node.yaml

heat_template_version: 2016-10-14


description: >
  OpenShift Node


parameters:

  # What version of OpenShift Container Platform to install
  # This value is used to select the RPM repo for the OCP release to install
  ocp_version:
    type: string
    description: >
      The version of OpenShift Container Platform to deploy

  key_name:
    description: >
      A pre-submitted SSH key to access the VM hosts
    type: string

  image:
    description: >
      Select a base image to use for the bastion server
    type: string

  flavor:
    description: >
      Define the hardware characteristics for the VMs: CPU, Memory, base disk
    type: string

  fixed_network:
    description: >
      The name or ID of the admin and public network
    type: string

  fixed_subnet:
    description: >
      The name or ID of the admin and public IPv4 space
    type: string

  internal_network:
    description: >
      The name or ID of the internal network
    type: string

  internal_subnet:
    description: >
      The name or ID of the internal IPv4 space
    type: string

  security_group:
    description: >
      ID of the network access policies for the OpenShift node hosts
    type: string

  docker_volume_size:
    description: >
      size of a cinder volume in GB to allocate to docker for container/image
      storage
    type: number
    default: 25

  rhn_username:
    description: >
      A valid user with entitlements to RHEL and OpenShift software repos
    type: string

  rhn_password:
    description: >
      The password for the RHN user
    type: string
    hidden: true

  # Red Hat satellite subscription parameters
  sat6_hostname:
    type: string
    description: >
      The hostname of the Satellite 6 server which will provide software updates
    default: ''

  sat6_organization:
    type: string
    description: >
      An organization string provided by Sat6 to group subscriptions
    default: ''

  sat6_activationkey:
    type: string
    description: >
      An activation key string provided by Sat6 to enable subscriptions

  rhn_pool:
    description: >
      A subscription pool containing the RHEL and OpenShift software repos
      OPTIONAL
    type: string
    hidden: true

  extra_rhn_pools:
    type: comma_delimited_list
    description: >
      The extra pools to attach.
    default: ''

  hostname:
    description: >
      A string to identify node hostnames.  Each node will also have a
      unique random substring attached
    type: string

  domain_name:
    description: >
      The DNS domain suffix. All VMs will be placed in this domain
    type: string

  app_subdomain:
    type: string
    description: >
      Default subdomain to use for exposed routes.
    default: ''

  ansible_public_key:
    description: >
      The SSH public key that Ansible will use to access master and node hosts
      This will be placed on each VM host in /root/.ssh/authorized_keys
    type: string

  ssh_user:
    description: >
      The user for SSH access to the VM hosts
    type: string

  all_master_nodes:
    description: >
      A list of all the master host replicas
    type: string
    default: ''

  all_infra_nodes:
    description: >
      A list of all the infra host replicas
    type: string
    default: ''

  bastion_node:
    description:
      A reference to the bastion VM resource
    type: string
    default: ''

  timeout:
    description: Time to wait until the node is ready.
    type: number
    default: 4000

  metadata:
    description: >
      A reference to the OpenStack stack id
    type: json

  system_update:
    type: boolean

  extra_repository_urls:
    type: comma_delimited_list
    description: List of repository URLs which will be installed on each node.
    default: ''

  extra_docker_repository_urls:
    type: comma_delimited_list
    description: List of docker repository URLs which will be installed on each node, if a repo is insecure use '#insecure' suffix.
    default: ''

  container_quota:
    type: number
    description: Quota for container in GB
    default: 0

  deployment_type:
    description: >
      Select the community or enterprise version of OpenShift
    type: string

  # Load Balancer
  lb_ip:
    description: >
      The IP address of the load balancer feeding the OpenShift master traffic
    type: string
    default: ''

  master_ip:
    description: >
      The IP address of the first master node (used instead of external LB during setup)
    type: string
    default: ''

  lb_hostname:
    description: >
      The hostname of the load balancer feeding the OpenShift master traffic
    type: string
    default: ''

  loadbalancer_type:
    type: string

  ldap_url:
    description: >
      The LDAP url for access to the LDAP service (redundant? ML)
    type: string
    default: ''

  ldap_preferred_username:
    description: >
      What field to use to look up and identify users in the database
    type: string
    default: 'uid'

  ldap_bind_dn:
    description: >
      LDAP service access user identifier
    type: string
    default: ''

  ldap_bind_password:
    description: >
      LDAP service access password
    type: string
    default: ''

  ldap_ca:
    description: >
      The Certificate Authority file to confirm SSL encryption security
    type: string
    default: ''

  ldap_insecure:
    description: >
      Toggle SSL encryption for LDAP communications
    type: string
    default: false

  openshift_sdn:
    description: >
      Enable and select the container communications network: OVS or Flannel
    type: string

  deploy_registry:
    description: >
      True = Enable automatic provisioning of the Docker registry
    type: boolean

  registry_volume_size:
    description: >
      Size of the Openshift registry persistent volume
    type: number
    default: 5

  registry_volume_id:
    description: >
      Volume to use by the Openshift registry
    type: string
    default: ''

  registry_volume_fs:
    description: >
      Filesystem to use for Openshift registry persistent volume
    type: string
    default: xfs

  prepare_registry:
    type: boolean
    description: If the registry volume should be formatted during deployment.
    default: false

  deploy_router:
    description: >
      True = Enable deployment of the OpenShift router
    type: boolean

  # OpenShift configuration: ansible controls
  # These are for debugging.
  #   Setting prepare_ansible=false will stop the stack before creating
  #   installation config files
  prepare_ansible:
    type: boolean
    description: >
      Create ansible configuration files for openshift-ansible playbooks
    default: true

  #   Setting execute_ansible=false will stop the stack before running
  #   the ansible playbooks to install openshift, but *after* the configuration
  #   files are generated
  execute_ansible:
    type: boolean
    description: >
      Run the ansible playbooks to install openshift
    default: true

  # OpenStack access parameters
  # These allow the OpenShift service to view and use OpenStack resources
  os_auth_url:
    description: >
      The location of the OpenStack Keystone service
    type: string

  os_username:
    description: >
      The OpenStack user that OpenShift will use to access resources
    type: string

  os_password:
    description: >
      The secret part of the OpenStack user credentials
    type: string
    hidden: true

  os_tenant_name:
    description: >
      The name of the OpenStack project or "tenant" for OpenShift to use
    type: string

  os_domain_name:
    description: >
      The name of the OpenStack domain for OpenShift to use. Leave it
      empty for v2 authentication.
    type: string
    default: ''

  os_region_name:
    description: >
      The name of the OpenStack "region" to use to create or find resources
    type: string

  dns_servers:
    type: comma_delimited_list
    description: address of dns nameservers reachable in your environment

  dns_update_key:
    type: string
    hidden: true

  router_vip:
    description: >
      The Openshift Router Virtual IP
    type: string

  volume_quota:
    type: number
    description: Quota for emptyDir volumes in GBi

  extra_openshift_ansible_params:
    type: string
    description: Extra parameters for openshift-ansible

  autoscaling:
    type: boolean
    description: >
      Automatically scale up/down openshift nodes.
    default: false

  ca_cert:
    type: string
    description: Certificate Authority Certificate to be added to trust chain

resources:

  # Generate a string to distinguish one node from the others
  random_hostname_suffix:
    type: OS::Heat::RandomString
    properties:
      character_classes: [{"class": lowercase}, {"class": digits}]
      length: 8

  # Create the VM to house the OpenShift node
  host:
    type: OS::Nova::Server
    properties:
      name:
        str_replace:
          template: "HOST-SUFFIX.DOMAIN"
          params:
            HOST: {get_param: hostname}
            SUFFIX: {get_attr: [random_hostname_suffix, value]}
            DOMAIN: {get_param: domain_name}
      admin_user: {get_param: ssh_user}
      image: {get_param: image}
      flavor: {get_param: flavor}
      key_name: {get_param: key_name}
      networks:
      - port: {get_resource: port}
      - port: {get_attr: [internal_port, port]}
      user_data_format: SOFTWARE_CONFIG
      user_data_update_policy: IGNORE
      user_data: {get_resource: init}
      metadata: {get_param: metadata}

  # Create an external volume to contain the Docker containers and images
  docker_volume:
    type: OOShift::DockerVolume
    properties:
      size: {get_param: docker_volume_size}

  docker_volume_attachment:
    type: OOShift::DockerVolumeAttachment
    properties:
      volume_uuid: {get_attr: [docker_volume, volume_id]}
      instance_uuid: {get_resource: host}

  # Collect the node configuration information in one structure
  init:
    type: OS::Heat::MultipartMime
    properties:
      parts:
      - config: {get_resource: set_hostname}
      - config: {get_resource: included_files}
      - config: {get_resource: update_ca_cert}
      - config: {get_resource: rhn_register}
      - config: {get_resource: set_extra_repos}
      - config: {get_resource: set_extra_docker_repos}
      - config: {get_resource: host_update}
      - config: {get_resource: add_dns_record}
      - config: {get_resource: node_boot}

  # Compose the node identifiers: hostname and FQDN: provide them to cloud-init
  set_hostname:
    type: OS::Heat::CloudConfig
    properties:
      cloud_config:
        hostname:
          str_replace:
            template: "HOST-SUFFIX"
            params:
              HOST: {get_param: hostname}
              SUFFIX: {get_attr: [random_hostname_suffix, value]}
        fqdn:
          str_replace:
            template: "HOST-SUFFIX.DOMAIN"
            params:
              HOST: {get_param: hostname}
              SUFFIX: {get_attr: [random_hostname_suffix, value]}
              DOMAIN: {get_param: domain_name}

  # A set of files to place on the node VM on creation
  included_files:
    type: OS::Heat::CloudConfig
    properties:
      cloud_config:
        write_files:
        - path: /usr/local/share/openshift-on-openstack/common_functions.sh
          permissions: 0755
          content:
            str_replace:
              params:
                $WC_NOTIFY: { get_attr: ['wait_handle', 'curl_cli'] }
              template: {get_file: fragments/common_functions.sh}
        - path: /usr/local/share/openshift-on-openstack/common_openshift_functions.sh
          permissions: 0755
          content: {get_file: fragments/common_openshift_functions.sh}
        - path: /usr/local/bin/retry
          permissions: 0755
          content: {get_file: fragments/retry.sh}
        - path: /usr/local/bin/update_dns
          permissions: 0755
          content: {get_file: fragments/update_dns.py}
        - path: /etc/sysconfig/network-scripts/ifcfg-eth1
          content:
            str_replace:
              params:
                $IFNAME: eth1
              template: {get_file: fragments/ifcfg-eth}
        - path: /etc/pki/ca-trust/source/anchors/ca.crt
          permissions: 0600
          content: {get_param: ca_cert}
        ssh_authorized_keys:
        - {get_param: ansible_public_key}

  # Add CA Cert to trust chain
  update_ca_cert:
    type: OS::Heat::SoftwareConfig
    properties:
      config:
        str_replace:
          params:
            $CA_CERT: {get_param: ca_cert}
          template: {get_file: fragments/ca_cert.sh}

  # Connect to software update source for RHEL
  rhn_register:
    type: OS::Heat::SoftwareConfig
    properties:
      config:
        str_replace:
          params:
            $OCP_VERSION: {get_param: ocp_version}
            $RHN_USERNAME: {get_param: rhn_username}
            $RHN_PASSWORD: {get_param: rhn_password}
            $SAT6_HOSTNAME: {get_param: sat6_hostname}
            $SAT6_ORGANIZATION: {get_param: sat6_organization}
            $SAT6_ACTIVATIONKEY: {get_param: sat6_activationkey}
            $POOL_ID: {get_param: rhn_pool}
            $EXTRA_POOL_IDS:
              list_join:
                - " --pool="
                - {get_param: extra_rhn_pools}
          template: {get_file: fragments/rhn-register.sh}

  # Enable any extra repositories
  set_extra_repos:
    type: OS::Heat::SoftwareConfig
    properties:
      config:
        str_replace:
          params:
            $REPOLIST:
              list_join:
                - " "
                - {get_param: extra_repository_urls}
          template: {get_file: fragments/set-extra-repos.sh}

  set_extra_docker_repos:
    type: OS::Heat::SoftwareConfig
    properties:
      config:
        str_replace:
          params:
            $REPOLIST:
              list_join:
                - " "
                - {get_param: extra_docker_repository_urls}
          template: {get_file: fragments/set-extra-docker-repos.sh}

  # Insure that the node VM has current software installed
  host_update:
    type: OS::Heat::SoftwareConfig
    properties:
      config:
        str_replace:
          params:
            $SYSTEM_UPDATE: {get_param: system_update}
          template: {get_file: fragments/host-update.sh}

  add_dns_record:
    type: OS::Heat::SoftwareConfig
    properties:
      config:
        str_replace:
          params:
            '%ZONE%': {get_param: domain_name}
            '%DNS_SERVER%': {get_param: [dns_servers, 0]}
            '%DNS_UPDATE_KEY%': {get_param: dns_update_key}
            '%IP_ADDRESS%': {get_attr: [port, fixed_ips, 0, ip_address]}
          template: {get_file: fragments/add_dns_record.sh}


  # Prepare the node to run Docker and Ansible on first boot
  node_boot:
    type: OS::Heat::SoftwareConfig
    properties:
      config:
        str_replace:
          params:
            $DOCKER_VOLUME_ID: {get_attr: [docker_volume, volume_id]}
            $CONTAINER_QUOTA: {get_param: container_quota}
          template: {get_file: fragments/node-boot.sh}

  # Create a network connection on the fixed network and apply security
  port:
    type: OS::Neutron::Port
    properties:
      security_groups:
      - {get_param: security_group}
      network: {get_param: fixed_network}
      fixed_ips:
      - subnet: {get_param: fixed_subnet}
      replacement_policy: AUTO

  # Create a network connection on the internal communications network
  internal_port:
    type: OOShift::ContainerPort
    properties:
      security_group: {get_param: security_group}
      network: {get_param: internal_network}
      subnet: {get_param: internal_subnet}

  node_cleanup:
    type: OS::Heat::SoftwareConfig
    properties:
      group: script
      inputs:
      - name: node_name
      - name: node_type
      - name: ssh_user
        default: {get_param: ssh_user}
      outputs:
      - name: result
      config: {get_file: fragments/bastion-node-cleanup.sh}

  # activation hook for removing the node from DNS and from the Kubernetes
  # cluster
  deployment_bastion_node_cleanup:
    depends_on: [host, wait_condition]
    type: OS::Heat::SoftwareDeployment
    properties:
      actions: ['DELETE']
      input_values:
        node_type: node
        node_name:
          str_replace:
            template: "HOST-SUFFIX.DOMAIN"
            params:
              HOST: {get_param: hostname}
              SUFFIX: {get_attr: [random_hostname_suffix, value]}
              DOMAIN: {get_param: domain_name}
      config:
        get_resource: node_cleanup
      server:
        get_param: bastion_node

  # Add a node's IP/Name mapping to DNS
  node_add:
    type: OS::Heat::SoftwareConfig
    properties:
      group: script
      inputs:
      - name: node_hostname
      - name: node_type
      outputs:
      - name: result
      config: {get_file: fragments/bastion-node-add.sh}

  # activation hook to add the node to DNS and Kubernetes cluster
  deployment_bastion_node_add:
    depends_on: wait_condition
    type: OS::Heat::SoftwareDeployment
    properties:
      config:
        get_resource: node_add
      server:
        get_param: bastion_node
      input_values:
        node_type: node
        node_hostname:
          str_replace:
            template: "HOST-SUFFIX.DOMAIN"
            params:
              HOST: {get_param: hostname}
              SUFFIX: {get_attr: [random_hostname_suffix, value]}
              DOMAIN: {get_param: domain_name}

  # Execute the ansible playbook(s) on the bastion server to configure the
  # openshift hosts and services
  run_ansible:
    type: OS::Heat::SoftwareConfig
    properties:
      group: script
      inputs:
        - name: node_hostname
        - name: all_master_nodes
        - name: all_infra_nodes
        - name: domainname
          default: {get_param: domain_name}
        - name: app_subdomain
          default: {get_param: app_subdomain}
        - name: ssh_user
          default: {get_param: ssh_user}
        - name: deployment_type
          default: {get_param: deployment_type}
        - name: lb_ip
          default: {get_param: lb_ip}
        - name: master_ip
          default: {get_param: master_ip}
        - name: lb_hostname
          default: {get_param: lb_hostname}
        - name: ldap_url
          default: {get_param: ldap_url}
        - name: ldap_preferred_username
          default: {get_param: ldap_preferred_username}
        - name: ldap_bind_dn
          default: {get_param: ldap_bind_dn}
        - name: ldap_bind_password
          default: {get_param: ldap_bind_password}
        - name: ldap_ca
          default: {get_param: ldap_ca}
        - name: ldap_insecure
          default: {get_param: ldap_insecure}
        - name: openshift_sdn
          default: {get_param: openshift_sdn}
        - name: deploy_registry
          default: {get_param: deploy_registry}
        - name: registry_volume_size
          default: {get_param: registry_volume_size}
        - name: registry_volume_id
          default: {get_param: registry_volume_id}
        - name: registry_volume_fs
          default: {get_param: registry_volume_fs}
        - name: prepare_registry
          default: {get_param: prepare_registry}
        - name: deploy_router
          default: {get_param: deploy_router}
        - name: prepare_ansible
          default: {get_param: prepare_ansible}
        - name: execute_ansible
          default: {get_param: execute_ansible}
        - name: os_auth_url
          default: {get_param: os_auth_url}
        - name: os_username
          default: {get_param: os_username}
        - name: os_password
          default: {get_param: os_password}
        - name: os_tenant_name
          default: {get_param: os_tenant_name}
        - name: os_domain_name
          default: {get_param: os_domain_name}
        - name: os_region_name
          default: {get_param: os_region_name}
        - name: lb_type
          default: {get_param: loadbalancer_type}
        - name: dns_forwarders
          default:
            list_join:
              - ","
              - {get_param: dns_servers}
        - name: bastion_instance_id
          default: {get_param: bastion_node}
        - name: router_vip
          default: {get_param: router_vip}
        - name: volume_quota
          default: {get_param: volume_quota}
        - name: extra_openshift_ansible_params
          default: {get_param: extra_openshift_ansible_params}
        - name: autoscaling
          default: {get_param: autoscaling}
      outputs:
        - name: ca_cert
        - name: ca_key
      config:
        get_file: fragments/bastion-ansible.sh

  # activation hook to run the ansible playbooks to install and config a node
  deployment_run_ansible:
    depends_on: [wait_condition, deployment_bastion_node_add]
    type: OS::Heat::SoftwareDeployment
    properties:
      config:
        get_resource: run_ansible
      server:
        get_param: bastion_node
      input_values:
        node_hostname:
          str_replace:
            template: "HOST-SUFFIX.DOMAIN"
            params:
              HOST: {get_param: hostname}
              SUFFIX: {get_attr: [random_hostname_suffix, value]}
              DOMAIN: {get_param: domain_name}
        all_master_nodes: {get_param: all_master_nodes}
        all_infra_nodes: {get_param: all_infra_nodes}

  # Wait for the node_boot (cloud-init) process to complete or time out
  wait_condition:
    type: OS::Heat::WaitCondition
    properties:
      handle: {get_resource: wait_handle}
      timeout: {get_param: timeout}

  # Provide a curl CLI command to the cloud-init script.  Called on completion
  # to indicate the status of the cloud-init process
  wait_handle:
    type: OS::Heat::WaitConditionHandle

outputs:
  hostname:
    description: Hostname of this OpenShift node
    value:
      str_replace:
        template: "HOST-SUFFIX.DOMAIN"
        params:
          HOST: {get_param: hostname}
          SUFFIX: {get_attr: [random_hostname_suffix, value]}
          DOMAIN: {get_param: domain_name}
  ansible_entry:
    description: Ansible inventory line for this OpenShift node
    value:
      str_replace:
        template: "HOST-SUFFIX.DOMAIN openshift_hostname=HOST-SUFFIX.DOMAIN openshift_public_hostname=HOST-SUFFIX.DOMAIN"
        params:
          HOST: {get_param: hostname}
          SUFFIX: {get_attr: [random_hostname_suffix, value]}
          DOMAIN: {get_param: domain_name}
  ip_address:
    description: IP address of the node
    value: {get_attr: [host, networks, {get_param: fixed_network}, 0]}
  wc_data:
    description: The completion status from the cloud-init sync condition
    value: {get_attr: ['wait_condition', 'data']}
  ca_cert:
    description: SSL CA signing certificate
    value: {get_attr: [deployment_run_ansible, ca_cert]}
  ca_key:
    description: SSL CA signing key
    value: {get_attr: [deployment_run_ansible, ca_key]}