, {protocol => 'tcp', port => '4730', hostname => 'ze10.openstack.org'}, {protocol => 'tcp', port => '4730', hostname => 'zm01.openstack.org'}, {protocol => 'tcp', port => '4730', hostname => 'zm02.openstack.org'}, {protocol => 'tcp', port => '4730', hostname => 'zm03.openstack.org'}, {protocol => 'tcp', port => '4730', hostname => 'zm04.openstack.org'}, {protocol => 'tcp', port => '4730', hostname => 'zm05.openstack.org'}, {protocol => 'tcp', port => '4730', hostname => 'zm06.openstack.org'}, {protocol => 'tcp', port => '4730', hostname => 'zm07.openstack.org'}, {protocol => 'tcp', port => '4730', hostname => 'zm08.openstack.org'}, ], sysadmins => hiera('sysadmins', []), } class { '::project_config': url => 'https://git.openstack.org/openstack-infra/project-config', } # NOTE(pabelanger): We call ::zuul directly, so we can override all in one # settings. class { '::zuul': gerrit_server => $gerrit_server, gerrit_user => $gerrit_user, zuul_ssh_private_key => $zuul_ssh_private_key, git_email => $git_email, git_name => $git_name, revision => $revision, python_version => 3, zookeeper_hosts => 'nodepool.openstack.org:2181', zookeeper_session_timeout => 40, zuulv3 => true, connections => hiera('zuul_connections', []), connection_secrets => hiera('zuul_connection_secrets', []), vhost_name => 'zuul.openstack.org', zuul_status_url => 'http://127.0.0.1:8001/openstack', zuul_web_url => 'http://127.0.0.1:9000', zuul_tenant_name => 'openstack', gearman_client_ssl_cert => hiera('gearman_client_ssl_cert'), gearman_client_ssl_key => hiera('gearman_client_ssl_key'), gearman_server_ssl_cert => hiera('gearman_server_ssl_cert'), gearman_server_ssl_key => hiera('gearman_server_ssl_key'), gearman_ssl_ca => hiera('gearman_ssl_ca'), proxy_ssl_cert_file_contents => hiera('zuul_ssl_cert_file_contents'), proxy_ssl_chain_file_contents => hiera('zuul_ssl_chain_file_contents'), proxy_ssl_key_file_contents => hiera('zuul_ssl_key_file_contents'), statsd_host => 'graphite.openstack.org', status_url => 'https://zuul.openstack.org', } file { "/etc/zuul/github.key": ensure => present, owner => 'zuul', group => 'zuul', mode => '0600', content => hiera('zuul_github_app_key'), require => File['/etc/zuul'], } class { '::zuul::scheduler': layout_dir => $::project_config::zuul_layout_dir, require => $::project_config::config_dir, python_version => 3, use_mysql => true, } class { '::zuul::web': tenant_name => 'openstack', vhost_name => 'zuul.openstack.org', ssl_cert_file_contents => hiera('zuul_ssl_cert_file_contents'), ssl_chain_file_contents => hiera('zuul_ssl_chain_file_contents'), ssl_key_file_contents => hiera('zuul_ssl_key_file_contents'), } class { '::zuul::fingergw': } include bup bup::site { 'rax.ord': backup_user => 'bup-zuulv3', backup_server => 'backup01.ord.rax.ci.openstack.org', } } # Node-OS: xenial node /^zm\d+.openstack\.org$/ { $group = "zuul-merger" $gerrit_server = 'review.openstack.org' $gerrit_user = 'zuul' $gerrit_ssh_host_key = hiera('gerrit_ssh_rsa_pubkey_contents') $zuul_ssh_private_key = hiera('zuulv3_ssh_private_key_contents') $zuul_url = "http://${::fqdn}/p" $git_email = 'zuul@openstack.org' $git_name = 'OpenStack Zuul' $revision = 'master' class { 'openstack_project::server': iptables_public_tcp_ports => [80], sysadmins => hiera('sysadmins', []), } # NOTE(pabelanger): We call ::zuul directly, so we can override all in one # settings. class { '::zuul': gearman_server => 'zuul01.openstack.org', gerrit_server => $gerrit_server, gerrit_user => $gerrit_user, zuul_ssh_private_key => $zuul_ssh_private_key, git_email => $git_email, git_name => $git_name, revision => $revision, python_version => 3, zookeeper_hosts => 'nodepool.openstack.org:2181', zuulv3 => true, connections => hiera('zuul_connections', []), gearman_client_ssl_cert => hiera('gearman_client_ssl_cert'), gearman_client_ssl_key => hiera('gearman_client_ssl_key'), gearman_ssl_ca => hiera('gearman_ssl_ca'), statsd_host => 'graphite.openstack.org', } class { 'openstack_project::zuul_merger': gerrit_server => $gerrit_server, gerrit_user => $gerrit_user, gerrit_ssh_host_key => $gerrit_ssh_host_key, zuul_ssh_private_key => $zuul_ssh_private_key, manage_common_zuul => false, } } # Node-OS: trusty node 'pbx.openstack.org' { class { 'openstack_project::server': sysadmins => hiera('sysadmins', []), # SIP signaling is either TCP or UDP port 5060. # RTP media (audio/video) uses a range of UDP ports. iptables_public_tcp_ports => [5060], iptables_public_udp_ports => ['5060', '10000:20000'], } class { 'openstack_project::pbx': sip_providers => [ { provider => 'voipms', hostname => 'dallas.voip.ms', username => hiera('voipms_username', 'username'), password => hiera('voipms_password'), outgoing => false, }, ], } } # Node-OS: xenial # A backup machine. Don't run cron or puppet agent on it. node /^backup\d+\..*\.ci\.openstack\.org$/ { $group = "ci-backup" class { 'openstack_project::server': iptables_public_tcp_ports => [], manage_exim => false, purge_apt_sources => false, } include openstack_project::backup_server } # Node-OS: trusty node 'openstackid.org' { class { 'openstack_project::openstackid_prod': sysadmins => hiera('sysadmins', []), site_admin_password => hiera('openstackid_site_admin_password'), id_mysql_host => hiera('openstackid_id_mysql_host', 'localhost'), id_mysql_password => hiera('openstackid_id_mysql_password'), id_mysql_user => hiera('openstackid_id_mysql_user', 'username'), id_db_name => hiera('openstackid_id_db_name'), ss_mysql_host => hiera('openstackid_ss_mysql_host', 'localhost'), ss_mysql_password => hiera('openstackid_ss_mysql_password'), ss_mysql_user => hiera('openstackid_ss_mysql_user', 'username'), ss_db_name => hiera('openstackid_ss_db_name', 'username'), redis_password => hiera('openstackid_redis_password'), ssl_cert_file_contents => hiera('openstackid_ssl_cert_file_contents'), ssl_key_file_contents => hiera('openstackid_ssl_key_file_contents'), ssl_chain_file_contents => hiera('openstackid_ssl_chain_file_contents'), id_recaptcha_public_key => hiera('openstackid_recaptcha_public_key'), id_recaptcha_private_key => hiera('openstackid_recaptcha_private_key'), app_url => 'https://openstackid.org', app_key => hiera('openstackid_app_key'), id_log_error_to_email => 'openstack@tipit.net', id_log_error_from_email => 'noreply@openstack.org', email_driver => 'smtp', email_smtp_server => 'smtp.sendgrid.net', email_smtp_server_user => hiera('openstackid_smtp_user'), email_smtp_server_password => hiera('openstackid_smtp_password'), } } # Node-OS: trusty node 'openstackid-dev.openstack.org' { class { 'openstack_project::openstackid_dev': sysadmins => hiera('sysadmins', []), site_admin_password => hiera('openstackid_dev_site_admin_password'), id_mysql_host => hiera('openstackid_dev_id_mysql_host', 'localhost'), id_mysql_password => hiera('openstackid_dev_id_mysql_password'), id_mysql_user => hiera('openstackid_dev_id_mysql_user', 'username'), ss_mysql_host => hiera('openstackid_dev_ss_mysql_host', 'localhost'), ss_mysql_password => hiera('openstackid_dev_ss_mysql_password'), ss_mysql_user => hiera('openstackid_dev_ss_mysql_user', 'username'), ss_db_name => hiera('openstackid_dev_ss_db_name', 'username'), redis_password => hiera('openstackid_dev_redis_password'), ssl_cert_file_contents => hiera('openstackid_dev_ssl_cert_file_contents'), ssl_key_file_contents => hiera('openstackid_dev_ssl_key_file_contents'), ssl_chain_file_contents => hiera('openstackid_dev_ssl_chain_file_contents'), id_recaptcha_public_key => hiera('openstackid_dev_recaptcha_public_key'), id_recaptcha_private_key => hiera('openstackid_dev_recaptcha_private_key'), app_url => 'https://openstackid-dev.openstack.org', app_key => hiera('openstackid_dev_app_key'), id_log_error_to_email => 'openstack@tipit.net', id_log_error_from_email => 'noreply@openstack.org', email_driver => 'smtp', email_smtp_server => 'smtp.sendgrid.net', email_smtp_server_user => hiera('openstackid_dev_smtp_user'), email_smtp_server_password => hiera('openstackid_dev_smtp_password'), } } # Node-OS: trusty # Used for testing all-in-one deployments node 'single-node-ci.test.only' { include ::openstackci::single_node_ci } # Node-OS: trusty node 'kdc01.openstack.org' { class { 'openstack_project::server': iptables_public_tcp_ports => [88, 464, 749, 754], iptables_public_udp_ports => [88, 464, 749], sysadmins => hiera('sysadmins', []), } class { 'openstack_project::kdc': } } # Node-OS: xenial node 'kdc04.openstack.org' { class { 'openstack_project::server': iptables_public_tcp_ports => [88, 464, 749, 754], iptables_public_udp_ports => [88, 464, 749], sysadmins => hiera('sysadmins', []), } class { 'openstack_project::kdc': slave => true, } } # Node-OS: trusty node 'afsdb01.openstack.org' { $group = "afsdb" class { 'openstack_project::server': iptables_public_udp_ports => [7000,7002,7003,7004,7005,7006,7007], sysadmins => hiera('sysadmins', []), afs => true, manage_exim => true, } include openstack_project::afsdb include openstack_project::afsrelease } # Node-OS: trusty node /^afsdb.*\.openstack\.org$/ { $group = "afsdb" class { 'openstack_project::server': iptables_public_udp_ports => [7000,7002,7003,7004,7005,7006,7007], sysadmins => hiera('sysadmins', []), afs => true, manage_exim => true, } include openstack_project::afsdb } # Node-OS: trusty node /^afs.*\..*\.openstack\.org$/ { $group = "afs" class { 'openstack_project::server': iptables_public_udp_ports => [7000,7002,7003,7004,7005,7006,7007], sysadmins => hiera('sysadmins', []), afs => true, manage_exim => true, } include openstack_project::afsfs } # Node-OS: trusty node 'ask.openstack.org' { class { 'openstack_project::server': iptables_public_tcp_ports => [22, 80, 443], sysadmins => hiera('sysadmins', []), } class { 'openstack_project::ask': db_user => hiera('ask_db_user', 'ask'), db_password => hiera('ask_db_password'), redis_password => hiera('ask_redis_password'), site_ssl_cert_file_contents => hiera('ask_site_ssl_cert_file_contents', undef), site_ssl_key_file_contents => hiera('ask_site_ssl_key_file_contents', undef), site_ssl_chain_file_contents => hiera('ask_site_ssl_chain_file_contents', undef), } } # Node-OS: trusty node 'ask-staging.openstack.org' { class { 'openstack_project::server': iptables_public_tcp_ports => [22, 80, 443], sysadmins => hiera('sysadmins', []), } class { 'openstack_project::ask_staging': db_password => hiera('ask_staging_db_password'), redis_password => hiera('ask_staging_redis_password'), } } # Node-OS: trusty # Node-OS: xenial node /^translate\d+\.openstack\.org$/ { $group = "translate" class { 'openstack_project::server': iptables_public_tcp_ports => [80, 443], sysadmins => hiera('sysadmins', []), } class { 'openstack_project::translate': admin_users => 'aeng,cboylan,eumel8,ianw,ianychoi,infra,jaegerandi,mordred,stevenk', openid_url => 'https://openstackid.org', listeners => ['ajp'], from_address => 'noreply@openstack.org', mysql_host => hiera('translate_mysql_host', 'localhost'), mysql_password => hiera('translate_mysql_password'), zanata_server_user => hiera('proposal_zanata_user'), zanata_server_api_key => hiera('proposal_zanata_api_key'), zanata_wildfly_version => '10.1.0', zanata_wildfly_install_url => 'https://repo1.maven.org/maven2/org/wildfly/wildfly-dist/10.1.0.Final/wildfly-dist-10.1.0.Final.tar.gz', zanata_main_version => 4, zanata_url => 'https://github.com/zanata/zanata-platform/releases/download/platform-4.3.3/zanata-4.3.3-wildfly.zip', zanata_checksum => 'eaf8bd07401dade758b677007d2358f173193d17', project_config_repo => 'https://git.openstack.org/openstack-infra/project-config', ssl_cert_file_contents => hiera('translate_ssl_cert_file_contents'), ssl_key_file_contents => hiera('translate_ssl_key_file_contents'), ssl_chain_file_contents => hiera('translate_ssl_chain_file_contents'), vhost_name => 'translate.openstack.org', } } # Node-OS: trusty # Node-OS: xenial node /^translate-dev\d*\.openstack\.org$/ { $group = "translate-dev" class { 'openstack_project::translate_dev': sysadmins => hiera('sysadmins', []), admin_users => 'aeng,cboylan,eumel,eumel8,ianw,ianychoi,infra,jaegerandi,mordred,stevenk', openid_url => 'https://openstackid-dev.openstack.org', listeners => ['ajp'], from_address => 'noreply@openstack.org', mysql_host => hiera('translate_dev_mysql_host', 'localhost'), mysql_password => hiera('translate_dev_mysql_password'), zanata_server_user => hiera('proposal_zanata_user'), zanata_server_api_key => hiera('proposal_zanata_api_key'), project_config_repo => 'https://git.openstack.org/openstack-infra/project-config', vhost_name => 'translate-dev.openstack.org', } } # Node-OS: trusty node 'odsreg.openstack.org' { class { 'openstack_project::server': iptables_public_tcp_ports => [80], sysadmins => hiera('sysadmins', []), } realize ( User::Virtual::Localuser['ttx'], ) class { '::odsreg': } } # Node-OS: trusty # Node-OS: xenial node /^codesearch\d*\.openstack\.org$/ { $group = "codesearch" class { 'openstack_project::server': iptables_public_tcp_ports => [80], sysadmins => hiera('sysadmins', []), } class { 'openstack_project::codesearch': project_config_repo => 'https://git.openstack.org/openstack-infra/project-config', } } # Node-OS: trusty node 'controller00.vanilla.ic.openstack.org' { $group = 'infracloud' class { '::openstack_project::server': iptables_public_tcp_ports => [80,5000,5671,8774,9292,9696,35357], # logs,keystone,rabbit,nova,glance,neutron,keystone sysadmins => hiera('sysadmins', []), enable_unbound => false, purge_apt_sources => false, } class { '::openstack_project::infracloud::controller': keystone_rabbit_password => hiera('keystone_rabbit_password'), neutron_rabbit_password => hiera('neutron_rabbit_password'), nova_rabbit_password => hiera('nova_rabbit_password'), root_mysql_password => hiera('infracloud_mysql_password'), keystone_mysql_password => hiera('keystone_mysql_password'), glance_mysql_password => hiera('glance_mysql_password'), neutron_mysql_password => hiera('neutron_mysql_password'), nova_mysql_password => hiera('nova_mysql_password'), keystone_admin_password => hiera('keystone_admin_password'), glance_admin_password => hiera('glance_admin_password'), neutron_admin_password => hiera('neutron_admin_password'), nova_admin_password => hiera('nova_admin_password'), keystone_admin_token => hiera('keystone_admin_token'), ssl_key_file_contents => hiera('ssl_key_file_contents'), ssl_cert_file_contents => hiera('infracloud_vanilla_ssl_cert_file_contents'), br_name => hiera('bridge_name'), controller_public_address => $::fqdn, neutron_subnet_cidr => '15.184.64.0/19', neutron_subnet_gateway => '15.184.64.1', neutron_subnet_allocation_pools => [ 'start=15.184.65.2,end=15.184.65.254', 'start=15.184.66.2,end=15.184.66.254', 'start=15.184.67.2,end=15.184.67.254' ], mysql_max_connections => hiera('mysql_max_connections'), } } node /^compute\d{3}\.vanilla\.ic\.openstack\.org$/ { $group = 'infracloud' class { '::openstack_project::server': sysadmins => hiera('sysadmins', []), enable_unbound => false, purge_apt_sources => false, } class { '::openstack_project::infracloud::compute': nova_rabbit_password => hiera('nova_rabbit_password'), neutron_rabbit_password => hiera('neutron_rabbit_password'), neutron_admin_password => hiera('neutron_admin_password'), ssl_key_file_contents => hiera('ssl_key_file_contents'), ssl_cert_file_contents => hiera('infracloud_vanilla_ssl_cert_file_contents'), br_name => hiera('bridge_name'), controller_public_address => 'controller00.vanilla.ic.openstack.org', } } # Node-OS: trusty node 'controller00.chocolate.ic.openstack.org' { $group = 'infracloud' class { '::openstack_project::server': iptables_public_tcp_ports => [80,5000,5671,8774,9292,9696,35357], # logs,keystone,rabbit,nova,glance,neutron,keystone sysadmins => hiera('sysadmins', []), enable_unbound => false, purge_apt_sources => false, } class { '::openstack_project::infracloud::controller': keystone_rabbit_password => hiera('keystone_rabbit_password'), neutron_rabbit_password => hiera('neutron_rabbit_password'), nova_rabbit_password => hiera('nova_rabbit_password'), root_mysql_password => hiera('infracloud_mysql_password'), keystone_mysql_password => hiera('keystone_mysql_password'), glance_mysql_password => hiera('glance_mysql_password'), neutron_mysql_password => hiera('neutron_mysql_password'), nova_mysql_password => hiera('nova_mysql_password'), keystone_admin_password => hiera('keystone_admin_password'), glance_admin_password => hiera('glance_admin_password'), neutron_admin_password => hiera('neutron_admin_password'), nova_admin_password => hiera('nova_admin_password'), keystone_admin_token => hiera('keystone_admin_token'), ssl_key_file_contents => hiera('infracloud_chocolate_ssl_key_file_contents'), ssl_cert_file_contents => hiera('infracloud_chocolate_ssl_cert_file_contents'), br_name => 'br-vlan2551', controller_public_address => $::fqdn, neutron_subnet_cidr => '15.184.64.0/19', neutron_subnet_gateway => '15.184.64.1', neutron_subnet_allocation_pools => [ 'start=15.184.68.2,end=15.184.68.254', 'start=15.184.69.2,end=15.184.69.254', 'start=15.184.70.2,end=15.184.70.254' ] } } node /^compute\d{3}\.chocolate\.ic\.openstack\.org$/ { $group = 'infracloud' class { '::openstack_project::server': sysadmins => hiera('sysadmins', []), enable_unbound => false, purge_apt_sources => false, } class { '::openstack_project::infracloud::compute': nova_rabbit_password => hiera('nova_rabbit_password'), neutron_rabbit_password => hiera('neutron_rabbit_password'), neutron_admin_password => hiera('neutron_admin_password'), ssl_key_file_contents => hiera('infracloud_chocolate_ssl_key_file_contents'), ssl_cert_file_contents => hiera('infracloud_chocolate_ssl_cert_file_contents'), br_name => 'br-vlan2551', controller_public_address => 'controller00.chocolate.ic.openstack.org', } } # Node-OS: trusty # Upgrade-Modules node /^baremetal\d{2}\.vanilla\.ic\.openstack\.org$/ { $group = 'infracloud' class { '::openstack_project::server': iptables_public_udp_ports => [67,69], sysadmins => hiera('sysadmins', []), enable_unbound => false, purge_apt_sources => false, } class { '::openstack_project::infracloud::baremetal': ironic_inventory => hiera('ironic_inventory', {}), ironic_db_password => hiera('ironic_db_password'), mysql_password => hiera('bifrost_mysql_password'), ipmi_passwords => hiera('ipmi_passwords'), ssh_private_key => hiera('bifrost_vanilla_ssh_private_key'), ssh_public_key => hiera('bifrost_vanilla_ssh_public_key'), bridge_name => hiera('bridge_name'), vlan => hiera('vlan'), gateway_ip => hiera('gateway_ip'), default_network_interface => hiera('default_network_interface'), dhcp_pool_start => hiera('dhcp_pool_start'), dhcp_pool_end => hiera('dhcp_pool_end'), network_interface => hiera('network_interface'), ipv4_nameserver => hiera('ipv4_nameserver'), ipv4_subnet_mask => hiera('ipv4_subnet_mask'), } } # vim:sw=2:ts=2:expandtab:textwidth=79