bastion.yaml

heat_template_version: 2016-10-14


description: >
  A host used for running openshift-ansible playbooks and other optional services.


parameters:

  node_count:
    type: number
    description: >
      Number of non-master nodes to create.

  # What version of OpenShift Container Platform to install
  # This value is used to select the RPM repo for the OCP release to install
  ocp_version:
    type: string
    description: >
      The version of OpenShift Container Platform to deploy

  # What version of OpenStack Platform to install
  # This value is used to select the RPM repo for the OSP release to install
  osp_version:
    type: string
    default: "10"
    description: >
      The version of OpenStack Platform to use to collect data

  # Allow the caller to specify the version of ansible
  ansible_version:
    type: string
    description: >
      Set the RPM version of Ansible that will run on the bastion
      If unset, use current version

  key_name:
    description: >
      A pre-submitted SSH key to access the VM hosts
    type: string
    constraints:
    - custom_constraint: nova.keypair

  image:
    description: >
      Select a base image to use for the bastion server
    type: string
    constraints:
    - custom_constraint: glance.image

  flavor:
    description: >
      Define the hardware characteristics for the VMs: CPU, Memory, base disk
    type: string
    constraints:
    - custom_constraint: nova.flavor

  hostname:
    description: >
      The Infrastructure hostname portion of the FQDN
    type: string
    constraints:
    - allowed_pattern: '[a-z0-9\-]*'
      description: Hostname must contain only characters [a-z0-9\-].

  domain_name:
    description: >
      All VMs will be placed in this domain
    type: string

  # Software Subscription information
  rhn_username:
    description: >
      A valid user with entitlements to RHEL and OpenShift software repos
    type: string

  rhn_password:
    description: >
      The password for the RHN user
    type: string
    hidden: true

  # Red Hat satellite subscription parameters
  sat6_hostname:
    type: string
    description: >
      The hostname of the Satellite 6 server which will provide software updates
    default: ''

  sat6_organization:
    type: string
    description: >
      An organization string provided by Sat6 to group subscriptions
    default: ''

  sat6_activationkey:
    type: string
    description: >
      An activation key string provided by Sat6 to enable subscriptions
    default: ''

  rhn_pool:
    description: >
      A subscription pool containing the RHEL and OpenShift software repos
      OPTIONAL
    type: string
    hidden: true

  extra_rhn_pools:
    type: comma_delimited_list
    description: List of rhn pools which will be installed on each node.
    default: ''

  ssh_user:
    description: >
      The user for SSH access to the VM hosts
    type: string

  fixed_network:
    description: >
      The name or ID of the internal network
    type: string
    constraints:
    - custom_constraint: neutron.network

  fixed_subnet:
    description: >
      The name or ID of the internal IPv4 space
    type: string
    constraints:
    - custom_constraint: neutron.subnet

  ansible_public_key:
    description: >
      The SSH public key that Ansible will use to access master and node hosts
      This will be placed on each VM host in /root/.ssh/authorized_keys
    type: string

  ansible_private_key:
    description: >
      The private key that Ansible will use to access master and node hosts
      This file will be placed on the bastion host and protected
    type: string

  docker_volume_size:
    description: >
      The size of a cinder volume in GB to allocate to docker for
      container/image storage
    type: number
    default: 25

  floating_ip:
    description: >
      TBD: What is this a floating IP for? For the DNS server?
    type: string

  port:
    description: Neutron port (with a floating IP address) to assign to the DNS Nova Server
    type: string

  # LDAP
  # For external and/or common user information with OpenStack
  ldap_ip:
    description: >
      The IP address of the LDAP server providing OpenShift user information
    type: string
    default: ''

  ldap_hostname:
    description: >
      The hostname of the LDAP server providing OpenShift user information
    type: string
    default: ''

  # Delay openshift installation until the master is ready to accept
  timeout:
    description: Time to wait until the master setup is ready.
    type: number
    default: 4000

  system_update:
    type: boolean

  openshift_ansible_git_url:
    description: >
      The location of the OpenShift Ansible playbooks. A Git respository URL
    type: string

  openshift_ansible_git_rev:
    description: >
      A specific revision of the Ansible playbooks to use for installation
    type: string

  extra_repository_urls:
    type: comma_delimited_list
    description: List of repository URLs which will be installed on each node.
    default: ''

  extra_docker_repository_urls:
    type: comma_delimited_list
    description: List of docker repository URLs which will be installed on each node, if a repo is insecure use '#insecure' suffix.
    default: ''

  ca_cert:
    type: string
    description: Certificate Authority Certificate to be added to trust chain

resources:

  # A VM to provide host based orchestration and other sub-services
  host:
    type: OS::Nova::Server
    properties:
      name:
        str_replace:
          template: "HOST.DOMAIN"
          params:
            HOST: {get_param: hostname}
            DOMAIN: {get_param: domain_name}
      admin_user: {get_param: ssh_user}
      image: {get_param: image}
      flavor: {get_param: flavor}
      key_name: {get_param: key_name}
      networks:
      - port: {get_param: port}
      user_data_format: SOFTWARE_CONFIG
      user_data_update_policy: IGNORE
      user_data: {get_resource: init}

  # Install, configure and enable the Heat configuration agent
  config_agent:
    type: collect-config-setup/install_config_agent_centos_yum.yaml
    properties:
      osp_version: {get_param: osp_version}

  # Collect the results from a set of resources
  init:
    type: OS::Heat::MultipartMime
    properties:
      parts:
      - config: {get_resource: set_hostname}
      - config: {get_resource: included_files}
      - config: {get_resource: update_ca_cert}
      - config: {get_resource: rhn_register}
      - config: {get_resource: set_extra_repos}
      - config: {get_resource: set_extra_docker_repos}
      - config: {get_resource: host_update}
      - config: {get_attr: [config_agent, config]}
        type: multipart
      - config: {get_resource: bastion_boot}

  # Install the DNS server and retrieve the Ansible playbooks for OpenShift
  bastion_boot:
    type: OS::Heat::SoftwareConfig
    properties:
      group: script
      config:
        str_replace:
          params:
            $OPENSHIFT_ANSIBLE_GIT_URL: {get_param: openshift_ansible_git_url}
            $OPENSHIFT_ANSIBLE_GIT_REV: {get_param: openshift_ansible_git_rev}
            $DOCKER_VOLUME_ID: {get_resource: docker_volume}
            $ANSIBLE_VERSION: {get_param: ansible_version}
          template: {get_file: fragments/bastion-boot.sh}

  # Compose the FQDN for cloud-init
  set_hostname:
    type: OS::Heat::CloudConfig
    properties:
      cloud_config:
        hostname: {get_param: hostname}
        fqdn:
          str_replace:
            template: "HOST.DOMAIN"
            params:
              HOST: {get_param: hostname}
              DOMAIN: {get_param: domain_name}

  # Place host configuration files via cloud-init
  included_files:
    type: OS::Heat::CloudConfig
    properties:
      cloud_config:
        write_files:
        - path: /usr/local/bin/retry
          permissions: 0755
          content: {get_file: fragments/retry.sh}
        - path: /usr/local/bin/merge_dict
          permissions: 0755
          content: {get_file: fragments/merge_dict.py}
        - path: /usr/local/share/openshift-on-openstack/common_functions.sh
          permissions: 0755
          content:
            str_replace:
              params:
                $WC_NOTIFY: { get_attr: ['wait_handle', 'curl_cli'] }
              template: {get_file: fragments/common_functions.sh}
        - path: /root/.ssh/id_rsa
          permissions: 0600
          content: {get_param: ansible_private_key}
        - path: /root/.ssh/id_rsa.pub
          permissions: 0600
          content: {get_param: ansible_public_key}
        - path: /etc/pki/ca-trust/source/anchors/ca.crt
          permissions: 0600
          content: {get_param: ca_cert}
        ssh_authorized_keys:
        - {get_param: ansible_public_key}

  # Add CA Cert to trust chain
  update_ca_cert:
    type: OS::Heat::SoftwareConfig
    properties:
      config: {get_file: fragments/ca_cert.sh}

  # Register the host with RHN for access to software packages
  rhn_register:
    type: OS::Heat::SoftwareConfig
    properties:
      config:
        str_replace:
          params:
            $OCP_VERSION: {get_param: ocp_version}
            $RHN_USERNAME: {get_param: rhn_username}
            $RHN_PASSWORD: {get_param: rhn_password}
            $SAT6_HOSTNAME: {get_param: sat6_hostname}
            $SAT6_ORGANIZATION: {get_param: sat6_organization}
            $SAT6_ACTIVATIONKEY: {get_param: sat6_activationkey}
            $POOL_ID: {get_param: rhn_pool}
            $EXTRA_POOL_IDS:
              list_join:
                - " --pool="
                - {get_param: extra_rhn_pools}
          template: {get_file: fragments/rhn-register.sh}

  # Enable any extra repositories
  set_extra_repos:
    type: OS::Heat::SoftwareConfig
    properties:
      config:
        str_replace:
          params:
            $REPOLIST:
              list_join:
                - " "
                - {get_param: extra_repository_urls}
          template: {get_file: fragments/set-extra-repos.sh}

  set_extra_docker_repos:
    type: OS::Heat::SoftwareConfig
    properties:
      config:
        str_replace:
          params:
            $REPOLIST:
              list_join:
                - " "
                - {get_param: extra_docker_repository_urls}
          template: {get_file: fragments/set-extra-docker-repos.sh}

  # Make sure the host software is current
  host_update:
    type: OS::Heat::SoftwareConfig
    properties:
      config:
        str_replace:
          params:
            $SYSTEM_UPDATE: {get_param: system_update}
          template: {get_file: fragments/host-update.sh}

  write_templates:
    type: OS::Heat::SoftwareConfig
    properties:
      group: script
      config:
        list_join:
        - "\n"
        - - "#!/bin/bash"
          - "set -eux"
          - get_file: templates/var/lib/ansible/group_vars/masters.yml
          - get_file: templates/var/lib/ansible/group_vars/nodes.yml
          - get_file: templates/var/lib/ansible/host_vars/loadbalancer.yml
          - get_file: templates/var/lib/ansible/group_vars/OSv3.yml
          - get_file: templates/var/lib/ansible/playbooks/registry.yml
          - get_file: templates/var/lib/ansible/playbooks/main.yml
          - get_file: templates/var/lib/ansible/playbooks/scaleup.yml
          - get_file: templates/var/lib/ansible/playbooks/scaledown.yml
          - get_file: templates/var/lib/ansible/inventory
          - get_file: templates/var/lib/ansible/playbooks/haproxy.yml
          - get_file: templates/var/lib/ansible/templates/etc/haproxy/router.cfg.j2
          - get_file: templates/var/lib/ansible/playbooks/ipfailover.yml
          - get_file: templates/var/lib/ansible/playbooks/flannel.yml
          - get_file: templates/var/lib/ansible/playbooks/quota.yml
          - get_file: templates/var/lib/ansible/roles/reboot/tasks/main.yml
          - get_file: templates/var/lib/ansible/roles/fstab_mount_options/tasks/main.yml
          - get_file: templates/var/lib/ansible/roles/xfs_grub_quota/tasks/main.yml

  update_node_count:
    type: OS::Heat::SoftwareConfig
    properties:
      group: script
      inputs:
        - name: node_count
      config: |
        #!/bin/bash
        set -eux
        mkdir -p /var/lib/ansible
        echo "$node_count" > /var/lib/ansible/node_count

  deployment_update_node_count:
    depends_on: wait_condition
    type: OS::Heat::SoftwareDeployment
    properties:
      config:
        get_resource: update_node_count
      server:
        get_resource: host
      input_values:
        node_count: {get_param: node_count}

  deployment_write_templates:
    depends_on: wait_condition
    type: OS::Heat::SoftwareDeployment
    properties:
      config:
        get_resource: write_templates
      server:
        get_resource: host

  # Apply ansible performance tuning values
  tune_ansible:
    type: OS::Heat::SoftwareConfig
    properties:
      group: script
      config:
        get_file: fragments/tune-ansible.sh

  # Execute the tuning operation on a host
  deployment_tune_ansible:
    depends_on: wait_condition
    type: OS::Heat::SoftwareDeployment
    properties:
      actions: ['CREATE']
      config:
        get_resource: tune_ansible
      server:
        get_resource: host

  node_cleanup:
    type: OS::Heat::SoftwareConfig
    properties:
      group: script
      config: |
        #!/bin/bash
        set -eux
        (subscription-manager unregister && subscription-manager clean) || true

  deployment_bastion_node_cleanup:
    depends_on: [host, wait_condition]
    type: OS::Heat::SoftwareDeployment
    properties:
      actions: ['DELETE']
      config:
        get_resource: node_cleanup
      server:
        get_resource: host

  # Additional space for Docker container and image storage
  docker_volume:
    type: OS::Cinder::Volume
    properties:
      size: {get_param: docker_volume_size}

  # Bind docker file space to the host filesystem
  docker_volume_attach:
    type: OS::Cinder::VolumeAttachment
    properties:
      instance_uuid: {get_resource: host}
      volume_id: {get_resource: docker_volume}

  # Wait until the cloud-init process ends and reports or times out
  wait_condition:
    type: OS::Heat::WaitCondition
    properties:
      handle: {get_resource: wait_handle}
      timeout: {get_param: timeout}

  # This is passed to bastion_init cloud-init script as a curl CLI command
  # When the cloud-init process ends it queries the URL with
  # a message which ends the wait and returns the value
  wait_handle:
    type: OS::Heat::WaitConditionHandle

outputs:
  instance_ip:
    description: Instance private IP (used by other nodes for DNS queries).
    value: {get_attr: [host, first_address]}