Merge "Move firewall to a plugin-specific task"

This commit is contained in:
Jenkins 2015-12-23 12:59:35 +00:00 committed by Gerrit Code Review
commit cba65c58e1
2 changed files with 68 additions and 7 deletions

View File

@ -0,0 +1,51 @@
notice('MODULAR: detach-database/database_firewall.pp')
$network_scheme = hiera_hash('network_scheme')
$network_metadata = hiera_hash('network_metadata')
$corosync_input_port = 5404
$corosync_output_port = 5405
$galera_clustercheck_port = 49000
$galera_ist_port = 4568
$mysql_backend_port = 3307
$mysql_gcomm_port = 4567
$mysql_port = 3306
$pcsd_port = 2224
$corosync_networks = get_routable_networks_for_network_role($network_scheme, 'mgmt/corosync')
$database_networks = get_routable_networks_for_network_role($network_scheme, 'mgmt/database')
# allow connections from haproxy namespace
firewall {'030 allow connections from haproxy namespace':
source => '240.0.0.2',
action => 'accept',
}
openstack::firewall::multi_net {'101 mysql':
port => [$mysql_port, $mysql_backend_port, $mysql_gcomm_port, $galera_ist_port, $galera_clustercheck_port],
proto => 'tcp',
action => 'accept',
source_nets => $database_networks,
}
openstack::firewall::multi_net {'113 corosync-input':
port => $corosync_input_port,
proto => 'udp',
action => 'accept',
source_nets => $corosync_networks,
}
openstack::firewall::multi_net {'114 corosync-output':
port => $corosync_output_port,
proto => 'udp',
action => 'accept',
source_nets => $corosync_networks,
}
openstack::firewall::multi_net {'115 pcsd-server':
port => $pcsd_port,
proto => 'tcp',
action => 'accept',
source_nets => $corosync_networks,
}

View File

@ -6,8 +6,8 @@
requires: [deploy_start]
required_for: [deploy_end, primary-controller, controller]
tasks: [fuel_pkgs, hiera, globals, tools, logging, netconfig,
hosts, firewall, deploy_start, cluster, database-virtual-ip, cluster-haproxy,
openstack-haproxy-stats, task-database]
hosts, firewall, database-firewall, deploy_start, cluster,
database-virtual-ip, cluster-haproxy, openstack-haproxy-stats, task-database]
parameters:
strategy:
type: one_by_one
@ -18,8 +18,8 @@
requires: [deploy_start, primary-standalone-database, primary-controller, controller]
required_for: [deploy_end]
tasks: [fuel_pkgs, hiera, globals, tools, logging, netconfig,
hosts, firewall, deploy_start, cluster, database-virtual-ip, cluster-haproxy,
openstack-haproxy-stats, task-database]
hosts, firewall, database-firewall, deploy_start, cluster,
database-virtual-ip, cluster-haproxy, openstack-haproxy-stats, task-database]
parameters:
strategy:
type: parallel
@ -40,7 +40,7 @@
type: puppet
groups: [primary-standalone-database, standalone-database]
required_for: [deploy_end]
requires: [cluster]
requires: [database-firewall, cluster]
parameters:
puppet_manifest: "/etc/puppet/modules/osnailyfacter/modular/virtual_ips/virtual_ips.pp"
puppet_modules: "/etc/puppet/modules"
@ -49,8 +49,8 @@
- id: task-database
type: puppet
role: [primary-standalone-database, standalone-database]
requires: [hosts, firewall]
requires: [database-haproxy, database-virtual-ip]
requires: [hosts, database-firewall, cluster, database-haproxy,
database-virtual-ip]
parameters:
puppet_manifest: /etc/puppet/modules/osnailyfacter/modular/database/database.pp
puppet_modules: /etc/puppet/modules
@ -72,3 +72,13 @@
puppet_modules: "/etc/puppet/modules"
timeout: 120
- id: database-firewall
type: puppet
role: [primary-standalone-database, standalone-database]
requires: [globals, firewall]
required_for: [cluster, task-database]
parameters:
puppet_manifest: "database_firewall.pp"
puppet_modules: "/etc/puppet/modules"
timeout: 120