Puppet Class: nova::api

Defined in:
manifests/api.pp

Overview

Class: nova::api

Setup and configure the Nova API endpoint

Parameters

admin_password

(required) The password to set for the nova admin user in keystone

enabled

(optional) Whether the nova api service will be run Defaults to false

manage_service

(optional) Whether to start/stop the service Defaults to true

ensure_package

(optional) Whether the nova api package will be installed Defaults to ‘present’

auth_strategy

(DEPRECATED) Does nothing and will be removed in Icehouse Defaults to false

auth_host

(optional) The IP of the server running keystone Defaults to ‘127.0.0.1’

auth_port

(optional) The port to use when authenticating against Keystone Defaults to 35357

auth_protocol

(optional) The protocol to use when authenticating against Keystone Defaults to ‘http’

auth_uri

(optional) The uri of a Keystone service to authenticate against Defaults to false

auth_admin_prefix

(optional) Prefix to prepend at the beginning of the keystone path Defaults to false

auth_version

(optional) API version of the admin Identity API endpoint for example, use ‘v3.0’ for the keystone version 3.0 api Defaults to false

admin_tenant_name

(optional) The name of the tenant to create in keystone for use by the nova services Defaults to ‘services’

admin_user

(optional) The name of the user to create in keystone for use by the nova services Defaults to ‘nova’

api_bind_address

(optional) IP address for nova-api server to listen Defaults to ‘0.0.0.0’

metadata_listen

(optional) IP address for metadata server to listen Defaults to ‘0.0.0.0’

enabled_apis

(optional) A comma separated list of apis to enable Defaults to ‘ec2,osapi_compute,metadata’

keystone_ec2_url

(optional) The keystone url where nova should send requests for ec2tokens Defaults to false

volume_api_class

(optional) The name of the class that nova will use to access volumes. Cinder is the only option. Defaults to ‘nova.volume.cinder.API’

use_forwarded_for

(optional) Treat X-Forwarded-For as the canonical remote address. Only enable this if you have a sanitizing proxy. Defaults to false

osapi_compute_workers

(optional) Number of workers for OpenStack API service Defaults to $::processorcount

ec2_workers

(optional) Number of workers for EC2 service Defaults to $::processorcount

metadata_workers

(optional) Number of workers for metadata service Defaults to $::processorcount

conductor_workers

(optional) DEPRECATED. Use workers parameter of nova::conductor Class instead. Defaults to undef

sync_db

(optional) Run nova-manage db sync on api nodes after installing the package. Defaults to true

neutron_metadata_proxy_shared_secret

(optional) Shared secret to validate proxies Neutron metadata requests Defaults to undef

pci_alias

(optional) Pci passthrough for controller: Defaults to undef Example “[ ‘product_id’:‘5678’, ‘name’:‘default’, … ]”

ratelimits

(optional) A string that is a semicolon-separated list of 5-tuples. See docs.openstack.org/trunk/config-reference/content/configuring-compute-API.html Example: ‘(POST, “*”, .*, 10, MINUTE);(POST, “*/servers”, ^/servers, 50, DAY);(PUT, “*”, .*, 10, MINUTE)’ Defaults to undef

ratelimits_factory

(optional) The rate limiting factory to use Defaults to ‘nova.api.openstack.compute.limits:RateLimitingMiddleware.factory’

osapi_v3

(optional) Enable or not Nova API v3 Defaults to false

validate

(optional) Whether to validate the service is working after any service refreshes Defaults to false

validation_options

(optional) Service validation options Should be a hash of options defined in openstacklib::service_validation If empty, defaults values are taken from openstacklib function. Default command list nova flavors. Require validate set at True. Example: nova::api::validation_options:

nova-api:
  command: check_nova.py
  path: /usr/bin:/bin:/usr/sbin:/sbin
  provider: shell
  tries: 5
  try_sleep: 10

Defaults to {}

Parameters:

  • admin_password (Any)
  • enabled (Any) (defaults to: false)
  • manage_service (Any) (defaults to: true)
  • ensure_package (Any) (defaults to: 'present')
  • auth_strategy (Any) (defaults to: undef)
  • auth_host (Any) (defaults to: '127.0.0.1')
  • auth_port (Any) (defaults to: 35357)
  • auth_protocol (Any) (defaults to: 'http')
  • auth_uri (Any) (defaults to: false)
  • auth_admin_prefix (Any) (defaults to: false)
  • auth_version (Any) (defaults to: false)
  • admin_tenant_name (Any) (defaults to: 'services')
  • admin_user (Any) (defaults to: 'nova')
  • api_bind_address (Any) (defaults to: '0.0.0.0')
  • metadata_listen (Any) (defaults to: '0.0.0.0')
  • enabled_apis (Any) (defaults to: 'ec2,osapi_compute,metadata')
  • keystone_ec2_url (Any) (defaults to: false)
  • volume_api_class (Any) (defaults to: 'nova.volume.cinder.API')
  • use_forwarded_for (Any) (defaults to: false)
  • osapi_compute_workers (Any) (defaults to: $::processorcount)
  • ec2_workers (Any) (defaults to: $::processorcount)
  • metadata_workers (Any) (defaults to: $::processorcount)
  • sync_db (Any) (defaults to: true)
  • neutron_metadata_proxy_shared_secret (Any) (defaults to: undef)
  • osapi_v3 (Any) (defaults to: false)
  • pci_alias (Any) (defaults to: undef)
  • ratelimits (Any) (defaults to: undef)
  • ratelimits_factory (Any) (defaults to: 'nova.api.openstack.compute.limits:RateLimitingMiddleware.factory')
  • validate (Any) (defaults to: false)
  • validation_options (Any) (defaults to: {})
  • workers (Any) (defaults to: undef)
  • conductor_workers (Any) (defaults to: undef) 


149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
 
# File 'manifests/api.pp', line 149

class nova::api(
  $admin_password,
  $enabled               = false,
  $manage_service        = true,
  $ensure_package        = 'present',
  $auth_strategy         = undef,
  $auth_host             = '127.0.0.1',
  $auth_port             = 35357,
  $auth_protocol         = 'http',
  $auth_uri              = false,
  $auth_admin_prefix     = false,
  $auth_version          = false,
  $admin_tenant_name     = 'services',
  $admin_user            = 'nova',
  $api_bind_address      = '0.0.0.0',
  $metadata_listen       = '0.0.0.0',
  $enabled_apis          = 'ec2,osapi_compute,metadata',
  $keystone_ec2_url      = false,
  $volume_api_class      = 'nova.volume.cinder.API',
  $use_forwarded_for     = false,
  $osapi_compute_workers = $::processorcount,
  $ec2_workers           = $::processorcount,
  $metadata_workers      = $::processorcount,
  $sync_db               = true,
  $neutron_metadata_proxy_shared_secret = undef,
  $osapi_v3              = false,
  $pci_alias             = undef,
  $ratelimits            = undef,
  $ratelimits_factory    =
    'nova.api.openstack.compute.limits:RateLimitingMiddleware.factory',
  $validate              = false,
  $validation_options    = {},
  # DEPRECATED PARAMETER
  $workers               = undef,
  $conductor_workers     = undef,
) {

  include nova::db
  include nova::params
  include nova::policy
  require keystone::python
  include cinder::client

  Package<| title == 'nova-api' |> -> Nova_paste_api_ini<| |>

  Package<| title == 'nova-common' |> -> Class['nova::api']
  Package<| title == 'nova-common' |> -> Class['nova::policy']

  Nova_paste_api_ini<| |> ~> Exec['post-nova_config']

  Nova_paste_api_ini<| |> ~> Service['nova-api']
  Class['nova::policy'] ~> Service['nova-api']

  if $auth_strategy {
    warning('The auth_strategy parameter is deprecated and has no effect.')
  }

  if $workers {
    warning('The workers parameter is deprecated, use osapi_compute_workers instead.')
    $osapi_compute_workers_real = $workers
  } else {
    $osapi_compute_workers_real = $osapi_compute_workers
  }

  if $conductor_workers {
    warning('The conductor_workers parameter is deprecated and has no effect. Use workers parameter of nova::conductor class instead.')
  }

  nova::generic_service { 'api':
    enabled        => $enabled,
    manage_service => $manage_service,
    ensure_package => $ensure_package,
    package_name   => $::nova::params::api_package_name,
    service_name   => $::nova::params::api_service_name,
    subscribe      => Class['cinder::client'],
  }

  nova_config {
    'DEFAULT/enabled_apis':          value => $enabled_apis;
    'DEFAULT/volume_api_class':      value => $volume_api_class;
    'DEFAULT/ec2_listen':            value => $api_bind_address;
    'DEFAULT/osapi_compute_listen':  value => $api_bind_address;
    'DEFAULT/metadata_listen':       value => $metadata_listen;
    'DEFAULT/osapi_volume_listen':   value => $api_bind_address;
    'DEFAULT/osapi_compute_workers': value => $osapi_compute_workers_real;
    'DEFAULT/ec2_workers':           value => $ec2_workers;
    'DEFAULT/metadata_workers':      value => $metadata_workers;
    'DEFAULT/use_forwarded_for':     value => $use_forwarded_for;
    'osapi_v3/enabled':              value => $osapi_v3;
  }

  if ($neutron_metadata_proxy_shared_secret){
    nova_config {
      'neutron/service_metadata_proxy': value => true;
      'neutron/metadata_proxy_shared_secret':
        value => $neutron_metadata_proxy_shared_secret;
    }
  } else {
    nova_config {
      'neutron/service_metadata_proxy':       value  => false;
      'neutron/metadata_proxy_shared_secret': ensure => absent;
    }
  }

  if $auth_uri {
    $auth_uri_real = $auth_uri
  } else {
    $auth_uri_real = "${auth_protocol}://${auth_host}:5000/"
  }
  nova_config { 'keystone_authtoken/auth_uri': value => $auth_uri_real; }

  if $auth_version {
    nova_config { 'keystone_authtoken/auth_version': value => $auth_version; }
  } else {
    nova_config { 'keystone_authtoken/auth_version': ensure => absent; }
  }

  nova_config {
    'keystone_authtoken/auth_host':         value => $auth_host;
    'keystone_authtoken/auth_port':         value => $auth_port;
    'keystone_authtoken/auth_protocol':     value => $auth_protocol;
    'keystone_authtoken/admin_tenant_name': value => $admin_tenant_name;
    'keystone_authtoken/admin_user':        value => $admin_user;
    'keystone_authtoken/admin_password':    value => $admin_password, secret => true;
  }

  if $auth_admin_prefix {
    validate_re($auth_admin_prefix, '^(/.+[^/])?$')
    nova_config {
      'keystone_authtoken/auth_admin_prefix': value => $auth_admin_prefix;
    }
  } else {
    nova_config {
      'keystone_authtoken/auth_admin_prefix': ensure => absent;
    }
  }

  if $keystone_ec2_url {
    nova_config {
      'DEFAULT/keystone_ec2_url': value => $keystone_ec2_url;
    }
  } else {
    nova_config {
      'DEFAULT/keystone_ec2_url': ensure => absent;
    }
  }

  if 'occiapi' in $enabled_apis {
    if !defined(Package['python-pip']) {
      package { 'python-pip':
        ensure => latest,
      }
    }
    if !defined(Package['pyssf']) {
      package { 'pyssf':
        ensure   => latest,
        provider => pip,
        require  => Package['python-pip']
      }
    }
    package { 'openstackocci':
      ensure   => latest,
      provider => 'pip',
      require  => Package['python-pip'],
    }
  }

  if ($ratelimits != undef) {
    nova_paste_api_ini {
      'filter:ratelimit/paste.filter_factory': value => $ratelimits_factory;
      'filter:ratelimit/limits':               value => $ratelimits;
    }
  }

  # Added arg and if statement prevents this from being run
  # where db is not active i.e. the compute
  if $sync_db {
    Package<| title == 'nova-api' |> -> Exec['nova-db-sync']
    exec { 'nova-db-sync':
      command     => '/usr/bin/nova-manage db sync',
      refreshonly => true,
      subscribe   => Exec['post-nova_config'],
    }
  }

  # Remove auth configuration from api-paste.ini
  nova_paste_api_ini {
    'filter:authtoken/auth_uri':          ensure => absent;
    'filter:authtoken/auth_host':         ensure => absent;
    'filter:authtoken/auth_port':         ensure => absent;
    'filter:authtoken/auth_protocol':     ensure => absent;
    'filter:authtoken/admin_tenant_name': ensure => absent;
    'filter:authtoken/admin_user':        ensure => absent;
    'filter:authtoken/admin_password':    ensure => absent;
    'filter:authtoken/auth_admin_prefix': ensure => absent;
  }

  if $pci_alias {
    nova_config {
      'DEFAULT/pci_alias': value => check_array_of_hash($pci_alias);
    }
  }

  if $validate {
    $defaults = {
      'nova-api' => {
        'command'  => "nova --os-auth-url ${auth_uri_real} --os-tenant-name ${admin_tenant_name} --os-username ${admin_user} --os-password ${admin_password} flavor-list",
      }
    }
    $validation_options_hash = merge ($defaults, $validation_options)
    create_resources('openstacklib::service_validation', $validation_options_hash, {'subscribe' => 'Service[nova-api]'})
  }
}